[RFC][PATCH] epoll: allow EPOLLWAKEUP flag if PM_SLEEP is enabled

2013-11-11 Thread Amit Pundir
I stumbled upon ENOMEM error from epoll_ctl() while bringing up Android-4.4 
on a device that does not yet support PM_SLEEP.

While looking into the problem, I found that ep_create_wakeup_source()
reports ENOMEM if wakeup_source_register() returns NULL.
ep_create_wakeup_source() assumes that NULL is only returned if we run
into ENOMEM but NULL is also returned when CONFIG_PM_SLEEP is disabled.

If CONFIG_PM_SLEEP is disabled, stripping the EPOLLWAKEUP flag seems to
be a reasonable solution here, allowing the call to succeed, while
dropping the wakeup logic.  While returning EINVAL might also be a good
solution, stripping the flag seems to follow the established behavior,
as is done when the process doesn't have sufficient capabilities to
block suspend.

I'd appreciate any thoughts or feedback!

Signed-off-by: Amit Pundir amit.pun...@linaro.org
---
 fs/eventpoll.c |3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 473e09d..7a83079 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1820,7 +1820,8 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
goto error_tgt_fput;
 
/* Check if EPOLLWAKEUP is allowed */
-   if ((epds.events  EPOLLWAKEUP)  !capable(CAP_BLOCK_SUSPEND))
+   if ((epds.events  EPOLLWAKEUP) 
+   (!capable(CAP_BLOCK_SUSPEND) || !IS_ENABLED(CONFIG_PM_SLEEP)))
epds.events = ~EPOLLWAKEUP;
 
/*
-- 
1.7.10.4

--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[RFC][PATCH v2] epoll: allow EPOLLWAKEUP flag if PM_SLEEP is enabled

2013-11-12 Thread Amit Pundir
ep_create_wakeup_source() reports ENOMEM if wakeup_source_register()
returns NULL. ep_create_wakeup_source() assumes that NULL is only
returned if we run into ENOMEM but NULL is also returned when
CONFIG_PM_SLEEP is disabled.

Signed-off-by: Amit Pundir amit.pun...@linaro.org
---
Changed in v2:
Using static inline functions instead of #ifdefs
---
 fs/eventpoll.c |3 +--
 include/uapi/linux/eventpoll.h |   12 
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 473e09d..10f9c43 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1820,8 +1820,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
goto error_tgt_fput;
 
/* Check if EPOLLWAKEUP is allowed */
-   if ((epds.events  EPOLLWAKEUP)  !capable(CAP_BLOCK_SUSPEND))
-   epds.events = ~EPOLLWAKEUP;
+   ep_epollwakeup_check(epds.events);
 
/*
 * We have to check that the file structure underneath the file 
descriptor
diff --git a/include/uapi/linux/eventpoll.h b/include/uapi/linux/eventpoll.h
index 2c267bc..1d139c2 100644
--- a/include/uapi/linux/eventpoll.h
+++ b/include/uapi/linux/eventpoll.h
@@ -62,4 +62,16 @@ struct epoll_event {
 } EPOLL_PACKED;
 
 
+#ifdef CONFIG_PM_SLEEP
+static inline void ep_epollwakeup_check(__u32 *epev)
+{
+   if ((*epev  EPOLLWAKEUP)  !capable(CAP_BLOCK_SUSPEND))
+   *epev = ~EPOLLWAKEUP;
+}
+#else
+static inline void ep_epollwakeup_check(__u32 *epev)
+{
+   *epev = ~EPOLLWAKEUP;
+}
+#endif
 #endif /* _UAPI_LINUX_EVENTPOLL_H */
-- 
1.7.10.4

--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [RFC][PATCH v2] epoll: allow EPOLLWAKEUP flag if PM_SLEEP is enabled

2013-11-13 Thread Amit Pundir
On 13 November 2013 05:29, Rafael J. Wysocki r...@sisk.pl wrote:
 On Wednesday, November 13, 2013 02:22:28 AM Amit Pundir wrote:
 ep_create_wakeup_source() reports ENOMEM

 That needs to be fixed too.  I suppose we can make the 
 wakeup_source_register()
 stub for CONFIG_PM_SLEEP unset return ERR_PTR(-ENOSYS) or something like that
 and ep_create_wakeup_source() return that instead of -ENOMEM.  It looks like
 eventpoll.c is the only user of it built for CONFIG_PM_SLEEP unset, but that
 needs to be double checked.

Instead of modifying wakeup_source_register() stub, what if I make
ep_create_wakeup_source() static inline as well and use its stub to
return -ENOSYS when CONFIG_PM_SLEEP is not set?
ep_create_wakeup_source() is used only in fs/eventpoll.c anyway.


 if wakeup_source_register()
 returns NULL. ep_create_wakeup_source() assumes that NULL is only
 returned if we run into ENOMEM but NULL is also returned when
 CONFIG_PM_SLEEP is disabled.

 Signed-off-by: Amit Pundir amit.pun...@linaro.org
 ---
 Changed in v2:
 Using static inline functions instead of #ifdefs
 ---
  fs/eventpoll.c |3 +--
  include/uapi/linux/eventpoll.h |   12 
  2 files changed, 13 insertions(+), 2 deletions(-)

 diff --git a/fs/eventpoll.c b/fs/eventpoll.c
 index 473e09d..10f9c43 100644
 --- a/fs/eventpoll.c
 +++ b/fs/eventpoll.c
 @@ -1820,8 +1820,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
   goto error_tgt_fput;

   /* Check if EPOLLWAKEUP is allowed */
 - if ((epds.events  EPOLLWAKEUP)  !capable(CAP_BLOCK_SUSPEND))
 - epds.events = ~EPOLLWAKEUP;
 + ep_epollwakeup_check(epds.events);

 The check part of the name kind of suggests that the function will not 
 change
 things.  What about ep_adjust_epollwakeup() or something along these lines?

I see couple of ep_set_* functions in eventpoll.c. Does it make sense
to have something like ep_set_epollwakeup()?


 And why don't you pass a pointer to epds to it?  Wouldn't it be cleaner this 
 way?

Ok.

Regards,
Amit Pundir



   /*
* We have to check that the file structure underneath the file 
 descriptor
 diff --git a/include/uapi/linux/eventpoll.h b/include/uapi/linux/eventpoll.h
 index 2c267bc..1d139c2 100644
 --- a/include/uapi/linux/eventpoll.h
 +++ b/include/uapi/linux/eventpoll.h
 @@ -62,4 +62,16 @@ struct epoll_event {
  } EPOLL_PACKED;


 +#ifdef CONFIG_PM_SLEEP
 +static inline void ep_epollwakeup_check(__u32 *epev)
 +{
 + if ((*epev  EPOLLWAKEUP)  !capable(CAP_BLOCK_SUSPEND))
 + *epev = ~EPOLLWAKEUP;
 +}
 +#else
 +static inline void ep_epollwakeup_check(__u32 *epev)
 +{
 + *epev = ~EPOLLWAKEUP;
 +}
 +#endif
  #endif /* _UAPI_LINUX_EVENTPOLL_H */

 Thanks!

 --
 I speak only for myself.
 Rafael J. Wysocki, Intel Open Source Technology Center.
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [RFC][PATCH v2] epoll: allow EPOLLWAKEUP flag if PM_SLEEP is enabled

2013-11-14 Thread Amit Pundir
On 14 November 2013 03:14, Rafael J. Wysocki r...@sisk.pl wrote:
 On Wednesday, November 13, 2013 01:35:38 PM Amit Pundir wrote:
 On 13 November 2013 05:29, Rafael J. Wysocki r...@sisk.pl wrote:
  On Wednesday, November 13, 2013 02:22:28 AM Amit Pundir wrote:
  ep_create_wakeup_source() reports ENOMEM
 
  That needs to be fixed too.  I suppose we can make the 
  wakeup_source_register()
  stub for CONFIG_PM_SLEEP unset return ERR_PTR(-ENOSYS) or something like 
  that
  and ep_create_wakeup_source() return that instead of -ENOMEM.  It looks 
  like
  eventpoll.c is the only user of it built for CONFIG_PM_SLEEP unset, but 
  that
  needs to be double checked.

 Instead of modifying wakeup_source_register() stub, what if I make
 ep_create_wakeup_source() static inline as well and use its stub to
 return -ENOSYS when CONFIG_PM_SLEEP is not set?
 ep_create_wakeup_source() is used only in fs/eventpoll.c anyway.

 Well, you can do that too.


On second thought we may skip modifying ep_create_wakeup_source() or
wakeup_source_register() altogether because once we drop EPOLLWAKEUP
from epoll events mask(if PM_SLEEP is unset) then I don't see us
running into ep_create_wakeup_source() again. And the only reason for
ep_create_wakeup_source() failure will be -ENOMEM as far as I can see.

  if wakeup_source_register()
  returns NULL. ep_create_wakeup_source() assumes that NULL is only
  returned if we run into ENOMEM but NULL is also returned when
  CONFIG_PM_SLEEP is disabled.
 
  Signed-off-by: Amit Pundir amit.pun...@linaro.org
  ---
  Changed in v2:
  Using static inline functions instead of #ifdefs
  ---
   fs/eventpoll.c |3 +--
   include/uapi/linux/eventpoll.h |   12 
   2 files changed, 13 insertions(+), 2 deletions(-)
 
  diff --git a/fs/eventpoll.c b/fs/eventpoll.c
  index 473e09d..10f9c43 100644
  --- a/fs/eventpoll.c
  +++ b/fs/eventpoll.c
  @@ -1820,8 +1820,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, 
  fd,
goto error_tgt_fput;
 
/* Check if EPOLLWAKEUP is allowed */
  - if ((epds.events  EPOLLWAKEUP)  !capable(CAP_BLOCK_SUSPEND))
  - epds.events = ~EPOLLWAKEUP;
  + ep_epollwakeup_check(epds.events);
 
  The check part of the name kind of suggests that the function will not 
  change
  things.  What about ep_adjust_epollwakeup() or something along these lines?

 I see couple of ep_set_* functions in eventpoll.c. Does it make sense
 to have something like ep_set_epollwakeup()?

 This particular one doesn't really set anything.  I suppose that a name like
 ep_take_care_of_epollwakeup might be somewhat closer to what it really does 
 ...

I'm running out of ideas on this one, lets go with
ep_take_care_of_epollwakeup.

Regards,
Amit Pundir


 Thanks!

 --
 I speak only for myself.
 Rafael J. Wysocki, Intel Open Source Technology Center.
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH v3] epoll: drop EPOLLWAKEUP if PM_SLEEP is disabled

2013-11-14 Thread Amit Pundir
Drop EPOLLWAKEUP from epoll events mask if CONFIG_PM_SLEEP is disabled.

Signed-off-by: Amit Pundir amit.pun...@linaro.org
---
Changes in v3:
 Renamed ep_epollwakeup_check() to ep_take_care_of_epollwakeup().
 Didn't update ep_create_wakeup_source() to return -ENOSYS if PM_SLEEP is unset.
---
 fs/eventpoll.c |3 +--
 include/uapi/linux/eventpoll.h |   13 -
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 473e09d..dbf382b 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1820,8 +1820,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
goto error_tgt_fput;
 
/* Check if EPOLLWAKEUP is allowed */
-   if ((epds.events  EPOLLWAKEUP)  !capable(CAP_BLOCK_SUSPEND))
-   epds.events = ~EPOLLWAKEUP;
+   ep_take_care_of_epollwakeup(epds);
 
/*
 * We have to check that the file structure underneath the file 
descriptor
diff --git a/include/uapi/linux/eventpoll.h b/include/uapi/linux/eventpoll.h
index 2c267bc..bc81fb2 100644
--- a/include/uapi/linux/eventpoll.h
+++ b/include/uapi/linux/eventpoll.h
@@ -61,5 +61,16 @@ struct epoll_event {
__u64 data;
 } EPOLL_PACKED;
 
-
+#ifdef CONFIG_PM_SLEEP
+static inline void ep_take_care_of_epollwakeup(struct epoll_event *epev)
+{
+   if ((epev-events  EPOLLWAKEUP)  !capable(CAP_BLOCK_SUSPEND))
+   epev-events = ~EPOLLWAKEUP;
+}
+#else
+static inline void ep_take_care_of_epollwakeup(struct epoll_event *epev)
+{
+   epev-events = ~EPOLLWAKEUP;
+}
+#endif
 #endif /* _UAPI_LINUX_EVENTPOLL_H */
-- 
1.7.10.4

--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[RFC][PATCH 2/2] PM: Suspend: Print wall time at suspend entry and exit

2014-08-01 Thread Amit Pundir
From: Todd Poynor toddpoy...@google.com

Existing printk timestamps in a dmesg only log suspend activities
(e.g. filesystem syncs, freezing/unfreezing tasks etc) while the
system has already started to enter/exit the suspend state. Sometimes
it is handy to have suspend entry/exit overhead information while
debugging suspend issues. This patch print markers with wall
timestamps at suspend Entry and Exit in the kernel log. These
timestamps can be used to compute how long the system spent in
low-power suspend state plus the entry/exit overhead.

This patch comes from the Android patch set, where its been used to
help diagnose battery life problems in various Android-based devices.

Cc: Pavel Machek pa...@ucw.cz
Cc: Thomas Gleixner t...@linutronix.de
Cc: Rafael J. Wysocki r...@rjwysocki.net
Cc: Len Brown len.br...@intel.com
Cc: linux...@vger.kernel.org
Cc: Android Kernel Team kernel-t...@android.com
Cc: John Stultz john.stu...@linaro.org
Cc: Sumit Semwal sumit.sem...@linaro.org
Signed-off-by: Todd Poynor toddpoy...@google.com
[Amit Pundir: Reworded the commit message]
Signed-off-by: Amit Pundir amit.pun...@linaro.org
---

The original patch was submitted to linux-pm couple of years back but
I could not trace any feedback or activity thereafter. Hence I'm
resubmitting this change.

 kernel/power/suspend.c |   15 +++
 1 file changed, 15 insertions(+)

diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index ed35a47..28726b6 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -26,6 +26,7 @@
 #include linux/suspend.h
 #include linux/syscore_ops.h
 #include linux/ftrace.h
+#include linux/rtc.h
 #include trace/events/power.h
 #include linux/compiler.h
 
@@ -417,6 +418,18 @@ static int enter_state(suspend_state_t state)
return error;
 }
 
+static void pm_suspend_marker(char *annotation)
+{
+   struct timespec ts;
+   struct rtc_time tm;
+
+   getnstimeofday(ts);
+   rtc_time_to_tm(ts.tv_sec, tm);
+   pr_info(PM: suspend %s %d-%02d-%02d %02d:%02d:%02d.%09lu UTC\n,
+   annotation, tm.tm_year + 1900, tm.tm_mon + 1, tm.tm_mday,
+   tm.tm_hour, tm.tm_min, tm.tm_sec, ts.tv_nsec);
+}
+
 /**
  * pm_suspend - Externally visible function for suspending the system.
  * @state: System sleep state to enter.
@@ -431,6 +444,7 @@ int pm_suspend(suspend_state_t state)
if (state = PM_SUSPEND_ON || state = PM_SUSPEND_MAX)
return -EINVAL;
 
+   pm_suspend_marker(entry);
error = enter_state(state);
if (error) {
suspend_stats.fail++;
@@ -438,6 +452,7 @@ int pm_suspend(suspend_state_t state)
} else {
suspend_stats.success++;
}
+   pm_suspend_marker(exit);
return error;
 }
 EXPORT_SYMBOL(pm_suspend);
-- 
1.7.10.4

--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[RFC][PATCH 1/2] PM: Print pending wakeup IRQ preventing suspend to dmesg

2014-08-01 Thread Amit Pundir
From: Todd Poynor toddpoy...@google.com

Currently when a pending wakeup irq stops suspend, it can be difficult
to determine why suspend was prevented and which IRQ was actually
responsible.

In order to help debug these situations, this patch prints the IRQ
number and action name of that pending wakeup irq which prevents suspend.
This patch comes from the Android patch set, where its been used to debug
suspend problems.

Cc: Pavel Machek pa...@ucw.cz
Cc: Thomas Gleixner t...@linutronix.de
Cc: Rafael J. Wysocki r...@rjwysocki.net
Cc: Len Brown len.br...@intel.com
Cc: linux...@vger.kernel.org
Cc: Android Kernel Team kernel-t...@android.com
Cc: John Stultz john.stu...@linaro.org
Cc: Sumit Semwal sumit.sem...@linaro.org
Signed-off-by: Todd Poynor toddpoy...@google.com
[Amit Pundir: Reworded the commit message]
Signed-off-by: Amit Pundir amit.pun...@linaro.org
---
 kernel/irq/pm.c |7 ++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/kernel/irq/pm.c b/kernel/irq/pm.c
index abcd6ca..c2bc8d9 100644
--- a/kernel/irq/pm.c
+++ b/kernel/irq/pm.c
@@ -109,8 +109,13 @@ int check_wakeup_irqs(void)
 * can abort suspend.
 */
if (irqd_is_wakeup_set(desc-irq_data)) {
-   if (desc-depth == 1  desc-istate  IRQS_PENDING)
+   if (desc-depth == 1  desc-istate  IRQS_PENDING) {
+   pr_info(Wakeup IRQ %d %s pending, suspend 
aborted\n,
+   irq,
+   desc-action  desc-action-name ?
+   desc-action-name : );
return -EBUSY;
+   }
continue;
}
/*
-- 
1.7.10.4

--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[RFC][PATCH 0/2] Minor Suspend debugging patches from Android

2014-08-01 Thread Amit Pundir
Couple of PM patches from Android tree printing Suspend debug messages.
These messages are used to help debug PM related issues on Android based
devices and look useful enough to troubleshoot PM issues on generic Linux
devices as well.

I'd greatly appreciate any feedback or comments!

Todd Poynor (2):
  PM: Print pending wakeup IRQ preventing suspend to dmesg
  PM: Suspend: Print wall time at suspend entry and exit

 kernel/irq/pm.c|7 ++-
 kernel/power/suspend.c |   15 +++
 2 files changed, 21 insertions(+), 1 deletion(-)

Cc: Todd Poynor toddpoy...@google.com
Cc: Pavel Machek pa...@ucw.cz
Cc: Thomas Gleixner t...@linutronix.de
Cc: Rafael J. Wysocki r...@rjwysocki.net
Cc: Len Brown len.br...@intel.com
Cc: linux...@vger.kernel.org
Cc: Android Kernel Team kernel-t...@android.com
Cc: John Stultz john.stu...@linaro.org
Cc: Sumit Semwal sumit.sem...@linaro.org
-- 
1.7.10.4

--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH v2] PM: Print pending wakeup IRQ preventing suspend

2014-09-18 Thread Amit Pundir
From: Todd Poynor toddpoy...@google.com

Currently when a pending wakeup irq stops suspend, it can be difficult
to determine why suspend was prevented and which IRQ was actually
responsible. In order to help debug such situation, this patch prints the
IRQ number and action name of that pending wakeup irq.

Cc: Pavel Machek pa...@ucw.cz
Cc: Thomas Gleixner t...@linutronix.de
Cc: Rafael J. Wysocki r...@rjwysocki.net
Cc: Len Brown len.br...@intel.com
Cc: linux...@vger.kernel.org
Cc: Android Kernel Team kernel-t...@android.com
Acked-by: Pavel Machek pa...@ucw.cz
Signed-off-by: Todd Poynor toddpoy...@google.com
[Amit Pundir: Reworded the commit message]
Signed-off-by: Amit Pundir amit.pun...@linaro.org
---
Resending this patch assuming that it might have got lost in between merge
window rush last time and now people might have some time to look at it.
 
 kernel/irq/pm.c | 7 ++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/kernel/irq/pm.c b/kernel/irq/pm.c
index abcd6ca..c2bc8d9 100644
--- a/kernel/irq/pm.c
+++ b/kernel/irq/pm.c
@@ -109,8 +109,13 @@ int check_wakeup_irqs(void)
 * can abort suspend.
 */
if (irqd_is_wakeup_set(desc-irq_data)) {
-   if (desc-depth == 1  desc-istate  IRQS_PENDING)
+   if (desc-depth == 1  desc-istate  IRQS_PENDING) {
+   pr_info(Wakeup IRQ %d %s pending, suspend 
aborted\n,
+   irq,
+   desc-action  desc-action-name ?
+   desc-action-name : );
return -EBUSY;
+   }
continue;
}
/*
-- 
1.9.1

--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[PATCH v2] PM: Print wall time at suspend entry and exit

2014-09-18 Thread Amit Pundir
From: Todd Poynor toddpoy...@google.com

Existing timestamps in a dmesg only log suspend activities
(e.g. filesystem syncs, freezing/unfreezing tasks etc) while the
system has already started to enter/exit the suspend state.

Sometimes it is handy to have suspend entry/exit overhead
information while debugging suspend issues. This patch print
markers with wall timestamps at suspend Entry and Exit in
the kernel log. These timestamps can be used to compute how
long the system spent in low-power suspend state plus the
entry/exit overhead.

Cc: Pavel Machek pa...@ucw.cz
Cc: Thomas Gleixner t...@linutronix.de
Cc: Rafael J. Wysocki r...@rjwysocki.net
Cc: Len Brown len.br...@intel.com
Cc: linux...@vger.kernel.org
Cc: Android Kernel Team kernel-t...@android.com
Signed-off-by: Todd Poynor toddpoy...@google.com
[Amit Pundir: Reworded the commit message]
Signed-off-by: Amit Pundir amit.pun...@linaro.org
---
Resending this patch assuming that it might have got lost in between merge
window rush last time and now people might have some time to look at it.

 kernel/power/suspend.c | 15 +++
 1 file changed, 15 insertions(+)

diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index 18c6219..5390c6c 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -26,6 +26,7 @@
 #include linux/suspend.h
 #include linux/syscore_ops.h
 #include linux/ftrace.h
+#include linux/rtc.h
 #include trace/events/power.h
 #include linux/compiler.h
 
@@ -443,6 +444,18 @@ static int enter_state(suspend_state_t state)
return error;
 }
 
+static void pm_suspend_marker(char *annotation)
+{
+   struct timespec ts;
+   struct rtc_time tm;
+
+   getnstimeofday(ts);
+   rtc_time_to_tm(ts.tv_sec, tm);
+   pr_info(PM: suspend %s %d-%02d-%02d %02d:%02d:%02d.%09lu UTC\n,
+   annotation, tm.tm_year + 1900, tm.tm_mon + 1, tm.tm_mday,
+   tm.tm_hour, tm.tm_min, tm.tm_sec, ts.tv_nsec);
+}
+
 /**
  * pm_suspend - Externally visible function for suspending the system.
  * @state: System sleep state to enter.
@@ -457,6 +470,7 @@ int pm_suspend(suspend_state_t state)
if (state = PM_SUSPEND_ON || state = PM_SUSPEND_MAX)
return -EINVAL;
 
+   pm_suspend_marker(entry);
error = enter_state(state);
if (error) {
suspend_stats.fail++;
@@ -464,6 +478,7 @@ int pm_suspend(suspend_state_t state)
} else {
suspend_stats.success++;
}
+   pm_suspend_marker(exit);
return error;
 }
 EXPORT_SYMBOL(pm_suspend);
-- 
1.9.1

--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH v2] android: binder: fix binder mmap failures

2015-03-01 Thread Amit Pundir
On 27 February 2015 at 23:14, Andrey Ryabinin a.ryabi...@samsung.com wrote:
 binder_update_page_range() initializes only addr and size
 fields in 'struct vm_struct tmp_area;' and passes it to
 map_vm_area().

 Before 71394fe50146 (mm: vmalloc: add flag preventing guard hole allocation)
 this was because map_vm_area() didn't use any other fields
 in vm_struct except addr and size.

 Now get_vm_area_size() (used in map_vm_area()) reads vm_struct's
 flags to determine whether vm area has guard hole or not.

 binder_update_page_range() don't initialize flags field, so
 this causes following binder mmap failures:
 ---[ cut here ]
 WARNING: CPU: 0 PID: 1971 at mm/vmalloc.c:130
 vmap_page_range_noflush+0x119/0x144()
 CPU: 0 PID: 1971 Comm: healthd Not tainted 4.0.0-rc1-00399-g7da3fdc-dirty #157
 Hardware name: ARM-Versatile Express
 [c001246d] (unwind_backtrace) from [c000f7f9] (show_stack+0x11/0x14)
 [c000f7f9] (show_stack) from [c049a221] (dump_stack+0x59/0x7c)
 [c049a221] (dump_stack) from [c001cf21] (warn_slowpath_common+0x55/0x84)
 [c001cf21] (warn_slowpath_common) from [c001cfe3]
 (warn_slowpath_null+0x17/0x1c)
 [c001cfe3] (warn_slowpath_null) from [c00c66c5]
 (vmap_page_range_noflush+0x119/0x144)
 [c00c66c5] (vmap_page_range_noflush) from [c00c716b] 
 (map_vm_area+0x27/0x48)
 [c00c716b] (map_vm_area) from [c038ddaf]
 (binder_update_page_range+0x12f/0x27c)
 [c038ddaf] (binder_update_page_range) from [c038e857]
 (binder_mmap+0xbf/0x1ac)
 [c038e857] (binder_mmap) from [c00c2dc7] (mmap_region+0x2eb/0x4d4)
 [c00c2dc7] (mmap_region) from [c00c3197] (do_mmap_pgoff+0x1e7/0x250)
 [c00c3197] (do_mmap_pgoff) from [c00b35b5] (vm_mmap_pgoff+0x45/0x60)
 [c00b35b5] (vm_mmap_pgoff) from [c00c1f39] (SyS_mmap_pgoff+0x5d/0x80)
 [c00c1f39] (SyS_mmap_pgoff) from [c000ce81] (ret_fast_syscall+0x1/0x5c)
 ---[ end trace 48c2c4b9a1349e54 ]---
 binder: 1982: binder_alloc_buf failed to map page at f0e0 in kernel
 binder: binder_mmap: 1982 b6bde000-b6cdc000 alloc small buf failed -12

 Use map_kernel_range_noflush() instead of map_vm_area() as this is better
 API for binder's purposes and it allows to get rid of 'vm_struct tmp_area' at 
 all.

 Fixes: 71394fe50146 (mm: vmalloc: add flag preventing guard hole allocation)
 Signed-off-by: Andrey Ryabinin a.ryabi...@samsung.com
 Reported-by: Amit Pundir amit.pun...@linaro.org
 ---
  Changes since v1:
- fixed ret check after map_kernel_ranges_noflush().

  drivers/android/binder.c | 10 +-
  1 file changed, 5 insertions(+), 5 deletions(-)

 diff --git a/drivers/android/binder.c b/drivers/android/binder.c
 index 33b09b6..6607f3c 100644
 --- a/drivers/android/binder.c
 +++ b/drivers/android/binder.c
 @@ -551,7 +551,6 @@ static int binder_update_page_range(struct binder_proc 
 *proc, int allocate,
  {
 void *page_addr;
 unsigned long user_page_addr;
 -   struct vm_struct tmp_area;
 struct page **page;
 struct mm_struct *mm;

 @@ -600,10 +599,11 @@ static int binder_update_page_range(struct binder_proc 
 *proc, int allocate,
 proc-pid, page_addr);
 goto err_alloc_page_failed;
 }
 -   tmp_area.addr = page_addr;
 -   tmp_area.size = PAGE_SIZE + PAGE_SIZE /* guard page? */;
 -   ret = map_vm_area(tmp_area, PAGE_KERNEL, page);
 -   if (ret) {
 +   ret = map_kernel_range_noflush((unsigned long)page_addr,
 +   PAGE_SIZE, PAGE_KERNEL, page);
 +   flush_cache_vmap((unsigned long)page_addr,
 +   (unsigned long)page_addr + PAGE_SIZE);
 +   if (ret != 1) {
 pr_err(%d: binder_alloc_buf failed to map page at %p 
 in kernel\n,
proc-pid, page_addr);
 goto err_map_kernel_failed;
 --

Works for me. Thanks.

Tested-by: Amit Pundir amit.pun...@linaro.org

 2.3.0

 --
 To unsubscribe from this list: send the line unsubscribe linux-kernel in
 the body of a message to majord...@vger.kernel.org
 More majordomo info at  http://vger.kernel.org/majordomo-info.html
 Please read the FAQ at  http://www.tux.org/lkml/
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Regression in v4.0.0-rc1 with Android Binder

2015-02-26 Thread Amit Pundir
Hi,

I ran into series of following binder mmap failures with v4.0.0-rc1:
[ cut here ]
WARNING: CPU: 0 PID: 1971 at mm/vmalloc.c:130
vmap_page_range_noflush+0x119/0x144()
CPU: 0 PID: 1971 Comm: healthd Not tainted 4.0.0-rc1-00399-g7da3fdc-dirty #157
Hardware name: ARM-Versatile Express
[c001246d] (unwind_backtrace) from [c000f7f9] (show_stack+0x11/0x14)
[c000f7f9] (show_stack) from [c049a221] (dump_stack+0x59/0x7c)
[c049a221] (dump_stack) from [c001cf21] (warn_slowpath_common+0x55/0x84)
[c001cf21] (warn_slowpath_common) from [c001cfe3]
(warn_slowpath_null+0x17/0x1c)
[c001cfe3] (warn_slowpath_null) from [c00c66c5]
(vmap_page_range_noflush+0x119/0x144)
[c00c66c5] (vmap_page_range_noflush) from [c00c716b] (map_vm_area+0x27/0x48)
[c00c716b] (map_vm_area) from [c038ddaf]
(binder_update_page_range+0x12f/0x27c)
[c038ddaf] (binder_update_page_range) from [c038e857]
(binder_mmap+0xbf/0x1ac)
[c038e857] (binder_mmap) from [c00c2dc7] (mmap_region+0x2eb/0x4d4)
[c00c2dc7] (mmap_region) from [c00c3197] (do_mmap_pgoff+0x1e7/0x250)
[c00c3197] (do_mmap_pgoff) from [c00b35b5] (vm_mmap_pgoff+0x45/0x60)
[c00b35b5] (vm_mmap_pgoff) from [c00c1f39] (SyS_mmap_pgoff+0x5d/0x80)
[c00c1f39] (SyS_mmap_pgoff) from [c000ce81] (ret_fast_syscall+0x1/0x5c)
---[ end trace 48c2c4b9a1349e54 ]---
binder: 1982: binder_alloc_buf failed to map page at f0e0 in kernel
binder: binder_mmap: 1982 b6bde000-b6cdc000 alloc small buf failed -12


Turned out that the following commit tripped off binder:
--8--
commit 71394fe50146202f2c8d92cf50f5ebc761acf254
Author: Andrey Ryabinin a.ryabi...@samsung.com
Date:   Fri Feb 13 14:40:03 2015 -0800

mm: vmalloc: add flag preventing guard hole allocation
--8--


Explicitly disabling the vmalloc no guard (VM_NO_GUARD) flag in binder
worked fine for me. So does a fix like this look reasonable enough to
submit?
--8--
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -601,6 +601,7 @@ static int binder_update_page_range(struct
binder_proc *proc, int allocate,
goto err_alloc_page_failed;
}
tmp_area.addr = page_addr;
+   tmp_area.flags = ~VM_NO_GUARD;
tmp_area.size = PAGE_SIZE + PAGE_SIZE /* guard page? */;
ret = map_vm_area(tmp_area, PAGE_KERNEL, page);
if (ret) {
--8--


Regards,
Amit Pundir
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[RFC][PATCH 0/2] usb: gadget: add MTP function and Uevent userspace notifications

2015-08-13 Thread Amit Pundir
RFC on Android's ConfigFS based MTP function implementation and usage
of Uevents to notify the userspace about the USB state changes.

The MTP function is based on years of work originally done in the
Android kernel tree by:
Mike Lockwood lockw...@android.com
Benoit Goby ben...@android.com
Colin Cross ccr...@android.com
Arve Hjønnevåg a...@android.com
Peter Oh p...@broadcom.com
Greg Hackmann ghackm...@google.com
Badhri Jagan Sridharan bad...@google.com

The Uevent notification patch is more of an RFC than an actual
submission. It is based on Android patchset originaly authored by
Badhri to send uevent notifications to Android userpace for USB
state changes.

I've folded the series up to make it easier to review, provided a
coherent patch description and modified it enough that I don't want
them to be blamed for any mistakes I've made condensing their patches
down.

Thoughts and feedback would be appreciated.

Thanks,
Amit Pundir

Cc: Mike Lockwood lockw...@android.com
Cc: Benoit Goby ben...@android.com
Cc: Colin Cross ccr...@android.com
Cc: Arve Hjønnevåg a...@android.com
Cc: Peter Oh p...@broadcom.com
Cc: Greg Hackmann ghackm...@google.com
Cc: Badhri Jagan Sridharan bad...@google.com
Cc: Android Kernel Team kernel-t...@android.com
Cc: Greg Kroah-Hartman gre...@linuxfoundation.org
Cc: Jonathan Corbet cor...@lwn.net
Cc: Felipe Balbi ba...@ti.com
Cc: Andrzej Pietrasiewicz andrze...@samsung.com
Cc: Laurent Pinchart laurent.pinch...@ideasonboard.com
Cc: Yegor Yefremov yegorsli...@googlemail.com
Cc: Philippe Reynes trem...@gmail.com
Cc: John Stultz john.stu...@linaro.org
Cc: Sumit Semwal sumit.sem...@linaro.org

Amit Pundir (2):
  usb: gadget: configfs: add MTP function
  usb: gadget: configfs: notify userspace of usb state changes

 Documentation/ABI/testing/configfs-usb-gadget-mtp |7 +
 Documentation/usb/gadget-testing.txt  |   24 +
 drivers/usb/gadget/Kconfig|   21 +
 drivers/usb/gadget/configfs.c |  201 ++-
 drivers/usb/gadget/function/Makefile  |2 +
 drivers/usb/gadget/function/f_mtp.c   | 1365 +
 include/linux/usb/f_mtp.h |   23 +
 include/uapi/linux/usb/f_mtp.h|   61 +
 8 files changed, 1702 insertions(+), 2 deletions(-)
 create mode 100644 Documentation/ABI/testing/configfs-usb-gadget-mtp
 create mode 100644 drivers/usb/gadget/function/f_mtp.c
 create mode 100644 include/linux/usb/f_mtp.h
 create mode 100644 include/uapi/linux/usb/f_mtp.h

-- 
1.9.1

--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[RFC][PATCH 2/2] usb: gadget: configfs: notify userspace of usb state changes

2015-08-13 Thread Amit Pundir
This is more of an RFC than an actual submission. There are few
scattered #ifdefs..#endifs here and there which still need to be
taken care of before going for actual submission.

Currently there is no way with the upstream ConfigFS gadget to
communicate state changes (connected, disconnected, configured), at
the gadget level. Instead such state changes are handled function by
function independently I presume. This is problematic, because some
coordination between the functions, across the state changes, may be
desired at the userspace level. Thus to address this issue, this
patch send uevents to allow userspace to be notified of these usb
state changes, allowing userspace to respond and configure the
configfs gadget appropriately.

This patch is based on an Android patchset originaly authored by
Badhri Jagan Sridharan bad...@google.com to send uevent notifications
to Android userpace for USB state changes. I've folded his patches
together and modified it enough that I don't want him to be blamed for
any mistakes I've made condensing his patches down.

This patch introduces USB_CONFIGFS_UEVENT Kconfig to handle userspace
notifications of usb state changes, and add setup and disconnect
functions to intercept the setup requests from the usb_core. It also
creates a sysfs device class entry and a device attribute (state) to
read and respond to gadget's current state from userspace. As of now
this sysfs device class (/sys/class/android_usb) and gadget device
(/sys/class/android_usb/android0) with state attribute
(/sys/class/android_usb/android0/state) are strictly tied up to
facilitate Android userspace requests. But going forward we may want
to bring all function devices (hid, printer etc) under a unified usb
gadget device class e.g. /sys/class/usb_gadget/g_{func0,func1} etc..

Also I think it make sense to add this state attribute to the configfs
usb gadget itself i.e. have something like /config/usb_gadget/g1/state
to read USB gadget's current state. Since it is going to be consistent
throughout all the functions tied up to that gadget.

Again this is just an initial RFC, thoughts and feedback would be
greatly appreciated.

Cc: Mike Lockwood lockw...@android.com
Cc: Benoit Goby ben...@android.com
Cc: Colin Cross ccr...@android.com
Cc: Arve Hjønnevåg a...@android.com
Cc: Peter Oh p...@broadcom.com
Cc: Greg Hackmann ghackm...@google.com
Cc: Badhri Jagan Sridharan bad...@google.com
Cc: Android Kernel Team kernel-t...@android.com
Cc: Greg Kroah-Hartman gre...@linuxfoundation.org
Cc: Jonathan Corbet cor...@lwn.net
Cc: Felipe Balbi ba...@ti.com
Cc: Andrzej Pietrasiewicz andrze...@samsung.com
Cc: Laurent Pinchart laurent.pinch...@ideasonboard.com
Cc: Yegor Yefremov yegorsli...@googlemail.com
Cc: Philippe Reynes trem...@gmail.com
Cc: John Stultz john.stu...@linaro.org
Cc: Sumit Semwal sumit.sem...@linaro.org
Signed-off-by: Amit Pundir amit.pun...@linaro.org
---
 drivers/usb/gadget/Kconfig|   8 ++
 drivers/usb/gadget/configfs.c | 201 +-
 2 files changed, 207 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 65d110d..e1d1fc1 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -464,6 +464,14 @@ config USB_CONFIGFS_F_MTP
  the file level. Thus exposing the relevant content but hiding
  the system/restricted files.
 
+config USB_CONFIGFS_UEVENT
+   bool Uevent notification of Gadget state
+   depends on USB_CONFIGFS
+   help
+ Enable uevent notifications to userspace when the gadget
+ state changes. The gadget can be in any of the following
+ three states: CONNECTED/DISCONNECTED/CONFIGURED
+
 source drivers/usb/gadget/legacy/Kconfig
 
 endchoice
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 289e201..1575343 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -9,6 +9,15 @@
 #include u_f.h
 #include u_os_desc.h
 
+#ifdef CONFIG_USB_CONFIGFS_UEVENT
+#include linux/platform_device.h
+#include linux/kdev_t.h
+#include linux/usb/ch9.h
+
+static struct class *usb_gadget_class;
+static struct device *usb_gadget_device;
+#endif
+
 int check_user_usb_string(const char *name,
struct usb_gadget_strings *stringtab_dev)
 {
@@ -63,6 +72,12 @@ struct gadget_info {
bool use_os_desc;
char b_vendor_code;
char qw_sign[OS_STRING_QW_SIGN_LEN];
+#ifdef CONFIG_USB_CONFIGFS_UEVENT
+   bool connected;
+   bool sw_connected;
+   struct work_struct work;
+   struct device *dev;
+#endif
 };
 
 struct config_usb_cfg {
@@ -1444,13 +1459,143 @@ static void configfs_composite_unbind(struct 
usb_gadget *gadget)
set_gadget_data(gadget, NULL);
 }
 
+#ifdef CONFIG_USB_CONFIGFS_UEVENT
+static ssize_t state_show(struct device *pdev, struct device_attribute *attr,
+   char *buf)
+{
+   struct gadget_info *dev = dev_get_drvdata(pdev

[RFC][PATCH 1/2] usb: gadget: configfs: add MTP function

2015-08-13 Thread Amit Pundir
This MTP function is based on years of work originally done in the
Android kernel tree by:
Mike Lockwood lockw...@android.com
Benoit Goby ben...@android.com
Colin Cross ccr...@android.com
Arve Hjønnevåg a...@android.com
Peter Oh p...@broadcom.com
Greg Hackmann ghackm...@google.com
Badhri Jagan Sridharan bad...@google.com
I've folded the series up to make it easier to review, and to provide
a coherent patch description.

Post Gingerbread (Android v2.3), Android dropped USB Mass Storage
in favor of Media Transfer Protocal (MTP), which is widely used for
transferring media files to digital music players and similar
applications. This USB gadget function implements MTP functionalty.

Historically this function has been a part of Android composite
gadget driver. Android composite driver was Android's solution
for dynamic gadget function switching prior to the ConfigFS gadget
being merged. There were failed few attempts in past
http://marc.info/?l=linux-usbm=132451695808552 to upstream Android
composite driver as well. Now this Android MTP gadget function has been
re-implemented so as to be used as a generic ConfigFS function instead.

Again, many thanks to Mike, Benoit, Colin, Arve, Peter, Greg and Badhri,
as they are the real authors of this work. However, I've folded their
patches together and modified it enough that I don't want them to be
blamed for any mistakes I've made condensing their patches down.

Cc: Mike Lockwood lockw...@android.com
Cc: Benoit Goby ben...@android.com
Cc: Colin Cross ccr...@android.com
Cc: Arve Hjønnevåg a...@android.com
Cc: Peter Oh p...@broadcom.com
Cc: Greg Hackmann ghackm...@google.com
Cc: Badhri Jagan Sridharan bad...@google.com
Cc: Android Kernel Team kernel-t...@android.com
Cc: Greg Kroah-Hartman gre...@linuxfoundation.org
Cc: Jonathan Corbet cor...@lwn.net
Cc: Felipe Balbi ba...@ti.com
Cc: Andrzej Pietrasiewicz andrze...@samsung.com
Cc: Laurent Pinchart laurent.pinch...@ideasonboard.com
Cc: Yegor Yefremov yegorsli...@googlemail.com
Cc: Philippe Reynes trem...@gmail.com
Cc: John Stultz john.stu...@linaro.org
Cc: Sumit Semwal sumit.sem...@linaro.org
Signed-off-by: Amit Pundir amit.pun...@linaro.org
---
 Documentation/ABI/testing/configfs-usb-gadget-mtp |7 +
 Documentation/usb/gadget-testing.txt  |   24 +
 drivers/usb/gadget/Kconfig|   13 +
 drivers/usb/gadget/function/Makefile  |2 +
 drivers/usb/gadget/function/f_mtp.c   | 1365 +
 include/linux/usb/f_mtp.h |   23 +
 include/uapi/linux/usb/f_mtp.h|   61 +
 7 files changed, 1495 insertions(+)
 create mode 100644 Documentation/ABI/testing/configfs-usb-gadget-mtp
 create mode 100644 drivers/usb/gadget/function/f_mtp.c
 create mode 100644 include/linux/usb/f_mtp.h
 create mode 100644 include/uapi/linux/usb/f_mtp.h

diff --git a/Documentation/ABI/testing/configfs-usb-gadget-mtp 
b/Documentation/ABI/testing/configfs-usb-gadget-mtp
new file mode 100644
index 000..6738bee
--- /dev/null
+++ b/Documentation/ABI/testing/configfs-usb-gadget-mtp
@@ -0,0 +1,7 @@
+What:  /config/usb-gadget/gadget/functions/mtp.name
+Date:  Aug 2015
+KernelVersion: 4.2
+Description:   The purpose of this directory is to create and remove it.
+
+   A corresponding USB function instance is created/removed.
+   There are no attributes here.
diff --git a/Documentation/usb/gadget-testing.txt 
b/Documentation/usb/gadget-testing.txt
index 5926780..7fb8494d4 100644
--- a/Documentation/usb/gadget-testing.txt
+++ b/Documentation/usb/gadget-testing.txt
@@ -20,6 +20,7 @@ provided by gadgets.
 17. UAC2 function
 18. UVC function
 19. PRINTER function
+20. MTP function
 
 
 1. ACM function
@@ -771,3 +772,26 @@ host:
 
 More advanced testing can be done with the prn_example
 described in Documentation/usb/gadget-printer.txt.
+
+20. MTP function
+===
+
+The function is provided by usb_f_mtp.ko module.
+
+Function-specific configfs interface
+
+
+The function name to use when creating the function directory is mtp.
+The function directory is intentionally empty and has no attributes as such.
+
+After creating the mtp function directory, link mtp function with the gadget
+configuration by creating symbolic link, enable the gadget by writing a
+suitable string to usb_gadget/gadget/UDC and start the mtp userspace daemon.
+
+Testing the mtp function
+
+
+On the device: enable the gadget, and start the mtp userspace daemon.
+On the host: if configured correctly the media storage device should auto-mount
+itself, or use Linux mtp-tools package to browse/transfer the media content
+instead.
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index bcf83c0..65d110d 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -199,6 +199,9 @@ config USB_F_HID
 config USB_F_PRINTER

Re: [RFC][PATCH 1/2] usb: gadget: configfs: add MTP function

2015-08-14 Thread Amit Pundir
On 14 August 2015 at 02:11, Krzysztof Opasiak k.opas...@samsung.com wrote:


 On 08/13/2015 09:57 PM, Greg Kroah-Hartman wrote:

 On Thu, Aug 13, 2015 at 09:34:46PM +0200, Krzysztof Opasiak wrote:

 Hello,

 On 08/13/2015 09:12 PM, Amit Pundir wrote:

 his MTP function is based on years of work originally done in the
 Android kernel tree by:
  Mike Lockwoodlockw...@android.com
  Benoit Gobyben...@android.com
  Colin Crossccr...@android.com
  Arve Hjønnevåga...@android.com
  Peter Ohp...@broadcom.com
  Greg Hackmannghackm...@google.com
  Badhri Jagan Sridharanbad...@google.com
 I've folded the series up to make it easier to review, and to provide
 a coherent patch description.

 Post Gingerbread (Android v2.3), Android dropped USB Mass Storage
 in favor of Media Transfer Protocal (MTP), which is widely used for
 transferring media files to digital music players and similar
 applications. This USB gadget function implements MTP functionalty.

 Historically this function has been a part of Android composite
 gadget driver. Android composite driver was Android's solution
 for dynamic gadget function switching prior to the ConfigFS gadget
 being merged. There were failed few attempts in past
 http://marc.info/?l=linux-usbm=132451695808552  to upstream Android
 composite driver as well. Now this Android MTP gadget function has been
 re-implemented so as to be used as a generic ConfigFS function instead.

 Again, many thanks to Mike, Benoit, Colin, Arve, Peter, Greg and Badhri,
 as they are the real authors of this work. However, I've folded their
 patches together and modified it enough that I don't want them to be
 blamed for any mistakes I've made condensing their patches down.

 Cc: Mike Lockwoodlockw...@android.com
 Cc: Benoit Gobyben...@android.com
 Cc: Colin Crossccr...@android.com
 Cc: Arve Hjønnevåga...@android.com
 Cc: Peter Ohp...@broadcom.com
 Cc: Greg Hackmannghackm...@google.com
 Cc: Badhri Jagan Sridharanbad...@google.com
 Cc: Android Kernel Teamkernel-t...@android.com
 Cc: Greg Kroah-Hartmangre...@linuxfoundation.org
 Cc: Jonathan Corbetcor...@lwn.net
 Cc: Felipe Balbiba...@ti.com
 Cc: Andrzej Pietrasiewiczandrze...@samsung.com
 Cc: Laurent Pinchartlaurent.pinch...@ideasonboard.com
 Cc: Yegor Yefremovyegorsli...@googlemail.com
 Cc: Philippe Reynestrem...@gmail.com
 Cc: John Stultzjohn.stu...@linaro.org
 Cc: Sumit Semwalsumit.sem...@linaro.org
 Signed-off-by: Amit Pundiramit.pun...@linaro.org


 In my humble opinion adding such function to Linux kernel doesn't make
 any
 sense. By design, MTP is a protocol which requires access to userspace
 features esp. file system. It is very important to run MTP daemon with
 suitable user and LSM label and many many other issues which should be
 handled by userspace access policy.

 Moreover this is not a fully functional USB function but only some
 interface
 which can be used by mtp-responder (mtp-daemon - call it as you like) to
 communicate with host. As we have FunctionFS which allows to implement
 any
 USB function in as a userspace service. As MTP nature is more related to
 userspace I think that porting MTP daemon to use this is a right way to
 go.
 This should be much more reasonable than adding new function which also
 requires daemon for proper working. So why add another interface while we
 can use a generic one?

Fairly valid point. I did see MTP mentioned in FunctionFS context in
Documentation/usb/functionfs.txt but I could not find an open
userpsace MTP daemon implementation based on F_FS to try.



 Isn't there already a userspace MTP daemon that uses the existing
 functionfs for usb gadgets?  I thought I remember seeing that
 somewhere...


 I've found some interesting link[2] which may mean that Sailfish OS guys has
 some mtp implementation with functionfs backend:

  cite

 - /dev/mtp
 mtp functionfs rw,relatime

 cite

 Started digging and got it!

 This looks like mtp with ffs backend:

 https://github.com/nemomobile/buteo-mtp

Thanks for the pointer. This buteo-mtp looks interesting.

Regards,
Amit Pundir


 Didn't tested, even didn't try to compile, no guarantee;)

 Footnotes:
 1 -
 http://reviewjolla.blogspot.com/2014/06/techspecs-android-on-jolla-phone.html


 Best regards,

 --
 Krzysztof Opasiak
 Samsung RD Institute Poland
 Samsung Electronics
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH] config: Add android config fragments

2016-06-22 Thread Amit Pundir
On 8 June 2016 at 22:09, Rob Herring <r...@kernel.org> wrote:
> Copy the config fragments from the AOSP common kernel tree. It is
> becoming possible to run mainline kernels with Android, but the kernel
> defconfigs don't work as-is and debugging missing config options is a
> pain. Adding the config fragments into the kernel tree, makes
> configuring a mainline kernel as simple as:
>
> make ARCH=arm multi_v7_defconfig android-base.config 
> android-recommended.config
>
> Cc: Amit Pundir <amit.pun...@linaro.org>
> Cc: John Stultz <john.stu...@linaro.org>
> Cc: Dmitry Torokhov <dmitry.torok...@gmail.com>
> Cc: Rom Lemarchand <rom...@android.com>
> Signed-off-by: Rob Herring <r...@kernel.org>
> ---
>  kernel/configs/android-base.config| 161 
> ++
>  kernel/configs/android-recommended.config | 121 ++
>  2 files changed, 282 insertions(+)
>  create mode 100644 kernel/configs/android-base.config
>  create mode 100644 kernel/configs/android-recommended.config
>
> diff --git a/kernel/configs/android-base.config 
> b/kernel/configs/android-base.config
> new file mode 100644
> index 000..44fa01d
> --- /dev/null
> +++ b/kernel/configs/android-base.config
> @@ -0,0 +1,161 @@
> +#  KEEP ALPHABETICALLY SORTED
> +# CONFIG_DEVKMEM is not set
> +# CONFIG_DEVMEM is not set
> +# CONFIG_INET_LRO is not set
> +# CONFIG_MODULES is not set
> +# CONFIG_OABI_COMPAT is not set
> +# CONFIG_SYSVIPC is not set
> +CONFIG_ANDROID=y
> +CONFIG_ANDROID_BINDER_IPC=y
> +CONFIG_ANDROID_LOW_MEMORY_KILLER=y
> +CONFIG_ARMV8_DEPRECATED=y
> +CONFIG_ASHMEM=y
> +CONFIG_AUDIT=y
> +CONFIG_BLK_DEV_DM=y
> +CONFIG_BLK_DEV_INITRD=y
> +CONFIG_CGROUPS=y
> +CONFIG_CGROUP_CPUACCT=y
> +CONFIG_CGROUP_DEBUG=y
> +CONFIG_CGROUP_FREEZER=y
> +CONFIG_CGROUP_SCHED=y
> +CONFIG_CP15_BARRIER_EMULATION=y
> +CONFIG_DM_CRYPT=y
> +CONFIG_DM_VERITY=y
> +CONFIG_EMBEDDED=y
> +CONFIG_FB=y
> +CONFIG_HIGH_RES_TIMERS=y
> +CONFIG_INET6_AH=y
> +CONFIG_INET6_ESP=y
> +CONFIG_INET6_IPCOMP=y
> +CONFIG_INET=y
> +CONFIG_INET_ESP=y
> +CONFIG_INET_XFRM_MODE_TUNNEL=y
> +CONFIG_IP6_NF_FILTER=y
> +CONFIG_IP6_NF_IPTABLES=y
> +CONFIG_IP6_NF_MANGLE=y
> +CONFIG_IP6_NF_RAW=y
> +CONFIG_IP6_NF_TARGET_REJECT=y
> +CONFIG_IP6_NF_TARGET_REJECT_SKERR=y
> +CONFIG_IPV6=y
> +CONFIG_IPV6_MIP6=y
> +CONFIG_IPV6_MULTIPLE_TABLES=y
> +CONFIG_IPV6_OPTIMISTIC_DAD=y
> +CONFIG_IPV6_PRIVACY=y
> +CONFIG_IPV6_ROUTER_PREF=y
> +CONFIG_IPV6_ROUTE_INFO=y
> +CONFIG_IP_ADVANCED_ROUTER=y
> +CONFIG_IP_MULTIPLE_TABLES=y
> +CONFIG_IP_NF_ARPFILTER=y
> +CONFIG_IP_NF_ARPTABLES=y
> +CONFIG_IP_NF_ARP_MANGLE=y
> +CONFIG_IP_NF_FILTER=y
> +CONFIG_IP_NF_IPTABLES=y
> +CONFIG_IP_NF_MANGLE=y
> +CONFIG_IP_NF_MATCH_AH=y
> +CONFIG_IP_NF_MATCH_ECN=y
> +CONFIG_IP_NF_MATCH_TTL=y
> +CONFIG_IP_NF_RAW=y
> +CONFIG_IP_NF_SECURITY=y
> +CONFIG_IP_NF_TARGET_MASQUERADE=y
> +CONFIG_IP_NF_TARGET_NETMAP=y
> +CONFIG_IP_NF_TARGET_REDIRECT=y
> +CONFIG_IP_NF_TARGET_REJECT=y
> +CONFIG_IP_NF_TARGET_REJECT_SKERR=y
> +CONFIG_NET=y
> +CONFIG_NETDEVICES=y
> +CONFIG_NETFILTER=y
> +CONFIG_NETFILTER_TPROXY=y
> +CONFIG_NETFILTER_XT_MATCH_COMMENT=y
> +CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=y
> +CONFIG_NETFILTER_XT_MATCH_CONNMARK=y
> +CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
> +CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y
> +CONFIG_NETFILTER_XT_MATCH_HELPER=y
> +CONFIG_NETFILTER_XT_MATCH_IPRANGE=y
> +CONFIG_NETFILTER_XT_MATCH_LENGTH=y
> +CONFIG_NETFILTER_XT_MATCH_LIMIT=y
> +CONFIG_NETFILTER_XT_MATCH_MAC=y
> +CONFIG_NETFILTER_XT_MATCH_MARK=y
> +CONFIG_NETFILTER_XT_MATCH_PKTTYPE=y
> +CONFIG_NETFILTER_XT_MATCH_POLICY=y
> +CONFIG_NETFILTER_XT_MATCH_QTAGUID=y
> +CONFIG_NETFILTER_XT_MATCH_QUOTA2=y
> +CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG=y
> +CONFIG_NETFILTER_XT_MATCH_QUOTA=y
> +CONFIG_NETFILTER_XT_MATCH_SOCKET=y
> +CONFIG_NETFILTER_XT_MATCH_STATE=y
> +CONFIG_NETFILTER_XT_MATCH_STATISTIC=y
> +CONFIG_NETFILTER_XT_MATCH_STRING=y
> +CONFIG_NETFILTER_XT_MATCH_TIME=y
> +CONFIG_NETFILTER_XT_MATCH_U32=y
> +CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y
> +CONFIG_NETFILTER_XT_TARGET_CONNMARK=y
> +CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=y
> +CONFIG_NETFILTER_XT_TARGET_IDLETIMER=y
> +CONFIG_NETFILTER_XT_TARGET_MARK=y
> +CONFIG_NETFILTER_XT_TARGET_NFLOG=y
> +CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y
> +CONFIG_NETFILTER_XT_TARGET_SECMARK=y
> +CONFIG_NETFILTER_XT_TARGET_TCPMSS=y
> +CONFIG_NETFILTER_XT_TARGET_TPROXY=y
> +CONFIG_NETFILTER_XT_TARGET_TRACE=y
> +CONFIG_NET_CLS_ACT=y
> +CONFIG_NET_CLS_U32=y
> +CONFIG_NET_EMATCH=y
> +CONFIG_NET_EMATCH_U32=y
> +CONFIG_NET_KEY=y
> +CONFIG_NET_SCHED=y
> +CONFIG_NET_SCH_HTB=y
>

Re: [PATCH] config: Add android config fragments

2016-06-23 Thread Amit Pundir
On 23 June 2016 at 08:50, Rob Herring <r...@kernel.org> wrote:
> On Wed, Jun 22, 2016 at 2:53 AM, Amit Pundir <amit.pun...@linaro.org> wrote:
>> On 8 June 2016 at 22:09, Rob Herring <r...@kernel.org> wrote:
>>> Copy the config fragments from the AOSP common kernel tree. It is
>>> becoming possible to run mainline kernels with Android, but the kernel
>>> defconfigs don't work as-is and debugging missing config options is a
>>> pain. Adding the config fragments into the kernel tree, makes
>>> configuring a mainline kernel as simple as:
>>>
>>> make ARCH=arm multi_v7_defconfig android-base.config 
>>> android-recommended.config
>>>
>>> Cc: Amit Pundir <amit.pun...@linaro.org>
>>> Cc: John Stultz <john.stu...@linaro.org>
>>> Cc: Dmitry Torokhov <dmitry.torok...@gmail.com>
>>> Cc: Rom Lemarchand <rom...@android.com>
>>> Signed-off-by: Rob Herring <r...@kernel.org>
>>> ---
>>>  kernel/configs/android-base.config| 161 
>>> ++
>>>  kernel/configs/android-recommended.config | 121 ++
>
> [...]
>
>>> +CONFIG_STAGING=y
>>> +CONFIG_SWITCH=y
>>
>> Switch Class support is dropped from kernel/common/android-4.4 sometime back.
>
> Okay. I'm also removing these options in v2 which don't exist in
> upstream. Any comments on them?
>
> IP6_NF_TARGET_REJECT_SKERR
> IP_NF_TARGET_REJECT_SKERR
> NETFILTER_XT_MATCH_QTAGUID
> NETFILTER_XT_MATCH_QUOTA2
> NETFILTER_XT_MATCH_QUOTA2_LOG
> PPPOLAC
> PPPOPNS
> RESOURCE_COUNTERS
> SECURITY_PERF_EVENTS_RESTRICT
> USB_CONFIGFS_F_MTP
> USB_CONFIGFS_F_PTP
> USB_CONFIGFS_F_ACC
> USB_CONFIGFS_F_AUDIO_SRC
> USB_CONFIGFS_UEVENT
> USB_OTG_WAKELOCK
> ANDROID_TIMED_GPIO
> ARM_KERNMEM_PERMS
> INPUT_KEYCHORD
> INPUT_KEYRESET
> TABLET_USB_WACOM

In my opinion we can keep the core configs (usb gadget, netfilter,
input key et al.). They will not harm the resulting kernel config
anyway. And we can definitely drop following configs from v2:

IP6_NF_TARGET_REJECT_SKERR
IP_NF_TARGET_REJECT_SKERR
RESOURCE_COUNTERS
ANDROID_TIMED_GPIO
ARM_KERNMEM_PERMS
TABLET_USB_WACOM


Also please add the following options in v2, which are present in
android-4.4 configs but missing from v1.

In android-base.config:
CONFIG_DM_VERITY_FEC
CONFIG_INET_DIAG_DESTROY
CONFIG_IP_MULTICAST
CONFIG_IP_NF_NAT
CONFIG_QUOTA

In android-recommended.config:
CONFIG_DRAGONRISE_FF
CONFIG_TASKSTATS
CONFIG_TASK_DELAY_ACCT
CONFIG_TASK_IO_ACCOUNTING
CONFIG_TASK_XACCT

Regards,
Amit Pundir

>
> Rob


[PATCH v2] usb: gadget: rndis: free response queue during REMOTE_NDIS_RESET_MSG

2016-06-29 Thread Amit Pundir
From: Xerox Lin <xerox_...@htc.com>

When rndis data transfer is in progress, some Windows7 Host PC is not
sending the GET_ENCAPSULATED_RESPONSE command for receiving the response
for the previous SEND_ENCAPSULATED_COMMAND processed.

The rndis function driver appends each response for the
SEND_ENCAPSULATED_COMMAND in a queue. As the above process got corrupted,
the Host sends a REMOTE_NDIS_RESET_MSG command to do a soft-reset.
As the rndis response queue is not freed, the previous response is sent
as a part of this REMOTE_NDIS_RESET_MSG's reset response and the Host
block any more Rndis transfers.

Hence free the rndis response queue as a part of this soft-reset so that
the correct response for REMOTE_NDIS_RESET_MSG is sent properly during the
response command.

Signed-off-by: Rajkumar Raghupathy <rag...@codeaurora.org>
Signed-off-by: Xerox Lin <xerox_...@htc.com>
[AmitP: Cherry-picked this patch and folded other relevant
fixes from Android common kernel android-4.4]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
v2: Sanitized the name of original author. Dropped his email address from
the list of reviewers, since it is no longer valid.

v1: Cherry picked this usb tethering fix from AOSP kernel/common/android-4.4
tree and to make sure it doesn't get overlooked, submiting it for review
and comment.

 drivers/usb/gadget/function/rndis.c | 6 ++
 1 file changed, 6 insertions(+)

diff --git a/drivers/usb/gadget/function/rndis.c 
b/drivers/usb/gadget/function/rndis.c
index 943c21a..ab6ac1b 100644
--- a/drivers/usb/gadget/function/rndis.c
+++ b/drivers/usb/gadget/function/rndis.c
@@ -680,6 +680,12 @@ static int rndis_reset_response(struct rndis_params 
*params,
 {
rndis_reset_cmplt_type *resp;
rndis_resp_t *r;
+   u8 *xbuf;
+   u32 length;
+
+   /* drain the response queue */
+   while ((xbuf = rndis_get_next_response(params, )))
+   rndis_free_response(params, xbuf);
 
r = rndis_add_response(params, sizeof(rndis_reset_cmplt_type));
if (!r)
-- 
2.7.4



Re: [RFC][PATCH] usb: gadget: rndis: Free the response queue during REMOTE_NDIS_RESET_MSG

2016-02-08 Thread Amit Pundir
Please ignore this one. I build tested these patches in series and
turned out it can't be build independently because configNr is
deprecated. I'll resend this patch.

Nevertheless I'd like to get a feedback on the real problem this patch
is trying to solve here.

Thanks,
Amit Pundir

On 9 February 2016 at 01:37, Amit Pundir <amit.pun...@linaro.org> wrote:
> From: xerox_lin <xerox_...@htc.com>
>
> When rndis data transfer is in progress, some Windows7 Host PC is not
> sending the GET_ENCAPSULATED_RESPONSE command for receiving the response
> for the previous SEND_ENCAPSULATED_COMMAND processed.
>
> The rndis function driver appends each response for the
> SEND_ENCAPSULATED_COMMAND in a queue. As the above process got corrupted,
> the Host sends a REMOTE_NDIS_RESET_MSG command to do a soft-reset.
> As the rndis response queue is not freed, the previous response is sent
> as a part of this REMOTE_NDIS_RESET_MSG's reset response and the Host
> blocks any more Rndis transfers.
>
> Hence free the rndis response queue as a part of this soft-reset so that
> the current response for REMOTE_NDIS_RESET_MSG is sent properly during the
> response command.
>
> Cc: Felipe Balbi <ba...@kernel.org>
> Cc: Greg Kroah-Hartman <gre...@linuxfoundation.org>
> Cc: Andrzej Pietrasiewicz <andrze...@samsung.com>
> Cc: Badhri Jagan Sridharan <bad...@google.com>
> Cc: Android Kernel Team <kernel-t...@android.com>
> Cc: John Stultz <john.stu...@linaro.org>
> Cc: Sumit Semwal <sumit.sem...@linaro.org>
> Signed-off-by: Rajkumar Raghupathy <rag...@codeaurora.org>
> Signed-off-by: Xerox Lin <xerox_...@htc.com>
> [pundir: cherry-picked this patch from AOSP experimental/android-4.4 tree.]
> Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
> ---
> Cherry-picked this patch from AOSP common/experimental/android-4.4 tree.
> I could not find upstream submission history for this patch, so my
> apologies in advance if this has already been NACKed before.
>
>  drivers/usb/gadget/function/rndis.c | 7 +++
>  1 file changed, 7 insertions(+)
>
> diff --git a/drivers/usb/gadget/function/rndis.c 
> b/drivers/usb/gadget/function/rndis.c
> index 70d3917..27163e8 100644
> --- a/drivers/usb/gadget/function/rndis.c
> +++ b/drivers/usb/gadget/function/rndis.c
> @@ -681,6 +681,13 @@ static int rndis_reset_response(struct rndis_params 
> *params,
> rndis_reset_cmplt_type *resp;
> rndis_resp_t *r;
>
> +   u32 length;
> +   u8 *xbuf;
> +
> +   /* drain the response queue */
> +   while ((xbuf = rndis_get_next_response(configNr, )))
> +   rndis_free_response(configNr, xbuf);
> +
> r = rndis_add_response(params, sizeof(rndis_reset_cmplt_type));
> if (!r)
> return -ENOMEM;
> --
> 1.9.1
>


[RFC][PATCH v2] usb: gadget: u_ether: Fix data stall issue in RNDIS tethering mode

2016-02-08 Thread Amit Pundir
From: Badhri Jagan Sridharan <bad...@google.com>

For dual speed gadget, with current no. of request(10), there is
possibility of corner case occurrence where all 10 requests are queued
to HW without setting IOC bit, which could lead to data stall in
RNDIS tethering and RNDIS local networking.

With this patch, counter will be incremented before queueing request to
HW and sets IOC bit for every nth request due to which the corner case
of all requests queued to HW without IOC bit set will be avoided.

Cc: Felipe Balbi <ba...@kernel.org>
Cc: Greg Kroah-Hartman <gre...@linuxfoundation.org>
Cc: Mike Looijmans <mike.looijm...@topic.nl> 
Cc: Robert Baldyga <r.bald...@samsung.com>
Cc: Android Kernel Team <kernel-t...@android.com>
Cc: John Stultz <john.stu...@linaro.org>
Cc: Sumit Semwal <sumit.sem...@linaro.org>
Cc: Praneeth Bajjuri <prane...@ti.com>
Signed-off-by: Vijayavardhan Vennapusa <vvre...@codeaurora.org>
[pundir:
 * cherry-picked this patch from AOSP experimental/android-4.4 tree.
 * folded in an AOSP build fix from Praneeth Bajjuri <prane...@ti.com>]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
v2: folded in the build fix for v1 from AOSP. Updated the commit log.

v1: Cherry-picked this patch from AOSP common/experimental/android-4.4 tree.
I could not find upstream submission history for this patch, so my
apologies in advance if this has already been NACKed before.

 drivers/usb/gadget/function/u_ether.c | 25 +++--
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/drivers/usb/gadget/function/u_ether.c 
b/drivers/usb/gadget/function/u_ether.c
index 9a69332..7f98a2d 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -64,7 +64,7 @@ struct eth_dev {
 
spinlock_t  req_lock;   /* guard {rx,tx}_reqs */
struct list_headtx_reqs, rx_reqs;
-   atomic_ttx_qlen;
+   unsignedtx_qlen;
 
struct sk_buff_head rx_frames;
 
@@ -464,7 +464,6 @@ static void tx_complete(struct usb_ep *ep, struct 
usb_request *req)
spin_unlock(>req_lock);
dev_kfree_skb_any(skb);
 
-   atomic_dec(>tx_qlen);
if (netif_carrier_ok(dev->net))
netif_wake_queue(dev->net);
 }
@@ -584,12 +583,19 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
 
req->length = length;
 
-   /* throttle high/super speed IRQ rate back slightly */
-   if (gadget_is_dualspeed(dev->gadget))
-   req->no_interrupt = (dev->gadget->speed == USB_SPEED_HIGH ||
-dev->gadget->speed == USB_SPEED_SUPER)
-   ? ((atomic_read(>tx_qlen) % dev->qmult) != 0)
-   : 0;
+   /* throttle highspeed IRQ rate back slightly */
+   if (gadget_is_dualspeed(dev->gadget) &&
+(dev->gadget->speed == USB_SPEED_HIGH)) {
+   dev->tx_qlen++;
+   if (dev->tx_qlen == dev->qmult) {
+   req->no_interrupt = 0;
+   dev->tx_qlen = 0;
+   } else {
+   req->no_interrupt = 1;
+   }
+   } else {
+   req->no_interrupt = 0;
+   }
 
retval = usb_ep_queue(in, req, GFP_ATOMIC);
switch (retval) {
@@ -598,7 +604,6 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
break;
case 0:
net->trans_start = jiffies;
-   atomic_inc(>tx_qlen);
}
 
if (retval) {
@@ -625,7 +630,7 @@ static void eth_start(struct eth_dev *dev, gfp_t gfp_flags)
rx_fill(dev, gfp_flags);
 
/* and open the tx floodgates */
-   atomic_set(>tx_qlen, 0);
+   dev->tx_qlen = 0;
netif_wake_queue(dev->net);
 }
 
-- 
1.9.1



[RFC][PATCH] usb: gadget: prevent change of Host MAC address of 'usb0' interface

2016-02-08 Thread Amit Pundir
From: "taeju.park" <taeju.p...@lge.com>

On windows 7 platform, previously allocated ip address is maintained.
However, Host MAC address of 'usb0' interface is changed when the
tethering driver re-enumerated. Thus, the tethering network driver
can't be allocated ip address from dhcp. It causes connection delay
between host and phone for usb tethering.

This patch prevents from changing Host MAC address of 'usb0' interface.
In other words, this patch maintains the Host MAC address allocated when
first tethering driver although the driver is re-enumerated. However,
after reboot, the Host MAC address can be changed.

Cc: Felipe Balbi <ba...@kernel.org>
Cc: Greg Kroah-Hartman <gre...@linuxfoundation.org>
Cc: Mike Looijmans <mike.looijm...@topic.nl> 
Cc: Robert Baldyga <r.bald...@samsung.com>
Cc: Android Kernel Team <kernel-t...@android.com>
Cc: John Stultz <john.stu...@linaro.org>
Cc: Sumit Semwal <sumit.sem...@linaro.org>
Signed-off-by: Badhri Jagan Sridharan <bad...@google.com>
[pundir: cherry-picked this patch from AOSP experimental/android-4.4 tree.]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
Cherry-picked this patch from AOSP common/experimental/android-4.4 tree.
I could not find upstream submission history for this patch, so my
apologies in advance if this has already been NACKed before.

 drivers/usb/gadget/function/u_ether.c | 20 ++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/function/u_ether.c 
b/drivers/usb/gadget/function/u_ether.c
index 637809e..9a69332 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -698,6 +698,8 @@ static int eth_stop(struct net_device *net)
 
 /*-*/
 
+static u8 host_ethaddr[ETH_ALEN];
+
 static int get_ether_addr(const char *str, u8 *dev_addr)
 {
if (str) {
@@ -728,6 +730,17 @@ static int get_ether_addr_str(u8 dev_addr[ETH_ALEN], char 
*str, int len)
return 18;
 }
 
+static int get_host_ether_addr(u8 *str, u8 *dev_addr)
+{
+   memcpy(dev_addr, str, ETH_ALEN);
+   if (is_valid_ether_addr(dev_addr))
+   return 0;
+
+   random_ether_addr(dev_addr);
+   memcpy(str, dev_addr, ETH_ALEN);
+   return 1;
+}
+
 static const struct net_device_ops eth_netdev_ops = {
.ndo_open   = eth_open,
.ndo_stop   = eth_stop,
@@ -784,9 +797,12 @@ struct eth_dev *gether_setup_name(struct usb_gadget *g,
if (get_ether_addr(dev_addr, net->dev_addr))
dev_warn(>dev,
"using random %s ethernet address\n", "self");
-   if (get_ether_addr(host_addr, dev->host_mac))
+
+   if (get_host_ether_addr(host_ethaddr, dev->host_mac))
+   dev_warn(>dev, "using random %s ethernet address\n", "host");
+   else
dev_warn(>dev,
-   "using random %s ethernet address\n", "host");
+   "using previous %s ethernet address\n", "host");
 
if (ethaddr)
memcpy(ethaddr, dev->host_mac, ETH_ALEN);
-- 
1.9.1



[RFC][PATCH v2] usb: gadget: u_ether: Add workqueue as bottom half handler for rx data path

2016-02-08 Thread Amit Pundir
From: Badhri Jagan Sridharan <bad...@google.com>

u_ether driver passes rx data to network layer and resubmits the
request back to usb hardware in interrupt context. Network layer
processes rx data by scheduling tasklet. For high throughput
scenarios on rx data path driver is spending lot of time in interrupt
context due to rx data processing by tasklet and continuous completion
and re-submission of the usb requests which results in watchdog bark.
Hence move the rx data processing and usb request submission to a
workqueue bottom half handler.

Cc: Felipe Balbi <ba...@kernel.org>
Cc: Greg Kroah-Hartman <gre...@linuxfoundation.org>
Cc: Mike Looijmans <mike.looijm...@topic.nl> 
Cc: Robert Baldyga <r.bald...@samsung.com>
Cc: Android Kernel Team <kernel-t...@android.com>
Cc: John Stultz <john.stu...@linaro.org>
Cc: Sumit Semwal <sumit.sem...@linaro.org>
Cc: Praneeth Bajjuri <prane...@ti.com>
Signed-off-by: Badhri Jagan Sridharan <bad...@google.com>
[pundir:
 * cherry-picked this patch from AOSP experimental/android-4.4 tree.
 * folded in an AOSP build fix from Praneeth Bajjuri <prane...@ti.com>]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
v2: Folded in the build fix for v1 from AOSP. Updated the commit log.

v1: Cherry-picked this patch from AOSP common/experimental/android-4.4 tree.
I could not find upstream submission history for this patch, so my
apologies in advance if this has already been NACKed before.

 drivers/usb/gadget/function/u_ether.c | 119 +++---
 1 file changed, 80 insertions(+), 39 deletions(-)

diff --git a/drivers/usb/gadget/function/u_ether.c 
b/drivers/usb/gadget/function/u_ether.c
index 7f98a2d..4235c33 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -53,6 +53,8 @@
  * blocks and still have efficient handling. */
 #define GETHER_MAX_ETH_FRAME_LEN 15412
 
+static struct workqueue_struct *uether_wq;
+
 struct eth_dev {
/* lock is held while accessing port_usb
 */
@@ -77,6 +79,7 @@ struct eth_dev {
struct sk_buff_head *list);
 
struct work_struct  work;
+   struct work_struct  rx_work;
 
unsigned long   todo;
 #defineWORK_RX_MEMORY  0
@@ -248,18 +251,16 @@ enomem:
DBG(dev, "rx submit --> %d\n", retval);
if (skb)
dev_kfree_skb_any(skb);
-   spin_lock_irqsave(>req_lock, flags);
-   list_add(>list, >rx_reqs);
-   spin_unlock_irqrestore(>req_lock, flags);
}
return retval;
 }
 
 static void rx_complete(struct usb_ep *ep, struct usb_request *req)
 {
-   struct sk_buff  *skb = req->context, *skb2;
+   struct sk_buff  *skb = req->context;
struct eth_dev  *dev = ep->driver_data;
int status = req->status;
+   boolqueue = 0;
 
switch (status) {
 
@@ -283,30 +284,8 @@ static void rx_complete(struct usb_ep *ep, struct 
usb_request *req)
} else {
skb_queue_tail(>rx_frames, skb);
}
-   skb = NULL;
-
-   skb2 = skb_dequeue(>rx_frames);
-   while (skb2) {
-   if (status < 0
-   || ETH_HLEN > skb2->len
-   || skb2->len > 
GETHER_MAX_ETH_FRAME_LEN) {
-   dev->net->stats.rx_errors++;
-   dev->net->stats.rx_length_errors++;
-   DBG(dev, "rx length %d\n", skb2->len);
-   dev_kfree_skb_any(skb2);
-   goto next_frame;
-   }
-   skb2->protocol = eth_type_trans(skb2, dev->net);
-   dev->net->stats.rx_packets++;
-   dev->net->stats.rx_bytes += skb2->len;
-
-   /* no buffer copies needed, unless hardware can't
-* use skb buffers.
-*/
-   status = netif_rx(skb2);
-next_frame:
-   skb2 = skb_dequeue(>rx_frames);
-   }
+   if (!status)
+   queue = 1;
break;
 
/* software-driven interface shutdown */
@@ -329,22 +308,20 @@ quiesce:
/* FALLTHROUGH */
 
default:
+   queue = 1;
+   dev_kfree_skb_any(skb);
dev->net->stats.rx_errors++;
DBG(dev, "rx status %d\n", status);
break;
}
 
-   if (skb)
-   dev_kfree_skb_any(skb);
-   if (!netif_running(dev->net)) {
 clean:
-  

Re: [RFC][PATCH] usb: gadget: u_ether: Add workqueue as bottom half handler for rx data path

2016-02-08 Thread Amit Pundir
Please ignore this one too. I should have build tested these patches
individually and not in particular series. I'll resend this patch.

Thanks,
Amit Pundir

On 9 February 2016 at 01:41, Amit Pundir <amit.pun...@linaro.org> wrote:
> From: Badhri Jagan Sridharan <bad...@google.com>
>
> u_ether driver passes rx data to network layer and resubmits the
> request back to usb hardware in interrupt context. Network layer
> processes rx data by scheduling tasklet. For high throughput
> scenarios on rx data path driver is spending lot of time in interrupt
> context due to rx data processing by tasklet and continuous completion
> and re-submission of the usb requests which results in watchdog bark.
> Hence move the rx data processing and usb request submission to a
> workqueue bottom half handler.
>
> Cc: Felipe Balbi <ba...@kernel.org>
> Cc: Greg Kroah-Hartman <gre...@linuxfoundation.org>
> Cc: Mike Looijmans <mike.looijm...@topic.nl>
> Cc: Robert Baldyga <r.bald...@samsung.com>
> Cc: Android Kernel Team <kernel-t...@android.com>
> Cc: John Stultz <john.stu...@linaro.org>
> Cc: Sumit Semwal <sumit.sem...@linaro.org>
> Signed-off-by: Badhri Jagan Sridharan <bad...@google.com>
> [pundir: cherry-picked this patch from AOSP experimental/android-4.4 tree.]
> Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
> ---
> Cherry-picked this patch from AOSP common/experimental/android-4.4 tree.
> I could not find upstream submission history for this patch, so my
> apologies in advance if this has already been NACKed before.
>
>  drivers/usb/gadget/function/u_ether.c | 119 
> +++---
>  1 file changed, 80 insertions(+), 39 deletions(-)
>
> diff --git a/drivers/usb/gadget/function/u_ether.c 
> b/drivers/usb/gadget/function/u_ether.c
> index 7f98a2d..4235c33 100644
> --- a/drivers/usb/gadget/function/u_ether.c
> +++ b/drivers/usb/gadget/function/u_ether.c
> @@ -53,6 +53,8 @@
>   * blocks and still have efficient handling. */
>  #define GETHER_MAX_ETH_FRAME_LEN 15412
>
> +static struct workqueue_struct *uether_wq;
> +
>  struct eth_dev {
> /* lock is held while accessing port_usb
>  */
> @@ -77,6 +79,7 @@ struct eth_dev {
> struct sk_buff_head *list);
>
> struct work_struct  work;
> +   struct work_struct  rx_work;
>
> unsigned long   todo;
>  #defineWORK_RX_MEMORY  0
> @@ -248,18 +251,16 @@ enomem:
> DBG(dev, "rx submit --> %d\n", retval);
> if (skb)
> dev_kfree_skb_any(skb);
> -   spin_lock_irqsave(>req_lock, flags);
> -   list_add(>list, >rx_reqs);
> -   spin_unlock_irqrestore(>req_lock, flags);
> }
> return retval;
>  }
>
>  static void rx_complete(struct usb_ep *ep, struct usb_request *req)
>  {
> -   struct sk_buff  *skb = req->context, *skb2;
> +   struct sk_buff  *skb = req->context;
> struct eth_dev  *dev = ep->driver_data;
> int status = req->status;
> +   boolqueue = 0;
>
> switch (status) {
>
> @@ -283,30 +284,8 @@ static void rx_complete(struct usb_ep *ep, struct 
> usb_request *req)
> } else {
> skb_queue_tail(>rx_frames, skb);
> }
> -   skb = NULL;
> -
> -   skb2 = skb_dequeue(>rx_frames);
> -   while (skb2) {
> -   if (status < 0
> -   || ETH_HLEN > skb2->len
> -   || skb2->len > 
> GETHER_MAX_ETH_FRAME_LEN) {
> -   dev->net->stats.rx_errors++;
> -   dev->net->stats.rx_length_errors++;
> -   DBG(dev, "rx length %d\n", skb2->len);
> -   dev_kfree_skb_any(skb2);
> -   goto next_frame;
> -   }
> -   skb2->protocol = eth_type_trans(skb2, dev->net);
> -   dev->net->stats.rx_packets++;
> -   dev->net->stats.rx_bytes += skb2->len;
> -
> -   /* no buffer copies needed, unless hardware can't
> -* use skb buffers.
> -*/
> -   status = netif_rx(skb2);
> -next_frame:
> -   skb2 = skb_dequeue(>rx_frames);
> -   }
> + 

[RFC][PATCH v2] usb: gadget: rndis: Free the response queue during REMOTE_NDIS_RESET_MSG

2016-02-08 Thread Amit Pundir
From: xerox_lin <xerox_...@htc.com>

When rndis data transfer is in progress, some Windows7 Host PC is not
sending the GET_ENCAPSULATED_RESPONSE command for receiving the response
for the previous SEND_ENCAPSULATED_COMMAND processed.

The rndis function driver appends each response for the
SEND_ENCAPSULATED_COMMAND in a queue. As the above process got corrupted,
the Host sends a REMOTE_NDIS_RESET_MSG command to do a soft-reset.
As the rndis response queue is not freed, the previous response is sent
as a part of this REMOTE_NDIS_RESET_MSG's reset response and the Host
blocks any more Rndis transfers.

Hence free the rndis response queue as a part of this soft-reset so that
the current response for REMOTE_NDIS_RESET_MSG is sent properly during the
response command.

Cc: Felipe Balbi <ba...@kernel.org>
Cc: Greg Kroah-Hartman <gre...@linuxfoundation.org>
Cc: Andrzej Pietrasiewicz <andrze...@samsung.com>
Cc: Badhri Jagan Sridharan <bad...@google.com>
Cc: Android Kernel Team <kernel-t...@android.com>
Cc: John Stultz <john.stu...@linaro.org>
Cc: Sumit Semwal <sumit.sem...@linaro.org>
Signed-off-by: Rajkumar Raghupathy <rag...@codeaurora.org>
Signed-off-by: Xerox Lin <xerox_...@htc.com>
[pundir:
 * cherry-picked this patch from AOSP experimental/android-4.4 tree.
 * folded in the AOSP fix to use rndis_params instead of configNr.]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
v2: Use rndis_params instead of configNr in v1. Updated commit log.

v1: Cherry-picked this patch from AOSP common/experimental/android-4.4 tree.
I could not find upstream submission history for this patch, so my
apologies in advance if this has already been NACKed before.

 drivers/usb/gadget/function/rndis.c | 7 +++
 1 file changed, 7 insertions(+)

diff --git a/drivers/usb/gadget/function/rndis.c 
b/drivers/usb/gadget/function/rndis.c
index 70d3917..27163e8 100644
--- a/drivers/usb/gadget/function/rndis.c
+++ b/drivers/usb/gadget/function/rndis.c
@@ -681,6 +681,13 @@ static int rndis_reset_response(struct rndis_params 
*params,
rndis_reset_cmplt_type *resp;
rndis_resp_t *r;
 
+   u32 length;
+   u8 *xbuf;
+
+   /* drain the response queue */
+   while ((xbuf = rndis_get_next_response(params, )))
+   rndis_free_response(params, xbuf);
+
r = rndis_add_response(params, sizeof(rndis_reset_cmplt_type));
if (!r)
return -ENOMEM;
-- 
1.9.1



[RFC][PATCH] usb: gadget: rndis: Free the response queue during REMOTE_NDIS_RESET_MSG

2016-02-08 Thread Amit Pundir
From: xerox_lin <xerox_...@htc.com>

When rndis data transfer is in progress, some Windows7 Host PC is not
sending the GET_ENCAPSULATED_RESPONSE command for receiving the response
for the previous SEND_ENCAPSULATED_COMMAND processed.

The rndis function driver appends each response for the
SEND_ENCAPSULATED_COMMAND in a queue. As the above process got corrupted,
the Host sends a REMOTE_NDIS_RESET_MSG command to do a soft-reset.
As the rndis response queue is not freed, the previous response is sent
as a part of this REMOTE_NDIS_RESET_MSG's reset response and the Host
blocks any more Rndis transfers.

Hence free the rndis response queue as a part of this soft-reset so that
the current response for REMOTE_NDIS_RESET_MSG is sent properly during the
response command.

Cc: Felipe Balbi <ba...@kernel.org>
Cc: Greg Kroah-Hartman <gre...@linuxfoundation.org>
Cc: Andrzej Pietrasiewicz <andrze...@samsung.com>
Cc: Badhri Jagan Sridharan <bad...@google.com>
Cc: Android Kernel Team <kernel-t...@android.com>
Cc: John Stultz <john.stu...@linaro.org>
Cc: Sumit Semwal <sumit.sem...@linaro.org>
Signed-off-by: Rajkumar Raghupathy <rag...@codeaurora.org>
Signed-off-by: Xerox Lin <xerox_...@htc.com>
[pundir: cherry-picked this patch from AOSP experimental/android-4.4 tree.]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
Cherry-picked this patch from AOSP common/experimental/android-4.4 tree.
I could not find upstream submission history for this patch, so my
apologies in advance if this has already been NACKed before.

 drivers/usb/gadget/function/rndis.c | 7 +++
 1 file changed, 7 insertions(+)

diff --git a/drivers/usb/gadget/function/rndis.c 
b/drivers/usb/gadget/function/rndis.c
index 70d3917..27163e8 100644
--- a/drivers/usb/gadget/function/rndis.c
+++ b/drivers/usb/gadget/function/rndis.c
@@ -681,6 +681,13 @@ static int rndis_reset_response(struct rndis_params 
*params,
rndis_reset_cmplt_type *resp;
rndis_resp_t *r;
 
+   u32 length;
+   u8 *xbuf;
+
+   /* drain the response queue */
+   while ((xbuf = rndis_get_next_response(configNr, )))
+   rndis_free_response(configNr, xbuf);
+
r = rndis_add_response(params, sizeof(rndis_reset_cmplt_type));
if (!r)
return -ENOMEM;
-- 
1.9.1



[RFC][PATCH] usb: gadget: u_ether: Add workqueue as bottom half handler for rx data path

2016-02-08 Thread Amit Pundir
From: Badhri Jagan Sridharan <bad...@google.com>

u_ether driver passes rx data to network layer and resubmits the
request back to usb hardware in interrupt context. Network layer
processes rx data by scheduling tasklet. For high throughput
scenarios on rx data path driver is spending lot of time in interrupt
context due to rx data processing by tasklet and continuous completion
and re-submission of the usb requests which results in watchdog bark.
Hence move the rx data processing and usb request submission to a
workqueue bottom half handler.

Cc: Felipe Balbi <ba...@kernel.org>
Cc: Greg Kroah-Hartman <gre...@linuxfoundation.org>
Cc: Mike Looijmans <mike.looijm...@topic.nl> 
Cc: Robert Baldyga <r.bald...@samsung.com>
Cc: Android Kernel Team <kernel-t...@android.com>
Cc: John Stultz <john.stu...@linaro.org>
Cc: Sumit Semwal <sumit.sem...@linaro.org>
Signed-off-by: Badhri Jagan Sridharan <bad...@google.com>
[pundir: cherry-picked this patch from AOSP experimental/android-4.4 tree.]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
Cherry-picked this patch from AOSP common/experimental/android-4.4 tree.
I could not find upstream submission history for this patch, so my
apologies in advance if this has already been NACKed before.

 drivers/usb/gadget/function/u_ether.c | 119 +++---
 1 file changed, 80 insertions(+), 39 deletions(-)

diff --git a/drivers/usb/gadget/function/u_ether.c 
b/drivers/usb/gadget/function/u_ether.c
index 7f98a2d..4235c33 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -53,6 +53,8 @@
  * blocks and still have efficient handling. */
 #define GETHER_MAX_ETH_FRAME_LEN 15412
 
+static struct workqueue_struct *uether_wq;
+
 struct eth_dev {
/* lock is held while accessing port_usb
 */
@@ -77,6 +79,7 @@ struct eth_dev {
struct sk_buff_head *list);
 
struct work_struct  work;
+   struct work_struct  rx_work;
 
unsigned long   todo;
 #defineWORK_RX_MEMORY  0
@@ -248,18 +251,16 @@ enomem:
DBG(dev, "rx submit --> %d\n", retval);
if (skb)
dev_kfree_skb_any(skb);
-   spin_lock_irqsave(>req_lock, flags);
-   list_add(>list, >rx_reqs);
-   spin_unlock_irqrestore(>req_lock, flags);
}
return retval;
 }
 
 static void rx_complete(struct usb_ep *ep, struct usb_request *req)
 {
-   struct sk_buff  *skb = req->context, *skb2;
+   struct sk_buff  *skb = req->context;
struct eth_dev  *dev = ep->driver_data;
int status = req->status;
+   boolqueue = 0;
 
switch (status) {
 
@@ -283,30 +284,8 @@ static void rx_complete(struct usb_ep *ep, struct 
usb_request *req)
} else {
skb_queue_tail(>rx_frames, skb);
}
-   skb = NULL;
-
-   skb2 = skb_dequeue(>rx_frames);
-   while (skb2) {
-   if (status < 0
-   || ETH_HLEN > skb2->len
-   || skb2->len > 
GETHER_MAX_ETH_FRAME_LEN) {
-   dev->net->stats.rx_errors++;
-   dev->net->stats.rx_length_errors++;
-   DBG(dev, "rx length %d\n", skb2->len);
-   dev_kfree_skb_any(skb2);
-   goto next_frame;
-   }
-   skb2->protocol = eth_type_trans(skb2, dev->net);
-   dev->net->stats.rx_packets++;
-   dev->net->stats.rx_bytes += skb2->len;
-
-   /* no buffer copies needed, unless hardware can't
-* use skb buffers.
-*/
-   status = netif_rx(skb2);
-next_frame:
-   skb2 = skb_dequeue(>rx_frames);
-   }
+   if (!status)
+   queue = 1;
break;
 
/* software-driven interface shutdown */
@@ -329,22 +308,20 @@ quiesce:
/* FALLTHROUGH */
 
default:
+   queue = 1;
+   dev_kfree_skb_any(skb);
dev->net->stats.rx_errors++;
DBG(dev, "rx status %d\n", status);
break;
}
 
-   if (skb)
-   dev_kfree_skb_any(skb);
-   if (!netif_running(dev->net)) {
 clean:
-   spin_lock(>req_lock);
-   list_add(>list, >rx_reqs);
-   spin_unlock(>req_lock);
-   req = NULL;
-   }
-   if (req)
-  

[RFC][PATCH] usb: gadget: u_ether: Fix data stall issue in RNDIS tethering mode

2016-02-08 Thread Amit Pundir
From: Badhri Jagan Sridharan <bad...@google.com>

For dual speed gadget, with current no. of request(10), there is
possibility of corner case occurrence where all 10 requests are queued
to HW without setting IOC bit, which could lead to data stall in
RNDIS tethering and RNDIS local networking.

With this patch, counter will be incremented before queueing request to
HW and sets IOC bit for every nth request due to which the corner case
of all requests queued to HW without IOC bit set will be avoided.

Cc: Felipe Balbi <ba...@kernel.org>
Cc: Greg Kroah-Hartman <gre...@linuxfoundation.org>
Cc: Mike Looijmans <mike.looijm...@topic.nl> 
Cc: Robert Baldyga <r.bald...@samsung.com>
Cc: Android Kernel Team <kernel-t...@android.com>
Cc: John Stultz <john.stu...@linaro.org>
Cc: Sumit Semwal <sumit.sem...@linaro.org>
Signed-off-by: Vijayavardhan Vennapusa <vvre...@codeaurora.org>
[pundir: cherry-picked this patch from AOSP experimental/android-4.4 tree.]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
Cherry-picked this patch from AOSP common/experimental/android-4.4 tree.
I could not find upstream submission history for this patch, so my
apologies in advance if this has already been NACKed before.

 drivers/usb/gadget/function/u_ether.c | 25 +++--
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/drivers/usb/gadget/function/u_ether.c 
b/drivers/usb/gadget/function/u_ether.c
index 9a69332..7f98a2d 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -64,7 +64,7 @@ struct eth_dev {
 
spinlock_t  req_lock;   /* guard {rx,tx}_reqs */
struct list_headtx_reqs, rx_reqs;
-   atomic_ttx_qlen;
+   unsignedtx_qlen;
 
struct sk_buff_head rx_frames;
 
@@ -464,7 +464,6 @@ static void tx_complete(struct usb_ep *ep, struct 
usb_request *req)
spin_unlock(>req_lock);
dev_kfree_skb_any(skb);
 
-   atomic_dec(>tx_qlen);
if (netif_carrier_ok(dev->net))
netif_wake_queue(dev->net);
 }
@@ -584,12 +583,19 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
 
req->length = length;
 
-   /* throttle high/super speed IRQ rate back slightly */
-   if (gadget_is_dualspeed(dev->gadget))
-   req->no_interrupt = (dev->gadget->speed == USB_SPEED_HIGH ||
-dev->gadget->speed == USB_SPEED_SUPER)
-   ? ((atomic_read(>tx_qlen) % dev->qmult) != 0)
-   : 0;
+   /* throttle highspeed IRQ rate back slightly */
+   if (gadget_is_dualspeed(dev->gadget) &&
+(dev->gadget->speed == USB_SPEED_HIGH)) {
+   dev->tx_qlen++;
+   if (dev->tx_qlen == qmult) {
+   req->no_interrupt = 0;
+   dev->tx_qlen = 0;
+   } else {
+   req->no_interrupt = 1;
+   }
+   } else {
+   req->no_interrupt = 0;
+   }
 
retval = usb_ep_queue(in, req, GFP_ATOMIC);
switch (retval) {
@@ -598,7 +604,6 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
break;
case 0:
net->trans_start = jiffies;
-   atomic_inc(>tx_qlen);
}
 
if (retval) {
@@ -625,7 +630,7 @@ static void eth_start(struct eth_dev *dev, gfp_t gfp_flags)
rx_fill(dev, gfp_flags);
 
/* and open the tx floodgates */
-   atomic_set(>tx_qlen, 0);
+   dev->tx_qlen = 0;
netif_wake_queue(dev->net);
 }
 
-- 
1.9.1



[RFC][PATCH] usb: phy: Dual role sysfs class definition

2016-02-08 Thread Amit Pundir
From: Badhri Jagan Sridharan <bad...@google.com>

This CL adds a new class to monitor and change
dual role usb ports from userspace. The usb
phy drivers can register to the dual_role_usb
class and expose the capabilities of the ports.
The phy drivers can decide on whether a specific
attribute can be changed from userspace by
choosing to implement the appropriate callback.

Cc: Felipe Balbi <ba...@kernel.org>
Cc: Greg Kroah-Hartman <gre...@linuxfoundation.org>
Cc: Android Kernel Team <kernel-t...@android.com>
Cc: John Stultz <john.stu...@linaro.org>
Cc: Sumit Semwal <sumit.sem...@linaro.org>
Signed-off-by: Badhri Jagan Sridharan <bad...@google.com>
[pundir: cherry-picked this patch from AOSP experimental/android-4.4 tree.]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
Cherry-picked this patch from AOSP common/experimental/android-4.4 tree.
I could not find upstream submission history for this patch, so my
apologies in advance if this has already been NACKed before.

 .../ABI/testing/sysfs-class-dual-role-usb  |  71 +++
 drivers/usb/phy/Kconfig|   9 +
 drivers/usb/phy/Makefile   |   1 +
 drivers/usb/phy/class-dual-role.c  | 529 +
 include/linux/usb/class-dual-role.h| 128 +
 5 files changed, 738 insertions(+)
 create mode 100644 Documentation/ABI/testing/sysfs-class-dual-role-usb
 create mode 100644 drivers/usb/phy/class-dual-role.c
 create mode 100644 include/linux/usb/class-dual-role.h

diff --git a/Documentation/ABI/testing/sysfs-class-dual-role-usb 
b/Documentation/ABI/testing/sysfs-class-dual-role-usb
new file mode 100644
index 000..a900fd7
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-class-dual-role-usb
@@ -0,0 +1,71 @@
+What:  /sys/class/dual_role_usb/.../
+Date:  June 2015
+Contact:   Badhri Jagan Sridharan<bad...@google.com>
+Description:
+   Provide a generic interface to monitor and change
+   the state of dual role usb ports. The name here
+   refers to the name mentioned in the
+   dual_role_phy_desc that is passed while registering
+   the dual_role_phy_intstance through
+   devm_dual_role_instance_register.
+
+What:   /sys/class/dual_role_usb/.../supported_modes
+Date:   June 2015
+Contact:Badhri Jagan Sridharan<bad...@google.com>
+Description:
+   This is a static node, once initialized this
+   is not expected to change during runtime. "dfp"
+   refers to "downstream facing port" i.e. port can
+   only act as host. "ufp" refers to "upstream
+   facing port" i.e. port can only act as device.
+   "dfp ufp" refers to "dual role port" i.e. the port
+   can either be a host port or a device port.
+
+What:  /sys/class/dual_role_usb/.../mode
+Date:  June 2015
+Contact:   Badhri Jagan Sridharan<bad...@google.com>
+Description:
+   The mode node refers to the current mode in which the
+   port is operating. "dfp" for host ports. "ufp" for device
+   ports and "none" when cable is not connected.
+
+   On devices where the USB mode is software-controllable,
+   userspace can change the mode by writing "dfp" or "ufp".
+   On devices where the USB mode is fixed in hardware,
+   this attribute is read-only.
+
+What:  /sys/class/dual_role_usb/.../power_role
+Date:  June 2015
+Contact:   Badhri Jagan Sridharan<bad...@google.com>
+Description:
+   The power_role node mentions whether the port
+   is "sink"ing or "source"ing power. "none" if
+   they are not connected.
+
+   On devices implementing USB Power Delivery,
+   userspace can control the power role by writing "sink" or
+   "source". On devices without USB-PD, this attribute is
+   read-only.
+
+What:  /sys/class/dual_role_usb/.../data_role
+Date:  June 2015
+Contact:   Badhri Jagan Sridharan<bad...@google.com>
+Description:
+   The data_role node mentions whether the port
+   is acting as "host" or "device" for USB data connection.
+   "none" if there is no active data link.
+
+   On devices implementing USB Power Delivery, userspace
+   can control the data role by writing "host" or "device".
+   On devices without USB-PD, this attribute is read-only
+
+What:  /sys/class/dual_role_usb/.../powers_vconn
+Date:  June 2015
+Conta

Re: [RFC][PATCH] usb: gadget: u_ether: Add workqueue as bottom half handler for rx data path

2016-02-09 Thread Amit Pundir
On 9 February 2016 at 04:50, Greg Kroah-Hartman
<gre...@linuxfoundation.org> wrote:
> On Tue, Feb 09, 2016 at 02:07:02AM +0530, Amit Pundir wrote:
>> Please ignore this one too. I should have build tested these patches
>> individually and not in particular series. I'll resend this patch.
>
> Send them in a numbered series so we know what order they have to be
> applied in.

Thanks I'll send them in a numbered series again. Since the patch
series didn't have much in common(feature wise), I changed my mind
right at the last moment to send them individually but that didn't go
well.

>
> And I always ignore RFC patches, if you can't be confident enough in
> submitting it for inclusion, why should we care?  :)

Yes I got your point. I was not intending to submit it yet, but hoping
to get any early feedback or objections from maintainers.

>
> You have of course tested these, right?

I have tested some of it for regressions, though not on the latest
kernel, but I will go through and re-test what I can. As I said I was
mainly just hoping for early maintainer feedback here.

Thank you for the suggestions and feedback Greg.

Regards,
Amit Pundir

>
> thanks,
>
> greg k-h


[PATCH] mmc: block: improve logging of handling emmc timeouts

2016-05-04 Thread Amit Pundir
From: Ken Sumrall <ksumr...@android.com>

Add some logging to make it clear just how the emmc timeout
was handled.

Cc: Ulf Hansson <ulf.hans...@linaro.org>
Cc: Adrian Hunter <adrian.hun...@intel.com>
Cc: Shawn Lin <shawn@rock-chips.com>
Cc: Jon Hunter <jonath...@nvidia.com>
Cc: Grant Grundler <grund...@chromium.org>
Cc: Luca Porzio <lpor...@micron.com>
Cc: Android Kernel Team <kernel-t...@android.com>
Cc: Sumit Semwal <sumit.sem...@linaro.org>
Cc: John Stultz <john.stu...@linaro.org>
Signed-off-by: Ken Sumrall <ksumr...@android.com>
[AmitP: cherry-picked this Android patch from aosp common kernel android-4.4]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 drivers/mmc/card/block.c | 11 +--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index 9c69e21..e737c81 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -948,18 +948,25 @@ static int mmc_blk_cmd_error(struct request *req, const 
char *name, int error,
req->rq_disk->disk_name, "timed out", name, status);
 
/* If the status cmd initially failed, retry the r/w cmd */
-   if (!status_valid)
+   if (!status_valid) {
+   pr_err("%s: status not valid, retrying timeout\n",
+   req->rq_disk->disk_name);
return ERR_RETRY;
+   }
 
/*
 * If it was a r/w cmd crc error, or illegal command
 * (eg, issued in wrong state) then retry - we should
 * have corrected the state problem above.
 */
-   if (status & (R1_COM_CRC_ERROR | R1_ILLEGAL_COMMAND))
+   if (status & (R1_COM_CRC_ERROR | R1_ILLEGAL_COMMAND)) {
+   pr_err("%s: command error, retrying timeout\n",
+   req->rq_disk->disk_name);
return ERR_RETRY;
+   }
 
/* Otherwise abort the command */
+   pr_err("%s: not retrying timeout\n", req->rq_disk->disk_name);
return ERR_ABORT;
 
default:
-- 
2.7.4



[PATCH v2] mmc: block: improve logging of handling emmc timeouts

2016-05-10 Thread Amit Pundir
From: Ken Sumrall <ksumr...@android.com>

Add some logging to make it clear just how the emmc timeout
was handled.

Signed-off-by: Ken Sumrall <ksumr...@android.com>
[AmitP: cherry-picked this Android patch from aosp
common kernel android-4.4]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
v1...v2:
  Removed CC list from the commit log and skipped one print statement.
 
 drivers/mmc/card/block.c | 10 --
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index 9c69e21..ddc9620 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -948,16 +948,22 @@ static int mmc_blk_cmd_error(struct request *req, const 
char *name, int error,
req->rq_disk->disk_name, "timed out", name, status);
 
/* If the status cmd initially failed, retry the r/w cmd */
-   if (!status_valid)
+   if (!status_valid) {
+   pr_err("%s: status not valid, retrying timeout\n",
+   req->rq_disk->disk_name);
return ERR_RETRY;
+   }
 
/*
 * If it was a r/w cmd crc error, or illegal command
 * (eg, issued in wrong state) then retry - we should
 * have corrected the state problem above.
 */
-   if (status & (R1_COM_CRC_ERROR | R1_ILLEGAL_COMMAND))
+   if (status & (R1_COM_CRC_ERROR | R1_ILLEGAL_COMMAND)) {
+   pr_err("%s: command error, retrying timeout\n",
+   req->rq_disk->disk_name);
return ERR_RETRY;
+   }
 
/* Otherwise abort the command */
return ERR_ABORT;
-- 
2.7.4



[PATCH] usb: gadget: rndis: free response queue during REMOTE_NDIS_RESET_MSG

2016-06-27 Thread Amit Pundir
From: xerox_lin <xerox_...@htc.com>

When rndis data transfer is in progress, some Windows7 Host PC is not
sending the GET_ENCAPSULATED_RESPONSE command for receiving the response
for the previous SEND_ENCAPSULATED_COMMAND processed.

The rndis function driver appends each response for the
SEND_ENCAPSULATED_COMMAND in a queue. As the above process got corrupted,
the Host sends a REMOTE_NDIS_RESET_MSG command to do a soft-reset.
As the rndis response queue is not freed, the previous response is sent
as a part of this REMOTE_NDIS_RESET_MSG's reset response and the Host
block any more Rndis transfers.

Hence free the rndis response queue as a part of this soft-reset so that
the correct response for REMOTE_NDIS_RESET_MSG is sent properly during the
response command.

Signed-off-by: Rajkumar Raghupathy <rag...@codeaurora.org>
Signed-off-by: Xerox Lin <xerox_...@htc.com>
[AmitP: Cherry-picked this patch and folded other relevant
fixes from Android common kernel android-4.4]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
Cherry picked this usb tethering fix from AOSP kernel/common/android-4.4
tree and to make sure it doesn't get overlooked, submiting it for review
and comment.

 drivers/usb/gadget/function/rndis.c | 6 ++
 1 file changed, 6 insertions(+)

diff --git a/drivers/usb/gadget/function/rndis.c 
b/drivers/usb/gadget/function/rndis.c
index 943c21a..ab6ac1b 100644
--- a/drivers/usb/gadget/function/rndis.c
+++ b/drivers/usb/gadget/function/rndis.c
@@ -680,6 +680,12 @@ static int rndis_reset_response(struct rndis_params 
*params,
 {
rndis_reset_cmplt_type *resp;
rndis_resp_t *r;
+   u8 *xbuf;
+   u32 length;
+
+   /* drain the response queue */
+   while ((xbuf = rndis_get_next_response(params, )))
+   rndis_free_response(params, xbuf);
 
r = rndis_add_response(params, sizeof(rndis_reset_cmplt_type));
if (!r)
-- 
2.7.4



Regression in ARM CLCD Fb

2016-10-15 Thread Amit Pundir
Hi,

Commit 25348160e9a4 ("video: ARM CLCD: add special panel hook for
Versatiles") broke CLCD framebuffer on my qemu-system-arm +
vexpress-v2p-ca9.dtb + Android test setup.

Android boot failed with:

E/SurfaceFlinger( 1003): ERROR: failed to open framebuffer (No such
file or directory), aborting

It means Android didn't find /dev/fb* or equivalent /dev/graphics/fb*.

Any thoughts on what might be going wrong here? Or am I missing
anything obvious in my Qemu setup, though it was working fine so far.
I'd be happy to help debug things.

Regards,
Amit Pundir


[PATCH 1/2] config: android-recommended: disable aio support

2016-12-07 Thread Amit Pundir
From: Daniel Micay <danielmi...@gmail.com>

The aio interface adds substantial attack surface for a feature that's
not being exposed by Android at all. It's unlikely that anyone is using
the kernel feature directly either. This feature is rarely used even on
servers. The glibc POSIX aio calls really use thread pools. The lack of
widespread usage also means this is relatively poorly audited/tested.

The kernel's aio rarely provides performance benefits over using a
thread pool and is quite incomplete in terms of system call coverage
along with having edge cases where blocking can occur. Part of the
performance issue is the fact that it only supports direct io, not
buffered io. The existing API is considered fundamentally flawed
and it's unlikely it will be expanded, but rather replaced:

https://marc.info/?l=linux-aio=145255815216051=2

Since ext4 encryption means no direct io support, kernel aio isn't even
going to work properly on Android devices using file-based encryption.

Reviewed-at: https://android-review.googlesource.com/#/c/292158/

Signed-off-by: Daniel Micay <danielmi...@gmail.com>
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 kernel/configs/android-recommended.config | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/configs/android-recommended.config 
b/kernel/configs/android-recommended.config
index 297756b..4719871 100644
--- a/kernel/configs/android-recommended.config
+++ b/kernel/configs/android-recommended.config
@@ -1,4 +1,5 @@
 #  KEEP ALPHABETICALLY SORTED
+# CONFIG_AIO is not set
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_LEGACY_PTYS is not set
-- 
2.7.4



[PATCH 2/2] config: android-base: enable hardened usercopy and kernel ASLR

2016-12-07 Thread Amit Pundir
Enable CONFIG_HARDENED_USERCOPY and CONFIG_RANDOMIZE_BASE in Android
base config fragment.

Reviewed-at: https://android-review.googlesource.com/#/c/283659/
Reviewed-at: https://android-review.googlesource.com/#/c/278133/

Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 kernel/configs/android-base.config | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/configs/android-base.config 
b/kernel/configs/android-base.config
index 1a8f34f..26a06e0 100644
--- a/kernel/configs/android-base.config
+++ b/kernel/configs/android-base.config
@@ -21,6 +21,7 @@ CONFIG_CP15_BARRIER_EMULATION=y
 CONFIG_DEFAULT_SECURITY_SELINUX=y
 CONFIG_EMBEDDED=y
 CONFIG_FB=y
+CONFIG_HARDENED_USERCOPY=y
 CONFIG_HIGH_RES_TIMERS=y
 CONFIG_INET6_AH=y
 CONFIG_INET6_ESP=y
@@ -129,6 +130,7 @@ CONFIG_PPP_DEFLATE=y
 CONFIG_PPP_MPPE=y
 CONFIG_PREEMPT=y
 CONFIG_QUOTA=y
+CONFIG_RANDOMIZE_BASE=y
 CONFIG_RTC_CLASS=y
 CONFIG_RT_GROUP_SCHED=y
 CONFIG_SECCOMP=y
-- 
2.7.4



[PATCH for-4.9 1/7] MIPS: Introduce irq_stack

2017-04-06 Thread Amit Pundir
From: Matt Redfearn <matt.redfe...@imgtec.com>

Allocate a per-cpu irq stack for use within interrupt handlers.

Also add a utility function on_irq_stack to determine if a given stack
pointer is within the irq stack for that cpu.

Signed-off-by: Matt Redfearn <matt.redfe...@imgtec.com>
Acked-by: Jason A. Donenfeld <ja...@zx2c4.com>
Cc: Thomas Gleixner <t...@linutronix.de>
Cc: Paolo Bonzini <pbonz...@redhat.com>
Cc: Chris Metcalf <cmetc...@mellanox.com>
Cc: Petr Mladek <pmla...@suse.com>
Cc: James Hogan <james.ho...@imgtec.com>
Cc: Paul Burton <paul.bur...@imgtec.com>
Cc: Aaron Tomlin <atom...@redhat.com>
Cc: Andrew Morton <a...@linux-foundation.org>
Cc: linux-kernel@vger.kernel.org
Cc: linux-m...@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/14740/
Signed-off-by: Ralf Baechle <r...@linux-mips.org>
(cherry picked from commit fe8bd18ffea5327344d4ec2bf11f47951212abd0)
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 arch/mips/include/asm/irq.h| 12 
 arch/mips/kernel/asm-offsets.c |  1 +
 arch/mips/kernel/irq.c | 11 +++
 3 files changed, 24 insertions(+)

diff --git a/arch/mips/include/asm/irq.h b/arch/mips/include/asm/irq.h
index 6bf10e7..956db6e 100644
--- a/arch/mips/include/asm/irq.h
+++ b/arch/mips/include/asm/irq.h
@@ -17,6 +17,18 @@
 
 #include 
 
+#define IRQ_STACK_SIZE THREAD_SIZE
+
+extern void *irq_stack[NR_CPUS];
+
+static inline bool on_irq_stack(int cpu, unsigned long sp)
+{
+   unsigned long low = (unsigned long)irq_stack[cpu];
+   unsigned long high = low + IRQ_STACK_SIZE;
+
+   return (low <= sp && sp <= high);
+}
+
 #ifdef CONFIG_I8259
 static inline int irq_canonicalize(int irq)
 {
diff --git a/arch/mips/kernel/asm-offsets.c b/arch/mips/kernel/asm-offsets.c
index fae2f94..4be2763 100644
--- a/arch/mips/kernel/asm-offsets.c
+++ b/arch/mips/kernel/asm-offsets.c
@@ -102,6 +102,7 @@ void output_thread_info_defines(void)
OFFSET(TI_REGS, thread_info, regs);
DEFINE(_THREAD_SIZE, THREAD_SIZE);
DEFINE(_THREAD_MASK, THREAD_MASK);
+   DEFINE(_IRQ_STACK_SIZE, IRQ_STACK_SIZE);
BLANK();
 }
 
diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c
index f25f7ea..2b0a371 100644
--- a/arch/mips/kernel/irq.c
+++ b/arch/mips/kernel/irq.c
@@ -25,6 +25,8 @@
 #include 
 #include 
 
+void *irq_stack[NR_CPUS];
+
 /*
  * 'what should we do if we get a hw irq event on an illegal vector'.
  * each architecture has to answer this themselves.
@@ -58,6 +60,15 @@ void __init init_IRQ(void)
clear_c0_status(ST0_IM);
 
arch_init_irq();
+
+   for_each_possible_cpu(i) {
+   int irq_pages = IRQ_STACK_SIZE / PAGE_SIZE;
+   void *s = (void *)__get_free_pages(GFP_KERNEL, irq_pages);
+
+   irq_stack[i] = s;
+   pr_debug("CPU%d IRQ stack at 0x%p - 0x%p\n", i,
+   irq_stack[i], irq_stack[i] + IRQ_STACK_SIZE);
+   }
 }
 
 #ifdef CONFIG_DEBUG_STACKOVERFLOW
-- 
2.7.4



[PATCH for-4.9 4/7] MIPS: Switch to the irq_stack in interrupts

2017-04-06 Thread Amit Pundir
From: Matt Redfearn <matt.redfe...@imgtec.com>

When enterring interrupt context via handle_int or except_vec_vi, switch
to the irq_stack of the current CPU if it is not already in use.

The current stack pointer is masked with the thread size and compared to
the base or the irq stack. If it does not match then the stack pointer
is set to the top of that stack, otherwise this is a nested irq being
handled on the irq stack so the stack pointer should be left as it was.

The in-use stack pointer is placed in the callee saved register s1. It
will be saved to the stack when plat_irq_dispatch is invoked and can be
restored once control returns here.

Signed-off-by: Matt Redfearn <matt.redfe...@imgtec.com>
Acked-by: Jason A. Donenfeld <ja...@zx2c4.com>
Cc: Thomas Gleixner <t...@linutronix.de>
Cc: James Hogan <james.ho...@imgtec.com>
Cc: Paul Burton <paul.bur...@imgtec.com>
Cc: linux-m...@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/14743/
Signed-off-by: Ralf Baechle <r...@linux-mips.org>
(cherry picked from commit dda45f701c9d7ad4ac0bb446e3a96f6df9a468d9)
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 arch/mips/kernel/genex.S | 81 +---
 1 file changed, 76 insertions(+), 5 deletions(-)

diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S
index dc0b296..0a7ba4b 100644
--- a/arch/mips/kernel/genex.S
+++ b/arch/mips/kernel/genex.S
@@ -187,9 +187,44 @@ NESTED(handle_int, PT_SIZE, sp)
 
LONG_L  s0, TI_REGS($28)
LONG_S  sp, TI_REGS($28)
-   PTR_LA  ra, ret_from_irq
-   PTR_LA  v0, plat_irq_dispatch
-   jr  v0
+
+   /*
+* SAVE_ALL ensures we are using a valid kernel stack for the thread.
+* Check if we are already using the IRQ stack.
+*/
+   moves1, sp # Preserve the sp
+
+   /* Get IRQ stack for this CPU */
+   ASM_CPUID_MFC0  k0, ASM_SMP_CPUID_REG
+#if defined(CONFIG_32BIT) || defined(KBUILD_64BIT_SYM32)
+   lui k1, %hi(irq_stack)
+#else
+   lui k1, %highest(irq_stack)
+   daddiu  k1, %higher(irq_stack)
+   dsllk1, 16
+   daddiu  k1, %hi(irq_stack)
+   dsllk1, 16
+#endif
+   LONG_SRLk0, SMP_CPUID_PTRSHIFT
+   LONG_ADDU   k1, k0
+   LONG_L  t0, %lo(irq_stack)(k1)
+
+   # Check if already on IRQ stack
+   PTR_LI  t1, ~(_THREAD_SIZE-1)
+   and t1, t1, sp
+   beq t0, t1, 2f
+
+   /* Switch to IRQ stack */
+   li  t1, _IRQ_STACK_SIZE
+   PTR_ADD sp, t0, t1
+
+2:
+   jal plat_irq_dispatch
+
+   /* Restore sp */
+   movesp, s1
+
+   j   ret_from_irq
 #ifdef CONFIG_CPU_MICROMIPS
nop
 #endif
@@ -262,8 +297,44 @@ NESTED(except_vec_vi_handler, 0, sp)
 
LONG_L  s0, TI_REGS($28)
LONG_S  sp, TI_REGS($28)
-   PTR_LA  ra, ret_from_irq
-   jr  v0
+
+   /*
+* SAVE_ALL ensures we are using a valid kernel stack for the thread.
+* Check if we are already using the IRQ stack.
+*/
+   moves1, sp # Preserve the sp
+
+   /* Get IRQ stack for this CPU */
+   ASM_CPUID_MFC0  k0, ASM_SMP_CPUID_REG
+#if defined(CONFIG_32BIT) || defined(KBUILD_64BIT_SYM32)
+   lui k1, %hi(irq_stack)
+#else
+   lui k1, %highest(irq_stack)
+   daddiu  k1, %higher(irq_stack)
+   dsllk1, 16
+   daddiu  k1, %hi(irq_stack)
+   dsllk1, 16
+#endif
+   LONG_SRLk0, SMP_CPUID_PTRSHIFT
+   LONG_ADDU   k1, k0
+   LONG_L  t0, %lo(irq_stack)(k1)
+
+   # Check if already on IRQ stack
+   PTR_LI  t1, ~(_THREAD_SIZE-1)
+   and t1, t1, sp
+   beq t0, t1, 2f
+
+   /* Switch to IRQ stack */
+   li  t1, _IRQ_STACK_SIZE
+   PTR_ADD sp, t0, t1
+
+2:
+   jal plat_irq_dispatch
+
+   /* Restore sp */
+   movesp, s1
+
+   j   ret_from_irq
END(except_vec_vi_handler)
 
 /*
-- 
2.7.4



[PATCH for-4.9 5/7] MIPS: Select HAVE_IRQ_EXIT_ON_IRQ_STACK

2017-04-06 Thread Amit Pundir
From: Matt Redfearn <matt.redfe...@imgtec.com>

Since do_IRQ is now invoked on a separate IRQ stack, we select
HAVE_IRQ_EXIT_ON_IRQ_STACK so that softirq's may be invoked directly
from irq_exit(), rather than requiring do_softirq_own_stack.

Signed-off-by: Matt Redfearn <matt.redfe...@imgtec.com>
Acked-by: Jason A. Donenfeld <ja...@zx2c4.com>
Cc: Thomas Gleixner <t...@linutronix.de>
Cc: linux-m...@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/14744/
Signed-off-by: Ralf Baechle <r...@linux-mips.org>
(cherry picked from commit 3cc3434fd6307d06b53b98ce83e76bf9807689b9)
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 arch/mips/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index b3c5bde..80832aa 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -9,6 +9,7 @@ config MIPS
select HAVE_CONTEXT_TRACKING
select HAVE_GENERIC_DMA_COHERENT
select HAVE_IDE
+   select HAVE_IRQ_EXIT_ON_IRQ_STACK
select HAVE_OPROFILE
select HAVE_PERF_EVENTS
select PERF_USE_VMALLOC
-- 
2.7.4



[PATCH for-4.9 2/7] MIPS: Stack unwinding while on IRQ stack

2017-04-06 Thread Amit Pundir
From: Matt Redfearn <matt.redfe...@imgtec.com>

Within unwind stack, check if the stack pointer being unwound is within
the CPU's irq_stack and if so use that page rather than the task's stack
page.

Signed-off-by: Matt Redfearn <matt.redfe...@imgtec.com>
Acked-by: Jason A. Donenfeld <ja...@zx2c4.com>
Cc: Thomas Gleixner <t...@linutronix.de>
Cc: Adam Buchbinder <adam.buchbin...@gmail.com>
Cc: Maciej W. Rozycki <ma...@imgtec.com>
Cc: Marcin Nowakowski <marcin.nowakow...@imgtec.com>
Cc: Chris Metcalf <cmetc...@mellanox.com>
Cc: James Hogan <james.ho...@imgtec.com>
Cc: Paul Burton <paul.bur...@imgtec.com>
Cc: Jiri Slaby <jsl...@suse.cz>
Cc: Andrew Morton <a...@linux-foundation.org>
Cc: linux-m...@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/14741/
Signed-off-by: Ralf Baechle <r...@linux-mips.org>
(cherry picked from commit d42d8d106b0275b027c1e8992c42aecf933436ea)
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 arch/mips/kernel/process.c | 15 ++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index 1652f36..fbbf5fc 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -33,6 +33,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -556,7 +557,19 @@ EXPORT_SYMBOL(unwind_stack_by_address);
 unsigned long unwind_stack(struct task_struct *task, unsigned long *sp,
   unsigned long pc, unsigned long *ra)
 {
-   unsigned long stack_page = (unsigned long)task_stack_page(task);
+   unsigned long stack_page = 0;
+   int cpu;
+
+   for_each_possible_cpu(cpu) {
+   if (on_irq_stack(cpu, *sp)) {
+   stack_page = (unsigned long)irq_stack[cpu];
+   break;
+   }
+   }
+
+   if (!stack_page)
+   stack_page = (unsigned long)task_stack_page(task);
+
return unwind_stack_by_address(stack_page, sp, pc, ra);
 }
 #endif
-- 
2.7.4



[PATCH for-4.9 3/7] MIPS: Only change $28 to thread_info if coming from user mode

2017-04-06 Thread Amit Pundir
From: Matt Redfearn <matt.redfe...@imgtec.com>

The SAVE_SOME macro is used to save the execution context on all
exceptions.
If an exception occurs while executing user code, the stack is switched
to the kernel's stack for the current task, and register $28 is switched
to point to the current_thread_info, which is at the bottom of the stack
region.
If the exception occurs while executing kernel code, the stack is left,
and this change ensures that register $28 is not updated. This is the
correct behaviour when the kernel can be executing on the separate irq
stack, because the thread_info will not be at the base of it.

With this change, register $28 is only switched to it's kernel
conventional usage of the currrent thread info pointer at the point at
which execution enters kernel space. Doing it on every exception was
redundant, but OK without an IRQ stack, but will be erroneous once that
is introduced.

Signed-off-by: Matt Redfearn <matt.redfe...@imgtec.com>
Acked-by: Jason A. Donenfeld <ja...@zx2c4.com>
Cc: Thomas Gleixner <t...@linutronix.de>
Cc: James Hogan <james.ho...@imgtec.com>
Cc: Paul Burton <paul.bur...@imgtec.com>
Cc: linux-m...@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/14742/
Signed-off-by: Ralf Baechle <r...@linux-mips.org>
(cherry picked from commit 510d86362a27577f5ee23f46cfb354ad49731e61)
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 arch/mips/include/asm/stackframe.h | 7 +++
 1 file changed, 7 insertions(+)

diff --git a/arch/mips/include/asm/stackframe.h 
b/arch/mips/include/asm/stackframe.h
index eebf395..2f182bd 100644
--- a/arch/mips/include/asm/stackframe.h
+++ b/arch/mips/include/asm/stackframe.h
@@ -216,12 +216,19 @@
LONG_S  $25, PT_R25(sp)
LONG_S  $28, PT_R28(sp)
LONG_S  $31, PT_R31(sp)
+
+   /* Set thread_info if we're coming from user mode */
+   mfc0k0, CP0_STATUS
+   sll k0, 3   /* extract cu0 bit */
+   bltzk0, 9f
+
ori $28, sp, _THREAD_MASK
xori$28, _THREAD_MASK
 #ifdef CONFIG_CPU_CAVIUM_OCTEON
.setmips64
pref0, 0($28)   /* Prefetch the current pointer */
 #endif
+9:
.setpop
.endm
 
-- 
2.7.4



[PATCH for-4.10 3/6] MIPS: Only change $28 to thread_info if coming from user mode

2017-04-06 Thread Amit Pundir
From: Matt Redfearn <matt.redfe...@imgtec.com>

The SAVE_SOME macro is used to save the execution context on all
exceptions.
If an exception occurs while executing user code, the stack is switched
to the kernel's stack for the current task, and register $28 is switched
to point to the current_thread_info, which is at the bottom of the stack
region.
If the exception occurs while executing kernel code, the stack is left,
and this change ensures that register $28 is not updated. This is the
correct behaviour when the kernel can be executing on the separate irq
stack, because the thread_info will not be at the base of it.

With this change, register $28 is only switched to it's kernel
conventional usage of the currrent thread info pointer at the point at
which execution enters kernel space. Doing it on every exception was
redundant, but OK without an IRQ stack, but will be erroneous once that
is introduced.

Signed-off-by: Matt Redfearn <matt.redfe...@imgtec.com>
Acked-by: Jason A. Donenfeld <ja...@zx2c4.com>
Cc: Thomas Gleixner <t...@linutronix.de>
Cc: James Hogan <james.ho...@imgtec.com>
Cc: Paul Burton <paul.bur...@imgtec.com>
Cc: linux-m...@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/14742/
Signed-off-by: Ralf Baechle <r...@linux-mips.org>
(cherry picked from commit 510d86362a27577f5ee23f46cfb354ad49731e61)
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 arch/mips/include/asm/stackframe.h | 7 +++
 1 file changed, 7 insertions(+)

diff --git a/arch/mips/include/asm/stackframe.h 
b/arch/mips/include/asm/stackframe.h
index eebf395..2f182bd 100644
--- a/arch/mips/include/asm/stackframe.h
+++ b/arch/mips/include/asm/stackframe.h
@@ -216,12 +216,19 @@
LONG_S  $25, PT_R25(sp)
LONG_S  $28, PT_R28(sp)
LONG_S  $31, PT_R31(sp)
+
+   /* Set thread_info if we're coming from user mode */
+   mfc0k0, CP0_STATUS
+   sll k0, 3   /* extract cu0 bit */
+   bltzk0, 9f
+
ori $28, sp, _THREAD_MASK
xori$28, _THREAD_MASK
 #ifdef CONFIG_CPU_CAVIUM_OCTEON
.setmips64
pref0, 0($28)   /* Prefetch the current pointer */
 #endif
+9:
.setpop
.endm
 
-- 
2.7.4



[PATCH for-4.10 2/6] MIPS: Stack unwinding while on IRQ stack

2017-04-06 Thread Amit Pundir
From: Matt Redfearn <matt.redfe...@imgtec.com>

Within unwind stack, check if the stack pointer being unwound is within
the CPU's irq_stack and if so use that page rather than the task's stack
page.

Signed-off-by: Matt Redfearn <matt.redfe...@imgtec.com>
Acked-by: Jason A. Donenfeld <ja...@zx2c4.com>
Cc: Thomas Gleixner <t...@linutronix.de>
Cc: Adam Buchbinder <adam.buchbin...@gmail.com>
Cc: Maciej W. Rozycki <ma...@imgtec.com>
Cc: Marcin Nowakowski <marcin.nowakow...@imgtec.com>
Cc: Chris Metcalf <cmetc...@mellanox.com>
Cc: James Hogan <james.ho...@imgtec.com>
Cc: Paul Burton <paul.bur...@imgtec.com>
Cc: Jiri Slaby <jsl...@suse.cz>
Cc: Andrew Morton <a...@linux-foundation.org>
Cc: linux-m...@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/14741/
Signed-off-by: Ralf Baechle <r...@linux-mips.org>
(cherry picked from commit d42d8d106b0275b027c1e8992c42aecf933436ea)
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 arch/mips/kernel/process.c | 15 ++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index 7d80447..efa1df5 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -33,6 +33,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -556,7 +557,19 @@ EXPORT_SYMBOL(unwind_stack_by_address);
 unsigned long unwind_stack(struct task_struct *task, unsigned long *sp,
   unsigned long pc, unsigned long *ra)
 {
-   unsigned long stack_page = (unsigned long)task_stack_page(task);
+   unsigned long stack_page = 0;
+   int cpu;
+
+   for_each_possible_cpu(cpu) {
+   if (on_irq_stack(cpu, *sp)) {
+   stack_page = (unsigned long)irq_stack[cpu];
+   break;
+   }
+   }
+
+   if (!stack_page)
+   stack_page = (unsigned long)task_stack_page(task);
+
return unwind_stack_by_address(stack_page, sp, pc, ra);
 }
 #endif
-- 
2.7.4



[PATCH for-4.10 5/6] MIPS: Select HAVE_IRQ_EXIT_ON_IRQ_STACK

2017-04-06 Thread Amit Pundir
From: Matt Redfearn <matt.redfe...@imgtec.com>

Since do_IRQ is now invoked on a separate IRQ stack, we select
HAVE_IRQ_EXIT_ON_IRQ_STACK so that softirq's may be invoked directly
from irq_exit(), rather than requiring do_softirq_own_stack.

Signed-off-by: Matt Redfearn <matt.redfe...@imgtec.com>
Acked-by: Jason A. Donenfeld <ja...@zx2c4.com>
Cc: Thomas Gleixner <t...@linutronix.de>
Cc: linux-m...@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/14744/
Signed-off-by: Ralf Baechle <r...@linux-mips.org>
(cherry picked from commit 3cc3434fd6307d06b53b98ce83e76bf9807689b9)
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 arch/mips/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index b3c5bde..80832aa 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -9,6 +9,7 @@ config MIPS
select HAVE_CONTEXT_TRACKING
select HAVE_GENERIC_DMA_COHERENT
select HAVE_IDE
+   select HAVE_IRQ_EXIT_ON_IRQ_STACK
select HAVE_OPROFILE
select HAVE_PERF_EVENTS
select PERF_USE_VMALLOC
-- 
2.7.4



[PATCH for-4.10 1/6] MIPS: Introduce irq_stack

2017-04-06 Thread Amit Pundir
From: Matt Redfearn <matt.redfe...@imgtec.com>

Allocate a per-cpu irq stack for use within interrupt handlers.

Also add a utility function on_irq_stack to determine if a given stack
pointer is within the irq stack for that cpu.

Signed-off-by: Matt Redfearn <matt.redfe...@imgtec.com>
Acked-by: Jason A. Donenfeld <ja...@zx2c4.com>
Cc: Thomas Gleixner <t...@linutronix.de>
Cc: Paolo Bonzini <pbonz...@redhat.com>
Cc: Chris Metcalf <cmetc...@mellanox.com>
Cc: Petr Mladek <pmla...@suse.com>
Cc: James Hogan <james.ho...@imgtec.com>
Cc: Paul Burton <paul.bur...@imgtec.com>
Cc: Aaron Tomlin <atom...@redhat.com>
Cc: Andrew Morton <a...@linux-foundation.org>
Cc: linux-kernel@vger.kernel.org
Cc: linux-m...@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/14740/
Signed-off-by: Ralf Baechle <r...@linux-mips.org>
(cherry picked from commit fe8bd18ffea5327344d4ec2bf11f47951212abd0)
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 arch/mips/include/asm/irq.h| 12 
 arch/mips/kernel/asm-offsets.c |  1 +
 arch/mips/kernel/irq.c | 11 +++
 3 files changed, 24 insertions(+)

diff --git a/arch/mips/include/asm/irq.h b/arch/mips/include/asm/irq.h
index 6bf10e7..956db6e 100644
--- a/arch/mips/include/asm/irq.h
+++ b/arch/mips/include/asm/irq.h
@@ -17,6 +17,18 @@
 
 #include 
 
+#define IRQ_STACK_SIZE THREAD_SIZE
+
+extern void *irq_stack[NR_CPUS];
+
+static inline bool on_irq_stack(int cpu, unsigned long sp)
+{
+   unsigned long low = (unsigned long)irq_stack[cpu];
+   unsigned long high = low + IRQ_STACK_SIZE;
+
+   return (low <= sp && sp <= high);
+}
+
 #ifdef CONFIG_I8259
 static inline int irq_canonicalize(int irq)
 {
diff --git a/arch/mips/kernel/asm-offsets.c b/arch/mips/kernel/asm-offsets.c
index 6080582..a727769 100644
--- a/arch/mips/kernel/asm-offsets.c
+++ b/arch/mips/kernel/asm-offsets.c
@@ -102,6 +102,7 @@ void output_thread_info_defines(void)
OFFSET(TI_REGS, thread_info, regs);
DEFINE(_THREAD_SIZE, THREAD_SIZE);
DEFINE(_THREAD_MASK, THREAD_MASK);
+   DEFINE(_IRQ_STACK_SIZE, IRQ_STACK_SIZE);
BLANK();
 }
 
diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c
index f8f5836..ba150c7 100644
--- a/arch/mips/kernel/irq.c
+++ b/arch/mips/kernel/irq.c
@@ -25,6 +25,8 @@
 #include 
 #include 
 
+void *irq_stack[NR_CPUS];
+
 /*
  * 'what should we do if we get a hw irq event on an illegal vector'.
  * each architecture has to answer this themselves.
@@ -58,6 +60,15 @@ void __init init_IRQ(void)
clear_c0_status(ST0_IM);
 
arch_init_irq();
+
+   for_each_possible_cpu(i) {
+   int irq_pages = IRQ_STACK_SIZE / PAGE_SIZE;
+   void *s = (void *)__get_free_pages(GFP_KERNEL, irq_pages);
+
+   irq_stack[i] = s;
+   pr_debug("CPU%d IRQ stack at 0x%p - 0x%p\n", i,
+   irq_stack[i], irq_stack[i] + IRQ_STACK_SIZE);
+   }
 }
 
 #ifdef CONFIG_DEBUG_STACKOVERFLOW
-- 
2.7.4



[PATCH for-4.10 4/6] MIPS: Switch to the irq_stack in interrupts

2017-04-06 Thread Amit Pundir
From: Matt Redfearn <matt.redfe...@imgtec.com>

When enterring interrupt context via handle_int or except_vec_vi, switch
to the irq_stack of the current CPU if it is not already in use.

The current stack pointer is masked with the thread size and compared to
the base or the irq stack. If it does not match then the stack pointer
is set to the top of that stack, otherwise this is a nested irq being
handled on the irq stack so the stack pointer should be left as it was.

The in-use stack pointer is placed in the callee saved register s1. It
will be saved to the stack when plat_irq_dispatch is invoked and can be
restored once control returns here.

Signed-off-by: Matt Redfearn <matt.redfe...@imgtec.com>
Acked-by: Jason A. Donenfeld <ja...@zx2c4.com>
Cc: Thomas Gleixner <t...@linutronix.de>
Cc: James Hogan <james.ho...@imgtec.com>
Cc: Paul Burton <paul.bur...@imgtec.com>
Cc: linux-m...@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/14743/
Signed-off-by: Ralf Baechle <r...@linux-mips.org>
(cherry picked from commit dda45f701c9d7ad4ac0bb446e3a96f6df9a468d9)
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 arch/mips/kernel/genex.S | 81 +---
 1 file changed, 76 insertions(+), 5 deletions(-)

diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S
index dc0b296..0a7ba4b 100644
--- a/arch/mips/kernel/genex.S
+++ b/arch/mips/kernel/genex.S
@@ -187,9 +187,44 @@ NESTED(handle_int, PT_SIZE, sp)
 
LONG_L  s0, TI_REGS($28)
LONG_S  sp, TI_REGS($28)
-   PTR_LA  ra, ret_from_irq
-   PTR_LA  v0, plat_irq_dispatch
-   jr  v0
+
+   /*
+* SAVE_ALL ensures we are using a valid kernel stack for the thread.
+* Check if we are already using the IRQ stack.
+*/
+   moves1, sp # Preserve the sp
+
+   /* Get IRQ stack for this CPU */
+   ASM_CPUID_MFC0  k0, ASM_SMP_CPUID_REG
+#if defined(CONFIG_32BIT) || defined(KBUILD_64BIT_SYM32)
+   lui k1, %hi(irq_stack)
+#else
+   lui k1, %highest(irq_stack)
+   daddiu  k1, %higher(irq_stack)
+   dsllk1, 16
+   daddiu  k1, %hi(irq_stack)
+   dsllk1, 16
+#endif
+   LONG_SRLk0, SMP_CPUID_PTRSHIFT
+   LONG_ADDU   k1, k0
+   LONG_L  t0, %lo(irq_stack)(k1)
+
+   # Check if already on IRQ stack
+   PTR_LI  t1, ~(_THREAD_SIZE-1)
+   and t1, t1, sp
+   beq t0, t1, 2f
+
+   /* Switch to IRQ stack */
+   li  t1, _IRQ_STACK_SIZE
+   PTR_ADD sp, t0, t1
+
+2:
+   jal plat_irq_dispatch
+
+   /* Restore sp */
+   movesp, s1
+
+   j   ret_from_irq
 #ifdef CONFIG_CPU_MICROMIPS
nop
 #endif
@@ -262,8 +297,44 @@ NESTED(except_vec_vi_handler, 0, sp)
 
LONG_L  s0, TI_REGS($28)
LONG_S  sp, TI_REGS($28)
-   PTR_LA  ra, ret_from_irq
-   jr  v0
+
+   /*
+* SAVE_ALL ensures we are using a valid kernel stack for the thread.
+* Check if we are already using the IRQ stack.
+*/
+   moves1, sp # Preserve the sp
+
+   /* Get IRQ stack for this CPU */
+   ASM_CPUID_MFC0  k0, ASM_SMP_CPUID_REG
+#if defined(CONFIG_32BIT) || defined(KBUILD_64BIT_SYM32)
+   lui k1, %hi(irq_stack)
+#else
+   lui k1, %highest(irq_stack)
+   daddiu  k1, %higher(irq_stack)
+   dsllk1, 16
+   daddiu  k1, %hi(irq_stack)
+   dsllk1, 16
+#endif
+   LONG_SRLk0, SMP_CPUID_PTRSHIFT
+   LONG_ADDU   k1, k0
+   LONG_L  t0, %lo(irq_stack)(k1)
+
+   # Check if already on IRQ stack
+   PTR_LI  t1, ~(_THREAD_SIZE-1)
+   and t1, t1, sp
+   beq t0, t1, 2f
+
+   /* Switch to IRQ stack */
+   li  t1, _IRQ_STACK_SIZE
+   PTR_ADD sp, t0, t1
+
+2:
+   jal plat_irq_dispatch
+
+   /* Restore sp */
+   movesp, s1
+
+   j   ret_from_irq
END(except_vec_vi_handler)
 
 /*
-- 
2.7.4



[PATCH for-4.4 3/7] MIPS: Only change $28 to thread_info if coming from user mode

2017-04-06 Thread Amit Pundir
From: Matt Redfearn <matt.redfe...@imgtec.com>

The SAVE_SOME macro is used to save the execution context on all
exceptions.
If an exception occurs while executing user code, the stack is switched
to the kernel's stack for the current task, and register $28 is switched
to point to the current_thread_info, which is at the bottom of the stack
region.
If the exception occurs while executing kernel code, the stack is left,
and this change ensures that register $28 is not updated. This is the
correct behaviour when the kernel can be executing on the separate irq
stack, because the thread_info will not be at the base of it.

With this change, register $28 is only switched to it's kernel
conventional usage of the currrent thread info pointer at the point at
which execution enters kernel space. Doing it on every exception was
redundant, but OK without an IRQ stack, but will be erroneous once that
is introduced.

Signed-off-by: Matt Redfearn <matt.redfe...@imgtec.com>
Acked-by: Jason A. Donenfeld <ja...@zx2c4.com>
Cc: Thomas Gleixner <t...@linutronix.de>
Cc: James Hogan <james.ho...@imgtec.com>
Cc: Paul Burton <paul.bur...@imgtec.com>
Cc: linux-m...@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/14742/
Signed-off-by: Ralf Baechle <r...@linux-mips.org>
(cherry picked from commit 510d86362a27577f5ee23f46cfb354ad49731e61)
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 arch/mips/include/asm/stackframe.h | 7 +++
 1 file changed, 7 insertions(+)

diff --git a/arch/mips/include/asm/stackframe.h 
b/arch/mips/include/asm/stackframe.h
index a71da57..5347f13 100644
--- a/arch/mips/include/asm/stackframe.h
+++ b/arch/mips/include/asm/stackframe.h
@@ -216,12 +216,19 @@
LONG_S  $25, PT_R25(sp)
LONG_S  $28, PT_R28(sp)
LONG_S  $31, PT_R31(sp)
+
+   /* Set thread_info if we're coming from user mode */
+   mfc0k0, CP0_STATUS
+   sll k0, 3   /* extract cu0 bit */
+   bltzk0, 9f
+
ori $28, sp, _THREAD_MASK
xori$28, _THREAD_MASK
 #ifdef CONFIG_CPU_CAVIUM_OCTEON
.setmips64
pref0, 0($28)   /* Prefetch the current pointer */
 #endif
+9:
.setpop
.endm
 
-- 
2.7.4



[PATCH for-4.4 2/7] MIPS: Stack unwinding while on IRQ stack

2017-04-06 Thread Amit Pundir
From: Matt Redfearn <matt.redfe...@imgtec.com>

Within unwind stack, check if the stack pointer being unwound is within
the CPU's irq_stack and if so use that page rather than the task's stack
page.

Signed-off-by: Matt Redfearn <matt.redfe...@imgtec.com>
Acked-by: Jason A. Donenfeld <ja...@zx2c4.com>
Cc: Thomas Gleixner <t...@linutronix.de>
Cc: Adam Buchbinder <adam.buchbin...@gmail.com>
Cc: Maciej W. Rozycki <ma...@imgtec.com>
Cc: Marcin Nowakowski <marcin.nowakow...@imgtec.com>
Cc: Chris Metcalf <cmetc...@mellanox.com>
Cc: James Hogan <james.ho...@imgtec.com>
Cc: Paul Burton <paul.bur...@imgtec.com>
Cc: Jiri Slaby <jsl...@suse.cz>
Cc: Andrew Morton <a...@linux-foundation.org>
Cc: linux-m...@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/14741/
Signed-off-by: Ralf Baechle <r...@linux-mips.org>
(cherry picked from commit d42d8d106b0275b027c1e8992c42aecf933436ea)
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 arch/mips/kernel/process.c | 15 ++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index fc537d1..8c26eca 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -32,6 +32,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -552,7 +553,19 @@ EXPORT_SYMBOL(unwind_stack_by_address);
 unsigned long unwind_stack(struct task_struct *task, unsigned long *sp,
   unsigned long pc, unsigned long *ra)
 {
-   unsigned long stack_page = (unsigned long)task_stack_page(task);
+   unsigned long stack_page = 0;
+   int cpu;
+
+   for_each_possible_cpu(cpu) {
+   if (on_irq_stack(cpu, *sp)) {
+   stack_page = (unsigned long)irq_stack[cpu];
+   break;
+   }
+   }
+
+   if (!stack_page)
+   stack_page = (unsigned long)task_stack_page(task);
+
return unwind_stack_by_address(stack_page, sp, pc, ra);
 }
 #endif
-- 
2.7.4



[PATCH for-4.4 1/7] MIPS: Introduce irq_stack

2017-04-06 Thread Amit Pundir
From: Matt Redfearn <matt.redfe...@imgtec.com>

Allocate a per-cpu irq stack for use within interrupt handlers.

Also add a utility function on_irq_stack to determine if a given stack
pointer is within the irq stack for that cpu.

Signed-off-by: Matt Redfearn <matt.redfe...@imgtec.com>
Acked-by: Jason A. Donenfeld <ja...@zx2c4.com>
Cc: Thomas Gleixner <t...@linutronix.de>
Cc: Paolo Bonzini <pbonz...@redhat.com>
Cc: Chris Metcalf <cmetc...@mellanox.com>
Cc: Petr Mladek <pmla...@suse.com>
Cc: James Hogan <james.ho...@imgtec.com>
Cc: Paul Burton <paul.bur...@imgtec.com>
Cc: Aaron Tomlin <atom...@redhat.com>
Cc: Andrew Morton <a...@linux-foundation.org>
Cc: linux-kernel@vger.kernel.org
Cc: linux-m...@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/14740/
Signed-off-by: Ralf Baechle <r...@linux-mips.org>
(cherry picked from commit fe8bd18ffea5327344d4ec2bf11f47951212abd0)
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 arch/mips/include/asm/irq.h| 12 
 arch/mips/kernel/asm-offsets.c |  1 +
 arch/mips/kernel/irq.c | 11 +++
 3 files changed, 24 insertions(+)

diff --git a/arch/mips/include/asm/irq.h b/arch/mips/include/asm/irq.h
index 15e0fec..ebb9efb 100644
--- a/arch/mips/include/asm/irq.h
+++ b/arch/mips/include/asm/irq.h
@@ -17,6 +17,18 @@
 
 #include 
 
+#define IRQ_STACK_SIZE THREAD_SIZE
+
+extern void *irq_stack[NR_CPUS];
+
+static inline bool on_irq_stack(int cpu, unsigned long sp)
+{
+   unsigned long low = (unsigned long)irq_stack[cpu];
+   unsigned long high = low + IRQ_STACK_SIZE;
+
+   return (low <= sp && sp <= high);
+}
+
 #ifdef CONFIG_I8259
 static inline int irq_canonicalize(int irq)
 {
diff --git a/arch/mips/kernel/asm-offsets.c b/arch/mips/kernel/asm-offsets.c
index 154e203..ec053ce 100644
--- a/arch/mips/kernel/asm-offsets.c
+++ b/arch/mips/kernel/asm-offsets.c
@@ -101,6 +101,7 @@ void output_thread_info_defines(void)
OFFSET(TI_REGS, thread_info, regs);
DEFINE(_THREAD_SIZE, THREAD_SIZE);
DEFINE(_THREAD_MASK, THREAD_MASK);
+   DEFINE(_IRQ_STACK_SIZE, IRQ_STACK_SIZE);
BLANK();
 }
 
diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c
index 8eb5af8..dc1180a 100644
--- a/arch/mips/kernel/irq.c
+++ b/arch/mips/kernel/irq.c
@@ -25,6 +25,8 @@
 #include 
 #include 
 
+void *irq_stack[NR_CPUS];
+
 /*
  * 'what should we do if we get a hw irq event on an illegal vector'.
  * each architecture has to answer this themselves.
@@ -55,6 +57,15 @@ void __init init_IRQ(void)
irq_set_noprobe(i);
 
arch_init_irq();
+
+   for_each_possible_cpu(i) {
+   int irq_pages = IRQ_STACK_SIZE / PAGE_SIZE;
+   void *s = (void *)__get_free_pages(GFP_KERNEL, irq_pages);
+
+   irq_stack[i] = s;
+   pr_debug("CPU%d IRQ stack at 0x%p - 0x%p\n", i,
+   irq_stack[i], irq_stack[i] + IRQ_STACK_SIZE);
+   }
 }
 
 #ifdef CONFIG_DEBUG_STACKOVERFLOW
-- 
2.7.4



[PATCH for-4.4 4/7] MIPS: Switch to the irq_stack in interrupts

2017-04-06 Thread Amit Pundir
From: Matt Redfearn <matt.redfe...@imgtec.com>

When enterring interrupt context via handle_int or except_vec_vi, switch
to the irq_stack of the current CPU if it is not already in use.

The current stack pointer is masked with the thread size and compared to
the base or the irq stack. If it does not match then the stack pointer
is set to the top of that stack, otherwise this is a nested irq being
handled on the irq stack so the stack pointer should be left as it was.

The in-use stack pointer is placed in the callee saved register s1. It
will be saved to the stack when plat_irq_dispatch is invoked and can be
restored once control returns here.

Signed-off-by: Matt Redfearn <matt.redfe...@imgtec.com>
Acked-by: Jason A. Donenfeld <ja...@zx2c4.com>
Cc: Thomas Gleixner <t...@linutronix.de>
Cc: James Hogan <james.ho...@imgtec.com>
Cc: Paul Burton <paul.bur...@imgtec.com>
Cc: linux-m...@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/14743/
Signed-off-by: Ralf Baechle <r...@linux-mips.org>
(cherry picked from commit dda45f701c9d7ad4ac0bb446e3a96f6df9a468d9)
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 arch/mips/kernel/genex.S | 81 +---
 1 file changed, 76 insertions(+), 5 deletions(-)

diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S
index baa7b6f..2c7cd62 100644
--- a/arch/mips/kernel/genex.S
+++ b/arch/mips/kernel/genex.S
@@ -188,9 +188,44 @@ NESTED(handle_int, PT_SIZE, sp)
 
LONG_L  s0, TI_REGS($28)
LONG_S  sp, TI_REGS($28)
-   PTR_LA  ra, ret_from_irq
-   PTR_LA  v0, plat_irq_dispatch
-   jr  v0
+
+   /*
+* SAVE_ALL ensures we are using a valid kernel stack for the thread.
+* Check if we are already using the IRQ stack.
+*/
+   moves1, sp # Preserve the sp
+
+   /* Get IRQ stack for this CPU */
+   ASM_CPUID_MFC0  k0, ASM_SMP_CPUID_REG
+#if defined(CONFIG_32BIT) || defined(KBUILD_64BIT_SYM32)
+   lui k1, %hi(irq_stack)
+#else
+   lui k1, %highest(irq_stack)
+   daddiu  k1, %higher(irq_stack)
+   dsllk1, 16
+   daddiu  k1, %hi(irq_stack)
+   dsllk1, 16
+#endif
+   LONG_SRLk0, SMP_CPUID_PTRSHIFT
+   LONG_ADDU   k1, k0
+   LONG_L  t0, %lo(irq_stack)(k1)
+
+   # Check if already on IRQ stack
+   PTR_LI  t1, ~(_THREAD_SIZE-1)
+   and t1, t1, sp
+   beq t0, t1, 2f
+
+   /* Switch to IRQ stack */
+   li  t1, _IRQ_STACK_SIZE
+   PTR_ADD sp, t0, t1
+
+2:
+   jal plat_irq_dispatch
+
+   /* Restore sp */
+   movesp, s1
+
+   j   ret_from_irq
 #ifdef CONFIG_CPU_MICROMIPS
nop
 #endif
@@ -263,8 +298,44 @@ NESTED(except_vec_vi_handler, 0, sp)
 
LONG_L  s0, TI_REGS($28)
LONG_S  sp, TI_REGS($28)
-   PTR_LA  ra, ret_from_irq
-   jr  v0
+
+   /*
+* SAVE_ALL ensures we are using a valid kernel stack for the thread.
+* Check if we are already using the IRQ stack.
+*/
+   moves1, sp # Preserve the sp
+
+   /* Get IRQ stack for this CPU */
+   ASM_CPUID_MFC0  k0, ASM_SMP_CPUID_REG
+#if defined(CONFIG_32BIT) || defined(KBUILD_64BIT_SYM32)
+   lui k1, %hi(irq_stack)
+#else
+   lui k1, %highest(irq_stack)
+   daddiu  k1, %higher(irq_stack)
+   dsllk1, 16
+   daddiu  k1, %hi(irq_stack)
+   dsllk1, 16
+#endif
+   LONG_SRLk0, SMP_CPUID_PTRSHIFT
+   LONG_ADDU   k1, k0
+   LONG_L  t0, %lo(irq_stack)(k1)
+
+   # Check if already on IRQ stack
+   PTR_LI  t1, ~(_THREAD_SIZE-1)
+   and t1, t1, sp
+   beq t0, t1, 2f
+
+   /* Switch to IRQ stack */
+   li  t1, _IRQ_STACK_SIZE
+   PTR_ADD sp, t0, t1
+
+2:
+   jal plat_irq_dispatch
+
+   /* Restore sp */
+   movesp, s1
+
+   j   ret_from_irq
END(except_vec_vi_handler)
 
 /*
-- 
2.7.4



[PATCH for-4.4 5/7] MIPS: Select HAVE_IRQ_EXIT_ON_IRQ_STACK

2017-04-06 Thread Amit Pundir
From: Matt Redfearn <matt.redfe...@imgtec.com>

Since do_IRQ is now invoked on a separate IRQ stack, we select
HAVE_IRQ_EXIT_ON_IRQ_STACK so that softirq's may be invoked directly
from irq_exit(), rather than requiring do_softirq_own_stack.

Signed-off-by: Matt Redfearn <matt.redfe...@imgtec.com>
Acked-by: Jason A. Donenfeld <ja...@zx2c4.com>
Cc: Thomas Gleixner <t...@linutronix.de>
Cc: linux-m...@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/14744/
Signed-off-by: Ralf Baechle <r...@linux-mips.org>
(cherry picked from commit 3cc3434fd6307d06b53b98ce83e76bf9807689b9)
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 arch/mips/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index db45961..49c276c 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -9,6 +9,7 @@ config MIPS
select HAVE_CONTEXT_TRACKING
select HAVE_GENERIC_DMA_COHERENT
select HAVE_IDE
+   select HAVE_IRQ_EXIT_ON_IRQ_STACK
select HAVE_OPROFILE
select HAVE_PERF_EVENTS
select PERF_USE_VMALLOC
-- 
2.7.4



Re: [PATCH 3.18 000/145] 3.18.49-stable review

2017-04-17 Thread Amit Pundir
On 17 April 2017 at 12:26, Greg Kroah-Hartman
<gre...@linuxfoundation.org> wrote:
> On Sun, Apr 16, 2017 at 04:30:32PM -0700, Guenter Roeck wrote:
>> On 04/16/2017 03:48 AM, Greg Kroah-Hartman wrote:
>> > This is the start of the stable review cycle for the 3.18.49 release.
>> > There are 145 patches in this series, all will be posted as a response
>> > to this one.  If anyone has any issues with these being applied, please
>> > let me know.
>> >
>> > -
>> > Wait, what?  3.18?  Wasn't that kernel dead and forgotten and left to
>> > rot on the side of the road?  Yes, it was, but unfortunately, there's a
>> > few million or so devices out there in the wild that still rely on this
>> > kernel.  Now, some of their manufacturers and SoC vendors might not be
>> > keeping their kernels up to date very well, but some do actually care
>> > about security and their users, so this release is for them.  If you
>> > happen to have a vendor that does not care about their users, go
>> > complain, as odds are, your device is very insecure right now...
>> >
>> > Because of this strange situation, and thanks to some vendors backing
>> > the effort[1], I'll keep 3.18-stable alive in a semi-active mode, doing
>> > releases every once in a while to keep it up to date and working well
>> > based on what is happening in other more well-maintained stable kernels
>> > (hint, use 4.4 or 4.9 or newer PLEASE, if your vendor refuses to do so,
>> > switch vendors, it's the only way they will learn...)  I don't know how
>> > long I'll keep doing this, so if you care about 3.18, please contact me
>> > to let me know the expected lifespan of your device.
>> >
>> > And finally, due to the delay from the last 3.18-stable kernel release,
>> > there is a large backlog of patches, this is about 1/2 of the pending
>> > ones so far.  I'll be working on catching up to the rest of them over
>> > the next few weeks, and then the updates should be smaller than this
>> > one.
>> >
>> > ok, back to your normal form-letter stable -rc release notice:
>> > -
>> >
>> > Responses should be made by Tue Apr 18 08:01:19 UTC 2017.
>> > Anything received after that time might be too late.
>> >
>>
>> Build results:
>>   total: 140 pass: 139 fail: 1
>> Failed builds:
>>   parisc:allmodconfig
>>
>> Qemu test results:
>>   total: 111 pass: 111 fail: 0
>>
>> Fixing the build failure requires commit 6c8afa88adce ("Input: gscps2 - fix
>> MODULE_DEVICE_TABLE invocation").
>
> Ah, nice!  I'm pretty amazed that there was only one failure, thanks for
> testing all of these and letting me know.  I've also queued up this last
> patch for 3.18.

Can you please pick this one
https://www.spinics.net/lists/stable/msg166162.html as well. It fixes
ARCH=arm + CONFIG_SMP=n + CONFIG_ARM_PSCI=y builds.

Regards,
Amit Pundir

>
> thanks,
>
> greg k-h


Re: [PATCH 3.18 00/22] 3.18.61-stable review

2017-07-14 Thread Amit Pundir
On 14 July 2017 at 15:01, Greg Kroah-Hartman <gre...@linuxfoundation.org> wrote:
> On Thu, Jul 13, 2017 at 06:26:28PM -0700, Guenter Roeck wrote:
>> On 07/13/2017 08:42 AM, Greg Kroah-Hartman wrote:
>> > This is the start of the stable review cycle for the 3.18.61 release.
>> > There are 22 patches in this series, all will be posted as a response
>> > to this one.  If anyone has any issues with these being applied, please
>> > let me know.
>> >
>> > Responses should be made by Sat Jul 15 15:39:17 UTC 2017.
>> > Anything received after that time might be too late.
>> >
>>
>> Build results:
>>   total: 136 pass: 135 fail: 1
>> Failed builds:
>>   mips:bcm47xx_defconfig
>> Qemu test results:
>>   total: 111 pass: 111 fail: 0
>>
>> Build failure:
>>
>> drivers/net/ethernet/broadcom/bgmac.c: In function ‘bgmac_dma_rx_read’:
>> drivers/net/ethernet/broadcom/bgmac.c:376:14: error: 'BGMAC_RX_ALLOC_SIZE’ 
>> undeclared
>> drivers/net/ethernet/broadcom/bgmac.c:379:32: error: ‘buf’ undeclared
>>
>> Details are available at http://kerneltests.org/builders.
>
> Ick, problem is in patch bgmac-add-check-for-oversized-packets.patch
> from Amit.
>
> Amit, how did you test this it obviously doesn't build :(

argh.. ARCH=mips allmodconfig didn't catch that. I'm sorry about that.
I'll be more careful next time and build test relevant defconfigs as well.

Regards,
Amit Pundir

>
> I'm dropping it from the tree now...
>
> thanks,
>
> greg k-h


Re: [PATCH 02/37] binder: use group leader instead of open thread

2017-07-27 Thread Amit Pundir
Hi,

On 25 July 2017 at 14:43, Martijn Coenen <m...@google.com> wrote:
> Hi John,
>
> On Mon, Jul 24, 2017 at 11:07 PM, John Stultz <john.stu...@linaro.org> wrote:
>>
>> 12-31 16:00:36.632  2518  2584 E hw-ProcessState: Using /dev/hwbinder
>> failed: unable to mmap transaction memory.
>
> This doesn't look right. Is there anything in the kernel log?

There is a slight difference in this patch and the one that got pushed
in android-4.9[1]. I cherry-picked those changes and got BT/WiFi
working again on Hikey with mainline tracking (4.13-rc2) tree.

Regards,
Amit Pundir
[1] 
https://android.googlesource.com/kernel/common/+/872c26eb0776ef160447d8703779e2bce0b7230a%5E%21/#F0

>
>> 12-31 16:00:36.632  2518  2566 D bt_hci  : hci_module_start_up
>> starting async portion
>> 12-31 16:00:36.632  2518  2584 E
>> android.hardware.bluetooth@1.0::BluetoothHci: getService:
>> defaultServiceManager()->getTransport returns
>> Status(EX_TRANSACTION_FAILED): '-9 Bad file descriptor: '
>> 12-31 16:00:36.633  2518  2584 F :
>> [1231/160036:FATAL:hci_layer_android.cc(109)] Check failed: btHci !=
>> nullptr.
>> 12-31 16:00:36.634  2518  2584 F libc: Fatal signal 6 (SIGABRT),
>> code -6 in tid 2584 (hci_thread)
>> ...
>> 12-31 16:00:38.027  2009  2061 E SupplicantStaIfaceHal: Exception
>> while trying to register a listener for ISupplicant service:
>> android.os.RemoteException: HwBinder Error: (-2147483648)
>> 12-31 16:00:38.027  2009  2061 E WifiMonitor: startMonitoring(wlan0) failed!
>> 12-31 16:00:38.028  2009  2061 E SupplicantStaIfaceHal: Can't call
>> setDebugParams, ISupplicant is null
>> 12-31 16:00:38.030  2009  2061 D WifiConfigStore: Reading from stores
>> completed in 2 ms.
>> 12-31 16:00:38.034  2009  2061 D WIFI: Registering NetworkFactory
>> 12-31 16:00:38.035  2009  2061 D WIFI_UT : Registering NetworkFactory
>> 12-31 16:00:38.035  2009  2065 D ConnectivityService: Got
>> NetworkFactory Messenger for WIFI
>> 12-31 16:00:38.035  2009  2065 D ConnectivityService: Got
>> NetworkFactory Messenger for WIFI_UT
>> 12-31 16:00:38.037  2009  2061 D WifiConfigStore: Reading from user
>> store completed in 2 ms.
>> 12-31 16:00:38.055  2009  2061 D WifiConfigStore: Writing to stores
>> completed in 17 ms.
>> 12-31 16:00:38.055  2009  2061 E WifiStateMachine: Failed to setup
>> control channel, restart supplicant
>> ...
>> etc.
>>
>> thanks
>> -john


Re: [PATCH 02/37] binder: use group leader instead of open thread

2017-07-27 Thread Amit Pundir
On 27 July 2017 at 18:53, Greg Kroah-Hartman <gre...@linuxfoundation.org> wrote:
> On Thu, Jul 27, 2017 at 02:38:30PM +0530, Amit Pundir wrote:
>> Hi,
>>
>> On 25 July 2017 at 14:43, Martijn Coenen <m...@google.com> wrote:
>> > Hi John,
>> >
>> > On Mon, Jul 24, 2017 at 11:07 PM, John Stultz <john.stu...@linaro.org> 
>> > wrote:
>> >>
>> >> 12-31 16:00:36.632  2518  2584 E hw-ProcessState: Using /dev/hwbinder
>> >> failed: unable to mmap transaction memory.
>> >
>> > This doesn't look right. Is there anything in the kernel log?
>>
>> There is a slight difference in this patch and the one that got pushed
>> in android-4.9[1]. I cherry-picked those changes and got BT/WiFi
>> working again on Hikey with mainline tracking (4.13-rc2) tree.
>>
>> Regards,
>> Amit Pundir
>> [1] 
>> https://android.googlesource.com/kernel/common/+/872c26eb0776ef160447d8703779e2bce0b7230a%5E%21/#F0
>
> And what is that difference?

These couple of lines of change:

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index f7665c31feca..d7291a5a13e1 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -3362,7 +3362,7 @@ static int binder_mmap(struct file *filp, struct
vm_area_struct *vma)
const char *failure_string;
struct binder_buffer *buffer;

-   if (proc->tsk != current)
+   if (proc->tsk != current->group_leader)
return -EINVAL;

if ((vma->vm_end - vma->vm_start) > SZ_4M)
@@ -3466,6 +3466,7 @@ static int binder_open(struct inode *nodp,
struct file *filp)
return -ENOMEM;
get_task_struct(current->group_leader);
proc->tsk = current->group_leader;
+   proc->vma_vm_mm = current->group_leader->mm;
INIT_LIST_HEAD(>todo);
init_waitqueue_head(>wait);
proc->default_priority = task_nice(current);

John reported hw_binder mmap failure in his logcat. So I'm assuming
that the check in binder_mmap is where the binder failed and returned.

Regards,
Amit Pundir


[PATCH for-4.4 09/16] MIPS: ralink: fix MT7628 wled_an pinmux gpio

2017-06-29 Thread Amit Pundir
From: Álvaro Fernández Rojas <nolt...@gmail.com>

commit 07b50db6e685172a41b9978aebffb2438166d9b6 upstream.

Signed-off-by: Álvaro Fernández Rojas <nolt...@gmail.com>
Cc: j...@phrozen.org
Cc: linux-m...@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/13307/
Signed-off-by: Ralf Baechle <r...@linux-mips.org>
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 arch/mips/ralink/mt7620.c | 8 
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/mips/ralink/mt7620.c b/arch/mips/ralink/mt7620.c
index 37cfc7d3c185..48d6349fd9d7 100644
--- a/arch/mips/ralink/mt7620.c
+++ b/arch/mips/ralink/mt7620.c
@@ -196,10 +196,10 @@ static struct rt2880_pmx_func wled_kn_grp_mt7628[] = {
 };
 
 static struct rt2880_pmx_func wled_an_grp_mt7628[] = {
-   FUNC("rsvd", 3, 35, 1),
-   FUNC("rsvd", 2, 35, 1),
-   FUNC("gpio", 1, 35, 1),
-   FUNC("wled_an", 0, 35, 1),
+   FUNC("rsvd", 3, 44, 1),
+   FUNC("rsvd", 2, 44, 1),
+   FUNC("gpio", 1, 44, 1),
+   FUNC("wled_an", 0, 44, 1),
 };
 
 #define MT7628_GPIO_MODE_MASK  0x3
-- 
2.7.4



[PATCH for-4.4 08/16] MIPS: ralink: fix MT7628 pinmux typos

2017-06-29 Thread Amit Pundir
From: Álvaro Fernández Rojas <nolt...@gmail.com>

commit d7146829c9da24e285cb1b1f2156b5b3e2d40c07 upstream.

Signed-off-by: Álvaro Fernández Rojas <nolt...@gmail.com>
Cc: j...@phrozen.org
Cc: linux-m...@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/13306/
Signed-off-by: Ralf Baechle <r...@linux-mips.org>
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 arch/mips/ralink/mt7620.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/mips/ralink/mt7620.c b/arch/mips/ralink/mt7620.c
index 4c17dc6e8ae9..37cfc7d3c185 100644
--- a/arch/mips/ralink/mt7620.c
+++ b/arch/mips/ralink/mt7620.c
@@ -223,9 +223,9 @@ static struct rt2880_pmx_func wled_an_grp_mt7628[] = {
 #define MT7628_GPIO_MODE_GPIO  0
 
 static struct rt2880_pmx_group mt7628an_pinmux_data[] = {
-   GRP_G("pmw1", pwm1_grp_mt7628, MT7628_GPIO_MODE_MASK,
+   GRP_G("pwm1", pwm1_grp_mt7628, MT7628_GPIO_MODE_MASK,
1, MT7628_GPIO_MODE_PWM1),
-   GRP_G("pmw0", pwm0_grp_mt7628, MT7628_GPIO_MODE_MASK,
+   GRP_G("pwm0", pwm0_grp_mt7628, MT7628_GPIO_MODE_MASK,
1, MT7628_GPIO_MODE_PWM0),
GRP_G("uart2", uart2_grp_mt7628, MT7628_GPIO_MODE_MASK,
1, MT7628_GPIO_MODE_UART2),
-- 
2.7.4



Re: [PATCH 3/3] ANDROID: binder: fix proc->tsk check.

2017-07-30 Thread Amit Pundir
On 28 July 2017 at 17:26, Martijn Coenen <m...@android.com> wrote:
> Commit c4ea41ba195d ("binder: use group leader instead of open thread")'
> was incomplete and didn't update a check in binder_mmap(), causing all
> mmap() calls into the binder driver to fail.
>

Fixes Android WiFi/BT regression reported on 4.13-rc2.

Tested-by: Amit Pundir <amit.pun...@linaro.org>

> Signed-off-by: Martijn Coenen <m...@android.com>
> ---
>  drivers/android/binder.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/android/binder.c b/drivers/android/binder.c
> index f7665c31feca..831cdd7d197d 100644
> --- a/drivers/android/binder.c
> +++ b/drivers/android/binder.c
> @@ -3362,7 +3362,7 @@ static int binder_mmap(struct file *filp, struct 
> vm_area_struct *vma)
> const char *failure_string;
> struct binder_buffer *buffer;
>
> -   if (proc->tsk != current)
> +   if (proc->tsk != current->group_leader)
> return -EINVAL;
>
> if ((vma->vm_end - vma->vm_start) > SZ_4M)
> --
> 2.14.0.rc0.400.g1c36432dff-goog
>


[PATCH 5/9] config: android-base: add CONFIG_IKCONFIG option

2017-06-08 Thread Amit Pundir
From: Greg Kroah-Hartman <gre...@google.com>

This adds CONFIG_IKCONFIG and CONFIG_IKCONFIG_PROC options, which are a
requirement for the O release.

Reviewed-at: https://android-review.googlesource.com/#/c/364553/

Signed-off-by: Greg Kroah-Hartman <gre...@google.com>
[AmitP: cherry-picked this change from Android common kernel]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 kernel/configs/android-base.config | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/configs/android-base.config 
b/kernel/configs/android-base.config
index efe5ff86767e..e12cfec25758 100644
--- a/kernel/configs/android-base.config
+++ b/kernel/configs/android-base.config
@@ -25,6 +25,8 @@ CONFIG_EMBEDDED=y
 CONFIG_FB=y
 CONFIG_HARDENED_USERCOPY=y
 CONFIG_HIGH_RES_TIMERS=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
 CONFIG_INET6_AH=y
 CONFIG_INET6_ESP=y
 CONFIG_INET6_IPCOMP=y
-- 
2.7.4



[PATCH 0/9] kernel/configs: Android config fragment updates

2017-06-08 Thread Amit Pundir
Hi,

Following are the Android config fragment changes cherry-picked from
Android common kernel for your consideration. Config fragments are
folded or re-placed in sorted order wherever required.

Regards,
Amit Pundir

Chenbo Feng (1):
  config: android-base: add CGROUP_BPF

Greg Kroah-Hartman (2):
  config: android-base: add CONFIG_IKCONFIG option
  config: android-base: add CONFIG_MODULES option

Jeff Vander Stoep (1):
  config: android-recommended: enable fstack-protector-strong

Lorenzo Colitti (1):
  config: android-base: enable CONFIG_INET_DIAG_DESTROY

Max Shi (1):
  config: android-base: disable CONFIG_USELIB and CONFIG_FHANDLE

Roberto Pereira (1):
  config: android-base: disable CONFIG_NFSD and CONFIG_NFS_FS

Sami Tolvanen (2):
  config: android-recommended: enable ARM64_SW_TTBR0_PAN
  config: android-recommended: enable CONFIG_CPU_SW_DOMAIN_PAN

 kernel/configs/android-base.config| 12 +++-
 kernel/configs/android-recommended.config |  5 -
 2 files changed, 15 insertions(+), 2 deletions(-)

-- 
2.7.4



[PATCH 7/9] config: android-base: enable CONFIG_INET_DIAG_DESTROY

2017-06-08 Thread Amit Pundir
From: Lorenzo Colitti <lore...@google.com>

As of Android N, this is required to close sockets when a
network disconnects.

Reviewed-at: https://android-review.googlesource.com/#/c/322674/

[AmitP: cherry-picked this change from Android common kernel]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 kernel/configs/android-base.config | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/configs/android-base.config 
b/kernel/configs/android-base.config
index 62cb392fc34b..5ecedaaf7c2e 100644
--- a/kernel/configs/android-base.config
+++ b/kernel/configs/android-base.config
@@ -27,6 +27,7 @@ CONFIG_HIGH_RES_TIMERS=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_INET6_AH=y
+CONFIG_INET6_DIAG_DESTROY=y
 CONFIG_INET6_ESP=y
 CONFIG_INET6_IPCOMP=y
 CONFIG_INET=y
-- 
2.7.4



[PATCH 1/9] config: android-recommended: enable fstack-protector-strong

2017-06-08 Thread Amit Pundir
From: Jeff Vander Stoep <je...@google.com>

If compiler has stack protector support, set
CONFIG_CC_STACKPROTECTOR_STRONG.

Reviewed-at: https://android-review.googlesource.com/#/c/238388/

Signed-off-by: Jeff Vander Stoep <je...@google.com>
[AmitP: cherry-picked this change from Android common kernel]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 kernel/configs/android-recommended.config | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/configs/android-recommended.config 
b/kernel/configs/android-recommended.config
index 28ee064b6744..a86faa41bfd2 100644
--- a/kernel/configs/android-recommended.config
+++ b/kernel/configs/android-recommended.config
@@ -11,6 +11,7 @@ CONFIG_BLK_DEV_DM=y
 CONFIG_BLK_DEV_LOOP=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=8192
+CONFIG_CC_STACKPROTECTOR_STRONG=y
 CONFIG_COMPACTION=y
 CONFIG_STRICT_KERNEL_RWX=y
 CONFIG_DM_CRYPT=y
-- 
2.7.4



[PATCH 2/9] config: android-recommended: enable CONFIG_ARM64_SW_TTBR0_PAN

2017-06-08 Thread Amit Pundir
From: Sami Tolvanen <samitolva...@google.com>

Enable PAN emulation using TTBR0_EL1 switching.

Reviewed-at: https://android-review.googlesource.com/#/c/325997/

Signed-off-by: Sami Tolvanen <samitolva...@google.com>
[AmitP: cherry-picked this change from Android common kernel
and updated the commit message]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 kernel/configs/android-recommended.config | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/configs/android-recommended.config 
b/kernel/configs/android-recommended.config
index a86faa41bfd2..a02c447769f7 100644
--- a/kernel/configs/android-recommended.config
+++ b/kernel/configs/android-recommended.config
@@ -6,6 +6,7 @@
 # CONFIG_NF_CONNTRACK_SIP is not set
 # CONFIG_PM_WAKELOCKS_GC is not set
 # CONFIG_VT is not set
+CONFIG_ARM64_SW_TTBR0_PAN=y
 CONFIG_BACKLIGHT_LCD_SUPPORT=y
 CONFIG_BLK_DEV_DM=y
 CONFIG_BLK_DEV_LOOP=y
-- 
2.7.4



[PATCH 8/9] config: android-base: add CGROUP_BPF

2017-06-08 Thread Amit Pundir
From: Chenbo Feng <fe...@google.com>

Add CONFIG_CGROUP_BPF as a default configuration in android base config
since it is used to replace XT_QTAGUID in future.

Reviewed-at: https://android-review.googlesource.com/#/c/400374/

Signed-off-by: Chenbo Feng <fe...@google.com>
[AmitP: cherry-picked this change from Android common kernel]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 kernel/configs/android-base.config | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/configs/android-base.config 
b/kernel/configs/android-base.config
index 5ecedaaf7c2e..01b186c5ef18 100644
--- a/kernel/configs/android-base.config
+++ b/kernel/configs/android-base.config
@@ -14,6 +14,7 @@ CONFIG_ASHMEM=y
 CONFIG_AUDIT=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_CGROUPS=y
+CONFIG_CGROUP_BPF=y
 CONFIG_CGROUP_CPUACCT=y
 CONFIG_CGROUP_DEBUG=y
 CONFIG_CGROUP_FREEZER=y
-- 
2.7.4



[PATCH 9/9] config: android-base: disable CONFIG_NFSD and CONFIG_NFS_FS

2017-06-08 Thread Amit Pundir
From: Roberto Pereira <rp...@google.com>

Disable Network file system support.

Reviewed-at: https://android-review.googlesource.com/#/c/409559/

Signed-off-by: Roberto Pereira <rp...@google.com>
[AmitP: cherry-picked this change from Android common kernel
and updated commit message]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 kernel/configs/android-base.config | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/configs/android-base.config 
b/kernel/configs/android-base.config
index 01b186c5ef18..dadb830413a3 100644
--- a/kernel/configs/android-base.config
+++ b/kernel/configs/android-base.config
@@ -3,6 +3,8 @@
 # CONFIG_DEVMEM is not set
 # CONFIG_FHANDLE is not set
 # CONFIG_INET_LRO is not set
+# CONFIG_NFSD is not set
+# CONFIG_NFS_FS is not set
 # CONFIG_OABI_COMPAT is not set
 # CONFIG_SYSVIPC is not set
 # CONFIG_USELIB is not set
-- 
2.7.4



[PATCH 4/9] config: android-recommended: enable CONFIG_CPU_SW_DOMAIN_PAN

2017-06-08 Thread Amit Pundir
From: Sami Tolvanen <samitolva...@google.com>

Enable CPU domain PAN to ensure that normal kernel accesses are
unable to access userspace addresses.

Reviewed-at: https://android-review.googlesource.com/#/c/334035/

Signed-off-by: Sami Tolvanen <samitolva...@google.com>
[AmitP: cherry-picked this change from Android common kernel, updated
the commit message and re-placed the CONFIG_STRICT_KERNEL_RWX
config in sorted order]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 kernel/configs/android-recommended.config | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/configs/android-recommended.config 
b/kernel/configs/android-recommended.config
index a02c447769f7..946fb92418f7 100644
--- a/kernel/configs/android-recommended.config
+++ b/kernel/configs/android-recommended.config
@@ -14,7 +14,7 @@ CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=8192
 CONFIG_CC_STACKPROTECTOR_STRONG=y
 CONFIG_COMPACTION=y
-CONFIG_STRICT_KERNEL_RWX=y
+CONFIG_CPU_SW_DOMAIN_PAN=y
 CONFIG_DM_CRYPT=y
 CONFIG_DM_UEVENT=y
 CONFIG_DM_VERITY=y
@@ -107,6 +107,7 @@ CONFIG_SCHEDSTATS=y
 CONFIG_SMARTJOYPLUS_FF=y
 CONFIG_SND=y
 CONFIG_SOUND=y
+CONFIG_STRICT_KERNEL_RWX=y
 CONFIG_SUSPEND_TIME=y
 CONFIG_TABLET_USB_ACECAD=y
 CONFIG_TABLET_USB_AIPTEK=y
-- 
2.7.4



[PATCH 6/9] config: android-base: add CONFIG_MODULES option

2017-06-08 Thread Amit Pundir
From: Greg Kroah-Hartman <gre...@google.com>

This adds CONFIG_MODULES, CONFIG_MODULE_UNLOAD, and CONFIG_MODVERSIONS
which are required by the O release.

Reviewed-at: https://android-review.googlesource.com/#/c/364554/

Signed-off-by: Greg Kroah-Hartman <gre...@google.com>
[AmitP: cherry-picked this change from Android common kernel]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 kernel/configs/android-base.config | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/configs/android-base.config 
b/kernel/configs/android-base.config
index e12cfec25758..62cb392fc34b 100644
--- a/kernel/configs/android-base.config
+++ b/kernel/configs/android-base.config
@@ -3,7 +3,6 @@
 # CONFIG_DEVMEM is not set
 # CONFIG_FHANDLE is not set
 # CONFIG_INET_LRO is not set
-# CONFIG_MODULES is not set
 # CONFIG_OABI_COMPAT is not set
 # CONFIG_SYSVIPC is not set
 # CONFIG_USELIB is not set
@@ -64,6 +63,9 @@ CONFIG_IP_NF_TARGET_MASQUERADE=y
 CONFIG_IP_NF_TARGET_NETMAP=y
 CONFIG_IP_NF_TARGET_REDIRECT=y
 CONFIG_IP_NF_TARGET_REJECT=y
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_MODVERSIONS=y
 CONFIG_NET=y
 CONFIG_NETDEVICES=y
 CONFIG_NETFILTER=y
-- 
2.7.4



[PATCH 3/9] config: android-base: disable CONFIG_USELIB and CONFIG_FHANDLE

2017-06-08 Thread Amit Pundir
From: Max Shi <meixuan...@google.com>

Turn off the two kernel configs to disable related system ABI.

Reviewed-at: https://android-review.googlesource.com/#/c/264976/

Signed-off-by: Max Shi <meixuan...@google.com>
[AmitP: cherry-picked this change from Android common kernel]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 kernel/configs/android-base.config | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/configs/android-base.config 
b/kernel/configs/android-base.config
index 26a06e09a5bd..efe5ff86767e 100644
--- a/kernel/configs/android-base.config
+++ b/kernel/configs/android-base.config
@@ -1,10 +1,12 @@
 #  KEEP ALPHABETICALLY SORTED
 # CONFIG_DEVKMEM is not set
 # CONFIG_DEVMEM is not set
+# CONFIG_FHANDLE is not set
 # CONFIG_INET_LRO is not set
 # CONFIG_MODULES is not set
 # CONFIG_OABI_COMPAT is not set
 # CONFIG_SYSVIPC is not set
+# CONFIG_USELIB is not set
 CONFIG_ANDROID=y
 CONFIG_ANDROID_BINDER_IPC=y
 CONFIG_ANDROID_LOW_MEMORY_KILLER=y
-- 
2.7.4



Re: [PATCH 7/9] config: android-base: enable CONFIG_INET_DIAG_DESTROY

2017-06-08 Thread Amit Pundir
On 8 June 2017 at 15:32, Lorenzo Colitti <lore...@google.com> wrote:
> On Thu, Jun 8, 2017 at 6:55 PM, Amit Pundir <amit.pun...@linaro.org> wrote:
>> Reviewed-at: https://android-review.googlesource.com/#/c/322674/
>
> Note: that change was a mistake.
>
>> --- a/kernel/configs/android-base.config
>> +++ b/kernel/configs/android-base.config
>> @@ -27,6 +27,7 @@ CONFIG_HIGH_RES_TIMERS=y
>>  CONFIG_IKCONFIG=y
>>  CONFIG_IKCONFIG_PROC=y
>>  CONFIG_INET6_AH=y
>> +CONFIG_INET6_DIAG_DESTROY=y
>
> CONFIG_INET6_DIAG_DESTROY does not exist. The correct variable is
> CONFIG_INET_DIAG_DESTROY.

Thanks for pointing it out. I grep-ed for "CONFIG_INET_DIAG_DESTROY"
as mentioned in the subject line before sending but didn't notice the
actual change. I'll re-spin the series.

Regards,
Amit Pundir


[PATCH v2 0/8] kernel/configs: Android config fragment updates

2017-06-08 Thread Amit Pundir
Hi,

Following are the Android config fragment changes cherry-picked from
Android common kernel for your consideration. Config fragments are
folded or re-placed in sorted order wherever required.

Changes since v1:
Dropped that one patch adding non-existent config.

Regards,
Amit Pundir


Chenbo Feng (1):
  config: android-base: add CGROUP_BPF

Greg Kroah-Hartman (2):
  config: android-base: add CONFIG_IKCONFIG option
  config: android-base: add CONFIG_MODULES option

Jeff Vander Stoep (1):
  config: android-recommended: enable fstack-protector-strong

Max Shi (1):
  config: android-base: disable CONFIG_USELIB and CONFIG_FHANDLE

Roberto Pereira (1):
  config: android-base: disable CONFIG_NFSD and CONFIG_NFS_FS

Sami Tolvanen (2):
  config: android-recommended: enable CONFIG_ARM64_SW_TTBR0_PAN
  config: android-recommended: enable CONFIG_CPU_SW_DOMAIN_PAN

 kernel/configs/android-base.config| 11 ++-
 kernel/configs/android-recommended.config |  5 -
 2 files changed, 14 insertions(+), 2 deletions(-)

-- 
2.7.4



[PATCH v2 2/8] config: android-recommended: enable CONFIG_ARM64_SW_TTBR0_PAN

2017-06-08 Thread Amit Pundir
From: Sami Tolvanen <samitolva...@google.com>

Enable PAN emulation using TTBR0_EL1 switching.

Reviewed-at: https://android-review.googlesource.com/#/c/325997/

Signed-off-by: Sami Tolvanen <samitolva...@google.com>
[AmitP: cherry-picked this change from Android common kernel
and updated the commit message]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 kernel/configs/android-recommended.config | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/configs/android-recommended.config 
b/kernel/configs/android-recommended.config
index a86faa41bfd2..a02c447769f7 100644
--- a/kernel/configs/android-recommended.config
+++ b/kernel/configs/android-recommended.config
@@ -6,6 +6,7 @@
 # CONFIG_NF_CONNTRACK_SIP is not set
 # CONFIG_PM_WAKELOCKS_GC is not set
 # CONFIG_VT is not set
+CONFIG_ARM64_SW_TTBR0_PAN=y
 CONFIG_BACKLIGHT_LCD_SUPPORT=y
 CONFIG_BLK_DEV_DM=y
 CONFIG_BLK_DEV_LOOP=y
-- 
2.7.4



[PATCH v2 1/8] config: android-recommended: enable fstack-protector-strong

2017-06-08 Thread Amit Pundir
From: Jeff Vander Stoep <je...@google.com>

If compiler has stack protector support, set
CONFIG_CC_STACKPROTECTOR_STRONG.

Reviewed-at: https://android-review.googlesource.com/#/c/238388/

Signed-off-by: Jeff Vander Stoep <je...@google.com>
[AmitP: cherry-picked this change from Android common kernel]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 kernel/configs/android-recommended.config | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/configs/android-recommended.config 
b/kernel/configs/android-recommended.config
index 28ee064b6744..a86faa41bfd2 100644
--- a/kernel/configs/android-recommended.config
+++ b/kernel/configs/android-recommended.config
@@ -11,6 +11,7 @@ CONFIG_BLK_DEV_DM=y
 CONFIG_BLK_DEV_LOOP=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=8192
+CONFIG_CC_STACKPROTECTOR_STRONG=y
 CONFIG_COMPACTION=y
 CONFIG_STRICT_KERNEL_RWX=y
 CONFIG_DM_CRYPT=y
-- 
2.7.4



[PATCH v2 3/8] config: android-base: disable CONFIG_USELIB and CONFIG_FHANDLE

2017-06-08 Thread Amit Pundir
From: Max Shi <meixuan...@google.com>

Turn off the two kernel configs to disable related system ABI.

Reviewed-at: https://android-review.googlesource.com/#/c/264976/

Signed-off-by: Max Shi <meixuan...@google.com>
[AmitP: cherry-picked this change from Android common kernel]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 kernel/configs/android-base.config | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/configs/android-base.config 
b/kernel/configs/android-base.config
index 26a06e09a5bd..efe5ff86767e 100644
--- a/kernel/configs/android-base.config
+++ b/kernel/configs/android-base.config
@@ -1,10 +1,12 @@
 #  KEEP ALPHABETICALLY SORTED
 # CONFIG_DEVKMEM is not set
 # CONFIG_DEVMEM is not set
+# CONFIG_FHANDLE is not set
 # CONFIG_INET_LRO is not set
 # CONFIG_MODULES is not set
 # CONFIG_OABI_COMPAT is not set
 # CONFIG_SYSVIPC is not set
+# CONFIG_USELIB is not set
 CONFIG_ANDROID=y
 CONFIG_ANDROID_BINDER_IPC=y
 CONFIG_ANDROID_LOW_MEMORY_KILLER=y
-- 
2.7.4



[PATCH v2 4/8] config: android-recommended: enable CONFIG_CPU_SW_DOMAIN_PAN

2017-06-08 Thread Amit Pundir
From: Sami Tolvanen <samitolva...@google.com>

Enable CPU domain PAN to ensure that normal kernel accesses are
unable to access userspace addresses.

Reviewed-at: https://android-review.googlesource.com/#/c/334035/

Signed-off-by: Sami Tolvanen <samitolva...@google.com>
[AmitP: cherry-picked this change from Android common kernel, updated
the commit message and re-placed the CONFIG_STRICT_KERNEL_RWX
config in sorted order]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 kernel/configs/android-recommended.config | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/configs/android-recommended.config 
b/kernel/configs/android-recommended.config
index a02c447769f7..946fb92418f7 100644
--- a/kernel/configs/android-recommended.config
+++ b/kernel/configs/android-recommended.config
@@ -14,7 +14,7 @@ CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=8192
 CONFIG_CC_STACKPROTECTOR_STRONG=y
 CONFIG_COMPACTION=y
-CONFIG_STRICT_KERNEL_RWX=y
+CONFIG_CPU_SW_DOMAIN_PAN=y
 CONFIG_DM_CRYPT=y
 CONFIG_DM_UEVENT=y
 CONFIG_DM_VERITY=y
@@ -107,6 +107,7 @@ CONFIG_SCHEDSTATS=y
 CONFIG_SMARTJOYPLUS_FF=y
 CONFIG_SND=y
 CONFIG_SOUND=y
+CONFIG_STRICT_KERNEL_RWX=y
 CONFIG_SUSPEND_TIME=y
 CONFIG_TABLET_USB_ACECAD=y
 CONFIG_TABLET_USB_AIPTEK=y
-- 
2.7.4



[PATCH v2 6/8] config: android-base: add CONFIG_MODULES option

2017-06-08 Thread Amit Pundir
From: Greg Kroah-Hartman <gre...@google.com>

This adds CONFIG_MODULES, CONFIG_MODULE_UNLOAD, and CONFIG_MODVERSIONS
which are required by the O release.

Reviewed-at: https://android-review.googlesource.com/#/c/364554/

Signed-off-by: Greg Kroah-Hartman <gre...@google.com>
[AmitP: cherry-picked this change from Android common kernel]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 kernel/configs/android-base.config | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/configs/android-base.config 
b/kernel/configs/android-base.config
index e12cfec25758..62cb392fc34b 100644
--- a/kernel/configs/android-base.config
+++ b/kernel/configs/android-base.config
@@ -3,7 +3,6 @@
 # CONFIG_DEVMEM is not set
 # CONFIG_FHANDLE is not set
 # CONFIG_INET_LRO is not set
-# CONFIG_MODULES is not set
 # CONFIG_OABI_COMPAT is not set
 # CONFIG_SYSVIPC is not set
 # CONFIG_USELIB is not set
@@ -64,6 +63,9 @@ CONFIG_IP_NF_TARGET_MASQUERADE=y
 CONFIG_IP_NF_TARGET_NETMAP=y
 CONFIG_IP_NF_TARGET_REDIRECT=y
 CONFIG_IP_NF_TARGET_REJECT=y
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_MODVERSIONS=y
 CONFIG_NET=y
 CONFIG_NETDEVICES=y
 CONFIG_NETFILTER=y
-- 
2.7.4



[PATCH v2 5/8] config: android-base: add CONFIG_IKCONFIG option

2017-06-08 Thread Amit Pundir
From: Greg Kroah-Hartman <gre...@google.com>

This adds CONFIG_IKCONFIG and CONFIG_IKCONFIG_PROC options, which are a
requirement for the O release.

Reviewed-at: https://android-review.googlesource.com/#/c/364553/

Signed-off-by: Greg Kroah-Hartman <gre...@google.com>
[AmitP: cherry-picked this change from Android common kernel]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 kernel/configs/android-base.config | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/configs/android-base.config 
b/kernel/configs/android-base.config
index efe5ff86767e..e12cfec25758 100644
--- a/kernel/configs/android-base.config
+++ b/kernel/configs/android-base.config
@@ -25,6 +25,8 @@ CONFIG_EMBEDDED=y
 CONFIG_FB=y
 CONFIG_HARDENED_USERCOPY=y
 CONFIG_HIGH_RES_TIMERS=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
 CONFIG_INET6_AH=y
 CONFIG_INET6_ESP=y
 CONFIG_INET6_IPCOMP=y
-- 
2.7.4



[PATCH v2 8/8] config: android-base: disable CONFIG_NFSD and CONFIG_NFS_FS

2017-06-08 Thread Amit Pundir
From: Roberto Pereira <rp...@google.com>

Disable Network file system support.

Reviewed-at: https://android-review.googlesource.com/#/c/409559/

Signed-off-by: Roberto Pereira <rp...@google.com>
[AmitP: cherry-picked this change from Android common kernel
and updated commit message]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 kernel/configs/android-base.config | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/configs/android-base.config 
b/kernel/configs/android-base.config
index cdde5af6b332..d70829033bb7 100644
--- a/kernel/configs/android-base.config
+++ b/kernel/configs/android-base.config
@@ -3,6 +3,8 @@
 # CONFIG_DEVMEM is not set
 # CONFIG_FHANDLE is not set
 # CONFIG_INET_LRO is not set
+# CONFIG_NFSD is not set
+# CONFIG_NFS_FS is not set
 # CONFIG_OABI_COMPAT is not set
 # CONFIG_SYSVIPC is not set
 # CONFIG_USELIB is not set
-- 
2.7.4



[PATCH v2 7/8] config: android-base: add CGROUP_BPF

2017-06-08 Thread Amit Pundir
From: Chenbo Feng <fe...@google.com>

Add CONFIG_CGROUP_BPF as a default configuration in android base config
since it is used to replace XT_QTAGUID in future.

Reviewed-at: https://android-review.googlesource.com/#/c/400374/

Signed-off-by: Chenbo Feng <fe...@google.com>
[AmitP: cherry-picked this change from Android common kernel]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 kernel/configs/android-base.config | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/configs/android-base.config 
b/kernel/configs/android-base.config
index 62cb392fc34b..cdde5af6b332 100644
--- a/kernel/configs/android-base.config
+++ b/kernel/configs/android-base.config
@@ -14,6 +14,7 @@ CONFIG_ASHMEM=y
 CONFIG_AUDIT=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_CGROUPS=y
+CONFIG_CGROUP_BPF=y
 CONFIG_CGROUP_CPUACCT=y
 CONFIG_CGROUP_DEBUG=y
 CONFIG_CGROUP_FREEZER=y
-- 
2.7.4



[PATCH] tracing: Resolve stack corruption due to string copy

2017-05-03 Thread Amit Pundir
From: Amey Telawane <am...@codeaurora.org>

Strcpy has no limit on string being copied which causes
stack corruption leading to kernel panic. Use strlcpy to
resolve the issue by providing length of string to be copied.

Cc: sta...@vger.kernel.org
Signed-off-by: Amey Telawane <am...@codeaurora.org>
[AmitP: Cherry-picked this commit from CodeAurora kernel/msm-3.10
https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=2161ae9a70b12cf18ac8e5952a20161ffbccb477]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
This patch featured in Android Security Bulletin for May 2017,
https://source.android.com/security/bulletin/2017-05-01#eop-in-kernel-trace-subsystem,
but it is not upstreamed yet and I couldn't find any previous
upstream submission as well.

 kernel/trace/trace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index bd8fb5cfda4d..b227e141e1f1 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1976,7 +1976,7 @@ static void __trace_find_cmdline(int pid, char comm[])
 
map = savedcmd->map_pid_to_cmdline[pid];
if (map != NO_CMDLINE_MAP)
-   strcpy(comm, get_saved_cmdlines(map));
+   strlcpy(comm, get_saved_cmdlines(map), TASK_COMM_LEN - 1);
else
strcpy(comm, "<...>");
 }
-- 
2.7.4



Re: [PATCH] binder: fix memory corruption in binder_transaction binder

2017-09-11 Thread Amit Pundir
On 5 September 2017 at 22:51, Todd Kjos <tk...@android.com> wrote:
> From: Xu YiPing <xuyip...@hisilicon.com>
>
> commit 7a4408c6bd3e ("binder: make sure accesses to proc/thread are
> safe") made a change to enqueue tcomplete to thread->todo before
> enqueuing the transaction. However, in err_dead_proc_or_thread case,
> the tcomplete is directly freed, without dequeued. It may cause the
> thread->todo list to be corrupted.
>
> So, dequeue it before freeing.

I see Android boot loops with this patch on hikey tracking
linux/master branch. 1st boot is fine but hikey runs into an
unexpected short boot loops on 2nd and successive boots.

It takes about 3-4 iterations to finally come to sane state and boot
to UI. I don't see this behaviour if I revert this patch.

Regards,
Amit Pundir

>
> Signed-off-by: Xu YiPing <xuyip...@hisilicon.com>
> Signed-off-by: Todd Kjos <tk...@google.com>
> ---
>  drivers/android/binder.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/android/binder.c b/drivers/android/binder.c
> index d055b3f2a207..96cc28afa383 100644
> --- a/drivers/android/binder.c
> +++ b/drivers/android/binder.c
> @@ -3083,6 +3083,7 @@ static void binder_transaction(struct binder_proc *proc,
>  err_dead_proc_or_thread:
> return_error = BR_DEAD_REPLY;
> return_error_line = __LINE__;
> +   binder_dequeue_work(proc, tcomplete);
>  err_translate_failed:
>  err_bad_object_type:
>  err_bad_offset:
> --
> 2.14.1.581.gf28d330327-goog
>


Re: [PATCH] binder: fix memory corruption in binder_transaction binder

2017-09-11 Thread Amit Pundir
Hi Todd,

On 11 September 2017 at 21:10, Todd Kjos <tk...@google.com> wrote:
> (resend in plain-text mode -- sorry about that)
>
> Amit,
>
> Are you sure this patch is the culprit? That is pretty surprising
> since this change can only be hit in a uncommon case (the target node
> is valid when we start creating the transaction, but dead when we
> check right before sending it) so it is unlikely to be hit during a
> normal boot. It also fixes a corruption -- so if you were actually
> hitting the case, it would likely have caused issues before and not
> now. Take a look at it and see if you think it is really possible.
>
> I just booted hikey to Android with this patch 10 times in a row with
> no issues (used hikey-linaro 4.9 kernel which has this patch).

Sorry for not being clear enough in the bug report. android-4.9 is
fine, I see this issue on linux mainline tree with this patch.

I can reproduce it on John's minimal Android tree for hikey hosted
here 
https://git.linaro.org/people/john.stultz/android-dev.git/log/?h=dev/hikey-mainline-WIP
and hikey-llct (android-4.9 patchset rebased to mainline) tree hosted
here 
https://android-git.linaro.org/kernel/linaro-android.git/log/?h=test/hikey-llct.
I have already reverted this patch in hikey-llct so you have to revert
that revert to reproduce this issue on hikey-llct tree.

Regards,
Amit Pundir

>
> -Todd
>
>> On Mon, Sep 11, 2017 at 5:18 AM, Amit Pundir <amit.pun...@linaro.org> wrote:
>>>
>>> On 5 September 2017 at 22:51, Todd Kjos <tk...@android.com> wrote:
>>> > From: Xu YiPing <xuyip...@hisilicon.com>
>>> >
>>> > commit 7a4408c6bd3e ("binder: make sure accesses to proc/thread are
>>> > safe") made a change to enqueue tcomplete to thread->todo before
>>> > enqueuing the transaction. However, in err_dead_proc_or_thread case,
>>> > the tcomplete is directly freed, without dequeued. It may cause the
>>> > thread->todo list to be corrupted.
>>> >
>>> > So, dequeue it before freeing.
>>>
>>> I see Android boot loops with this patch on hikey tracking
>>> linux/master branch. 1st boot is fine but hikey runs into an
>>> unexpected short boot loops on 2nd and successive boots.
>>>
>>> It takes about 3-4 iterations to finally come to sane state and boot
>>> to UI. I don't see this behaviour if I revert this patch.
>>>
>>> Regards,
>>> Amit Pundir
>>>
>>> >
>>> > Signed-off-by: Xu YiPing <xuyip...@hisilicon.com>
>>> > Signed-off-by: Todd Kjos <tk...@google.com>
>>> > ---
>>> >  drivers/android/binder.c | 1 +
>>> >  1 file changed, 1 insertion(+)
>>> >
>>> > diff --git a/drivers/android/binder.c b/drivers/android/binder.c
>>> > index d055b3f2a207..96cc28afa383 100644
>>> > --- a/drivers/android/binder.c
>>> > +++ b/drivers/android/binder.c
>>> > @@ -3083,6 +3083,7 @@ static void binder_transaction(struct binder_proc
>>> > *proc,
>>> >  err_dead_proc_or_thread:
>>> > return_error = BR_DEAD_REPLY;
>>> > return_error_line = __LINE__;
>>> > +   binder_dequeue_work(proc, tcomplete);
>>> >  err_translate_failed:
>>> >  err_bad_object_type:
>>> >  err_bad_offset:
>>> > --
>>> > 2.14.1.581.gf28d330327-goog
>>> >
>>
>>


Re: [PATCH] binder: fix memory corruption in binder_transaction binder

2017-10-03 Thread Amit Pundir
Hi,

On 12 September 2017 at 13:50, Martijn Coenen <m...@google.com> wrote:
> Hi Amit,
>
> Can you try with the patch I sent to LKML recently, "[PATCH v2 10/13]
> ANDROID: binder: call poll_wait() unconditionally."? This fixes a
> problem in binder's poll() implementation that only causes issues
> under certain racy conditions. I'm not sure why it would only trigger
> now, as this problem has always been there, but perhaps my patches to
> remove the proc waitqueue (which were merged recently) have
> exacerbated this problem.
>

Sorry took me a while to get back to test this patch again. I didn't
try your binder poll fix yet. I can not reproduce this problem on hikey
anyway, running 4.14-rc3 on latest AOSP(rootfs) master snapshot.

It could be my older AOSP rootfs snapshot which was running into that
random system crash on boot, causing boot animation loop. I've been
bitten by such intermittent AOSP issues before.

I also ran binder tests from frameworks/native/libs/binder/tests/ to
be sure and found the results mostly inline with android-4.9 kernel.
Sorry for all the noise.

Regards,
Amit Pundir

> Thanks,
> Martijn
>
> On Mon, Sep 11, 2017 at 9:59 PM, Todd Kjos <tk...@google.com> wrote:
>> Amit,
>>
>> I tested with 
>> https://android-git.linaro.org/kernel/linaro-android.git/log/?h=test/hikey-llct.
>> I added a pr_info() above the patch's single line change and in
>> binder_init (so I could easily prove that I was running the correct
>> kernel).
>>
>> First I did 10 reboots with the patch. I saw one failure to reach the
>> Android home screen in boot #7 (but the new line of code was never
>> reached, so the patch cannot be the cause)... so 9 out of 10 reboots
>> were fine and the failure does not point to this patch.
>>
>> Then I did 10 reboots without the patch. No failures.
>>
>> Then 10 more with the patch. No failures.
>>
>> Then with the patch: power-on, reboot twice, no failures (repeat, no 
>> failures).
>>
>> I think the issue you are seeing cannot be caused by this patch --
>> take a look at it and see if you think its really possible...
>>
>> -Todd
>>
>> On Mon, Sep 11, 2017 at 9:55 AM, Amit Pundir <amit.pun...@linaro.org> wrote:
>>> Hi Todd,
>>>
>>> On 11 September 2017 at 21:10, Todd Kjos <tk...@google.com> wrote:
>>>> (resend in plain-text mode -- sorry about that)
>>>>
>>>> Amit,
>>>>
>>>> Are you sure this patch is the culprit? That is pretty surprising
>>>> since this change can only be hit in a uncommon case (the target node
>>>> is valid when we start creating the transaction, but dead when we
>>>> check right before sending it) so it is unlikely to be hit during a
>>>> normal boot. It also fixes a corruption -- so if you were actually
>>>> hitting the case, it would likely have caused issues before and not
>>>> now. Take a look at it and see if you think it is really possible.
>>>>
>>>> I just booted hikey to Android with this patch 10 times in a row with
>>>> no issues (used hikey-linaro 4.9 kernel which has this patch).
>>>
>>> Sorry for not being clear enough in the bug report. android-4.9 is
>>> fine, I see this issue on linux mainline tree with this patch.
>>>
>>> I can reproduce it on John's minimal Android tree for hikey hosted
>>> here 
>>> https://git.linaro.org/people/john.stultz/android-dev.git/log/?h=dev/hikey-mainline-WIP
>>> and hikey-llct (android-4.9 patchset rebased to mainline) tree hosted
>>> here 
>>> https://android-git.linaro.org/kernel/linaro-android.git/log/?h=test/hikey-llct.
>>> I have already reverted this patch in hikey-llct so you have to revert
>>> that revert to reproduce this issue on hikey-llct tree.
>>>
>>> Regards,
>>> Amit Pundir
>>>
>>>>
>>>> -Todd
>>>>
>>>>> On Mon, Sep 11, 2017 at 5:18 AM, Amit Pundir <amit.pun...@linaro.org> 
>>>>> wrote:
>>>>>>
>>>>>> On 5 September 2017 at 22:51, Todd Kjos <tk...@android.com> wrote:
>>>>>> > From: Xu YiPing <xuyip...@hisilicon.com>
>>>>>> >
>>>>>> > commit 7a4408c6bd3e ("binder: make sure accesses to proc/thread are
>>>>>> > safe") made a change to enqueue tcomplete to thread->todo before
>>>>>> > enqueuing the transaction. However, in err_dead_proc_or_thread case,
>>>>>> > the tcomplete is direc

[PATCH 0/2] selftests: firmware: skip testing unsupported features

2017-11-08 Thread Amit Pundir
Hi,

At Linaro we run mainline/linux-next selftests on LTS releases and
run into few test failures due to kernel mismatch or missing upstream
functionality in older kernels. Discussed at length here:
https://lkml.org/lkml/2017/6/15/652

This patch series is an attempt to modify selftest firmware test scripts.
The proposed changes skip/ignore testing the upstream functionality
missing in the older kernel releases.

Regards,
Amit Pundir


Amit Pundir (2):
  selftests: firmware: skip unsupported async loading tests
  selftests: firmware: skip unsupported custom firmware fallback tests

 tools/testing/selftests/firmware/fw_fallback.sh   | 38 ---
 tools/testing/selftests/firmware/fw_filesystem.sh | 34 
 2 files changed, 47 insertions(+), 25 deletions(-)

-- 
2.7.4



[PATCH 1/2] selftests: firmware: skip unsupported async loading tests

2017-11-08 Thread Amit Pundir
Ignore async firmware loading tests on older kernel releases,
which do not support this feature.

Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 tools/testing/selftests/firmware/fw_filesystem.sh | 34 ++-
 1 file changed, 21 insertions(+), 13 deletions(-)

diff --git a/tools/testing/selftests/firmware/fw_filesystem.sh 
b/tools/testing/selftests/firmware/fw_filesystem.sh
index 62f2d6f54929..b1f20fef36c7 100755
--- a/tools/testing/selftests/firmware/fw_filesystem.sh
+++ b/tools/testing/selftests/firmware/fw_filesystem.sh
@@ -70,9 +70,13 @@ if printf '\000' >"$DIR"/trigger_request 2> /dev/null; then
exit 1
 fi
 
-if printf '\000' >"$DIR"/trigger_async_request 2> /dev/null; then
-   echo "$0: empty filename should not succeed (async)" >&2
-   exit 1
+if [ ! -e "$DIR"/trigger_async_request ]; then
+   echo "$0: empty filename: async trigger not supported" >&2
+else
+   if printf '\000' >"$DIR"/trigger_async_request 2> /dev/null; then
+   echo "$0: empty filename should not succeed (async)" >&2
+   exit 1
+   fi
 fi
 
 # Request a firmware that doesn't exist, it should fail.
@@ -105,17 +109,21 @@ else
 fi
 
 # Try the asynchronous version too
-if ! echo -n "$NAME" >"$DIR"/trigger_async_request ; then
-   echo "$0: could not trigger async request" >&2
-   exit 1
-fi
-
-# Verify the contents are what we expect.
-if ! diff -q "$FW" /dev/test_firmware >/dev/null ; then
-   echo "$0: firmware was not loaded (async)" >&2
-   exit 1
+if [ ! -e "$DIR"/trigger_async_request ]; then
+   echo "$0: firmware loading: async trigger not supported" >&2
 else
-   echo "$0: async filesystem loading works"
+   if ! echo -n "$NAME" >"$DIR"/trigger_async_request ; then
+   echo "$0: could not trigger async request" >&2
+   exit 1
+   fi
+
+   # Verify the contents are what we expect.
+   if ! diff -q "$FW" /dev/test_firmware >/dev/null ; then
+   echo "$0: firmware was not loaded (async)" >&2
+   exit 1
+   else
+   echo "$0: async filesystem loading works"
+   fi
 fi
 
 ### Batched requests tests
-- 
2.7.4



[PATCH 2/2] selftests: firmware: skip unsupported custom firmware fallback tests

2017-11-08 Thread Amit Pundir
Ignore custom firmware loading and cancellation tests on older
kernel releases, which do not support this feature.

Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 tools/testing/selftests/firmware/fw_fallback.sh | 38 +
 1 file changed, 26 insertions(+), 12 deletions(-)

diff --git a/tools/testing/selftests/firmware/fw_fallback.sh 
b/tools/testing/selftests/firmware/fw_fallback.sh
index a52a3bab532b..72858c921eed 100755
--- a/tools/testing/selftests/firmware/fw_fallback.sh
+++ b/tools/testing/selftests/firmware/fw_fallback.sh
@@ -86,6 +86,11 @@ load_fw_cancel()
 
 load_fw_custom()
 {
+   if [ ! -e "$DIR"/trigger_custom_fallback ]; then
+   echo "$0: custom fallback loading trigger not supported" >&2
+   return 1
+   fi
+
local name="$1"
local file="$2"
 
@@ -108,11 +113,17 @@ load_fw_custom()
 
# Wait for request to finish.
wait
+   return 0
 }
 
 
 load_fw_custom_cancel()
 {
+   if [ ! -e "$DIR"/trigger_custom_fallback ]; then
+   echo "$0: cancelling custom fallback trigger not supported" >&2
+   return 1
+   fi
+
local name="$1"
local file="$2"
 
@@ -133,6 +144,7 @@ load_fw_custom_cancel()
 
# Wait for request to finish.
wait
+   return 0
 }
 
 load_fw_fallback_with_child()
@@ -227,20 +239,22 @@ else
echo "$0: cancelling fallback mechanism works"
 fi
 
-load_fw_custom "$NAME" "$FW"
-if ! diff -q "$FW" /dev/test_firmware >/dev/null ; then
-   echo "$0: firmware was not loaded" >&2
-   exit 1
-else
-   echo "$0: custom fallback loading mechanism works"
+if load_fw_custom "$NAME" "$FW" ; then
+   if ! diff -q "$FW" /dev/test_firmware >/dev/null ; then
+   echo "$0: firmware was not loaded" >&2
+   exit 1
+   else
+   echo "$0: custom fallback loading mechanism works"
+   fi
 fi
 
-load_fw_custom_cancel "nope-$NAME" "$FW"
-if diff -q "$FW" /dev/test_firmware >/dev/null ; then
-   echo "$0: firmware was expected to be cancelled" >&2
-   exit 1
-else
-   echo "$0: cancelling custom fallback mechanism works"
+if load_fw_custom_cancel "nope-$NAME" "$FW" ; then
+   if diff -q "$FW" /dev/test_firmware >/dev/null ; then
+   echo "$0: firmware was expected to be cancelled" >&2
+   exit 1
+   else
+   echo "$0: cancelling custom fallback mechanism works"
+   fi
 fi
 
 set +e
-- 
2.7.4



[PATCH v2 0/2] selftests: firmware: skip testing unsupported features

2017-11-08 Thread Amit Pundir
Hi,

At Linaro we run mainline/linux-next selftests on LTS releases and
run into few test failures due to kernel mismatch or missing upstream
functionality in older kernels. Discussed at length here:
https://lkml.org/lkml/2017/6/15/652

This patch series is an attempt to modify selftest firmware test scripts.
The proposed changes skip/ignore testing the upstream functionality
missing in the older kernel releases.

v2:
 Changed the display message to make it consistent across all
 the firmware test scripts. Added Fixes tag.

Regards,
Amit Pundir


Amit Pundir (2):
  selftests: firmware: skip unsupported async loading tests
  selftests: firmware: skip unsupported custom firmware fallback tests

 tools/testing/selftests/firmware/fw_fallback.sh   | 38 ---
 tools/testing/selftests/firmware/fw_filesystem.sh | 34 
 2 files changed, 47 insertions(+), 25 deletions(-)

-- 
2.7.4



[PATCH v2 1/2] selftests: firmware: skip unsupported async loading tests

2017-11-08 Thread Amit Pundir
Ignore async firmware loading tests on older kernel releases,
which do not support this feature.

Fixes: 1b1fe542b6f0 ("selftests: firmware: add empty string and async tests")
Reviewed-by: Sumit Semwal <sumit.sem...@linaro.org>
Acked-by: Luis R. Rodriguez <mcg...@kernel.org>
Acked-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
v2:
 Changed the display message to make it consistent across all
 the firmware test scripts. Added Fixes tag.

 tools/testing/selftests/firmware/fw_filesystem.sh | 34 ++-
 1 file changed, 21 insertions(+), 13 deletions(-)

diff --git a/tools/testing/selftests/firmware/fw_filesystem.sh 
b/tools/testing/selftests/firmware/fw_filesystem.sh
index 62f2d6f54929..b1f20fef36c7 100755
--- a/tools/testing/selftests/firmware/fw_filesystem.sh
+++ b/tools/testing/selftests/firmware/fw_filesystem.sh
@@ -70,9 +70,13 @@ if printf '\000' >"$DIR"/trigger_request 2> /dev/null; then
exit 1
 fi
 
-if printf '\000' >"$DIR"/trigger_async_request 2> /dev/null; then
-   echo "$0: empty filename should not succeed (async)" >&2
-   exit 1
+if [ ! -e "$DIR"/trigger_async_request ]; then
+   echo "$0: empty filename: async trigger not present, ignoring test" >&2
+else
+   if printf '\000' >"$DIR"/trigger_async_request 2> /dev/null; then
+   echo "$0: empty filename should not succeed (async)" >&2
+   exit 1
+   fi
 fi
 
 # Request a firmware that doesn't exist, it should fail.
@@ -105,17 +109,21 @@ else
 fi
 
 # Try the asynchronous version too
-if ! echo -n "$NAME" >"$DIR"/trigger_async_request ; then
-   echo "$0: could not trigger async request" >&2
-   exit 1
-fi
-
-# Verify the contents are what we expect.
-if ! diff -q "$FW" /dev/test_firmware >/dev/null ; then
-   echo "$0: firmware was not loaded (async)" >&2
-   exit 1
+if [ ! -e "$DIR"/trigger_async_request ]; then
+   echo "$0: firmware loading: async trigger not present, ignoring test" 
>&2
 else
-   echo "$0: async filesystem loading works"
+   if ! echo -n "$NAME" >"$DIR"/trigger_async_request ; then
+   echo "$0: could not trigger async request" >&2
+   exit 1
+   fi
+
+   # Verify the contents are what we expect.
+   if ! diff -q "$FW" /dev/test_firmware >/dev/null ; then
+   echo "$0: firmware was not loaded (async)" >&2
+   exit 1
+   else
+   echo "$0: async filesystem loading works"
+   fi
 fi
 
 ### Batched requests tests
-- 
2.7.4



[PATCH v2 2/2] selftests: firmware: skip unsupported custom firmware fallback tests

2017-11-08 Thread Amit Pundir
Ignore custom firmware loading and cancellation tests on older
kernel releases, which do not support this feature.

Fixes: 061132d2b9c9 ("test_firmware: add test custom fallback trigger")
Reviewed-by: Sumit Semwal <sumit.sem...@linaro.org>
Acked-by: Luis R. Rodriguez <mcg...@kernel.org>
Acked-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
v2:
 Changed the display message to make it consistent across all
 the firmware test scripts. Added Fixes tag.

 tools/testing/selftests/firmware/fw_fallback.sh | 38 +
 1 file changed, 26 insertions(+), 12 deletions(-)

diff --git a/tools/testing/selftests/firmware/fw_fallback.sh 
b/tools/testing/selftests/firmware/fw_fallback.sh
index a52a3bab532b..72858c921eed 100755
--- a/tools/testing/selftests/firmware/fw_fallback.sh
+++ b/tools/testing/selftests/firmware/fw_fallback.sh
@@ -86,6 +86,11 @@ load_fw_cancel()
 
 load_fw_custom()
 {
+   if [ ! -e "$DIR"/trigger_custom_fallback ]; then
+   echo "$0: custom fallback trigger not present, ignoring test" 
>&2
+   return 1
+   fi
+
local name="$1"
local file="$2"
 
@@ -108,11 +113,17 @@ load_fw_custom()
 
# Wait for request to finish.
wait
+   return 0
 }
 
 
 load_fw_custom_cancel()
 {
+   if [ ! -e "$DIR"/trigger_custom_fallback ]; then
+   echo "$0: canceling custom fallback trigger not present, 
ignoring test" >&2
+   return 1
+   fi
+
local name="$1"
local file="$2"
 
@@ -133,6 +144,7 @@ load_fw_custom_cancel()
 
# Wait for request to finish.
wait
+   return 0
 }
 
 load_fw_fallback_with_child()
@@ -227,20 +239,22 @@ else
echo "$0: cancelling fallback mechanism works"
 fi
 
-load_fw_custom "$NAME" "$FW"
-if ! diff -q "$FW" /dev/test_firmware >/dev/null ; then
-   echo "$0: firmware was not loaded" >&2
-   exit 1
-else
-   echo "$0: custom fallback loading mechanism works"
+if load_fw_custom "$NAME" "$FW" ; then
+   if ! diff -q "$FW" /dev/test_firmware >/dev/null ; then
+   echo "$0: firmware was not loaded" >&2
+   exit 1
+   else
+   echo "$0: custom fallback loading mechanism works"
+   fi
 fi
 
-load_fw_custom_cancel "nope-$NAME" "$FW"
-if diff -q "$FW" /dev/test_firmware >/dev/null ; then
-   echo "$0: firmware was expected to be cancelled" >&2
-   exit 1
-else
-   echo "$0: cancelling custom fallback mechanism works"
+if load_fw_custom_cancel "nope-$NAME" "$FW" ; then
+   if diff -q "$FW" /dev/test_firmware >/dev/null ; then
+   echo "$0: firmware was expected to be cancelled" >&2
+   exit 1
+   else
+   echo "$0: cancelling custom fallback mechanism works"
+   fi
 fi
 
 set +e
-- 
2.7.4



[PATCH v2 3/3] NFC: fdp: Fix possible buffer overflow in WCS4000 NFC driver

2018-05-02 Thread Amit Pundir
From: Suren Baghdasaryan <sur...@google.com>

Possible buffer overflow when reading next_read_size bytes into
tmp buffer after next_read_size was extracted from a previous packet.

Signed-off-by: Suren Baghdasaryan <sur...@google.com>
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
v2:
Remove redundant __func__ from dev_dgb().

 drivers/nfc/fdp/i2c.c | 9 +
 1 file changed, 9 insertions(+)

diff --git a/drivers/nfc/fdp/i2c.c b/drivers/nfc/fdp/i2c.c
index c4da50e..b80d1ad 100644
--- a/drivers/nfc/fdp/i2c.c
+++ b/drivers/nfc/fdp/i2c.c
@@ -176,6 +176,15 @@ static int fdp_nci_i2c_read(struct fdp_i2c_phy *phy, 
struct sk_buff **skb)
/* Packet that contains a length */
if (tmp[0] == 0 && tmp[1] == 0) {
phy->next_read_size = (tmp[2] << 8) + tmp[3] + 3;
+   /*
+* Ensure next_read_size does not exceed sizeof(tmp)
+* for reading that many bytes during next iteration
+*/
+   if (phy->next_read_size > FDP_NCI_I2C_MAX_PAYLOAD) {
+   dev_dbg(>dev, "corrupted packet\n");
+   phy->next_read_size = 5;
+   goto flush;
+   }
} else {
phy->next_read_size = FDP_NCI_I2C_MIN_PAYLOAD;
 
-- 
2.7.4



[PATCH v2 2/3] NFC: Fix possible memory corruption when handling SHDLC I-Frame commands

2018-05-02 Thread Amit Pundir
From: Suren Baghdasaryan <sur...@google.com>

When handling SHDLC I-Frame commands "pipe" field used for indexing
into an array should be checked before usage. If left unchecked it
might access memory outside of the array of size NFC_HCI_MAX_PIPES(127).

Signed-off-by: Suren Baghdasaryan <sur...@google.com>
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
v2:
Resend. No changes.

 net/nfc/hci/core.c | 10 ++
 1 file changed, 10 insertions(+)

diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c
index ac8030c4..19cb2e4 100644
--- a/net/nfc/hci/core.c
+++ b/net/nfc/hci/core.c
@@ -209,6 +209,11 @@ void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 
pipe, u8 cmd,
}
create_info = (struct hci_create_pipe_resp *)skb->data;
 
+   if (create_info->pipe >= NFC_HCI_MAX_PIPES) {
+   status = NFC_HCI_ANY_E_NOK;
+   goto exit;
+   }
+
/* Save the new created pipe and bind with local gate,
 * the description for skb->data[3] is destination gate id
 * but since we received this cmd from host controller, we
@@ -232,6 +237,11 @@ void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 
pipe, u8 cmd,
}
delete_info = (struct hci_delete_pipe_noti *)skb->data;
 
+   if (delete_info->pipe >= NFC_HCI_MAX_PIPES) {
+   status = NFC_HCI_ANY_E_NOK;
+   goto exit;
+   }
+
hdev->pipes[delete_info->pipe].gate = NFC_HCI_INVALID_GATE;
hdev->pipes[delete_info->pipe].dest_host = NFC_HCI_INVALID_HOST;
break;
-- 
2.7.4



[PATCH v2 0/3] Few NFC fixes from android-4.14 tree

2018-05-02 Thread Amit Pundir
Hi,

Submitting v2 of NFC fixes I picked up from android-4.14 tree[1]
for review and comments.

Again like to point out that I have not feature tested these patches
at all. Only made small cosmetic changes to the original patches
(removed Android-only tag and internal bug ID) and build tested for
arm, before posting them here for review.

Really appreciate any comments or feedback on how to take it forward.

Changes since v1:
* Dropped "NFC: st21nfca: Fix memory OOB and leak issues in connectivity
  events handler" patch for now. I'm yet to verify if the additional
  aid_len and params_len checks for buffer size are really required, and
  I didn't want to hold up this patch series for one patch alone.
* Dropped redundant __func__ use dev_dbg() in "NFC: fdp: Fix possible
  buffer overflow in WCS4000 NFC driver" patch.

Also drivers/nfc/fdp/ is full of __func__ parameter usage in dev_dbg(),
so submitting a new patch separately to clean that up.

Regards,
Amit Pundir
[1] https://android.googlesource.com/kernel/common/+log/android-4.14

Suren Baghdasaryan (3):
  NFC: st21nfca: Fix out of bounds kernel access when handling ATR_REQ
  NFC: Fix possible memory corruption when handling SHDLC I-Frame
commands
  NFC: fdp: Fix possible buffer overflow in WCS4000 NFC driver

 drivers/nfc/fdp/fdp.c  | 22 +++---
 drivers/nfc/fdp/i2c.c  | 29 ++---
 drivers/nfc/st21nfca/dep.c |  3 ++-
 net/nfc/hci/core.c | 10 ++
 4 files changed, 41 insertions(+), 23 deletions(-)

-- 
2.7.4



[PATCH] NFC: fdp: Remove __func__ parameter from dev_dbg() call

2018-05-02 Thread Amit Pundir
Remove redundant __func__ parameter from dev_dgb() calls.

Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 drivers/nfc/fdp/fdp.c | 22 +++---
 drivers/nfc/fdp/i2c.c | 20 +---
 2 files changed, 20 insertions(+), 22 deletions(-)

diff --git a/drivers/nfc/fdp/fdp.c b/drivers/nfc/fdp/fdp.c
index d5784a4..3251346 100644
--- a/drivers/nfc/fdp/fdp.c
+++ b/drivers/nfc/fdp/fdp.c
@@ -249,7 +249,7 @@ static int fdp_nci_open(struct nci_dev *ndev)
struct fdp_nci_info *info = nci_get_drvdata(ndev);
struct device *dev = >phy->i2c_dev->dev;
 
-   dev_dbg(dev, "%s\n", __func__);
+   dev_dbg(dev, "\n");
 
r = info->phy_ops->enable(info->phy);
 
@@ -261,7 +261,7 @@ static int fdp_nci_close(struct nci_dev *ndev)
struct fdp_nci_info *info = nci_get_drvdata(ndev);
struct device *dev = >phy->i2c_dev->dev;
 
-   dev_dbg(dev, "%s\n", __func__);
+   dev_dbg(dev, "\n");
return 0;
 }
 
@@ -270,7 +270,7 @@ static int fdp_nci_send(struct nci_dev *ndev, struct 
sk_buff *skb)
struct fdp_nci_info *info = nci_get_drvdata(ndev);
struct device *dev = >phy->i2c_dev->dev;
 
-   dev_dbg(dev, "%s\n", __func__);
+   dev_dbg(dev, "\n");
 
if (atomic_dec_and_test(>data_pkt_counter))
info->data_pkt_counter_cb(ndev);
@@ -283,7 +283,7 @@ int fdp_nci_recv_frame(struct nci_dev *ndev, struct sk_buff 
*skb)
struct fdp_nci_info *info = nci_get_drvdata(ndev);
struct device *dev = >phy->i2c_dev->dev;
 
-   dev_dbg(dev, "%s\n", __func__);
+   dev_dbg(dev, "\n");
return nci_recv_frame(ndev, skb);
 }
 EXPORT_SYMBOL(fdp_nci_recv_frame);
@@ -498,7 +498,7 @@ static int fdp_nci_setup(struct nci_dev *ndev)
int r;
u8 patched = 0;
 
-   dev_dbg(dev, "%s\n", __func__);
+   dev_dbg(dev, "\n");
 
r = nci_core_init(ndev);
if (r)
@@ -609,7 +609,7 @@ static int fdp_nci_core_reset_ntf_packet(struct nci_dev 
*ndev,
struct fdp_nci_info *info = nci_get_drvdata(ndev);
struct device *dev = >phy->i2c_dev->dev;
 
-   dev_dbg(dev, "%s\n", __func__);
+   dev_dbg(dev, "\n");
info->setup_reset_ntf = 1;
wake_up(>setup_wq);
 
@@ -622,7 +622,7 @@ static int fdp_nci_prop_patch_ntf_packet(struct nci_dev 
*ndev,
struct fdp_nci_info *info = nci_get_drvdata(ndev);
struct device *dev = >phy->i2c_dev->dev;
 
-   dev_dbg(dev, "%s\n", __func__);
+   dev_dbg(dev, "\n");
info->setup_patch_ntf = 1;
info->setup_patch_status = skb->data[0];
wake_up(>setup_wq);
@@ -637,7 +637,7 @@ static int fdp_nci_prop_patch_rsp_packet(struct nci_dev 
*ndev,
struct device *dev = >phy->i2c_dev->dev;
u8 status = skb->data[0];
 
-   dev_dbg(dev, "%s: status 0x%x\n", __func__, status);
+   dev_dbg(dev, "status 0x%x\n", status);
nci_req_complete(ndev, status);
 
return 0;
@@ -650,7 +650,7 @@ static int 
fdp_nci_prop_set_production_data_rsp_packet(struct nci_dev *ndev,
struct device *dev = >phy->i2c_dev->dev;
u8 status = skb->data[0];
 
-   dev_dbg(dev, "%s: status 0x%x\n", __func__, status);
+   dev_dbg(dev, "status 0x%x\n", status);
nci_req_complete(ndev, status);
 
return 0;
@@ -695,7 +695,7 @@ static int fdp_nci_core_get_config_rsp_packet(struct 
nci_dev *ndev,
dev_dbg(dev, "OTP version %d\n", info->otp_version);
dev_dbg(dev, "RAM version %d\n", info->ram_version);
dev_dbg(dev, "key index %d\n", info->key_index);
-   dev_dbg(dev, "%s: status 0x%x\n", __func__, rsp->status);
+   dev_dbg(dev, "status 0x%x\n", rsp->status);
 
nci_req_complete(ndev, rsp->status);
 
@@ -798,7 +798,7 @@ void fdp_nci_remove(struct nci_dev *ndev)
struct fdp_nci_info *info = nci_get_drvdata(ndev);
struct device *dev = >phy->i2c_dev->dev;
 
-   dev_dbg(dev, "%s\n", __func__);
+   dev_dbg(dev, "\n");
 
nci_unregister_device(ndev);
nci_free_device(ndev);
diff --git a/drivers/nfc/fdp/i2c.c b/drivers/nfc/fdp/i2c.c
index b80d1ad..3138730 100644
--- a/drivers/nfc/fdp/i2c.c
+++ b/drivers/nfc/fdp/i2c.c
@@ -57,7 +57,7 @@ static int fdp_nci_i2c_enable(void *phy_id)
 {
struct fdp_i2c_phy *phy = phy_id;
 
-   dev_dbg(>i2c_dev->dev, "%s\n", __func__);
+   dev_dbg(>i2c_dev->dev, "\n");
fdp_nci_i2c_reset(phy);
 
return 0;
@@ -67,7 +67,7 @@ static void fdp_nci_i2c_disable(void *phy_id)
 {
struct fdp_i2c_phy *phy = p

[PATCH v2 1/3] NFC: st21nfca: Fix out of bounds kernel access when handling ATR_REQ

2018-05-02 Thread Amit Pundir
From: Suren Baghdasaryan <sur...@google.com>

Out of bounds kernel accesses in st21nfca's NFC HCI layer
might happen when handling ATR_REQ events if user-specified
atr_req->length is bigger than the buffer size. In
that case memcpy() inside st21nfca_tm_send_atr_res() will
read extra bytes resulting in OOB read from the kernel heap.

Signed-off-by: Suren Baghdasaryan <sur...@google.com>
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
v2:
Resend. No changes.

 drivers/nfc/st21nfca/dep.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/nfc/st21nfca/dep.c b/drivers/nfc/st21nfca/dep.c
index fd08be2..3420c51 100644
--- a/drivers/nfc/st21nfca/dep.c
+++ b/drivers/nfc/st21nfca/dep.c
@@ -217,7 +217,8 @@ static int st21nfca_tm_recv_atr_req(struct nfc_hci_dev 
*hdev,
 
atr_req = (struct st21nfca_atr_req *)skb->data;
 
-   if (atr_req->length < sizeof(struct st21nfca_atr_req)) {
+   if (atr_req->length < sizeof(struct st21nfca_atr_req) ||
+   atr_req->length > skb->len) {
r = -EPROTO;
goto exit;
}
-- 
2.7.4



[PATCH v2] NFC: fdp: Remove __func__ from dev_dbg()

2018-05-02 Thread Amit Pundir
Remove redundant __func__ parameter from dev_dgb() calls.

v2:
Deleted empty dev_dbg() trace calls, which are redundant if
function tracer is enabled.

Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 drivers/nfc/fdp/fdp.c | 18 +++---
 drivers/nfc/fdp/i2c.c | 17 -
 2 files changed, 7 insertions(+), 28 deletions(-)

diff --git a/drivers/nfc/fdp/fdp.c b/drivers/nfc/fdp/fdp.c
index d5784a4..f64a6fd 100644
--- a/drivers/nfc/fdp/fdp.c
+++ b/drivers/nfc/fdp/fdp.c
@@ -249,8 +249,6 @@ static int fdp_nci_open(struct nci_dev *ndev)
struct fdp_nci_info *info = nci_get_drvdata(ndev);
struct device *dev = >phy->i2c_dev->dev;
 
-   dev_dbg(dev, "%s\n", __func__);
-
r = info->phy_ops->enable(info->phy);
 
return r;
@@ -261,7 +259,6 @@ static int fdp_nci_close(struct nci_dev *ndev)
struct fdp_nci_info *info = nci_get_drvdata(ndev);
struct device *dev = >phy->i2c_dev->dev;
 
-   dev_dbg(dev, "%s\n", __func__);
return 0;
 }
 
@@ -270,8 +267,6 @@ static int fdp_nci_send(struct nci_dev *ndev, struct 
sk_buff *skb)
struct fdp_nci_info *info = nci_get_drvdata(ndev);
struct device *dev = >phy->i2c_dev->dev;
 
-   dev_dbg(dev, "%s\n", __func__);
-
if (atomic_dec_and_test(>data_pkt_counter))
info->data_pkt_counter_cb(ndev);
 
@@ -283,7 +278,6 @@ int fdp_nci_recv_frame(struct nci_dev *ndev, struct sk_buff 
*skb)
struct fdp_nci_info *info = nci_get_drvdata(ndev);
struct device *dev = >phy->i2c_dev->dev;
 
-   dev_dbg(dev, "%s\n", __func__);
return nci_recv_frame(ndev, skb);
 }
 EXPORT_SYMBOL(fdp_nci_recv_frame);
@@ -498,8 +492,6 @@ static int fdp_nci_setup(struct nci_dev *ndev)
int r;
u8 patched = 0;
 
-   dev_dbg(dev, "%s\n", __func__);
-
r = nci_core_init(ndev);
if (r)
goto error;
@@ -609,7 +601,6 @@ static int fdp_nci_core_reset_ntf_packet(struct nci_dev 
*ndev,
struct fdp_nci_info *info = nci_get_drvdata(ndev);
struct device *dev = >phy->i2c_dev->dev;
 
-   dev_dbg(dev, "%s\n", __func__);
info->setup_reset_ntf = 1;
wake_up(>setup_wq);
 
@@ -622,7 +613,6 @@ static int fdp_nci_prop_patch_ntf_packet(struct nci_dev 
*ndev,
struct fdp_nci_info *info = nci_get_drvdata(ndev);
struct device *dev = >phy->i2c_dev->dev;
 
-   dev_dbg(dev, "%s\n", __func__);
info->setup_patch_ntf = 1;
info->setup_patch_status = skb->data[0];
wake_up(>setup_wq);
@@ -637,7 +627,7 @@ static int fdp_nci_prop_patch_rsp_packet(struct nci_dev 
*ndev,
struct device *dev = >phy->i2c_dev->dev;
u8 status = skb->data[0];
 
-   dev_dbg(dev, "%s: status 0x%x\n", __func__, status);
+   dev_dbg(dev, "status 0x%x\n", status);
nci_req_complete(ndev, status);
 
return 0;
@@ -650,7 +640,7 @@ static int 
fdp_nci_prop_set_production_data_rsp_packet(struct nci_dev *ndev,
struct device *dev = >phy->i2c_dev->dev;
u8 status = skb->data[0];
 
-   dev_dbg(dev, "%s: status 0x%x\n", __func__, status);
+   dev_dbg(dev, "status 0x%x\n", status);
nci_req_complete(ndev, status);
 
return 0;
@@ -695,7 +685,7 @@ static int fdp_nci_core_get_config_rsp_packet(struct 
nci_dev *ndev,
dev_dbg(dev, "OTP version %d\n", info->otp_version);
dev_dbg(dev, "RAM version %d\n", info->ram_version);
dev_dbg(dev, "key index %d\n", info->key_index);
-   dev_dbg(dev, "%s: status 0x%x\n", __func__, rsp->status);
+   dev_dbg(dev, "status 0x%x\n", rsp->status);
 
nci_req_complete(ndev, rsp->status);
 
@@ -798,8 +788,6 @@ void fdp_nci_remove(struct nci_dev *ndev)
struct fdp_nci_info *info = nci_get_drvdata(ndev);
struct device *dev = >phy->i2c_dev->dev;
 
-   dev_dbg(dev, "%s\n", __func__);
-
nci_unregister_device(ndev);
nci_free_device(ndev);
 }
diff --git a/drivers/nfc/fdp/i2c.c b/drivers/nfc/fdp/i2c.c
index c4da50e..f355ab2 100644
--- a/drivers/nfc/fdp/i2c.c
+++ b/drivers/nfc/fdp/i2c.c
@@ -57,7 +57,6 @@ static int fdp_nci_i2c_enable(void *phy_id)
 {
struct fdp_i2c_phy *phy = phy_id;
 
-   dev_dbg(>i2c_dev->dev, "%s\n", __func__);
fdp_nci_i2c_reset(phy);
 
return 0;
@@ -67,7 +66,6 @@ static void fdp_nci_i2c_disable(void *phy_id)
 {
struct fdp_i2c_phy *phy = phy_id;
 
-   dev_dbg(>i2c_dev->dev, "%s\n", __func__);
fdp_nci_i2c_reset(phy);
 }
 
@@ -113,8 +111,8 @@ static int fdp_nci_i2c_write(void *phy_id, struct sk_buff 
*skb)
}
 
if (r < 0 || r != skb->le

Re: [PATCH v2 3/3] NFC: fdp: Fix possible buffer overflow in WCS4000 NFC driver

2018-05-03 Thread Amit Pundir
On 3 May 2018 at 15:50, Andy Shevchenko
<andriy.shevche...@linux.intel.com> wrote:
> On Wed, 2018-05-02 at 23:18 +0530, Amit Pundir wrote:
>> From: Suren Baghdasaryan <sur...@google.com>
>>
>> Possible buffer overflow when reading next_read_size bytes into
>> tmp buffer after next_read_size was extracted from a previous packet.
>>
>> Signed-off-by: Suren Baghdasaryan <sur...@google.com>
>> Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
>> ---
>> v2:
>> Remove redundant __func__ from dev_dgb().
>>
>>  drivers/nfc/fdp/i2c.c | 9 +
>>  1 file changed, 9 insertions(+)
>>
>> diff --git a/drivers/nfc/fdp/i2c.c b/drivers/nfc/fdp/i2c.c
>> index c4da50e..b80d1ad 100644
>> --- a/drivers/nfc/fdp/i2c.c
>> +++ b/drivers/nfc/fdp/i2c.c
>> @@ -176,6 +176,15 @@ static int fdp_nci_i2c_read(struct fdp_i2c_phy
>> *phy, struct sk_buff **skb)
>>   /* Packet that contains a length */
>>   if (tmp[0] == 0 && tmp[1] == 0) {
>>   phy->next_read_size = (tmp[2] << 8) + tmp[3]
>> + 3;
>> + /*
>> +  * Ensure next_read_size does not exceed
>> sizeof(tmp)
>> +  * for reading that many bytes during next
>> iteration
>> +  */
>> + if (phy->next_read_size >
>> FDP_NCI_I2C_MAX_PAYLOAD) {
>> +     dev_dbg(>dev, "corrupted
>> packet\n");
>
>> + phy->next_read_size = 5;
>
> Shouldn't be this magic replaced by
>
> phy->next_read_size = FDP_NCI_I2C_MIN_PAYLOAD;
>
> ?

Ack. Fixing it in v3.

Regards,
Amit Pundir

>
>> + goto flush;
>> + }
>>   } else {
>>   phy->next_read_size =
>> FDP_NCI_I2C_MIN_PAYLOAD;
>>
>
> --
> Andy Shevchenko <andriy.shevche...@linux.intel.com>
> Intel Finland Oy


[PATCH v3 3/4] NFC: fdp: Fix possible buffer overflow in WCS4000 NFC driver

2018-05-03 Thread Amit Pundir
From: Suren Baghdasaryan <sur...@google.com>

Possible buffer overflow when reading next_read_size bytes into
tmp buffer after next_read_size was extracted from a previous packet.

cc: Stable <sta...@vger.kernel.org>
Signed-off-by: Suren Baghdasaryan <sur...@google.com>
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
Reviewed-by: Andy Shevchenko <andriy.shevche...@linux.intel.com>
---
v3:
Reset next_read_size to a more readable macro FDP_NCI_I2C_MIN_PAYLOAD
instead of 5.

v2:
Remove redundant __func__ from dev_dgb().

 drivers/nfc/fdp/i2c.c | 9 +
 1 file changed, 9 insertions(+)

diff --git a/drivers/nfc/fdp/i2c.c b/drivers/nfc/fdp/i2c.c
index c4da50e07bbc..2c5ed2224c5e 100644
--- a/drivers/nfc/fdp/i2c.c
+++ b/drivers/nfc/fdp/i2c.c
@@ -176,6 +176,15 @@ static int fdp_nci_i2c_read(struct fdp_i2c_phy *phy, 
struct sk_buff **skb)
/* Packet that contains a length */
if (tmp[0] == 0 && tmp[1] == 0) {
phy->next_read_size = (tmp[2] << 8) + tmp[3] + 3;
+   /*
+* Ensure next_read_size does not exceed sizeof(tmp)
+* for reading that many bytes during next iteration
+*/
+   if (phy->next_read_size > FDP_NCI_I2C_MAX_PAYLOAD) {
+   dev_dbg(>dev, "corrupted packet\n");
+   phy->next_read_size = FDP_NCI_I2C_MIN_PAYLOAD;
+   goto flush;
+   }
} else {
phy->next_read_size = FDP_NCI_I2C_MIN_PAYLOAD;
 
-- 
2.7.4



[PATCH v3 1/4] NFC: st21nfca: Fix out of bounds kernel access when handling ATR_REQ

2018-05-03 Thread Amit Pundir
From: Suren Baghdasaryan <sur...@google.com>

Out of bounds kernel accesses in st21nfca's NFC HCI layer
might happen when handling ATR_REQ events if user-specified
atr_req->length is bigger than the buffer size. In
that case memcpy() inside st21nfca_tm_send_atr_res() will
read extra bytes resulting in OOB read from the kernel heap.

cc: Stable <sta...@vger.kernel.org>
Signed-off-by: Suren Baghdasaryan <sur...@google.com>
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
Reviewed-by: Andy Shevchenko <andriy.shevche...@linux.intel.com>
---
v3..v1:
Resend. No changes.

 drivers/nfc/st21nfca/dep.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/nfc/st21nfca/dep.c b/drivers/nfc/st21nfca/dep.c
index fd08be2917e6..3420c5104c94 100644
--- a/drivers/nfc/st21nfca/dep.c
+++ b/drivers/nfc/st21nfca/dep.c
@@ -217,7 +217,8 @@ static int st21nfca_tm_recv_atr_req(struct nfc_hci_dev 
*hdev,
 
atr_req = (struct st21nfca_atr_req *)skb->data;
 
-   if (atr_req->length < sizeof(struct st21nfca_atr_req)) {
+   if (atr_req->length < sizeof(struct st21nfca_atr_req) ||
+   atr_req->length > skb->len) {
r = -EPROTO;
goto exit;
}
-- 
2.7.4



[PATCH v3 4/4] NFC: fdp: Remove __func__ from dev_dbg()

2018-05-03 Thread Amit Pundir
Remove redundant __func__ parameter from dev_dgb() calls and
delete empty dev_dbg() trace calls, which are redundant if
function tracer is enabled.

Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
Reviewed-by: Andy Shevchenko <andriy.shevche...@linux.intel.com>
---
v3:
Updated commit message.

v2:
Deleted empty dev_dbg() trace calls, which are redundant if
function tracer is enabled.

 drivers/nfc/fdp/fdp.c | 18 +++---
 drivers/nfc/fdp/i2c.c | 17 -
 2 files changed, 7 insertions(+), 28 deletions(-)

diff --git a/drivers/nfc/fdp/fdp.c b/drivers/nfc/fdp/fdp.c
index d5784a47fc13..f64a6fd65c41 100644
--- a/drivers/nfc/fdp/fdp.c
+++ b/drivers/nfc/fdp/fdp.c
@@ -249,8 +249,6 @@ static int fdp_nci_open(struct nci_dev *ndev)
struct fdp_nci_info *info = nci_get_drvdata(ndev);
struct device *dev = >phy->i2c_dev->dev;
 
-   dev_dbg(dev, "%s\n", __func__);
-
r = info->phy_ops->enable(info->phy);
 
return r;
@@ -261,7 +259,6 @@ static int fdp_nci_close(struct nci_dev *ndev)
struct fdp_nci_info *info = nci_get_drvdata(ndev);
struct device *dev = >phy->i2c_dev->dev;
 
-   dev_dbg(dev, "%s\n", __func__);
return 0;
 }
 
@@ -270,8 +267,6 @@ static int fdp_nci_send(struct nci_dev *ndev, struct 
sk_buff *skb)
struct fdp_nci_info *info = nci_get_drvdata(ndev);
struct device *dev = >phy->i2c_dev->dev;
 
-   dev_dbg(dev, "%s\n", __func__);
-
if (atomic_dec_and_test(>data_pkt_counter))
info->data_pkt_counter_cb(ndev);
 
@@ -283,7 +278,6 @@ int fdp_nci_recv_frame(struct nci_dev *ndev, struct sk_buff 
*skb)
struct fdp_nci_info *info = nci_get_drvdata(ndev);
struct device *dev = >phy->i2c_dev->dev;
 
-   dev_dbg(dev, "%s\n", __func__);
return nci_recv_frame(ndev, skb);
 }
 EXPORT_SYMBOL(fdp_nci_recv_frame);
@@ -498,8 +492,6 @@ static int fdp_nci_setup(struct nci_dev *ndev)
int r;
u8 patched = 0;
 
-   dev_dbg(dev, "%s\n", __func__);
-
r = nci_core_init(ndev);
if (r)
goto error;
@@ -609,7 +601,6 @@ static int fdp_nci_core_reset_ntf_packet(struct nci_dev 
*ndev,
struct fdp_nci_info *info = nci_get_drvdata(ndev);
struct device *dev = >phy->i2c_dev->dev;
 
-   dev_dbg(dev, "%s\n", __func__);
info->setup_reset_ntf = 1;
wake_up(>setup_wq);
 
@@ -622,7 +613,6 @@ static int fdp_nci_prop_patch_ntf_packet(struct nci_dev 
*ndev,
struct fdp_nci_info *info = nci_get_drvdata(ndev);
struct device *dev = >phy->i2c_dev->dev;
 
-   dev_dbg(dev, "%s\n", __func__);
info->setup_patch_ntf = 1;
info->setup_patch_status = skb->data[0];
wake_up(>setup_wq);
@@ -637,7 +627,7 @@ static int fdp_nci_prop_patch_rsp_packet(struct nci_dev 
*ndev,
struct device *dev = >phy->i2c_dev->dev;
u8 status = skb->data[0];
 
-   dev_dbg(dev, "%s: status 0x%x\n", __func__, status);
+   dev_dbg(dev, "status 0x%x\n", status);
nci_req_complete(ndev, status);
 
return 0;
@@ -650,7 +640,7 @@ static int 
fdp_nci_prop_set_production_data_rsp_packet(struct nci_dev *ndev,
struct device *dev = >phy->i2c_dev->dev;
u8 status = skb->data[0];
 
-   dev_dbg(dev, "%s: status 0x%x\n", __func__, status);
+   dev_dbg(dev, "status 0x%x\n", status);
nci_req_complete(ndev, status);
 
return 0;
@@ -695,7 +685,7 @@ static int fdp_nci_core_get_config_rsp_packet(struct 
nci_dev *ndev,
dev_dbg(dev, "OTP version %d\n", info->otp_version);
dev_dbg(dev, "RAM version %d\n", info->ram_version);
dev_dbg(dev, "key index %d\n", info->key_index);
-   dev_dbg(dev, "%s: status 0x%x\n", __func__, rsp->status);
+   dev_dbg(dev, "status 0x%x\n", rsp->status);
 
nci_req_complete(ndev, rsp->status);
 
@@ -798,8 +788,6 @@ void fdp_nci_remove(struct nci_dev *ndev)
struct fdp_nci_info *info = nci_get_drvdata(ndev);
struct device *dev = >phy->i2c_dev->dev;
 
-   dev_dbg(dev, "%s\n", __func__);
-
nci_unregister_device(ndev);
nci_free_device(ndev);
 }
diff --git a/drivers/nfc/fdp/i2c.c b/drivers/nfc/fdp/i2c.c
index 2c5ed2224c5e..bb14d30c568c 100644
--- a/drivers/nfc/fdp/i2c.c
+++ b/drivers/nfc/fdp/i2c.c
@@ -57,7 +57,6 @@ static int fdp_nci_i2c_enable(void *phy_id)
 {
struct fdp_i2c_phy *phy = phy_id;
 
-   dev_dbg(>i2c_dev->dev, "%s\n", __func__);
fdp_nci_i2c_reset(phy);
 
return 0;
@@ -67,7 +66,6 @@ static void fdp_nci_i2c_disable(void *phy_id)
 {
struct fdp_i2c_phy *phy = phy_id;
 
-   dev_dbg(>i2c_dev

[PATCH v3 2/4] NFC: Fix possible memory corruption when handling SHDLC I-Frame commands

2018-05-03 Thread Amit Pundir
From: Suren Baghdasaryan <sur...@google.com>

When handling SHDLC I-Frame commands "pipe" field used for indexing
into an array should be checked before usage. If left unchecked it
might access memory outside of the array of size NFC_HCI_MAX_PIPES(127).

cc: Stable <sta...@vger.kernel.org>
Signed-off-by: Suren Baghdasaryan <sur...@google.com>
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
Reviewed-by: Andy Shevchenko <andriy.shevche...@linux.intel.com>
---
v3..v1:
Resend. No changes.

 net/nfc/hci/core.c | 10 ++
 1 file changed, 10 insertions(+)

diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c
index ac8030c4bcf8..19cb2e473ea6 100644
--- a/net/nfc/hci/core.c
+++ b/net/nfc/hci/core.c
@@ -209,6 +209,11 @@ void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 
pipe, u8 cmd,
}
create_info = (struct hci_create_pipe_resp *)skb->data;
 
+   if (create_info->pipe >= NFC_HCI_MAX_PIPES) {
+   status = NFC_HCI_ANY_E_NOK;
+   goto exit;
+   }
+
/* Save the new created pipe and bind with local gate,
 * the description for skb->data[3] is destination gate id
 * but since we received this cmd from host controller, we
@@ -232,6 +237,11 @@ void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 
pipe, u8 cmd,
}
delete_info = (struct hci_delete_pipe_noti *)skb->data;
 
+   if (delete_info->pipe >= NFC_HCI_MAX_PIPES) {
+   status = NFC_HCI_ANY_E_NOK;
+   goto exit;
+   }
+
hdev->pipes[delete_info->pipe].gate = NFC_HCI_INVALID_GATE;
hdev->pipes[delete_info->pipe].dest_host = NFC_HCI_INVALID_HOST;
break;
-- 
2.7.4



[PATCH] usb: f_fs: Prevent gadget unbind if it is already unbound

2018-01-08 Thread Amit Pundir
From: Hemant Kumar <hema...@codeaurora.org>

Upon usb composition switch there is possibility of ep0 file
release happening after gadget driver bind. In case of composition
switch from adb to a non-adb composition gadget will never gets
bound again resulting into failure of usb device enumeration. Fix
this issue by checking FFS_FL_BOUND flag and avoid extra
gadget driver unbind if it is already done as part of composition
switch.

This fixes adb reconnection error reported on Android running
v4.4 and above kernel versions. Verified on Hikey running vanilla
v4.15-rc7 + few out of tree Mali patches.

Reviewed-at: https://android-review.googlesource.com/#/c/582632/

Cc: Felipe Balbi <ba...@kernel.org>
Cc: Greg KH <gre...@linux-foundation.org>
Cc: Michal Nazarewicz <min...@mina86.com>
Cc: John Stultz <john.stu...@linaro.org>
Cc: Dmitry Shmidt <dimitr...@google.com>
Cc: Badhri <bad...@google.com>
Cc: Android Kernel Team <kernel-t...@android.com>
Cc: sta...@vger.kernel.org
Signed-off-by: Hemant Kumar <hema...@codeaurora.org>
[AmitP: Cherry-picked it from android-4.14 and updated the commit log]
Signed-off-by: Amit Pundir <amit.pun...@linaro.org>
---
 drivers/usb/gadget/function/f_fs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/function/f_fs.c 
b/drivers/usb/gadget/function/f_fs.c
index b6cf5ab5a0a1..f9bd351637cd 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -3700,7 +3700,8 @@ static void ffs_closed(struct ffs_data *ffs)
ci = opts->func_inst.group.cg_item.ci_parent->ci_parent;
ffs_dev_unlock();
 
-   unregister_gadget_item(ci);
+   if (test_bit(FFS_FL_BOUND, >flags))
+   unregister_gadget_item(ci);
return;
 done:
ffs_dev_unlock();
-- 
2.7.4



  1   2   3   >