summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2013-02-14mfd: twl-core: Remove no longer valid comment regarding to write buffer sizePeter Ujfalusi
With the regmap conversion there is no longeer a need to allocate bigger buffer for writes Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-02-14mfd: twl-core: Collect global variables behind one private structure (global)Peter Ujfalusi
Gather the global variables under a single structure and allocate it with devm_kzalloc(). It is easier to see them and if in the future we try to add support for multiple instance of twl in the system it is going to be much simpler. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-02-14mfd: twl-core: Move 'inuse' check early at probe timePeter Ujfalusi
We can fail earlier in case multiple instance of the twl-core is tried to be loaded. The twl-core by design only supports one instance. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-02-14mfd: twl-core: Do not create dummy pdata when booted with DTPeter Ujfalusi
When booted with DT we can manage without the dummy pdata. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-02-14mfd: twl-core: Do not try to call legacy mfd add_children() when booted with DTPeter Ujfalusi
There is really no point to retry to add children devices in case the of_platform_populate() fails. We do not have any information provided via pdata in this case anyways. Depending on the boot type (legacy or DT) only execute either one. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-02-14mfd: twl-core: Allocate twl_modules dynamicallyPeter Ujfalusi
At boot time we can allocate the twl_modules array dynamically based on the twl class we are using with devm_kzalloc() instead of the static twl_modules[] array. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-02-14mfd: twl-core: Use the lookup table to find the correct subchip for the modulesPeter Ujfalusi
Instead of using SUB_CHIP_ID* or magic numbers use the twl_mapping table to look for the subchip ID. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-02-14mfd: twl-core: No need to check for invalid subchip IDPeter Ujfalusi
The module id table no longer can have invalid/unused entries. No need for checking the ID for validity. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-02-14mfd: twl-core: Clean up module id lookup and definitionsPeter Ujfalusi
Use enums for all module definitions: twl_module_ids for common functionality among twl4030/twl6030 twl4030_module_ids for twl4030 specific ids twl6030_module_ids for twl6030 specific ids In this way the list can be managed easier when new functionality going to be implemented. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-02-14ARM: OMAP: zoom-display: Remove the use of TWL4030_MODULE_PWM1Peter Ujfalusi
Use the future proof TWL_MODULE_PWM module id instead to aim the twl-core cleanup planed for 3.9 kernel cycle. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Acked-by: Tony Lindgren <tony@atomide.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-02-14mfd: arizona: Provide platform data for MICBIAS configurationMark Brown
Allow the MICBIAS voltages and other attributes to be configured by the platform. Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-02-14mfd: arizona: Clarify mixer underclocking errorMark Brown
If the mixer is underclocked it will drop a sample so log that error more directly. Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-02-14mfd: arizona: Disable interrupts during resumeMark Brown
Runtime power management does not function during system suspend but the Arizona devices need to use runtime power management to power up the device in order to handle interrupts. Try to avoid interrupts firing during resume by disabling the primary IRQ before interrupts are reenabled on resume and only reenabling it again during main resume. The goal is to avoid issues in the situation where an interrupt is asserted during resume (eg, due to it being the wake source) and the interrupt handling gets scheduled prior to the device being able to handle runtime PM. Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-02-14mfd: wm5102: Refresh register defaultsMark Brown
The WM5102 register defaults are not up to date with the current register map, synchronise them with those for current devices. Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-02-14mfd: wm5102: Mark DSP memory regions as volatile and readableMark Brown
We can cache some of them but this is simpler for now. Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-02-14mfd: wm8994: Use devm_regulator_bulk_get APISachin Kamat
devm_regulator_bulk_get is device managed and saves some cleanup and exit code. Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org> Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-02-14mfd: wm5102: Update rev B patch for latest evaluationMark Brown
The latest evaluation of the revision B silicon suggests some changes to the tuning applied for optimal performance. Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-02-14mfd: arizona: Register MICVDD supply first to ensure no retriesMark Brown
Not strictly required as probe deferral will take care of everything but it makes boot a little smoother. Reported-by: Ryo Tsutsui <Ryo.Tsutsui@wolfsonmicro.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-02-14mfd: wm5102: Mark only extant DSP registers volatileMark Brown
Since regmap sometimes uses volatile as a proxy for readable simply having a blanket condition can mark too many registers as readable. Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-02-14rtc: palmas: Add RTC driver Palmas series PMICLaxman Dewangan
TI Palmas series PMIC support the RTC and alarm functionality. Add RTC driver with alarm support for this device. Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-02-14gpio: palmas: Add support for Palmas GPIOLaxman Dewangan
Add gpio driver for TI Palmas series PMIC. This has 8 gpio which can work as input/output. Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com> Acked-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-02-14mfd: palmas: Add APIs to access the Palmas' registersLaxman Dewangan
Palmas register set is divided into different blocks (base and offset) and hence different i2c addresses. The i2c address offsets are derived from base address of block of registers. Add inline APIs to access the Palma's registers which takes the base of register block and register offset. The i2c address offset is derived from the base address of register blocks. Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-02-14mfd: palmas: Add rtc irq number as irq resource for palmas-rtcLaxman Dewangan
Palma RTC is capable of generating alarm interrupt. Pass the alarm interrupt as IRQ_RESOURCE for palmas-rtc sub device driver so that rtc driver can get irq as platform_get_irq(). Also pass the irq domain in mfd_add_devices() to properly offset the irqs for sub devices. This is needed when adding device through DT. Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-02-13tools/power turbostat: display SMI count by defaultLen Brown
The SMI counter is popular -- so display it by default rather than requiring an option. What the heck, we've blown the 80 column budget on many systems already... Note that the value displayed is the delta during the measurement interval. The absolute value of the counter can still be seen with the generic 32-bit MSR option, ie. -m 0x34 Signed-off-by: Len Brown <len.brown@intel.com>
2013-02-13intel_idle: export both C1 and C1ELen Brown
Here we disable HW promotion of C1 to C1E and export both C1 and C1E and distinct C-states. This allows a cpuidle governor to choose a lower latency C-state than C1E when necessary to satisfy performance and QOS constraints -- and still save power versus polling. This also corrects the erroneous latency previously reported for C1E -- it is 10usec, not 1usec. Note that if you use "intel_idle.max_cstate=N", then you must increment N by 1 to get the same behavior after this change. Signed-off-by: Len Brown <len.brown@intel.com>
2013-02-14drm/fb-helper: remove unused members of struct drm_fb_helperDaniel Vetter
Spotted by Rob Clark. Reviewed-by: Rob Clark <robdclark@gmail.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2013-02-14drm/fb-helper: don't sleep for screen unblank when an oopps is in progressDaniel Vetter
Otherwise the system will burn even brighter and worse, leave the user wondering what's going on exactly. Since we already have a panic handler which will (try) to restore the entire fbdev console mode, we can just bail out. Inspired by a patch from Konstantin Khlebnikov. The callchain leading to this, cut&pasted from Konstantin's original patch: callstack: panic() bust_spinlocks(1) unblank_screen() vc->vc_sw->con_blank() fbcon_blank() fb_blank() info->fbops->fb_blank() drm_fb_helper_blank() drm_fb_helper_dpms() drm_modeset_lock_all() mutex_lock(&dev->mode_config.mutex) Note that the entire locking in the fb helper around panic/sysrq and kdbg is ... non-existant. So we have a decent change of blowing up everything. But since reworking this ties in with funny concepts like the fbdev notifier chain or the impressive things which happen around console_lock while oopsing, I'll leave that as an exercise for braver souls than me. v2: Drop the -EBUSY return value I've copied, we don't need it since the we'll take care of things ourselves anyway. Cc: Konstantin Khlebnikov <khlebnikov@openvz.org> Cc: Andrew Morton <akpm@linux-foundation.org> References: https://patchwork.kernel.org/patch/1878181/ Reviewed-by: Rob Clark <robdclark@gmail.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2013-02-14drm/fb-helper: improve kerneldocDaniel Vetter
Now that the fbdev helper interface for drivers is trimmed down, update the kerneldoc for all the remaining exported functions. I've tried to beat the DocBook a bit by reordering the function references a bit into a more sensible ordering. But that didn't work out at all. Hence just extend the in-code DOC: section a bit. Also remove the LOCKING: sections - especially for the setup functions they're totally bogus. But that's not a documentation problem, but simply an artifact of the current rather hazardous locking around drm init and even more so around fbdev setup ... v2: Some further improvements: - Also add documentation for drm_fb_helper_single_add_all_connectors, Dave Airlie didn't want me to kill this one from the fb helper interface. - Update docs for drm_fb_helper_fill_var/fix - they should be used from the driver's ->fb_probe callback to setup the fbdev info structure. - Clarify what the ->fb_probe callback should all do - it needs to setup both the fbdev info and allocate the drm framebuffer used as backing storage. - Add basic documentaation for the drm_fb_helper_funcs driver callback vfunc. v3: Implement clarifications Laurent Pinchart suggested in his review. v4: Fix another mispelling Laurent spotted. Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2013-02-14drm/<drivers>: simplify ->fb_probe callbackDaniel Vetter
The fb helper lost its support for reallocating an fb completely, so no need to return special success values any more. Reviewed-by: Rob Clark <robdclark@gmail.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2013-02-14drm/fb-helper: streamline drm_fb_helper_single_fb_probeDaniel Vetter
No need to check whether we've allocated a new fb since we're not always doing that. Also, we always need to register the fbdev and add it to the panic notifier. Reviewed-by: Rob Clark <robdclark@gmail.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2013-02-14drm/fb-helper: directly call set_par from the hotplug handlerDaniel Vetter
The idea behind calling down into the driver's ->fb_probe function on each hotplug seems to be able to reallocate the backing storage (if e.g. a screen with higher resolution gets added). But that requires quite a bit of work in the fb helper itself, since currently we limit new screens to the currently allocated fb. An no kms driver supports fbdev fb resizing. So don't bother and start to simplify the code by calling drm_fb_helper_set_par directly from the fbdev hotplug function, since that's the only thing left in drm_fb_helper_single_fb_probe which does not concern itself with fb allocation and initial setup. Follow-on patches will streamline the initial setup code. Reviewed-by: Rob Clark <robdclark@gmail.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2013-02-14drm/fb-helper: fixup set_config semanticsDaniel Vetter
While doing the modeset rework for drm/i915 I've noticed that the fb helper is very liberal with the semantics of the ->set_config interface: - It doesn't bother clearing stale modes (e.g. when unplugging a screen). - It unconditionally sets the fb, even if no mode will be set on a given crtc. - The initial setup is a bit fun since we need to pick crtcs to decide the desired fb size, but also should set the modeset->fb pointer. Explain what's going on in the fixup code after the fb is allocated. The crtc helper didn't really care, but the new i915 modeset infrastructure did, so I've had to add a bunch of special-cases to catch this. Fix this all up and enforce the interface by converting the checks in drm/i915/intel_display.c to BUG_ONs. v2: Fix commit message spell fail spotted by Rob Clark. Reviewed-by: Rob Clark <robdclark@gmail.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2013-02-14drm/i915: rip out helper->disable noop functionsDaniel Vetter
Now that the driver is in control of whether it needs to disable everything at take-over or not, we can rip this all out. Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2013-02-14drm/fb-helper: don't disable everything in initial_configDaniel Vetter
This should be done in the drivers for two reasons: - it gets in the way of fastboot efforts - it links the fb helpers with the crtc helpers instead of going through the real interface vfuncs, forcing i915 to fake all the ->disable callbacks used by the crtc helper to avoid ugly Oopsen v2: Resolve conflicts since drivers still call drm_fb_helper_single_add_all_connectors. Reviewed-by: Rob Clark <robdclark@gmail.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2013-02-14drm/tegra: don't set up initial fbcon config twiceDaniel Vetter
drm_fbdev_cma_init does the inital fbcon setup by calling down into drm_fb_helper_initial_config, so no need at all to restore the just set up configuration right away ... Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2013-02-14drm/fb-helper: unexport drm_fb_helper_single_fb_probeDaniel Vetter
Not called by anyone, and really, shouldn't be. Drivers are supposed either drm_fb_helper_initial_config or drm_fb_helper_hotplug_event. Originally this was done differently, but is now consolidated in the helper functions and no longer done by drivers directly. Reviewed-by: Rob Clark <robdclark@gmail.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2013-02-14drm/fb-helper: unexport drm_fb_helper_panicDaniel Vetter
It doesn't even show up in any header files and only used iternally. Originally it was (ab)used to restore the fbcon on lastclose, but that died with commit e8e7a2b8ccfdae0d4cb6bd25824bbedcd42da316 Author: Dave Airlie <airlied@redhat.com> Date: Thu Apr 21 22:18:32 2011 +0100 drm/i915: restore only the mode of this driver on lastclose (v2) Reviewed-by: Rob Clark <robdclark@gmail.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2013-02-14drm/fb-helper: kill drm_fb_helper_restoreDaniel Vetter
It's only used internally for the sysrq and panic handlers provided by the drm fb helper implementation. Hence just inline it, kill the export and remove the confusing kerneldoc. Driver's are supposed to call drm_fb_helper_restore_fbdev_mode on lastclose. Note that locking is totally fubar - the sysrq case doesn't take any locks at all. The panic handler probably shouldn't take any locks since it'll only make things worse. Otoh it's probably better to switch things over to the atomic modeset callbacks (and disable the panic handler for those drivers which don't implement it). But that's both better done in separate patches. Reviewed-by: Rob Clark <robdclark@gmail.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2013-02-14drm: review locking for drm_fb_helper_restore_fbdev_modeDaniel Vetter
... it's required. Fix up exynos and the cma helper, and add a corresponding WARN_ON to drm_fb_helper_restore_fbdev_mode. Note that tegra calls the fbdev cma helper restore function also from it's driver-load callback. Which is a bit against current practice, since usually the call is only from ->lastclose, and initial setup is done by drm_fb_helper_initial_config. Also add the relevant drm DocBook entry. v2: Add promised WARN to restore_fbdev_mode. Reviewed-by: Rob Clark <robdclark@gmail.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2013-02-14extcon: max8997: Use workqueue to check cable state after completing boot of ↵Chanwoo Choi
platform This patch use delayed workqueue to check cable state after a certain time. If extcon-max8997 driver check cable state during booting of platform, this couldn't send the correct notification of cable state to extcon consumer. Alwasys, this driver should check cable state after the completion of platform initialization Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com> Signed-off-by: Myungjoo Ham <myungjoo.ham@samsung.com>
2013-02-14extcon: max8997: Set default UART/USB path on probeChanwoo Choi
This patch set default H/W line path according to platfomr data. The MAX8997 MUIC device can possibly set UART/USB or UART_AUX /USB_AUX to internal H/W line path of MUIC device. Namely, only one H/W line is used for two operation. For example, if H/W line path of MAX8997 device set UART/USB, micro usb cable is connected to AP(Application Processor) and if H/W line path set UART_AUX/USB_AUX, micro usb cable is connected to CP(Coprocessor). Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com> Signed-off-by: Myungjoo Ham <myungjoo.ham@samsung.com>
2013-02-14extcon: max8997: Consolidate duplicate code for checking ADC/CHG cable typeChanwoo Choi
This patch make max8997_muic_get_cable_type() function to remove duplicate code for checking ADC/Charger cable type because almost internal function need to read adc/chg_type value of MUIC register. Also, remove *_detach() function, extcon-max8997 driver treat attach/detach operation of cable in max8997_*_handler() function. Lastly, this patch move defined constant in header file(include/ linux/mfd/max8997.h, max8997-private.h) because defined constant is only used in the 'extcon-max8997.c'. Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com> Signed-off-by: Myungjoo Ham <myungjoo.ham@samsung.com>
2013-02-14extcon: max8997: Set default of ADC debounce time during initializationChanwoo Choi
This patch set default of ADC Debounce Time(25ms) during probe step. Also, can possible change ADC Debounce Time according to H/W situation by using max8997_set_adc_debounce_time() Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com> Signed-off-by: Myungjoo Ham <myungjoo.ham@samsung.com>
2013-02-14extcon: max8997: Remove duplicate code related to set H/W line pathChanwoo Choi
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com> Signed-off-by: Myungjoo Ham <myungjoo.ham@samsung.com>
2013-02-14extcon: max8997: Move defined constant to header fileChanwoo Choi
This patch move defined constants to header file(max77693-private.h) because of mask/unmask selectively interrupt of MUIC device according to attribute of H/W board. Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com> Signed-off-by: Myungjoo Ham <myungjoo.ham@samsung.com>
2013-02-14extcon: max77693: Make max77693_extcon_cable staticSachin Kamat
'max77693_extcon_cable' is used only in this file. Hence make it static. Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org> Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com> Signed-off-by: Myungjoo Ham <myungjoo.ham@samsung.com>
2013-02-14extcon: max8997: Remove unreachable codeSachin Kamat
'break' after 'return' is never executed and hence can be deleted. Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org> Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com> Signed-off-by: Myungjoo Ham <myungjoo.ham@samsung.com>
2013-02-14extcon: max8997: Make max8997_extcon_cable staticSachin Kamat
'max8997_extcon_cable' is used only in this file. Hence make it static. Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org> Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com> Signed-off-by: Myungjoo Ham <myungjoo.ham@samsung.com>
2013-02-13xen: remove redundant NULL check before unregister_and_remove_pcpu().Cyril Roelandt
unregister_and_remove_pcpu on a NULL pointer is a no-op, so the NULL check in sync_pcpu can be removed. Signed-off-by: Cyril Roelandt <tipecaml@gmail.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
2013-02-13x86/xen: don't assume %ds is usable in xen_iret for 32-bit PVOPS.Jan Beulich
This fixes CVE-2013-0228 / XSA-42 Drew Jones while working on CVE-2013-0190 found that that unprivileged guest user in 32bit PV guest can use to crash the > guest with the panic like this: ------------- general protection fault: 0000 [#1] SMP last sysfs file: /sys/devices/vbd-51712/block/xvda/dev Modules linked in: sunrpc ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4 iptable_filter ip_tables ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables ipv6 xen_netfront ext4 mbcache jbd2 xen_blkfront dm_mirror dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan] Pid: 1250, comm: r Not tainted 2.6.32-356.el6.i686 #1 EIP: 0061:[<c0407462>] EFLAGS: 00010086 CPU: 0 EIP is at xen_iret+0x12/0x2b EAX: eb8d0000 EBX: 00000001 ECX: 08049860 EDX: 00000010 ESI: 00000000 EDI: 003d0f00 EBP: b77f8388 ESP: eb8d1fe0 DS: 0000 ES: 007b FS: 0000 GS: 00e0 SS: 0069 Process r (pid: 1250, ti=eb8d0000 task=c2953550 task.ti=eb8d0000) Stack: 00000000 0027f416 00000073 00000206 b77f8364 0000007b 00000000 00000000 Call Trace: Code: c3 8b 44 24 18 81 4c 24 38 00 02 00 00 8d 64 24 30 e9 03 00 00 00 8d 76 00 f7 44 24 08 00 00 02 80 75 33 50 b8 00 e0 ff ff 21 e0 <8b> 40 10 8b 04 85 a0 f6 ab c0 8b 80 0c b0 b3 c0 f6 44 24 0d 02 EIP: [<c0407462>] xen_iret+0x12/0x2b SS:ESP 0069:eb8d1fe0 general protection fault: 0000 [#2] ---[ end trace ab0d29a492dcd330 ]--- Kernel panic - not syncing: Fatal exception Pid: 1250, comm: r Tainted: G D --------------- 2.6.32-356.el6.i686 #1 Call Trace: [<c08476df>] ? panic+0x6e/0x122 [<c084b63c>] ? oops_end+0xbc/0xd0 [<c084b260>] ? do_general_protection+0x0/0x210 [<c084a9b7>] ? error_code+0x73/ ------------- Petr says: " I've analysed the bug and I think that xen_iret() cannot cope with mangled DS, in this case zeroed out (null selector/descriptor) by either xen_failsafe_callback() or RESTORE_REGS because the corresponding LDT entry was invalidated by the reproducer. " Jan took a look at the preliminary patch and came up a fix that solves this problem: "This code gets called after all registers other than those handled by IRET got already restored, hence a null selector in %ds or a non-null one that got loaded from a code or read-only data descriptor would cause a kernel mode fault (with the potential of crashing the kernel as a whole, if panic_on_oops is set)." The way to fix this is to realize that the we can only relay on the registers that IRET restores. The two that are guaranteed are the %cs and %ss as they are always fixed GDT selectors. Also they are inaccessible from user mode - so they cannot be altered. This is the approach taken in this patch. Another alternative option suggested by Jan would be to relay on the subtle realization that using the %ebp or %esp relative references uses the %ss segment. In which case we could switch from using %eax to %ebp and would not need the %ss over-rides. That would also require one extra instruction to compensate for the one place where the register is used as scaled index. However Andrew pointed out that is too subtle and if further work was to be done in this code-path it could escape folks attention and lead to accidents. Reviewed-by: Petr Matousek <pmatouse@redhat.com> Reported-by: Petr Matousek <pmatouse@redhat.com> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com> Signed-off-by: Jan Beulich <jbeulich@suse.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>