- 05 5月, 2015 11 次提交
-
-
由 Suman Anna 提交于
The L3 Error handling on OMAP5 for the most part is very similar to that of OMAP4, and had leveraged common data structures and register layout definitions so far. Upon closer inspection, there are a few minor differences causing an incorrect decoding and reporting of the master NIU upon an error: 1. The L3_TARG_STDERRLOG_MSTADDR.STDERRLOG_MSTADDR occupies 11 bits on OMAP5 as against 8 bits on OMAP4, with the master NIU connID encoded in the 6 MSBs of the STDERRLOG_MSTADDR field. 2. The CLK3 FlagMux component has 1 input source on OMAP4 and 3 input sources on OMAP5. The common DEBUGSS source is at a different input on each SoC. Fix the above issues by using a OMAP5-specific compatible property and using SoC-specific data where there are differences. Signed-off-by: NSuman Anna <s-anna@ti.com> Acked-by: NNishanth Menon <nm@ti.com> Signed-off-by: NTony Lindgren <tony@atomide.com>
-
由 Nishanth Menon 提交于
Fix a typo in DRA7 dtsi where 12 bytes are needed for register description of ABB efuse registers, however only 8 bytes are provided to map. For some weird reason, this does not generate abort at offset 0x8, probably due to default maps already provided in io.c for the bus register ranges. Reported-by: NMatt Gessner <Matt.Gessner@windriver.com> Reported-by: NSuman Anna <s-anna@ti.com> Signed-off-by: NNishanth Menon <nm@ti.com> Signed-off-by: NTony Lindgren <tony@atomide.com>
-
由 Nishanth Menon 提交于
BeagleBoard-X15 pre-production change includes switching the GPIO fan gpio over from 1 to 2 to allow for a potential fix at a later point in time for USB client VBUS detection using PMIC VBUS detect capability. Signed-off-by: NNishanth Menon <nm@ti.com> Signed-off-by: NTony Lindgren <tony@atomide.com>
-
由 Nishanth Menon 提交于
BeagleBoard-X15 pre-production change includes switching over to UART pins that now allow for UART download capability. All original boards should either have been returned for modifications or already modified for the required change and maintaining compatibility for older boards are no longer needed. Signed-off-by: NNishanth Menon <nm@ti.com> Signed-off-by: NTony Lindgren <tony@atomide.com>
-
由 Felipe Balbi 提交于
The new AM437x SK Beta boards have removed the large capacitors on the gpio-matrix column lines which means we can reduce col-scan-delay-us to 5us without loosing functionality. Signed-off-by: NFelipe Balbi <balbi@ti.com> Signed-off-by: NTony Lindgren <tony@atomide.com>
-
由 Felipe Balbi 提交于
AM437x Starter Kit uses a NewHaven Display module with a 4.3" display and EDT FT5306 touchscreen On that module's new revision, NewHave decided to change the pinout on the 6 pin flat-pcb touchscreen connector so that instead of having WAKE pin, we now have RESETn. The new display module is available on AM437x SK Beta and all new revisions while the older revision is only available on AM437x SK Alpha which, unfortunately, can't be supported anymore in mainline without a revert of this patch. Signed-off-by: NFelipe Balbi <balbi@ti.com> Signed-off-by: NTony Lindgren <tony@atomide.com>
-
由 Nishanth Menon 提交于
With commit bc078316 ("ARM: dts: DRA7: Add node for RTC"), we now have AM57xx RTC register itself as alias 0 even before DS1307 or TPS rtc drivers are loaded up. However, since neither TPS, nor AM57xx RTC are capable of being backedup by battery, we would like to maintain the "primary" rtc as mcp79410 rtc device. This also generates the following warnings in the bootlog highlighting the issue: [ 5.895445] rtc-ds1307 2-006f: /aliases ID 0 not available ... [ 6.476285] palmas-rtc 48070000.i2c:tps659038@58:tps659038_rtc: /aliases ID 1 not available So, add proper aliases to ensure that RTC order is always consistent to userspace immaterial of probe order. Signed-off-by: NNishanth Menon <nm@ti.com> Signed-off-by: NTony Lindgren <tony@atomide.com>
-
由 Grygorii Strashko 提交于
The interrupt polarity provided in devicetree is used to configure the interrupt controller(ARM GIC), however, it seems that we have an inverter at the GIC boundary inside AM57xx which inverts the signal input from sys_irq external interrupt source. Further, as per GIC distributor TRM, http://infocenter.arm.com/help/topic/com.arm.doc.ddi0438d/BGBHIACJ.html#BABJFCFB ARM GIC distributor does not support IRQ trigger type IRQ_TYPE_LEVEL_LOW, and only rising or level high signals. However, for some reason, the current configuration(which gets ignored by GIC driver) functions on some platforms, however, on few platforms results in infinite interrupts hogging the system down. Switch over to rising edge for GIC configuration which is also aligned with trigger point from the RTC chip and the internal inversion. Fixes: 5a0f93c6 ("ARM: dts: Add am57xx-beagle-x15") Signed-off-by: NGrygorii Strashko <Grygorii.Strashko@linaro.org> Signed-off-by: NNishanth Menon <nm@ti.com> Signed-off-by: NTony Lindgren <tony@atomide.com>
-
由 Sebastian Reichel 提交于
Add missing #iommu-cells property to the isp and iva iommu nodes. This fixes the binding (property is required according to the generic iommu binding) and removes the following kernel warning triggered once the iommu nodes are referenced: [ 0.647521] /ocp/isp@480bc000: could not get #iommu-cells for /ocp/mmu@480bd400 Signed-off-by: NSebastian Reichel <sre@kernel.org> Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Acked-by: NSakari Ailus <sakari.ailus@iki.fi> Signed-off-by: NTony Lindgren <tony@atomide.com>
-
由 Roger Quadros 提交于
We need to enable EXTCON_USB_GPIO_USB and not EXTCON_GPIO_USB. Fixes: c08a54c0 ("ARM: omap2plus_defconfig: Enable EXTCON_GPIO_USB") Reported-by: NNishant Menon <nm@ti.com> Signed-off-by: NRoger Quadros <rogerq@ti.com> Acked-by-by: Nishanth Menon <nm@ti.com Tested-by: Nishanth Menon <nm@ti.com Reviewed-by: NFelipe Balbi <balbi@ti.com> Acked-by: NFelipe Balbi <balbi@ti.com> Signed-off-by: NTony Lindgren <tony@atomide.com>
-
由 Pavel Machek 提交于
N900 audio recording needs that codec provides bias voltage for integrated digital microphone and headset microphone depending which one is used. Digital microphone uses 2 V bias and it comes from the codec A part. Codec B part drives the headset microphone bias and that is set to 2.5 V. Cc: stable@vger.kernel.org # v3.16+ Signed-off-by: NPavel Machek <pavel@ucw.cz> [Jarkko: Headset mic bias changed to 2 (2.5 V) as it was before commit e2e8bfdf ("ASoC: tlv320aic3x: Convert mic bias to a supply widget")] Signed-off-by: NJarkko Nikula <jarkko.nikula@bitmer.com> Signed-off-by: NTony Lindgren <tony@atomide.com>
-
- 04 5月, 2015 1 次提交
-
-
由 Tony Lindgren 提交于
If we use a combination of VMODE and I2C4 for retention modes, eventually the off idle power consumption will creep up by about 23mW, even during off mode with I2C4 always staying enabled. Turns out this is because of erratum i531 "Extra Power Consumed When Repeated Start Operation Mode Is Enabled on I2C Interface Dedicated for Smart Reflex (I2C4)" as pointed out by Nishanth Menon <nm@ti.com>. Let's fix the issue by adding i2c_cfg_clear_mask for the bits to clear when initializing the I2C4 adapter so we can clear SREN bit that drives the I2C4 lines low otherwise when there is no traffic. Fixes: 3b8c4ebb ("ARM: OMAP3: Fix idle mode signaling for Cc: stable@vger.kernel.org # v3.16+ sys_clkreq and sys_off_mode") Cc: Kevin Hilman <khilman@kernel.org> Cc: Tero Kristo <t-kristo@ti.com> Reviewed-by: NNishanth Menon <nm@ti.com> Signed-off-by: NTony Lindgren <tony@atomide.com>
-
- 01 5月, 2015 3 次提交
-
-
由 Robert Jarzmik 提交于
As the interrupt handling was transferred to the pxa_cplds driver, make the switch in lubbock platform code. Fixes: 157d2644 ("ARM: pxa: change gpio to platform device") Signed-off-by: NRobert Jarzmik <robert.jarzmik@free.fr> Acked-by: NArnd Bergmann <arnd@arndb.de>
-
由 Robert Jarzmik 提交于
As the interrupt handling was transferred to the pxa_cplds driver, make the switch in mainstone platform code. Fixes: 157d2644 ("ARM: pxa: change gpio to platform device") Signed-off-by: NRobert Jarzmik <robert.jarzmik@free.fr> Acked-by: NArnd Bergmann <arnd@arndb.de>
-
由 Robert Jarzmik 提交于
Historically, this support was in arch/arm/mach-pxa/lubbock.c and arch/arm/mach-pxa/mainstone.c. When gpio-pxa was moved to drivers/pxa, it became a driver, and its initialization and probing happened at postcore initcall. The lubbock code used to install the chained lubbock interrupt handler at init_irq() time. The consequence of the gpio-pxa change is that the installed chained irq handler lubbock_irq_handler() was overwritten in pxa_gpio_probe(_dt)(), removing : - the handler - the falling edge detection setting of GPIO0, which revealed the interrupt request from the lubbock IO board. As a fix, move the gpio0 chained handler setup to a place where we have the guarantee that pxa_gpio_probe() was called before, so that lubbock handler becomes the true IRQ chained handler of GPIO0, demuxing the lubbock IO board interrupts. This patch moves all that handling to a mfd driver. It's only purpose for the time being is the interrupt handling, but in the future it should encompass all the motherboard CPLDs handling : - leds - switches - hexleds The same logic applies to mainstone board. Fixes: 157d2644 ("ARM: pxa: change gpio to platform device") Signed-off-by: NRobert Jarzmik <robert.jarzmik@free.fr> Acked-by: NArnd Bergmann <arnd@arndb.de>
-
- 28 4月, 2015 1 次提交
-
-
由 Shawn Guo 提交于
The pinctrl-assert-gpios is an invalid pinctrl property. It was probably sneaked from vendor tree. Remove it. Fixes: 4e18a224 ("ARM: imx6qdl-sabreauto.dtsi: add max7310 support") Signed-off-by: NShawn Guo <shawn.guo@linaro.org>
-
- 27 4月, 2015 7 次提交
-
-
由 Marek Vasut 提交于
Fix a typo in the TX DMA interrupt name for AUART4. This patch makes AUART4 operational again. Signed-off-by: NMarek Vasut <marex@denx.de> Fixes: f30fb03d ("ARM: dts: add generic DMA device tree binding for mxs-dma") Cc: stable@vger.kernel.org Acked-by: NStefan Wahren <stefan.wahren@i2se.com> Signed-off-by: NShawn Guo <shawn.guo@linaro.org>
-
由 Markus Pargmann 提交于
The property '#pwm-cells' is currently missing. It is not possible to use pwm4 without this property. Signed-off-by: NMarkus Pargmann <mpa@pengutronix.de> Fixes: 5658a68f ("ARM i.MX25: Add devicetree") Cc: <stable@vger.kernel.org> Reviewed-by: NFabio Estevam <fabio.estevam@freescale.com> Signed-off-by: NShawn Guo <shawn.guo@linaro.org>
-
由 Philipp Zabel 提交于
The fixed-regulator bindings require a separate property enable-active-high, the standard gpio phandle property polarity setting is ignored. Signed-off-by: NPhilipp Zabel <p.zabel@pengutronix.de> Fixes: 4fe69a93 ("ARM: dts: Add Phytec pfla02 with i.MX6 DualLite/Solo") Cc: stable@vger.kernel.org Signed-off-by: NShawn Guo <shawn.guo@linaro.org>
-
由 Wolfram Sang 提交于
My Pengutronix address is not valid anymore, redirect people to the Pengutronix kernel team. Reported-by: NHarald Geyer <harald@ccbib.org> Signed-off-by: NWolfram Sang <wsa@the-dreams.de> Acked-by: NRobert Schwebel <r.schwebel@pengutronix.de> Signed-off-by: NShawn Guo <shawn.guo@linaro.org>
-
由 Stefan Wahren 提交于
The dr_mode of usb0 on imx233-olinuxino is left to default "otg". Since the green LED (GPIO2_1) on imx233-olinuxino is connected to the same pin as USB_OTG_ID it's possible to disable USB host by LED toggling: echo 0 > /sys/class/leds/green/brightness [ 1068.890000] ci_hdrc ci_hdrc.0: remove, state 1 [ 1068.890000] usb usb1: USB disconnect, device number 1 [ 1068.920000] usb 1-1: USB disconnect, device number 2 [ 1068.920000] usb 1-1.1: USB disconnect, device number 3 [ 1069.070000] usb 1-1.2: USB disconnect, device number 4 [ 1069.450000] ci_hdrc ci_hdrc.0: USB bus 1 deregistered [ 1074.460000] ci_hdrc ci_hdrc.0: timeout waiting for 00000800 in 11 This patch fixes the issue by setting dr_mode to "host" in the dts file. Reported-by: NHarald Geyer <harald@ccbib.org> Signed-off-by: NStefan Wahren <stefan.wahren@i2se.com> Reviewed-by: NFabio Estevam <fabio.estevam@freescale.com> Reviewed-by: NMarek Vasut <marex@denx.de> Acked-by: NPeter Chen <peter.chen@freescale.com> Fixes: b4931294 ("ARM: dts: imx23-olinuxino: Add USB host support") Cc: stable@vger.kernel.org Signed-off-by: NShawn Guo <shawn.guo@linaro.org>
-
由 Fabio Estevam 提交于
On imx23-olinuxino the LED turns on when level logic high is aplied to GPIO2_1. Fix the gpios property accordingly. Fixes: b34aa185 ("ARM: dts: imx23-olinuxino: Remove unneeded "default-on"") Reported-by: NStefan Wahren <stefan.wahren@i2se.com> Signed-off-by: NFabio Estevam <fabio.estevam@freescale.com> Tested-by: NStefan Wahren <stefan.wahren@i2se.com> Cc: stable@vger.kernel.org Signed-off-by: NShawn Guo <shawn.guo@linaro.org>
-
由 Gregory CLEMENT 提交于
There is no crystal connected to the internal RTC on the Open Block AX3. So let's disable it in order to prevent the kernel probing the driver uselessly. Eventually this patches removes the following warning message from the boot log: "rtc-mv d0010300.rtc: internal RTC not ticking" Acked-by: NAndrew Lunn <andrew@lunn.ch> Signed-off-by: NGregory CLEMENT <gregory.clement@free-electrons.com> Cc: <stable@vger.kernel.org> # v3.8 +
-
- 22 4月, 2015 2 次提交
-
-
由 Andre Przywara 提交于
When userland injects a SPI via the KVM_IRQ_LINE ioctl we currently only check it against a fixed limit, which historically is set to 127. With the new dynamic IRQ allocation the effective limit may actually be smaller (64). So when now a malicious or buggy userland injects a SPI in that range, we spill over on our VGIC bitmaps and bytemaps memory. I could trigger a host kernel NULL pointer dereference with current mainline by injecting some bogus IRQ number from a hacked kvmtool: ----------------- .... DEBUG: kvm_vgic_inject_irq(kvm, cpu=0, irq=114, level=1) DEBUG: vgic_update_irq_pending(kvm, cpu=0, irq=114, level=1) DEBUG: IRQ #114 still in the game, writing to bytemap now... Unable to handle kernel NULL pointer dereference at virtual address 00000000 pgd = ffffffc07652e000 [00000000] *pgd=00000000f658b003, *pud=00000000f658b003, *pmd=0000000000000000 Internal error: Oops: 96000006 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 1053 Comm: lkvm-msi-irqinj Not tainted 4.0.0-rc7+ #3027 Hardware name: FVP Base (DT) task: ffffffc0774e9680 ti: ffffffc0765a8000 task.ti: ffffffc0765a8000 PC is at kvm_vgic_inject_irq+0x234/0x310 LR is at kvm_vgic_inject_irq+0x30c/0x310 pc : [<ffffffc0000ae0a8>] lr : [<ffffffc0000ae180>] pstate: 80000145 ..... So this patch fixes this by checking the SPI number against the actual limit. Also we remove the former legacy hard limit of 127 in the ioctl code. Signed-off-by: NAndre Przywara <andre.przywara@arm.com> Reviewed-by: NChristoffer Dall <christoffer.dall@linaro.org> CC: <stable@vger.kernel.org> # 4.0, 3.19, 3.18 [maz: wrap KVM_ARM_IRQ_GIC_MAX with #ifndef __KERNEL__, as suggested by Christopher Covington] Signed-off-by: NMarc Zyngier <marc.zyngier@arm.com>
-
由 Mathieu Olivari 提交于
Add the watchdog related entries to the Krait Processor Sub-system (KPSS) timer IPQ8064 devicetree section. Also, add a fixed-clock description of SLEEP_CLK, which will do for now. Signed-off-by: NJosh Cartwright <joshc@codeaurora.org> Signed-off-by: NMathieu Olivari <mathieu@codeaurora.org> Reviewed-by: NStephen Boyd <sboyd@codeaurora.org> Acked-by: NGuenter Roeck <linux@roeck-us.net> Signed-off-by: NWim Van Sebroeck <wim@iguana.be>
-
- 21 4月, 2015 4 次提交
-
-
由 Nathan Lynch 提交于
When CONFIG_VDSO=n, the build normally does not enter arch/arm/vdso/ because arch/arm/Makefile does not add it to core-y. However, if the user runs 'make arch/arm/vdso/' the VDSO targets will get visited. This is because the VDSO Makefile itself does not consider the value of CONFIG_VDSO. It is arguably better and more consistent behavior to generate an empty built-in.o when CONFIG_VDSO=n and the user attempts to build arch/arm/vdso/. It's nicer because it doesn't try to build things that Kconfig dependencies are there to prevent (e.g. the dependency on AEABI), and it's less confusing than building objects that won't be used in the final image. Signed-off-by: NNathan Lynch <nathan_lynch@mentor.com> Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>
-
由 Nathan Lynch 提交于
vdsomunge and vdso.so.raw are outputs that don't get matched by the normal ignore rules. Signed-off-by: NNathan Lynch <nathan_lynch@mentor.com> Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>
-
由 Russell King 提交于
Commit bf35706f ("ARM: 8314/1: replace PROCINFO embedded branch with relative offset") broke booting on nommu platforms as it didn't update the nommu boot code. This patch fixes that oversight. Fixes: bf35706f ("ARM: 8314/1: replace PROCINFO embedded branch with relative offset") Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>
-
由 Tony Lindgren 提交于
With the recent changes omaps have developed a dependency to MFD_SYSCON. This is used for system control module generic register area and some clocks. We do have it selected in omap2plus_defconfig, but targeted config files may not have it selected. Let's make sure it's selected like few other ARM platforms are already doing. Reported-by: NRussell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: NTony Lindgren <tony@atomide.com>
-
- 18 4月, 2015 1 次提交
-
-
由 Nathan Lynch 提交于
When targeting ARMv3 (e.g. rpc) and enabling CONFIG_VDSO we get: arch/arm/vdso/datapage.S:13: Error: selected processor does not support ARM mode `bx lr' One fix considered was to use 'ldr pc,lr' for such configurations, but since the VDSO is unlikely to be useful for pre-v7 hardware, just make it depend on CONFIG_CPU_V7. Reported-by: NArnd Bergmann <arnd@arndb.de> Signed-off-by: NNathan Lynch <nathan_lynch@mentor.com> Acked-by: NArnd Bergmann <arnd@arndb.de> Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>
-
- 17 4月, 2015 4 次提交
-
-
由 Kees Cook 提交于
Switch to using the newly created asm-generic/seccomp.h for the seccomp strict mode syscall definitions. Definitions were identical. Signed-off-by: NKees Cook <keescook@chromium.org> Cc: Russell King <linux@arm.linux.org.uk> Cc: Laura Abbott <lauraa@codeaurora.org> Signed-off-by: NAndrew Morton <akpm@linux-foundation.org> Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
-
由 Heiko Stuebner 提交于
timer7 supplies the architected timer and thus as has to run when the system clocksource and clockevents drivers are registered. While it should be the responsibility of the bootloader to do this, and there exists a fix in a community u-boot, all u-boot based systems that actually shipped have the mentioned issue. Therefore to not require every developer to update their u-boot, add a snippet for this, enabling the timer early in the kernel. Signed-off-by: NHeiko Stuebner <heiko@sntech.de>
-
由 Chris Zhong 提交于
Sometimes the debug module may not work well after resume, since it has not been correctly reset when wakeup from suspend. That cause system crash during reusme, and a 'undefined instruction' is displayed on the console. Set the GRF_FORCE_JTAG bit of RK3288_GRF_SOC_CON0 can ensure that debug modul is reset. And we can change the value of RK3288_GRF_SOC_CON0 back when system resume. Signed-off-by: NChris Zhong <zyw@rock-chips.com> Tested-by: NCaesar Wang <wxt@rock-chips.com> Reviewed-by: NDouglas Anderson <dianders@chromium.org> According to discussions, there does not seem a better solution available. Please also see the potential security implication described in the comment inline in the code. Signed-off-by: NHeiko Stuebner <heiko@sntech.de>
-
由 Chris Zhong 提交于
Reset dapswjdp is controlled by JTAG_TRSTN, if the iomux of this pin is not "jtag_trstn". the AP would think this pin is always high, so it can not reset before resume. When system resume, but the dapswjdp is not in a default state, it may Access some illegal address, it cause system crash during resume. Let's disable this jtag function by clear the dapdeviceen bit, it prohibit the dapswjdp to access memory and registers. This bit would be enable in MASKROM, so we need clear it in suspend everytime. Signed-off-by: NChris Zhong <zyw@rock-chips.com> Reviewed-by: NDoug Anderson <dianders@chromium.org> Signed-off-by: NHeiko Stuebner <heiko@sntech.de>
-
- 16 4月, 2015 1 次提交
-
-
由 Joe Perches 提交于
The seq_printf return value, because it's frequently misused, (as it is here, it doesn't return # of chars emitted) will eventually be converted to void. See: commit 1f33c41c ("seq_file: Rename seq_overflow() to seq_has_overflowed() and make public") Signed-off-by: NJoe Perches <joe@perches.com> Cc: Russell King <linux@arm.linux.org.uk> Signed-off-by: NAndrew Morton <akpm@linux-foundation.org> Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
-
- 15 4月, 2015 5 次提交
-
-
由 Vladimir Murzin 提交于
Add support for memtest command line option. Signed-off-by: NVladimir Murzin <vladimir.murzin@arm.com> Acked-by: NWill Deacon <will.deacon@arm.com> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Ingo Molnar <mingo@elte.hu> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Russell King <rmk@arm.linux.org.uk> Cc: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: NAndrew Morton <akpm@linux-foundation.org> Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
-
由 Kees Cook 提交于
The arch_randomize_brk() function is used on several architectures, even those that don't support ET_DYN ASLR. To avoid bulky extern/#define tricks, consolidate the support under CONFIG_ARCH_HAS_ELF_RANDOMIZE for the architectures that support it, while still handling CONFIG_COMPAT_BRK. Signed-off-by: NKees Cook <keescook@chromium.org> Cc: Hector Marco-Gisbert <hecmargi@upv.es> Cc: Russell King <linux@arm.linux.org.uk> Reviewed-by: NIngo Molnar <mingo@kernel.org> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Will Deacon <will.deacon@arm.com> Cc: Ralf Baechle <ralf@linux-mips.org> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Paul Mackerras <paulus@samba.org> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Cc: Heiko Carstens <heiko.carstens@de.ibm.com> Cc: Alexander Viro <viro@zeniv.linux.org.uk> Cc: Oleg Nesterov <oleg@redhat.com> Cc: Andy Lutomirski <luto@amacapital.net> Cc: "David A. Long" <dave.long@linaro.org> Cc: Andrey Ryabinin <a.ryabinin@samsung.com> Cc: Arun Chandran <achandran@mvista.com> Cc: Yann Droneaud <ydroneaud@opteya.com> Cc: Min-Hua Chen <orca.chen@gmail.com> Cc: Paul Burton <paul.burton@imgtec.com> Cc: Alex Smith <alex@alex-smith.me.uk> Cc: Markos Chandras <markos.chandras@imgtec.com> Cc: Vineeth Vijayan <vvijayan@mvista.com> Cc: Jeff Bailey <jeffbailey@google.com> Cc: Michael Holzheu <holzheu@linux.vnet.ibm.com> Cc: Ben Hutchings <ben@decadent.org.uk> Cc: Behan Webster <behanw@converseincode.com> Cc: Ismael Ripoll <iripoll@upv.es> Cc: Jan-Simon Mller <dl9pf@gmx.de> Signed-off-by: NAndrew Morton <akpm@linux-foundation.org> Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
-
由 Kees Cook 提交于
This fixes the "offset2lib" weakness in ASLR for arm, arm64, mips, powerpc, and x86. The problem is that if there is a leak of ASLR from the executable (ET_DYN), it means a leak of shared library offset as well (mmap), and vice versa. Further details and a PoC of this attack is available here: http://cybersecurity.upv.es/attacks/offset2lib/offset2lib.html With this patch, a PIE linked executable (ET_DYN) has its own ASLR region: $ ./show_mmaps_pie 54859ccd6000-54859ccd7000 r-xp ... /tmp/show_mmaps_pie 54859ced6000-54859ced7000 r--p ... /tmp/show_mmaps_pie 54859ced7000-54859ced8000 rw-p ... /tmp/show_mmaps_pie 7f75be764000-7f75be91f000 r-xp ... /lib/x86_64-linux-gnu/libc.so.6 7f75be91f000-7f75beb1f000 ---p ... /lib/x86_64-linux-gnu/libc.so.6 7f75beb1f000-7f75beb23000 r--p ... /lib/x86_64-linux-gnu/libc.so.6 7f75beb23000-7f75beb25000 rw-p ... /lib/x86_64-linux-gnu/libc.so.6 7f75beb25000-7f75beb2a000 rw-p ... 7f75beb2a000-7f75beb4d000 r-xp ... /lib64/ld-linux-x86-64.so.2 7f75bed45000-7f75bed46000 rw-p ... 7f75bed46000-7f75bed47000 r-xp ... 7f75bed47000-7f75bed4c000 rw-p ... 7f75bed4c000-7f75bed4d000 r--p ... /lib64/ld-linux-x86-64.so.2 7f75bed4d000-7f75bed4e000 rw-p ... /lib64/ld-linux-x86-64.so.2 7f75bed4e000-7f75bed4f000 rw-p ... 7fffb3741000-7fffb3762000 rw-p ... [stack] 7fffb377b000-7fffb377d000 r--p ... [vvar] 7fffb377d000-7fffb377f000 r-xp ... [vdso] The change is to add a call the newly created arch_mmap_rnd() into the ELF loader for handling ET_DYN ASLR in a separate region from mmap ASLR, as was already done on s390. Removes CONFIG_BINFMT_ELF_RANDOMIZE_PIE, which is no longer needed. Signed-off-by: NKees Cook <keescook@chromium.org> Reported-by: NHector Marco-Gisbert <hecmargi@upv.es> Cc: Russell King <linux@arm.linux.org.uk> Reviewed-by: NIngo Molnar <mingo@kernel.org> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Will Deacon <will.deacon@arm.com> Cc: Ralf Baechle <ralf@linux-mips.org> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Paul Mackerras <paulus@samba.org> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Cc: Heiko Carstens <heiko.carstens@de.ibm.com> Cc: Alexander Viro <viro@zeniv.linux.org.uk> Cc: Oleg Nesterov <oleg@redhat.com> Cc: Andy Lutomirski <luto@amacapital.net> Cc: "David A. Long" <dave.long@linaro.org> Cc: Andrey Ryabinin <a.ryabinin@samsung.com> Cc: Arun Chandran <achandran@mvista.com> Cc: Yann Droneaud <ydroneaud@opteya.com> Cc: Min-Hua Chen <orca.chen@gmail.com> Cc: Paul Burton <paul.burton@imgtec.com> Cc: Alex Smith <alex@alex-smith.me.uk> Cc: Markos Chandras <markos.chandras@imgtec.com> Cc: Vineeth Vijayan <vvijayan@mvista.com> Cc: Jeff Bailey <jeffbailey@google.com> Cc: Michael Holzheu <holzheu@linux.vnet.ibm.com> Cc: Ben Hutchings <ben@decadent.org.uk> Cc: Behan Webster <behanw@converseincode.com> Cc: Ismael Ripoll <iripoll@upv.es> Cc: Jan-Simon Mller <dl9pf@gmx.de> Signed-off-by: NAndrew Morton <akpm@linux-foundation.org> Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
-
由 Kees Cook 提交于
When an architecture fully supports randomizing the ELF load location, a per-arch mmap_rnd() function is used to find a randomized mmap base. In preparation for randomizing the location of ET_DYN binaries separately from mmap, this renames and exports these functions as arch_mmap_rnd(). Additionally introduces CONFIG_ARCH_HAS_ELF_RANDOMIZE for describing this feature on architectures that support it (which is a superset of ARCH_BINFMT_ELF_RANDOMIZE_PIE, since s390 already supports a separated ET_DYN ASLR from mmap ASLR without the ARCH_BINFMT_ELF_RANDOMIZE_PIE logic). Signed-off-by: NKees Cook <keescook@chromium.org> Cc: Hector Marco-Gisbert <hecmargi@upv.es> Cc: Russell King <linux@arm.linux.org.uk> Reviewed-by: NIngo Molnar <mingo@kernel.org> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Will Deacon <will.deacon@arm.com> Cc: Ralf Baechle <ralf@linux-mips.org> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Paul Mackerras <paulus@samba.org> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Cc: Heiko Carstens <heiko.carstens@de.ibm.com> Cc: Alexander Viro <viro@zeniv.linux.org.uk> Cc: Oleg Nesterov <oleg@redhat.com> Cc: Andy Lutomirski <luto@amacapital.net> Cc: "David A. Long" <dave.long@linaro.org> Cc: Andrey Ryabinin <a.ryabinin@samsung.com> Cc: Arun Chandran <achandran@mvista.com> Cc: Yann Droneaud <ydroneaud@opteya.com> Cc: Min-Hua Chen <orca.chen@gmail.com> Cc: Paul Burton <paul.burton@imgtec.com> Cc: Alex Smith <alex@alex-smith.me.uk> Cc: Markos Chandras <markos.chandras@imgtec.com> Cc: Vineeth Vijayan <vvijayan@mvista.com> Cc: Jeff Bailey <jeffbailey@google.com> Cc: Michael Holzheu <holzheu@linux.vnet.ibm.com> Cc: Ben Hutchings <ben@decadent.org.uk> Cc: Behan Webster <behanw@converseincode.com> Cc: Ismael Ripoll <iripoll@upv.es> Cc: Jan-Simon Mller <dl9pf@gmx.de> Signed-off-by: NAndrew Morton <akpm@linux-foundation.org> Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
-
由 Kees Cook 提交于
To address the "offset2lib" ASLR weakness[1], this separates ET_DYN ASLR from mmap ASLR, as already done on s390. The architectures that are already randomizing mmap (arm, arm64, mips, powerpc, s390, and x86), have their various forms of arch_mmap_rnd() made available via the new CONFIG_ARCH_HAS_ELF_RANDOMIZE. For these architectures, arch_randomize_brk() is collapsed as well. This is an alternative to the solutions in: https://lkml.org/lkml/2015/2/23/442 I've been able to test x86 and arm, and the buildbot (so far) seems happy with building the rest. [1] http://cybersecurity.upv.es/attacks/offset2lib/offset2lib.html This patch (of 10): In preparation for splitting out ET_DYN ASLR, this moves the ASLR calculations for mmap on ARM into a separate routine, similar to x86. This also removes the redundant check of personality (PF_RANDOMIZE is already set before calling arch_pick_mmap_layout). Signed-off-by: NKees Cook <keescook@chromium.org> Cc: Hector Marco-Gisbert <hecmargi@upv.es> Cc: Russell King <linux@arm.linux.org.uk> Reviewed-by: NIngo Molnar <mingo@kernel.org> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Will Deacon <will.deacon@arm.com> Cc: Ralf Baechle <ralf@linux-mips.org> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Paul Mackerras <paulus@samba.org> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Cc: Heiko Carstens <heiko.carstens@de.ibm.com> Cc: Alexander Viro <viro@zeniv.linux.org.uk> Cc: Oleg Nesterov <oleg@redhat.com> Cc: Andy Lutomirski <luto@amacapital.net> Cc: "David A. Long" <dave.long@linaro.org> Cc: Andrey Ryabinin <a.ryabinin@samsung.com> Cc: Arun Chandran <achandran@mvista.com> Cc: Yann Droneaud <ydroneaud@opteya.com> Cc: Min-Hua Chen <orca.chen@gmail.com> Cc: Paul Burton <paul.burton@imgtec.com> Cc: Alex Smith <alex@alex-smith.me.uk> Cc: Markos Chandras <markos.chandras@imgtec.com> Cc: Vineeth Vijayan <vvijayan@mvista.com> Cc: Jeff Bailey <jeffbailey@google.com> Cc: Michael Holzheu <holzheu@linux.vnet.ibm.com> Cc: Ben Hutchings <ben@decadent.org.uk> Cc: Behan Webster <behanw@converseincode.com> Cc: Ismael Ripoll <iripoll@upv.es> Cc: Jan-Simon Mller <dl9pf@gmx.de> Signed-off-by: NAndrew Morton <akpm@linux-foundation.org> Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
-