Commit Graph

83162 Commits

Author SHA1 Message Date
Philipp Zabel
bbf5af445f FROMLIST: ASoC: hdmi-codec: Use HDMI notifications to add jack support
Use HDMI connection / disconnection notifications to update an ALSA
jack object. Also make a copy of the ELD block after every change.

Conflicts:
	sound/soc/codecs/Kconfig
	sound/soc/codecs/hdmi-codec.c

(am from https://patchwork.kernel.org/patch/8887251/)
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Chris Zhong <zyw@rock-chips.com>
Change-Id: I5f4a931c3b91c2b230ce5a61b60f191628d93105
2016-12-20 20:04:25 +08:00
Philipp Zabel
0e3070da06 FROMLIST: video: rmk's HDMI notification prototype
This is Russell's HDMI notification prototype [1], currently waiting
for the HDMI CEC situation to resolve.

The use case for the notifications on MediaTek MT8173 is to let the
(dis)connection notifications control an ALSA jack object.

No Signed-off-by since this is not my code, and still up for discussion.

[1] https://patchwork.kernel.org/patch/8351501/

(am from https://patchwork.kernel.org/patch/8887261/)

Signed-off-by: Chris Zhong <zyw@rock-chips.com>
Change-Id: I87daa156de6cfa7ff8db9df9d8ecc8c42d76798f
2016-12-20 20:02:17 +08:00
Sean Paul
2083812848 UPSTREAM: drm: Introduce DRM_DEV_* log messages
This patch consolidates all the various log functions/macros into
one uber function, drm_log. It also introduces some new DRM_DEV_*
variants that print the device name to delineate multiple devices
of the same type.

Change-Id: Ic213cce1d775cc7b820473ee5263458a001f9558
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Eric Engestrom <eric.engestrom@imgtec.com>
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Link: http://patchwork.freedesktop.org/patch/msgid/1471303084-3757-1-git-send-email-seanpaul@chromium.org
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>
(cherry picked from commit c4e68a5832)
2016-12-19 18:06:20 +08:00
Lyude
df8f1d7529 UPSTREAM: drm: Add ratelimited versions of the DRM_DEBUG* macros
There's a couple of places where this would be useful for drivers (such
as reporting DP aux transaction timeouts).

Change-Id: I027648bacec5e23890f6743207d66858f91c05df
Signed-off-by: Lyude <cpaul@redhat.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1470443443-27252-7-git-send-email-cpaul@redhat.com
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>
(cherry picked from commit 27528c667a)
2016-12-19 18:04:51 +08:00
Mark Yao
28269b219a drm/panel: support get bus_format from device-tree
copy include/uapi/linux/media-bus-format.h to include/dt-bindings/display/media-bus-format.h
So we can use media bus format on device-tree.

Change-Id: I8f63856c4d61c77958c24cd5a4436050b85a093c
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>
2016-12-15 10:32:12 +08:00
Chen Liang
030e4e1584 arm64: dts add Rockchip RK3328 core dtsi and dts for EVB board
Change-Id: I7b0af1eff050262d38716ce83ec7debb6538b010
Signed-off-by: Chen Liang <cl@rock-chips.com>
Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>
Signed-off-by: David Wu <david.wu@rock-chips.com>
2016-12-14 17:12:39 +08:00
Elaine Zhang
2cecbe21eb clk: rockchip: add dt-binding header for rk3328
Add the dt-bindings header for the rk3328, that gets shared between
the clock controller and the clock references in the dts.
Add softreset ID for rk3328.

Change-Id: I8e6301fd854fe5c9a820fe76d7826db2c1c08b4e
Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>
2016-12-12 10:54:22 +08:00
Huang Jiachai
a8332c3a4c video: rockchip: fb: add dataspace for hdr
Change-Id: I65fb95a550d6afecf6b45f65afbd24047e8d5097
Signed-off-by: Huang Jiachai <hjc@rock-chips.com>
2016-12-09 18:54:14 +08:00
Jacob Chen
67893900ee clk: rockchip: rk3288: export isp and cif clk
Change-Id: I2d9e46383f94cbd8023ad042f3921364c191f852
Signed-off-by: Jacob Chen <jacob2.chen@rock-chips.com>
2016-12-08 20:32:39 +08:00
Caesar Wang
7a96f91b3f soc: rockchip: power-domain: export idle request
We need to put the power status of HEVC IP into IDLE unless
we can't reset that IP or the SoC would crash down.
rockchip_pmu_idle_request(dev, true)---> enter idle
rockchip_pmu_idle_request(dev, false)---> exit idle

Change-Id: I76733efd2de4f7ee183c1b6bd1545d60038ee31b
Signed-off-by: Caesar Wang <wxt@rock-chips.com>
Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com>
Signed-off-by: Randy Li <randy.li@rock-chips.com>
2016-12-07 14:53:43 +08:00
Huang, Tao
ef179e79e9 Merge branch 'linux-linaro-lsk-v4.4-android' of git://git.linaro.org/kernel/linux-linaro-stable.git
* linux-linaro-lsk-v4.4-android: (61 commits)
  Linux 4.4.36
  scsi: mpt3sas: Unblock device after controller reset
  flow_dissect: call init_default_flow_dissectors() earlier
  mei: fix return value on disconnection
  mei: me: fix place for kaby point device ids.
  mei: me: disable driver on SPT SPS firmware
  drm/radeon: Ensure vblank interrupt is enabled on DPMS transition to on
  mpi: Fix NULL ptr dereference in mpi_powm() [ver #3]
  parisc: Also flush data TLB in flush_icache_page_asm
  parisc: Fix race in pci-dma.c
  parisc: Fix races in parisc_setup_cache_timing()
  NFSv4.x: hide array-bounds warning
  apparmor: fix change_hat not finding hat after policy replacement
  cfg80211: limit scan results cache size
  tile: avoid using clocksource_cyc2ns with absolute cycle count
  scsi: mpt3sas: Fix secure erase premature termination
  Fix USB CB/CBI storage devices with CONFIG_VMAP_STACK=y
  USB: serial: ftdi_sio: add support for TI CC3200 LaunchPad
  USB: serial: cp210x: add ID for the Zone DPMX
  usb: chipidea: move the lock initialization to core file
  ...
2016-12-06 20:58:56 +08:00
Alex Shi
bdcf7d8df4 Merge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-android
Conflicts:
	keep low scan freq in android in net/wireless/scan.c
2016-12-06 13:01:29 +08:00
Alex Shi
3ba1692e72 Merge tag 'v4.4.36' into linux-linaro-lsk-v4.4
This is the 4.4.36 stable release
2016-12-05 12:01:22 +08:00
Huang, Tao
45cd824a30 Merge branch 'linux-linaro-lsk-v4.4-android' of git://git.linaro.org/kernel/linux-linaro-stable.git
* linux-linaro-lsk-v4.4-android: (315 commits)
  Linux 4.4.35
  netfilter: nft_dynset: fix element timeout for HZ != 1000
  IB/cm: Mark stale CM id's whenever the mad agent was unregistered
  IB/uverbs: Fix leak of XRC target QPs
  IB/core: Avoid unsigned int overflow in sg_alloc_table
  IB/mlx5: Fix fatal error dispatching
  IB/mlx5: Use cache line size to select CQE stride
  IB/mlx4: Fix create CQ error flow
  IB/mlx4: Check gid_index return value
  PM / sleep: don't suspend parent when async child suspend_{noirq, late} fails
  PM / sleep: fix device reference leak in test_suspend
  uwb: fix device reference leaks
  mfd: core: Fix device reference leak in mfd_clone_cell
  iwlwifi: pcie: fix SPLC structure parsing
  rtc: omap: Fix selecting external osc
  clk: mmp: mmp2: fix return value check in mmp2_clk_init()
  clk: mmp: pxa168: fix return value check in pxa168_clk_init()
  clk: mmp: pxa910: fix return value check in pxa910_clk_init()
  drm/amdgpu: Attach exclusive fence to prime exported bo's. (v5)
  crypto: caam - do not register AES-XTS mode on LP units
  ...

Change-Id: Ic14c01a22a5e8a0356d6c0ef6bcca7bc6cad6b4b
2016-12-02 20:31:31 +08:00
Mark Yao
c69d9335f3 drm/rockchip: add loader protect ops to drm connector
Change-Id: Iae26ac5c994727b98db045ae00c62d641f31c4b1
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>
2016-12-02 17:06:56 +08:00
David Woodhouse
d88a1bd00c iommu/vt-d: Fix PASID table allocation
commit 9101704429 upstream.

Somehow I ended up with an off-by-three error in calculating the size of
the PASID and PASID State tables, which triggers allocations failures as
those tables unfortunately have to be physically contiguous.

In fact, even the *correct* maximum size of 8MiB is problematic and is
wont to lead to allocation failures. Since I have extracted a promise
that this *will* be fixed in hardware, I'm happy to limit it on the
current hardware to a maximum of 0x20000 PASIDs, which gives us 1MiB
tables — still not ideal, but better than before.

Reported by Mika Kuoppala <mika.kuoppala@linux.intel.com> and also by
Xunlei Pang <xlpang@redhat.com> who submitted a simpler patch to fix
only the allocation (and not the free) to the "correct" limit... which
was still problematic.

Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-12-02 09:09:00 +01:00
Joel Fernandes
bcddfb47bf UPSTREAM: timekeeping: Add a fast and NMI safe boot clock
This boot clock can be used as a tracing clock and will account for
suspend time.

To keep it NMI safe since we're accessing from tracing, we're not using a
separate timekeeper with updates to monotonic clock and boot offset
protected with seqlocks. This has the following minor side effects:

(1) Its possible that a timestamp be taken after the boot offset is updated
but before the timekeeper is updated. If this happens, the new boot offset
is added to the old timekeeping making the clock appear to update slightly
earlier:
   CPU 0                                        CPU 1
   timekeeping_inject_sleeptime64()
   __timekeeping_inject_sleeptime(tk, delta);
                                                timestamp();
   timekeeping_update(tk, TK_CLEAR_NTP...);

(2) On 32-bit systems, the 64-bit boot offset (tk->offs_boot) may be
partially updated.  Since the tk->offs_boot update is a rare event, this
should be a rare occurrence which postprocessing should be able to handle.

Bug: b/33184060

Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Richard Cochran <richardcochran@gmail.com>
Cc: Prarit Bhargava <prarit@redhat.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Joel Fernandes <joelaf@google.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>
2016-12-01 15:18:44 +05:30
dalong.zhang
8bffe04905 isp10: rockchip: v0.1.6
Change-Id: I1b702fb51d1baabd47f190fdafd79ecd22e18be0
Signed-off-by: dalong.zhang <dalon.zhang@rock-chips.com>
2016-11-29 21:11:43 +08:00
Alex Shi
c39fa16476 Merge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-android 2016-11-29 16:06:48 +08:00
Alex Shi
072c0f9ee4 Merge remote-tracking branch 'origin/v4.4/topic/wb-cg2' into linux-linaro-lsk-v4.4 2016-11-29 15:58:42 +08:00
Tejun Heo
cd5367ae02 cgroup: replace __DEVEL__sane_behavior with cgroup2 fs type
With major controllers - cpu, memory and io - shaping up for the
unified hierarchy, cgroup2 is about ready to be, gradually, released
into the wild.  Replace __DEVEL__sane_behavior flag which was used to
select the unified hierarchy with a separate filesystem type "cgroup2"
so that unified hierarchy can be mounted as follows.

  mount -t cgroup2 none $MOUNT_POINT

The cgroup2 fs has its own magic number - 0x63677270 ("cgrp").

v2: Assign a different magic number to cgroup2 fs.

Signed-off-by: Tejun Heo <tj@kernel.org>
Acked-by: Li Zefan <lizefan@huawei.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
(cherry picked from commit 67e9c74b8a)
Signed-off-by: Alex Shi <alex.shi@linaro.org>
2016-11-29 15:25:16 +08:00
Johannes Weiner
aaaf9e59c0 mm: page_alloc: generalize the dirty balance reserve
The dirty balance reserve that dirty throttling has to consider is
merely memory not available to userspace allocations.  There is nothing
writeback-specific about it.  Generalize the name so that it's reusable
outside of that context.

Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Rik van Riel <riel@redhat.com>
Cc: Mel Gorman <mgorman@suse.de>
Acked-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit a8d0143730)
Signed-off-by: Alex Shi <alex.shi@linaro.org>
2016-11-29 15:25:03 +08:00
Finley Xiao
8ad93d71d3 PM / OPP: Add dev_pm_opp_check_initial_rate()
Bootloader or kernel sets CPU frequency to an initial value before cpufreq
starts on rockchip platform, if cpu's opp table is modified to a specified
value, it will cause an issue.

For example, the initial frequency is 816MHz and voltage set by hardware
is 900mV:
1. there is only one opp whose frequency is 816MHz and voltage is 850mV
in opp table list, as they frequency is equal, the voltage will not be
changed, it is still 900mV and a little too large relative to 850mV.
2. there is only one opp whose frequency is 1200MHz and voltage is 1100mV
in opp table list, as it doesn't set voltage to 1100mV before set frequency
to 1200MHz in the dev_pm_opp_set_rate function, the initial voltage 900mV
cann't supply for 1200MHz, the system crash.

Change-Id: Id8c5efc34d9c94ff37921b33f5a76e059240d368
Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>
2016-11-29 14:13:37 +08:00
Alex Shi
068e31608a Merge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-android
Conflicts:
	drivers/usb/gadget/function/u_ether.c
2016-11-25 12:55:17 +08:00
Alex Shi
5497d2d7d5 Merge remote-tracking branch 'lts/linux-4.4.y' into linux-linaro-lsk-v4.4
Conflicts:
	keep check_object_size in copy_from_user
	in arch/sparc/include/asm/uaccess_64.h
2016-11-25 12:50:56 +08:00
Mark Yao
a98cfbe2de drm: add 10bit support for yuv format
drm_format_plane_cpp use byte size, not works for 10bit
format, use drm_format_plane_bpp instead.

Change-Id: If1a6ca1c286747fdc868184cebe75eb0af0a746d
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>
2016-11-24 12:59:29 +08:00
Shawn Lin
d776fdb776 UPSTREAM: of/pci: Add helper function to parse max-link-speed from dt
This new helper function could be used by host drivers to
get the limitaion of max link speed provided by dt. If the
property isn't assigned or is invalid, it will return -EINVAL
to the caller.

Change-Id: I430b05fa5fd25fe17cf1bd8b1226e460eb7dd14b
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
(am from git.kernel.org/cgit/linux/kernel/git/next/linux-next.git
commit 9a1dc38912)
2016-11-23 17:33:37 +08:00
Rhyland Klein
e342aa4666 UPSTREAM: power_supply: fix return value of get_property
power_supply_get_property() should ideally return -EAGAIN if it is
called while the power_supply is being registered. There was no way
previously to determine if use_cnt == 0 meant that the power_supply
wasn't fully registered yet, or if it had already been unregistered.

Add a new boolean to the power_supply struct to simply show if
registration is completed. Lastly, modify the check in
power_supply_show_property() to also ignore -EAGAIN when so it
doesn't complain about not returning the property.

Change-Id: I8a710802534c033d64589d8d213eeaa36d9cc7d7
Signed-off-by: Rhyland Klein <rklein@nvidia.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
Signed-off-by: Caesar Wang <wxt@rock-chips.com>
(cherry picked from commit e380538529)
2016-11-22 11:40:28 +08:00
Eric Dumazet
225a24ae97 tcp: take care of truncations done by sk_filter()
[ Upstream commit ac6e780070 ]

With syzkaller help, Marco Grassi found a bug in TCP stack,
crashing in tcp_collapse()

Root cause is that sk_filter() can truncate the incoming skb,
but TCP stack was not really expecting this to happen.
It probably was expecting a simple DROP or ACCEPT behavior.

We first need to make sure no part of TCP header could be removed.
Then we need to adjust TCP_SKB_CB(skb)->end_seq

Many thanks to syzkaller team and Marco for giving us a reproducer.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Marco Grassi <marco.gra@gmail.com>
Reported-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-11-21 10:06:40 +01:00
Eli Cooper
8777977b22 ip6_tunnel: Clear IP6CB in ip6tunnel_xmit()
[ Upstream commit 23f4ffedb7 ]

skb->cb may contain data from previous layers. In the observed scenario,
the garbage data were misinterpreted as IP6CB(skb)->frag_max_size, so
that small packets sent through the tunnel are mistakenly fragmented.

This patch unconditionally clears the control buffer in ip6tunnel_xmit(),
which affects ip6_tunnel, ip6_udp_tunnel and ip6_gre. Currently none of
these tunnels set IP6CB(skb)->flags, otherwise it needs to be done earlier.

Cc: stable@vger.kernel.org
Signed-off-by: Eli Cooper <elicooper@gmx.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-11-21 10:06:39 +01:00
Finley Xiao
126dca84f6 clk: rockchip: add clock ids for efuse on RK3366
Set the newly added id for efuse, so that they can be called
in other parts.

Change-Id: Id372ca207901aed689304f862412b2cf1e08fa80
Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>
2016-11-16 18:33:39 +08:00
Huang, Tao
7e8031c929 input: sensors: fromdos and remove trailing whitespace
Change-Id: I6799f2538f95953d1565ac805497161ce6043855
Signed-off-by: Huang, Tao <huangtao@rock-chips.com>
2016-11-16 11:32:49 +08:00
Martijn Coenen
5b3e17679b android: binder: support for file-descriptor arrays.
This patch introduces a new binder_fd_array object,
that allows us to support one or more file descriptors
embedded in a buffer that is scatter-gathered.

Change-Id: I647a53cf0d905c7be0dfd9333806982def68dd74
Signed-off-by: Martijn Coenen <maco@google.com>
2016-11-15 20:23:03 +05:30
Martijn Coenen
34b8f97791 android: binder: support for scatter-gather.
Previously all data passed over binder needed
to be serialized, with the exception of Binder
objects and file descriptors.

This patchs adds support for scatter-gathering raw
memory buffers into a binder transaction, avoiding
the need to first serialize them into a Parcel.

To remain backwards compatibile with existing
binder clients, it introduces two new command
ioctls for this purpose - BC_TRANSACTION_SG and
BC_REPLY_SG. These commands may only be used with
the new binder_transaction_data_sg structure,
which adds a field for the total size of the
buffers we are scatter-gathering.

Because memory buffers may contain pointers to
other buffers, we allow callers to specify
a parent buffer and an offset into it, to indicate
this is a location pointing to the buffer that
we are fixing up. The kernel will then take care
of fixing up the pointer to that buffer as well.

Change-Id: I02417f28cff14688f2e1d6fcb959438fd96566cc
Signed-off-by: Martijn Coenen <maco@google.com>
2016-11-15 20:23:03 +05:30
Martijn Coenen
d8e0aca03a android: binder: split flat_binder_object.
flat_binder_object is used for both handling
binder objects and file descriptors, even though
the two are mostly independent. Since we'll
have more fixup objects in binder in the future,
instead of extending flat_binder_object again,
split out file descriptors to their own object
while retaining backwards compatibility to
existing user-space clients. All binder objects
just share a header.

Change-Id: If3c55f27a2aa8f21815383e0e807be47895e4786
Signed-off-by: Martijn Coenen <maco@google.com>
2016-11-15 20:09:23 +05:30
Huang Jiachai
766e5dbd77 video: rockchip: fb: add api to enable mirror for VR
Change-Id: Ic9a6409f0243896021eb94df3600cdc2fc3db637
Signed-off-by: Huang Jiachai <hjc@rock-chips.com>
2016-11-15 22:03:46 +08:00
Amit Pundir
91e63c11a5 Merge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-android
Conflicts:
* arch/arm64/include/asm/assembler.h
    Pick changes from AOSP Change-Id: I450594dc311b09b6b832b707a9abb357608cc6e4
    ("UPSTREAM: arm64: include alternative handling in dcache_by_line_op").

* drivers/android/binder.c
    Pick changes from LTS commit 14f09e8e7c ("ANDROID: binder: Add strong ref checks"),
    instead of AOSP Change-Id: I66c15b066808f28bd27bfe50fd0e03ff45a09fca
    ("ANDROID: binder: Add strong ref checks").

* drivers/usb/gadget/function/u_ether.c
    Refactor throttling of highspeed IRQ logic in AOSP by adding
    a check for last queue request as intended by LTS commit
    660c04e8f1 ("usb: gadget: function: u_ether: don't starve tx request queue").
    Fixes AOSP Change-Id: I26515bfd9bbc8f7af38be7835692143f7093118a
    ("USB: gadget: u_ether: Fix data stall issue in RNDIS tethering mode").

Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
2016-11-15 18:33:34 +05:30
Alex Shi
2970358821 Merge tag 'v4.4.32' into linux-linaro-lsk-v4.4
This is the 4.4.32 stable release
2016-11-15 18:36:04 +08:00
Alex Shi
62c3330b7f Merge branch v4.4/topic/hibernate into linux-linaro-lsk-v4.4 2016-11-15 17:28:46 +08:00
Eric Dumazet
d46c76765d udp: fix IP_CHECKSUM handling
[ Upstream commit 10df8e6152 ]

First bug was added in commit ad6f939ab1 ("ip: Add offset parameter to
ip_cmsg_recv") : Tom missed that ipv4 udp messages could be received on
AF_INET6 socket. ip_cmsg_recv(msg, skb) should have been replaced by
ip_cmsg_recv_offset(msg, skb, sizeof(struct udphdr));

Then commit e6afc8ace6 ("udp: remove headers from UDP packets before
queueing") forgot to adjust the offsets now UDP headers are pulled
before skb are put in receive queue.

Fixes: ad6f939ab1 ("ip: Add offset parameter to ip_cmsg_recv")
Fixes: e6afc8ace6 ("udp: remove headers from UDP packets before queueing")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Sam Kumar <samanthakumar@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Tested-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-11-15 07:46:39 +01:00
Sabrina Dubroca
3cb00b90e8 net: add recursion limit to GRO
[ Upstream commit fcd91dd449 ]

Currently, GRO can do unlimited recursion through the gro_receive
handlers.  This was fixed for tunneling protocols by limiting tunnel GRO
to one level with encap_mark, but both VLAN and TEB still have this
problem.  Thus, the kernel is vulnerable to a stack overflow, if we
receive a packet composed entirely of VLAN headers.

This patch adds a recursion counter to the GRO layer to prevent stack
overflow.  When a gro_receive function hits the recursion limit, GRO is
aborted for this skb and it is processed normally.  This recursion
counter is put in the GRO CB, but could be turned into a percpu counter
if we run out of space in the CB.

Thanks to Vladimír Beneš <vbenes@redhat.com> for the initial bug report.

Fixes: CVE-2016-7039
Fixes: 9b174d88c2 ("net: Add Transparent Ethernet Bridging GRO support.")
Fixes: 66e5133f19 ("vlan: Add GRO support for non hardware accelerated vlan")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Jiri Benc <jbenc@redhat.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Tom Herbert <tom@herbertland.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-11-15 07:46:38 +01:00
Jiri Pirko
02558fa0e0 rtnetlink: Add rtnexthop offload flag to compare mask
[ Upstream commit 85dda4e5b0 ]

The offload flag is a status flag and should not be used by
FIB semantics for comparison.

Fixes: 37ed949369 ("rtnetlink: add RTNH_F_EXTERNAL flag for fib offload")
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Reviewed-by: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-11-15 07:46:38 +01:00
Shmulik Ladkani
9edbf4a0b6 net/sched: act_vlan: Push skb->data to mac_header prior calling skb_vlan_*() functions
[ Upstream commit f39acc84aa ]

Generic skb_vlan_push/skb_vlan_pop functions don't properly handle the
case where the input skb data pointer does not point at the mac header:

- They're doing push/pop, but fail to properly unwind data back to its
  original location.
  For example, in the skb_vlan_push case, any subsequent
  'skb_push(skb, skb->mac_len)' calls make the skb->data point 4 bytes
  BEFORE start of frame, leading to bogus frames that may be transmitted.

- They update rcsum per the added/removed 4 bytes tag.
  Alas if data is originally after the vlan/eth headers, then these
  bytes were already pulled out of the csum.

OTOH calling skb_vlan_push/skb_vlan_pop with skb->data at mac_header
present no issues.

act_vlan is the only caller to skb_vlan_*() that has skb->data pointing
at network header (upon ingress).
Other calles (ovs, bpf) already adjust skb->data at mac_header.

This patch fixes act_vlan to point to the mac_header prior calling
skb_vlan_*() functions, as other callers do.

Signed-off-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Pravin Shelar <pshelar@ovn.org>
Cc: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-11-15 07:46:37 +01:00
Nikolay Aleksandrov
6eb0061fa6 ipmr, ip6mr: fix scheduling while atomic and a deadlock with ipmr_get_route
[ Upstream commit 2cf750704b ]

Since the commit below the ipmr/ip6mr rtnl_unicast() code uses the portid
instead of the previous dst_pid which was copied from in_skb's portid.
Since the skb is new the portid is 0 at that point so the packets are sent
to the kernel and we get scheduling while atomic or a deadlock (depending
on where it happens) by trying to acquire rtnl two times.
Also since this is RTM_GETROUTE, it can be triggered by a normal user.

Here's the sleeping while atomic trace:
[ 7858.212557] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:620
[ 7858.212748] in_atomic(): 1, irqs_disabled(): 0, pid: 0, name: swapper/0
[ 7858.212881] 2 locks held by swapper/0/0:
[ 7858.213013]  #0:  (((&mrt->ipmr_expire_timer))){+.-...}, at: [<ffffffff810fbbf5>] call_timer_fn+0x5/0x350
[ 7858.213422]  #1:  (mfc_unres_lock){+.....}, at: [<ffffffff8161e005>] ipmr_expire_process+0x25/0x130
[ 7858.213807] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.8.0-rc7+ #179
[ 7858.213934] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
[ 7858.214108]  0000000000000000 ffff88005b403c50 ffffffff813a7804 0000000000000000
[ 7858.214412]  ffffffff81a1338e ffff88005b403c78 ffffffff810a4a72 ffffffff81a1338e
[ 7858.214716]  000000000000026c 0000000000000000 ffff88005b403ca8 ffffffff810a4b9f
[ 7858.215251] Call Trace:
[ 7858.215412]  <IRQ>  [<ffffffff813a7804>] dump_stack+0x85/0xc1
[ 7858.215662]  [<ffffffff810a4a72>] ___might_sleep+0x192/0x250
[ 7858.215868]  [<ffffffff810a4b9f>] __might_sleep+0x6f/0x100
[ 7858.216072]  [<ffffffff8165bea3>] mutex_lock_nested+0x33/0x4d0
[ 7858.216279]  [<ffffffff815a7a5f>] ? netlink_lookup+0x25f/0x460
[ 7858.216487]  [<ffffffff8157474b>] rtnetlink_rcv+0x1b/0x40
[ 7858.216687]  [<ffffffff815a9a0c>] netlink_unicast+0x19c/0x260
[ 7858.216900]  [<ffffffff81573c70>] rtnl_unicast+0x20/0x30
[ 7858.217128]  [<ffffffff8161cd39>] ipmr_destroy_unres+0xa9/0xf0
[ 7858.217351]  [<ffffffff8161e06f>] ipmr_expire_process+0x8f/0x130
[ 7858.217581]  [<ffffffff8161dfe0>] ? ipmr_net_init+0x180/0x180
[ 7858.217785]  [<ffffffff8161dfe0>] ? ipmr_net_init+0x180/0x180
[ 7858.217990]  [<ffffffff810fbc95>] call_timer_fn+0xa5/0x350
[ 7858.218192]  [<ffffffff810fbbf5>] ? call_timer_fn+0x5/0x350
[ 7858.218415]  [<ffffffff8161dfe0>] ? ipmr_net_init+0x180/0x180
[ 7858.218656]  [<ffffffff810fde10>] run_timer_softirq+0x260/0x640
[ 7858.218865]  [<ffffffff8166379b>] ? __do_softirq+0xbb/0x54f
[ 7858.219068]  [<ffffffff816637c8>] __do_softirq+0xe8/0x54f
[ 7858.219269]  [<ffffffff8107a948>] irq_exit+0xb8/0xc0
[ 7858.219463]  [<ffffffff81663452>] smp_apic_timer_interrupt+0x42/0x50
[ 7858.219678]  [<ffffffff816625bc>] apic_timer_interrupt+0x8c/0xa0
[ 7858.219897]  <EOI>  [<ffffffff81055f16>] ? native_safe_halt+0x6/0x10
[ 7858.220165]  [<ffffffff810d64dd>] ? trace_hardirqs_on+0xd/0x10
[ 7858.220373]  [<ffffffff810298e3>] default_idle+0x23/0x190
[ 7858.220574]  [<ffffffff8102a20f>] arch_cpu_idle+0xf/0x20
[ 7858.220790]  [<ffffffff810c9f8c>] default_idle_call+0x4c/0x60
[ 7858.221016]  [<ffffffff810ca33b>] cpu_startup_entry+0x39b/0x4d0
[ 7858.221257]  [<ffffffff8164f995>] rest_init+0x135/0x140
[ 7858.221469]  [<ffffffff81f83014>] start_kernel+0x50e/0x51b
[ 7858.221670]  [<ffffffff81f82120>] ? early_idt_handler_array+0x120/0x120
[ 7858.221894]  [<ffffffff81f8243f>] x86_64_start_reservations+0x2a/0x2c
[ 7858.222113]  [<ffffffff81f8257c>] x86_64_start_kernel+0x13b/0x14a

Fixes: 2942e90050 ("[RTNETLINK]: Use rtnl_unicast() for rtnetlink unicasts")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-11-15 07:46:37 +01:00
Eric Dumazet
d2e01b1565 net: avoid sk_forward_alloc overflows
[ Upstream commit 20c64d5cd5 ]

A malicious TCP receiver, sending SACK, can force the sender to split
skbs in write queue and increase its memory usage.

Then, when socket is closed and its write queue purged, we might
overflow sk_forward_alloc (It becomes negative)

sk_mem_reclaim() does nothing in this case, and more than 2GB
are leaked from TCP perspective (tcp_memory_allocated is not changed)

Then warnings trigger from inet_sock_destruct() and
sk_stream_kill_queues() seeing a not zero sk_forward_alloc

All TCP stack can be stuck because TCP is under memory pressure.

A simple fix is to preemptively reclaim from sk_mem_uncharge().

This makes sure a socket wont have more than 2 MB forward allocated,
after burst and idle period.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-11-15 07:46:36 +01:00
Alex Shi
ce11555672 Merge branch 'v4.4/topic/hibernate' into linux-linaro-lsk-v4.4
Conflicts:
	conflicts are almost come from mm-kaslr, focus on mm
	arch/arm64/include/asm/cpufeature.h
	arch/arm64/include/asm/pgtable.h
	arch/arm64/kernel/Makefile
	arch/arm64/kernel/cpufeature.c
	arch/arm64/kernel/head.S
	arch/arm64/kernel/suspend.c
	arch/arm64/kernel/vmlinux.lds.S
	arch/arm64/kvm/hyp.S
	arch/arm64/mm/init.c
	arch/arm64/mm/mmu.c
	arch/arm64/mm/proc-macros.S
2016-11-14 21:20:48 +08:00
Finley Xiao
715bb9379e soc: rockchip: pvtm: add driver handling Rockchip pvtm
This patch supports acquiring pvtm values.

Change-Id: I20c0c5a5136371880da1c246b0d71c7a2bddc1d6
Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>
2016-11-11 14:52:15 +08:00
Alex Shi
17d454ca33 Merge tag 'v4.4.31' into linux-linaro-lsk-v4.4
This is the 4.4.31 stable release
2016-11-11 12:01:04 +08:00
David Hsu
4b06152a48 pwm: Unexport children before chip removal
commit 0733424c9b upstream.

Exported pwm channels aren't removed before the pwmchip and are
leaked. This results in invalid sysfs files. This fix removes
all exported pwm channels before chip removal.

Signed-off-by: David Hsu <davidhsu@google.com>
Fixes: 76abbdde2d ("pwm: Add sysfs interface")
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-11-10 16:36:37 +01:00
Marc Zyngier
ac6ec447c6 arm64: KVM: Implement timer save/restore
Implement the timer save restore as a direct translation of
the assembly code version.

Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
(cherry picked from commit 1431af367e)
Signed-off-by: Alex Shi <alex.shi@linaro.org>

Conflicts:
	arch/arm64/kvm/hyp/Makefile
	arch/arm64/kvm/hyp/hyp.h
2016-11-09 22:15:41 +08:00