Merge e2fcd5dbee into aa0aecbd80

If thread 1 is executing kasan_unpoison but a scheduling occurs and the block is trampled upon, the displayed backtracking may still be from the previously allocated backtracking

Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>

drivers/input/Kconfig

@@ -65,7 +65,7 @@ endif # FF_AW86225
 endif # INPUT_FF
 
 config INPUT_MOUSE
-	bool
+	bool "Enable mouse support"
 	default n
 	---help---
 		Enable support for mouse devices.
@@ -82,11 +82,11 @@ config INPUT_MOUSE_WHEEL
 endif # INPUT_MOUSE
 
 config INPUT_TOUCHSCREEN
-	bool
+	bool "Enable touchscreen support"
 	default n
 
 config INPUT_KEYBOARD
-	bool
+	bool "Enable keyboard support"
 	default n
 
 config INPUT_UINPUT

drivers/input/mouse_upper.c

@@ -68,6 +68,8 @@ static int     mouse_open(FAR struct file *filep);
 static int     mouse_close(FAR struct file *filep);
 static ssize_t mouse_read(FAR struct file *filep, FAR char *buffer,
                           size_t buflen);
+static int     mouse_ioctl(FAR struct file *filep, int cmd,
+                           unsigned long arg);
 static int     mouse_poll(FAR struct file *filep, FAR struct pollfd *fds,
                           bool setup);
 
@@ -82,7 +84,7 @@ static const struct file_operations g_mouse_fops =
   mouse_read,     /* read */
   NULL,           /* write */
   NULL,           /* seek */
-  NULL,           /* ioctl */
+  mouse_ioctl,    /* ioctl */
   NULL,           /* mmap */
   NULL,           /* truncate */
   mouse_poll      /* poll */
@@ -101,6 +103,7 @@ static int mouse_open(FAR struct file *filep)
   FAR struct mouse_openpriv_s  *openpriv;
   FAR struct inode             *inode = filep->f_inode;
   FAR struct mouse_upperhalf_s *upper = inode->i_private;
+  FAR struct mouse_lowerhalf_s *lower = upper->lower;
   int ret;
 
   ret = nxmutex_lock(&upper->lock);
@@ -129,6 +132,11 @@ static int mouse_open(FAR struct file *filep)
   nxmutex_init(&openpriv->lock);
   list_add_tail(&upper->head, &openpriv->node);
 
+  if (lower->open && list_is_singular(&openpriv->node))
+    {
+      ret = lower->open(lower);
+    }
+
   /* Save the buffer node pointer so that it can be used directly
    * in the read operation.
    */
@@ -147,6 +155,7 @@ static int mouse_close(FAR struct file *filep)
   FAR struct mouse_openpriv_s  *openpriv = filep->f_priv;
   FAR struct inode             *inode    = filep->f_inode;
   FAR struct mouse_upperhalf_s *upper    = inode->i_private;
+  FAR struct mouse_lowerhalf_s *lower    = upper->lower;
   int ret;
 
   ret = nxmutex_lock(&upper->lock);
@@ -155,6 +164,11 @@ static int mouse_close(FAR struct file *filep)
       return ret;
     }
 
+  if (lower->close && list_is_singular(&openpriv->node))
+    {
+      ret = lower->close(lower);
+    }
+
   list_delete(&openpriv->node);
   circbuf_uninit(&openpriv->circbuf);
   nxsem_destroy(&openpriv->waitsem);
@@ -217,6 +231,36 @@ out:
   return ret;
 }
 
+/****************************************************************************
+ * Name: mouse_ioctl
+ ****************************************************************************/
+
+static int mouse_ioctl(FAR struct file *filep, int cmd, unsigned long arg)
+{
+  FAR struct inode             *inode = filep->f_inode;
+  FAR struct mouse_upperhalf_s *upper = inode->i_private;
+  FAR struct mouse_lowerhalf_s *lower = upper->lower;
+  int ret;
+
+  ret = nxmutex_lock(&upper->lock);
+  if (ret < 0)
+    {
+      return ret;
+    }
+
+  if (lower->control)
+    {
+      ret = lower->control(lower, cmd, arg);
+    }
+  else
+    {
+      ret = -ENOTTY;
+    }
+
+  nxmutex_unlock(&upper->lock);
+  return ret;
+}
+
 /****************************************************************************
  * Name: mouse_poll
  ****************************************************************************/

drivers/misc/rpmsgdev.c

@@ -45,6 +45,7 @@
 #include <nuttx/net/ioctl.h>
 #include <nuttx/drivers/rpmsgdev.h>
 #include <nuttx/power/battery_ioctl.h>
+#include <nuttx/input/mouse.h>
 
 #include "rpmsgdev.h"
 
@@ -103,7 +104,7 @@ static ssize_t rpmsgdev_write(FAR struct file *filep, FAR const char *buffer,
                               size_t buflen);
 static off_t   rpmsgdev_seek(FAR struct file *filep, off_t offset,
                              int whence);
-static ssize_t rpmsgdev_ioctl_arglen(int cmd);
+static ssize_t rpmsgdev_ioctl_arglen(int cmd, unsigned long arg);
 static int     rpmsgdev_ioctl(FAR struct file *filep, int cmd,
                               unsigned long arg);
 static int     rpmsgdev_poll(FAR struct file *filep, FAR struct pollfd *fds,
@@ -591,6 +592,7 @@ static off_t rpmsgdev_seek(FAR struct file *filep, off_t offset, int whence)
  *
  * Parameters:
  *   cmd - the ioctl command
+ *   arg - the ioctl arguments
  *
  * Returned Values:
  *   0        - ioctl command not support
@@ -598,7 +600,7 @@ static off_t rpmsgdev_seek(FAR struct file *filep, off_t offset, int whence)
  *
  ****************************************************************************/
 
-static ssize_t rpmsgdev_ioctl_arglen(int cmd)
+static ssize_t rpmsgdev_ioctl_arglen(int cmd, unsigned long arg)
 {
   switch (cmd)
     {
@@ -622,6 +624,9 @@ static ssize_t rpmsgdev_ioctl_arglen(int cmd)
       case BATIOC_GET_PROTOCOL:
       case BATIOC_OPERATE:
         return sizeof(struct batio_operate_msg_s);
+      case MSIOC_VENDOR:
+        return sizeof(struct mouse_vendor_cmd_s) +
+               ((FAR struct mouse_vendor_cmd_s *)(uintptr_t)arg)->len;
       default:
         return -ENOTTY;
     }
@@ -661,7 +666,7 @@ static int rpmsgdev_ioctl(FAR struct file *filep, int cmd, unsigned long arg)
 
   /* Call our internal routine to perform the ioctl */
 
-  arglen = rpmsgdev_ioctl_arglen(cmd);
+  arglen = rpmsgdev_ioctl_arglen(cmd, arg);
   if (arglen < 0)
     {
       return arglen;

include/nuttx/fs/ioctl.h

@@ -108,6 +108,7 @@
 #define _PINCTRLBASE    (0x4000) /* Pinctrl driver ioctl commands */
 #define _PCIBASE        (0x4100) /* Pci ioctl commands */
 #define _I3CBASE        (0x4200) /* I3C driver ioctl commands */
+#define _MSIOCBASE      (0x4300) /* Mouse ioctl commands */
 #define _WLIOCBASE      (0x8b00) /* Wireless modules ioctl network commands */
 
 /* boardctl() commands share the same number space */
@@ -370,6 +371,11 @@
 #define _TSIOCVALID(c)    (_IOC_TYPE(c)==_TSIOCBASE)
 #define _TSIOC(nr)        _IOC(_TSIOCBASE,nr)
 
+/* NuttX mouse ioctl definitions (see nuttx/input/mouse.h) ******************/
+
+#define _MSIOCVALID(c)    (_IOC_TYPE(c)==_MSIOCBASE)
+#define _MSIOC(nr)        _IOC(_MSIOCBASE,nr)
+
 /* NuttX sensor ioctl definitions (see nuttx/sensor/ioctl.h) ****************/
 
 #define _SNIOCVALID(c)    (_IOC_TYPE(c)==_SNIOCBASE)

include/nuttx/input/mouse.h

@@ -37,6 +37,7 @@
  ****************************************************************************/
 
 #include <nuttx/config.h>
+#include <nuttx/fs/ioctl.h>
 
 /****************************************************************************
  * Pre-processor Definitions
@@ -50,6 +51,54 @@
 #define MOUSE_BUTTON_2       (1 << 1) /* True: Right mouse button pressed */
 #define MOUSE_BUTTON_3       (1 << 2) /* True: Middle mouse button pressed */
 
+/* IOCTL Commands ***********************************************************/
+
+/* Common mouse IOCTL commands */
+
+#define MSIOC_VENDOR         _MSIOC(0x0001)  /* Vendor-specific commands */
+
+#define MSC_FIRST            0x0001          /* First common command */
+#define MSC_NCMDS            1               /* One common commands */
+
+/* Vendor-specific command structure
+ *
+ * This structure is used to pass vendor-specific commands to the mouse
+ * driver.  The vendor-specific command is identified by the 'cmd' field
+ * and the length of the data is specified by the 'len' field.  The
+ * data follows the structure in a contiguous block of memory.
+ *
+ * The vendor-specific command is defined by the vendor and is not
+ * standardized.  The data format and meaning is defined by the vendor.
+ *
+ * The usage is as follows :
+ *
+ *   struct mse_vendor_data_s
+ *   {
+ *     uint16_t cmd;
+ *     uint16_t len;
+ *     uint16_t data;
+ *     ... ... ...
+ *   };
+ *
+ *   struct mse_vendor_data_s cmd_data;
+ *   cmd_data.cmd = VENDOR_CMD_ID;
+ *   cmd_data.data = 12;
+ *
+ *   struct mouse_vendor_cmd_s *ioctl;
+ *   ioctl = malloc(sizeof(*ioctl) + sizeof(struct mse_vendor_data_s));
+ *   ioctl->len = sizeof(struct mse_vendor_data_s);
+ *   memcpy(ioctl->data, &cmd_data, sizeof(struct mse_vendor_data_s));
+ *
+ *   ioctl(file, MSIOC_VENDOR, ioctl);
+ *
+ */
+
+struct mouse_vendor_cmd_s
+{
+  size_t len;
+  char data[1];
+};
+
 /****************************************************************************
  * Public Types
  ****************************************************************************/
@@ -75,6 +124,64 @@ struct mouse_report_s
 struct mouse_lowerhalf_s
 {
   FAR void *priv;  /* Save the upper half pointer */
+
+  /**************************************************************************
+   * Name: control
+   *
+   * Description:
+   *   Users can use this interface to implement custom IOCTL.
+   *
+   * Arguments:
+   *   lower   - The instance of lower half of mouse device.
+   *   cmd     - User defined specific command.
+   *   arg     - Argument of the specific command.
+   *
+   * Return Value:
+   *   Zero(OK) on success; a negated errno value on failure.
+   *   -ENOTTY - The command is not supported.
+   **************************************************************************/
+
+  CODE int (*control)(FAR struct mouse_lowerhalf_s *lower,
+                      int cmd, unsigned long arg);
+
+  /**************************************************************************
+   * Name: open
+   *
+   * Description:
+   *   This function pointer is used to open a connection to the mouse driver
+   *   instance. It initializes the mouse and prepares it for subsequent
+   *   interactions with the user. This function typically sets up the state
+   *   of the driver and allocates any necessary resources.
+   *
+   * Input Parameters:
+   *   lower  - A pointer to the instance of the lower half mouse driver.
+   *   filep  - A pointer to the file structure representing the user.
+   *
+   * Returned Value:
+   *   It returns zero (OK) on success; a negative errno value on failure.
+   **************************************************************************/
+
+  CODE int (*open)(FAR struct mouse_lowerhalf_s *lower);
+
+  /**************************************************************************
+   * Name: close
+   *
+   * Description:
+   *   This function pointer is used to close the connection to the mouse
+   *   driver instance. It performs any necessary cleanup operations, such as
+   *   releasing resources and resetting the state of the mouse driver,
+   *   before ending theinteraction with the user.
+   *
+   * Input Parameters:
+   *   lower  - A pointer to the instance of the lower half mouse driver.
+   *   filep  - A pointer to the file structure representing the user closing
+   *            the mouse connection.
+   *
+   * Returned Value:
+   *   Returns zero (OK) on success; a negative errno value on failure.
+   **************************************************************************/
+
+  CODE int (*close)(FAR struct mouse_lowerhalf_s *lower);
 };
 
 /****************************************************************************

mm/mempool/mempool.c

@@ -397,16 +397,17 @@ retry:
 
   pool->nalloc++;
   spin_unlock_irqrestore(&pool->lock, flags);
-  blk = kasan_unpoison(blk, pool->blocksize);
-#ifdef CONFIG_MM_FILL_ALLOCATIONS
-  memset(blk, MM_ALLOC_MAGIC, pool->blocksize);
-#endif
 
 #if CONFIG_MM_BACKTRACE >= 0
   mempool_add_backtrace(pool, (FAR struct mempool_backtrace_s *)
                               ((FAR char *)blk + pool->blocksize));
 #endif
 
+  blk = kasan_unpoison(blk, pool->blocksize);
+#ifdef CONFIG_MM_FILL_ALLOCATIONS
+  memset(blk, MM_ALLOC_MAGIC, pool->blocksize);
+#endif
+
   return blk;
 }