The tables are separated with tabs and spaces mixed together, leading
to malformation. Changed the characters all into spaces to solve this
issue.
Signed-off-by: Hu Haowen <src.res@email.cn>
Link: https://lore.kernel.org/r/20210805040146.121526-1-src.res@email.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 235196743
(cherry picked from commit 9c0edd5649a26e380ed2e687a20f7b301a66c746)
Change-Id: I3a7edcb21497cd143c2e7347c4dd796eec989218
Signed-off-by: Luiz Matheus <luizmmat@motorola.com>
This adds bi-directional (host->device, device->host)
volume/mute support to the f_uac1 driver by adding
Feature Units and interrupt endpoint.
Currently only master channel is supported.
Volume and mute are configurable through configfs,
by default volume has -100..0 dB range with 1 dB step.
Similar to existing flexible endpoints configuration,
Feature Unit won't be added to the topology if both
mute and volume are not enabled, also interrupt endpoint
isn't added to the device if no feature unit is present
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Signed-off-by: Pavel Hofman <pavel.hofman@ivitera.com>
Link: https://lore.kernel.org/r/20210712125529.76070-5-pavel.hofman@ivitera.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 235196743
(cherry picked from commit 0356e6283c7177391d144612f4b12986ed5c4f6e)
Change-Id: If37a2696bd3cfd0ab9ad1022e804b5e355fdfb64
Signed-off-by: Luiz Matheus <luizmmat@motorola.com>
This adds bi-directional (host->device, device->host)
volume/mute support to the f_uac2 driver by adding
Feature Units and interrupt endpoint.
Currently only master channel is supported.
Volume and mute are configurable through configfs,
by default volume has -100..0 dB range with 1 dB step.
Similar to existing flexible endpoints configuration,
Feature Unit won't be added to the topology if both
mute and volume are not enabled, also interrupt endpoint
isn't added to the device if no feature unit is present
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Signed-off-by: Pavel Hofman <pavel.hofman@ivitera.com>
Link: https://lore.kernel.org/r/20210712125529.76070-4-pavel.hofman@ivitera.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 235196743
(cherry picked from commit eaf6cbe0992052a46d93047dc122fad5126aa3bd)
[luizmmat: Resolved minor conflict in f_uac2.c]
Change-Id: Ie8e0de9ac43d2d2030e530e8b244760f45627d7e
Signed-off-by: Luiz Matheus <luizmmat@motorola.com>
USB Audio Class 1/2 have ability to change device's
volume and mute by USB Host through class-specific control
requests. Device also can notify Host about volume/mute
change on its side through optional interrupt endpoint.
This patch adds Volume and Mute ALSA controls which can be
used by user to send and receive notifications to/from
the USB Host about Volume and Mute change.
These params come from f_uac* so volume and mute controls
will be created only if the function support and enable
each explicitly
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Signed-off-by: Pavel Hofman <pavel.hofman@ivitera.com>
Link: https://lore.kernel.org/r/20210712125529.76070-3-pavel.hofman@ivitera.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 235196743
(cherry picked from commit 02de698ca8123782c0c6fb8ed99080e2f032b0d2)
Change-Id: I7354c4c354952224ab88acd0b8d77d9bc4ba0745
Signed-off-by: Luiz Matheus <luizmmat@motorola.com>
Similar to UAC1 spec, UAC2 feature unit descriptor
has variable size.
Current audio-v2 feature unit descriptor structure
is used for parsing descriptors, but can't be used
to define your own descriptor.
Add a new macro similar to what audio v1 already has.
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Signed-off-by: Pavel Hofman <pavel.hofman@ivitera.com>
Link: https://lore.kernel.org/r/20210712125529.76070-2-pavel.hofman@ivitera.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 235196743
(cherry picked from commit b48f8939b9ff593ebed20433bb53c51199920412)
Change-Id: Ifa8f979824d81ce6c269f34e0e1118cb4701493a
Signed-off-by: Luiz Matheus <luizmmat@motorola.com>
Static code analysis tool reported NULL pointer access in
shrink_page_list() as the commit 26aa2d199d6f2 ("mm/migrate: demote
pages during reclaim") expects valid pgdat.
There is already an existing api, reclaim_pages, that tries to reclaim
pages from the list. use it instead of creating custom function.
Bug: 201263305
Fixes: 96f80f628451 ("ANDROID: mm: add reclaim_shmem_address_space() for faster reclaims")
Change-Id: Iaa11feac94c9e8338324ace0276c49d6a0adeb0c
Signed-off-by: Charan Teja Reddy <quic_charante@quicinc.com>
User can configure f_uac1 function via p_chmask/c_chmask
whether uac1 shall support playback and/or capture,
but it has only effect on the created ALSA device,
but not on the USB descriptor.
This patch adds playback/capture descriptors
dependent on that parameter. It is similar to
the same conversion done earlier for f_uac2
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Link: https://lore.kernel.org/r/1614599375-8803-6-git-send-email-ruslan.bilovol@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 235196743
(cherry picked from commit 254cb1e0d78cfa2c189171cacb88fc85d915bc84)
Change-Id: I02328b9c496645e487ad9eb4784e9a4ac80c85f9
Signed-off-by: Luiz Matheus <luizmmat@motorola.com>
commit d270453a0d9ec10bb8a802a142fb1b3601a83098 upstream.
There are destructive operations such as nfcmrvl_fw_dnld_abort and
gpio_free in nfcmrvl_nci_unregister_dev. The resources such as firmware,
gpio and so on could be destructed while the upper layer functions such as
nfcmrvl_fw_dnld_start and nfcmrvl_nci_recv_frame is executing, which leads
to double-free, use-after-free and null-ptr-deref bugs.
There are three situations that could lead to double-free bugs.
The first situation is shown below:
(Thread 1) | (Thread 2)
nfcmrvl_fw_dnld_start |
... | nfcmrvl_nci_unregister_dev
release_firmware() | nfcmrvl_fw_dnld_abort
kfree(fw) //(1) | fw_dnld_over
| release_firmware
... | kfree(fw) //(2)
| ...
The second situation is shown below:
(Thread 1) | (Thread 2)
nfcmrvl_fw_dnld_start |
... |
mod_timer |
(wait a time) |
fw_dnld_timeout | nfcmrvl_nci_unregister_dev
fw_dnld_over | nfcmrvl_fw_dnld_abort
release_firmware | fw_dnld_over
kfree(fw) //(1) | release_firmware
... | kfree(fw) //(2)
The third situation is shown below:
(Thread 1) | (Thread 2)
nfcmrvl_nci_recv_frame |
if(..->fw_download_in_progress)|
nfcmrvl_fw_dnld_recv_frame |
queue_work |
|
fw_dnld_rx_work | nfcmrvl_nci_unregister_dev
fw_dnld_over | nfcmrvl_fw_dnld_abort
release_firmware | fw_dnld_over
kfree(fw) //(1) | release_firmware
| kfree(fw) //(2)
The firmware struct is deallocated in position (1) and deallocated
in position (2) again.
The crash trace triggered by POC is like below:
BUG: KASAN: double-free or invalid-free in fw_dnld_over
Call Trace:
kfree
fw_dnld_over
nfcmrvl_nci_unregister_dev
nci_uart_tty_close
tty_ldisc_kill
tty_ldisc_hangup
__tty_hangup.part.0
tty_release
...
What's more, there are also use-after-free and null-ptr-deref bugs
in nfcmrvl_fw_dnld_start. If we deallocate firmware struct, gpio or
set null to the members of priv->fw_dnld in nfcmrvl_nci_unregister_dev,
then, we dereference firmware, gpio or the members of priv->fw_dnld in
nfcmrvl_fw_dnld_start, the UAF or NPD bugs will happen.
This patch reorders destructive operations after nci_unregister_device
in order to synchronize between cleanup routine and firmware download
routine.
The nci_unregister_device is well synchronized. If the device is
detaching, the firmware download routine will goto error. If firmware
download routine is executing, nci_unregister_device will wait until
firmware download routine is finished.
Bug: 234690530
Fixes: 3194c68701 ("NFC: nfcmrvl: add firmware download support")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: I8cc1f6450c7fecf5f5994033931da1d23a522282
Provide a vendor hook android_vh_free_pages to clear the
information in struct page_ext, when the page is freed.
Bug: 234214858
Signed-off-by: Bing Han <bing.han@transsion.com>
Change-Id: Iac8e3a72f59f8d3ae16dbc93d94034fe4b627d61
Create and export a function is_swap_slot_cache_enabled
to check whether the swap slot cache can be used.
Bug: 234214858
Signed-off-by: Bing Han <bing.han@transsion.com>
Change-Id: Iaca9519b838e0c3c8c06acbec83003f8309aa363
Provide a vendor hook android_vh_swap_slot_cache_active to
pass the active status of swap_slots_cache. This status
will be used in the process of reclaiming the pages that
is required to be reclaimed to a specified swap location.
Bug: 234214858
Signed-off-by: Bing Han <bing.han@transsion.com>
Change-Id: I8211760e0f37fe4a514f6ceaae9993925da8cd6d
Export swapcache_free_entries to be used in the alternative function
android_vh_drain_slots_cache_cpu to swap entries in swap slot cache,
it's usage is similar to the usage in drain_slots_cache_cpu.
Bug: 234214858
Signed-off-by: Bing Han <bing.han@transsion.com>
Change-Id: Ia89b1728d540c5cc8995a939a918e12c23057266
3 symbols are exported to be used in vendor hook android_vh_get_swap_page:
1)check_cache_active, used to get swap page from the specified
swap location, it's usage is similar to the usage in get_swap_page
2)scan_swap_map_slots, used to get swap page from the specified swap,
it's usage is similar to get_swap_pages
3)swap_alloc_cluster, used to get swap page from the specified swap,
it's usage is similar to get_swap_pages
Bug: 234214858
Signed-off-by: Bing Han <bing.han@transsion.com>
Change-Id: Ie24c5d32a16c7cb87905d034095ec8fb070dbe0f
Three vendor hooks are provided to extend struct swap_slots_cache.
The extended data are used to record the information of the
specified reclaimed swap location:
1) android_vh_alloc_swap_slot_cache, replace the function
alloc_swap_slot_cache adding allocation of the extension
of struct swap_slots_cache;
2) android_vh_drain_slots_cache_cpu, replace the function
drain_slots_cache_cpu adding the initialization of the
extension of struct swap_slots_cache;
3) android_vh_get_swap_page, replace the function get_swap_page,
according to the reclaimed location information of the page,
get the the swap page from the specified swap location;
Bug: 234214858
Signed-off-by: Bing Han <bing.han@transsion.com>
Change-Id: I3bce6e8cf255df1d879b7c4022d54981cce7c273
The function swap_type_to_swap_info is exported to access the
swap_info_struct of the specified swap, which is regarded as
reserved extended memory.
Bug: 234214858
Signed-off-by: Bing Han <bing.han@transsion.com>
Change-Id: I0107e7d561150f1945a4c161e886e9e03383fff6
Provide a vendor hook android_vh_si_swapinf to replace the
process of updating nr_to_be_unused. When the page is swapped
to a specified swap location, nr_to_be_unused should not be
updated. Because the specified swap is regarded as a reserved
extended memory.
Bug: 234214858
Signed-off-by: Bing Han <bing.han@transsion.com>
Change-Id: Ie41caec345658589bf908fb0f96d038d1fba21f3
Two vendor hooks are added to extend the struct swap_info_struct:
android_vh_alloc_si, extend the allocation of struct swap_info_struct,
adding data to record the information of specified reclaimed location;
android_vh_init_swap_info_struct, adding initializing the extension of
struct swap_info_struct;
Bug: 234214858
Signed-off-by: Bing Han <bing.han@transsion.com>
Change-Id: I0e1d8e38ba7dfd52b609b1c14eb78f8b0ef0f9e6
When the page is unused, a vendor hook android_vh_unuse_swap_page
should be called to specify that the page should not be swapped
to the specified swap location any more.
Bug: 234214858
Signed-off-by: Bing Han <bing.han@transsion.com>
Change-Id: I3fc3675020517f7cc69c76a06150dfb2380dae21
Provide a vendor hook to replace the function free_swap_slot,
adding the free_swap_slot process of pages swapped to the
specified swap location(i.e., the reserved expended memory)
Bug: 234214858
Signed-off-by: Bing Han <bing.han@transsion.com>
Change-Id: Idd6d0007e64d56d556d1234a8b931fce06031809
The specified swap is regarded as reserved extended memory.
So nr_swap_pages and total_swap_pages should not be affected
by the specified swap.
Provide a vendor hook android_vh_account_swap_pages to replace
the updating process of nr_swap_pages and total_swap_pages.
When the page is swapped to the specified swap location,
nr_swap_pages and total_swap_pages should not be updated.
Bug: 234214858
Signed-off-by: Bing Han <bing.han@transsion.com>
Change-Id: Ib8dfb355d190399a037b9d9eda478a81c436e224
Add android_vh_page_referenced_one_end at the end of function
page_referenced_one to update the status that whether the page
need to be reclaimed to a specified swap location.
Bug: 234214858
Signed-off-by: Bing Han <bing.han@transsion.com>
Change-Id: Ia06a229956328ef776da5d163708dcb011a327fb
android_vh_count_pswpin, Update the write I/O statistics of the swap;
android_vh_count_pswpout, Update the read I/O statistics of the swap;
android_vh_count_swpout_vm_event, Replace count_swpout_vm_event with
adding updating the I/O statistics of the swap;
Bug: 234214858
Signed-off-by: Bing Han <bing.han@transsion.com>
Change-Id: I4eb69db59fe2d822555a508c2f0c6cd5ca9083d1
Provide a vendor hook to copy the status whether the page need to be
reclaimed to a specified swap location.
Bug: 234214858
Signed-off-by: Bing Han <bing.han@transsion.com>
Change-Id: I1a451b40407718900b56de6ed17b7fd5ef56da01
android_vh_waiting_for_page_migration: provide a vendor hook
to force not to reclaim the page under migration to a specified
swap location, until the migration is finished.
Bug: 234214858
Signed-off-by: Bing Han <bing.han@transsion.com>
Change-Id: Iceeae91cbd912d9c44d7eac25f1299bbff547388
android_vh_handle_pte_fault_end: after handle_pte_fault, update
the information that whether this page need to be reclaimed to
a swap location.
Bug: 234214858
Signed-off-by: Bing Han <bing.han@transsion.com>
Change-Id: I0ceb02422fc858ed96fbb47e220bf96bdc8fa68c
android_vh_swapin_add_anon_rmap: after add pte mapping to an anonymous
page durning do_swap_page, update the status that whether this page
need to be reclaimed to a swap location, according to the information
of vm_fault.
Bug: 234214858
Signed-off-by: Bing Han <bing.han@transsion.com>
Change-Id: I8a2d603102c315323817e6c9366db9b0da878344
android_vh_cow_user_page: when copy a page to a new page, set the
status that whether the new page should be reclaimed to a specified
swap location, according to the information of vm_fault.
Bug: 234214858
Signed-off-by: Bing Han <bing.han@transsion.com>
Change-Id: Ie445c7b034ca176ec1e8fd1cd67c88581bf9ddf4
Provide a vendor hook android_vh_page_isolated_for_reclaim to
process whether the page should be reclaimed to a specified
swap(i.e., the expanded memory).
This strategy will take into account the state of the current
process/application, resource usage, and other information.
Bug: 234214858
Signed-off-by: Bing Han <bing.han@transsion.com>
Change-Id: Id80a377c87bea13922e7b23963b050ab37ba0cb0
Provide a vendor hook android_vh_snapshot_refaults to record the
refault statistics of WORKINGSET_RESTORE_ANON;
Bug: 234214858
Signed-off-by: Bing Han <bing.han@transsion.com>
Change-Id: I20eb5ea99bf21fa8ba34b45e87d2ab9e9cdca167
Provide a vendor hook android_vh_inactive_is_low to replace the
calculation process of inactive_ratio.
The alternative calculation algorithm takes into account the
difference between file pages and anonymous pages.
Bug: 234214858
Signed-off-by: Bing Han <bing.han@transsion.com>
Change-Id: I6cf9c47fbc440852cc36e04f49d644146eb2c6af
In ffs_epfile_io(), when read/write data in blocking mode, it will wait
the completion in interruptible mode, if task receive a signal, it will
terminate the wait, at same time, if function unbind occurs,
ffs_func_unbind() will kfree all eps, ffs_epfile_io() still try to
dequeue request by dereferencing ep which may become invalid.
Fix it by add ep spinlock and will not dereference ep if it is not valid.
Cc: <stable@vger.kernel.org> # 5.15
Reported-by: Michael Wu <michael@allwinnertech.com>
Tested-by: Michael Wu <michael@allwinnertech.com>
Reviewed-by: John Keeping <john@metanate.com>
Signed-off-by: Linyu Yuan <quic_linyyuan@quicinc.com>
Link: https://lore.kernel.org/r/1654863478-26228-3-git-send-email-quic_linyyuan@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 0698f0209d8032e8869525aeb68f65ee7fde12ad
https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git/ usb-next)
Bug: 237482099
Change-Id: I796c819a855241186058359a13c57c802e35ccbb
Signed-off-by: Krishna Kurapati <quic_kriskura@quicinc.com>
If a task read/write data in blocking mode, it will wait the completion
in ffs_epfile_io(), if function unbind occurs, ffs_func_unbind() will
kfree ffs ep, once the task wake up, it still dereference the ffs ep to
obtain the request status.
Fix it by moving the request status to io_data which is stack-safe.
Cc: <stable@vger.kernel.org> # 5.15
Reported-by: Michael Wu <michael@allwinnertech.com>
Tested-by: Michael Wu <michael@allwinnertech.com>
Reviewed-by: John Keeping <john@metanate.com>
Signed-off-by: Linyu Yuan <quic_linyyuan@quicinc.com>
Link: https://lore.kernel.org/r/1654863478-26228-2-git-send-email-quic_linyyuan@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit fb1f16d74e263baa4ad11e31e28b68f144aa55ed
https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git/ usb-next)
Bug: 237482099
Change-Id: I439b94c4fbc56416c3339ada5f066aa606fd81bd
Signed-off-by: Krishna Kurapati <quic_kriskura@quicinc.com>
The inclusion of the internal kernel/cgroup/cgroup-internal.h header
broke some androidci builds.
Bug: 233047575
Fixes: 1590a0e8e1 ("ANDROID: GKI: include more type definitions in vendor hooks")
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: I3139b63e5bea277c6687ce1c3c69db35059f3825
After 7b26719a77c4 ("ANDROID: GKI: use internal type definitions in
vendor hooks") we stopped providing a forward declaration of 'struct
uclamp_se' and instead relied on pulling its definition from
linux/sched.h. the 'uclamp_se' structure is conditionally defined based
upon CONFIG_UCLAMP_TASK therefore causing a build error to show up for
the android_rvh_uclamp_eff_get trace point.
Fix this by providing a forward declaration of 'struct uclamp_se' like
before.
Fixes: 7b26719a77c4 ("ANDROID: GKI: use internal type definitions in vendor hooks")
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
Change-Id: Iaa803d149150c1703435f9cfa52ea1406a9521fd
check_sync() checks for whether device driver DMA sync sg list entry count equals to map sg list entry count, but in struct dma_buf_ops, there has below interface:
int (*begin_cpu_access_partial)
int (*end_cpu_access_partial)
When vendor implement these interface in dma heap to support dma-buf partial cache sync for performance improvement, in dma_buf_ops of heap, we copy a sgtable from orginal sgtable but with necessary nents, it will less then nents used in map attachment, in the way, the following warning had occurred:
DMA-API: device_xxx: device driver syncs DMA sg list with different entry count [map count=5] [sync count=1]
Call trace:
check_sync+0x6d8/0xb40
debug_dma_sync_sg_for_cpu+0x114/0x16c
dma_sync_sg_for_cpu+0xa0/0xe4
So need change check conditation in check_sync to support dma-buf partial cache sync.
Bug: 236343688
Signed-off-by: Mingyuan Ma <mingyuan.ma@mediatek.com>
Signed-off-by: Yunfei Wang <yf.wang@mediatek.com>
Change-Id: I2f4db3b156e752eeb022927957f77a3fa534a573
(cherry picked from commit d61fe3ad4bab3f4bc040e7ac0c7ec919b50e8a43)
Currently the VBUS/ID detection interrupts are disabled during system
suspend. So the USB cable connect/disconnect event can't wakeup the
system from low power mode. To allow this, we keep these interrupts
enabled and configure them as wakeup capable. This behavior can be
controlled through device wakeup source policy by the user space.
This was tested and verified on a target.
(cherry picked from commit 7afe69ad9221a77dc782b81f49cd7f99987740ed https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git/ usb-next)
Bug: 234808630
Link: https://lore.kernel.org/r/1653634146-12215-1-git-send-email-quic_prashk@quicinc.com
Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I8767f91aa78805984856334821072e0c7986eea0
A panic can occur if the endpoint becomes disabled and the
uvcg_video_pump adds the request back to the req_free list after it has
already been queued to the endpoint. The endpoint complete will add the
request back to the req_free list. Invalidate the local request handle
once it's been queued.
<6>[ 246.796704][T13726] configfs-gadget gadget: uvc: uvc_function_set_alt(1, 0)
<3>[ 246.797078][ T26] list_add double add: new=ffffff878bee5c40, prev=ffffff878bee5c40, next=ffffff878b0f0a90.
<6>[ 246.797213][ T26] ------------[ cut here ]------------
<2>[ 246.797224][ T26] kernel BUG at lib/list_debug.c:31!
<6>[ 246.807073][ T26] Call trace:
<6>[ 246.807180][ T26] uvcg_video_pump+0x364/0x38c
<6>[ 246.807366][ T26] process_one_work+0x2a4/0x544
<6>[ 246.807394][ T26] worker_thread+0x350/0x784
<6>[ 246.807442][ T26] kthread+0x2ac/0x320
Fixes: f9897ec0f6d3 ("usb: gadget: uvc: only pump video data if necessary")
Cc: stable@vger.kernel.org
Signed-off-by: Dan Vacura <w36195@motorola.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Bug: 236299719
Link: https://lore.kernel.org/all/20220617163154.16621-1-w36195@motorola.com/
Change-Id: Ie36696d51e0199fc4befca58032842137dece886
Signed-off-by: Dan Vacura <w36195@motorola.com>
Degradation of write speed caused by frequent disk access for cluster
bitmap update on every cluster allocation could be improved by
selective syncing bitmap buffer. Change to flush bitmap buffer only
for the directory related operations.
Signed-off-by: Hyeongseok Kim <hyeongseok@gmail.com>
Acked-by: Sungjong Seo <sj1557.seo@samsung.com>
Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com>
Change-Id: I660931d6da488880337a33dd03b48cb0be0bb26c
Signed-off-by: Howard Chen <howardsoc@google.com>
(cherry picked from commit 23befe490ba885bdf757d40b2489134315fef690)
Bug: 233712676
In following scenario(diagram), when one thread X running dev_coredumpm()
adds devcd device to the framework which sends uevent notification to
userspace and another thread Y reads this uevent and call to
devcd_data_write() which eventually try to delete the queued timer that
is not initialized/queued yet.
So, debug object reports some warning and in the meantime, timer is
initialized and queued from X path. and from Y path, it gets reinitialized
again and timer->entry.pprev=NULL and try_to_grab_pending() stucks.
To fix this, introduce mutex and a boolean flag to serialize the behaviour.
cpu0(X) cpu1(Y)
dev_coredump() uevent sent to user space
device_add() ======================> user space process Y reads the
uevents writes to devcd fd
which results into writes to
devcd_data_write()
mod_delayed_work()
try_to_grab_pending()
del_timer()
debug_assert_init()
INIT_DELAYED_WORK()
schedule_delayed_work()
debug_object_fixup()
timer_fixup_assert_init()
timer_setup()
do_init_timer()
/*
Above call reinitializes
the timer to
timer->entry.pprev=NULL
and this will be checked
later in timer_pending() call.
*/
timer_pending()
!hlist_unhashed_lockless(&timer->entry)
!h->pprev
/*
del_timer() checks h->pprev and finds
it to be NULL due to which
try_to_grab_pending() stucks.
*/
Bug: 235577024
Change-Id: I5e86abf72e8dff6952ba493fd9f43a26b2b40352
Link: https://lore.kernel.org/lkml/2e1f81e2-428c-f11f-ce92-eb11048cb271@quicinc.com/
Link: https://lore.kernel.org/lkml/1653660220-19197-1-git-send-email-quic_mojha@quicinc.com/
Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com>
The current limitation of possible number of requests being handled is
dependent on the gadget speed. It makes more sense to depend on the
typical frame size when calculating the number of requests. This patch
is changing this and is using the previous limits as boundaries for
reasonable minimum and maximum number of requests.
For a 1080p jpeg encoded video stream with a maximum imagesize of
e.g. 800kB with a maxburst of 8 and an multiplier of 1 the resulting
number of requests is calculated to 49.
800768 1
nreqs = ------ * -------------- ~= 49
2 (1024 * 8 * 1)
Tested-by: Dan Vacura <w36195@motorola.com>
Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Link: https://lore.kernel.org/r/20220529223848.105914-2-m.grzeschik@pengutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 234757296
(cherry picked from commit 87d76b5f1d8eeb49efa16e2018e188864cbb9401
https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-next)
Change-Id: I0228cbaa56d4e75bed33e1ef721ae3127d779faf
Signed-off-by: Dan Vacura <w36195@motorola.com>
The tracing_is_on interface has been exported, add it to the symbol table so that we can use it in the external module.
Leaf changes summary: 1 artifact changed
Changed leaf types summary: 0 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 1 Added function
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable
1 Added function:
[A] 'function int tracing_is_on()'
Bug: 193384408
Signed-off-by: xieliujie <xieliujie@oppo.com>
Change-Id: If9f923850ab1db76214240efd8337211972d3a67
Mac OS-X expects CD-ROM TOC in raw format (i.e. format:2). It also
sends the READ_TOC CDB in old style SFF8020i format. i.e. 2 format bits
are encoded in MSBs of CDB byte 9.
This patch will enable CD-ROM emulation to work with Mac OS-X. Tested on
Mac OS X v10.6.3.
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Roger Quadros <roger.quadros@nokia.com>
Signed-off-by: Jack Pham <quic_jackp@quicinc.com>
Link: https://lore.kernel.org/r/20220124160150.19499-1-quic_jackp@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 235304500
(cherry picked from commit 89ada0fe669a7abf8777b793b874202a0767a24f)
Change-Id: Ibc4b89260f3ca788edae401d60e1392322e785a0
commit e677edbcabee849bfdd43f1602bccbecf736a646 upstream.
io_flush_timeouts() assumes the timeout isn't in progress of triggering
or being removed/canceled, so it unconditionally removes it from the
timeout list and attempts to cancel it.
Leave it on the list and let the normal timeout cancelation take care
of it.
Bug: 231494876
Cc: stable@vger.kernel.org # 5.5+
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: Ie7dba41da32732391f8a85526fe20168bd431be8
If the ring is setup with IORING_SETUP_IOPOLL and we have more than
one task doing submissions on a ring, we can up in a situation where
we assign the context from the current task rather than the request
originator.
Always use req->task rather than assume it's the same as current.
No upstream patch exists for this issue, as only older kernels with
the non-native workers have this problem.
Bug: 233078742
Reported-by: Kyle Zeng <zengyhkyle@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Akilesh Kailash <akailash@google.com>
(cherry picked from commit 29f077d070
from linux-5.10.y stable branch)
Change-Id: I4cc543950a95e1df201fa9867c5e9c272fd54b6f
Add dma_release_coherent_memory to DMA API to allow dma
user call it to release dev->dma_mem when the device is
removed.
Signed-off-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
Bug: 233721768
Link: https://lore.kernel.org/lkml/20220422062436.14384-2-mark-pk.tsai@mediatek.com/
Change-Id: Ief72cf5bbe18a977bae76a1e5799ebc06b46d791
Signed-off-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
(cherry picked from commit 137066946c448e67c4b5b344949ab0c3aec62dfa)
