From d10e4ffd64a19d88f085e92a4b0a2470aa336915 Mon Sep 17 00:00:00 2001 From: Heesub Shin Date: Fri, 30 May 2014 10:26:27 +0900 Subject: staging: ion: remove order from struct page_info ION system heap uses an internal data structure, struct page_info, for tracking down the meta information of the pages allocated from the pool. Now that the pool returns compound pages, we don't need to store page order in struct page_info. Signed-off-by: Heesub Shin Reviewed-by: Mitchel Humpherys Tested-by: John Stultz Signed-off-by: Greg Kroah-Hartman --- drivers/staging/android/ion/ion_system_heap.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) (limited to 'drivers/staging/android') diff --git a/drivers/staging/android/ion/ion_system_heap.c b/drivers/staging/android/ion/ion_system_heap.c index cb7ae08a5e24..621b857eae6b 100644 --- a/drivers/staging/android/ion/ion_system_heap.c +++ b/drivers/staging/android/ion/ion_system_heap.c @@ -54,7 +54,6 @@ struct ion_system_heap { struct page_info { struct page *page; - unsigned int order; struct list_head list; }; @@ -123,7 +122,6 @@ static struct page_info *alloc_largest_available(struct ion_system_heap *heap, continue; info->page = page; - info->order = orders[i]; return info; } kfree(info); @@ -160,8 +158,8 @@ static int ion_system_heap_allocate(struct ion_heap *heap, if (!info) goto free_pages; list_add_tail(&info->list, &pages); - size_remaining -= PAGE_SIZE << info->order; - max_order = info->order; + size_remaining -= PAGE_SIZE << compound_order(info->page); + max_order = compound_order(info->page); i++; } table = kmalloc(sizeof(struct sg_table), GFP_KERNEL); @@ -174,7 +172,7 @@ static int ion_system_heap_allocate(struct ion_heap *heap, sg = table->sgl; list_for_each_entry_safe(info, tmp_info, &pages, list) { struct page *page = info->page; - sg_set_page(sg, page, PAGE_SIZE << info->order, 0); + sg_set_page(sg, page, PAGE_SIZE << compound_order(page), 0); sg = sg_next(sg); list_del(&info->list); kfree(info); @@ -187,7 +185,8 @@ free_table: kfree(table); free_pages: list_for_each_entry_safe(info, tmp_info, &pages, list) { - free_buffer_page(sys_heap, buffer, info->page, info->order); + free_buffer_page(sys_heap, buffer, info->page, + compound_order(info->page)); kfree(info); } return -ENOMEM; -- cgit v1.2.3 From 7eb88bffbd883fa78944799ff3887da916159a59 Mon Sep 17 00:00:00 2001 From: Heesub Shin Date: Fri, 30 May 2014 10:26:28 +0900 Subject: staging: ion: remove struct page_info ION system heap creates a temporary list of pages to build scatter/gather table, introducing an internal data type, page_info. Now that the order field has been removed from it, we do not need to depend on such data type anymore. Signed-off-by: Heesub Shin Reviewed-by: Mitchel Humpherys Tested-by: John Stultz Signed-off-by: Greg Kroah-Hartman --- drivers/staging/android/ion/ion_system_heap.c | 47 +++++++++------------------ 1 file changed, 15 insertions(+), 32 deletions(-) (limited to 'drivers/staging/android') diff --git a/drivers/staging/android/ion/ion_system_heap.c b/drivers/staging/android/ion/ion_system_heap.c index 621b857eae6b..f3b9008f90cb 100644 --- a/drivers/staging/android/ion/ion_system_heap.c +++ b/drivers/staging/android/ion/ion_system_heap.c @@ -52,11 +52,6 @@ struct ion_system_heap { struct ion_page_pool **pools; }; -struct page_info { - struct page *page; - struct list_head list; -}; - static struct page *alloc_buffer_page(struct ion_system_heap *heap, struct ion_buffer *buffer, unsigned long order) @@ -98,19 +93,14 @@ static void free_buffer_page(struct ion_system_heap *heap, } -static struct page_info *alloc_largest_available(struct ion_system_heap *heap, - struct ion_buffer *buffer, - unsigned long size, - unsigned int max_order) +static struct page *alloc_largest_available(struct ion_system_heap *heap, + struct ion_buffer *buffer, + unsigned long size, + unsigned int max_order) { struct page *page; - struct page_info *info; int i; - info = kmalloc(sizeof(struct page_info), GFP_KERNEL); - if (!info) - return NULL; - for (i = 0; i < num_orders; i++) { if (size < order_to_size(orders[i])) continue; @@ -121,10 +111,8 @@ static struct page_info *alloc_largest_available(struct ion_system_heap *heap, if (!page) continue; - info->page = page; - return info; + return page; } - kfree(info); return NULL; } @@ -140,7 +128,7 @@ static int ion_system_heap_allocate(struct ion_heap *heap, struct sg_table *table; struct scatterlist *sg; struct list_head pages; - struct page_info *info, *tmp_info; + struct page *page, *tmp_page; int i = 0; unsigned long size_remaining = PAGE_ALIGN(size); unsigned int max_order = orders[0]; @@ -153,13 +141,13 @@ static int ion_system_heap_allocate(struct ion_heap *heap, INIT_LIST_HEAD(&pages); while (size_remaining > 0) { - info = alloc_largest_available(sys_heap, buffer, size_remaining, + page = alloc_largest_available(sys_heap, buffer, size_remaining, max_order); - if (!info) + if (!page) goto free_pages; - list_add_tail(&info->list, &pages); - size_remaining -= PAGE_SIZE << compound_order(info->page); - max_order = compound_order(info->page); + list_add_tail(&page->lru, &pages); + size_remaining -= PAGE_SIZE << compound_order(page); + max_order = compound_order(page); i++; } table = kmalloc(sizeof(struct sg_table), GFP_KERNEL); @@ -170,12 +158,10 @@ static int ion_system_heap_allocate(struct ion_heap *heap, goto free_table; sg = table->sgl; - list_for_each_entry_safe(info, tmp_info, &pages, list) { - struct page *page = info->page; + list_for_each_entry_safe(page, tmp_page, &pages, lru) { sg_set_page(sg, page, PAGE_SIZE << compound_order(page), 0); sg = sg_next(sg); - list_del(&info->list); - kfree(info); + list_del(&page->lru); } buffer->priv_virt = table; @@ -184,11 +170,8 @@ static int ion_system_heap_allocate(struct ion_heap *heap, free_table: kfree(table); free_pages: - list_for_each_entry_safe(info, tmp_info, &pages, list) { - free_buffer_page(sys_heap, buffer, info->page, - compound_order(info->page)); - kfree(info); - } + list_for_each_entry_safe(page, tmp_page, &pages, lru) + free_buffer_page(sys_heap, buffer, page, compound_order(page)); return -ENOMEM; } -- cgit v1.2.3 From 06566f5dc3f30e74de9e7bee4da6aad9ca35f287 Mon Sep 17 00:00:00 2001 From: Heesub Shin Date: Fri, 30 May 2014 10:26:29 +0900 Subject: staging: ion: remove order argument from free_buffer_page() Now that the pages returned from the pool are compound pages, we do not need to pass the order information to free_buffer_page(). Signed-off-by: Heesub Shin Reviewed-by: Mitchel Humpherys Tested-by: John Stultz Signed-off-by: Greg Kroah-Hartman --- drivers/staging/android/ion/ion_system_heap.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) (limited to 'drivers/staging/android') diff --git a/drivers/staging/android/ion/ion_system_heap.c b/drivers/staging/android/ion/ion_system_heap.c index f3b9008f90cb..e0a7e5491f59 100644 --- a/drivers/staging/android/ion/ion_system_heap.c +++ b/drivers/staging/android/ion/ion_system_heap.c @@ -78,9 +78,9 @@ static struct page *alloc_buffer_page(struct ion_system_heap *heap, } static void free_buffer_page(struct ion_system_heap *heap, - struct ion_buffer *buffer, struct page *page, - unsigned int order) + struct ion_buffer *buffer, struct page *page) { + unsigned int order = compound_order(page); bool cached = ion_buffer_cached(buffer); if (!cached && !(buffer->private_flags & ION_PRIV_FLAG_SHRINKER_FREE)) { @@ -171,7 +171,7 @@ free_table: kfree(table); free_pages: list_for_each_entry_safe(page, tmp_page, &pages, lru) - free_buffer_page(sys_heap, buffer, page, compound_order(page)); + free_buffer_page(sys_heap, buffer, page); return -ENOMEM; } @@ -191,8 +191,7 @@ static void ion_system_heap_free(struct ion_buffer *buffer) ion_heap_buffer_zero(buffer); for_each_sg(table->sgl, sg, table->nents, i) - free_buffer_page(sys_heap, buffer, sg_page(sg), - get_order(sg->length)); + free_buffer_page(sys_heap, buffer, sg_page(sg)); sg_free_table(table); kfree(table); } -- cgit v1.2.3 From 6944561ece14d865238d14e40da858efb29dc2e8 Mon Sep 17 00:00:00 2001 From: Heesub Shin Date: Fri, 30 May 2014 10:26:30 +0900 Subject: staging: ion: optimize struct ion_system_heap struct ion_system_heap has an array for storing pointers to page pools and it is allocated separately from the containing structure. There is no point in allocating those two small objects individually, bothering slab allocator. Using a variable length array simplifies code lines and reduces overhead to the slab. Signed-off-by: Heesub Shin Reviewed-by: Mitchel Humpherys Tested-by: John Stultz Signed-off-by: Greg Kroah-Hartman --- drivers/staging/android/ion/ion_system_heap.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) (limited to 'drivers/staging/android') diff --git a/drivers/staging/android/ion/ion_system_heap.c b/drivers/staging/android/ion/ion_system_heap.c index e0a7e5491f59..c826b4c63861 100644 --- a/drivers/staging/android/ion/ion_system_heap.c +++ b/drivers/staging/android/ion/ion_system_heap.c @@ -49,7 +49,7 @@ static inline unsigned int order_to_size(int order) struct ion_system_heap { struct ion_heap heap; - struct ion_page_pool **pools; + struct ion_page_pool *pools[0]; }; static struct page *alloc_buffer_page(struct ion_system_heap *heap, @@ -264,16 +264,15 @@ struct ion_heap *ion_system_heap_create(struct ion_platform_heap *unused) struct ion_system_heap *heap; int i; - heap = kzalloc(sizeof(struct ion_system_heap), GFP_KERNEL); + heap = kzalloc(sizeof(struct ion_system_heap) + + sizeof(struct ion_page_pool *) * num_orders, + GFP_KERNEL); if (!heap) return ERR_PTR(-ENOMEM); heap->heap.ops = &system_heap_ops; heap->heap.type = ION_HEAP_TYPE_SYSTEM; heap->heap.flags = ION_HEAP_FLAG_DEFER_FREE; - heap->pools = kzalloc(sizeof(struct ion_page_pool *) * num_orders, - GFP_KERNEL); - if (!heap->pools) - goto free_heap; + for (i = 0; i < num_orders; i++) { struct ion_page_pool *pool; gfp_t gfp_flags = low_order_gfp_flags; @@ -292,8 +291,6 @@ struct ion_heap *ion_system_heap_create(struct ion_platform_heap *unused) destroy_pools: while (i--) ion_page_pool_destroy(heap->pools[i]); - kfree(heap->pools); -free_heap: kfree(heap); return ERR_PTR(-ENOMEM); } -- cgit v1.2.3 From 69b2b20e287870441f0a8f1a1e51b94c247986ae Mon Sep 17 00:00:00 2001 From: Tair Rzayev Date: Sat, 31 May 2014 22:47:42 +0300 Subject: staging: android: ion: ion_chunk_heap.c: Fix checkpatch warning Fix the over 80 character line Signed-off-by: Tair Rzayev Signed-off-by: Greg Kroah-Hartman --- drivers/staging/android/ion/ion_chunk_heap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/staging/android') diff --git a/drivers/staging/android/ion/ion_chunk_heap.c b/drivers/staging/android/ion/ion_chunk_heap.c index 3f2c12ba4d14..9c3e49aa204b 100644 --- a/drivers/staging/android/ion/ion_chunk_heap.c +++ b/drivers/staging/android/ion/ion_chunk_heap.c @@ -106,7 +106,7 @@ static void ion_chunk_heap_free(struct ion_buffer *buffer) if (ion_buffer_cached(buffer)) dma_sync_sg_for_device(NULL, table->sgl, table->nents, - DMA_BIDIRECTIONAL); + DMA_BIDIRECTIONAL); for_each_sg(table->sgl, sg, table->nents, i) { gen_pool_free(chunk_heap->pool, page_to_phys(sg_page(sg)), -- cgit v1.2.3 From 32c3f470ec7e427db69d86a3061101ea4a5c681f Mon Sep 17 00:00:00 2001 From: Pramod Gurav Date: Fri, 13 Jun 2014 11:49:43 +0530 Subject: staging: alarm-dev: Support to Compile as Module Currently this alarm-dev can be compiles only as built in driver. This adds support to compile it as module as well which is in planned activity (See drivers/staging/android/TODO) CC: Brian Swetland Signed-off-by: Pramod Gurav Signed-off-by: Greg Kroah-Hartman --- drivers/staging/android/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/staging/android') diff --git a/drivers/staging/android/Kconfig b/drivers/staging/android/Kconfig index 99e484f845f2..c359317abadf 100644 --- a/drivers/staging/android/Kconfig +++ b/drivers/staging/android/Kconfig @@ -76,7 +76,7 @@ config ANDROID_LOW_MEMORY_KILLER Registers processes to be killed when memory is low config ANDROID_INTF_ALARM_DEV - bool "Android alarm driver" + tristate "Android alarm driver" depends on RTC_CLASS default n ---help--- -- cgit v1.2.3 From 895ae8765726df407264dc661674e4e04eaf8664 Mon Sep 17 00:00:00 2001 From: Heesub Shin Date: Fri, 20 Jun 2014 11:46:14 +0900 Subject: staging: ion: fixup invalid kfree() calls on heap destroy I've noticed that the last commit to ion_system_heap.c ('staging: ion: optimize struct ion_system_heap') has an omission, so an invalid kfree() gets called on ion_system_heap_destroy(). As ION system heap is never destroyed until system shutdown, it may not cause any harm, but should be fixed. I should have caught this before the merge, my bad. Signed-off-by: Heesub Shin Signed-off-by: Greg Kroah-Hartman --- drivers/staging/android/ion/ion_system_heap.c | 1 - 1 file changed, 1 deletion(-) (limited to 'drivers/staging/android') diff --git a/drivers/staging/android/ion/ion_system_heap.c b/drivers/staging/android/ion/ion_system_heap.c index c826b4c63861..6b77c5195b4d 100644 --- a/drivers/staging/android/ion/ion_system_heap.c +++ b/drivers/staging/android/ion/ion_system_heap.c @@ -304,7 +304,6 @@ void ion_system_heap_destroy(struct ion_heap *heap) for (i = 0; i < num_orders; i++) ion_page_pool_destroy(sys_heap->pools[i]); - kfree(sys_heap->pools); kfree(sys_heap); } -- cgit v1.2.3 From 2a838c6484e13da6f1bfe093d7300d02daca80d1 Mon Sep 17 00:00:00 2001 From: Pramod Gurav Date: Fri, 20 Jun 2014 14:13:59 +0530 Subject: staging: alarm-dev: Set the license to GPL Adding "GPL" license to fix a warning while compiling as module. CC: Brian Swetland Signed-off-by: Pramod Gurav Signed-off-by: Greg Kroah-Hartman --- drivers/staging/android/alarm-dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/staging/android') diff --git a/drivers/staging/android/alarm-dev.c b/drivers/staging/android/alarm-dev.c index f200e8a84325..ff4b3e8758a7 100644 --- a/drivers/staging/android/alarm-dev.c +++ b/drivers/staging/android/alarm-dev.c @@ -443,4 +443,4 @@ static void __exit alarm_dev_exit(void) module_init(alarm_dev_init); module_exit(alarm_dev_exit); - +MODULE_LICENSE("GPL"); -- cgit v1.2.3 From 7873311aed5436bad100ff7ed98f159e6c8c17a7 Mon Sep 17 00:00:00 2001 From: Karthik Nayak Date: Sat, 21 Jun 2014 20:23:16 +0530 Subject: Staging: Android: removed an unnecessary else statement As per checkpatch warning, removed an unnecessary else statement proceeding an if statement with a return. Signed-off-by: Karthik Nayak Signed-off-by: Greg Kroah-Hartman --- drivers/staging/android/binder.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) (limited to 'drivers/staging/android') diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c index a741da77828a..589cfc81f419 100644 --- a/drivers/staging/android/binder.c +++ b/drivers/staging/android/binder.c @@ -454,9 +454,8 @@ static size_t binder_buffer_size(struct binder_proc *proc, { if (list_is_last(&buffer->entry, &proc->buffers)) return proc->buffer + proc->buffer_size - (void *)buffer->data; - else - return (size_t)list_entry(buffer->entry.next, - struct binder_buffer, entry) - (size_t)buffer->data; + return (size_t)list_entry(buffer->entry.next, + struct binder_buffer, entry) - (size_t)buffer->data; } static void binder_insert_free_buffer(struct binder_proc *proc, -- cgit v1.2.3 From ddac7d5fba555967654bf47b7b458b050391dc1f Mon Sep 17 00:00:00 2001 From: Vinayak Menon Date: Mon, 2 Jun 2014 18:17:59 +0530 Subject: staging: binder: add vm_fault handler An issue was observed when a userspace task exits. The page which hits error here is the zero page. In binder mmap, the whole of vma is not mapped. On a task crash, when debuggerd reads the binder regions, the unmapped areas fall to do_anonymous_page in handle_pte_fault, due to the absence of a vm_fault handler. This results in zero page being mapped. Later in zap_pte_range, vm_normal_page returns zero page in the case of VM_MIXEDMAP and it results in the error. BUG: Bad page map in process mediaserver pte:9dff379f pmd:9bfbd831 page:c0ed8e60 count:1 mapcount:-1 mapping: (null) index:0x0 page flags: 0x404(referenced|reserved) addr:40c3f000 vm_flags:10220051 anon_vma: (null) mapping:d9fe0764 index:fd vma->vm_ops->fault: (null) vma->vm_file->f_op->mmap: binder_mmap+0x0/0x274 CPU: 0 PID: 1463 Comm: mediaserver Tainted: G W 3.10.17+ #1 [] (unwind_backtrace+0x0/0x11c) from [] (show_stack+0x10/0x14) [] (show_stack+0x10/0x14) from [] (print_bad_pte+0x158/0x190) [] (print_bad_pte+0x158/0x190) from [] (unmap_single_vma+0x2e4/0x598) [] (unmap_single_vma+0x2e4/0x598) from [] (unmap_vmas+0x34/0x50) [] (unmap_vmas+0x34/0x50) from [] (exit_mmap+0xc8/0x1e8) [] (exit_mmap+0xc8/0x1e8) from [] (mmput+0x54/0xd0) [] (mmput+0x54/0xd0) from [] (do_exit+0x360/0x990) [] (do_exit+0x360/0x990) from [] (do_group_exit+0x84/0xc0) [] (do_group_exit+0x84/0xc0) from [] (get_signal_to_deliver+0x4d4/0x548) [] (get_signal_to_deliver+0x4d4/0x548) from [] (do_signal+0xa8/0x3b8) Add a vm_fault handler which returns VM_FAULT_SIGBUS, and prevents the wrong fallback to do_anonymous_page. Signed-off-by: Vinayak Menon Signed-off-by: Greg Kroah-Hartman --- drivers/staging/android/binder.c | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'drivers/staging/android') diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c index 589cfc81f419..2f38e44ce44b 100644 --- a/drivers/staging/android/binder.c +++ b/drivers/staging/android/binder.c @@ -2768,9 +2768,15 @@ static void binder_vma_close(struct vm_area_struct *vma) binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES); } +static int binder_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf) +{ + return VM_FAULT_SIGBUS; +} + static struct vm_operations_struct binder_vm_ops = { .open = binder_vma_open, .close = binder_vma_close, + .fault = binder_vm_fault, }; static int binder_mmap(struct file *filp, struct vm_area_struct *vma) -- cgit v1.2.3 From 78260ac625e91d2402d72dd2f8c7109f98c1d19a Mon Sep 17 00:00:00 2001 From: Tair Rzayev Date: Tue, 3 Jun 2014 22:27:21 +0300 Subject: staging: android: binder.c: binder_ioctl() cleanup MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit binder_ioctl() is quite huge and checkpatch dirty - mostly because of the amount of code for the BINDER_WRITE_READ and BINDER_SET_CONTEXT_MGR. Moved that code into the new binder_ioctl_write_read() and binder_ioctl_set_ctx_mgr() Signed-off-by: Tair Rzayev Cc: Arve Hjønnevåg Signed-off-by: Greg Kroah-Hartman --- drivers/staging/android/binder.c | 186 ++++++++++++++++++++++----------------- 1 file changed, 107 insertions(+), 79 deletions(-) (limited to 'drivers/staging/android') diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c index 2f38e44ce44b..e446f624a04e 100644 --- a/drivers/staging/android/binder.c +++ b/drivers/staging/android/binder.c @@ -2593,6 +2593,106 @@ static unsigned int binder_poll(struct file *filp, return 0; } +static int binder_ioctl_write_read(struct file *filp, + unsigned int cmd, unsigned long arg, + struct binder_thread *thread) +{ + int ret = 0; + struct binder_proc *proc = filp->private_data; + unsigned int size = _IOC_SIZE(cmd); + void __user *ubuf = (void __user *)arg; + struct binder_write_read bwr; + + if (size != sizeof(struct binder_write_read)) { + ret = -EINVAL; + goto out; + } + if (copy_from_user(&bwr, ubuf, sizeof(bwr))) { + ret = -EFAULT; + goto out; + } + binder_debug(BINDER_DEBUG_READ_WRITE, + "%d:%d write %lld at %016llx, read %lld at %016llx\n", + proc->pid, thread->pid, + (u64)bwr.write_size, (u64)bwr.write_buffer, + (u64)bwr.read_size, (u64)bwr.read_buffer); + + if (bwr.write_size > 0) { + ret = binder_thread_write(proc, thread, + bwr.write_buffer, + bwr.write_size, + &bwr.write_consumed); + trace_binder_write_done(ret); + if (ret < 0) { + bwr.read_consumed = 0; + if (copy_to_user(ubuf, &bwr, sizeof(bwr))) + ret = -EFAULT; + goto out; + } + } + if (bwr.read_size > 0) { + ret = binder_thread_read(proc, thread, bwr.read_buffer, + bwr.read_size, + &bwr.read_consumed, + filp->f_flags & O_NONBLOCK); + trace_binder_read_done(ret); + if (!list_empty(&proc->todo)) + wake_up_interruptible(&proc->wait); + if (ret < 0) { + if (copy_to_user(ubuf, &bwr, sizeof(bwr))) + ret = -EFAULT; + goto out; + } + } + binder_debug(BINDER_DEBUG_READ_WRITE, + "%d:%d wrote %lld of %lld, read return %lld of %lld\n", + proc->pid, thread->pid, + (u64)bwr.write_consumed, (u64)bwr.write_size, + (u64)bwr.read_consumed, (u64)bwr.read_size); + if (copy_to_user(ubuf, &bwr, sizeof(bwr))) { + ret = -EFAULT; + goto out; + } +out: + return ret; +} + +static int binder_ioctl_set_ctx_mgr(struct file *filp) +{ + int ret = 0; + struct binder_proc *proc = filp->private_data; + kuid_t curr_euid = current_euid(); + + if (binder_context_mgr_node != NULL) { + pr_err("BINDER_SET_CONTEXT_MGR already set\n"); + ret = -EBUSY; + goto out; + } + if (uid_valid(binder_context_mgr_uid)) { + if (!uid_eq(binder_context_mgr_uid, curr_euid)) { + pr_err("BINDER_SET_CONTEXT_MGR bad uid %d != %d\n", + from_kuid(&init_user_ns, curr_euid), + from_kuid(&init_user_ns, + binder_context_mgr_uid)); + ret = -EPERM; + goto out; + } + } else { + binder_context_mgr_uid = curr_euid; + } + binder_context_mgr_node = binder_new_node(proc, 0, 0); + if (binder_context_mgr_node == NULL) { + ret = -ENOMEM; + goto out; + } + binder_context_mgr_node->local_weak_refs++; + binder_context_mgr_node->local_strong_refs++; + binder_context_mgr_node->has_strong_ref = 1; + binder_context_mgr_node->has_weak_ref = 1; +out: + return ret; +} + static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) { int ret; @@ -2600,9 +2700,9 @@ static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) struct binder_thread *thread; unsigned int size = _IOC_SIZE(cmd); void __user *ubuf = (void __user *)arg; - kuid_t curr_euid = current_euid(); - /*pr_info("binder_ioctl: %d:%d %x %lx\n", proc->pid, current->pid, cmd, arg);*/ + /*pr_info("binder_ioctl: %d:%d %x %lx\n", + proc->pid, current->pid, cmd, arg);*/ trace_binder_ioctl(cmd, arg); @@ -2618,61 +2718,11 @@ static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) } switch (cmd) { - case BINDER_WRITE_READ: { - struct binder_write_read bwr; - - if (size != sizeof(struct binder_write_read)) { - ret = -EINVAL; + case BINDER_WRITE_READ: + ret = binder_ioctl_write_read(filp, cmd, arg, thread); + if (ret) goto err; - } - if (copy_from_user(&bwr, ubuf, sizeof(bwr))) { - ret = -EFAULT; - goto err; - } - binder_debug(BINDER_DEBUG_READ_WRITE, - "%d:%d write %lld at %016llx, read %lld at %016llx\n", - proc->pid, thread->pid, - (u64)bwr.write_size, (u64)bwr.write_buffer, - (u64)bwr.read_size, (u64)bwr.read_buffer); - - if (bwr.write_size > 0) { - ret = binder_thread_write(proc, thread, - bwr.write_buffer, - bwr.write_size, - &bwr.write_consumed); - trace_binder_write_done(ret); - if (ret < 0) { - bwr.read_consumed = 0; - if (copy_to_user(ubuf, &bwr, sizeof(bwr))) - ret = -EFAULT; - goto err; - } - } - if (bwr.read_size > 0) { - ret = binder_thread_read(proc, thread, bwr.read_buffer, - bwr.read_size, - &bwr.read_consumed, - filp->f_flags & O_NONBLOCK); - trace_binder_read_done(ret); - if (!list_empty(&proc->todo)) - wake_up_interruptible(&proc->wait); - if (ret < 0) { - if (copy_to_user(ubuf, &bwr, sizeof(bwr))) - ret = -EFAULT; - goto err; - } - } - binder_debug(BINDER_DEBUG_READ_WRITE, - "%d:%d wrote %lld of %lld, read return %lld of %lld\n", - proc->pid, thread->pid, - (u64)bwr.write_consumed, (u64)bwr.write_size, - (u64)bwr.read_consumed, (u64)bwr.read_size); - if (copy_to_user(ubuf, &bwr, sizeof(bwr))) { - ret = -EFAULT; - goto err; - } break; - } case BINDER_SET_MAX_THREADS: if (copy_from_user(&proc->max_threads, ubuf, sizeof(proc->max_threads))) { ret = -EINVAL; @@ -2680,31 +2730,9 @@ static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) } break; case BINDER_SET_CONTEXT_MGR: - if (binder_context_mgr_node != NULL) { - pr_err("BINDER_SET_CONTEXT_MGR already set\n"); - ret = -EBUSY; + ret = binder_ioctl_set_ctx_mgr(filp); + if (ret) goto err; - } - if (uid_valid(binder_context_mgr_uid)) { - if (!uid_eq(binder_context_mgr_uid, curr_euid)) { - pr_err("BINDER_SET_CONTEXT_MGR bad uid %d != %d\n", - from_kuid(&init_user_ns, curr_euid), - from_kuid(&init_user_ns, binder_context_mgr_uid)); - ret = -EPERM; - goto err; - } - } else { - binder_context_mgr_uid = curr_euid; - } - binder_context_mgr_node = binder_new_node(proc, 0, 0); - if (binder_context_mgr_node == NULL) { - ret = -ENOMEM; - goto err; - } - binder_context_mgr_node->local_weak_refs++; - binder_context_mgr_node->local_strong_refs++; - binder_context_mgr_node->has_strong_ref = 1; - binder_context_mgr_node->has_weak_ref = 1; break; case BINDER_THREAD_EXIT: binder_debug(BINDER_DEBUG_THREADS, "%d:%d exit\n", -- cgit v1.2.3 From 403f8af323f0b3b1893ef257be5c5a41cd213d55 Mon Sep 17 00:00:00 2001 From: Chen Gang Date: Mon, 7 Jul 2014 16:49:24 +0800 Subject: drivers: staging: android: ion: Kconfig: Let it also depend on HAS_DMA ION need HAS_DMA (e.g. need DMA_SHARED_BUFFER), so it has to depend on HAS_DMA, or can not pass compiling with allmodconfig under score which NO_DMA. And the related error: CC drivers/staging/android/ion/ion_cma_heap.o drivers/staging/android/ion/ion_cma_heap.c: In function 'ion_cma_mmap': drivers/staging/android/ion/ion_cma_heap.c:168:2: error: implicit declaration of function 'dma_mmap_coherent' [-Werror=implicit-function-declaration] return dma_mmap_coherent(dev, vma, info->cpu_addr, info->handle, ^ cc1: some warnings being treated as errors make[4]: *** [drivers/staging/android/ion/ion_cma_heap.o] Error 1 make[3]: *** [drivers/staging/android/ion] Error 2 make[2]: *** [drivers/staging/android] Error 2 make[1]: *** [drivers/staging] Error 2 make: *** [drivers] Error 2 Signed-off-by: Chen Gang Signed-off-by: Greg Kroah-Hartman --- drivers/staging/android/ion/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/staging/android') diff --git a/drivers/staging/android/ion/Kconfig b/drivers/staging/android/ion/Kconfig index 0f8fec1f84e5..0a6e4d03c78a 100644 --- a/drivers/staging/android/ion/Kconfig +++ b/drivers/staging/android/ion/Kconfig @@ -1,6 +1,6 @@ menuconfig ION bool "Ion Memory Manager" - depends on HAVE_MEMBLOCK + depends on HAVE_MEMBLOCK && HAS_DMA select GENERIC_ALLOCATOR select DMA_SHARED_BUFFER ---help--- -- cgit v1.2.3 From 48d5bb4403a0380613267770f9dccb73ab7f98fa Mon Sep 17 00:00:00 2001 From: Jerry Stralko Date: Tue, 1 Jul 2014 07:13:18 -0400 Subject: staging: android: logger: fixed checkpatch.pl warnings. Signed-off-by: Jerry Stralko Signed-off-by: Greg Kroah-Hartman --- drivers/staging/android/logger.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) (limited to 'drivers/staging/android') diff --git a/drivers/staging/android/logger.c b/drivers/staging/android/logger.c index 2772e01b37f5..9b47e66599a3 100644 --- a/drivers/staging/android/logger.c +++ b/drivers/staging/android/logger.c @@ -110,8 +110,8 @@ static inline struct logger_log *file_get_log(struct file *file) struct logger_reader *reader = file->private_data; return reader->log; - } else - return file->private_data; + } + return file->private_data; } /* @@ -159,8 +159,7 @@ static size_t get_user_hdr_len(int ver) { if (ver < 2) return sizeof(struct user_logger_entry_compat); - else - return sizeof(struct logger_entry); + return sizeof(struct logger_entry); } static ssize_t copy_header_to_user(int ver, struct logger_entry *entry, -- cgit v1.2.3 From 6a44b50f9819571c2b871bffba107defec556a87 Mon Sep 17 00:00:00 2001 From: Lucas Tanure Date: Tue, 15 Jul 2014 00:32:35 -0300 Subject: staging: android: Clean up else statement from sync_fence_poll() Kernel coding style. Remove useless else statement after return. Signed-off-by: Lucas Tanure Signed-off-by: Greg Kroah-Hartman --- drivers/staging/android/sync.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'drivers/staging/android') diff --git a/drivers/staging/android/sync.c b/drivers/staging/android/sync.c index 18174f7c871c..cd7b8f59b948 100644 --- a/drivers/staging/android/sync.c +++ b/drivers/staging/android/sync.c @@ -687,8 +687,7 @@ static unsigned int sync_fence_poll(struct file *file, poll_table *wait) return POLLIN; else if (fence->status < 0) return POLLERR; - else - return 0; + return 0; } static long sync_fence_ioctl_wait(struct sync_fence *fence, unsigned long arg) -- cgit v1.2.3 From d4ec15e16ff0d72f9a3f1909b1ed20515f1f40d0 Mon Sep 17 00:00:00 2001 From: Lucas Tanure Date: Sun, 13 Jul 2014 21:31:05 -0300 Subject: staging: android: Clean up else statement from binder_send_failed_reply Kernel coding style. Remove useless else statement after return. Changes from v1 and v2: Fix warning for mixed declarations and code. Declaration of "struct binder_transaction *next" made outside of while. Changes from v3: Removed initialization to NULL for next variable. Signed-off-by: Lucas Tanure Signed-off-by: Greg Kroah-Hartman --- drivers/staging/android/binder.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) (limited to 'drivers/staging/android') diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c index e446f624a04e..02b0379ae550 100644 --- a/drivers/staging/android/binder.c +++ b/drivers/staging/android/binder.c @@ -1185,6 +1185,7 @@ static void binder_send_failed_reply(struct binder_transaction *t, uint32_t error_code) { struct binder_thread *target_thread; + struct binder_transaction *next; BUG_ON(t->flags & TF_ONE_WAY); while (1) { @@ -1212,24 +1213,23 @@ static void binder_send_failed_reply(struct binder_transaction *t, target_thread->return_error); } return; - } else { - struct binder_transaction *next = t->from_parent; + } + next = t->from_parent; - binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, - "send failed reply for transaction %d, target dead\n", - t->debug_id); + binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, + "send failed reply for transaction %d, target dead\n", + t->debug_id); - binder_pop_transaction(target_thread, t); - if (next == NULL) { - binder_debug(BINDER_DEBUG_DEAD_BINDER, - "reply failed, no target thread at root\n"); - return; - } - t = next; + binder_pop_transaction(target_thread, t); + if (next == NULL) { binder_debug(BINDER_DEBUG_DEAD_BINDER, - "reply failed, no target thread -- retry %d\n", - t->debug_id); + "reply failed, no target thread at root\n"); + return; } + t = next; + binder_debug(BINDER_DEBUG_DEAD_BINDER, + "reply failed, no target thread -- retry %d\n", + t->debug_id); } } -- cgit v1.2.3 From 657b8dbc49bce60cc3f58c5667b731d77fa8e734 Mon Sep 17 00:00:00 2001 From: Sachin Kamat Date: Thu, 17 Jul 2014 11:17:15 +0530 Subject: staging: ion: Remove left over comment Commit 2bb9f5034ec7 ("gpu: ion: Remove heapmask from client") removed the heap_type_mask parameter. Remove the associated kernel-doc comment too. Signed-off-by: Sachin Kamat Cc: Rebecca Schultz Zavin Cc: John Stultz Signed-off-by: Greg Kroah-Hartman --- drivers/staging/android/ion/ion.h | 1 - 1 file changed, 1 deletion(-) (limited to 'drivers/staging/android') diff --git a/drivers/staging/android/ion/ion.h b/drivers/staging/android/ion/ion.h index dcd2a0cdb192..d305bb7e9a74 100644 --- a/drivers/staging/android/ion/ion.h +++ b/drivers/staging/android/ion/ion.h @@ -84,7 +84,6 @@ void ion_reserve(struct ion_platform_data *data); /** * ion_client_create() - allocate a client and returns it * @dev: the global ion device - * @heap_type_mask: mask of heaps this client can allocate from * @name: used for debugging */ struct ion_client *ion_client_create(struct ion_device *dev, -- cgit v1.2.3 From f0ca3e87cc132b67c40ba1161cd02c8a2985ac4c Mon Sep 17 00:00:00 2001 From: Phong Tran Date: Sun, 20 Jul 2014 11:10:55 +0700 Subject: staging: android: ion: ion_cma_heap.c: Fix checkpatch warning This patch fix coding style: - Remove "fail memory allocation" waring - Remove return of void function Tested by compilation only Signed-off-by: Phong Tran Signed-off-by: Greg Kroah-Hartman --- drivers/staging/android/ion/ion_cma_heap.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) (limited to 'drivers/staging/android') diff --git a/drivers/staging/android/ion/ion_cma_heap.c b/drivers/staging/android/ion/ion_cma_heap.c index ce68ecfed31f..f8cabcbc39e5 100644 --- a/drivers/staging/android/ion/ion_cma_heap.c +++ b/drivers/staging/android/ion/ion_cma_heap.c @@ -76,10 +76,8 @@ static int ion_cma_allocate(struct ion_heap *heap, struct ion_buffer *buffer, return -EINVAL; info = kzalloc(sizeof(struct ion_cma_buffer_info), GFP_KERNEL); - if (!info) { - dev_err(dev, "Can't allocate buffer info\n"); + if (!info) return ION_CMA_ALLOCATE_FAILED; - } info->cpu_addr = dma_alloc_coherent(dev, len, &(info->handle), GFP_HIGHUSER | __GFP_ZERO); @@ -90,10 +88,8 @@ static int ion_cma_allocate(struct ion_heap *heap, struct ion_buffer *buffer, } info->table = kmalloc(sizeof(struct sg_table), GFP_KERNEL); - if (!info->table) { - dev_err(dev, "Fail to allocate sg table\n"); + if (!info->table) goto free_mem; - } if (ion_cma_get_sgtable (dev, info->table, info->cpu_addr, info->handle, len)) @@ -155,7 +151,6 @@ static struct sg_table *ion_cma_heap_map_dma(struct ion_heap *heap, static void ion_cma_heap_unmap_dma(struct ion_heap *heap, struct ion_buffer *buffer) { - return; } static int ion_cma_mmap(struct ion_heap *mapper, struct ion_buffer *buffer, -- cgit v1.2.3 From 80dd7052089f0ee847ba3dc7c5ad471c0ed18089 Mon Sep 17 00:00:00 2001 From: Fabian Frederick Date: Wed, 23 Jul 2014 21:04:38 +0200 Subject: staging: ion: vm_insert_pfn and zap_page_range rely on CONFIG_MMU Fix following sh-allmodconfig errors reported on kisskb " drivers/built-in.o: In function `ion_vm_fault': ion.c:(.text+0x1f2d8f8): undefined reference to `vm_insert_pfn' drivers/built-in.o: In function `ion_buffer_sync_for_device': ion.c:(.text+0x1f316bc): undefined reference to `zap_page_range' make: *** [vmlinux] Error 1 " Signed-off-by: Fabian Frederick Signed-off-by: Greg Kroah-Hartman --- drivers/staging/android/ion/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/staging/android') diff --git a/drivers/staging/android/ion/Kconfig b/drivers/staging/android/ion/Kconfig index 0a6e4d03c78a..345234624492 100644 --- a/drivers/staging/android/ion/Kconfig +++ b/drivers/staging/android/ion/Kconfig @@ -1,6 +1,6 @@ menuconfig ION bool "Ion Memory Manager" - depends on HAVE_MEMBLOCK && HAS_DMA + depends on HAVE_MEMBLOCK && HAS_DMA && MMU select GENERIC_ALLOCATOR select DMA_SHARED_BUFFER ---help--- -- cgit v1.2.3 From 6aa2621183ee0142ebbcadff59417f0f1c10ae15 Mon Sep 17 00:00:00 2001 From: Murilo Opsfelder Araujo Date: Mon, 28 Jul 2014 20:45:06 -0300 Subject: Staging: android: timed_output.c: use kstrtoint() instead of sscanf() This patch makes checkpatch.pl happy by fixing the following warning: WARNING: Prefer kstrto to single variable sscanf Signed-off-by: Murilo Opsfelder Araujo Signed-off-by: Greg Kroah-Hartman --- drivers/staging/android/timed_output.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'drivers/staging/android') diff --git a/drivers/staging/android/timed_output.c b/drivers/staging/android/timed_output.c index c341ac11c5a3..b41429f379fe 100644 --- a/drivers/staging/android/timed_output.c +++ b/drivers/staging/android/timed_output.c @@ -41,8 +41,10 @@ static ssize_t enable_store(struct device *dev, struct device_attribute *attr, { struct timed_output_dev *tdev = dev_get_drvdata(dev); int value; + int rc; - if (sscanf(buf, "%d", &value) != 1) + rc = kstrtoint(buf, 0, &value); + if (rc != 0) return -EINVAL; tdev->enable(tdev, value); -- cgit v1.2.3 From 80039faa8809461f8e23892e14277f9f0af45505 Mon Sep 17 00:00:00 2001 From: Murilo Opsfelder Araujo Date: Thu, 31 Jul 2014 08:34:11 -0300 Subject: Staging: android: timed_gpio.c: improved logic of gpio_get_time() This patch improves the logic of gpio_get_time() and, thereafter, makes checkpatch.pl happy. Signed-off-by: Murilo Opsfelder Araujo Signed-off-by: Greg Kroah-Hartman --- drivers/staging/android/timed_gpio.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) (limited to 'drivers/staging/android') diff --git a/drivers/staging/android/timed_gpio.c b/drivers/staging/android/timed_gpio.c index 180c209a009e..8fa4758517c0 100644 --- a/drivers/staging/android/timed_gpio.c +++ b/drivers/staging/android/timed_gpio.c @@ -45,16 +45,17 @@ static enum hrtimer_restart gpio_timer_func(struct hrtimer *timer) static int gpio_get_time(struct timed_output_dev *dev) { - struct timed_gpio_data *data = - container_of(dev, struct timed_gpio_data, dev); + struct timed_gpio_data *data; + struct timeval t; - if (hrtimer_active(&data->timer)) { - ktime_t r = hrtimer_get_remaining(&data->timer); - struct timeval t = ktime_to_timeval(r); + data = container_of(dev, struct timed_gpio_data, dev); - return t.tv_sec * 1000 + t.tv_usec / 1000; - } else + if (!hrtimer_active(&data->timer)) return 0; + + t = ktime_to_timeval(hrtimer_get_remaining(&data->timer)); + + return t.tv_sec * 1000 + t.tv_usec / 1000; } static void gpio_enable(struct timed_output_dev *dev, int value) -- cgit v1.2.3