18 Mar, 2011

9 commits

  • Mike Galbraith reported finding a lockup ("perma-spin bug") where the
    cpumask passed to smp_call_function_many was cleared by other cpu(s)
    while a cpu was preparing its call_data block, resulting in no cpu to
    clear the last ref and unlock the block.

    Having cpus clear their bit asynchronously could be useful on a mask of
    cpus that might have a translation context, or cpus that need a push to
    complete an rcu window.

    Instead of adding a BUG_ON and requiring yet another cpumask copy, just
    detect the race and handle it.

    Note: arch_send_call_function_ipi_mask must still handle an empty
    cpumask because the data block is globally visible before the that arch
    callback is made. And (obviously) there are no guarantees to which cpus
    are notified if the mask is changed during the call; only cpus that were
    online and had their mask bit set during the whole call are guaranteed
    to be called.

    Reported-by: Mike Galbraith
    Reported-by: Jan Beulich
    Acked-by: Jan Beulich
    Cc: stable@kernel.org
    Signed-off-by: Milton Miller
    Signed-off-by: Linus Torvalds

    Milton Miller
     
  • Paul McKenney's review pointed out two problems with the barriers in the
    2.6.38 update to the smp call function many code.

    First, a barrier that would force the func and info members of data to
    be visible before their consumption in the interrupt handler was
    missing. This can be solved by adding a smp_wmb between setting the
    func and info members and setting setting the cpumask; this will pair
    with the existing and required smp_rmb ordering the cpumask read before
    the read of refs. This placement avoids the need a second smp_rmb in
    the interrupt handler which would be executed on each of the N cpus
    executing the call request. (I was thinking this barrier was present
    but was not).

    Second, the previous write to refs (establishing the zero that we the
    interrupt handler was testing from all cpus) was performed by a third
    party cpu. This would invoke transitivity which, as a recient or
    concurrent addition to memory-barriers.txt now explicitly states, would
    require a full smp_mb().

    However, we know the cpumask will only be set by one cpu (the data
    owner) and any preivous iteration of the mask would have cleared by the
    reading cpu. By redundantly writing refs to 0 on the owning cpu before
    the smp_wmb, the write to refs will follow the same path as the writes
    that set the cpumask, which in turn allows us to keep the barrier in the
    interrupt handler a smp_rmb instead of promoting it to a smp_mb (which
    will be be executed by N cpus for each of the possible M elements on the
    list).

    I moved and expanded the comment about our (ab)use of the rcu list
    primitives for the concurrent walk earlier into this function. I
    considered moving the first two paragraphs to the queue list head and
    lock, but felt it would have been too disconected from the code.

    Cc: Paul McKinney
    Cc: stable@kernel.org (2.6.32 and later)
    Signed-off-by: Milton Miller
    Signed-off-by: Linus Torvalds

    Milton Miller
     
  • Peter pointed out there was nothing preventing the list_del_rcu in
    smp_call_function_interrupt from running before the list_add_rcu in
    smp_call_function_many.

    Fix this by not setting refs until we have gotten the lock for the list.
    Take advantage of the wmb in list_add_rcu to save an explicit additional
    one.

    I tried to force this race with a udelay before the lock & list_add and
    by mixing all 64 online cpus with just 3 random cpus in the mask, but
    was unsuccessful. Still, inspection shows a valid race, and the fix is
    a extension of the existing protection window in the current code.

    Cc: stable@kernel.org (v2.6.32 and later)
    Reported-by: Peter Zijlstra
    Signed-off-by: Milton Miller
    Signed-off-by: Linus Torvalds

    Milton Miller
     
  • Change the _mapcount value indicating PageBuddy from -2 to -128 for
    more robusteness against page_mapcount() undeflows.

    Use reset_page_mapcount instead of __ClearPageBuddy in bad_page to
    ignore the previous retval of PageBuddy().

    Signed-off-by: Andrea Arcangeli
    Reported-by: Hugh Dickins
    Signed-off-by: Linus Torvalds

    Andrea Arcangeli
     
  • * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/epip/linux-2.6-unicore32: (40 commits)
    unicore32: rewrite arch-specific tlb.h to use asm-generic version
    unicore32: modify io_p2v and io_v2p macros, and adjust PKUNITY_mmio_BASEs
    unicore32: replace unicore32-specific iomap functions with generic lib implementation
    unicore32 machine related: add frame buffer driver for pkunity-v3 soc
    unicore32 machine related files: add i2c bus drivers for pkunity-v3 soc
    unicore32 io: redefine __REG(x) and re-use readl/writel funcs
    unicore32 i8042 upgrade and bugfix: adjust resource request region type
    unicore32 upgrade to v2.6.38-rc5: add one more paramter for pte_alloc_map call
    unicore32 i8042: adjust io funcs of i8042-unicore32io.h
    unicore32: rename PKUNITY_IOSPACE_BASE to PKUNITY_MMIO_BASE
    unicore32: modify function names and parameters for irq_chips
    unicore32: remove unused lines in arch/unicore32/include/asm/irq.h
    unicore32 time.c: change calculate method for clock_event_device
    unicore32: ADD MAINTAINER for unicore32 architecture
    unicore32 machine related files: ps2 driver
    unicore32 machine related files: pci bus handling
    unicore32 machine related files: hardware registers
    unicore32 machine related files: core files
    unicore32 additional architecture files: boot process
    unicore32 additional architecture files: low-level lib: misc
    ...

    Acked-by: Arnd Bergmann

    Linus Torvalds
     
  • * 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6:
    [S390] kexec: Disable ftrace during kexec
    [S390] support XZ compressed kernel
    [S390] css_bus_type: make it static
    [S390] css_driver: remove duplicate members
    [S390] css: remove subchannel private
    [S390] css: move chsc_private to drv_data
    [S390] css: move io_private to drv_data
    [S390] cio: move cdev pointer to io_subchannel_private
    [S390] cio: move options to io_sch_private
    [S390] cio: move asms to generic header
    [S390] cio: move orb definitions to separate header
    [S390] Write protect module text and RO data
    [S390] dasd: get rid of compile warning
    [S390] remove superfluous check from do_IRQ
    [S390] remove redundant stack check option

    Linus Torvalds
     
  • * 'sh-latest' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6: (34 commits)
    sh: Convert to generic show_interrupts.
    sh: Wire up new fhandle and clock_adjtime syscalls.
    sh: modify platform_device for sh_eth driver
    sh: add GETHER's platform_device in board-sh7757lcr
    sh: update sh7757lcr_defconfig
    sh: add platform_device of tmio_mmc and sh_mmcif to sh7757lcr
    sh: dmaengine support for SH7757
    sh: add mmc clock in clock-sh7757
    sh: add spi_board_info in sh7757lcr
    sh: add platform_device for SPI
    sh: add USB_ARCH_HAS_EHCI and OHCI for SH7757
    sh: Rename cpuidle states to fit general conventions
    serial: sh-sci: fix deadlock when resuming from S3 sleep
    sh: Enable CONFIG_GCOV_PROFILE_ALL for sh
    sh: Fix up async PCIe probing on SMP.
    serial: sh-sci: Kill off the special earlyprintk device.
    serial: sh-sci: Use dev_name() for region reservations.
    serial: sh-sci: Fix up earlyprintk port mapping.
    serial: sh-sci: Limit early console to one device.
    serial: sh-sci: Fix up break timer scheduling race.
    ...

    Linus Torvalds
     
  • * git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-2.6:
    fbdev: sh_mobile_lcdc: Add YUV framebuffer support
    viafb: split pll configs up
    viafb: remove duplicated clock storage
    viafb: always return the best possible clock
    viafb: remove duplicated clock information
    fbdev: sh_mobile_lcdcfb: add backlight support
    viafb: factor lcd scaling parameters out
    viafb: strip some structures
    viafb: remove unused data_mode and device_type
    viafb: kill lcd_panel_id
    video via: make local variables static
    video via: fix iomem access
    video/via: drop deprecated (and unused) i2c_adapter.id

    Linus Torvalds
     
  • * 'drm-core-next' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: (177 commits)
    drm/radeon: fixup refcounts in radeon dumb create ioctl.
    drm: radeon: *_cs_packet_parse_vline() cleanup
    radeon: merge list_del()/list_add_tail() to list_move_tail()
    drm: Retry i2c transfer of EDID block after failure
    drm/radeon/kms: fix typo in atom overscan setup
    drm: Hold the mode mutex whilst probing for sysfs status
    drm/nouveau: fix __nouveau_fence_wait performance
    drm/nv40: attempt to reserve just enough vram for all 32 channels
    drm/nv50: check for vm traps on every gr irq
    drm/nv50: decode vm faults some more
    drm/nouveau: add nouveau_enum_find() util function
    drm/nouveau: properly handle pushbuffer check failures
    drm/nvc0: remove vm hack forcing large/small pages to not share a PDE
    drm/i915: disable opregion lid detection for now.
    drm/i915: Only wait on a pending flip if we intend to write to the buffer
    drm/i915/dp: Sanity check eDP existence
    drm: add cap bit to denote if dumb ioctl is available or not.
    drm/core: add ioctl to query device/driver capabilities
    drm/radeon/kms: allow max clock of 340 Mhz on hdmi 1.3+
    drm/radeon/kms: add cayman pci ids
    ...

    Linus Torvalds
     

17 Mar, 2011

31 commits