16 months agoarm64: Improve CNTVCT/CNTFRQ macros for compat read rel-24-uda-r1.4
Nicolin Chen [Fri, 12 Jan 2018 23:12:15 +0000]
arm64: Improve CNTVCT/CNTFRQ macros for compat read

Having opcode checked might not be sufficient in some corner cases
as an MRC or MRRC instruction might jump into the same trap handler
while having the same opcode but reading a different corprocessor.
In this case, that instruction will get an unexpected result -- a
CNTVCT or CNTFRQ value.

So this patch just simply check all fields (except condition fields)
to make sure the instruction is for CNTVCT or CNTFRQ. Since it does
not hurt to unconditionally read a CNTVCT/CNTFRQ value, this change
just ignore the condition field and read it anyway.

Bug 2044346

Change-Id: Ia63855573d1b63d5bf503567556bd64bd83e0458
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1637504
Reviewed-by: Vinayak Pane <vpane@nvidia.com>
Tested-by: Vinayak Pane <vpane@nvidia.com>

16 months agoarm64: Handle traps from accessing CNTVCT/CNTFRQ via 32-bit instructions
Nicolin Chen [Wed, 10 Jan 2018 02:59:20 +0000]
arm64: Handle traps from accessing CNTVCT/CNTFRQ via 32-bit instructions

CNTVCT and CNTFRQ can be accessed via 32-bit instructions (mrrc/mrc).

So the trap handler should take care of these two situations as well.
Otherwise, it will trigger an "undefined instruction" state and file
a SIGILL back to user space without caring about which application.

Bug 2044346

Change-Id: I39de0a3f332c405042bb181ccdf616eeb96b1608
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1635304
GVS: Gerrit_Virtual_Submit
Reviewed-by: Vinayak Pane <vpane@nvidia.com>
Tested-by: Vinayak Pane <vpane@nvidia.com>

16 months ago[PATCH 4/4] clocksource: arch_timer: make virtual counter access configurable
Greg Hackmann [Tue, 9 Jan 2018 04:00:15 +0000]
[PATCH 4/4] clocksource: arch_timer: make virtual counter access configurable

Bug 2031796

Change-Id: Ibdb1fd768b748002b90bfc165612c12c8311f8a2
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1634425
GVS: Gerrit_Virtual_Submit
Reviewed-by: Vinayak Pane <vpane@nvidia.com>
Tested-by: Vinayak Pane <vpane@nvidia.com>

16 months agoTZ: API to invalidate BTB
Mahesh Lagadapati [Fri, 22 Dec 2017 01:22:53 +0000]
TZ: API to invalidate BTB

This change exposes the API "te_invalidate_btb" to invalidate BTB

Bug 1975157

Change-Id: I0143c6ff27381844db7a0f736b41e335590b2fbc
Signed-off-by: Mahesh Lagadapati <mlagadapati@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1624365
GVS: Gerrit_Virtual_Submit
Reviewed-by: Stephen Wolfe <swolfe@nvidia.com>
Reviewed-by: Mustafa Bilgen <mbilgen@nvidia.com>
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

16 months agoRevert "Revert "[PATCH 3/4] arm64: Issue isb when trapping CNTVCT_EL0 access""
Manish Tuteja [Mon, 8 Jan 2018 21:09:13 +0000]
Revert "Revert "[PATCH 3/4] arm64: Issue isb when trapping CNTVCT_EL0 access""

This reverts commit 3e137be12e5399b5fcd36e53c662468dd123d38a.

Change-Id: I0ff80eaff0085bc7e4565d34a7ba27f9647d4002
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Signed-off-by: Manish Tuteja <mtuteja@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1634115

16 months agoRevert "Revert "[PATCH 2/4] BACKPORT: arm64: Add CNTFRQ_EL0 trap handler""
Manish Tuteja [Mon, 8 Jan 2018 21:13:42 +0000]
Revert "Revert "[PATCH 2/4] BACKPORT: arm64: Add CNTFRQ_EL0 trap handler""

This reverts commit 8f483d726671284eae98f45a013bd29d2b194028.

Change-Id: I7db83b9ecb4f79e7ed24d442eb4b5cf7d42c1d31
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Signed-off-by: Manish Tuteja <mtuteja@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1634116

16 months agoRevert "Revert "[PATCH 1/4] BACKPORT: arm64: Add CNTVCT_EL0 trap handler""
Manish Tuteja [Mon, 8 Jan 2018 21:14:06 +0000]
Revert "Revert "[PATCH 1/4] BACKPORT: arm64: Add CNTVCT_EL0 trap handler""

This reverts commit 1428be593190e4b82e74f5d672aab9f4acef48c2.

Change-Id: I5694bb4171c0cac19599919ed8743b1e97b88b88
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Signed-off-by: Manish Tuteja <mtuteja@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1634117

16 months agotegra210: emc training timer race condition
David DSH [Wed, 3 Jan 2018 01:05:17 +0000]
tegra210: emc training timer race condition

del_timer can be called at the same time as modtimer which lead to null
function pointer

Bug 200376954

Change-Id: I15c14db1eb610a91f89a15901e09cd8f0cae45db
Signed-off-by: David DSH <ddastoussthi@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1632366
GVS: Gerrit_Virtual_Submit
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

16 months agoRevert "[PATCH 1/4] BACKPORT: arm64: Add CNTVCT_EL0 trap handler"
Gagan Grover [Fri, 5 Jan 2018 03:46:46 +0000]
Revert "[PATCH 1/4] BACKPORT: arm64: Add CNTVCT_EL0 trap handler"

This reverts commit fe7b634c82d1c21f7c83caecf8bd23cbdf56d389.

Change-Id: I60bb869c902d6efd82115e716ad4a426e6961b4f
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1632116
Reviewed-by: Manish Tuteja <mtuteja@nvidia.com>
Tested-by: Manish Tuteja <mtuteja@nvidia.com>

16 months agoRevert "[PATCH 2/4] BACKPORT: arm64: Add CNTFRQ_EL0 trap handler"
Gagan Grover [Fri, 5 Jan 2018 03:46:15 +0000]
Revert "[PATCH 2/4] BACKPORT: arm64: Add CNTFRQ_EL0 trap handler"

This reverts commit b7437af000c530e53cedce73a942571405766245.

Change-Id: Ic60a62cd170d595219e379f0e2fbddb10672dc02
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1632115
Reviewed-by: Manish Tuteja <mtuteja@nvidia.com>
Tested-by: Manish Tuteja <mtuteja@nvidia.com>

16 months agoRevert "[PATCH 3/4] arm64: Issue isb when trapping CNTVCT_EL0 access"
Gagan Grover [Fri, 5 Jan 2018 03:43:19 +0000]
Revert "[PATCH 3/4] arm64: Issue isb when trapping CNTVCT_EL0 access"

This reverts commit e0d40dddcfa7388d2f71a1fe3798eaae0704fd0a.

Change-Id: I34deebeb196d18313f3cbc8c1ed0e6f1bc0b7ff1
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1632114
Reviewed-by: Manish Tuteja <mtuteja@nvidia.com>
Tested-by: Manish Tuteja <mtuteja@nvidia.com>

16 months agousb: xhci-hub: Fix kernel panic on invalid addr
Jim Lin [Thu, 2 Nov 2017 10:54:52 +0000]
usb: xhci-hub: Fix kernel panic on invalid addr

To fix a kernel panic in xhci_find_slot_id_by_port when xhci->devs[i]->udev
is accessed but not initialized.

bug 200326779

Change-Id: I6dacd488d59a7e06f32b28464ef50008990c52be
Signed-off-by: Jim Lin <jilin@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1590604
GVS: Gerrit_Virtual_Submit
Reviewed-by: ChihMin Cheng <ccheng@nvidia.com>
Reviewed-by: Henry Lin <henryl@nvidia.com>
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

16 months agoarm64: Add CONFIG_HARDEN_BRANCH_PREDICTOR option
Martin Gao [Thu, 21 Dec 2017 23:48:19 +0000]
arm64: Add CONFIG_HARDEN_BRANCH_PREDICTOR option

Aliasing attacks against CPU branch predictors can allow an attacker to
redirect speculative control flow on some CPUs and potentially divulge
information from one context to another.

This patch adds a Kconfig option to enable implementation-specific
mitigations against these attacks for CPUs that are affected. Currently,
a workaround is only implemented for Cortex-A57 and Cortex-A72, which
additionally relies on the EL3 firmware setting CPUACTLR_EL1[0] to 1.

Back ported from K4.9: https://git-master.nvidia.com/r/1621628/

Bug 1975157

Change-Id: Id0b12003837f64a60780ec96b2cf22725615ad35
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1626828
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

16 months agoarm64: alternative: Provide if/else/endif assembler macros
Nicolin Chen [Thu, 21 Dec 2017 03:58:13 +0000]
arm64: alternative: Provide if/else/endif assembler macros

The existing alternative_insn macro has some limitations that make it
hard to work with. In particular the fact it takes instructions from it
own macro arguments means it doesn't play very nicely with C pre-processor
macros because the macro arguments look like a string to the C
pre-processor. Workarounds are (probably) possible but things start to
look ugly.

Introduce an alternative set of macros that allows instructions to be
presented to the assembler as normal and switch everything over to the
new macros.

==  This is a back port change from K4.4 to K3.10 so it also includes: ==
  arm64: alternatives: add enable parameter to conditional asm macros

  There are cases where we want to compile out both versions of an
  alternative code block, so add an enable parameter to the new conditional
  alternative assembly macros in the same way as alternative_insn.

Bug 1975157

Change-Id: I39fd42525f717c63e9b5f8a9ec182e77a3e28401
Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1626807
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

16 months ago[PATCH 3/4] arm64: Issue isb when trapping CNTVCT_EL0 access
Greg Hackmann [Wed, 20 Dec 2017 09:36:20 +0000]
[PATCH 3/4] arm64: Issue isb when trapping CNTVCT_EL0 access

Bug 2031796
CVE-2017-13218

Change-Id: I6005a6e944494257bfc2243fde2f7a09c3fd76c6
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1623697
GVS: Gerrit_Virtual_Submit
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

16 months ago[PATCH 2/4] BACKPORT: arm64: Add CNTFRQ_EL0 trap handler
Marc Zyngier [Wed, 20 Dec 2017 09:34:10 +0000]
[PATCH 2/4] BACKPORT: arm64: Add CNTFRQ_EL0 trap handler

We now trap accesses to CNTVCT_EL0 when the counter is broken
enough to require the kernel to mediate the access. But it
turns out that some existing userspace (such as OpenMPI) do
probe for the counter frequency, leading to an UNDEF exception
as CNTVCT_EL0 and CNTFRQ_EL0 share the same control bit.

The fix is to handle the exception the same way we do for CNTVCT_EL0.

Bug 2031796
CVE-2017-13218

Fixes: a86bd139f2ae ("arm64: arch_timer: Enable CNTVCT_EL0 trap if workaround is enabled")
Reported-by: Hanjun Guo <guohanjun@huawei.com>
Tested-by: Hanjun Guo <guohanjun@huawei.com>
Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
(cherry picked from commit 9842119a238bfb92cbab63258dabb54f0e7b111b)
Change-Id: Ie5a9a93fcca238d6097ecacd6df0e540be90220b
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1623696
GVS: Gerrit_Virtual_Submit
Reviewed-by: Vinayak Pane <vpane@nvidia.com>
Reviewed-by: Bo Yan <byan@nvidia.com>
Reviewed-by: Mandar Padmawar <mpadmawar@nvidia.com>

16 months ago[PATCH 1/4] BACKPORT: arm64: Add CNTVCT_EL0 trap handler
Marc Zyngier [Wed, 20 Dec 2017 03:24:17 +0000]
[PATCH 1/4] BACKPORT: arm64: Add CNTVCT_EL0 trap handler

Since people seem to make a point in breaking the userspace visible
counter, we have no choice but to trap the access. Add the required
handler.

Bug 2031796
CVE-2017-13218

Acked-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
(cherry picked from commit 6126ce0588eb5a0752d5c8b5796a7fca324fd887)
Change-Id: I4204b5e1db899849ca16e6b26fe234339815f864
Signed-off-by: Rohit Khanna <rokhanna@nvidia.com>
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1621712
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bo Yan <byan@nvidia.com>
Reviewed-by: Mandar Padmawar <mpadmawar@nvidia.com>

17 months agostaging: android: ashmem: fix a race condition in ASHMEM_SET_SIZE ioctl
Viktor Slavkovic [Fri, 15 Dec 2017 11:45:48 +0000]
staging: android: ashmem: fix a race condition in ASHMEM_SET_SIZE ioctl

A lock-unlock is missing in ASHMEM_SET_SIZE ioctl which can result in a
race condition when mmap is called. After the !asma->file check, before
setting asma->size, asma->file can be set in mmap. That would result in
having different asma->size than the mapped memory size. Combined with
ASHMEM_UNPIN ioctl and shrinker invocation, this can result in memory
corruption.

Bug 2031796
ANDROID-66954097

Bug: 66954097
Signed-off-by: Viktor Slavkovic <viktors@google.com>
Change-Id: I268225133f96fde0fadd1ec621aafef27d392d65
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1618689
GVS: Gerrit_Virtual_Submit
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

17 months agoALSA: timer: Call notifier in the same spinlock
Manoj Gangwal [Thu, 14 Dec 2017 08:34:55 +0000]
ALSA: timer: Call notifier in the same spinlock

From fe9cd48f4b3273dc1c9e52567edb4e77dafa45d8 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Wed, 10 Feb 2016 12:47:03 +0100
Subject: [PATCH] UPSTREAM: ALSA: timer: Call notifier in the same spinlock

snd_timer_notify1() is called outside the spinlock and it retakes the
lock after the unlock.  This is rather racy, and it's safer to move
snd_timer_notify() call inside the main spinlock.

The patch also contains a slight refactoring / cleanup of the code.
Now all start/stop/continue/pause look more symmetric and a bit better
readable.

Bug: 37240993

Change-Id: I2e0b18e14ed6ecb39c7425dce0f67bec0e13ae36
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Siqi Lin <siqilin@google.com>
Signed-off-by: Manoj Gangwal <mgangwal@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1617816
GVS: Gerrit_Virtual_Submit
Reviewed-by: Sanjay Singh Chauhan <schauhan@nvidia.com>
Reviewed-by: Mandar Padmawar <mpadmawar@nvidia.com>

17 months agousb: xhci-tegra: Add option en/disable USB3 speed
Jim Lin [Fri, 17 Nov 2017 14:02:40 +0000]
usb: xhci-tegra: Add option en/disable USB3 speed

Add user-mode option to disable USB3 speed.
Writing 0xFFFFFFFF to
  /sys/devices/platform/tegra-xhci/downgrade_usb3
will downgrade device from USB3.0 speed to USB2.0 speed immediately.
e.g.,
echo "0xFFFFFFFF" > /sys/devices/platform/tegra-xhci/downgrade_usb3
in command line.

Add user-mode option to enable USB3 speed.
Writing 0 to
  /sys/devices/platform/tegra-xhci/downgrade_usb3
will support USB3.0 speed on next device connection.
e.g.,
echo "0" > /sys/devices/platform/tegra-xhci/downgrade_usb3
in command line.

bug 200365041

Change-Id: I9e2a60d1f7e6f38fa2d3d52c3483f1e8e5dc813f
Signed-off-by: Jim Lin <jilin@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1600372
Reviewed-by: Ashutosh Jha <ajha@nvidia.com>

17 months agogpu: nvgpu: Validate buffer_offset argument
skadamati [Thu, 28 Sep 2017 06:51:28 +0000]
gpu: nvgpu: Validate buffer_offset argument

Validate the mapping_size argument in the VM mapping IOCTL before
attempting to use the argument for anything.

Manual Cherry pick - https://git-master.nvidia.com/r/1547046

Bug 1954931
Bug 1993254
Bug 200288656

Change-Id: I81b22dc566c6c6f89e5e62604ce996376b33a343
Signed-off-by: Alex Waterman <alexw@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1547046
Signed-off-by: skadamati <skadamati@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1569976
(cherry picked from commit 84c14d463b613b6f29455295f27683821a78dce9)
Reviewed-on: https://git-master.nvidia.com/r/1584264
(cherry picked from commit 25e2877d988453dc29bd1573e6d8f8b566bce170)
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1606956
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Mandar Padmawar <mpadmawar@nvidia.com>
Tested-by: Mandar Padmawar <mpadmawar@nvidia.com>

18 months agovideo: tegra: dc: fix multiple HPD in HDCP
Prafull Suryawanshi [Wed, 16 Aug 2017 10:29:02 +0000]
video: tegra: dc: fix multiple HPD in HDCP

This change clears the g_fallback flag only when there
is real HPD. HDCP state machine uses g_fallback to decide
if it has to authenticate 2.2 or 1.4 on this. So it skips
multiple HPD to be notified to userspace. Earlier to this
change, when HDCP authentication falls from 2.2 to 1.4,
 it used to send hpd unplug and plug event.

bug 1744655

Change-Id: Idd778cfab918e95b6c8c72ad2a684787e673bd9a
Signed-off-by: Prafull Suryawanshi <prafulls@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1539437
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Santosh Galma <galmar@nvidia.com>
Reviewed-by: Aly Hirani <ahirani@nvidia.com>
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

18 months agousb: xhci-tegra: Add sysfs node to degrade USB3.0
Jim Lin [Thu, 19 Oct 2017 11:12:05 +0000]
usb: xhci-tegra: Add sysfs node to degrade USB3.0

Add sysfs node at
 /sys/devices/platform/tegra-xhci/downgrade_usb3
for system app to write non-zero value to trigger degradation
to USB2.0 mode if USB3.0 device is listed in
 /sys/module/xhci_hcd/parameters/downgraded_usb3
already.

Bug 1978463

Change-Id: Iacf3e663354b648f9fc8d7b7a36129a633ee95c0
Signed-off-by: Jim Lin <jilin@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1581878
GVS: Gerrit_Virtual_Submit
Reviewed-by: Manish Tuteja <mtuteja@nvidia.com>

18 months agousb: core: quirks: Added to be downgraded to USB2.0
Jim Lin [Tue, 17 Oct 2017 13:49:21 +0000]
usb: core: quirks: Added to be downgraded to USB2.0

Added into quirk list to downgrade USB 3.0 to USB2.0 mode
when device is connected to root-hub port to reduce RF interference.

Bug 1978463

Change-Id: I58d3fed174e12e723c87b30a8cf4bf5627c9021d
Signed-off-by: Jim Lin <jilin@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1580531
GVS: Gerrit_Virtual_Submit
Reviewed-by: ChihMin Cheng <ccheng@nvidia.com>
Reviewed-by: Manish Tuteja <mtuteja@nvidia.com>

18 months agousb: xhci-tegra: downgrade USB3 device for quirk
Jim Lin [Tue, 26 Sep 2017 13:51:42 +0000]
usb: xhci-tegra: downgrade USB3 device for quirk

Add module_param_array for downgraded_usb3 array parameter which
can be filled with maximum 100 array members.

The parameter will have quirk flag USB_QUIRK_DOWNGRADE_USB3
to be set in update_driver callback during hub_port_init phase.

Quirked USB3.0 device will be running at USB2.0 mode.

Bug 1978463

Change-Id: I46f5ceee4d915d24e4359c879690e83a0a3ac435
Signed-off-by: Jim Lin <jilin@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1568577
GVS: Gerrit_Virtual_Submit
Reviewed-by: ChihMin Cheng <ccheng@nvidia.com>
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

18 months agousb: Add quirk flag to downgrade USB3.0 device
Jim Lin [Tue, 26 Sep 2017 13:45:59 +0000]
usb: Add quirk flag to downgrade USB3.0 device

Add quirk flag to downgrade USB3.0 to USB2.0 mode.

Bug 1978463

Change-Id: I800e765dce96d4a4902834b84a50acdb6d63be4f
Signed-off-by: Jim Lin <jilin@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1568576
GVS: Gerrit_Virtual_Submit
Reviewed-by: ChihMin Cheng <ccheng@nvidia.com>
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

19 months agonet: wireless: bcmdhd: Disable roaming by default
Srinivas Ramachandran [Wed, 29 Mar 2017 00:19:28 +0000]
net: wireless: bcmdhd: Disable roaming by default

Issue: Roaming triggers known regression issues with latest
       firmware and leads to no internet access (until user
       manually disconnects and reconnects to AP).
Fix:   To prevent this state, disable roaming until fw issue
       is resolved.

Bug 1895940

Change-Id: Icd5cc4d5d4d0ab0eb2940c2e59553f8ec1e65947
Signed-off-by: Srinivas Ramachandran <srinivasra@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1580682
Reviewed-by: Manish Tuteja <mtuteja@nvidia.com>
Tested-by: Manish Tuteja <mtuteja@nvidia.com>

19 months agoBACKPORT: pids: make task_tgid_nr_ns() safe
Oleg Nesterov [Fri, 6 Oct 2017 06:54:01 +0000]
BACKPORT: pids: make task_tgid_nr_ns() safe

This was reported many times, and this was even mentioned in commit
52ee2dfdd4f5 "pids: refactor vnr/nr_ns helpers to make them safe" but
somehow nobody bothered to fix the obvious problem: task_tgid_nr_ns()
is not safe because task->group_leader points to nowhere after the
exiting task passes exit_notify(), rcu_read_lock() can not help.

We really need to change __unhash_process() to nullify group_leader,
parent, and real_parent, but this needs some cleanups. Until then we
can turn task_tgid_nr_ns() into another user of __task_pid_nr_ns() and
fix the problem.

Bug 2000058

Bug: 31495866
Reported-by: Troy Kensinger <tkensinger@google.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
(cherry picked from commit dd1c1f2f2028a7b851f701fc6a8ebe39dcb95e7c)
Change-Id: Iad19a77f4f0aa9f3b6b0539ac9c549fa64c18550
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1574419
GVS: Gerrit_Virtual_Submit
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

19 months agoipv6/dccp: do not inherit ipv6_mc_list from parent
WANG Cong [Tue, 9 May 2017 23:59:54 +0000]
ipv6/dccp: do not inherit ipv6_mc_list from parent

Like commit 657831ffc38e ("dccp/tcp: do not inherit mc_list from parent")
we should clear ipv6_mc_list etc. for IPv6 sockets too.

Bug 1970716
Bug 1971959
Bug 200288656

Cc: Eric Dumazet <edumazet@google.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 83eaddab4378db256d00d295bda6ca997cd13a52)
Change-Id: Icaa523c47ab1daa47caa2ffd13c6f6d1ab3b1b55
Reviewed-on: https://git-master.nvidia.com/r/1574219
Reviewed-by: Manish Tuteja <mtuteja@nvidia.com>
Tested-by: Manish Tuteja <mtuteja@nvidia.com>

19 months agonet: wireless: bcmdhd: remove SDIO debug IOVARs causing out of bounds
Insun Song [Fri, 7 Jul 2017 21:53:03 +0000]
net: wireless: bcmdhd: remove SDIO debug IOVARs causing out of bounds

"sd_devreg" IOVAR can cause out of bounds access when user input
manipulated. Proposed fix is removing debug oriented IOVARs completely.

Bug: 37622847
Bug 1990376
Signed-off-by: Insun Song <insun.song@broadcom.com>
Change-Id: I8fc5111fe9d8d2c5d7ae5b1c24ae8e531113beae
Reviewed-on: https://git-master.nvidia.com/r/1565309
(cherry picked from commit c0fac815bbc4b78915e030054a01752f133fe219)
Reviewed-on: https://git-master.nvidia.com/r/1572875
GVS: Gerrit_Virtual_Submit
Reviewed-by: Om Prakash Singh <omp@nvidia.com>
Tested-by: Om Prakash Singh <omp@nvidia.com>
Reviewed-by: Manish Tuteja <mtuteja@nvidia.com>

19 months agonet: wireless: bcmdhd: adding boundary check in wl_notify_rx_mgmt_frame
Insun Song [Wed, 24 May 2017 16:21:02 +0000]
net: wireless: bcmdhd: adding boundary check in wl_notify_rx_mgmt_frame

added boundary check for input parameters not to corrupt kernel heap in
case user injected malformed input

Bug: 37306719
Bug 1971966
Change-Id: I6dc12e9bcfce8f3b43ecf14bfd6976bf87afeaa5
Signed-off-by: Insun Song <insun.song@broadcom.com>
Reviewed-on: https://git-master.nvidia.com/r/1562394
(cherry picked from commit 0104f956f90f2eb6460461392aa6aacc426a3593)
Reviewed-on: https://git-master.nvidia.com/r/1572856
Reviewed-by: Manish Tuteja <mtuteja@nvidia.com>
Tested-by: Manish Tuteja <mtuteja@nvidia.com>

19 months agonet: wireless: bcmdhd: adding boudary check in wl_escan_handler
Insun Song [Mon, 5 Jun 2017 17:21:10 +0000]
net: wireless: bcmdhd: adding boudary check in wl_escan_handler

WLC_E_ESCAN_RESULT event could be manipulated especially two length field
inside, one is for escan_result buffer length and another one is
bss_info length, the forged fields may bypass current length check and
corrupt kernel heap memory.

so added checking validation for two length fields in WLC_E_ESCAN_RESULT
event.

Bug: 37351060
Bug 1971966
Change-Id: I31e9fccc48fc06278fb3a87a76ef7337296c2b0d
Signed-off-by: Insun Song <insun.song@broadcom.com>
Reviewed-on: https://git-master.nvidia.com/r/1562393
(cherry picked from commit ff046d4d4051d582a21cee2e453ac892158d20ff)
Reviewed-on: https://git-master.nvidia.com/r/1572855
GVS: Gerrit_Virtual_Submit
Reviewed-by: Om Prakash Singh <omp@nvidia.com>
Tested-by: Om Prakash Singh <omp@nvidia.com>
Reviewed-by: Manish Tuteja <mtuteja@nvidia.com>

19 months agomedia: usb: em28xx: add support for WinTV-SoloHD
Henning Garbers [Sat, 22 Apr 2017 22:05:36 +0000]
media: usb: em28xx: add support for WinTV-SoloHD

Backport to support the PCTV tripleStick (292e) and the Hauppauge
WinTV-soloHD (same hardware but different USB IDs).
SHA: 7dd154e9e27c6bd73e8cc8d9d990bace787ba452
Also added PID for retail WinTV-soloHD Bulk, 8264 is their OEM version.

Bug 1918181

Change-Id: I61d4647a12f02f4e413a35aed862dba9424ad730
Signed-off-by: Sungtak Lee <taklee@google.com>
Signed-off-by: Patrick Horng <phorng@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1558403
GVS: Gerrit_Virtual_Submit
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

19 months agoplatform: tegra: powergate: use tegra_mc_flush API
Krishna Reddy [Tue, 22 Aug 2017 18:47:59 +0000]
platform: tegra: powergate: use tegra_mc_flush API

powergate code shouldn't access hotreset registers directly.
It should use tegra_mc_flush API.

Bug 200327368

Change-Id: Ibd35744a8e2b68dfd74c677b95912b7b2a3743d9
Signed-off-by: Krishna Reddy <vdumpa@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1554867
(cherry picked from commit 72663c6477ad587cdb4f31c5f860f2f18bc57841)
Reviewed-on: https://git-master.nvidia.com/r/1566235
GVS: Gerrit_Virtual_Submit
Reviewed-by: Manish Tuteja <mtuteja@nvidia.com>
Tested-by: Manish Tuteja <mtuteja@nvidia.com>

19 months ago[PATCH] Prevent potential double frees in sg driver
Robb Glasser [Tue, 26 Sep 2017 06:21:02 +0000]
[PATCH] Prevent potential double frees in sg driver

sg_ioctl could be spammed by requests, leading to a double free in
__free_pages. This protects the entry points of sg_ioctl where the
memory could be corrupted by a double call to __free_pages if multiple
requests are happening concurrently.

Bug 1970716
Bug 1971959
Bug 200288656

Bug:35644812
Change-Id: Ie13f65beb6974430f90292e2742841b26aecb8b1
Signed-off-by: Robb Glasser <rglasser@google.com>
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1568288
(cherry picked from commit a59fff36c5a23ded36dab87d70548f7ba18b6d4a)
Reviewed-on: https://git-master.nvidia.com/r/1570222
GVS: Gerrit_Virtual_Submit
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

19 months agomm/mempolicy.c: fix error handling in set_mempolicy and mbind.
Chris Salls [Sat, 8 Apr 2017 06:48:11 +0000]
mm/mempolicy.c: fix error handling in set_mempolicy and mbind.

In the case that compat_get_bitmap fails we do not want to copy the
bitmap to the user as it will contain uninitialized stack data and leak
sensitive data.

Bug 1970716
Bug 1971959
Bug 200288656

Signed-off-by: Chris Salls <salls@cs.ucsb.edu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit cf01fb9985e8deb25ccf0ea54d916b8871ae0e62)
Change-Id: I60f7ed76df891df1ad57140b0892d6b22cde94f9
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1568281
(cherry picked from commit d1032e2d497514b4539dd7be66972b9f62356016)
Reviewed-on: https://git-master.nvidia.com/r/1570221
GVS: Gerrit_Virtual_Submit
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

19 months agoip6_gre: fix ip6gre_err() invalid reads
Eric Dumazet [Sun, 5 Feb 2017 07:18:55 +0000]
ip6_gre: fix ip6gre_err() invalid reads

Andrey Konovalov reported out of bound accesses in ip6gre_err()

If GRE flags contains GRE_KEY, the following expression
*(((__be32 *)p) + (grehlen / 4) - 1)

accesses data ~40 bytes after the expected point, since
grehlen includes the size of IPv6 headers.

Let's use a "struct gre_base_hdr *greh" pointer to make this
code more readable.

p[1] becomes greh->protocol.
grhlen is the GRE header length.

Bug 1970716
Bug 1971959
Bug 200288656

Fixes: c12b395a4664 ("gre: Support GRE over IPv6")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 7892032cfe67f4bde6fc2ee967e45a8fbaf33756)
Change-Id: Iad0a924abddf49d0f5ba07afd9ce16795f74bdfd
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1568275
(cherry picked from commit 98ba3df721c016a83d1d74963b0c09d17eaa6f7f)
Reviewed-on: https://git-master.nvidia.com/r/1570220
GVS: Gerrit_Virtual_Submit
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

19 months agotcp: avoid infinite loop in tcp_splice_read()
Eric Dumazet [Fri, 3 Feb 2017 22:59:38 +0000]
tcp: avoid infinite loop in tcp_splice_read()

Splicing from TCP socket is vulnerable when a packet with URG flag is
received and stored into receive queue.

__tcp_splice_read() returns 0, and sk_wait_data() immediately
returns since there is the problematic skb in queue.

This is a nice way to burn cpu (aka infinite loop) and trigger
soft lockups.

Again, this gem was found by syzkaller tool.

Bug 1970716
Bug 1971959
Bug 200288656

Fixes: 9c55e01c0cc8 ("[TCP]: Splice receive support.")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov  <dvyukov@google.com>
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit ccf7abb93af09ad0868ae9033d1ca8108bdaec82)
Change-Id: I0ed67e83effcc6c1970fe6f8192e00bf3947138d
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1565183
(cherry picked from commit 63fdebd244e1b6ddb72fcd75e6cd4fc97a3aac97)
Reviewed-on: https://git-master.nvidia.com/r/1570219
GVS: Gerrit_Virtual_Submit
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

19 months agoipx: call ipxitf_put() in ioctl error path
Dan Carpenter [Tue, 2 May 2017 10:58:53 +0000]
ipx: call ipxitf_put() in ioctl error path

We should call ipxitf_put() if the copy_to_user() fails.

Bug 1970716
Bug 1971959
Bug 200288656

Reported-by: 李强 <liqiang6-s@360.cn>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit ee0d8d8482345ff97a75a7d747efc309f13b0d80)
Change-Id: I5460804b62e4d81dd8de403aafc7aff64a5a3edf
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1565173
(cherry picked from commit fd2ac9fa0a7ef25f584f6d9bd05843f94594f4d1)
Reviewed-on: https://git-master.nvidia.com/r/1570217
GVS: Gerrit_Virtual_Submit
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

19 months agodccp/tcp: do not inherit mc_list from parent
Eric Dumazet [Tue, 9 May 2017 13:29:19 +0000]
dccp/tcp: do not inherit mc_list from parent

syzkaller found a way to trigger double frees from ip_mc_drop_socket()

It turns out that leave a copy of parent mc_list at accept() time,
which is very bad.

Very similar to commit 8b485ce69876 ("tcp: do not inherit
fastopen_req from parent")

Initial report from Pray3r, completed by Andrey one.
Thanks a lot to them !

Bug 1970716
Bug 1971959
Bug 200288656

Change-Id: I5917eb701382a098553186fcf9f50347957cf5cd
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Pray3r <pray3r.z@gmail.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1564121
(cherry picked from commit 84a456465ed1e2e980f8490a534223f957998e75)
Reviewed-on: https://git-master.nvidia.com/r/1570216
GVS: Gerrit_Virtual_Submit
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

19 months agodrivers: hid: hid-atv-javis: set silence timeout
Martin Gao [Thu, 21 Sep 2017 03:15:51 +0000]
drivers: hid: hid-atv-javis: set silence timeout

- If we are getting no new audio data for 5 seconds continously, then
  simply make timer callback no-op and waits for pcm lib's timeout
  mechanism (alsa's timeout currently is set to be 10 seconds) to detect
  this case and trigger stop/suspend.

Bug 1992638

Change-Id: I34f43b94adb2a8c9c926cfeeb1d0ad378ca328cc
Signed-off-by: Martin Gao <marting@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1565005
Reviewed-by: Manish Tuteja <mtuteja@nvidia.com>
Tested-by: Manish Tuteja <mtuteja@nvidia.com>

20 months agovideo: tegra: dc: configure dpaux clock in ddc
Prafull Suryawanshi [Wed, 6 Sep 2017 09:41:58 +0000]
video: tegra: dc: configure dpaux clock in ddc

This change enable/disable dpaux clock and powerdomain
accordingly ddc i2c transfer. It also make sure to have
host1x clock enable before doing ddc i2c transfer.

bug 200328473

Change-Id: I900eb848d644b5634317de7b781f1da95d603331
Signed-off-by: Prafull Suryawanshi <prafulls@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1553220
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Aly Hirani <ahirani@nvidia.com>
Tested-by: Aly Hirani <ahirani@nvidia.com>
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

20 months agoRevert "DNI: rcu: debug patch"
Vinayak Pane [Fri, 8 Sep 2017 05:42:03 +0000]
Revert "DNI: rcu: debug patch"

This reverts commit f29f2eba1663efeeaaef1296b6d954230120c8e3.

Bug 200339401

Change-Id: I8a50a5eae216997a9b7bac126e91fef778bcb566
Signed-off-by: Vinayak Pane <vpane@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1555226
Reviewed-by: Manish Tuteja <mtuteja@nvidia.com>
Tested-by: Manish Tuteja <mtuteja@nvidia.com>

20 months agokernel: timer: sanity check pointer address before access
Martin Gao [Tue, 22 Aug 2017 03:57:24 +0000]
kernel: timer: sanity check pointer address before access

Bug 200343941
Bug 1977274
Bug 1972419

Change-Id: Id2ce7ff86463762e7eb116937b8b71fc4b2d1824
Signed-off-by: Martin Gao <marting@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1543168
Reviewed-by: David Dastous St Hilaire <ddastoussthi@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

20 months agoinput: input-cfboost: increase boost time for GA
Martin Gao [Tue, 29 Aug 2017 20:47:34 +0000]
input: input-cfboost: increase boost time for GA

- increase boost time to 10 seconds for hotword/voice query of GA

Bug 1980313

Change-Id: Iadf8653b30a38ebb7b26297c6d250f9aa2f5fd05
Signed-off-by: Martin Gao <marting@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1547941
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

20 months agohid: hid-atv-jarvis: fix substream deadlock
Martin Gao [Tue, 29 Aug 2017 19:50:44 +0000]
hid: hid-atv-jarvis: fix substream deadlock

- substream lock is acquired without disabling irq, and thus it can be
  re-entrant and cause deadlock.
- use spin_lock_irqsave and spin_lock_irqrestore instead.
- if DEBUG_TIMER defined, latency measurement is added to log as well to
  check whether the latency is within tolerance.
- remove unneeded debug print (guarding with debug flag)

Bug 1980335
Bug 200339401

Change-Id: I2ce1ffb182dfb0fe3788c355bb8dbe54f7a6e45d
Signed-off-by: Martin Gao <marting@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1547896
Reviewed-by: Vinayak Pane <vpane@nvidia.com>
GVS: Gerrit_Virtual_Submit

20 months agodc: hdmi: Resetting HDA prior to disabling HDMI
Jerry Wang [Wed, 14 Jun 2017 03:27:10 +0000]
dc: hdmi: Resetting HDA prior to disabling HDMI

When HDMI unplug happens while playing audio,
HDA has chance to accesses SOR when it's already
disabled and cause host read timeout.

Resetting HDA before disabling HDMI to avoid
this problem.

Bug 1922197
Bug 200319900

Change-Id: I3f4d04bcb2b6232a400046898caf0247c25c7b0e
Signed-off-by: Jerry Wang <jerryw@nvidia.com>
Reviewed-on: http://git-master/r/1501997
(cherry picked from commit 550eea1f37ace6e55ba31149abdd64fb208dd6f8)
Reviewed-on: https://git-master.nvidia.com/r/1505541
Reviewed-on: https://git-master.nvidia.com/r/1548514
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Vinayak Pane <vpane@nvidia.com>
Tested-by: Manish Tuteja <mtuteja@nvidia.com>

20 months agodc: hdmi: hda: protect hda from race
Ahung Cheng [Thu, 15 Jun 2017 08:37:38 +0000]
dc: hdmi: hda: protect hda from race

add mutex to protect hda pointer from
race condition if hot plug happens right
after hda check is just passed

bug 1922197
bug 200319900

Change-Id: I84d28ce2075163b7cf42c7a0dda739da6ad4fafd
Signed-off-by: Ahung Cheng <ahcheng@nvidia.com>
Reviewed-on: http://git-master/r/1502917
(cherry picked from commit 66fcf53525a368cebf00680c843e44447ef88944)
Reviewed-on: https://git-master.nvidia.com/r/1505540
Reviewed-on: https://git-master.nvidia.com/r/1548513
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Vinayak Pane <vpane@nvidia.com>
Tested-by: Manish Tuteja <mtuteja@nvidia.com>

20 months agodriver: devfreq: update df previous freq properly
Martin Gao [Wed, 30 Aug 2017 09:24:21 +0000]
driver: devfreq: update df previous freq properly

- Despite the naming, df previous frequency is used to track current
  frequency. So if mismatch, return 0 instead of GET_TARGET_FREQ_DONTSCALE.

Bug 1980313

Change-Id: Ie3a6ca4c7a0166a907a4f2e4ae5ed666d8eb1a2c
Signed-off-by: Martin Gao <marting@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1548663
GVS: Gerrit_Virtual_Submit
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

20 months agot210: disable power gating for nvdec
Vivek Bangera [Tue, 22 Aug 2017 06:15:45 +0000]
t210: disable power gating for nvdec

Disabling power gating for nvdec
for all T210 devices

Bug 200308164

Change-Id: I41ca30e64a744abbfbcfede64a9bef12d2739cf1
Signed-off-by: Vivek Bangera <vbangera@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1544128
GVS: Gerrit_Virtual_Submit
Reviewed-by: Terry Wang <terwang@nvidia.com>
Tested-by: Soumen Dey <sdey@nvidia.com>
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

20 months agodriver: input: boost clock upon google assistant
Martin Gao [Fri, 25 Aug 2017 04:42:04 +0000]
driver: input: boost clock upon google assistant

- UX of Google Assistant is crucial and thus would like to boost clock
  frequency when it's triggered either via hotword or mic button press

Bug 1980313

Change-Id: Ic03b35d38be2ddd8a4e22a5c09ae057aef53793b
Signed-off-by: Martin Gao <marting@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1545495
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

20 months agoDNI: rcu: debug patch
Martin Gao [Tue, 22 Aug 2017 23:48:54 +0000]
DNI: rcu: debug patch

Bug 200339401

Change-Id: Ife48a872407eb0930385ce824933480818657d66
Signed-off-by: Martin Gao <marting@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1543669
GVS: Gerrit_Virtual_Submit
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

20 months agohid: move to spinlock instead of using barrier
Martin Gao [Tue, 22 Aug 2017 01:39:55 +0000]
hid: move to spinlock instead of using barrier

- hid-atv-remote driver always uses barrier for synchronization, but
  it's not enough in this case. Making minumum change to avoid impacting
  perf and added a spinlock to synchronize timer modification and
  deletion

Bug 1977274
Bug 1972419

Change-Id: Ic7fcc13a809a177151b7ca82cbabae9eebf90c67
Signed-off-by: Martin Gao <marting@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1543114
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: David Dastous St Hilaire <ddastoussthi@nvidia.com>
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

21 months agodebug: dump stack in panic
Martin Gao [Fri, 11 Aug 2017 01:23:18 +0000]
debug: dump stack in panic

- when device is in panic, always dump stack for better debugging. Thus
  remove the condition check.

Bug 1972419

Change-Id: I46721088fa5b1d4188238239d1b1edc36fb284e9
Signed-off-by: Martin Gao <marting@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1537073
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

21 months agohid: fix race condition of delete timer and mod timer
Martin Gao [Tue, 15 Aug 2017 00:59:52 +0000]
hid: fix race condition of delete timer and mod timer

- traditionally, hid-atv-jarvis doesn't use lock and depends on memory
  barrier to certain sychronization, which lead to a small window of
  opportunity of this above race condition
- changing timer_enabled to bit mask base instead of boolean to indicate
  three different states: enabled, re-scheduling (mod timer), disabled
- when disabling timer, polling block to check whether it's in
  re-scheduling or not to ensure re-scheduling happen before delete
  timer
- add a time out to avoid infinite polling with error message

Bug 1972419

Change-Id: I25cc42d90e351be5b28fa423567a74c7a35d5444
Signed-off-by: Martin Gao <marting@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1538564
Reviewed-by: David Dastous St Hilaire <ddastoussthi@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

21 months agoarm64: dts: update polling delay of Darcy AO-therm
Daniel Fu [Thu, 10 Aug 2017 10:16:40 +0000]
arm64: dts: update polling delay of Darcy AO-therm

The default "0" polling delay will break the thermal management
of "active" trips on Darcy a08.
As AOTAG interrupts are not supported yet.

Update the polling delay to enable the polling mode correctly.

Bug 1646378

Change-Id: I7bacbceeca76ae8948e3b09ae635c95599a27701
Signed-off-by: Daniel Fu <danifu@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1537926
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

21 months agoandroid: fiq_debugger: remove sysrq checking
Sunny Li [Fri, 4 Aug 2017 13:04:55 +0000]
android: fiq_debugger: remove sysrq checking

Sysrq should be disabled due to security concern.
Remove sysrq checking before CPU dumps.

Bug 1956627

Change-Id: I20ea3d37bd52636d4131944e1060c49b723d1681
Signed-off-by: Sunny Li <sunnyl@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1536886
Reviewed-by: Martin Gao <marting@nvidia.com>
Tested-by: Martin Gao <marting@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

21 months agovideo: tegra: edid: replace hard coded block size
Tow Wang [Tue, 18 Apr 2017 01:07:01 +0000]
video: tegra: edid: replace hard coded block size

Replace hard coded constants with EDID_BYTES_PER_BLOCK.
This will allow low-level code to process EDID blocks without
further proliferation of hard coded constants.

Bug 1858144
JIRA: EVLR-1204

Change-Id: I8af0f04a962d68290ab54c48dfc1735030cd5c05
Signed-off-by: Tow Wang <toww@nvidia.com>
Reviewed-on: http://git-master/r/1464229
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Santosh Galma <galmar@nvidia.com>
Reviewed-by: svccoveritychecker <svccoveritychecker@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Mitch Luban <mluban@nvidia.com>
(cherry picked from commit 8e57f845994e2281161c72faa9dd69fad0f013bc)
Reviewed-on: https://git-master.nvidia.com/r/1536361
Reviewed-by: Prafull Suryawanshi <prafulls@nvidia.com>
Tested-by: Prafull Suryawanshi <prafulls@nvidia.com>
Reviewed-by: Dhiren Parmar <dparmar@nvidia.com>

21 months agotegra: video: hdmi: fix match when vedid present
Tow Wang [Tue, 18 Apr 2017 01:18:04 +0000]
tegra: video: hdmi: fix match when vedid present

If we are rechecking EDID, compare against vedid when present.
Otherwise we'd report a false match with video mode that no longer exists.

Bug 1858144
JIRA: EVLR-1204

Change-Id: I332c4ee28ac56c9e2f74b4268c46848c84782f20
Signed-off-by: Tow Wang <toww@nvidia.com>
Reviewed-on: http://git-master/r/1464230
Reviewed-by: Shu Zhong <shuz@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Vishnu Reddy Mandalapu <vmandalapu@nvidia.com>
Reviewed-by: Santosh Galma <galmar@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Ujwal Patel <ujwalp@nvidia.com>
(cherry picked from commit 0739658e1ab6e4bd6324256ede40226214ffefdf)
Reviewed-on: https://git-master.nvidia.com/r/1536360
Reviewed-by: Prafull Suryawanshi <prafulls@nvidia.com>
Tested-by: Prafull Suryawanshi <prafulls@nvidia.com>
Reviewed-by: Dhiren Parmar <dparmar@nvidia.com>

21 months agosi2168: enable DVB-T/T2 auto-detect feature
Henning Garbers [Mon, 7 Aug 2017 01:28:00 +0000]
si2168: enable DVB-T/T2 auto-detect feature

Bug 1969116

Change-Id: I286c7879855c7c860a406b1efe7a252cf148d639
Signed-off-by: Henning Garbers <henning.garbers@mail.de>
Reviewed-on: https://git-master.nvidia.com/r/1535203
Tested-by: Patrick Horng <phorng@nvidia.com>
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

21 months agotegra: hdcp: protect sor control reg by sor reset_lock
Ken Chang [Wed, 2 Aug 2017 07:55:00 +0000]
tegra: hdcp: protect sor control reg by sor reset_lock

Introduce sor locking 'reset_lock' to avoid sor accesses during
sor reset sequence from TSEC firmware.

Bug 1954641

Change-Id: I9d1f4409c3d4559fb7874ec1b3f67eded6654d40
Signed-off-by: Ken Chang <kenc@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1531244
Reviewed-by: Dhiren Parmar <dparmar@nvidia.com>
Tested-by: Dhiren Parmar <dparmar@nvidia.com>

21 months agovideo: dc: avoid sor access during reset
Ken Chang [Wed, 2 Aug 2017 07:27:21 +0000]
video: dc: avoid sor access during reset

SOR register access during reset is not allowed and will
cause host1x timeout. Thus introduce locking between SOR
reset and SOR read/write to avoid SOR accesses.

We don't want mutual exclusion for SOR read/write callers
because SOR supports concurrent accesses. We do want mutual
exclusion for SOR read/write and SOR reset (also reset from
different callers).
Given that SOR reset is performed only in enable or disable
calls with a rare number of callers compared with SOR
read/write, rwsem is used for this locking, SOR read/write
is the reader and SOR reset is the writer.

Bug 1922197

Change-Id: Icfd9f41cd02b4d96fba3fbad1bd5a1300e1b00fd
Signed-off-by: Ken Chang <kenc@nvidia.com>
(cherry picked from commit 1624104fff3cdd87f1dca996ac4250feead1420a)
Reviewed-on: https://git-master.nvidia.com/r/1518430
(cherry picked from commit 8b037d2acb8c59ec9b9c675125e85c6341cb6feb)
Reviewed-on: https://git-master.nvidia.com/r/1531225
Reviewed-by: Dhiren Parmar <dparmar@nvidia.com>
Tested-by: Dhiren Parmar <dparmar@nvidia.com>

21 months agovideo: tegra: dc: disable win raster after sleep
Prafull Suryawanshi [Fri, 4 Aug 2017 11:01:41 +0000]
video: tegra: dc: disable win raster after sleep

This change disables win raster after sor_sleep
which fixes OPMOD=SLEEP issue causing blank ioctl
to loop forever flush_kthread_worker in
tegra_dc_ext_disable.

Bug 1923462

Change-Id: I76d322f39ddfdb2c05e08a87cf132bf6548c102c
Signed-off-by: Prafull Suryawanshi <prafulls@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1533613
GVS: Gerrit_Virtual_Submit
Reviewed-by: Dhiren Parmar <dparmar@nvidia.com>
Tested-by: Dhiren Parmar <dparmar@nvidia.com>

21 months agoARM64/Tegra21 - Increases the VPR size to 840 MB
Suresh Choudhary [Fri, 28 Jul 2017 11:54:11 +0000]
ARM64/Tegra21 - Increases the VPR size to 840 MB

Recent changes for HDR video support and DRM apps (Introduction
of 1440P resoluton step when moving from 1080P to 4K) has made
more VPR size a need.

Bug 200333208

Change-Id: I0e1e403bb5f4649ec2829bcd43711511c7e0f61b
Signed-off-by: Suresh Choudhary <sureshc@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1530465
Reviewed-by: Vinayak Pane <vpane@nvidia.com>
Reviewed-by: Michael Frydrych <mfrydrych@nvidia.com>

21 months agousb: cdc-acm: Add DISABLE_AUTOSUSPEND quirk
Aly Hirani [Fri, 28 Jul 2017 23:45:25 +0000]
usb: cdc-acm: Add DISABLE_AUTOSUSPEND quirk

This change adds a new DISABLE_AUTOSUSPEND quirk. If the quirk is set,
we signal to the usb system to never attempt to autosuspend a device.

The ST Link dongle does not support autosuspend at all. Despite having
reset on resume, they go in a bad state if we try. Hence this
change adds the ST Link dongle to the quirk list to disable
autosuspend.

Fixes the issues with the dongle not responding on boot.

Bug 200258732

Change-Id: I1570f0e05c6e7623d0247ca158920c621e064420
Signed-off-by: Aly Hirani <ahirani@nvidia.com>
(cherry picked from commit 1b2f9269062d80a54cc9c15fffaeddfc599ae6ff)
Reviewed-on: https://git-master.nvidia.com/r/1530749
GVS: Gerrit_Virtual_Submit
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

21 months agoi2c: tegra: Ratelimit arb lost error print
Shardar Shariff Md [Wed, 26 Jul 2017 09:21:09 +0000]
i2c: tegra: Ratelimit arb lost error print

Ratelimits the arb lost error messages from a specific
i2c client to prevent the kernel log buffer from
being filled with i2c failure messages.

Bug 200331403

Change-Id: I24cea4ffcbf9638e53eaf9fda4d16caea694e6a7
Signed-off-by: Shardar Shariff Md <smohammed@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1526919
GVS: Gerrit_Virtual_Submit
Reviewed-by: Vinayak Pane <vpane@nvidia.com>
Reviewed-by: Laxman Dewangan <ldewangan@nvidia.com>

21 months agobcmdhd/bcmdhd_88: adding boundary check in wl_cfg80211_mgmt_tx
Insun Song [Wed, 3 May 2017 23:20:41 +0000]
bcmdhd/bcmdhd_88: adding boundary check in wl_cfg80211_mgmt_tx

added boundary check for user-input parameter not to corrupt kernel
memmory.

Bug 1946939
Bug 200288656

Signed-off-by: Insun Song <insun.song@broadcom.com>
Bug: 35195787
Change-Id: Ia497feae5f502c9a650e50a39fd0620fa976d908
Reviewed-on: https://git-master.nvidia.com/r/1517924
Reviewed-by: Manish Tuteja <mtuteja@nvidia.com>
Tested-by: Manish Tuteja <mtuteja@nvidia.com>

21 months agof2fs: sanity check checkpoint segno and blkoff
Jin Qian [Wed, 19 Jul 2017 08:39:53 +0000]
f2fs: sanity check checkpoint segno and blkoff

Make sure segno and blkoff read from raw image are valid.

Bug 1954564
Bug 200288656

Change-Id: I4896cc63550f5810638861c04b6bcfcf9d36e056
Signed-off-by: Jin Qian <jinqian@google.com>
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1522958
Reviewed-by: mobile promotions <svcmobile_promotions@nvidia.com>
Tested-by: mobile promotions <svcmobile_promotions@nvidia.com>

21 months agof2fs: sanity check segment count
Jin Qian [Tue, 25 Apr 2017 23:28:48 +0000]
f2fs: sanity check segment count

F2FS uses 4 bytes to represent block address. As a result, supported
size of disk is 16 TB and it equals to 16 * 1024 * 1024 / 2 segments.

Bug 1954564
Bug 200288656

Change-Id: I4c288b7d044067ca9b850ffdddd0bdeeb5bfdcb5
Signed-off-by: Jin Qian <jinqian@google.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1522954
Reviewed-by: mobile promotions <svcmobile_promotions@nvidia.com>
Tested-by: mobile promotions <svcmobile_promotions@nvidia.com>

21 months agoBACKPORT: f2fs: sanity check log_blocks_per_seg
Jin Qian [Wed, 19 Jul 2017 08:17:53 +0000]
BACKPORT: f2fs: sanity check log_blocks_per_seg

f2fs currently only supports 4KB block size and 2MB segment size.
Sanity check log_blocks_per_seg == 9, i.e. 2MB/4KB = (1 << 9)

Partially
(cherry-picked from commit 9a59b62fd88196844cee5fff851bee2cfd7afb6e)

f2fs: do more integrity verification for superblock

Do more sanity check for superblock during ->mount.

Bug 1954564
Bug 200288656

Signed-off-by: Chao Yu <chao2.yu@samsung.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Jin Qian <jinqian@google.com>
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Bug: 36817013
Change-Id: I0be52e54fba82083068337ceb9f7ad985a87319f
Reviewed-on: https://git-master.nvidia.com/r/1522952
GVS: Gerrit_Virtual_Submit
Reviewed-by: Venkata Jagadish <vjagadish@nvidia.com>
Reviewed-by: Dhiren Parmar <dparmar@nvidia.com>

21 months agonet: wireless: bcmdhd: additional length check for BRCM EVENT frame.
Insun Song [Wed, 19 Jul 2017 07:39:02 +0000]
net: wireless: bcmdhd: additional length check for BRCM EVENT frame.

(cherry picked from commit 72c9463eaab0fa19a461ac8de7d0abbf825a44bd)

This is just for exceptional case where user has updated kernel to the
latest, but still used non-patched firmware. The non-patched firmware
could deliver ETHER_TYPE_BRCM packet to host.

If attacker inject packet with its header length forged, it could bypass
current host driver's length check routine and cause memory corruption.

Proposed fix is enhancing length check to validate its header length.

Bug 1954564
Bug 200288656

Signed-off-by: Insun Song <insun.song@broadcom.com>
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Bug: 37168488
Change-Id: I90fc5101bddfd1d427e0a52758ddf8bc16577555
Reviewed-on: https://git-master.nvidia.com/r/1522916
GVS: Gerrit_Virtual_Submit
Reviewed-by: Om Prakash Singh <omp@nvidia.com>
Reviewed-by: Ashutosh Jha <ajha@nvidia.com>

21 months agohid: jarvis: don't fake button release for repeats
Andrew Chen [Fri, 26 May 2017 03:28:27 +0000]
hid: jarvis: don't fake button release for repeats

Bug 1907511

Change-Id: Iff453c971464a553343010c3b990654830bc8108
Signed-off-by: Andrew Chen <andrewc@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1498080
Reviewed-by: mobile promotions <svcmobile_promotions@nvidia.com>
Tested-by: mobile promotions <svcmobile_promotions@nvidia.com>

21 months agohid: jarvis: add pepper button release miss stats
Andrew Chen [Tue, 2 May 2017 09:19:50 +0000]
hid: jarvis: add pepper button release miss stats

Bug 1907511

Change-Id: I07e0c7390dbd2a1986b805ccce1dd2dd917cad06
Signed-off-by: Andrew Chen <andrewc@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1481944
Reviewed-by: mobile promotions <svcmobile_promotions@nvidia.com>
Tested-by: mobile promotions <svcmobile_promotions@nvidia.com>

22 months agoRevert "video: tegra: nvmap: allow vpr page allocation"
Vinayak Pane [Fri, 21 Jul 2017 01:13:56 +0000]
Revert "video: tegra: nvmap: allow vpr page allocation"

This reverts commit 95211c873a6a49641f4f59419d6266565deddc03.

Bug 200317803

Change-Id: I6d2fa9463e163b150fb6a03c87ac181140be5046
Signed-off-by: Vinayak Pane <vpane@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1524205
GVS: Gerrit_Virtual_Submit
Reviewed-by: Mandar Padmawar <mpadmawar@nvidia.com>
Tested-by: Mandar Padmawar <mpadmawar@nvidia.com>

22 months agoRevert "dma-coherent: Support page allocation from coherent memory"
Vinayak Pane [Fri, 21 Jul 2017 01:14:11 +0000]
Revert "dma-coherent: Support page allocation from coherent memory"

This reverts commit 7fbb90ae78c6428252ca749d989325087ec5ef5e.

Bug 200317803

Change-Id: I36e429d075d053bc8372c3bb828efe1b6b9b101c
Signed-off-by: Vinayak Pane <vpane@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1524206
GVS: Gerrit_Virtual_Submit
Reviewed-by: Mandar Padmawar <mpadmawar@nvidia.com>
Tested-by: Mandar Padmawar <mpadmawar@nvidia.com>

22 months agoRevert "dma-coherent: Add current used memory to stats"
Vinayak Pane [Fri, 21 Jul 2017 01:13:48 +0000]
Revert "dma-coherent: Add current used memory to stats"

This reverts commit a4beb9863b9c32fbecabe5c416919aa9f48a822d.

Bug 200317803

Change-Id: I44b0d371be8f37093d450d3f47c9b8f20dec393a
Signed-off-by: Vinayak Pane <vpane@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1524204
GVS: Gerrit_Virtual_Submit
Reviewed-by: Mandar Padmawar <mpadmawar@nvidia.com>
Tested-by: Mandar Padmawar <mpadmawar@nvidia.com>

22 months agoRevert "video: tegra: nvmap: Report VPR memory usage info"
Vinayak Pane [Fri, 21 Jul 2017 01:13:38 +0000]
Revert "video: tegra: nvmap: Report VPR memory usage info"

This reverts commit 2e79527edb1e5d1f49732391d488bb5cc080c3bd.

Bug 200317803

Change-Id: I323beb36be5c3267a8052d0fe1560467d2e978ce
Signed-off-by: Vinayak Pane <vpane@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1524203
GVS: Gerrit_Virtual_Submit
Reviewed-by: Mandar Padmawar <mpadmawar@nvidia.com>
Tested-by: Mandar Padmawar <mpadmawar@nvidia.com>

22 months agotimerfd: Protect the might cancel mechanism proper
Thomas Gleixner [Tue, 31 Jan 2017 14:24:03 +0000]
timerfd: Protect the might cancel mechanism proper

The handling of the might_cancel queueing is not properly protected, so
parallel operations on the file descriptor can race with each other and
lead to list corruptions or use after free.

Protect the context for these operations with a seperate lock.

The wait queue lock cannot be reused for this because that would create a
lock inversion scenario vs. the cancel lock. Replacing might_cancel with an
atomic (atomic_t or atomic bit) does not help either because it still can
race vs. the actual list operation.

Bug 1954564
Bug 200288656

Change-Id: Ie6c4c1a404cb0bfafc8a3a48bbc202560da7608c
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: "linux-fsdevel@vger.kernel.org"
Cc: syzkaller <syzkaller@googlegroups.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: linux-fsdevel@vger.kernel.org
Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1701311521430.3457@nanos
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1522946
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>

22 months agovideo: tegra: dsi: Set max limit for reading panel
Gagan Grover [Wed, 12 Apr 2017 11:28:42 +0000]
video: tegra: dsi: Set max limit for reading panel

In the debugfs support for reading panel registers, max payload
needs to be limited to the buff array size to avoid stack corruption.

Bug 1873360
Bug 200288656

Change-Id: Ibee7bd81027d2669297942c09b905f1dd3bb09ee
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: http://git-master/r/1322188
Reviewed-on: https://git-master.nvidia.com/r/1461401
Reviewed-by: Saket Sinha <sakets@nvidia.com>
Reviewed-by: Santosh Galma <galmar@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Prafull Suryawanshi <prafulls@nvidia.com>
Reviewed-by: Mitch Luban <mluban@nvidia.com>

22 months agoudf: Check path length when reading symlink
Jan Kara [Thu, 18 Dec 2014 21:37:50 +0000]
udf: Check path length when reading symlink

Symlink reading code does not check whether the resulting path fits into
the page provided by the generic code. This isn't as easy as just
checking the symlink size because of various encoding conversions we
perform on path. So we have to check whether there is still enough space
in the buffer on the fly.

Bug 1940296
Bug 200288656

Change-Id: I7858524c1878fb5af78a27759596befbcb164d08
CC: stable@vger.kernel.org
Reported-by: Carl Henrik Lunde <chlunde@ping.uio.no>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1512354
Reviewed-by: Michael Hsu <mhsu@nvidia.com>
Reviewed-by: Dhiren Parmar <dparmar@nvidia.com>

22 months agonet/packet: fix overflow in check for tp_reserve
Andrey Konovalov [Wed, 29 Mar 2017 14:11:22 +0000]
net/packet: fix overflow in check for tp_reserve

When calculating po->tp_hdrlen + po->tp_reserve the result can overflow.

Fix by checking that tp_reserve <= INT_MAX on assign.

Bug 1940296
Bug 200288656

Change-Id: I12128da5390c28d4fbf99ef94ebbafe8dbc24ed8
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1512350
Reviewed-by: Michael Hsu <mhsu@nvidia.com>
Reviewed-by: Dhiren Parmar <dparmar@nvidia.com>

22 months agonet/packet: fix overflow in check for tp_frame_nr
Andrey Konovalov [Wed, 29 Mar 2017 14:11:21 +0000]
net/packet: fix overflow in check for tp_frame_nr

When calculating rb->frames_per_block * req->tp_block_nr the result
can overflow.

Add a check that tp_block_size * tp_block_nr <= UINT_MAX.

Since frames_per_block <= tp_block_size, the expression would
never overflow.

Bug 1940296
Bug 200288656

Change-Id: Id499c301d4a538be717e260cac34b29134172de7
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1512349
Reviewed-by: Michael Hsu <mhsu@nvidia.com>
Reviewed-by: Dhiren Parmar <dparmar@nvidia.com>

22 months agonet/packet: fix overflow in check for priv area size
Andrey Konovalov [Wed, 29 Mar 2017 14:11:20 +0000]
net/packet: fix overflow in check for priv area size

Subtracting tp_sizeof_priv from tp_block_size and casting to int
to check whether one is less then the other doesn't always work
(both of them are unsigned ints).

Compare them as is instead.

Also cast tp_sizeof_priv to u64 before using BLK_PLUS_PRIV, as
it can overflow inside BLK_PLUS_PRIV otherwise.

Bug 1940296
Bug 200288656

Change-Id: I832dab4250dcbeb8e7ddf7c83a53f13b15cd28c8
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1512348
Reviewed-by: Michael Hsu <mhsu@nvidia.com>
Reviewed-by: Dhiren Parmar <dparmar@nvidia.com>

22 months agoRevert "proc: smaps: Allow smaps access for CAP_SYS_RESOURCE"
Nick Desaulniers [Mon, 3 Jul 2017 05:23:49 +0000]
Revert "proc: smaps: Allow smaps access for CAP_SYS_RESOURCE"

This reverts commit f0ce0eee6b71bc310153edb87e66e6b25e12fece.

Bug 1940296
Bug 200288656

Bug: 34951864
Bug: 36468447
Change-Id: I87bd92e096c6c28a53b9ecf302ae008f5e58eba1
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1512345
Reviewed-by: Dhiren Parmar <dparmar@nvidia.com>

22 months agoipv4: keep skb->dst around in presence of IP options
Eric Dumazet [Sat, 4 Feb 2017 19:16:52 +0000]
ipv4: keep skb->dst around in presence of IP options

Andrey Konovalov got crashes in __ip_options_echo() when a NULL skb->dst
is accessed.

ipv4_pktinfo_prepare() should not drop the dst if (evil) IP options
are present.

We could refine the test to the presence of ts_needtime or srr,
but IP options are not often used, so let's be conservative.

Thanks to syzkaller team for finding this bug.

Bug 1940296
Bug 200288656

Change-Id: I0811582c8f0a0c3e205ccf3276596ae13bbe1130
Fixes: d826eb14ecef ("ipv4: PKTINFO doesnt need dst reference")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1512314
Reviewed-by: Michael Hsu <mhsu@nvidia.com>
Reviewed-by: Dhiren Parmar <dparmar@nvidia.com>

22 months agodccp: fix freeing skb too early for IPV6_RECVPKTINFO
Andrey Konovalov [Thu, 16 Feb 2017 16:22:46 +0000]
dccp: fix freeing skb too early for IPV6_RECVPKTINFO

In the current DCCP implementation an skb for a DCCP_PKT_REQUEST packet
is forcibly freed via __kfree_skb in dccp_rcv_state_process if
dccp_v6_conn_request successfully returns.

However, if IPV6_RECVPKTINFO is set on a socket, the address of the skb
is saved to ireq->pktopts and the ref count for skb is incremented in
dccp_v6_conn_request, so skb is still in use. Nevertheless, it gets freed
in dccp_rcv_state_process.

Fix by calling consume_skb instead of doing goto discard and therefore
calling __kfree_skb.

Similar fixes for TCP:

fb7e2399ec17f1004c0e0ccfd17439f8759ede01 [TCP]: skb is unexpectedly freed.
0aea76d35c9651d55bbaf746e7914e5f9ae5a25d tcp: SYN packets are now
simply consumed

Bug 1940296
Bug 200288656

Change-Id: I9b68d6d5208ea46e0e389cc74af31ed208384afa
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1512313
Reviewed-by: Michael Hsu <mhsu@nvidia.com>
Reviewed-by: Dhiren Parmar <dparmar@nvidia.com>

22 months agotegra:dc: reset background color for YUV420/10
Michael Frydrych [Mon, 3 Jul 2017 19:14:26 +0000]
tegra:dc: reset background color for YUV420/10

Reset background color for YUV420 10-bit packing to black. Black
background is necessary for the optimized packing scheme. The clear
layer needs to be presented only if no layer is otherwise visible.

The scheme combines two layers with BLEND_ADD blending mode. The
layers are displayed with one pixel horizontal offset, hence left
and right screen edge is covered by only one of the layers. That
layer is combined with the background. Therefore the background
must be black in order not to interfere with the layer content.

Bug 200318984

Change-Id: Ic17b224bdbff3185bf393d70a6d0975e538f75d9
Signed-off-by: Michael Frydrych <mfrydrych@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1512745
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Season Li <seasonl@nvidia.com>
Tested-by: Season Li <seasonl@nvidia.com>
Reviewed-by: Ivan Raul Guadarrama <iguadarrama@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Jon Mayo <jmayo@nvidia.com>

22 months agotegra-pmc: show pmc reset status
Shardar Shariff Md [Thu, 22 Jun 2017 07:13:03 +0000]
tegra-pmc: show pmc reset status

Adding support to show pmc reset status in the kernel logs
during boot for t210 platforms,also enabling debugfs for t210
plaforms to read pmc reset status through debugfs interface.

This is used by SQA boot scripts to determine if the boot happened
as expected.

Based on commit:
1aeb821 soc: tegra-pmc: show pmc reset status for t210

Bug 200223696

Change-Id: I0f246023a77f4a7b7595ba844f65af3404930143
Signed-off-by: Shardar Shariff Md <smohammed@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1507705
GVS: Gerrit_Virtual_Submit
Reviewed-by: Laxman Dewangan <ldewangan@nvidia.com>

22 months agoarm64: dts: t210: gpt option only for foster-pro
Yunfan Zhang [Thu, 6 Jul 2017 04:18:30 +0000]
arm64: dts: t210: gpt option only for foster-pro

- add gpt cmdline option for Foster-pro(hdd) device only, since sata device
  has no protective mbr flashed
- remove gpt option for foster-e

Bug 200285232

Change-Id: I5cde4b97d570e63e36e3016d020187411a471359
Signed-off-by: Yunfan Zhang <yunfanz@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1514266
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Martin Gao <marting@nvidia.com>
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

22 months agovideo: tegra: nvmap: Report VPR memory usage info
Sri Krishna chowdary [Thu, 11 May 2017 16:56:33 +0000]
video: tegra: nvmap: Report VPR memory usage info

With resizable VPR, print information like current used
memory, current vpr size and maximum vpr size. These can
provide better debug information.

bug 19238298
bug 200317803

Change-Id: I4179331ae2c8b06eef0fda9dad10cac75cd48e53
Signed-off-by: Sri Krishna chowdary <schowdary@nvidia.com>
Reviewed-on: https://git-master/r/1500614
Reviewed-by: Dhiren Parmar <dparmar@nvidia.com>

22 months agodma-coherent: Add current used memory to stats
Sri Krishna chowdary [Thu, 11 May 2017 16:49:11 +0000]
dma-coherent: Add current used memory to stats

current used and maximum available vpr information are
needed as debug information in case allocations from vpr
fail.

bug 1923829
bug 200317803

Change-Id: Id15506bb36fa689eef21becb290996191fce0092
Signed-off-by: Sri Krishna chowdary <schowdary@nvidia.com>
Reviewed-on: https://git-master/r/1500613
Reviewed-by: Dhiren Parmar <dparmar@nvidia.com>

22 months agovideo: tegra: nvmap: allow vpr page allocation
Sri Krishna chowdary [Mon, 30 Jan 2017 05:59:01 +0000]
video: tegra: nvmap: allow vpr page allocation

dma_coherent now supports the DMA_ATTR_ALLOC_SINGLE_PAGES which returns
the pages[] of the cma pages available for device usage. Allocate these
pages and treat vpr similar to IOVMM.

Also change the debugfs to reflect the vpr allocations correctly.

bug 1837607
bug 200317803

Change-Id: Idd127a758e37c64ad1048c0bb35237bf204a681d
Signed-off-by: Sri Krishna chowdary <schowdary@nvidia.com>
Reviewed-on: http://git-master/r/1253666
(cherry picked from commit a9b6b3754bcf90d5b148e179274b136695a65c27)
Signed-off-by: Sri Krishna chowdary <schowdary@nvidia.com>
Reviewed-on: https://git-master/r/1500612
Reviewed-by: Dhiren Parmar <dparmar@nvidia.com>

22 months agodma-coherent: Support page allocation from coherent memory
Sri Krishna chowdary [Wed, 14 Dec 2016 10:43:34 +0000]
dma-coherent: Support page allocation from coherent memory

Allocate single pages when DMA_ATTR_ALLOC_SINGLE_PAGES
is specified. Return the pages array as cpu_addr and the
dma addr of the first page as dma_handle.

Freeing this memory only needs the pointer to the pages array.

bug 1837607
bug 200317803

Change-Id: Ib23f3b7362a1e6a80fa58a6a2f48f7eac1776d61
Signed-off-by: Sri Krishna chowdary <schowdary@nvidia.com>
Reviewed-on: http://git-master/r/1270947
(cherry picked from commit 3d926b3816ba938cb46f25db606fc06d1a3f5b2a)
Reviewed-on: https://git-master/r/1500611
Reviewed-by: Dhiren Parmar <dparmar@nvidia.com>

22 months agoTS/Pepper: Mitigate timer deletion bug
David DSH [Wed, 21 Dec 2016 23:51:54 +0000]
TS/Pepper: Mitigate timer deletion bug

Current implementation crashes sometime when deleting timer due to
race condition between timer call back and control of the timer
You cannot call del_timer_sync from interupt and the context is unclear
so instead use del_timer. Note this may leave the timer to trigger once
or twice with no actual work left.

Also add proper barrier for pcm_stopped.

Bug 1856286
Bug 200279149

Change-Id: Iad10c4fdac28581f82532483662e66d15cbd15ac
Signed-off-by: David DSH <ddastoussthi@nvidia.com>
Reviewed-on: https://git-master/r/1275134
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

22 months agofs/file.c: bypass file resource limit check during dup2/dup3 conditionally
Krishna Reddy [Thu, 16 Feb 2017 23:40:09 +0000]
fs/file.c: bypass file resource limit check during dup2/dup3 conditionally

If the newfd is beyond file resource limit and already pointing to
a valid file *, It means kernel is allowing the process to use fd's
beyond file resource limit. In this case, Bypass the file resource limit
check for newfd and allow recycling it.

Bug 1867572
Bug 1771717

Change-Id: I8d173ca627b3bcbe8d44cb7d1c690538316b1ccc
Signed-off-by: Krishna Reddy <vdumpa@nvidia.com>
Reviewed-on: http://git-master/r/1306503
Reviewed-on: http://git-master/r/1314054
Reviewed-by: Sri Krishna Chowdary <schowdary@nvidia.com>
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
Tested-by: Bharat Nihalani <bnihalani@nvidia.com>
(cherry picked from commit efd41f9559c6afb2dd3eff9a71d710a34ea46a42)
Reviewed-on: https://git-master/r/1511846
Reviewed-by: Daniel Koch <dkoch@nvidia.com>
Tested-by: Daniel Koch <dkoch@nvidia.com>
GVS: Gerrit_Virtual_Submit

22 months agoARM64: config: tegra21: disable ADSP audio driver
Viraj Karandikar [Tue, 23 May 2017 07:39:19 +0000]
ARM64: config: tegra21: disable ADSP audio driver

Bug 1900028

Change-Id: If9ab464eb6583de73cfd3ef487ee849f54a52a3c
Signed-off-by: Viraj Karandikar <vkarandikar@nvidia.com>
Reviewed-on: https://git-master/r/1487058
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

22 months agousb-quirks: Add second quirk for SmartThings
wahsu [Fri, 2 Dec 2016 06:10:45 +0000]
usb-quirks: Add second quirk for SmartThings

The SmartThings USB Dongle has 2 pair of VID/PIDs. This change adds the
second pair to fix the issue of the dongle not resuming correctly after
device suspend.

This adds quirk to reset the device after resume.

Bug 200258732

Change-Id: I261b567ab880b3bf0f190f2a0ea85c41645ed9c0
Signed-off-by: Aly Hirani <ahirani@nvidia.com>
Reviewed-on: https://git-master/r/1497866
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

22 months agomisc: tegra_cec: turn on TV ASAP
Chun XU [Tue, 27 Dec 2016 09:35:07 +0000]
misc: tegra_cec: turn on TV ASAP

Turn on the TV as soon as possible for better user experience
by sending <Text View On> and <ACTIVE SOURCE> CEC commands if
the previous reboot is not recovery. If the previous reboot
reason is recovery, don't send <Text View On> to avoid turning
on TV when there is an auto OTA on-going.

CEC driver uses RESERVED2 logical address as the source address.
Later, the upper layer will send OneTouchPlay command by using
its valid logical address.

Bug 200253563

Change-Id: Iecd759bb50c1f21549f55906e68e3faab905f86b
Signed-off-by: Chun XU <chunx@nvidia.com>
Reviewed-on: http://git-master/r/1277092
(cherry picked from commit 2beab2dcfc4e40712004500df99633d59ae0e70c)
Reviewed-on: http://git-master/r/1307931
GVS: Gerrit_Virtual_Submit
Reviewed-by: Santosh Galma <galmar@nvidia.com>
Reviewed-by: Mitch Luban <mluban@nvidia.com>

23 months agofs:coredump:fsync when finish dump data
Sunny Li [Thu, 1 Jun 2017 14:43:59 +0000]
fs:coredump:fsync when finish dump data

fsync will guarantee data saved in core file, when kernel panic happened.

Bug 200262060

Change-Id: I9d5bf5fa54603b85f42d249cbbe482ac32d4d3f6
Signed-off-by: Sunny Li <sunnyl@nvidia.com>
Reviewed-on: http://git-master/r/1494076
Reviewed-by: Sachin Nikam <snikam@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Chun Xu <chunx@nvidia.com>
Reviewed-by: Vinayak Pane <vpane@nvidia.com>

23 months agoDNI: ARM64: config: tegra21: Enable CONFIG_ELF_CORE
Sunny Li [Sat, 27 May 2017 06:23:53 +0000]
DNI: ARM64: config: tegra21: Enable CONFIG_ELF_CORE

Enable CONFIG_ELF_CORE for enable core dump in t210

Bug 200262060

Change-Id: I211a40623d85a46cac64b1f74c7a8c826351a942
Signed-off-by: Sunny Li <sunnyl@nvidia.com>
Reviewed-on: http://git-master/r/1490983
Reviewed-by: Chun Xu <chunx@nvidia.com>
Reviewed-by: Sachin Nikam <snikam@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Vinayak Pane <vpane@nvidia.com>