1. 25 9月, 2012 1 次提交
  2. 22 9月, 2012 4 次提交
  3. 17 9月, 2012 1 次提交
    • R
      MIPS: Malta: Don't crash on spurious interrupt. · e376fdf4
      Ralf Baechle 提交于
      48d480b0 [[MIPS] Malta: Fix off by one bug in interrupt
      handler.] did not take in account that irq_ffs() will also return 0 if for some reason
      the set of pending interrupts happens to be empty.
      
      This is trivial to trigger with a RM5261 CPU module running a 64-bit kernel and results
      in something like the following:
      
      CPU 0 Unable to handle kernel paging request at virtual address 0000000000000000, epc == ffffffff801772d0, ra == ffffffff8017ad24
      Oops[#1]:
      Cpu 0
      $ 0   : 0000000000000000 ffffffff9000a4e0 ffffffff9000a4e0 ffffffff9000a4e0
      $ 4   : ffffffff80592be0 0000000000000000 00000000000000d6 ffffffff80322ed0
      $ 8   : ffffffff805fe538 0000000000000000 ffffffff9000a4e0 ffffffff80590000
      $12   : 00000000000000d6 0000000000000000 ffffffff80600000 ffffffff805fe538
      $16   : 0000000000000000 0000000000000010 ffffffff80592be0 0000000000000010
      $20   : 0000000000000000 0000000000500001 0000000000000000 ffffffff8051e078
      $24   : 0000000000000028 ffffffff803226e8
      $28   : 9800000003828000 980000000382b900 ffffffff8051e060 ffffffff8017ad24
      Hi    : 0000000000000000
      Lo    : 0000006388974000
      epc   : ffffffff801772d0 handle_irq_event_percpu+0x70/0x2f0
          Not tainted
      ra    : ffffffff8017ad24 handle_percpu_irq+0x54/0x88
      Status: 9000a4e2    KX SX UX KERNEL EXL
      Cause : 00808008
      BadVA : 0000000000000000
      PrId  : 000028a0 (Nevada)
      Modules linked in:
      Process init (pid: 1, threadinfo=9800000003828000, task=9800000003827968, tls=0000000077087490)
      Stack : ffffffff80592be0 ffffffff8058d248 0000000000000040 0000000000000000
              ffffffff80613340 0000000000500001 ffffffff805a0000 0000000000000882
              9800000003b89000 ffffffff8017ad24 00000000000000d5 0000000000000010
              ffffffff9000a4e1 ffffffff801769f4 ffffffff9000a4e0 ffffffff801037f8
              0000000000000000 ffffffff80101c44 0000000000000000 ffffffff9000a4e0
              0000000000000000 9000000018000000 90000000180003f9 0000000000000001
              0000000000000000 00000000000000ff 0000000000000018 0000000000000001
              0000000000000001 00000000003fffff 0000000000000020 ffffffff802cf7ac
              ffffffff80208918 000000007fdadf08 ffffffff80612d88 ffffffff9000a4e1
              0000000000000040 0000000000000000 ffffffff80613340 0000000000500001
              ...
      Call Trace:
      [<ffffffff801772d0>] handle_irq_event_percpu+0x70/0x2f0
      [<ffffffff8017ad24>] handle_percpu_irq+0x54/0x88
      [<ffffffff801769f4>] generic_handle_irq+0x44/0x60
      [<ffffffff801037f8>] do_IRQ+0x48/0x70
      [<ffffffff80101c44>] ret_from_irq+0x0/0x4
      [<ffffffff80326170>] serial8250_startup+0x310/0x870
      [<ffffffff8032175c>] uart_startup.part.7+0x9c/0x330
      [<ffffffff80321b4c>] uart_open+0x15c/0x1b0
      [<ffffffff80302034>] tty_open+0x1fc/0x720
      [<ffffffff801bffac>] chrdev_open+0x7c/0x180
      [<ffffffff801b9ab8>] do_dentry_open.isra.14+0x288/0x390
      [<ffffffff801bac5c>] nameidata_to_filp+0x5c/0xc0
      [<ffffffff801ca700>] do_last.isra.33+0x330/0x8f0
      [<ffffffff801caf3c>] path_openat+0xbc/0x440
      [<ffffffff801cb3c8>] do_filp_open+0x38/0xa8
      [<ffffffff801bade4>] do_sys_open+0x124/0x218
      [<ffffffff80110538>] handle_sys+0x118/0x13c
      
      Code: 02d5a825  12800012  02a0b02d <de820000> de850008  0040f809  0220202d  0040a82d  40026000
      ---[ end trace 5d8e7b9a86badd2d ]---
      Kernel panic - not syncing: Fatal exception in interrupt
      Signed-off-by: NRalf Baechle <ralf@linux-mips.org>
      e376fdf4
  4. 14 9月, 2012 1 次提交
    • M
      MIPS: Malta: Remove RTC Data Mode bootstrap breakage · 636221b8
      Maciej W. Rozycki 提交于
       YAMON requires and enforces the RTC Data Mode (Register B, DM bit) to
      binary, that is the bit is set every time the board goes through the
      firmware bootstrap sequence.  Likewise its calendar manipulation commands
      interpret or set the RTC registers unconditionally as binary, never
      actually checking what the value of the DM bit is, under the (correct)
      assumption that it has been previously set, to indicate the binary mode.
      
       A change to Linux a while ago however introduced a platform-specific
      tweak that clears that bit and therefore forces the data mode to BCD.
      This causes clock corruption and misinterpretation that has to be fixed up
      by user-mode tools in system startup scripts as the initial clock is often
      incorrect according to the BCD interpretation forced.
      
       This change removes the hack; a comment included refers to alarm code,
      but even if it was broken at one point by requiring the BCD mode, it
      should have been trivially corrected and even if not, given how rarely the
      alarm feature is used, that was not really a reasonable justification to
      break the system clock that is indeed used by virtually everything.  And
      either way the alarm code has been since fixed anyway.
      Signed-off-by: NMaciej W. Rozycki <macro@codesourcery.com>
      Cc: linux-mips@linux-mips.org
      Patchwork: https://patchwork.linux-mips.org/patch/4336/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>
      636221b8
  5. 27 8月, 2012 2 次提交
  6. 22 8月, 2012 1 次提交
    • M
      mm: hugetlbfs: correctly populate shared pmd · eb48c071
      Michal Hocko 提交于
      Each page mapped in a process's address space must be correctly
      accounted for in _mapcount.  Normally the rules for this are
      straightforward but hugetlbfs page table sharing is different.  The page
      table pages at the PMD level are reference counted while the mapcount
      remains the same.
      
      If this accounting is wrong, it causes bugs like this one reported by
      Larry Woodman:
      
        kernel BUG at mm/filemap.c:135!
        invalid opcode: 0000 [#1] SMP
        CPU 22
        Modules linked in: bridge stp llc sunrpc binfmt_misc dcdbas microcode pcspkr acpi_pad acpi]
        Pid: 18001, comm: mpitest Tainted: G        W    3.3.0+ #4 Dell Inc. PowerEdge R620/07NDJ2
        RIP: 0010:[<ffffffff8112cfed>]  [<ffffffff8112cfed>] __delete_from_page_cache+0x15d/0x170
        Process mpitest (pid: 18001, threadinfo ffff880428972000, task ffff880428b5cc20)
        Call Trace:
          delete_from_page_cache+0x40/0x80
          truncate_hugepages+0x115/0x1f0
          hugetlbfs_evict_inode+0x18/0x30
          evict+0x9f/0x1b0
          iput_final+0xe3/0x1e0
          iput+0x3e/0x50
          d_kill+0xf8/0x110
          dput+0xe2/0x1b0
          __fput+0x162/0x240
      
      During fork(), copy_hugetlb_page_range() detects if huge_pte_alloc()
      shared page tables with the check dst_pte == src_pte.  The logic is if
      the PMD page is the same, they must be shared.  This assumes that the
      sharing is between the parent and child.  However, if the sharing is
      with a different process entirely then this check fails as in this
      diagram:
      
        parent
          |
          ------------>pmd
                       src_pte----------> data page
                                              ^
        other--------->pmd--------------------|
                        ^
        child-----------|
                       dst_pte
      
      For this situation to occur, it must be possible for Parent and Other to
      have faulted and failed to share page tables with each other.  This is
      possible due to the following style of race.
      
        PROC A                                          PROC B
        copy_hugetlb_page_range                         copy_hugetlb_page_range
          src_pte == huge_pte_offset                      src_pte == huge_pte_offset
          !src_pte so no sharing                          !src_pte so no sharing
      
        (time passes)
      
        hugetlb_fault                                   hugetlb_fault
          huge_pte_alloc                                  huge_pte_alloc
            huge_pmd_share                                 huge_pmd_share
              LOCK(i_mmap_mutex)
              find nothing, no sharing
              UNLOCK(i_mmap_mutex)
                                                            LOCK(i_mmap_mutex)
                                                            find nothing, no sharing
                                                            UNLOCK(i_mmap_mutex)
            pmd_alloc                                       pmd_alloc
            LOCK(instantiation_mutex)
            fault
            UNLOCK(instantiation_mutex)
                                                        LOCK(instantiation_mutex)
                                                        fault
                                                        UNLOCK(instantiation_mutex)
      
      These two processes are not poing to the same data page but are not
      sharing page tables because the opportunity was missed.  When either
      process later forks, the src_pte == dst pte is potentially insufficient.
      As the check falls through, the wrong PTE information is copied in
      (harmless but wrong) and the mapcount is bumped for a page mapped by a
      shared page table leading to the BUG_ON.
      
      This patch addresses the issue by moving pmd_alloc into huge_pmd_share
      which guarantees that the shared pud is populated in the same critical
      section as pmd.  This also means that huge_pte_offset test in
      huge_pmd_share is serialized correctly now which in turn means that the
      success of the sharing will be higher as the racing tasks see the pud
      and pmd populated together.
      
      Race identified and changelog written mostly by Mel Gorman.
      
      {akpm@linux-foundation.org: attempt to make the huge_pmd_share() comment comprehensible, clean up coding style]
      Reported-by: NLarry Woodman <lwoodman@redhat.com>
      Tested-by: NLarry Woodman <lwoodman@redhat.com>
      Reviewed-by: NMel Gorman <mgorman@suse.de>
      Signed-off-by: NMichal Hocko <mhocko@suse.cz>
      Reviewed-by: NRik van Riel <riel@redhat.com>
      Cc: David Gibson <david@gibson.dropbear.id.au>
      Cc: Ken Chen <kenchen@google.com>
      Cc: Cong Wang <xiyou.wangcong@gmail.com>
      Cc: Hillf Danton <dhillf@gmail.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      eb48c071
  7. 21 8月, 2012 1 次提交
  8. 19 8月, 2012 10 次提交
  9. 17 8月, 2012 2 次提交
  10. 16 8月, 2012 2 次提交
    • M
      C6X: select GENERIC_ATOMIC64 · 01ddd9a8
      Mark Salter 提交于
      The generic atomic64 support came in 2009 to support the perf subsystem
      with the expectation that all architectures would implement atomic64
      support. Since then, other optional parts of the generic kernel have
      also come to expect atomic64 support. This patch enables generic atomic64
      support for C6X architecture.
      Signed-off-by: NMark Salter <msalter@redhat.com>
      01ddd9a8
    • M
      C6X: add Lx_CACHE_SHIFT defines · 6330c790
      Mark Salter 提交于
      C6X currently lacks Lx_CACHE_SHIFT defines which are needed in a
      few places in the generic kernel. This patch adds _SHIFT defines
      for the various caches and bases the Lx_CACHE_BYTES defines on
      them.
      Signed-off-by: NMark Salter <msalter@redhat.com>
      6330c790
  11. 15 8月, 2012 4 次提交
  12. 14 8月, 2012 4 次提交
  13. 13 8月, 2012 1 次提交
  14. 11 8月, 2012 6 次提交