summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Merge remote-tracking branch 'regulator/topic/lp872x' into regulator-nextMark Brown2013-02-191-29/+7
|\
| * regulator: lp872x: Kill _rdev_to_offset() functionAxel Lin2012-12-101-29/+7
| | | | | | | | | | | | | | | | | | There is only one user calling _rdev_to_offset() function. Remove _rdev_to_offset() makes the code simpler. Signed-off-by: Axel Lin <axel.lin@ingics.com> Acked-by: Milo(Woogyom) Kim <milo.kim@ti.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
* | Merge remote-tracking branch 'regulator/topic/lp3972' into regulator-nextMark Brown2013-02-191-16/+6
|\ \
| * | regulator: lp3972: Convert to get_voltage_selAxel Lin2013-01-081-16/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | regulator_list_voltage_table() returns -EINVAL if selector >= n_voltages. Thus we don't need to check if reg is greater than LP3972_BUCK_VOL_MAX_IDX in lp3972_[ldo|dcdc]_get_voltage_sel. LP3972_BUCK_VOL_MIN_IDX and LP3972_BUCK_VOL_MAX_IDX are not used, remove them. Signed-off-by: Axel Lin <axel.lin@ingics.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
* | | Merge remote-tracking branch 'regulator/topic/lp3971' into regulator-nextMark Brown2013-02-191-16/+6
|\ \ \
| * | | regulator: lp3971: Convert to get_voltage_selAxel Lin2012-12-241-16/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | regulator_list_voltage_table() returns -EINVAL if selector >= n_voltages. Thus we don't need to check if reg is greater than BUCK_TARGET_VOL_MAX_IDX in lp3971_dcdc_get_voltage_sel. BUCK_TARGET_VOL_MIN_IDX and BUCK_TARGET_VOL_MAX_IDX are not used, remove them. Signed-off-by: Axel Lin <axel.lin@ingics.com> Acked-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
* | | | Merge remote-tracking branch 'regulator/topic/gpio' into regulator-nextMark Brown2013-02-192-6/+3
|\ \ \ \
| * | | | regulator: show state for GPIO-controlled regulatorsMichał Mirosław2013-02-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
| * | | | regulator: gpio-regulator: Staticize of_get_gpio_regulator_config()Axel Lin2013-01-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | of_get_gpio_regulator_config() is only used in gpio-regulator.c, make it static. Signed-off-by: Axel Lin <axel.lin@ingics.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
| * | | | regulator: gpio-regulator: Use of_gpio_count()Axel Lin2013-01-291-4/+1
| | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Axel Lin <axel.lin@ingics.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
* | | | | Merge remote-tracking branch 'regulator/topic/da9055' into regulator-nextMark Brown2013-02-191-3/+0
|\ \ \ \ \
| * | | | | regulator: da9055: Remove unused v_shift field from struct da9055_volt_regAxel Lin2013-01-071-3/+0
| | |_|/ / | |/| | | | | | | | | | | | | | | | | | Signed-off-by: Axel Lin <axel.lin@ingics.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
* | | | | Merge remote-tracking branch 'regulator/topic/core' into regulator-nextMark Brown2013-02-191-7/+22
|\ \ \ \ \
| * | | | | regulator: Fix memory garbage dev_err printout.Russ Dill2013-02-141-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit dd8004af: 'regulator: core: Log when a device causes a voltage constraint fail', tried to print out some information about the check consumer min/max uV fixup, however, it uses a garbage pointer left over from list_for_each_entry leading to boot messages in the form: '[ 2.079890] <RANDOM ASCII>: Restricting voltage, 3735899821-4294967295uV' Because it references regulator->dev, it could potentially read memory from anywhere causing a panic. This patch instead uses rdev and the updated min/max uV values. Signed-off-by: Russ Dill <Russ.Dill@ti.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
| * | | | | Merge tag 'v3.8-rc7' into regulator-coreMark Brown2013-02-1411398-325551/+550618
| |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | Linux 3.8-rc7
| * | | | | | regulator: core: Optimize _regulator_do_set_voltage if voltage does not changeAxel Lin2013-02-081-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Optimize _regulator_do_set_voltage() for the case selector is equal to old_selector. Since the voltage does not change, we don't need to call set_voltage_sel() and set_voltage_time_sel() in this case. Signed-off-by: Axel Lin <axel.lin@ingics.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
| * | | | | | regulator: core: if voltage scaling fails, restore original voltage valuesPaolo Pisati2012-12-151-2/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com> Tested-by: Robert Nelson <robertcnelson@gmail.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
* | | | | | | Merge remote-tracking branch 'regulator/topic/as3711' into regulator-nextMark Brown2013-02-191-1/+1
|\ \ \ \ \ \ \
| * | | | | | | regulator: as3711: Fix checking if no platform initialization dataAxel Lin2013-02-131-1/+1
| | |/ / / / / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To skip registering regulator if no platform initialization data, we should check reg_data rather than ri->desc.name. Signed-off-by: Axel Lin <axel.lin@ingics.com> Acked-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
* | | | | | | Merge remote-tracking branch 'regulator/topic/arizona' into regulator-nextMark Brown2013-02-194-4/+83
|\ \ \ \ \ \ \
| * | | | | | | ASoC: wm5110: Provide MICSUPP widget for regulator driverMark Brown2013-01-131-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
| * | | | | | | ASoC: wm5102: Provide MICSUPP widget for regulator driverMark Brown2013-01-131-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
| * | | | | | | regulator: arizona-micsupp: Enable bypass in default constraintsMark Brown2013-01-131-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This will be used as part of low power accessory detect. Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
| * | | | | | | regulator: arizona-micsupp: Enable SYSCLK for charge pumpMark Brown2013-01-132-3/+73
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If we are in non-bypass mode then the SYSCLK is required for full charge pump operation, otherwise we will fall back to bypass mode. Use the DAPM context exposed by the ASoC driver to manage this. Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
* | | | | | | | Merge remote-tracking branch 'regulator/topic/apply' into regulator-nextMark Brown2013-02-195-111/+39
|\ \ \ \ \ \ \ \
| * | | | | | | | regulator: 88pm8607: Use apply_[reg|bit] with regmap based voltage_sel ↵Axel Lin2012-12-271-32/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | operations Signed-off-by: Axel Lin <axel.lin@ingics.com> Acked-by: Haojian Zhuang <haojian.zhuang@gmail.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
| * | | | | | | | regulator: 88pm8607: Update update_bit for BUCK2 in pm8607_set_voltage_selAxel Lin2012-12-271-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | BUCK2 has the update_bit setting, but current code does not set update_bit in pm8607_set_voltage_sel. Signed-off-by: Axel Lin <axel.lin@ingics.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
| * | | | | | | | regulator: tps6586x: Use apply_[reg|bit] with regmap based voltage_sel ↵Axel Lin2012-12-241-44/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | operations Signed-off-by: Axel Lin <axel.lin@ingics.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
| * | | | | | | | regulator: da9052: Use apply_[reg|bit] with regmap based voltage_sel operationsAxel Lin2012-12-241-35/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Axel Lin <axel.lin@ingics.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
| * | | | | | | | regulator: core: Allow specify apply_[reg|bit] for regmap based voltage_sel ↵Axel Lin2012-12-242-1/+17
| | |_|_|_|_|/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | operations Some DVM regulators needs to update apply_bit after setting vsel_reg to initiate voltage change on the output. This patch adds apply_reg and apply_bit to struct regulator_desc and update regulator_set_voltage_sel_regmap() to set apply_bit of apply_reg when apply_bit is set. Signed-off-by: Axel Lin <axel.lin@ingics.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
* | | | | | | | Merge remote-tracking branch 'regulator/topic/anatop' into regulator-nextMark Brown2013-02-192-0/+49
|\ \ \ \ \ \ \ \
| * | | | | | | | regulator: anatop: improve precision of delay timeShawn Guo2013-02-081-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For cpufreq example, it takes 13 steps (25 mV for one step) to increase vddcore from 0.95 V to 1.275 V, and the time of 64 clock cycles at 24 MHz for one step is ~2.67 uS, so the total delay time would be ~34.71 uS. But the current calculation in the driver gives 39 uS. Change the formula to have the addition of 1 be the last step, so that we can get a more precise delay time. For example above, the new formula will give 35 uS. Signed-off-by: Shawn Guo <shawn.guo@linaro.org> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
| * | | | | | | | regulators: anatop: add set_voltage_time_sel interfaceAnson Huang2013-01-312-0/+49
| | |_|_|_|_|/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | some of anatop's regulators(cpu, vddpu and vddsoc) have register settings about LDO's step time, which will impact the LDO ramp up speed, need to use set_voltage_time_sel interface to add necessary delay everytime LDOs' voltage is increased. offset 0x170: bit [24-25]: cpu bit [26-27]: vddpu bit [28-29]: vddsoc field definition: 0'b00: 64 cycles of 24M clock; 0'b01: 128 cycles of 24M clock; 0'b02: 256 cycles of 24M clock; 0'b03: 512 cycles of 24M clock; Signed-off-by: Anson Huang <b20788@freescale.com> Acked-by: Shawn Guo <shawn.guo@linaro.org> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
* | | | | | | | Linux 3.8v3.8Linus Torvalds2013-02-181-1/+1
| | | | | | | |
* | | | | | | | Merge branch 'for-linus' of ↵Linus Torvalds2013-02-183-6/+18
|\ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input subsystem fixes from Dmitry Torokhov: "Two small driver fixups and a documentation update for managed input devices" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: wacom - fix wacom_set_report retry logic Input: document that unregistering managed devices is not necessary Input: lm8323 - fix checking PWM interrupt status
| * | | | | | | | Input: wacom - fix wacom_set_report retry logicChris Bagwell2013-01-231-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Logic sets a value and then reads it back to make sure it worked and retries write on failures. Since read and write share a buffer, it needs to be set back up before writing though. Issue is not seen a lot because 1) it doesn't need to retry for a lot of tablets and 2) a lot of failures that need a retry are from an -ETIMEDOUT and hopefully buffer is not touched in this case. At least one user has shown logs with buffer being modified during -ETIMEDOUT case with linux 3.7 kernel. Signed-off-by: Chris Bagwell <chris@cnpbagwell.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
| * | | | | | | | Input: document that unregistering managed devices is not necessaryDmitry Torokhov2013-01-091-2/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Apparently some users of managed input devices are confused whether input_unregister_device() is needed when working with them. Clarify this in the kernel doc for devm_input_allocate_device(): in most cases there is no need to call neither input_unregister_device() nor input_free_device() when working with managed devices. Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
| * | | | | | | | Input: lm8323 - fix checking PWM interrupt statusNickolai Zeldovich2013-01-061-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | INT_PWM1 is already a bitmask, not the bit number, so shifting by INT_PWM1 is incorrect. Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* | | | | | | | | mm: fix pageblock bitmap allocationLinus Torvalds2013-02-181-6/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit c060f943d092 ("mm: use aligned zone start for pfn_to_bitidx calculation") fixed out calculation of the index into the pageblock bitmap when a !SPARSEMEM zome was not aligned to pageblock_nr_pages. However, the _allocation_ of that bitmap had never taken this alignment requirement into accout, so depending on the exact size and alignment of the zone, the use of that index could then access past the allocation, resulting in some very subtle memory corruption. This was reported (and bisected) by Ingo Molnar: one of his random config builds would hang with certain very specific kernel command line options. In the meantime, commit c060f943d092 has been marked for stable, so this fix needs to be back-ported to the stable kernels that backported the commit to use the right alignment. Bisected-and-tested-by: Ingo Molnar <mingo@kernel.org> Acked-by: Mel Gorman <mgorman@suse.de> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* | | | | | | | | Merge tag 'stable/for-linus-3.8-rc7-tag-two' of ↵Linus Torvalds2013-02-155-65/+33
|\ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen Pull xen fixes from Konrad Rzeszutek Wilk: "Two fixes: - A simple bug-fix for redundant NULL check. - CVE-2013-0228/XSA-42: x86/xen: don't assume %ds is usable in xen_iret for 32-bit PVOPS and two reverts: - Revert the PVonHVM kexec. The patch introduces a regression with older hypervisor stacks, such as Xen 4.1." * tag 'stable/for-linus-3.8-rc7-tag-two' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen: Revert "xen PVonHVM: use E820_Reserved area for shared_info" Revert "xen/PVonHVM: fix compile warning in init_hvm_pv_info" xen: remove redundant NULL check before unregister_and_remove_pcpu(). x86/xen: don't assume %ds is usable in xen_iret for 32-bit PVOPS.
| * | | | | | | | | Revert "xen PVonHVM: use E820_Reserved area for shared_info"Konrad Rzeszutek Wilk2013-02-143-55/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 9d02b43dee0d7fb18dfb13a00915550b1a3daa9f. We are doing this b/c on 32-bit PVonHVM with older hypervisors (Xen 4.1) it ends up bothing up the start_info. This is bad b/c we use it for the time keeping, and the timekeeping code loops forever - as the version field never changes. Olaf says to revert it, so lets do that. Acked-by: Olaf Hering <olaf@aepfle.de> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
| * | | | | | | | | Revert "xen/PVonHVM: fix compile warning in init_hvm_pv_info"Konrad Rzeszutek Wilk2013-02-141-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit a7be94ac8d69c037d08f0fd94b45a593f1d45176. Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
| * | | | | | | | | xen: remove redundant NULL check before unregister_and_remove_pcpu().Cyril Roelandt2013-02-131-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | unregister_and_remove_pcpu on a NULL pointer is a no-op, so the NULL check in sync_pcpu can be removed. Signed-off-by: Cyril Roelandt <tipecaml@gmail.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
| * | | | | | | | | x86/xen: don't assume %ds is usable in xen_iret for 32-bit PVOPS.Jan Beulich2013-02-131-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes CVE-2013-0228 / XSA-42 Drew Jones while working on CVE-2013-0190 found that that unprivileged guest user in 32bit PV guest can use to crash the > guest with the panic like this: ------------- general protection fault: 0000 [#1] SMP last sysfs file: /sys/devices/vbd-51712/block/xvda/dev Modules linked in: sunrpc ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4 iptable_filter ip_tables ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables ipv6 xen_netfront ext4 mbcache jbd2 xen_blkfront dm_mirror dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan] Pid: 1250, comm: r Not tainted 2.6.32-356.el6.i686 #1 EIP: 0061:[<c0407462>] EFLAGS: 00010086 CPU: 0 EIP is at xen_iret+0x12/0x2b EAX: eb8d0000 EBX: 00000001 ECX: 08049860 EDX: 00000010 ESI: 00000000 EDI: 003d0f00 EBP: b77f8388 ESP: eb8d1fe0 DS: 0000 ES: 007b FS: 0000 GS: 00e0 SS: 0069 Process r (pid: 1250, ti=eb8d0000 task=c2953550 task.ti=eb8d0000) Stack: 00000000 0027f416 00000073 00000206 b77f8364 0000007b 00000000 00000000 Call Trace: Code: c3 8b 44 24 18 81 4c 24 38 00 02 00 00 8d 64 24 30 e9 03 00 00 00 8d 76 00 f7 44 24 08 00 00 02 80 75 33 50 b8 00 e0 ff ff 21 e0 <8b> 40 10 8b 04 85 a0 f6 ab c0 8b 80 0c b0 b3 c0 f6 44 24 0d 02 EIP: [<c0407462>] xen_iret+0x12/0x2b SS:ESP 0069:eb8d1fe0 general protection fault: 0000 [#2] ---[ end trace ab0d29a492dcd330 ]--- Kernel panic - not syncing: Fatal exception Pid: 1250, comm: r Tainted: G D --------------- 2.6.32-356.el6.i686 #1 Call Trace: [<c08476df>] ? panic+0x6e/0x122 [<c084b63c>] ? oops_end+0xbc/0xd0 [<c084b260>] ? do_general_protection+0x0/0x210 [<c084a9b7>] ? error_code+0x73/ ------------- Petr says: " I've analysed the bug and I think that xen_iret() cannot cope with mangled DS, in this case zeroed out (null selector/descriptor) by either xen_failsafe_callback() or RESTORE_REGS because the corresponding LDT entry was invalidated by the reproducer. " Jan took a look at the preliminary patch and came up a fix that solves this problem: "This code gets called after all registers other than those handled by IRET got already restored, hence a null selector in %ds or a non-null one that got loaded from a code or read-only data descriptor would cause a kernel mode fault (with the potential of crashing the kernel as a whole, if panic_on_oops is set)." The way to fix this is to realize that the we can only relay on the registers that IRET restores. The two that are guaranteed are the %cs and %ss as they are always fixed GDT selectors. Also they are inaccessible from user mode - so they cannot be altered. This is the approach taken in this patch. Another alternative option suggested by Jan would be to relay on the subtle realization that using the %ebp or %esp relative references uses the %ss segment. In which case we could switch from using %eax to %ebp and would not need the %ss over-rides. That would also require one extra instruction to compensate for the one place where the register is used as scaled index. However Andrew pointed out that is too subtle and if further work was to be done in this code-path it could escape folks attention and lead to accidents. Reviewed-by: Petr Matousek <pmatouse@redhat.com> Reported-by: Petr Matousek <pmatouse@redhat.com> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com> Signed-off-by: Jan Beulich <jbeulich@suse.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
* | | | | | | | | | Revert "[media] dvb_frontend: return -ENOTTY for unimplement IOCTL"Mauro Carvalho Chehab2013-02-151-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As reported by Klaus Schmidinger: "In VDR I use an ioctl() call with FE_READ_UNCORRECTED_BLOCKS on a device (using stb0899). After this call I check 'errno' for EOPNOTSUPP to determine whether this device supports this call. This used to work just fine, until a few months ago I noticed that my devices using stb0899 didn't display their signal quality in VDR's OSD any more. After further investigation I found that ioctl(FE_READ_UNCORRECTED_BLOCKS) no longer returns EOPNOTSUPP, but rather ENOTTY. And since I stop getting the signal quality in case any unknown errno value appears, this broke my signal quality query function." While the changes reflect what is there at: http://comments.gmane.org/gmane.linux.kernel/1235728 it does cause regression on userspace. So, revert it to stop the damage. This reverts commit 177ffe506cf8 ("[media] dvb_frontend: return -ENOTTY for unimplement IOCTL"). Reported-by: Klaus Schmidinger <Klaus.Schmidinger@tvdr.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* | | | | | | | | | Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparcLinus Torvalds2013-02-155-14/+68
|\ \ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pull sparc fixes from David Miller: "A couple small fixes for sparc including some THP brown-paper-bag material: 1) During the merging of all the THP support for various architectures, sparc missed adding a HAVE_ARCH_TRANSPARENT_HUGEPAGE to it's Kconfig, oops. 2) Sparc needs to be mindful of hugepages in get_user_pages_fast(). 3) Fix memory leak in SBUS probe, from Cong Ding. 4) The sunvdc virtual disk client driver has a test of the bitmask of vdisk server supported operations which was off by one bit" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc: sunvdc: Fix off-by-one in generic_request(). sparc64: Fix get_user_pages_fast() wrt. THP. sparc64: Add missing HAVE_ARCH_TRANSPARENT_HUGEPAGE. sparc: kernel/sbus.c: fix memory leakage
| * | | | | | | | | | sunvdc: Fix off-by-one in generic_request().David S. Miller2013-02-141-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The 'operations' bitmap corresponds one-for-one with the operation codes, no adjustment is necessary. Reported-by: Mark Kettenis <mark.kettenis@xs4all.nl> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | | | | | | | | sparc64: Fix get_user_pages_fast() wrt. THP.David S. Miller2013-02-132-10/+63
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Mostly mirrors the s390 logic, as unlike x86 we don't need the SetPageReferenced() bits. On sparc64 we also lack a user/privileged bit in the huge PMDs. In order to make this work for THP and non-THP builds, some header file adjustments were necessary. Namely, provide the PMD_HUGE_* bit defines and the pmd_large() inline unconditionally rather than protected by TRANSPARENT_HUGEPAGE. Reported-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | | | | | | | | sparc64: Add missing HAVE_ARCH_TRANSPARENT_HUGEPAGE.David S. Miller2013-02-131-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This got missed in the cleanups done for the S390 THP support. CC: Gerald Schaefer <gerald.schaefer@de.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | | | | | | | | sparc: kernel/sbus.c: fix memory leakageCong Ding2013-01-211-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The variable iommu and strbuf are not freed properly if it goes to error. Signed-off-by: Cong Ding <dinggnu@gmail.com> Reviewed-by: Richard Mortimer <richm@oldelvet.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-24 08:57:11 +0000