Jaroslav Kysela [Sun, 9 Feb 2003 20:47:59 +0000 (21:47 +0100)]
ALSA update
- moved inclusion of <linux/interrupt.h> from <sound/asound.h> to <sound/timer.h>
- pmac driver - removed beep stuff for 2.5 kernels
- USB driver - fixed compilation
James Bottomley [Sun, 9 Feb 2003 04:07:51 +0000 (22:07 -0600)]
[SCSI] Migrate sim710 to 53c700 chip driver
This should add synchronous support and Tagged Command Queueing.
At the moment, it cuts down on the number of command line options,
but we can add those back in later.
This patch also migrates the driver to the new device model for
both MCA and EISA.
James Bottomley [Sun, 9 Feb 2003 03:36:18 +0000 (21:36 -0600)]
Restore device command queue functionality
The recent slab allocation changes mean that we no longer keep a
permanent list of commands on the device_queue list. However,
certain pieces of SCSI code relied on being able to traverse this
list to find details of all outstanding commands (the error handler
being the prime example). This code adds back a new dynamic cmd_list
which keeps the list of commands currently allocated to the device.
Since the list is dynamic, it is protected by a lock (list_lock).
Jamie Lokier [Sat, 8 Feb 2003 18:41:34 +0000 (10:41 -0800)]
[PATCH] CONFIG_PREEMPT fix of do_debug()
If CONFIG_PREEMPT is enabled, and the kernel is preempted just before
do_debug() has a chance to save the debug register values, DR6 could be
read from the wrong CPU.
It is exactly the same problem as reading %cr2 in the page fault
handler. Same fix: make the handler a interrupt gate, and enable
interrupts only once safe.
Linus Torvalds [Sat, 8 Feb 2003 14:02:27 +0000 (06:02 -0800)]
More signal handling fixups for the threaded signal fix upheavals.
This fixes the signal code to not wake up threads with blocked signals,
especially noticeable with kernel threads that may not be able to handle
signals at all.
We also don't unnecessarily wake processes in TASK_UNINTERRUPTIBLE.
Roland McGrath [Fri, 7 Feb 2003 08:31:37 +0000 (00:31 -0800)]
[PATCH] TASK_STOPPED wakeup cleanup
For handle_stop_signal to do the special case for SIGKILL and have it
work right in all SMP cases (without changing all the existing ptrace
stops), it needs to at least set TIF_SIGPENDING on each thread before
resuming it.
handle_stop_signal addresses a related race for SIGCONT by setting
TIF_SIGPENDING already, so having SIGKILL handled the same way makes
sense.
Now it seems pretty clean to have handle_stop_signal resume threads for
SIGKILL, and have on SIGKILL special case in group_send_sig_info.
There is also an SMP race issue with cases like do_syscall_trace, i.e.
TASK_STOPPED state set without holding the siglock. So I think
handle_stop_signal should call wake_up_process unconditionally.
Linus Torvalds [Fri, 7 Feb 2003 04:25:24 +0000 (20:25 -0800)]
Split up "struct signal_struct" into "signal" and "sighand" parts.
This is required to get make the old LinuxThread semantics work
together with the fixed-for-POSIX full signal sharing. A traditional
CLONE_SIGHAND thread (LinuxThread) will not see any other shared
signal state, while a new-style CLONE_THREAD thread will share all
of it.
This way the two methods don't confuse each other.
Roland McGrath [Fri, 7 Feb 2003 00:22:30 +0000 (16:22 -0800)]
[PATCH] do_sigaction locking cleanup
This changes do_sigaction to avoid read_lock(&tasklist_lock) on every
call. Only in the fairly uncommon cases where it's really needed will
it take that lock (which requires unlocking and relocking the siglock
for locking order).
I also changed the ERESTARTSYS added in my earlier patch to ERESTARTNOINTR.
That is an "instantaneous" case, and there is no reason to have it possibly
return EINTR if !SA_RESTART (which AFAIK sigaction never could before, and
it might not be kosher by POSIX); rollback is always better.
Andrew Morton [Thu, 6 Feb 2003 08:22:04 +0000 (00:22 -0800)]
[PATCH] revert extra sendfile security hook patch
hm. It seems that I sent this patch twice.
After resyncing with your tree I go through and try to reapply all the sent
patches, throwing out the ones which get a lot of rejects. Just to make sure
that everything got through OK.
But it appears that that particular patch happily applied on top of itself,
so I assumed it was not applied...
Roland McGrath [Thu, 6 Feb 2003 07:39:31 +0000 (23:39 -0800)]
[PATCH] Make sys_wait4() more readable
I cleaned up sys_wait4; it was straightforward and I think a definite
improvement. While at it, I noticed that one of the races I fixed in the
TASK_STOPPED case actually can happen earlier. Between read_unlock and
write_lock_irq, another thread could reap the process and make P invalid,
so now I do get_task_struct before read_unlock and then the existing race
checks catch all scenarios.
Aside from the aforementioned race tweak, the code should be the same as
in the previous patch (that Ingo and I have tested more thoroughly)
modulo being moved into functions and some reformatting and comment
changes.
Oh, my old patch had one case where it failed to retake the read lock after
a race bailout that I just noticed reading over it. That's fixed too.
These exit fixes were something I noticed incidentally and spent less time
on than the signals changes. Another few passes of eyeballs over them are
certainly warranted. (In particular, there are code paths like that one
that check for specific races that have probably never been seen in
practice, so those code paths have never run once.)
Matthew Dobson [Thu, 6 Feb 2003 06:55:32 +0000 (22:55 -0800)]
[PATCH] Broken CLEAR_BITMAP() macro
The CLEAR_BITMAP() macro in include/linux/types.h is broken and doesn't
round the bitmap size to the proper 'long' boundary.
This fixes it by creating a macro BITS_TO_LONGS that just rounds a
number of bits up to the closest number of unsigned longs. This makes
the DECLARE & CLEAR _BITMAP macros more readable and fixes the bug.
Ingo Molnar [Thu, 6 Feb 2003 04:49:30 +0000 (20:49 -0800)]
[PATCH] signal-fixes-2.5.59-A4
this is the current threading patchset, which accumulated up during the
past two weeks. It consists of a biggest set of changes from Roland, to
make threaded signals work. There were still tons of testcases and
boundary conditions (mostly in the signal/exit/ptrace area) that we did
not handle correctly.
- fix signal delivery race with do_exit() => signals are re-queued to the
'process' if do_exit() finds pending unhandled ones. This prevents
signals getting lost upon thread-sys_exit().
- a non-main thread has died on one processor and gone to TASK_ZOMBIE,
but before it's gotten to release_task a sys_wait4 on the other
processor reaps it. It's only because it's ptraced that this gets
through eligible_child. Somewhere in there the main thread is also
dying so it reparents the child thread to hit that case. This means
that there is a race where P might be totally invalid.
- forget_original_parent is not doing the right thing when the group
leader dies, i.e. reparenting threads to init when there is a zombie
group leader. Perhaps it doesn't matter for any practical purpose
without ptrace, though it makes for ppid=1 for each thread in core
dumps, which looks funny. Incidentally, SIGCHLD here really should be
p->exit_signal.
- one of the gdb tests makes a questionable assumption about what kill
will do when it has some threads stopped by ptrace and others running.
exit races:
1. Processor A is in sys_wait4 case TASK_STOPPED considering task P.
Processor B is about to resume P and then switch to it.
While A is inside that case block, B starts running P and it clears
P->exit_code, or takes a pending fatal signal and sets it to a new
value. Depending on the interleaving, the possible failure modes are:
a. A gets to its put_user after B has cleared P->exit_code
=> returns with WIFSTOPPED, WSTOPSIG==0
b. A gets to its put_user after B has set P->exit_code anew
=> returns with e.g. WIFSTOPPED, WSTOPSIG==SIGKILL
A can spend an arbitrarily long time in that case block, because
there's getrusage and put_user that can take page faults, and
write_lock'ing of the tasklist_lock that can block. But even if it's
short the race is there in principle.
2. This is new with NPTL, i.e. CLONE_THREAD.
Two processors A and B are both in sys_wait4 case TASK_STOPPED
considering task P.
Both get through their tests and fetches of P->exit_code before either
gets to P->exit_code = 0. => two threads return the same pid from
waitpid.
In other interleavings where one processor gets to its put_user after
the other has cleared P->exit_code, it's like case 1(a).
3. SMP races with stop/cont signals
First, take:
kill(pid, SIGSTOP);
kill(pid, SIGCONT);
or:
kill(pid, SIGSTOP);
kill(pid, SIGKILL);
It's possible for this to leave the process stopped with a pending
SIGCONT/SIGKILL. That's a state that should never be possible.
Moreover, kill(pid, SIGKILL) without any repetition should always be
enough to kill a process. (Likewise SIGCONT when you know it's
sequenced after the last stop signal, must be sufficient to resume a
process.)
4. take:
kill(pid, SIGKILL); // or any fatal signal
kill(pid, SIGCONT); // or SIGKILL
it's possible for this to cause pid to be reaped with status 0
instead of its true termination status. The equivalent scenario
happens when the process being killed is in an _exit call or a
trap-induced fatal signal before the kills.
plus i've done stability fixes for bugs that popped up during
beta-testing, and minor tidying of Roland's changes:
- a rare tasklist corruption during exec, causing some very spurious and
colorful crashes.
- a copy_process()-related dereference of already freed thread structure
if hit with a SIGKILL in the wrong moment.
- SMP spinlock deadlocks in the signal code
this patchset has been tested quite well in the 2.4 backport of the
threading changes - and i've done some stresstesting on 2.5.59 SMP as
well, and did an x86 UP testcompile + testboot as well.
David Jeffery [Thu, 6 Feb 2003 02:23:48 +0000 (18:23 -0800)]
[PATCH] ips driver 4/4: error messages
This small patch does 2 things. It reworks the firmware/driver
versioning messages to make them more understandable, and it
fixes one case where the 64bit addressing changes caused
error/success to not be properly reported to the serveraid tools.
David Jeffery [Thu, 6 Feb 2003 02:23:35 +0000 (18:23 -0800)]
[PATCH] ips driver 2/4: initialization reordering
This large patch reworks much of the adapter initialization
code.
It splits the scsi initialization code from the pci
initialization. It adds support for working with some
future cards. It also removes the use of multiple pci_driver
registrations and instead does its own adapter ordering.
David Jeffery [Thu, 6 Feb 2003 02:23:29 +0000 (18:23 -0800)]
[PATCH] ips driver 1/4: fix struct length and remove dead code
This small patch fixes the length of the IPS_ENQ
struct. It was too short which can cause the adapter
to write beyond the the end of the struct during
driver initialization and corrupt part of memory.
Rusty Russell [Thu, 6 Feb 2003 03:25:30 +0000 (21:25 -0600)]
[PATCH] [patch, 2.5] scsi_qla1280.c free on error path
From: Marcus Alanen <maalanen@ra.abo.fi>
Remove check_region in favour of request_region. Free resources
properly on error path. Horribly subtle ioremap/iounmap lurks here I
think, in qla1280_pci_config(), which the below patch should take care
of.
I'm wondering if there couldn't / shouldn't be a better way to
allocate resources. Obviously lots of drivers have broken error paths.
Is this even necessary?
Marcus
#
# create_patch: qla1280_release_on_error_path-2002-12-08-A.patch
# Date: Sun Dec 8 22:32:33 EET 2002
#
Andrew Morton [Thu, 6 Feb 2003 00:59:24 +0000 (16:59 -0800)]
[PATCH] Fix signed use of i_blocks in ext3 truncate
Patch from "Stephen C. Tweedie" <sct@redhat.com>
Fix "h_buffer_credits<0" assert failure during truncate.
The bug occurs when the "i_blocks" count in the file's inode overflows
past 2^31. That works fine most of the time, because i_blocks is an
unsigned long, and should go up to 2^32; but there's a place in truncate
where ext3 calculates the size of the next transaction chunk for the
delete, and that mistakenly uses a signed long instead. Because the
huge i_blocks gets cast to a negative value, ext3 does not reserve
enough credits for the transaction and the above error results.
This is usually only possible on filesystems corrupted for other
reasons, but it is reproducible if you create a single, non-sparse file
larger than 1TB on ext3 and then try to delete it.
Andrew Morton [Thu, 6 Feb 2003 00:59:17 +0000 (16:59 -0800)]
[PATCH] CPU Hotplug mm/slab.c CPU_UP_CANCELED fix
Patch from Manfred Spraul.
Fixes a bug which was exposed by Zwane's hotplug CPU work. The
cache_cache.array pointer is initially given a temp bootstrap area, which is
later converted over to the final value after the CPU is brought up.
But if slab is enhanced to permit cancellation of a CPU bringup, this pointer
ends up pointing at stale memory. So reinitialise it by hand when
kmem_cache_init() is run.
Andrew Morton [Thu, 6 Feb 2003 00:59:11 +0000 (16:59 -0800)]
[PATCH] spinlock debugging on uniprocessors
Patch from Manfred Spraul <manfred@colorfullife.com>
This enables spinlock debuggng on uniprocessor builds, under
CONFIG_DEBUG_SPINLOCK.
The reason I want this is that one day we'll need to pull out the debugging
support from the timer code which detects uninitialised timers. And once
that has gone, uniprocessor developers and testers have no way of detecting
uninitialised timers - there will be mysterious deadlocks on SMP machines.
And there will surely be more uninitialised timers
The patch also removes the last pieces of the support for including
<asm/spinlock.h> directly. Doesn't work since (IIRC) 2.3.x
Andrew Morton [Thu, 6 Feb 2003 00:58:57 +0000 (16:58 -0800)]
[PATCH] hugetlb mremap fix
If you attempt to perform a relocating 4k-aligned mremap and the new address
for the map lands on top of a hugepage VMA, do_mremap() will attempt to
perform a 4k-aligned unmap inside the hugetlb VMA. The hugetlb layer goes
BUG.
Fix that by trapping the poorly-aligned unmap attempt in do_munmap().
do_remap() will then fall through without having done anything to the place
where it tests for a hugetlb VMA.
It would be neater to perform these checks on entry to do_mremap(), but that
would incur another VMA lookup.
Also, if you attempt to perform a 4k-aligned and/or sized munmap() inside a
hugepage VMA the same BUG happens. This patch fixes that too.
This all means that an mremap attempt against a hugetlb area will fail, but
only after having unmapped the source pages. That's a bit messy, but
supporting hugetlb mremap doesn't seem worth it, and completely disallowing
it will add overhead to normal mremaps.
Andrew Morton [Thu, 6 Feb 2003 00:58:38 +0000 (16:58 -0800)]
[PATCH] Fix hugetlbfs faults
If the underlying mapping was truncated and someone references the
now-unmapped memory the kernel will enter handle_mm_fault() and will start
instantiating PAGE_SIZE pte's inside the hugepage VMA. Everything goes
generally pear-shaped.
So trap this in handle_mm_fault(). It adds no overhead to non-hugepage
builds.
Another possible fix would be to not unmap the huge pages at all in truncate
- just anonymise them.
But I think we want full ftruncate semantics for hugepages for management
purposes.
Andrew Morton [Thu, 6 Feb 2003 00:58:32 +0000 (16:58 -0800)]
[PATCH] Give all architectures a hugetlb_nopage().
If someone maps a hugetlbfs file, then truncates it, then references the part
of the mapping outside the truncation point, they take a pagefault and we end
up hitting hugetlb_nopage().
We want to prevent this from ever happening. This patch just makes sure that
all architectures have a goes-BUG hugetlb_nopage() to trap it.
Andrew Morton [Thu, 6 Feb 2003 00:58:19 +0000 (16:58 -0800)]
[PATCH] hugetlbfs i_size fixes
We're expanding hugetlbfs i_size in the wrong place. If someone attempts to
mmap more pages than are available, i_size is updated to reflect the
attempted mapping size.
So set i_size only when pages are successfully added to the mapping.
i_size handling at truncate time is still a bit wrong - if the mapping has
pages at (say) page offset 100-200 and the mappng is truncated to (say) page
offset 50, i_size should be set to zero. But it is instead set to
50*HPAGE_SIZE. That's harmless.
Andrew Morton [Thu, 6 Feb 2003 00:58:06 +0000 (16:58 -0800)]
[PATCH] get_unmapped_area for hugetlbfs
Having to specify the mapping address is a pain. Give hugetlbfs files a
file_operations.get_unmapped_area().
The implementation is in hugetlbfs rather than in arch code because it's
probably common to several architectures. If the architecture has special
needs it can define HAVE_ARCH_HUGETLB_UNMAPPED_AREA and go it alone. Just
like HAVE_ARCH_UNMAPPED_AREA.
Andrew Morton [Thu, 6 Feb 2003 00:58:00 +0000 (16:58 -0800)]
[PATCH] convert hugetlb code to use compound pages
The odd thing about hugetlb is that it maintains its own freelist of pages.
And it has to do that, else it would trivially run out of pages due to buddy
fragmetation.
So we we don't want callers of put_page() to be passing those pages
to __free_pages_ok() on the final put().
So hugetlb installs a destructor in the compound pages to point at
free_huge_page(), which knows how to put these pages back onto the free list.
Also, don't mark hugepages as all PageReserved any more. That's preenting
callers from doing proper refcounting. Any code which does a user pagetable
walk and hits part of a hugepage will now handle it transparently.
projects / linux / log