16 months agotegra-alt: adsp: add parameter size checks
Viraj Karandikar [Tue, 14 Mar 2017 05:17:22 +0000]
tegra-alt: adsp: add parameter size checks

Fix possible buffer overflow in case of invalid user
parameter by adding size checks

Bug 1869543
Bug 1888389
Bug 2002359

Change-Id: I82ac00e24a3ca40915eb6c556454c9649cb644bd
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: http://git-master/r/1297227
(cherry-picked from commit 2e4308a3800f3dcd4aa91a1b446cf00cf7ebda59)
Reviewed-on: http://git-master/r/1320244
Signed-off-by: Amulya Y <ayarlagadda@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1656808
Reviewed-by: Jonathan Hunter <jonathanh@nvidia.com>
Reviewed-by: Bibek Basu <bbasu@nvidia.com>

16 months agothermal: add boundary check to set_cur_state
Srikar Srimath Tirumala [Tue, 12 Sep 2017 19:27:13 +0000]
thermal: add boundary check to set_cur_state

Prevent sysfs from setting a cur_state that exceeds the max cur_state
of the cooling device.

Bug 200334223
Bug 200331706
Bug 1968660
Bug 1968616

Change-Id: I935be6166a9e184683abfcdce70cb08cbe4a1350
Signed-off-by: Srikar Srimath Tirumala <srikars@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1558407
(cherry picked from commit 142cf9d96ed221124ea2b778dc37cf5db8d5702c)
Reviewed-on: https://git-master.nvidia.com/r/1630002
Reviewed-on: https://git-master.nvidia.com/r/1661413
GVS: Gerrit_Virtual_Submit
Reviewed-by: Winnie Hsu <whsu@nvidia.com>
Tested-by: Amulya Yarlagadda <ayarlagadda@nvidia.com>

17 months agocryptodev: avoid untrusted user pointers
Konduri Praveen [Tue, 1 Aug 2017 12:05:58 +0000]
cryptodev: avoid untrusted user pointers

add algo variable for avoid the usage of
user space pointers

Bug 200286426

Change-Id: I7e208b45ba11348e7b89a429d457ae51ac29bde0
Signed-off-by: Konduri Praveen <kondurip@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1530560
(cherry picked from commit b210c724aea24160a5fdcec5ee9b8f9c86c8540d)
Reviewed-on: https://git-master.nvidia.com/r/1649889
GVS: Gerrit_Virtual_Submit
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Winnie Hsu <whsu@nvidia.com>
Tested-by: Winnie Hsu <whsu@nvidia.com>

17 months agoCRYPTO: disable disable crypto dev for t210
Konduri Praveen [Fri, 20 Oct 2017 05:48:09 +0000]
CRYPTO: disable disable crypto dev for t210

disabling tegra SE crypto dev for t210
platform.

Bug 1927682

Change-Id: I57cd2b143e82122945b78635f36706bdbdeaca6c
Signed-off-by: Konduri Praveen <kondurip@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1582386
Reviewed-by: Winnie Hsu <whsu@nvidia.com>
Tested-by: Winnie Hsu <whsu@nvidia.com>

18 months agopcie: host: disable AFI dynamic clock gating
Ken Chang [Tue, 25 Apr 2017 04:46:02 +0000]
pcie: host: disable AFI dynamic clock gating

Override AFI clock enable to disable dynamic clock gating logic.

Bug 200366033

Change-Id: I15a4f67f0a0fd0fb5d28504f9317a9228fca9531
Reviewed-on: http://git-master/r/1469192
(cherry picked from commit fbacedca8e25ebc5400191156316efc52edc3888)
Signed-off-by: Ken Chang <kenc@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1602161
GVS: Gerrit_Virtual_Submit
Reviewed-by: Manikanta Maddireddy <mmaddireddy@nvidia.com>
Reviewed-by: Sandipan Patra <spatra@nvidia.com>
Tested-by: Sandipan Patra <spatra@nvidia.com>
Reviewed-by: Bibek Basu <bbasu@nvidia.com>

20 months agocryptodev: Use wait_for_completion_timeout for async calls
Debarshi Dutta [Tue, 3 Oct 2017 09:00:47 +0000]
cryptodev: Use wait_for_completion_timeout for async calls

AES operations are asynchronous and when waiting for them
to complete, don't allow tasks to be interruptible.

Bug 200327042
Bug 200292436

Change-Id: I17305f601543d349e60cd986df3e949b7439e971
Signed-off-by: Debarshi Dutta <ddutta@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1572379
GVS: Gerrit_Virtual_Submit
Reviewed-by: Mallikarjun Kasoju <mkasoju@nvidia.com>
Tested-by: Mallikarjun Kasoju <mkasoju@nvidia.com>
Reviewed-by: Bibek Basu <bbasu@nvidia.com>

21 months agovideo: tegra: nvmap: handle the vma->vm_mm NULL case
Krishna Reddy [Mon, 18 Sep 2017 18:00:27 +0000]
video: tegra: nvmap: handle the vma->vm_mm NULL case

v4l2 is registering vma with vm_mm = NULL.

Bug 1874184

Change-Id: I24e61a531d9a506c7c146335240754931b3c238d
Signed-off-by: Krishna Reddy <vdumpa@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1564203
Tested-by: Frank Shi <fshi@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Winnie Hsu <whsu@nvidia.com>
Reviewed-by: Sachin Nikam <snikam@nvidia.com>
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>

22 months agoarm64: dts: update emc dvfs table for Jetson CV
Sandipan Patra [Fri, 9 Jun 2017 05:19:41 +0000]
arm64: dts: update emc dvfs table for Jetson CV

Updating emc dvfs table dts for Jetson CV with
Samsung and Hynix configuration.

Bug 200315053

Change-Id: I199c65c7e1261b37748b5045eac0d1da702ba986
Signed-off-by: Sandipan Patra <spatra@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1499061
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>

22 months agovideo: tegra: host: use lock to get syncpt name
Gagan Grover [Tue, 22 Nov 2016 10:13:19 +0000]
video: tegra: host: use lock to get syncpt name

Use sp->syncpt_mutex lock to get syncpt name in
syncpt_name_show()
Without the lock, it is possible for user to read
syncpt name in corrupted state if user read
coincides with syncpt free

Bug 1838598
Bug 1883567

Change-Id: I69ca5c1d80adaca4b93a337fe4a5debeb78f34fc
Reviewed-on: http://git-master/r/1252580
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: http://git-master/r/1258020
Signed-off-bu: Debarshi Dutta <ddutta@nvidia.com>
(cherry picked from commit 9a7d12e49ca6c627dff2dc4c15fa9ba153e9265d in rel-24)
Reviewed-on: https://git-master.nvidia.com/r/1513005
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
Tested-by: Bibek Basu <bbasu@nvidia.com>

22 months agotegra-se: Set IV in UIV slot
Konduri Praveen [Wed, 31 May 2017 05:58:20 +0000]
tegra-se: Set IV in UIV slot

Set IV in UIV slot so that when an IV is not set,
Engine will use updated IV from UIV which is
calculated from previous AES operation.

Bug 200225148

Change-Id: I16133f87a37fccf6645e7e99b4a37ebbe4e145d0
Signed-off-by: Konduri Praveen <kondurip@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1492705
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>

22 months agoMerge "Merge remote-tracking branch 'origin/dev/tsp-to-l4t-r24.2' into l4t-r24.2...
Gerrit Code Review [Tue, 19 Sep 2017 21:00:43 +0000]
Merge "Merge remote-tracking branch 'origin/dev/tsp-to-l4t-r24.2' into l4t-r24.2" into l4t/l4t-r24.2

22 months agoarm64: tegra21: Add USB_SERIAL_CP210X config
Shreshtha SAHU [Fri, 11 Aug 2017 04:40:50 +0000]
arm64: tegra21: Add USB_SERIAL_CP210X config

Bug 1954342

Change-Id: Ie327ae44a96fc30a76364b06a71974e999f81203
Signed-off-by: Shreshtha SAHU <ssahu@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1537342
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>

22 months agogpu: nvgpu: Simplify ref-counting on VMs
Alex Waterman [Wed, 30 Nov 2016 00:01:41 +0000]
gpu: nvgpu: Simplify ref-counting on VMs

Simplify ref-counting on VMs: take a ref when a VM is bound to a
channel and drop a ref when a channel is freed.

Previously ref-counts were scattered over the driver. Also the CE
and CDE code would bind channels with custom rolled code. This was
because the gk20a_vm_bind_channel() function took an as_share as
the VM argument (the VM was then inferred from that as_share).
However, it is trivial to abtract that bit out and allow a central
bind channel function that just takes a VM and a channel.

Bug 1846718
Bug 1885921

Change-Id: I156aab259f6c7a2fa338408c6c4a3a464cd44a0c
Signed-off-by: Alex Waterman <alexw@nvidia.com>
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: http://git-master/r/1261886
(cherry picked from commit 7e403974d3584ab8880e42d422ee3afb7f49d6f3)
Signed-off-by: Debarshi Dutta <ddutta@nvidia.com>
Change-Id: Ibac97d05e13fad3dcbe55c56f1b166699ce39af7
Reviewed-on: https://git-master.nvidia.com/r/1551138
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>

22 months agogpu: nvgpu: Remove ref count from as_share
Alex Waterman [Tue, 31 Jan 2017 23:49:40 +0000]
gpu: nvgpu: Remove ref count from as_share

Remove the broke ref counting from as_share. The ref-count is
incremented for every bind channel but never decremented. This
results in VMs never being freed.

Bug 1846718
Bug 1885921

Change-Id: I6253b3eab7c7471d3ed6feddb3705c49a8704bed
Signed-off-by: Alex Waterman <alexw@nvidia.com>
Signed-off-by: Debarshi Dutta <ddutta@nvidia.com>
Reviewed-on: http://git-master/r/1296900
(cherry picked from commit c6594c744d8fca738a1a8f5177c84a05899695dc in
rel-24)
Reviewed-on: https://git-master.nvidia.com/r/1483632
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>

22 months agoBluetooth: Properly check L2CAP config option output buffer length
Ben Seri [Wed, 13 Sep 2017 08:34:32 +0000]
Bluetooth: Properly check L2CAP config option output buffer length

Validate the output buffer length for L2CAP config requests and responses
to avoid overflowing the stack buffer used for building the option blocks.

Bug 1989825

Change-Id: Id158ece2176c4ac339a7232dfde8c47ce2241122
Cc: stable@vger.kernel.org
Signed-off-by: Ben Seri <ben@armis.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Bibek Basu <bbasu@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1558940
GVS: Gerrit_Virtual_Submit

23 months agoMerge remote-tracking branch 'origin/dev/tsp-to-l4t-r24.2' into l4t-r24.2
Igor Nabirushkin [Tue, 8 Aug 2017 14:49:44 +0000]
Merge remote-tracking branch 'origin/dev/tsp-to-l4t-r24.2' into l4t-r24.2

Bug 1968122

Change-Id: Ib0a684568442cd15b6fcb1cdb8e50fa56289f2ab
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>

23 months agomisc: tegra-profiler: fix stopping the session
Igor Nabirushkin [Thu, 3 Aug 2017 15:52:21 +0000]
misc: tegra-profiler: fix stopping the session

Do not stop profiling if some clocks are not available.
This commit fixes unexpected stop on some devices.

Bug 1968948

Change-Id: Ieacf481d1884ec717027aff2460be499ddf77ff8
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1532770
(cherry picked from commit abec385924a12beda1c281a1b5aa872729761d05)

23 months agomisc: tegra-profiler: send virtual ids
Igor Nabirushkin [Sun, 23 Jul 2017 18:56:46 +0000]
misc: tegra-profiler: send virtual ids

Send virtual pid and tgid of the current task (from
the pid namespace).
This is useful for correlation between ids coming from the kernel
module with ids coming from the injection library.

Bug 1963327

Change-Id: I8e15a9803730ef443ada528e39116056b05157a2
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1525176
(cherry picked from commit ee3f90e2c768558107c7ee43a3f7378418214600)

23 months agomisc: tegra-profiler: fix lost samples
Igor Nabirushkin [Mon, 10 Jul 2017 19:54:12 +0000]
misc: tegra-profiler: fix lost samples

Do not send 'header' samples for non-present cores.
This fixes lost samples in some cases.

Bug 1956713

Change-Id: Ib09aecbb71265b96840e18dcb40315adf286994f
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1516355
(cherry picked from commit 333e27f016348a41473292189be72ad05512c528)

23 months agomisc: tegra-profiler: fix uninitialized spinlocks
Igor Nabirushkin [Tue, 4 Jul 2017 06:12:42 +0000]
misc: tegra-profiler: fix uninitialized spinlocks

Fix uninitialized spinlocks for some systems with "holes"
in the CPU numbering.
Use possible cpus instead of nr_cpu_ids for per-cpu buffers.
This fixes possible system crash.

Bug 200320513

Change-Id: I4610459b84bff2ed78d0521e77c6251dc4ded0ad
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: https://git-master/r/1512907
(cherry picked from commit ada8ad34fad3522974d9d7a1ea835474779d91c8)

23 months agomisc: tegra-profiler: fix out-of-bounds access
Igor Nabirushkin [Tue, 4 Jul 2017 05:53:45 +0000]
misc: tegra-profiler: fix out-of-bounds access

Fix potential out-of-bounds write in read_all_sources() function
that can lead to data corruption.
This commit fixes the problem (the array size is increased by 1).

Bug 1953704

Change-Id: Iac6c54dfbd13b7ebef20de67f60cd3281e13814c
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: https://git-master/r/1512895
(cherry picked from commit 38c82f0ff897d6a8b9f5d0793f113a09d229a0cc)

23 months agotegra-profiler: fix UBSAN shift_out_of_bound error
Igor Nabirushkin [Wed, 7 Jun 2017 11:54:47 +0000]
tegra-profiler: fix UBSAN shift_out_of_bound error

The UBSAN reports the following error in armv8_pmu.c:

[.../lib/ubsan.c:421>] __ubsan_handle_shift_out_of_bounds
[.../drivers/misc/tegra-profiler/armv8_pmu.c:273>] pmu_start
[.../drivers/misc/tegra-profiler/hrt.c:594>] __quadd_task_sched_in

The reason for this error is wrong value for PMOVSCLR_EL0 register.
This commit fixes this problem.

Bug 1932645

Change-Id: I589587b0d30e1c84a6c27d2f6b06cb2ced742655
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: http://git-master/r/1497591
(cherry picked from commit 96ca19ae7cdceae82ff3e96cae247334775e30c5)

23 months agomisc: tegra-profiler: add overhead information
Igor Nabirushkin [Tue, 6 Jun 2017 12:22:35 +0000]
misc: tegra-profiler: add overhead information

Add profiler overhead information: store duration
of the profiler sampling period in the tail of sample.

Bug 1939233

Change-Id: Ifbfb0b98ed8c6ffeec8af96b682761f3fd3d2d61
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: http://git-master/r/1496893
(cherry picked from commit eb061ee4457f2ff5b271f133c14f553759acab6f)

23 months agomisc: tegra-profiler: support raw hardware events
Igor Nabirushkin [Wed, 10 May 2017 06:48:52 +0000]
misc: tegra-profiler: support raw hardware events

Support arbitrary raw hardware PMU events.
There are also a few minor changes in procfs output.

Bug 1923017

Change-Id: I490817d4dba10100d7450572835c45dcba8cac32
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: http://git-master/r/1478869
(cherry picked from commit 83d257b17e00e97b3c2fc93e8a2b142c7074c23f)

23 months agomisc: tegra-profiler: fix crash in power_clk stop
Igor Nabirushkin [Fri, 5 May 2017 11:56:59 +0000]
misc: tegra-profiler: fix crash in power_clk stop

Fix crash in profiler when using gpu and emc clocks: using
the freed clock source can cause the kernel panic.
Remove redundant clk_get_sys calls.

Bug 1918185

Change-Id: I421049c7a30fad6356f7300226e84794cecf0673
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: http://git-master/r/1476299
(cherry picked from commit 8b0d7e1748b31dd87ab2837a6b9f0a1d2e3d6ecc)

23 months agomisc: tegra-profiler: add instruction barriers
Igor Nabirushkin [Wed, 29 Mar 2017 08:35:04 +0000]
misc: tegra-profiler: add instruction barriers

Add missing instruction synchronization barriers:
- After writing to the performance counter selection register.
- Before writing to the performance monitors control register.

Bug 1896853

Change-Id: Id63f73ef26eb0c99277339936f06cda109f6afe8
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: http://git-master/r/1330552
(cherry picked from commit 3775cd2936a345405143c7d71f100d88136986c6)

23 months agomisc: tegra-profiler: use power-of-2 sized buffer
Igor Nabirushkin [Mon, 6 Mar 2017 10:00:20 +0000]
misc: tegra-profiler: use power-of-2 sized buffer

Kernel/User-space circle buffers:
- Use power-of-2 sized buffers to reduce overhead
- Use the common circular buffer macros

Bug 1881997

Change-Id: I664f4745e625cc4cd395d1683eada191abe12624
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: http://git-master/r/1315654
(cherry picked from commit a7971b07d3f04fe424a3506ae665214e76abecb4)

23 months agomisc: tegra-profiler: add a memory barrier
Igor Nabirushkin [Mon, 6 Mar 2017 10:06:10 +0000]
misc: tegra-profiler: add a memory barrier

Use smp_store_release() to update circle buffer write pointers to
ensure the data is stored before we update write pointer.

Bug 1881996

Change-Id: Icaade5e6f57056c638efa61e65e9a8a6f6e12416
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: http://git-master/r/1315657
(cherry picked from commit c19fa2487c1d385d9cde0595cab66aeea416c00d)

23 months agomisc: tegra-profiler: fix coverity defect
Igor Nabirushkin [Sun, 12 Mar 2017 21:04:54 +0000]
misc: tegra-profiler: fix coverity defect

Fix coverity defect "Bad bit shift operation".

Coverity ID: 33234

Bug 200192567

Change-Id: I7f0edb9c41ac9a9b624bafab3eab660968e57fef
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: http://git-master/r/1319568
(cherry picked from commit 40a0e6c7d697b72a05258c587c6062c9c6f09c65)

23 months agomisc: tegra-profiler: fix dwarf unwinding
Igor Nabirushkin [Sat, 11 Mar 2017 14:21:51 +0000]
misc: tegra-profiler: fix dwarf unwinding

DWARF unwinding: do not stop unwinding if stack is not growing
at the first function in call chain.
This patch fixes broken backtraces in leaf functions with
empty FDE entries.

Bug 1887662

Change-Id: Ib3d577afc20c923b6240e797482717f1a3e00ea4
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: http://git-master/r/1319323
(cherry picked from commit 82729960283f432cdbfc82af546dbfbde3e2cd7f)

23 months agomisc: tegra-profiler: verify stack pointer
Igor Nabirushkin [Sun, 29 Jan 2017 20:33:13 +0000]
misc: tegra-profiler: verify stack pointer

Add additional stack pointer verification for DWARF unwinding
since stack always has to grow downwards in memory.
This commit prevents infinite loop when FDE entry is empty.

Bug 1868657

Change-Id: I4e8eda697606f2b9ca9d613b35ffad5a39a14be7
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: http://git-master/r/1295733
(cherry picked from commit 832bcf45afce219eb4beb8d0ad385f07ef40ac95)
Reviewed-on: http://git-master/r/1302041
(cherry picked from commit c9848e202c00f1ccc5edf14cb7c080c63ec119c9)

23 months agomisc: tegra-profiler: fix crash in dwarf unwinding
Igor Nabirushkin [Wed, 11 Jan 2017 10:45:30 +0000]
misc: tegra-profiler: fix crash in dwarf unwinding

Do not update sections information in sched context,
it is not safely.

Bug 200246808

Change-Id: Iadca09f29e62d57330430c3325ccbc9ac8280f88
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: http://git-master/r/1252603
(cherry picked from commit 819e89ac73a5f62f04cbdea328683c25332ba71b)
Reviewed-on: http://git-master/r/1283451
(cherry picked from commit 247a28b42dc1f67c011b5c50af9ebdd35d6eb1c6)
Reviewed-on: http://git-master/r/1302040
(cherry picked from commit 846036e40df43448784389e087e8f9397396a57c)

23 months agomisc: tegra-profiler: fix backtraces
Igor Nabirushkin [Mon, 9 Jan 2017 17:39:36 +0000]
misc: tegra-profiler: fix backtraces

Fix missed user address for unwinding from the kernel context.

Bug 1859763

Change-Id: Ia5d1fc779f47a954f624ee16dd4353910d62de05
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: http://git-master/r/1282285
(cherry picked from commit 57babc79f6edaaec3e4c43962e3db7c7ecec7749)
Reviewed-on: http://git-master/r/1302039
(cherry picked from commit d9d001cd59e020a25f7b6bde0481070f34a1f5dd)

23 months agomisc: tegra-profiler: fix a potential crash
Igor Nabirushkin [Wed, 21 Dec 2016 11:42:08 +0000]
misc: tegra-profiler: fix a potential crash

Incorrect cpu number in ioctl can lead to system crash.
Add additional validations to prevent the potential crash.

Bug 1855617

Change-Id: Ib87e3999da9212fbd22f5a46b5615c860c895af5
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: http://git-master/r/1274785
(cherry picked from commit b3738f63c28da9fe8a9acba8a7ef419e70b641fb)
Reviewed-on: http://git-master/r/1302038
(cherry picked from commit 44a80bd56710447a195f04da2e1a8a8810775453)

23 months agomisc: tegra-profiler: fix pmu init failure
Igor Nabirushkin [Mon, 5 Dec 2016 10:18:07 +0000]
misc: tegra-profiler: fix pmu init failure

On some linux-linux systems, midr register can be zeroed for
cores which are not really present in VM and this leads to PMU
initialization failure.
Process such cores correctly.
Do not show them in capabilities.

Bug 1848139

Change-Id: Id434a8e2cf4a323d49bdffe9ac06d837b05474ed
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: http://git-master/r/1270083
(cherry picked from commit 13569332e89040fe6a5ad05587ab52005055f4e6)
Reviewed-on: http://git-master/r/1274708
(cherry picked from commit 0889663b7fd527c06c37d0b25157eefce8b260b2)

23 months agomisc: tegra_profiler: fix dwarf unwinding
Igor Nabirushkin [Wed, 30 Nov 2016 09:29:26 +0000]
misc: tegra_profiler: fix dwarf unwinding

Problem is that on systems with a 64-bit kernel and 32 bit userspace,
read_user_data function reads 32-bit value into 64-bit uninitialized
variable, so high half of the variable might be dirty.
Use 32-bit temporary variable in such cases.

Bug 1846986

Change-Id: I2b024a00da536ad95e12e354597bde9811ca7998
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: http://git-master/r/1262234
(cherry picked from commit d58031aa0cb381ecc5a8c11d08b81a141c435244)
Reviewed-on: http://git-master/r/1274707
(cherry picked from commit 8b990d05eb94c305642dc2fbd8f79bc00bce0308)

23 months agotegra-profiler: convert spinlock to raw spinlock
Igor Nabirushkin [Mon, 21 Nov 2016 11:55:35 +0000]
tegra-profiler: convert spinlock to raw spinlock

Profiler kernel thread tries to acquire a spinlock for ring buffer
that was already locked before, this leads to BUG_ON in rt_mutex.
Convert this lock to raw lock, this prevents preemption during
the critical sections.
This commit fixes the bug on -rt kernels.

Bug 1843939

Change-Id: I3f4c0d28d13cb1c117dae4699fc79f466e72825f
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: http://git-master/r/1257247
(cherry picked from commit 7fb4665bde29ee5b4ab96618cc6b19c1ce9a59a6)
Reviewed-on: http://git-master/r/1274706
(cherry picked from commit 86f2c7adeac42096d46e5f531f6a8e1bf5a72826)

23 months agomisc: tegra-profiler: add timestamps to mmap event
Igor Nabirushkin [Mon, 10 Oct 2016 13:17:40 +0000]
misc: tegra-profiler: add timestamps to mmap event

- Add timestamps to mmap events.
- Add size of sample data (useful for user space).

Bug 1825161

Change-Id: I13d63f938d891eac1e697fab1d6118a57a5faa4b
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: http://git-master/r/1236250
(cherry picked from commit d0a5f9f394af8462bca1690abf7ee2cd8d8a5ca3)
Reviewed-on: http://git-master/r/1251886
(cherry picked from commit 32858420961ae8c615638050f1be320f5833c21c)

23 months agomisc: tegra-profiler: fix possible deadlock
Igor Nabirushkin [Fri, 2 Sep 2016 15:08:26 +0000]
misc: tegra-profiler: fix possible deadlock

power_clk: fix possible deadlock in read_source - move
cpufreq_get call out of power_clk_source lock.

Bug 200224828

Change-Id: Ia06159ccf5c084840818917ca10dcd667c347650
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: http://git-master/r/1216914
(cherry picked from commit 2d9bc2aa4fb102cb3f4064524503d76905240504)
Reviewed-on: http://git-master/r/1251883
(cherry picked from commit 3e413f90129a50346ccf6510033ec1715c1fcba8)

23 months agomisc: tegra-profiler: fix sleep inside atomic
Igor Nabirushkin [Thu, 1 Sep 2016 06:49:43 +0000]
misc: tegra-profiler: fix sleep inside atomic

Unwinding: fix possible sleep in atomic context.

Bug 200214930
Bug 200224828

Change-Id: Iaca298a689d14a5eb46fea01c24d72c56fd44a79
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: http://git-master/r/1216911
(cherry picked from commit 2decd51ef944f4804099bee4a1ebd2aca4e7ac47)
Reviewed-on: http://git-master/r/1251881
(cherry picked from commit 71d4937be67ec177c23131a3252752a939c778ca)

23 months agomisc: tegra-profiler: remove polling mode
Igor Nabirushkin [Tue, 23 Aug 2016 08:25:14 +0000]
misc: tegra-profiler: remove polling mode

Tegra Profiler: remove polling mode (we don't use this mode).

Bug 1801804

Change-Id: Ifef37af2e05322c9de8c15c13c3782abb1dc29f6
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: http://git-master/r/1208894
(cherry picked from commit 6e8d6cc08aeedc0d7308d9f66206fcaf46005045)
Reviewed-on: http://git-master/r/1251878
(cherry picked from commit c801413829a2e9a3648e0b3277c1047657e0f553)

23 months agomisc: tegra-profiler: fix validate_addr errors
Igor Nabirushkin [Fri, 11 Nov 2016 09:22:49 +0000]
misc: tegra-profiler: fix validate_addr errors

DWARF unwinding: do not try to read from unloaded sections

Bug 200176624

Change-Id: I2c0f90857a036a59ef80f905a5d7c7d2faea78b3
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: http://git-master/r/1168215
(cherry picked from commit b099bf6ed21bb3ff57ad5fe2f18849e67dc8b437)
Reviewed-on: http://git-master/r/1249596
(cherry picked from commit a2edf3f388259bf4b2bca0e0bd4cdec1707bf75e)

23 months agomisc: tegra-profiler: fix coverity defects
Igor Nabirushkin [Sun, 5 Jun 2016 12:58:52 +0000]
misc: tegra-profiler: fix coverity defects

Fix coverity defects. Use strlcpy() instead of strcpy() and
snprintf() instead of sprintf().

Coverity ID 24003 24004 24005 24006

Bug 200192567

Change-Id: Ifd33023ea9cf622e0376bcd249d5f0c4da28abfa
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: http://git-master/r/1171557
(cherry picked from commit 503371a9301b85f92b395497199a082754ed2b48)
Reviewed-on: http://git-master/r/1249594
(cherry picked from commit d054a43aca021ea757ed1428269ffd402be7526f)

23 months agomisc: tegra-profiler: fix coverity defect
Igor Nabirushkin [Sat, 4 Jun 2016 10:38:58 +0000]
misc: tegra-profiler: fix coverity defect

Fix coverity defect "Use of untrusted scalar value".

Coverity ID 24041

Bug 200192567

Change-Id: I92b4464525f45481e23a4fcfe2aea51de8cb8e07
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: http://git-master/r/1171552
(cherry picked from commit a3f967b70c47aa583ef2e1f4164c688ed641f388)
Reviewed-on: http://git-master/r/1249584
(cherry picked from commit 17f5d17ac835466558832cf6ed67eb72d2fc28c1)

23 months agomisc: tegra-profiler: fix coverity defect
Igor Nabirushkin [Sat, 4 Jun 2016 09:10:08 +0000]
misc: tegra-profiler: fix coverity defect

Fix coverity defect "Buffer not null terminated".

Coverity ID 23890

Bug 200192567

Change-Id: I5c55c7f0460b45a9185eb790338fc01b301bb10c
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: http://git-master/r/1171551
(cherry picked from commit 2d10b141f51e39602f1fe4c566c55ad3db184b07)
Reviewed-on: http://git-master/r/1249582
(cherry picked from commit 4e8a826423196af98fbdc0a5adc5d14b696e75b5)

23 months agomisc: tegra-profiler: fix coverity defect
Igor Nabirushkin [Sat, 4 Jun 2016 04:27:33 +0000]
misc: tegra-profiler: fix coverity defect

Fix coverity defect "Out-of-bounds access".

Coverity ID 29588

Bug 200192567

Change-Id: I8d1057d29216eeabdd24686fa12a52d7e2a220d4
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: http://git-master/r/1171550
(cherry picked from commit 7c76afae5c3fcac4c7365d3fd1fb5706e2b64446)
Reviewed-on: http://git-master/r/1249579
(cherry picked from commit 2ffb50ff95239cf489672c30f1ba40014e780da5)

23 months agotegra-profiler: fix unused function build issue
Sri Krishna chowdary [Tue, 24 May 2016 15:14:00 +0000]
tegra-profiler: fix unused function build issue

fix below compilation issues pointed out by clang

eh_unwind.c:182:1: error: unused function 'prel31_to_addr'
dwarf_unwind.c:441:1: error: unused function 'set_rule_reg'
armv8_pmu.c:236:1: error: unused function 'armv8_pmu_pmintenset_read'
armv8_pmu.c:246:1: error: unused function 'armv8_pmu_pmintenset_write'
armv8_pmu.c:260:1: error: unused function 'armv8_pmu_pmovsclr_read'
armv8_pmu.c:364:1: error: unused function 'disable_interrupt'
armv8_pmu.c:612:1: error: unused function 'pmu_read_emulate'

bug 1745660

Change-Id: If4a57aa0bfc375980357e3d92bdadac0b165695a
Signed-off-by: Sri Krishna chowdary <schowdary@nvidia.com>
Reviewed-on: http://git-master/r/1171549
(cherry picked from commit 4c4d58f49c61ebfe3b729b30166ddd9fe309977d)
Reviewed-on: http://git-master/r/1249578
(cherry picked from commit fee6b59514b50811bf66f8d531fd692bce63b29e)

23 months agomisc: tegra-profiler: fix compilation issue
Igor Nabirushkin [Thu, 19 May 2016 09:06:37 +0000]
misc: tegra-profiler: fix compilation issue

Fix below compilation issue.

dwarf_unwind.c:2044:1: error: stack frame size of 2080 bytes in
function 'quadd_get_user_cc_dwarf' [-Werror,-Wframe-larger-than=]

bug 1745660

Change-Id: I1b30ff58a1f636a2f0fe4160d0141a3bdf268675
Signed-off-by: Igor Nabirushkin <inabirushkin@nvidia.com>
Reviewed-on: http://git-master/r/1159465
(cherry picked from commit afff85102772697e5df2e18d0b94e1fe4dc29a3f)
Reviewed-on: http://git-master/r/1249576
(cherry picked from commit 667313a3cf7ceb84c4bf2e60dcebaaaee0f5c7ca)

23 months agomisc: tegra-profiler: fix getting capabilities
Alexey Kravets [Mon, 9 Nov 2015 10:32:08 +0000]
misc: tegra-profiler: fix getting capabilities

Bug 1416640

Change-Id: I96bef5e1f7326a8ba3e3e63a2d764f937b252da5
Signed-off-by: Alexey Kravets <akravets@nvidia.com>
Reviewed-on: http://git-master/r/830693
(cherry picked from commit 3576da34ba83153968df2121627d939562f81cec)
Reviewed-on: http://git-master/r/1249570
(cherry picked from commit 7e0b6b87c5410e0e5b65fda68678fb835a5ba405)

23 months agomm: larger stack guard gap, between vmas
Sri Krishna chowdary [Fri, 23 Jun 2017 06:26:03 +0000]
mm: larger stack guard gap, between vmas

commit 1be7107fbe18eed3e319a6c3e83c78254b693acb upstream.

Stack guard page is a useful feature to reduce a risk of stack smashing
into a different mapping. We have been using a single page gap which
is sufficient to prevent having stack adjacent to a different mapping.
But this seems to be insufficient in the light of the stack usage in
userspace. E.g. glibc uses as large as 64kB alloca() in many commonly
used functions. Others use constructs liks gid_t buffer[NGROUPS_MAX]
which is 256kB or stack strings with MAX_ARG_STRLEN.

This will become especially dangerous for suid binaries and the default
no limit for the stack size limit because those applications can be
tricked to consume a large portion of the stack and a single glibc call
could jump over the guard page. These attacks are not theoretical,
unfortunatelly.

Make those attacks less probable by increasing the stack guard gap
to 1MB (on systems with 4k pages; but make it depend on the page size
because systems with larger base pages might cap stack allocations in
the PAGE_SIZE units) which should cover larger alloca() and VLA stack
allocations. It is obviously not a full fix because the problem is
somehow inherent, but it should reduce attack space a lot.

One could argue that the gap size should be configurable from userspace,
but that can be done later when somebody finds that the new 1MB is wrong
for some special case applications.  For now, add a kernel command line
option (stack_guard_gap) to specify the stack gap size (in page units).

Implementation wise, first delete all the old code for stack guard page:
because although we could get away with accounting one extra page in a
stack vma, accounting a larger gap can break userspace - case in point,
a program run with "ulimit -S -v 20000" failed when the 1MB gap was
counted for RLIMIT_AS; similar problems could come with RLIMIT_MLOCK
and strict non-overcommit mode.

Instead of keeping gap inside the stack vma, maintain the stack guard
gap as a gap between vmas: using vm_start_gap() in place of vm_start
(or vm_end_gap() in place of vm_end if VM_GROWSUP) in just those few
places which need to respect the gap - mainly arch_get_unmapped_area(),
and and the vma tree's subtree_gap support for that.

Bug 1946430

Change-Id: I9a66aabc34b687996fb971e01bb0ef30a3d4de7d
Original-patch-by: Oleg Nesterov <oleg@redhat.com>
Original-patch-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Hugh Dickins <hughd@google.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Tested-by: Helge Deller <deller@gmx.de> # parisc
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[wt: backport to 4.11: adjust context]
[wt: backport to 4.9: adjust context ; kernel doc was not in admin-guide]
[wt: backport to 4.4: adjust context ; drop ppc hugetlb_radix changes]
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sri Krishna chowdary <schowdary@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1509433
Reviewed-by: Winnie Hsu <whsu@nvidia.com>
Tested-by: Winnie Hsu <whsu@nvidia.com>

2 years agovideo: tegra: dsi: Set max limit for reading panel
Pavan Kunapuli [Thu, 16 Mar 2017 14:02:06 +0000]
video: tegra: dsi: Set max limit for reading panel

In the debugfs support for reading panel registers, max payload
needs to be limited to the buff array size to avoid stack corruption.

Bug 1873360

Change-Id: Ibee7bd81027d2669297942c09b905f1dd3bb09ee
Signed-off-by: Pavan Kunapuli <pkunapuli@nvidia.com>
Signed-off-by: sakets <sakets@nvidia.com>
Reviewed-on: https://git-master/r/1505449
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>

2 years agovideo: tegra: nvmap: fix information leak in pin/unpin
Sri Krishna chowdary [Fri, 3 Mar 2017 05:14:08 +0000]
video: tegra: nvmap: fix information leak in pin/unpin

When the NVMAP_IOC_PIN_MULT_32 and NVMAP_IOC_UNPIN_MULT_32 are
called it is possible that the op.addr is not initialized. This
can cause write to some random address thus causing corruption.

This patch fixes Google Bug 31668540

bug 1832092

Change-Id: I4d12d1a6c777131ba1fa2a753ea640861f8e82a6
Signed-off-by: Sri Krishna chowdary <schowdary@nvidia.com>
Reviewed-on: http://git-master/r/1314406
(cherry picked from commit da0c43534bb61e2e0849e297d389517d5e4ed168)
Reviewed-on: http://git-master/r/1504672
Reviewed-by: Winnie Hsu <whsu@nvidia.com>
Tested-by: Winnie Hsu <whsu@nvidia.com>

2 years agogpu: nvgpu: Remove IOCTL FREE_OBJ_CTX
Terje Bergstrom [Tue, 8 Nov 2016 22:29:14 +0000]
gpu: nvgpu: Remove IOCTL FREE_OBJ_CTX

We have never used the IOCTL FREE_OBJ_CTX. Using it leads to context
being only partially available, and can lead to use-after-free.

Bug 1834225
Bug 1885775

Change-Id: I9d2b632ab79760f8186d02e0f35861b3a6aae649
Signed-off-by: Terje Bergstrom <tbergstrom@nvidia.com>
Reviewed-on: http://git-master/r/1250004
Reviewed-on: http://git-master/r/1258422
Signed-off-by: Debarshi Dutta <ddutta@nvidia.com>
(cherry picked from commit 9d4ed1b513b675c700cf1aa519663570ca188278 in
rel-24)
Reviewed-on: http://git-master/r/1489613
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
Tested-by: Bibek Basu <bbasu@nvidia.com>

2 years agovideo: tegra: nvmap: fix nvmap create handle vulnerability
skadamati [Thu, 15 Dec 2016 11:23:22 +0000]
video: tegra: nvmap: fix nvmap create handle vulnerability

Handle the race condition between malicious fd close and
copy_to_user error, which can create use after free condition.
This is fixed by deferring the fd install, which eliminates
the race that leads to use after free condition.
Fixing Google Bug 32160775.

Bug 1835857
Bug 200260161
Bug 1849492
Bug 1825283
CVE-2016-8424 (A-31606947)

Change-Id: I337807e4360661beced8f9e1155c47b66607b8df
Reviewed-on: http://git-master/r/1248391
(cherry picked from commit c26f2a34c189bef2d99740a420b2ab4023d912c0)
Reviewed-on: http://git-master/r/1273324
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: http://git-master/r/1285852
(cherry picked from commit b1513dff2b4bd35d1b400645642bce8dcf3c96c7)
Reviewed-on: http://git-master/r/1504680
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
Tested-by: Bibek Basu <bbasu@nvidia.com>
Reviewed-by: Winnie Hsu <whsu@nvidia.com>

2 years agovideo: tegra: host: Prevent the race between channel open and close
Gagan Grover [Fri, 4 Nov 2016 11:09:33 +0000]
video: tegra: host: Prevent the race between channel open and close

Moved fd_install() at the end of the channel_open ioctl. So, the fd
can't be used until open ioctl completes.

Bug 1832094

Change-Id: Ib33d43bf5164418a38f98677d4e3295f3d1c1450
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: http://git-master/r/1248180
(cherry picked from commit e6a41d5c0049c2878543006b67b7ee2b2bbda2ab)
Reviewed-on: http://git-master/r/1504683
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
Tested-by: Bibek Basu <bbasu@nvidia.com>
Reviewed-by: Winnie Hsu <whsu@nvidia.com>

2 years agovideo: tegra: nvmap: Fix NULL pointer dereference
Sri Krishna chowdary [Wed, 14 Dec 2016 06:28:30 +0000]
video: tegra: nvmap: Fix NULL pointer dereference

Consider the following case:
1. NVMAP_IOC_CREATE on IOVMM gives a valid fd to user space
2. user space does not call NVMAP_IOC_ALLOC.
3. user space calls a client driver IOCTL which calls dma_buf_map_attachment
4. call to dma_buf_map_attachment propagates till__nvmap_sg_table
   which has heap_pgalloc as true and tries to access pages[]
   which has all NULL.
5. Similarly, a dma_buf_kmap() can result in __nvmap_kmap() being called
   which again results in NULL dereference if pages[] is accessed.

A valid __nvmap_sg_table should occur only when h->alloc is true.
So, add check for it.

bug 1838597
bug 1883708

Change-Id: I400d9d8a94ff1003db207fc9c252b9256d796f60
Signed-off-by: Sri Krishna chowdary <schowdary@nvidia.com>
Reviewed-on: http://git-master/r/1270827
Signed-off-by: Debarshi Dutta <ddutta@nvidia.com>
(cherry picked from commit 928dc0a9fdc3f2f507dbc08ed4d54d0292fd4d9e in
rel-24)
Reviewed-on: http://git-master/r/1489493
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
Tested-by: Bibek Basu <bbasu@nvidia.com>

2 years agohid: i2c-hid: fix write in i2c_set_hid_set_report
Debarshi Dutta [Mon, 15 May 2017 05:16:48 +0000]
hid: i2c-hid: fix write in i2c_set_hid_set_report

Even though hid_hw_* checks that passed in data_len, it is not enough.
If data_len exceeds the BUFSIZE, the function returns.

Bug 1885135

Change-Id: Ie931852abdc1b25ac69ae0bc2c63bbcac82c1ca4
Signed-off-by: Debarshi Dutta <ddutta@nvidia.com>
Reviewed-on: http://git-master/r/1481617
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
Tested-by: Bibek Basu <bbasu@nvidia.com>

2 years agoarm64: tegra: jetson_cv: clear DSR bit in EMC_DYN_SELF_REF_CONTROL
Shreshtha SAHU [Mon, 22 May 2017 08:03:55 +0000]
arm64: tegra: jetson_cv: clear DSR bit in EMC_DYN_SELF_REF_CONTROL

Bug 1915944
Bug 200306741

Change-Id: If8bed3a3fd0c1331c64a35e2a440f1f6c1062dfa
Signed-off-by: Shreshtha SAHU <ssahu@nvidia.com>
Reviewed-on: http://git-master/r/1486906
Reviewed-by: Martin Chi <mchi@nvidia.com>
Tested-by: Martin Chi <mchi@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Winnie Hsu <whsu@nvidia.com>

2 years agoarm64: dt: emc: t210: Add nvidia,poll_thresh_freq
Shreshtha SAHU [Mon, 22 May 2017 07:28:34 +0000]
arm64: dt: emc: t210: Add nvidia,poll_thresh_freq

Set "nvidia,poll_thresh_freq" property to 408000.
This fixes the issue of DRAM refresh not getting
triggered hence DRAM refresh rate was not getting
updated with increasing or decreasing temperature.

Bug 200306741

Change-Id: Iaaf988e65aef80c6ff08e2390850c3343de3cc64
Signed-off-by: Shreshtha SAHU <ssahu@nvidia.com>
Reviewed-on: http://git-master/r/1486905
Reviewed-by: Martin Chi <mchi@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Winnie Hsu <whsu@nvidia.com>

2 years agotegra210-emc: Get max temperature of two DDR die
Shreshtha SAHU [Mon, 22 May 2017 07:21:35 +0000]
tegra210-emc: Get max temperature of two DDR die

DDR temperature is polled to decide the refresh rate
of DDR during high temperatures. In case of two die
solution, each die can have different temperature.

Hence take max temperature of two DDR die to detemine
DDR refresh speed next action.

Bug 1915944
Bug 200306741

Change-Id: Ica25bad6a9348d15c21f5260b4329762137c7e83
Signed-off-by: Shreshtha SAHU <ssahu@nvidia.com>
Reviewed-on: http://git-master/r/1486904
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Martin Chi <mchi@nvidia.com>
Tested-by: Martin Chi <mchi@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Winnie Hsu <whsu@nvidia.com>

2 years agoARM64: tegra21: lower threshold of dram throttle
Shreshtha SAHU [Mon, 22 May 2017 07:15:51 +0000]
ARM64: tegra21: lower threshold of dram throttle

Accroding to the tests, when temperature of Tboard reaches to ~74C,
EMC will swicthes to 2x refresh, so lower the threshold of dram
throttle to make sure it's able to switch to 2x refresh in time.

Bug 1915944
Bug 200306741

Change-Id: If7956f6d6bed86bedeafd25bd6626d7e1cfe0994
Signed-off-by: Shreshtha SAHU <ssahu@nvidia.com>
Reviewed-on: http://git-master/r/1486903
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Martin Chi <mchi@nvidia.com>
Tested-by: Martin Chi <mchi@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Winnie Hsu <whsu@nvidia.com>

2 years agovideo: tegra: nvmap: Fix security issue in NVMAP_IOC_PARAM
Gagan Grover [Thu, 24 Nov 2016 11:28:49 +0000]
video: tegra: nvmap: Fix security issue in NVMAP_IOC_PARAM

Initialized the uninitialized variables and handled return status
from nvmap_get_handle_param.

Bug 1820242
Bug 1884311

Change-Id: I2390c859d2b2af39eaff44749ca64e60920fe944
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: http://git-master/r/1259560
(cherry picked from commit cc94ffd0b3b2c2075cb870ead1e6e8994d902a56)
Reviewed-on: http://git-master/r/1489710
GVS: Gerrit_Virtual_Submit
Tested-by: Sumit Gupta <sumitg@nvidia.com>
Reviewed-by: Bibek Basu <bbasu@nvidia.com>

2 years agomedia: tegra: nvavp: Fix UAF issue.
Jitendra Kumar [Thu, 27 Oct 2016 08:35:00 +0000]
media: tegra: nvavp: Fix UAF issue.

Use locking to protect generated fd, so that it can't be
freed before channel open completes. Also add null value checks
in release call.

CVE-2016-8449 (A-31798848)
Bug 1830023
Bug 1849492

Change-Id: Ie6e2b29c7132fdfdff6b0bfa75440bd43afffd5f
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: http://git-master/r/1285817
(cherry picked from commit 2ff0fdedfd65f269359d6540df4662e958681aa7)
Reviewed-on: http://git-master/r/1299505
(cherry picked from commit ea1af2ce5a746bda36205357c9e0adaf527026bb)
Reviewed-on: http://git-master/r/1489467
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
Tested-by: Bibek Basu <bbasu@nvidia.com>
GVS: Gerrit_Virtual_Submit

2 years agogpu: nvgpu: serialize debug session IOCTLs
Deepak Nibade [Mon, 23 Jan 2017 11:32:07 +0000]
gpu: nvgpu: serialize debug session IOCTLs

Hold debug_s->ioctl_lock for all debug session IOCTLs to prevent
multi-threaded user space IOCTL calls.
Debug session IOCTL calls are not thread-safe and hence this
serialization is required.

Bug 1832267
Bug 1832095
Bug 1849492
Bug 1883499

Change-Id: I847ac951601d4f0093546b592bdb8c8f00185317
Reviewed-on: http://git-master/r/1286436
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: http://git-master/r/1292432
Signed-off-by: Debarshi Dutta <ddutta@nvidia.com>
(cherry picked from commit d4629278161f2dc3c74e0f13c6ca08038355dd22 in
rel-24)
Reviewed-on: http://git-master/r/1487009
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
Tested-by: Bibek Basu <bbasu@nvidia.com>

2 years agovideo: tegra: nvmap: Check if handle holds a buffer before map
Sri Krishna chowdary [Tue, 15 Nov 2016 05:53:30 +0000]
video: tegra: nvmap: Check if handle holds a buffer before map

Consider the following case:
1. NVMAP_IOC_CREATE gives a valid fd to user space
2. user space calls NVMAP_IOC_ALLOC and it fails. So, all
of the handle's allocation fields are zero.
3. Subsequent dma_buf_vmap, mmap on fd leads to __nvmap_mmap
call.
4. handle is valid but h->alloc, h->carveout, h->heap_pgalloc,
h->vaddr all are 0.
5. We check for h->heap_pgalloc which is false, so proceed and
dereference h->carveout leading to NULL pointer exception.

A valid __nvmap_mmap should occur only when h->alloc is true.
So, add check for it.

bug 1837468

Change-Id: I9be9d94f9b74c25b9b588fb1a16a74e96161ceda
Signed-off-by: Sri Krishna chowdary <schowdary@nvidia.com>
Reviewed-on: http://git-master/r/1253236
(cherry picked from commit c5da78cf3d0c19f1e04501a4b3f64a5acacd0ff3)
Reviewed-on: http://git-master/r/1311817
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
Tested-by: Bibek Basu <bbasu@nvidia.com>

2 years agotegra-cryptodev:check valid SHA message length
Konduri Praveen [Wed, 3 May 2017 05:11:36 +0000]
tegra-cryptodev:check valid SHA message length

SHA message length is provided from user space
through IOCTL call. If this length is not valid,
then it can lead to panic due to buffer overflow.

Fix by checking message length for SHA before
copying from user space.

Bug 1883640

Change-Id: I08e7a6037251822b7e8a3e1b7f00f71dc0495aba
Signed-off-by: Konduri Praveen <kondurip@nvidia.com>
Reviewed-on: http://git-master/r/1474442
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Mallikarjun Kasoju <mkasoju@nvidia.com>
Reviewed-by: Bibek Basu <bbasu@nvidia.com>

2 years agofbcon: unblank console during mode_switch
Naveen Kumar S [Thu, 29 Sep 2016 12:24:29 +0000]
fbcon: unblank console during mode_switch

VT stays blank if a graphical application (e.g.: X server) powers down
DC before switching to VT. This happens because the powerdown info
is not transmitted to VT, and it assumes itself to be in unblanked state.
To avoid such a scenario, unblank console during a switch from a different
mode.

bug 1826852
bug 200223878
bug 200271418

Change-Id: Iaeb322c1e9197ca33be05b1d4a6a8f3051f5967d
Signed-off-by: Naveen Kumar S <nkumars@nvidia.com>
Reviewed-on: http://git-master/r/1229223
(cherry picked from commit ef2b7d41eee03582b41097ef8e3ec68c99c12638)
Reviewed-on: http://git-master/r/1327327
Tested-by: Nine Feng <nfeng@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Winnie Hsu <whsu@nvidia.com>

2 years agodriver: media: tegra: fix v4l2 issue for 12bit
esen chen [Fri, 17 Mar 2017 08:52:29 +0000]
driver: media: tegra: fix v4l2 issue for 12bit

Fix v4l2 capture issue for 12bit sensor

Bug 200247041

Change-Id: I68daeaa1a66fa8d3554e1cf4f17ba0818e8b8c49
Signed-off-by: Esen Chen <esenc@nvidia.com>
Reviewed-on: http://git-master/r/1250786
(cherry picked from commit 280b810dbf3a441c6415242f15327de198d974a)
Reviewed-on: http://git-master/r/1322929
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bhanu Murthy V <bmurthyv@nvidia.com>
Reviewed-by: Frank Chen <frankc@nvidia.com>
Reviewed-by: Winnie Hsu <whsu@nvidia.com>

2 years agovideo: tegra: host: Fix overflow issue allocation
Mikko Perttunen [Fri, 27 Jan 2017 07:32:20 +0000]
video: tegra: host: Fix overflow issue allocation

Change kmalloc to kmalloc_array to prevent overflow issues
caused by large values supplied by user.

Based on "video: tegra: host: Fix overflow issues in allocation"
in nvhost/.

Coverity ID 27942
Bug 1856419

Change-Id: I5e96d0ec184543782dfe8814ad7e856b3b71221c
Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
Reviewed-on: http://git-master/r/1295060
GVS: Gerrit_Virtual_Submit
Reviewed-by: Arto Merilainen <amerilainen@nvidia.com>

2 years agoDT: Jetson: Remove unused usb-vbus3 DT node
Suresh Mangipudi [Tue, 4 Apr 2017 12:04:39 +0000]
DT: Jetson: Remove unused usb-vbus3 DT node

Removing the usb-vbus3 DT node which is not being used.
USB1 is sourcing vbus from usb-vbus3 DT node, removal of
this node result in regulator get failure.
Hence adding a dummy vbus source for USB1.

Bug 200294630

Based on change 83838c9d37522e903e668edc4cec6870614086f5

Change-Id: Ida623c30dbd22ed2757c5612bbb47e146380bd20
Signed-off-by: Suresh Mangipudi <smangipudi@nvidia.com>
Reviewed-on: http://git-master/r/1454823
GVS: Gerrit_Virtual_Submit
Reviewed-by: Krishna Yarlagadda <kyarlagadda@nvidia.com>
Reviewed-by: Bibek Basu <bbasu@nvidia.com>

2 years ago[media] uvcvideo: fix null pointer dereference
Henry Lin [Wed, 23 Nov 2016 11:51:34 +0000]
[media] uvcvideo: fix null pointer dereference

stream->urb_num needs to set to 0 while freeing urbs to avoid null
pointer dereference afterwards.

Bug 200237870

Change-Id: Ib26f7b23f34db049790e7a5b31a8bde181b74d99
Signed-off-by: Henry Lin <henryl@nvidia.com>
Signed-off-by: Bibek Basu <bbasu@nvidia.com>
Reviewed-on: http://git-master/r/1258903
(cherry picked from commit 5531411014e4b1239a597a1511c736d1bfb31cb0)
Reviewed-on: http://git-master/r/1281107
GVS: Gerrit_Virtual_Submit

2 years ago[media] uvcvideo: improve urb buffer allocation
Henry Lin [Wed, 21 Sep 2016 16:02:03 +0000]
[media] uvcvideo: improve urb buffer allocation

Some UVC device (e.g. StereoLabs ZED camera) may have strict timing
requirement for transferring video payload. This change improves URB
buffer allocation for UVC device with bulk VideoStreaming interface. The
criteria for buffer allocation are:
- Let an URB able to receive a complete UVC payload
- Prepare and submit URBs for a complete video frame

If system memory is large enough, URB buffers will consume memory size
up to a complete video frame.

Bug 1674178

Change-Id: If5f366582ee1c1cb559e890176d74484634dccef
Signed-off-by: Henry Lin <henryl@nvidia.com>
Signed-off0by: Bibek Basu <bbasu@nvidia.com>
Reviewed-on: http://git-master/r/1225266
(cherry picked from commit 4797f84301fe6ff42313c688e72e4f7c0d52b2e6)
Reviewed-on: http://git-master/r/1239557
(cherry picked from commit 3d96f9a8e9f50e08a8306b94378c08dcdfa83abc)
Reviewed-on: http://git-master/r/1281090
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
Tested-by: Bibek Basu <bbasu@nvidia.com>

2 years agoarm: dts: Remove support for IMX208 sensor
Vincent Chung [Thu, 24 Nov 2016 01:24:43 +0000]
arm: dts: Remove support for IMX208 sensor

Remove support for the IMX208 sensor in all T124 target branches due
to a security vulnerability reported for the Pixel C.

This Gerrit removes the DeviceTree and configuration references.

boot.img size not changed.

Bug 1825317

Change-Id: I04c7a8cad07f31ea5aa4a33389838f2ce2a8f31f
Signed-off-by: Vincent Chung <vincentc@nvidia.com>
Reviewed-on: http://git-master/r/1259194
(cherry picked from commit ca610513f9ff266ca475fdd7689100661a25054f)
Reviewed-on: http://git-master/r/1260885
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Jihoon Bang <jbang@nvidia.com>
Tested-by: Winnie Hsu <whsu@nvidia.com>

2 years agodrivers: media: Remove support for IMX208 sensor
Vincent Chung [Tue, 22 Nov 2016 02:33:03 +0000]
drivers: media: Remove support for IMX208 sensor

Remove support for the IMX208 sensor in all T124 target branches due
to a security vulnerability reported for the Pixel C.

This Gerrit removes the IMX208 driver.

Bug 1825317

Change-Id: I5a5b140526c9aabe3f57d60cd750176579f18391
Signed-off-by: Vincent Chung <vincentc@nvidia.com>
Reviewed-on: http://git-master/r/1259195
(cherry picked from commit 7dca6a9ec76c83aabf21a7d1c9ac6f48fc7fa3f4)
Reviewed-on: http://git-master/r/1260883
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Jihoon Bang <jbang@nvidia.com>
Tested-by: Winnie Hsu <whsu@nvidia.com>

2 years agoiommu/tegra: pci: fix PCIe switch configurations
Vidya Sagar [Sun, 20 Nov 2016 11:48:21 +0000]
iommu/tegra: pci: fix PCIe switch configurations

fixes of_node lookup even if the PCIe device(s) are not
connected directly to root port, rather connected via a
PCIe switch configuratin.

Bug 200253693

Change-Id: I952c1dcc83a3cc6ecccae195c246b2bb1eec7354
Signed-off-by: Vidya Sagar <vidyas@nvidia.com>
Reviewed-on: http://git-master/r/1256856
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Alex Waterman <alexw@nvidia.com>
Reviewed-by: Krishna Reddy <vdumpa@nvidia.com>
Reviewed-by: Pritesh Raithatha <praithatha@nvidia.com>

2 years agoASoC: tegra-alt: fix noisy audio issue
Sameer Pujar [Thu, 5 Jan 2017 05:58:28 +0000]
ASoC: tegra-alt: fix noisy audio issue

Playback of few sample rates is affected due to incorrect pll_a
and pll_a_out0 values. Issues seen with 8kHz, 176.4kHz and some
of the odd frequency (multiples of 11.025kHz) streams.

Current patch provides required rates for pll_a and pll_a_out0.
pll_a rate is fixed at 338.688MHz, which can serve odd sample
rates. To support lower frequency sample rates (8/11.025 kHz),
pll_a_out0 is reduced to half of its value corresponding to
even/odd stream rates.

Bug 1849362

Change-Id: Icc1e7b08b573dc6ca1f4cc84ff931bf9fefe1a98
Signed-off-by: Sameer Pujar <spujar@nvidia.com>
Reviewed-on: http://git-master/r/1280564
(cherry picked from commit 8cf22e26dcfe7fa390188ca42b52df5c07adc56c)
Reviewed-on: http://git-master/r/1281482
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
Tested-by: Bibek Basu <bbasu@nvidia.com>

2 years agoarm64: dts: update pll source for sdmmc3
Jerry Chang [Fri, 13 Jan 2017 06:15:03 +0000]
arm64: dts: update pll source for sdmmc3

add pll_c4_out2 clock source for HS200 mode

Bug 1847474

Change-Id: I310846d5679d8bbce2fffe5af9eb0199e91c0f21
Signed-off-by: Jerry Chang <jerchang@nvidia.com>
Reviewed-on: http://git-master/r/1284689
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Jackie Chen <jackchen@nvidia.com>
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
Reviewed-by: Vick Yu <vyu@nvidia.com>

2 years agopcie: host: tegra: use GFP_DMA32 for MSI mem alloc
Martin Chi [Fri, 24 Feb 2017 02:10:01 +0000]
pcie: host: tegra: use GFP_DMA32 for MSI mem alloc

uses GFP_DMA32 instead of GFP_KERNEL while allocating
memory to be given to PCIe end points to issue write
transactions to generate MSI interrupts.
This fixes issues with PCIe end points that are capable
of generating writes to only 32-bit addresses for generating
MSI interrupts

Bug 200234273

Signed-off-by: Vidya Sagar <vidyas@nvidia.com>
Reviewed-on: http://git-master/r/1227735
(cherry picked from commit 11b39e38141e2b862ed79b9b414e0412e0e0e2f4)
Change-Id: I269cb5c55bcac20fd14deb2311067e8a1f58c49b
Signed-off-by: Martin Chi <mchi@nvidia.com>
Reviewed-on: http://git-master/r/1306920
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>

2 years agovideo: tegra: nvmap: fix possible use after free
Gagan Grover [Tue, 22 Nov 2016 09:31:11 +0000]
video: tegra: nvmap: fix possible use after free

Fix possible use after free issue.

Bug 1814555
Bug 1884319

Change-Id: I826aa34f61d43fda5419a528697ce84ba2ce1eae
Reviewed-on: http://git-master/r/1221643
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: http://git-master/r/1257999
(cherry picked from commit b1647da33cff0c498ca8439a722ea1962ecf6901 in rel-24)
Reviewed-on: http://git-master/r/1460521
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
Tested-by: Bibek Basu <bbasu@nvidia.com>

2 years agodrivers: crypto: Avoid use of tainted scalar value
Konduri Praveen [Wed, 3 May 2017 03:42:41 +0000]
drivers: crypto: Avoid use of tainted scalar value

Copy from user may taint the scalar value members
in the respective struct variables.
Add check for verifying the validity of the
scalar value members to avoid undefined behaviour.

Bug 1903278

Change-Id: I727f28783eee880d03c90c027d3538b7e4b57b6d
Signed-off-by: Konduri Praveen <kondurip@nvidia.com>
Reviewed-on: http://git-master/r/1474467
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Rakesh Babu Bodla <rbodla@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Mallikarjun Kasoju <mkasoju@nvidia.com>
Reviewed-by: Bibek Basu <bbasu@nvidia.com>

2 years agovideo: tegra: host: add lower bound to num_syncpt_incrs
Gagan Grover [Fri, 21 Oct 2016 06:15:00 +0000]
video: tegra: host: add lower bound to num_syncpt_incrs

Check if there is at least one syncpt_incrs in each job.

Bug 1812182

Change-Id: I0bd0b2e7c4d01641c83ba729ec34390ddea81496
Reviewed-on: http://git-master/r/1221226
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: http://git-master/r/1240374
Reviewed-by: Arto Merilainen <amerilainen@nvidia.com>
(cherry picked from commit 847bb69132adcdb8fc2ce2d7dabeb80d9cc2aa32)
Reviewed-on: http://git-master/r/1460494
GVS: Gerrit_Virtual_Submit
Tested-by: Sandipan Patra <spatra@nvidia.com>
Reviewed-by: Winnie Hsu <whsu@nvidia.com>

2 years agodccp: fix freeing skb too early for IPV6_RECVPKTINFO
Sandipan Patra [Tue, 21 Mar 2017 10:14:31 +0000]
dccp: fix freeing skb too early for IPV6_RECVPKTINFO

In the current DCCP implementation an skb for a DCCP_PKT_REQUEST packet
is forcibly freed via __kfree_skb in dccp_rcv_state_process if
dccp_v6_conn_request successfully returns.

However, if IPV6_RECVPKTINFO is set on a socket, the address of the skb
is saved to ireq->pktopts and the ref count for skb is incremented in
dccp_v6_conn_request, so skb is still in use. Nevertheless, it gets
freed
in dccp_rcv_state_process.

Fix by calling consume_skb instead of doing goto discard and therefore
calling __kfree_skb.

Similar fixes for TCP:

fb7e2399ec17f1004c0e0ccfd17439f8759ede01 [TCP]: skb is unexpectedly
freed.
0aea76d35c9651d55bbaf746e7914e5f9ae5a25d tcp: SYN packets are now
simply consumed

Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Bug 200285540

Change-Id: I3bec712b03278102c88933d4684324c3f414b606
Signed-off-by: Sandipan Patra <spatra@nvidia.com>
Reviewed-on: http://git-master/r/1325178
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>

2 years agogpu: nvgpu: acquire mutex for notifier read
Deepak Nibade [Mon, 27 Feb 2017 10:53:21 +0000]
gpu: nvgpu: acquire mutex for notifier read

We use &ch->error_notifier_mutex to protect writes and free of error
notifier. But we currently do not protect reading of notifier in
gk20a_fifo_set_ctx_mmu_error() and vgpu_fifo_set_ctx_mmu_error().
Add new API gk20a_set_error_notifier_locked() which is same as
gk20a_set_error_notifier() but without the locks.
In *_fifo_set_ctx_mmu_error() APIs, acquire the mutex explicitly,
and then use this new API gk20a_set_error_notifier() will now just
call gk20a_set_error_notifier_locked() within a mutex

Bug 1824788
Bug 1844312
Bug 200270206

Change-Id: I1f3831dc63fe1daa761b2e17e4de3c155f505d6f
Signed-off-by: Deepak Nibade <dnibade@nvidia.com>
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: http://git-master/r/1273471
(cherry picked from commit 505b442551a2e27aa3bc9e608c5a2bc9fccecbc4)
Reviewed-on: http://git-master/r/1311857
Reviewed-on: http://git-master/r/1324991
GVS: Gerrit_Virtual_Submit
Tested-by: Sandipan Patra <spatra@nvidia.com>
Reviewed-by: Bibek Basu <bbasu@nvidia.com>

2 years agovideo: tegra: nvmap: Fix print format specifier
Gagan Grover [Tue, 29 Nov 2016 13:02:40 +0000]
video: tegra: nvmap: Fix print format specifier

The format specifier %p can leak kernel addresses.
The fix is designed to use %pK instead of %p, which also evaluates
whether kptr_restrict is set.

CVE-2016-8409 A-31495687

Bug 1844902
Bug 200286375

Change-Id: I57a1fca9c58c0ac433415e39c82ab72d7429e48e
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: http://git-master/r/1261530
(cherry picked from commit aa8d5a3cda7ecce610c39baee371a3ca8a6533a5)
Reviewed-on: http://git-master/r/1315831
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Matthew Pedro <mapedro@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Shivdas Patil <shivdasp@nvidia.com>
Tested-by: Christian Gonzalez <christiang@nvidia.com>
Reviewed-by: Kaustubh Purandare <kpurandare@nvidia.com>
Reviewed-by: Winnie Hsu <whsu@nvidia.com>

2 years agovideo: tegra: nvmap: fix time-of-check,time-of-use vulnerability
Sri Krishna chowdary [Sat, 25 Feb 2017 19:02:47 +0000]
video: tegra: nvmap: fix time-of-check,time-of-use vulnerability

Validate the region specified by offset and size before performing
the operations like nvmap_prot_handle, nvmap_cache_maint and nvmap_handle_mk*.
This validation of offset and size once the values are in local variables
guarantees that even though user space changes the values in user buffers,
nvmap continues to perform operations with the contents that are validated.
Fixes Google Bug 34113000.

Bug 1862379
Bug 1880033

Change-Id: I32786d26c269a95122fbaf0b91d6d090cba7388e
Signed-off-by: Bibek Basu <bbasu@nvidia.com>
Reviewed-on: http://git-master/r/1298712
(cherry picked from commit f45441da608d8015ece73d253d4bdb48863f99e2)
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: http://git-master/r/1311449
(cherry picked from commit 18b957d355340c436c7e58a95b2907402684b242)
Reviewed-on: http://git-master/r/1319904
GVS: Gerrit_Virtual_Submit

2 years agoFix L4T Bluetooth l2cap PTS test failures
Mahesh Patil [Fri, 24 Feb 2017 20:49:31 +0000]
Fix L4T Bluetooth l2cap PTS test failures

Include proper FCS length in Bluetooth l2cap ertm packet
retransmission and added l2cap extended feature UCD
(unicast connectionless data reception) support flag.

Bug 1882139

Change-Id: I02facaff214f3d9bf963f0843aa1de1c5dedcfd6
Signed-off-by: Mahesh Patil <maheshp@nvidia.com>
Reviewed-on: http://git-master/r/1311185
Reviewed-by: Nagarjuna Kristam <nkristam@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Rohit Vaswani <rvaswani@nvidia.com>
Reviewed-by: Ashutosh Jha <ajha@nvidia.com>

2 years agomedia: tegra: camera: Fix stack overread
Amey Asgaonkar [Mon, 16 May 2016 23:33:15 +0000]
media: tegra: camera: Fix stack overread

We are not checking a variable which is user
controlled. This can lead to reading of the
stack data. Adding a check to ensure it is
less than the max possible value of the variable.

Bug 1763649

Change-Id: I395e882d030199bdd7684837906a9b5d60741650
Signed-off-by: Amey Asgaonkar <aasgaonkar@nvidia.com>
Signed-off-by: Bibek Basu <bbasu@nvidia.com>
Reviewed-on: http://git-master/r/1150943
(cherry picked from commit 14359cb871606ffefa4ca2070b7e9ccb08dcd378)
Reviewed-on: http://git-master/r/1260833
Reviewed-by: Shreshtha Sahu <ssahu@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Matthew Pedro <mapedro@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Christian Gonzalez <christiang@nvidia.com>
Tested-by: Christian Gonzalez <christiang@nvidia.com>

2 years agoarm64: config: enable Trusty for L4T
Stephen Warren [Wed, 9 Nov 2016 16:22:34 +0000]
arm64: config: enable Trusty for L4T

L4T systems will include the Trusty secure OS in the near future. Enable
the drivers required to communicate with Trusty in L4T's defconfig.

Bug 1818826

Change-Id: I7f0d139ea5a72e267f249510cd090e2aa94ae785
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Reviewed-on: http://git-master/r/1255194
(cherry picked from commit 226a18e5a581107c1c0e25642eedf924d53f5ce7 in dev-kernel-3.10)
Reviewed-on: http://git-master/r/1257374
GVS: Gerrit_Virtual_Submit
Reviewed-by: Varun Wadekar <vwadekar@nvidia.com>

2 years agoARM64: t210: dts: use virtual timer for secure timer
Sharif Inamdar [Fri, 23 Oct 2015 11:44:03 +0000]
ARM64: t210: dts: use virtual timer for secure timer

Initially with Trusty, we were facing a crash since kernel
registers for both secure and non-secure timer and trusty registers
for secure timer. Since both registers for the same interrupt we
see a crash.

The suggested fix was to make the arch timer driver register for
non-secure and virtual timer by changing the secure interrupt value
to virtual interrupt such that the kernel registers for non-secure
and virtual timer where as trusty then registers for secure timer.

With this we get rid of the crash since both trusty and arch timer
driver registers for different interrupt value.
arch timer driver will now register for non-secure and virtual timer.
Trusty will use the secure timer for its operation.

Bug 200148571
Bug 1818826

Change-Id: I5405c105e3694128afe93fb73371d4fae43300f1
Signed-off-by: Sharif Inamdar <isharif@nvidia.com>
Reviewed-on: http://git-master/r/822025
(cherry picked from commit 402e96ae9dbda633ccf9f44e2e1884454f8b2443 in dev-kernel-3.18)
(swarren manually applied the k3.18 patch to k3.10)
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Reviewed-on: http://git-master/r/1255192
(cherry picked from commit 1d26af2ce2315553274bfd819fead1e17ef9eb51 in dev-kernel-3.10)
Reviewed-on: http://git-master/r/1257373
GVS: Gerrit_Virtual_Submit
Reviewed-by: Varun Wadekar <vwadekar@nvidia.com>

2 years agotrusty: Don't register IPI
Wayne Lin [Wed, 23 Mar 2016 17:46:06 +0000]
trusty: Don't register IPI

System will randomly crash in trusty after enabling IPI.
If the previous CPU is A57, and IPI send to Denver.
There will be some memory coherence issue in trusty.

Bug 200184071
Bug 1818826

Change-Id: I9422cc75ce70acfdd44f5662c492ed0d64d3f212
Signed-off-by: Wayne Lin <wlin@nvidia.com>
Reviewed-on: http://git-master/r/1114575
(cherry picked from commit cc6387320acb8b2cd7c6345e62de32ac9a27b53e)
Reviewed-on: http://git-master/r/1115131
(cherry picked from commit 13b2e5944b9d5cb80782342fead3a022d3e63618 in dev-kernel-3.18)
(swarren manually applied the k3.18 patch to k3.10)
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Reviewed-on: http://git-master/r/1255191
(cherry picked from commit 5cef87e303dcc5f2af2821d874357fb62c3ab725 in dev-kernel-3.10)
Reviewed-on: http://git-master/r/1257372
GVS: Gerrit_Virtual_Submit
Reviewed-by: Varun Wadekar <vwadekar@nvidia.com>

2 years agotrusty-ipc: Add support for default Trusty IPC device
Michael Ryleev [Thu, 30 Jul 2015 19:50:08 +0000]
trusty-ipc: Add support for default Trusty IPC device

If particular Trusty IPC device to operate on is not
important caller can pass NULL for dev parameter to
tipc_create_channel routine to access default Trusty IPC
device.

Bug 1818826

Change-Id: Ib35f44f87ee9d71f827263c6a667a5852d4286e6
Signed-off-by: Michael Ryleev <gmar@google.com>
(cherry picked from commit 78dd8a2878e3e7cf8d5fa998eea47a54bcb848b3 from https://android.googlesource.com/kernel/common/+/android-trusty-3.10)
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Reviewed-on: http://git-master/r/1255190
(cherry picked from commit 4a2adf1b31dbb404b9276ed3772fa749fc7ead3b in dev-kernel-3.10)
Reviewed-on: http://git-master/r/1257371
GVS: Gerrit_Virtual_Submit
Reviewed-by: Varun Wadekar <vwadekar@nvidia.com>

2 years agotrusty-virtio: add support for 64-bit phys addresses for vrings
Michael Ryleev [Thu, 22 Oct 2015 01:15:30 +0000]
trusty-virtio: add support for 64-bit phys addresses for vrings

Work around limitation of vring descriptor structure that only
supports 32 bits addresses. On archs with 64 bit physical addresses
store top 32 bits of such address in currently unused reserved field.

Bug 1818826

Change-Id: I30333f6b8966db89bd4b8a699a72b80c6257a31f
Signed-off-by: Michael Ryleev <gmar@google.com>
(cherry picked from commit 5905c66d15412a6e0d82e3675fb5f01431040785 from https://android.googlesource.com/kernel/common/+/android-trusty-3.10)
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Reviewed-on: http://git-master/r/1255189
(cherry picked from commit df360bc31f3b875af6a3f72bc7175228a9f06a0b in dev-kernel-3.10)
Reviewed-on: http://git-master/r/1257370
GVS: Gerrit_Virtual_Submit
Reviewed-by: Varun Wadekar <vwadekar@nvidia.com>

2 years agotrusty-ipc: Fix a corner case in dn_handle_message
Michael Ryleev [Tue, 13 Oct 2015 02:51:04 +0000]
trusty-ipc: Fix a corner case in dn_handle_message

Return an original RX buffer to actually implement intended behavior
in corner case when tipc_chan_get_rx_buffer fails. This is only
currently possible when 0 order memory allocation fails.

Bug 1818826

Change-Id: I8599f7cfcecd2dda0e1d01c5477c9ac519bf6dcf
Signed-off-by: Michael Ryleev <gmar@google.com>
(cherry picked from commit a32bbb810f65b8d036148a34ce1b05fd9188d2b4 from https://android.googlesource.com/kernel/common/+/android-trusty-3.10)
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Reviewed-on: http://git-master/r/1255188
(cherry picked from commit 5c6842c0723256446aabee37e8f48cd25e028c4f in dev-kernel-3.10)
Reviewed-on: http://git-master/r/1257369
GVS: Gerrit_Virtual_Submit
Reviewed-by: Varun Wadekar <vwadekar@nvidia.com>

2 years agotrusty-ipc: Fix a corner case in _handle_disc_request
Michael Ryleev [Tue, 13 Oct 2015 01:55:29 +0000]
trusty-ipc: Fix a corner case in _handle_disc_request

It is possible to receive a valid disconnect request when channel
still is in connecting state.

Bug 1818826

Change-Id: Iad1ef831a0ca5fc793f6d1df0be5b48933b633db
Signed-off-by: Michael Ryleev <gmar@google.com>
(cherry picked from commit fe31b177f1f36f74febbb666af1319af8d1ee497 from https://android.googlesource.com/kernel/common/+/android-trusty-3.10)
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Reviewed-on: http://git-master/r/1255187
(cherry picked from commit c6ddbc8bf143376e0fe2de679cfec656b8727adb in dev-kernel-3.10)
Reviewed-on: http://git-master/r/1257368
GVS: Gerrit_Virtual_Submit
Reviewed-by: Varun Wadekar <vwadekar@nvidia.com>

2 years agotrusty-ipc: Add aio based readv and writev support
Michael Ryleev [Fri, 18 Dec 2015 22:46:40 +0000]
trusty-ipc: Add aio based readv and writev support

This implementation is aio based and suitable for older
kernels.

Bug 1818826

Change-Id: I0f21f727898d3bed9e7bb71df26371edb06061c0
Signed-off-by: Michael Ryleev <gmar@google.com>
(cherry picked from commit 834aa62117ed2eae7b60874f2ed7cd7670f5bf1f from https://android.googlesource.com/kernel/common/+/android-trusty-3.10)
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Reviewed-on: http://git-master/r/1255186
(cherry picked from commit 254130096e987d01134c025c34572d95a3ccab95 in dev-kernel-3.10)
Reviewed-on: http://git-master/r/1257367
GVS: Gerrit_Virtual_Submit
Reviewed-by: Varun Wadekar <vwadekar@nvidia.com>

2 years agotrusty: Add smp support
Arve Hjønnevåg [Sat, 24 Jan 2015 01:55:48 +0000]
trusty: Add smp support

Add an unlocked nop call to allow multiple cpus to enter trusty.
Other standard calls are still serialized to avoid return codes
getting mixed up.
A new return code is used to indicate that the standard call is
running on another cpu.

Bug 1818826

Change-Id: Iccc0785138fbc3eb9daebf22fd79d6c1f9b23f6a
Signed-off-by: Arve Hjønnevåg <arve@android.com>
(cherry picked from commit 51132bfbacfcc63b4414fcb3b0bc62e737da93e3 from https://android.googlesource.com/kernel/common/+/android-trusty-3.10)
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Reviewed-on: http://git-master/r/1255185
(cherry picked from commit 4d23c49eef7df76107393312feb6569656de50c8 in dev-kernel-3.10)
Reviewed-on: http://git-master/r/1257366
GVS: Gerrit_Virtual_Submit
Reviewed-by: Varun Wadekar <vwadekar@nvidia.com>

2 years agoarm: smp: Add support for custom ipi interrupt handlers
Arve Hjønnevåg [Tue, 3 Mar 2015 23:24:40 +0000]
arm: smp: Add support for custom ipi interrupt handlers

This allows forwarding IPIs to the trustzone OS.

Bug 1818826

Change-Id: I368ae24e8679afa089bfe14d44bf7a59b72b5c95
Signed-off-by: Arve Hjønnevåg <arve@android.com>
(swarren, Arve's s-o-b received by email)
(cherry picked from commit 63df83ff361160be6cba09ef84696342a03e65d9 from https://android.googlesource.com/kernel/common/+/android-trusty-3.10)
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Reviewed-on: http://git-master/r/1255184
(cherry picked from commit d442eac05903422d631b11720b4fccc7bd208a12 in dev-kernel-3.10)
Reviewed-on: http://git-master/r/1257365
GVS: Gerrit_Virtual_Submit
Reviewed-by: Varun Wadekar <vwadekar@nvidia.com>

2 years agoarm64: smp: Add support for custom ipi interrupt handlers
Arve Hjønnevåg [Sat, 24 Jan 2015 01:53:12 +0000]
arm64: smp: Add support for custom ipi interrupt handlers

This allows forwarding IPIs to the trustzone OS.

Bug 1818826

Change-Id: I157ce3a554a8a422755ac479815366fc893f6fea
Signed-off-by: Arve Hjønnevåg <arve@android.com>
(cherry picked from commit a000af3a0fc5ad20769b1060eab1633de907ce8e from https://android.googlesource.com/kernel/common/+/android-trusty-3.10)
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Reviewed-on: http://git-master/r/1255183
(cherry picked from commit 6e66ce11edd14102bc3b57d30a2b3f0abf479915 in dev-kernel-3.10)
Reviewed-on: http://git-master/r/1257364
GVS: Gerrit_Virtual_Submit
Reviewed-by: Varun Wadekar <vwadekar@nvidia.com>

2 years agotrusty: Handle fiqs without calling notifier and enabling interrupts
Arve Hjønnevåg [Fri, 12 Jun 2015 02:51:54 +0000]
trusty: Handle fiqs without calling notifier and enabling interrupts

Bug 1818826

Change-Id: I3e396497283237b83a43127098dde0bf6e781c1f
Signed-off-by: Arve Hjønnevåg <arve@android.com>
(swarren, Arve's s-o-b received by email)
(cherry picked from commit 63f6b6cdcad0c6f23de0b694310cb1659b577e8e)
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Reviewed-on: http://git-master/r/1255182
(cherry picked from commit b8edc8e1a219e5eedb9457d1de452f7f37a62fcf in dev-kernel-3.10)
Reviewed-on: http://git-master/r/1257363
GVS: Gerrit_Virtual_Submit
Reviewed-by: Varun Wadekar <vwadekar@nvidia.com>

2 years agotrusty: Select api version
Arve Hjønnevåg [Fri, 12 Jun 2015 02:34:28 +0000]
trusty: Select api version

Select api version in probe, and store it in trusty_state.
This enables new return codes from trusty, and will later be used
to enable a nop stdcall that does not take smc_lock.

Bug 1818826

Change-Id: Ia72d4264537ce7ddba12b867c3221dd92db22056
Signed-off-by: Arve Hjønnevåg <arve@android.com>
(swarren, Arve's s-o-b received by email)
(cherry picked from commit 7f12378c142220404248c32eac0a8ca68de9c37a from https://android.googlesource.com/kernel/common/+/android-trusty-3.10)
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Reviewed-on: http://git-master/r/1255181
(cherry picked from commit 4e9d3d16313c081a349cf1c8ed98b2472ebad7be in dev-kernel-3.10)
Reviewed-on: http://git-master/r/1257362
GVS: Gerrit_Virtual_Submit
Reviewed-by: Varun Wadekar <vwadekar@nvidia.com>