<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/include/linux/regulator/driver.h, branch v6.4-rc1</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>regulator: core: Use different devices for resource allocation and DT lookup</title>
<updated>2022-12-08T13:02:37+00:00</updated>
<author>
<name>ChiYuan Huang</name>
<email>cy_huang@richtek.com</email>
</author>
<published>2022-12-06T07:22:21+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=8f3cbcd6b440032ebc7f7d48a1689dcc70a4eb98'/>
<id>8f3cbcd6b440032ebc7f7d48a1689dcc70a4eb98</id>
<content type='text'>
Following by the below discussion, there's the potential UAF issue
between regulator and mfd.
https://lore.kernel.org/all/20221128143601.1698148-1-yangyingliang@huawei.com/

From the analysis of Yingliang

CPU A				|CPU B
mt6370_probe()			|
  devm_mfd_add_devices()	|
				|mt6370_regulator_probe()
				|  regulator_register()
				|    //allocate init_data and add it to devres
				|    regulator_of_get_init_data()
i2c_unregister_device()		|
  device_del()			|
    devres_release_all()	|
      // init_data is freed	|
      release_nodes()		|
				|  // using init_data causes UAF
				|  regulator_register()

It's common to use mfd core to create child device for the regulator.
In order to do the DT lookup for init data, the child that registered
the regulator would pass its parent as the parameter. And this causes
init data resource allocated to its parent, not itself. The issue happen
when parent device is going to release and regulator core is still doing
some operation of init data constraint for the regulator of child device.

To fix it, this patch expand 'regulator_register' API to use the
different devices for init data allocation and DT lookup.

Reported-by: Yang Yingliang &lt;yangyingliang@huawei.com&gt;
Signed-off-by: ChiYuan Huang &lt;cy_huang@richtek.com&gt;
Link: https://lore.kernel.org/r/1670311341-32664-1-git-send-email-u0084500@gmail.com
Signed-off-by: Mark Brown &lt;broonie@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Following by the below discussion, there's the potential UAF issue
between regulator and mfd.
https://lore.kernel.org/all/20221128143601.1698148-1-yangyingliang@huawei.com/

From the analysis of Yingliang

CPU A				|CPU B
mt6370_probe()			|
  devm_mfd_add_devices()	|
				|mt6370_regulator_probe()
				|  regulator_register()
				|    //allocate init_data and add it to devres
				|    regulator_of_get_init_data()
i2c_unregister_device()		|
  device_del()			|
    devres_release_all()	|
      // init_data is freed	|
      release_nodes()		|
				|  // using init_data causes UAF
				|  regulator_register()

It's common to use mfd core to create child device for the regulator.
In order to do the DT lookup for init data, the child that registered
the regulator would pass its parent as the parameter. And this causes
init data resource allocated to its parent, not itself. The issue happen
when parent device is going to release and regulator core is still doing
some operation of init data constraint for the regulator of child device.

To fix it, this patch expand 'regulator_register' API to use the
different devices for init data allocation and DT lookup.

Reported-by: Yang Yingliang &lt;yangyingliang@huawei.com&gt;
Signed-off-by: ChiYuan Huang &lt;cy_huang@richtek.com&gt;
Link: https://lore.kernel.org/r/1670311341-32664-1-git-send-email-u0084500@gmail.com
Signed-off-by: Mark Brown &lt;broonie@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>regulator: fix a kernel-doc warning</title>
<updated>2022-06-28T12:07:42+00:00</updated>
<author>
<name>Mauro Carvalho Chehab</name>
<email>mchehab@kernel.org</email>
</author>
<published>2022-06-28T09:46:22+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=0e584d46218e3b9dc12a98e18e81a0cd3e0d5419'/>
<id>0e584d46218e3b9dc12a98e18e81a0cd3e0d5419</id>
<content type='text'>
document n_ramp_values field at struct regulator_desc, in order
to solve this warning:

	include/linux/regulator/driver.h:434: warning: Function parameter or member 'n_ramp_values' not described in 'regulator_desc'

Signed-off-by: Mauro Carvalho Chehab &lt;mchehab@kernel.org&gt;
Link: https://lore.kernel.org/r/15efc16e878aa327aa2769023bcdf959a795f41d.1656409369.git.mchehab@kernel.org
Signed-off-by: Mark Brown &lt;broonie@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
document n_ramp_values field at struct regulator_desc, in order
to solve this warning:

	include/linux/regulator/driver.h:434: warning: Function parameter or member 'n_ramp_values' not described in 'regulator_desc'

Signed-off-by: Mauro Carvalho Chehab &lt;mchehab@kernel.org&gt;
Link: https://lore.kernel.org/r/15efc16e878aa327aa2769023bcdf959a795f41d.1656409369.git.mchehab@kernel.org
Signed-off-by: Mark Brown &lt;broonie@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'regulator-v5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator</title>
<updated>2022-01-11T20:17:45+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2022-01-11T20:17:45+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=fef8dfaea9d6c444b6c2174b3a2b0fca4d226c5e'/>
<id>fef8dfaea9d6c444b6c2174b3a2b0fca4d226c5e</id>
<content type='text'>
Pull regulator updates from Mark Brown:
 "This has been a fairly quiet release for the regulator API, the main
  thing has been the addition of helpers for interrupt handling from
  Matti Vaittinen.

  We do also have support for quite a few new devices.

  Summary:

   - Helpers for trivial interrupt notifications, making it easier for
     drivers to handle error interrupts.

   - Support for Dialog DA914x, Maxim MAX2008x, Qualcomm PM8826,
     PMG1100, and PM8450 and TI TPS68470"

* tag 'regulator-v5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (30 commits)
  regulator: Add MAX20086-MAX20089 driver
  dt-bindings: regulators: Add bindings for Maxim MAX20086-MAX20089
  regulator: qcom_smd: Align probe function with rpmh-regulator
  regulator: remove redundant ret variable
  regulator: qcom-labibb: OCP interrupts are not a failure while disabled
  regulator: dt-bindings: samsung,s5m8767: Move fixed string BUCK9 to 'properties'
  regulator: Introduce tps68470-regulator driver
  drivers/regulator: remove redundant ret variable
  regulator: fix bullet lists of regulator_ops comment
  regulator: Fix type of regulator-coupled-max-spread property
  regulator: maxim,max8973: Document interrupts property
  regulator: qcom-rpmh: Add support for PM8450 regulators
  regulator: qcom,rpmh: Add compatible for PM8450
  regulator: da9121: Add DA914x binding info
  regulator: da9121: Remove erroneous compatible from binding
  regulator: da9121: Add DA914x support
  regulator: da9121: Prevent current limit change when enabled
  regulator: qcom-rpmh: Add PMG1110 regulators
  dt-bindings: regulator: Add compatible for pmg1110
  regulator: qcom_spmi: Add pm8226 regulators
  ...
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Pull regulator updates from Mark Brown:
 "This has been a fairly quiet release for the regulator API, the main
  thing has been the addition of helpers for interrupt handling from
  Matti Vaittinen.

  We do also have support for quite a few new devices.

  Summary:

   - Helpers for trivial interrupt notifications, making it easier for
     drivers to handle error interrupts.

   - Support for Dialog DA914x, Maxim MAX2008x, Qualcomm PM8826,
     PMG1100, and PM8450 and TI TPS68470"

* tag 'regulator-v5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (30 commits)
  regulator: Add MAX20086-MAX20089 driver
  dt-bindings: regulators: Add bindings for Maxim MAX20086-MAX20089
  regulator: qcom_smd: Align probe function with rpmh-regulator
  regulator: remove redundant ret variable
  regulator: qcom-labibb: OCP interrupts are not a failure while disabled
  regulator: dt-bindings: samsung,s5m8767: Move fixed string BUCK9 to 'properties'
  regulator: Introduce tps68470-regulator driver
  drivers/regulator: remove redundant ret variable
  regulator: fix bullet lists of regulator_ops comment
  regulator: Fix type of regulator-coupled-max-spread property
  regulator: maxim,max8973: Document interrupts property
  regulator: qcom-rpmh: Add support for PM8450 regulators
  regulator: qcom,rpmh: Add compatible for PM8450
  regulator: da9121: Add DA914x binding info
  regulator: da9121: Remove erroneous compatible from binding
  regulator: da9121: Add DA914x support
  regulator: da9121: Prevent current limit change when enabled
  regulator: qcom-rpmh: Add PMG1110 regulators
  dt-bindings: regulator: Add compatible for pmg1110
  regulator: qcom_spmi: Add pm8226 regulators
  ...
</pre>
</div>
</content>
</entry>
<entry>
<title>regulator: fix bullet lists of regulator_ops comment</title>
<updated>2021-12-07T14:33:27+00:00</updated>
<author>
<name>Yanteng Si</name>
<email>siyanteng01@gmail.com</email>
</author>
<published>2021-12-07T12:32:30+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=8d9f738f16a3ee9f2341578873c542ddd9802fe4'/>
<id>8d9f738f16a3ee9f2341578873c542ddd9802fe4</id>
<content type='text'>
Since 89a6a5e56c82("regulator: add property parsing and callbacks to set protection limits")
which introduced a warning:

Documentation/driver-api/regulator:166: ./include/linux/regulator/driver.h:96: WARNING: Unexpected indentation.
Documentation/driver-api/regulator:166: ./include/linux/regulator/driver.h:98: WARNING: Block quote ends without a blank line; unexpected unindent.

Let's fix them.

Signed-off-by: Yanteng Si &lt;siyanteng@loongson.cn&gt;
Link: https://lore.kernel.org/r/20211207123230.2262047-1-siyanteng@loongson.cn
Signed-off-by: Mark Brown &lt;broonie@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Since 89a6a5e56c82("regulator: add property parsing and callbacks to set protection limits")
which introduced a warning:

Documentation/driver-api/regulator:166: ./include/linux/regulator/driver.h:96: WARNING: Unexpected indentation.
Documentation/driver-api/regulator:166: ./include/linux/regulator/driver.h:98: WARNING: Block quote ends without a blank line; unexpected unindent.

Let's fix them.

Signed-off-by: Yanteng Si &lt;siyanteng@loongson.cn&gt;
Link: https://lore.kernel.org/r/20211207123230.2262047-1-siyanteng@loongson.cn
Signed-off-by: Mark Brown &lt;broonie@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>regulator: irq_helper: Provide helper for trivial IRQ notifications</title>
<updated>2021-11-24T12:57:30+00:00</updated>
<author>
<name>Matti Vaittinen</name>
<email>matti.vaittinen@fi.rohmeurope.com</email>
</author>
<published>2021-11-24T07:17:13+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=a764ff77d697a4a13e69b3379cc613f7409c6b9a'/>
<id>a764ff77d697a4a13e69b3379cc613f7409c6b9a</id>
<content type='text'>
Provide a generic map_event helper for regulators which have a notification
IRQ with single, well defined purpose. Eg, IRQ always indicates exactly one
event for exactly one regulator device. For such IRQs the mapping is
trivial.

Signed-off-by: Matti Vaittinen &lt;matti.vaittinen@fi.rohmeurope.com&gt;
Link: https://lore.kernel.org/r/603b7ed1938013a00371c1e7ccc63dfb16982b87.1637736436.git.matti.vaittinen@fi.rohmeurope.com
Signed-off-by: Mark Brown &lt;broonie@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Provide a generic map_event helper for regulators which have a notification
IRQ with single, well defined purpose. Eg, IRQ always indicates exactly one
event for exactly one regulator device. For such IRQs the mapping is
trivial.

Signed-off-by: Matti Vaittinen &lt;matti.vaittinen@fi.rohmeurope.com&gt;
Link: https://lore.kernel.org/r/603b7ed1938013a00371c1e7ccc63dfb16982b87.1637736436.git.matti.vaittinen@fi.rohmeurope.com
Signed-off-by: Mark Brown &lt;broonie@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>regulator: Add regulator_err2notif() helper</title>
<updated>2021-11-24T12:57:28+00:00</updated>
<author>
<name>Matti Vaittinen</name>
<email>matti.vaittinen@fi.rohmeurope.com</email>
</author>
<published>2021-11-24T07:16:45+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=6fadec4c5561e2fbe1dfa8a7da9bc58d094a8f04'/>
<id>6fadec4c5561e2fbe1dfa8a7da9bc58d094a8f04</id>
<content type='text'>
Help drivers avoid storing both supported notification and supported error
flags by supporting conversion from regulator error to notification.
This may help saving some bytes.

Add helper for finding the regulator notification corresponding to a
regulator error.

Signed-off-by: Matti Vaittinen &lt;matti.vaittinen@fi.rohmeurope.com&gt;
Link: https://lore.kernel.org/r/eb1755ac0569ff07ffa466cf8912c6fd50e7c7c6.1637736436.git.matti.vaittinen@fi.rohmeurope.com
Signed-off-by: Mark Brown &lt;broonie@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Help drivers avoid storing both supported notification and supported error
flags by supporting conversion from regulator error to notification.
This may help saving some bytes.

Add helper for finding the regulator notification corresponding to a
regulator error.

Signed-off-by: Matti Vaittinen &lt;matti.vaittinen@fi.rohmeurope.com&gt;
Link: https://lore.kernel.org/r/eb1755ac0569ff07ffa466cf8912c6fd50e7c7c6.1637736436.git.matti.vaittinen@fi.rohmeurope.com
Signed-off-by: Mark Brown &lt;broonie@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>regulator: Drop unnecessary struct member</title>
<updated>2021-11-24T12:57:27+00:00</updated>
<author>
<name>Matti Vaittinen</name>
<email>matti.vaittinen@fi.rohmeurope.com</email>
</author>
<published>2021-11-24T07:17:37+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=1b6ed6bf32fb22ef8e3572fc9c0f6454adf1ca40'/>
<id>1b6ed6bf32fb22ef8e3572fc9c0f6454adf1ca40</id>
<content type='text'>
The irq_flags from the regulator IRQ helper description struct was never
used. The IRQ flags are passed as parameters to helper registration
instead.

Remove the unnecessary struct field.

Fixes: 7111c6d1b31b ("regulator: IRQ based event/error notification helpers")
Signed-off-by: Matti Vaittinen &lt;matti.vaittinen@fi.rohmeurope.com&gt;
Link: https://lore.kernel.org/r/5f6371e178453fa2b165da50452f7db4e986debb.1637736436.git.matti.vaittinen@fi.rohmeurope.com
Signed-off-by: Mark Brown &lt;broonie@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The irq_flags from the regulator IRQ helper description struct was never
used. The IRQ flags are passed as parameters to helper registration
instead.

Remove the unnecessary struct field.

Fixes: 7111c6d1b31b ("regulator: IRQ based event/error notification helpers")
Signed-off-by: Matti Vaittinen &lt;matti.vaittinen@fi.rohmeurope.com&gt;
Link: https://lore.kernel.org/r/5f6371e178453fa2b165da50452f7db4e986debb.1637736436.git.matti.vaittinen@fi.rohmeurope.com
Signed-off-by: Mark Brown &lt;broonie@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>regulator: Add units to limit documentation</title>
<updated>2021-11-18T13:57:51+00:00</updated>
<author>
<name>Matti Vaittinen</name>
<email>matti.vaittinen@fi.rohmeurope.com</email>
</author>
<published>2021-11-18T11:49:30+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=92b1348277f8893671e5354adde64fe3cf462821'/>
<id>92b1348277f8893671e5354adde64fe3cf462821</id>
<content type='text'>
The documentation for limits used at protection level setting
did not mention the units. Fix the units in documentation to
match values passed in from device-tree (uV, uA, Kelvin) to
avoid confusion.

Signed-off-by: Matti Vaittinen &lt;matti.vaittinen@fi.rohmeurope.com&gt;
Link: https://lore.kernel.org/r/111114aca991e41e49a32f89b74e95285f07c1e3.1637233864.git.matti.vaittinen@fi.rohmeurope.com
Signed-off-by: Mark Brown &lt;broonie@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The documentation for limits used at protection level setting
did not mention the units. Fix the units in documentation to
match values passed in from device-tree (uV, uA, Kelvin) to
avoid confusion.

Signed-off-by: Matti Vaittinen &lt;matti.vaittinen@fi.rohmeurope.com&gt;
Link: https://lore.kernel.org/r/111114aca991e41e49a32f89b74e95285f07c1e3.1637233864.git.matti.vaittinen@fi.rohmeurope.com
Signed-off-by: Mark Brown &lt;broonie@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>regulator: Update protection IRQ helper docs</title>
<updated>2021-11-18T13:57:09+00:00</updated>
<author>
<name>Matti Vaittinen</name>
<email>matti.vaittinen@fi.rohmeurope.com</email>
</author>
<published>2021-11-18T11:49:51+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=6966df483d7b5b218aeb0e13e7e334a8fc3c1744'/>
<id>6966df483d7b5b218aeb0e13e7e334a8fc3c1744</id>
<content type='text'>
The documentation of IRQ notification helper had still references to
first RFC implementation which called BUG() while trying to protect the
hardware. Behaviour was improved as calling the BUG() was not a proper
solution. Current implementation attempts to call poweroff if handling
of potentially damaging error notification fails. Update the
documentation to reflect the actual behaviour.

Signed-off-by: Matti Vaittinen &lt;matti.vaittinen@fi.rohmeurope.com&gt;
Link: https://lore.kernel.org/r/0c9cc4bcf20c3da66fd5a85c97ee4288e5727538.1637233864.git.matti.vaittinen@fi.rohmeurope.com
Signed-off-by: Mark Brown &lt;broonie@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The documentation of IRQ notification helper had still references to
first RFC implementation which called BUG() while trying to protect the
hardware. Behaviour was improved as calling the BUG() was not a proper
solution. Current implementation attempts to call poweroff if handling
of potentially damaging error notification fails. Update the
documentation to reflect the actual behaviour.

Signed-off-by: Matti Vaittinen &lt;matti.vaittinen@fi.rohmeurope.com&gt;
Link: https://lore.kernel.org/r/0c9cc4bcf20c3da66fd5a85c97ee4288e5727538.1637233864.git.matti.vaittinen@fi.rohmeurope.com
Signed-off-by: Mark Brown &lt;broonie@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>regulator: Documentation fix for regulator error notification helper</title>
<updated>2021-08-23T10:06:28+00:00</updated>
<author>
<name>Matti Vaittinen</name>
<email>matti.vaittinen@fi.rohmeurope.com</email>
</author>
<published>2021-08-23T07:56:51+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=ad3ead1efe057029bf112e13d7ef5901915d6abd'/>
<id>ad3ead1efe057029bf112e13d7ef5901915d6abd</id>
<content type='text'>
The helper to send IRQ notification for regulator errors had still
old description mentioning calling BUG() as a last resort when
error status reading has kept failing for more times than a given
threshold.

The impementation calling BUG() did never end-up in-tree but was
replaced by hopefully more sophisticated handler trying to power-off
the system.

Fix the documentation to reflect actual behaviour.

Signed-off-by: Matti Vaittinen &lt;matti.vaittinen@fi.rohmeurope.com&gt;
Link: https://lore.kernel.org/r/20210823075651.GA3717293@localhost.localdomain
Signed-off-by: Mark Brown &lt;broonie@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The helper to send IRQ notification for regulator errors had still
old description mentioning calling BUG() as a last resort when
error status reading has kept failing for more times than a given
threshold.

The impementation calling BUG() did never end-up in-tree but was
replaced by hopefully more sophisticated handler trying to power-off
the system.

Fix the documentation to reflect actual behaviour.

Signed-off-by: Matti Vaittinen &lt;matti.vaittinen@fi.rohmeurope.com&gt;
Link: https://lore.kernel.org/r/20210823075651.GA3717293@localhost.localdomain
Signed-off-by: Mark Brown &lt;broonie@kernel.org&gt;
</pre>
</div>
</content>
</entry>
</feed>
