KOSAKI Motohiro [Tue, 23 Mar 2010 20:35:33 +0000 (13:35 -0700)]
doc: add the documentation for mpol=local
commit
5574169613b40b85d6f4c67208fa4846b897a0a1 upstream.
commit
3f226aa1c (mempolicy: support mpol=local tmpfs mount option) added
new mpol=local mount option. but it didn't add a documentation.
This patch does it.
Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Ravikiran Thirumalai <kiran@scalex86.org>
Cc: Christoph Lameter <cl@linux-foundation.org>
Cc: Mel Gorman <mel@csn.ul.ie>
Acked-by: Lee Schermerhorn <lee.schermerhorn@hp.com>
Cc: Hugh Dickins <hugh.dickins@tiscali.co.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
KOSAKI Motohiro [Tue, 23 Mar 2010 20:35:32 +0000 (13:35 -0700)]
tmpfs: cleanup mpol_parse_str()
commit
926f2ae04f183098cf9a30521776fb2759c8afeb upstream.
mpol_parse_str() made lots 'err' variable related bug. Because it is ugly
and reviewing unfriendly.
This patch simplifies it.
Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Ravikiran Thirumalai <kiran@scalex86.org>
Cc: Christoph Lameter <cl@linux-foundation.org>
Cc: Mel Gorman <mel@csn.ul.ie>
Acked-by: Lee Schermerhorn <lee.schermerhorn@hp.com>
Cc: Hugh Dickins <hugh.dickins@tiscali.co.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
KOSAKI Motohiro [Tue, 23 Mar 2010 20:35:31 +0000 (13:35 -0700)]
tmpfs: handle MPOL_LOCAL mount option properly
commit
12821f5fb942e795f8009ece14bde868893bd811 upstream.
commit
71fe804b6d5 (mempolicy: use struct mempolicy pointer in
shmem_sb_info) added mpol=local mount option. but its feature is broken
since it was born. because such code always return 1 (i.e. mount
failure).
This patch fixes it.
Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Ravikiran Thirumalai <kiran@scalex86.org>
Cc: Christoph Lameter <cl@linux-foundation.org>
Cc: Mel Gorman <mel@csn.ul.ie>
Acked-by: Lee Schermerhorn <lee.schermerhorn@hp.com>
Cc: Hugh Dickins <hugh.dickins@tiscali.co.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
KOSAKI Motohiro [Tue, 23 Mar 2010 20:35:30 +0000 (13:35 -0700)]
tmpfs: mpol=bind:0 don't cause mount error.
commit
d69b2e63e9172afb4d07c305601b79a55509ac4c upstream.
Currently, following mount operation cause mount error.
% mount -t tmpfs -ompol=bind:0 none /tmp
Because commit
71fe804b6d5 (mempolicy: use struct mempolicy pointer in
shmem_sb_info) corrupted MPOL_BIND parse code.
This patch restore the needed one.
Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Ravikiran Thirumalai <kiran@scalex86.org>
Cc: Christoph Lameter <cl@linux-foundation.org>
Cc: Mel Gorman <mel@csn.ul.ie>
Acked-by: Lee Schermerhorn <lee.schermerhorn@hp.com>
Cc: Hugh Dickins <hugh.dickins@tiscali.co.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Ravikiran G Thirumalai [Tue, 23 Mar 2010 20:35:28 +0000 (13:35 -0700)]
tmpfs: fix oops on mounts with mpol=default
commit
413b43deab8377819aba1dbad2abf0c15d59b491 upstream.
Fix an 'oops' when a tmpfs mount point is mounted with the mpol=default
mempolicy.
Upon remounting a tmpfs mount point with 'mpol=default' option, the mount
code crashed with a null pointer dereference. The initial problem report
was on 2.6.27, but the problem exists in mainline 2.6.34-rc as well. On
examining the code, we see that mpol_new returns NULL if default mempolicy
was requested. This 'NULL' mempolicy is accessed to store the node mask
resulting in oops.
The following patch fixes it.
Signed-off-by: Ravikiran Thirumalai <kiran@scalex86.org>
Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Christoph Lameter <cl@linux-foundation.org>
Cc: Mel Gorman <mel@csn.ul.ie>
Acked-by: Lee Schermerhorn <lee.schermerhorn@hp.com>
Cc: Hugh Dickins <hugh.dickins@tiscali.co.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Paul Mackerras [Wed, 10 Mar 2010 09:45:52 +0000 (20:45 +1100)]
perf_event: Fix oops triggered by cpu offline/online
commit
220b140b52ab6cc133f674a7ffec8fa792054f25 upstream.
Anton Blanchard found that he could reliably make the kernel hit a
BUG_ON in the slab allocator by taking a cpu offline and then online
while a system-wide perf record session was running.
The reason is that when the cpu comes up, we completely reinitialize
the ctx field of the struct perf_cpu_context for the cpu. If there is
a system-wide perf record session running, then there will be a struct
perf_event that has a reference to the context, so its refcount will
be 2. (The perf_event has been removed from the context's group_entry
and event_entry lists by perf_event_exit_cpu(), but that doesn't
remove the perf_event's reference to the context and doesn't decrement
the context's refcount.)
When the cpu comes up, perf_event_init_cpu() gets called, and it calls
__perf_event_init_context() on the cpu's context. That resets the
refcount to 1. Then when the perf record session finishes and the
perf_event is closed, the refcount gets decremented to 0 and the
context gets kfreed after an RCU grace period. Since the context
wasn't kmalloced -- it's part of a per-cpu variable -- bad things
happen.
In fact we don't need to completely reinitialize the context when the
cpu comes up. It's sufficient to initialize the context once at boot,
but we need to do it for all possible cpus.
This moves the context initialization to happen at boot time. With
this, we don't trash the refcount and the context never gets kfreed,
and we don't hit the BUG_ON.
Reported-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>
Tested-by: Anton Blanchard <anton@samba.org>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
John Kacur [Thu, 11 Mar 2010 12:57:00 +0000 (13:57 +0100)]
perf: Make the install relative to DESTDIR if specified
commit
7ae5f21361fea11f58c398701da635f778635d13 upstream.
Without this change, the install path is relative to
prefix/DESTDIR where prefix is automatically set to $HOME.
This can produce unexpected results. For example:
make -C tools/perf DESTDIR=/home/jkacur/tmp install-man
creates the directory: /home/jkacur/home/jkacur/tmp/share/...
instead of the expected: /home/jkacur/tmp/share/...
Signed-off-by: John Kacur <jkacur@redhat.com>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Tom Zanussi <tzanussi@gmail.com>
Cc: Kyle McMartin <kyle@redhat.com>
LKML-Reference: <
1268312220-12880-1-git-send-email-jkacur@redhat.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Tilman Schmidt [Sun, 14 Mar 2010 12:58:05 +0000 (12:58 +0000)]
gigaset: prune use of tty_buffer_request_room
commit
873a69a358a6b393fd8d9d92e193ec8895cac4d7 upstream.
Calling tty_buffer_request_room() before tty_insert_flip_string()
is unnecessary, costs CPU and for big buffers can mess up the
multi-page allocation avoidance.
Signed-off-by: Tilman Schmidt <tilman@imap.cc>
Acked-by: Karsten Keil <keil@b1-systems.de>
CC: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Tilman Schmidt [Sun, 14 Mar 2010 12:58:05 +0000 (12:58 +0000)]
gigaset: correct clearing of at_state strings on RING
commit
3a0a3a6b92edf181f849ebd8417122392ba73a96 upstream.
In RING handling, clear the table of received parameter strings in
a loop like everywhere else, instead of by enumeration which had
already gotten out of sync.
Impact: minor bugfix
Signed-off-by: Tilman Schmidt <tilman@imap.cc>
Acked-by: Karsten Keil <keil@b1-systems.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Clemens Ladisch [Wed, 24 Mar 2010 06:10:54 +0000 (07:10 +0100)]
ALSA: cmipci: work around invalid PCM pointer
commit
1c583063a5c769fe2ec604752e383972c69e6d9b upstream.
When the CMI8738 FRAME2 register is read, the chip sometimes (probably
when wrapping around) returns an invalid value that would be outside the
programmed DMA buffer. This leads to an inconsistent PCM pointer that is
likely to result in an underrun.
To work around this, read the register multiple times until we get a
valid value; the error state seems to be very short-lived.
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Reported-and-tested-by: Matija Nalis <mnalis-alsadev@voyager.hr>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Daniel T Chen [Sun, 21 Mar 2010 22:34:43 +0000 (18:34 -0400)]
ALSA: hda: Fix 0 dB offset for HP laptops using CX20551 (Waikiki)
commit
025f206c9e0f96cc41567b01c07fb852d8900da1 upstream.
BugLink: https://launchpad.net/bugs/420578
The OR has verified that his hardware distorts because of the 0 dB
offset not corresponding to the highest PCM level. Fix this by capping
said PCM level to 0 dB similarly to what we do for CX20549 (Venice).
Reported-by: Mike Pontillo <pontillo@gmail.com>
Tested-by: Mike Pontillo <pontillo@gmail.com>
Signed-off-by: Daniel T Chen <crimsun@ubuntu.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Takashi Iwai [Mon, 15 Mar 2010 08:07:52 +0000 (09:07 +0100)]
ALSA: hda - Fix secondary ADC of ALC260 basic model
commit
9c4cc0bdede1c39bde60a0d5d9251aac71fbe719 upstream.
Fix adc_nids[] for ALC260 basic model to match with num_adc_nids.
Otherwise you get an invalid NID in the secondary "Input Source" mixer
element.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Takashi Iwai [Mon, 15 Mar 2010 14:51:53 +0000 (15:51 +0100)]
ALSA: hda - Disable MSI for Nvidia controller
commit
80c43ed724797627d8f86855248c497a6161a214 upstream.
Judging from the member of enable_msi white-list, Nvidia controller
seems to cause troubles with MSI enabled, e.g. boot hang up or other
serious issue may come up. It's safer to disable MSI as default for
Nvidia controllers again for now.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Daniel T Chen [Mon, 15 Mar 2010 03:44:03 +0000 (23:44 -0400)]
ALSA: hda: Use LPIB and 6stack-dig for eMachines T5212
commit
572c0e3c73341755f3e7dfaaef6b26df12bd709c upstream.
BugLink: https://bugs.launchpad.net/bugs/538895
The OR has verified that both position_fix=1 and model=6stack-dig are
necessary to have capture function properly. (The existing 3stack-6ch
model quirk seems to be incorrect.)
Reported-by: Reuben Bailey <reuben.e.bailey@gmail.com>
Tested-by: Reuben Bailey <reuben.e.bailey@gmail.com>
Signed-off-by: Daniel T Chen <crimsun@ubuntu.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Hisashi Hifumi [Thu, 17 Dec 2009 23:27:26 +0000 (15:27 -0800)]
readahead: add blk_run_backing_dev
commit
65a80b4c61f5b5f6eb0f5669c8fb120893bfb388 upstream.
I added blk_run_backing_dev on page_cache_async_readahead so readahead I/O
is unpluged to improve throughput on especially RAID environment.
The normal case is, if page N become uptodate at time T(N), then T(N) <=
T(N+1) holds. With RAID (and NFS to some degree), there is no strict
ordering, the data arrival time depends on runtime status of individual
disks, which breaks that formula. So in do_generic_file_read(), just
after submitting the async readahead IO request, the current page may well
be uptodate, so the page won't be locked, and the block device won't be
implicitly unplugged:
if (PageReadahead(page))
page_cache_async_readahead()
if (!PageUptodate(page))
goto page_not_up_to_date;
//...
page_not_up_to_date:
lock_page_killable(page);
Therefore explicit unplugging can help.
Following is the test result with dd.
#dd if=testdir/testfile of=/dev/null bs=16384
-2.6.30-rc6
1048576+0 records in
1048576+0 records out
17179869184 bytes (17 GB) copied, 224.182 seconds, 76.6 MB/s
-2.6.30-rc6-patched
1048576+0 records in
1048576+0 records out
17179869184 bytes (17 GB) copied, 206.465 seconds, 83.2 MB/s
(7Disks RAID-0 Array)
-2.6.30-rc6
1054976+0 records in
1054976+0 records out
17284726784 bytes (17 GB) copied, 212.233 seconds, 81.4 MB/s
-2.6.30-rc6-patched
1054976+0 records out
17284726784 bytes (17 GB) copied, 198.878 seconds, 86.9 MB/s
(7Disks RAID-5 Array)
The patch was found to improve performance with the SCST scsi target
driver. See
http://sourceforge.net/mailarchive/forum.php?thread_name=a0272b440906030714g67eabc5k8f847fb1e538cc62%40mail.gmail.com&forum_name=scst-devel
[akpm@linux-foundation.org: unbust comment layout]
[akpm@linux-foundation.org: "fix" CONFIG_BLOCK=n]
Signed-off-by: Hisashi Hifumi <hifumi.hisashi@oss.ntt.co.jp>
Acked-by: Wu Fengguang <fengguang.wu@intel.com>
Cc: Jens Axboe <jens.axboe@oracle.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Tested-by: Ronald <intercommit@gmail.com>
Cc: Bart Van Assche <bart.vanassche@gmail.com>
Cc: Vladislav Bolkhovitin <vst@vlnb.net>
Cc: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Suresh Siddha [Thu, 11 Mar 2010 08:45:44 +0000 (09:45 +0100)]
sched: Fix SCHED_MC regression caused by change in sched cpu_power
commit
dd5feea14a7de4edbd9f36db1a2db785de91b88d upstream
On platforms like dual socket quad-core platform, the scheduler load
balancer is not detecting the load imbalances in certain scenarios. This
is leading to scenarios like where one socket is completely busy (with
all the 4 cores running with 4 tasks) and leaving another socket
completely idle. This causes performance issues as those 4 tasks share
the memory controller, last-level cache bandwidth etc. Also we won't be
taking advantage of turbo-mode as much as we would like, etc.
Some of the comparisons in the scheduler load balancing code are
comparing the "weighted cpu load that is scaled wrt sched_group's
cpu_power" with the "weighted average load per task that is not scaled
wrt sched_group's cpu_power". While this has probably been broken for a
longer time (for multi socket numa nodes etc), the problem got aggrevated
via this recent change:
|
| commit
f93e65c186ab3c05ce2068733ca10e34fd00125e
| Author: Peter Zijlstra <a.p.zijlstra@chello.nl>
| Date: Tue Sep 1 10:34:32 2009 +0200
|
| sched: Restore __cpu_power to a straight sum of power
|
Also with this change, the sched group cpu power alone no longer reflects
the group capacity that is needed to implement MC, MT performance
(default) and power-savings (user-selectable) policies.
We need to use the computed group capacity (sgs.group_capacity, that is
computed using the SD_PREFER_SIBLING logic in update_sd_lb_stats()) to
find out if the group with the max load is above its capacity and how
much load to move etc.
Reported-by: Ma Ling <ling.ma@intel.com>
Initial-Analysis-by: Zhang, Yanmin <yanmin_zhang@linux.intel.com>
Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
[ -v2: build fix ]
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
LKML-Reference: <
1266970432.11588.22.camel@sbs-t61.sc.intel.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Oleg Nesterov [Tue, 16 Feb 2010 14:02:13 +0000 (15:02 +0100)]
x86: set_personality_ia32() misses force_personality32
commit
1252f238db48ec419f40c1bdf30fda649860eed9 upstream.
05d43ed8a "x86: get rid of the insane TIF_ABI_PENDING bit" forgot about
force_personality32. Fix.
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Michael S. Tsirkin [Thu, 25 Feb 2010 17:08:55 +0000 (19:08 +0200)]
virtio: fix out of range array access
commit
3119815912a220bdac943dfbdfee640414c0c611 upstream.
I have observed the following error on virtio-net module unload:
------------[ cut here ]------------
WARNING: at kernel/irq/manage.c:858 __free_irq+0xa0/0x14c()
Hardware name: Bochs
Trying to free already-free IRQ 0
Modules linked in: virtio_net(-) virtio_blk virtio_pci virtio_ring
virtio af_packet e1000 shpchp aacraid uhci_hcd ohci_hcd ehci_hcd [last
unloaded: scsi_wait_scan]
Pid: 1957, comm: rmmod Not tainted 2.6.33-rc8-vhost #24
Call Trace:
[<
ffffffff8103e195>] warn_slowpath_common+0x7c/0x94
[<
ffffffff8103e204>] warn_slowpath_fmt+0x41/0x43
[<
ffffffff810a7a36>] ? __free_pages+0x5a/0x70
[<
ffffffff8107cc00>] __free_irq+0xa0/0x14c
[<
ffffffff8107cceb>] free_irq+0x3f/0x65
[<
ffffffffa0081424>] vp_del_vqs+0x81/0xb1 [virtio_pci]
[<
ffffffffa0091d29>] virtnet_remove+0xda/0x10b [virtio_net]
[<
ffffffffa0075200>] virtio_dev_remove+0x22/0x4a [virtio]
[<
ffffffff812709ee>] __device_release_driver+0x66/0xac
[<
ffffffff81270ab7>] driver_detach+0x83/0xa9
[<
ffffffff8126fc66>] bus_remove_driver+0x91/0xb4
[<
ffffffff81270fcf>] driver_unregister+0x6c/0x74
[<
ffffffffa0075418>] unregister_virtio_driver+0xe/0x10 [virtio]
[<
ffffffffa0091c4d>] fini+0x15/0x17 [virtio_net]
[<
ffffffff8106997b>] sys_delete_module+0x1c3/0x230
[<
ffffffff81007465>] ? old_ich_force_enable_hpet+0x117/0x164
[<
ffffffff813bb720>] ? do_page_fault+0x29c/0x2cc
[<
ffffffff81028e58>] sysenter_dispatch+0x7/0x27
---[ end trace
15e88e4c576cc62b ]---
The bug is in virtio-pci: we use msix_vector as array index to get irq
entry, but some vqs do not have a dedicated vector so this causes an out
of bounds access. By chance, we seem to often get 0 value, which
results in this error.
Fix by verifying that vector is legal before using it as index.
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Anthony Liguori <aliguori@us.ibm.com>
Acked-by: Shirley Ma <xma@us.ibm.com>
Acked-by: Amit Shah <amit.shah@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
André Goddard Rosa [Tue, 23 Feb 2010 07:04:28 +0000 (04:04 -0300)]
mqueue: fix mq_open() file descriptor leak on user-space processes
commit
4294a8eedb17bbc45e1e7447c2a4d05332943248 upstream.
We leak fd on lookup_one_len() failure
Signed-off-by: André Goddard Rosa <andre.goddard@gmail.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Ming Lei [Sat, 27 Feb 2010 16:56:24 +0000 (00:56 +0800)]
ath9k: fix lockdep warning when unloading module
commit
a9f042cbe5284f34ccff15f3084477e11b39b17b upstream.
Since txq->axq_lock may be hold in softirq context, it must be
acquired with spin_lock_bh() instead of spin_lock() if softieq is
enabled.
The patch fixes the lockdep warning below when unloading ath9k modules.
=================================
[ INFO: inconsistent lock state ]
2.6.33-wl #12
---------------------------------
inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage.
rmmod/3642 [HC0[0]:SC0[0]:HE1:SE1] takes:
(&(&txq->axq_lock)->rlock){+.?...}, at: [<
ffffffffa03568c3>] ath_tx_node_cleanup+0x62/0x180 [ath9k]
{IN-SOFTIRQ-W} state was registered at:
[<
ffffffff8107577d>] __lock_acquire+0x2f6/0xd35
[<
ffffffff81076289>] lock_acquire+0xcd/0xf1
[<
ffffffff813a7486>] _raw_spin_lock_bh+0x3b/0x6e
[<
ffffffffa0356b49>] spin_lock_bh+0xe/0x10 [ath9k]
[<
ffffffffa0358ec7>] ath_tx_tasklet+0xcd/0x391 [ath9k]
[<
ffffffffa0354f5f>] ath9k_tasklet+0x70/0xc8 [ath9k]
[<
ffffffff8104e601>] tasklet_action+0x8c/0xf4
[<
ffffffff8104f459>] __do_softirq+0xf8/0x1cd
[<
ffffffff8100ab1c>] call_softirq+0x1c/0x30
[<
ffffffff8100c2cf>] do_softirq+0x4b/0xa3
[<
ffffffff8104f045>] irq_exit+0x4a/0x8c
[<
ffffffff813acccc>] do_IRQ+0xac/0xc3
[<
ffffffff813a7d53>] ret_from_intr+0x0/0x16
[<
ffffffff81302d52>] cpuidle_idle_call+0x9e/0xf8
[<
ffffffff81008be7>] cpu_idle+0x62/0x9d
[<
ffffffff81391c1a>] rest_init+0x7e/0x80
[<
ffffffff818bbd38>] start_kernel+0x3e8/0x3f3
[<
ffffffff818bb2bc>] x86_64_start_reservations+0xa7/0xab
[<
ffffffff818bb3b8>] x86_64_start_kernel+0xf8/0x107
irq event stamp: 42037
hardirqs last enabled at (42037): [<
ffffffff813a7b21>] _raw_spin_unlock_irqrestore+0x47/0x56
hardirqs last disabled at (42036): [<
ffffffff813a72f4>] _raw_spin_lock_irqsave+0x2b/0x88
softirqs last enabled at (42000): [<
ffffffffa0353ea6>] spin_unlock_bh+0xe/0x10 [ath9k]
softirqs last disabled at (41998): [<
ffffffff813a7463>] _raw_spin_lock_bh+0x18/0x6e
other info that might help us debug this:
4 locks held by rmmod/3642:
#0: (rtnl_mutex){+.+.+.}, at: [<
ffffffff8132c10d>] rtnl_lock+0x17/0x19
#1: (&wdev->mtx){+.+.+.}, at: [<
ffffffffa01e53f2>] cfg80211_netdev_notifier_call+0x28d/0x46d [cfg80211]
#2: (&ifmgd->mtx){+.+.+.}, at: [<
ffffffffa0260834>] ieee80211_mgd_deauth+0x3f/0x17e [mac80211]
#3: (&local->sta_mtx){+.+.+.}, at: [<
ffffffffa025a381>] sta_info_destroy_addr+0x2b/0x5e [mac80211]
stack backtrace:
Pid: 3642, comm: rmmod Not tainted 2.6.33-wl #12
Call Trace:
[<
ffffffff81074469>] valid_state+0x178/0x18b
[<
ffffffff81014f94>] ? save_stack_trace+0x2f/0x4c
[<
ffffffff81074e08>] ? check_usage_backwards+0x0/0x88
[<
ffffffff8107458f>] mark_lock+0x113/0x230
[<
ffffffff810757f1>] __lock_acquire+0x36a/0xd35
[<
ffffffff8101018d>] ? native_sched_clock+0x2d/0x5f
[<
ffffffffa03568c3>] ? ath_tx_node_cleanup+0x62/0x180 [ath9k]
[<
ffffffff81076289>] lock_acquire+0xcd/0xf1
[<
ffffffffa03568c3>] ? ath_tx_node_cleanup+0x62/0x180 [ath9k]
[<
ffffffff810732eb>] ? trace_hardirqs_off+0xd/0xf
[<
ffffffff813a7193>] _raw_spin_lock+0x36/0x69
[<
ffffffffa03568c3>] ? ath_tx_node_cleanup+0x62/0x180 [ath9k]
[<
ffffffffa03568c3>] ath_tx_node_cleanup+0x62/0x180 [ath9k]
[<
ffffffff810749ed>] ? trace_hardirqs_on+0xd/0xf
[<
ffffffffa0353950>] ath9k_sta_remove+0x22/0x26 [ath9k]
[<
ffffffffa025a08f>] __sta_info_destroy+0x1ad/0x38c [mac80211]
[<
ffffffffa025a394>] sta_info_destroy_addr+0x3e/0x5e [mac80211]
[<
ffffffffa02605d6>] ieee80211_set_disassoc+0x175/0x180 [mac80211]
[<
ffffffffa026084d>] ieee80211_mgd_deauth+0x58/0x17e [mac80211]
[<
ffffffff813a60c1>] ? __mutex_lock_common+0x37f/0x3a4
[<
ffffffffa01e53f2>] ? cfg80211_netdev_notifier_call+0x28d/0x46d [cfg80211]
[<
ffffffffa026786e>] ieee80211_deauth+0x1e/0x20 [mac80211]
[<
ffffffffa01f47f9>] __cfg80211_mlme_deauth+0x130/0x13f [cfg80211]
[<
ffffffffa01e53f2>] ? cfg80211_netdev_notifier_call+0x28d/0x46d [cfg80211]
[<
ffffffff810732eb>] ? trace_hardirqs_off+0xd/0xf
[<
ffffffffa01f7eee>] __cfg80211_disconnect+0x111/0x189 [cfg80211]
[<
ffffffffa01e5433>] cfg80211_netdev_notifier_call+0x2ce/0x46d [cfg80211]
[<
ffffffff813aa9ea>] notifier_call_chain+0x37/0x63
[<
ffffffff81068c98>] raw_notifier_call_chain+0x14/0x16
[<
ffffffff81322e97>] call_netdevice_notifiers+0x1b/0x1d
[<
ffffffff8132386d>] dev_close+0x6a/0xa6
[<
ffffffff8132395f>] rollback_registered_many+0xb6/0x2f4
[<
ffffffff81323bb8>] unregister_netdevice_many+0x1b/0x66
[<
ffffffffa026494f>] ieee80211_remove_interfaces+0xc5/0xd0 [mac80211]
[<
ffffffffa02580a2>] ieee80211_unregister_hw+0x47/0xe8 [mac80211]
[<
ffffffffa035290e>] ath9k_deinit_device+0x7a/0x9b [ath9k]
[<
ffffffffa035bc26>] ath_pci_remove+0x38/0x76 [ath9k]
[<
ffffffff8120940a>] pci_device_remove+0x2d/0x51
[<
ffffffff8129d797>] __device_release_driver+0x7b/0xd1
[<
ffffffff8129d885>] driver_detach+0x98/0xbe
[<
ffffffff8129ca7a>] bus_remove_driver+0x94/0xb7
[<
ffffffff8129ddd6>] driver_unregister+0x6c/0x74
[<
ffffffff812096d2>] pci_unregister_driver+0x46/0xad
[<
ffffffffa035bae1>] ath_pci_exit+0x15/0x17 [ath9k]
[<
ffffffffa035e1a2>] ath9k_exit+0xe/0x2f [ath9k]
[<
ffffffff8108050a>] sys_delete_module+0x1c7/0x236
[<
ffffffff813a7df5>] ? retint_swapgs+0x13/0x1b
[<
ffffffff810749b5>] ? trace_hardirqs_on_caller+0x119/0x144
[<
ffffffff8109b9f6>] ? audit_syscall_entry+0x11e/0x14a
[<
ffffffff81009bb2>] system_call_fastpath+0x16/0x1b
wlan1: deauthenticating from 00:23:cd:e1:f9:b2 by local choice (reason=3)
PM: Removing info for No Bus:wlan1
cfg80211: Calling CRDA to update world regulatory domain
PM: Removing info for No Bus:rfkill2
PM: Removing info for No Bus:phy1
ath9k 0000:16:00.0: PCI INT A disabled
Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Ping Cheng [Tue, 15 Dec 2009 08:35:24 +0000 (00:35 -0800)]
Input: wacom - ensure the device is initialized properly upon resume
commit
232f5693e5c9483e222528ef81979e42ea2f2908 upstream.
Call wacom_query_tablet_data() from wacom_resume() so the device will be
switched to Wacom mode upon resume. Devices that require this are: regular
tablets and two finger touch devices.
Signed-off-by: Ping Cheng <pingc@wacom.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Don Skidmore [Tue, 8 Dec 2009 07:22:23 +0000 (07:22 +0000)]
ixgbe: add support for 82599 KR device 0x1517
commit
74757d49016a8b06ca028196886641d7aeb78de5 upstream.
Signed-off-by: Don Skidmore <donald.c.skidmore@intel.com>
Acked-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Bruce Allan [Tue, 1 Dec 2009 15:50:31 +0000 (15:50 +0000)]
e1000e: enable new 82567V-3 device
commit
9e135a2e6266eba276f33c404a2478499bc07ff5 upstream.
This new PCI device ID is for a new combination of MAC and PHY both of
which already have supporting code in the driver, just not yet in this
combination. During validation of the device, an intermittent issue was
discovered with waking it from a suspended state which can be resolved with
the pre-existing workaround to disable gigabit speed prior to suspending.
Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Kees Cook [Sun, 8 Nov 2009 17:37:00 +0000 (09:37 -0800)]
sysctl: require CAP_SYS_RAWIO to set mmap_min_addr
commit
0e1a6ef2dea88101b056b6d9984f3325c5efced3 upstream.
Currently the mmap_min_addr value can only be bypassed during mmap when
the task has CAP_SYS_RAWIO. However, the mmap_min_addr sysctl value itself
can be adjusted to 0 if euid == 0, allowing a bypass without CAP_SYS_RAWIO.
This patch adds a check for the capability before allowing mmap_min_addr to
be changed.
Signed-off-by: Kees Cook <kees.cook@canonical.com>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
David S. Miller [Wed, 3 Mar 2010 17:06:03 +0000 (09:06 -0800)]
sparc64: Make prom entry spinlock NMI safe.
[ Upstream commit
8a4fd1e4922413cfdfa6c51a59efb720d904a5eb ]
If we do something like try to print to the OF console from an NMI
while we're already in OpenFirmware, we'll deadlock on the spinlock.
Use a raw spinlock and disable NMIs when we take it.
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Peter Zijlstra [Wed, 16 Dec 2009 17:04:31 +0000 (18:04 +0100)]
sched: Mark boot-cpu active before smp_init()
commit
933b0618d8b2a59c7a0742e43836544e02f1e9bd upstream.
A UP machine has 1 active cpu, not having the boot-cpu in the
active map when starting the scheduler confuses things.
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Mike Galbraith <efault@gmx.de>
LKML-Reference: <
20091216170517.
423469527@chello.nl>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Cc: Christoph Biedl <linux-kernel.bfrz@manchmal.in-ulm.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Alexander Duyck [Fri, 19 Feb 2010 17:57:46 +0000 (17:57 +0000)]
pci: add support for 82576NS serdes to existing SR-IOV quirk
commit
7a0deb6bcda98c2a764cb87f1441eef920fd3663 upstream.
This patch adds support for the 82576NS Serdes adapter to the existing pci
quirk for 82576 parts.
Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Srinivas [Tue, 24 Nov 2009 14:37:39 +0000 (20:07 +0530)]
mvsas: add support for Adaptec ASC-1045/1405 SAS/SATA HBA
commit
7ec4ad0125db0222e397508c190b01c8f2b5f7cd upstream.
This is support for Adaptec ASC-1045/1405 SAS/SATA HBA on mvsas, which
is based on Marvell 88SE6440 chipset.
Signed-off-by: Srinivas <satyasrinivasp@hcl.in>
Cc: Andy Yan <ayan@marvell.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Cc: Thomas Voegtle <tv@lio96.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Suresh Siddha [Thu, 18 Feb 2010 23:30:55 +0000 (15:30 -0800)]
x86, apic: Don't use logical-flat mode when CPU hotplug may exceed 8 CPUs
commit
681ee44d40d7c93b42118320e4620d07d8704fd6 upstream
We need to fall back from logical-flat APIC mode to physical-flat mode
when we have more than 8 CPUs. However, in the presence of CPU
hotplug(with bios listing not enabled but possible cpus as disabled cpus in
MADT), we have to consider the number of possible CPUs rather than
the number of current CPUs; otherwise we may cross the 8-CPU boundary
when CPUs are added later.
32bit apic code can use more cleanups (like the removal of vendor checks in
32bit default_setup_apic_routing()) and more unifications with 64bit code.
Yinghai has some patches in works already. This patch addresses the boot issue
that is reported in the virtualization guest context.
Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
Acked-by: Shaohui Zheng <shaohui.zheng@intel.com>
Reviewed-by: Yinghai Lu <yinghai@kernel.org>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Thomas Gleixner [Fri, 13 Nov 2009 16:05:44 +0000 (17:05 +0100)]
hrtimer: Tune hrtimer_interrupt hang logic
commit
41d2e494937715d3150e5c75d01f0e75ae899337 upstream.
The hrtimer_interrupt hang logic adjusts min_delta_ns based on the
execution time of the hrtimer callbacks.
This is error-prone for virtual machines, where a guest vcpu can be
scheduled out during the execution of the callbacks (and the callbacks
themselves can do operations that translate to blocking operations in
the hypervisor), which in can lead to large min_delta_ns rendering the
system unusable.
Replace the current heuristics with something more reliable. Allow the
interrupt code to try 3 times to catch up with the lost time. If that
fails use the total time spent in the interrupt handler to defer the
next timer interrupt so the system can catch up with other things
which got delayed. Limit that deferment to 100ms.
The retry events and the maximum time spent in the interrupt handler
are recorded and exposed via /proc/timer_list
Inspired by a patch from Marcelo.
Reported-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Marcelo Tosatti <mtosatti@redhat.com>
Cc: kvm@vger.kernel.org
Cc: Jeremy Fitzhardinge <jeremy@goop.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Francesco Lavra [Thu, 31 Dec 2009 11:47:11 +0000 (08:47 -0300)]
V4L/DVB (13961): em28xx-dvb: fix memleak in dvb_fini()
commit
19f48cb105b7fa18d0dcab435919a3a29b7a7c4c upstream.
this patch fixes a memory leak which occurs when an em28xx card with DVB
extension is unplugged or its DVB extension driver is unloaded. In
dvb_fini(), dev->dvb must be freed before being set to NULL, as is done
in dvb_init() in case of error.
Note that this bug is also present in the latest stable kernel release.
Signed-off-by: Francesco Lavra <francescolavra@interfree.it>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Neil Horman [Fri, 5 Mar 2010 21:44:16 +0000 (13:44 -0800)]
coredump: suppress uid comparison test if core output files are pipes
commit
76595f79d76fbe6267a51b3a866a028d150f06d4 upstream.
Modify uid check in do_coredump so as to not apply it in the case of
pipes.
This just got noticed in testing. The end of do_coredump validates the
uid of the inode for the created file against the uid of the crashing
process to ensure that no one can pre-create a core file with different
ownership and grab the information contained in the core when they
shouldn' tbe able to. This causes failures when using pipes for a core
dumps if the crashing process is not root, which is the uid of the pipe
when it is created.
The fix is simple. Since the check for matching uid's isn't relevant for
pipes (a process can't create a pipe that the uermodehelper code will open
anyway), we can just just skip it in the event ispipe is non-zero
Reverts a pipe-affecting change which was accidentally made in
: commit
c46f739dd39db3b07ab5deb4e3ec81e1c04a91af
: Author: Ingo Molnar <mingo@elte.hu>
: AuthorDate: Wed Nov 28 13:59:18 2007 +0100
: Commit: Linus Torvalds <torvalds@woody.linux-foundation.org>
: CommitDate: Wed Nov 28 10:58:01 2007 -0800
:
: vfs: coredumping fix
Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Cc: Andi Kleen <andi@firstfloor.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: maximilian attems <max@stro.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Marcin Slusarz [Mon, 22 Feb 2010 20:44:22 +0000 (12:44 -0800)]
efifb: fix framebuffer handoff
commit
89f3f2199084a160a3a45fa6d9af235696321758 upstream.
Commit
4410f3910947dcea8672280b3adecd53cec4e85e ("fbdev: add support for
handoff from firmware to hw framebuffers") didn't add fb_destroy
operation to efifb. Fix it and change aperture_size to match size
passed to request_mem_region.
Addresses http://bugzilla.kernel.org/show_bug.cgi?id=15151
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Reported-by: Alex Zhavnerchik <alex.vizor@gmail.com>
Tested-by: Alex Zhavnerchik <alex.vizor@gmail.com>
Acked-by: Peter Jones <pjones@redhat.com>
Cc: Huang Ying <ying.huang@intel.com>
Cc: Dave Airlie <airlied@redhat.com>
Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: maximilian attems <max@stro.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Adam Jackson [Thu, 3 Dec 2009 22:44:36 +0000 (17:44 -0500)]
drm/edid: Unify detailed block parsing between base and extension blocks
commit
9cf00977da092096c7a983276dad8b3002d23a99 upstream.
Also fix an embarassing bug in standard timing subblock parsing that
would result in an infinite loop.
Signed-off-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Cc: maximilian attems <max@stro.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Andrew Patterson [Thu, 3 Dec 2009 17:28:20 +0000 (10:28 -0700)]
PCI: unconditionally clear AER uncorr status register during cleanup
commit
6cdfd995a65a52e05b99e3a72a9b979abe73b312 upstream.
The current implementation of pci_cleanup_aer_uncorrect_error_status
only clears either fatal or non-fatal error status bits depending
on the state of the I/O channel. This implementation will then often
leave some bits set after PCI error recovery completes. The uncleared bit
settings will then be falsely reported the next time an AER interrupt is
generated for that hierarchy. An easy way to illustrate this issue is to
use the aer-inject module to simultaneously inject both an uncorrectable
non-fatal and uncorrectable fatal error. One of the errors will not be
cleared.
This patch resolves this issue by unconditionally clearing all bits in
the AER uncorrectable status register. All settings and corrective action
strategies are saved and determined before
pci_cleanup_aer_uncorrect_error_status is called, so this change should not
affect errory handling functionality.
Signed-off-by: Andrew Patterson <andrew.patterson@hp.com>
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Cc: Alex Chiang <achiang@hp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Steven Rostedt [Sat, 13 Mar 2010 01:03:30 +0000 (20:03 -0500)]
tracing: Do not record user stack trace from NMI context
commit
b6345879ccbd9b92864fbd7eb8ac48acdb4d6b15 upstream.
A bug was found with Li Zefan's ftrace_stress_test that caused applications
to segfault during the test.
Placing a tracing_off() in the segfault code, and examining several
traces, I found that the following was always the case. The lock tracer
was enabled (lockdep being required) and userstack was enabled. Testing
this out, I just enabled the two, but that was not good enough. I needed
to run something else that could trigger it. Running a load like hackbench
did not work, but executing a new program would. The following would
trigger the segfault within seconds:
# echo 1 > /debug/tracing/options/userstacktrace
# echo 1 > /debug/tracing/events/lock/enable
# while :; do ls > /dev/null ; done
Enabling the function graph tracer and looking at what was happening
I finally noticed that all cashes happened just after an NMI.
1) | copy_user_handle_tail() {
1) | bad_area_nosemaphore() {
1) | __bad_area_nosemaphore() {
1) | no_context() {
1) | fixup_exception() {
1) 0.319 us | search_exception_tables();
1) 0.873 us | }
[...]
1) 0.314 us | __rcu_read_unlock();
1) 0.325 us | native_apic_mem_write();
1) 0.943 us | }
1) 0.304 us | rcu_nmi_exit();
[...]
1) 0.479 us | find_vma();
1) | bad_area() {
1) | __bad_area() {
After capturing several traces of failures, all of them happened
after an NMI. Curious about this, I added a trace_printk() to the NMI
handler to read the regs->ip to see where the NMI happened. In which I
found out it was here:
ffffffff8135b660 <page_fault>:
ffffffff8135b660: 48 83 ec 78 sub $0x78,%rsp
ffffffff8135b664: e8 97 01 00 00 callq
ffffffff8135b800 <error_entry>
What was happening is that the NMI would happen at the place that a page
fault occurred. It would call rcu_read_lock() which was traced by
the lock events, and the user_stack_trace would run. This would trigger
a page fault inside the NMI. I do not see where the CR2 register is
saved or restored in NMI handling. This means that it would corrupt
the page fault handling that the NMI interrupted.
The reason the while loop of ls helped trigger the bug, was that
each execution of ls would cause lots of pages to be faulted in, and
increase the chances of the race happening.
The simple solution is to not allow user stack traces in NMI context.
After this patch, I ran the above "ls" test for a couple of hours
without any issues. Without this patch, the bug would trigger in less
than a minute.
Reported-by: Li Zefan <lizf@cn.fujitsu.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Steven Rostedt [Sat, 13 Mar 2010 00:56:00 +0000 (19:56 -0500)]
tracing: Disable buffer switching when starting or stopping trace
commit
a2f8071428ed9a0f06865f417c962421c9a6b488 upstream.
When the trace iterator is read, tracing_start() and tracing_stop()
is called to stop tracing while the iterator is processing the trace
output.
These functions disable both the standard buffer and the max latency
buffer. But if the wakeup tracer is running, it can switch these
buffers between the two disables:
buffer = global_trace.buffer;
if (buffer)
ring_buffer_record_disable(buffer);
<<<--------- swap happens here
buffer = max_tr.buffer;
if (buffer)
ring_buffer_record_disable(buffer);
What happens is that we disabled the same buffer twice. On tracing_start()
we can enable the same buffer twice. All ring_buffer_record_disable()
must be matched with a ring_buffer_record_enable() or the buffer
can be disable permanently, or enable prematurely, and cause a bug
where a reset happens while a trace is commiting.
This patch protects these two by taking the ftrace_max_lock to prevent
a switch from occurring.
Found with Li Zefan's ftrace_stress_test.
Reported-by: Lai Jiangshan <laijs@cn.fujitsu.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Steven Rostedt [Sat, 13 Mar 2010 00:48:41 +0000 (19:48 -0500)]
tracing: Use same local variable when resetting the ring buffer
commit
283740c619d211e34572cc93c8cdba92ccbdb9cc upstream.
In the ftrace code that resets the ring buffer it references the
buffer with a local variable, but then uses the tr->buffer as the
parameter to reset. If the wakeup tracer is running, which can
switch the tr->buffer with the max saved buffer, this can break
the requirement of disabling the buffer before the reset.
buffer = tr->buffer;
ring_buffer_record_disable(buffer);
synchronize_sched();
__tracing_reset(tr->buffer, cpu);
If the tr->buffer is swapped, then the reset is not happening to the
buffer that was disabled. This will cause the ring buffer to fail.
Found with Li Zefan's ftrace_stress_test.
Reported-by: Lai Jiangshan <laijs@cn.fujitsu.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Marcel Holtmann [Wed, 3 Feb 2010 23:52:18 +0000 (15:52 -0800)]
Bluetooth: Fix sleeping function in RFCOMM within invalid context
commit
485f1eff73a7b932fd3abb0dfcf804e1a1f59025 upstream.
With the commit
9e726b17422bade75fba94e625cd35fd1353e682 the
rfcomm_session_put() gets accidentially called from a timeout
callback and results in this:
BUG: sleeping function called from invalid context at net/core/sock.c:1897
in_atomic(): 1, irqs_disabled(): 0, pid: 0, name: swapper
Pid: 0, comm: swapper Tainted: P 2.6.32 #31
Call Trace:
<IRQ> [<
ffffffff81036455>] __might_sleep+0xf8/0xfa
[<
ffffffff8138ef1d>] lock_sock_nested+0x29/0xc4
[<
ffffffffa03921b3>] lock_sock+0xb/0xd [l2cap]
[<
ffffffffa03948e6>] l2cap_sock_shutdown+0x1c/0x76 [l2cap]
[<
ffffffff8106adea>] ? clockevents_program_event+0x75/0x7e
[<
ffffffff8106bea2>] ? tick_dev_program_event+0x37/0xa5
[<
ffffffffa0394967>] l2cap_sock_release+0x27/0x67 [l2cap]
[<
ffffffff8138c971>] sock_release+0x1a/0x67
[<
ffffffffa03d2492>] rfcomm_session_del+0x34/0x53 [rfcomm]
[<
ffffffffa03d24c5>] rfcomm_session_put+0x14/0x16 [rfcomm]
[<
ffffffffa03d28b4>] rfcomm_session_timeout+0xe/0x1a [rfcomm]
[<
ffffffff810554a8>] run_timer_softirq+0x1e2/0x29a
[<
ffffffffa03d28a6>] ? rfcomm_session_timeout+0x0/0x1a [rfcomm]
[<
ffffffff8104e0f6>] __do_softirq+0xfe/0x1c5
[<
ffffffff8100e8ce>] ? timer_interrupt+0x1a/0x21
[<
ffffffff8100cc4c>] call_softirq+0x1c/0x28
[<
ffffffff8100e05b>] do_softirq+0x33/0x6b
[<
ffffffff8104daf6>] irq_exit+0x36/0x85
[<
ffffffff8100d7a9>] do_IRQ+0xa6/0xbd
[<
ffffffff8100c493>] ret_from_intr+0x0/0xa
<EOI> [<
ffffffff812585b3>] ? acpi_idle_enter_bm+0x269/0x294
[<
ffffffff812585a9>] ? acpi_idle_enter_bm+0x25f/0x294
[<
ffffffff81373ddc>] ? cpuidle_idle_call+0x97/0x107
[<
ffffffff8100aca0>] ? cpu_idle+0x53/0xaa
[<
ffffffff81429006>] ? rest_init+0x7a/0x7c
[<
ffffffff8177bc8c>] ? start_kernel+0x389/0x394
[<
ffffffff8177b29c>] ? x86_64_start_reservations+0xac/0xb0
[<
ffffffff8177b384>] ? x86_64_start_kernel+0xe4/0xeb
To fix this, the rfcomm_session_put() needs to be moved out of
rfcomm_session_timeout() into rfcomm_process_sessions(). In that
context it is perfectly fine to sleep and disconnect the socket.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Tested-by: David John <davidjon@xenontk.org>
Cc: Chase Douglas <chase.douglas@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Steven Rostedt [Sat, 13 Mar 2010 00:41:23 +0000 (19:41 -0500)]
function-graph: Init curr_ret_stack with ret_stack
commit
ea14eb714041d40fcc5180b5a586034503650149 upstream.
If the graph tracer is active, and a task is forked but the allocating of
the processes graph stack fails, it can cause crash later on.
This is due to the temporary stack being NULL, but the curr_ret_stack
variable is copied from the parent. If it is not -1, then in
ftrace_graph_probe_sched_switch() the following:
for (index = next->curr_ret_stack; index >= 0; index--)
next->ret_stack[index].calltime += timestamp;
Will cause a kernel OOPS.
Found with Li Zefan's ftrace_stress_test.
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Lai Jiangshan [Mon, 8 Mar 2010 06:50:43 +0000 (14:50 +0800)]
ring-buffer: Move disabled check into preempt disable section
commit
52fbe9cde7fdb5c6fac196d7ebd2d92d05ef3cd4 upstream.
The ring buffer resizing and resetting relies on a schedule RCU
action. The buffers are disabled, a synchronize_sched() is called
and then the resize or reset takes place.
But this only works if the disabling of the buffers are within the
preempt disabled section, otherwise a window exists that the buffers
can be written to while a reset or resize takes place.
Reported-by: Li Zefan <lizf@cn.fujitsu.com>
Signed-off-by: Lai Jiangshan <laijs@cn.fujitsu.com>
LKML-Reference: <
4B949E43.
2010906@cn.fujitsu.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Bob Copeland [Thu, 21 Jan 2010 04:51:04 +0000 (23:51 -0500)]
ath5k: fix setup for CAB queue
commit
a951ae2176b982574ffa197455db6c89359fd5eb upstream.
The beacon sent gating doesn't seem to work with any combination
of flags. Thus, buffered frames tend to stay buffered forever,
using up tx descriptors.
Instead, use the DBA gating and hold transmission of the buffered
frames until 80% of the beacon interval has elapsed using the ready
time. This fixes the following error in AP mode:
ath5k phy0: no further txbuf available, dropping packet
Add a comment to acknowledge that this isn't the best solution.
Signed-off-by: Bob Copeland <me@bobcopeland.com>
Acked-by: Nick Kossifidis <mickflemm@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Bob Copeland [Thu, 11 Mar 2010 23:23:48 +0000 (18:23 -0500)]
ath5k: dont use external sleep clock in AP mode
commit
5d6ce628f986d1a3c523cbb0a5a52095c48cc332 upstream
When using the external sleep clock in AP mode, the
TSF increments too quickly, causing beacon interval
to be much lower than it is supposed to be, resulting
in lots of beacon-not-ready interrupts.
This fixes http://bugzilla.kernel.org/show_bug.cgi?id=14802.
Signed-off-by: Bob Copeland <me@bobcopeland.com>
Acked-by: Nick Kossifidis <mickflemm@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Cc: Luis Rodriguez <lrodriguez@atheros.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Jean Delvare [Sat, 13 Mar 2010 19:56:53 +0000 (20:56 +0100)]
i2c-i801: Don't use the block buffer for I2C block writes
commit
c074c39d62306efa5ba7c69c1a1531bc7333d252 upstream.
Experience has shown that the block buffer can only be used for SMBus
(not I2C) block transactions, even though the datasheet doesn't
mention this limitation.
Reported-by: Felix Rubinstein <felixru@gmail.com>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Cc: Oleg Ryjkov <oryjkov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Christoph Fritz [Sun, 14 Mar 2010 06:26:23 +0000 (22:26 -0800)]
Input: i8042 - add ALDI/MEDION netbook E1222 to qurik reset table
commit
31968ecf584330b51a25b7bf881c2b632a02a3fb upstream.
ALDI/MEDION netbook E1222 needs to be in the reset quirk list for
its touchpad's proper function.
Reported-by: Michael Fischer <mifi@gmx.de>
Signed-off-by: Christoph Fritz <chf.fritz@googlemail.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Thomas Bächler [Wed, 10 Mar 2010 04:38:48 +0000 (20:38 -0800)]
Input: alps - add support for the touchpad on Toshiba Tecra A11-11L
commit
eb8bff85c5bd5caef7c374ff32b86545029efb56 upstream.
Signed-off-by: Thomas Bächler <thomas@archlinux.org>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
john stultz [Mon, 1 Mar 2010 20:34:43 +0000 (12:34 -0800)]
timekeeping: Prevent oops when GENERIC_TIME=n
commit
ad6759fbf35d104dbf573cd6f4c6784ad6823f7e upstream.
Aaro Koskinen reported an issue in kernel.org bugzilla #15366, where
on non-GENERIC_TIME systems, accessing
/sys/devices/system/clocksource/clocksource0/current_clocksource
results in an oops.
It seems the timekeeper/clocksource rework missed initializing the
curr_clocksource value in the !GENERIC_TIME case.
Thanks to Aaro for reporting and diagnosing the issue as well as
testing the fix!
Reported-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Signed-off-by: John Stultz <johnstul@us.ibm.com>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
LKML-Reference: <
1267475683.4216.61.camel@localhost.localdomain>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Daniel T Chen [Mon, 15 Mar 2010 05:04:26 +0000 (01:04 -0400)]
ALSA: hda: enable MSI for Gateway M-6866
BugLink: https://bugs.launchpad.net/bugs/538918
The OR has verified that explicitly enabling MSI is necessary for audio
to be audible by default.
This patch is only applicable to 2.6.32.y; in 2.6.33, MSI is enabled by
default.
Reported-by: Sam Townsend <stownsend42@sbcglobal.net>
Tested-by: Sam Townsend <stownsend42@sbcglobal.net>
Acked-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Daniel T Chen <crimsun@ubuntu.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Takashi Iwai [Mon, 8 Mar 2010 11:13:07 +0000 (12:13 +0100)]
ALSA: hda - Fix input source elements of secondary ADCs on Realtek
commit
5311114d4867113c00f78829d4ce14be458ec925 upstream.
Since alc_auto_create_input_ctls() doesn't set the elements for the
secondary ADCs, "Input Source" elemtns for these also get empty, resulting
in buggy outputs of alsactl like:
control.14 {
comment.access 'read write'
comment.type ENUMERATED
comment.count 1
iface MIXER
name 'Input Source'
index 1
value 0
}
This patch fixes alc_mux_enum_*() (and others) to fall back to the
first entry if the secondary input mux is empty.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Matt Carlson [Fri, 12 Mar 2010 23:12:13 +0000 (18:12 -0500)]
tg3: Fix 5906 transmit hangs
This is a resubmit backport of commit
92c6b8d16a36df3f28b2537bed2a56491fb08f11
to kernel version 2.6.32. The gentoo bug report can be found at
https://bugs.gentoo.org/show_bug.cgi?id=301091. Thanks to Matt Carlson for his
assistance and working me to fix a regression caused by the initial patch. The
original description is as follows:
The 5906 has trouble with fragments that are less than 8 bytes in size. This
patch works around the problem by pivoting the 5906's transmit routine to
tg3_start_xmit_dma_bug() and introducing a new SHORT_DMA_BUG flag that enables
code to detect and react to the problematic condition.
Signed-off-by: Mike Pagano <mpagano@gentoo.org>
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Louis Rilling [Tue, 9 Mar 2010 06:14:41 +0000 (06:14 +0000)]
tg3: Fix tg3_poll_controller() passing wrong pointer to tg3_interrupt()
commit
fe234f0e5cbb880792d2d1ac0743cf8c07e9dde3 upstream.
Commit
09943a1819a240ff4a72f924d0038818fcdd0a90
Author: Matt Carlson <mcarlson@broadcom.com>
Date: Fri Aug 28 14:01:57 2009 +0000
tg3: Convert ISR parameter to tnapi
forgot to update tg3_poll_controller(), leading to intermittent crashes with
netpoll.
Fix this.
Signed-off-by: Louis Rilling <louis.rilling@kerlabs.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
David Daney [Fri, 4 Dec 2009 01:43:54 +0000 (17:43 -0800)]
MIPS: Cleanup forgotten label_module_alloc in tlbex.c
commit
abbdc3d88aa2d5c937b21044c336bcd056c1732f upstream.
commit
c8af165342e83a4eb078c9607d29a7c399d30a53 (lmo) rsp.
e0cc87f59490d7d62a8ab2a76498dc8a2b64927a (kernel.org) left
label_module_alloc unused. Remove it now.
Signed-off-by: David Daney <ddaney@caviumnetworks.com>
Cc: linux-mips@linux-mips.org
Patchwork: http://patchwork.linux-mips.org/patch/752/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Russell King [Thu, 25 Feb 2010 23:56:38 +0000 (23:56 +0000)]
ARM: Fix decompressor's kernel size estimation for ROM=y
commit
98e12b5a6e05413420a7e3b3eca7fbfc2ff41b6d upstream.
Commit
2552fc2 changed the way the decompressor decides if it is safe
to decompress the kernel directly to its final location. Unfortunately,
it took the top of the compressed data as being the stack pointer,
which it is for ROM=n cases. However, for ROM=y, the stack pointer
is not relevant, and results in the wrong answer.
Fix this by explicitly storing the end of the biggybacked data in the
decompressor, and use that to calculate the compressed image size.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Russell King [Wed, 10 Mar 2010 23:23:53 +0000 (15:23 -0800)]
decompress: fix new decompressor for PIC
commit
5ceaa2f39bfa73c4398cd01e78f1c3ebde3d3383 upstream.
The ARM kernel decompressor wants to be able to relocate r/w data
independently from the rest of the image, and we do this by ensuring that
r/w data has global visibility. Define STATIC_RW_DATA to be empty to
achieve this.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Cc: Alain Knaff <alain@knaff.lu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Julia Lawall [Wed, 10 Mar 2010 23:20:42 +0000 (15:20 -0800)]
drivers/scsi/ses.c: eliminate double free
commit
9b3a6549b2602ca30f58715a0071e29f9898cae9 upstream.
The few lines below the kfree of hdr_buf may go to the label err_free
which will also free hdr_buf. The most straightforward solution seems to
be to just move the kfree of hdr_buf after these gotos.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@r@
identifier E;
expression E1;
iterator I;
statement S;
@@
*kfree(E);
... when != E = E1
when != I(E,...) S
when != &E
*kfree(E);
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Shaohua Li [Wed, 18 Nov 2009 07:15:02 +0000 (15:15 +0800)]
drm/i915: fix gpio register detection logic for BIOS without VBT
commit
29874f44fbcbc24b231b42c9956f8f9de9407231 upstream.
if no VBT is present, crt_ddc_bus will be left at 0, and cause us
to use that for the GPIO register offset. That's never a valid register
offset, so let the "undefined" value be 0 instead of -1.
Signed-off-by: Shaohua Li <shaohua.li@intel.com>
Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
[anholt: clarified the commit message a bit]
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Greg Kroah-Hartman [Mon, 15 Mar 2010 15:52:04 +0000 (08:52 -0700)]
Linux 2.6.32.10
Ian Campbell [Wed, 17 Feb 2010 10:38:10 +0000 (10:38 +0000)]
x86, mm: Allow highmem user page tables to be disabled at boot time
commit
14315592009c17035cac81f4954d5a1f4d71e489 upstream.
Distros generally (I looked at Debian, RHEL5 and SLES11) seem to
enable CONFIG_HIGHPTE for any x86 configuration which has highmem
enabled. This means that the overhead applies even to machines which
have a fairly modest amount of high memory and which therefore do not
really benefit from allocating PTEs in high memory but still pay the
price of the additional mapping operations.
Running kernbench on a 4G box I found that with CONFIG_HIGHPTE=y but
no actual highptes being allocated there was a reduction in system
time used from 59.737s to 55.9s.
With CONFIG_HIGHPTE=y and highmem PTEs being allocated:
Average Optimal load -j 4 Run (std deviation):
Elapsed Time 175.396 (0.238914)
User Time 515.983 (5.85019)
System Time 59.737 (1.26727)
Percent CPU 263.8 (71.6796)
Context Switches 39989.7 (4672.64)
Sleeps 42617.7 (246.307)
With CONFIG_HIGHPTE=y but with no highmem PTEs being allocated:
Average Optimal load -j 4 Run (std deviation):
Elapsed Time 174.278 (0.831968)
User Time 515.659 (6.07012)
System Time 55.9 (1.07799)
Percent CPU 263.8 (71.266)
Context Switches 39929.6 (4485.13)
Sleeps 42583.7 (373.039)
This patch allows the user to control the allocation of PTEs in
highmem from the command line ("userpte=nohigh") but retains the
status-quo as the default.
It is possible that some simple heuristic could be developed which
allows auto-tuning of this option however I don't have a sufficiently
large machine available to me to perform any particularly meaningful
experiments. We could probably handwave up an argument for a threshold
at 16G of total RAM.
Assuming 768M of lowmem we have 196608 potential lowmem PTE
pages. Each page can map 2M of RAM in a PAE-enabled configuration,
meaning a maximum of 384G of RAM could potentially be mapped using
lowmem PTEs.
Even allowing generous factor of 10 to account for other required
lowmem allocations, generous slop to account for page sharing (which
reduces the total amount of RAM mappable by a given number of PT
pages) and other innacuracies in the estimations it would seem that
even a 32G machine would not have a particularly pressing need for
highmem PTEs. I think 32G could be considered to be at the upper bound
of what might be sensible on a 32 bit machine (although I think in
practice 64G is still supported).
It's seems questionable if HIGHPTE is even a win for any amount of RAM
you would sensibly run a 32 bit kernel on rather than going 64 bit.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
LKML-Reference: <
1266403090-20162-1-git-send-email-ian.campbell@citrix.com>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Thomas Gleixner [Wed, 17 Feb 2010 08:05:48 +0000 (09:05 +0100)]
sched: Don't use possibly stale sched_class
commit
83ab0aa0d5623d823444db82c3b3c34d7ec364ae upstream.
setscheduler() saves task->sched_class outside of the rq->lock held
region for a check after the setscheduler changes have become
effective. That might result in checking a stale value.
rtmutex_setprio() has the same problem, though it is protected by
p->pi_lock against setscheduler(), but for correctness sake (and to
avoid bad examples) it needs to be fixed as well.
Retrieve task->sched_class inside of the rq->lock held region.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Suresh Siddha [Sat, 13 Feb 2010 01:14:22 +0000 (17:14 -0800)]
sched: Fix SMT scheduler regression in find_busiest_queue()
commit
9000f05c6d1607f79c0deacf42b09693be673f4c upstream.
Fix a SMT scheduler performance regression that is leading to a scenario
where SMT threads in one core are completely idle while both the SMT threads
in another core (on the same socket) are busy.
This is caused by this commit (with the problematic code highlighted)
commit
bdb94aa5dbd8b55e75f5a50b61312fe589e2c2d1
Author: Peter Zijlstra <a.p.zijlstra@chello.nl>
Date: Tue Sep 1 10:34:38 2009 +0200
sched: Try to deal with low capacity
@@ -4203,15 +4223,18 @@ find_busiest_queue()
...
for_each_cpu(i, sched_group_cpus(group)) {
+ unsigned long power = power_of(i);
...
- wl = weighted_cpuload(i);
+ wl = weighted_cpuload(i) * SCHED_LOAD_SCALE;
+ wl /= power;
- if (rq->nr_running == 1 && wl > imbalance)
+ if (capacity && rq->nr_running == 1 && wl > imbalance)
continue;
On a SMT system, power of the HT logical cpu will be 589 and
the scheduler load imbalance (for scenarios like the one mentioned above)
can be approximately 1024 (SCHED_LOAD_SCALE). The above change of scaling
the weighted load with the power will result in "wl > imbalance" and
ultimately resulting in find_busiest_queue() return NULL, causing
load_balance() to think that the load is well balanced. But infact
one of the tasks can be moved to the idle core for optimal performance.
We don't need to use the weighted load (wl) scaled by the cpu power to
compare with imabalance. In that condition, we already know there is only a
single task "rq->nr_running == 1" and the comparison between imbalance,
wl is to make sure that we select the correct priority thread which matches
imbalance. So we really need to compare the imabalnce with the original
weighted load of the cpu and not the scaled load.
But in other conditions where we want the most hammered(busiest) cpu, we can
use scaled load to ensure that we consider the cpu power in addition to the
actual load on that cpu, so that we can move the load away from the
guy that is getting most hammered with respect to the actual capacity,
as compared with the rest of the cpu's in that busiest group.
Fix it.
Reported-by: Ma Ling <ling.ma@intel.com>
Initial-Analysis-by: Zhang, Yanmin <yanmin_zhang@linux.intel.com>
Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
LKML-Reference: <
1266023662.2808.118.camel@sbs-t61.sc.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Vaidyanathan Srinivasan [Mon, 8 Feb 2010 10:05:55 +0000 (15:35 +0530)]
sched: Fix sched_mv_power_savings for !SMT
commit
28f5318167adf23b16c844b9c2253f355cb21796 upstream.
Fix for sched_mc_powersavigs for pre-Nehalem platforms.
Child sched domain should clear SD_PREFER_SIBLING if parent will have
SD_POWERSAVINGS_BALANCE because they are contradicting.
Sets the flags correctly based on sched_mc_power_savings.
Signed-off-by: Vaidyanathan Srinivasan <svaidy@linux.vnet.ibm.com>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
LKML-Reference: <
20100208100555.GD2931@dirshya.in.ibm.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Gleb Natapov [Wed, 10 Feb 2010 12:21:35 +0000 (14:21 +0200)]
KVM: x86 emulator: Check CPL level during privilege instruction emulation
commit
e92805ac1228626c59c865f2f4e9059b9fb8c97b upstream.
Add CPL checking in case emulator is tricked into emulating
privilege instruction from userspace.
Signed-off-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Gleb Natapov [Wed, 10 Feb 2010 12:21:30 +0000 (14:21 +0200)]
KVM: x86 emulator: Add group9 instruction decoding
commit
60a29d4ea4e7b6b95d9391ebc8625b0426f3a363 upstream.
Use groups mechanism to decode 0F C7 instructions.
Signed-off-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Gleb Natapov [Thu, 18 Feb 2010 10:14:59 +0000 (12:14 +0200)]
KVM: x86 emulator: Forbid modifying CS segment register by mov instruction
commit
8b9f44140bc4afd2698413cd9960c3912168ee91 upstream.
Inject #UD if guest attempts to do so. This is in accordance to Intel
SDM.
Signed-off-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Gleb Natapov [Wed, 10 Feb 2010 12:21:29 +0000 (14:21 +0200)]
KVM: x86 emulator: Add group8 instruction decoding
commit
2db2c2eb6226e30f8059b82512a1364db98da8e3 upstream.
Use groups mechanism to decode 0F BA instructions.
Signed-off-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Mikulas Patocka [Sat, 6 Mar 2010 02:32:29 +0000 (02:32 +0000)]
dm: free dm_io before bio_endio not after
commit
a97f925a32aad2a37971d7bfb657006acf04e42d upstream.
Free the dm_io structure before calling bio_endio() instead of after it,
to ensure that the io_pool containing it is not referenced after it is
freed.
This partially fixes a problem described here
https://www.redhat.com/archives/dm-devel/2010-February/msg00109.html
thread 1:
bio_endio(bio, io_error);
/* scheduling happens */
thread 2:
close the device
remove the device
thread 1:
free_io(md, io);
Thread 2, when removing the device, sees non-empty md->io_pool (because the
io hasn't been freed by thread 1 yet) and may crash with BUG in mempool_free.
Thread 1 may also crash, when freeing into a nonexisting mempool.
To fix this we must make sure that bio_endio() is the last call and
the md structure is not accessed afterwards.
There is another bio_endio in process_barrier, but it is called from the thread
and the thread is destroyed prior to freeing the mempools, so this call is
not affected by the bug.
A similar bug exists with module unloads - the module may be unloaded
immediately after bio_endio - but that is more difficult to fix.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Trond Myklebust [Tue, 2 Mar 2010 18:06:22 +0000 (13:06 -0500)]
NFS: Fix an allocation-under-spinlock bug
commit
ebed9203b68a4f333ce5d17e874b26c3afcfeff1 upstream.
sunrpc_cache_update() will always call detail->update() from inside the
detail->hash_lock, so it cannot allocate memory.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
James Hogan [Fri, 5 Mar 2010 21:44:31 +0000 (13:44 -0800)]
rtc-coh901331: fix braces in resume code
commit
5a98c04d78c896d52baef20ffc11f6d1ba6eb786 upstream.
The else part of the if statement is indented but does not have braces
around it. It clearly should since it uses clk_enable and clk_disable
which are supposed to balance.
Signed-off-by: James Hogan <james@albanarts.com>
Acked-by: Linus Walleij <linus.walleij@stericsson.com>
Acked-by: Alessandro Zummo <a.zummo@towertech.it>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Lars-Peter Clausen [Fri, 5 Mar 2010 21:43:37 +0000 (13:43 -0800)]
s3cmci: s3cmci_card_present: Use no_detect to decide whether there is a card detect pin
commit
dc2ed552804f3a2ae41c0ffe4bc09879ec8f7396 upstream.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Cc: Ben Dooks <ben-linux@fluff.org>
Cc: <linux-mmc@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Trond Myklebust [Tue, 2 Mar 2010 18:06:21 +0000 (13:06 -0500)]
SUNRPC: Handle EINVAL error returns from the TCP connect operation
commit
9fcfe0c83c3b04a759cde6b8c5f961237f17808b upstream.
This can, for instance, happen if the user specifies a link local IPv6
address.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Neil Brown [Fri, 26 Feb 2010 22:33:40 +0000 (09:33 +1100)]
sunrpc: remove unnecessary svc_xprt_put
commit
ab1b18f70a007ea6caeb007d269abb75b131a410 upstream.
The 'struct svc_deferred_req's on the xpt_deferred queue do not
own a reference to the owning xprt. This is seen in svc_revisit
which is where things are added to this queue. dr->xprt is set to
NULL and the reference to the xprt it put.
So when this list is cleaned up in svc_delete_xprt, we mustn't
put the reference.
Also, replace the 'for' with a 'while' which is arguably
simpler and more likely to compile efficiently.
Cc: Tom Tucker <tom@opengridcomputing.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Maarten Maathuis [Sat, 20 Feb 2010 02:22:21 +0000 (03:22 +0100)]
drm/ttm: handle OOM in ttm_tt_swapout
commit
290e55056ec3d25c72088628245d8cae037b30db upstream.
- Without this change I get a general protection fault.
- Also use PTR_ERR where applicable.
Signed-off-by: Maarten Maathuis <madman2003@gmail.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Acked-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Zhao Yakui [Mon, 8 Feb 2010 13:35:12 +0000 (21:35 +0800)]
drm/i915: Use a dmi quirk to skip a broken SDVO TV output.
commit
6070a4a928f8c92b9fae7d6717ebbb05f425d6b2 upstream.
This IBM system has a multi-function SDVO card that reports both VGA
and TV, but the system has no TV connector. The TV connector always
reported as connected, which would lead to poor modesetting choices.
https://bugs.freedesktop.org/show_bug.cgi?id=25787
Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
Tested-by: Vance <liangghv@sg.ibm.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Jan Dumon [Tue, 5 Jan 2010 14:53:26 +0000 (15:53 +0100)]
USB: unusual_devs: Add support for multiple Option 3G sticks
commit
46216e4fbe8c62059b5440dec0b236f386248a41 upstream.
Enable the SD-Card interface on multiple Option 3G sticks.
The unusual_devs.h entry is necessary because the device descriptor is
vendor-specific. That prevents usb-storage from binding to it as an interface
driver.
Signed-off-by: Jan Dumon <j.dumon@option.com>
Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Alan Cox [Mon, 8 Feb 2010 10:10:44 +0000 (10:10 +0000)]
USB: cp210x: Add 81E8 (Zephyr Bioharness)
commit
bd07c551aae5d2200c7b195142e5ba63f26424da upstream.
As reported in
http://bugzilla.kernel.org/show_bug.cgi?id=10980
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Daniel Sangorrin [Mon, 22 Feb 2010 02:03:11 +0000 (11:03 +0900)]
USB: serial: ftdi: add CONTEC vendor and product id
commit
46b72d78cb022714c89a9ebc00b9581b550cfca7 upstream.
This is a patch to ftdi_sio_ids.h and ftdi_sio.c that adds
identifiers for CONTEC USB serial converter. I tested it
with the device COM-1(USB)H
Signed-off-by: Daniel Sangorrin <daniel.sangorrin@gmail.com>
Cc: Andreas Mohr <andi@lisas.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Mitchell Solomon [Fri, 12 Feb 2010 18:23:18 +0000 (13:23 -0500)]
USB: add new ftdi_sio device ids
commit
9714080d20f2ec4b671a06ce69367d91fa9e227e upstream.
PID patch for my products
Signed-off-by: Mitchell Solomon <mitchjs@rush2112.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Andreas Mohr [Sun, 17 Jan 2010 10:45:38 +0000 (11:45 +0100)]
USB: ftdi_sio: add device IDs (several ELV, one Mindstorms NXT)
commit
65e1ec6751b3eefee6d94161185e78736366126f upstream.
- add FTDI device IDs for several ELV devices and NXTCam of Lego Mindstorms NXT
- add hopefully helpful new_id comment
- remove less helpful "Due to many user requests for multiple ELV devices we enable
them by default." comment (we simply add _all_ known devices - an
enduser shouldn't have to fiddle with obscure module parameters...).
- add myself to DRIVER_AUTHOR
The missing NXTCam ID has been found at
http://www.unixboard.de/vb3/showthread.php?t=44155
, ELV devices taken from ELV Windows .inf file.
Signed-off-by: Andreas Mohr <andi@lisas.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Radek Liboska [Wed, 27 Jan 2010 14:38:34 +0000 (15:38 +0100)]
USB: ftdi_sio: new device id for papouch AD4USB
commit
a7787e508acb4378d62f4584bae3dd1cd0ba3eac upstream.
added new device pid (PAPOUCH_AD4USB_PID) to ftdi_sio.h and ftdi_sio.c
AD4USB measuring converter is a 4-input A/D converter which enables the
user to measure to four current inputs ranging from 0(4) to 20 mA or
voltage between 0 and 10 V. The measured values are then transferred to
a superior system in digital form. The AD4USB communicates via USB.
Powered is also via USB. datasheet in english is here:
http://www.papouch.com/shop/scripts/pdf/ad4usb_en.pdf
Signed-off-by: Radek Liboska <liboska@uochb.cas.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Andreas Mohr [Thu, 17 Dec 2009 10:56:09 +0000 (11:56 +0100)]
USB: ftdi_sio: sort PID/VID entries in new ftdi_sio_ids.h header
commit
4e092d110fe931db3878865db185be1c9df3e182 upstream.
This is a (almost) sort-only patch to sort FTDI device
product ID definitions in new ftdi_sio_ids.h header.
Advantage is that new device ID submissions will now have a specific (sorted)
position - less future merge conflicts.
Compile-tested, based on _current_ mainline git.
Minor checkpatch.pl warnings were eliminated whereever it made sense,
very minor text changes.
Signed-off-by: Andreas Mohr <andi@lisas.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Andreas Mohr [Wed, 16 Dec 2009 20:45:10 +0000 (21:45 +0100)]
USB: ftdi_sio: isolate all device IDs to new ftdi_sio_ids.h header
commit
31844d55800e1b93fe75c4d6188a4a44db2e1bbe upstream.
This is a strictly move-only patch to relocate all FTDI device
product ID definitions to their own ftdi_sio_ids.h header
(following the usual *_ids.h kernel tree convention, too),
thus correcting the slightly too messy appearance
(crucial driver defines were stuck somewhere in the decaying middle swamp
of the huge existing header).
Compile-tested, based on latest mainline git.
Signed-off-by: Andreas Mohr <andi@lisas.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Herbert Xu [Sun, 10 Jan 2010 09:15:03 +0000 (20:15 +1100)]
USB: Move hcd free_dev call into usb_disconnect to fix oops
commit
f7410ced7f931bb1ad79d1336412cf7b7a33cb14 upstream.
USB: Move hcd free_dev call into usb_disconnect
I found a way to oops the kernel:
1. Open a USB device through devio.
2. Remove the hcd module in the host kernel.
3. Close the devio file descriptor.
The problem is that closing the file descriptor does usb_release_dev
as it is the last reference. usb_release_dev then tries to invoke
the hcd free_dev function (or rather dereferencing the hcd driver
struct). This causes an oops as the hcd driver has already been
unloaded so the struct is gone.
This patch tries to fix this by bringing the free_dev call earlier
and into usb_disconnect. I have verified that repeating the
above steps no longer crashes with this patch applied.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Alan Stern [Mon, 8 Feb 2010 14:45:12 +0000 (09:45 -0500)]
USB: remove debugging message for uevent constructions
commit
cceffe9348f93188d7811bda95924d4bd3040d0f upstream.
This patch (as1332) removes an unneeded and annoying debugging message
announcing all USB uevent constructions.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Pete Zaitcev [Fri, 8 Jan 2010 22:39:22 +0000 (15:39 -0700)]
USB: fix crash in uhci_scan_schedule
commit
d23356da714595b888686d22cd19061323c09190 upstream.
When hardware is removed on a Stratus, the system may crash like this:
ACPI: PCI interrupt for device 0000:7c:00.1 disabled
Trying to free nonexistent resource <
00000000a8000000-
00000000afffffff>
Trying to free nonexistent resource <
00000000a4800000-
00000000a480ffff>
uhci_hcd 0000:7e:1d.0: remove, state 1
usb usb2: USB disconnect, address 1
usb 2-1: USB disconnect, address 2
Unable to handle kernel paging request at
0000000000100100 RIP:
[<
ffffffff88021950>] :uhci_hcd:uhci_scan_schedule+0xa2/0x89c
#4 [
ffff81011de17e50] uhci_scan_schedule at
ffffffff88021918
#5 [
ffff81011de17ed0] uhci_irq at
ffffffff88023cb8
#6 [
ffff81011de17f10] usb_hcd_irq at
ffffffff801f1c1f
#7 [
ffff81011de17f20] handle_IRQ_event at
ffffffff8001123b
#8 [
ffff81011de17f50] __do_IRQ at
ffffffff800ba749
This occurs because an interrupt scans uhci->skelqh, which is
being freed. We do the right thing: disable the interrupts in the
device, and do not do any processing if the interrupt is shared
with other source, but it's possible that another CPU gets
delayed somewhere (e.g. loops) until we started freeing.
The agreed-upon solution is to wait for interrupts to play out
before proceeding. No other bareers are neceesary.
A backport of this patch was tested on a 2.6.18 based kernel.
Testing of 2.6.32-based kernels is under way, but it takes us
forever (months) to turn this around. So I think it's a good
patch and we should keep it.
Tracked in RH bz#516851
Signed-Off-By: Pete Zaitcev <zaitcev@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Alan Stern [Thu, 25 Feb 2010 18:19:37 +0000 (13:19 -0500)]
USB: fix the idProduct value for USB-3.0 root hubs
commit
cd780694920fbf869b23c8afb0bd083e7b0448c7 upstream.
This patch (as1346) changes the idProduct value for USB-3.0 root hubs
from 0x0002 (which we already use for USB-2.0 root hubs) to 0x0003.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Acked-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Edward Shao [Wed, 10 Feb 2010 19:37:30 +0000 (03:37 +0800)]
USB: xhci: Fix finding extended capabilities registers
commit
05197921ff3dad52d99fd1647974c57d9c28d40e upstream.
According "5.3.6 Capability Parameters (HCCPARAMS)" of xHCI rev0.96 spec,
value of xECP register indicates a relative offset, in 32-bit words,
from Base to the beginning of the first extended capability.
The wrong calculation will cause BIOS handoff fail (not handoff from BIOS)
in some platform with BIOS USB legacy sup support.
Signed-off-by: Edward Shao <laface.tw@gmail.com>
Cc: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Yinghai Lu [Wed, 10 Feb 2010 09:20:05 +0000 (01:20 -0800)]
x86: Fix SCI on IOAPIC != 0
commit
18dce6ba5c8c6bd0f3ab4efa4cbdd698dab5c40a upstream.
Thomas Renninger <trenn@suse.de> reported on IBM x3330
booting a latest kernel on this machine results in:
PCI: PCI BIOS revision 2.10 entry at 0xfd61c, last bus=1
PCI: Using configuration type 1 for base access bio: create slab <bio-0> at 0
ACPI: SCI (IRQ30) allocation failed
ACPI Exception: AE_NOT_ACQUIRED, Unable to install System Control Interrupt handler (
20090903/evevent-161)
ACPI: Unable to start the ACPI Interpreter
Later all kind of devices fail...
and bisect it down to this commit:
commit
b9c61b70075c87a8612624736faf4a2de5b1ed30
x86/pci: update pirq_enable_irq() to setup io apic routing
it turns out we need to set irq routing for the sci on ioapic1 early.
-v2: make it work without sparseirq too.
-v3: fix checkpatch.pl warning, and cc to stable
Reported-by: Thomas Renninger <trenn@suse.de>
Bisected-by: Thomas Renninger <trenn@suse.de>
Tested-by: Thomas Renninger <trenn@suse.de>
Signed-off-by: Yinghai Lu <yinghai@kernel.org>
LKML-Reference: <
1265793639-15071-2-git-send-email-yinghai@kernel.org>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Brandon Phiilps [Wed, 10 Feb 2010 09:20:06 +0000 (01:20 -0800)]
x86: Avoid race condition in pci_enable_msix()
commit
ced5b697a76d325e7a7ac7d382dbbb632c765093 upstream.
Keep chip_data in create_irq_nr and destroy_irq.
When two drivers are setting up MSI-X at the same time via
pci_enable_msix() there is a race. See this dmesg excerpt:
[ 85.170610] ixgbe 0000:02:00.1: irq 97 for MSI/MSI-X
[ 85.170611] alloc irq_desc for 99 on node -1
[ 85.170613] igb 0000:08:00.1: irq 98 for MSI/MSI-X
[ 85.170614] alloc kstat_irqs on node -1
[ 85.170616] alloc irq_2_iommu on node -1
[ 85.170617] alloc irq_desc for 100 on node -1
[ 85.170619] alloc kstat_irqs on node -1
[ 85.170621] alloc irq_2_iommu on node -1
[ 85.170625] ixgbe 0000:02:00.1: irq 99 for MSI/MSI-X
[ 85.170626] alloc irq_desc for 101 on node -1
[ 85.170628] igb 0000:08:00.1: irq 100 for MSI/MSI-X
[ 85.170630] alloc kstat_irqs on node -1
[ 85.170631] alloc irq_2_iommu on node -1
[ 85.170635] alloc irq_desc for 102 on node -1
[ 85.170636] alloc kstat_irqs on node -1
[ 85.170639] alloc irq_2_iommu on node -1
[ 85.170646] BUG: unable to handle kernel NULL pointer dereference
at
0000000000000088
As you can see igb and ixgbe are both alternating on create_irq_nr()
via pci_enable_msix() in their probe function.
ixgbe: While looping through irq_desc_ptrs[] via create_irq_nr() ixgbe
choses irq_desc_ptrs[102] and exits the loop, drops vector_lock and
calls dynamic_irq_init. Then it sets irq_desc_ptrs[102]->chip_data =
NULL via dynamic_irq_init().
igb: Grabs the vector_lock now and starts looping over irq_desc_ptrs[]
via create_irq_nr(). It gets to irq_desc_ptrs[102] and does this:
cfg_new = irq_desc_ptrs[102]->chip_data;
if (cfg_new->vector != 0)
continue;
This hits the NULL deref.
Another possible race exists via pci_disable_msix() in a driver or in
the number of error paths that call free_msi_irqs():
destroy_irq()
dynamic_irq_cleanup() which sets desc->chip_data = NULL
...race window...
desc->chip_data = cfg;
Remove the save and restore code for cfg in create_irq_nr() and
destroy_irq() and take the desc->lock when checking the irq_cfg.
Reported-and-analyzed-by: Brandon Philips <bphilips@suse.de>
Signed-off-by: Yinghai Lu <yinghai@kernel.org>
LKML-Reference: <
1265793639-15071-3-git-send-email-yinghai@kernel.org>
Signed-off-by: Brandon Phililps <bphilips@suse.de>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Ian Campbell [Fri, 26 Feb 2010 17:16:00 +0000 (17:16 +0000)]
x86, xen: Disable highmem PTE allocation even when CONFIG_HIGHPTE=y
commit
817a824b75b1475f1b067c8cee318c7b4d66fcde upstream.
There's a path in the pagefault code where the kernel deliberately
breaks its own locking rules by kmapping a high pte page without
holding the pagetable lock (in at least page_check_address). This
breaks Xen's ability to track the pinned/unpinned state of the
page. There does not appear to be a viable workaround for this
behaviour so simply disable HIGHPTE for all Xen guests.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
LKML-Reference: <
1267204562-11844-1-git-send-email-ian.campbell@citrix.com>
Cc: Jeremy Fitzhardinge <jeremy@goop.org>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Pasi Kärkkäinen <pasik@iki.fi>
Cc: <xen-devel@lists.xensource.com>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Justin P. Mattock [Tue, 16 Feb 2010 23:17:29 +0000 (15:17 -0800)]
x86: Add iMac9,1 to pci_reboot_dmi_table
commit
0a832320f1bae6a4169bf683e201378f2437cfc1 upstream.
On the iMac9,1 /sbin/reboot results in a black mangled screen. Adding
this DMI entry gets the machine to reboot cleanly as it should.
Signed-off-by: Justin P. Mattock <justinmattock@gmail.com>
LKML-Reference: <
1266362249-3337-1-git-send-email-justinmattock@gmail.com>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Jiri Slaby [Wed, 10 Feb 2010 19:55:16 +0000 (20:55 +0100)]
x86, ia32_aout: do not kill argument mapping
commit
318f6b228ba88a394ef560efc1bfe028ad5ae6b6 upstream.
Do not set current->mm->mmap to NULL in 32-bit emulation on 64-bit
load_aout_binary after flush_old_exec as it would destroy already
set brpm mapping with arguments.
Introduced by
b6a2fea39318e43fee84fa7b0b90d68bed92d2ba
mm: variable length argument support
where the argument mapping in bprm was added.
[ hpa: this is a regression from 2.6.22... time to kill a.out? ]
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
LKML-Reference: <
1265831716-7668-1-git-send-email-jslaby@suse.cz>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ollie Wild <aaw@google.com>
Cc: x86@kernel.org
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Tao Ma [Fri, 26 Feb 2010 02:54:52 +0000 (10:54 +0800)]
ocfs2: Only bug out in direct io write for reflinked extent.
commit
cbaee472f274ea9a98aabe47025f6e5551acadcb upstream.
In ocfs2_direct_IO_get_blocks, we only need to bug out
in case of we are going to write a recounted extent rec.
What a silly bug introduced by me!
Signed-off-by: Tao Ma <tao.ma@oracle.com>
Signed-off-by: Joel Becker <joel.becker@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Henrique de Moraes Holschuh [Fri, 26 Feb 2010 01:22:07 +0000 (22:22 -0300)]
thinkpad-acpi: fix bluetooth/wwan resume
commit
08fedfc903c78e380b0baa7b57c52d367794d0a5 upstream.
Studying the DSDTs of various thinkpads, it looks like bit 3 of the
argument to SBDC and SWAN is not "set radio to last state on resume".
Rather, it seems to be "if this bit is set, enable radio on resume,
otherwise disable it on resume".
So, the proper way to prepare the radios for S3 suspend is: disable
radio and clear bit 3 on the SBDC/SWAN call to to resume with radio
disabled, and enable radio and set bit 3 on the SBDC/SWAN call to
resume with the radio enabled.
Also, for persistent devices, the rfkill core does not restore state,
so we really need to get the firmware to do the right thing.
We don't sync the radio state on suspend, instead we trust the BIOS to
not do anything weird if we never touched the radio state since boot.
Time will tell if that's a wise way of doing things...
Signed-off-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Henrique de Moraes Holschuh [Fri, 26 Feb 2010 00:29:00 +0000 (21:29 -0300)]
thinkpad-acpi: make driver events work in NVRAM poll mode
commit
7f0cf712a74fcc3ad21f0bde95bd32c2f2cc3888 upstream.
Thadeu Lima de Souza Cascardo reports this:
Brightness notification does not work until the user writes to
hotkey_mask attribute. That's because the polling thread will only run
if hotkey_user_mask is set and someone is reading the input device or
if hotkey_driver_mask is set. In this second case, this condition is
not tested after the mask is changed, because the brightness and
volume drivers are started after the hotkey drivers.
Fix tpacpi_hotkey_driver_mask_set() to call hotkey_poll_setup(), so
that the poller kthread will be started when needed.
Reported-by: Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
Tested-by: Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
Signed-off-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Henrique de Moraes Holschuh [Fri, 26 Feb 2010 00:28:56 +0000 (21:28 -0300)]
thinkpad-acpi: document HKEY event 3006
commit
bf8b29c8f7f8269e99eca8b19048ed5b34b51810 upstream.
Event 0x3006 is used to help power management of the ODD in the
UltraBay. The EC generates this event when the ODD eject button is
pressed (even if the bay is powered down).
Normally, Linux doesn't need this as we keep the SATA link powered
up (which wastes power). The EC powers up the bay by itself when the
ODD eject button is pressed, and the SATA PHY reports the hotplug.
However, we could also power that SATA link down (and for that matter,
also power down the Ultrabay) if the ODD is left idle for a while with
no disk inside, and use event 0x3006 to know when we need that SATA link
powered back up.
For now, just stop asking for more information when event 0x3006 is
seen, there is no point in pestering users about it anymore.
Signed-off-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Henrique de Moraes Holschuh [Fri, 26 Feb 2010 00:28:56 +0000 (21:28 -0300)]
thinkpad-acpi: R52 brightness_mode has been confirmed
commit
7d1894d8d1c411d2dad95abfe0f65bacf68c4afa upstream.
We can stop pestering users for confirmation of the brightness_mode
default for firmware TP-76.
While at it, add a few missing comments in that quirk table.
Reported-by: Whoopie <whoopie79@gmx.net>
Signed-off-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Henrique de Moraes Holschuh [Fri, 26 Feb 2010 00:28:58 +0000 (21:28 -0300)]
thinkpad-acpi: fix poll thread auto-start
commit
b589ea4c44170d3f7a845684e2d1b3b9571663af upstream.
The driver was not starting the NVRAM polling thread if the input
device was bound immediately after registration.
This fixes:
http://bugzilla.kernel.org/show_bug.cgi?id=15118
Reported-by: Florian Zumbiehl <florz@florz.de>
Signed-off-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Ben Hutchings [Fri, 26 Feb 2010 12:37:09 +0000 (04:37 -0800)]
sunxvr500: Additional PCI id for sunxvr500 driver
commit
275143e9b237dd7e0b6d01660fd9b8acd9922fa7 upstream.
Intergraph bought 3D Labs and some XVR-500 chips have Intergraph's
vendor id.
Reported-by: Jurij Smakov <jurij@wooyd.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Tim Gardner [Tue, 23 Feb 2010 13:59:12 +0000 (14:59 +0100)]
netfilter: xt_recent: fix false match
commit
8ccb92ad41cb311e52ad1b1fe77992c7f47a3b63 upstream.
A rule with a zero hit_count will always match.
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Tim Gardner [Tue, 23 Feb 2010 13:55:21 +0000 (14:55 +0100)]
netfilter: xt_recent: fix buffer overflow
commit
2c08522e5d2f0af2d6f05be558946dcbf8173683 upstream.
e->index overflows e->stamps[] every ip_pkt_list_tot packets.
Consider the case when ip_pkt_list_tot==1; the first packet received is stored
in e->stamps[0] and e->index is initialized to 1. The next received packet
timestamp is then stored at e->stamps[1] in recent_entry_update(),
a buffer overflow because the maximum e->stamps[] index is 0.
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>