1. 14 May, 2011 2 commits
    • Tejun Heo's avatar
      libata: fix oops when LPM is used with PMP · 5f6f12cc
      Tejun Heo authored
      ae01b249 (libata: Implement ATA_FLAG_NO_DIPM and apply it to mcp65)
      added ATA_FLAG_NO_DIPM and made ata_eh_set_lpm() check the flag.
      However, @ap is NULL if @link points to a PMP link and thus the
      unconditional @ap->flags dereference leads to the following oops.
      
        BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
        IP: [<ffffffff813f98e1>] ata_eh_recover+0x9a1/0x1510
        ...
        Pid: 295, comm: scsi_eh_4 Tainted: P            2.6.38.5-core2 #1 System76, Inc. Serval Professional/Serval Professional
        RIP: 0010:[<ffffffff813f98e1>]  [<ffffffff813f98e1>] ata_eh_recover+0x9a1/0x1510
        RSP: 0018:ffff880132defbf0  EFLAGS: 00010246
        RAX: 0000000000000000 RBX: ffff880132f40000 RCX: 0000000000000000
        RDX: ffff88013377c000 RSI: ffff880132f40000 RDI: 0000000000000000
        RBP: ffff880132defce0 R08: ffff88013377dc58 R09: ffff880132defd98
        R10: 0000000000000000 R11: 00000000ffffffff R12: 0000000000000000
        R13: 0000000000000000 R14: ffff88013377c000 R15: 0000000000000000
        FS:  0000000000000000(0000) GS:ffff8800bf700000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
        CR2: 0000000000000018 CR3: 0000000001a03000 CR4: 00000000000406e0
        DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
        DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
        Process scsi_eh_4 (pid: 295, threadinfo ffff880132dee000, task ffff880133b416c0)
        Stack:
         0000000000000000 ffff880132defcc0 0000000000000000 ffff880132f42738
         ffffffff813ee8f0 ffffffff813eefe0 ffff880132defd98 ffff88013377f190
         ffffffffa00b3e30 ffffffff813ef030 0000000032defc60 ffff880100000000
        Call Trace:
         [<ffffffff81400867>] sata_pmp_error_handler+0x607/0xc30
         [<ffffffffa00b273f>] ahci_error_handler+0x1f/0x70 [libahci]
         [<ffffffff813faade>] ata_scsi_error+0x5be/0x900
         [<ffffffff813cf724>] scsi_error_handler+0x124/0x650
         [<ffffffff810834b6>] kthread+0x96/0xa0
         [<ffffffff8100cd64>] kernel_thread_helper+0x4/0x10
        Code: 8b 95 70 ff ff ff b8 00 00 00 00 48 3b 9a 10 2e 00 00 48 0f 44 c2 48 89 85 70 ff ff ff 48 8b 8d 70 ff ff ff f6 83 69 02 00 00 01 <48> 8b 41 18 0f 85 48 01 00 00 48 85 c9 74 12 48 8b 51 08 48 83
        RIP  [<ffffffff813f98e1>] ata_eh_recover+0x9a1/0x1510
         RSP <ffff880132defbf0>
        CR2: 0000000000000018
      
      Fix it by testing @link->ap->flags instead.
      
      stable: ATA_FLAG_NO_DIPM was added during 2.6.39 cycle but was
              backported to 2.6.37 and 38.  This is a fix for that and thus
              also applicable to 2.6.37 and 38.
      Signed-off-by: default avatarTejun Heo <tj@kernel.org>
      Reported-by: default avatar"Nathan A. Mourey II" <nmoureyii@ne.rr.com>
      LKML-Reference: <1304555277.2059.2.camel@localhost.localdomain>
      Cc: Connor H <cmdkhh@gmail.com>
      Cc: stable@kernel.org
      Signed-off-by: default avatarJeff Garzik <jgarzik@pobox.com>
      5f6f12cc
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha-2.6 · ddb503b4
      Linus Torvalds authored
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha-2.6:
        alpha: Wire up syscalls new to 2.6.39
        alpha: convert to clocksource_register_hz
      ddb503b4
  2. 13 May, 2011 11 commits
  3. 12 May, 2011 27 commits
    • Linus Torvalds's avatar
      Merge branch 'for-2639-rc7/i2c-fixes' of git://git.fluff.org/bjdooks/linux · 9bbd0558
      Linus Torvalds authored
      * 'for-2639-rc7/i2c-fixes' of git://git.fluff.org/bjdooks/linux:
        i2c: pnx: Fix crash due to wrong init of timer->data
      9bbd0558
    • James Morris's avatar
    • Wolfram Sang's avatar
      i2c: pnx: Fix crash due to wrong init of timer->data · 9ddabb05
      Wolfram Sang authored
      alg_data is already a pointer which must be passed directly.
      Reported-by: default avatarDieter Ripp <ripp@systecnet.com>
      Signed-off-by: default avatarWolfram Sang <w.sang@pengutronix.de>
      Cc: Russell King <linux@arm.linux.org.uk>
      Cc: Ben Dooks <ben-i2c@fluff.org>
      Signed-off-by: default avatarBen Dooks <ben-linux@fluff.org>
      9ddabb05
    • Steinar H. Gunderson's avatar
      ipv6: restore correct ECN handling on TCP xmit · ca067070
      Steinar H. Gunderson authored
      Since commit e9df2e8f (Use appropriate sock tclass setting for
      routing lookup) we lost ability to properly add ECN codemarks to ipv6
      TCP frames.
      
      It seems like TCP_ECN_send() calls INET_ECN_xmit(), which only sets the
      ECN bit in the IPv4 ToS field (inet_sk(sk)->tos), but after the patch,
      what's checked is inet6_sk(sk)->tclass, which is a completely different
      field.
      
      Close bug https://bugzilla.kernel.org/show_bug.cgi?id=34322
      
      [Eric Dumazet] : added the INET_ECN_dontxmit() fix and replace macros
      by inline functions for clarity.
      Signed-off-by: default avatarSteinar H. Gunderson <sgunderson@bigfoot.com>
      Signed-off-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
      Cc: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ca067070
    • Ingo Molnar's avatar
      vsprintf: Turn kptr_restrict off by default · 411f05f1
      Ingo Molnar authored
      kptr_restrict has been triggering bugs in apps such as perf, and it also makes
      the system less useful by default, so turn it off by default.
      
      This is how we generally handle security features that remove functionality,
      such as firewall code or SELinux - they have to be configured and activated
      from user-space.
      
      Distributions can turn kptr_restrict on again via this line in
      /etc/sysctrl.conf:
      
      kernel.kptr_restrict = 1
      
      ( Also mark the variable __read_mostly while at it, as it's typically modified
        only once per bootup, or not at all. )
      Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
      Acked-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      411f05f1
    • Pedro Scarapicchia Junior's avatar
      net/9p/protocol.c: Fix a memory leak · 1b0bcbcf
      Pedro Scarapicchia Junior authored
      When p9pdu_readf() is called with "s" attribute, it allocates a pointer that
      will store a string. In p9dirent_read(), this pointer is not being released,
      leading to out of memory errors.
      This patch releases this pointer after string is copyed to dirent->d_name.
      Signed-off-by: default avatarPedro Scarapicchia Junior <pedro.scarapiccha@br.flextronics.com>
      Signed-off-by: default avatarEric Van Hensbergen <ericvh@gmail.com>
      1b0bcbcf
    • Geert Uytterhoeven's avatar
      ne-h8300: Fix regression caused during net_device_ops conversion · 2592a735
      Geert Uytterhoeven authored
      Changeset dcd39c90 ("ne-h8300: convert to
      net_device_ops") broke ne-h8300 by adding 8390.o to the link. That
      meant that lib8390.c was included twice, once in ne-h8300.c and once in
      8390.c, subject to different macros. This patch reverts that by
      avoiding the wrappers in 8390.c.
      
      Fix based on commits 217cbfa8 ("mac8390:
      fix regression caused during net_device_ops conversion") and
      4e0168fa ("mac8390: fix build with
      NET_POLL_CONTROLLER").
      Signed-off-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Cc: stable@kernel.org
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2592a735
    • Geert Uytterhoeven's avatar
      hydra: Fix regression caused during net_device_ops conversion · 0b25e015
      Geert Uytterhoeven authored
      Changeset 5618f0d1 ("hydra: convert to
      net_device_ops") broke hydra by adding 8390.o to the link. That
      meant that lib8390.c was included twice, once in hydra.c and once in
      8390.c, subject to different macros. This patch reverts that by
      avoiding the wrappers in 8390.c.
      
      Fix based on commits 217cbfa8 ("mac8390:
      fix regression caused during net_device_ops conversion") and
      4e0168fa ("mac8390: fix build with
      NET_POLL_CONTROLLER").
      Signed-off-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Cc: stable@kernel.org
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0b25e015
    • Geert Uytterhoeven's avatar
      zorro8390: Fix regression caused during net_device_ops conversion · cf7e032f
      Geert Uytterhoeven authored
      Changeset b6114794 ("zorro8390: convert to
      net_device_ops") broke zorro8390 by adding 8390.o to the link. That
      meant that lib8390.c was included twice, once in zorro8390.c and once in
      8390.c, subject to different macros. This patch reverts that by
      avoiding the wrappers in 8390.c.
      
      Fix based on commits 217cbfa8 ("mac8390:
      fix regression caused during net_device_ops conversion") and
      4e0168fa ("mac8390: fix build with
      NET_POLL_CONTROLLER").
      Reported-by: default avatarChristian T. Steigies <cts@debian.org>
      Suggested-by: default avatarFinn Thain <fthain@telegraphics.com.au>
      Signed-off-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Tested-by: default avatarChristian T. Steigies <cts@debian.org>
      Cc: stable@kernel.org
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cf7e032f
    • David S. Miller's avatar
    • Eric Paris's avatar
      SELinux: delete debugging printks from filename_trans rule processing · 93826c09
      Eric Paris authored
      The filename_trans rule processing has some printk(KERN_ERR ) messages
      which were intended as debug aids in creating the code but weren't removed
      before it was submitted.  Remove them.
      Reported-by: default avatarPaul Bolle <pebolle@tiscali.nl>
      Signed-off-by: default avatarEric Paris <eparis@redhat.com>
      93826c09
    • Linus Torvalds's avatar
      Merge branch 'fix/asoc' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 · ca1376d1
      Linus Torvalds authored
      * 'fix/asoc' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
        ASoC: WM8903: Fix Digital Capture Volume range
        ASoC: UDA134x: Remove POWER_OFF_ON_STANDBY define.
        ASoC: SSM2602: Fix reg_cache_size
        ASoC: SSM2602: Fix 'Mic Boost2' control
        ASoC: SSM2602: Properly annotate i2c probe and remove functions
        ASoC: sst_platform: add hw_free callback to fix resource leak
        ASoC: Don't crash on PM operations
        ASoC: JZ4740: Fix i2s shutdown
      ca1376d1
    • Linus Torvalds's avatar
      Merge branch 'stable/bug-fixes-for-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen · 0c5e1577
      Linus Torvalds authored
      * 'stable/bug-fixes-for-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
        x86/mm: Fix section mismatch derived from native_pagetable_reserve()
        x86,xen: introduce x86_init.mapping.pagetable_reserve
        Revert "xen/mmu: Add workaround "x86-64, mm: Put early page table high""
      0c5e1577
    • Linus Torvalds's avatar
      Revert "drm/i915: Only enable the plane after setting the fb base (pre-ILK)" · 982b2035
      Linus Torvalds authored
      This reverts commit 49183b28.
      
      Quoth Franz Melchior:
      
        "This patch introduces a bug on my infamous "Acer Travelmate
         5735Z-452G32Mnss": when KMS takes over, the frame buffer contents get
         completely garbled up on screen, with colored stripes and unreadable
         text (photo on request).  Only when X11 is started, the screen gets
         restored again.  Closing and re-opening the lid partly cures the
         mess, too: it makes the font readable, though horizontally stretched."
      Acked-by: default avatarKeith Packard <keithp@keithp.com>
      Cc: Chris Wilson <chris@chris-wilson.co.uk>
      Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
      Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      982b2035
    • Linus Torvalds's avatar
      Merge branch 'fbmem' · df43938b
      Linus Torvalds authored
      * fbmem:
        fbmem: make read/write/ioctl use the frame buffer at open time
        fbcon: add lifetime refcount to opened frame buffers
      df43938b
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input · 49f019c1
      Linus Torvalds authored
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
        Input: ads7846 - remove unused variable from struct ads7845_ser_req
        Input: ads7846 - make transfer buffers DMA safe
      49f019c1
    • Sedat Dilek's avatar
      x86/mm: Fix section mismatch derived from native_pagetable_reserve() · 53f8023f
      Sedat Dilek authored
      With CONFIG_DEBUG_SECTION_MISMATCH=y I see these warnings in next-20110415:
      
        LD      vmlinux.o
        MODPOST vmlinux.o
      WARNING: vmlinux.o(.text+0x1ba48): Section mismatch in reference from the function native_pagetable_reserve() to the function .init.text:memblock_x86_reserve_range()
      The function native_pagetable_reserve() references
      the function __init memblock_x86_reserve_range().
      This is often because native_pagetable_reserve lacks a __init
      annotation or the annotation of memblock_x86_reserve_range is wrong.
      
      This patch fixes the issue.
      Thanks to pipacs from PaX project for help on IRC.
      Acked-by: default avatar"H. Peter Anvin" <hpa@zytor.com>
      Signed-off-by: default avatarSedat Dilek <sedat.dilek@gmail.com>
      Signed-off-by: default avatarKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      53f8023f
    • Stefano Stabellini's avatar
      x86,xen: introduce x86_init.mapping.pagetable_reserve · 279b706b
      Stefano Stabellini authored
      Introduce a new x86_init hook called pagetable_reserve that at the end
      of init_memory_mapping is used to reserve a range of memory addresses for
      the kernel pagetable pages we used and free the other ones.
      
      On native it just calls memblock_x86_reserve_range while on xen it also
      takes care of setting the spare memory previously allocated
      for kernel pagetable pages from RO to RW, so that it can be used for
      other purposes.
      
      A detailed explanation of the reason why this hook is needed follows.
      
      As a consequence of the commit:
      
      commit 4b239f45
      Author: Yinghai Lu <yinghai@kernel.org>
      Date:   Fri Dec 17 16:58:28 2010 -0800
      
          x86-64, mm: Put early page table high
      
      at some point init_memory_mapping is going to reach the pagetable pages
      area and map those pages too (mapping them as normal memory that falls
      in the range of addresses passed to init_memory_mapping as argument).
      Some of those pages are already pagetable pages (they are in the range
      pgt_buf_start-pgt_buf_end) therefore they are going to be mapped RO and
      everything is fine.
      Some of these pages are not pagetable pages yet (they fall in the range
      pgt_buf_end-pgt_buf_top; for example the page at pgt_buf_end) so they
      are going to be mapped RW.  When these pages become pagetable pages and
      are hooked into the pagetable, xen will find that the guest has already
      a RW mapping of them somewhere and fail the operation.
      The reason Xen requires pagetables to be RO is that the hypervisor needs
      to verify that the pagetables are valid before using them. The validation
      operations are called "pinning" (more details in arch/x86/xen/mmu.c).
      
      In order to fix the issue we mark all the pages in the entire range
      pgt_buf_start-pgt_buf_top as RO, however when the pagetable allocation
      is completed only the range pgt_buf_start-pgt_buf_end is reserved by
      init_memory_mapping. Hence the kernel is going to crash as soon as one
      of the pages in the range pgt_buf_end-pgt_buf_top is reused (b/c those
      ranges are RO).
      
      For this reason we need a hook to reserve the kernel pagetable pages we
      used and free the other ones so that they can be reused for other
      purposes.
      On native it just means calling memblock_x86_reserve_range, on Xen it
      also means marking RW the pagetable pages that we allocated before but
      that haven't been used before.
      
      Another way to fix this is without using the hook is by adding a 'if
      (xen_pv_domain)' in the 'init_memory_mapping' code and calling the Xen
      counterpart, but that is just nasty.
      Signed-off-by: default avatarStefano Stabellini <stefano.stabellini@eu.citrix.com>
      Acked-by: default avatarYinghai Lu <yinghai@kernel.org>
      Acked-by: default avatarH. Peter Anvin <hpa@zytor.com>
      Cc: Ingo Molnar <mingo@elte.hu>
      Signed-off-by: default avatarKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      279b706b
    • Konrad Rzeszutek Wilk's avatar
      Revert "xen/mmu: Add workaround "x86-64, mm: Put early page table high"" · 92bdaef7
      Konrad Rzeszutek Wilk authored
      This reverts commit a3864783.
      
      It does not work with certain AMD machines.
      
      last_pfn = 0x100000 max_arch_pfn = 0x400000000
      initial memory mapped : 0 - 02c3a000
      Base memory trampoline at [ffff88000009b000] 9b000 size 20480
      init_memory_mapping: 0000000000000000-0000000100000000
       0000000000 - 0100000000 page 4k
      kernel direct mapping tables up to 100000000 @ ff7fb000-100000000
      init_memory_mapping: 0000000100000000-00000001e0800000
       0100000000 - 01e0800000 page 4k
      kernel direct mapping tables up to 1e0800000 @ 1df0f3000-1e0000000
      xen: setting RW the range fffdc000 - 100000000
      RAMDISK: 0203b000 - 02c3a000
      No NUMA configuration found
      Faking a node at 0000000000000000-00000001e0800000
      NUMA: Using 63 for the hash shift.
      Initmem setup node 0 0000000000000000-00000001e0800000
        NODE_DATA [00000001dfffb000 - 00000001dfffffff]
      BUG: unable to handle kernel NULL pointer dereference at           (null)
      IP: [<ffffffff81cf6a75>] setup_node_bootmem+0x18a/0x1ea
      PGD 0
      Oops: 0003 [#1] SMP
      last sysfs file:
      CPU 0
      Modules linked in:
      
      Pid: 0, comm: swapper Not tainted 2.6.39-0-virtual #6~smb1
      RIP: e030:[<ffffffff81cf6a75>]  [<ffffffff81cf6a75>] setup_node_bootmem+0x18a/0x1ea
      RSP: e02b:ffffffff81c01e38  EFLAGS: 00010046
      RAX: 0000000000000000 RBX: 00000001e0800000 RCX: 0000000000001040
      RDX: 0000000000004100 RSI: 0000000000000000 RDI: ffff8801dfffb000
      RBP: ffffffff81c01e58 R08: 0000000000000020 R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
      R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000bfe400
      FS:  0000000000000000(0000) GS:ffffffff81cca000(0000) knlGS:0000000000000000
      CS:  e033 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000000000000000 CR3: 0000000001c03000 CR4: 0000000000000660
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
      Process swapper (pid: 0, threadinfo ffffffff81c00000, task ffffffff81c0b020)
      Stack:
       0000000000000040 0000000000000001 0000000000000000 ffffffffffffffff
       ffffffff81c01e88 ffffffff81cf6c25 0000000000000000 0000000000000000
       ffffffff81cf687f 0000000000000000 ffffffff81c01ea8 ffffffff81cf6e45
      Call Trace:
       [<ffffffff81cf6c25>] numa_register_memblks.constprop.3+0x150/0x181
       [<ffffffff81cf687f>] ? numa_add_memblk+0x7c/0x7c
       [<ffffffff81cf6e45>] numa_init.part.2+0x1c/0x7c
       [<ffffffff81cf687f>] ? numa_add_memblk+0x7c/0x7c
       [<ffffffff81cf6f67>] numa_init+0x6c/0x70
       [<ffffffff81cf7057>] initmem_init+0x39/0x3b
       [<ffffffff81ce5865>] setup_arch+0x64e/0x769
       [<ffffffff815e43c1>] ? printk+0x51/0x53
       [<ffffffff81cdf92b>] start_kernel+0xd4/0x3f3
       [<ffffffff81cdf388>] x86_64_start_reservations+0x132/0x136
       [<ffffffff81ce2ed4>] xen_start_kernel+0x588/0x58f
      Code: 41 00 00 48 8b 3c c5 a0 24 cc 81 31 c0 40 f6 c7 01 74 05 aa 66 ba ff 40 40 f6 c7 02 74 05 66 ab 83 ea 02 89 d1 c1 e9 02 f6 c2 02 <f3> ab 74 02 66 ab 80 e2 01 74 01 aa 49 63 c4 48 c1 eb 0c 44 89
      RIP  [<ffffffff81cf6a75>] setup_node_bootmem+0x18a/0x1ea
       RSP <ffffffff81c01e38>
      CR2: 0000000000000000
      ---[ end trace a7919e7f17c0a725 ]---
      Kernel panic - not syncing: Attempted to kill the idle task!
      Pid: 0, comm: swapper Tainted: G      D     2.6.39-0-virtual #6~smb1
      Reported-by: default avatarStefan Bader <stefan.bader@canonical.com>
      Signed-off-by: default avatarKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      92bdaef7
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse · 6eaed0a4
      Linus Torvalds authored
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse:
        fuse: fix oops in revalidate when called with NULL nameidata
      6eaed0a4
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6 · 8043f4eb
      Linus Torvalds authored
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6:
        sparc32: Fixed unaligned memory copying in function __csum_partial_copy_sparc_generic
        sparc32: fix sparcstation 5 boot
        sparc32: fix section mismatch warnings in apc, pmc and time_32
      8043f4eb
    • Linus Torvalds's avatar
      Merge branch 'fixes' of master.kernel.org:/home/rmk/linux-2.6-arm · 75c0b3b4
      Linus Torvalds authored
      * 'fixes' of master.kernel.org:/home/rmk/linux-2.6-arm:
        ARM: 6870/1: The mandatory barrier rmb() must be a dsb() in for device accesses
        ARM: 6892/1: handle ptrace requests to change PC during interrupted system calls
        ARM: 6890/1: memmap: only free allocated memmap entries when using SPARSEMEM
        ARM: zImage: the page table memory must be considered before relocation
        ARM: zImage: make sure not to relocate on top of the relocation code
        ARM: zImage: Fix bad SP address after relocating kernel
        ARM: zImage: make sure the stack is 64-bit aligned
        ARM: RiscPC: acornfb: fix section mismatches
        ARM: RiscPC: etherh: fix section mismatches
      75c0b3b4
    • Linus Torvalds's avatar
      fbmem: make read/write/ioctl use the frame buffer at open time · c47747fd
      Linus Torvalds authored
      read/write/ioctl on a fbcon file descriptor has traditionally used the
      fbcon not when it was opened, but as it was at the time of the call.
      That makes no sense, but the lack of sense is much more obvious now that
      we properly ref-count the usage - it means that the ref-counting doesn't
      actually protect operations we do on the frame buffer.
      
      This changes it to look at the fb_info that we got at open time, but in
      order to avoid using a frame buffer long after it has been unregistered,
      we do verify that it is still current, and return -ENODEV if not.
      Acked-by: default avatarTim Gardner <tim.gardner@canonical.com>
      Tested-by: default avatarDaniel J Blueman <daniel.blueman@gmail.com>
      Tested-by: default avatarAnca Emanuel <anca.emanuel@gmail.com>
      Cc: Bruno Prémont <bonbons@linux-vserver.org>
      Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
      Cc: Paul Mundt <lethal@linux-sh.org>
      Cc: Dave Airlie <airlied@redhat.com>
      Cc: Andy Whitcroft <andy.whitcroft@canonical.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      c47747fd
    • Linus Torvalds's avatar
      fbcon: add lifetime refcount to opened frame buffers · 698b3682
      Linus Torvalds authored
      This just adds the refcount and the new registration lock logic.  It
      does not (for example) actually change the read/write/ioctl routines to
      actually use the frame buffer that was opened: those function still end
      up alway susing whatever the current frame buffer is at the time of the
      call.
      
      Without this, if something holds the frame buffer open over a
      framebuffer switch, the close() operation after the switch will access a
      fb_info that has been free'd by the unregistering of the old frame
      buffer.
      
      (The read/write/ioctl operations will normally not cause problems,
      because they will - illogically - pick up the new fbcon instead.  But a
      switch that happens just as one of those is going on might see problems
      too, the window is just much smaller: one individual op rather than the
      whole open-close sequence.)
      
      This use-after-free is apparently fairly easily triggered by the Ubuntu
      11.04 boot sequence.
      Acked-by: default avatarTim Gardner <tim.gardner@canonical.com>
      Tested-by: default avatarDaniel J Blueman <daniel.blueman@gmail.com>
      Tested-by: default avatarAnca Emanuel <anca.emanuel@gmail.com>
      Cc: Bruno Prémont <bonbons@linux-vserver.org>
      Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
      Cc: Paul Mundt <lethal@linux-sh.org>
      Cc: Dave Airlie <airlied@redhat.com>
      Cc: Andy Whitcroft <andy.whitcroft@canonical.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      698b3682
    • Ben Hutchings's avatar
      sfc: Always map MCDI shared memory as uncacheable · 747df225
      Ben Hutchings authored
      We enabled write-combining for memory-mapped registers in commit
      65f0b417, but inhibited it for the
      MCDI shared memory where this is not supported.  However,
      write-combining mappings also allow read-reordering, which may also
      be a problem.
      
      I found that when an SFC9000-family controller is connected to an
      Intel 3000 chipset, and write-combining is enabled, the controller
      stops responding to PCIe read requests during driver initialisation
      while the driver is polling for completion of an MCDI command.  This
      results in an NMI and system hang.  Adding read memory barriers
      between all reads to the shared memory area appears to reduce but not
      eliminate the probability of this.
      
      We have not yet established whether this is a bug in our BIU or in the
      PCIe bridge.  For now, work around by mapping the shared memory area
      separately.
      Signed-off-by: default avatarBen Hutchings <bhutchings@solarflare.com>
      747df225
    • Catalin Marinas's avatar
      ARM: 6870/1: The mandatory barrier rmb() must be a dsb() in for device accesses · a904f5f9
      Catalin Marinas authored
      Since mandatory barriers may be used (explicitly or implicitly via readl
      etc.) to ensure the ordering between Device and Normal memory accesses,
      a DMB is not enough. This patch converts it to a DSB.
      
      Cc: Colin Cross <ccross@android.com>
      Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      a904f5f9
    • Arnd Bergmann's avatar
      ARM: 6892/1: handle ptrace requests to change PC during interrupted system calls · 2af68df0
      Arnd Bergmann authored
      GDB's interrupt.exp test cases currenly fail on ARM.  The problem is how do_signal
      handled restarting interrupted system calls:
      
      The entry.S assembler code determines that we come from a system call; and that
      information is passed as "syscall" parameter to do_signal.  That routine then
      calls get_signal_to_deliver [*] and if a signal is to be delivered, calls into
      handle_signal.  If a system call is to be restarted either after the signal
      handler returns, or if no handler is to be called in the first place, the PC
      is updated after the get_signal_to_deliver call, either in handle_signal (if
      we have a handler) or at the end of do_signal (otherwise).
      
      Now the problem is that during [*], the call to get_signal_to_deliver, a ptrace
      intercept may happen.  During this intercept, the debugger may change registers,
      including the PC.  This is done by GDB if it wants to execute an "inferior call",
      i.e. the execution of some code in the debugged program triggered by GDB.
      
      To this purpose, GDB will save all registers, allocate a stack frame, set up
      PC and arguments as appropriate for the call, and point the link register to
      a dummy breakpoint instruction.  Once the process is restarted, it will execute
      the call and then trap back to the debugger, at which point GDB will restore
      all registers and continue original execution.
      
      This generally works fine.  However, now consider what happens when GDB attempts
      to do exactly that while the process was interrupted during execution of a to-be-
      restarted system call:  do_signal is called with the syscall flag set; it calls
      get_signal_to_deliver, at which point the debugger takes over and changes the PC
      to point to a completely different place.  Now get_signal_to_deliver returns
      without a signal to deliver; but now do_signal decides it should be restarting
      a system call, and decrements the PC by 2 or 4 -- so it now points to 2 or 4
      bytes before the function GDB wants to call -- which leads to a subsequent crash.
      
      To fix this problem, two things need to be supported:
      - do_signal must be able to recognize that get_signal_to_deliver changed the PC
        to a different location, and skip the restart-syscall sequence
      - once the debugger has restored all registers at the end of the inferior call
        sequence, do_signal must recognize that *now* it needs to restart the pending
        system call, even though it was now entered from a breakpoint instead of an
        actual svc instruction
      
      This set of issues is solved on other platforms, usually by one of two
      mechanisms:
      
      - The status information "do_signal is handling a system call that may need
        restarting" is itself carried in some register that can be accessed via
        ptrace.  This is e.g. on Intel the "orig_eax" register; on Sparc the kernel
        defines a magic extra bit in the flags register for this purpose.
        This allows GDB to manage that state: reset it when doing an inferior call,
        and restore it after the call is finished.
      
      - On s390, do_signal transparently handles this problem without requiring
        GDB interaction, by performing system call restarting in the following
        way: first, adjust the PC as necessary for restarting the call.  Then,
        call get_signal_to_deliver; and finally just continue execution at the
        PC.  This way, if GDB does not change the PC, everything is as before.
        If GDB *does* change the PC, execution will simply continue there --
        and once GDB restores the PC it saved at that point, it will automatically
        point to the *restarted* system call.  (There is the minor twist how to
        handle system calls that do *not* need restarting -- do_signal will undo
        the PC change in this case, after get_signal_to_deliver has returned, and
        only if ptrace did not change the PC during that call.)
      
      Because there does not appear to be any obvious register to carry the
      syscall-restart information on ARM, we'd either have to introduce a new
      artificial ptrace register just for that purpose, or else handle the issue
      transparently like on s390.  The patch below implements the second option;
      using this patch makes the interrupt.exp test cases pass on ARM, with no
      regression in the GDB test suite otherwise.
      
      Cc: patches@linaro.org
      Signed-off-by: default avatarUlrich Weigand <ulrich.weigand@linaro.org>
      Signed-off-by: default avatarArnd Bergmann <arnd.bergmann@linaro.org>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      2af68df0