aboutsummaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2015-05-11proc: uid_cputime: fix show_uid_stat permissionJin Qian
Change-Id: Ice9084e39da599261df0be6dc305b817b50cfbbf Signed-off-by: Jin Qian <jinqian@google.com>
2015-05-01cpufreq: interactive: Round up timer_rate to match jiffyJunjie Wu
Timers are scheduled in unit of jiffies. Round up timer_rate so that it matches the actual sampling period. Change-Id: I88386a5a448e40333f9a9b9f0cf72af58cb54656 Signed-off-by: Junjie Wu <junjiew@codeaurora.org>
2015-05-01cpufreq: interactive: Don't set floor_validate_time during boostJunjie Wu
Frequency selection algorithm guarantees its chosen frequency is not lower than hispeed_freq as long as boost is enabled. Setting floor_freq and floor_validate_time during boost could block CPU frequency from going below hispeed_freq even after boostpulse_duration expires, if min_sample_time is higher than boostpulse_duration. This conflicts with the intention of commit de091367ead15b6e95dd1d0743a18f0da5a07ee5 (cpufreq: interactive: specify duration of CPU speed boost pulse) to allow CPU to ramp down immediately after boost expires. It also makes boost behavior inconsistent since it depends on min_sample_time. Avoid setting floor_freq and floor_validate_time when boost starts. Change-Id: I12852998af46cfbfaf8661eb5e8d5301b6f631e7 Signed-off-by: Junjie Wu <junjiew@codeaurora.org>
2015-04-20subsystem: CPU FREQUENCY DRIVERS- Set cpu_load calculation on current frequencyrahul.khandelwal
In timer, cpu_load is calcuated on target_freq. cpu_load = loadadjfreq / pcpu->target_freq; But cpu is actually running on current freq i.e. pcpu->policy->cur. So cpu_load should be calculated on current frequency. cpu_load = loadadjfreq / pcpu->policy->cur; Change-Id: I89db6b68e9f82aa52077f6bf7d819dab74265790 Signed-off-by: rahul.khandelwal <rahul.khandelwal@spreadtrum.com>
2015-04-15proc: uid_cputime: create uids from kuidsAmit Pundir
Create uids from kuids using from_kuid_munged(), otherwise we run into following build error and warnings: -------------------- CC drivers/misc/uid_cputime.o drivers/misc/uid_cputime.c: In function ‘uid_stat_show’: drivers/misc/uid_cputime.c:90:36: error: incompatible type for argument 1 of ‘find_or_register_uid’ drivers/misc/uid_cputime.c:54:26: note: expected ‘uid_t’ but argument is of type ‘kuid_t’ drivers/misc/uid_cputime.c:94:4: warning: format ‘%d’ expects argument of type ‘int’, but argument 3 has type ‘kuid_t’ [-Wformat] drivers/misc/uid_cputime.c: In function ‘process_notifier’: drivers/misc/uid_cputime.c:194:6: error: incompatible types when assigning to type ‘uid_t’ from type ‘kuid_t’ make[2]: *** [drivers/misc/uid_cputime.o] Error 1 -------------------- Change-Id: Ifecb98001f7fe2fac74d1ef3e1abd03d43fc9059 Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
2015-04-14wakeup: Add last wake up source logging for suspend abort reason.Ruchi Kandoi
There is a possibility that a wakeup source event is received after the device prepares to suspend which might cause the suspend to abort. This patch adds the functionality of reporting the last active wakeup source which is currently not active but caused the suspend to abort reason via the /sys/kernel/power/last_wakeup_reason file. Change-Id: I1760d462f497b33e425f5565cb6cff5973932ec3 Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
2015-04-13cpufreq: interactive: Put global cpufreq kobject on failureJunjie Wu
Fix failure recovery path in cpufreq_governor_interactive(). Call cpufreq_put_global_kobject() to release cpufreq global kobject upon governor init failure. Change-Id: I7a977070b7a3c75c90acccd2c117064ed1a10d0e Signed-off-by: Junjie Wu <junjiew@codeaurora.org>
2015-04-06proc: uid: Adds accounting for the cputimes per uid.jinqian
Adds proc files /proc/uid_cputime/show_uid_stat and /proc/uid_cputime/remove_uid_range. show_uid_stat lists the total utime and stime for the active as well as terminated processes for each of the uids. Writing a range of uids to remove_uid_range will delete the accounting for all the uids within that range. Change-Id: I21d9210379da730b33ddc1a0ea663c8c9d2ac15b
2015-04-06arm: dcc_tty: fix armv6 dcc tty build failureJohn Stultz
Fix spinlock declaration and tty_insert/flip arguments. If ARM DCC tty driver is enabled then we run into following build failure: ----------   CC      drivers/char/dcc_tty.o drivers/char/dcc_tty.c:29:36: error: ‘SPIN_LOCK_UNLOCKED’ undeclared here (not in a function) drivers/char/dcc_tty.c: In function ‘dcc_poll_locked’: drivers/char/dcc_tty.c:83:4: warning: passing argument 1 of ‘tty_insert_flip_string’ from incompatible pointer type [enabled by default] In file included from drivers/char/dcc_tty.c:23:0: include/linux/tty_flip.h:32:19: note: expected ‘struct tty_port *’ but argument is of type ‘struct tty_struct *’ drivers/char/dcc_tty.c:84:4: warning: passing argument 1 of ‘tty_flip_buffer_push’ from incompatible pointer type [enabled by default] In file included from drivers/char/dcc_tty.c:23:0: include/linux/tty_flip.h:13:13: note: expected ‘struct tty_port *’ but argument is of type ‘struct tty_struct *’ make[2]: *** [drivers/char/dcc_tty.o] Error 1 ---------- Signed-off-by: Amit Pundir <amit.pundir@linaro.org> (cherry picked from commit 0274b1c917fe1eba159910e4775d981edc446495) Change-Id: I571f5117d985a5ad9f3ca557c45bdf9e0600171a
2015-03-23staging: Remove logger and alarm-dev from android MakefileJohn Stultz
My previous patches deleting logger and alarm-dev from staging missed the android Makefile. This patch cleans up the Makefile to remove the now non-existent files. Cc: Rom Lemarchand <romlem@google.com>, Cc: Mark Salyzyn <salyzyn@google.com>, Cc: Kees Cook <keescook@chromium.org>, Cc: Android Kernel Team <kernel-team@android.com>, Cc: Valentin Rothberg <valentinrothberg@gmail.com>, Cc: Greg Hackmann <ghackmann@google.com>, Cc: Elliott Hughes <enh@google.com>, Cc: Todd Poynor <toddpoynor@google.com>, Reported-by: Paul Bolle <pebolle@tiscali.nl> Signed-off-by: John Stultz <john.stultz@linaro.org> Acked-by: Kees Cook <keescook@chromium.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 13505761 Change-Id: Id8c027ce51a663ee2e9ea2618612921db7cf7637
2015-03-23staging: Remove the Android alarm-dev driverJohn Stultz
The functionality provided by the Android alarm-dev driver should now be present in the timerfd interface (thanks to Greg Hackmann and Todd Poynor). As of Lollipop, AOSP can make use of the timerfd if alarm-dev is not present (though a fixup for setting the rtc time if rtc0 isn't the backing for _ALARM clockids has been applied post-Lollipop). Thus, we should be able to remove alarm-dev from staging. Cc: Greg Hackmann <ghackmann@google.com> Cc: Elliott Hughes <enh@google.com> Cc: Todd Poynor <toddpoynor@google.com> Cc: Android Kernel Team <kernel-team@android.com> Signed-off-by: John Stultz <john.stultz@linaro.org> Acked-by: Mark Salyzyn <salyzyn@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Change-Id: Ia905d4b809cc1614ddde01ccb791fc56ac292fa9
2015-03-23staging: Remove the Android logger driverJohn Stultz
With the relase of Lollipop, Android no longer requires the logger driver. There are three patches which the android dev's still need before they drop logger on all their devices: [PATCH v4 1/5] pstores: use scnprintf [PATCH v2 2/5] pstore: remove superfluous memory size check [PATCH 3/5] pstore: handle zero-sized prz in series [PATCH v4 4/5] pstore: add pmsg [PATCH 5/5] pstore: selinux: add security in-core xattr support for pstore and debugfs But these seem to have been acked and are hopefully queued for upstream. So this patch removes the logger driver from staging. Cc: Rom Lemarchand <romlem@google.com>, Cc: Mark Salyzyn <salyzyn@google.com> Cc: Kees Cook <keescook@chromium.org> Cc: Android Kernel Team <kernel-team@android.com> Signed-off-by: John Stultz <john.stultz@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 13505761 Change-Id: I21b6897f01871851e05b6eb53c7c08a1cb597e3f
2015-03-03mmc: Move tracepoint creation and export symbolsDylan Reid
Move the tracepoint creation to core from card, as core shouldn't depend on card. Also add EXPORT_SYMBOL_GPL calls to enable module build. Change-Id: Ie39fcdadc0516df99600d0963efe09b6cd7a9bf8 Signed-off-by: Dylan Reid <dgreid@chromium.org>
2015-02-27input: evdev: fix double free in evdev_releaseDavid Riley
Double free introduced in porting Android 3.10 changes to 3.14. Signed-off-by: David Riley <davidriley@google.com>
2015-01-26usb: gadget: check for accessory device before disconnecting HIDsAmit Pundir
While disabling ConfigFS Android gadget, android_disconnect() calls kill_all_hid_devices(), if CONFIG_USB_CONFIGFS_F_ACC is enabled, to free the registered HIDs without checking whether the USB accessory device really exist or not. If USB accessory device doesn't exist then we run into following kernel panic: ----8<---- [  136.724761] Unable to handle kernel NULL pointer dereference at virtual address 00000064 [  136.724809] pgd = c0204000 [  136.731924] [00000064] *pgd=00000000 [  136.737830] Internal error: Oops: 5 [#1] SMP ARM [  136.738108] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 3.18.0-rc4-00400-gf75300e-dirty #76 [  136.742788] task: c0fb19d8 ti: c0fa4000 task.ti: c0fa4000 [  136.750890] PC is at _raw_spin_lock_irqsave+0x24/0x60 [  136.756246] LR is at kill_all_hid_devices+0x24/0x114 ---->8---- This patch adds a test to check if USB Accessory device exists before freeing HIDs. Change-Id: Ie229feaf0de3f4f7a151fcaa9a994e34e15ff73b Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
2015-01-24staging: android: ashmem: add missing includeRom Lemarchand
Include <linux/types.h> into ashmem.h to ensure referenced types are defined Signed-off-by: Rom Lemarchand <romlem@android.com> Change-Id: Iac18ed86dd47296d02a269607b1514724aaa9958 (cherry picked from commit 0d7c7ba9f6428e694130a40e270516618f27ce14)
2015-01-23usb: gadget: android: Save/restore ep0 completion functionJack Pham
The android_setup() function currently gives the f_accessory setup function first opportunity to handle control requests in order to support Android Open Accessory (AOA) hosts. That function makes use of cdev->req and overrides its completion function, but not in all cases. Thus, if a later request uses the same request pointer but doesn't (re)set req->complete it could result in the wrong completion function being called and causing invalid memory access. One way to fix this would be to explicitly set req->complete in all cases but that might require auditing all function drivers that have ep0 handling. Instead, note that the composite device had already initially set cdev->req->complete and simply cache and restore that pointer at the start of android_setup(). Change-Id: I33bcd17bd20687a349d537d1013b52a2afef6996 Signed-off-by: Jack Pham <jackp@codeaurora.org>
2015-01-23usb: u_ether: Fix compile errorsPraneeth Bajjuri
commit f1a1823ff24fa4e3412b5078f20021cf40834946 usb: gadget: u_ether: convert into module changes qlen function definition. and this has to be fixed accordingly in current u_ether driver. This patch fixes following compile error in u_ether caused by commit. drivers/usb/gadget/u_ether.c: In function 'rx_fill': drivers/usb/gadget/u_ether.c:416:3: error: too few arguments to function 'qlen' if (++req_cnt > qlen(dev->gadget)) ^ drivers/usb/gadget/u_ether.c: In function 'eth_start_xmit': drivers/usb/gadget/u_ether.c:738:24: error: 'qmult' undeclared (first use in this function) if (dev->tx_qlen == (qmult/2)) { which was caused by commits commit 79467317949e1621240f632acfb7453783bec2e7 USB: gadget: u_ether: Fix data stall issue in RNDIS tethering mode commit 68b91e8c54f5c091986c5719631893b10eab760a usb: u_ether: Add workqueue as bottom half handler for rx data path Change-Id: Ic4e5a1e08cb688e5a606c7c1895f869d8f887b9f Signed-off-by: Praneeth Bajjuri <praneeth@ti.com>
2015-01-23usb: gadget: Add Uevent to notify userspaceBadhri Jagan Sridharan
Android userspace UsbDeviceManager relies on the uevents generated by the composition driver to generate user notifications. This CL adds uevents to be generated whenever USB changes its state i.e. connected, disconnected, configured. This CL also intercepts the setup requests from the usb_core anb routes it to the specific usb function if required. Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com> Change-Id: Ib3d3a78255a532f7449dac286f776c2966caf8c1
2015-01-21usb: gadget: mtp/ptp: Migrate functions to the USB_FUNCTION interfaceBadhri Jagan Sridharan
This patch adds support to use mtp/ptp gadget functions through the DECLARE_USB_FUNCTION_INIT interface. enabling USB_CONFIGFS_F_MTP config compiles f_mtp.c thereby providing support for MTP gadget enabling USB_CONFIGFS_F_PTP config compiles f_ptp.c thereby providing support for PTP gadget Signed-off-by: Badhri Jagan Sridharan <badhri@google.com> Change-Id: I38d7b570e8886d155ef10cd2c839b2232dcb3158
2015-01-14cpufreq: stats: hold reference on global cpufreqDaniel Rosenberg
As in f8ad216f37e6a7b07d5f6982a25c426c72f661f6, cpufreq stat must grab a reference to the global cpufreq kobject in order to use it. Otherwise, the kobj->sd will be NULL, and trigger a BUG in sysfs_create_file. Change-Id: If7d1c13c6ebb1678e1cd33d46eba04a41a0a796d Signed-off-by: Daniel Rosenberg <drosen@google.com>
2015-01-12video: adf: fix wrong bitops in adf_modeinfo_to_fb_videomode()Greg Hackmann
Change-Id: I1296153e382c0b66b713a0e7d09665ed5961f13d Signed-off-by: Greg Hackmann <ghackmann@google.com> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
2015-01-12cpufreq: interactive: only boost tunable affected cpusLianwei Wang
It is not correct to boost all the cpus when tunable boost parameters are changed. It also does not need to boost the cpus which is already boosted. Signed-off-by: Lianwei Wang <a22439@motorola.com>
2015-01-12cpufreq: interactive: don't skip waking up speedchange_task if target_freq > ↵Minsung Kim
policy->cur When __cpufreq_driver_target() in speedchange_task failed for some reason, the policy->cur could be lower than the target_freq. The governor misses to change the target_freq if the target_freq is equal to the next_freq at the next sample time. Added a check to prevent the CPU to stay at the speed that is lower than the target_freq for long duration. Change-Id: Ibfdcd193b8280390b8f8374a63218aa31267f310 Signed-off-by: Minsung Kim <ms925.kim@samsung.com>
2015-01-12staging: binder: Change binder mutex to rtmutex.Riley Andrews
Surfaceflinger uses binder heavily to receive/send frames from applications while compositing the screen. Change the binder mutex to an rt mutex to minimize instances where high priority surfaceflinger binder work is blocked by lower priority binder ipc. Signed-off-by: Riley Andrews <riandrews@google.com> Change-Id: I086a715267648448f0c5f62b037a3093d1079a79
2015-01-12power: Adds functionality to log the last suspend abort reason.Ruchi Kandoi
Extends the last_resume_reason to log suspend abort reason. The abort reasons will have "Abort:" appended at the start to distinguish itself from the resume reason. Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com> Change-Id: I3207f1844e3d87c706dfc298fb10e1c648814c5f
2015-01-12cpufreq: Avoid using global variable total_cpusRuchi Kandoi
The change is to compile on kernels where cpufreq stats are compiled as a module (CONFIG_CPU_FREQ_STAT=m), because total_cpus is not exported for module use. Reported-By: Emilio López <elopez93@gmail.com> Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com> Change-Id: I4f3c74f0fac5e8d9449655b26bf3b407b0fe4290
2015-01-09USB: f_rndis: fix compile errorBadhri Jagan Sridharan
Change-Id: Ied5dd8ef905bdf84d176a5e560b09e292b68fbc5 Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com>
2015-01-07USB: gadget: rndis: Add module parameter for DL max packets per xferxerox_lin
Currently DL aggregation is supported in RNDIS driver and is set to 3 by default. And there is no support to change downlink maximum packets per transfer at runtime through module parameter. Hence add module parameter for DL maximum packets per transfer to change it at runtime. echo 6 > /sys/module/g_android/parameters/rndis_dl_max_pkt_per_xfer To disable DL aggregation during runtime, echo 1 > /sys/module/g_android/parameters/rndis_dl_max_pkt_per_xfer Change-Id: I3a1d0bc97358e2b6f233df7ae8725fb507de50db Signed-off-by: Xerox Lin <xerox_lin@htc.com> Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
2015-01-07ndis: Add debug support to disable RNDIS Multipacket FeatureBadhri Jagan Sridharan
This change adds module param which allows to disable RNDIS Multi-packet Feature (Aggregation support in Downlink path) as this feature is enabled by default. To disable use this param before moving to RNDIS Composition: echo 1 > /sys/module/g_android/parameters/rndis_multipacket_dl_disable Also counts errors as Rx errors if received RNDIS packets are not following RNDIS message format as those packets are being discarded. Change-Id: I764430da78f2204af92e14bb279c11b24c7e4c67 Signed-off-by: Mayank Rana <mrana@codeaurora.org>
2015-01-07RNDIS: Add Data aggregation (multi packet) supportBadhri Jagan Sridharan
Add data aggregation support using RNDIS Multi Packet feature to achieve better UDP Downlink throughput. Max 3 RNDIS Packets aggregated into one RNDIS Packet with this implementation. With this change, seeing UDP Downlink throughput increase from 90 Mbps to above 100 Mbps when using Iperf and sending data more than 100 Mbps. Change-Id: I21c39482718944bb1b1068bdd02f626531e58f08 Signed-off-by: Mayank Rana <mrana@codeaurora.org> Signed-off-by: Rajkumar Raghupathy <raghup@codeaurora.org>
2015-01-07USB: gadget: u_ether: Fix data stall issue in RNDIS tethering modeBadhri Jagan Sridharan
For dual speed gadget, with current no. of request(10), there is possibility of corner case occurence where all 10 reuqests are queued to HW without setting IOC bit, which could lead to data stall in RNDIS tethering and RNDIS local networking. With this patch, counter will be incremented before queueing request to HW and sets IOC bit for every nth request due to which the corner case of all requests queued to HW without IOC bit set will be avoided. Change-Id: I26515bfd9bbc8f7af38be7835692143f7093118a Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
2015-01-07usb: gadget: prevent change of Host MAC address of 'usb0' interfacetaeju.park
On windows 7 platform, previously allocated ip address is maintained. However, Host MAC address of 'usb0' interface is changed when the tethering driver re-enumerated. Thus, the tethering network driver can't be allocated ip address from dhcp. It causes connection delay between host and phone for usb tethering. This patch prevents from changing Host MAC address of 'usb0' interface. In other words, this patch maintains the Host MAC address allocated when first tethering driver although the driver is re-enumerated. However, after reboot, the Host MAC address can be changed. Change-Id: I43add9925e9d6d90c56cffbd3ed999104448f818 Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com>
2015-01-07usb: u_ether: Add workqueue as bottom half handler for rx data pathBadhri Jagan Sridharan
u_ether driver passes rx data to network layer and resubmits the request back to usb hardware in interrupt context. Network layer processes rx data by scheduling tasklet. For high throughput scenarios on rx data path driver is spending lot of time in interrupt context due to rx data processing by tasklet and continuous completion and re-submission of the usb requests which results in watchdog bark. Hence move the rx data processing and usb request submission to a workqueue bottom half handler. Change-Id: I316de8e267997137ac189a8b7b2846fa325f4a5a Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com>
2015-01-06cpufreq: interactive: make common_tunables staticTodd Poynor
From: Cylen Yao <cylen.yao@mediatek.com> common_tunables should be static. Change-Id: I502ee3062bece5082fea7861eff2f6237e25cede Signed-off-by: Todd Poynor <toddpoynor@google.com>
2015-01-06cpu: add generic support for CPU feature based module autoloadingArd Biesheuvel
This patch adds support for advertising optional CPU features over udev using the modalias, and for declaring compatibility with/dependency upon such a feature in a module. The mapping between feature numbers and actual features should be provided by the architecture in a file called <asm/cpufeature.h> which exports the following functions/macros: - cpu_feature(FEAT), a preprocessor macro that maps token FEAT to a numeric index; - bool cpu_have_feature(n), returning whether this CPU has support for feature #n; - MAX_CPU_FEATURES, an upper bound for 'n' in the previous function. The feature can then be enabled by setting CONFIG_GENERIC_CPU_AUTOPROBE for the architecture. For instance, a module that registers its module init function using module_cpu_feature_match(FEAT_X, module_init_function) will be probed automatically when the CPU's support for the 'FEAT_X' feature is advertised over udev, and will only allow the module to be loaded by hand if the 'FEAT_X' feature is supported. Change-Id: Icae8e3ff347235fc72a5b41279f0afdb34fb161a Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-01-06usb: Add support for rndis uplink aggregationxerox_lin
RNDIS protocol supports data aggregation on uplink and can help reduce mips by reducing number of interrupts on device. Throughput also improved by 20-30%. Aggregation is disabled by setting aggregation packet size to 1. To help better UL throughput, set as ul aggregation support to 3 rndis packets by default. It can be configured via module parameter: rndis_ul_max_pkt_per_xfer. Change-Id: I0b62a21a5c3ceb6b04933d0d6da33301dbafe493 Signed-off-by: Vamsi Krishna <vskrishn@codeaurora.org> Signed-off-by: Xerox Lin <xerox_lin@htc.com>
2015-01-06USB: rndis: Free the rndis response queue during REMOTE_NDIS_RESET_MSGxerox_lin
When rndis data transfer is in progress, some Windows7 Host PC is not sending the GET_ENCAPSULATED_RESPONSE command for receiving the response for the previous SEND_ENCAPSULATED_COMMAND processed. The rndis function driver appends each response for the SEND_ENCAPSULATED_COMMAND in a queue. As the above process got corrupted, the Host sends a REMOTE_NDIS_RESET_MSG command to do a soft-reset. As the rndis response queue is not freed, the previous response is sent as a part of this REMOTE_NDIS_RESET_MSG's reset response and the Host blocks any more Rndis transfers. Hence free the rndis response queue as a part of this soft-reset so that the current response for REMOTE_NDIS_RESET_MSG is sent properly during the response command. Change-Id: I8eff3849db452fe01b7d1fe4140ef1f1ad3f4fd4 Signed-off-by: Rajkumar Raghupathy <raghup@codeaurora.org> Signed-off-by: Xerox Lin <xerox_lin@htc.com>
2015-01-06firmware loader: fix pending_fw_head list corruptionMaxime Bizon
Got the following oops just before reboot: Unable to handle kernel NULL pointer dereference at virtual address 00000000 [<8028d300>] (__list_del_entry+0x44/0xac) [<802e3320>] (__fw_load_abort.part.13+0x1c/0x50) [<802e337c>] (fw_shutdown_notify+0x28/0x50) [<80034f80>] (notifier_call_chain.isra.1+0x5c/0x9c) [<800350ec>] (__blocking_notifier_call_chain+0x44/0x58) [<80035114>] (blocking_notifier_call_chain+0x14/0x18) [<80035d64>] (kernel_restart_prepare+0x14/0x38) [<80035d94>] (kernel_restart+0xc/0x50) The following race condition triggers here: _request_firmware_load() device_create_file(...) kobject_uevent(...) (schedule) (resume) firmware_loading_store(1) firmware_loading_store(0) list_del_init(&buf->pending_list) (schedule) (resume) list_add(&buf->pending_list, &pending_fw_head); wait_for_completion(&buf->completion); causing an oops later when walking pending_list after the firmware has been released. The proposed fix is to move the list_add() before sysfs attribute creation. Signed-off-by: Maxime Bizon <mbizon@freebox.fr> Acked-by: Ming Lei <ming.lei@canonical.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-01-06firmware: Avoid deadlock of usermodehelper lock at shutdownTakashi Iwai
When a system goes to reboot/shutdown, it tries to disable the usermode helper via usermodehelper_disable(). This might be blocked when a driver tries to load a firmware beforehand and it's stuck by some reason. For example, dell_rbu driver loads the firmware in non-hotplug mode and waits for user-space clearing the loading sysfs flag. If user-space doesn't clear the flag, it waits forever, thus blocks the reboot, too. As a workaround, in this patch, the firmware class driver registers a reboot notifier so that it can abort all pending f/w bufs before issuing usermodehelper_disable(). Signed-off-by: Takashi Iwai <tiwai@suse.de> Acked-by: Ming Lei <ming.lei@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Conflicts: drivers/base/firmware_class.c Change-Id: I7ff6c198cd34090e55845b9d4035b1e5dc86226b
2015-01-06staging: android: ashmem: Avoid deadlock with mmap/shrinkLaura Abbott
Both ashmem_mmap and ashmem_shrink take the ashmem_lock. It may be possible for ashmem_mmap to invoke ashmem_shrink: -000|mutex_lock(lock = 0x0) -001|ashmem_shrink(?, sc = 0x0) <--- try to take ashmem_mutex again -002|shrink_slab(shrink = 0xDA5F1CC0, nr_pages_scanned = 0, lru_pages -002|= -002|124) -003|try_to_free_pages(zonelist = 0x0, ?, ?, ?) -004|__alloc_pages_nodemask(gfp_mask = 21200, order = 1, zonelist = -004|0xC11D0940, -005|new_slab(s = 0xE4841E80, ?, node = -1) -006|__slab_alloc.isra.43.constprop.50(s = 0xE4841E80, gfpflags = -006|2148925462, ad -007|kmem_cache_alloc(s = 0xE4841E80, gfpflags = 208) -008|shmem_alloc_inode(?) -009|alloc_inode(sb = 0xE480E800) -010|new_inode_pseudo(?) -011|new_inode(?) -012|shmem_get_inode(sb = 0xE480E800, dir = 0x0, ?, dev = 0, flags = -012|187) -013|shmem_file_setup(?, ?, flags = 187) -014|ashmem_mmap(?, vma = 0xC5D64210) <---- Acquire ashmem_mutex -015|mmap_region(file = 0xDF8E2C00, addr = 1772974080, len = 233472, -015|flags = 57, -016|sys_mmap_pgoff(addr = 0, len = 230400, prot = 3, flags = 1, fd = -016|157, pgoff -017|ret_fast_syscall(asm) -->|exception -018|NUR:0x40097508(asm) ---|end of frame Avoid this deadlock by using mutex_trylock in ashmem_shrink; if the mutex is already held, do not attempt to shrink. Change-Id: I222bbf55856d5849da813b730de0636c80966c8e Reported-by: Matt Wagantall <mattw@codeaurora.org> Reported-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org> Reported-by: Osvaldo Banuelos <osvaldob@codeaurora.org> Reported-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org> Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
2015-01-06usb: gadget: f_audio_source: Fixed USB Audio Class Interface DescriptorAnson Jacob
Fixed Android Issue #56549. When both Vendor Class and Audio Class are activated for AOA 2.0, the baInterfaceNr of the AudioControl Interface Descriptor points to wrong interface numbers. They should be pointing to Audio Control Device and Audio Streaming interfaces. Replaced baInterfaceNr with the correct value. Change-Id: Iaa083f3d97c1f0fc9481bf87852b2b51278a6351 Signed-off-by: Anson Jacob <ansonkuzhumbil@gmail.com>
2015-01-06usb: gadget: f_audio_source: change max ISO packet sizeAnson Jacob
Re-applying from https://gitorious.org/shr/linux/commit/eb4c9d2db894c3492c0a848581bd4f6790f93d5f Most USB-AUDIO devices are limited to 256 byte for max iso buffer size. If a IN_EP_MAX_PACKET_SIZE is bigger than a USB-AUDIO device's max iso buffer size, it will cause noise. This patch will prevent this case as possibe by reducing packet size. When using 44.1khz, 2ch, 16bit audio data, if max packet size is bigger than 176 bytes, it's no problem. Credits to: Iliyan Malchev <malchev@google.com> Change-Id: Ic2a1c19ea65d5fb42bf12926b51b255b465d7215 Signed-off-by: Anson Jacob <ansonkuzhumbil@gmail.com>
2015-01-06video: adf: Cleanup sw_sync timeline at adf_device_destroyJonathan Hamilton
If a sw_sync timeline was created by ADF (for drivers that do not implement ops->complete_fence) we should clean it up when the ADF device is destroyed. Change-Id: Idd90180fcae56a87111f7d12bdd80190756a6b80 Signed-off-by: Jonathan Hamilton <jonathan.hamilton@imgtec.com>
2015-01-06HID: steelseries: validate output report detailsKees Cook
A HID device could send a malicious output report that would cause the steelseries HID driver to write beyond the output report allocation during initialization, causing a heap overflow: [ 167.981534] usb 1-1: New USB device found, idVendor=1038, idProduct=1410 ... [ 182.050547] BUG kmalloc-256 (Tainted: G W ): Redzone overwritten CVE-2013-2891 Signed-off-by: Kees Cook <keescook@chromium.org> Cc: stable@vger.kernel.org Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2015-01-06usb: gadget: f_accessory: Enabled Zero Length Packet (ZLP) for acc_writeAnson Jacob
Accessory connected to Android Device requires Zero Length Packet (ZLP) to be written when data transferred out from the Android device are multiples of wMaxPacketSize (64bytes (Full-Speed) / 512bytes (High-Speed)) to end the transfer. Change-Id: Ib2c2c0ab98ef9afa10e74a720142deca5c0ed476 Signed-off-by: Anson Jacob <ansonkuzhumbil@gmail.com>
2015-01-06input: Made keyreset more robustDaniel Rosenberg
Switched do_restart to run in a seperate workqueue to handle cases where kernel_restart hangs. Change-Id: I1ecd61f8d0859f1a86d37c692351d644b5db9c69 Signed-off-by: Daniel Rosenberg <drosen@google.com>
2015-01-06power: Add property CHARGE_COUNTER_EXT and 64-bit precision propertiesTodd Poynor
Add POWER_SUPPLY_PROP_CHARGE_COUNTER_EXT that stores accumulated charge in nAh units as a signed 64-bit value. Add generic support for signed 64-bit property values. Change-Id: I2bd34b1e95ffba24e7bfef81f398f22bd2aaf05e Signed-off-by: Todd Poynor <toddpoynor@google.com>
2015-01-06cpufreq: fix sleeping in atomic context when realloc freq_table for ↵Minsung Kim
all_time_in_state Commit 40cf2f8 (cpufreq: Persist cpufreq time in state data across hotplug) causes the following call trace to be spit on boot: BUG: sleeping function called from invalid context at mm/slub.c:936 in_atomic(): 1, irqs_disabled(): 0, pid: 1, name: swapper/0 CPU: 6 PID: 1 Comm: swapper/0 Not tainted 3.10.9-20140624.172707-eng-gd6c0f69-dirty #50 Backtrace: [<c0012270>] (dump_backtrace+0x0/0x10c) from [<c001256c>] (show_stack+0x18/0x1c) r6:ffff1788 r5:c0c020c0 r4:e609c000 r3:00000000 [<c0012554>] (show_stack+0x0/0x1c) from [<c07a2970>] (dump_stack+0x20/0x28) [<c07a2950>] (dump_stack+0x0/0x28) from [<c0057678>] (__might_sleep+0x104/0x120) [<c0057574>] (__might_sleep+0x0/0x120) from [<c00ff000>] (__kmalloc_track_caller+0x144/0x274) r6:00000000 r5:e609c000 r4:e6802140 [<c00feebc>] (__kmalloc_track_caller+0x0/0x274) from [<c00da098>] (krealloc+0x58/0xb0) [<c00da040>] (krealloc+0x0/0xb0) from [<c050266c>] (cpufreq_allstats_create+0x120/0x204) r8:e4c4ff00 r7:c0d266b8 r6:0013d620 r5:e4c4e600 r4:00000001 r3:e535d6d0 [<c050254c>] (cpufreq_allstats_create+0x0/0x204) from [<c0502e38>] (cpufreq_stat_notifier_policy+0xb8/0xd0) [<c0502d80>] (cpufreq_stat_notifier_policy+0x0/0xd0) from [<c00517cc>] (notifier_call_chain+0x4c/0x8c) r5:00000000 r4:fffffffe [<c0051780>] (notifier_call_chain+0x0/0x8c) from [<c00519fc>] (__blocking_notifier_call_chain+0x50/0x68) r8:c0cd4d00 r7:00000002 r6:e609dd7c r5:ffffffff r4:c0d25a4c r3:ffffffff [<c00519ac>] (__blocking_notifier_call_chain+0x0/0x68) from [<c0051a34>] (blocking_notifier_call_chain+0x20/0x28) r7:c0e24f30 r6:00000000 r5:e53e1e00 r4:e609dd7c [<c0051a14>] (blocking_notifier_call_chain+0x0/0x28) from [<c0500fec>] (__cpufreq_set_policy+0xc0/0x1d0) [<c0500f2c>] (__cpufreq_set_policy+0x0/0x1d0) from [<c0501308>] (cpufreq_add_dev_interface+0x20c/0x270) r7:00000008 r6:00000000 r5:e53e1e00 r4:e53e1e58 [<c05010fc>] (cpufreq_add_dev_interface+0x0/0x270) from [<c05016a8>] (cpufreq_add_dev+0x33c/0x420) [<c050136c>] (cpufreq_add_dev+0x0/0x420) from [<c03604a4>] (subsys_interface_register+0x80/0xbc) [<c0360424>] (subsys_interface_register+0x0/0xbc) from [<c050035c>] (cpufreq_register_driver+0x8c/0x194) Change-Id: If77a656d0ea60a8fc4083283d104509fa6c07f8f Signed-off-by: Minsung Kim <ms925.kim@samsung.com>
2015-01-06cpufreq: Persist cpufreq time in state data across hotplugRuchi Kandoi
Cpufreq time_in_state data for all CPUs is made persistent across hotplug and exposed to userspace via sysfs file /sys/devices/system/cpu/cpufreq/all_time_in_state Change-Id: I97cb5de24b6de16189bf8b5df9592d0a6e6ddf32 Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>