1. 14 5月, 2011 10 次提交
  2. 13 5月, 2011 21 次提交
  3. 12 5月, 2011 9 次提交
    • L
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse · 6eaed0a4
      Linus Torvalds 提交于
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse:
        fuse: fix oops in revalidate when called with NULL nameidata
      6eaed0a4
    • L
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6 · 8043f4eb
      Linus Torvalds 提交于
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6:
        sparc32: Fixed unaligned memory copying in function __csum_partial_copy_sparc_generic
        sparc32: fix sparcstation 5 boot
        sparc32: fix section mismatch warnings in apc, pmc and time_32
      8043f4eb
    • L
      Merge branch 'fixes' of master.kernel.org:/home/rmk/linux-2.6-arm · 75c0b3b4
      Linus Torvalds 提交于
      * 'fixes' of master.kernel.org:/home/rmk/linux-2.6-arm:
        ARM: 6870/1: The mandatory barrier rmb() must be a dsb() in for device accesses
        ARM: 6892/1: handle ptrace requests to change PC during interrupted system calls
        ARM: 6890/1: memmap: only free allocated memmap entries when using SPARSEMEM
        ARM: zImage: the page table memory must be considered before relocation
        ARM: zImage: make sure not to relocate on top of the relocation code
        ARM: zImage: Fix bad SP address after relocating kernel
        ARM: zImage: make sure the stack is 64-bit aligned
        ARM: RiscPC: acornfb: fix section mismatches
        ARM: RiscPC: etherh: fix section mismatches
      75c0b3b4
    • L
      fbmem: make read/write/ioctl use the frame buffer at open time · c47747fd
      Linus Torvalds 提交于
      read/write/ioctl on a fbcon file descriptor has traditionally used the
      fbcon not when it was opened, but as it was at the time of the call.
      That makes no sense, but the lack of sense is much more obvious now that
      we properly ref-count the usage - it means that the ref-counting doesn't
      actually protect operations we do on the frame buffer.
      
      This changes it to look at the fb_info that we got at open time, but in
      order to avoid using a frame buffer long after it has been unregistered,
      we do verify that it is still current, and return -ENODEV if not.
      Acked-by: NTim Gardner <tim.gardner@canonical.com>
      Tested-by: NDaniel J Blueman <daniel.blueman@gmail.com>
      Tested-by: NAnca Emanuel <anca.emanuel@gmail.com>
      Cc: Bruno Prémont <bonbons@linux-vserver.org>
      Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
      Cc: Paul Mundt <lethal@linux-sh.org>
      Cc: Dave Airlie <airlied@redhat.com>
      Cc: Andy Whitcroft <andy.whitcroft@canonical.com>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      c47747fd
    • L
      fbcon: add lifetime refcount to opened frame buffers · 698b3682
      Linus Torvalds 提交于
      This just adds the refcount and the new registration lock logic.  It
      does not (for example) actually change the read/write/ioctl routines to
      actually use the frame buffer that was opened: those function still end
      up alway susing whatever the current frame buffer is at the time of the
      call.
      
      Without this, if something holds the frame buffer open over a
      framebuffer switch, the close() operation after the switch will access a
      fb_info that has been free'd by the unregistering of the old frame
      buffer.
      
      (The read/write/ioctl operations will normally not cause problems,
      because they will - illogically - pick up the new fbcon instead.  But a
      switch that happens just as one of those is going on might see problems
      too, the window is just much smaller: one individual op rather than the
      whole open-close sequence.)
      
      This use-after-free is apparently fairly easily triggered by the Ubuntu
      11.04 boot sequence.
      Acked-by: NTim Gardner <tim.gardner@canonical.com>
      Tested-by: NDaniel J Blueman <daniel.blueman@gmail.com>
      Tested-by: NAnca Emanuel <anca.emanuel@gmail.com>
      Cc: Bruno Prémont <bonbons@linux-vserver.org>
      Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
      Cc: Paul Mundt <lethal@linux-sh.org>
      Cc: Dave Airlie <airlied@redhat.com>
      Cc: Andy Whitcroft <andy.whitcroft@canonical.com>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      698b3682
    • B
      sfc: Always map MCDI shared memory as uncacheable · 747df225
      Ben Hutchings 提交于
      We enabled write-combining for memory-mapped registers in commit
      65f0b417, but inhibited it for the
      MCDI shared memory where this is not supported.  However,
      write-combining mappings also allow read-reordering, which may also
      be a problem.
      
      I found that when an SFC9000-family controller is connected to an
      Intel 3000 chipset, and write-combining is enabled, the controller
      stops responding to PCIe read requests during driver initialisation
      while the driver is polling for completion of an MCDI command.  This
      results in an NMI and system hang.  Adding read memory barriers
      between all reads to the shared memory area appears to reduce but not
      eliminate the probability of this.
      
      We have not yet established whether this is a bug in our BIU or in the
      PCIe bridge.  For now, work around by mapping the shared memory area
      separately.
      Signed-off-by: NBen Hutchings <bhutchings@solarflare.com>
      747df225
    • C
      ARM: 6870/1: The mandatory barrier rmb() must be a dsb() in for device accesses · a904f5f9
      Catalin Marinas 提交于
      Since mandatory barriers may be used (explicitly or implicitly via readl
      etc.) to ensure the ordering between Device and Normal memory accesses,
      a DMB is not enough. This patch converts it to a DSB.
      
      Cc: Colin Cross <ccross@android.com>
      Signed-off-by: NCatalin Marinas <catalin.marinas@arm.com>
      Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>
      a904f5f9
    • A
      ARM: 6892/1: handle ptrace requests to change PC during interrupted system calls · 2af68df0
      Arnd Bergmann 提交于
      GDB's interrupt.exp test cases currenly fail on ARM.  The problem is how do_signal
      handled restarting interrupted system calls:
      
      The entry.S assembler code determines that we come from a system call; and that
      information is passed as "syscall" parameter to do_signal.  That routine then
      calls get_signal_to_deliver [*] and if a signal is to be delivered, calls into
      handle_signal.  If a system call is to be restarted either after the signal
      handler returns, or if no handler is to be called in the first place, the PC
      is updated after the get_signal_to_deliver call, either in handle_signal (if
      we have a handler) or at the end of do_signal (otherwise).
      
      Now the problem is that during [*], the call to get_signal_to_deliver, a ptrace
      intercept may happen.  During this intercept, the debugger may change registers,
      including the PC.  This is done by GDB if it wants to execute an "inferior call",
      i.e. the execution of some code in the debugged program triggered by GDB.
      
      To this purpose, GDB will save all registers, allocate a stack frame, set up
      PC and arguments as appropriate for the call, and point the link register to
      a dummy breakpoint instruction.  Once the process is restarted, it will execute
      the call and then trap back to the debugger, at which point GDB will restore
      all registers and continue original execution.
      
      This generally works fine.  However, now consider what happens when GDB attempts
      to do exactly that while the process was interrupted during execution of a to-be-
      restarted system call:  do_signal is called with the syscall flag set; it calls
      get_signal_to_deliver, at which point the debugger takes over and changes the PC
      to point to a completely different place.  Now get_signal_to_deliver returns
      without a signal to deliver; but now do_signal decides it should be restarting
      a system call, and decrements the PC by 2 or 4 -- so it now points to 2 or 4
      bytes before the function GDB wants to call -- which leads to a subsequent crash.
      
      To fix this problem, two things need to be supported:
      - do_signal must be able to recognize that get_signal_to_deliver changed the PC
        to a different location, and skip the restart-syscall sequence
      - once the debugger has restored all registers at the end of the inferior call
        sequence, do_signal must recognize that *now* it needs to restart the pending
        system call, even though it was now entered from a breakpoint instead of an
        actual svc instruction
      
      This set of issues is solved on other platforms, usually by one of two
      mechanisms:
      
      - The status information "do_signal is handling a system call that may need
        restarting" is itself carried in some register that can be accessed via
        ptrace.  This is e.g. on Intel the "orig_eax" register; on Sparc the kernel
        defines a magic extra bit in the flags register for this purpose.
        This allows GDB to manage that state: reset it when doing an inferior call,
        and restore it after the call is finished.
      
      - On s390, do_signal transparently handles this problem without requiring
        GDB interaction, by performing system call restarting in the following
        way: first, adjust the PC as necessary for restarting the call.  Then,
        call get_signal_to_deliver; and finally just continue execution at the
        PC.  This way, if GDB does not change the PC, everything is as before.
        If GDB *does* change the PC, execution will simply continue there --
        and once GDB restores the PC it saved at that point, it will automatically
        point to the *restarted* system call.  (There is the minor twist how to
        handle system calls that do *not* need restarting -- do_signal will undo
        the PC change in this case, after get_signal_to_deliver has returned, and
        only if ptrace did not change the PC during that call.)
      
      Because there does not appear to be any obvious register to carry the
      syscall-restart information on ARM, we'd either have to introduce a new
      artificial ptrace register just for that purpose, or else handle the issue
      transparently like on s390.  The patch below implements the second option;
      using this patch makes the interrupt.exp test cases pass on ARM, with no
      regression in the GDB test suite otherwise.
      
      Cc: patches@linaro.org
      Signed-off-by: NUlrich Weigand <ulrich.weigand@linaro.org>
      Signed-off-by: NArnd Bergmann <arnd.bergmann@linaro.org>
      Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>
      2af68df0
    • W
      ARM: 6890/1: memmap: only free allocated memmap entries when using SPARSEMEM · 9af386c8
      Will Deacon 提交于
      The SPARSEMEM code allocates memmap entries only for sections which are
      present (i.e. those which contain some valid memory). The membank checks
      in free_unused_memmap do not take this into account and can incorrectly
      attempt to free memory which is not allocated, resulting in a BUG() in
      the bootmem code.
      
      However, if memory is configured as follows:
      
          |<----section---->|<----hole---->|<----section---->|
          +--------+--------+--------------+--------+--------+
          | bank 0 | unused |              | bank 1 | unused |
          +--------+--------+--------------+--------+--------+
      
      where a bank only occupies part of a section, the memmap allocated for
      the remainder of the section *can* be freed.
      
      This patch modifies the checks in free_unused_memmap so that only valid
      memmap entries are considered for removal.
      Acked-by: NCatalin Marinas <catalin.marinas@arm.com>
      Signed-off-by: NWill Deacon <will.deacon@arm.com>
      Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>
      9af386c8