Commit Graph

119397 Commits

Author SHA1 Message Date
Nicolas Pitre b5ee900258 [ARM] remove a common set of __virt_to_bus definitions
Let's provide an overridable default instead of having every machine
class define __virt_to_bus and __bus_to_virt to the same thing.  What
most platforms are using is bus_addr == phys_addr so such is the default.

One exception is ebsa110 which has no DMA what so ever, so the actual
definition is not important except only for proper compilation.  Also
added a comment about the special footbridge bus translation.

Let's also remove comments alluding to set_dma_addr which is not
(and should not) be commonly used.

Signed-off-by: Nicolas Pitre <nico@marvell.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2008-11-28 15:36:49 +00:00
Nicolas Pitre 75f4aa15cf [ARM] unconditionally define __virt_to_phys and __phys_to_virt
There is no machine class overriding this.  If non linear translations
are implemented again for some machines then this could be restored at
that time.

Signed-off-by: Nicolas Pitre <nico@marvell.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2008-11-28 15:36:48 +00:00
Nicolas Pitre 252d4c276d [ARM] remove bogus #ifdef CONFIG_HIGHMEM in show_pte()
The restriction on !CONFIG_HIGHMEM is unneeded since page tables are
currently never allocated with highmem pages, and actually disable PTE
dump whenever highmem is configured.  Let's have a dynamic test to better
describe the current limitation instead.

Signed-off-by: Nicolas Pitre <nico@marvell.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2008-11-28 15:36:47 +00:00
Nicolas Pitre 9210807cb5 [ARM] prevent the vmalloc cmdline argument from eating all memory
Commit 8d5796d2ec allows for the vmalloc
area to be resized from the kernel cmdline.  Make sure it cannot overlap
with RAM entirely.

Signed-off-by: Nicolas Pitre <nico@marvell.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2008-11-28 15:36:47 +00:00
Nicolas Pitre 6db015e49c [ARM] mem_init() cleanups
Make free_area() arguments pfn based, and return number of freed pages.
This will simplify highmem initialization later.

Also, codepages, datapages and initpages are actually codesize, datasize
and initsize.

Signed-off-by: Nicolas Pitre <nico@marvell.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2008-11-28 15:36:46 +00:00
Nicolas Pitre a1bbaec0cd [ARM] split highmem into its own memory bank
Doing so will greatly simplify the bootmem initialization code as each
bank is therefore entirely lowmem or highmem with no crossing between
those zones.

Signed-off-by: Nicolas Pitre <nico@marvell.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2008-11-28 15:36:45 +00:00
Nicolas Pitre 4b5f32cee0 [ARM] rationalize memory configuration code some more
Currently there are two instances of struct meminfo: one in
kernel/setup.c marked __initdata, and another in mm/init.c with
permanent storage.  Let's keep only the later to directly populate
the permanent version from arm_add_memory().

Also move common validation tests between the MMU and non-MMU cases
into arm_add_memory() to remove some duplication.  Protection against
overflowing the membank array is also moved in there in order to cover
the kernel cmdline parsing path as well.

Signed-off-by: Nicolas Pitre <nico@marvell.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2008-11-28 15:36:44 +00:00
Nicolas Pitre 43ae286b7d [ARM] fix a couple clear_user_highpage assembly constraints
In all cases the kaddr is assigned an input register even though it is
modified in the assembly code.  Let's assign a new variable to the
modified value and mark those inline asm with volatile otherwise they
get optimized away because the output variable is otherwise not used.

Also fix a few conversion errors in copypage-feroceon.c and
copypage-v4mc.c.

Signed-off-by: Nicolas Pitre <nico@marvell.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2008-11-28 15:36:43 +00:00
Russell King 303c644365 [ARM] clearpage: provide our own clear_user_highpage()
For similar reasons as copy_user_page(), we want to avoid the
additional kmap_atomic if it's unnecessary.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2008-11-27 23:53:48 +00:00
Russell King 063b0a4207 [ARM] copypage: provide our own copy_user_highpage()
We used to override the copy_user_page() function.  However, this
is not only inefficient, it also causes additional complexity for
highmem support, since we convert from a struct page to a kernel
direct mapped address and back to a struct page again.

Moreover, with highmem support, we end up pointlessly setting up
kmap entries for pages which we're going to remap.  So, push the
kmapping down into the copypage implementation files where it's
required.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2008-11-27 23:53:47 +00:00
Russell King d73e60b714 [ARM] copypage: convert assembly files to C
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2008-11-27 23:53:46 +00:00
Russell King 487ff32082 Allow architectures to override copy_user_highpage()
With aliasing VIPT cache support, the ARM implementation of
clear_user_page() and copy_user_page() sets up a temporary kernel space
mapping such that we have the same cache colour as the userspace page.
This avoids having to consider any userspace aliases from this operation.

However, when highmem is enabled, kmap_atomic() have to setup mappings.
The copy_user_highpage() and clear_user_highpage() call these functions
before delegating the copies to copy_user_page() and clear_user_page().

The effect of this is that each of the *_user_highpage() functions setup
their own kmap mapping, followed by the *_user_page() functions setting
up another mapping.  This is rather wasteful.

Thankfully, copy_user_highpage() can be overriden by architectures by
defining __HAVE_ARCH_COPY_USER_HIGHPAGE.  However, replacement of
clear_user_highpage() is more difficult because its inline definition
is not conditional.  It seems that you're expected to define
__HAVE_ARCH_ALLOC_ZEROED_USER_HIGHPAGE and provide a replacement
__alloc_zeroed_user_highpage() implementation instead.

The allocation itself is fine, so we don't want to override that.  What
we really want to do is to override clear_user_highpage() with our own
version which doesn't kmap_atomic() unnecessarily.

Other VIPT architectures (PARISC and SH) would also like to override
this function as well.

Acked-by: Hugh Dickins <hugh@veritas.com>
Acked-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Acked-by: Paul Mundt <lethal@linux-sh.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2008-11-27 23:39:48 +00:00
Russell King f412b09f4e Merge branch 'for-rmk' of git://linux-arm.org/linux-2.6 into devel 2008-11-27 12:42:48 +00:00
Russell King 31bccbf392 Merge branch 'clps7500' into devel
Conflicts:

	arch/arm/Kconfig
2008-11-27 12:39:43 +00:00
Russell King e902be56cb Merge branches 'core' and 'clks' into devel 2008-11-27 12:39:14 +00:00
Russell King 5e1dbdb458 [ARM] sa1100: match clock by dev_name(dev)
Continuing the move away from implementations which give an excuse
for other bad implementations, convert SA1100 to lookup its singular
clock by dev_name(dev) rather than by id.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2008-11-27 12:38:24 +00:00
Russell King e0d8b13ae1 [ARM] pxa: don't pass a consumer clock name for devices with unique clocks
Where devices only have one consumer, passing a consumer clock ID
has no real benefit.  Remove it.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2008-11-27 12:38:23 +00:00
Russell King 8c3abc7d90 [ARM] pxa: convert to clkdev and match clocks by struct device where possible
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2008-11-27 12:38:23 +00:00
Russell King 71a06da08c [ARM] versatile: convert to clkdev and lookup clocks by device name
People often point to the Integrator/Versatile/Realview
implementations to justify using the consumer name as the sole
selector for clocks.

Eliminate this excuse by changing the Versatile implementation, so
it provides a better example of how it should be done.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2008-11-27 12:38:22 +00:00
Russell King d72fbdf01f [ARM] integrator: convert to clkdev and lookup clocks by device name
People often point to the Integrator/Versatile/Realview
implementations to justify using the consumer name as the sole
selector for clocks.

Eliminate this excuse by changing the Integrator implementation, so
it provides a better example of how it should be done.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2008-11-27 12:38:22 +00:00
Russell King cf30fb4a4f [ARM] realview: convert to clkdev and lookup clocks by device name
People often point to the Integrator/Versatile/Realview
implementations to justify using the consumer name as the sole
selector for clocks.

Eliminate this excuse by changing the Realview implementation, so
it provides a better example of how it should be done.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2008-11-27 12:38:21 +00:00
Russell King 0318e693d3 [ARM] clkdev: add generic clkdev infrastructure
Add some generic infrastructure to assist looking up struct clks
for the ARM architecture.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2008-11-27 12:38:21 +00:00
Russell King 635f0258e5 [ARM] clps7500: remove support
The CLPS7500 platform has not built since 2.6.22-git7 and there
seems to be no interest in fixing it.  So, remove the platform
support.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2008-11-27 12:38:11 +00:00
Russell King c750815e2d [ARM] Arrange for platforms to select appropriate CPU support
Rather than:

	config CPU_BLAH
		bool
		depends on ARCH_FOO || MACH_BAR
		default y if ARCH_FOO || MACH_BAR

arrange for ARCH_FOO and MACH_BAR to select CPU_BLAH directly.

Acked-by: Nicolas Pitre <nico@marvell.com>
Acked-by: Andrew Victor <linux@maxim.org.za>
Acked-by: Brian Swetland <swetland@google.com>
Acked-by: Eric Miao <eric.miao@marvell.com>
Acked-by: Nicolas Bellido <ml@acolin.be>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2008-11-27 12:38:00 +00:00
Russell King 59f0cb0fdd [ARM] remove memzero()
As suggested by Andrew Morton, remove memzero() - it's not supported
on other architectures so use of it is a potential build breaking bug.
Since the compiler optimizes memset(x,0,n) to __memzero() perfectly
well, we don't miss out on the underlying benefits of memzero().

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2008-11-27 12:37:59 +00:00
Russell King 6417a917b5 Merge branch 'omap-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6 2008-11-27 11:13:10 +00:00
Tero Kristo 723fdb781a ARM: OMAP: Fixes for suspend / resume GPIO wake-up handling
Use the correct wake-up enable register, and make it
work with 34xx also.

Signed-off-by: Tero Kristo <tero.kristo@nokia.com>
Signed-off-by: Kevin Hilman <khilman@deeprootsystems.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2008-11-26 14:35:16 -08:00
Amit Kucheria 147dcf5489 ARM: OMAP: Typo fix for clock_allow_idle
The second clk_deny_idle instance should be clk_allow_idle instead.

Signed-off-by: Amit Kucheria <amit.kucheria@verdurent.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2008-11-25 15:11:12 -08:00
Tony Lindgren 7953031da4 ARM: OMAP: Remove broken LCD driver for SX1
Recently the omap McBSP code was cleaned up to get rid of
direct McBSP register tinkering by the drivers. Looks like
lcd_sx1.c never got converted, and now it breaks builds.

It seems the lcd_sx1.c driver is attempting SPI mode, but
doing it in a different way compared to omap_mcbsp_set_spi_mode().

Remove the broken driver, patches welcome to add it back when
done properly by patching both mcbsp.c and lcd_sx1.c.

Cc: Vovan888@gmail.com
Cc: linux-fbdev-devel@lists.sourceforge.net
Signed-off-by: Tony Lindgren <tony@atomide.com>
2008-11-24 18:11:16 -08:00
Jaya Kumar 47fd6f7c94 [ARM] 5335/1: pxa25x_udc: Fix is_vbus_present to return 1 or 0
the use of is_blah() suggests a 1 or 0 return. This assumption is made in
pxa25x_udc code such as:
	dev->vbus = is_vbus_present();
where dev->vbus is a bitfield. This fix allows pxa25x_udc_probe to correctly
detect vbus. Other changes were to make its use consistent in the rest of
the code.

Signed-off-by: Jaya Kumar <jayakumar.lkml@gmail.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2008-11-23 15:49:59 +00:00
Robert Jarzmik 844c6f6a36 [ARM] pxa/MioA701: bluetooth resume fix
The G3IPL expects the value at RAM address 0xa020b020 to be
exactly 1 to setup the bluetooth GPIOs properly. The actual
code got a value from gpio_get_value() which was not 1, but
a "not equal to 0" integer.

Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Acked-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Eric Miao <eric.miao@marvell.com>
2008-11-22 20:57:21 +08:00
Robert Jarzmik 999f633878 [ARM] pxa/MioA701: fix memory corruption.
In the resume bootstrap, the early disable address is wrong.
Fix it to RAM address 0xa020b000 instead of 0xa0200000, and
make it consistent with RESUME_ENABLE_ADDR in mioa701.c.

Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Acked-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Eric Miao <eric.miao@marvell.com>
2008-11-22 20:57:21 +08:00
Linus Torvalds ed313489ba Merge master.kernel.org:/home/rmk/linux-2.6-arm
* master.kernel.org:/home/rmk/linux-2.6-arm:
  [ARM] 5330/1: mach-pxa: Fixup reset for systems using reboot=cold or other strings
  [ARM] pxa: fix incorrect PCMCIA PSKTSEL pin configuration for spitz
  [ARM] pxa: fix I2C controller device being registered twice on Akita
  pxafb: only initialize the smart panel thread when dealing with a smartpanel
  pxafb: introduce LCD_TYPE_MASK and use it.
2008-11-20 18:08:09 -08:00
Linus Torvalds 13d428afc0 Linux 2.6.28-rc6 2008-11-20 15:19:22 -08:00
Linus Torvalds 906430a99e Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6
* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6:
  [IA64] xen: fix xen_get_eflags.
  [IA64] ia64/pv_ops/pv_cpu_ops: fix _IA64_REG_IP case.
  [IA64] remove duplicate include iommu.h
  [IA64] use mprintk instead of printk, in ia64_mca_modify_original_stack
  [IA64] Rationalize kernel mode alignment checking
2008-11-20 15:07:40 -08:00
Linus Torvalds ba721d318b Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6:
  USB: ACE1001 patch for cp2101.c
  USB: usbmon: fix read(2)
  USB: gadget rndis: send notifications
  USB: gadget rndis: stop windows self-immolation
  USB: storage: update unusual_devs entries for Nokia 5300 and 5310
  USB: storage: updates unusual_devs entry for the Nokia 6300
  usb: musb: fix bug in musb_schedule
  USB: fix SB700 usb subsystem hang bug
2008-11-20 13:53:21 -08:00
Isaku Yamahata 0090d481ee [IA64] xen: fix xen_get_eflags.
fix xen_get_eflags. It doesn't take any argument.

Signed-off-by: Isaku Yamahata <yamahata@valinux.co.jp>
Signed-off-by: Tony Luck <tony.luck@intel.com>
2008-11-20 13:43:01 -08:00
Isaku Yamahata 93fe10b670 [IA64] ia64/pv_ops/pv_cpu_ops: fix _IA64_REG_IP case.
pv_cpu_ops.getreg(_IA64_REG_IP) returned constant.
But the returned ip valued should be the one in the caller, not of the callee.
This patch fixes that.

Signed-off-by: Isaku Yamahata <yamahata@valinux.co.jp>
Signed-off-by: Tony Luck <tony.luck@intel.com>
2008-11-20 13:41:20 -08:00
Huang Weiyi d596410776 [IA64] remove duplicate include iommu.h
arch/ia64/kernel/pci-dma.c only needs to include iommu once.

Signed-off-by: Huang Weiyi <weiyi.huang@gmail.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
2008-11-20 13:38:16 -08:00
Hidetoshi Seto ef23cdbefc [IA64] use mprintk instead of printk, in ia64_mca_modify_original_stack
Using printk from MCA/INIT context is unsafe since it can cause deadlock.
The ia64_mca_modify_original_stack is called from both of mca handler and
init handler, so it should use mprintk instead of printk.

Signed-off-by: Hidetoshi Seto <seto.hidetoshi@jp.fujitsu.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
2008-11-20 13:31:10 -08:00
Tony Luck b704882e70 [IA64] Rationalize kernel mode alignment checking
Itanium processors can handle some misaligned data accesses. They
also provide a mode where all such accesses are forced to trap. The
kernel was schizophrenic about use of this mode:

* Base kernel code ran in permissive mode where the only traps
  generated were from those cases that the h/w could not handle.
* Interrupt, syscall and trap code ran in strict mode where all
  unaligned accesses caused traps to the 0x5a00 unaligned reference
  vector.

Use strict alignment checking throughout the kernel, but make
sure that we continue to let user mode use more relaxed mode
as the default.

Signed-off-by: Tony Luck <tony.luck@intel.com>
2008-11-20 13:27:12 -08:00
Matthew Wilcox 0ca4b6b001 x86: Fix interrupt leak due to migration
When we migrate an interrupt from one CPU to another, we set the
move_in_progress flag and clean up the vectors later once they're not
being used.  If you're unlucky and call destroy_irq() before the vectors
become un-used, the move_in_progress flag is never cleared, which causes
the interrupt to become unusable.

This was discovered by Jesse Brandeburg for whom it manifested as an
MSI-X device refusing to use MSI-X mode when the driver was unloaded
and reloaded repeatedly.

Signed-off-by: Matthew Wilcox <willy@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-11-20 13:17:40 -08:00
Trond Myklebust 23918b0306 SUNRPC: Fix a performance regression in the RPC authentication code
Fix a regression reported by Max Kellermann whereby kernel profiling
showed that his clients were spending 45% of their time in
rpcauth_lookup_credcache.

It turns out that although his processes had identical uid/gid/groups,
generic_match() was failing to detect this, because the task->group_info
pointers were not shared. This again lead to the creation of a huge number
of identical credentials at the RPC layer.

The regression is fixed by comparing the contents of task->group_info
if the actual pointers are not identical.

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-11-20 13:17:40 -08:00
Linus Torvalds 0cb39aa0ac Merge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6:
  [CIFS] Do not attempt to close invalidated file handles
  [CIFS] fix check for dead tcon in smb_init
2008-11-20 13:14:16 -08:00
Linus Torvalds c93fc2873e Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus
* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
  MIPS: csrc-r4k: Fix declaration depending on the wrong CONFIG_ symbol.
  MIPS: csrc-r4k: Fix spelling mistake.
  MIPS: RB532: Provide functions for gpio configuration
  MIPS: IP22: Make indy_sc_ops variable static
  MIPS: RB532: GPIO register offsets are relative to GPIOBASE
  MIPS: Malta: Fix include paths in malta-amon.c
2008-11-20 13:13:48 -08:00
Linus Torvalds e3b4ae79e9 Merge branch 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
* 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  intel-iommu: fix compile warnings
2008-11-20 13:13:03 -08:00
Linus Torvalds 4dd61d92d7 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (23 commits)
  net: fix tiny output corruption of /proc/net/snmp6
  atl2: don't request irq on resume if netif running
  ipv6: use seq_release_private for ip6mr.c /proc entries
  pkt_sched: fix missing check for packet overrun in qdisc_dump_stab()
  smc911x: Fix printf format typo in smc911x driver.
  asix: Fix asix-based cards connecting to 10/100Mbs LAN.
  mv643xx_eth: fix recycle check bound
  mv643xx_eth: fix the order of mdiobus_{unregister, free}() calls
  sh: sh_eth: Update to change of mii_bus
  TPROXY: supply a struct flowi->flags argument in inet_sk_rebuild_header()
  TPROXY: fill struct flowi->flags in udp_sendmsg()
  net: ipg.c fix bracing on endian swapping
  phylib: Fix auto-negotiation restart avoidance
  net: jme.c rxdesc.flags is __le16, other missing endian swaps
  phylib: fix phy name example in documentation
  net: Do not fire linkwatch events until the device is registered.
  phonet: fix compilation with gcc-3.4
  ixgbe: fix compilation with gcc-3.4
  pktgen: fix multiple queue warning
  net: fix ip_mr_init() error path
  ...
2008-11-20 13:12:14 -08:00
Linus Torvalds 95763dd52b Merge branch 'tracing-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
* 'tracing-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  ftrace: fix dyn ftrace filter selection
  ftrace: make filtered functions effective on setting
  ftrace: fix set_ftrace_filter
  trace: introduce missing mutex_unlock()
  tracing: kernel/trace/trace.c: introduce missing kfree()
2008-11-20 13:11:21 -08:00
Linus Torvalds 0260da162f Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
* 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  x86: uaccess_64: fix return value in __copy_from_user()
  x86: quirk for reboot stalls on a Dell Optiplex 330
2008-11-20 13:09:32 -08:00
Helge Deller ed79b86d8a parisc: fix bug in compat_arch_ptrace
Commit 81e192d6ce ("parisc: convert to
generic compat_sys_ptrace") introduced a bug which segfaults the parisc
64bit kernel when stracing 32bit applications:

  Kernel Fault: Code=15 regs=00000000bafa42b0 (Addr=00000001baf5ab57)
       YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI
  PSW: 00001000000001101111111100001011 Tainted: G        W
  r00-03  000000ff0806ff0b 000000004068edc0 00000000401203f8 00000000fb3e2508
  r04-07  0000000040686dc0 00000000baf5a800 fffffffffffffffc fffffffffb3e2508
  r08-11  00000000baf5a800 000000000004b068 00000000000402b0 0000000000040d68
  r12-15  0000000000042a9c 0000000000040a9c 0000000000040d60 0000000000042e9c
  r16-19  000000000004b060 000000000004b058 0000000000042d9c ffffffffffffffff
  r20-23  000000000800000b 0000000000000000 000000000800000b fffffffffb3e2508
  r24-27  00000000fffffffc 0000000000000003 00000000fffffffc 0000000040686dc0
  r28-31  00000001baf5a7ff 00000000bafa4280 00000000bafa42b0 00000000000001d7
  sr00-03  0000000000fca000 0000000000000000 0000000000000000 0000000000fca000
  sr04-07  0000000000000000 0000000000000000 0000000000000000 0000000000000000

  IASQ: 0000000000000000 0000000000000000 IAOQ: 0000000040120400 0000000040120404
   IIR: 4b9a06b0    ISR: 0000000000000000  IOR: 00000001baf5ab57
   CPU:        0   CR30: 00000000bafa4000 CR31: 00000000d22344e0
   ORIG_R28: 00000000fb3e2248
   IAOQ[0]: compat_arch_ptrace+0xb8/0x160
   IAOQ[1]: compat_arch_ptrace+0xbc/0x160
   RP(r2): compat_arch_ptrace+0xb0/0x160
  Backtrace:
   [<00000000401612ac>] compat_sys_ptrace+0x15c/0x180
   [<0000000040104ef8>] syscall_exit+0x0/0x14

The problem is that compat_arch_ptrace() enters with an addr value of
type compat_ulong_t and calls translate_usr_offset() to translate the
address offset into a struct pt_regs offset like this:

	addr = translate_usr_offset(addr)

this means that any return value of translate_usr_offset() is stored
back as compat_ulong_t type into the addr variable.

But since translate_usr_offset() returns -1 for invalid offsets, addr
can now get the value 0xffffffff which then fails the next return-value
sanity check and thus the kernel tries to access invalid memory:

	if (addr < 0)
		break;

Fix this bug by modifying translate_usr_offset() to take and return
values of type compat_ulong_t, and by returning the value
"sizeof(struct pt_regs)" as an error indicator.

Additionally change the sanity check to check for return values
for >= sizeof(struct pt_regs).

This patch survived my compile and run-tests.

Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-11-20 13:09:17 -08:00