aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2016-03-22UPSTREAM: mm: ASLR: use get_random_long()HEADmastermainDaniel Cashman
Replace calls to get_random_int() followed by a cast to (unsigned long) with calls to get_random_long(). Also address shifting bug which, in case of x86 removed entropy mask for mmap_rnd_bits values > 31 bits. Signed-off-by: Daniel Cashman <dcashman@android.com> Acked-by: Kees Cook <keescook@chromium.org> Cc: "Theodore Ts'o" <tytso@mit.edu> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Will Deacon <will.deacon@arm.com> Cc: Ralf Baechle <ralf@linux-mips.org> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Paul Mackerras <paulus@samba.org> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: David S. Miller <davem@davemloft.net> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Ingo Molnar <mingo@redhat.com> Cc: H. Peter Anvin <hpa@zytor.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Nick Kralevich <nnk@google.com> Cc: Jeff Vander Stoep <jeffv@google.com> Cc: Mark Salyzyn <salyzyn@android.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Bug: 27796957 Patchset: ASLR sysctl (cherry picked from commit 5ef11c35ce86b94bfb878b684de4cdaf96f54b2f) Signed-off-by: Kees Cook <keescook@google.com> Change-Id: I4599d0d5bf85e295886338398ab92bee0dd46f7c
2016-03-22UPSTREAM: drivers: char: random: add get_random_long()Daniel Cashman
Commit d07e22597d1d ("mm: mmap: add new /proc tunable for mmap_base ASLR") added the ability to choose from a range of values to use for entropy count in generating the random offset to the mmap_base address. The maximum value on this range was set to 32 bits for 64-bit x86 systems, but this value could be increased further, requiring more than the 32 bits of randomness provided by get_random_int(), as is already possible for arm64. Add a new function: get_random_long() which more naturally fits with the mmap usage of get_random_int() but operates exactly the same as get_random_int(). Also, fix the shifting constant in mmap_rnd() to be an unsigned long so that values greater than 31 bits generate an appropriate mask without overflow. This is especially important on x86, as its shift instruction uses a 5-bit mask for the shift operand, which meant that any value for mmap_rnd_bits over 31 acts as a no-op and effectively disables mmap_base randomization. Finally, replace calls to get_random_int() with get_random_long() where appropriate. This patch (of 2): Add get_random_long(). Signed-off-by: Daniel Cashman <dcashman@android.com> Acked-by: Kees Cook <keescook@chromium.org> Cc: "Theodore Ts'o" <tytso@mit.edu> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Will Deacon <will.deacon@arm.com> Cc: Ralf Baechle <ralf@linux-mips.org> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Paul Mackerras <paulus@samba.org> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: David S. Miller <davem@davemloft.net> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Ingo Molnar <mingo@redhat.com> Cc: H. Peter Anvin <hpa@zytor.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Nick Kralevich <nnk@google.com> Cc: Jeff Vander Stoep <jeffv@google.com> Cc: Mark Salyzyn <salyzyn@android.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Bug: 27796957 Patchset: ASLR sysctl (cherry picked from commit ec9ee4acd97c0039a61c0ae4f12705767ae62153) Signed-off-by: Kees Cook <keescook@google.com> Change-Id: I80d9574d98ed871873301530ad453589658410ee
2016-03-22BACKPORT: x86: mm: support ARCH_MMAP_RND_BITSDaniel Cashman
x86: arch_mmap_rnd() uses hard-coded values, 8 for 32-bit and 28 for 64-bit, to generate the random offset for the mmap base address. This value represents a compromise between increased ASLR effectiveness and avoiding address-space fragmentation. Replace it with a Kconfig option, which is sensibly bounded, so that platform developers may choose where to place this compromise. Keep default values as new minimums. Signed-off-by: Daniel Cashman <dcashman@google.com> Cc: Russell King <linux@arm.linux.org.uk> Acked-by: Kees Cook <keescook@chromium.org> Cc: Ingo Molnar <mingo@kernel.org> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Don Zickus <dzickus@redhat.com> Cc: Eric W. Biederman <ebiederm@xmission.com> Cc: Heinrich Schuchardt <xypron.glpk@gmx.de> Cc: Josh Poimboeuf <jpoimboe@redhat.com> Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com> Cc: Andrea Arcangeli <aarcange@redhat.com> Cc: Mel Gorman <mgorman@suse.de> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: David Rientjes <rientjes@google.com> Cc: Mark Salyzyn <salyzyn@android.com> Cc: Jeff Vander Stoep <jeffv@google.com> Cc: Nick Kralevich <nnk@google.com> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Will Deacon <will.deacon@arm.com> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Hector Marco-Gisbert <hecmargi@upv.es> Cc: Borislav Petkov <bp@suse.de> Cc: Ralf Baechle <ralf@linux-mips.org> Cc: Heiko Carstens <heiko.carstens@de.ibm.com> Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Bug: 27796957 Patchset: ASLR sysctl (cherry picked from commit 9e08f57d684ac2f40685f55f659564bfd91a971e) Signed-off-by: Kees Cook <keescook@google.com> Change-Id: I8e7bbdd1eb5144c13953f10867a39a4cf59da6b0
2016-03-22UPSTREAM: arm64: mm: support ARCH_MMAP_RND_BITSDaniel Cashman
arm64: arch_mmap_rnd() uses STACK_RND_MASK to generate the random offset for the mmap base address. This value represents a compromise between increased ASLR effectiveness and avoiding address-space fragmentation. Replace it with a Kconfig option, which is sensibly bounded, so that platform developers may choose where to place this compromise. Keep default values as new minimums. Signed-off-by: Daniel Cashman <dcashman@google.com> Cc: Russell King <linux@arm.linux.org.uk> Acked-by: Kees Cook <keescook@chromium.org> Cc: Ingo Molnar <mingo@kernel.org> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Don Zickus <dzickus@redhat.com> Cc: Eric W. Biederman <ebiederm@xmission.com> Cc: Heinrich Schuchardt <xypron.glpk@gmx.de> Cc: Josh Poimboeuf <jpoimboe@redhat.com> Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com> Cc: Andrea Arcangeli <aarcange@redhat.com> Cc: Mel Gorman <mgorman@suse.de> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: David Rientjes <rientjes@google.com> Cc: Mark Salyzyn <salyzyn@android.com> Cc: Jeff Vander Stoep <jeffv@google.com> Cc: Nick Kralevich <nnk@google.com> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Will Deacon <will.deacon@arm.com> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Hector Marco-Gisbert <hecmargi@upv.es> Cc: Borislav Petkov <bp@suse.de> Cc: Ralf Baechle <ralf@linux-mips.org> Cc: Heiko Carstens <heiko.carstens@de.ibm.com> Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Bug: 27796957 Patchset: ASLR sysctl (cherry picked from commit 8f0d3aa9de57662fe35d8bacfbd9d7ef85ffe98f) Signed-off-by: Kees Cook <keescook@google.com> Change-Id: I23b7f4a79d24b54c71583b759deee40544ad4dc7
2016-03-22BACKPORT: arm: mm: support ARCH_MMAP_RND_BITSDaniel Cashman
arm: arch_mmap_rnd() uses a hard-code value of 8 to generate the random offset for the mmap base address. This value represents a compromise between increased ASLR effectiveness and avoiding address-space fragmentation. Replace it with a Kconfig option, which is sensibly bounded, so that platform developers may choose where to place this compromise. Keep 8 as the minimum acceptable value. [arnd@arndb.de: ARM: avoid ARCH_MMAP_RND_BITS for NOMMU] Signed-off-by: Daniel Cashman <dcashman@google.com> Cc: Russell King <linux@arm.linux.org.uk> Acked-by: Kees Cook <keescook@chromium.org> Cc: Ingo Molnar <mingo@kernel.org> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Don Zickus <dzickus@redhat.com> Cc: Eric W. Biederman <ebiederm@xmission.com> Cc: Heinrich Schuchardt <xypron.glpk@gmx.de> Cc: Josh Poimboeuf <jpoimboe@redhat.com> Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com> Cc: Andrea Arcangeli <aarcange@redhat.com> Cc: Mel Gorman <mgorman@suse.de> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: David Rientjes <rientjes@google.com> Cc: Mark Salyzyn <salyzyn@android.com> Cc: Jeff Vander Stoep <jeffv@google.com> Cc: Nick Kralevich <nnk@google.com> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Will Deacon <will.deacon@arm.com> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Hector Marco-Gisbert <hecmargi@upv.es> Cc: Borislav Petkov <bp@suse.de> Cc: Ralf Baechle <ralf@linux-mips.org> Cc: Heiko Carstens <heiko.carstens@de.ibm.com> Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Bug: 27796957 Patchset: ASLR sysctl (cherry picked from commit e0c25d958f78acfd5c97df5776eeba3e0684101b) Signed-off-by: Kees Cook <keescook@google.com> Change-Id: I836e14c5ee8a92048f3d18f5d6498e6edd943b41
2016-03-22BACKPORT: mm: mmap: add new /proc tunable for mmap_base ASLRDaniel Cashman
Address Space Layout Randomization (ASLR) provides a barrier to exploitation of user-space processes in the presence of security vulnerabilities by making it more difficult to find desired code/data which could help an attack. This is done by adding a random offset to the location of regions in the process address space, with a greater range of potential offset values corresponding to better protection/a larger search-space for brute force, but also to greater potential for fragmentation. The offset added to the mmap_base address, which provides the basis for the majority of the mappings for a process, is set once on process exec in arch_pick_mmap_layout() and is done via hard-coded per-arch values, which reflect, hopefully, the best compromise for all systems. The trade-off between increased entropy in the offset value generation and the corresponding increased variability in address space fragmentation is not absolute, however, and some platforms may tolerate higher amounts of entropy. This patch introduces both new Kconfig values and a sysctl interface which may be used to change the amount of entropy used for offset generation on a system. The direct motivation for this change was in response to the libstagefright vulnerabilities that affected Android, specifically to information provided by Google's project zero at: http://googleprojectzero.blogspot.com/2015/09/stagefrightened.html The attack presented therein, by Google's project zero, specifically targeted the limited randomness used to generate the offset added to the mmap_base address in order to craft a brute-force-based attack. Concretely, the attack was against the mediaserver process, which was limited to respawning every 5 seconds, on an arm device. The hard-coded 8 bits used resulted in an average expected success rate of defeating the mmap ASLR after just over 10 minutes (128 tries at 5 seconds a piece). With this patch, and an accompanying increase in the entropy value to 16 bits, the same attack would take an average expected time of over 45 hours (32768 tries), which makes it both less feasible and more likely to be noticed. The introduced Kconfig and sysctl options are limited by per-arch minimum and maximum values, the minimum of which was chosen to match the current hard-coded value and the maximum of which was chosen so as to give the greatest flexibility without generating an invalid mmap_base address, generally a 3-4 bits less than the number of bits in the user-space accessible virtual address space. When decided whether or not to change the default value, a system developer should consider that mmap_base address could be placed anywhere up to 2^(value) bits away from the non-randomized location, which would introduce variable-sized areas above and below the mmap_base address such that the maximum vm_area_struct size may be reduced, preventing very large allocations. This patch (of 4): ASLR only uses as few as 8 bits to generate the random offset for the mmap base address on 32 bit architectures. This value was chosen to prevent a poorly chosen value from dividing the address space in such a way as to prevent large allocations. This may not be an issue on all platforms. Allow the specification of a minimum number of bits so that platforms desiring greater ASLR protection may determine where to place the trade-off. Signed-off-by: Daniel Cashman <dcashman@google.com> Cc: Russell King <linux@arm.linux.org.uk> Acked-by: Kees Cook <keescook@chromium.org> Cc: Ingo Molnar <mingo@kernel.org> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Don Zickus <dzickus@redhat.com> Cc: Eric W. Biederman <ebiederm@xmission.com> Cc: Heinrich Schuchardt <xypron.glpk@gmx.de> Cc: Josh Poimboeuf <jpoimboe@redhat.com> Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com> Cc: Andrea Arcangeli <aarcange@redhat.com> Cc: Mel Gorman <mgorman@suse.de> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: David Rientjes <rientjes@google.com> Cc: Mark Salyzyn <salyzyn@android.com> Cc: Jeff Vander Stoep <jeffv@google.com> Cc: Nick Kralevich <nnk@google.com> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Will Deacon <will.deacon@arm.com> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Hector Marco-Gisbert <hecmargi@upv.es> Cc: Borislav Petkov <bp@suse.de> Cc: Ralf Baechle <ralf@linux-mips.org> Cc: Heiko Carstens <heiko.carstens@de.ibm.com> Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Bug: 27796957 Patchset: ASLR sysctl (cherry picked from commit d07e22597d1d355829b7b18ac19afa912cf758d1) Signed-off-by: Kees Cook <keescook@google.com> Change-Id: I4aaf45213e0a2ea9dcdac9462c081d6458245790
2016-03-17BACKPORT: ARM: dts: rockchip: add to support emac for rk3036 SoCsXing Zheng
This patch adds the emac device node for rk3036 SoCs. We need to let mac clock under the DPLL which is able to provide the accurate 50MHz what mac_ref need, since that will cause some unstable things if the cpufreq is working. Signed-off-by: Xing Zheng <zhengxing@rock-chips.com> Signed-off-by: Caesar Wang <wxt@rock-chips.com> Cc: linux-rockchip@lists.infradead.org Cc: Xing Zheng <zhengxing@rock-chips.com> Cc: Heiko Stuebner <heiko@sntech.de> Cc: linux-arm-kernel@lists.infradead.org Signed-off-by: David S. Miller <davem@davemloft.net> Bug: 27311701 Patchset: Add the emac phy reset for dts (Fixes the conflict and sync to upstream) (cherry picked from git.kernel.org davem/net-next.git master commit af671e7bd96bc9bde623b0e6f75bfa4269c2c57f) Signed-off-by: Caesar Wang <wxt@rock-chips.com> Change-Id: Ie9dcd545eb562fdbf610163d3d5ecdfe7e91d402
2016-03-17UPSTREAM: net: arc_emac: support the phy reset for emac driverCaesar Wang
This patch adds to support the emac phy reset. Different boards may require different phy reset duration. Add property phy-reset-duration for emac driver, so that the boards that need a longer reset duration can specify it in their device tree. Signed-off-by: Heiko Stuebner <heiko@sntech.de> Signed-off-by: Caesar Wang <wxt@rock-chips.com> Cc: "David S. Miller" <davem@davemloft.net> Cc: netdev@vger.kernel.org Cc: Alexander Kochetkov <al.kochet@gmail.com> Cc: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> Signed-off-by: David S. Miller <davem@davemloft.net> Bug: 27311701 Patchset: Add the emac phy reset for driver (cherry picked from git.kernel.org davem/net-next.git master commit 1bddd96cba03da0a14b3e5144e98c9a6ff17e983) Signed-off-by: Caesar Wang <wxt@rock-chips.com> Change-Id: I8964138c66f9b45581bd18dce986f6a4d0d48406
2016-03-17UPSTREAM: net: arc_emac: add phy reset is optional for device treeCaesar Wang
This patch adds the following property for arc_emac. 1) phy-reset-gpios: The phy-reset-gpio is an optional property for arc emac device tree boot. Change the binding document to match the driver code. 2) phy-reset-duration: Different boards may require different phy reset duration. Add property phy-reset-duration for device tree probe, so that the boards that need a longer reset duration can specify it in their device tree. Anyway, we can add the above property for arc emac. Signed-off-by: Caesar Wang <wxt@rock-chips.com> Cc: Rob Herring <robh+dt@kernel.org> Cc: devicetree@vger.kernel.org Cc: netdev@vger.kernel.org Cc: "David S. Miller" <davem@davemloft.net> Cc: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> Cc; Alexander Kochetkov <al.kochet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Bug: 27311701 Patchset: Add the emac phy reset for document (cherry picked from git.kernel.org davem/net-next.git master commit 8700eee6271c932b2747a6b157655f546c27e7ad) Signed-off-by: Caesar Wang <wxt@rock-chips.com> Change-Id: Ie7f06ec9aa6171a551f8d0d9e8d1bc3f8c680e2f
2016-03-10net: wireless: bcmdhd: check packet length for event messagesPatrick Tjin
Check the datalen field is less than the size of packet received from the network. Signed-off-by: Patrick Tjin <pattjin@google.com> Bug: 27335472 [fixes CVE-2016-0802] Signed-off-by: Kees Cook <keescook@chromium.org> Change-Id: I92b394e85cfc61a0e08fb5bc573a4c000e027fad
2016-03-10net: wireless: bcmdhd: Do not print out device name on invalid lengthPatrick Tjin
(cherry picked from commit b149dd5d22c3e4c2faab0bb934a018888ff99ef3) Signed-off-by: Patrick Tjin <pattjin@google.com> Bug: 27335848 [fixes CVE-2016-0801] Signed-off-by: Kees Cook <keescook@chromium.org> Change-Id: I5cfc20061930080508f31ad2c198a4aca55caa6e
2016-03-10bcmdhd: Add checks for stack buffer overflowsdataanddreams
These two checks prevent exploitable buffer overflows in two scenarios. 1. Long WPS_ID_DEVICE_NAME in WPS info elements 2. Invalid SSID determined in certain scan results Bug: 27335848 [fixes CVE-2016-0801] Signed-off-by: Kees Cook <keescook@chromium.org> Change-Id: I755543d84770be58ef2467745d5d2b55682a126a
2016-03-08UPSTREAM: ASoC: rt5616: add missing mute control for HPVOLJohn Lin
Add missing kcontrol for HPVOL mute control. Signed-off-by: John Lin <john.lin@realtek.com> Signed-off-by: Mark Brown <broonie@kernel.org> Bug: 25923642 (cherry picked from git.kernel.org broonie/sound.git for-next commit d7fcd13663fe43ad938fec1acd46ff196dddf914) Signed-off-by: Caesar Wang <wxt@rock-chips.com> Change-Id: I75951c4b67474951e6c033e0dece5134c51dc233
2016-03-04UPSTREAM: ALSA: usb-audio: avoid freeing umidi object twiceAndrey Konovalov
The 'umidi' object will be free'd on the error path by snd_usbmidi_free() when tearing down the rawmidi interface. So we shouldn't try to free it in snd_usbmidi_create() after having registered the rawmidi interface. Found by KASAN. Signed-off-by: Andrey Konovalov <andreyknvl@gmail.com> Acked-by: Clemens Ladisch <clemens@ladisch.de> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Bug: 27300729 (cherry picked from commit 07d86ca93db7e5cdf4743564d98292042ec21af7) Signed-off-by: Kees Cook <keescook@chromium.org> Change-Id: I3fd3de84d97575ee64fd3ca0fc3643ced7ac72ab
2016-02-05FROMLIST: kbuild: disable Android-specific compiler featuresbrillo-m10-releasebrillo-m10-devKees Cook
The Android compilers enable some non-standard features by default. While most Android build systems inject the needed "-mno-android" option via KCFLAGS, it happens too late (at least on x86_64), since KBUILD_CFLAGS gains KCFLAGS after running (and failing) many cc-option tests. (For example, the stack-protector tests happen after arch-specific KBUILD_CFLAGS are added but before the external KCFLAGS are added.) As such, we should notice this option and immediately turn it on as the first cc-option test we run. Signed-off-by: Kees Cook <keescook@chromium.org> Bug: 27039414 Patchset: android compiler (git am from https://patchwork.kernel.org/patch/8240831/) Signed-off-by: Kees Cook <keescook@chromium.org> Change-Id: Idc0c80ddef90bb02ce6255055f30b05864ff4cfd
2016-02-03UPSTREAM: ARM: dts: rockchip: increase the mclk_fs to 512 for kylin boardXing Zheng
If we playback the 8KHz FS audio with the 256 mclk_fs, we need the mclk = 256 * 8000 = 2.048MHz, the frac div is 594 / 2.048 = 290, the frac div value 0x00809015 set to the CRU_CLKSEL7_CON will cause to hang. We increase the mclk_fs to 512, will get the mclk = 512 * 8000 = 4.096MHz, use 0x01009015 instead of 0x00809015 to work around this issue. We will keep tracking it. Signed-off-by: Xing Zheng <zhengxing@rock-chips.com> Signed-off-by: Heiko Stuebner <heiko@sntech.de> Bug: 25923642 Patchset: Support to playback 8KHz got audio. (Note: fixit as the 512 since the upstream is 256) (cherry picked from git.kernel.org mmind/linux-rockchip.git v4.6-armsoc/dts32 commit f6bb9d5f30d6986c4fdce1ed5a36088a0c30c544) Signed-off-by: Caesar Wang <wxt@rock-chips.com> Change-Id: Id6f5a864f6d6f8f3dbcadd4c03fa5882000711dd
2016-02-03UPSTREAM: ASoC: rt5616: Add support sample rate to 192KHzXing Zheng
Reference the TRM, the ALC5616 support one 24bit/8KHz ~ 192KHz I2S/PCM Interface for stereo DAC and stereo ADC. Signed-off-by: Xing Zheng <zhengxing@rock-chips.com> Signed-off-by: Mark Brown <broonie@kernel.org> Bug: 25923642 Patchset: Support to playback the 8KHz for audio. (cherry picked from git.kernel.org mmind/linux-rockchip.git v4.6-armsoc/dts32 commit 4e26ad80cbd3a6b0d606201892e81a9a9c6864ce) Signed-off-by: Caesar Wang <wxt@rock-chips.com> Change-Id: I74fdc71d3e84a53dda5516257ababf7927338fb0
2016-01-29UPSTREAM: ASoC: rockchip: i2s: change bclk and lrck according to sample ratesCaesar Wang
This patch sets the dividers autonomously. when i2s works on master mode, and sample rates changed. We need to change bclk and lrck at the same time for cpu internal side. As the input source clock to the module is MCLK_I2S, and by the divider of the module, the clock generator generates SCLK and LRCK to transmitter and receiver. Bug: 25923642 Patchset: I2S block needed to adjust it's divider settings for these different frequencies. Signed-off-by: Caesar Wang <wxt@rock-chips.com> Signed-off-by: Mark Brown <broonie@kernel.org> (cherry picked from git.kernel.org torvalds/linux.git master commit 2458c37779ddb91b4109949d86f5a5e193ba415b) Signed-off-by: Caesar Wang <wxt@rock-chips.com> Change-Id: I91073f0a2252d965cd425c7240db3a024dc055ab
2016-01-28UPSTREAM: ASoC: simple-card: Add tdm slot mask support to simple-cardJyri Sarha
Adds DT binding for explicitly choosing a tdm mask for DAI and uses it in simple-card. The API for snd_soc_of_parse_tdm_slot() has also been changed. Signed-off-by: Jyri Sarha <jsarha@ti.com> Signed-off-by: Mark Brown <broonie@kernel.org> Bug: 25923642 Patchset: update upstream simple card at here. (cherry picked from git.kernel.org torvalds/linux.git master commit 6131084a0bc966107021d8c89489f9cd1663b902) Signed-off-by: Caesar Wang <wxt@rock-chips.com> Change-Id: I226a4427ca88d357a2e04b1e11f0300f4c637d86
2016-01-28UPSTREAM: ASoC: simple card: Add mclk-fs property in dai-linkArnaud Pouliquen
Add mclk-fs ratio property per dai-link sub node. This will allow to manage several codecs with different ratio. Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@st.com> Signed-off-by: Mark Brown <broonie@kernel.org> Bug: 25923642 Patchset: update upstream simple card at here. (cherry picked from git.kernel.org torvalds/linux.git master commit 85a4bfd895778960dc2d655087ac7ff442b6ab9e) Signed-off-by: Caesar Wang <wxt@rock-chips.com> Change-Id: I88c68eb826ecd82ca50b7ee09d2cf10e63ed8b7a
2016-01-28UPSTREAM: ASoC: simple card: set cpu-dai sysclk with mclk-fsArnaud Pouliquen
Allows to request a specific mclk frequency per cpu_dai. To support some codecs with mclk provided by the cpu_dai, the mclk rate must be set depending on frame rate. Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@st.com> Signed-off-by: Mark Brown <broonie@kernel.org> Bug: 25923642 Patchset: update upstream simple card at here. (cherry picked from git.kernel.org torvalds/linux.git master commit e22579713ae1384a3dff545369cebe42b01370fa) Signed-off-by: Caesar Wang <wxt@rock-chips.com> Change-Id: I1a3aa7c97164f49e6fe7c133606ac052072bb1c6
2016-01-28UPSTREAM: ASoC: simple-card: support platform in dts parseJun Nie
Support platform in dts parse so that dma pcm component can be added in dts. Signed-off-by: Jun Nie <jun.nie@linaro.org> Signed-off-by: Mark Brown <broonie@kernel.org> Bug: 25923642 Patchset: update upstream simple card at here. (cherry picked from git.kernel.org torvalds/linux.git master commit e0ae225b7e96e50daaa3ca8d3cd2c944ce48e007) Signed-off-by: Caesar Wang <wxt@rock-chips.com> Change-Id: I3ff20471619888d4ad958f3fb3f56c4a4625f199
2016-01-28FROMLIST: ARM: dts: rockchip: add the leds control for kylin boardCaesar Wang
As the kylin schematic drawing, add the needed work led for kylin board. Run: echo 0 > /sys/class/leds/kylin:red:led/brightness echo 1 > /sys/class/leds/kylin:red:led/brightness The led can normal on/off on kylin board. Signed-off-by: Caesar Wang <wxt@rock-chips.com> Bug: 25923642 Patchset: Leds can be controled on rk3036 kylin. (am https://patchwork.kernel.org/patch/8129971/) Signed-off-by: Caesar Wang <wxt@rock-chips.com> Change-Id: I2911be574045d1a182b47c88401b7c685ea05176
2016-01-28FROMLIST: ARM: dts: rockchip: add i2s_clk_out to list of clocks used on ↵Caesar Wang
rk3036 i2s The I2S block that it needs to claim that output clock. This also adds properties to model the relationship between the output clock and the i2s clock itself, to ensure that the clock muxing is set correctly. Signed-off-by: Caesar Wang <wxt@rock-chips.com> Bug: 25923642 Patchset: rk3036 kylin bring up with codec device, audio can work. Conflicts: arch/arm/boot/dts/rk3036.dtsi (Note: remove the perious hclk<->sclk,, sync to upstream) (am from https://patchwork.kernel.org/patch/8040991/) Signed-off-by: Caesar Wang <wxt@rock-chips.com> Change-Id: I4617df71b274748d5aa8b0461272ed46ec17400c
2016-01-28FROMLIST: ASoC: rockchip: i2s: add support for grabbing output clock to codecSonny Rao
We need to claim the clock which is driving the codec so that when we enable clock gating, we continue to clock the codec when needed. I make this an optional clock since there might be some applications where we don't need it but can still use the I2S block. Signed-off-by: Sonny Rao <sonnyrao@chromium.org> Signed-off-by: Jianqun Xu <jay.xu@rock-chips.com> Signed-off-by: Caesar Wang <wxt@rock-chips.com> Bug: 25923642 Patchset: Support the output clock for codec. (am from https://patchwork.kernel.org/patch/8041001/) Signed-off-by: Caesar Wang <wxt@rock-chips.com> Change-Id: Ib3b44613214ee15f69060bee38b86337afc4d472
2016-01-27VENDOR: rockchip: ARM: dts: rockchip: support the spi for rk3036Caesar Wang
You have to use the 4 bus to work if someone wants to support the spi devices, since the the pin is re-used by data[5-8] and spi. Anyway, this patch to support the spi making the happy work. Unfortunatily, that will waste the emmc performance. Moment, the kylin hasn't the spi devices to work, so maybe we need wait the new required to land it. Bug: 25923642 Patchset: rk3036 kylin bring up with spi devices. Signed-off-by: Caesar Wang <wxt@rock-chips.com> Change-Id: I0e50f742439278323c6247fbba086ba9eb94a971
2016-01-27FROMLIST: ARM: dts: rockchip: add reboot-mode node for rk3036 SoCsCaesar Wang
Add reboot mode driver DT node for rk3036 platform. Signed-off-by: Caesar Wang <wxt@rock-chips.com> Bug: 25923642 Patchset: reboot bootloader can enter fastboot mode. (fixes the bootloader instead of the fastboot) (am from https://patchwork.kernel.org/patch/8021581/) Signed-off-by: Caesar Wang <wxt@rock-chips.com> Change-Id: I986a393e67536b841fd7db0118a7bf8fbcda868e
2016-01-27FROMLIST: ARM: dts: rockchip: add support emac for RK3036zhengxing
This patch describe the emac, and we need to let mac clock under the APLL which is able to provide the accurate 50MHz what mac_ref need. This patch makes the emac parent clock is DPLL instead of APLL. since that will cause some unstable things if the cpufreq is working. Signed-off-by: Xing Zheng <zhengxing@rock-chips.com> Signed-off-by: Caesar Wang <wxt@rock-chips.com> Bug: 25923642 Patchset: rk3036 kylin can work with emac. (am https://patchwork.kernel.org/patch/8108231/) Signed-off-by: Caesar Wang <wxt@rock-chips.com> Change-Id: I6e7d01cbd224f4b68753467965da05ebbf663626
2016-01-27FROMLIST: clk: rockchip: rk3036: fix and add node id for emac clockzhengxing
Due to referred old version TRM, there is incorrect emac clock node, we should fix it. The SEL_21_9 is the parent of SEL_21_4. In the emac driver, we need to refer HCLK_MAC, and because There are only 3PLLs (APLL/GPLL/DPLL) on the rk3036, most clock are under the GPLL, and it is unable to provide the accurate rate for mac_ref which need to 50MHz probability, we should let it under the APLL and are able to set the freq which integer multiples of 50MHz, so we add these emac node for reference. Signed-off-by: Xing Zheng <zhengxing@rock-chips.com> Bug: 25923642 Patchset: rk3036 kylin bring up with emac. (Note: remove the merged hclk content) (am from https://patchwork.kernel.org/patch/7925141/) Signed-off-by: Caesar Wang <wxt@rock-chips.com> Change-Id: Ieae3dc5fde9162520957c163b36a95207d8bd7e9
2016-01-27Revert "FROMLIST: ARM: dts: rockchip: Add support emac for RK3036"Caesar Wang
This reverts commit 659692874d00a2d31f6fef5905770c4f50da4659. Update the new version from LKML to fix the emac hack way to work, As the previous the emac need work on the 600M frequency.
2016-01-27Merge "Revert "FROMLIST: ARM: dts: rk3036: override operating-points to 600M ↵Leo Wang
on kylin board""
2016-01-27Merge "BACKPORT: ARM: dts: rockchip: add the sdmmc for kylin board"Leo Wang
2016-01-25Revert "FROMLIST: ARM: dts: rk3036: override operating-points to 600M on ↵Caesar Wang
kylin board" This reverts commit 6707e0764b9e10f12715dc08de2f11582db75d14.
2016-01-25BACKPORT: ARM: dts: rockchip: add the sdmmc for kylin boardCaesar Wang
Although We can add the sdmmc node, shouldn't enable it. Since the sdmmc is reusing the same pin with uart2. Unfortunately, the uart2 is used by the debug port, so that will cause the debug information can't display on console if enabling the sdmmc. As we have supported the sdmmc (sd card) on hardware for kylin board. So, maybe we can have the sdmmc node in kylin dts, not to enable it. Anyway, you only need add the okay status if someone want to enable the sdmmc. e.g. if you use the adb to debug with android os. You can add the status = "okay" to enable the sdmmc for sd card working. The default status is disabling it. Signed-off-by: Caesar Wang <wxt@rock-chips.com> Signed-off-by: Heiko Stuebner <heiko@sntech.de> Bug: 25923642 Patchset: rk3036 kylin bring up with sd card. Conflicts: arch/arm/boot/dts/rk3036-kylin.dts (cherry picked from commit 082cdf76163ad445fb3c399b63eeb9d034583263) Signed-off-by: Caesar Wang <wxt@rock-chips.com> Change-Id: I3bde4136dcc7c084a708e06b1b1914067699e8e9
2016-01-23UPSTREAM: ARM: fix uaccess_with_memcpy() with SW_DOMAIN_PANRussell King
The uaccess_with_memcpy() code is currently incompatible with the SW PAN code: it takes locks within the region that we've changed the DACR, potentially sleeping as a result. As we do not save and restore the DACR across co-operative sleep events, can lead to an incorrect DACR value later in this code path. Reported-by: Peter Rosin <peda@axentia.se> Tested-by: Peter Rosin <peda@axentia.se> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> (cherry picked from commit c014953d84ec21a4df9a43be2378861ea6e9246e) Change-Id: I9c9d1789cb69dcb6ecd1e4055833a5dfebe2045e
2016-01-23Revert "FROMLIST: ARM: dts: rockchip: add reboot-mode node for rk3036 SoCs"Caesar Wang
This reverts commit 4c9ec9da205964399b36845e701c1370e73d31f2. That should be the "reboot bootloader" instead of "reboot fastboot" if you are using the standard interface. Change-Id: I7b119b9d81a694716efdfe2181ea6e2e19d0c817
2016-01-20UPSTREAM: KEYS: Fix keyring ref leak in join_session_keyring()Yevgeny Pats
This fixes CVE-2016-0728. If a thread is asked to join as a session keyring the keyring that's already set as its session, we leak a keyring reference. This can be tested with the following program: #include <stddef.h> #include <stdio.h> #include <sys/types.h> #include <keyutils.h> int main(int argc, const char *argv[]) { int i = 0; key_serial_t serial; serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING, "leaked-keyring"); if (serial < 0) { perror("keyctl"); return -1; } if (keyctl(KEYCTL_SETPERM, serial, KEY_POS_ALL | KEY_USR_ALL) < 0) { perror("keyctl"); return -1; } for (i = 0; i < 100; i++) { serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING, "leaked-keyring"); if (serial < 0) { perror("keyctl"); return -1; } } return 0; } If, after the program has run, there something like the following line in /proc/keys: 3f3d898f I--Q--- 100 perm 3f3f0000 0 0 keyring leaked-keyring: empty with a usage count of 100 * the number of times the program has been run, then the kernel is malfunctioning. If leaked-keyring has zero usages or has been garbage collected, then the problem is fixed. Reported-by: Yevgeny Pats <yevgeny@perception-point.io> Signed-off-by: David Howells <dhowells@redhat.com> Acked-by: Don Zickus <dzickus@redhat.com> Acked-by: Prarit Bhargava <prarit@redhat.com> Acked-by: Jarod Wilson <jarod@redhat.com> Signed-off-by: James Morris <james.l.morris@oracle.com> Bug: 26692844 (cherry picked from commit 23567fd052a9abb6d67fe8e7a9ccdd9800a540f2) Signed-off-by: Kees Cook <keescook@chromium.org> Change-Id: I4043bffac931fda6f238ab0a678fa9182f9f9e7f
2016-01-19ANDROID: security: Add proper checks for Android specific capability checksTushar Behera
Commit b641072 ("security: Add AID_NET_RAW and AID_NET_ADMIN capability check in cap_capable().") introduces additional checks for AID_NET_xxx macros. Since the header file including those macros are conditionally included, the checks should also be conditionally executed. Change-Id: Iaec5208d5b95a46b1ac3f2db8449c661e803fa5b Signed-off-by: Tushar Behera <tushar.behera@linaro.org> Signed-off-by: Andrey Konovalov <andrey.konovalov@linaro.org> Bug: 25923642 Patchset: rk3036 evb bring up Cherry picked from android-3.18 branch. (cherry picked from commit 13d423b1bfdaa74cdd61647eadd5430dcb820aae) Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com>
2016-01-19ANDROID: net: Replace AID_NET_RAW checks with capable(CAP_NET_RAW).Chia-chi Yeh
Signed-off-by: Chia-chi Yeh <chiachi@android.com> Bug: 25923642 Patchset: rk3036 evb bring up Cherry picked from android-3.18 branch. (cherry picked from commit 6a3db02c6f32102f98e1bd8d33b28ba5ec4528bb) Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com> Change-Id: Ibe7a0087ab2478f8bc1d373883410a91b44fd8f2
2016-01-19ANDROID: security: Add AID_NET_RAW and AID_NET_ADMIN capability check in ↵Chia-chi Yeh
cap_capable(). Signed-off-by: Chia-chi Yeh <chiachi@android.com> Bug: 25923642 Patchset: rk3036 evb bring up Cherry picked from android-3.18 branch. (cherry picked from commit 7985836fdfd4ca68842ee9f2995ed7bb6b1a6ac4) Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com> Change-Id: I72708c2a0d3e33da5712589dcd4580ad8f3a4725
2016-01-19ANDROID: Paranoid network.Robert Love
With CONFIG_ANDROID_PARANOID_NETWORK, require specific uids/gids to instantiate network sockets. Signed-off-by: Robert Love <rlove@google.com> paranoid networking: Use in_egroup_p() to check group membership The previous group_search() caused trouble for partners with module builds. in_egroup_p() is also cleaner. Signed-off-by: Nick Pelly <npelly@google.com> Fix 2.6.29 build. Signed-off-by: Arve Hjønnevåg <arve@android.com> net: Fix compilation of the IPv6 module Fix compilation of the IPv6 module -- current->euid does not exist anymore, current_euid() is what needs to be used. Signed-off-by: Steinar H. Gunderson <sesse@google.com> net: bluetooth: Remove the AID_NET_BT* gid numbers Removed bluetooth checks for AID_NET_BT and AID_NET_BT_ADMIN which are not useful anymore. This is in preparation for getting rid of all the AID_* gids. Signed-off-by: JP Abgrall <jpa@google.com> Bug: 25923642 Patchset: rk3036 evb bring up Cherry picked from android-3.18 branch. (cherry picked from commit db0e07948289cd4d332b82b1b5e9fe05846b2bc6) Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com> Change-Id: I347a8ae7fafe7b338f6fdc15f4dc8403a91e88a9
2016-01-19ANDROID: Add android_aid.hRobert Love
Add <linux/android_aid.h>, our mapping of AID defines to gid numbers. Change-Id: I3a02eb2b5c7e336e3de0cb45d8e04ec82f7281b4 Signed-off-by: Robert Love <rlove@google.com> Bug: 25923642 Patchset: rk3036 evb bring up Cherry picked from android-3.18 branch. (cherry picked from commit c2ff66b3e9653a4ff43c79f7da555e3ad9d0cb60) Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com> Change-Id: I3a02eb2b5c7e336e3de0cb45d8e04ec82f7281b0
2016-01-14FROMLIST: ARM: dts: rockchip: make more compatible for rk3036 SoCsCaesar Wang
This patch will be better to support and compatible for rk3036. Although some other SoCs drivers also can work for rk3036, that will prevent some mutatin factors for drivers. Signed-off-by: Caesar Wang <wxt@rock-chips.com> Bug: 25923642 Patchset: More compatible for rk3036 dts. (Note: add the usb-phy compatible since the upstream hasn't land it) (am from https://patchwork.kernel.org/patch/8028891/) Signed-off-by: Caesar Wang <wxt@rock-chips.com> Change-Id: I9f403b5d22c9924a0c06c59581e07a97afb005c8
2016-01-13Merge "VENDOR: rockchip: ARM: dts: rockchip: update kylin board dts"Leo Wang
2016-01-13FROMLIST: dt-bindings: power: reset: add document for reboot-mode driverAndy Yan
add device tree binding document for reboot-mode driver Signed-off-by: Andy Yan <andy.yan@rock-chips.com> Bug: 25923642 Patchset: reboot fastboot can work. (am from https://patchwork.kernel.org/patch/8016361/) Signed-off-by: Caesar Wang <wxt@rock-chips.com> Change-Id: I4e446aa4ff6f3c364af5745b3bfb0c238e7a097b
2016-01-13Merge "FROMLIST: power: reset: add reboot mode driver"Leo Wang
2016-01-13Merge "FROMLIST: ARM: dts: rockchip: add syscon-reboot-mode node"Leo Wang
2016-01-13FROMLIST: ARM: dts: rockchip: add reboot-mode node for rk3036 SoCsCaesar Wang
Add reboot mode driver DT node for rk3036 platform. Signed-off-by: Caesar Wang <wxt@rock-chips.com> Bug: 25923642 Patchset: Support rk3036 reboot mode, reboot fastboot can work. (am https://patchwork.kernel.org/patch/8021581/) Signed-off-by: Caesar Wang <wxt@rock-chips.com> Change-Id: Iee5264d7dd4b5d6fbb22952b2d240b63c1d360c1
2016-01-13FROMLIST: ARM: dts: rockchip: add syscon-reboot-mode nodeAndy Yan
Rockchip platform use a SYSCON mapped register store the reboot mode magic value for bootloader to use when system reboot. So add syscon-reboot-mode driver DT node for rk3xxx,rk3288 platform Signed-off-by: Andy Yan <andy.yan@rock-chips.com> Conflicts: arch/arm/boot/dts/rk3288.dtsi (due to the power-doamin land in kernel4,4 ) Bug: 25923642 Patchset: reboot mode PATCH[3/4], reboot fastboot can work. (am https://patchwork.kernel.org/patch/8016431/) Signed-off-by: Caesar Wang <wxt@rock-chips.com> Change-Id: I03b24649b175cc67613277f47d70bf55871e3312
2016-01-13FROMLIST: power: reset: add reboot mode driverAndy Yan
This driver parse the reboot commands like "reboot loader" and "reboot recovery" to get a boot mode described in the device tree , then call the write interfae to store the boot mode in some persistent storage like special register or ram, which can be read by the bootloader after system reboot, then the bootloader can take different action according to the mode stored. This is commonly used on Android based devices, which in order to reboot the device into fastboot or recovery mode. Signed-off-by: Andy Yan <andy.yan@rock-chips.com> Conflicts: drivers/power/reset/Makefile drivers/power/reset/Kconfig Bug: 25923642 Patchset: reboot mode PATCH[2/4], reboot fastboot can work. (am https://patchwork.kernel.org/patch/8016401/) Signed-off-by: Caesar Wang <wxt@rock-chips.com> Change-Id: Ibcd3b893fa1895503b8f51ac16a4d5068620a604