We should use the attribute groups, not group, for the device, so
add and remove it.  No one should ever be updating a sysfs group for a
device, as that can be pretty dangerous if you don't duplicate _all_
existing attribute for that device, and I don't think we were doing that
here.
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

x86 doesn't include SZ_4K somehow so explicitly include <linux/sizes.h>
to fix the build breakage.
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Add a simple Greybus protocol in order to stress USB and Greybus.
This protocol currently support 2 requests: ping and transfer.

ping request is useful to measure latency.
Kernel send a ping request and firmware should respond with a ping.

The transfer request request is useful to stress Greybus and USB.
Kernel can send data from 0 to 4k and the firmware must send back the data to kernel.

This behaviour of gb-loopback module is controlled via sysfs.
Curently, connection sysfs folder is updated with new entries:
- type: Type of loopback message to send
  * 0 => Don't send message
  * 1 => Send ping message continuously (message without payload)
  * 2 => Send transer message continuously (message with payload)
- size: Size of transfer message payload: 0-4096 bytes
- ms_wait: Time to wait between two messages: 0-1024 ms

Module also export some statistics about connection:
- latency: Time to send and receive one message
- frequency: Number of packet sent per second on this cport
- throughput: Quantity of data sent and received on this cport
- error
All this statistics are cleared everytime type, size or ms_wait entries are updated.
Signed-off-by: Alexandre Bailon <abailon@baylibre.com>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

When usb_log_enable() is called, the global apb1_log_task is used to
hold the result of kthread_run().  It is possible for kthread_run()
to return an error pointer, so tests of apb_log_task against NULL
are insufficient to determine its validity.

Note that kthread_run() never returns NULL so we don't have to check
for that.  But apb1_log_task is initially NULL, so that global must
be both non-null and not an error in order to be considered valid.
Signed-off-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

When usb_log_enable() is called, the global apb1_log_task is used to
hold the result of kthread_run().  It is possible for kthread_run()
to return an error pointer, so tests of apb_log_task against NULL
are insufficient to determine its validity.

Note that kthread_run() never returns NULL so we don't have to check
for that.  But apb1_log_task is initially NULL, so that global must
be both non-null and not an error in order to be considered valid.
Signed-off-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

In identify_descriptor(), the variable desc_size represents the size
of a memory object.  So change its type from int to size_t.

The return value for this function can be desc_size cast to int.
One can verify by inspection this will never exceed INT_MAX.
Signed-off-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Send response to incoming requests from the operation request handler
rather than in every protocol request_recv callback.

This simplifies request_recv error handling and allows for further code
reuse.

Note that if we ever get protocols that need to hold off sending
responses we could implement this by letting them return a special
value (after acquiring the necessary operation references) to suppress
the response from being sent by greybus core.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Send response also to incoming requests that cannot be fulfilled.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Add minimal verification of incoming report size, before using it to
determine what buffer and size to pass on to HID core.

Add comment about protocol needing to be revisited. If we are going to
be parsing the report data received, then those fields have to be
defined in the Greybus specification at least.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Make sure to verify the length of incoming requests before trying to
parse the request buffer, which can even be NULL on empty requests.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Make sure to only send a success response if we did not detect any
errors.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Replace pr_err with dev_err and clean up error messages somewhat.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Send response also to incoming requests that cannot be fulfilled.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Fix null-pointer dereference on failure to look up irq due to missing
error handling.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Make sure to verify the length of incoming requests before trying to
parse the request buffer, which can even be NULL on empty requests.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Include the operation id as well as the received and expected size
(from header) when reporting incomplete messages.

This information is useful when debugging communication errors.

Also invert the size test to match the error message and increase
readability.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Use dev_err whenever we have a connection for more informative error
messages.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Fix the payload size of incoming requests, which should not include the
operation message-header size.

When creating requests we pass the sizes of request and response
payloads and greybus core allocates buffers and adds the required
headers. Specifically, the payload sizes do not include the
message-header size.

This is currently not the case for incoming requests however, something
which prevents protocol drivers from implementing appropriate input
verification and could lead to random data being treated as a valid
message in case of a short request.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Incoming operations are created without a response message. If a
protocol driver fails to send a response, or if the operation were to be
cancelled before it has been fully processed, we get a null-pointer
dereference when the operation is released.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Incoming operations are created without a response message. If an
operation were to be cancelled before it has been fully processed (e.g.
on connection destroy), we would get a null-pointer dereference in
gb_operation_cancel.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Make sure to return a proper response in case we get a request we do not
recognise.

This fixes an infinite loop and use-after-free bug, where the freed
operations structure would get re-added to the work queue indefinitely.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Make sure to drop the operation reference when sending the request fails
to avoid leaking the operation structures.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Fix use-after-free when sending responses due to reference imbalance.

Make sure to take a reference to the operation when sending responses.
This reference is dropped in greybus_data_sent when the message has been
sent, while the initial reference is dropped in gb_operation_work after
processing the corresponding request.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Fix up obsolete comments referring to null callback pointers for
synchronous operations, and make sure a callback is always provided when
sending a request.

Also document that the callback is responsible for dropping the initial
(and not necessarily final) reference to the operation.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Fix typo in comment.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Add missing EXPORT_SYMBOL_GPL for gb_operation_response_alloc,
gb_operation_result, gb_operation_get, gb_operation_request_send and
gb_operation_cancel, which are all supposed to be accessible from
protocol handlers.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

And this is the warning I was getting on kernel version > 3.14

  CC [M]  greybus/connection.o
  In file included from
  include/asm-generic/gpio.h:4:0,
	from arch/arm/include/asm/gpio.h:9,
	from include/linux/gpio.h:48,
	from greybus/kernel_ver.h:59,
	from greybus/connection.c:12:
  include/linux/kernel.h:35:0: warning: "U16_MAX" redefined

kernel_ver.h is taking care of defining U16_MAX only if is not defined earlier,
but it is often included as the first .h file. <linux/kernel.h> might be
included later, which always defines it, unconditionally. And so this warning.
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

This brings the debug log functionality of es1.c to es2.c, along with
some other minor cleanups.
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>
Reviewed-by: Alex Elder <elder@linaro.org>

This removes the error checking for debugfs initialization as we really
don't care if it failed or not.
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>
Reviewed-by: Alex Elder <elder@linaro.org>

These clever macros were fine for early development, but they're
more of a distraction now.
Signed-off-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

This is an old patch that I neglected to send out.  It's cleaning
up a couple things that got committed before I had a chance to
comment on them.

In operation.c there is a "FIXME" comment that is easily proven
wrong by inspection.

In gb_protocol_put(), there is another wrong "FIXME" comment as
well.  We can also use our cached copies of the protocol major
and minor version number in another spot.  And balance that
out by using a cached copy of the protocol id.
Signed-off-by: Alex Elder <elder@linaro.org>
Reviewed-by: Johan Hovold <johan@hovoldconsulting.com>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Merge the es1 log file fixes into master.
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

In order to decrement the reference count of module on failures, we must call
put_device(module->dev). This was missing for one of the error cases, fix it.
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

As mentioned in kernel coding guidelines.
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

identify_descriptor() doesn't return 0 anymore and so we don't need to check the
returned value against 0.
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Reviewed-by: Johan Hovold <johan@hovoldconsulting.com>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

We are calculating descriptors expected size differently based on the type of
descriptor, that's fine but at few places we aren't taking size of the header
into account. And that looks wrong.

Lets make sure it is atleast as big as descriptor's header.
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Reviewed-by: Johan Hovold <johan@hovoldconsulting.com>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

If you write 0 to the debugfs file, the log will stop being updated.
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

One function shouldn't do two different things depending on a parameter
passed to it, so split usb_log_enable() into usb_log_disable()
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Add a blank line in apb1_log_enable_read() to make checkpatch happy.

Oh, and it makes the code more readable too...
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

No need to duplicate built-in functions that the kernel has, so have the
core kernel parse the userspace string.  Saves us an allocation and
makes the logic simpler.
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>