Vegard Nossum [Thu, 22 Jan 2009 14:29:45 +0000 (15:29 +0100)]
inotify: clean up inotify_read and fix locking problems
If userspace supplies an invalid pointer to a read() of an inotify
instance, the inotify device's event list mutex is unlocked twice.
This causes an unbalance which effectively leaves the data structure
unprotected, and we can trigger oopses by accessing the inotify
instance from different tasks concurrently.
The best fix (contributed largely by Linus) is a total rewrite
of the function in question:
On Thu, Jan 22, 2009 at 7:05 AM, Linus Torvalds wrote:
> The thing to notice is that:
>
> - locking is done in just one place, and there is no question about it
> not having an unlock.
>
> - that whole double-while(1)-loop thing is gone.
>
> - use multiple functions to make nesting and error handling sane
>
> - do error testing after doing the things you always need to do, ie do
> this:
>
> mutex_lock(..)
> ret = function_call();
> mutex_unlock(..)
>
> .. test ret here ..
>
> instead of doing conditional exits with unlocking or freeing.
>
> So if the code is written in this way, it may still be buggy, but at least
> it's not buggy because of subtle "forgot to unlock" or "forgot to free"
> issues.
>
> This _always_ unlocks if it locked, and it always frees if it got a
> non-error kevent.
Cc: John McCutchan <ttb@tentacle.dhs.org>
Cc: Robert Love <rlove@google.com>
Cc: <stable@kernel.org>
Signed-off-by: Vegard Nossum <vegard.nossum@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Mon, 26 Jan 2009 18:01:53 +0000 (10:01 -0800)]
Fix annoying DRM_ERROR() string warning
Use '%zu' to print out a size_t variable, not '%d'. Another case of the
"let's keep at least Linus' defconfig compile warningless" rule.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Mon, 26 Jan 2009 17:49:22 +0000 (09:49 -0800)]
Merge branch 'for-linus' of git://git./linux/kernel/git/mszeredi/fuse
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse:
fuse: fix poll notify
fuse: destroy bdi on umount
fuse: fuse_fill_super error handling cleanup
fuse: fix missing fput on error
fuse: fix NULL deref in fuse_file_alloc()
Linus Torvalds [Mon, 26 Jan 2009 17:47:56 +0000 (09:47 -0800)]
Merge branch 'core-fixes-for-linus' of git://git./linux/kernel/git/tip/linux-2.6-tip
* 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
debugobjects: add and use INIT_WORK_ON_STACK
rcu: remove duplicate CONFIG_RCU_CPU_STALL_DETECTOR
relay: fix lock imbalance in relay_late_setup_files
oprofile: fix uninitialized use of struct op_entry
rcu: move Kconfig menu
softlock: fix false panic which can occur if softlockup_thresh is reduced
rcu: add __cpuinit to rcu_init_percpu_data()
Linus Torvalds [Mon, 26 Jan 2009 17:47:43 +0000 (09:47 -0800)]
Merge branch 'timers-fixes-for-linus' of git://git./linux/kernel/git/tip/linux-2.6-tip
* 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
hrtimers: fix inconsistent lock state on resume in hres_timers_resume
time-sched.c: tick_nohz_update_jiffies should be static
locking, hpet: annotate false positive warning
kernel/fork.c: unused variable 'ret'
itimers: remove the per-cpu-ish-ness
Linus Torvalds [Mon, 26 Jan 2009 17:47:28 +0000 (09:47 -0800)]
Merge branch 'x86-fixes-for-linus' of git://git./linux/kernel/git/tip/linux-2.6-tip
* 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: (29 commits)
xen: unitialised return value in xenbus_write_transaction
x86: fix section mismatch warning
x86: unmask CPUID levels on Intel CPUs, fix
x86: work around PAGE_KERNEL_WC not getting WC in iomap_atomic_prot_pfn.
x86: use standard PIT frequency
xen: handle highmem pages correctly when shrinking a domain
x86, mm: fix pte_free()
xen: actually release memory when shrinking domain
x86: unmask CPUID levels on Intel CPUs
x86: add MSR_IA32_MISC_ENABLE bits to <asm/msr-index.h>
x86: fix PTE corruption issue while mapping RAM using /dev/mem
x86: mtrr fix debug boot parameter
x86: fix page attribute corruption with cpa()
Revert "x86: signal: change type of paramter for sys_rt_sigreturn()"
x86: use early clobbers in usercopy*.c
x86: remove kernel_physical_mapping_init() from init section
fix: crash: IP: __bitmap_intersects+0x48/0x73
cpufreq: use work_on_cpu in acpi-cpufreq.c for drv_read and drv_write
work_on_cpu: Use our own workqueue.
work_on_cpu: don't try to get_online_cpus() in work_on_cpu.
...
Linus Torvalds [Mon, 26 Jan 2009 17:46:29 +0000 (09:46 -0800)]
Merge git://git./linux/kernel/git/bart/ide-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6:
drivers/ide/palm_bk3710.c buildfix
ide: fix Falcon IDE breakage
ide: fix IDE PMAC breakage
Linus Torvalds [Mon, 26 Jan 2009 17:44:17 +0000 (09:44 -0800)]
Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs
* 'for-linus' of git://oss.sgi.com/xfs/xfs:
Long btree pointers are still 64 bit on disk
[XFS] Remove the rest of the macro-to-function indirections.
xfs: sanity check attr fork size
xfs: fix bad_features2 fixups for the root filesystem
xfs: add a lock class for group/project dquots
xfs: lockdep annotations for xfs_dqlock2
xfs: add a separate lock class for the per-mount list of dquots
xfs: use mnt_want_write in compat_attrmulti ioctl
xfs: fix dentry aliasing issues in open_by_handle
Linus Torvalds [Mon, 26 Jan 2009 17:42:00 +0000 (09:42 -0800)]
Merge branch 'for-linus' of git://git./linux/kernel/git/tiwai/sound-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
ASoC: Add missing comma to SND_SOC_DAPM_SWITCH_E in soc-dapm.h
ALSA: hda: Add STAC92HD83XXX_PWR_REF quirk
ALSA: hda: revert change to 92hd83xxx power mapping
ALSA: hda - Add model entry for HP dv4
ALSA: hda: 83xxx port 0xe DAC selection
ASoC: fix registration of the SoC card in the Freescale MPC8610 drivers
sound: virtuoso: document HDAV1.3 driver status
sound: virtuoso: add newline
sound: virtuoso: enable UART on Xonar HDAV1.3
sound: Remove removed OSS kernel parameters from doc
ALSA: hda: fix invalid power mapping masks
ASoC: atmel_pcm: Remove non-existant header
ALSA: hda - add quirks for some 82801H variants to use ALC883_MITAC
ALSA: hda - Fix (yet more) STAC925x issues
Miklos Szeredi [Mon, 26 Jan 2009 14:00:59 +0000 (15:00 +0100)]
fuse: fix poll notify
Move fuse_copy_finish() to before calling fuse_notify_poll_wakeup().
This is not a big issue because fuse_notify_poll_wakeup() should be
atomic, but it's cleaner this way, and later uses of notification will
need to be able to finish the copying before performing some actions.
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Miklos Szeredi [Mon, 26 Jan 2009 14:00:59 +0000 (15:00 +0100)]
fuse: destroy bdi on umount
If a fuse filesystem is unmounted but the device file descriptor
remains open and a new mount reuses the old device number, then the
mount fails with EEXIST and the following warning is printed in the
kernel log:
WARNING: at fs/sysfs/dir.c:462 sysfs_add_one+0x35/0x3d()
sysfs: duplicate filename '0:15' can not be created
The cause is that the bdi belonging to the fuse filesystem was
destoryed only after the device file was released. Fix this by
calling bdi_destroy() from fuse_put_super() instead.
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
CC: stable@kernel.org
Miklos Szeredi [Mon, 26 Jan 2009 14:00:58 +0000 (15:00 +0100)]
fuse: fuse_fill_super error handling cleanup
Clean up error handling for the whole of fuse_fill_super() function.
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Miklos Szeredi [Mon, 26 Jan 2009 14:00:58 +0000 (15:00 +0100)]
fuse: fix missing fput on error
Fix the leaking file reference if allocation or initialization of
fuse_conn failed.
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
CC: stable@kernel.org
Dan Carpenter [Mon, 26 Jan 2009 14:00:58 +0000 (15:00 +0100)]
fuse: fix NULL deref in fuse_file_alloc()
ff is set to NULL and then dereferenced on line 65. Compile tested only.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
CC: stable@kernel.org
Ian Campbell [Sat, 24 Jan 2009 08:22:47 +0000 (08:22 +0000)]
xen: unitialised return value in xenbus_write_transaction
The return value of xenbus_write_transaction can be uninitialised in
the success case leading to the userspace xenstore utilities failing.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Rakib Mullick [Fri, 23 Jan 2009 19:46:03 +0000 (01:46 +0600)]
x86: fix section mismatch warning
Here function vmi_activate calls a init function activate_vmi , which
causes the following section mismatch warnings:
LD arch/x86/kernel/built-in.o
WARNING: arch/x86/kernel/built-in.o(.text+0x13ba9): Section mismatch
in reference from the function vmi_activate() to the function
.init.text:vmi_time_init()
The function vmi_activate() references
the function __init vmi_time_init().
This is often because vmi_activate lacks a __init
annotation or the annotation of vmi_time_init is wrong.
WARNING: arch/x86/kernel/built-in.o(.text+0x13bd1): Section mismatch
in reference from the function vmi_activate() to the function
.devinit.text:vmi_time_bsp_init()
The function vmi_activate() references
the function __devinit vmi_time_bsp_init().
This is often because vmi_activate lacks a __devinit
annotation or the annotation of vmi_time_bsp_init is wrong.
WARNING: arch/x86/kernel/built-in.o(.text+0x13bdb): Section mismatch
in reference from the function vmi_activate() to the function
.devinit.text:vmi_time_ap_init()
The function vmi_activate() references
the function __devinit vmi_time_ap_init().
This is often because vmi_activate lacks a __devinit
annotation or the annotation of vmi_time_ap_init is wrong.
Fix it by marking vmi_activate() as __init too.
Signed-off-by: Rakib Mullick <rakib.mullick@gmail.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Ingo Molnar [Mon, 26 Jan 2009 03:30:41 +0000 (04:30 +0100)]
x86: unmask CPUID levels on Intel CPUs, fix
Impact: fix boot hang on pre-model-15 Intel CPUs
rdmsrl_safe() does not work in very early bootup code yet, because we
dont have the pagefault handler installed yet so exception section
does not get parsed. rdmsr_safe() will just crash and hang the bootup.
So limit the MSR_IA32_MISC_ENABLE MSR read to those CPU types that
support it.
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Eric Anholt [Fri, 23 Jan 2009 22:14:21 +0000 (14:14 -0800)]
x86: work around PAGE_KERNEL_WC not getting WC in iomap_atomic_prot_pfn.
In the absence of PAT, PAGE_KERNEL_WC ends up mapping to a memory type that
gets UC behavior even in the presence of a WC MTRR covering the area in
question. By swapping to PAGE_KERNEL_UC_MINUS, we can get the actual
behavior the caller wanted (WC if you can manage it, UC otherwise).
This recovers the 40% performance improvement of using WC in the DRM
to upload vertex data.
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Ingo Molnar [Sun, 25 Jan 2009 15:57:00 +0000 (16:57 +0100)]
x86: use standard PIT frequency
the RDC and ELAN platforms use slighly different PIT clocks, resulting in
a timex.h hack that changes PIT_TICK_RATE during build time. But if a
tester enables any of these platform support .config options, the PIT
will be miscalibrated on standard PC platforms.
So use one frequency - in a subsequent patch we'll add a quirk to allow
x86 platforms to define different PIT frequencies.
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Ian Campbell [Fri, 23 Jan 2009 16:26:21 +0000 (16:26 +0000)]
xen: handle highmem pages correctly when shrinking a domain
Commit
1058a75f07b9bb8323fb5197be5526220f8b75cf ("xen: actually release
memory when shrinking domain") causes a crash if the page being released
is a highmem page.
If a page is highmem then there is no need to unmap it.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Jeremy Fitzhardinge <jeremy@goop.org>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Peter Zijlstra [Fri, 23 Jan 2009 16:37:49 +0000 (17:37 +0100)]
x86, mm: fix pte_free()
On -rt we were seeing spurious bad page states like:
Bad page state in process 'firefox'
page:
c1bc2380 flags:0x40000000 mapping:
c1bc2390 mapcount:0 count:0
Trying to fix it up, but a reboot is needed
Backtrace:
Pid: 503, comm: firefox Not tainted 2.6.26.8-rt13 #3
[<
c043d0f3>] ? printk+0x14/0x19
[<
c0272d4e>] bad_page+0x4e/0x79
[<
c0273831>] free_hot_cold_page+0x5b/0x1d3
[<
c02739f6>] free_hot_page+0xf/0x11
[<
c0273a18>] __free_pages+0x20/0x2b
[<
c027d170>] __pte_alloc+0x87/0x91
[<
c027d25e>] handle_mm_fault+0xe4/0x733
[<
c043f680>] ? rt_mutex_down_read_trylock+0x57/0x63
[<
c043f680>] ? rt_mutex_down_read_trylock+0x57/0x63
[<
c0218875>] do_page_fault+0x36f/0x88a
This is the case where a concurrent fault already installed the PTE and
we get to free the newly allocated one.
This is due to pgtable_page_ctor() doing the spin_lock_init(&page->ptl)
which is overlaid with the {private, mapping} struct.
union {
struct {
unsigned long private;
struct address_space *mapping;
};
spinlock_t ptl;
struct kmem_cache *slab;
struct page *first_page;
};
Normally the spinlock is small enough to not stomp on page->mapping, but
PREEMPT_RT=y has huge 'spin'locks.
But lockdep kernels should also be able to trigger this splat, as the
lock tracking code grows the spinlock to cover page->mapping.
The obvious fix is calling pgtable_page_dtor() like the regular pte free
path __pte_free_tlb() does.
It seems all architectures except x86 and nm10300 already do this, and
nm10300 doesn't seem to use pgtable_page_ctor(), which suggests it
doesn't do SMP or simply doesnt do MMU at all or something.
Signed-off-by: Peter Zijlstra <a.p.zijlsta@chello.nl>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Cc: <stable@kernel.org>
Takashi Iwai [Fri, 23 Jan 2009 17:14:25 +0000 (18:14 +0100)]
Merge branch 'fix/asoc' into for-linus
Peter Ujfalusi [Fri, 23 Jan 2009 08:08:35 +0000 (10:08 +0200)]
ASoC: Add missing comma to SND_SOC_DAPM_SWITCH_E in soc-dapm.h
Typo fix.
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@nokia.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Takashi Iwai [Fri, 23 Jan 2009 07:13:52 +0000 (08:13 +0100)]
Merge branch 'fix/hda' into for-linus
Takashi Iwai [Fri, 23 Jan 2009 07:13:49 +0000 (08:13 +0100)]
Merge branch 'fix/asoc' into for-linus
Matthew Ranostay [Fri, 23 Jan 2009 01:53:29 +0000 (20:53 -0500)]
ALSA: hda: Add STAC92HD83XXX_PWR_REF quirk
Some revisions of the 92hd8xxx codec's not supporting port power
downs in which the using of it causes capture and also randomly
playback streams to not function at all. Thus by disabling it by
default and adding a option to enable it manually will fix all issue
on current and future revisions.
Signed-off-by: Matthew Ranostay <mranostay@embeddedalley.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Matthew Ranostay [Fri, 23 Jan 2009 01:38:42 +0000 (20:38 -0500)]
ALSA: hda: revert change to 92hd83xxx power mapping
Port 0xe power mapping was incorrect set to 0x80 changed to the correct
value 0x40.
Signed-off-by: Matthew Ranostay <mranostay@embeddedalley.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Dan Magenheimer [Thu, 22 Jan 2009 22:36:08 +0000 (14:36 -0800)]
xen: actually release memory when shrinking domain
Fix this:
> It appears that in the upstream balloon driver,
> the call to HYPERVISOR_update_va_mapping is missing
> from decrease_reservation. I think as a result,
> the balloon driver is eating memory but not
> releasing it to Xen, thus rendering the balloon
> driver essentially useless. (Can be observed via xentop.)
Signed-off-by: Dan Magenheimer <dan.magenheimer@oracle.com>
Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Takashi Iwai [Thu, 22 Jan 2009 11:58:11 +0000 (12:58 +0100)]
ALSA: hda - Add model entry for HP dv4
Added model=hp-dv5 for HP dv4 (103c:30f7).
Reference: kernel bug #12440
http://bugzilla.kernel.org/show_bug.cgi?id=12440
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Thomas Gleixner [Thu, 22 Jan 2009 09:03:02 +0000 (10:03 +0100)]
Merge branch 'core/debugobjects' into core/urgent
Thomas Gleixner [Thu, 22 Jan 2009 08:50:44 +0000 (09:50 +0100)]
debugobjects: add and use INIT_WORK_ON_STACK
Impact: Fix debugobjects warning
debugobject enabled kernels spit out a warning in hpet code due to a
workqueue which is initialized on stack.
Add INIT_WORK_ON_STACK() which calls init_timer_on_stack() and use it
in hpet.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Lai Jiangshan [Thu, 22 Jan 2009 01:46:38 +0000 (09:46 +0800)]
rcu: remove duplicate CONFIG_RCU_CPU_STALL_DETECTOR
Impact: remove the old CONFIG_RCU_CPU_STALL_DETECTOR
tree_rcu introduce CONFIG_RCU_CPU_STALL_DETECTOR again.
These two are the same exactly except:
the old one "depends on CLASSIC_RCU"
the new one "depends on CLASSIC_RCU || TREE_RCU"
This patch remove the old one.
Signed-off-by: Lai Jiangshan <laijs@cn.fujitsu.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
H. Peter Anvin [Wed, 21 Jan 2009 23:04:32 +0000 (15:04 -0800)]
x86: unmask CPUID levels on Intel CPUs
Impact: Fixes crashes with misconfigured BIOSes on XSAVE hardware
Avuton Olrich reported early boot crashes with v2.6.28 and
bisected it down to
dc1e35c6e95e8923cf1d3510438b63c600fee1e2
("x86, xsave: enable xsave/xrstor on cpus with xsave support").
If the CPUID limit bit in MSR_IA32_MISC_ENABLE is set, clear it to
make all CPUID information available. This is required for some
features to work, in particular XSAVE.
Reported-and-bisected-by: Avuton Olrich <avuton@gmail.com>
Tested-by: Avuton Olrich <avuton@gmail.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Dave Chinner [Wed, 21 Jan 2009 04:22:17 +0000 (15:22 +1100)]
Long btree pointers are still 64 bit on disk
[XFS] Long btree pointers are still 64 bit on disk
On 32 bit machines with CONFIG_LBD=n, XFS reduces the
in memory size of xfs_fsblock_t to 32 bits so that it
will fit within 32 bit addressing. However, the disk format
for long btree pointers are still 64 bits in size.
The recent btree rewrite failed to take this into account
when initialising new btree blocks, setting sibling pointers
to NULL and checking if they are NULL. Hence checking whether
a 64 bit NULL was the same as a 32 bit NULL was failingi
resulting in NULL sibling pointers failing to be detected
correctly. This showed up as WANT_CORRUPTED_GOTO shutdowns
in xfs_btree_delrec.
Fix this by making all the comparisons and setting of long
pointer btree NULL blocks to the disk format, not the
in memory format. i.e. use NULLDFSBNO.
Reported-by: Alexander Beregalov <a.beregalov@gmail.com>
Reported-by: Jacek Luczak <difrost.kernel@gmail.com>
Reported-by: Danny ter Haar <dth@dth.net>
Tested-by: Jacek Luczak <difrost.kernel@gmail.com>
Reviewed-by: Christoph Hellwig <hch@infradead.org>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Felix Blyakher <felixb@sgi.com>
H. Peter Anvin [Wed, 21 Jan 2009 23:01:56 +0000 (15:01 -0800)]
x86: add MSR_IA32_MISC_ENABLE bits to <asm/msr-index.h>
Impact: None (new bit definitions currently unused)
Add bit definitions for the MSR_IA32_MISC_ENABLE MSRs to
<asm/msr-index.h>.
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Suresh Siddha [Tue, 13 Jan 2009 18:21:30 +0000 (10:21 -0800)]
x86: fix PTE corruption issue while mapping RAM using /dev/mem
Beschorner Daniel reported:
> hwinfo problem since 2.6.28, showing this in the oops:
> Corrupted page table at address
7fd04de3ec00
Also, PaX Team reported a regression with this commit:
> commit
9542ada803198e6eba29d3289abb39ea82047b92
> Author: Suresh Siddha <suresh.b.siddha@intel.com>
> Date: Wed Sep 24 08:53:33 2008 -0700
>
> x86: track memtype for RAM in page struct
This commit breaks mapping any RAM page through /dev/mem, as the
reserve_memtype() was not initializing the return attribute type and as such
corrupting the PTE entry that was setup with the return attribute type.
Because of this bug, application mapping this RAM page through /dev/mem
will die with "Corrupted page table at address xxxx" message in the kernel
log and also the kernel identity mapping which maps the underlying RAM
page gets converted to UC.
Fix this by initializing the return attribute type before calling
reserve_ram_pages_type()
Reported-by: PaX Team <pageexec@freemail.hu>
Reported-and-tested-by: Beschorner Daniel <Daniel.Beschorner@facton.com>
Tested-and-Acked-by: PaX Team <pageexec@freemail.hu>
Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
Signed-off-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Thomas Renninger [Tue, 20 Jan 2009 09:37:39 +0000 (10:37 +0100)]
x86: mtrr fix debug boot parameter
while looking at:
http://bugzilla.kernel.org/show_bug.cgi?id=11541
I realized that the mtrr.show param cannot work, because
the code is processed much too early.
This patch:
- Declares mtrr.show as early_param
- Stays consistent with the previous param (which I doubt
that it ever worked), so mtrr.show=1 would still work
- Declares mtrr_show as initdata
Signed-off-by: Thomas Renninger <trenn@suse.de>
Acked-by: Jan Beulich <jbeulich@novell.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Suresh Siddha [Tue, 20 Jan 2009 22:20:21 +0000 (14:20 -0800)]
x86: fix page attribute corruption with cpa()
Impact: fix sporadic slowdowns and warning messages
This patch fixes a performance issue reported by Linus on his
Nehalem system. While Linus reverted the PAT patch (commit
58dab916dfb57328d50deb0aa9b3fc92efa248ff) which exposed the issue,
existing cpa() code can potentially still cause wrong(page attribute
corruption) behavior.
This patch also fixes the "WARNING: at arch/x86/mm/pageattr.c:560" that
various people reported.
In 64bit kernel, kernel identity mapping might have holes depending
on the available memory and how e820 reports the address range
covering the RAM, ACPI, PCI reserved regions. If there is a 2MB/1GB hole
in the address range that is not listed by e820 entries, kernel identity
mapping will have a corresponding hole in its 1-1 identity mapping.
If cpa() happens on the kernel identity mapping which falls into these holes,
existing code fails like this:
__change_page_attr_set_clr()
__change_page_attr()
returns 0 because of if (!kpte). But doesn't
set cpa->numpages and cpa->pfn.
cpa_process_alias()
uses uninitialized cpa->pfn (random value)
which can potentially lead to changing the page
attribute of kernel text/data, kernel identity
mapping of RAM pages etc. oops!
This bug was easily exposed by another PAT patch which was doing
cpa() more often on kernel identity mapping holes (physical range between
max_low_pfn_mapped and 4GB), where in here it was setting the
cache disable attribute(PCD) for kernel identity mappings aswell.
Fix cpa() to handle the kernel identity mapping holes. Retain
the WARN() for cpa() calls to other not present address ranges
(kernel-text/data, ioremap() addresses)
Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
Signed-off-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
Cc: <stable@kernel.org>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Ingo Molnar [Tue, 20 Jan 2009 08:31:49 +0000 (09:31 +0100)]
Revert "x86: signal: change type of paramter for sys_rt_sigreturn()"
This reverts commit
4217458dafaa57d8e26a46f5d05ab8c53cf64191.
Justin Madru bisected this commit, it was causing weird Firefox
crashes.
The reason is that GCC mis-optimizes (re-uses) the on-stack parameters of
the calling frame, which corrupts the syscall return pt_regs state and
thus corrupts user-space register state.
So we go back to the slightly less clean but more optimization-safe
method of getting to pt_regs. Also add a comment to explain this.
Resolves: http://bugzilla.kernel.org/show_bug.cgi?id=12505
Reported-and-bisected-by: Justin Madru <jdm64@gawab.com>
Tested-by: Justin Madru <jdm64@gawab.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Andi Kleen [Fri, 16 Jan 2009 14:22:11 +0000 (15:22 +0100)]
x86: use early clobbers in usercopy*.c
Impact: fix rare (but currently harmless) miscompile with certain configs and gcc versions
Hugh Dickins noticed that strncpy_from_user() was miscompiled
in some circumstances with gcc 4.3.
Thanks to Hugh's excellent analysis it was easy to track down.
Hugh writes:
> Try building an x86_64 defconfig 2.6.29-rc1 kernel tree,
> except not quite defconfig, switch CONFIG_PREEMPT_NONE=y
> and CONFIG_PREEMPT_VOLUNTARY off (because it expands a
> might_fault() there, which hides the issue): using a
> gcc 4.3.2 (I've checked both openSUSE 11.1 and Fedora 10).
>
> It generates the following:
>
>
0000000000000000 <__strncpy_from_user>:
> 0: 48 89 d1 mov %rdx,%rcx
> 3: 48 85 c9 test %rcx,%rcx
> 6: 74 0e je 16 <__strncpy_from_user+0x16>
> 8: ac lods %ds:(%rsi),%al
> 9: aa stos %al,%es:(%rdi)
> a: 84 c0 test %al,%al
> c: 74 05 je 13 <__strncpy_from_user+0x13>
> e: 48 ff c9 dec %rcx
> 11: 75 f5 jne 8 <__strncpy_from_user+0x8>
> 13: 48 29 c9 sub %rcx,%rcx
> 16: 48 89 c8 mov %rcx,%rax
> 19: c3 retq
>
> Observe that "sub %rcx,%rcx; mov %rcx,%rax", whereas gcc 4.2.1
> (and many other configs) say "sub %rcx,%rdx; mov %rdx,%rax".
> Isn't it returning 0 when it ought to be returning strlen?
The asm constraints for the strncpy_from_user() result were missing an
early clobber, which tells gcc that the last output arguments
are written before all input arguments are read.
Also add more early clobbers in the rest of the file and fix 32-bit
usercopy.c in the same way.
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
[ since this API is rarely used and no in-kernel user relies on a 'len'
return value (they only rely on negative return values) this miscompile
was never noticed in the field. But it's worth fixing it nevertheless. ]
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Matthew Ranostay [Tue, 20 Jan 2009 21:50:25 +0000 (16:50 -0500)]
ALSA: hda: 83xxx port 0xe DAC selection
On the 92hd8xxx codecs port 0xe needs the connection selected to be the
last DAC in the list.
Signed-off-by: Matthew Ranostay <mranostay@embeddedalley.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Timur Tabi [Mon, 19 Jan 2009 23:14:24 +0000 (17:14 -0600)]
ASoC: fix registration of the SoC card in the Freescale MPC8610 drivers
The Freescale MPC8610 driver was defining two SOC card (snd_soc_card)
structures, partially initializing each one, but registering only one of
them with ASoC.
Signed-off-by: Timur Tabi <timur@freescale.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Gary Hade [Mon, 19 Jan 2009 21:46:41 +0000 (13:46 -0800)]
x86: remove kernel_physical_mapping_init() from init section
Impact: fix crash with memory hotplug enabled
kernel_physical_mapping_init() is called during memory hotplug
so it does not belong in the init section.
If the kernel is built with CONFIG_DEBUG_SECTION_MISMATCH=y on
the make command line, arch/x86/mm/init_64.c is compiled with
the -fno-inline-functions-called-once gcc option defeating
inlining of kernel_physical_mapping_init() within init_memory_mapping().
When kernel_physical_mapping_init() is not inlined it is placed
in the .init.text section according to the __init in it's current
declaration. A later call to kernel_physical_mapping_init() during
a memory hotplug operation encounters an int3 trap because the
.init.text section memory has been freed.
This patch eliminates the crash caused by the int3 trap by moving the
non-inlined kernel_physical_mapping_init() from .init.text to .meminit.text.
Signed-off-by: Gary Hade <garyhade@us.ibm.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Ingo Molnar [Thu, 15 Jan 2009 14:46:08 +0000 (15:46 +0100)]
fix: crash: IP: __bitmap_intersects+0x48/0x73
-tip testing found this crash:
> [ 35.258515] calling acpi_cpufreq_init+0x0/0x127 @ 1
> [ 35.264127] BUG: unable to handle kernel NULL pointer dereference at (null)
> [ 35.267554] IP: [<
ffffffff80478092>] __bitmap_intersects+0x48/0x73
> [ 35.267554] PGD 0
> [ 35.267554] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c is still broken: there's no
allocation of the variable mask, so we pass in an uninitialized cmd.mask
field to drv_read(), which then passes it to the scheduler which then
crashes ...
Switch it over to the much simpler constant-cpumask-pointers approach.
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Mike Travis [Fri, 16 Jan 2009 23:31:15 +0000 (15:31 -0800)]
cpufreq: use work_on_cpu in acpi-cpufreq.c for drv_read and drv_write
Impact: use new work_on_cpu function to reduce stack usage
Replace the saving of current->cpus_allowed and set_cpus_allowed_ptr() with
a work_on_cpu function for drv_read() and drv_write().
Basically converts do_drv_{read,write} into "work_on_cpu" functions that
are now called by drv_read and drv_write.
Note: This patch basically reverts
50c668d6 which reverted
7503bfba, now
that the work_on_cpu() function is more stable.
Signed-off-by: Mike Travis <travis@sgi.com>
Acked-by: Rusty Russell <rusty@rustcorp.com.au>
Tested-by: Dieter Ries <clip2@gmx.de>
Tested-by: Maciej Rutecki <maciej.rutecki@gmail.com>
Cc: Dave Jones <davej@redhat.com>
Cc: <cpufreq@vger.kernel.org>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Rusty Russell [Fri, 16 Jan 2009 23:31:15 +0000 (15:31 -0800)]
work_on_cpu: Use our own workqueue.
Impact: remove potential clashes with generic kevent workqueue
Annoyingly, some places we want to use work_on_cpu are already in
workqueues. As per Ingo's suggestion, we create a different workqueue
for work_on_cpu.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Mike Travis <travis@sgi.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Rusty Russell [Fri, 16 Jan 2009 23:31:15 +0000 (15:31 -0800)]
work_on_cpu: don't try to get_online_cpus() in work_on_cpu.
Impact: remove potential circular lock dependency with cpu hotplug lock
This has caused more problems than it solved, with a pile of cpu
hotplug locking issues.
Followup patches will get_online_cpus() in callers that need it, but
if they don't do it they're no worse than before when they were using
set_cpus_allowed without locking.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Mike Travis <travis@sgi.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Takashi Iwai [Mon, 19 Jan 2009 13:08:25 +0000 (14:08 +0100)]
Merge branch 'topic/virtuoso' into for-linus
Clemens Ladisch [Mon, 19 Jan 2009 09:08:38 +0000 (10:08 +0100)]
sound: virtuoso: document HDAV1.3 driver status
Mention in the Kconfig help text that the HDAV1.3 code is rather
experimental.
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Clemens Ladisch [Mon, 19 Jan 2009 09:07:58 +0000 (10:07 +0100)]
sound: virtuoso: add newline
Add a missing newline.
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Clemens Ladisch [Mon, 19 Jan 2009 09:07:21 +0000 (10:07 +0100)]
sound: virtuoso: enable UART on Xonar HDAV1.3
This hardware has a better chance of working correctly if we don't
forget to enable it.
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
David Brownell [Mon, 19 Jan 2009 12:46:57 +0000 (13:46 +0100)]
drivers/ide/palm_bk3710.c buildfix
CC drivers/ide/palm_bk3710.o
drivers/ide/palm_bk3710.c: In function 'palm_bk3710_probe':
drivers/ide/palm_bk3710.c:382: warning: assignment makes integer from pointer without a cast
Someone should fix hw_regs_t to neither be a typedef, nor
use "unsigned long" where it should use "void __iomem *".
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Cc: Kevin Hilman <khilman@deeprootsystems.com>
Cc: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Michael Schmitz [Mon, 19 Jan 2009 12:46:56 +0000 (13:46 +0100)]
ide: fix Falcon IDE breakage
[m68k] Falcon IDE: always serialize, in order to force execution of
ide_get_lock() and friends.
Signed-off-By: Michael Schmitz <schmitz@debian.org>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
[bart: set flag in falconide_port_info instead of falconide_init()]
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Andreas Schwab [Mon, 19 Jan 2009 12:46:56 +0000 (13:46 +0100)]
ide: fix IDE PMAC breakage
Bartlomiej Zolnierkiewicz <bzolnier@gmail.com> writes:
> Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
> ---
> drivers/ide/ide-probe.c | 9 ++-------
> 1 file changed, 2 insertions(+), 7 deletions(-)
>
> Index: b/drivers/ide/ide-probe.c
> ===================================================================
> --- a/drivers/ide/ide-probe.c
> +++ b/drivers/ide/ide-probe.c
> @@ -640,14 +640,9 @@ static int ide_register_port(ide_hwif_t
> /* register with global device tree */
> dev_set_name(&hwif->gendev, hwif->name);
> hwif->gendev.driver_data = hwif;
> - if (hwif->gendev.parent == NULL) {
> - if (hwif->dev)
> - hwif->gendev.parent = hwif->dev;
> - else
> - /* Would like to do = &device_legacy */
> - hwif->gendev.parent = NULL;
> - }
> + hwif->gendev.parent = hwif->dev;
This [bart: commit
96d40941236722777c259775640b8880b7dc6f33 ("ide: small
ide_register_port() cleanup")] breaks ide-pmac. It overwrites the parent
that pmac_ide_macio_attach has set.
Signed-off-by: Andreas Schwab <schwab@suse.de>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Eric Sandeen [Thu, 15 Jan 2009 05:22:07 +0000 (23:22 -0600)]
[XFS] Remove the rest of the macro-to-function indirections.
Remove the last of the macros-defined-to-static-functions.
Signed-off-by: Eric Sandeen <sandeen@sandeen.net>
Reviewed-by: Christoph Hellwig <hch@infradead.org>
Signed-off-by: Lachlan McIlroy <lachlan@sgi.com>
Christoph Hellwig [Mon, 19 Jan 2009 01:04:16 +0000 (02:04 +0100)]
xfs: sanity check attr fork size
Recently we have quite a few kerneloops reports about dereferencing a NULL
if_data in the attribute fork. From looking over the code this can only
happen if we pass a 0 size argument to xfs_iformat_local. This implies some
sort of corruption and in fact the only mailinglist report about this from
earlier this year was after a powerfail presumably on a system with write
cache and without barriers.
Add a quick sanity check for the attr fork size in xfs_iformat to catch
these early and without an oops.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Dave Chinner <david@fromorbit.com>
Christoph Hellwig [Mon, 19 Jan 2009 01:04:07 +0000 (02:04 +0100)]
xfs: fix bad_features2 fixups for the root filesystem
Currently the bad_features2 fixup and the alignment updates in the superblock
are skipped if we mount a filesystem read-only. But for the root filesystem
the typical case is to mount read-only first and only later remount writeable
so we'll never perform this update at all. It's not a big problem but means
the logs of people needing the fixup get spammed at every boot because they
never happen on disk.
Reported-by: Arkadiusz Miskiewicz <arekm@maven.pl>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Dave Chinner <david@fromorbit.com>
Christoph Hellwig [Mon, 19 Jan 2009 01:03:25 +0000 (02:03 +0100)]
xfs: add a lock class for group/project dquots
We can have both a user and a group/project dquot locked at the same time,
as long as the user dquot is locked first. Tell lockdep about that fact
by making the group/project dquots a different lock class.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Dave Chinner <david@fromorbit.com>
Christoph Hellwig [Mon, 19 Jan 2009 01:03:19 +0000 (02:03 +0100)]
xfs: lockdep annotations for xfs_dqlock2
xfs_dqlock2 locks two xfs_dquots, which is fine as it always locks the
dquot with the lower id first. Use mutex_lock_nested to tell lockdep
about this fact.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Dave Chinner <david@fromorbit.com>
Christoph Hellwig [Mon, 19 Jan 2009 01:03:11 +0000 (02:03 +0100)]
xfs: add a separate lock class for the per-mount list of dquots
We can have both a a quota hash chain and the per-mount list locked at
the same time. But given that both use the same struct dqhash as list
head we have to tell lockdep that they are different lock classes.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Dave Chinner <david@fromorbit.com>
Christoph Hellwig [Mon, 19 Jan 2009 01:03:03 +0000 (02:03 +0100)]
xfs: use mnt_want_write in compat_attrmulti ioctl
The compat version of the attrmulti ioctl needs to ask for and then
later release write access to the mount just like the native version,
otherwise we could potentially write to read-only mounts.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Dave Chinner <david@fromorbit.com>
Christoph Hellwig [Mon, 19 Jan 2009 01:02:57 +0000 (02:02 +0100)]
xfs: fix dentry aliasing issues in open_by_handle
Open by handle just grabs an inode by handle and then creates itself
a dentry for it. While this works for regular files it is horribly
broken for directories, where the VFS locking relies on the fact that
there is only just one single dentry for a given inode, and that
these are always connected to the root of the filesystem so that
it's locking algorithms work (see Documentations/filesystems/Locking)
Remove all the existing open by handle code and replace it with a small
wrapper around the exportfs code which deals with all these issues.
At the same time we also make the checks for a valid handle strict
enough to reject all not perfectly well formed handles - given that
we never hand out others that's okay and simplifies the code.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Dave Chinner <david@fromorbit.com>
Leonardo Potenza [Sun, 18 Jan 2009 22:03:56 +0000 (23:03 +0100)]
x86: fix section mismatch warnings in kernel/setup_percpu.c
The function setup_cpu_local_masks() has been marked __init, in
order to remove the following section mismatch messages:
WARNING: vmlinux.o(.text+0x3c2c7): Section mismatch in reference from the function setup_cpu_local_masks() to the function .init.text:alloc_bootmem_cpumask_var()
The function setup_cpu_local_masks() references
the function __init alloc_bootmem_cpumask_var().
This is often because setup_cpu_local_masks lacks a __init
annotation or the annotation of alloc_bootmem_cpumask_var is wrong.
WARNING: vmlinux.o(.text+0x3c2d3): Section mismatch in reference from the function setup_cpu_local_masks() to the function .init.text:alloc_bootmem_cpumask_var()
The function setup_cpu_local_masks() references
the function __init alloc_bootmem_cpumask_var().
This is often because setup_cpu_local_masks lacks a __init
annotation or the annotation of alloc_bootmem_cpumask_var is wrong.
WARNING: vmlinux.o(.text+0x3c2df): Section mismatch in reference from the function setup_cpu_local_masks() to the function .init.text:alloc_bootmem_cpumask_var()
The function setup_cpu_local_masks() references
the function __init alloc_bootmem_cpumask_var().
This is often because setup_cpu_local_masks lacks a __init
annotation or the annotation of alloc_bootmem_cpumask_var is wrong.
WARNING: vmlinux.o(.text+0x3c2eb): Section mismatch in reference from the function setup_cpu_local_masks() to the function .init.text:alloc_bootmem_cpumask_var()
The function setup_cpu_local_masks() references
the function __init alloc_bootmem_cpumask_var().
This is often because setup_cpu_local_masks lacks a __init
annotation or the annotation of alloc_bootmem_cpumask_var is wrong.
Signed-off-by: Leonardo Potenza <lpotenza@inwind.it>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Peter Zijlstra [Sun, 18 Jan 2009 15:39:29 +0000 (16:39 +0100)]
hrtimers: fix inconsistent lock state on resume in hres_timers_resume
Andrey Borzenkov reported this lockdep assert:
> [17854.688347] =================================
> [17854.688347] [ INFO: inconsistent lock state ]
> [17854.688347] 2.6.29-rc2-1avb #1
> [17854.688347] ---------------------------------
> [17854.688347] inconsistent {in-hardirq-W} -> {hardirq-on-W} usage.
> [17854.688347] pm-suspend/18240 [HC0[0]:SC0[0]:HE1:SE1] takes:
> [17854.688347] (&cpu_base->lock){++..}, at: [<
c0136fcc>] retrigger_next_event+0x5c/0xa0
> [17854.688347] {in-hardirq-W} state was registered at:
> [17854.688347] [<
c01443cd>] __lock_acquire+0x79d/0x1930
> [17854.688347] [<
c01455bc>] lock_acquire+0x5c/0x80
> [17854.688347] [<
c03092e5>] _spin_lock+0x35/0x70
> [17854.688347] [<
c0136e61>] hrtimer_run_queues+0x31/0x140
> [17854.688347] [<
c0128d98>] run_local_timers+0x8/0x20
> [17854.688347] [<
c0128dd3>] update_process_times+0x23/0x60
> [17854.688347] [<
c013e274>] tick_periodic+0x24/0x80
> [17854.688347] [<
c013e2e2>] tick_handle_periodic+0x12/0x70
> [17854.688347] [<
c0104e24>] timer_interrupt+0x14/0x20
> [17854.688347] [<
c01607b9>] handle_IRQ_event+0x29/0x60
> [17854.688347] [<
c0161c59>] handle_level_irq+0x69/0xe0
> [17854.688347] [<
ffffffff>] 0xffffffff
> [17854.688347] irq event stamp: 55771
> [17854.688347] hardirqs last enabled at (55771): [<
c0309125>] _spin_unlock_irqrestore+0x35/0x60
> [17854.688347] hardirqs last disabled at (55770): [<
c0309419>] _spin_lock_irqsave+0x19/0x80
> [17854.688347] softirqs last enabled at (54836): [<
c0124f54>] __do_softirq+0xc4/0x110
> [17854.688347] softirqs last disabled at (54831): [<
c01049ae>] do_softirq+0x8e/0xe0
> [17854.688347]
> [17854.688347] other info that might help us debug this:
> [17854.688347] 3 locks held by pm-suspend/18240:
> [17854.688347] #0: (&buffer->mutex){--..}, at: [<
c01dd4c5>] sysfs_write_file+0x25/0x100
> [17854.688347] #1: (pm_mutex){--..}, at: [<
c015056f>] enter_state+0x4f/0x140
> [17854.688347] #2: (dpm_list_mtx){--..}, at: [<
c027880f>] device_pm_lock+0xf/0x20
> [17854.688347]
> [17854.688347] stack backtrace:
> [17854.688347] Pid: 18240, comm: pm-suspend Not tainted 2.6.29-rc2-1avb #1
> [17854.688347] Call Trace:
> [17854.688347] [<
c0306248>] ? printk+0x18/0x20
> [17854.688347] [<
c0141fac>] print_usage_bug+0x16c/0x1d0
> [17854.688347] [<
c0142bcf>] mark_lock+0x8bf/0xc90
> [17854.688347] [<
c0106b8f>] ? pit_next_event+0x2f/0x40
> [17854.688347] [<
c01441b0>] __lock_acquire+0x580/0x1930
> [17854.688347] [<
c030916d>] ? _spin_unlock+0x1d/0x20
> [17854.688347] [<
c0106b8f>] ? pit_next_event+0x2f/0x40
> [17854.688347] [<
c013dd38>] ? clockevents_program_event+0x98/0x160
> [17854.688347] [<
c0142fe8>] ? mark_held_locks+0x48/0x90
> [17854.688347] [<
c0309125>] ? _spin_unlock_irqrestore+0x35/0x60
> [17854.688347] [<
c0143229>] ? trace_hardirqs_on_caller+0x139/0x190
> [17854.688347] [<
c014328b>] ? trace_hardirqs_on+0xb/0x10
> [17854.688347] [<
c01455bc>] lock_acquire+0x5c/0x80
> [17854.688347] [<
c0136fcc>] ? retrigger_next_event+0x5c/0xa0
> [17854.688347] [<
c03092e5>] _spin_lock+0x35/0x70
> [17854.688347] [<
c0136fcc>] ? retrigger_next_event+0x5c/0xa0
> [17854.688347] [<
c0136fcc>] retrigger_next_event+0x5c/0xa0
> [17854.688347] [<
c013711a>] hres_timers_resume+0xa/0x10
> [17854.688347] [<
c013aa8e>] timekeeping_resume+0xee/0x150
> [17854.688347] [<
c0273384>] __sysdev_resume+0x14/0x50
> [17854.688347] [<
c0273407>] sysdev_resume+0x47/0x80
> [17854.688347] [<
c02791ab>] device_power_up+0xb/0x20
> [17854.688347] [<
c015043f>] suspend_devices_and_enter+0xcf/0x150
> [17854.688347] [<
c0150c2f>] ? freeze_processes+0x3f/0x90
> [17854.688347] [<
c0150614>] enter_state+0xf4/0x140
> [17854.688347] [<
c01506dd>] state_store+0x7d/0xc0
> [17854.688347] [<
c0150660>] ? state_store+0x0/0xc0
> [17854.688347] [<
c0202da4>] kobj_attr_store+0x24/0x30
> [17854.688347] [<
c01dd53c>] sysfs_write_file+0x9c/0x100
> [17854.688347] [<
c019916c>] vfs_write+0x9c/0x160
> [17854.688347] [<
c0103494>] ? restore_nocheck_notrace+0x0/0xe
> [17854.688347] [<
c01dd4a0>] ? sysfs_write_file+0x0/0x100
> [17854.688347] [<
c01992ed>] sys_write+0x3d/0x70
> [17854.688347] [<
c0103371>] sysenter_do_call+0x12/0x31
Andrey's analysis:
> timekeeping_resume() is called via class ->resume
> method; and according to comments in sysdev_resume() and
> device_power_up(), they are called with interrupts disabled.
>
> Looking at suspend_enter, irqs *are* disabled at this point.
>
> So it actually looks like something (may be some driver)
> unconditionally enabled irqs in resume path.
Add a debug check to test this theory. If it triggers then it
triggers because the resume code calls it with irqs enabled,
which is a no-no not just for timekeeping_resume(), but also
bad for a number of other resume handlers.
Reported-by: Andrey Borzenkov <arvidjaar@mail.ru>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Mike Travis [Fri, 16 Jan 2009 23:22:16 +0000 (15:22 -0800)]
x86: put trigger in to detect mismatched apic versions
Impact: add debug warning
Fire off one message if two apic's discovered with different
apic versions. (this code is only called during CPU init)
The goal of this is to pave the way of the removal of the apic_version[]
array. We dont expect any apic version incompatibilities in the x86
landscape of systems [if so we dont handle them very well and probably
never will handle deep apic version assymetries well], but it's prudent
to have a debug check for one kernel cycle nevertheless.
Signed-off-by: Mike Travis <travis@sgi.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Jeff Mahoney [Fri, 16 Jan 2009 18:23:35 +0000 (13:23 -0500)]
x86: define ARCH_WANT_FRAME_POINTERS
Commit
da4276b8299a6544dc41ac2485d3ffca5811b3fb changed a dependency
for FRAME_POINTER from X86 to ARCH_WANT_FRAME_POINTERS, but didn't
actually define it.
This patch adds the definition for ARCH_WANT_FRAME_POINTERS. Without it,
FRAME_POINTER can't be enabled on x86.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Jiri Slaby [Sat, 17 Jan 2009 11:04:36 +0000 (12:04 +0100)]
relay: fix lock imbalance in relay_late_setup_files
One fail path in relay_late_setup_files() omits
mutex_unlock(&relay_channels_mutex);
Add it.
Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Takashi Iwai [Sun, 18 Jan 2009 10:06:41 +0000 (11:06 +0100)]
Merge branch 'topic/oss-cleanup' into for-linus
Takashi Iwai [Sun, 18 Jan 2009 10:06:37 +0000 (11:06 +0100)]
Merge branch 'topic/hda' into for-linus
Henrik Kretzschmar [Sun, 18 Jan 2009 09:40:24 +0000 (10:40 +0100)]
sound: Remove removed OSS kernel parameters from doc
Remove removed OSS kernel parameters from kernel-parameters.txt
Remove the kernel parameters from the OSS drivers of the chips
es1371 (removed 10-2007/2.6.24) and
cs4232 (removed 02-2008/2.6.25) from the kernel parameters documentation.
Signed-off-by: Henrik Kretzschmar <henne@nachtwindheim.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Matthew Ranostay [Sat, 17 Jan 2009 23:47:27 +0000 (18:47 -0500)]
ALSA: hda: fix invalid power mapping masks
Fixed invalid power mappings for ports 0xd and 0xe on 93hd83xxx codecs.
They were shifted right one too many bits.
Signed-off-by: Matthew Ranostay <mranostay@embeddedalley.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Linus Torvalds [Sat, 17 Jan 2009 22:28:53 +0000 (14:28 -0800)]
Merge branch 'for-linus' of git://git./linux/kernel/git/roland/infiniband
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
IB/ehca: Use consistent types for ehca_plpar_hcall9()
IB/ehca: Fix printk format warnings from u64 type change
IPoIB: Do not print error messages for multicast join retries
IB/mlx4: Fix memory ordering problem when posting LSO sends
mlx4_core: Fix min() warning
IPoIB: Fix deadlock between ipoib_open() and child interface create
IPoIB: Fix hang in napi_disable() if P_Key is never found
Linus Torvalds [Sat, 17 Jan 2009 22:28:23 +0000 (14:28 -0800)]
Merge branch 'for-linus' of git://git./linux/kernel/git/lrg/voltage-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lrg/voltage-2.6:
move wm8400-regulator's probe function to .devinit.text
Pavel Roskin [Sat, 17 Jan 2009 18:33:03 +0000 (13:33 -0500)]
dell_rbu: use scnprintf() instead of less secure sprintf()
Reading 0 bytes from /sys/devices/platform/dell_rbu/image_type or
/sys/devices/platform/dell_rbu/packet_size by an ordinary user causes an
oops.
Signed-off-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Vegard Nossum [Sat, 17 Jan 2009 16:45:45 +0000 (17:45 +0100)]
security: introduce missing kfree
Plug this leak.
Acked-by: David Howells <dhowells@redhat.com>
Cc: James Morris <jmorris@namei.org>
Cc: <stable@kernel.org>
Signed-off-by: Vegard Nossum <vegard.nossum@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Robert Richter [Sat, 17 Jan 2009 16:13:27 +0000 (17:13 +0100)]
oprofile: fix uninitialized use of struct op_entry
Impact: fix crash
In case of losing samples struct op_entry could have been used
uninitialized causing e.g. a wrong preemption count or NULL pointer
access. This patch fixes this.
Signed-off-by: Robert Richter <robert.richter@amd.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Uwe Kleine-König [Mon, 12 Jan 2009 22:25:05 +0000 (23:25 +0100)]
move wm8400-regulator's probe function to .devinit.text
A pointer to wm8400_regulator_probe is passed to the core via
platform_driver_register and so the function must not disappear when the
.init sections are discarded. Otherwise (if also having HOTPLUG=y)
unbinding and binding a device to the driver via sysfs will result in an
oops as does a device being registered late.
An alternative to this patch is using platform_driver_probe instead of
platform_driver_register plus removing the pointer to the probe function
from the struct platform_driver.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
Takashi Iwai [Sat, 17 Jan 2009 11:10:17 +0000 (12:10 +0100)]
Merge branch 'topic/hda' into for-linus
Takashi Iwai [Sat, 17 Jan 2009 11:10:13 +0000 (12:10 +0100)]
Merge branch 'topic/asoc' into for-linus
Roland Dreier [Fri, 16 Jan 2009 23:05:54 +0000 (15:05 -0800)]
Merge branches 'ehca', 'ipoib' and 'mlx4' into for-linus
Stephen Rothwell [Fri, 16 Jan 2009 22:55:40 +0000 (14:55 -0800)]
IB/ehca: Use consistent types for ehca_plpar_hcall9()
ehca_plpar_hcall9() takes an unsigned long array, so make all callers
pass that in. This fixes warnings introduced by commit
fe333321
("powerpc: Change u64/s64 to a long long integer type"), which changed
u64 from unsigned long to unsigned long long.
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Stephen Rothwell [Fri, 16 Jan 2009 22:55:28 +0000 (14:55 -0800)]
IB/ehca: Fix printk format warnings from u64 type change
Commit
fe333321 ("powerpc: Change u64/s64 to a long long integer
type") changed u64 from unsigned long to unsigned long long, which
means that printk formats for printing u64 values should use "ll"
instead of "l" to avoid warnings. Fix all the places affected by this
in ehca.
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Yossi Etigin [Fri, 16 Jan 2009 21:42:59 +0000 (13:42 -0800)]
IPoIB: Do not print error messages for multicast join retries
When IPoIB tries to join a multicast group, and the SA module's SM
address handle is NULL (because of an SM change, etc), the join
returns with -EAGAIN status. In that case, don't print an error
message unless multicast debugging is enabled.
Signed-off-by: Yossi Etigin <yosefe@voltaire.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Roland Dreier [Fri, 16 Jan 2009 20:47:47 +0000 (12:47 -0800)]
IB/mlx4: Fix memory ordering problem when posting LSO sends
The current work request posting code writes the LSO segment before
writing any data segments. This leaves a window where the LSO segment
overwrites the stamping in one cacheline that the HCA prefetches
before the rest of the cacheline is filled with the correct data
segments. When the HCA processes this work request, a local
protection error may result.
Fix this by saving the LSO header size field off and writing it only
after all data segments are written. This fix is a cleaned-up version
of a patch from Jack Morgenstein <jackm@dev.mellanox.co.il>.
This fixes <https://bugs.openfabrics.org/show_bug.cgi?id=1383>.
Reported-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Linus Torvalds [Fri, 16 Jan 2009 20:43:00 +0000 (12:43 -0800)]
Linux 2.6.29-rc2
Linus Torvalds [Fri, 16 Jan 2009 20:40:37 +0000 (12:40 -0800)]
Merge branch 'release' of git://git./linux/kernel/git/lenb/linux-acpi-2.6
* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6: (23 commits)
ACPI PCI hotplug: harden against panic regression
ACPI: rename main.c to sleep.c
dell-laptop: move to drivers/platform/x86/ from drivers/misc/
eeepc-laptop: enable Bluetooth ACPI details
ACPI: fix ACPI_FADT_S4_RTC_WAKE comment
kprobes: check CONFIG_FREEZER instead of CONFIG_PM
PM: Fix freezer compilation if PM_SLEEP is unset
thermal fixup for broken BIOS which has invalid trip points.
ACPI: EC: Don't trust ECDT tables from ASUS
ACPI: EC: Limit workaround for ASUS notebooks even more
ACPI: thinkpad-acpi: bump up version to 0.22
ACPI: thinkpad-acpi: handle HKEY event 6030
ACPI: thinkpad-acpi: clean-up fan subdriver quirk
ACPI: thinkpad-acpi: start the event hunt season
ACPI: thinkpad-acpi: handle HKEY thermal and battery alarms
ACPI: thinkpad-acpi: clean up hotkey_notify()
ACPI: thinkpad-acpi: use killable instead of interruptible mutexes
ACPI: thinkpad-acpi: add UWB radio support
ACPI: thinkpad-acpi: preserve radio state across shutdown
ACPI: thinkpad-acpi: resume with radios disabled
...
Linus Torvalds [Fri, 16 Jan 2009 20:40:11 +0000 (12:40 -0800)]
Merge git://git./linux/kernel/git/davem/net-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
netxen: include ipv6.h (fixes build failure)
netxen: avoid invalid iounmap
James Bottomley [Thu, 15 Jan 2009 20:12:27 +0000 (15:12 -0500)]
ACPI PCI hotplug: harden against panic regression
ACPI hotplug panic with current git head
http://lkml.org/lkml/2009/1/10/136
Rather than reverting the entire commit that causes the crash:
e8c331e963c58b83db24b7d0e39e8c07f687dbc6
"PCI hotplug: introduce functions for ACPI slot detection"
simply harden against it while the changes to
the hotplug code on this particularl machine are understood.
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Len Brown <len.brown@intel.com>
Len Brown [Fri, 16 Jan 2009 19:45:34 +0000 (14:45 -0500)]
Merge branch 'misc' into release
Len Brown [Fri, 16 Jan 2009 19:45:24 +0000 (14:45 -0500)]
Merge branch 'thinkpad-acpi' into release
Len Brown [Fri, 16 Jan 2009 19:45:11 +0000 (14:45 -0500)]
Merge branches 'bugzilla-11884' and 'bugzilla-8544' into release
Len Brown [Fri, 16 Jan 2009 18:52:03 +0000 (13:52 -0500)]
ACPI: rename main.c to sleep.c
Signed-off-by: Len Brown <len.brown@intel.com>
Len Brown [Fri, 9 Jan 2009 22:23:38 +0000 (17:23 -0500)]
dell-laptop: move to drivers/platform/x86/ from drivers/misc/
Signed-off-by: Len Brown <len.brown@intel.com>
Jonathan McDowell [Wed, 3 Dec 2008 20:31:11 +0000 (20:31 +0000)]
eeepc-laptop: enable Bluetooth ACPI details
Although rfkill support for the EEE bluetooth device has been added to
2.6.28-rc the appropriate ACPI accessor definitions were not added, so
the support was non functional. The patch below adds the get and set
accessors and has been verified to work on an EEE 901.
Signed-off-by: Jonathan McDowell <noodles@earth.li>
Acked-by: Matthew Garrett <mjg@redhat.com>
Acked-by: Corentin Chary <corentincj@iksaif.net>
Signed-off-by: Len Brown <len.brown@intel.com>
David Brownell [Fri, 9 Jan 2009 20:17:08 +0000 (12:17 -0800)]
ACPI: fix ACPI_FADT_S4_RTC_WAKE comment
Make the comment for ACPI_FADT_S4_RTC_WAKE match the ACPI spec;
that bit has nothing to do with status bits.
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Len Brown <len.brown@intel.com>
Masami Hiramatsu [Tue, 6 Jan 2009 20:15:32 +0000 (21:15 +0100)]
kprobes: check CONFIG_FREEZER instead of CONFIG_PM
Check CONFIG_FREEZER instead of CONFIG_PM because kprobe booster
depends on freeze_processes() and thaw_processes() when CONFIG_PREEMPT=y.
This fixes a linkage error which occurs when CONFIG_PREEMPT=y, CONFIG_PM=y
and CONFIG_FREEZER=n.
Reported-by: Cheng Renquan <crquan@gmail.com>
Signed-off-by: Masami Hiramatsu <mhiramat@redhat.com>
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Acked-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Len Brown <len.brown@intel.com>
Rafael J. Wysocki [Tue, 6 Jan 2009 20:14:04 +0000 (21:14 +0100)]
PM: Fix freezer compilation if PM_SLEEP is unset
Freezer fails to compile if with the following configuration
settings:
CONFIG_CGROUPS=y
CONFIG_CGROUP_FREEZER=y
CONFIG_MODULES=y
CONFIG_FREEZER=y
CONFIG_PM=y
CONFIG_PM_SLEEP=n
Fix this by making process.o compilation depend on CONFIG_FREEZER.
Reported-by: Cheng Renquan <crquan@gmail.com>
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Acked-by: Pavel Machek <pavel@suse.cz>
Signed-off-by: Len Brown <len.brown@intel.com>
Zhang Rui [Fri, 16 Jan 2009 17:53:42 +0000 (12:53 -0500)]
thermal fixup for broken BIOS which has invalid trip points.
ACPI thermal driver only re-evaluate VALID trip points.
For the broken BIOS show in
http://bugzilla.kernel.org/show_bug.cgi?id=8544
the active[0] is set to invalid at boot time
and it will not be re-evaluated again.
We can still get a single warning message at boot time.
http://marc.info/?l=linux-kernel&m=
120496222629983&w=2
http://bugzilla.kernel.org/show_bug.cgi?id=12203
Signed-off-by: Zhang Rui<rui.zhang@intel.com>
Tested-by: Márton Németh <nm127@freemail.hu>
Signed-off-by: Len Brown <len.brown@intel.com>
Dhananjay Phadke [Fri, 16 Jan 2009 19:03:25 +0000 (11:03 -0800)]
netxen: include ipv6.h (fixes build failure)
Fixes a build error in absence of CONFIG_IPV6:
drivers/net/netxen/netxen_nic_main.c:1189: error: implicit declaration of function 'ipv6_hdr'
drivers/net/netxen/netxen_nic_main.c:1189: error: invalid type argument of '->'
Reported-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Dhananjay Phadke <dhananjay@netxen.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Alexey Starikovskiy [Tue, 13 Jan 2009 23:57:53 +0000 (02:57 +0300)]
ACPI: EC: Don't trust ECDT tables from ASUS
http://bugzilla.kernel.org/show_bug.cgi?id=9399
http://bugzilla.kernel.org/show_bug.cgi?id=11880
Signed-off-by: Alexey Starikovskiy <astarikovskiy@suse.de>
Signed-off-by: Len Brown <len.brown@intel.com>