OSDN Git Service
Daniel Campello [Mon, 20 Jul 2015 23:23:50 +0000 (16:23 -0700)]
ANDROID: Included sdcardfs source code for kernel 3.0
Only included the source code as is for kernel 3.0. Following patches
take care of porting this file system to version 3.10.
Change-Id: I09e76db77cd98a059053ba5b6fd88572a4b75b5b
Signed-off-by: Daniel Campello <campello@google.com>
Dmitry Shmidt [Wed, 24 Jan 2018 21:59:50 +0000 (13:59 -0800)]
ANDROID: Fix script to fetch android kernel config fragments for 4.14
Change-Id: I6036d0cc9d4f28f0df0e8d3267034b34ec276a08
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
Artem Borisov [Sat, 13 Jan 2018 15:03:40 +0000 (18:03 +0300)]
ANDROID: uid_sys_stats: fix the comment
It is not uid_cputime.c anymore.
Change-Id: I7effc2a449c1f9cba9d86a7b122a9c05fc266405
Signed-off-by: Artem Borisov <dedsa2002@gmail.com>
Dmitry Shmidt [Mon, 8 Jan 2018 23:21:57 +0000 (15:21 -0800)]
ANDROID: netfilter: xt_qtaguid: Fix 4.14 compilation
struct xt_action_param was changed:
in, out, family and hooknum were moved to
struct nf_hook_state *state
in, out, pf and hook
Replace atomic_read() with refcount_read()
Change-Id: If463bf84db08fe382baa825ca7818cab2150b60d
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
Nick Bray [Thu, 30 Nov 2017 23:49:54 +0000 (15:49 -0800)]
ANDROID: initramfs: call free_initrd() when skipping init
Memory allocated for initrd would not be reclaimed if initializing ramfs
was skipped.
Bug:
69901741
Test: "grep MemTotal /proc/meminfo" increases by a few MB on an Android
device with a/b boot.
Change-Id: Ifbe094d303ed12cfd6de6aa004a8a19137a2f58a
Signed-off-by: Nick Bray <ncbray@google.com>
Evgenii Stepanov [Wed, 1 Nov 2017 22:10:12 +0000 (15:10 -0700)]
ANDROID: Revert "arm64: move ELF_ET_DYN_BASE to 4GB / 4MB"
Part of the above change was reverted in
c715b72c1ba406f133217b509044c38d8e714a37;
this change reverts the rest.
This ARM mmap change breaks AddressSanitizer:
Shadow memory range interleaves with an existing memory mapping. ASan cannot proceed correctly. ABORTING.
Revert it until ASAN runtime library is updated to handle it.
Bug:
67425063
Signed-off-by: Evgenii Stepanov <eugenis@google.com>
[AmitP: Updated the commit ID of the upstream commit]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Evgenii Stepanov [Wed, 1 Nov 2017 22:04:42 +0000 (15:04 -0700)]
ANDROID: Revert "arm: move ELF_ET_DYN_BASE to 4MB"
This ARM mmap change breaks AddressSanitizer:
Shadow memory range interleaves with an existing memory mapping. ASan cannot proceed correctly. ABORTING.
Revert it until ASAN runtime library is updated to handle it.
Bug:
67425063
This reverts commit
6a9af90a3bcde217a1c053e135f5f43e5d5fafbd.
Signed-off-by: Evgenii Stepanov <eugenis@google.com>
[AmitP: Updated the commit ID of reverted upstream commit]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Arnd Bergmann [Wed, 10 May 2017 09:21:27 +0000 (11:21 +0200)]
ANDROID: memory_state_time: fix undefined behavior with missing DT properties
kernelci reports warnings about unintialized variable usage:
drivers/misc/memory_state_time.c:351:12: warning: 'lenf' is used uninitialized in this function [-Wuninitialized]
drivers/misc/memory_state_time.c:321:14: warning: 'lenb' is used uninitialized in this function [-Wuninitialized]
In both cases we try to continue without a DT property but use the
length that has not been assigned at this point. This rearranges the
code in the two functions to bail out earlier in case of an error.
The patch is needed for both android-common-4.9, 4.4 and 3.18.
Link: https://kernelci.org/build/id/591177f459b5147648b12d54/logs/
Fixes:
ad3c02f8b3a5 ("ANDROID: Implement memory_state_time, used by qcom,cpubw")
Cc: James Carr <carrja@google.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
James Carr [Sat, 30 Jul 2016 02:02:16 +0000 (19:02 -0700)]
ANDROID: memory_state_time: Implement memory_state_time, used by qcom,cpubw
New driver memory_state_time tracks time spent in different DDR
frequency and bandwidth states.
Memory drivers such as qcom,cpubw can post updated state to the driver
after registering a callback. Processed by a workqueue
Bandwidth buckets are read in from device tree in the relevant qualcomm
section, can be defined in any quantity and spacing.
The data is exposed at /sys/kernel/memory_state_time, able to be read by
the Android framework.
Functionality is behind a config option CONFIG_MEMORY_STATE_TIME
Change-Id: I4fee165571cb975fb9eacbc9aada5e6d7dd748f0
Signed-off-by: James Carr <carrja@google.com>
Yang Jin [Wed, 26 Jul 2017 19:52:22 +0000 (12:52 -0700)]
ANDROID: uid_sys_stats: log task io with a debug flag
Add a hashmap inside each uid_entry to keep track of task name and io.
Task full name is a combination of thread and process name.
Bug:
63739275
Change-Id: I30083b757eaef8c61e55a213a883ce8d0c9cf2b1
Signed-off-by: Yang Jin <yajin@google.com>
[AmitP: Folded following android-4.9 commit changes into this patch
0ea205a6a224 ("ANDROID: uid_sys_stats: Fix implicit declaration of get_cmdline()")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Ganesh Mahendran [Thu, 25 May 2017 07:20:29 +0000 (15:20 +0800)]
ANDROID: uid_sys_stats: check previous uid_entry before call find_or_register_uid
Theads in a process are stored in list struct task_struct->thread_group,
so it will be visited continiously in below loop:
do_each_thread(temp, task) {
...
} while_each_thread(temp, task);
I add some log in the loop, we can see below information:
[ 65.033561] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033567] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033574] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033581] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033588] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033595] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033602] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033609] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033615] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033622] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033629] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033637] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033644] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033651] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033658] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033665] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033672] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033680] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033687] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033694] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033701] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033708] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033715] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033722] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033729] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033736] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033743] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033750] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033757] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033763] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033770] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033777] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033784] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033791] uid 1000, uid_entry
ffffffc0f2761600
[ 65.033798] uid 1000, uid_entry
ffffffc0f2761600
So we can check the previous uid_entry before calling find_or_register_uid
to save time.
Change-Id: I05ec1a1405a80c0a620cb4b4b2f6483dbfde7829
Signed-off-by: Ganesh Mahendran <opensource.ganesh@gmail.com>
Ganesh Mahendran [Wed, 24 May 2017 02:28:27 +0000 (10:28 +0800)]
ANDROID: uid_sys_stats: Kconfig: add depends for UID_SYS_STATS
uid_io depends on TASK_XACCT and TASK_IO_ACCOUNTING.
So add depends in Kconfig before compiling code.
Change-Id: Ie6bf57ec7c2eceffadf4da0fc2aca001ce10c36e
Signed-off-by: Ganesh Mahendran <opensource.ganesh@gmail.com>
Jin Qian [Mon, 22 May 2017 19:08:06 +0000 (12:08 -0700)]
ANDROID: uid_sys_stats: defer io stats calulation for dead tasks
Store sum of dead task io stats in uid_entry and defer uid io
calulation until next uid proc stat change or dumpsys.
Bug:
37754877
Change-Id: I970f010a4c841c5ca26d0efc7e027414c3c952e0
Signed-off-by: Jin Qian <jinqian@google.com>
Ganesh Mahendran [Tue, 25 Apr 2017 10:07:43 +0000 (18:07 +0800)]
ANDROID: uid_sys_stats: fix access of task_uid(task)
struct task_struct *task should be proteced by tasklist_lock.
Change-Id: Iefcd13442a9b9d855a2bbcde9fd838a4132fee58
Signed-off-by: Ganesh Mahendran <opensource.ganesh@gmail.com>
(cherry picked from commit
90d78776c4a0e13fb7ee5bd0787f04a1730631a6)
Jin Qian [Fri, 14 Apr 2017 00:07:58 +0000 (17:07 -0700)]
ANDROID: uid_sys_stats: reduce update_io_stats overhead
Replaced read_lock with rcu_read_lock to reduce time that preemption
is disabled.
Added a function to update io stats for specific uid and moved
hash table lookup, user_namespace out of loops.
Bug:
37319300
Change-Id: I2b81b5cd3b6399b40d08c3c14b42cad044556970
Signed-off-by: Jin Qian <jinqian@google.com>
Wei Wang [Mon, 13 Mar 2017 19:22:21 +0000 (12:22 -0700)]
ANDROID: uid_sys_stats: change to use rt_mutex
We see this happens multiple times in heavy workload in systrace
and AMS stuck in uid_lock.
Running process: Process 953
Running thread: android.ui
State: Uninterruptible Sleep
Start:
1,025.628 ms
Duration:
27,955.949 ms
On CPU:
Running instead: system_server
Args:
{kernel callsite when blocked:: "uid_procstat_write+0xb8/0x144"}
Changing to rt_mutex can mitigate the priority inversion
Bug:
34991231
Bug:
34193533
Test: on marlin
Change-Id: I28eb3971331cea60b1075740c792ab87d103262c
Signed-off-by: Wei Wang <wvw@google.com>
Jin Qian [Thu, 2 Mar 2017 21:39:43 +0000 (13:39 -0800)]
ANDROID: uid_sys_stats: account for fsync syscalls
Change-Id: Ie888d8a0f4ec7a27dea86dc4afba8e6fd4203488
Signed-off-by: Jin Qian <jinqian@google.com>
Jin Qian [Tue, 28 Feb 2017 23:09:42 +0000 (15:09 -0800)]
ANDROID: uid_sys_stats: fix negative write bytes.
A task can cancel writes made by other tasks. In rare cases,
cancelled_write_bytes is larger than write_bytes if the task
itself didn't make any write. This doesn't affect total size
but may cause confusion when looking at IO usage on individual
tasks.
Bug:
35851986
Change-Id: If6cb549aeef9e248e18d804293401bb2b91918ca
Signed-off-by: Jin Qian <jinqian@google.com>
Jin Qian [Wed, 18 Jan 2017 01:26:07 +0000 (17:26 -0800)]
ANDROID: uid_sys_stats: allow writing same state
Signed-off-by: Jin Qian <jinqian@google.com>
Bug:
34360629
Change-Id: Ia748351e07910b1febe54f0484ca1be58c4eb9c7
Jin Qian [Wed, 11 Jan 2017 00:11:07 +0000 (16:11 -0800)]
ANDROID: uid_sys_stats: rename uid_cputime.c to uid_sys_stats.c
This module tracks cputime and io stats.
Signed-off-by: Jin Qian <jinqian@google.com>
Bug:
34198239
Change-Id: I9ee7d9e915431e0bb714b36b5a2282e1fdcc7342
Jin Qian [Wed, 11 Jan 2017 00:10:35 +0000 (16:10 -0800)]
ANDROID: uid_cputime: add per-uid IO usage accounting
IO usages are accounted in foreground and background buckets.
For each uid, io usage is calculated in two steps.
delta = current total of all uid tasks - previus total
current bucket += delta
Bucket is determined by current uid stat. Userspace writes to
/proc/uid_procstat/set <uid> <stat> when uid stat is updated.
/proc/uid_io/stats shows IO usage in this format.
<uid> <foreground IO> <background IO>
Signed-off-by: Jin Qian <jinqian@google.com>
Bug:
34198239
Change-Id: Ib8bebda53e7a56f45ea3eb0ec9a3153d44188102
Ruchi Kandoi [Sat, 24 Oct 2015 00:49:11 +0000 (17:49 -0700)]
ANDROID: uid_cputime: Check for the range while removing range of UIDs.
Checking if the uid_entry->uid matches the uid intended to be removed will
prevent deleting unwanted uid_entry.
Type cast the key for the hashtable to the same size, as when they were
inserted. This will make sure that we can find the uid_entry we want.
Bug:
25195548
Change-Id: I567942123cfb20e4b61ad624da19ec4cc84642c1
Signed-off: Ruchi kandoi <kandoiruchi@google.com>
Ruchi Kandoi [Fri, 31 Jul 2015 17:17:54 +0000 (10:17 -0700)]
ANDROID: uid_cputime: Iterates over all the threads instead of processes.
Bug:
22833116
Change-Id: I775a18f61bd2f4df2bec23d01bd49421d0969f87
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
Jin Qian [Tue, 14 Jul 2015 01:16:55 +0000 (18:16 -0700)]
ANDROID: uid_cputime: fix cputime overflow
Converting cputime_t to usec caused overflow when the value is greater
than 1 hour. Use msec and convert to unsigned long long to support bigger
range.
Bug:
22461683
Change-Id: I853fe3e8e7dbf0d3e2cc5c6f9688a5a6e1f1fb3e
Signed-off-by: Jin Qian <jinqian@google.com>
[AmitP: Refactored the original changes because cputime_to_jiffies()
is obsolete and removed in upstream commit
f22d6df0b23e ("sched/cputime: Remove jiffies based cputime")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
jinqian [Wed, 11 Mar 2015 17:44:50 +0000 (10:44 -0700)]
ANDROID: uid_cputime: Adds accounting for the cputimes per uid.
Adds proc files /proc/uid_cputime/show_uid_stat and
/proc/uid_cputime/remove_uid_range.
show_uid_stat lists the total utime and stime for the active as well as
terminated processes for each of the uids.
Writing a range of uids to remove_uid_range will delete the accounting
for all the uids within that range.
Change-Id: I21d9210379da730b33ddc1a0ea663c8c9d2ac15b
[AmitP: Refactored the original patch because upstream commit
605dc2b31a2a ("tsacct: Convert obsolete cputime type to nsecs")
made cputime_t type obsolete, so use u64 nanoseconds directly instead.
Also folded following android-4.9 changes into this patch
48a9906c0fd8 ("ANDROID: proc: uid_cputime: create uids from kuids")
453ac31cab34 ("ANDROID: proc: uid_cputime: fix show_uid_stat permission")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Mark Kuo [Mon, 11 Jan 2016 11:07:12 +0000 (19:07 +0800)]
CHROMIUM: usb: gadget: f_accessory: add .raw_request callback
After this upstream commit:
3c86726cfe38952f0366f86acfbbb025813ec1c2,
.raw_request is mandatory in hid_ll_driver structure, hence add an empty
raw_request() function.
BUG=chrome-os-partner:49140
TEST=none
Change-Id: Idd0bbe6960aad2c557376e4a24827d7e1df8e023
Signed-off-by: Mark Kuo <mkuo@nvidia.com>
Reviewed-on: https://chromium-review.googlesource.com/321038
Commit-Ready: Andrew Bresticker <abrestic@chromium.org>
Tested-by: Andrew Bresticker <abrestic@chromium.org>
Reviewed-by: Andrew Bresticker <abrestic@chromium.org>
Mark Kuo [Mon, 11 Jan 2016 09:49:16 +0000 (17:49 +0800)]
CHROMIUM: usb: gadget: f_audio_source: add .free_func callback
When userspace unbinds gadget functions through configfs, the
.free_func() callback is always invoked. (in config_usb_cfg_unlink())
Implement it as a no-op to avoid the following crash:
[ 68.125679] configfs-gadget gadget: unbind function 'accessory'/
ffffffc0720bf000
[ 68.133202] configfs-gadget gadget: unbind function 'audio_source'/
ffffffc0012ca3c0
[ 68.142668] tegra-xudc
700d0000.usb-device: ep 0 disabled
[ 68.148186] Bad mode in Synchronous Abort handler detected, code 0x86000006
[ 68.155144] CPU: 2 PID: 1 Comm: init Tainted: G U W
3.18.0-09419-g87296c3-dirty #561
[ 68.163743] Hardware name: Google Tegra210 Smaug Rev 1,3+ (DT)
[ 68.169566] task:
ffffffc0bc8d0000 ti:
ffffffc0bc8bc000 task.ti:
ffffffc0bc8bc000
[ 68.177039] PC is at 0x0
[ 68.179577] LR is at usb_put_function+0x14/0x1c
....
BUG=chrome-os-partner:49140
TEST="setprop sys.usb.config accessory,audio_source" on A44 and then
switch back to default: "setprop sys.usb.config mtp,adb", no crash will
be seen.
Change-Id: I5b6141964aab861e86e3afb139ded02d4d122dab
Signed-off-by: Mark Kuo <mkuo@nvidia.com>
Reviewed-on: https://chromium-review.googlesource.com/321013
Commit-Ready: Andrew Bresticker <abrestic@chromium.org>
Tested-by: Andrew Bresticker <abrestic@chromium.org>
Reviewed-by: Andrew Bresticker <abrestic@chromium.org>
Winter Wang [Fri, 20 May 2016 03:05:00 +0000 (11:05 +0800)]
ANDROID: usb: gadget: f_midi: set fi->f to NULL when free f_midi function
fi->f is set in f_midi's alloc_func, need to clean this to
NULL in free_func, otherwise on ConfigFS's function switch,
midi->usb_function it self is freed, fi->f will be a wild
pointer and run into below kernel panic:
---------------
[ 58.950628] Unable to handle kernel paging request at virtual address
63697664
[ 58.957869] pgd =
c0004000
[ 58.960583] [
63697664] *pgd=
00000000
[ 58.964185] Internal error: Oops:
80000005 [#1] PREEMPT SMP ARM
[ 58.970111] Modules linked in:
[ 58.973191] CPU: 0 PID: 0 Comm: swapper/0 Not tainted
4.1.15-03504-g34c857c-dirty #89
[ 58.981024] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
[ 58.987557] task:
c110bd70 ti:
c1100000 task.ti:
c1100000
[ 58.992962] PC is at 0x63697664
[ 58.996120] LR is at android_setup+0x78/0x138
<..snip..>
[ 60.044980] 1fc0:
ffffffff ffffffff c1000684 00000000 00000000 c108ecd0 c11f7294 c11039c0
[ 60.053181] 1fe0:
c108eccc c110d148 1000406a 412fc09a 00000000 1000807c 00000000 00000000
[ 60.061420] [<
c073b1fc>] (android_setup) from [<
c0730490>] (udc_irq+0x758/0x1034)
[ 60.068951] [<
c0730490>] (udc_irq) from [<
c017c650>] (handle_irq_event_percpu+0x50/0x254)
[ 60.077165] [<
c017c650>] (handle_irq_event_percpu) from [<
c017c890>] (handle_irq_event+0x3c/0x5c)
[ 60.086072] [<
c017c890>] (handle_irq_event) from [<
c017f3ec>] (handle_fasteoi_irq+0xe0/0x198)
[ 60.094630] [<
c017f3ec>] (handle_fasteoi_irq) from [<
c017bcfc>] (generic_handle_irq+0x2c/0x3c)
[ 60.103271] [<
c017bcfc>] (generic_handle_irq) from [<
c017bfb8>] (__handle_domain_irq+0x7c/0xec)
[ 60.112000] [<
c017bfb8>] (__handle_domain_irq) from [<
c0101450>] (gic_handle_irq+0x24/0x5c)
--------------
Signed-off-by: Winter Wang <wente.wang@nxp.com>
Badhri Jagan Sridharan [Thu, 3 Sep 2015 05:49:10 +0000 (22:49 -0700)]
ANDROID: usb: gadget: f_midi: create F_midi device
Android frameworks relies on the alsa
config reported by the f_midi device.
Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com>
Change-Id: I0695e00b166fd953f50acea93802245b0d5a5240
Badhri Jagan Sridharan [Fri, 21 Jul 2017 21:58:16 +0000 (14:58 -0700)]
ANDROID: usb: gadget: f_accessory: assign no-op request complete callbacks
The req->complete seems to presist the callback pointer for
the control requests. This causes the serial of the accessory
to be overridden when an accessory function specific out
control request is issued right after the ACCESSORY_SEND_STRING
control request. Therefore, assign a no-op req complete function
when nothing needs to be done once the request is completed.
Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com>
Bug:
63867169
Change-Id: I78c1602e9a044b8718b270b8a068cf5afc83f984
Anson Jacob [Sat, 13 Aug 2016 00:38:10 +0000 (20:38 -0400)]
ANDROID: usb: gadget: f_accessory: Fix for UsbAccessory clean unbind.
Reapplying fix by Darren Whobrey (Change 69674)
Fixes issues: 20545, 59667 and 61390.
With prior version of f_accessory.c, UsbAccessories would not
unbind cleanly when application is closed or i/o stopped
while the usb cable is still connected. The accessory gadget
driver would be left in an invalid state which was not reset
on subsequent binding or opening. A reboot was necessary to clear.
In some phones this issues causes the phone to reboot upon
unplugging the USB cable.
Main problem was that acc_disconnect was being called on I/O error
which reset disconnected and online.
Minor fix required to properly track setting and unsetting of
disconnected and online flags. Also added urb Q wakeup's on unbind
to help unblock waiting threads.
Tested on Nexus 7 grouper. Expected behaviour now observed:
closing accessory causes blocked i/o to interrupt with IOException.
Accessory can be restarted following closing of file handle
and re-opening.
This is a generic fix that applies to all devices.
Change-Id: I4e08b326730dd3a2820c863124cee10f7cb5501e
Signed-off-by: Darren Whobrey <d.whobrey@mildai.org>
Signed-off-by: Anson Jacob <ansonjacob.aj@gmail.com>
keunyoung [Wed, 29 Jan 2014 20:41:50 +0000 (12:41 -0800)]
ANDROID: usb: gadget: f_accessory: fix false disconnect due to a signal sent to the reading process
- In the current implementation, when a signal is sent to the reading process,
read is cancelled by calling usb_ep_dequeue, which lead into calling
acc_complete_out with ECONNRESET, but the current logic treats it as
disconnection, which makes the device inaccessible until cable is actually
disconnected.
- The fix calls disconnect only when ESHUTDOWN error is passed.
- If data has already arrived while trying cancelling, the data is marked
as available, and it will be read out on the next read. This is necessary
as USB bulk is assumed to guarantee no data loss.
Signed-off-by: keunyoung <keunyoung@google.com>
Badhri Jagan Sridharan [Mon, 30 Mar 2015 22:32:22 +0000 (15:32 -0700)]
ANDROID: usb: gadget: f_accessory: Move gadget functions code
3.18 kernel has reorganized drivers/usb/gadget
directory. Moving accessory gadget driver from
drivers/usb/gadget to drivers/usb/gadget/function
Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com>
Change-Id: If73c6df0537c4b1f51338ed3b0db817e51f06b4a
[AmitP: Refactored the original changes after squashing of related patches]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Badhri Jagan Sridharan [Mon, 24 Nov 2014 01:21:22 +0000 (17:21 -0800)]
ANDROID: usb: gadget: f_accessory: Migrate to USB_FUNCTION API
This patch adds support to use Android accessory
gadget function through the
DECLARE_USB_FUNCTION_INIT interface.
Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
Change-Id: Ib352752d5bc905fa1df9049b53eabf1294930db7
[AmitP: Folded following android-4.9 commit changes into this patch
Parts of
e45c769fa7af ("ANDROID: usb: gadget: cleanup: fix unused variable and function warnings")
a0a752add9b5 ("ANDROID: usb: gadget: f_accessory: remove duplicate endpoint alloc")
Parts of
051584e76d12 ("ANDROID: usb: gadget: function: cleanup: Add blank line after declaration")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Konrad Leszczynski [Wed, 24 Feb 2016 10:47:12 +0000 (10:47 +0000)]
ANDROID: usb: gadget: f_audio_source: disable the CPU C-states upon playback
Due to the issue with the isoc transfers being interrupted
by the CPU going into the idle state, the C-states will be
disabled for the playback time.
Change-Id: If4e52673606923d7e33a1d1dbe0192b8ad24f78c
Signed-off-by: Konrad Leszczynski <konrad.leszczynski@intel.com>
Signed-off-by: Russ Weight <russell.h.weight@intel.com>
Badhri Jagan Sridharan [Fri, 27 Mar 2015 21:49:55 +0000 (14:49 -0700)]
ANDROID: usb: gadget: f_audio_source: Move gadget functions code
3.18 kernel has reorganized drivers/usb/gadget
directory. Moving gadget functions drivers from
drivers/usb/gadget to drivers/usb/gadget/function
Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com>
Change-Id: I1eab0190f8d42e3be1b4e91ad3bc3a2dc853b0ef
[AmitP: Refactored the original changes after squashing of related patches]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Badhri Jagan Sridharan [Sun, 23 Nov 2014 21:51:28 +0000 (13:51 -0800)]
ANDROID: usb: gadget: f_audio_source: Move to USB_FUNCTION API
This patch adds support to use audio_source
gadget function through DECLARE_USB_FUNCTION_INIT
interface.
Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
Change-Id: I1fc6c9ea07105ae4eb785eebd3bb925bfdd8bc6b
[AmitP: Folded following android-4.9 commit changes into this patch
95106e3d2071 ("ANDROID: usb: gadget: build audio_source function only if SND is enabled")
4de9e33e5046 ("ANDROID: usb: gadget: audio_source: fix comparison of distinct pointer types")
Parts of
051584e76d12 ("ANDROID: usb: gadget: function: cleanup: Add blank line after declaration")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Danilo Krummrich [Mon, 14 Aug 2017 10:45:38 +0000 (12:45 +0200)]
ANDROID: usb: gadget: configfs: fix null ptr in android_disconnect
There's a race between usb_gadget_udc_stop() which is likely
to set the gadget driver to NULL in the udc driver and this drivers
gadget disconnect fn which likely checks for the gadget driver to
a null ptr. It happens that unbind (doing set_gadget_data(NULL))
is called before the gadget driver is set to NULL and the udc driver
calls disconnect fn which results in cdev being a null ptr.
As a workaround we check cdev in android_disconnect() to prevent
the following panic:
Unable to handle kernel NULL pointer dereference at virtual address
000000a8
pgd =
ffffff800940a000
[
000000a8] *pgd=
00000000be1fe003, *pud=
00000000be1fe003, *pmd=
0000000000000000
Internal error: Oops:
96000046 [#1] PREEMPT SMP
CPU: 7 PID: 1134 Comm: kworker/u16:3 Tainted: G S
4.9.41-g75cd2a0231ea-dirty #4
Hardware name: HiKey960 (DT)
Workqueue: events_power_efficient event_work
task:
ffffffc0b5f4f000 task.stack:
ffffffc0b5b94000
PC is at android_disconnect+0x54/0xa4
LR is at android_disconnect+0x54/0xa4
pc : [<
ffffff8008855938>] lr : [<
ffffff8008855938>] pstate:
80000185
sp :
ffffffc0b5b97bf0
x29:
ffffffc0b5b97bf0 x28:
0000000000000003
x27:
ffffffc0b5181c54 x26:
ffffffc0b5181c68
x25:
ffffff8008dc1000 x24:
ffffffc0b5181d70
x23:
ffffff8008dc18a0 x22:
ffffffc0b5f5a018
x21:
ffffffc0b5894ad8 x20:
0000000000000000
x19:
ffffff8008ddaec8 x18:
0000000000000000
x17:
0000000000000000 x16:
0000000000000000
x15:
0000000000000000 x14:
00000000007c9ccd
x13:
0000000000000000 x12:
0000000000000000
x11:
0000000000000001 x10:
0000000000000001
x9 :
ffffff800930f1a8 x8 :
ffffff800932a133
x7 :
0000000000000000 x6 :
0000000000000000
x5 :
ffffffc0b5b97a50 x4 :
ffffffc0be19f090
x3 :
0000000000000000 x2 :
ffffff80091ca000
x1 :
000000000000002f x0 :
000000000000002f
This happened on a hikey960 with the following backtrace:
[<
ffffff8008855938>] android_disconnect+0x54/0xa4
[<
ffffff80089def38>] dwc3_disconnect_gadget.part.19+0x114.888119]
[<
ffffff80087f7d48>] dwc3_gadget_suspend+0x6c/0x70
[<
ffffff80087ee674>] dwc3_suspend_device+0x58/0xa0
[<
ffffff80087fb418>] dwc3_otg_work+0x214/0x474
[<
ffffff80087fdc74>] event_work+0x3bc/0x5ac
[<
ffffff80080e5d88>] process_one_work+0x14c/0x43c
[<
ffffff80080e60d4>] worker_thread+0x5c/0x438
[<
ffffff80080ece68>] kthread+0xec/0x100
[<
ffffff8008083680>] ret_from_fork+0x10/0x50
dwc3_otg_work tries to handle a switch from host to device mode
and therefore calls disconnect on the gadget driver.
To reproduce the issue it is enaugh to enable tethering (rndis gadget),
unplug and plug in again the usb connector which causes the change
from device to host and back to device mode.
Signed-off-by: Danilo Krummrich <danilokrummrich@gmail.com>
Badhri Jagan Sridharan [Sun, 9 Aug 2015 22:12:50 +0000 (15:12 -0700)]
ANDROID: usb: gadget: configfs: Add device attribute to determine gadget state
Android frameworks (UsbDeviceManager) relies on gadget state exported
through device attributes. This CL adds the device attribute to export
USB gadget state.
Change-Id: Id0391810d75b58c579610fbec6e37ab22f28886d
Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com>
[AmitP: Folded following android-4.9 commit changes into this patch
Parts of
e45c769fa7af ("ANDROID: usb: gadget: cleanup: fix unused variable and function warnings")
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Badhri Jagan Sridharan [Tue, 14 Jul 2015 22:46:11 +0000 (15:46 -0700)]
ANDROID: usb: gadget: configfs: Add "state" attribute to android_device
Added a device attribute to android_device to
determine USB_GADGET's state
Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com>
Change-Id: I17f8903120df96bf2f4bf441940b53a87b818230
Badhri Jagan Sridharan [Fri, 27 Mar 2015 21:15:19 +0000 (14:15 -0700)]
ANDROID: usb: gadget: configfs: Add function devices to the parent
Added create_function_device to create child
function devices for USB gadget functions.
Android UsbDeviceManager relies on communicating
to the devices created by the gadget functions
to implement functions such as audio_source.
Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com>
Change-Id: I0df9ad86ac32d8cdacdea164e9fed49891b45fc2
Badhri Jagan Sridharan [Mon, 15 Dec 2014 18:44:47 +0000 (10:44 -0800)]
ANDROID: usb: gadget: configfs: Add Uevent to notify userspace
Android userspace UsbDeviceManager relies on the
uevents generated by the composition driver to
generate user notifications. This CL adds uevents
to be generated whenever USB changes its state
i.e. connected, disconnected, configured.
This CL also intercepts the setup requests from
the usb_core anb routes it to the specific
usb function if required.
Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com>
Change-Id: Ib3d3a78255a532f7449dac286f776c2966caf8c1
[AmitP: Folded following android-4.9 commit changes into this patch
9214c899f730 ("ANDROID: usb: gadget: configfs: handle gadget reset request for android")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Badhri Jagan Sridharan [Tue, 16 Dec 2014 00:42:27 +0000 (16:42 -0800)]
ANDROID: usb: gadget: configfs: Add usb_function ptr to fi struct
Add a pointer to the usb_function inside the
usb_function_instance structure to service
functions specific setup requests even before
the function gets added to the usb_gadget
Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com>
Change-Id: I6f457006f6c5516cc6986ec2acdf5b1ecf259d0c
Anson Jacob [Mon, 23 Jun 2014 11:14:01 +0000 (19:14 +0800)]
ANDROID: usb: gadget: f_audio_source: Fixed USB Audio Class Interface Descriptor
Fixed Android Issue #56549.
When both Vendor Class and Audio Class are activated for AOA 2.0,
the baInterfaceNr of the AudioControl Interface Descriptor points
to wrong interface numbers. They should be pointing to
Audio Control Device and Audio Streaming interfaces.
Replaced baInterfaceNr with the correct value.
Change-Id: Iaa083f3d97c1f0fc9481bf87852b2b51278a6351
Signed-off-by: Anson Jacob <ansonkuzhumbil@gmail.com>
Anson Jacob [Tue, 1 Jul 2014 10:17:20 +0000 (18:17 +0800)]
ANDROID: usb: gadget: f_audio_source: change max ISO packet size
Re-applying from
https://gitorious.org/shr/linux/commit/
eb4c9d2db894c3492c0a848581bd4f6790f93d5f
Most USB-AUDIO devices are limited to 256 byte for max iso buffer size.
If a IN_EP_MAX_PACKET_SIZE is bigger than a USB-AUDIO device's max iso
buffer size, it will cause noise. This patch will prevent this case as
possibe by reducing packet size. When using 44.1khz, 2ch, 16bit audio
data, if max packet size is bigger than 176 bytes, it's no problem.
Credits to: Iliyan Malchev <malchev@google.com>
Change-Id: Ic2a1c19ea65d5fb42bf12926b51b255b465d7215
Signed-off-by: Anson Jacob <ansonkuzhumbil@gmail.com>
Mike Lockwood [Fri, 11 May 2012 16:01:08 +0000 (09:01 -0700)]
ANDROID: usb: gadget: f_audio_source: New gadget driver for audio output
This driver presents a standard USB audio class interface to the host
and an ALSA PCM device to userspace
Change-Id: If16b14a5ff27045f9cb2daaf1ae9195c5eeab7d0
Signed-off-by: Mike Lockwood <lockwood@google.com>
[AmitP: Folded following android-4.9 commit changes into this patch
Parts of
e27543931009 ("ANDROID: usb: gadget: Fixes and hacks to make android usb gadget compile on 3.8")
i6d9285e2574a ("ANDROID: usb: gadget: f_audio_source:replace deprecated API")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Amit Pundir [Fri, 16 Jan 2015 00:11:10 +0000 (05:41 +0530)]
ANDROID: usb: gadget: f_accessory: check for accessory device before disconnecting HIDs
While disabling ConfigFS Android gadget, android_disconnect() calls
kill_all_hid_devices(), if CONFIG_USB_CONFIGFS_F_ACC is enabled, to free
the registered HIDs without checking whether the USB accessory device
really exist or not. If USB accessory device doesn't exist then we run into
following kernel panic:
----8<----
[ 136.724761] Unable to handle kernel NULL pointer dereference at virtual address
00000064
[ 136.724809] pgd =
c0204000
[ 136.731924] [
00000064] *pgd=
00000000
[ 136.737830] Internal error: Oops: 5 [#1] SMP ARM
[ 136.738108] CPU: 0 PID: 0 Comm: swapper/0 Not tainted
3.18.0-rc4-00400-gf75300e-dirty #76
[ 136.742788] task:
c0fb19d8 ti:
c0fa4000 task.ti:
c0fa4000
[ 136.750890] PC is at _raw_spin_lock_irqsave+0x24/0x60
[ 136.756246] LR is at kill_all_hid_devices+0x24/0x114
---->8----
This patch adds a test to check if USB Accessory device exists before freeing HIDs.
Change-Id: Ie229feaf0de3f4f7a151fcaa9a994e34e15ff73b
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Anson Jacob [Mon, 23 Jun 2014 11:07:44 +0000 (19:07 +0800)]
ANDROID: usb: gadget: f_accessory: Enabled Zero Length Packet (ZLP) for acc_write
Accessory connected to Android Device requires
Zero Length Packet (ZLP) to be written when data
transferred out from the Android device are multiples
of wMaxPacketSize (64bytes (Full-Speed) / 512bytes (High-Speed))
to end the transfer.
Change-Id: Ib2c2c0ab98ef9afa10e74a720142deca5c0ed476
Signed-off-by: Anson Jacob <ansonkuzhumbil@gmail.com>
Colin Cross [Thu, 7 Nov 2013 21:08:39 +0000 (13:08 -0800)]
ANDROID: usb: gadget: f_accessory: move userspace interface to uapi
Move the entire contents of linux/usb/f_accessory.h header to uapi,
it only contains a userspace interface.
Change-Id: Ieb5547da449588ae554988a201c0e6b4e3afc531
Signed-off-by: Colin Cross <ccross@android.com>
Mike Lockwood [Mon, 26 Mar 2012 18:03:55 +0000 (11:03 -0700)]
ANDROID: usb: gadget: f_accessory: Add support for HID input devices
Change-Id: I4f1452db32508382df52acdc47c0eb395ae328c7
Signed-off-by: Mike Lockwood <lockwood@google.com>
[AmitP: Folded following android-4.9 commit changes into this patch
4ce5e656ae74 ("ANDROID: usb: gadget: accessory: Fix section mismatch (again)")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Mike Lockwood [Fri, 11 May 2012 16:00:40 +0000 (09:00 -0700)]
ANDROID: usb: gadget: f_accessory: Add ACCESSORY_SET_AUDIO_MODE control request and ioctl
The control request will be used by the host to enable/disable USB audio
and the ioctl will be used by userspace to read the audio mode
Change-Id: I81c38611b588451e80eacdccc417ca6e11c60cab
Signed-off-by: Mike Lockwood <lockwood@google.com>
Benoit Goby [Mon, 19 Dec 2011 22:39:37 +0000 (14:39 -0800)]
ANDROID: usb: gadget: f_accessory: Add Android Accessory function
USB accessory mode allows users to connect USB host hardware
specifically designed for Android-powered devices. The accessories
must adhere to the Android accessory protocol outlined in the
http://accessories.android.com documentation. This allows
Android devices that cannot act as a USB host to still interact with
USB hardware. When an Android device is in USB accessory mode, the
attached Android USB accessory acts as the host, provides power
to the USB bus, and enumerates connected devices.
Change-Id: I67964b50d278f3c0471d47efbb7b0973a3502681
Signed-off-by: Mike Lockwood <lockwood@android.com>
[AmitP: Folded following android-4.9 commit changes into this patch
ceb2f0aac624 ("ANDROID: usb: gadget: accessory: Fix section mismatch")
Parts of
e27543931009 ("ANDROID: usb: gadget: Fixes and hacks to make android usb gadget compile on 3.8")
1b07ec751563 ("ANDROID: drivers: usb: gadget: 64-bit related type fixes")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Ruchi Kandoi [Fri, 20 Nov 2015 00:07:19 +0000 (16:07 -0800)]
ANDROID: trace: cpufreq: Add tracing for min/max cpufreq
Change-Id: I73f6ec437c1f805437d9376abb6510d1364b07ec
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
[AmitP: Folded following android-4.9 commit changes into this patch
d335459377f7 ("ANDROID: trace: cpufreq: fix typo in min/max cpufreq")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Riley Andrews [Fri, 2 Oct 2015 07:39:53 +0000 (00:39 -0700)]
ANDROID: trace: sched: add sched blocked tracepoint which dumps out context of sleep.
Decare war on uninterruptible sleep. Add a tracepoint which
walks the kernel stack and dumps the first non-scheduler function
called before the scheduler is invoked.
Change-Id: I19e965d5206329360a92cbfe2afcc8c30f65c229
Signed-off-by: Riley Andrews <riandrews@google.com>
Jeff Vander Stoep [Sun, 29 May 2016 21:22:32 +0000 (14:22 -0700)]
ANDROID: security,perf: Allow further restriction of perf_event_open
When kernel.perf_event_open is set to 3 (or greater), disallow all
access to performance events by users without CAP_SYS_ADMIN.
Add a Kconfig symbol CONFIG_SECURITY_PERF_EVENTS_RESTRICT that
makes this value the default.
This is based on a similar feature in grsecurity
(CONFIG_GRKERNSEC_PERF_HARDEN). This version doesn't include making
the variable read-only. It also allows enabling further restriction
at run-time regardless of whether the default is changed.
https://lkml.org/lkml/2016/1/11/587
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Bug:
29054680
Change-Id: Iff5bff4fc1042e85866df9faa01bce8d04335ab8
Mark Salyzyn [Wed, 30 Dec 2015 17:26:15 +0000 (09:26 -0800)]
ANDROID: rtc-palmas: correct for bcd year
Replace bcd2bin and bin2bcd with one that maps years 1970 to 2129
in a pattern that works with the underlying hardware.
The only transition that does not work correctly for this rtc clock
is the transition from 2099 to 2100, it proceeds to 2000. The rtc
clock retains and transitions the year correctly in all other
circumstances.
Signed-off-by: Mark Salyzyn <salyzyn@google.com>
Bug:
26346842
Change-Id: Ie527700190b1ae4b4bc3c12279d875aa5985b168
yangdongdong [Sat, 8 Aug 2015 03:59:59 +0000 (11:59 +0800)]
ANDROID: power: wakeup: align wakeup_sources format
This aligns every column of elements in wakeup_sources to
conveniently check any specific column for suspicious power
consumption wakeup source or for other easily human readable purpose.
Change-Id: Iac8b0538170fcc0cca9f6857c15d9a4c62c8865e
Signed-off-by: yangdongdong <yangdongdong@xiaomi.com>
Ruchi Kandoi [Tue, 10 Nov 2015 18:53:55 +0000 (10:53 -0800)]
ANDROID: power: wakeup: Add the guard condition for len in pm_get_active_wakeup_sources
Check if the len is not greater than maximum to prevent buffer overflow.
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
Change-Id: I575b0a72bb5448b68353408d71fa8b83420c9088
Ruchi Kandoi [Wed, 8 Apr 2015 22:42:29 +0000 (15:42 -0700)]
ANDROID: power: wakeup: Add last wake up source logging for suspend abort reason.
There is a possibility that a wakeup source event is received after
the device prepares to suspend which might cause the suspend to abort.
This patch adds the functionality of reporting the last active wakeup
source which is currently not active but caused the suspend to abort reason
via the /sys/kernel/power/last_wakeup_reason file.
Change-Id: I1760d462f497b33e425f5565cb6cff5973932ec3
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
Amit Pundir [Mon, 13 Apr 2015 21:08:20 +0000 (02:38 +0530)]
ANDROID: power: wakeup_reason: fix suspend time reporting
Suspend time reporting Change-Id: I2cb9a9408a5fd12166aaec11b935a0fd6a408c63
(Power: Report suspend times from last_suspend_time), is broken on 3.16+
kernels because get_xtime_and_monotonic_and_sleep_offset() hrtimer helper
routine is removed from kernel timekeeping.
The replacement helper routines ktime_get_update_offsets_{tick,now}()
are private to core kernel timekeeping so we can't use them, hence using
ktime_get() and ktime_get_boottime() instead and sampling the time twice.
Idea is to use Monotonic boottime offset to calculate total time spent
in last suspend state and CLOCK_MONOTONIC to calculate time spent in
last suspend-resume process.
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
jinqian [Wed, 25 Mar 2015 23:18:44 +0000 (16:18 -0700)]
ANDROID: power: wakeup_reason: Report suspend times from last_suspend_time
This node epxorts two values separated by space.
From left to right:
1. time spent in suspend/resume process
2. time spent sleep in suspend state
Change-Id: I2cb9a9408a5fd12166aaec11b935a0fd6a408c63
Dmitry Shmidt [Fri, 31 Oct 2014 23:05:46 +0000 (16:05 -0700)]
ANDROID: power: wakeup_reason: Add check_wakeup_reason() to verify wakeup source irq
Wakeup reason is set before driver resume handlers are called.
It is cleared before driver suspend handlers are called, on
PM_SUSPEND_PREPARE.
Change-Id: I04218c9b0c115a7877e8029c73e6679ff82e0aa4
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
Ruchi Kandoi [Wed, 29 Oct 2014 17:36:27 +0000 (10:36 -0700)]
ANDROID: power: wakeup_reason: Adds functionality to log the last suspend abort reason.
Extends the last_resume_reason to log suspend abort reason. The abort
reasons will have "Abort:" appended at the start to distinguish itself
from the resume reason.
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
Change-Id: I3207f1844e3d87c706dfc298fb10e1c648814c5f
[AmitP: Folded following android-4.9 changes into this patch
00a83e61b4fc ("ANDROID: Make suspend abort reason logging depend on CONFIG_PM_SLEEP")
9d17e24b036e ("ANDROID: wakeup_reason: use vsnprintf instead of snsprintf for vargs.")
7961972600ba ("ANDROID: power: Provide dummy log_suspend_abort_reason() if SUSPEND is disabled")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Ruchi Kandoi [Wed, 15 Oct 2014 00:43:21 +0000 (17:43 -0700)]
ANDROID: power: wakeup_reason: Avoids bogus error messages for the suspend aborts.
Avoids printing bogus error message "tasks refusing to freeze", in cases
where pending wakeup source caused the suspend abort.
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
Change-Id: I913ad290f501b31cd536d039834c8d24c6f16928
Ruchi Kandoi [Fri, 7 Mar 2014 20:54:30 +0000 (12:54 -0800)]
ANDROID: power: wakeup_reason: Add guard condition for maximum wakeup reasons
Ensure the array for the wakeup reason IRQs does not overflow.
Change-Id: Iddc57a3aeb1888f39d4e7b004164611803a4d37c
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
(cherry picked from commit
b5ea40cdfcf38296535f931a7e5e7bf47b6fad7f)
Ruchi Kandoi [Wed, 19 Feb 2014 23:30:47 +0000 (15:30 -0800)]
ANDROID: power: wakeup_reason: add an API to log wakeup reasons
Add API log_wakeup_reason() and expose it to userspace via sysfs path
/sys/kernel/wakeup_reasons/last_resume_reason
Change-Id: I81addaf420f1338255c5d0638b0d244a99d777d1
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
[AmitP: Folded following android-4.9 commit changes into this patch
1135122a192a ("ANDROID: POWER: fix compile warnings in log_wakeup_reason")
b4e6247778b0 ("ANDROID: Power: Changes the permission to read only for sysfs file /sys/kernel/wakeup_reasons/last_resume_reason")
e13dbc7c69cd ("ANDROID: power: wakeup_reason: rename irq_count to irqcount")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Todd Poynor [Thu, 12 Dec 2013 23:59:09 +0000 (15:59 -0800)]
ANDROID: power: power_supply: Add property CHARGE_COUNTER_EXT and 64-bit precision properties
Add POWER_SUPPLY_PROP_CHARGE_COUNTER_EXT that stores accumulated charge
in nAh units as a signed 64-bit value.
Add generic support for signed 64-bit property values.
Change-Id: I2bd34b1e95ffba24e7bfef81f398f22bd2aaf05e
Signed-off-by: Todd Poynor <toddpoynor@google.com>
Todd Poynor [Wed, 18 Jul 2012 23:28:50 +0000 (16:28 -0700)]
ANDROID: power: power_supply: add POWER_SUPPLY_PROP_CHARGE_ENABLED
Change-Id: I3e93b502452811cbfc4d904202b4f1d94edc143d
Signed-off-by: Todd Poynor <toddpoynor@google.com>
Todd Poynor [Fri, 13 Jul 2012 20:30:04 +0000 (13:30 -0700)]
ANDROID: power: power_supply: add POWER_SUPPLY_PROP_USB_OTG
Change-Id: Idfc6ef2e37d62aad6f26cc8eafa53db642cd352b
Signed-off-by: Todd Poynor <toddpoynor@google.com>
Todd Poynor [Tue, 3 Jul 2012 22:41:20 +0000 (15:41 -0700)]
ANDROID: power: power_supply: Add custom property for USB High Current mode
For smb347.
Change-Id: I3323469072e1ee5085d61af8a89612b06b91f94a
Signed-off-by: Todd Poynor <toddpoynor@google.com>
[AmitP: Folded following android-4.9 commit changes into this patch
af4f6ce7f57b ("ANDROID: power: power_supply: move POWER_SUPPLY_PROP_USB_HC to type 'int' order")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Colin Cross [Thu, 3 Apr 2014 01:02:15 +0000 (18:02 -0700)]
ANDROID: arm64: copy CONFIG_CMDLINE_EXTEND from ARM
Copy the config choice for CONFIG_CMDLINE_EXTEND from
arch/arm/Kconfig, including CONFIG_CMDLINE_FROM_BOOTLOADER
as the default. These will be used by drivers/of/fdt.c.
Change-Id: I8416038498ddf8fc1e99ab06109825eb1492aa7f
Signed-off-by: Colin Cross <ccross@android.com>
Doug Anderson [Fri, 3 Feb 2012 06:58:28 +0000 (22:58 -0800)]
ANDROID: of: Support CONFIG_CMDLINE_EXTEND config option
The old logic assumes CMDLINE_FROM_BOOTLOADER vs. CMDLINE_FORCE and
ignores CMDLINE_EXTEND. Here's the old logic:
- CONFIG_CMDLINE_FORCE=true
CONFIG_CMDLINE
- dt bootargs=non-empty:
dt bootargs
- dt bootargs=empty, @data is non-empty string
@data is left unchanged
- dt bootargs=empty, @data is empty string
CONFIG_CMDLINE (or "" if that's not defined)
The new logic is now documented in of_fdt.h and is copied here for
reference:
- CONFIG_CMDLINE_FORCE=true
CONFIG_CMDLINE
- CONFIG_CMDLINE_EXTEND=true, @data is non-empty string
@data + dt bootargs (even if dt bootargs are empty)
- CONFIG_CMDLINE_EXTEND=true, @data is empty string
CONFIG_CMDLINE + dt bootargs (even if dt bootargs are empty)
- CMDLINE_FROM_BOOTLOADER=true, dt bootargs=non-empty:
dt bootargs
- CMDLINE_FROM_BOOTLOADER=true, dt bootargs=empty, @data is non-empty string
@data is left unchanged
- CMDLINE_FROM_BOOTLOADER=true, dt bootargs=empty, @data is empty string
CONFIG_CMDLINE (or "" if that's not defined)
Signed-off-by: Doug Anderson <dianders@chromium.org>
CC: devicetree-discuss@lists.ozlabs.org
CC: Grant Likely <grant.likely@secretlab.ca>
CC: Benjamin Herrenschmidt <benh@kernel.crashing.org>
CC: Rob Herring <rob.herring@calxeda.com>
Change-Id: I40ace250847f813358125dfcaa8998fd32cf7ea3
Signed-off-by: Colin Cross <ccross@android.com>
[AmitP: Folded following android-4.9 commit changes into this patch
e820270abb5d ("ANDROID: of: fix CONFIG_CMDLINE_EXTEND")
9a4a74055444 ("ANDROID: of: Fix build warnings")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Suren Baghdasaryan [Thu, 17 Aug 2017 20:58:40 +0000 (13:58 -0700)]
ANDROID: NFC: st21nfca: Fix memory OOB and leak issues in connectivity events handler
Overflow on memcpy is possible in kernel driver for st21nfca's
NFC HCI layer when handling connectivity events if aid_len or
params_len are bigger than the buffer size.
Memory leak is possible when parameter tag is invalid.
Bug:
62679581
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Suren Baghdasaryan [Thu, 17 Aug 2017 22:50:54 +0000 (15:50 -0700)]
ANDROID: NFC: Fix possible memory corruption when handling SHDLC I-Frame commands
When handling SHDLC I-Frame commands "pipe" field used for indexing
into an array should be checked before usage. If left unchecked it
might access memory outside of the array of size NFC_HCI_MAX_PIPES(127).
Bug:
62679701
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Suren Baghdasaryan [Thu, 17 Aug 2017 23:30:47 +0000 (16:30 -0700)]
ANDROID: nfc: fdp: Fix possible buffer overflow in WCS4000 NFC driver
Possible buffer overflow when reading next_read_size bytes into
tmp buffer after next_read_size was extracted from a previous packet.
Bug:
62678828
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Suren Baghdasaryan [Thu, 17 Aug 2017 17:43:14 +0000 (10:43 -0700)]
ANDROID: NFC: st21nfca: Fix out of bounds kernel access when handling ATR_REQ
Out of bounds kernel accesses in st21nfca's NFC HCI layer
might happen when handling ATR_REQ events if user-specified
atr_req->length is bigger than the buffer size. In
that case memcpy() inside st21nfca_tm_send_atr_res() will
read extra bytes resulting in OOB read from the kernel heap.
Bug:
62679012
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Subash Abhinov Kasiviswanathan [Wed, 2 Nov 2016 17:56:40 +0000 (11:56 -0600)]
ANDROID: netfilter: xt_IDLETIMER: Use fullsock when querying uid
sock_i_uid() acquires the sk_callback_lock which does not exist for
sockets in TCP_NEW_SYN_RECV state. This results in errors showing up
as spinlock bad magic. Fix this by looking for the full sock as
suggested by Eric.
Callstack for reference -
-003|rwlock_bug
-004|arch_read_lock
-004|do_raw_read_lock
-005|raw_read_lock_bh
-006|sock_i_uid
-007|from_kuid_munged(inline)
-007|reset_timer
-008|idletimer_tg_target
-009|ipt_do_table
-010|iptable_mangle_hook
-011|nf_iterate
-012|nf_hook_slow
-013|NF_HOOK_COND(inline)
-013|ip_output
-014|ip_local_out
-015|ip_build_and_send_pkt
-016|tcp_v4_send_synack
-017|atomic_sub_return(inline)
-017|reqsk_put(inline)
-017|tcp_conn_request
-018|tcp_v4_conn_request
-019|tcp_rcv_state_process
-020|tcp_v4_do_rcv
-021|tcp_v4_rcv
-022|ip_local_deliver_finish
-023|NF_HOOK_THRESH(inline)
-023|NF_HOOK(inline)
-023|ip_local_deliver
-024|ip_rcv_finish
-025|NF_HOOK_THRESH(inline)
-025|NF_HOOK(inline)
-025|ip_rcv
-026|deliver_skb(inline)
-026|deliver_ptype_list_skb(inline)
-026|__netif_receive_skb_core
-027|__netif_receive_skb
-028|netif_receive_skb_internal
-029|netif_receive_skb
Change-Id: Ic8f3a3d2d7af31434d1163b03971994e2125d552
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Cc: Eric Dumazet <edumazet@google.com>
Subash Abhinov Kasiviswanathan [Fri, 11 Nov 2016 02:36:15 +0000 (19:36 -0700)]
ANDROID: netfilter: xt_IDLETIMER: Fix use after free condition during work
schedule_work(&timer->work) appears to be called after
cancel_work_sync(&info->timer->work) is completed.
Work can be scheduled from the PM_POST_SUSPEND notification event
even after cancel_work_sync is called.
Call stack
-004|notify_netlink_uevent(
| [X19] timer = 0xFFFFFFC0A5DFC780 -> (
| ...
| [NSD:0xFFFFFFC0A5DFC800] kobj = 0x6B6B6B6B6B6B6B6B,
| [NSD:0xFFFFFFC0A5DFC868] timeout = 0x6B6B6B6B,
| [NSD:0xFFFFFFC0A5DFC86C] refcnt = 0x6B6B6B6B,
| [NSD:0xFFFFFFC0A5DFC870] work_pending = 0x6B,
| [NSD:0xFFFFFFC0A5DFC871] send_nl_msg = 0x6B,
| [NSD:0xFFFFFFC0A5DFC872] active = 0x6B,
| [NSD:0xFFFFFFC0A5DFC874] uid = 0x6B6B6B6B,
| [NSD:0xFFFFFFC0A5DFC878] suspend_time_valid = 0x6B))
-005|idletimer_tg_work(
-006|__read_once_size(inline)
-006|static_key_count(inline)
-006|static_key_false(inline)
-006|trace_workqueue_execute_end(inline)
-006|process_one_work(
-007|worker_thread(
-008|kthread(
-009|ret_from_fork(asm)
---|end of frame
Force any pending idletimer_tg_work() to complete before freeing
the associated work struct and after unregistering to the pm_notifier
callback.
Change-Id: I4c5f0a1c142f7d698c092cf7bcafdb0f9fbaa9c1
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Ruchi Kandoi [Thu, 23 Apr 2015 19:09:09 +0000 (12:09 -0700)]
ANDROID: netfilter: xt_IDLETIMER: Adds the uid field in the msg
Message notifications contains an additional uid field. This field
represents the uid that was responsible for waking the radio. And hence
it is present only in notifications stating that the radio is now
active.
Change-Id: I18fc73eada512e370d7ab24fc9f890845037b729
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
Bug:
20264396
[AmitP: Folded following android-4.9 commit changes into this patch
22ea73dee036 ("nf: IDLETIMER: Fix broken uid field in the msg")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Ruchi Kandoi [Tue, 25 Mar 2014 23:43:28 +0000 (16:43 -0700)]
ANDROID: netfilter: xt_IDLETIMER: time-stamp and suspend/resume handling.
Message notifications contains an additional timestamp field in nano seconds.
The expiry time for the timers are modified during suspend/resume.
If timer was supposed to expire while the system is suspended then a
notification is sent when it resumes with the timestamp of the scheduled expiry.
Removes the race condition for multiple work scheduled.
Bug:
13247811
Change-Id: I752c5b00225fe7085482819f975cc0eb5af89bff
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
[AmitP: Folded following android-4.9 commit changes into this patch
13e257eaa624 ("nf: Remove compilation error caused by
e8430cbed3ef15fdb1ac26cfd020e010aa5f1c35")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
JP Abgrall [Fri, 27 Apr 2012 06:28:35 +0000 (23:28 -0700)]
ANDROID: netfilter: xt_IDLETIMER: Add new netlink msg type
Send notifications when the label becomes active after an idle period.
Send netlink message notifications in addition to sysfs notifications.
Using a uevent with
subsystem=xt_idletimer
INTERFACE=...
STATE={active,inactive}
This is backport from common android-3.0
commit:
beb914e987cbbd368988d2b94a6661cb907c4d5a
with uevent support instead of a new netlink message type.
Change-Id: I31677ef00c94b5f82c8457e5bf9e5e584c23c523
Signed-off-by: Ashish Sharma <ashishsharma@google.com>
Signed-off-by: JP Abgrall <jpa@google.com>
Chenbo Feng [Fri, 21 Apr 2017 01:54:13 +0000 (18:54 -0700)]
ANDROID: netfilter: xt_qtaguid: Use sk_uid to replace uid get from socket file
Retrieve socket uid from the sk_uid field added to struct sk instead of
read it from sk->socket->file. It prevent the packet been dropped when
the socket file doesn't exist.
Bug:
37524657
Signed-off-by: Chenbo Feng <fengc@google.com>
Change-Id: Ic58239c1f9aa7e0eb1d4d1c09d40b845fd4e8e57
JP Abgrall [Sat, 21 Dec 2013 00:51:11 +0000 (16:51 -0800)]
ANDROID: netfilter: xt_qtaguid: fix handling for cases where tunnels are used.
* fix skb->dev vs par->in/out
When there is some forwarding going on, it introduces extra state
around devs associated with xt_action_param->in/out and sk_buff->dev.
E.g.
par->in and par->out are both set, or
skb->dev and par->out are both set (and different)
This would lead qtaguid to make the wrong assumption about the
direction and update the wrong device stats.
Now we rely more on par->in/out.
* Fix handling when qtaguid is used as "owner"
When qtaguid is used as an owner module, and sk_socket->file is
not there (happens when tunnels are involved), it would
incorrectly do a tag stats update.
* Correct debug messages.
Bug:
11687690
Change-Id: I2b1ff8bd7131969ce9e25f8291d83a6280b3ba7f
CRs-Fixed: 747810
Signed-off-by: JP Abgrall <jpa@google.com>
Git-commit:
2b71479d6f5fe8f33b335f713380f72037244395
Git-repo: https://www.codeaurora.org/cgit/quic/la/kernel/mediatek
[imaund@codeaurora.org: Resolved trivial context conflicts.]
Signed-off-by: Ian Maund <imaund@codeaurora.org>
[bflowers@codeaurora.org: Resolved merge conflicts]
Signed-off-by: Bryse Flowers <bflowers@codeaurora.org>
Signed-off-by: Chenbo Feng <fengc@google.com>
Simon Dubray [Tue, 1 Aug 2017 16:22:47 +0000 (18:22 +0200)]
ANDROID: netfilter: xt_qtaguid: handle properly request sockets
To match rules related to uid/gid for syn recv packets
we need to get the full socket from request_sock struct.
Bug:
63917742
Change-Id: I03acb2251319fd800d0e36a6dde30fc1fbb7d1b0
Signed-off-by: Simon Dubray <simonx.dubray@intel.com>
Chenbo Feng [Wed, 19 Apr 2017 21:22:47 +0000 (14:22 -0700)]
ANDROID: netfilter: xt_qtaguid: Add untag hacks to inet_release function
To prevent protential risk of memory leak caused by closing socket with
out untag it from qtaguid module, the qtaguid module now do not hold any
socket file reference count. Instead, it will increase the sk_refcnt of
the sk struct to prevent a reuse of the socket pointer. And when a socket
is released. It will delete the tag if the socket is previously tagged so
no more resources is held by xt_qtaguid moudle. A flag is added to the untag
process to prevent possible kernel crash caused by fail to delete
corresponding socket_tag_entry list.
Bug:
36374484
Test: compile and run test under system/extra/test/iptables,
run cts -m CtsNetTestCases -t android.net.cts.SocketRefCntTest
Signed-off-by: Chenbo Feng <fengc@google.com>
Change-Id: Iea7c3bf0c59b9774a5114af905b2405f6bc9ee52
Greg Hackmann [Mon, 24 Apr 2017 23:16:15 +0000 (16:16 -0700)]
ANDROID: netfilter: xt_qtaguid: don't check if embedded arrays are NULL
clang warns about four NULL pointer checks:
net/netfilter/xt_qtaguid.c:973:11: warning: address of array 'ifa->ifa_label' will always evaluate to 'true' [-Wpointer-bool-conversion]
net/netfilter/xt_qtaguid.c:974:13: warning: address of array 'ifa->ifa_label' will always evaluate to 'true' [-Wpointer-bool-conversion]
net/netfilter/xt_qtaguid.c:1212:31: warning: address of array 'el_dev->name' will always evaluate to 'true' [-Wpointer-bool-conversion]
net/netfilter/xt_qtaguid.c:1640:31: warning: address of array 'el_dev->name' will always evaluate to 'true' [-Wpointer-bool-conversion]
Both of these fields are embedded char[16] arrays rather than pointers,
so they can never be NULL.
Change-Id: I748ff6dd11569e5596a9d5cecdf9c334847e7307
Signed-off-by: Greg Hackmann <ghackmann@google.com>
Chenbo Feng [Thu, 23 Mar 2017 20:51:24 +0000 (13:51 -0700)]
ANDROID: netfilter: xt_qtaguid: fix the deadlock when enable DDEBUG
When DDEBUG is enabled, the prdebug_full_state() function will try to
recursively aquire the spinlock of sock_tag_list and causing deadlock. A
check statement is added before it aquire the spinlock to differentiate
the behavior depend on the caller of the function.
Bug:
36559739
Test: Compile and run test under system/extra/test/iptables/
Change-Id: Ie3397fbaa207e14fe214d47aaf5e8ca1f4a712ee
Signed-off-by: Chenbo Feng <fengc@google.com>
(cherry picked from commit
f0faedd6b468777f3bb5834f97100794d562c8b7)
Mohamad Ayyash [Wed, 11 May 2016 20:18:35 +0000 (13:18 -0700)]
ANDROID: netfilter: xt_qtaguid: Don't show empty tag stats for unprivileged uids
BUG:
27577101
BUG:
27532522
Change-Id: Ibee3c5d224f139b9312a40acb203e87aa7060797
Signed-off-by: Mohamad Ayyash <mkayyash@google.com>
John Stultz [Thu, 12 May 2016 18:17:52 +0000 (11:17 -0700)]
ANDROID: netfilter: xt_qtaguid: Fix panic caused by processing non-full socket.
In an issue very similar to
4e461c777e3 (xt_qtaguid: Fix panic
caused by synack processing), we were seeing panics on occasion
in testing.
In this case, it was the same issue, but caused by a different
call path, as the sk being returned from qtaguid_find_sk() was
not a full socket. Resulting in the sk->sk_socket deref to fail.
This patch adds an extra check to ensure the sk being retuned
is a full socket, and if not it returns NULL.
Reported-by: Milosz Wasilewski <milosz.wasilewski@linaro.org>
Signed-off-by: John Stultz <john.stultz@linaro.org>
John Stultz [Sat, 23 Apr 2016 00:12:57 +0000 (17:12 -0700)]
ANDROID: netfilter: xt_qtaguid: Fix panic caused by synack processing
In upstream commit
ca6fb06518836ef9b65dc0aac02ff97704d52a05
(tcp: attach SYNACK messages to request sockets instead of
listener)
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=
ca6fb0651883
The building of synack messages was changed, which made it so
the skb->sk points to a casted request_sock. This is problematic,
as there is no sk_socket in a request_sock. So when the qtaguid_mt
function tries to access the sk->sk_socket, it accesses uninitialized
memory.
After looking at how other netfilter implementations handle this,
I realized there was a skb_to_full_sk() helper added, which the
xt_qtaguid code isn't yet using.
This patch adds its use, and resovles panics seen when accessing
uninitialzed memory when processing synack packets.
Reported-by: YongQin Liu <yongquin.liu@linaro.org>
Signed-off-by: John Stultz <john.stultz@linaro.org>
liping.zhang [Mon, 11 Jan 2016 05:31:01 +0000 (13:31 +0800)]
ANDROID: netfilter: xt_qtaguid: fix a race condition in if_tag_stat_update
Miss a lock protection in if_tag_stat_update while doing get_iface_entry. So if
one CPU is doing iface_stat_create while another CPU is doing if_tag_stat_update,
race will happened.
Change-Id: Ib8d98e542f4e385685499f5b7bb7354f08654a75
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Amit Pundir [Mon, 6 Jul 2015 18:58:49 +0000 (00:28 +0530)]
ANDROID: netfilter: xt_qtaguid: xt_socket: build fixes
Add missing header <linux/miscdevice.h> and use
xt_socket_lookup_slow_v* instead of xt_socket_get*_sk
in xt_qtaguid.c.
Fix xt_socket_lookup_slow_v* functions in xt_socket.c
and declare them in xt_socket.h
Change-Id: I55819b2d4ffa82a2be20995c87d28fb5cc77b5ba
Signed-off-by: John Stultz <john.stultz@linaro.org>
[AmitP: Upstream commit
8db4c5be88f6 ("netfilter: move socket lookup
infrastructure to nf_socket_ipv{4,6}.c")] moved socket lookup
to nf_socket_ipv{4,6}.c, hence use nf_sk_lookup_slow_v[4|6]()
instead of obsolete xt_socket_lookup_slow_v[4|6]().
Also folded following android-4.9 commit changes into this patch
7de1bb86dc5a ("ANDROID: netfilter: xt_qtaguid/socket: build fixes for 4.4")
5b5ab94817f9 ("ANDROID: netfilter: xt_qtaguid: seq_printf fixes")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Dmitry Torokhov [Thu, 3 Sep 2015 21:48:52 +0000 (14:48 -0700)]
ANDROID: netfilter: xt_socket/nf_socket: fix refcount underflow and crash
nf_socket_get_sock_v[4|6]() do not always increment sock refcount, which
causes confusion in xt_qtaguid module which is not aware of this fact
and drops the reference whether it should have or not. Fix it by
changing nf_socket_get_sock_v[4|6]() to always increment recount of returned
sock.
This should fix the following crash:
[ 111.319523] BUG: failure at
/mnt/host/source/src/third_party/kernel/v3.18/net/ipv4/inet_timewait_sock.c:90/__inet_twsk_kill()!
[ 111.331192] Kernel panic - not syncing: BUG!
[ 111.335468] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G U W
3.18.0-06867-g268df91 #1
[ 111.343810] Hardware name: Google Tegra210 Smaug Rev 1+ (DT)
[ 111.349463] Call trace:
[ 111.351917] [<
ffffffc000207288>] dump_backtrace+0x0/0x10c
[ 111.357314] [<
ffffffc0002073a4>] show_stack+0x10/0x1c
[ 111.362367] [<
ffffffc000a82d1c>] dump_stack+0x74/0x94
[ 111.367414] [<
ffffffc000a81824>] panic+0xec/0x238
[ 111.372116] [<
ffffffc000981648>] __inet_twsk_kill+0xd0/0xf8
[ 111.377684] [<
ffffffc0009817b0>] inet_twdr_do_twkill_work+0x64/0xd0
[ 111.383946] [<
ffffffc000981a5c>] inet_twdr_hangman+0x2c/0xa4
[ 111.389602] [<
ffffffc000271cf0>] call_timer_fn+0xac/0x160
[ 111.394995] [<
ffffffc00027250c>] run_timer_softirq+0x23c/0x274
[ 111.400824] [<
ffffffc000220a68>] __do_softirq+0x1a4/0x330
[ 111.406218] [<
ffffffc000220e94>] irq_exit+0x70/0xd0
[ 111.411093] [<
ffffffc000264e00>] __handle_domain_irq+0x84/0xa8
[ 111.416922] [<
ffffffc0002003ec>] gic_handle_irq+0x4c/0x80
b/
22476945
Originally reviewed at:
https://chromium-review.googlesource.com/#/c/297414/
Change-Id: I51fa94a9d92a84a0bd3b58466d711e46a6892a79
Signed-off-by: Dmitry Torokhov <dtor@google.com>
[jstultz: Cherry-picked and added missing local var definition]
Signed-off-by: John Stultz <john.stultz@linaro.org>
[AmitP: Refactored the original changes based on upstream commit,
8db4c5be88f6 ("netfilter: move socket lookup infrastructure to nf_socket_ipv{4,6}.c"),
changes. Also use refcount_inc instead of atomic_inc to align with
41c6d650f653 ("net: convert sock.sk_refcnt from atomic_t to refcount_t")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Mohamad Ayyash [Wed, 14 Jan 2015 03:20:44 +0000 (19:20 -0800)]
ANDROID: netfilter: xt_qtaguid: Use sk_callback_lock read locks before reading sk->sk_socket
It prevents a kernel panic when accessing sk->sk_socket fields due to NULLing sk->sk_socket when sock_orphan is called through
sk_common_release.
Change-Id: I4aa46b4e2d8600e4d4ef8dcdd363aa4e6e5f8433
Signed-off-by: Mohamad Ayyash <mkayyash@google.com>
(cherry picked from commit
cdea0ebcb8bcfe57688f6cb692b49e550ebd9796)
Signed-off-by: John Stultz <john.stultz@linaro.org>
John Stultz [Fri, 28 Mar 2014 23:23:48 +0000 (16:23 -0700)]
ANDROID: netfilter: xt_qtaguid/xt_socket: Build fixups
Fix up build kuid/kguid build issues in netfilter code.
Also re-add the xt_socket_get/put_sk interfaces needed by xt_qtaguid.
Change-Id: I7027fb840e109785bddffe8ea717b8d018b26d82
Signed-off-by: John Stultz <john.stultz@linaro.org>
[AmitP: Folded following android-4.9 commit changes into this patch
da5ea99a74f2 ("ANDROID: netfilter: xt_qtaguid: fix seq_printf type mismatch warning")
070eff8f023c ("ANDROID: netfilter: xt_qtaguid: fix broken uid/gid range check")]
2879b6ec24ee ("ANDROID: xt_qtaguid: use sock_gen_put() instead of xt_socket_put_sk()")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Jon Medhurst (Tixy) [Tue, 15 Apr 2014 04:20:49 +0000 (21:20 -0700)]
ANDROID: netfilter: xt_qtaguid: Fix boot panic
We need the change below because of mainline commit
351638e7de (net: pass
info struct via netdevice notifier). Otherwise we panic.
Change-Id: I7daf7513a733933fdcbaeebea7f8191f8b6a0432
Signed-off-by: John Stultz <john.stultz@linaro.org>
JP Abgrall [Thu, 21 Feb 2013 00:38:34 +0000 (16:38 -0800)]
ANDROID: netfilter: xt_qtaguid: fix bad tcp_time_wait sock handling
Since (
41063e9 ipv4: Early TCP socket demux), skb's can have an sk which
is not a struct sock but the smaller struct inet_timewait_sock without an
sk->sk_socket. Now we bypass sk_state == TCP_TIME_WAIT
Signed-off-by: JP Abgrall <jpa@google.com>
Arve Hjønnevåg [Tue, 14 May 2013 03:45:02 +0000 (20:45 -0700)]
ANDROID: netfilter: xt_qtaguid: 3.10 fixes
Stop using obsolete procfs api.
Signed-off-by: Arve Hjønnevåg <arve@android.com>
[AmitP: Folded following android-4.9 commit changes into this patch
564729173b12 ("netfilter: xt_qtaguid: fix memory leak in seq_file handlers")
85a2eb5b48fc ("ANDROID: netfilter: xt_qtaguid: 64-bit warning fixes")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
JP Abgrall [Mon, 8 Apr 2013 22:09:26 +0000 (15:09 -0700)]
ANDROID: netfilter: xt_qtaguid: rate limit some of the printks
Some of the printks are in the packet handling path.
We now ratelimit the very unlikely errors to avoid
kmsg spamming.
Signed-off-by: JP Abgrall <jpa@google.com>
JP Abgrall [Thu, 7 Feb 2013 01:40:07 +0000 (17:40 -0800)]
ANDROID: netfilter: xt_qtaguid: Allow tracking loopback
In the past it would always ignore interfaces with loopback addresses.
Now we just treat them like any other.
This also helps with writing tests that check for the presence
of the qtaguid module.
Signed-off-by: JP Abgrall <jpa@google.com>