git.stricted.de - GitHub/MotorolaMobilityLLC/kernel-slsi.git/log

ANDROID: trace: add non-hierarchical function_graph option

Add the 'funcgraph-flat' option to the function_graph tracer to use the default
trace printing format rather than the hierarchical formatting normally used.

Change-Id: If2900bfb86e6f8f51379f56da4f6fabafa630909
Signed-off-by: Jamie Gennis <jgennis@google.com>
[AmitP: Folded following android-4.9 commit changes into this patch
b96956e7a5de ("ANDROID: trace: fix compilation for 4.1")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: security,perf: Allow further restriction of perf_event_open

When kernel.perf_event_open is set to 3 (or greater), disallow all
access to performance events by users without CAP_SYS_ADMIN.
Add a Kconfig symbol CONFIG_SECURITY_PERF_EVENTS_RESTRICT that
makes this value the default.

This is based on a similar feature in grsecurity
(CONFIG_GRKERNSEC_PERF_HARDEN). This version doesn't include making
the variable read-only. It also allows enabling further restriction
at run-time regardless of whether the default is changed.

https://lkml.org/lkml/2016/1/11/587

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Bug: 29054680
Change-Id: Iff5bff4fc1042e85866df9faa01bce8d04335ab8

ANDROID: rtc-palmas: correct for bcd year

Replace bcd2bin and bin2bcd with one that maps years 1970 to 2129
in a pattern that works with the underlying hardware.

The only transition that does not work correctly for this rtc clock
is the transition from 2099 to 2100, it proceeds to 2000. The rtc
clock retains and transitions the year correctly in all other
circumstances.

Signed-off-by: Mark Salyzyn <salyzyn@google.com>
Bug: 26346842
Change-Id: Ie527700190b1ae4b4bc3c12279d875aa5985b168

ANDROID: power: wakeup: align wakeup_sources format

This aligns every column of elements in wakeup_sources to
conveniently check any specific column for suspicious power
consumption wakeup source or for other easily human readable purpose.

Change-Id: Iac8b0538170fcc0cca9f6857c15d9a4c62c8865e
Signed-off-by: yangdongdong <yangdongdong@xiaomi.com>

ANDROID: power: wakeup: Add the guard condition for len in pm_get_active_wakeup_sources

Check if the len is not greater than maximum to prevent buffer overflow.

Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
Change-Id: I575b0a72bb5448b68353408d71fa8b83420c9088

ANDROID: power: wakeup: Add last wake up source logging for suspend abort reason.

There is a possibility that a wakeup source event is received after
the device prepares to suspend which might cause the suspend to abort.

This patch adds the functionality of reporting the last active wakeup
source which is currently not active but caused the suspend to abort reason
via the /sys/kernel/power/last_wakeup_reason file.

Change-Id: I1760d462f497b33e425f5565cb6cff5973932ec3
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>

ANDROID: power: wakeup_reason: fix suspend time reporting

Suspend time reporting Change-Id: I2cb9a9408a5fd12166aaec11b935a0fd6a408c63
(Power: Report suspend times from last_suspend_time), is broken on 3.16+
kernels because get_xtime_and_monotonic_and_sleep_offset() hrtimer helper
routine is removed from kernel timekeeping.

The replacement helper routines ktime_get_update_offsets_{tick,now}()
are private to core kernel timekeeping so we can't use them, hence using
ktime_get() and ktime_get_boottime() instead and sampling the time twice.

Idea is to use Monotonic boottime offset to calculate total time spent
in last suspend state and CLOCK_MONOTONIC to calculate time spent in
last suspend-resume process.

Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: power: wakeup_reason: Report suspend times from last_suspend_time

This node epxorts two values separated by space.
From left to right:
1. time spent in suspend/resume process
2. time spent sleep in suspend state

Change-Id: I2cb9a9408a5fd12166aaec11b935a0fd6a408c63

ANDROID: power: wakeup_reason: Add check_wakeup_reason() to verify wakeup source irq

Wakeup reason is set before driver resume handlers are called.
It is cleared before driver suspend handlers are called, on
PM_SUSPEND_PREPARE.

Change-Id: I04218c9b0c115a7877e8029c73e6679ff82e0aa4
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>

ANDROID: power: wakeup_reason: Adds functionality to log the last suspend abort reason.

Extends the last_resume_reason to log suspend abort reason. The abort
reasons will have "Abort:" appended at the start to distinguish itself
from the resume reason.

Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
Change-Id: I3207f1844e3d87c706dfc298fb10e1c648814c5f

[AmitP: Folded following android-4.9 changes into this patch
        00a83e61b4fc ("ANDROID: Make suspend abort reason logging depend on CONFIG_PM_SLEEP")
        9d17e24b036e ("ANDROID: wakeup_reason: use vsnprintf instead of snsprintf for vargs.")
        7961972600ba ("ANDROID: power: Provide dummy log_suspend_abort_reason() if SUSPEND is disabled")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: power: wakeup_reason: Avoids bogus error messages for the suspend aborts.

Avoids printing bogus error message "tasks refusing to freeze", in cases
where pending wakeup source caused the suspend abort.

Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
Change-Id: I913ad290f501b31cd536d039834c8d24c6f16928

ANDROID: power: wakeup_reason: Add guard condition for maximum wakeup reasons

Ensure the array for the wakeup reason IRQs does not overflow.

Change-Id: Iddc57a3aeb1888f39d4e7b004164611803a4d37c
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
(cherry picked from commit b5ea40cdfcf38296535f931a7e5e7bf47b6fad7f)

ANDROID: power: wakeup_reason: add an API to log wakeup reasons

Add API log_wakeup_reason() and expose it to userspace via sysfs path
/sys/kernel/wakeup_reasons/last_resume_reason

Change-Id: I81addaf420f1338255c5d0638b0d244a99d777d1
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
[AmitP: Folded following android-4.9 commit changes into this patch
        1135122a192a ("ANDROID: POWER: fix compile warnings in log_wakeup_reason")
        b4e6247778b0 ("ANDROID: Power: Changes the permission to read only for sysfs file /sys/kernel/wakeup_reasons/last_resume_reason")
        e13dbc7c69cd ("ANDROID: power: wakeup_reason: rename irq_count to irqcount")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: power: power_supply: Add property CHARGE_COUNTER_EXT and 64-bit precision properties

Add POWER_SUPPLY_PROP_CHARGE_COUNTER_EXT that stores accumulated charge
in nAh units as a signed 64-bit value.

Add generic support for signed 64-bit property values.

Change-Id: I2bd34b1e95ffba24e7bfef81f398f22bd2aaf05e
Signed-off-by: Todd Poynor <toddpoynor@google.com>

ANDROID: power: power_supply: add POWER_SUPPLY_PROP_CHARGE_ENABLED

Change-Id: I3e93b502452811cbfc4d904202b4f1d94edc143d
Signed-off-by: Todd Poynor <toddpoynor@google.com>

ANDROID: power: power_supply: add POWER_SUPPLY_PROP_USB_OTG

Change-Id: Idfc6ef2e37d62aad6f26cc8eafa53db642cd352b
Signed-off-by: Todd Poynor <toddpoynor@google.com>

ANDROID: power: power_supply: Add custom property for USB High Current mode

For smb347.

Change-Id: I3323469072e1ee5085d61af8a89612b06b91f94a
Signed-off-by: Todd Poynor <toddpoynor@google.com>
[AmitP: Folded following android-4.9 commit changes into this patch
af4f6ce7f57b ("ANDROID: power: power_supply: move POWER_SUPPLY_PROP_USB_HC to type 'int' order")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: arm64: copy CONFIG_CMDLINE_EXTEND from ARM

Copy the config choice for CONFIG_CMDLINE_EXTEND from
arch/arm/Kconfig, including CONFIG_CMDLINE_FROM_BOOTLOADER
as the default. These will be used by drivers/of/fdt.c.

Change-Id: I8416038498ddf8fc1e99ab06109825eb1492aa7f
Signed-off-by: Colin Cross <ccross@android.com>

ANDROID: of: Support CONFIG_CMDLINE_EXTEND config option

The old logic assumes CMDLINE_FROM_BOOTLOADER vs. CMDLINE_FORCE and
ignores CMDLINE_EXTEND.  Here's the old logic:

- CONFIG_CMDLINE_FORCE=true
    CONFIG_CMDLINE
- dt bootargs=non-empty:
    dt bootargs
- dt bootargs=empty, @data is non-empty string
    @data is left unchanged
- dt bootargs=empty, @data is empty string
    CONFIG_CMDLINE (or "" if that's not defined)

The new logic is now documented in of_fdt.h and is copied here for
reference:

- CONFIG_CMDLINE_FORCE=true
    CONFIG_CMDLINE
- CONFIG_CMDLINE_EXTEND=true, @data is non-empty string
    @data + dt bootargs (even if dt bootargs are empty)
- CONFIG_CMDLINE_EXTEND=true, @data is empty string
    CONFIG_CMDLINE + dt bootargs (even if dt bootargs are empty)
- CMDLINE_FROM_BOOTLOADER=true, dt bootargs=non-empty:
    dt bootargs
- CMDLINE_FROM_BOOTLOADER=true, dt bootargs=empty, @data is non-empty string
    @data is left unchanged
- CMDLINE_FROM_BOOTLOADER=true, dt bootargs=empty, @data is empty string
    CONFIG_CMDLINE (or "" if that's not defined)

Signed-off-by: Doug Anderson <dianders@chromium.org>
CC: devicetree-discuss@lists.ozlabs.org
CC: Grant Likely <grant.likely@secretlab.ca>
CC: Benjamin Herrenschmidt <benh@kernel.crashing.org>
CC: Rob Herring <rob.herring@calxeda.com>
Change-Id: I40ace250847f813358125dfcaa8998fd32cf7ea3
Signed-off-by: Colin Cross <ccross@android.com>
[AmitP: Folded following android-4.9 commit changes into this patch
        e820270abb5d ("ANDROID: of: fix CONFIG_CMDLINE_EXTEND")
        9a4a74055444 ("ANDROID: of: Fix build warnings")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: NFC: st21nfca: Fix memory OOB and leak issues in connectivity events handler

Overflow on memcpy is possible in kernel driver for st21nfca's
NFC HCI layer when handling connectivity events if aid_len or
params_len are bigger than the buffer size.
Memory leak is possible when parameter tag is invalid.

Bug: 62679581

Signed-off-by: Suren Baghdasaryan <surenb@google.com>

ANDROID: NFC: Fix possible memory corruption when handling SHDLC I-Frame commands

When handling SHDLC I-Frame commands "pipe" field used for indexing
into an array should be checked before usage. If left unchecked it
might access memory outside of the array of size NFC_HCI_MAX_PIPES(127).

Bug: 62679701

Signed-off-by: Suren Baghdasaryan <surenb@google.com>

ANDROID: nfc: fdp: Fix possible buffer overflow in WCS4000 NFC driver

Possible buffer overflow when reading next_read_size bytes into
tmp buffer after next_read_size was extracted from a previous packet.

Bug: 62678828

Signed-off-by: Suren Baghdasaryan <surenb@google.com>

ANDROID: NFC: st21nfca: Fix out of bounds kernel access when handling ATR_REQ

Out of bounds kernel accesses in st21nfca's NFC HCI layer
might happen when handling ATR_REQ events if user-specified
atr_req->length is bigger than the buffer size. In
that case memcpy() inside st21nfca_tm_send_atr_res() will
read extra bytes resulting in OOB read from the kernel heap.

Bug: 62679012

Signed-off-by: Suren Baghdasaryan <surenb@google.com>

ANDROID: netfilter: xt_IDLETIMER: Fix use after free condition during work

schedule_work(&timer->work) appears to be called after
cancel_work_sync(&info->timer->work) is completed.
Work can be scheduled from the PM_POST_SUSPEND notification event
even after cancel_work_sync is called.

Call stack

-004|notify_netlink_uevent(
    |    [X19] timer = 0xFFFFFFC0A5DFC780 -> (
    |      ...
    |      [NSD:0xFFFFFFC0A5DFC800] kobj = 0x6B6B6B6B6B6B6B6B,
    |      [NSD:0xFFFFFFC0A5DFC868] timeout = 0x6B6B6B6B,
    |      [NSD:0xFFFFFFC0A5DFC86C] refcnt = 0x6B6B6B6B,
    |      [NSD:0xFFFFFFC0A5DFC870] work_pending = 0x6B,
    |      [NSD:0xFFFFFFC0A5DFC871] send_nl_msg = 0x6B,
    |      [NSD:0xFFFFFFC0A5DFC872] active = 0x6B,
    |      [NSD:0xFFFFFFC0A5DFC874] uid = 0x6B6B6B6B,
    |      [NSD:0xFFFFFFC0A5DFC878] suspend_time_valid = 0x6B))
-005|idletimer_tg_work(
-006|__read_once_size(inline)
-006|static_key_count(inline)
-006|static_key_false(inline)
-006|trace_workqueue_execute_end(inline)
-006|process_one_work(
-007|worker_thread(
-008|kthread(
-009|ret_from_fork(asm)
---|end of frame

Force any pending idletimer_tg_work() to complete before freeing
the associated work struct and after unregistering to the pm_notifier
callback.

Change-Id: I4c5f0a1c142f7d698c092cf7bcafdb0f9fbaa9c1
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>

ANDROID: netfilter: xt_IDLETIMER: Adds the uid field in the msg

Message notifications contains an additional uid field. This field
represents the uid that was responsible for waking the radio. And hence
it is present only in notifications stating that the radio is now
active.

Change-Id: I18fc73eada512e370d7ab24fc9f890845037b729
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
Bug: 20264396

[AmitP: Folded following android-4.9 commit changes into this patch
22ea73dee036 ("nf: IDLETIMER: Fix broken uid field in the msg")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: netfilter: xt_IDLETIMER: time-stamp and suspend/resume handling.

Message notifications contains an additional timestamp field in nano seconds.
The expiry time for the timers are modified during suspend/resume.
If timer was supposed to expire while the system is suspended then a
notification is sent when it resumes with the timestamp of the scheduled expiry.

Removes the race condition for multiple work scheduled.

Bug: 13247811

Change-Id: I752c5b00225fe7085482819f975cc0eb5af89bff
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
[AmitP: Folded following android-4.9 commit changes into this patch
13e257eaa624 ("nf: Remove compilation error caused by e8430cbed3ef15fdb1ac26cfd020e010aa5f1c35")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: netfilter: xt_IDLETIMER: Add new netlink msg type

Send notifications when the label becomes active after an idle period.
Send netlink message notifications in addition to sysfs notifications.
Using a uevent with
  subsystem=xt_idletimer
  INTERFACE=...
  STATE={active,inactive}

This is backport from common android-3.0
commit: beb914e987cbbd368988d2b94a6661cb907c4d5a
with uevent support instead of a new netlink message type.

Change-Id: I31677ef00c94b5f82c8457e5bf9e5e584c23c523
Signed-off-by: Ashish Sharma <ashishsharma@google.com>
Signed-off-by: JP Abgrall <jpa@google.com>

ANDROID: netfilter: xt_qtaguid: Use sk_uid to replace uid get from socket file

Retrieve socket uid from the sk_uid field added to struct sk instead of
read it from sk->socket->file. It prevent the packet been dropped when
the socket file doesn't exist.

Bug: 37524657
Signed-off-by: Chenbo Feng <fengc@google.com>
Change-Id: Ic58239c1f9aa7e0eb1d4d1c09d40b845fd4e8e57

ANDROID: netfilter: xt_qtaguid: fix handling for cases where tunnels are used.

* fix skb->dev vs par->in/out
When there is some forwarding going on, it introduces extra state
around devs associated with xt_action_param->in/out and sk_buff->dev.
E.g.
par->in and par->out are both set, or
skb->dev and par->out are both set (and different)
This would lead qtaguid to make the wrong assumption about the
direction and update the wrong device stats.
Now we rely more on par->in/out.

* Fix handling when qtaguid is used as "owner"
When qtaguid is used as an owner module, and sk_socket->file is
not there (happens when tunnels are involved), it would
incorrectly do a tag stats update.

* Correct debug messages.

Bug: 11687690
Change-Id: I2b1ff8bd7131969ce9e25f8291d83a6280b3ba7f
CRs-Fixed: 747810
Signed-off-by: JP Abgrall <jpa@google.com>
Git-commit: 2b71479d6f5fe8f33b335f713380f72037244395
Git-repo: https://www.codeaurora.org/cgit/quic/la/kernel/mediatek
[imaund@codeaurora.org: Resolved trivial context conflicts.]
Signed-off-by: Ian Maund <imaund@codeaurora.org>
[bflowers@codeaurora.org: Resolved merge conflicts]
Signed-off-by: Bryse Flowers <bflowers@codeaurora.org>
Signed-off-by: Chenbo Feng <fengc@google.com>

ANDROID: netfilter: xt_qtaguid: handle properly request sockets

To match rules related to uid/gid for syn recv packets
we need to get the full socket from request_sock struct.

Bug: 63917742
Change-Id: I03acb2251319fd800d0e36a6dde30fc1fbb7d1b0
Signed-off-by: Simon Dubray <simonx.dubray@intel.com>

ANDROID: netfilter: xt_qtaguid: Add untag hacks to inet_release function

To prevent protential risk of memory leak caused by closing socket with
out untag it from qtaguid module, the qtaguid module now do not hold any
socket file reference count. Instead, it will increase the sk_refcnt of
the sk struct to prevent a reuse of the socket pointer. And when a socket
is released. It will delete the tag if the socket is previously tagged so
no more resources is held by xt_qtaguid moudle. A flag is added to the untag
process to prevent possible kernel crash caused by fail to delete
corresponding socket_tag_entry list.
Bug: 36374484
Test: compile and run test under system/extra/test/iptables,
run cts -m CtsNetTestCases -t android.net.cts.SocketRefCntTest

Signed-off-by: Chenbo Feng <fengc@google.com>
Change-Id: Iea7c3bf0c59b9774a5114af905b2405f6bc9ee52

ANDROID: netfilter: xt_qtaguid: don't check if embedded arrays are NULL

clang warns about four NULL pointer checks:

net/netfilter/xt_qtaguid.c:973:11: warning: address of array 'ifa->ifa_label' will always evaluate to 'true' [-Wpointer-bool-conversion]
net/netfilter/xt_qtaguid.c:974:13: warning: address of array 'ifa->ifa_label' will always evaluate to 'true' [-Wpointer-bool-conversion]
net/netfilter/xt_qtaguid.c:1212:31: warning: address of array 'el_dev->name' will always evaluate to 'true' [-Wpointer-bool-conversion]
net/netfilter/xt_qtaguid.c:1640:31: warning: address of array 'el_dev->name' will always evaluate to 'true' [-Wpointer-bool-conversion]

Both of these fields are embedded char[16] arrays rather than pointers,
so they can never be NULL.

Change-Id: I748ff6dd11569e5596a9d5cecdf9c334847e7307
Signed-off-by: Greg Hackmann <ghackmann@google.com>

ANDROID: netfilter: xt_qtaguid: fix the deadlock when enable DDEBUG

When DDEBUG is enabled, the prdebug_full_state() function will try to
recursively aquire the spinlock of sock_tag_list and causing deadlock. A
check statement is added before it aquire the spinlock to differentiate
the behavior depend on the caller of the function.

Bug: 36559739
Test: Compile and run test under system/extra/test/iptables/
Change-Id: Ie3397fbaa207e14fe214d47aaf5e8ca1f4a712ee
Signed-off-by: Chenbo Feng <fengc@google.com>
(cherry picked from commit f0faedd6b468777f3bb5834f97100794d562c8b7)

ANDROID: netfilter: xt_qtaguid: Don't show empty tag stats for unprivileged uids

BUG: 27577101
BUG: 27532522
Change-Id: Ibee3c5d224f139b9312a40acb203e87aa7060797
Signed-off-by: Mohamad Ayyash <mkayyash@google.com>

ANDROID: netfilter: xt_qtaguid: Fix panic caused by processing non-full socket.

In an issue very similar to 4e461c777e3 (xt_qtaguid: Fix panic
caused by synack processing), we were seeing panics on occasion
in testing.

In this case, it was the same issue, but caused by a different
call path, as the sk being returned from qtaguid_find_sk() was
not a full socket. Resulting in the sk->sk_socket deref to fail.

This patch adds an extra check to ensure the sk being retuned
is a full socket, and if not it returns NULL.

Reported-by: Milosz Wasilewski <milosz.wasilewski@linaro.org>
Signed-off-by: John Stultz <john.stultz@linaro.org>

ANDROID: netfilter: xt_qtaguid: Fix panic caused by synack processing

In upstream commit ca6fb06518836ef9b65dc0aac02ff97704d52a05
(tcp: attach SYNACK messages to request sockets instead of
listener)
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ca6fb0651883

The building of synack messages was changed, which made it so
the skb->sk points to a casted request_sock. This is problematic,
as there is no sk_socket in a request_sock. So when the qtaguid_mt
function tries to access the sk->sk_socket, it accesses uninitialized
memory.

After looking at how other netfilter implementations handle this,
I realized there was a skb_to_full_sk() helper added, which the
xt_qtaguid code isn't yet using.

This patch adds its use, and resovles panics seen when accessing
uninitialzed memory when processing synack packets.

Reported-by: YongQin Liu <yongquin.liu@linaro.org>
Signed-off-by: John Stultz <john.stultz@linaro.org>

ANDROID: netfilter: xt_qtaguid: fix a race condition in if_tag_stat_update

Miss a lock protection in if_tag_stat_update while doing get_iface_entry. So if
one CPU is doing iface_stat_create while another CPU is doing if_tag_stat_update,
race will happened.

Change-Id: Ib8d98e542f4e385685499f5b7bb7354f08654a75
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>

ANDROID: netfilter: xt_qtaguid: xt_socket: build fixes

Add missing header <linux/miscdevice.h> and use
xt_socket_lookup_slow_v* instead of xt_socket_get*_sk
in xt_qtaguid.c.

Fix xt_socket_lookup_slow_v* functions in xt_socket.c
and declare them in xt_socket.h

Change-Id: I55819b2d4ffa82a2be20995c87d28fb5cc77b5ba
Signed-off-by: John Stultz <john.stultz@linaro.org>
[AmitP: Upstream commit 8db4c5be88f6 ("netfilter: move socket lookup
        infrastructure to nf_socket_ipv{4,6}.c")] moved socket lookup
        to nf_socket_ipv{4,6}.c, hence use nf_sk_lookup_slow_v[4|6]()
        instead of obsolete xt_socket_lookup_slow_v[4|6]().

        Also folded following android-4.9 commit changes into this patch
        7de1bb86dc5a ("ANDROID: netfilter: xt_qtaguid/socket: build fixes for 4.4")
        5b5ab94817f9 ("ANDROID: netfilter: xt_qtaguid: seq_printf fixes")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: netfilter: xt_socket/nf_socket: fix refcount underflow and crash

nf_socket_get_sock_v[4|6]() do not always increment sock refcount, which
causes confusion in xt_qtaguid module which is not aware of this fact
and drops the reference whether it should have or not. Fix it by
changing nf_socket_get_sock_v[4|6]() to always increment recount of returned
sock.

This should fix the following crash:

[  111.319523] BUG: failure at
/mnt/host/source/src/third_party/kernel/v3.18/net/ipv4/inet_timewait_sock.c:90/__inet_twsk_kill()!
[  111.331192] Kernel panic - not syncing: BUG!
[  111.335468] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G     U  W
3.18.0-06867-g268df91 #1
[  111.343810] Hardware name: Google Tegra210 Smaug Rev 1+ (DT)
[  111.349463] Call trace:
[  111.351917] [<ffffffc000207288>] dump_backtrace+0x0/0x10c
[  111.357314] [<ffffffc0002073a4>] show_stack+0x10/0x1c
[  111.362367] [<ffffffc000a82d1c>] dump_stack+0x74/0x94
[  111.367414] [<ffffffc000a81824>] panic+0xec/0x238
[  111.372116] [<ffffffc000981648>] __inet_twsk_kill+0xd0/0xf8
[  111.377684] [<ffffffc0009817b0>] inet_twdr_do_twkill_work+0x64/0xd0
[  111.383946] [<ffffffc000981a5c>] inet_twdr_hangman+0x2c/0xa4
[  111.389602] [<ffffffc000271cf0>] call_timer_fn+0xac/0x160
[  111.394995] [<ffffffc00027250c>] run_timer_softirq+0x23c/0x274
[  111.400824] [<ffffffc000220a68>] __do_softirq+0x1a4/0x330
[  111.406218] [<ffffffc000220e94>] irq_exit+0x70/0xd0
[  111.411093] [<ffffffc000264e00>] __handle_domain_irq+0x84/0xa8
[  111.416922] [<ffffffc0002003ec>] gic_handle_irq+0x4c/0x80

b/22476945

Originally reviewed at:
https://chromium-review.googlesource.com/#/c/297414/

Change-Id: I51fa94a9d92a84a0bd3b58466d711e46a6892a79
Signed-off-by: Dmitry Torokhov <dtor@google.com>
[jstultz: Cherry-picked and added missing local var definition]
Signed-off-by: John Stultz <john.stultz@linaro.org>
[AmitP: Refactored the original changes based on upstream commit,
        8db4c5be88f6 ("netfilter: move socket lookup infrastructure to nf_socket_ipv{4,6}.c"),
        changes. Also use refcount_inc instead of atomic_inc to align with
        41c6d650f653 ("net: convert sock.sk_refcnt from atomic_t to refcount_t")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: netfilter: xt_qtaguid: Use sk_callback_lock read locks before reading sk->sk_socket

It prevents a kernel panic when accessing sk->sk_socket fields due to NULLing sk->sk_socket when sock_orphan is called through
sk_common_release.

Change-Id: I4aa46b4e2d8600e4d4ef8dcdd363aa4e6e5f8433
Signed-off-by: Mohamad Ayyash <mkayyash@google.com>
(cherry picked from commit cdea0ebcb8bcfe57688f6cb692b49e550ebd9796)
Signed-off-by: John Stultz <john.stultz@linaro.org>

ANDROID: netfilter: xt_qtaguid/xt_socket: Build fixups

Fix up build kuid/kguid build issues in netfilter code.

Also re-add the xt_socket_get/put_sk interfaces needed by xt_qtaguid.

Change-Id: I7027fb840e109785bddffe8ea717b8d018b26d82
Signed-off-by: John Stultz <john.stultz@linaro.org>
[AmitP: Folded following android-4.9 commit changes into this patch
        da5ea99a74f2 ("ANDROID: netfilter: xt_qtaguid: fix seq_printf type mismatch warning")
        070eff8f023c ("ANDROID: netfilter: xt_qtaguid: fix broken uid/gid range check")]
        2879b6ec24ee ("ANDROID: xt_qtaguid: use sock_gen_put() instead of xt_socket_put_sk()")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: netfilter: xt_qtaguid: Fix boot panic

We need the change below because of mainline commit 351638e7de (net: pass
info struct via netdevice notifier). Otherwise we panic.

Change-Id: I7daf7513a733933fdcbaeebea7f8191f8b6a0432
Signed-off-by: John Stultz <john.stultz@linaro.org>

ANDROID: netfilter: xt_qtaguid: fix bad tcp_time_wait sock handling

Since (41063e9 ipv4: Early TCP socket demux), skb's can have an sk which
is not a struct sock but the smaller struct inet_timewait_sock without an
sk->sk_socket. Now we bypass sk_state == TCP_TIME_WAIT

Signed-off-by: JP Abgrall <jpa@google.com>

ANDROID: netfilter: xt_qtaguid: 3.10 fixes

Stop using obsolete procfs api.

Signed-off-by: Arve Hjønnevåg <arve@android.com>
[AmitP: Folded following android-4.9 commit changes into this patch
564729173b12 ("netfilter: xt_qtaguid: fix memory leak in seq_file handlers")
85a2eb5b48fc ("ANDROID: netfilter: xt_qtaguid: 64-bit warning fixes")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: netfilter: xt_qtaguid: rate limit some of the printks

Some of the printks are in the packet handling path.
We now ratelimit the very unlikely errors to avoid
kmsg spamming.

Signed-off-by: JP Abgrall <jpa@google.com>

ANDROID: netfilter: xt_qtaguid: Allow tracking loopback

In the past it would always ignore interfaces with loopback addresses.
Now we just treat them like any other.
This also helps with writing tests that check for the presence
of the qtaguid module.

Signed-off-by: JP Abgrall <jpa@google.com>

ANDROID: netfilter: xt_qtaguid: extend iface stat to report protocols

In the past the iface_stat_fmt would only show global bytes/packets
for the skb-based numbers.
For stall detection in userspace, distinguishing tcp vs other protocols
makes it easier.
Now we report
ifname total_skb_rx_bytes total_skb_rx_packets total_skb_tx_bytes
total_skb_tx_packets {rx,tx}_{tcp,udp,ohter}_{bytes,packets}

Bug: 6818637
Signed-off-by: JP Abgrall <jpa@google.com>

ANDROID: netfilter: xt_qtaguid: remove AID_* dependency for access control

qtaguid limits what can be done with /ctrl and /stats based on group
membership.
This changes removes AID_NET_BW_STATS and AID_NET_BW_ACCT, and picks
up the groups from the gid of the matching proc entry files.

Signed-off-by: JP Abgrall <jpa@google.com>
Change-Id: I42e477adde78a12ed5eb58fbc0b277cdaadb6f94

ANDROID: netfilter: xt_qtaguid: Don't BUG_ON if create_if_tag_stat fails

If create_if_tag_stat fails to allocate memory (GFP_ATOMIC) the
following will happen:

qtaguid: iface_stat: tag stat alloc failed
...
kernel BUG at xt_qtaguid.c:1482!

Signed-off-by: Pontus Fuchs <pontus.fuchs@gmail.com>

ANDROID: netfilter: xt_qtaguid: fix error exit that would keep a spinlock.

qtudev_open() could return with a uid_tag_data_tree_lock held
when an kzalloc(..., GFP_ATOMIC) would fail.
Very unlikely to get triggered AND survive the mayhem of running out of mem.

Signed-off-by: JP Abgrall <jpa@google.com>

ANDROID: netfilter: xt_qtaguid: report only uid tags to non-privileged processes

In the past, a process could only see its own stats (uid-based summary,
and details).
Now we allow any process to see other UIDs uid-based stats, but still
hide the detailed stats.

Change-Id: I7666961ed244ac1d9359c339b048799e5db9facc
Signed-off-by: JP Abgrall <jpa@google.com>

ANDROID: netfilter: xt_qtaguid: start tracking iface rx/tx at low level

qtaguid tracks the device stats by monitoring when it goes up and down,
then it gets the dev_stats().
But devs don't correctly report stats (either they don't count headers
symmetrically between rx/tx, or they count internal control messages).

Now qtaguid counts the rx/tx bytes/packets during raw:prerouting and
mangle:postrouting (nat is not available in ipv6).

The results are in
/proc/net/xt_qtaguid/iface_stat_fmt
which outputs a format line (bash expansion):
ifname total_skb_{rx,tx}_{bytes,packets}

Added event counters for pre/post handling.
Added extra ctrl_*() pid/uid debugging.

Change-Id: Id84345d544ad1dd5f63e3842cab229e71d339297
Signed-off-by: JP Abgrall <jpa@google.com>

ANDROID: netfilter: xt_qtaguid: fix ipv6 protocol lookup

When updating the stats for a given uid it would incorrectly assume
IPV4 and pick up the wrong protocol when IPV6.

Change-Id: Iea4a635012b4123bf7aa93809011b7b2040bb3d5
Signed-off-by: JP Abgrall <jpa@google.com>

ANDROID: netfilter: xt_qtaguid: add qtaguid matching module

This module allows tracking stats at the socket level for given UIDs.
It replaces xt_owner.
If the --uid-owner is not specified, it will just count stats based on
who the skb belongs to. This will even happen on incoming skbs as it
looks into the skb via xt_socket magic to see who owns it.
If an skb is lost, it will be assigned to uid=0.

To control what sockets of what UIDs are tagged by what, one uses:
  echo t $sock_fd $accounting_tag $the_billed_uid \
     > /proc/net/xt_qtaguid/ctrl
So whenever an skb belongs to a sock_fd, it will be accounted against
   $the_billed_uid
  and matching stats will show up under the uid with the given
   $accounting_tag.

Because the number of allocations for the stats structs is not that big:
  ~500 apps * 32 per app
we'll just do it atomic. This avoids walking lists many times, and
the fancy worker thread handling. Slabs will grow when needed later.

It use netdevice and inetaddr notifications instead of hooks in the core dev
code to track when a device comes and goes. This removes the need for
exposed iface_stat.h.

Put procfs dirs in /proc/net/xt_qtaguid/
  ctrl
  stats
  iface_stat/<iface>/...
The uid stats are obtainable in ./stats.

Change-Id: I01af4fd91c8de651668d3decb76d9bdc1e343919
Signed-off-by: JP Abgrall <jpa@google.com>
[AmitP: Folded following android-4.9 commit changes into this patch
        e5d798684a71 ("ANDROID: netfilter: qtaguid: initialize a local var to keep compiler happy")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: netfilter: xt_quota2: fixup the quota2, and enable.

The xt_quota2 came from
  http://sourceforge.net/projects/xtables-addons/develop

It needed tweaking for it to compile within the kernel tree.
Fixed kmalloc() and create_proc_entry() invocations within
a non-interruptible context.
Removed useless copying of current quota back to the iptable's
struct matchinfo:
  - those are per CPU: they will change randomly based on which
    cpu gets to update the value.
  - they prevent matching a rule: e.g.
      -A chain -m quota2 --name q1 --quota 123
     can't be followed by
      -D chain -m quota2 --name q1 --quota 123
    as the 123 will be compared to the struct matchinfo's quota member.
Use the NETLINK NETLINK_NFLOG family to log a single message
when the quota limit is reached.
It uses the same packet type as ipt_ULOG, but
- never copies skb data,
- uses 112 as the event number (ULOG's +1)
It doesn't log if the module param "event_num" is 0.

Change-Id: I021d3b743db3b22158cc49acb5c94d905b501492
Signed-off-by: JP Abgrall <jpa@google.com>
[AmitP: Fix quota2_log() call and use ktime directly to align with
        upstream commits 2456e8553544 ("ktime: Get rid of the union") and
        613dbd95723a ("netfilter: x_tables: move hook state into xt_action_param structure").

        Also folded following android-4.9 commit changes into this patch
        eb6aba2a14b9 ("ANDROID: netfilter: xt_quota2: 3.10 fixes.")
        Parts of 85a2eb5b48fc ("ANDROID: netfilter: xt_qtaguid: 64-bit warning fixes")
        89f9044e826c ("ANDROID: net: kuid/kguid build fixes")
        60d4c172c5cd ("ANDROID: netfilter: xt_quota2: make quota2_log work well")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: netfilter: xt_quota2: adding the original quota2 from xtables-addons

The original xt_quota in the kernel is plain broken:
  - counts quota at a per CPU level
    (was written back when ubiquitous SMP was just a dream)
  - provides no way to count across IPV4/IPV6.

This patch is the original unaltered code from:
  http://sourceforge.net/projects/xtables-addons

  at commit e84391ce665cef046967f796dd91026851d6bbf3

Change-Id: I19d49858840effee9ecf6cff03c23b45a97efdeb
Signed-off-by: JP Abgrall <jpa@google.com>

ANDROID: net: xfrm: check dir value of xfrm_userpolicy_id

Check user provided dir value to prevent out-of-bound access
which may occur if dir is not less than XFRM_POLICY_MAX.

(url: http://seclists.org/bugtraq/2017/Jul/30)

Bug: 64257838
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Change-Id: I5bbdf95e14a61bdf5207977d9a5a4465bc848da0

ANDROID: net: xfrm: make PF_KEY SHA256 use RFC-compliant truncation.

When using the PF_KEY interface, SHA-256 hashes are hardcoded to
use 96-bit truncation. This is a violation of RFC4868, which
specifies 128-bit truncation, but will not be fixed upstream due
to backwards compatibility concerns and because the PF_KEY
interface is deprecated in favour of netlink XFRM (which allows
the app to specify an arbitrary truncation length).

Change the hardcoded truncation length from 96 to 128 so that
PF_KEY apps such as racoon will work with standards-compliant VPN
servers.

Bug: 34114242
Change-Id: Ie46bff4b6358f18117d0be241171d677d31d33f7
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>

ANDROID: net: wireless: wlcore: Disable filtering in AP role

When you configure (set it up) a STA interface, the driver
install a multicast filter. This is normal behavior, when
one application subscribe to multicast address the filter
is updated. When Access Point interface is configured, there
is no filter installation and the "filter update" path is
disabled in the driver.

The problem happens when you switch an interface from STA
type to AP type. The filter is installed but there are no
means to update it.

Change-Id: Ied22323af831575303abd548574918baa9852dd0
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: net: wireless: Decrease scan entry expiration to avoid stall results

Change-Id: I0e23ce45d78d7c17633670973f49943a5ed6032d
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>

ANDROID: net: rfkill: Introduce CONFIG_RFKILL_PM and use instead of CONFIG_PM to power down

Some platforms do not want to power down rfkill devices on suspend.

Change-Id: I62a11630521c636d54a4a02ab9037a43435925f5
Signed-off-by: Nick Pelly <npelly@google.com>
[AmitP: Folded following android-4.9 commit changes into this patch
faad2b874fea ("rfkill: fix unused function warning")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: net: ipv6: autoconf routes into per-device tables

Currently, IPv6 router discovery always puts routes into
RT6_TABLE_MAIN. This causes problems for connection managers
that want to support multiple simultaneous network connections
and want control over which one is used by default (e.g., wifi
and wired).

To work around this connection managers typically take the routes
they prefer and copy them to static routes with low metrics in
the main table. This puts the burden on the connection manager
to watch netlink to see if the routes have changed, delete the
routes when their lifetime expires, etc.

Instead, this patch adds a per-interface sysctl to have the
kernel put autoconf routes into different tables. This allows
each interface to have its own autoconf table, and choosing the
default interface (or using different interfaces at the same
time for different types of traffic) can be done using
appropriate ip rules.

The sysctl behaves as follows:

- = 0: default. Put routes into RT6_TABLE_MAIN as before.
- > 0: manual. Put routes into the specified table.
- < 0: automatic. Add the absolute value of the sysctl to the
       device's ifindex, and use that table.

The automatic mode is most useful in conjunction with
net.ipv6.conf.default.accept_ra_rt_table. A connection manager
or distribution could set it to, say, -100 on boot, and
thereafter just use IP rules.

Change-Id: I82d16e3737d9cdfa6489e649e247894d0d60cbb1
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
[AmitP: Refactored original changes to align with
        the changes introduced by upstream commit
        830218c1add1 ("net: ipv6: Fix processing of RAs in presence of VRF")

        Also folded following android-4.9 commit changes into this patch
        be65fb01da4d ("ANDROID: net: ipv6: remove unused variable ifindex in")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: net: ipv6: fix crash caused by ipv6_find_hdr()

When calling:
    ipv6_find_hdr(skb, &thoff, -1, NULL)
on a fragmented packet, thoff would be left with a random
value causing callers to read random memory offsets with:
    skb_header_pointer(skb, thoff, ...)

Now we force ipv6_find_hdr() to return a failure in this case.
Calling:
  ipv6_find_hdr(skb, &thoff, -1, &fragoff)
will set fragoff as expected, and not return a failure.

Change-Id: Ib474e8a4267dd2b300feca325811330329684a88
Signed-off-by: JP Abgrall <jpa@google.com>

ANDROID: net: ipv4: tcp: add a sysctl to config the tcp_default_init_rwnd

The default initial rwnd is hardcoded to 10.

Now we allow it to be controlled via
/proc/sys/net/ipv4/tcp_default_init_rwnd
which limits the values from 3 to 100

This is somewhat needed because ipv6 routes are
autoconfigured by the kernel.

See "An Argument for Increasing TCP's Initial Congestion Window"
in https://developers.google.com/speed/articles/tcp_initcwnd_paper.pdf

Change-Id: I386b2a9d62de0ebe05c1ebe1b4bd91b314af5c54
Signed-off-by: JP Abgrall <jpa@google.com>
Conflicts:
net/ipv4/sysctl_net_ipv4.c
net/ipv4/tcp_input.c

[AmitP: Folded following android-4.9 commit changes into this patch
3823c8b26e6e ("ANDROID: tcp: fix tcp_default_init_rwnd() for 4.1")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: net: ipv4: sysfs_net_ipv4: Add sysfs-based knobs for controlling TCP window size

Add a family of knobs to /sys/kernel/ipv4 for controlling the TCP window size:

tcp_wmem_min
tcp_wmem_def
tcp_wmem_max
tcp_rmem_min
tcp_rmem_def
tcp_rmem_max

This six values mirror the sysctl knobs in /proc/sys/net/ipv4/tcp_wmem and
/proc/sys/net/ipv4/tcp_rmem.

Sysfs, unlike sysctl, allows us to set and manage the files' permissions and
owners.

Signed-off-by: Robert Love <rlove@google.com>

ANDROID: net: ip-sysctl: Document tcp_fwmark_accept

This documentation patch is the part of original tcp_fwmark_accept
implementation, Change-Id: I26bc1eceefd2c588d73b921865ab70e4645ade57
("net: support marking accepting TCP sockets").

The implementation since then got upstreamed, 84f39b08d786
("net: support marking accepting TCP sockets"), without this
documentation part.

Change-Id: I26bc1eceefd2c588d73b921865ab70e4645ade57
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
[AmitP: Refactored the commit log.
Fixes: 84f39b08d786 ("net: support marking accepting TCP sockets")
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: net: paranoid: commoncap: Begin to warn users of implicit PARANOID_NETWORK capability grants

CAP_NET_ADMIN and CAP_NET_RAW are implicity granted to the "special"
Android groups net_admin and net_raw.

This is a byproduct of the init system not being able to specify
capabilities back in the day, but has now been resolved and .rc files
can explictly specify the capabilities to be granted to a service.

Thus, we should start to remove this implict capability grant, and the
first step is to warn when a process doesn't have explicit capablity
but is a member of the implicitly granted group, when that capability
is checked.

This will allow for the PARANOID_NETWORK checks in commoncap.c to
be totally removed in a future kernel.

Change-Id: I6dac90e23608b6dba14a8f2049ba29ae56cb7ae4
Signed-off-by: John Stultz <john.stultz@linaro.org>

ANDROID: net: paranoid: security: Add proper checks for Android specific capability checks

Commit b641072 ("security: Add AID_NET_RAW and AID_NET_ADMIN capability
check in cap_capable().") introduces additional checks for AID_NET_xxx
macros. Since the header file including those macros are conditionally
included, the checks should also be conditionally executed.

Change-Id: Iaec5208d5b95a46b1ac3f2db8449c661e803fa5b
Signed-off-by: Tushar Behera <tushar.behera@linaro.org>
Signed-off-by: Andrey Konovalov <andrey.konovalov@linaro.org>

ANDROID: net: paranoid: Only NET_ADMIN is allowed to fully control TUN interfaces.

Signed-off-by: Chia-chi Yeh <chiachi@android.com>

ANDROID: net: paranoid: Replace AID_NET_RAW checks with capable(CAP_NET_RAW).

Signed-off-by: Chia-chi Yeh <chiachi@android.com>

ANDROID: net: paranoid: security: Add AID_NET_RAW and AID_NET_ADMIN capability check in cap_capable().

Signed-off-by: Chia-chi Yeh <chiachi@android.com>

ANDROID: net: Paranoid network.

With CONFIG_ANDROID_PARANOID_NETWORK, require specific uids/gids to instantiate
network sockets.

Signed-off-by: Robert Love <rlove@google.com>
paranoid networking: Use in_egroup_p() to check group membership

The previous group_search() caused trouble for partners with module builds.
in_egroup_p() is also cleaner.

Signed-off-by: Nick Pelly <npelly@google.com>
Fix 2.6.29 build.

Signed-off-by: Arve Hjønnevåg <arve@android.com>
net: Fix compilation of the IPv6 module

Fix compilation of the IPv6 module -- current->euid does not exist anymore,
current_euid() is what needs to be used.

Signed-off-by: Steinar H. Gunderson <sesse@google.com>
net: bluetooth: Remove the AID_NET_BT* gid numbers

Removed bluetooth checks for AID_NET_BT and AID_NET_BT_ADMIN
which are not useful anymore.
This is in preparation for getting rid of all the AID_* gids.

Change-Id: I879d7181f07532784499ef152288d12a03ab6354
Signed-off-by: JP Abgrall <jpa@google.com>
[AmitP: Folded following android-4.9 commit changes into this patch
a2624d7b9d73 ("ANDROID: Add android_aid.h")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: mmc: core: export emmc revision

Change-Id: If23bc838327ef751ee65baadc429e218eaa2a848
Signed-off-by: Jin Qian <jinqian@google.com>

ANDROID: mmc: core: move to a SCHED_FIFO thread

(cherry picked from commit 011e507b413393eab8279dac8b778ad9b6e9971b)

Running mmcqd as a prio 120 thread forces it to compete with standard
user processes for IO performance, especially when the system is under
severe CPU load. Move it to a SCHED_FIFO thread to reduce the impact of
load on IO performance.

Signed-off-by: Tim Murray <timmurray@google.com>
Bug: 25392275
Change-Id: I1edfe73baa25e181367c30c1f40fee886e92b60d

[AmitP: Include <uapi/linux/sched/types.h> for struct sched_param]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: mmc: core: Add "ignore mmc pm notify" functionality

Change-Id: I20821a82831b07ca037973d5d92e832372c6b583
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>

ANDROID: mmc: sdio: Add concept of an 'embedded' SDIO device.

This is required to support chips which use SDIO for signaling/
communication but do not implement the various card enumeration registers
as required for full SD / SDIO cards.

mmc: sdio: Fix bug where we're freeing the CIS tables we never allocated when using EMBEDDED_SDIO
mmc: Add max_blksize to embedded SDIO data

Change-Id: Ibff2e3e991e5522f55ec8c6edc25ed09f2553736
Signed-off-by: San Mehat <san@google.com>
[AmitP: Rebased the original commit to align with the upstream commit
        5fc3d80ef496 ("mmc: sdio: don't use rocr to check if the card could support UHS mode")

        Also folded following android-4.9 commit changes into this patch
        d775b65ecaf6 ("ANDROID: mmc: core: Remove stray CONFIG_EXPERIMENTAL dependencies")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: mmc: sd: Add retries in re-detection

Signed-off-by: San Mehat <san@android.com>
mmc: sd: Remove debugging printk

Signed-off-by: Dima Zavin <dima@android.com>

ANDROID: mmc: sd: When resuming, try a little harder to init the card

Signed-off-by: San Mehat <san@android.com>

ANDROID: mmc: sd: Add new CONFIG_MMC_PARANOID_SD_INIT for enabling retries during SD detection

Change-Id: I4e6b9d9a3600d7efbee1d8379e45db11c57827f2
Signed-off-by: San Mehat <san@google.com>

ANDROID: mm: add a field to store names for private anonymous memory

Userspace processes often have multiple allocators that each do
anonymous mmaps to get memory.  When examining memory usage of
individual processes or systems as a whole, it is useful to be
able to break down the various heaps that were allocated by
each layer and examine their size, RSS, and physical memory
usage.

This patch adds a user pointer to the shared union in
vm_area_struct that points to a null terminated string inside
the user process containing a name for the vma.  vmas that
point to the same address will be merged, but vmas that
point to equivalent strings at different addresses will
not be merged.

Userspace can set the name for a region of memory by calling
prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, start, len, (unsigned long)name);
Setting the name to NULL clears it.

The names of named anonymous vmas are shown in /proc/pid/maps
as [anon:<name>] and in /proc/pid/smaps in a new "Name" field
that is only present for named vmas.  If the userspace pointer
is no longer valid all or part of the name will be replaced
with "<fault>".

The idea to store a userspace pointer to reduce the complexity
within mm (at the expense of the complexity of reading
/proc/pid/mem) came from Dave Hansen.  This results in no
runtime overhead in the mm subsystem other than comparing
the anon_name pointers when considering vma merging.  The pointer
is stored in a union with fieds that are only used on file-backed
mappings, so it does not increase memory usage.

Includes fix from Jed Davis <jld@mozilla.com> for typo in
prctl_set_vma_anon_name, which could attempt to set the name
across two vmas at the same time due to a typo, which might
corrupt the vma list.  Fix it to use tmp instead of end to limit
the name setting to a single vma at a time.

Change-Id: I9aa7b6b5ef536cd780599ba4e2fba8ceebe8b59f
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
[AmitP: Fix get_user_pages_remote() call to align with upstream commit
        5b56d49fc31d ("mm: add locked parameter to get_user_pages_remote()")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: HACK: arm64: use -mno-implicit-float instead of -mgeneral-regs-only

LLVM bug 30792 causes clang's AArch64 backend to crash compiling
arch/arm64/crypto/aes-ce-cipher.c. Replacing -mgeneral-regs-only with
-mno-implicit-float is the suggested workaround.

Drop this patch once the clang bug has been fixed.

Change-Id: I89fda12d826783ffe18142ba048ff10bd769e240
Signed-off-by: Greg Hackmann <ghackmann@google.com>
Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
[AmitP: Refactored the changes to align with changes from upstream commit
bbb56c27228d ("arm64: Add detection code for broken .inst support in binutils")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: Kbuild, LLVMLinux: allow overriding clang target triple

Android has an unusual setup where the kernel needs to target
[arch]-linux-gnu to avoid Android userspace-specific flags and
optimizations, but AOSP doesn't ship a matching binutils.

Add a new variable CLANG_TRIPLE which can override the "-target" triple
used to compile the kernel, while using a different CROSS_COMPILE to
pick the binutils/gcc installation.  For Android you'd do something
like:

  export CLANG_TRIPLE=aarch64-linux-gnu-
  export CROSS_COMPILE=aarch64-linux-android-

If you don't need something like this, leave CLANG_TRIPLE unset and it
will default to CROSS_COMPILE.

Change-Id: I85d63599c6ab8ed458071cdf9197d85b1f7f150b
Signed-off-by: Greg Hackmann <ghackmann@google.com>

CHROMIUM: arm64: Disable asm-operand-width warning for clang

clang raises 'asm-operand-widths' warnings in inline assembly code when
the size of an operand is < 64 bits and the operand width is unspecified.
Most warnings are raised in macros, i.e. the datatype of the operand may
vary. Most of these warnings are fixed in upstream, however we consider it
isn't worth the effort/risk to backport all the necessary changes. On
future CrOS kernels >= v4.13 the warning should be re-enabled.

Change-Id: Ie44748344853f5a394879718ad5d6f610f3c396a
Signed-off-by: Matthias Kaehlcke <mka@chromium.org>

CHROMIUM: kbuild: clang: Disable the 'duplicate-decl-specifier' warning

clang generates plenty of these warnings in different parts of the code.
They are mostly caused by container_of() and other macros which declare
a "const <type> *" variable for their internal use which triggers a
"duplicate 'const' specifier" warning if the <type> is already const
qualified.

Change-Id: I3ad9d33e31b7b40f926554eed2afeea1ebb7e961
Wording-mostly-from: Michael Davidson <md@google.com>
Signed-off-by: Matthias Kaehlcke <mka@chromium.org>

ANDROID: kbuild: Makefile.clean: make Kbuild and Makefile optional

AOSP commit b13ce9f4aa6f "ARM64: add option to build
Image.gz/dtb combo" broke archclean / mrproper build
targets and we run into:
----------
./scripts/Makefile.clean:14: arch/arm64/boot/amd/Makefile: No such file or directory
make[2]: *** No rule to make target `arch/arm64/boot/amd/Makefile'. Stop.
make[1]: *** [arch/arm64/boot/amd] Error 2
make: *** [archclean] Error 2
----------

This patch skip the missing Kbuild/Makefile reporting
error. It does the job (i.e cleanup dts/*/*.dtb and
do not spit out missing file error messages as well).

Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: kbuild: make it possible to specify the module output dir

Make modinst_dir user-defined on the command line.

This allows to do things like:
make MODLIB=output/ modinst_dir=. modules_install

to ensure all the .ko are in the output/ directory.

Change-Id: I2bc007eea27ee744d35289e26e4a8ac43ba04151
Signed-off-by: Rom Lemarchand <romlem@android.com>

ANDROID: input: goldfish_events: no extra EV_SYN; register goldfish

If we send SYN_REPORT on every single
multitouch event, it breaks the multitouch.

The multitouch becomes janky and
having to click 2-3 times to
do stuff (plus randomly activating notification
bars when not clicking)

If we suppress these SYN_REPORTS,
multitouch will work fine, plus the events
will have a protocol that looks nice.

In addition, we need to register Goldfish Events
as a multitouch device by issuing
input_mt_init_slots, otherwise
input_handle_abs_event in drivers/input/input.c
will silently drop all ABS_MT_SLOT events,
making it so that touches with more than 1 finger
do not work properly.

Signed-off-by: "Lingfeng Yang" <lfy@google.com>
Change-Id: Ib2350f7d1732449d246f6f0d9b7b08f02cc7c2dd
(cherry picked from commit 6cf40d0a16330e1ef42bdf07d9aba6c16ee11fbc)

ANDROID: input: keychord: Fix for a memory leak in keychord.

Fixes a steady memory leak in the keychord release code. A close of
the keychord device will leak 1 keychord structure. Easily
reproducible by a simple program that does an open()->write()->close()
of the keychord device.

Bug: 64483974
Change-Id: I1fa402c666cffb00b8cfd6379d9fe47a0989152c
Signed-off-by: Mohan Srinivasan <srmohan@google.com>

ANDROID: input: keychord: Fix races in keychord_write.

There are multiple bugs caused by threads racing in keychord_write.
1) Threads racing through this function can cause the same element to
be added to a linked list twice (multiple calls to
input_register_handler() for the same input_handler struct). And the
races can also cause an element in a linked list that doesn't exist
attempted to be removed (multiple calls to input_unregister_handler()
with the same input_handler struct).
2) The races can also cause duplicate kfree's of the keychords
struct.

Bug: 64133562
Bug: 63974334
Change-Id: I6329a4d58c665fab5d3e96ef96391e07b4941e80
Signed-off-by: Mohan Srinivasan <srmohan@google.com>

ANDROID: input: keychord: Fix a slab out-of-bounds read.

Fix a slab out of bounds read in keychord_write(), detected by KASAN.

Signed-off-by: Mohan Srinivasan <srmohan@google.com>
Bug: 63962952
Change-Id: Iafef48b5d7283750ac0f39f5aaa767b1c3bf2004

[AmitP: Folded following android-4.9 commit changes into this patch
a1e4c795e1b6 ("Use %zu to print resid (size_t).")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: input: keychord: log when keychord triggered

log keychord id at info level just before waking up processes.

Signed-off-by: JP Abgrall <jpa@google.com>
[AmitP: Rename task_list in wait_queue_head{} to align with upstream commit
2055da97389a ("sched/wait: Disambiguate wq_entry->task_list and wq_head->task_list naming")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: input: keyreset: switch to orderly_reboot

Prior restart function would make a call to sys_sync and then
execute a kernel reset. Rather than call the sync directly,
thus necessitating this driver to be builtin, call orderly_reboot,
which will take care of the file system sync.

Note: since CONFIG_INPUT Kconfig is tristate, this driver can be built
as module, despite being marked bool.

Signed-off-by: Eric Ernst <eric.ernst@linux.intel.com>

ANDROID: input: keyreset: Made keyreset more robust

Switched do_restart to run in a seperate workqueue to handle
cases where kernel_restart hangs.

Change-Id: I1ecd61f8d0859f1a86d37c692351d644b5db9c69
Signed-off-by: Daniel Rosenberg <drosen@google.com>

ANDROID: input: keyreset: Changed keyreset to act as a wrapper for keycombo.

keyreset now registers a keycombo driver that acts as the old
keyreset driver acted.

Change-Id: I08f5279e3a33b267571b699697f9f54508868983
Signed-off-by: Daniel Rosenberg <drosen@google.com>

ANDROID: input: keycombo: add keycombo, a general key combo driver.

Keycombo lets you provide a key up and key down function, and an
optional time delay for key down. The driver will call the key
down function after the specified key combo has been held for the
speicified time delay. After you release the combo, if the key down
has happened, it calls key up.

Change-Id: I6a9a94e96a8f58fadd908fd1dc7944b9102a089f
Signed-off-by: Daniel Rosenberg <drosen@google.com>

ANDROID: input: keychord: Add keychord driver

This driver allows userspace to receive notification when client
specified key combinations are pressed.
The client opens /dev/keychord and writes a list of keychords
for the driver to monitor.
The client then reads or polls /dev/keychord for notifications.
A client specified ID for the keychord is returned from read()
when a keychord press is detected.

Signed-off-by: Mike Lockwood <lockwood@android.com>
keychord: fix to build without CONFIG_PREEMPT

Change-Id: I911f13aeda4224b6fa57863bc7e8972fec8837fb

[AmitP: Folded following android-4.9 commit changes into this patch
f4d1cf1208fe ("ANDROID: input: misc: keychord: move header to uapi")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

ANDROID: input: keyreset: Add keyreset driver.

Add a platform device in the board file to specify a reset key-combo.
The first time the key-combo is detected a work function that syncs
the filesystems is scheduled. If all the keys are released and then
pressed again, it calls panic. Reboot on panic should be set for
this to work.

Change-Id: I9d54283ca1fba45e4b1ae1a407524cdda8171143
Signed-off-by: Arve Hjønnevåg <arve@android.com>

ANDROID: input: gpio_matrix: Remove wakelock.h dependencies

Change-Id: I228bcdebf28f5c67765002043d3f919718827316
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>

ANDROID: input: gpio_input: convert from wakelocks to wakeup sources

And add device names to wakeup source names

Change-Id: Ia5f2723319a2e749f00d6ec7d846edff6af6d5c2
Signed-off-by: Todd Poynor <toddpoynor@google.com>