aboutsummaryrefslogtreecommitdiff
path: root/drivers/staging
AgeCommit message (Collapse)Author
2013-12-12ion: check return value from remap_pfn_rangeColin Cross
Check the return value of remap_pfn_range and return an error if it fails. Change-Id: I206cf95a24607ebe1c80274e3ed15cc7c076d007 Signed-off-by: Colin Cross <ccross@android.com>
2013-12-12ion: free low memory from page pools firstColin Cross
When the shrinkers are called with GFP_HIGH free low memory first, it is more important to have free than high memory. Change-Id: I7ad8a9c133830f04d429c3d87b781b3e862ccedb Signed-off-by: Colin Cross <ccross@android.com>
2013-12-12ion: optimize ion_heap_buffer_zeroColin Cross
ion_heap_buffer_zero can spend a long time in unmap_kernel_range if it has to broadcast a tlb flush to every cpu for every page. Modify it to batch pages into a larger region to clear using a single mapping. This may cause the mapping size to change if the buffer size is not a multiple of the mapping size, so switch to allocating the address space for each chunk. This allows us to use vm_map_ram to handle the allocation and mapping together. The number of pages to zero using a single mapping is set to 32 to hit the fastpath in vm_map_ram. Change-Id: I1accfe67b285cbc9e95e387bea4246864197827d Signed-off-by: Colin Cross <ccross@android.com>
2013-12-12ion: add alignment check to carveout heapColin Cross
Change-Id: I25c752b3eacb48cccea5be2df319634b3affd331 Signed-off-by: Colin Cross <ccross@android.com>
2013-12-12ion: drop dependency on ARMColin Cross
Ion will compile and run on other platforms now, remove the dependency on ARM. Change-Id: I9da0ab686708bdab575a021031392b4402cce090 Signed-off-by: Colin Cross <ccross@android.com>
2013-12-12ion: Fix two small issues in system_heap allocationJohn Stultz
In testing ion system heap allocations, I ran across two issues: 1) Not k*z*allocing the sg table. This can cause trouble if we end up trying call sg_alloc_table() with too many entries, then sg_alloc_table() internally fails and tries to free what it thinks is internal table structure, which causes bad pointer traversals. 2) The second list_for_each_entry probably should be _safe, since I was seeing strange lock warnings and oopses on occasion. This seems to resolve it, but could use some extra checking. Change-Id: I59d4c90104a8cf23dc4ae814d0b17348f1b68ac0 Signed-off-by: John Stultz <john.stultz@linaro.org>
2013-12-12gpu: ion: fix use-after-free in ion_heap_freelist_drainMitchel Humpherys
The `buffer' variable is being used after being freed. Fix this. Change-Id: Iea3471fa7dc7535bbf0620c1639fea2008d7cf19 Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
2013-12-12ion: clean up ioctlsColin Cross
Convert the ion ioctls to use _IOW instead of _IOWR where appropriate, and factor out the copy_from_user and copy_to_user based on the _IOC_DIR bits. For the existing incorrect ioctls, add a function to wrap _IOC_DIR to return the corrected value. Change-Id: I3cc34c84b9c52305bdbec27a9224447b102fadcd Signed-off-by: Colin Cross <ccross@android.com>
2013-12-12gpu: ion: remove unnecessary function from system heapColin Cross
ion_system_contig_heap buffers have an sglist, just call ion_heap_map_user to map it. Change-Id: I6dea383955834613fa8833659b31533c957c2b0b Signed-off-by: Colin Cross <ccross@android.com>
2013-12-12ion: fix printk warningsColin Cross
Use %z for size_t and %pa for dma_addr_t to avoid warnings in printks. Change-Id: I2c72874acd0b69cb35fca691928783817deb9394 Signed-off-by: Colin Cross <ccross@android.com>
2013-12-12ion: don't use phys_to_page or __phys_to_pfnColin Cross
phys_to_page and __phys_to_pfn don't exist on all platforms. Use a combination of pfn_to_page, PFN_DOWN, page_to_pfn, and virt_to_page to get the same results. Change-Id: I53cef26059800bc8b7fb85ae458741574c97c257 Signed-off-by: Colin Cross <ccross@android.com>
2013-12-12ion: don't use __arm_ioremap to map pagesColin Cross
ion_heap_map_kernel already implements mapping a scatterlist of pages into the kernel, and all heaps are required to have struct pages associated with them, so delete the functions that use __arm_ioremap and use ion_heap_map_kernel instead. Change-Id: Ia2dfd8d8c6e719d7d2f68dd4c458826fdb938260 Signed-off-by: Colin Cross <ccross@android.com>
2013-12-12ion: update idr to avoid deprecated apisColin Cross
Use idr_alloc instead if idr_pre_get/idr_get_new_above, and remove idr_remove_all. Change-Id: I675b789879549bd3767ed3ef2016cf108eb622d2 Signed-off-by: Colin Cross <ccross@android.com>
2013-12-12ion: add test device for unit tests to interact with dma_bufsColin Cross
Add a /dev/ion-test device that will be created if CONFIG_ION_TEST is set. The device accepts a dma_buf fd and allows reading and writing to the backing memory using DMA-like apis or kernel mapping apis. Can be used to test the dma_buf mapping ops, including the ion implementations, from userspace. Change-Id: I30703ba69cd75bdfe7767ac642e5f0cacd8d0478 Signed-off-by: Colin Cross <ccross@android.com>
2013-12-11ion: check invalid values in ion_system_heapColin Cross
ion_system_heap can only satisfy page alignment, and ion_system_contig_heap can only satisify alignment to the allocation size. Neither can support faulting user mappings because they use slab pages. Change-Id: I895c2d4184c672f647f83a17aeb862985dc92f2c Signed-off-by: Colin Cross <ccross@android.com>
2013-12-05Merge branch 'linux-linaro-lsk' into linux-linaro-lsk-androidMark Brown
Conflicts (add/add): drivers/input/evdev.c
2013-12-04media: lirc_zilog: Don't use dynamic static allocationMauro Carvalho Chehab
commit ac5b4b6bf0c84c48d7e2e3fce22e35b04282ba76 upstream. Dynamic static allocation is evil, as Kernel stack is too low, and ompilation complains about it on some archs: drivers/staging/media/lirc/lirc_zilog.c:967:1: warning: 'read' uses dynamic stack allocation [enabled by default] Instead, let's enforce a limit for the buffer to be 64. That should be more than enough. Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com> Reviewed-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-12-04staging: vt6656: [BUG] Fix for TX USB resets from vendors driver.Malcolm Priestley
commit 9df682927c2e3a92f43803d6b52095992e3b2ab8 upstream. This fixes resets on heavy TX data traffic. Vendor driver VT6656_Linux_src_v1.21.03_x86_11.04.zip http://www.viaembedded.com/servlet/downloadSvl?id=1890&download_file_id=14704 This is GPL-licensed code. original code BBbVT3184Init ... //2007-0725, RobertChang add, Enable Squelch detect reset option(SQ_RST_Opt), USB (register4, bit1) CONTROLnsRequestIn(pDevice, MESSAGE_TYPE_READ, (WORD)0x600+4, // USB's Reg4's bit1 MESSAGE_REQUEST_MEM, 1, (PBYTE) &byData); byData = byData|2 ; CONTROLnsRequestOut(pDevice, MESSAGE_TYPE_WRITE, (WORD)0x600+4, // USB's Reg4's bit1 MESSAGE_REQUEST_MEM, 1, (PBYTE) &byData); return TRUE;//ntStatus; .... A back port patch is needed for kernels less than 3.10. Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-12-04staging: zsmalloc: Ensure handle is never 0 on successOlav Haugan
commit 67296874eb1cc80317bf2a8fba22b494e21eb29b upstream. zsmalloc encodes a handle using the pfn and an object index. On hardware platforms with physical memory starting at 0x0 the pfn can be 0. This causes the encoded handle to be 0 and is incorrectly interpreted as an allocation failure. This issue affects all current and future SoCs with physical memory starting at 0x0. All MSM8974 SoCs which includes Google Nexus 5 devices are affected. To prevent this false error we ensure that the encoded handle will not be 0 when allocation succeeds. Signed-off-by: Olav Haugan <ohaugan@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-12-04Staging: tidspbridge: disable driverGreg Kroah-Hartman
commit 930ba4a374b96560ef9fde2145cdc454a164ddcc upstream. There seems to be no active maintainer for the driver, and there is an unfixed security bug, so disable the driver for now. Hopefully someone steps up to be the maintainer, and works to get this out of staging, otherwise it will be deleted soon. Reported-by: Nico Golde <nico@ngolde.de> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: Omar Ramirez Luna <omar.ramirez@copitl.com> Cc: Omar Ramirez Luna <omar.ramirez@ti.com> Cc: Kanigeri, Hari <h-kanigeri2@ti.com> Cc: Ameya Palande <ameya.palande@nokia.com> Cc: Guzman Lugo, Fernando <fernando.lugo@ti.com> Cc: Hebbar, Shivananda <x0hebbar@ti.com> Cc: Ramos Falcon, Ernesto <ernesto@ti.com> Cc: Felipe Contreras <felipe.contreras@gmail.com> Cc: Anna, Suman <s-anna@ti.com> Cc: Gupta, Ramesh <grgupta@ti.com> Cc: Gomez Castellanos, Ivan <ivan.gomez@ti.com> Cc: Andy Shevchenko <ext-andriy.shevchenko@nokia.com> Cc: Armando Uribe De Leon <x0095078@ti.com> Cc: Deepak Chitriki <deepak.chitriki@ti.com> Cc: Menon, Nishanth <nm@ti.com> Cc: Phil Carmody <ext-phil.2.carmody@nokia.com> Cc: Ohad Ben-Cohen <ohad@wizery.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-11-25Merge branch 'upstream/android-3.10' into linaro-fixes/android-3.10John Stultz
Update to latest android-3.10 branch. Minor conflict with the direct printk stuff Signed-off-by: John Stultz <john.stultz@linaro.org>
2013-11-15ion: convert sg_dma_len(sg) to sg->lengthColin Cross
ion is always dealing with the allocation and not the mapping, so it should always be using sg->length and not sg->dma_length. Change-Id: Id9b07f1196b2bafe04636fa1aa46dfc84d003cf0 Signed-off-by: Colin Cross <ccross@android.com>
2013-11-15ion: fix dma APIsColin Cross
__dma_page_cpu_to_dev is a private ARM api that is not available on 3.10 and was never available on other architectures. We can get the same behavior by calling dma_sync_sg_for_device with a scatterlist containing a single page. It's still not quite a kosher use of the dma apis, we still conflate physical addresses with bus addresses, but it should at least compile on all platforms, and work on any platform that doesn't have a physical to bus address translation. Change-Id: I8451c2dae4bf85841015c016640684ac28430a5a Signed-off-by: Colin Cross <ccross@android.com>
2013-11-15ion: fix crash when alloc len is -1Colin Cross
If userspace passes a length between -4095 and -1 to allocate it will pass the len != 0 check, but when len is page aligned it will be 0. Check len after page aligning. Drop the warning as well, userspace shouldn't be able to trigger a warning in the kernel. Change-Id: I96c7142637638991f3a9af9be7cfbb50f79f3803 Signed-off-by: Colin Cross <ccross@android.com>
2013-11-15ion: hold reference to handle after ion_uhandle_getColin Cross
commit 1262ab1846cf76f7549c66ef709120dbfbe6d49f (ion: replace userspace handle cookies with idr) broke the locking in ion. The ION_IOC_FREE and ION_IOC_MAP ioctls were relying on ion_handle_validate to detect the case where a call raced with another ION_IOC_FREE which may have freed the struct ion_handle. Rename ion_uhandle_get to ion_handle_get_by_id, and have it take the client lock and return with an extra reference to the handle. Make each caller put its reference once it is done with the handle. Also modify users of ion_handle_validate to continue to hold the client lock after calling ion_handle_validate until they are done with the handle, and warn if ion_handle_validate is called without the client lock held. Change-Id: I56da5624fca3bed4ee24806b6ec39de903543341 Signed-off-by: Colin Cross <ccross@android.com>
2013-11-14ion: Fix compat support to use proper compat ioctl numbersJohn Stultz
The compat support added to ion didn't provide compat ioctl numbers (who's value depends on the compat structure size). So 32bit applications would get an error when trying to make ioctl calls. This patch adds the needed COMPAT_ macros and uses them in the compat_ion_ioctl, translating them to their non-compat cmd when calling the normal ioctl call. Change-Id: I53636d4ec46d8dc5e694697aaf2d62b98bd78cb1 Signed-off-by: John Stultz <john.stultz@linaro.org>
2013-11-14Merge remote-tracking branch 'lsk/v3.10/topic/android-fixes' into ↵Mark Brown
linux-linaro-lsk-android The cpufreq_interactive changes have been merged upstream and the local version dropped. Conflicts: drivers/cpufreq/cpufreq_interactive.c
2013-11-13Merge branch 'linux-linaro-lsk' into linux-linaro-lsk-androidMark Brown
2013-11-13staging: wlags49_h2: buffer overflow setting station nameDan Carpenter
commit b5e2f339865fb443107e5b10603e53bbc92dc054 upstream. We need to check the length parameter before doing the memcpy(). I've actually changed it to strlcpy() as well so that it's NUL terminated. You need CAP_NET_ADMIN to trigger these so it's not the end of the world. Reported-by: Nico Golde <nico@ngolde.de> Reported-by: Fabian Yamaguchi <fabs@goesec.de> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-11-13Staging: sb105x: info leak in mp_get_count()Dan Carpenter
commit a8b33654b1e3b0c74d4a1fed041c9aae50b3c427 upstream. The icount.reserved[] array isn't initialized so it leaks stack information to userspace. Reported-by: Nico Golde <nico@ngolde.de> Reported-by: Fabian Yamaguchi <fabs@goesec.de> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-11-13Staging: bcm: info leak in ioctlDan Carpenter
commit 8d1e72250c847fa96498ec029891de4dc638a5ba upstream. The DevInfo.u32Reserved[] array isn't initialized so it leaks kernel information to user space. Reported-by: Nico Golde <nico@ngolde.de> Reported-by: Fabian Yamaguchi <fabs@goesec.de> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-11-13staging: ozwpan: prevent overflow in oz_cdev_write()Dan Carpenter
commit c2c65cd2e14ada6de44cb527e7f1990bede24e15 upstream. We need to check "count" so we don't overflow the ei->data buffer. Reported-by: Nico Golde <nico@ngolde.de> Reported-by: Fabian Yamaguchi <fabs@goesec.de> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-11-12Merge branch 'upstream/android-3.10' into linaro-fixes/android-3.10John Stultz
2013-11-07drivers: staging: android: split uapi out of sync.h and sw_sync.hColin Cross
Move the userspace interfaces of sync.h and sw_sync.h to drivers/staging/android/uapi/ Change-Id: I3b2598b37385bb993bd03f5faa98a8e196befe45 Signed-off-by: Colin Cross <ccross@android.com>
2013-11-07drivers: staging: android: split uapi out of binder.hColin Cross
Move the userspace interface of binder.h to drivers/staging/android/uapi/binder.h. Change-Id: I2e56ba89ade5e1f33b121e6ecd456392d588a14e Signed-off-by: Colin Cross <ccross@android.com>
2013-11-07drivers: staging: android: split uapi out of ashmem.hColin Cross
Move the userspace interface of ashmem.h to drivers/staging/android/uapi/ashmem.h Change-Id: I60f5baa4ce8e2425262a406f2733c089ec55aa72 Signed-off-by: Colin Cross <ccross@android.com>
2013-11-07drivers: staging: android: split uapi out of android_alarm.hColin Cross
Move the userspace interface of android_alarm.h to drivers/staging/android/uapi/android_alarm.h Change-Id: Ieb96e8e9bf742786efc4e248e6a242dab8199ca3 Signed-off-by: Colin Cross <ccross@android.com>
2013-11-07ion: move userspace api into uapi/ion.hColin Cross
Split the userspace api out of drivers/staging/android/ion/ion.h into drivers/staging/android/uapi/ion.h Change-Id: I51baa4a7c86bf99c493e28a15f8664a489fd5a2d Signed-off-by: Colin Cross <ccross@android.com>
2013-11-07ion: move into stagingColin Cross
Move ion from drivers/gpu/ion to drivers/android/staging/ion. Change-Id: Id6e996aa3954cbb8e1a8abc9578a56204f5eb211 Signed-off-by: Colin Cross <ccross@android.com>
2013-11-04Merge branch 'upstream/android-3.10' into linaro-fixes/android-3.10John Stultz
2013-10-29Merge branch 'android-3.10-adf' into android-3.10Greg Hackmann
2013-10-24sync: Fix a race condition between release_obj and print_objAlistair Strachan
Before this change, a timeline would only be removed from the timeline list *after* the sync driver had its release_obj() called. However, the driver's release_obj() may free resources needed by print_obj(). Although the timeline list is locked when print_obj() is called, it is not locked when release_obj() is called. If one CPU was in print_obj() when another was in release_obj(), the print_obj() may make unsafe accesses. It is not actually necessary to hold the timeline list lock when calling release_obj() if the call is made after the timeline is unlinked from the list, since there is no possibility another thread could be in -- or enter -- print_obj() for that timeline. This change moves the release_obj() call to after the timeline is unlinked, preventing the above race from occurring. Signed-off-by: Alistair Strachan <alistair.strachan@imgtec.com> (cherry picked from commit 3bfc1e9e0c7d0c0e3f52ee1f3803482416afa295) Change-Id: Ib2b2b23fde5be34016f9d86b8b9c5e561b56cd4c
2013-10-17staging: android: binder: Fix build warningsAndy Green
This commit in mainline (now) causes a couple of warnings commit 975a1ac9a9fe65d66ee1726c0db6dc58e53d232a Author: Arve Hjønnevåg <arve@android.com> Date: Tue Oct 16 15:29:53 2012 -0700 Staging: android: binder: Add some tracepoints This patch fixes them Signed-off-by: Andy Green <andy.green@linaro.org> Signed-off-by: John Stultz <john.stultz@linaro.org>
2013-10-14Merge branch 'linux-linaro-lsk' into linux-linaro-lsk-androidMark Brown
2013-10-13staging: comedi: ni_65xx: (bug fix) confine insn_bits to one subdeviceIan Abbott
commit 677a31565692d596ef42ea589b53ba289abf4713 upstream. The `insn_bits` handler `ni_65xx_dio_insn_bits()` has a `for` loop that currently writes (optionally) and reads back up to 5 "ports" consisting of 8 channels each. It reads up to 32 1-bit channels but can only read and write a whole port at once - it needs to handle up to 5 ports as the first channel it reads might not be aligned on a port boundary. It breaks out of the loop early if the next port it handles is beyond the final port on the card. It also breaks out early on the 5th port in the loop if the first channel was aligned. Unfortunately, it doesn't check that the current port it is dealing with belongs to the comedi subdevice the `insn_bits` handler is acting on. That's a bug. Redo the `for` loop to terminate after the final port belonging to the subdevice, changing the loop variable in the process to simplify things a bit. The `for` loop could now try and handle more than 5 ports if the subdevice has more than 40 channels, but the test `if (bitshift >= 32)` ensures it will break out early after 4 or 5 ports (depending on whether the first channel is aligned on a port boundary). (`bitshift` will be between -7 and 7 inclusive on the first iteration, increasing by 8 for each subsequent operation.) Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-10-13sync: signal pt before sync_timeline object gets destroyedPrakash Kamliya
There is a race condition Assume we have *one* sync_fence object, with *one* sync_pt which belongs to *one* sync_timeline, given this condition, sync_timeline->kref will have two counts, one for sync_timeline (implicit) and another for sync_pt. Assume following is the situation on CPU Theead-1 : (Thread which calls sync_timeline_destroy()) -> (some function calls) -> sync_timeline_destory() -> sync_timeline_signal() (CPU is inside this function after putting reference to sync_timeline) At this time Thread-2 comes and does following Thread-2 : (fclose on fence fd) > sync_fence_release() -> because of fclose() on fence object -> sync_fence_free() -> sync_pt_free() -> kref_put(&pt->parent->kref, sync_timeline_free); -> sync_timeline_free() (CPU is inside this because this time kref will be zero after _put) Thread-2 will free sync_timeline object before Thread-1 has finished its work inside sync_timeline_signal. With this change we signals all sync_pt before putting reference to sync_timeline object. Change-Id: Ic680e4d0bbef1c46bcb7cfba693395645241d203 Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>
2013-10-11staging: sw_sync: add stubs for kernels without CONFIG_SW_SYNCGreg Hackmann
Change-Id: I7a12679eb3c10b1beaf36c6612cf2e3f6662a034 Signed-off-by: Greg Hackmann <ghackmann@google.com>
2013-10-06Merge branch 'linux-linaro-lsk' into linux-linaro-lsk-androidMark Brown
2013-10-05staging: vt6656: [BUG] iwctl_siwencodeext return if device not openMalcolm Priestley
commit 5e8c3d3e41b0bf241e830a1ee0752405adecc050 upstream. Don't allow entry to iwctl_siwencodeext if device not open. This fixes a race condition where wpa supplicant/network manager enters the function when the device is already closed. Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-10-05staging: vt6656: [BUG] main_usb.c oops on device_close move flag earlier.Malcolm Priestley
commit e3eb270fab7734427dd8171a93e4946fe28674bc upstream. The vt6656 is prone to resetting on the usb bus. It seems there is a race condition and wpa supplicant is trying to open the device via iw_handlers before its actually closed at a stage that the buffers are being removed. The device is longer considered open when the buffers are being removed. So move ~DEVICE_FLAGS_OPENED flag to before freeing the device buffers. Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-23 08:38:14 +0000