1. 05 Sep, 2009 20 commits
  2. 04 Sep, 2009 16 commits
    • Sunil Mushran's avatar
      ocfs2: ocfs2_write_begin_nolock() should handle len=0 · 8379e7c4
      Sunil Mushran authored
      Bug introduced by mainline commit e7432675
      The bug causes ocfs2_write_begin_nolock() to oops when len=0.
      Signed-off-by: default avatarSunil Mushran <sunil.mushran@oracle.com>
      Cc: stable@kernel.org
      Signed-off-by: default avatarJoel Becker <joel.becker@oracle.com>
      8379e7c4
    • Mikulas Patocka's avatar
      dm snapshot: fix on disk chunk size validation · ae0b7448
      Mikulas Patocka authored
      Fix some problems seen in the chunk size processing when activating a
      pre-existing snapshot.
      
      For a new snapshot, the chunk size can either be supplied by the creator
      or a default value can be used.  For an existing snapshot, the
      chunk size in the snapshot header on disk should always be used.
      
      If someone attempts to load an existing snapshot and has the 'default
      chunk size' option set, the kernel uses its default value even when it
      is incorrect for the snapshot being loaded.  This patch ensures the
      correct on-disk value is always used.
      
      Secondly, when the code does use the chunk size stored on the disk it is
      prudent to revalidate it, so the code can exit cleanly if it got
      corrupted as happened in
      https://bugzilla.redhat.com/show_bug.cgi?id=461506 .
      
      Cc: stable@kernel.org
      Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
      Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
      ae0b7448
    • Mikulas Patocka's avatar
      dm exception store: split set_chunk_size · 2defcc3f
      Mikulas Patocka authored
      Break the function set_chunk_size to two functions in preparation for
      the fix in the following patch.
      
      Cc: stable@kernel.org
      Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
      Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
      2defcc3f
    • Mikulas Patocka's avatar
      dm snapshot: fix header corruption race on invalidation · 61578dcd
      Mikulas Patocka authored
      If a persistent snapshot fills up, a race can corrupt the on-disk header
      which causes a crash on any future attempt to activate the snapshot
      (typically while booting).  This patch fixes the race.
      
      When the snapshot overflows, __invalidate_snapshot is called, which calls
      snapshot store method drop_snapshot. It goes to persistent_drop_snapshot that
      calls write_header. write_header constructs the new header in the "area"
      location.
      
      Concurrently, an existing kcopyd job may finish, call copy_callback
      and commit_exception method, that goes to persistent_commit_exception.
      persistent_commit_exception doesn't do locking, relying on the fact that
      callbacks are single-threaded, but it can race with snapshot invalidation and
      overwrite the header that is just being written while the snapshot is being
      invalidated.
      
      The result of this race is a corrupted header being written that can
      lead to a crash on further reactivation (if chunk_size is zero in the
      corrupted header).
      
      The fix is to use separate memory areas for each.
      
      See the bug: https://bugzilla.redhat.com/show_bug.cgi?id=461506
      
      Cc: stable@kernel.org
      Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
      Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
      61578dcd
    • Mikulas Patocka's avatar
      dm snapshot: refactor zero_disk_area to use chunk_io · 02d2fd31
      Mikulas Patocka authored
      Refactor chunk_io to prepare for the fix in the following patch.
      
      Pass an area pointer to chunk_io and simplify zero_disk_area to use
      chunk_io.  No functional change.
      
      Cc: stable@kernel.org
      Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
      Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
      02d2fd31
    • Jonathan Brassow's avatar
      dm log: userspace add luid to distinguish between concurrent log instances · 7ec23d50
      Jonathan Brassow authored
      Device-mapper userspace logs (like the clustered log) are
      identified by a universally unique identifier (UUID).  This
      identifier is used to associate requests from the kernel to
      a specific log in userspace.  The UUID must be unique everywhere,
      since multiple machines may use this identifier when communicating
      about a particular log, as is the case for cluster logs.
      
      Sometimes, device-mapper/LVM may re-use a UUID.  This is the
      case during pvmoves, when moving from one segment of an LV
      to another, or when resizing a mirror, etc.  In these cases,
      a new log is created with the same UUID and loaded in the
      "inactive" slot.  When a device-mapper "resume" is issued,
      the "live" table is deactivated and the new "inactive" table
      becomes "live".  (The "inactive" table can also be removed
      via a device-mapper 'clear' command.)
      
      The above two issues were colliding.  More than one log was being
      created with the same UUID, and there was no way to distinguish
      between them.  So, sometimes the wrong log would be swapped
      out during the exchange.
      
      The solution is to create a locally unique identifier,
      'luid', to go along with the UUID.  This new identifier is used
      to determine exactly which log is being referenced by the kernel
      when the log exchange is made.  The identifier is not
      universally safe, but it does not need to be, since
      create/destroy/suspend/resume operations are bound to a specific
      machine; and these are the operations that make up the exchange.
      Signed-off-by: default avatarJonathan Brassow <jbrassow@redhat.com>
      Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
      7ec23d50
    • Jonathan Brassow's avatar
      dm raid1: do not allow log_failure variable to unset after being set · d2b69864
      Jonathan Brassow authored
      This patch fixes a bug which was triggering a case where the primary leg
      could not be changed on failure even when the mirror was in-sync.
      
      The case involves the failure of the primary device along with
      the transient failure of the log device.  The problem is that
      bios can be put on the 'failures' list (due to log failure)
      before 'fail_mirror' is called due to the primary device failure.
      Normally, this is fine, but if the log device failure is transient,
      a subsequent iteration of the work thread, 'do_mirror', will
      reset 'log_failure'.  The 'do_failures' function then resets
      the 'in_sync' variable when processing bios on the failures list.
      The 'in_sync' variable is what is used to determine if the
      primary device can be switched in the event of a failure.  Since
      this has been reset, the primary device is incorrectly assumed
      to be not switchable.
      
      The case has been seen in the cluster mirror context, where one
      machine realizes the log device is dead before the other machines.
      As the responsibilities of the server migrate from one node to
      another (because the mirror is being reconfigured due to the failure),
      the new server may think for a moment that the log device is fine -
      thus resetting the 'log_failure' variable.
      
      In any case, it is inappropiate for us to reset the 'log_failure'
      variable.  The above bug simply illustrates that it can actually
      hurt us.
      
      Cc: stable@kernel.org
      Signed-off-by: default avatarJonathan Brassow <jbrassow@redhat.com>
      Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
      d2b69864
    • Jonathan Brassow's avatar
      dm log: remove incorrect field from userspace table output · b8313b6d
      Jonathan Brassow authored
      The output of 'dmsetup table' includes an internal field that should not
      be there.  This patch removes it.  To make the fix simpler, we first
      reorder a constructor argument
      
      The 'device size' argument is generated internally.  Currently it is
      placed as the last space-separated word of the constructor string.
      However, we need to use a version of the string without this word, so we
      move it to the beginning instead so it is trivial to skip past it.
      
      We keep a copy of the arguments passed to userspace for creating a log,
      just in case we need to resend them.  These are the same arguments that
      are desired in the STATUSTYPE_TABLE request, except for one.  When
      creating the userspace log, the userspace daemon must know the size of
      the mirror, so that is added to the arguments given in the constructor
      table.  We were printing this extra argument out as well, which is a
      mistake.
      Signed-off-by: default avatarJonathan Brassow <jbrassow@redhat.com>
      Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
      b8313b6d
    • Jonathan Brassow's avatar
      dm log: fix userspace status output · 4142a969
      Jonathan Brassow authored
      Fix 'dmsetup table' output.
      
      There is a missing ' ' at the end of the string causing two
      words to run together.
      Signed-off-by: default avatarJonathan Brassow <jbrassow@redhat.com>
      Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
      4142a969
    • Mike Snitzer's avatar
      dm stripe: expose correct io hints · 40bea431
      Mike Snitzer authored
      Set sensible I/O hints for striped DM devices in the topology
      infrastructure added for 2.6.31 for userspace tools to
      obtain via sysfs.
      
      Add .io_hints to 'struct target_type' to allow the I/O hints portion
      (io_min and io_opt) of the 'struct queue_limits' to be set by each
      target and implement this for dm-stripe.
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
      40bea431
    • Mike Snitzer's avatar
      dm table: add more context to terse warning messages · a963a956
      Mike Snitzer authored
      A couple of recent warning messages make it difficult for the reader to
      determine exactly what is wrong.  This patch adds more information to
      those messages.
      
      The messages were added by these commits:
        5dea271b ("dm table: pass correct dev area size
      to device_area_is_valid")
        ea9df47c ("dm table: fix blk_stack_limits arg
      to use bytes not sectors")
      
      The patch also corrects references to logical_block_size in printk format
      strings from %hu to %u.
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
      a963a956
    • Mikulas Patocka's avatar
      dm table: fix queue_limit checking device iterator · f6a1ed10
      Mikulas Patocka authored
      The logic to check for valid device areas is inverted relative to proper
      use with iterate_devices.
      
      The iterate_devices method calls its callback for every underlying
      device in the target.  If any callback returns non-zero, iterate_devices
      exits immediately.  But the callback device_area_is_valid() returns 0 on
      error and 1 on success.  The overall effect without is that an error is
      issued only if every device is invalid.
      
      This patch renames device_area_is_valid to device_area_is_invalid and
      inverts the logic so that one invalid device is sufficient to raise
      an error.
      Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
      f6a1ed10
    • Mike Snitzer's avatar
      dm snapshot: implement iterate devices · 8811f46c
      Mike Snitzer authored
      Implement the .iterate_devices for the origin and snapshot targets.
      dm-snapshot's lack of .iterate_devices resulted in the inability to
      properly establish queue_limits for both targets.
      
      With 4K sector drives: an unfortunate side-effect of not establishing
      proper limits in either targets' DM device was that IO to the devices
      would fail even though both had been created without error.
      
      Commit af4874e0 ("dm target:s introduce
      iterate devices fn") in 2.6.31-rc1 should have implemented .iterate_devices
      for dm-snap.c's origin and snapshot targets.
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
      8811f46c
    • Kiyoshi Ueda's avatar
      dm multipath: fix oops when request based io fails when no paths · a77e28c7
      Kiyoshi Ueda authored
      The patch posted at http://marc.info/?l=dm-devel&m=124539787228784&w=2
      which was merged into cec47e3d ("dm:
      prepare for request based option") introduced a regression in
      request-based dm.
      
      If map_request() calls dm_kill_unmapped_request() to complete a cloned
      bio without dispatching it, clone->bio is still set when
      dm_end_request() is called and the BUG_ON(clone->bio) is incorrect.
      
      The patch fixes this bug by freeing bio in dm_end_request() if the clone
      has bio.  I've redone my tests to cover all I/O paths and confirmed
      there's no other regression.
      
      Here is the oops I hit in request-based dm when I do I/O to a multipath
      device which doesn't have any active path nor queue_if_no_path setting:
      
      ------------[ cut here ]------------
      kernel BUG at /root/2.6.31-rc4.rqdm/drivers/md/dm.c:828!
      invalid opcode: 0000 [#1] SMP
      last sysfs file: /sys/devices/system/cpu/cpu3/cache/index2/shared_cpu_map
      CPU 1
      Modules linked in: autofs4 sunrpc cpufreq_ondemand acpi_cpufreq dm_mirror dm_region_hash dm_log dm_service_time dm_multipath scsi_dh dm_mod video output sbs sbshc battery ac sg sr_mod e1000e button cdrom serio_raw rtc_cmos rtc_core rtc_lib piix lpfc scsi_transport_fc ata_piix libata megaraid_sas sd_mod scsi_mod crc_t10dif ext3 jbd uhci_hcd ohci_hcd ehci_hcd [last unloaded: microcode]
      Pid: 7, comm: ksoftirqd/1 Not tainted 2.6.31-rc4.rqdm #1 Express5800/120Lj [N8100-1417]
      RIP: 0010:[<ffffffffa023629d>]  [<ffffffffa023629d>] dm_softirq_done+0xbd/0x100 [dm_mod]
      RSP: 0018:ffff8800280a1f08  EFLAGS: 00010282
      RAX: ffffffffa02544e0 RBX: ffff8802aa1111d0 RCX: ffff8802aa1111e0
      RDX: ffff8802ab913e70 RSI: 0000000000000000 RDI: ffff8802ab913e70
      RBP: ffff8800280a1f28 R08: ffffc90005457040 R09: 0000000000000000
      R10: 0000000000000001 R11: 0000000000000000 R12: 00000000fffffffb
      R13: ffff8802ab913e88 R14: ffff8802ab9c1438 R15: 0000000000000100
      FS:  0000000000000000(0000) GS:ffff88002809e000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
      CR2: 0000003d54a98640 CR3: 000000029f0a1000 CR4: 00000000000006e0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
      Process ksoftirqd/1 (pid: 7, threadinfo ffff8802ae50e000, task ffff8802ae4f8040)
      Stack:
       ffff8800280a1f38 0000000000000020 ffffffff814f30a0 0000000000000004
      <0> ffff8800280a1f58 ffffffff8116b245 ffff8800280a1f38 ffff8800280a1f38
      <0> ffff8800280a1f58 0000000000000001 ffff8800280a1fa8 ffffffff810477bc
      Call Trace:
       <IRQ>
       [<ffffffff8116b245>] blk_done_softirq+0x75/0x90
       [<ffffffff810477bc>] __do_softirq+0xcc/0x210
       [<ffffffff81047170>] ? ksoftirqd+0x0/0x110
       [<ffffffff8100ce7c>] call_softirq+0x1c/0x50
       <EOI>
       [<ffffffff8100e785>] do_softirq+0x65/0xa0
       [<ffffffff81047170>] ? ksoftirqd+0x0/0x110
       [<ffffffff810471e0>] ksoftirqd+0x70/0x110
       [<ffffffff81059559>] kthread+0x99/0xb0
       [<ffffffff8100cd7a>] child_rip+0xa/0x20
       [<ffffffff8100c73c>] ? restore_args+0x0/0x30
       [<ffffffff810594c0>] ? kthread+0x0/0xb0
       [<ffffffff8100cd70>] ? child_rip+0x0/0x20
      Code: 44 89 e6 48 89 df e8 23 fb f2 e0 be 01 00 00 00 4c 89 f7 e8 f6 fd ff ff 5b 41 5c 41 5d 41 5e c9 c3 4c 89 ef e8 85 fe ff ff eb ed <0f> 0b eb fe 41 8b 85 dc 00 00 00 48 83 bb 10 01 00 00 00 89 83
      RIP  [<ffffffffa023629d>] dm_softirq_done+0xbd/0x100 [dm_mod]
       RSP <ffff8800280a1f08>
      ---[ end trace 16af0a1d8542da55 ]---
      Signed-off-by: default avatarKiyoshi Ueda <k-ueda@ct.jp.nec.com>
      Signed-off-by: default avatarJun'ichi Nomura <j-nomura@ce.jp.nec.com>
      Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
      a77e28c7
    • David S. Miller's avatar
      sparc64: Fix bootup with mcount in some configs. · bd4352ca
      David S. Miller authored
      Functions invoked early when booting up a cpu can't use
      tracing because mcount requires a valid 'current_thread_info()'
      and TLB mappings to be setup.
      
      The code path of sun4v_register_mondo_queues --> register_one_mondo
      is one such case.  sun4v_register_mondo_queues already has the
      necessary 'notrace' annotation, but register_one_mondo does not.
      
      Normally register_one_mondo is inlined so the bug doesn't trigger,
      but with some config/compiler combinations, it won't be so we
      must properly mark it notrace.
      
      While we're here, add 'notrace' annoations to prom_printf and
      prom_halt so that early error handling won't have the same problem.
      Reported-by: default avatarAlexander Beregalov <a.beregalov@gmail.com>
      Reported-by: default avatarLeif Sawyer <lsawyer@gci.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bd4352ca
    • Dave Andrews's avatar
      Input: atkbd - add Compaq Presario R4000-series repeat quirk · 2bcaa6a4
      Dave Andrews authored
      Compaq Presario R4000-series laptops are not sending a "volume up button
      release" and "volume down button release" signal in the PS/2 protocol for
      atkbd. The URL below has some of confirmed reports:
      
      https://bugs.launchpad.net/ubuntu/+source/linux/+bug/385477Signed-off-by: default avatarDave Andrews <jetdog330@hotmail.com>
      Signed-off-by: default avatarDmitry Torokhov <dtor@mail.ru>
      2bcaa6a4
  3. 03 Sep, 2009 3 commits
    • Eric Dumazet's avatar
      slub: Fix kmem_cache_destroy() with SLAB_DESTROY_BY_RCU · d76b1590
      Eric Dumazet authored
      kmem_cache_destroy() should call rcu_barrier() *after* kmem_cache_close() and
      *before* sysfs_slab_remove() or risk rcu_free_slab() being called after
      kmem_cache is deleted (kfreed).
      
      rmmod nf_conntrack can crash the machine because it has to kmem_cache_destroy()
      a SLAB_DESTROY_BY_RCU enabled cache.
      
      Cc: <stable@kernel.org>
      Reported-by: default avatarZdenek Kabelac <zdenek.kabelac@gmail.com>
      Signed-off-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
      Acked-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      Signed-off-by: default avatarPekka Enberg <penberg@cs.helsinki.fi>
      d76b1590
    • David S. Miller's avatar
      sparc64: Kill spurious NMI watchdog triggers by increasing limit to 30 seconds. · e6617c6e
      David S. Miller authored
      This is a compromise and a temporary workaround for bootup NMI
      watchdog triggers some people see with qla2xxx devices present.
      
      This happens when, for example:
      
      CPU 0 is in the driver init and looping submitting mailbox commands to
      load the firmware, then waiting for completion.
      
      CPU 1 is receiving the device interrupts.  CPU 1 is where the NMI
      watchdog triggers.
      
      CPU 0 is submitting mailbox commands fast enough that by the time CPU
      1 returns from the device interrupt handler, a new one is pending.
      This sequence runs for more than 5 seconds.
      
      The problematic case is CPU 1's timer interrupt running when the
      barrage of device interrupts begin.  Then we have:
      
      	timer interrupt
      	return for softirq checking
      	pending, thus enable interrupts
      
      		 qla2xxx interrupt
      		 return
      		 qla2xxx interrupt
      		 return
      		 ... 5+ seconds pass
      		 final qla2xxx interrupt for fw load
      		 return
      
      	run timer softirq
      	return
      
      At some point in the multi-second qla2xxx interrupt storm we trigger
      the NMI watchdog on CPU 1 from the NMI interrupt handler.
      
      The timer softirq, once we get back to running it, is smart enough to
      run the timer work enough times to make up for the missed timer
      interrupts.
      
      However, the NMI watchdogs (both x86 and sparc) use the timer
      interrupt count to notice the cpu is wedged.  But in the above
      scenerio we'll receive only one such timer interrupt even if we last
      all the way back to running the timer softirq.
      
      The default watchdog trigger point is only 5 seconds, which is pretty
      low (the softwatchdog triggers at 60 seconds).  So increase it to 30
      seconds for now.
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e6617c6e
    • Paul Mackerras's avatar
      perf_counter/powerpc: Fix cache event codes for POWER7 · a3df6f7d
      Paul Mackerras authored
      I had the codes for L1 D-cache load accesses and misses swapped
      around, and the wrong codes for LL-cache accesses and misses.
      This corrects them.
      Reported-by: default avatarCorey Ashford <cjashfor@linux.vnet.ibm.com>
      Signed-off-by: default avatarPaul Mackerras <paulus@samba.org>
      Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
      Cc: <stable@kernel.org>
      LKML-Reference: <19103.8514.709300.585484@cargo.ozlabs.ibm.com>
      Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
      a3df6f7d
  4. 02 Sep, 2009 1 commit
    • Jiri Bohac's avatar
      [IA64] fix csum_ipv6_magic() · 5afe18d2
      Jiri Bohac authored
      The 32-bit parameters (len and csum) of csum_ipv6_magic() are passed in 64-bit
      registers in2 and in4. The high order 32 bits of the registers were never
      cleared, and garbage was sometimes calculated into the checksum.
      
      Fix this by clearing the high order 32 bits of these registers.
      Signed-off-by: default avatarJiri Bohac <jbohac@suse.cz>
      Signed-off-by: default avatarTony Luck <tony.luck@intel.com>
      5afe18d2