26 Sep, 2008

1 commit


03 Sep, 2008

1 commit

  • Fix a bug reported by and diagnosed by Aaron Straus.

    This is a regression intruduced into 2.6.26 by

    commit adc782dae6c4c0f6fb679a48a544cfbcd79ae3dc
    Author: Matt Mackall
    Date: Tue Apr 29 01:03:07 2008 -0700

    random: simplify and rename credit_entropy_store

    credit_entropy_bits() does:

    spin_lock_irqsave(&r->lock, flags);
    ...
    if (r->entropy_count > r->poolinfo->POOLBITS)
    r->entropy_count = r->poolinfo->POOLBITS;

    so there is a time window in which this BUG_ON():

    static size_t account(struct entropy_store *r, size_t nbytes, int min,
    int reserved)
    {
    unsigned long flags;

    BUG_ON(r->entropy_count > r->poolinfo->POOLBITS);

    /* Hold lock while accounting */
    spin_lock_irqsave(&r->lock, flags);

    can trigger.

    We could fix this by moving the assertion inside the lock, but it seems
    safer and saner to revert to the old behaviour wherein
    entropy_store.entropy_count at no time exceeds
    entropy_store.poolinfo->POOLBITS.

    Reported-by: Aaron Straus
    Cc: Matt Mackall
    Cc: Theodore Ts'o
    Cc: [2.6.26.x]
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Andrew Morton
     

28 Aug, 2008

2 commits

  • Kanru Chen posted a patch versus the old code which deals with the case
    where you resize the pty side of a pty/tty pair. In that situation the
    termios data is updated for both pty and tty but the locks are not held
    for the right side.

    This implements the fix differently against the updated tty code. Patch
    by self but the hard bit (noticing and fixing the bug) is thanks to Kanru
    Chen.

    Signed-off-by: Alan Cox
    Signed-off-by: Linus Torvalds

    Alan Cox
     
  • The termios settings ioctls on a pty should affect the bound tty side not
    the pty. The SOFTCAR ioctls use the wrong device file.

    Signed-off-by: Alan Cox
    Signed-off-by: Linus Torvalds

    Alan Cox
     

24 Aug, 2008

1 commit


21 Aug, 2008

1 commit


20 Aug, 2008

1 commit

  • * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (94 commits)
    pkt_sched: Prevent livelock in TX queue running.
    Revert "pkt_sched: Add BH protection for qdisc_stab_lock."
    Revert "pkt_sched: Protect gen estimators under est_lock."
    pkt_sched: remove bogus block (cleanup)
    nf_nat: use secure_ipv4_port_ephemeral() for NAT port randomization
    netfilter: ctnetlink: sleepable allocation with spin lock bh
    netfilter: ctnetlink: fix sleep in read-side lock section
    netfilter: ctnetlink: fix double helper assignation for NAT'ed conntracks
    netfilter: ipt_addrtype: Fix matching of inverted destination address type
    dccp: Fix panic caused by too early termination of retransmission mechanism
    pkt_sched: Don't hold qdisc lock over qdisc_destroy().
    pkt_sched: Add lockdep annotation for qdisc locks
    pkt_sched: Never schedule non-root qdiscs.
    removed unused #include
    rt2x00: Fix txdone_entry_desc_flags
    b43: Fix for another Bluetooth Coexistence SPROM Programming error for BCM4306
    mac80211: remove kdoc references to IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE
    p54u: reset skb's data/tail pointer on requeue
    p54: move p54_vdcf_init to the right place.
    iwlwifi: fix printk newlines
    ...

    Linus Torvalds
     

19 Aug, 2008

1 commit


17 Aug, 2008

1 commit

  • The drivers below do not use LINUX_VERSION_CODE nor KERNEL_VERSION.
    drivers/char/pcmcia/ipwireless/tty.c
    drivers/char/synclink_gt.c
    drivers/char/xilinx_hwicap/xilinx_hwicap.c

    This patch removes the said #include .

    Signed-off-by: Huang Weiyi
    Signed-off-by: Linus Torvalds

    Huang Weiyi
     

16 Aug, 2008

1 commit

  • This moves it to being a tty operation. That removes special cases and now
    also means that resize can be picked up by um and other non vt consoles
    which may have a resize operation.

    Signed-off-by: Alan Cox
    Signed-off-by: Linus Torvalds

    Alan Cox
     

13 Aug, 2008

2 commits

  • Wolfgang Walter reported this oops on his via C3 using padlock for
    AES-encryption:

    ##################################################################

    BUG: unable to handle kernel NULL pointer dereference at 000001f0
    IP: [] __switch_to+0x30/0x117
    *pde = 00000000
    Oops: 0002 [#1] PREEMPT
    Modules linked in:

    Pid: 2071, comm: sleep Not tainted (2.6.26 #11)
    EIP: 0060:[] EFLAGS: 00010002 CPU: 0
    EIP is at __switch_to+0x30/0x117
    EAX: 00000000 EBX: c0493300 ECX: dc48dd00 EDX: c0493300
    ESI: dc48dd00 EDI: c0493530 EBP: c04cff8c ESP: c04cff7c
    DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
    Process sleep (pid: 2071, ti=c04ce000 task=dc48dd00 task.ti=d2fe6000)
    Stack: dc48df30 c0493300 00000000 00000000 d2fe7f44 c03b5b43 c04cffc8 00000046
    c0131856 0000005a dc472d3c c0493300 c0493470 d983ae00 00002696 00000000
    c0239f54 00000000 c04c4000 c04cffd8 c01025fe c04f3740 00049800 c04cffe0
    Call Trace:
    [] ? schedule+0x285/0x2ff
    [] ? pm_qos_requirement+0x3c/0x53
    [] ? acpi_processor_idle+0x0/0x434
    [] ? cpu_idle+0x73/0x7f
    [] ? rest_init+0x61/0x63
    =======================

    Wolfgang also found out that adding kernel_fpu_begin() and kernel_fpu_end()
    around the padlock instructions fix the oops.

    Suresh wrote:

    These padlock instructions though don't use/touch SSE registers, but it behaves
    similar to other SSE instructions. For example, it might cause DNA faults
    when cr0.ts is set. While this is a spurious DNA trap, it might cause
    oops with the recent fpu code changes.

    This is the code sequence that is probably causing this problem:

    a) new app is getting exec'd and it is somewhere in between
    start_thread() and flush_old_exec() in the load_xyz_binary()

    b) At pont "a", task's fpu state (like TS_USEDFPU, used_math() etc) is
    cleared.

    c) Now we get an interrupt/softirq which starts using these encrypt/decrypt
    routines in the network stack. This generates a math fault (as
    cr0.ts is '1') which sets TS_USEDFPU and restores the math that is
    in the task's xstate.

    d) Return to exec code path, which does start_thread() which does
    free_thread_xstate() and sets xstate pointer to NULL while
    the TS_USEDFPU is still set.

    e) At the next context switch from the new exec'd task to another task,
    we have a scenarios where TS_USEDFPU is set but xstate pointer is null.
    This can cause an oops during unlazy_fpu() in __switch_to()

    Now:

    1) This should happen with or with out pre-emption. Viro also encountered
    similar problem with out CONFIG_PREEMPT.

    2) kernel_fpu_begin() and kernel_fpu_end() will fix this problem, because
    kernel_fpu_begin() will manually do a clts() and won't run in to the
    situation of setting TS_USEDFPU in step "c" above.

    3) This was working before the fpu changes, because its a spurious
    math fault which doesn't corrupt any fpu/sse registers and the task's
    math state was always in an allocated state.

    With out the recent lazy fpu allocation changes, while we don't see oops,
    there is a possible race still present in older kernels(for example,
    while kernel is using kernel_fpu_begin() in some optimized clear/copy
    page and an interrupt/softirq happens which uses these padlock
    instructions generating DNA fault).

    This is the failing scenario that existed even before the lazy fpu allocation
    changes:

    0. CPU's TS flag is set

    1. kernel using FPU in some optimized copy routine and while doing
    kernel_fpu_begin() takes an interrupt just before doing clts()

    2. Takes an interrupt and ipsec uses padlock instruction. And we
    take a DNA fault as TS flag is still set.

    3. We handle the DNA fault and set TS_USEDFPU and clear cr0.ts

    4. We complete the padlock routine

    5. Go back to step-1, which resumes clts() in kernel_fpu_begin(), finishes
    the optimized copy routine and does kernel_fpu_end(). At this point,
    we have cr0.ts again set to '1' but the task's TS_USEFPU is stilll
    set and not cleared.

    6. Now kernel resumes its user operation. And at the next context
    switch, kernel sees it has do a FP save as TS_USEDFPU is still set
    and then will do a unlazy_fpu() in __switch_to(). unlazy_fpu()
    will take a DNA fault, as cr0.ts is '1' and now, because we are
    in __switch_to(), math_state_restore() will get confused and will
    restore the next task's FP state and will save it in prev tasks's FP state.
    Remember, in __switch_to() we are already on the stack of the next task
    but take a DNA fault for the prev task.

    This causes the fpu leakage.

    Fix the padlock instruction usage by calling them inside the
    context of new routines irq_ts_save/restore(), which clear/restore cr0.ts
    manually in the interrupt context. This will not generate spurious DNA
    in the context of the interrupt which will fix the oops encountered and
    the possible FPU leakage issue.

    Reported-and-bisected-by: Wolfgang Walter
    Signed-off-by: Suresh Siddha
    Signed-off-by: Herbert Xu

    Suresh Siddha
     
  • Signed-off-by: Huang Weiyi
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Huang Weiyi
     

12 Aug, 2008

8 commits

  • * git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6-for-linus:
    fix spinlock recursion in hvc_console
    stop_machine: remove unused variable
    modules: extend initcall_debug functionality to the module loader
    export virtio_rng.h
    lguest: use get_user_pages_fast() instead of get_user_pages()
    mm: Make generic weak get_user_pages_fast and EXPORT_GPL it
    lguest: don't set MAC address for guest unless specified

    Linus Torvalds
     
  • commit 611e097d7707741a336a0677d9d69bec40f29f3d
    Author: Christian Borntraeger
    hvc_console: rework setup to replace irq functions with callbacks
    introduced a spinlock recursion problem.

    request_irq tries to call the handler if the IRQ is shared.
    The irq handler of hvc_console calls hvc_poll and hvc_kill
    which might take the hvc_struct spinlock. Therefore, we have
    to call request_irq outside the spinlock.

    We can move the notifier_add safely outside the spinlock as ->data must
    not be changed by the backend. Otherwise, tty_hangup would fail anyway.

    Signed-off-by: Christian Borntraeger
    Signed-off-by: Rusty Russell

    Christian Borntraeger
     
  • The correct id is the id of the main host (5591) not
    the id of the PCI-to-PCI bridge AGP (0001).
    Output from "lspci -nv" shows that only the former
    has AGP capabilities flag set:

    00:00.0 0600: 1039:5591 (rev 02)
    Flags: bus master, medium devsel, latency 64
    Memory at ec000000 (32-bit, non-prefetchable) [size=32M]
    Capabilities: [c0] AGP version 1.0

    00:02.0 0604: 1039:0001 (prog-if 00 [Normal decode])
    Flags: bus master, fast devsel, latency 0
    Bus: primary=00, secondary=01, subordinate=01, sec-latency=0
    I/O behind bridge: 0000c000-0000cfff
    Memory behind bridge: eb500000-eb5fffff
    Prefetchable memory behind bridge: eb300000-eb3fffff

    Signed-off-by: Krzysztof Helt
    Signed-off-by: Dave Airlie

    Krzysztof Helt
     
  • On my Intel chipset (965GM), the GTT is entirely erased across
    suspend/resume. This patch simply re-plays the current mapping at resume
    time to restore the table.=20

    I noticed this once I started relying on persistent GTT mappings across VT
    switch in our GEM work -- the old X server and DRM code carefully unbind
    all memory from the GTT on VT switch, but GEM does not bother.

    I placed the list management and rewrite code in the generic layer on the
    assumption that it will be needed on other hardware, but I did not add the
    rewrite call to anything other than the Intel resume function.

    Keep a list of current GATT mappings. At resume time, rewrite them into
    the GATT. This is needed on Intel (at least) as the entire GATT is
    cleared across suspend/resume.

    [akpm@linux-foundation.org: coding-style fixes]
    Signed-off-by: Keith Packard
    Cc: Dave Jones
    Cc: Andi Kleen
    Signed-off-by: Andrew Morton
    Signed-off-by: Dave Airlie

    Keith Packard
     
  • Convert printks to use dev_printk().

    Signed-off-by: Bjorn Helgaas
    Signed-off-by: Andrew Morton
    Signed-off-by: Dave Airlie

    Bjorn Helgaas
     
  • I think the intent was that if no bridges matched agp_amd64_pci_table[],
    we would fall back to checking for any bridge with the AGP capability.
    But in the current code, we execute the fallback path only when
    pci_register_driver() itself fails, which is unrelated to whether any
    matching devices were found.

    This patch counts the AGP bridges found in the probe() method and executes
    the fallback path when none is found.

    Signed-off-by: Bjorn Helgaas
    Signed-off-by: Andrew Morton
    Signed-off-by: Dave Airlie

    Bjorn Helgaas
     
  • Signed-off-by: Zhenyu Wang
    Cc: Dave Airlie
    Signed-off-by: Andrew Morton
    Signed-off-by: Dave Airlie

    Zhenyu Wang
     
  • While testing our KVM code for s390 (starting and killall kvm in a loop)
    I can reproduce the following oops:

    Unable to handle kernel pointer dereference at virtual kernel address 6b6b6b6b6b6b6000 Oops: 0038 [#1] SMP
    Modules linked in: dm_multipath sunrpc qeth_l3 qeth_l2 dm_mod qeth
    ccwgroup CPU: 1 Not tainted 2.6.27-rc1 #54
    Process kuli (pid: 4409, task: 00000000b6aa5940, ksp: 00000000b7343e10)
    Krnl PSW : 0704e00180000000 00000000002e0b8c
    (disassociate_ctty+0x1c0/0x288) R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3
    CC:2 PM:0 EA:3 Krnl GPRS: 0000000000000000 6b6b6b6b6b6b6b6b
    0000000000000001 00000000000003a6 00000000002e0a46 00000000004b4160
    0000000000000001 00000000bbd79758 00000000b7343e58 00000000b8854148
    00000000bd34dea0 00000000b7343c20 0000000000000001 00000000004b6d08
    00000000002e0a46 00000000b7343c20 Krnl Code: 00000000002e0b7e:
    eb9fb0a00004 lmg %r9,%r15,160(%r11) 00000000002e0b84:
    07f4 bcr 15,%r4 00000000002e0b86:
    e31090080004 lg %r1,8(%r9) >00000000002e0b8c:
    d501109cd000 clc 156(2,%r1),0(%r13) 00000000002e0b92:
    a784ff5d brc 8,2e0a4c 00000000002e0b96:
    b9040029 lgr %r2,%r9 00000000002e0b9a:
    c0e5fffff9c3 brasl %r14,2dff20 00000000002e0ba0:
    a7f4ff56 brc 15,2e0a4c Call Trace:
    ([] disassociate_ctty+0x7a/0x288)
    [] do_exit+0x212/0x8d4
    [] do_group_exit+0x60/0xcc
    [] get_signal_to_deliver+0x270/0x3ac
    [] do_signal+0x8e/0x8dc
    [] sysc_sigpending+0xe/0x22
    [] 0x1ff0000b134
    INFO: lockdep is turned off.
    Last Breaking-Event-Address:
    [] disassociate_ctty+0x7c/0x288
    Kernel panic - not syncing: Fatal exception: panic_on_oops

    It seems that tty was already free in disassocate_ctty when it tries
    to dereference tty->driver.

    After moving the lock_kernel before the mutex_unlock, I can no longer
    reproduce the problem.

    [ This is a temporary partial fix for the documented and long standing
    race in disassociate_tty. This stops most problem cases for now.

    For the next release the -next tree has an initial implementation of
    kref counting for tty structures and this quickfix will be dropped.

    - Alan ]

    Signed-off-by: Christian Borntraeger
    Signed-off-by; Alan Cox
    Signed-off-by: Linus Torvalds

    Christian Borntraeger
     

09 Aug, 2008

3 commits

  • * 'for-linus-merged' of master.kernel.org:/home/rmk/linux-2.6-arm:
    [ARM] 5177/1: arm/mach-sa1100/Makefile: remove CONFIG_SA1100_USB
    [ARM] 5166/1: magician: add MAINTAINERS entry
    [ARM] fix pnx4008 build errors
    [ARM] Fix SMP booting with non-zero PHYS_OFFSET
    [ARM] 5185/1: Fix spi num_chipselect for lubbock
    [ARM] Move include/asm-arm/arch-* to arch/arm/*/include/mach
    [ARM] Add support for arch/arm/mach-*/include and arch/arm/plat-*/include
    [ARM] Remove asm/hardware.h, use asm/arch/hardware.h instead
    [ARM] Eliminate useless includes of asm/mach-types.h
    [ARM] Fix circular include dependency with IRQ headers
    avr32: Use instead of
    avr32: Introduce arch/avr32/mach-*/include/mach
    avr32: Move include/asm-avr32 to arch/avr32/include/asm
    [ARM] sa1100_wdt: use reset_status to remember watchdog reset status
    [ARM] pxa: introduce reset_status and clear_reset_status for driver's usage
    [ARM] pxa: introduce reset.h for reset specific header information

    Linus Torvalds
     
  • Conflicts:

    drivers/watchdog/at91rm9200_wdt.c
    drivers/watchdog/davinci_wdt.c
    drivers/watchdog/ep93xx_wdt.c
    drivers/watchdog/ixp2000_wdt.c
    drivers/watchdog/ixp4xx_wdt.c
    drivers/watchdog/ks8695_wdt.c
    drivers/watchdog/omap_wdt.c
    drivers/watchdog/pnx4008_wdt.c
    drivers/watchdog/sa1100_wdt.c
    drivers/watchdog/wdt285.c

    Russell King
     
  • * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (99 commits)
    pkt_sched: Fix actions referencing
    bnx2x: fix logical op
    tcp: (whitespace only) fix confusing indentation
    pkt_sched: Fix qdisc config when link is down.
    [Bluetooth] Add full quirk implementation for btusb driver
    [Bluetooth] Removal of unnecessary ignore module parameter
    [Bluetooth] Add parameters to control BNEP header compression
    ath9k: Revamp wireless mode usage
    ath9k: More unused macros
    ath9k: Remove a few unused macros and fix indentation
    ath9k: Use mac80211's band macros and remove enum hal_freq_band
    ath9k: Remove redundant data structure ath9k_txq_info
    ath9k: Cleanup data structures related to HW capabilities
    ath9k: work around gcc ICEs
    ath9k: Add new Atheros IEEE 802.11n driver
    ath5k: remove Atheros 11n devices from supported list
    list.h: add list_cut_position()
    list.h: Add list_splice_tail() and list_splice_tail_init()
    p54: swap short slot time dcf values
    rt2x00: Block all unsupported modes
    ...

    Linus Torvalds
     

08 Aug, 2008

1 commit

  • This driver was declared obsolete over 2 years ago, the alternative
    console driver for legacy iSeries (hvc_iseries) was made the default
    over 1 year ago and this driver has been build broken for over 3
    months, so remove it.

    Signed-off-by: Stephen Rothwell
    Signed-off-by: Linus Torvalds

    Stephen Rothwell
     

07 Aug, 2008

7 commits


05 Aug, 2008

3 commits


04 Aug, 2008

1 commit

  • from include/asm-powerpc. This is the result of a

    mkdir arch/powerpc/include/asm
    git mv include/asm-powerpc/* arch/powerpc/include/asm

    Followed by a few documentation/comment fixups and a couple of places
    where was being used explicitly. Of the latter only
    one was outside the arch code and it is a driver only built for powerpc.

    Signed-off-by: Stephen Rothwell
    Signed-off-by: Paul Mackerras

    Stephen Rothwell
     

02 Aug, 2008

1 commit

  • Currently function tty_ldisc_get() tries to load an ldisc driver module
    only when tty_ldisc_try_get() returns -EAGAIN. This happens only if
    module is being unloaded. If ldisc module is not loaded
    tty_ldisc_try_get() returns -EINVAL and this case is not handled in
    tty_ldisc_get(), so request_module() is not called.

    Attached patch fixes this by calling request_module() if
    tty_ldisc_try_get() returned any error code.

    I discovered this when my UMTS modem stopped working with 2.6.27-rc1
    because module ppp_async was not loaded.

    Signed-off-by: Eugeniy Meshcheryakov
    Signed-off-by: Alan Cox
    Signed-off-by: Linus Torvalds

    Eugeniy Meshcheryakov
     

31 Jul, 2008

2 commits

  • * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
    powerpc/mm: Lockless get_user_pages_fast() for 64-bit (v3)
    powerpc: Don't use the wrong thread_struct for ptrace get/set VSX regs
    powerpc: Fix ptrace buffer size for VSX
    powerpc: Correctly hookup PTRACE_GET/SETVSRREGS for 32 bit processes
    ide/powermac: Fix use of uninitialized pointer on media-bay
    powerpc: Allow non-hcall return values for lparcfg writes
    ipmi/powerpc: Use linux/of_{device,platform}.h instead of asm
    powerpc/fsl: proliferate simple-bus compatibility to soc nodes
    Documentation: remove old sbc8260 board specific information
    cpm2: Rework baud rate generators configuration to support external clocks.
    powerpc: rtc_cmos_setup: assign interrupts only if there is i8259 PIC
    cpm_uart: Add generic clock API support to set baudrates
    cpm_uart: Modem control lines support
    powerpc: implement GPIO LIB API on CPM1 Freescale SoC.
    cpm2: Implement GPIO LIB API on CPM2 Freescale SoC.
    powerpc: Fix 8xx build failure
    powerpc: clean up the Book-E HW watchpoint support

    Linus Torvalds
     
  • The GET_MAJOR ioctl prints out a warning, make it ratelimited.

    Signed-off-by: Jiri Slaby
    Acked-by: Alan Cox
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Jiri Slaby
     

30 Jul, 2008

1 commit


29 Jul, 2008

1 commit

  • There's a brown paper bag compile failure introduced by this patch

    commit a01386924874c4d6d67f8a34e66f04452c2abb69
    Author: David Sterba
    Date: Mon Jul 28 16:53:32 2008 +0200

    ipwireless: Preallocate received packet buffers with MRU size

    Really, it can't ever have been even compile tested. It looks like the
    closing bracket is in the wrong place, so this is the fix.

    Signed-off-by: James Bottomley
    Signed-off-by: Linus Torvalds

    James Bottomley