1. 23 Sep, 2012 18 commits
    • Paul E. McKenney's avatar
      rcu: Fix CONFIG_RCU_FAST_NO_HZ stall warning message · 86f343b5
      Paul E. McKenney authored
      The print_cpu_stall_fast_no_hz() function attempts to print -1 when
      the ->idle_gp_timer is not pending, but unsigned arithmetic causes it
      to instead print ULONG_MAX, which is 4294967295 on 32-bit systems and
      18446744073709551615 on 64-bit systems.  Neither of these are the most
      reader-friendly values, so this commit instead causes "timer not pending"
      to be printed when ->idle_gp_timer is not pending.
      Reported-by: default avatarPaul Walmsley <paul@pwsan.com>
      Signed-off-by: default avatarPaul E. McKenney <paul.mckenney@linaro.org>
      Signed-off-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      86f343b5
    • Li Zhong's avatar
      rcu: Move TINY_RCU quiescent state out of extended quiescent state · 22a76726
      Li Zhong authored
      TINY_RCU's rcu_idle_enter_common() invokes rcu_sched_qs() in order
      to inform the RCU core of the quiescent state implied by idle entry.
      Of course, idle is also an extended quiescent state, so that the call
      to rcu_sched_qs() speeds up RCU's invoking of any callbacks that might
      be queued.  This speed-up is important when entering into dyntick-idle
      mode -- if there are no further scheduling-clock interrupts, the callbacks
      might never be invoked, which could result in a system hang.
      
      However, processing callbacks does event tracing, which in turn
      implies RCU read-side critical sections, which are illegal in extended
      quiescent states.  This patch therefore moves the call to rcu_sched_qs()
      so that it precedes the point at which we inform lockdep that RCU has
      entered an extended quiescent state.
      Signed-off-by: default avatarLi Zhong <zhong@linux.vnet.ibm.com>
      Signed-off-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      22a76726
    • Michael Wang's avatar
      kmemleak: Replace list_for_each_continue_rcu with new interface · 58fac095
      Michael Wang authored
      This patch replaces list_for_each_continue_rcu() with
      list_for_each_entry_continue_rcu() to save a few lines
      of code and allow removing list_for_each_continue_rcu().
      Signed-off-by: default avatarMichael Wang <wangyun@linux.vnet.ibm.com>
      Acked-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
      Signed-off-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      Reviewed-by: default avatarJosh Triplett <josh@joshtriplett.org>
      58fac095
    • Paul E. McKenney's avatar
      time: RCU permitted to stop idle entry via softirq · 803b0eba
      Paul E. McKenney authored
      The can_stop_idle_tick() function complains if a softirq vector is
      raised too late in the idle-entry process, presumably in order to
      prevent dangling softirq invocations from being delayed across the
      full idle period, which might be indefinitely long -- and if softirq
      was asserted any later than the call to this function, such a delay
      might well happen.
      
      However, RCU needs to be able to use softirq to stop idle entry in
      order to be able to drain RCU callbacks from the current CPU, which in
      turn enables faster entry into dyntick-idle mode, which in turn reduces
      power consumption.  Because RCU takes this action at a well-defined
      point in the idle-entry path, it is safe for RCU to take this approach.
      
      This commit therefore silences the error message that is sometimes
      produced when the going-idle CPU suddenly finds that it has an RCU_SOFTIRQ
      to process.  The error message will continue to be issued for other
      softirq vectors.
      Reported-by: default avatarSedat Dilek <sedat.dilek@gmail.com>
      Signed-off-by: default avatarPaul E. McKenney <paul.mckenney@linaro.org>
      Signed-off-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      Tested-by: default avatarSedat Dilek <sedat.dilek@gmail.com>
      Reviewed-by: default avatarJosh Triplett <josh@joshtriplett.org>
      803b0eba
    • Paul E. McKenney's avatar
      rcu: Move TINY_PREEMPT_RCU away from raw_local_irq_save() · 7a11e205
      Paul E. McKenney authored
      The use of raw_local_irq_save() is unnecessary, given that local_irq_save()
      really does disable interrupts.  Also, it appears to interfere with lockdep.
      Therefore, this commit moves to local_irq_save().
      Reported-by: default avatarFengguang Wu <fengguang.wu@intel.com>
      Signed-off-by: default avatarPaul E. McKenney <paul.mckenney@linaro.org>
      Signed-off-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      Tested-by: default avatarFengguang Wu <fengguang.wu@intel.com>
      7a11e205
    • Paul E. McKenney's avatar
      rcu: Remove redundant memory barrier from __call_rcu() · fdab649b
      Paul E. McKenney authored
      The first memory barrier in __call_rcu() is supposed to order any
      updates done beforehand by the caller against the actual queuing
      of the callback.  However, the second memory barrier (which is intended
      to order incrementing the queue lengths before queuing the callback)
      is also between the caller's updates and the queuing of the callback.
      The second memory barrier can therefore serve both purposes.
      
      This commit therefore removes the first memory barrier.
      Signed-off-by: default avatarPaul E. McKenney <paul.mckenney@linaro.org>
      Signed-off-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      Reviewed-by: default avatarJosh Triplett <josh@joshtriplett.org>
      fdab649b
    • Paul E. McKenney's avatar
      rcu: Avoid spurious RCU CPU stall warnings · c96ea7cf
      Paul E. McKenney authored
      If a given CPU avoids the idle loop but also avoids starting a new
      RCU grace period for a full minute, RCU can issue spurious RCU CPU
      stall warnings.  This commit fixes this issue by adding a check for
      ongoing grace period to avoid these spurious stall warnings.
      Reported-by: default avatarBecky Bruce <bgillbruce@gmail.com>
      Signed-off-by: default avatarPaul E. McKenney <paul.mckenney@linaro.org>
      Signed-off-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      Reviewed-by: default avatarJosh Triplett <josh@joshtriplett.org>
      c96ea7cf
    • Paul E. McKenney's avatar
      rcu: Protect rcu_node accesses during CPU stall warnings · c8020a67
      Paul E. McKenney authored
      The print_other_cpu_stall() function accesses a number of rcu_node
      fields without protection from the ->lock.  In theory, this is not
      a problem because the fields accessed are all integers, but in
      practice the compiler can get nasty.  Therefore, the commit extends
      the existing critical section to cover the entire loop body.
      Signed-off-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      c8020a67
    • Paul E. McKenney's avatar
      rcu: Avoid rcu_print_detail_task_stall_rnp() segfault · 5fd4dc06
      Paul E. McKenney authored
      The rcu_print_detail_task_stall_rnp() function invokes
      rcu_preempt_blocked_readers_cgp() to verify that there are some preempted
      RCU readers blocking the current grace period outside of the protection
      of the rcu_node structure's ->lock.  This means that the last blocked
      reader might exit its RCU read-side critical section and remove itself
      from the ->blkd_tasks list before the ->lock is acquired, resulting in
      a segmentation fault when the subsequent code attempts to dereference
      the now-NULL gp_tasks pointer.
      
      This commit therefore moves the test under the lock.  This will not
      have measurable effect on lock contention because this code is invoked
      only when printing RCU CPU stall warnings, in other words, in the common
      case, never.
      Signed-off-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      5fd4dc06
    • Paul E. McKenney's avatar
      rcu: Apply for_each_rcu_flavor() to increment_cpu_stall_ticks() · 115f7a7c
      Paul E. McKenney authored
      The increment_cpu_stall_ticks() function listed each RCU flavor
      explicitly, with an ifdef to handle preemptible RCU.  This commit
      therefore applies for_each_rcu_flavor() to save a line of code.
      
      Because this commit switches from a code-based enumeration of the
      flavors of RCU to an rcu_state-list-based enumeration, it is no longer
      possible to apply __get_cpu_var() to the per-CPU rcu_data structures.
      We instead use __this_cpu_var() on the rcu_state structure's ->rda field
      that references the corresponding rcu_data structures.
      Signed-off-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      115f7a7c
    • Paul E. McKenney's avatar
      rcu: Fix obsolete rcu_initiate_boost() header comment · b065a853
      Paul E. McKenney authored
      Commit 1217ed1b (rcu: permit rcu_read_unlock() to be called while holding
      runqueue locks) made rcu_initiate_boost() restore irq state when releasing
      the rcu_node structure's ->lock, but failed to update the header comment
      accordingly.  This commit therefore brings the header comment up to date.
      Signed-off-by: default avatarPaul E. McKenney <paul.mckenney@linaro.org>
      Signed-off-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      Reviewed-by: default avatarJosh Triplett <josh@joshtriplett.org>
      b065a853
    • Paul E. McKenney's avatar
      rcu: Make offline-CPU checking allow for indefinite delays · a82dcc76
      Paul E. McKenney authored
      The rcu_implicit_offline_qs() function implicitly assumed that execution
      would progress predictably when interrupts are disabled, which is of course
      not guaranteed when running on a hypervisor.  Furthermore, this function
      is short, and is called from one place only in a short function.
      
      This commit therefore ensures that the timing is checked before
      checking the condition, which guarantees correct behavior even given
      indefinite delays.  It also inlines rcu_implicit_offline_qs() into
      rcu_implicit_dynticks_qs().
      Signed-off-by: default avatarPaul E. McKenney <paul.mckenney@linaro.org>
      Signed-off-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      Reviewed-by: default avatarJosh Triplett <josh@joshtriplett.org>
      a82dcc76
    • Paul E. McKenney's avatar
      rcu: Improve boost selection when moving tasks to root rcu_node · 5cc900cf
      Paul E. McKenney authored
      The rcu_preempt_offline_tasks() moves all tasks queued on a given leaf
      rcu_node structure to the root rcu_node, which is done when the last CPU
      corresponding the the leaf rcu_node structure goes offline.  Now that
      RCU-preempt's synchronize_rcu_expedited() implementation blocks CPU-hotplug
      operations during the initialization of each rcu_node structure's
      ->boost_tasks pointer, rcu_preempt_offline_tasks() can do a better job
      of setting the root rcu_node's ->boost_tasks pointer.
      
      The key point is that rcu_preempt_offline_tasks() runs as part of the
      CPU-hotplug process, so that a concurrent synchronize_rcu_expedited()
      is guaranteed to either have not started on the one hand (in which case
      there is no boosting on behalf of the expedited grace period) or to be
      completely initialized on the other (in which case, in the absence of
      other priority boosting, all ->boost_tasks pointers will be initialized).
      Therefore, if rcu_preempt_offline_tasks() finds that the ->boost_tasks
      pointer is equal to the ->exp_tasks pointer, it can be sure that it is
      correctly placed.
      
      In the case where there was boosting ongoing at the time that the
      synchronize_rcu_expedited() function started, different nodes might start
      boosting the tasks blocking the expedited grace period at different times.
      In this mixed case, the root node will either be boosting tasks for
      the expedited grace period already, or it will start as soon as it gets
      done boosting for the normal grace period -- but in this latter case,
      the root node's tasks needed to be boosted in any case.
      
      This commit therefore adds a check of the ->boost_tasks pointer against
      the ->exp_tasks pointer to the list that prevents updating ->boost_tasks.
      Signed-off-by: default avatarPaul E. McKenney <paul.mckenney@linaro.org>
      Signed-off-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      Reviewed-by: default avatarJosh Triplett <josh@joshtriplett.org>
      5cc900cf
    • Paul E. McKenney's avatar
      rcu: Permit RCU_NONIDLE() to be used from interrupt context · b4270ee3
      Paul E. McKenney authored
      There is a need to use RCU from interrupt context, but either before
      rcu_irq_enter() is called or after rcu_irq_exit() is called.  If the
      interrupt occurs from idle, then lockdep-RCU will complain about such
      uses, as they appear to be illegal uses of RCU from the idle loop.
      In other environments, RCU_NONIDLE() could be used to properly protect
      the use of RCU, but RCU_NONIDLE() currently cannot be invoked except
      from process context.
      
      This commit therefore modifies RCU_NONIDLE() to permit its use more
      globally.
      Reported-by: default avatarSteven Rostedt <rostedt@goodmis.org>
      Signed-off-by: default avatarPaul E. McKenney <paul.mckenney@linaro.org>
      Signed-off-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      b4270ee3
    • Paul E. McKenney's avatar
      rcu: Properly initialize ->boost_tasks on CPU offline · 1e3fd2b3
      Paul E. McKenney authored
      When rcu_preempt_offline_tasks() clears tasks from a leaf rcu_node
      structure, it does not NULL out the structure's ->boost_tasks field.
      This commit therefore fixes this issue.
      Signed-off-by: default avatarPaul E. McKenney <paul.mckenney@linaro.org>
      Signed-off-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      Reviewed-by: default avatarJosh Triplett <josh@joshtriplett.org>
      1e3fd2b3
    • Paul E. McKenney's avatar
      rcu: Pull TINY_RCU dyntick-idle tracing into non-idle region · 818615c4
      Paul E. McKenney authored
      Because TINY_RCU's idle detection keys directly off of the nesting
      level, rather than from a separate variable as in TREE_RCU, the
      TINY_RCU dyntick-idle tracing on transition to idle must happen
      before the change to the nesting level.  This commit therefore makes
      this change by passing the desired new value (rather than the old value)
      of the nesting level in to rcu_idle_enter_common().
      
      [ paulmck: Add fix for wrong-variable bug spotted by
        Michael Wang <wangyun@linux.vnet.ibm.com>. ]
      Signed-off-by: default avatarPaul E. McKenney <paul.mckenney@linaro.org>
      Signed-off-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      Reviewed-by: default avatarJosh Triplett <josh@joshtriplett.org>
      818615c4
    • Paul E. McKenney's avatar
      rcu: Add PROVE_RCU_DELAY to provoke difficult races · e3ebfb96
      Paul E. McKenney authored
      There have been some recent bugs that were triggered only when
      preemptible RCU's __rcu_read_unlock() was preempted just after setting
      ->rcu_read_lock_nesting to INT_MIN, which is a low-probability event.
      Therefore, reproducing those bugs (to say nothing of gaining confidence
      in alleged fixes) was quite difficult.  This commit therefore creates
      a new debug-only RCU kernel config option that forces a short delay
      in __rcu_read_unlock() to increase the probability of those sorts of
      bugs occurring.
      Signed-off-by: default avatarPaul E. McKenney <paul.mckenney@linaro.org>
      Signed-off-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      Reviewed-by: default avatarJosh Triplett <josh@joshtriplett.org>
      e3ebfb96
    • Paul E. McKenney's avatar
      rcu: Fix day-one dyntick-idle stall-warning bug · a10d206e
      Paul E. McKenney authored
      Each grace period is supposed to have at least one callback waiting
      for that grace period to complete.  However, if CONFIG_NO_HZ=n, an
      extra callback-free grace period is no big problem -- it will chew up
      a tiny bit of CPU time, but it will complete normally.  In contrast,
      CONFIG_NO_HZ=y kernels have the potential for all the CPUs to go to
      sleep indefinitely, in turn indefinitely delaying completion of the
      callback-free grace period.  Given that nothing is waiting on this grace
      period, this is also not a problem.
      
      That is, unless RCU CPU stall warnings are also enabled, as they are
      in recent kernels.  In this case, if a CPU wakes up after at least one
      minute of inactivity, an RCU CPU stall warning will result.  The reason
      that no one noticed until quite recently is that most systems have enough
      OS noise that they will never remain absolutely idle for a full minute.
      But there are some embedded systems with cut-down userspace configurations
      that consistently get into this situation.
      
      All this begs the question of exactly how a callback-free grace period
      gets started in the first place.  This can happen due to the fact that
      CPUs do not necessarily agree on which grace period is in progress.
      If a CPU still believes that the grace period that just completed is
      still ongoing, it will believe that it has callbacks that need to wait for
      another grace period, never mind the fact that the grace period that they
      were waiting for just completed.  This CPU can therefore erroneously
      decide to start a new grace period.  Note that this can happen in
      TREE_RCU and TREE_PREEMPT_RCU even on a single-CPU system:  Deadlock
      considerations mean that the CPU that detected the end of the grace
      period is not necessarily officially informed of this fact for some time.
      
      Once this CPU notices that the earlier grace period completed, it will
      invoke its callbacks.  It then won't have any callbacks left.  If no
      other CPU has any callbacks, we now have a callback-free grace period.
      
      This commit therefore makes CPUs check more carefully before starting a
      new grace period.  This new check relies on an array of tail pointers
      into each CPU's list of callbacks.  If the CPU is up to date on which
      grace periods have completed, it checks to see if any callbacks follow
      the RCU_DONE_TAIL segment, otherwise it checks to see if any callbacks
      follow the RCU_WAIT_TAIL segment.  The reason that this works is that
      the RCU_WAIT_TAIL segment will be promoted to the RCU_DONE_TAIL segment
      as soon as the CPU is officially notified that the old grace period
      has ended.
      
      This change is to cpu_needs_another_gp(), which is called in a number
      of places.  The only one that really matters is in rcu_start_gp(), where
      the root rcu_node structure's ->lock is held, which prevents any
      other CPU from starting or completing a grace period, so that the
      comparison that determines whether the CPU is missing the completion
      of a grace period is stable.
      Reported-by: default avatarBecky Bruce <bgillbruce@gmail.com>
      Reported-by: default avatarSubodh Nijsure <snijsure@grid-net.com>
      Reported-by: default avatarPaul Walmsley <paul@pwsan.com>
      Signed-off-by: default avatarPaul E. McKenney <paul.mckenney@linaro.org>
      Signed-off-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      Tested-by: Paul Walmsley <paul@pwsan.com>  # OMAP3730, OMAP4430
      Cc: stable@vger.kernel.org
      a10d206e
  2. 12 Sep, 2012 1 commit
  3. 08 Sep, 2012 3 commits
    • Linus Torvalds's avatar
      Linux 3.6-rc5 · 55d512e2
      Linus Torvalds authored
      55d512e2
    • Linus Torvalds's avatar
      Merge branch 'fixes-for-3.6' of git://git.linaro.org/people/mszyprowski/linux-dma-mapping · 32d687ca
      Linus Torvalds authored
      Pull DMA-mapping fixes from Marek Szyprowski:
       "Another set of fixes for ARM dma-mapping subsystem.
      
        Commit e9da6e99 replaced custom consistent buffer remapping code
        with generic vmalloc areas.  It however introduced some regressions
        caused by limited support for allocations in atomic context.  This
        series contains fixes for those regressions.
      
        For some subplatforms the default, pre-allocated pool for atomic
        allocations turned out to be too small, so a function for setting its
        size has been added.
      
        Another set of patches adds support for atomic allocations to
        IOMMU-aware DMA-mapping implementation.
      
        The last part of this pull request contains two fixes for Contiguous
        Memory Allocator, which relax too strict requirements."
      
      * 'fixes-for-3.6' of git://git.linaro.org/people/mszyprowski/linux-dma-mapping:
        ARM: dma-mapping: IOMMU allocates pages from atomic_pool with GFP_ATOMIC
        ARM: dma-mapping: Introduce __atomic_get_pages() for __iommu_get_pages()
        ARM: dma-mapping: Refactor out to introduce __in_atomic_pool
        ARM: dma-mapping: atomic_pool with struct page **pages
        ARM: Kirkwood: increase atomic coherent pool size
        ARM: DMA-Mapping: print warning when atomic coherent allocation fails
        ARM: DMA-Mapping: add function for setting coherent pool size from platform code
        ARM: relax conditions required for enabling Contiguous Memory Allocator
        mm: cma: fix alignment requirements for contiguous regions
      32d687ca
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input · 11be4bc6
      Linus Torvalds authored
      Pull input subsystem updates from Dmitry Torokhov.
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
        Input: wacom - add support for EMR on Cintiq 24HD touch
        Input: i8042 - add Gigabyte T1005 series netbooks to noloop table
        Input: imx_keypad - reset the hardware before enabling
        Input: edt-ft5x06 - fix build error when compiling wthout CONFIG_DEBUG_FS
      11be4bc6
  4. 07 Sep, 2012 4 commits
  5. 06 Sep, 2012 14 commits
    • Linus Torvalds's avatar
      Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · eeea3ac9
      Linus Torvalds authored
      Pull ARM SoC bug fixes from Olof Johansson:
       "Mostly Renesas and Atmel bugfixes this time, targeting boot and build
        problems.  A couple of patches for gemini and kirkwood as well.  On a
        whole nothing very controversial."
      
      * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
        ARM: gemini: fix the gemini build
        ARM: shmobile: armadillo800eva: enable rw rootfs mount
        ARM: Kirkwood: Fix 'SZ_1M' undeclared here for db88f6281-bp-setup.c
        ARM: shmobile: mackerel: fixup usb module order
        ARM: shmobile: armadillo800eva: fixup: sound card detection order
        ARM: shmobile: marzen: fixup smsc911x id for regulator
        ARM: at91/feature-removal-schedule: delay at91_mci removal
        ARM: mach-shmobile: armadillo800eva: Enable power button as wakeup source
        ARM: mach-shmobile: armadillo800eva: Fix GPIO buttons descriptions
        ARM: at91/dts: remove partial parameter in at91sam9g25ek.dts
        ARM: at91/clock: fix PLLA overclock warning
        ARM: at91: fix rtc-at91sam9 irq issue due to sparse irq support
        ARM: at91: fix system timer irq issue due to sparse irq support
        ARM: shmobile: sh73a0: fixup RELOC_BASE of intca_irq_pins_desc
      eeea3ac9
    • Linus Torvalds's avatar
      Merge tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging · c7c6bf1e
      Linus Torvalds authored
      Pull a hwmon fix from Guenter Roeck:
       "One patch, fixing DIV_ROUND_CLOSEST to support negative dividends.
      
        While the changes are not in the drivers/hwmon directory, the problem
        primarily affects hwmon drivers, and it makes sense to push the patch
        through the hwmon tree."
      
      * tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
        linux/kernel.h: Fix DIV_ROUND_CLOSEST to support negative dividends
      c7c6bf1e
    • Linus Torvalds's avatar
      Merge branch 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild · bd12ce8c
      Linus Torvalds authored
      Pull kbuild fixes from Michal Marek:
       "These are two fixes that should go into 3.6.  The link-vmlinux.sh one
        is obvious.
      
        The other one fixes make firmware_install with certain configurations,
        where a file in the toplevel firmware tree gets installed first, and
        $(INSTALL_FW_PATH)/$$(dir <file>) results in /lib/firmware/./, which
        confuses make 3.82 for some reason."
      
      * 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild:
        firmware: fix directory creation rule matching with make 3.82
        link-vmlinux.sh: Fix stray "echo" in error message
      bd12ce8c
    • Dave Jones's avatar
      Remove user-triggerable BUG from mpol_to_str · 80de7c31
      Dave Jones authored
      Trivially triggerable, found by trinity:
      
        kernel BUG at mm/mempolicy.c:2546!
        Process trinity-child2 (pid: 23988, threadinfo ffff88010197e000, task ffff88007821a670)
        Call Trace:
          show_numa_map+0xd5/0x450
          show_pid_numa_map+0x13/0x20
          traverse+0xf2/0x230
          seq_read+0x34b/0x3e0
          vfs_read+0xac/0x180
          sys_pread64+0xa2/0xc0
          system_call_fastpath+0x1a/0x1f
        RIP: mpol_to_str+0x156/0x360
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarDave Jones <davej@redhat.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      80de7c31
    • Konrad Rzeszutek Wilk's avatar
      xen/pciback: Fix proper FLR steps. · 80ba77df
      Konrad Rzeszutek Wilk authored
      When we do FLR and save PCI config we did it in the wrong order.
      The end result was that if a PCI device was unbind from
      its driver, then binded to xen-pciback, and then back to its
      driver we would get:
      
      > lspci -s 04:00.0
      04:00.0 Ethernet controller: Intel Corporation 82574L Gigabit Network Connection
      13:42:12 # 4 :~/
      > echo "0000:04:00.0" > /sys/bus/pci/drivers/pciback/unbind
      > modprobe e1000e
      e1000e: Intel(R) PRO/1000 Network Driver - 2.0.0-k
      e1000e: Copyright(c) 1999 - 2012 Intel Corporation.
      e1000e 0000:04:00.0: Disabling ASPM L0s L1
      e1000e 0000:04:00.0: enabling device (0000 -> 0002)
      xen: registering gsi 48 triggering 0 polarity 1
      Already setup the GSI :48
      e1000e 0000:04:00.0: Interrupt Throttling Rate (ints/sec) set to dynamic conservative mode
      e1000e: probe of 0000:04:00.0 failed with error -2
      
      This fixes it by first saving the PCI configuration space, then
      doing the FLR.
      Reported-by: default avatarRen, Yongjie <yongjie.ren@intel.com>
      Reported-and-Tested-by: default avatarTobias Geiger <tobias.geiger@vido.info>
      Signed-off-by: default avatarKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      CC: stable@vger.kernel.org
      80ba77df
    • Linus Torvalds's avatar
      Merge tag 'mmc-fixes-for-3.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc · 08090950
      Linus Torvalds authored
      Pull MMC fixes from Chris Ball:
       - a firmware bug on several Samsung MoviNAND eMMC models causes
         permanent corruption on the device when secure erase and secure trim
         requests are made, so we disable those requests on these eMMC devices.
       - atmel-mci: fix a hang with some SD cards by waiting for not-busy flag.
       - dw_mmc: low-power mode breaks SDIO interrupts; fix PIO error handling;
         fix handling of error interrupts.
       - mxs-mmc: fix deadlocks; fix compile error due to dma.h arch change.
       - omap: fix broken PIO mode causing memory corruption.
       - sdhci-esdhc: fix card detection.
      
      * tag 'mmc-fixes-for-3.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc:
        mmc: omap: fix broken PIO mode
        mmc: card: Skip secure erase on MoviNAND; causes unrecoverable corruption.
        mmc: dw_mmc: Disable low power mode if SDIO interrupts are used
        mmc: dw_mmc: fix error handling in PIO mode
        mmc: dw_mmc: correct mishandling error interrupt
        mmc: dw_mmc: amend using error interrupt status
        mmc: atmel-mci: not busy flag has also to be used for read operations
        mmc: sdhci-esdhc: break out early if clock is 0
        mmc: mxs-mmc: fix deadlock caused by recursion loop
        mmc: mxs-mmc: fix deadlock in SDIO IRQ case
        mmc: bfin_sdh: fix dma_desc_array build error
      08090950
    • Miklos Szeredi's avatar
      uml: fix compile error in deliver_alarm() · bc6c8364
      Miklos Szeredi authored
      Fix the following compile error on UML.
      
        arch/um/os-Linux/time.c: In function 'deliver_alarm':
        arch/um/os-Linux/time.c:117:3: error: too few arguments to function 'alarm_handler'
        arch/um/os-Linux/internal.h:1:6: note: declared here
      
      The error was introduced by commit d3c1cfcd ("um: pass siginfo to guest
      process") in 3.6-rc1.
      Signed-off-by: default avatarMiklos Szeredi <mszeredi@suse.cz>
      CC: Martin Pärtel <martin.partel@gmail.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      bc6c8364
    • Alan Cox's avatar
      dj: memory scribble in logi_dj · 8a55ade7
      Alan Cox authored
      Allocate a structure not a pointer to it !
      Signed-off-by: default avatarAlan Cox <alan@linux.intel.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      8a55ade7
    • Linus Torvalds's avatar
      Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc · cb4f9a29
      Linus Torvalds authored
      Pull powerpc fixes from Benjamin Herrenschmidt:
       "Here are a few fixes for 3.6 that were piling up while I was away or
        busy (I was mostly MIA a week or two before San Diego).
      
        Some fixes from Anton fixing up issues with our relatively new DSCR
        control feature, and a few other fixes that are either regressions or
        bugs nasty enough to warrant not waiting."
      
      * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
        powerpc: Don't use __put_user() in patch_instruction
        powerpc: Make sure IPI handlers see data written by IPI senders
        powerpc: Restore correct DSCR in context switch
        powerpc: Fix DSCR inheritance in copy_thread()
        powerpc: Keep thread.dscr and thread.dscr_inherit in sync
        powerpc: Update DSCR on all CPUs when writing sysfs dscr_default
        powerpc/powernv: Always go into nap mode when CPU is offline
        powerpc: Give hypervisor decrementer interrupts their own handler
        powerpc/vphn: Fix arch_update_cpu_topology() return value
      cb4f9a29
    • Linus Torvalds's avatar
      Merge tag 'gpio-fixes-for-v3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio · 813e6438
      Linus Torvalds authored
      Pull GPIO fixes from Linus Walleij:
       "These are some GPIO regression fixes for v3.6:
         - Erroneous debug message from of_get_named_gpio_flags()
         - Make sure the MC9S08DZ60 GPIO driver depend on I2C being compiled
           in (not module) or allmodconfig breaks.
         - Check return value from irq_alloc_descs() in the Emma Mobile GPIO
           driver.
         - Assign the owner field for the rdc321x driver so the module won't
           be removed if it has active GPIOs."
      
      * tag 'gpio-fixes-for-v3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
        gpio: rdc321x: Prevent removal of modules exporting active GPIOs
        gpio: em: Fix checking return value of irq_alloc_descs
        gpio: mc9s08dz60: Fix build error if I2C=m
        gpio: Fix debug message in of_get_named_gpio_flags()
      813e6438
    • Linus Torvalds's avatar
      Merge tag 'sound-3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 5e682c0e
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "There are nothing scaring, contains only small fixes for HD-audio and
        USB-audio:
         - EPSS regression fix and GPIO fix for HD-audio IDT codecs
         - A series of USB-audio regression fixes that are found since 3.5
           kernel"
      
      * tag 'sound-3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: snd-usb: fix cross-interface streaming devices
        ALSA: snd-usb: fix calls to next_packet_size
        ALSA: snd-usb: restore delay information
        ALSA: snd-usb: use list_for_each_safe for endpoint resources
        ALSA: snd-usb: Fix URB cancellation at stream start
        ALSA: hda - Don't trust codec EPSS bit for IDT 92HD83xx & co
        ALSA: hda - Avoid unnecessary parameter read for EPSS
        ALSA: hda - Do not set GPIOs for speakers on IDT if there are no speakers
      5e682c0e
    • Linus Torvalds's avatar
      Merge tag 'fbdev-fixes-for-3.6-1' of git://github.com/schandinat/linux-2.6 · 6d1a0503
      Linus Torvalds authored
      Pull fbdev fixes from Florian Tobias Schandinat:
       - a fix by Paul Cercueil to prevent a possible buffer overflow
       - a fix by Bruno Prémont to prevent a rare sleep in invalid context
       - a fix by Julia Lawall for a double free in auo_k190x
       - a fix by Dan Carpenter to prevent a division by zero in mb862xxfb
       - a regression fix by Tomi Valkeinen for the SDI output in OMAP
       - a fix by Grazvydas Ignotas to fix the console colors in OMAP
      
      * tag 'fbdev-fixes-for-3.6-1' of git://github.com/schandinat/linux-2.6:
        OMAPFB: fix framebuffer console colors
        OMAPDSS: Fix SDI PLL locking
        video: mb862xxfb: prevent divide by zero bug
        drivers/video/auo_k190x.c: drop kfree of devm_kzalloc's data
        fbcon: Fix bit_putcs() call to kmalloc(s, GFP_KERNEL)
        fbcon: prevent possible buffer overflow.
      6d1a0503
    • Linus Torvalds's avatar
      Merge tag 'upstream-3.6-rc5' of git://git.infradead.org/linux-ubi · 50234c58
      Linus Torvalds authored
      Pull ubi fix from Artem Bityutskiy:
       "A single small fix for memory deallocation: we allocated memory using
        'kmem_cache_alloc()' but were freeing it using 'kfree()' in some
        cases.  Now we fix this by using 'kmem_cache_free()' instead."
      
      * tag 'upstream-3.6-rc5' of git://git.infradead.org/linux-ubi:
        UBI: fix a horrible memory deallocation bug
      50234c58
    • Mikulas Patocka's avatar
      Fix order of arguments to compat_put_time[spec|val] · ed6fe9d6
      Mikulas Patocka authored
      Commit 644595f8 ("compat: Handle COMPAT_USE_64BIT_TIME in
      net/socket.c") introduced a bug where the helper functions to take
      either a 64-bit or compat time[spec|val] got the arguments in the wrong
      order, passing the kernel stack pointer off as a user pointer (and vice
      versa).
      
      Because of the user address range check, that in turn then causes an
      EFAULT due to the user pointer range checking failing for the kernel
      address.  Incorrectly resuling in a failed system call for 32-bit
      processes with a 64-bit kernel.
      
      On odder architectures like HP-PA (with separate user/kernel address
      spaces), it can be used read kernel memory.
      Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      ed6fe9d6