snowball/igloo-kernel.git/drivers/base, branch integration-linux-ux500

sync: add poll support

2012-05-16T20:27:24+00:00

Change-Id: I294e481bba92658e6dd26f157ddbf0e9ff4ce8a5 Signed-off-by: Erik Gilling

sw_sync: add fill_driver_data support

2012-05-16T20:27:24+00:00

Change-Id: Ib3812d282db56362d82f5ccc9a12b7d2100ab93a Signed-off-by: Erik Gilling

sync: add ioctl to get fence data

2012-05-16T20:27:23+00:00

Change-Id: I71410aef7e03a52562f7cb15b993ac8441b1fa12 Signed-off-by: Erik Gilling

sw_sync: add debug support

2012-05-16T20:27:23+00:00

Change-Id: Ibcc5fa8cb36e283cdf0e3308064876722e2675fc Signed-off-by: Erik Gilling

sync: add debugfs support

2012-05-16T20:27:23+00:00

Change-Id: I8a7ea63e454fbeee1ecf17e6c3caff7c43b24734 Signed-off-by: Erik Gilling

sync: add timestamps to sync_pts

2012-05-16T20:27:23+00:00

Change-Id: I2ad855072b86873880769a09a3176e85aa1199d7 Signed-off-by: Erik Gilling

sw_sync: add cpu based sync driver

2012-05-16T20:27:23+00:00

Change-Id: I1042851f5e30f9fdc2f35bdad84123bcf108560f Signed-off-by: Erik Gilling

sync: Add synchronization framework

2012-05-16T20:27:22+00:00

not run through checkpatch yet. Change-Id: I209f9db2824e0313f467f11ab09e5f54f0a4a6b5 Signed-off-by: Erik Gilling

Merge commit 'v3.4-rc7' into android-3.4

2012-05-14T23:41:02+00:00

regmap: fix possible memory corruption in regmap_bulk_read()

2012-05-09T14:44:11+00:00

The function regmap_bulk_read() calls the regmap_read() for each register if set of register has volatile and cache is enabled. In this case, last few register read makes the memory corruption if the register size is not the size of unsigned int. The regam_read() takes argument as unsigned int for returning value and it update the value as *val = map->format.parse_val(map->work_buf); This causes complete 4 bytes (size of unsigned int) to get written. Now if client pass the memory pointer for value which is equal to the required size of register count in regmap_bulk_read() then last few register read actually update the memory beyond passed pointer size. Avoid this by using local variable for read and then do memcpy() for actual byte copy to passed pointer based on register size. I allocated one pointer ptr and take first 16 bytes dump of that pointer then call regmap_bulk_read() with pointer which is just on top of this allocated pointer and register count of 128. Here register size is 1 byte. The memory trace of last 5 register read are as follows: [ 5.438589] regmap_bulk_read after regamp_read() for register 122 [ 5.447421] 0xef993c20 0xef993c00 0x00000000 0x00000001 [ 5.467535] regmap_bulk_read after regamp_read() for register 123 [ 5.476374] 0xef993c20 0xef993c00 0x00000000 0x00000001 [ 5.496425] regmap_bulk_read after regamp_read() for register 124 [ 5.505260] 0xef993c20 0xef993c00 0x00000000 0x00000001 [ 5.525372] regmap_bulk_read after regamp_read() for register 125 [ 5.534205] 0xef993c00 0xef993c00 0x00000000 0x00000001 [ 5.554258] regmap_bulk_read after regamp_read() for register 126 [ 5.563100] 0xef990000 0xef993c00 0x00000000 0x00000001 [ 5.554258] regmap_bulk_read after regamp_read() for register 127 [ 5.587108] 0xef000000 0xef993c00 0x00000000 0x00000001 Here it is observed that the memory content at first word started changing on last 3 regmap_read() and so corruption happened. Signed-off-by: Laxman Dewangan Signed-off-by: Mark Brown