- 17 Aug, 2006 7 commits
-
-
Olof Johansson authored
Clear HID0[en_attn] at CPU init time on PPC970. Closes CVE-2006-4093. Signed-off-by:
Olof Johansson <olof@lixom.net> Signed-off-by:
Paul Mackerras <paulus@samba.org>
-
Benjamin Herrenschmidt authored
The code for using the radix tree for reverse mapping of interrupts has a typo that causes it to create incorrect mappings if the software and hardware numbers happen to be different. This would, among others, cause the IDE interrupt to fail on js20's. This fixes it. Signed-off-by:
Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by:
-
Ananth N Mavinakayanahalli authored
- On archs that have no-exec support, we vmalloc() a executable scratch area of PAGE_SIZE and divide it up into an array of slots of maximum instruction size for that arch - On a kprobe registration, the original instruction is copied to the first available free slot, so if multiple kprobes are registered, chances are, they get contiguous slots - On POWER4, due to not having coherent icaches, we could hit a situation where a probe that is registered on one processor, is hit immediately on another. This second processor could have fetched the stream of text from the out-of-line single-stepping area *before* the probe registration completed, possibly due to an earlier (and a different) kprobe hit and hence would see stale data at the slot. Executing such an arbitrary instruction lead to a problem as reported in LTC bugzilla 23555. The correct solution is to call flush_icache_range() as soon as the instruction is copied for out-of-line single-stepping, so the correct instruction is seen on all processors. Thanks to Will Schmidt who tracked this down. Signed-off-by:
Ananth N Mavinakayanahalli <ananth@in.ibm.com> Acked-by:
Will Schmidt <will_schmidt@vnet.ibm.com> Signed-off-by:
-
Michael Ellerman authored
To compile kexec on 32-bit we need a few more bits and pieces. Rather than add empty definitions, we can make crash.c work on 32-bit, with only a couple of kludges. Signed-off-by:
Michael Ellerman <michael@ellerman.id.au> Signed-off-by:
-
Michael Ellerman authored
We're missing a few functions for kexec to compile on 32-bit. There's nothing really 64-bit specific about the 64-bit versions, so make them generic rather than adding empty definitions for 32-bit. Signed-off-by:
-
Will Schmidt authored
Updating the defconfigs for iseries, pseries, and G5. Sticking with the defaults, with the following exceptions: I've turned off HW_RANDOM for all three configs. For G5, I've enabled SND_AOA and friends as modules; this includes the FABRIC_LAYOUT, ONYX, TAS, TOONIE and SOUNDBUS* config options. Signed-off-by:
-
David Wilder authored
In the case of a system hang, the user will invoke soft-reset to initiate the kdump boot. If xmon is enabled, the CPU(s) enter into the xmon debugger. Unfortunately, the secondary CPU(s) will return to the hung state when they exit from the debugger (returned from die() -> system_reset_exception()). This causes a problem in kdump since the hung CPU(s) will not respond to the IPI sent from kdump. This patch fixes the issue by calling crash_kexec_secondary() directly from system_reset_exception() without returning to the previous state. These secondary CPUs wait 5ms until the kdump boot is started by the primary CPU. In the case we exited from the debugger to "recover" (command 'x' in xmon) the primary and the secondary CPUs will all return from die() -> system_reset_exception() ->crash_kexec_secondary() wait 5ms, then return to the previous state. A kdump boot is not started in this case. Signed-off-by:
Haren Myneni <haren@us.ibm.com> Signed-off-by:
David Wilder <dwilder@us.ibm.com> Signed-off-by:
-
- 08 Aug, 2006 2 commits
-
-
Haren Myneni authored
Noticing the following might_sleep warning (dump_stack()) during kdump testing when CONFIG_DEBUG_SPINLOCK_SLEEP is enabled. All secondary CPUs will be calling rtas_set_indicator with interrupts disabled to remove them from global interrupt queue. BUG: sleeping function called from invalid context at arch/powerpc/kernel/rtas.c:463 in_atomic():1, irqs_disabled():1 Call Trace: [C00000000FFFB970] [C000000000010234] .show_stack+0x68/0x1b0 (unreliable) [C00000000FFFBA10] [C000000000059354] .__might_sleep+0xd8/0xf4 [C00000000FFFBA90] [C00000000001D1BC] .rtas_busy_delay+0x20/0x5c [C00000000FFFBB20] [C00000000001D8A8] .rtas_set_indicator+0x6c/0xcc [C00000000FFFBBC0] [C000000000048BF4] .xics_teardown_cpu+0x118/0x134 [C00000000FFFBC40] [C00000000004539C] .pseries_kexec_cpu_down_xics+0x74/0x8c [C00000000FFFBCC0] [C00000000002DF08] .crash_ipi_callback+0x15c/0x188 [C00000000FFFBD50] [C0000000000296EC] .smp_message_recv+0x84/0xdc [C00000000FFFBDC0] [C000000000048E08] .xics_ipi_dispatch+0xf0/0x130 [C00000000FFFBE50] [C00000000009EF10] .handle_IRQ_event+0x7c/0xf8 [C00000000FFFBF00] [C0000000000A0A14] .handle_percpu_irq+0x90/0x10c [C00000000FFFBF90] [C00000000002659C] .call_handle_irq+0x1c/0x2c [C00000000058B9C0] [C00000000000CA10] .do_IRQ+0xf4/0x1a4 [C00000000058BA50] [C0000000000044EC] hardware_interrupt_entry+0xc/0x10 --- Exception: 501 at .plpar_hcall_norets+0x14/0x1c LR = .pseries_dedicated_idle_sleep+0x190/0x1d4 [C00000000058BD40] [C00000000058BDE0] 0xc00000000058bde0 (unreliable) [C00000000058BDF0] [C00000000001270C] .cpu_idle+0x10c/0x1e0 [C00000000058BE70] [C000000000009274] .rest_init+0x44/0x5c To fix this issue, rtas_set_indicator_fast() is added so that will not wait for RTAS 'busy' delay and this new function is used for kdump (in xics_teardown_cpu()) and for CPU hotplug ( xics_migrate_irqs_away() and xics_setup_cpu()). Note that the platform architecture spec says that set-indicator on the indicator we're using here is not permitted to return the busy or extended busy status codes. Signed-off-by:
-
Sonny Rao authored
We should not be calling power4_enable_pmcs() in pseries_lpar_enable_pmcs(); just doing the hypercall is sufficient. Prior to 2.6.15 we did not call power4_enable_pmcs() for an lpar. power4_enable_pmcs() tries to read the hid0 register which is no longer legal for an lpar in newer Power processors. Signed-off-by:
-
- 06 Aug, 2006 31 commits
-
-
Linus Torvalds authored
-
Linus Torvalds authored
* 'for-linus' of master.kernel.org:/pub/scm/linux/kernel/git/dtor/input: (24 commits) Input: ati_remote - use msec instead of jiffies Input: ati_remote - add missing input_sync() Input: ati_remote - relax permissions sysfs module parameters Input: ati_remote - make filter time a module parameter Input: atkbd - restore repeat rate when resuming Input: trackpoint - activate protocol when resuming Input: logips2pp - fix button mapping for MX300 Input: keyboard - change to use kzalloc Input: serio/gameport - check whether driver core calls succeeded Input: spaceball - make 4000FLX Lefty work Input: keyboard - simplify emulate_raw() implementation Input: keyboard - remove static variable and clean up initialization Input: hiddev - use standard list implementation Input: add missing handler->start() call Input: HID - fix potential out-of-bound array access Input: fix list iteration in input_release_device() Input: iforce - add Trust Force Feedback Race Master support Input: iforce - check array bounds before accessing elements Input: libps2 - warn instead of oopsing when passed bad arguments Input: fm801-gp - fix use after free ...
-
Linus Torvalds authored
* master.kernel.org:/pub/scm/linux/kernel/git/perex/alsa: [ALSA] Don't reject O_RDWR at opening PCM OSS with read/write-only device [ALSA] snd-emu10k1: Implement support for Audigy 2 ZS [SB0353] [ALSA] add MAINTAINERS entry for snd-aoa [ALSA] aoa: platform function gpio: ignore errors from functions that don't exist [ALSA] make snd-powermac load even when it can't bind the device [ALSA] aoa: fix toonie codec [ALSA] aoa: feature gpio layer: fix IRQ access [ALSA] Conversions from kmalloc+memset to k(z|c)alloc [ALSA] snd-emu10k1: Fixes ALSA bug#2190
-
Linus Torvalds authored
* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: [LAPB]: Fix windowsize check [TCP]: Fixes IW > 2 cases when TCP is application limited [PKT_SCHED] RED: Fix overflow in calculation of queue average [LLX]: SOCK_DGRAM interface fixes [PKT_SCHED]: Return ENOENT if qdisc module is unavailable [BRIDGE]: netlink status fix
-
David Woodhouse authored
While busy-waiting for completion, check the hardware after scheduling; don't schedule and then immediately check the _timeout_. If the yield() took a long time (as it does on my OLPC prototype board when it's busy), we'd report a timeout even though the hardware was now ready. This fixes it, and also switches the yield() for a cond_resched() because we don't actually want to be _that_ nice about it. I see nice tightly-packed SMBus transactions now, rather than waiting for milliseconds between successive phases. Actually, we shouldn't be busy-waiting here at all. We should be using interrupts. That's an exercise for another day though. Signed-off-by:
David Woodhouse <dwmw2@infradead.org> Cc: Christer Weinigel <wingel@nano-system.com> Cc: <Jordan.Crouse@amd.com> Signed-off-by:
Andrew Morton <akpm@osdl.org> Signed-off-by:
Linus Torvalds <torvalds@osdl.org>
-
Eric Sandeen authored
I saw an oops down this path when trying to create a new file on a UDF filesystem which was internally marked as readonly, but mounted rw: udf_create udf_new_inode new_inode alloc_inode udf_alloc_inode udf_new_block returns EIO due to readonlyness iput (on error) udf_put_inode udf_discard_prealloc udf_next_aext udf_current_aext udf_get_fileshortad OOPS the udf_discard_prealloc() path was examining uninitialized fields of the udf inode. udf_discard_prealloc() already has this code to short-circuit the discard path if no extents are preallocated: if (UDF_I_ALLOCTYPE(inode) == ICBTAG_FLAG_AD_IN_ICB || inode->i_size == UDF_I_LENEXTENTS(inode)) { return; } so if we initialize UDF_I_LENEXTENTS(inode) = 0 earlier in udf_new_inode, we won't try to free the (not) preallocated blocks, since this will match the i_size = 0 set when the inode was initialized. Signed-off-by:Eric Sandeen <sandeen@sandeen.net> Signed-off-by:
-
Thomas Gleixner authored
The recent fixups in futex.c need to be applied to futex_compat.c too. Fixes a hang reported by Olaf. Signed-off-by:
Thomas Gleixner <tglx@linutronix.de> Cc: Olaf Hering <olh@suse.de> Signed-off-by:
-
matthieu castet authored
A patch in -mm kernel correct the parsing of "address resources" of pnpacpi. Before we assumed it was memory only, but it could be also IO. But this change show an hidden bug : some resources could be producer type that are not handled by pnp layer. So we should ignore the producer resources. This patch fixes bug 6292 (http://bugzilla.kernel.org/show_bug.cgi?id=6292). Some devices like PNP0A03 have 0xd00-0xffff and 0x0-0xcf7 as IO producer resources. Before correcting "address resources" parsing, it was seen as memory and was harmless, because nobody tried to reserve this memory range as it should be IO. With the correction it become IO resources, and make failed all others device that want to register IO in this range and use pnp layer (like a ISA sound card). The solution is to ignore producer resources Signed-off-by:
Matthieu CASTET <castet.matthieu@free.fr> Signed-off-by:
Uwe Bugla <uwe.bugla@gmx.de> Cc: Bjorn Helgaas <bjorn.helgaas@hp.com> Cc: Adam Belay <ambx1@neo.rr.com> Cc: "Brown, Len" <len.brown@intel.com> Acked-by:
Shaohua Li <shaohua.li@intel.com> Signed-off-by:
-
Chris Mason authored
reiserfs_write_full_page does zero bytes in the file past eof, but it may call get_block on those buffers as well. On machines where the page size is larger than the blocksize, this can result in mmaped files incorrectly growing up to a block boundary during writepage. The fix is to avoid calling get_block for any blocks that are entirely past eof Signed-off-by:
Chris Mason <mason@suse.com> Signed-off-by:
-
Chris Mason authored
The correct lock ordering is inode lock -> BKL Signed-off-by:
-
KAMEZAWA Hiroyuki authored
This patch is for collision check enhancement for memory hot add. It's better to do resouce collision check before doing memory hot add, which will touch memory management structures. And add_section() should check section exists or not before calling sparse_add_one_section(). (sparse_add_one_section() will do another check anyway. but checking in memory_hotplug.c will be easy to understand.) Signed-off-by:
KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Cc: keith mannthey <kmannth@us.ibm.com> Signed-off-by:
-
KAMEZAWA Hiroyuki authored
both of acpi_memory_enable_device() and acpi_memory_add_device() may evaluate _CRS method. We should avoid evaluate device's resource twice if we could get it successfully in past. Signed-off-by:
-
KAMEZAWA Hiroyuki authored
add_memory() does all necessary check to avoid collision. then, acpi layer doesn't have to check region by itself. (*) pfn_valid() just returns page struct is valid or not. It returns 0 if a section has been already added even is ioresource is not added. ioresource collision check in mm/memory_hotplug.c can do more precise collistion check. added enabled bit check just for sanity check.. Signed-off-by: -
KAMEZAWA Hiroyuki authored
find_next_system_ram() is used to find available memory resource at onlining newly added memory. This patch fixes following problem. find_next_system_ram() cannot catch this case. Resource: (start)-------------(end) Section : (start)-------------(end) Signed-off-by:
-
KAMEZAWA Hiroyuki authored
find_next_system_ram() returns valid memory range which meets requested area, only used by memory-hot-add. This function always rewrite requested resource even if returned area is not fully fit in requested one. And sometimes the returnd resource is larger than requested area. This annoyes the caller. This patch changes the returned value to fit in requested area. Signed-off-by:
-
KAMEZAWA Hiroyuki authored
ioresouce handling code in memory hotplug allows not-aligned memory hot add. But when memmap and other memory structures are initialized, parameters should be aligned. (if not aligned, initialization of mem_map will do wrong, it assumes parameters are aligned.) This patch fix it. And this patch allows ioresource collision check to handle -EEXIST. Signed-off-by:
-
Diego Calleja authored
In bugzilla #6941, Jens Kilian reported: "The function befs_utf2nls (in fs/befs/linuxvfs.c) writes a 0 byte past the end of a block of memory allocated via kmalloc(), leading to memory corruption. This happens only for filenames which are pure ASCII and a multiple of 4 bytes in length. [...] Without DEBUG_SLAB, this leads to further corruption and hard lockups; I believe this is the bug which has made kernels later than 2.6.8 unusable for me. (This must be due to changes in memory management, the bug has been in the BeFS driver since the time it was introduced (AFAICT).) Steps to reproduce: Create a directory (in BeOS, naturally :-) with files named, e.g., "1", "22", "333", "4444", ... Mount it in Linux and do an "ls" or "find"" This patch implements the suggested fix. Credits to Jens Kilian for debugging the problem and finding the right fix. Signed-off-by:
Diego Calleja <diegocg@gmail.com> Cc: Jens Kilian <jjk@acm.org> Cc: <stable@kernel.org> Signed-off-by:
-
Stefan Richter authored
At least Maxtor OneTouch III require a "start stop unit" command after auto spin-down before the next access can proceed. This patch activates the responsible code in scsi_mod for all Maxtor SBP-2 disks. https://bugzilla.novell.com/show_bug.cgi?id=183011 Maybe that should be done for all SBP-2 disks, but better be cautious. Signed-off-by:
Stefan Richter <stefanr@s5r6.in-berlin.de> Cc: Jody McIntyre <scjody@modernduck.com> Cc: Ben Collins <bcollins@ubuntu.com> Signed-off-by:
-
Steven Rostedt authored
While helping someone to submit a patch to the stable branch, I noticed that the stable branch is not listed in the MAINTAINERS file. This was after I went there to look for the email addresses for the stable branch list (stable@kernel.org). This patch adds the stable branch to the maintainers file so that people can find where to send patches when they have a fix for the stable team. Signed-off-by:
Steven Rostedt <rostedt@goodmis.org> Signed-off-by:
Chris Wright <chrisw@sous-sol.org> Cc: Greg KH <greg@kroah.com> Signed-off-by:
-
Neil Horman authored
Clean up proc file removal in sq module for superh arch. currently on a failed module load or on module unload a proc file is left registered which can cause a random memory execution or oopses if read after unload. This patch cleans up that deregistration. Signed-off-by:
Neil Horman <nhorman@tuxdriver.com> Acked-by:
Paul Mundt <lethal@linux-sh.org> Cc: Kazumoto Kojima <kkojima@rr.iij4u.or.jp> Signed-off-by:
-
Alexey Dobriyan authored
* MODE_MASK is unused in eicon driver. * Conflicts with a ptrace stuff on arm. drivers/isdn/hardware/eicon/divasync.h:259:1: warning: "MODE_MASK" redefined include2/asm/ptrace.h:48:1: warning: this is the location of the previous definition Signed-off-by:
Alexey Dobriyan <adobriyan@gmail.com> Acked-by:
Karsten Keil <kkeil@suse.de> Acked-by:
Armin Schindler <armin@melware.de> Signed-off-by:
-
Linas Vepstas authored
A set of tty line discipline cleanup patches were introduced before the dawn of time, in kernel version 2.4.21. This patch performs that cleanup for the hvsi driver. The hvsi driver is used only on IBM pSeries PowerPC boxes. The driver was originally written by Hollis Blanchard, who has delegated maintainership to me. So this my first and maybe only patch in this official new role, because this driver is otherwise bug-free :-) Alan: "Actually its also a bug fix, tty->ldisc should be locked by refcounting and the helpers do this for you." Signed-off-by:
Linas Vepstas <linas@austin.ibm.com> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Paul Mackerras <paulus@samba.org> Acked-by:
Alan Cox <alan@redhat.com> Signed-off-by:
-
Linas Vepstas authored
Under certain rare circumstances, it appears that there can be be a NULL-pointer deref when a user fiddles with terminal emeulation programs while outpu is being sent to the console. This patch checks for and avoids a NULL-pointer deref. Signed-off-by:
Hollis Blanchard <hollisbl@austin.ibm.com> Signed-off-by:
Alan Cox <alan@lxorguk.ukuu.org.uk> Signed-off-by:
-
Alexey Dobriyan authored
Signed-off-by:
-
Maxime Bizon authored
Signed-off-by:
Maxime Bizon <mbizon@freebox.fr> Acked-by:
Simon Horman <horms@verge.net.au> Signed-off-by:
-
Neil Brown authored
If we don't find the item we are lookng for, we allocate a new one, and then grab the lock again and search to see if it has been added while we did the alloc. If it had been added we need to 'cache_put' the newly created item that we are never going to use. But as it hasn't been initialised properly, putting it can cause an oops. So move the ->init call earlier to that it will always be fully initilised if we have to put it. Thanks to Philipp Matthias Hahn <pmhahn@svs.Informatik.Uni-Oldenburg.de> for reporting the problem. Signed-off-by:
Neil Brown <neilb@suse.de> Cc: <stable@kernel.org> Signed-off-by:
-
Alexey Dobriyan authored
Removes many, many "declared inside parameter list" warnings on parisc. Signed-off-by:
-
Andrew Morton authored
The POSIX_FADV_NOREUSE hint means "the application will use this range of the file a single time". It seems to be intended that the implementation will use this hint to perform drop-behind of that part of the file when the application gets around to reading or writing it. However for reasons which aren't obvious (or sane?) I mapped POSIX_FADV_NOREUSE onto POSIX_FADV_WILLNEED. ie: it does readahead. That's daft. So for now, make POSIX_FADV_NOREUSE a no-op. This is a non-back-compatible change. If someone was using POSIX_FADV_NOREUSE to perform readahead, they lose. The likelihood is low. If/when we later implement POSIX_FADV_NOREUSE things will get interesting - to do it fully we'll need to maintain file offset/length ranges and peform all sorts of complex tricks, and managing the lifetime of those ranges' data structures will be interesting.. A sensible implementation would probably ignore the file range and would simply mark the entire file as needing some form of drop-behind treatment. Cc: Michael Kerrisk <mtk-manpages@gmx.net> Signed-off-by:
-
Rodolfo Giometti authored
- fix up the start up sequence. This new sequence allow you to correctly enable the LCD controller even if the bootloader has already did it. - fix up a wrong indentation issue. Signed-off-by:
Rodolfo Giometti <giometti@linux.it> Signed-off-by:
Antonino Daplas <adaplas@pol.net> Signed-off-by:
-
Rodolfo Giometti authored
Fix "info->var.rotate" data settings. This info should be deduced directly from "fbdev->panel->control_base" defined into au1100fb.h. Signed-off-by:
-
Antonino A. Daplas authored
Reported by: Dave Jones Whilst printk'ing to both console and serial console, I got this... (2.6.18rc1) BUG: sleeping function called from invalid context at kernel/sched.c:4438 in_atomic():0, irqs_disabled():1 Call Trace: [<ffffffff80271db8>] show_trace+0xaa/0x23d [<ffffffff80271f60>] dump_stack+0x15/0x17 [<ffffffff8020b9f8>] __might_sleep+0xb2/0xb4 [<ffffffff8029232e>] __cond_resched+0x15/0x55 [<ffffffff80267eb8>] cond_resched+0x3b/0x42 [<ffffffff80268c64>] console_conditional_schedule+0x12/0x14 [<ffffffff80368159>] fbcon_redraw+0xf6/0x160 [<ffffffff80369c58>] fbcon_scroll+0x5d9/0xb52 [<ffffffff803a43c4>] scrup+0x6b/0xd6 [<ffffffff803a4453>] lf+0x24/0x44 [<ffffffff803a7ff8>] vt_console_print+0x166/0x23d [<ffffffff80295528>] __call_console_drivers+0x65/0x76 [<ffffffff80295597>] _call_console_drivers+0x5e/0x62 [<ffffffff80217e3f>] release_console_sem+0x14b/0x232 [<ffffffff8036acd6>] fb_flashcursor+0x279/0x2a6 [<ffffffff80251e3f>] run_workqueue+0xa8/0xfb [<ffffffff8024e5e0>] worker_thread+0xef/0x122 [<ffffffff8023660f>] kthread+0x100/0x136 [<ffffffff8026419e>] child_rip+0x8/0x12 This can occur when release_console_sem() is called but the log buffer still has contents that need to be flushed. The console drivers are called while the console_may_schedule flag is still true. The might_sleep() is triggered when fbcon calls console_conditional_schedule(). Fix by setting console_may_schedule to zero earlier, before the call to the console drivers. Signed-off-by:
-
