Using bitfields for shared variables is a "bad idea", as they require
a non-atomic read-modify-write to be generated by the compiler, which can
cause updates to unrelated bits in the same word to disappear.
Ensure the 'online' and 'disconnected' members of 'struct acc_dev' are
placed in separate variables by declaring them each as 'int'.
Bug: 173789633
Signed-off-by: Will Deacon <willdeacon@google.com>
Change-Id: Ia6031d82a764e83b2cc3502fbe5fb273511da752
Signed-off-by: Giuliano Procida <gprocida@google.com>
Tearing down and freeing the 'acc_dev' structure when there is
potentially asynchronous work queued involving its member fields is
likely to lead to use-after-free issues.
Cancel any pending work before freeing the structure.
Bug: 173789633
Signed-off-by: Will Deacon <willdeacon@google.com>
Change-Id: I68a91274aea18034637b738d558d043ac74fadf4
Signed-off-by: Giuliano Procida <gprocida@google.com>
If acc_setup() is called when there is already an allocated instance,
misc_register() will fail but the error path leaves a dangling pointer
to freed memory in the global 'acc_dev' state.
Fix this by ensuring that the refcount is zero before we start, and then
using a cmpxchg() from NULL to serialise any concurrent initialisers.
Bug: 173789633
Signed-off-by: Will Deacon <willdeacon@google.com>
Change-Id: I2c26289dcce7dbc493964516c49b05d04aaa6839
Signed-off-by: Giuliano Procida <gprocida@google.com>
acc_release() attempts to synchronise with acc_open() using an atomic
'open_excl' member in 'struct acc_dev'. Unfortunately, acc_release()
prematurely resets this atomic variable to zero, meaning there is a
potential race on 'dev->disconnected':
acc_open() acc_release()
atomic_xchg(open_excl), 0)
atomic_xchg(open_excl, 1)
dev->disconnected = 0; dev->disconnected = 1;
Fix the race by ensuring that the 'disconnected' field is written
before clearing 'open_excl' in acc_release().
Bug: 173789633
Signed-off-by: Will Deacon <willdeacon@google.com>
Change-Id: Ib9a21f2305f6d70de3e760da62dbfdd66889200a
Signed-off-by: Giuliano Procida <gprocida@google.com>
Add refcounting to track the lifetime of the global 'acc_dev' structure,
as the underlying function directories can be removed while references
still exist to the dev node.
Bug: 173789633
Signed-off-by: Will Deacon <willdeacon@google.com>
Change-Id: I248408e890d01167706c329146d63b64a6456df6
Signed-off-by: Giuliano Procida <gprocida@google.com>
The '_acc_dev' global variable is a fancy use-after-free factory. Wrap
it in some get()/put() functions in preparation for introducing some
refcounting.
Bug: 173789633
Signed-off-by: Will Deacon <willdeacon@google.com>
Change-Id: I4c839627648c209341a81efa0c001c8d71b878d4
Signed-off-by: Giuliano Procida <gprocida@google.com>
acc_alloc_inst() assigns to a local 'dev' variable, but then never uses
it. Remove the redundant assignment, and the local variable along with
it.
Bug: 173789633
Signed-off-by: Will Deacon <willdeacon@google.com>
Change-Id: Ide9c2e89fb12b846eb8739b302d1b742fc7eb6b5
Signed-off-by: Giuliano Procida <gprocida@google.com>
Remove some useless print statements, as they can trivially be used to
spam the console and don't report anything meaningful.
Bug: 173789633
Signed-off-by: Will Deacon <willdeacon@google.com>
Change-Id: I28052010fc3ec033a2c99efeb3f6c919d54d75c2
Signed-off-by: Giuliano Procida <gprocida@google.com>
Neither acc_gadget_bind() nor acc_gadget_register_driver() exist, so
remove the stale comments that refer to them.
Bug: 173789633
Signed-off-by: Will Deacon <willdeacon@google.com>
Change-Id: If396ba3bcac3ca59c48e5a5faa0a8520534ed625
Signed-off-by: Giuliano Procida <gprocida@google.com>
In case of poweroff charging mode, accessory function instance
is not created and due to this, _acc_dev will be NULL. If target
is connected to Accessory dock in poweroff charging mode, there
is a chance dev pointer is accessed, which is NULL. Hence add a
check before processing control request and return error if it is
NULL.
Bug: 141002587
Change-Id: I4f1deb9d764b8c0bd1d7837cbc43a2933167f568
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Signed-off-by: Giuliano Procida <gprocida@google.com>
pte_accessible() is used by ptep_clear_flush() to figure out whether TLB
invalidation is necessary when unmapping pages for reclaim. Although our
implementation is correct according to the architecture, returning true
only for valid, young ptes in the absence of racing page-table
modifications, this is in fact flawed due to lazy invalidation of old
ptes in ptep_clear_flush_young() where we elide the expensive DSB
instruction for completing the TLB invalidation.
Rather than penalise the aging path, adjust pte_accessible() to return
true for any valid pte, even if the access flag is cleared.
Bug: 176475096
Change-Id: Ifd7919b4e9b790a94802b0115f93a9a260757036
Cc: <stable@vger.kernel.org>
Fixes: 76c714be0e ("arm64: pgtable: implement pte_accessible()")
Reported-by: Yu Zhao <yuzhao@google.com>
Acked-by: Yu Zhao <yuzhao@google.com>
Reviewed-by: Minchan Kim <minchan@kernel.org>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Link: https://lore.kernel.org/r/20201120143557.6715-2-will@kernel.org
Signed-off-by: Will Deacon <will@kernel.org>
(cherry picked from commit 07509e10dcc77627f8b6a57381e878fe269958d3)
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
This patch is for updating GKI allowed symbol list without adding any
new symbol. Next patch will introduce newly added symbols for Exynosauto
SoC GKI vendor modules. To avoid unnecessary symbols, this patch also
adds "preserved by --additions-only" even though we don't need them
anymore.
Bug: 176138611
Signed-off-by: Chanho Park <chanho61.park@samsung.com>
Change-Id: I9fa9eb313ef1e2aeb8c853bae1c8cde18cdd9188
f_accessory: fix CTS test stuck since CTS 9.0.
- Refine acc_read() process.
The data length that user (test program) wants to read is different
from they really requested. This will cause the test flow stuck on the
2nd or the 3rd transfers in accessory test.
(By connecting 2 phones with CtsVerifier.apk and
CtsVerifierUSBCompanion.apk installed.)
Bug: 174729307
Change-Id: I5367c8075ed37534e8bed94b60cc79135ae5aebc
Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
This patch is the first trial to upload GKI symbol list for running
android as VM on type1 hypervisor. Unlike traditional device driver,
para-virtualized drivers for hypervisor tend to use more core symbols.
- ioremap_cache: to skip cached mapping for io remap
Leaf changes summary: 1 artifact changed
Changed leaf types summary: 0 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 1 Added function
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable
1 Added function:
[A] 'function void* ioremap_cache(long long unsigned int, unsigned long int)'
Bug: 175289068
Signed-off-by: Chanho Park <chanho61.park@samsung.com>
Change-Id: Ia3f0073065ad2da481cce10dd882d7de093b1de3
This patch is for updating GKI allowed symbol list without adding a new
symbol. Next patch will introduce newly added symbols for Exynosauto
SoC GKI vendor modules.
Bug: 175289068
Signed-off-by: Chanho Park <chanho61.park@samsung.com>
Change-Id: I035373ee8f980cd5c03c967d5d2b684150e7fc74
This symbol is needed for certain vendor modules which cannot rely on
only the sysfs interface for uclamp alone.
Bug: 170697030
Signed-off-by: J. Avila <elavila@google.com>
Change-Id: Ic904ade83a45d259cfc95501e6b81e6c5a0e90a0
(cherry picked from commit 0edac9cb95fb2fa292a4b25ac77b125cde28b674)
NULL pointer dereference is observed while exporting the dmabuf but
failed to allocate the 'struct file' which results into the dropping
of the allocated dentry corresponding to this file in the dmabuf fs,
which is ending up in dma_buf_release() and accessing the
uninitialzed dentry->d_fsdata.
Call stack on 5.4 is below:
dma_buf_release+0x2c/0x254 drivers/dma-buf/dma-buf.c:88
__dentry_kill+0x294/0x31c fs/dcache.c:584
dentry_kill fs/dcache.c:673 [inline]
dput+0x250/0x380 fs/dcache.c:859
path_put+0x24/0x40 fs/namei.c:485
alloc_file_pseudo+0x1a4/0x200
fs/file_table.c:235
dma_buf_getfile drivers/dma-buf/dma-buf.c:473 [inline]
dma_buf_export+0x25c/0x3ec
drivers/dma-buf/dma-buf.c:585
Fix this by checking for the valid pointer in the dentry->d_fsdata.
cherry picked from commit 19a508bd1ad8e444de86873bf2f2b2ab8edd6552
Bug: 175512919
Link: https://patchwork.freedesktop.org/patch/391319/
Change-Id: I3856a387d1902fd2b39b016e81283f082089131c
Cc: <stable@vger.kernel.org> [5.7+]
Signed-off-by: Charan Teja Reddy <charante@codeaurora.org>
Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Chao Hao <chao.hao@mediatek.com>
Signed-off-by: Chun-Hung Wu <chun-hung.wu@mediatek.com>
Export memblock_end_of_DRAM() so that module drivers can know
the physical end address of memory blocks that system booted with.
Bug: 174547201
Change-Id: Ib0c90b736f16d1abbf47d4f3288443c35f9e17b4
Signed-off-by: Sudarshan Rajagopalan <sudaraja@codeaurora.org>
Signed-off-by: Stanley Chu <stanley.chu@mediatek.com>
A number of kthread-related functions indirectly take task_struct->pi_lock
while holding worker->lock in the call chain like this:
spin_lock(&worker->lock)
kthread_insert_work
wake_up_process
try_to_wake_up
raw_spin_lock_irqsave(&p->pi_lock, flags)
This lock dependency exists whenever kthread_insert_work is called either
directly or indirectly via __kthread_queue_delayed_work in the following
functions:
kthread_queue_work
kthread_delayed_work_timer_fn
kthread_queue_delayed_work
kthread_flush_work
kthread_mod_delayed_work
This creates possibilities for circular dependencies like the one reported
at [1]. Break this lock dependency by moving task wakeup after worker->lock
has been released.
[1]: https://lore.kernel.org/lkml/CAJuCfpG4NkhpQvZjgXZ_3gm6Hf1QgN_eUOQ8iX9Cv1k9whLwSQ@mail.gmail.com
Reported-by: Ke Wang <ke.wang@unisoc.com>
Reported-by: Shakeel Butt <shakeelb@google.com>
Suggested-by: Peter Zijlstra <peterz@infradead.org>
Tested-by: Shakeel Butt <shakeelb@google.com>
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Link: https://lkml.org/lkml/2020/5/4/1148
Cherry picked instead of commit 461daba06bdcb9c7a3f92b9bbd110e1f7d093ffc
as an alternative solution for the lockdep error that does not break KMI.
Bug: 174875976
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Change-Id: I2478847f66c85dca953846cd77955928d690c97c
commit bce1305c0ece3dc549663605e567655dd701752c upstream.
It appears that a ReportSize value of zero is legal, even if a bit
non-sensical. Most of the HID code seems to handle that gracefully,
except when computing the total size in bytes. When fed as input to
memset, this leads to some funky outcomes.
Detect the corner case and correctly compute the size.
Cc: stable@vger.kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit bce1305c0ece3dc549663605e567655dd701752c)
Change-Id: I5ab5febc22b8d5d8c5d398c3ff93f73cb3c90e05
Signed-off-by: Todd Kjos <tkjos@google.com>
commit 35556bed836f8dc07ac55f69c8d17dce3e7f0e25 upstream.
When calling into hid_map_usage(), the passed event code is
blindly stored as is, even if it doesn't fit in the associated bitmap.
This event code can come from a variety of sources, including devices
masquerading as input devices, only a bit more "programmable".
Instead of taking the event code at face value, check that it actually
fits the corresponding bitmap, and if it doesn't:
- spit out a warning so that we know which device is acting up
- NULLify the bitmap pointer so that we catch unexpected uses
Code paths that can make use of untrusted inputs can now check
that the mapping was indeed correct and bail out if not.
Cc: stable@vger.kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 35556bed836f8dc07ac55f69c8d17dce3e7f0e25)
Change-Id: Ie4dc11f43ed1eae2d09feaf9cff17d6d16cf9987
Signed-off-by: Todd Kjos <tkjos@google.com>
When merging configuration fragments, it might be of interest to
identify mismatches (redefinitions) programmatically. Hence add the
option -s (strict mode) to instruct merge_config.sh to bail out in
case any redefinition has been detected.
With strict mode, warnings are emitted as before, but the script
terminates with rc=1. If -y is set to define "builtin having
precedence over modules", fragments are still allowed to set =m (while
the base config has =y). Strict mode will tolerate that as demotions
from =y to =m are ignored when setting -y.
Bug: 174454795
Link: https://lore.kernel.org/linux-kbuild/20201202151238.3776616-1-maennich@google.com/
Cc: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Matthias Maennich <maennich@google.com>
Change-Id: Ib982a87811956e48b718a15680f06474a39dc19d
(cherry picked from commit 32164038495558fbc6d47f36033bac3014f53b8e)
After LLVM rG9e33c096476a ("[ELF] Keep orphan section names
(.rodata.foo .text.foo) unchanged if !hasSectionsCommand"), LLD splits
compound literals to separate sections with -fdata-sections, which
it always enables with LTO. Merge these sections to allow LLVM to be
upgraded.
Bug: 174047799
Change-Id: I858c5fcc48283d5528c1d3e2b2d7a3c72f9e03d6
Link: https://github.com/ClangBuiltLinux/linux/issues/958
Suggested-by: Danny Lin <danny@kdrag0n.dev>
Suggested-by: Fangrui Song <maskray@google.com>
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Update the android/abi_gki_aarch64_qcom with recent symbol additions.
Simple change and no need to update the .xml file, as no new symbol
addition.
Bug: 174275677
Signed-off-by: Archana Sriram <apsrir@codeaurora.org>
Signed-off-by: Kamal Agrawal <kamaagra@codeaurora.org>
Change-Id: Ic96fc5d11ab8d21fadbf85658e374e06dde14d0f
This patch adds GKI symbol list for Exynosauto SoC. We need to add
below 2 functions to GKI allowed symbol list.
snd_pcm_release_substream
- It's necessary from suspend/resume callback to clean current pcm stream.
unmap_kernel_range
- To unmap which are allocated by map_vm_area
Leaf changes summary: 2 artifacts changed
Changed leaf types summary: 0 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 2 Added functions
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable
2 Added functions:
[A] 'function void snd_pcm_release_substream(snd_pcm_substream*)'
[A] 'function void unmap_kernel_range(unsigned long int, unsigned long int)'
Bug: 174288561
Signed-off-by: Chanho Park <chanho61.park@samsung.com>
Change-Id: I71058d55bbe10f2ec075e4c2c40291e5357b13a7
This patch adds to update GKI symbol list for Exynosauto SoC since
adding some drivers as GKI vendor modules.. To review the allowed list
easily, this patch does not include any newly additions of GKI symbols.
Bug: 174288561
Signed-off-by: Chanho Park <chanho61.park@samsung.com>
Change-Id: Iac4910d0c43a07e24e5e4069e3d2f1b3378fce2b
This allows communication with external entities.
It also required fixing up the netlink policy, since NLA_UNSPEC
attributes are no longer accepted.
Signed-off-by: Erel Geron <erelx.geron@intel.com>
[port to backports, inline the ID, use 29 as the ID as requested,
drop != NULL checks, reduce ifdefs]
Link: https://lore.kernel.org/r/20200305143212.c6e4c87d225b.I7ce60bf143e863dcdf0fb8040aab7168ba549b99@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
(cherry picked from commit 5d44fe7c9808c56e136e59147bd932f5491520f1)
Bug: 173808904
Signed-off-by: Weilun Du <wdu@google.com>
Change-Id: I6097464f47460c2383e941594c88637446a77dd5
Allwinner's SoC timer driver (timer-sun4i.c) has to be built-in rather
than modularized for the following limitations in linux timer framework:
1. tick broadcast installed by insmod cannot switch to oneshot mode
correctly
2. cpus cannot enter cpuidle state due to the issue above.
3. rcu warnings will appear if we forcibly re-enable tick-broadcast
for each cpu when new tick broadcast device is installed by insmod
(timer-sun4i.c in our case)
Bug: 173667601
Change-Id: If077db348c027ec02549e25eee3e17c2cc429644
Signed-off-by: Martin Wu <wuyan@allwinnertech.com>
A porting error in commit 0ae8088521d9 ("ANDROID: uid_cputime: Adds
accounting for the cputimes per uid.") caused
/proc/uid_cputime/show_uid_stat to report times in milliseconds
instead of microseconds. Restore the expected behavior.
Bug: 133273154
Bug: 146339763
Signed-off-by: Ed Savage-Jones <edward.savage-jones@sony.com>
Signed-off-by: Connor O'Brien <connoro@google.com>
Change-Id: I203919d1d44b300dab91810b16626a6950b063f8
(cherry picked from commit 305d5c197508b80a8dec0ab506de309e5d85fd26)
Access to the AMU counters should be disabled by default in kvm guests,
as information from the counters might reveal activity in other guests
or activity on the host.
Therefore, disable access to AMU registers from EL0 and EL1 in kvm
guests by:
- Hiding the presence of the extension in the feature register
(SYS_ID_AA64PFR0_EL1) on the VCPU.
- Disabling access to the AMU registers before switching to the guest.
- Trapping accesses and injecting an undefined instruction into the
guest.
Bug: 172781912
Change-Id: Ie8048574431dfe00e9d8f59ecbcf51b4c1167000
Signed-off-by: Ionela Voinescu <ionela.voinescu@arm.com>
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>
Acked-by: Marc Zyngier <maz@kernel.org>
Cc: Will Deacon <will@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Suzuki K Poulose <suzuki.poulose@arm.com>
Cc: Julien Thierry <julien.thierry.kdev@gmail.com>
Cc: James Morse <james.morse@arm.com>
Cc: Marc Zyngier <maz@kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
(cherry picked from commit 4fcdf106a4330bb5c2306a1efbb3af3b7c0db537)
Signed-off-by: Neeraj Upadhyay <neeraju@codeaurora.org>
The activity monitors extension is an optional extension introduced
by the ARMv8.4 CPU architecture. In order to access the activity
monitors counters safely, if desired, the kernel should detect the
presence of the extension through the feature register, and mediate
the access.
Therefore, disable direct accesses to activity monitors counters
from EL0 (userspace) and trap them to EL1 (kernel).
To be noted that the ARM64_AMU_EXTN kernel config does not have an
effect on this code. Given that the amuserenr_el0 resets to an
UNKNOWN value, setting the trap of EL0 accesses to EL1 is always
attempted for safety and security considerations. Therefore firmware
should still ensure accesses to AMU registers are not trapped in
EL2/EL3 as this code cannot be bypassed if the CPU implements the
Activity Monitors Unit.
Bug: 172781912
Change-Id: I231595cd2d1e36bfc6abd24559c9c3d13e7eab03
Signed-off-by: Ionela Voinescu <ionela.voinescu@arm.com>
Reviewed-by: James Morse <james.morse@arm.com>
Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Cc: Steve Capper <steve.capper@arm.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Will Deacon <will@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
(cherry picked from commit 87a1f063464afd934f0f22aac710ca65bef77af3)
Signed-off-by: Neeraj Upadhyay <neeraju@codeaurora.org>
