* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: (47 commits)
doc: CONFIG_UNEVICTABLE_LRU doesn't exist anymore
Update cpuset info & webiste for cgroups
dcdbas: force SMI to happen when expected
arch/arm/Kconfig: remove one to many l's in the word.
asm-generic/user.h: Fix spelling in comment
drm: fix printk typo 'sracth'
Remove one to many n's in a word
Documentation/filesystems/romfs.txt: fixing link to genromfs
drivers:scsi Change printk typo initate -> initiate
serial, pch uart: Remove duplicate inclusion of linux/pci.h header
fs/eventpoll.c: fix spelling
mm: Fix out-of-date comments which refers non-existent functions
drm: Fix printk typo 'failled'
coh901318.c: Change initate to initiate.
mbox-db5500.c Change initate to initiate.
edac: correct i82975x error-info reported
edac: correct i82975x mci initialisation
edac: correct commented info
fs: update comments to point correct document
target: remove duplicate include of target/target_core_device.h from drivers/target/target_core_hba.c
...
Trivial conflict in fs/eventpoll.c (spelling vs addition)
* 'stable/hvc-console' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
xen/hvc: Disable probe_irq_on/off from poking the hvc-console IRQ line.
* 'stable/gntalloc.v6' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
xen: gntdev: fix build warning
xen/p2m/m2p/gnttab: do not add failed grant maps to m2p override
xen-gntdev: Add cast to pointer
xen-gntdev: Fix incorrect use of zero handle
xen: change xen/[gntdev/gntalloc] to default m
xen-gntdev: prevent using UNMAP_NOTIFY_CLEAR_BYTE on read-only mappings
xen-gntdev: Avoid double-mapping memory
xen-gntdev: Avoid unmapping ranges twice
xen-gntdev: Use map->vma for checking map validity
xen-gntdev: Fix unmap notify on PV domains
xen-gntdev: Fix memory leak when mmap fails
xen/gntalloc,gntdev: Add unmap notify ioctl
xen-gntalloc: Userspace grant allocation driver
xen-gntdev: Support mapping in HVM domains
xen-gntdev: Add reference counting to maps
xen-gntdev: Use find_vma rather than iterating our vma list manually
xen-gntdev: Change page limit to be global instead of per-open
* 'stable/balloon' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen: (24 commits)
xen-gntdev: Use ballooned pages for grant mappings
xen-balloon: Add interface to retrieve ballooned pages
xen-balloon: Move core balloon functionality out of module
xen/balloon: Remove pr_info's and don't alter retry_count
xen/balloon: Protect against CPU exhaust by event/x process
xen/balloon: Migration from mod_timer() to schedule_delayed_work()
xen/balloon: Removal of driver_pages
This fixes a particular nasty racing problem found when using
Xen hypervisor with the console (hvc) output being routed to the
serial port and the serial port receiving data when
probe_irq_off(probe_irq_on) is running.
Specifically the bug manifests itself with:
[ 4.470693] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
[ 4.470693] IP: [<ffffffff810a8c65>] handle_IRQ_event+0xe/0xc9
..snip..
[ 4.470693] Call Trace:
[ 4.470693] <IRQ>
[ 4.470693] [<ffffffff810aa645>] handle_percpu_irq+0x3c/0x69
[ 4.470693] [<ffffffff8123cda7>] __xen_evtchn_do_upcall+0xfd/0x195
[ 4.470693] [<ffffffff810308cf>] ? xen_restore_fl_direct_end+0x0/0x1
[ 4.470693] [<ffffffff8123d873>] xen_evtchn_do_upcall+0x32/0x47
[ 4.470693] [<ffffffff81034dfe>] xen_do_hypervisor_callback+0x1e/0x30
[ 4.470693] <EOI>
[ 4.470693] [<ffffffff8100922a>] ? hypercall_page+0x22a/0x1000
[ 4.470693] [<ffffffff8100922a>] ? hypercall_page+0x22a/0x1000
[ 4.470693] [<ffffffff810301c5>] ? xen_force_evtchn_callback+0xd/0xf
[ 4.470693] [<ffffffff810308e2>] ? check_events+0x12/0x20
[ 4.470693] [<ffffffff81030889>] ? xen_irq_enable_direct_end+0x0/0x7
[ 4.470693] [<ffffffff810ab0a0>] ? probe_irq_on+0x8f/0x1d7
[ 4.470693] [<ffffffff812b105e>] ? serial8250_config_port+0x7b7/0x9e6
[ 4.470693] [<ffffffff812ad66c>] ? uart_add_one_port+0x11b/0x305
The bug is trigged by three actors working together:
A). serial_8250_config_port calling
probe_irq_off(probe_irq_on())
wherein all of the IRQ handlers are being started and shut off.
The functions utilize the sleep functions so the minimum time
they are run is 120 msec.
B). Xen hypervisor receiving on the serial line any character and
setting the bits in the event channel - during this 120 msec timeframe.
C). The hvc API makes a call to 'request_irq' (and hence setting desc->action
to a valid value), much much later - when user space opens
/dev/console (hvc_open). To make the console usable during bootup,
the Xen HVC implementation sets the IRQ chip (and correspondingly
the event channel) much earlier. The IRQ chip handler that is used
is the handle_percpu_irq (aaca49642b)
Back to the issue. When A) is being called it ends up calling the
xen_percpu_chip's chip->startup twice and chip->shutdown once. Those
are set to the default_startup and mask_irq (events.c) respectivly.
If (and this seems to depend on what serial concentrator you use), B)
gets data from the serial port it sets in the event channel a pending bit.
When A) calls chip->startup(), the masking of the pending bit, and
unmasking of the event channel mask, and also setting of the upcall_pending
flag is done (since there is data present on the event channel).
If before the 120 msec has elapsed, any IRQ handler (Xen IRQ has one
IRQ handler, which checks the event channels bitmap to figure which one
to call) is called we end up calling the handle_percpu_irq. The
handle_percpu_irq calls desc->action (which is NULL) and we blow up.
Caveats: I could only reproduce this on 2.6.32 pvops. I am not sure
why this is not showing up on 2.6.38 kernel.
The probe_irq_on/off has code to disable poking specific IRQ lines. This is
done by using the set_irq_noprobe() and then we do not have to
worry about the handle_percpu_irq being called before the IRQ action
handler has been installed.
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
The HVCS driver, for those who don't know, is a driver for the "server" side
of the IBM virtual terminal mechanism allowing Linux partitions to act as
terminal servers under IBM PowerVM hypervisor. It's almost never used on
the field at the moment.
However, it's part of our configs, and in its current incarnation, will
allocate the tty driver & major (with 64 minors) and create a kernel thread
whether it's used or not, ie, whether the hypervisor did put a virtual
terminal server device node in the partition or not (or whether running on
a pseries machine or not even).
This in turns causes modern distro's udev's to start trying to open all
those 64 minors at boot, which, since they aren't linked to anything,
causes the driver to spew errors in the kernel log for each of them.
Not nice.
This moves all that initialization to a function which is now only called
the first time a terminal server virtual IO device is actually probed
(that is almost never).
There's still a _LOT_ of cleanup that can be done in this driver, some
simple (almost all printk's statements in there shall either just be
removed or in some case turned into better written & more informative
messages, including using the dev_* variants etc...). This is left as
an exercise for whoever actually cares about that driver.
One could also try to be smart and dispose of all the tty related
resources when the last instance of the VIO server device
is removed (Hotplug anybody ?).
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
The Kconfig options for the drivers/tty/ files still were hanging around
in the "big" drivers/char/Kconfig file, so move them to the proper
location under drivers/tty and drivers/tty/hvc/
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Doing tiocmget was such fun we should do tiocmset as well for the same
reasons
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
We don't actually need this and it causes problems for internal use of
this functionality. Currently there is a single use of the FILE * pointer.
That is the serial core which uses it to check tty_hung_up_p. However if
that is true then IO_ERROR is also already set so the check may be removed.
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This converts the existing bfin_jtag_comm TTY driver to the HVC layer so
that the common HVC code can worry about all of the TTY/polling crap and
leave the Blackfin code to worry about the Blackfin bits.
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The inline assembly differences for v6 vs. v7 in the hvc_dcc
driver are purely optimizations. On a v7 processor, an mrc with
the pc sets the condition codes to the 28-31 bits of the register
being read. It just so happens that the TX/RX full bits the DCC
driver is testing for are high enough in the register to be put
into the condition codes. On a v6 processor, this "feature" isn't
implemented and thus we have to do the usual read, mask, test
operations to check for TX/RX full.
Since we already test the RX/TX full bits before calling
__dcc_getchar() and __dcc_putchar() we don't actually need to do
anything special for v7 over v6. The only difference is in
hvc_dcc_get_chars(). We would test RX full, poll RX full, and
then read a character from the buffer, whereas now we will test
RX full, read a character from the buffer, and then test RX full
again for the second iteration of the loop. It doesn't seem
possible for the buffer to go from full to empty between testing
the RX full and reading a character. Therefore, replace the v7
versions with the v6 versions and everything works the same.
Acked-by: Tony Lindgren <tony@atomide.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Acked-by: Nicolas Pitre <nicolas.pitre@linaro.org>
Cc: Daniel Walker <dwalker@codeaurora.org>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Casting and anding with 0xff is unnecessary in
hvc_dcc_put_chars() since buf is already a char[].
__dcc_get_char() can't return an int less than 0 since it only
returns a char. Simplify the if statement in hvc_dcc_get_chars()
to take this into account.
Cc: Daniel Walker <dwalker@codeaurora.org>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Without marking the asm __dcc_getstatus() volatile my compiler
decides it can cache the value of __ret in a register and then
check the value of it continually in hvc_dcc_put_chars() (I had
to replace get_wait/put_wait with 1 and fixup the branch
otherwise my disassembler barfed on __dcc_(get|put)char).
00000000 <hvc_dcc_put_chars>:
0: ee103e11 mrc 14, 0, r3, cr0, cr1, {0}
4: e3a0c000 mov ip, #0 ; 0x0
8: e2033202 and r3, r3, #536870912 ; 0x20000000
c: ea000006 b 2c <hvc_dcc_put_chars+0x2c>
10: e3530000 cmp r3, #0 ; 0x0
14: 1afffffd bne 10 <hvc_dcc_put_chars+0x10>
18: e7d1000c ldrb r0, [r1, ip]
1c: ee10fe11 mrc 14, 0, pc, cr0, cr1, {0}
20: 2afffffd bcs 1c <hvc_dcc_put_chars+0x1c>
24: ee000e15 mcr 14, 0, r0, cr0, cr5, {0}
28: e28cc001 add ip, ip, #1 ; 0x1
2c: e15c0002 cmp ip, r2
30: bafffff6 blt 10 <hvc_dcc_put_chars+0x10>
34: e1a00002 mov r0, r2
38: e12fff1e bx lr
As you can see, the value of the mrc is checked against
DCC_STATUS_TX (bit 29) and then stored in r3 for later use.
Marking the asm volatile produces the following:
00000000 <hvc_dcc_put_chars>:
0: e3a03000 mov r3, #0 ; 0x0
4: ea000007 b 28 <hvc_dcc_put_chars+0x28>
8: ee100e11 mrc 14, 0, r0, cr0, cr1, {0}
c: e3100202 tst r0, #536870912 ; 0x20000000
10: 1afffffc bne 8 <hvc_dcc_put_chars+0x8>
14: e7d10003 ldrb r0, [r1, r3]
18: ee10fe11 mrc 14, 0, pc, cr0, cr1, {0}
1c: 2afffffd bcs 18 <hvc_dcc_put_chars+0x18>
20: ee000e15 mcr 14, 0, r0, cr0, cr5, {0}
24: e2833001 add r3, r3, #1 ; 0x1
28: e1530002 cmp r3, r2
2c: bafffff5 blt 8 <hvc_dcc_put_chars+0x8>
30: e1a00002 mov r0, r2
34: e12fff1e bx lr
which looks better and actually works. Mark all the inline
assembly in this file as volatile since we don't want the
compiler to optimize away these statements or move them around
in any way.
Acked-by: Tony Lindgren <tony@atomide.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Acked-by: Nicolas Pitre <nicolas.pitre@linaro.org>
Cc: Daniel Walker <dwalker@codeaurora.org>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Commit 728674a7e4 moved virtio_console.c
to drivers/tty/hvc/ under the perception of this being an hvc driver.
It was such once, but these days it has generic communication
capabilities as well, so move it to drivers/char/.
In the future, the hvc part from this file can be split off and moved
under drivers/tty/hvc/.
Signed-off-by: Amit Shah <amit.shah@redhat.com>
CC: Rusty Russell <rusty@rustcorp.com.au>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
As requested by Arnd Bergmann, the hvc drivers are now
moved to the drivers/tty/hvc/ directory. The virtio_console.c driver
was also moved, as it required the hvc_console.h file to be able to be
built, and it really is a hvc driver.
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Lucas De Marchi