Skip to content

R
raspberrypi-kernel

openeuler / raspberrypi-kernel

通知 13
Star 1
Fork 0
R
raspberrypi-kernel
切换分支/标签
  1. 13 7月, 2011 9 次提交
  3. 16 6月, 2011 1 次提交
    • N
      drivers/char/hpet.c: fix periodic-emulation for delayed interrupts · 273ef950
      由 Nils Carlson 提交于 
      When interrupts are delayed due to interrupt masking or due to other
interrupts being serviced the HPET periodic-emuation would fail.  This
happened because given an interval t and a time for the current interrupt
m we would compute the next time as t + m.  This works until we are
delayed for > t, in which case we would be writing a new value which is in
fact in the past.

This can be solved by computing the next time instead as (k * t) + m where
k is large enough to be in the future.  The exact computation of k is
described in a comment to the code.

More detail:

Assuming an interval of 5 between each expected interrupt we have a normal
case of

t0: interrupt, read t0 from comparator, set next interrupt t0 + 5
t5: interrupt, read t5 from comparator, set next interrupt t5 + 5
t10: interrupt, read t10 from comparator, set next interrupt t10 + 5
...

So, what happens when the interrupt is serviced too late?

t0: interrupt, read t0 from comparator, set next interrupt t0 + 5
t11: delayed interrupt serviced, read t5 from comparator, set next
interrupt t5 + 5, which is in the past!
... counter loops ...
t10: Much much later, get the next interrupt.

This can happen either because we have interrupts masked for too long
(some stupid driver goes on a printk rampage) or just because we are
pushing the limits of the interval (too small a period), or both most
probably.

My solution is to read the main counter as well and set the next interrupt
to occur at the right interval, for example:

t0: interrupt, read t0 from comparator, set next interrupt t0 + 5
t11: delayed interrupt serviced, read t5 from comparator, set next
interrupt t15 as t10 has been missed.
t15: back on track.
Signed-off-by: NNils Carlson <nils.carlson@ericsson.com>
Cc: John Stultz <john.stultz@linaro.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      273ef950
  5. 30 5月, 2011 1 次提交
  7. 27 5月, 2011 3 次提交
  9. 26 5月, 2011 2 次提交
  11. 23 5月, 2011 1 次提交
    • P
      apm-emulation: apm_mutex breaks ACK; remove it · fda5fe19
      由 Paul Parsons 提交于 
      apm_mutex is locked by a process (e.g. apm -s) at the start of apm_ioctl() and
remains locked while pm_suspend() is called. Any subsequent process trying to
ACK the suspend (e.g. apmd) is then blocked at the start of apm_ioctl(),
causing the suspend to be delayed for 5 seconds in apm_suspend_notifier()
while the ACK times out. In short, ACKs don't work.

The driver's data structures are sufficiently protected by assorted locks. And
pm_suspend() has its own mutex to prevent reentrancy. Consequently there is no
obvious requirement for apm_mutex, which evolved from earlier BKL calls. So
let's remove it.
Signed-off-by: NPaul Parsons <lost.distance@yahoo.com>
Acked-by: NRafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      fda5fe19
  13. 22 5月, 2011 1 次提交
  15. 19 5月, 2011 1 次提交
    • G
      drivercore: revert addition of of_match to struct device · b1608d69
      由 Grant Likely 提交于 
      Commit b826291c, "drivercore/dt: add a match table pointer to struct
device" added an of_match pointer to struct device to cache the
of_match_table entry discovered at driver match time.  This was unsafe
because matching is not an atomic operation with probing a driver.  If
two or more drivers are attempted to be matched to a driver at the
same time, then the cached matching entry pointer could get
overwritten.

This patch reverts the of_match cache pointer and reworks all users to
call of_match_device() directly instead.
Signed-off-by: NGrant Likely <grant.likely@secretlab.ca>
      b1608d69
  17. 14 5月, 2011 1 次提交
  19. 07 5月, 2011 2 次提交
  21. 06 5月, 2011 1 次提交
  23. 04 5月, 2011 3 次提交
  25. 21 4月, 2011 3 次提交
    • A
      virtio: console: Enable call to hvc_remove() on console port remove · afa2689e
      由 Amit Shah 提交于 
      This call was disabled as hot-unplugging one virtconsole port led to
another virtconsole port freezing.

Upon testing it again, this now works, so enable it.

In addition, a bug was found in qemu wherein removing a port of one type
caused the guest output from another port to stop working.  I doubt it
was just this bug that caused it (since disabling the hvc_remove() call
did allow other ports to continue working), but since it's all solved
now, we're fine with hot-unplugging of virtconsole ports.
Signed-off-by: NAmit Shah <amit.shah@redhat.com>
Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
      afa2689e
    • V
      agp: fix arbitrary kernel memory writes · 194b3da8
      由 Vasiliy Kulikov 提交于 
      pg_start is copied from userspace on AGPIOC_BIND and AGPIOC_UNBIND ioctl
cmds of agp_ioctl() and passed to agpioc_bind_wrap().  As said in the
comment, (pg_start + mem->page_count) may wrap in case of AGPIOC_BIND,
and it is not checked at all in case of AGPIOC_UNBIND.  As a result, user
with sufficient privileges (usually "video" group) may generate either
local DoS or privilege escalation.
Signed-off-by: NVasiliy Kulikov <segoon@openwall.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>
      194b3da8
    • V
      agp: fix OOM and buffer overflow · b522f021
      由 Vasiliy Kulikov 提交于 
      page_count is copied from userspace.  agp_allocate_memory() tries to
check whether this number is too big, but doesn't take into account the
wrap case.  Also agp_create_user_memory() doesn't check whether
alloc_size is calculated from num_agp_pages variable without overflow.
This may lead to allocation of too small buffer with following buffer
overflow.

Another problem in agp code is not addressed in the patch - kernel memory
exhaustion (AGPIOC_RESERVE and AGPIOC_ALLOCATE ioctls).  It is not checked
whether requested pid is a pid of the caller (no check in agpioc_reserve_wrap()).
Each allocation is limited to 16KB, though, there is no per-process limit.
This might lead to OOM situation, which is not even solved in case of the
caller death by OOM killer - the memory is allocated for another (faked) process.
Signed-off-by: NVasiliy Kulikov <segoon@openwall.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>
      b522f021
  27. 20 4月, 2011 2 次提交
  29. 31 3月, 2011 1 次提交
  31. 30 3月, 2011 1 次提交
  33. 24 3月, 2011 3 次提交
  35. 17 3月, 2011 1 次提交
  37. 11 3月, 2011 1 次提交
  39. 08 3月, 2011 2 次提交