Change return type to boolean. Remove unnecessary check routine for NULL
string. (Power supply name is always valid when the function is executed.)
Signed-off-by: Milo(Woogyom) Kim <milo.kim@ti.com>
Signed-off-by: Anton Vorontsov <anton.vorontsov@linaro.org>
Add new LP8727_ICHG_SHIFT definition and replace a magic number. Reuse
definition for the size of interrupt register buffer.
Signed-off-by: Milo(Woogyom) Kim <milo.kim@ti.com>
Signed-off-by: Anton Vorontsov <anton.vorontsov@linaro.org>
All definitions should be unique, since they're in the gloabl namespace.
So the prefix LP8727_ are added. Additionally, use BIT() macro for bit
masks. Remove unnecessary definitions such as SW_DM1_U1 and SW_DP2_U2.
Signed-off-by: Milo(Woogyom) Kim <milo.kim@ti.com>
Signed-off-by: Anton Vorontsov <anton.vorontsov@linaro.org>
Enum lp8727_chg_state can be removed because only one charger status is
used - EOC(End Of Charge).
To check whether the EOC is reached or not, use simple comparison rather
than shift-operation.
Signed-off-by: Milo(Woogyom) Kim <milo.kim@ti.com>
Signed-off-by: Anton Vorontsov <anton.vorontsov@linaro.org>
For better understanding, use specific function and definitions rather
than magic numbers. New enum type for die temperature is matched with hex
codes. Specific temperature names are better than 0x1, 0x2 and 0x3.
And lp8727_is_high_temperature() function has better readability than
comparing raw register values.
Signed-off-by: Milo(Woogyom) Kim <milo.kim@ti.com>
Signed-off-by: Anton Vorontsov <anton.vorontsov@linaro.org>
To initialize the device, previous interrupts need to be cleared while
loading the driver.
Signed-off-by: Milo(Woogyom) Kim <milo.kim@ti.com>
Signed-off-by: Anton Vorontsov <anton.vorontsov@linaro.org>
For better understanding, function name is changed. (lp8727_intr_config()
is replaced with lp8727_setup_irq().)
The private IRQ number is set when the IRQ is allocated successfully. This
data is used for releasing the IRQ on unloading the driver. Even the IRQ
number is not defined, the driver should be operated. In this case, just
return as 0.
In additional function lp8727_release_irq(), the workqueue is canceled and
the allocated IRQ is released.
Signed-off-by: Milo(Woogyom) Kim <milo.kim@ti.com>
Signed-off-by: Anton Vorontsov <anton.vorontsov@linaro.org>
LP8727 has two IRQ threads. One is the I2C HW IRQ pin, the other is for
delayed interrupt processing. But this delayed processing can be handled
without additional single thread by using schedule_delayed_work() with
jiffies time value.
Signed-off-by: Milo(Woogyom) Kim <milo.kim@ti.com>
Signed-off-by: Anton Vorontsov <anton.vorontsov@linaro.org>
Debounce time is configurable in the platform side. If it is not defined,
the default value is 270ms.
Platform data is msec unit, and this time is converted to jiffies
internally. The workqueue uses this jiffies time in the interrupt
handling. So debounce_jiffies is added in the private data.
Signed-off-by: Milo(Woogyom) Kim <milo.kim@ti.com>
Signed-off-by: Anton Vorontsov <anton.vorontsov@linaro.org>
LP8727 platform data is optional, so the driver should work even the
platform data is NULL.
To check the platform data, charging parameter data should be changed to
the pointer type.
Fix NULL point access problem when getting the battery properties. When
the data is NULL, just return as invalid value.
Signed-off-by: Milo(Woogyom) Kim <milo.kim@ti.com>
Signed-off-by: Anton Vorontsov <anton.vorontsov@linaro.org>
If the lp8727_register_psy() gets failed, registered interrupt handler
should be freed, but this is not complete solution. It has still problem.
Assume that the IRQ occurs while unregistering power supply devices. Then
the ISR will access to freed IRQ.
From Anton's opinion, it can be resolved if re-ordering the call sequence.
Register power supplies first, then create interrupt handler. Then no need
to free the IRQ in _probe(). Additionally goto statements can be removed
because those can be replaced with return statements.
The _remove() should be changed the sequence - in reverse order of
_probe()
Signed-off-by: Milo(Woogyom) Kim <milo.kim@ti.com>
Signed-off-by: Anton Vorontsov <anton.vorontsov@linaro.org>
Use devm_kzalloc() rather than kzalloc()/kfree() to make
allocating/freeing the private data simpler.
Signed-off-by: Milo(Woogyom) Kim <milo.kim@ti.com>
Signed-off-by: Anton Vorontsov <anton.vorontsov@linaro.org>
This branch includes some late device tree changes for Tegra:
A property is added to Whistler's device tree to enable the PMIC to
act as the pm_power_off() implementation.
A number of new device tree are added for boards from Avionic Design.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iQIcBAABAgAGBQJQWzknAAoJEMzrak5tbycx5xgP+gMwuLEEd9YFTm8s2lpco8F8
k6hDy/5a7LSgmYgrVa8U7dooQSZyDQE8/Arfzw/uXKbhHY77+B06aqz6doCLjQ2s
UZp9TGqS9rFcItNipeYbqxKMU0QYzHAX+ZCgld2Sq9TI9STCJjmB1Rhb9zmcr+zv
kYGp73b8fjDI/44bRGsF3AOwKjQjB4hmAyFY+ybjUENFU7pFIR1V1bGsczhDvwzs
Bp2JilSKPrS9kf+pzMDWON8/0HHoKnKfLE/Cx7iwYbKgt9Czl4wUUqeFzNI5CCnw
/FquASmefo3JUPRR2Q7A8IwCF6YksJCDO6nQSa6wD0k4tuC/5qHm7x+pZkWDZwBM
iWovqYFEMgN1rhzdxb6BJVt3I6zVSzkhF8+gcw5rRSakZgKSVsJqsNU20hrkRx5A
mW0F2vCwEzKZa2v9wHpqJ7YjJdr4X6ISKWbipDmmTXxBBUyXIpJTSjkTd969J9iQ
XFvPK3VI4LRgw/Nu5qMbPIyIIbGWLkIY6dKJNOHY1aDZGuntDqVWen4OTrX57S/E
XC00MR7WAZtLbternGj6WA6UiyuYU+JQ825CfLs8PS5a9+xLSntyaPeQtMkEpz6p
7kDBSBOBg9O5KxgJNT/6ufk7qogWpe461OyQsAt6BHfmjXStQM0ZN2DmZhaYaqkm
hxGAq/7/0F1R7kUvyw3j
=s7Ln
-----END PGP SIGNATURE-----
Merge tag 'tegra-for-3.7-dt2' of git://git.kernel.org/pub/scm/linux/kernel/git/swarren/linux-tegra into next/dt
ARM: tegra: second round of device tree changes
This branch includes some late device tree changes for Tegra:
A property is added to Whistler's device tree to enable the PMIC to
act as the pm_power_off() implementation.
A number of new device tree are added for boards from Avionic Design.
* tag 'tegra-for-3.7-dt2' of git://git.kernel.org/pub/scm/linux/kernel/git/swarren/linux-tegra:
ARM: tegra: Add Avionic Design Tamonten Evaluation Carrier support
ARM: tegra: Add Avionic Design Medcom-Wide support
ARM: tegra: Add Avionic Design Plutux support
ARM: tegra: Add Avionic Design Tamonten support
ARM: tegra: dts: Add pwm label
ARM: dt: tegra: whistler: configure power off
The BCM2835 is an ARM SoC from Broadcom. This patch adds very basic
support for this SoC; enough to boot the system into an initrd with
UART console, interrupt controller, timers, and a stub clock driver.
Also provided is a similarly basic device tree for the Raspberry Pi
Model B board.
This series was written by Simon Arlott, Chris Boot, and Dom Cobley
downstream, with reference to a Broadcom tree, and modified for upstream
and submitted by Stephen Warren.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAABAgAGBQJQWnCOAAoJEJuNpwkmVCGcQS8P/01yZOE2QhW/S4ap1voLyRuI
T7wcjla6UXckuz72qnLitJCDHxwDAF6Kgc/anibQfgambqjOAA5YuXBkJlUaBQF1
3u6k8pNJ7cI3R44BznnLN4U8QXw/w5IlUdFu7Y7Xg4xyb1Fdx11QJelYmiPIdXEQ
fFVqO5JQoMWXz7i9fYU/jXHcbINyljgSqhBOM9O1R2W3kayPm3OdmyAXHzmt7rSw
XPta3QlrkI/fCgolI2A9LMhrfaJVRQe59H9b+fP2R9baWs7BnkZywjO8mwipR8eI
d4tRH8cy+Aa/RobLe5DnorxZ9abj3vlSv0kG0qBhcieqXZmGKlum3J4h1cBAvs8p
Cv0Gm7GFxeqCJ3RaLfn1mX2OESmGQ9KH33J3PFQUcNmd82saXz6Kas7YZ5KRlMAI
+TS3n9Er7P2HlpYF/3ckE3aYrN/iHJaZ/2pa2ZiR8KRnRTY3DMTxgvNIaz044zud
gHUbQpttzNV0aiqMDqMvpVqBhUMCVF0LWlhQyewQHHdVSS9XNq1lrfbXPc4k54Fs
Tkz4JT5S1Vhv+iqakwKQvNVpO8XWvj0Z5t5/3IqLpzdYWRp6kQh8giJXhLEQSoVl
38sJ2v6MzNmyx1yggO58Qq+OpelNDowhY0tGcOrSl6uR786gcivw9T2wd8V0iwbw
uMeZ6apUnOseOaKU9mrm
=vqsx
-----END PGP SIGNATURE-----
Merge tag 'rpi-for-3.7' of git://git.kernel.org/pub/scm/linux/kernel/git/swarren/linux-rpi into next/soc
ARM: add basic BCM2835 SoC and Raspberry Pi board support
The BCM2835 is an ARM SoC from Broadcom. This patch adds very basic
support for this SoC; enough to boot the system into an initrd with
UART console, interrupt controller, timers, and a stub clock driver.
Also provided is a similarly basic device tree for the Raspberry Pi
Model B board.
This series was written by Simon Arlott, Chris Boot, and Dom Cobley
downstream, with reference to a Broadcom tree, and modified for upstream
and submitted by Stephen Warren.
* tag 'rpi-for-3.7' of git://git.kernel.org/pub/scm/linux/kernel/git/swarren/linux-rpi:
MAINTAINERS: add an entry for the BCM2835 ARM sub-architecture
ARM: bcm2835: instantiate console UART
ARM: bcm2835: add stub clock driver
ARM: bcm2835: add system timer
ARM: bcm2835: add interrupt controller driver
ARM: add infra-structure for BCM2835 and Raspberry Pi
Like 8250 driver, when pstore is registered as a console,
to avoid recursive spinlocks when panic happening, change the
spin_lock_irqsave to spin_trylock_irqsave when oops_in_progress
is true.
Signed-off-by: liu chuansheng <chuansheng.liu@intel.com>
Signed-off-by: Anton Vorontsov <anton.vorontsov@linaro.org>
From Kukjin Kim:
This is for updating s3c6400_defconfig to build every s3c64xx stuff.
This helps to know at least building error before merging them.
* 'next/defconfig-samsung' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung:
ARM: s3c6400_defconfig: enable more boards in defconfig
Signed-off-by: Olof Johansson <olof@lixom.net>
From Kukjin Kim:
This is for updating non-DT Samsung board files for v3.7, there are adding
generic PWM lookup support and some updates.
* 'next/board-samsung' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung:
ARM: EXYNOS: Add generic PWM lookup support for SMDKV310
ARM: EXYNOS: Add generic PWM lookup support for SMDK4X12
ARM: EXYNOS: Use generic pwm driver in Origen board
ARM: dts: Add heartbeat gpio-leds support to Origen
ARM: dts: Use active low flag for gpio-keys on Origen
ARM: S3C64XX: Register audio platform devices for Bells on Cragganmore
ARM: S3C64XX: Update configuration for WM5102 module on Cragganmore
Fixed trivial merge conflict in arch/arm/mach-exynos/mach-smdkv310.c.
Signed-off-by: Olof Johansson <olof@lixom.net>
From Kukjin Kim:
Here is G-Scaler DT for supporting EXYNOS5 SoCs.
* 'next/dt-gscaler' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung:
ARM: EXYNOS: Adds G-Scaler device from Device Tree
ARM: EXYNOS: Add clock support for G-Scaler
From Kukjin Kim:
This branch is for supporting pinctrl for Samsung EXYNOS. Now this can
support EXYNOS4210 and other EXYNOS SoCs such as EXYNOS4X12 will be
supported next time.
* 'next/pinctrl-samsung' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung:
ARM: EXYNOS: Enable pinctrl driver support for EXYNOS4 device tree enabled platform
ARM: dts: Add pinctrl node entries for SAMSUNG EXYNOS4210 SoC
ARM: EXYNOS: skip wakeup interrupt setup if pinctrl driver is used
gpio: exynos4: skip gpiolib registration if pinctrl driver is used
pinctrl: add exynos4210 specific extensions for samsung pinctrl driver
pinctrl: add samsung pinctrl and gpiolib driver
This restores the previous behavior of stopping all child devices before
removing any of them. The current SR-IOV design, where removing the PF
also drops references on all the VFs, depends on having the VFs continue
to exist after having been stopped.
[bhelgaas: changelog]
Signed-off-by: Yinghai Lu <yinghai@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
From Kukjin Kim:
Since there are many changes for gpio-samsung in my tree, this has been
included in my tree with Linus' agreement.
* 'next/gpio-samsung' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung:
gpio: samsung: add devicetree init for s3c24xx arches
From Kukjin Kim:
Here, there are cleanup patches for Samsung v3.7 and most of them are
related to cleanup Samsung specific gpio API.
* samsung/cleanup:
gpio: samsung: Update documentation
ARM: S3C24XX: Use module_platform_driver macro in mach-osiris-dvs.c
ARM: S3C24XX: Use module_platform_driver macro in h1940-bluetooth.c
gpio-samsung: Remove now unused s3c2410_gpio* API
ARM: S3C24XX: Remove obsolete GPIO API declarations
ARM: S3C24XX: Convert users of s3c2410_gpio_setpin to gpiolib API
ARM: EXYNOS: cleanup unused code related to GPS
Pick up one more bugfix
* drivers/ocp2scp:
drivers: bus: omap_l3: use resources instead of hardcoded irqs
Signed-off-by: Olof Johansson <olof@lixom.net>
This fixes up a merge conflict due to the move of the driver and cleanups of
platform data around the same time. Moving to the resource is what we want
anyway, so do it in this branch.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
[olof: rewrote with this branch as base, same end result]
Signed-off-by: Olof Johansson <olof@lixom.net>
Acked-by: Tony Lindgren <tony@atomide.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@ti.com>
This reverts commit 433efd2247.
When we remove an SR-IOV device, we have this call chain:
driver .remove() method
pci_disable_sriov()
sriov_disable()
virtfn_remove()
pci_get_domain_bus_and_slot()
sriov_disable() is only called for PFs, not for VFs. When it's called
for a PF, it loops through all the VFs and calls virtfn_remove() for
each. But we stop and remove VFs before PFs, so by the time we get
to virtfn_remove(), the VFs have already been stopped and deleted
from the device list. Now pci_get_domain_bus_and_slot(), which uses
bus_find_device() and relies on that device list, doesn't find the
VFs, so the VF references aren't released correctly.
Reported-by: Yinghai Lu <yinghai@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Silences the following warnings:
arch/arm/plat-samsung/devs.c:765:31: warning:
symbol 's5p_hdmi_def_platdata' was not declared. Should it be static?
arch/arm/plat-samsung/devs.c:767:13: warning:
symbol 's5p_hdmi_set_platdata' was not declared. Should it be static?
Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
Add missing get_rate callback for the "camif-upll" clock, so frequency
of this clock is properly reported with clk_get_rate().
Signed-off-by: Sylwester Nawrocki <sylvester.nawrocki@gmail.com>
Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
The clocks for NAND, OneNAND and Transport Stream Interface(TSI)
controllers could be either enabled or disabled at boot. To ensure
that these are turned off until used, add them to the list of clocks
to be turned off during boot.
Signed-off-by: Chander Kashyap <chander.kashyap@linaro.org>
Reviewed-by: Thomas Abraham <thomas.abraham@linaro.org>
Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
Generated by: scripts/coccinelle/misc/irqf_oneshot.cocci
Make sure threaded IRQs without a primary handler are always request with IRQF_ONESHOT
Signed-off-by: Fengguang Wu <fengguang.wu@intel.com>
Acked-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Anton Vorontsov <anton.vorontsov@linaro.org>
Generated by: scripts/coccinelle/misc/irqf_oneshot.cocci
ERROR: Threaded IRQ with no primary handler requested without IRQF_ONESHOT
Make sure threaded IRQs without a primary handler are always request
with IRQF_ONESHOT
Signed-off-by: Fengguang Wu <fengguang.wu@intel.com>
Acked-by: Milo(Woogyom) Kim <milo.kim@ti.com>
Signed-off-by: Anton Vorontsov <anton.vorontsov@linaro.org>
Because of a typo, incorrect field of a structure was being checked.
This patch fixes the check to use correct field.
Signed-off-by: Tomasz Figa <t.figa@samsung.com>
Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
Although the function is used only a single time, it is not performance
critical and it is pretty heavy, so let the compiler decide whether to
inline it instead.
Signed-off-by: Tomasz Figa <t.figa@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
Current way of finding the wakeup-eint node scans the whole device tree
not only children of the pinctrl node, so it might detect a wakeup-eint
node of another pinctrl device.
This patch limits the scope of looking for nodes only to subnodes of the
pinctrl node.
Signed-off-by: Tomasz Figa <t.figa@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
The exynos_irq_demux_eint utility function is used in chained IRQ
handler for EINT16-31 to handle multiplexed interrupts. Inlining it
should improve the performance a bit.
Signed-off-by: Tomasz Figa <t.figa@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
A bit in EINTxx_PEND register is set regardless of interrupt mask, which
causes spurious interrupts. To avoid them, the read value of pending
register must be masked with current interrupt mask manually.
Signed-off-by: Tomasz Figa <t.figa@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
To mask GPIO/wakeup IRQ, the corresponding bit in mask register has to
be set.
Signed-off-by: Tomasz Figa <t.figa@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
Pins used as GPIO interrupts need to be configured as EINTs. This patch
adds the required configuration code to exynos_gpio_irq_set_type,
to set the pin as EINT when its interrupt trigger is configured.
Signed-off-by: Tomasz Figa <t.figa@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
Sparse complains:
CHECK drivers/power/88pm860x_battery.c
drivers/power/88pm860x_battery.c:128:5: warning: symbol 'array_soc' was not declared. Should it be static?
CHECK drivers/power/88pm860x_charger.c
drivers/power/88pm860x_charger.c:640:3: warning: symbol 'pm860x_irq_descs' was not declared. Should it be static?
CHECK drivers/mfd/88pm860x-core.c
drivers/mfd/88pm860x-core.c:803:53: warning: incorrect type in assignment (different base types)
drivers/mfd/88pm860x-core.c:803:53: expected struct charger_regulator *charger_regulators
drivers/mfd/88pm860x-core.c:803:53: got struct regulator_bulk_data static [toplevel] *
The issues are minor, except for the last one. We seemed to use
'regulator_bulk_data' struct (just as charger manager documentation
wrongly tells us), but in real it should have been
'struct charger_regulator'. The only reason that it worked is
because both 'supply' and 'regulator_name' struct members are the
first in these structs. :-)
Signed-off-by: Anton Vorontsov <anton.vorontsov@linaro.org>
There are charger and battery measurement feature for 88pm860x PMIC.
For charger, it can support pre-charge with small current when battery is
nearly exausted and then changed into fast-charge with CC&CV mode.
For battery monitor, it can support battery measurement such as
vbat,vsys,vchg and ibat etc,it can aslo accumulating the Coulomb value
charged or discharged from battery based on Conlomb Counter, we use it
to estimate battery capacity.
Signed-off-by: Jett.Zhou <jtzhou@marvell.com>
Signed-off-by: Anton Vorontsov <anton.vorontsov@linaro.org>
AM33xx hwmod data includes "mcspi.h" which has now been moved after
the platform_data move. Fix it.
Signed-off-by: Kevin Hilman <khilman@ti.com>
Acked-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Olof Johansson <olof@lixom.net>
TI LP8788 PMU supports regulators, battery charger, RTC, ADC, backlight
driver and current sinks.
This patch supports the charger operations including the charger
interrupt handling.
The LP8788 charger driver provides configurable platform data. The
charger platform data includes ADC input ID, maximum battery voltage,
charging parameters and etc.
The ADC input is used for getting the battery voltage and temperature.
Charging parameters are used for updating the charger operations such
like setting charging current and setting End-of-charge conditions.
When the charging interrupt occurs, power supply uevents are generated
in order to update the user-space information. For platform specific
charger action, the charger_event() function can be used in the
platform side.
Signed-off-by: Milo(Woogyom) Kim <milo.kim@ti.com>
Signed-off-by: Anton Vorontsov <anton.vorontsov@linaro.org>
The ESN replay window was already fully initialized in
xfrm_alloc_replay_state_esn(). No need to copy it again.
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
The current code fails to ensure that the netlink message actually
contains as many bytes as the header indicates. If a user creates a new
state or updates an existing one but does not supply the bytes for the
whole ESN replay window, the kernel copies random heap bytes into the
replay bitmap, the ones happen to follow the XFRMA_REPLAY_ESN_VAL
netlink attribute. This leads to following issues:
1. The replay window has random bits set confusing the replay handling
code later on.
2. A malicious user could use this flaw to leak up to ~3.5kB of heap
memory when she has access to the XFRM netlink interface (requires
CAP_NET_ADMIN).
Known users of the ESN replay window are strongSwan and Steffen's
iproute2 patch (<http://patchwork.ozlabs.org/patch/85962/>). The latter
uses the interface with a bitmap supplied while the former does not.
strongSwan is therefore prone to run into issue 1.
To fix both issues without breaking existing userland allow using the
XFRMA_REPLAY_ESN_VAL netlink attribute with either an empty bitmap or a
fully specified one. For the former case we initialize the in-kernel
bitmap with zero, for the latter we copy the user supplied bitmap. For
state updates the full bitmap must be supplied.
To prevent overflows in the bitmap length calculation the maximum size
of bmp_len is limited to 128 by this patch -- resulting in a maximum
replay window of 4096 packets. This should be sufficient for all real
life scenarios (RFC 4303 recommends a default replay window size of 64).
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Martin Willi <martin@revosec.ch>
Cc: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
The memory used for the template copy is a local stack variable. As
struct xfrm_user_tmpl contains multiple holes added by the compiler for
alignment, not initializing the memory will lead to leaking stack bytes
to userland. Add an explicit memset(0) to avoid the info leak.
Initial version of the patch by Brad Spengler.
Cc: Brad Spengler <spender@grsecurity.net>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
The memory reserved to dump the xfrm policy includes multiple padding
bytes added by the compiler for alignment (padding bytes in struct
xfrm_selector and struct xfrm_userpolicy_info). Add an explicit
memset(0) before filling the buffer to avoid the heap info leak.
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
The memory reserved to dump the xfrm state includes the padding bytes of
struct xfrm_usersa_info added by the compiler for alignment (7 for
amd64, 3 for i386). Add an explicit memset(0) before filling the buffer
to avoid the info leak.
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
copy_to_user_auth() fails to initialize the remainder of alg_name and
therefore discloses up to 54 bytes of heap memory via netlink to
userland.
Use strncpy() instead of strcpy() to fill the trailing bytes of alg_name
with null bytes.
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
