Skip to content

L
linux
Switch branch/tag
  1. 01 Feb, 2010 1 commit
    • Stefan Richter's avatar
      firewire: net: fix panic in fwnet_write_complete · 110f82d7
      Stefan Richter authored 
      In the transmit path of firewire-net (IPv4 over 1394), the following
race condition may occur:
  - The networking soft IRQ inserts a datagram into the 1394 async
    request transmit DMA.
  - The 1394 async transmit completion tasklet runs to finish cleaning
    up (unlink datagram from list of pending ones, release skb and
    outbound 1394 transaction object) --- before the networking soft IRQ
    had a chance to proceed and add the datagram to the list of pending
    datagrams.

This caused a panic in the 1394 async transmit completion tasklet when
it dereferenced unitialized list heads:
http://bugzilla.kernel.org/show_bug.cgi?id=15077

The fix is to add checks in the tx soft IRQ and in the tasklet to
determine which of these two is the last referrer to the transaction
object.  Then handle the cleanup of the object by the last referrer
rather than assuming that the tasklet is always the last one.

There is another similar race:  Between said tasklet and fwnet_close,
i.e. at ifdown.  However, that race is much less likely to occur in
practice and shall be fixed in a separate update.
Reported-by: default avatarИлья Басин <basinilya@gmail.com>
Signed-off-by: default avatarStefan Richter <stefanr@s5r6.in-berlin.de>
      110f82d7
  3. 29 Jan, 2010 13 commits
  5. 28 Jan, 2010 16 commits
  7. 27 Jan, 2010 10 commits
    • David VomLehn's avatar
      MIPS: PowerTV: Fix support for timer interrupts with > 64 external IRQs · 010c108d
      David VomLehn authored 
      The MIPS processor is limited to 64 external interrupt sources. Using a
greater number without IRQ sharing requires reading platform-specific
registers. On such platforms, reading the IntCtl register to determine
which interrupt corresponds to a timer interrupt will not work.

On MIPSR2 systems there is a solution - the TI bit in the Cause register,
specifically indicates that a timer interrupt has occured. This patch uses
that bit to detect interrupts for MIPSR2 processors, which may be expected
to work regardless of how the timer interrupt may be routed in the hardware.

Signed-off-by: David VomLehn (dvomlehn@cisco.com)
To: linux-mips@linux-mips.org
Patchwork: http://patchwork.linux-mips.org/patch/804/Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
      010c108d
    • David VomLehn's avatar
      MIPS: PowerTV: Streamline access to platform device registers · 59dfa2fc
      David VomLehn authored 
      Pre-compute addresses for the basic ASIC registers. This speeds up access
and allows memory for unused configurations to be freed. In addition,
uninitialized register addresses will be returned as NULL to catch bad
usage quickly.
Signed-off-by: default avatarDavid VomLehn <dvomlehn@cisco.com>
To: linux-mips@linux-mips.org
Patchwork: http://patchwork.linux-mips.org/patch/806/Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
      59dfa2fc
    • Alexander Clouter's avatar
      MIPS: Fix vmlinuz build for 32bit-only math shells · 9c4a6fce
      Alexander Clouter authored 
      POSIX requires $((<expression>)) arithmetic in sh only to have long
arithmetic so on 32-bit sh binaries might do only 32-bit arithmetic but
the arithmetic done in arch/mips/boot/compressed/Makefile needs 64-bit.

I play with the AR7 platform, so VMLINUX_LOAD_ADDRESS is
0xffffffff94100000, and for an example 4MiB kernel
VMLINUZ_LOAD_ADDRESS is made out to be:
----
alex@berk:~$ bash -c 'printf "%x\n" $((0xffffffff94100000 + 0x400000))'
ffffffff94500000
alex@berk:~$ dash -c 'printf "%x\n" $((0xffffffff94100000 + 0x400000))'
80000000003fffff
----

The former is obviously correct whilst the later breaks things royally.

Fortunately working with only the lower 32bit's works for both bash and
dash:
----
$ bash -c 'printf "%x\n" $((0x94100000 + 0x400000))'
94500000
$ dash -c 'printf "%x\n" $((0x94100000 + 0x400000))'
94500000
----

So, we can split the original 64bit string to two parts, and only
calculate the low 32bit part, which is big enough (1GiB kernel sizes
anyone?) for a normal Linux kernel image file, now, we calculate the
VMLINUZ_LOAD_ADDRESS like this:

1. if present, append top 32bit of VMLINUX_LOAD_ADDRESS" as a prefix
2. get the sum of the low 32bit of VMLINUX_LOAD_ADDRESS + VMLINUX_SIZE

This patch fixes vmlinuz kernel builds on systems where only a
32bit-only math shell is available.

Patch Changelog:
  Version 2
    - simplified method by using 'expr' for 'substr' and making it work
	with dash once again
  Version 1
    - Revert the removals of '-n "$(VMLINUX_SIZE)"' to avoid the error
        of "make clean"
    - Consider more cases of the VMLINUX_LOAD_ADDRESS
  Version 0
    - initial release
Signed-off-by: default avatarAlexander Clouter <alex@digriz.org.uk>
Acked-by: default avatarWu Zhangjin <wuzhangjin@gmail.com>
Patchwork: http://patchwork.linux-mips.org/patch/861/Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
      9c4a6fce
    • Wu Zhangjin's avatar
      MIPS: Add support of LZO-compressed kernels · fe1d45e0
      Wu Zhangjin authored 
      The necessary changes to the x86 Kconfig and boot/compressed to allow the
use of this new compression method.
Signed-off-by: default avatarWu Zhangjin <wuzhangjin@gmail.com>
Cc: linux-mips@linux-mips.org
Cc: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Patchwork: http://patchwork.linux-mips.org/patch/857/Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
      fe1d45e0
    • Russell King's avatar
      Merge branch 'for-rmk' of git://git.marvell.com/orion · 00e4acb1
      Russell King authored
      00e4acb1
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6 · be8cde8b
      Linus Torvalds authored 
      * git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6:
  [SCSI] aic79xx: check for non-NULL scb in ahd_handle_nonpkt_busfree
  [SCSI] zfcp: Set hardware timeout as requested by BSG request.
  [SCSI] zfcp: Introduce bsg_timeout callback.
  [SCSI] scsi_transport_fc: Allow LLD to reset FC BSG timeout
  [SCSI] zfcp: add missing compat ptr conversion
  [SCSI] zfcp: Fix linebreak in hba trace
  [SCSI] zfcp: Issue zfcp_fc_wka_port_put after FC CT BSG request
  [SCSI] qla2xxx: Update version number to 8.03.01-k10.
  [SCSI] fc-transport: Use packed modifier for fc_bsg_request structure.
  [SCSI] qla2xxx: Perform fast mailbox read of flash regardless of size nor address alignment.
  [SCSI] qla2xxx: Correct FCP2 recovery handling.
  [SCSI] scsi_lib: Fix bug in completion of bidi commands
  [SCSI] mptsas: Fix issue with chain pools allocation on katmai
  [SCSI] aacraid: fix File System going into read-only mode
  [SCSI] lpfc: fix file permissions
      be8cde8b
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6 · 981a2edd
      Linus Torvalds authored 
      * 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6:
  [S390] fix single stepped svcs with TRACE_IRQFLAGS=y
  [S390] zcrypt: Do not remove coprocessor for error 8/72
  [S390] sclp_vt220: set initial terminal window size
  [S390] use set_current_state in sigsuspend
  [S390] irqflags: add missing types.h include
  [S390] dasd: fix possible NULL pointer errors
      981a2edd
    • Chris Wilson's avatar
      drm/i915: Selectively enable self-reclaim · 4bdadb97
      Chris Wilson authored 
      Having missed the ENOMEM return via i915_gem_fault(), there are probably
other paths that I also missed. By not enabling NORETRY by default these
paths can run the shrinker and take memory from the system (but not from
our own inactive lists because our shrinker can not run whilst we hold
the struct mutex) and this may allow the system to survive a little longer
whilst our drivers consume all available memory.

References:
  OOM killer unexpectedly called with kernel 2.6.32
  http://bugzilla.kernel.org/show_bug.cgi?id=14933

v2: Pass gfp into page mapping.
v3: Use new read_cache_page_gfp() instead of open-coding.
Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Hugh Dickins <hugh.dickins@tiscali.co.uk>
Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
Cc: Eric Anholt <eric@anholt.net>
Cc: stable@kernel.org
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      4bdadb97
    • Stefan Richter's avatar
      firewire: ohci: fix crashes with TSB43AB23 on 64bit systems · 7a481436
      Stefan Richter authored 
      Unsurprisingly, Texas Instruments TSB43AB23 exhibits the same behaviour
as TSB43AB22/A in dual buffer IR DMA mode:  If descriptors are located
at physical addresses above the 31 bit address range (2 GB), the
controller will overwrite random memory.  With luck, this merely
prevents video reception.  With only a little less luck, the machine
crashes.

We use the same workaround here as with TSB43AB22/A:  Switch off the
dual buffer capability flag and use packet-per-buffer IR DMA instead.
Another possible workaround would be to limit the coherent DMA mask to
31 bits.

In Linux 2.6.33, this change serves effectively only as documentation
since dual buffer mode is not used for any controller anymore.  But
somebody might want to re-enable it in the future to make use of
features of dual buffer DMA that are not available in packet-per-buffer
mode.

In Linux 2.6.32 and older, this update is vital for anyone with this
controller, more than 2 GB RAM, a 64 bit kernel, and FireWire video or
audio applications.

We have at least four reports:
http://bugzilla.kernel.org/show_bug.cgi?id=13808
http://marc.info/?l=linux1394-user&m=126154279004083
https://bugzilla.redhat.com/show_bug.cgi?id=552142
http://marc.info/?l=linux1394-user&m=126432246128386

Reported-by: Paul Johnson
Reported-by: Ronneil Camara
Reported-by: G Zornetzer
Reported-by: Mark Thompson
Cc: stable@kernel.org
Signed-off-by: default avatarStefan Richter <stefanr@s5r6.in-berlin.de>
      7a481436
    • Linus Torvalds's avatar
      mm: add new 'read_cache_page_gfp()' helper function · 0531b2aa
      Linus Torvalds authored 
      It's a simplified 'read_cache_page()' which takes a page allocation
flag, so that different paths can control how aggressive the memory
allocations are that populate a address space.

In particular, the intel GPU object mapping code wants to be able to do
a certain amount of own internal memory management by automatically
shrinking the address space when memory starts getting tight.  This
allows it to dynamically use different memory allocation policies on a
per-allocation basis, rather than depend on the (static) address space
gfp policy.

The actual new function is a one-liner, but re-organizing the helper
functions to the point where you can do this with a single line of code
is what most of the patch is all about.
Tested-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      0531b2aa
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7