]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
3.6-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 20 Nov 2012 19:03:07 +0000 (11:03 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 20 Nov 2012 19:03:07 +0000 (11:03 -0800)
added patches:
alsa-usb-audio-fix-crash-at-re-preparing-the-pcm-stream.patch
gfs2-don-t-call-file_accessed-with-a-shared-glock.patch
r8169-use-unlimited-dma-burst-for-tx.patch
scsi-isci-allow-ssp-tasks-into-the-task-management-path.patch
tg3-unconditionally-select-hwmon-support-when-tg3-is-enabled.patch
tmpfs-change-final-i_blocks-bug-to-warning.patch
xen-events-fix-rcu-warning-or-call-idle-notifier-after-irq_enter.patch

queue-3.6/alsa-usb-audio-fix-crash-at-re-preparing-the-pcm-stream.patch [new file with mode: 0644]
queue-3.6/gfs2-don-t-call-file_accessed-with-a-shared-glock.patch [new file with mode: 0644]
queue-3.6/module-fix-out-by-one-error-in-kallsyms.patch
queue-3.6/r8169-use-unlimited-dma-burst-for-tx.patch [new file with mode: 0644]
queue-3.6/scsi-isci-allow-ssp-tasks-into-the-task-management-path.patch [new file with mode: 0644]
queue-3.6/series
queue-3.6/tg3-unconditionally-select-hwmon-support-when-tg3-is-enabled.patch [new file with mode: 0644]
queue-3.6/tmpfs-change-final-i_blocks-bug-to-warning.patch [new file with mode: 0644]
queue-3.6/xen-events-fix-rcu-warning-or-call-idle-notifier-after-irq_enter.patch [new file with mode: 0644]

diff --git a/queue-3.6/alsa-usb-audio-fix-crash-at-re-preparing-the-pcm-stream.patch b/queue-3.6/alsa-usb-audio-fix-crash-at-re-preparing-the-pcm-stream.patch
new file mode 100644 (file)
index 0000000..dc0bab2
--- /dev/null
@@ -0,0 +1,93 @@
+From tiwai@suse.de  Tue Nov 20 10:52:09 2012
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 20 Nov 2012 08:20:02 +0100
+Subject: ALSA: usb-audio: Fix crash at re-preparing the PCM stream
+To: <gregkh@linuxfoundation.org>
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit f58161ba1b05a968e5136824b5a16b714b6a5317 upstream.
+
+There are bug reports of a crash with USB-audio devices when PCM
+prepare is performed immediately after the stream is stopped via
+trigger callback.  It turned out that the problem is that we don't
+wait until all URBs are killed.
+
+This patch adds a new function to synchronize the pending stop
+operation on an endpoint, and calls in the prepare callback for
+avoiding the crash above.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=49181
+
+Reported-and-tested-by: Artem S. Tashkinov <t.artem@lycos.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/endpoint.c |   13 +++++++++++++
+ sound/usb/endpoint.h |    1 +
+ sound/usb/pcm.c      |    3 +++
+ 3 files changed, 17 insertions(+)
+
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -35,6 +35,7 @@
+ #define EP_FLAG_ACTIVATED     0
+ #define EP_FLAG_RUNNING               1
++#define EP_FLAG_STOPPING      2
+ /*
+  * snd_usb_endpoint is a model that abstracts everything related to an
+@@ -502,10 +503,20 @@ static int wait_clear_urbs(struct snd_us
+       if (alive)
+               snd_printk(KERN_ERR "timeout: still %d active urbs on EP #%x\n",
+                                       alive, ep->ep_num);
++      clear_bit(EP_FLAG_STOPPING, &ep->flags);
+       return 0;
+ }
++/* sync the pending stop operation;
++ * this function itself doesn't trigger the stop operation
++ */
++void snd_usb_endpoint_sync_pending_stop(struct snd_usb_endpoint *ep)
++{
++      if (ep && test_bit(EP_FLAG_STOPPING, &ep->flags))
++              wait_clear_urbs(ep);
++}
++
+ /*
+  * unlink active urbs.
+  */
+@@ -913,6 +924,8 @@ void snd_usb_endpoint_stop(struct snd_us
+               if (wait)
+                       wait_clear_urbs(ep);
++              else
++                      set_bit(EP_FLAG_STOPPING, &ep->flags);
+       }
+ }
+--- a/sound/usb/endpoint.h
++++ b/sound/usb/endpoint.h
+@@ -16,6 +16,7 @@ int snd_usb_endpoint_set_params(struct s
+ int  snd_usb_endpoint_start(struct snd_usb_endpoint *ep, int can_sleep);
+ void snd_usb_endpoint_stop(struct snd_usb_endpoint *ep,
+                          int force, int can_sleep, int wait);
++void snd_usb_endpoint_sync_pending_stop(struct snd_usb_endpoint *ep);
+ int  snd_usb_endpoint_activate(struct snd_usb_endpoint *ep);
+ int  snd_usb_endpoint_deactivate(struct snd_usb_endpoint *ep);
+ void snd_usb_endpoint_free(struct list_head *head);
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -563,6 +563,9 @@ static int snd_usb_pcm_prepare(struct sn
+               goto unlock;
+       }
++      snd_usb_endpoint_sync_pending_stop(subs->sync_endpoint);
++      snd_usb_endpoint_sync_pending_stop(subs->data_endpoint);
++
+       /* some unit conversions in runtime */
+       subs->data_endpoint->maxframesize =
+               bytes_to_frames(runtime, subs->data_endpoint->maxpacksize);
diff --git a/queue-3.6/gfs2-don-t-call-file_accessed-with-a-shared-glock.patch b/queue-3.6/gfs2-don-t-call-file_accessed-with-a-shared-glock.patch
new file mode 100644 (file)
index 0000000..77ef045
--- /dev/null
@@ -0,0 +1,65 @@
+From 3d1626889a64bd5a661544d582036a0a02104a60 Mon Sep 17 00:00:00 2001
+From: Benjamin Marzinski <bmarzins@redhat.com>
+Date: Tue, 6 Nov 2012 00:49:28 -0600
+Subject: GFS2: Don't call file_accessed() with a shared glock
+
+From: Benjamin Marzinski <bmarzins@redhat.com>
+
+commit 3d1626889a64bd5a661544d582036a0a02104a60 upstream.
+
+file_accessed() was being called by gfs2_mmap() with a shared glock. If it
+needed to update the atime, it was crashing because it dirtied the inode in
+gfs2_dirty_inode() without holding an exclusive lock. gfs2_dirty_inode()
+checked if the caller was already holding a glock, but it didn't make sure that
+the glock was in the exclusive state. Now, instead of calling file_accessed()
+while holding the shared lock in gfs2_mmap(), file_accessed() is called after
+grabbing and releasing the glock to update the inode.  If file_accessed() needs
+to update the atime, it will grab an exclusive lock in gfs2_dirty_inode().
+
+gfs2_dirty_inode() now also checks to make sure that if the calling process has
+already locked the glock, it has an exclusive lock.
+
+Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com>
+Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/gfs2/file.c  |   12 +++++-------
+ fs/gfs2/super.c |    3 ++-
+ 2 files changed, 7 insertions(+), 8 deletions(-)
+
+--- a/fs/gfs2/file.c
++++ b/fs/gfs2/file.c
+@@ -515,15 +515,13 @@ static int gfs2_mmap(struct file *file,
+               struct gfs2_holder i_gh;
+               int error;
+-              gfs2_holder_init(ip->i_gl, LM_ST_SHARED, LM_FLAG_ANY, &i_gh);
+-              error = gfs2_glock_nq(&i_gh);
+-              if (error == 0) {
+-                      file_accessed(file);
+-                      gfs2_glock_dq(&i_gh);
+-              }
+-              gfs2_holder_uninit(&i_gh);
++              error = gfs2_glock_nq_init(ip->i_gl, LM_ST_SHARED, LM_FLAG_ANY,
++                                         &i_gh);
+               if (error)
+                       return error;
++              /* grab lock to update inode */
++              gfs2_glock_dq_uninit(&i_gh);
++              file_accessed(file);
+       }
+       vma->vm_ops = &gfs2_vm_ops;
+       vma->vm_flags |= VM_CAN_NONLINEAR;
+--- a/fs/gfs2/super.c
++++ b/fs/gfs2/super.c
+@@ -810,7 +810,8 @@ static void gfs2_dirty_inode(struct inod
+                       return;
+               }
+               need_unlock = 1;
+-      }
++      } else if (WARN_ON_ONCE(ip->i_gl->gl_state != LM_ST_EXCLUSIVE))
++              return;
+       if (current->journal_info == NULL) {
+               ret = gfs2_trans_begin(sdp, RES_DINODE, 0);
index 008739c567f7889703d731187caccd5f40d81dd2..80a28cf63d9f6c955110babc2337873bdebb2d5c 100644 (file)
@@ -23,6 +23,7 @@ This bug exists since the following commit was introduced.
 
 LKML: http://lkml.org/lkml/2012/10/24/27
 Reported-by: Masaki Kimura <masaki.kimura.kz@hitachi.com>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 
 ---
diff --git a/queue-3.6/r8169-use-unlimited-dma-burst-for-tx.patch b/queue-3.6/r8169-use-unlimited-dma-burst-for-tx.patch
new file mode 100644 (file)
index 0000000..a5109c8
--- /dev/null
@@ -0,0 +1,65 @@
+From aee77e4accbeb2c86b1d294cd84fec4a12dde3bd Mon Sep 17 00:00:00 2001
+From: Michal Schmidt <mschmidt@redhat.com>
+Date: Sun, 9 Sep 2012 13:55:26 +0000
+Subject: r8169: use unlimited DMA burst for TX
+
+From: Michal Schmidt <mschmidt@redhat.com>
+
+commit aee77e4accbeb2c86b1d294cd84fec4a12dde3bd upstream.
+
+The r8169 driver currently limits the DMA burst for TX to 1024 bytes. I have
+a box where this prevents the interface from using the gigabit line to its full
+potential. This patch solves the problem by setting TX_DMA_BURST to unlimited.
+
+The box has an ASRock B75M motherboard with on-board RTL8168evl/8111evl
+(XID 0c900880). TSO is enabled.
+
+I used netperf (TCP_STREAM test) to measure the dependency of TX throughput
+on MTU. I did it for three different values of TX_DMA_BURST ('5'=512, '6'=1024,
+'7'=unlimited). This chart shows the results:
+http://michich.fedorapeople.org/r8169/r8169-effects-of-TX_DMA_BURST.png
+
+Interesting points:
+ - With the current DMA burst limit (1024):
+   - at the default MTU=1500 I get only 842 Mbit/s.
+   - when going from small MTU, the performance rises monotonically with
+     increasing MTU only up to a peak at MTU=1076 (908 MBit/s). Then there's
+     a sudden drop to 762 MBit/s from which the throughput rises monotonically
+     again with further MTU increases.
+ - With a smaller DMA burst limit (512):
+   - there's a similar peak at MTU=1076 and another one at MTU=564.
+ - With unlimited DMA burst:
+   - at the default MTU=1500 I get nice 940 Mbit/s.
+   - the throughput rises monotonically with increasing MTU with no strange
+     peaks.
+
+Notice that the peaks occur at MTU sizes that are multiples of the DMA burst
+limit plus 52. Why 52? Because:
+  20 (IP header) + 20 (TCP header) + 12 (TCP options) = 52
+
+The Realtek-provided r8168 driver (v8.032.00) uses unlimited TX DMA burst too,
+except for CFG_METHOD_1 where the TX DMA burst is set to 512 bytes.
+CFG_METHOD_1 appears to be the oldest MAC version of "RTL8168B/8111B",
+i.e. RTL_GIGA_MAC_VER_11 in r8169. Not sure if this MAC version really needs
+the smaller burst limit, or if any other versions have similar requirements.
+
+Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
+Acked-by: Francois Romieu <romieu@fr.zoreil.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/realtek/r8169.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -77,7 +77,7 @@
+ static const int multicast_filter_limit = 32;
+ #define MAX_READ_REQUEST_SHIFT        12
+-#define TX_DMA_BURST  6       /* Maximum PCI burst, '6' is 1024 */
++#define TX_DMA_BURST  7       /* Maximum PCI burst, '7' is unlimited */
+ #define SafeMtu               0x1c20  /* ... actually life sucks beyond ~7k */
+ #define InterFrameGap 0x03    /* 3 means InterFrameGap = the shortest one */
diff --git a/queue-3.6/scsi-isci-allow-ssp-tasks-into-the-task-management-path.patch b/queue-3.6/scsi-isci-allow-ssp-tasks-into-the-task-management-path.patch
new file mode 100644 (file)
index 0000000..e68bca1
--- /dev/null
@@ -0,0 +1,63 @@
+From 54b46677757ff8d6c282305fc7710f466b63d6dc Mon Sep 17 00:00:00 2001
+From: Jeff Skirvin <jeffrey.d.skirvin@intel.com>
+Date: Wed, 5 Sep 2012 21:36:47 -0700
+Subject: SCSI: isci: Allow SSP tasks into the task management path.
+
+From: Jeff Skirvin <jeffrey.d.skirvin@intel.com>
+
+commit 54b46677757ff8d6c282305fc7710f466b63d6dc upstream.
+
+This commit fixes a driver bug for SSP tasks that require task management
+in the target after they complete in the SCU hardware.  The problem was
+manifested in the function "isci_task_abort_task", which tests
+to see if the sas_task.lldd_task is non-NULL before allowing task
+management; this bug would always NULL lldd_task in the SCU I/O completion
+path even if target management was required, which would prevent
+task / target manangement from happening.
+
+Note that in the case of SATA/STP targets, error recovery is provided by
+the libata error handler which is why SATA/STP device recovery worked
+correctly even though SSP handling did not.
+
+Signed-off-by: Jeff Skirvin <jeffrey.d.skirvin@intel.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Cc: "Dorau, Lukasz" <lukasz.dorau@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/isci/host.c |   10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/isci/host.c
++++ b/drivers/scsi/isci/host.c
+@@ -1079,7 +1079,6 @@ static void sci_controller_completion_ha
+ void ireq_done(struct isci_host *ihost, struct isci_request *ireq, struct sas_task *task)
+ {
+-      task->lldd_task = NULL;
+       if (!test_bit(IREQ_ABORT_PATH_ACTIVE, &ireq->flags) &&
+           !(task->task_state_flags & SAS_TASK_STATE_ABORTED)) {
+               if (test_bit(IREQ_COMPLETE_IN_TARGET, &ireq->flags)) {
+@@ -1087,16 +1086,19 @@ void ireq_done(struct isci_host *ihost,
+                       dev_dbg(&ihost->pdev->dev,
+                               "%s: Normal - ireq/task = %p/%p\n",
+                               __func__, ireq, task);
+-
++                      task->lldd_task = NULL;
+                       task->task_done(task);
+               } else {
+                       dev_dbg(&ihost->pdev->dev,
+                               "%s: Error - ireq/task = %p/%p\n",
+                               __func__, ireq, task);
+-
++                      if (sas_protocol_ata(task->task_proto))
++                              task->lldd_task = NULL;
+                       sas_task_abort(task);
+               }
+-      }
++      } else
++              task->lldd_task = NULL;
++
+       if (test_and_clear_bit(IREQ_ABORT_PATH_ACTIVE, &ireq->flags))
+               wake_up_all(&ihost->eventq);
index 41f59938defd58c9e2ee9f720f66f70dd876ce2a..71e92eaa4fd90082189da514fecf8a73f9b06c7d 100644 (file)
@@ -37,3 +37,10 @@ net-rps-fix-brokeness-causing-ooo-packets.patch
 sctp-fix-proc-net-sctp-memory-leak.patch
 tcp-fix-retransmission-in-repair-mode.patch
 tcp-handle-tcp_net_metrics_init-order-5-memory-allocation-failures.patch
+tmpfs-change-final-i_blocks-bug-to-warning.patch
+alsa-usb-audio-fix-crash-at-re-preparing-the-pcm-stream.patch
+gfs2-don-t-call-file_accessed-with-a-shared-glock.patch
+r8169-use-unlimited-dma-burst-for-tx.patch
+xen-events-fix-rcu-warning-or-call-idle-notifier-after-irq_enter.patch
+scsi-isci-allow-ssp-tasks-into-the-task-management-path.patch
+tg3-unconditionally-select-hwmon-support-when-tg3-is-enabled.patch
diff --git a/queue-3.6/tg3-unconditionally-select-hwmon-support-when-tg3-is-enabled.patch b/queue-3.6/tg3-unconditionally-select-hwmon-support-when-tg3-is-enabled.patch
new file mode 100644 (file)
index 0000000..5595fd5
--- /dev/null
@@ -0,0 +1,100 @@
+From de0a41484c47d783dd4d442914815076aa2caac2 Mon Sep 17 00:00:00 2001
+From: Paul Gortmaker <paul.gortmaker@windriver.com>
+Date: Mon, 1 Oct 2012 11:43:49 -0400
+Subject: tg3: unconditionally select HWMON support when tg3 is enabled.
+
+From: Paul Gortmaker <paul.gortmaker@windriver.com>
+
+commit de0a41484c47d783dd4d442914815076aa2caac2 upstream.
+
+There is the seldom used corner case where HWMON=m at the same
+time as TIGON3=y (typically randconfigs) which will cause a link
+fail like:
+
+drivers/built-in.o: In function `tg3_close':
+tg3.c:(.text+0x16bd86): undefined reference to `hwmon_device_unregister'
+drivers/built-in.o: In function `tg3_hwmon_open':
+tg3.c:(.text+0x16fc4b): undefined reference to `hwmon_device_register'
+make[1]: *** [vmlinux] Error 1
+
+Fix it as suggested by DaveM[1] by having the Kconfig logic simply
+select HWMON when TIGON3 is selected.  This gets rid of all the
+extra IS_ENABLED ifdeffery in tg3.c as a side benefit.
+
+[1] http://marc.info/?l=linux-netdev&m=134250573718151&w=2
+
+Reported-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Michael Chan <mchan@broadcom.com>
+Reported-by: Anisse Astier <anisse@astier.eu>
+Suggested-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/broadcom/Kconfig |    1 +
+ drivers/net/ethernet/broadcom/tg3.c   |    9 ---------
+ 2 files changed, 1 insertion(+), 9 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/Kconfig
++++ b/drivers/net/ethernet/broadcom/Kconfig
+@@ -101,6 +101,7 @@ config TIGON3
+       tristate "Broadcom Tigon3 support"
+       depends on PCI
+       select PHYLIB
++      select HWMON
+       ---help---
+         This driver supports Broadcom Tigon3 based gigabit Ethernet cards.
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -44,10 +44,8 @@
+ #include <linux/prefetch.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/firmware.h>
+-#if IS_ENABLED(CONFIG_HWMON)
+ #include <linux/hwmon.h>
+ #include <linux/hwmon-sysfs.h>
+-#endif
+ #include <net/checksum.h>
+ #include <net/ip.h>
+@@ -9517,7 +9515,6 @@ static int tg3_init_hw(struct tg3 *tp, i
+       return tg3_reset_hw(tp, reset_phy);
+ }
+-#if IS_ENABLED(CONFIG_HWMON)
+ static void tg3_sd_scan_scratchpad(struct tg3 *tp, struct tg3_ocir *ocir)
+ {
+       int i;
+@@ -9570,22 +9567,17 @@ static const struct attribute_group tg3_
+       .attrs = tg3_attributes,
+ };
+-#endif
+-
+ static void tg3_hwmon_close(struct tg3 *tp)
+ {
+-#if IS_ENABLED(CONFIG_HWMON)
+       if (tp->hwmon_dev) {
+               hwmon_device_unregister(tp->hwmon_dev);
+               tp->hwmon_dev = NULL;
+               sysfs_remove_group(&tp->pdev->dev.kobj, &tg3_group);
+       }
+-#endif
+ }
+ static void tg3_hwmon_open(struct tg3 *tp)
+ {
+-#if IS_ENABLED(CONFIG_HWMON)
+       int i, err;
+       u32 size = 0;
+       struct pci_dev *pdev = tp->pdev;
+@@ -9617,7 +9609,6 @@ static void tg3_hwmon_open(struct tg3 *t
+               dev_err(&pdev->dev, "Cannot register hwmon device, aborting\n");
+               sysfs_remove_group(&pdev->dev.kobj, &tg3_group);
+       }
+-#endif
+ }
diff --git a/queue-3.6/tmpfs-change-final-i_blocks-bug-to-warning.patch b/queue-3.6/tmpfs-change-final-i_blocks-bug-to-warning.patch
new file mode 100644 (file)
index 0000000..880f2c4
--- /dev/null
@@ -0,0 +1,50 @@
+From 0f3c42f522dc1ad7e27affc0a4aa8c790bce0a66 Mon Sep 17 00:00:00 2001
+From: Hugh Dickins <hughd@google.com>
+Date: Fri, 16 Nov 2012 14:15:04 -0800
+Subject: tmpfs: change final i_blocks BUG to WARNING
+
+From: Hugh Dickins <hughd@google.com>
+
+commit 0f3c42f522dc1ad7e27affc0a4aa8c790bce0a66 upstream.
+
+Under a particular load on one machine, I have hit shmem_evict_inode()'s
+BUG_ON(inode->i_blocks), enough times to narrow it down to a particular
+race between swapout and eviction.
+
+It comes from the "if (freed > 0)" asymmetry in shmem_recalc_inode(),
+and the lack of coherent locking between mapping's nrpages and shmem's
+swapped count.  There's a window in shmem_writepage(), between lowering
+nrpages in shmem_delete_from_page_cache() and then raising swapped
+count, when the freed count appears to be +1 when it should be 0, and
+then the asymmetry stops it from being corrected with -1 before hitting
+the BUG.
+
+One answer is coherent locking: using tree_lock throughout, without
+info->lock; reasonable, but the raw_spin_lock in percpu_counter_add() on
+used_blocks makes that messier than expected.  Another answer may be a
+further effort to eliminate the weird shmem_recalc_inode() altogether,
+but previous attempts at that failed.
+
+So far undecided, but for now change the BUG_ON to WARN_ON: in usual
+circumstances it remains a useful consistency check.
+
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/shmem.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -654,7 +654,7 @@ static void shmem_evict_inode(struct ino
+               kfree(xattr->name);
+               kfree(xattr);
+       }
+-      BUG_ON(inode->i_blocks);
++      WARN_ON(inode->i_blocks);
+       shmem_free_inode(inode->i_sb);
+       clear_inode(inode);
+ }
diff --git a/queue-3.6/xen-events-fix-rcu-warning-or-call-idle-notifier-after-irq_enter.patch b/queue-3.6/xen-events-fix-rcu-warning-or-call-idle-notifier-after-irq_enter.patch
new file mode 100644 (file)
index 0000000..627bf95
--- /dev/null
@@ -0,0 +1,75 @@
+From 772aebcefeff310f80e32b874988af0076cb799d Mon Sep 17 00:00:00 2001
+From: Mojiong Qiu <qiumojiong@gmail.com>
+Date: Tue, 6 Nov 2012 16:08:15 +0800
+Subject: xen/events: fix RCU warning, or Call idle notifier after irq_enter()
+
+From: Mojiong Qiu <qiumojiong@gmail.com>
+
+commit 772aebcefeff310f80e32b874988af0076cb799d upstream.
+
+exit_idle() should be called after irq_enter(), otherwise it throws:
+
+[ INFO: suspicious RCU usage. ]
+3.6.5 #1 Not tainted
+-------------------------------
+include/linux/rcupdate.h:725 rcu_read_lock() used illegally while idle!
+
+other info that might help us debug this:
+
+RCU used illegally from idle CPU!
+rcu_scheduler_active = 1, debug_locks = 1
+RCU used illegally from extended quiescent state!
+1 lock held by swapper/0/0:
+ #0:  (rcu_read_lock){......}, at: [<ffffffff810e9fe0>] __atomic_notifier_call_chain+0x0/0x140
+
+stack backtrace:
+Pid: 0, comm: swapper/0 Not tainted 3.6.5 #1
+Call Trace:
+ <IRQ>  [<ffffffff811259a2>] lockdep_rcu_suspicious+0xe2/0x130
+ [<ffffffff810ea10c>] __atomic_notifier_call_chain+0x12c/0x140
+ [<ffffffff810e9fe0>] ? atomic_notifier_chain_unregister+0x90/0x90
+ [<ffffffff811216cd>] ? trace_hardirqs_off+0xd/0x10
+ [<ffffffff810ea136>] atomic_notifier_call_chain+0x16/0x20
+ [<ffffffff810777c3>] exit_idle+0x43/0x50
+ [<ffffffff81568865>] xen_evtchn_do_upcall+0x25/0x50
+ [<ffffffff81aa690e>] xen_do_hypervisor_callback+0x1e/0x30
+ <EOI>  [<ffffffff810013aa>] ? hypercall_page+0x3aa/0x1000
+ [<ffffffff810013aa>] ? hypercall_page+0x3aa/0x1000
+ [<ffffffff81061540>] ? xen_safe_halt+0x10/0x20
+ [<ffffffff81075cfa>] ? default_idle+0xba/0x570
+ [<ffffffff810778af>] ? cpu_idle+0xdf/0x140
+ [<ffffffff81a4d881>] ? rest_init+0x135/0x144
+ [<ffffffff81a4d74c>] ? csum_partial_copy_generic+0x16c/0x16c
+ [<ffffffff82520c45>] ? start_kernel+0x3db/0x3e8
+ [<ffffffff8252066a>] ? repair_env_string+0x5a/0x5a
+ [<ffffffff82520356>] ? x86_64_start_reservations+0x131/0x135
+ [<ffffffff82524aca>] ? xen_start_kernel+0x465/0x46
+
+Git commit 98ad1cc14a5c4fd658f9d72c6ba5c86dfd3ce0d5
+Author: Frederic Weisbecker <fweisbec@gmail.com>
+Date:   Fri Oct 7 18:22:09 2011 +0200
+
+    x86: Call idle notifier after irq_enter()
+
+did this, but it missed the Xen code.
+
+Signed-off-by: Mojiong Qiu <mjqiu@tencent.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/xen/events.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/xen/events.c
++++ b/drivers/xen/events.c
+@@ -1374,8 +1374,8 @@ void xen_evtchn_do_upcall(struct pt_regs
+ {
+       struct pt_regs *old_regs = set_irq_regs(regs);
+-      exit_idle();
+       irq_enter();
++      exit_idle();
+       __xen_evtchn_do_upcall();