On VLV, after i915_pm_suspend display power wells are staying
power ungated. So, after initiating mem sleep "echo mem > /sys/power/state"
Display is staing D0 State. There might be better way/place to power gate
these wells. Also, we need to make sure that if wells are power gated due to
DPMS OFF sequence, they need not be turned off by i915_pm_suspend again.
v2: Extracted helper for intel_crtc_disable and power gating CRTC power wells.
[Daniel]
Cc: Imre Deak <imre.deak@intel.com>
Cc: Paulo Zanoni <paulo.r.zanoni@intel.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Change-Id: I34c80da66aa24c423a5576c68aa1f3a8d0f43848
Signed-off-by: Borun Fu <borun.fu@intel.com>
Signed-off-by: Sagar Kamble <sagar.a.kamble@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Merge armada changes, I've confirmed the componenet changes are same as in Greg's tree.
* 'drm-armada-devel' of git://ftp.arm.linux.org.uk/~rmk/linux-arm:
drm/armada: register crtc with port
drm/armada: permit CRTCs to be registered as separate devices
dt-bindings: add Marvell Dove LCD controller documentation
drm/armada: update Armada 510 (Dove) to use "ext_ref_clk1" as the clock
drm/armada: convert to componentized support
drm: add of_graph endpoint helper to find possible CRTCs
component: fix bug with legacy API
drm/armada: make variant a CRTC thing
drm/armada: move variant initialisation to CRTC init
drm/armada: use number of CRTCs registered
drm/armada: move IRQ handling into CRTC
component: add support for component match array
component: ignore multiple additions of the same component
component: fix missed cleanup in case of devres failure
Packets shorter than ETH_ZLEN were not padded with zeroes, hence leaking
potentially sensitive information. This bug has been present since the
driver got accepted in commit 1c1008c793
("net: bcmgenet: add main driver file").
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Add support to view addresses added by the driver and learnt by the
hardware from ALE table via ethtool register dump interface.
Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jason reported an oops caused by SCTP on his ARM machine with
SCTP authentication enabled:
Internal error: Oops: 17 [#1] ARM
CPU: 0 PID: 104 Comm: sctp-test Not tainted 3.13.0-68744-g3632f30c9b20-dirty #1
task: c6eefa40 ti: c6f52000 task.ti: c6f52000
PC is at sctp_auth_calculate_hmac+0xc4/0x10c
LR is at sg_init_table+0x20/0x38
pc : [<c024bb80>] lr : [<c00f32dc>] psr: 40000013
sp : c6f538e8 ip : 00000000 fp : c6f53924
r10: c6f50d80 r9 : 00000000 r8 : 00010000
r7 : 00000000 r6 : c7be4000 r5 : 00000000 r4 : c6f56254
r3 : c00c8170 r2 : 00000001 r1 : 00000008 r0 : c6f1e660
Flags: nZcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
Control: 0005397f Table: 06f28000 DAC: 00000015
Process sctp-test (pid: 104, stack limit = 0xc6f521c0)
Stack: (0xc6f538e8 to 0xc6f54000)
[...]
Backtrace:
[<c024babc>] (sctp_auth_calculate_hmac+0x0/0x10c) from [<c0249af8>] (sctp_packet_transmit+0x33c/0x5c8)
[<c02497bc>] (sctp_packet_transmit+0x0/0x5c8) from [<c023e96c>] (sctp_outq_flush+0x7fc/0x844)
[<c023e170>] (sctp_outq_flush+0x0/0x844) from [<c023ef78>] (sctp_outq_uncork+0x24/0x28)
[<c023ef54>] (sctp_outq_uncork+0x0/0x28) from [<c0234364>] (sctp_side_effects+0x1134/0x1220)
[<c0233230>] (sctp_side_effects+0x0/0x1220) from [<c02330b0>] (sctp_do_sm+0xac/0xd4)
[<c0233004>] (sctp_do_sm+0x0/0xd4) from [<c023675c>] (sctp_assoc_bh_rcv+0x118/0x160)
[<c0236644>] (sctp_assoc_bh_rcv+0x0/0x160) from [<c023d5bc>] (sctp_inq_push+0x6c/0x74)
[<c023d550>] (sctp_inq_push+0x0/0x74) from [<c024a6b0>] (sctp_rcv+0x7d8/0x888)
While we already had various kind of bugs in that area
ec0223ec48 ("net: sctp: fix sctp_sf_do_5_1D_ce to verify if
we/peer is AUTH capable") and b14878ccb7 ("net: sctp: cache
auth_enable per endpoint"), this one is a bit of a different
kind.
Giving a bit more background on why SCTP authentication is
needed can be found in RFC4895:
SCTP uses 32-bit verification tags to protect itself against
blind attackers. These values are not changed during the
lifetime of an SCTP association.
Looking at new SCTP extensions, there is the need to have a
method of proving that an SCTP chunk(s) was really sent by
the original peer that started the association and not by a
malicious attacker.
To cause this bug, we're triggering an INIT collision between
peers; normal SCTP handshake where both sides intent to
authenticate packets contains RANDOM; CHUNKS; HMAC-ALGO
parameters that are being negotiated among peers:
---------- INIT[RANDOM; CHUNKS; HMAC-ALGO] ---------->
<------- INIT-ACK[RANDOM; CHUNKS; HMAC-ALGO] ---------
-------------------- COOKIE-ECHO -------------------->
<-------------------- COOKIE-ACK ---------------------
RFC4895 says that each endpoint therefore knows its own random
number and the peer's random number *after* the association
has been established. The local and peer's random number along
with the shared key are then part of the secret used for
calculating the HMAC in the AUTH chunk.
Now, in our scenario, we have 2 threads with 1 non-blocking
SEQ_PACKET socket each, setting up common shared SCTP_AUTH_KEY
and SCTP_AUTH_ACTIVE_KEY properly, and each of them calling
sctp_bindx(3), listen(2) and connect(2) against each other,
thus the handshake looks similar to this, e.g.:
---------- INIT[RANDOM; CHUNKS; HMAC-ALGO] ---------->
<------- INIT-ACK[RANDOM; CHUNKS; HMAC-ALGO] ---------
<--------- INIT[RANDOM; CHUNKS; HMAC-ALGO] -----------
-------- INIT-ACK[RANDOM; CHUNKS; HMAC-ALGO] -------->
...
Since such collisions can also happen with verification tags,
the RFC4895 for AUTH rather vaguely says under section 6.1:
In case of INIT collision, the rules governing the handling
of this Random Number follow the same pattern as those for
the Verification Tag, as explained in Section 5.2.4 of
RFC 2960 [5]. Therefore, each endpoint knows its own Random
Number and the peer's Random Number after the association
has been established.
In RFC2960, section 5.2.4, we're eventually hitting Action B:
B) In this case, both sides may be attempting to start an
association at about the same time but the peer endpoint
started its INIT after responding to the local endpoint's
INIT. Thus it may have picked a new Verification Tag not
being aware of the previous Tag it had sent this endpoint.
The endpoint should stay in or enter the ESTABLISHED
state but it MUST update its peer's Verification Tag from
the State Cookie, stop any init or cookie timers that may
running and send a COOKIE ACK.
In other words, the handling of the Random parameter is the
same as behavior for the Verification Tag as described in
Action B of section 5.2.4.
Looking at the code, we exactly hit the sctp_sf_do_dupcook_b()
case which triggers an SCTP_CMD_UPDATE_ASSOC command to the
side effect interpreter, and in fact it properly copies over
peer_{random, hmacs, chunks} parameters from the newly created
association to update the existing one.
Also, the old asoc_shared_key is being released and based on
the new params, sctp_auth_asoc_init_active_key() updated.
However, the issue observed in this case is that the previous
asoc->peer.auth_capable was 0, and has *not* been updated, so
that instead of creating a new secret, we're doing an early
return from the function sctp_auth_asoc_init_active_key()
leaving asoc->asoc_shared_key as NULL. However, we now have to
authenticate chunks from the updated chunk list (e.g. COOKIE-ACK).
That in fact causes the server side when responding with ...
<------------------ AUTH; COOKIE-ACK -----------------
... to trigger a NULL pointer dereference, since in
sctp_packet_transmit(), it discovers that an AUTH chunk is
being queued for xmit, and thus it calls sctp_auth_calculate_hmac().
Since the asoc->active_key_id is still inherited from the
endpoint, and the same as encoded into the chunk, it uses
asoc->asoc_shared_key, which is still NULL, as an asoc_key
and dereferences it in ...
crypto_hash_setkey(desc.tfm, &asoc_key->data[0], asoc_key->len)
... causing an oops. All this happens because sctp_make_cookie_ack()
called with the *new* association has the peer.auth_capable=1
and therefore marks the chunk with auth=1 after checking
sctp_auth_send_cid(), but it is *actually* sent later on over
the then *updated* association's transport that didn't initialize
its shared key due to peer.auth_capable=0. Since control chunks
in that case are not sent by the temporary association which
are scheduled for deletion, they are issued for xmit via
SCTP_CMD_REPLY in the interpreter with the context of the
*updated* association. peer.auth_capable was 0 in the updated
association (which went from COOKIE_WAIT into ESTABLISHED state),
since all previous processing that performed sctp_process_init()
was being done on temporary associations, that we eventually
throw away each time.
The correct fix is to update to the new peer.auth_capable
value as well in the collision case via sctp_assoc_update(),
so that in case the collision migrated from 0 -> 1,
sctp_auth_asoc_init_active_key() can properly recalculate
the secret. This therefore fixes the observed server panic.
Fixes: 730fc3d05c ("[SCTP]: Implete SCTP-AUTH parameter processing")
Reported-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Tested-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Cc: Vlad Yasevich <vyasevich@gmail.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
When timestamping received packets, rx_timestamp_work may be scheduled
before the timestamps is received from the hardware resulting in the
packet beeing delivered without the timestamp.
This is fixed by changing the receive timestamp path:
On receiving a packet that need timestamping, the rxts list is
traversed. If a match is found, packet+timestamp are delivered,
otherwise the packet is added to a rx_queue.
When a timestamp arrives rx_queue is traversed and if a matching
packet is found, it is delivered with the timestamp. Otherwise the
timestamp is added to the rxts list for matching with packets arriving
later.
In case the hardware drops a timestamp, a workqueue regularly checks
the queue for old packets and delivers them without a timestamp.
Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This patch adds the sfc driver code for implementing busy polling.
It adds ndo_busy_poll method and locking between it and napi poll.
It also adds each napi to the napi_hash right after netif_napi_add().
Uses efx_start_eventq and efx_stop_eventq in the self tests.
Signed-off-by: Shradha Shah <sshah@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Amir Vadai says:
====================
Mellanox driver update Jul-22-2014
This patchset contains a fix by Eyal to fix a bug in mlx4_en with bonding
alb/tlb mode.
The second patch, by me, is an ethtool private flag that enable turning off the
BlueFlame hardware feature.
The last two patches, introduce a new low memory profile for mlx4_en and
mlx4_core. This mode is useful when running from a limited resources
environment, like kdump. This will reduce the memory consumed by both drivers
from more than 100M to ~30M.
This patchset was applied and tested on commit 575a193 ("net: mvpp2: Fix error
return code in mvpp2_probe")
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
When memory is limited, reduce number of rx and tx rings.
Signed-off-by: Amir Vadai <amirv@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
When running in kdump kernel, reduce number of resources allocated for
the hardware. This will enable the NIC to operate in this low memory
environment at the expense of performance and some features not related
to the basic NIC functionality.
Signed-off-by: Amir Vadai <amirv@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Enable the user to turn off the hardware feature called BlueFlame.
Since it is something specific to mlx4_en hardware, we control
the feature via ethtool private flags.
Signed-off-by: Amir Vadai <amirv@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
When port is down dev_addr is changed (e.g. by bonding) but current_mac
is not touched. When port is up again, hash_mac is updated to dev_addr,
but current_mac isn't. This leads to inconsistency between current_mac
and mac_hash. Because of that, mlx4_en_replace_mac() fails to find
current_mac in mac_hash.
Fix is to reset current_mac to dev_addr when port is up - as we do for
mac_hash.
Signed-off-by: Eyal Perry <eyalpe@mellanox.com>
Signed-off-by: Amir Vadai <amirv@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Now that all the users of mvpp2_bm_bufs_free() have been fixed, we can safely
clean the function prototype.
The function is always called to release all the buffers in a BM pool, and
the number of buffers freed is not needed. Therefore, we change the return
to a void, and remove the "num" parameter. This is a cosmetic change, to
make the code slightly cleaner.
Signed-off-by: Ezequiel Garcia <ezequiel.garcia@free-electrons.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
After a call to mvpp2_bm_bufs_free(), the caller usually wants to know
if the function successfully freed the requested number. However, this
cannot be done by looking into the BM pool count, because the current
buffer count was updated by mvpp2_bm_bufs_free().
In fact, the current callers of mvpp2_bm_bufs_free() use it to release
all the buffers in the pool, so we can fix this by simply checking
if the pool is not empty.
Signed-off-by: Ezequiel Garcia <ezequiel.garcia@free-electrons.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Currently, the network interfaces that are not configured by the bootloader
(using e.g. tftp or ping) can detect the link status but are unable to
transmit data.
The network controller has a functionality that allows the hardware to
continuously poll the PHY and directly update the MAC configuration accordingly
(speed, duplex, etc.). However, this doesn't work well with phylib's
software-based polling and updating MAC configuration in the driver's callback.
This commit fixes this issue by:
1. Setting MVPP2_PHY_AN_STOP_SMI0_MASK in MVPP2_PHY_AN_CFG0_REG in
mvpp2_init(), which disables the harware polling feature.
2. Disabling MVPP2_GMAC_PCS_ENABLE_MASK bit in MVPP2_GMAC_CTRL_2_REG in
mvpp2_port_mii_set() for port types other than SGMII.
Signed-off-by: Marcin Wojtas <mw@semihalf.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This bit was originally wrong, the correct value is BIT(1), so fix it.
Signed-off-by: Marcin Wojtas <mw@semihalf.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This patch add documentation for binding of SM5502 MUIC (Micro-USB Interface
Controller) device which is using EXTCON subsystem. The SM5502 MUIC device
can detect various external accessories when external accessories is attached
or detached.
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
This patch changes internal hardware DP_CON/DM_CON switch according to
cable type. The SM5502 MUIC device can set hardware switch as following:
- OPEN (not connected state) / USB / UART / AUDIO
Also, this patch set VBUSIN switch according to cable type.
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
This patch detect whether cable is connected or not and the cable type
after completing kernel/platform booting using system_power_efficient_wq.
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
This patch add new SM5502 MUIC(Micro-USB Interface Controller) device by using
EXTCON subsystem. The extcon-sm5502 driver is capable of identifying the type
of the external power source and attached accessory. An external power sources,
such as Deticated Charger or a standard USB port, are able to charge the battery
in the smart phone via the connector.
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Previously we would do a regulator get against the main Arizona device
to obtain the MICVDD regulator. Arizona is an MFD device and normally
MICVDD will be supplied by one of its children (the arizona-micsupp
regulator). As devres destruction for the MFD device will run after all
its children have been destroyed, the regulator will be destroyed before
devres calls regulator_put. This causes a warning from both the
destruction of the child node, as the regulator is still open, and from
the put of the regulator as the regulator device has already been
destroyed.
A simple fix here is to get the regulator against the extcon device
itself such that devres runs when the child is destroyed. This has the
additional benefit that if for some reason the extcon driver is unloaded
the regulator reference won't hang around until the MFD is unloaded.
Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
The site-specific OOM messages are unnecessary, because they
duplicate the MM subsystem generic OOM message. The following
checkpatch warning is also removed.
WARNING: Possible unnecessary 'out of memory' message
Signed-off-by: Jingoo Han <jg1.han@samsung.com>
[Acked by Charles Keepax for arizona part]
Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
As reported by Vincent:
[ 16.332247] xc2028 0-0061: Loading firmware for type=BASE F8MHZ (3), id 0000000000000000.
[ 16.344378] cxusb: i2c wr: len=64 is too big!
64 bytes is too short for firmware load on this device. So, increase it
to 80 bytes.
Reported-by: Vincent McIntyre <vincent.mcintyre@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
The DocBook documentation is incorrect: on ISDB-T, interleaving
time is always a power of 2. Fix it and provides a table showing
the actual interleaving length for each mode.
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
The programmed frequency on xc4000 is not the middle
frequency, but the initial frequency on the bandwidth range.
However, the DVB API works with the middle frequency.
This works fine on set_frontend, as the device calculates
the needed offset. However, at get_frequency(), the returned
value is the initial frequency. That's generally not a big
problem on most drivers, however, starting with changeset
6fe1099c7a, the frequency drift is taken into account at
dib7000p driver.
This broke support for PCTV 340e, with uses dib7000p demod and
xc4000 tuner.
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
The programmed frequency on xc5000 is not the middle
frequency, but the initial frequency on the bandwidth range.
However, the DVB API works with the middle frequency.
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
This meta-tag is used by some distros to help them package
the firmware and generate proper initrd images.
So, add the firmware names there.
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
The firmware name at:
http://www.kernellabs.com/firmware/xc4000/
Is different from the one at the Kernel. Update it
try first the new name, falling back to the previous one
if the new name can't be found.
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
This patch removes the null test on ch. ch is initialized at the
beginning of the function to &demod->dtv_property_cache. Since demod
is dereferenced prior to the null test, demod must be a valid pointer,
and &demod->dtv_property_cache cannot be null.
The following Coccinelle script is used for detecting the change:
@r@
expression e,f;
identifier g,y;
statement S1,S2;
@@
*e = &f->g
<+...
f->y
...+>
*if (e != NULL || ...)
S1 else S2
Signed-off-by: Himangi Saraogi <himangi774@gmail.com>
Acked-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Instead of looking at the guard interval field, it was using
the interval length, with is wrong. Fix it.
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Interleaving code was wrong at mb86a20s: instead, it was looking
at the Guard Interval. Fix it.
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
The driver was reporting an incorrect mode, when mode 2
is selected.
While testing it, noticed that neither mode 1 or guard
interval 1/32 is supported by this device. Document it,
and ensure that it will report _AUTO when it doesn't lock,
in order to not report a wrong detection to userspace.
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
There was 32-bit calculation overflow. Use div_u64.
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
This cleans up some line over 80 character violations.
Signed-off-by: Emil Goode <emilgoode@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
This removes checks of struct member addresses since they likely result
in the condition always being true. Also in the stb6100_get_bandwidth
and tda8261_get_bandwidth functions the pointers frontend_ops and
tuner_ops are assigned the same addresses twice.
Signed-off-by: Emil Goode <emilgoode@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
This updated patch also fixes out of bound access to b[].
In dib9000_risc_apb_access_write() an out of bound access to mb[].
The current test to avoid out of bound access to mb[] is insufficient.
For len = 19 non-existent mb[10] will be accessed.
For odd values of len b[] is accessed out of bounds.
For large values of len an of bound access to mb[] may occur in
dib9000_mbx_send_attr.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
>From the context this should be hex 0x80 instead of decimal 80.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
changeset a733291d69 didn't merge the fixes well. It ended by
restoring some bad logic removed there.
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Acked-by: Antti Palosaari <crope@iki.fi>
Reviewed-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Commit 3d1c90d48c ("serial: altera_jtaguart: Adpot
uart_console_write()") introduced the usage of uart_console_write() but
didn't change the signature of altera_jtaguart_console_putc() to take a
pointer to struct uart_port instead of struct console, breaking the
driver's console support and leading to the following warning:
> drivers/tty/serial/altera_jtaguart.c: In function 'altera_jtaguart_console_write':
> >> drivers/tty/serial/altera_jtaguart.c:350:2: warning: passing argument 4 of 'uart_console_write' from incompatible pointer type [enabled by default]
> uart_console_write(port, s, count, altera_jtaguart_console_putc);
> ^
> In file included from drivers/tty/serial/altera_jtaguart.c:25:0:
> include/linux/serial_core.h:317:6: note: expected 'void (*)(struct uart_port *, int)' but argument is of type 'void (*)(struct console *, int)'
> void uart_console_write(struct uart_port *port, const char *s,
Fix this by adjusting the signature of altera_jtaguart_console_putc()
accordingly.
Reported-by: kbuild test robot <fengguang.wu@intel.com>
Reported-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
