)]}' { "log": [ { "commit": "d0725992c8a6fb63a16bc9e8b2a50094cc4db3cd", "tree": "55b52c5bcc051c3b8c2fc3122000925541d5707b", "parents": [ "c82e6d450fda56cb2d4f68534173d3cd11b32f9f" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Thu Jun 11 23:15:43 2009 +0200" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Wed Jun 24 21:27:35 2009 +0200" }, "message": "futex: Fix the write access fault problem for real\n\ncommit 64d1304a64 (futex: setup writeable mapping for futex ops which\nmodify user space data) did address only half of the problem of write\naccess faults.\n\nThe patch was made on two wrong assumptions:\n\n1) access_ok(VERIFY_WRITE,...) would actually check write access.\n\n On x86 it does _NOT_. It\u0027s a pure address range check.\n\n2) a RW mapped region can not go away under us.\n\n That\u0027s wrong as well. Nobody can prevent another thread to call\n mprotect(PROT_READ) on that region where the futex resides. If that\n call hits between the get_user_pages_fast() verification and the\n actual write access in the atomic region we are toast again.\n\nThe solution is to not rely on access_ok and get_user() for any write\naccess related fault on private and shared futexes. Instead we need to\nfault it in with verification of write access.\n\nThere is no generic non destructive write mechanism which would fault\nthe user page in trough a #PF, but as we already know that we will\nfault we can as well call get_user_pages() directly and avoid the #PF\noverhead.\n\nIf get_user_pages() returns -EFAULT we know that we can not fix it\nanymore and need to bail out to user space.\n\nRemove a bunch of confusing comments on this issue as well.\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: stable@kernel.org\n" }, { "commit": "2070887fdeacd9c13f3e805e3f0086c9f22a4d93", "tree": "f1695bd701f7a2558e11052bfe6ff42d6dc561df", "parents": [ "1c840c14906d4ddf66c1f4f5daea059aad951c82" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Tue May 19 23:04:59 2009 +0200" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Wed May 20 10:34:32 2009 +0200" }, "message": "futex: fix restart in wait_requeue_pi\n\nIf the waiter has been requeued to the outer PI futex and is\ninterrupted by a signal and the thread handles the signal then\nERESTART_RESTARTBLOCK is changed to EINTR and the restart block is\ndiscarded. That way we return an unexcpected EINTR to user space\ninstead of ending up in futex_lock_pi_restart.\n\nBut we do not need to restart the syscall because we know that the\ncondition has changed since we have been requeued. If we would simply\nrestart the syscall then we would drop out via the comparison of the\nuser space value with EWOULDBLOCK.\n\nThe user space side needs to handle EWOULDBLOCK anyway as the\nenqueueing on the inner futex can race with a requeue/wake. So we can\nsimply return EWOULDBLOCK to user space which also signals that we did\nnot take the outer futex and let user space handle it in the same way\nit has to handle the requeue/wake race.\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n" }, { "commit": "1c840c14906d4ddf66c1f4f5daea059aad951c82", "tree": "3c71d3d67c590df598098f5cdb79151359ff2ce4", "parents": [ "c8b15a706d921baed3195407e4f55270112bb3c6" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Wed May 20 09:22:40 2009 +0200" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Wed May 20 10:28:45 2009 +0200" }, "message": "futex: fix restart for early wakeup in futex_wait_requeue_pi()\n\nThe futex_wait_requeue_pi op should restart unconditionally like\nfutex_lock_pi. The user of that function e.g. pthread_cond_wait can\nnot be interrupted so we do not care about the SA_RESTART flag of the\nsignal. Clean up the FIXMEs.\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n" }, { "commit": "c8b15a706d921baed3195407e4f55270112bb3c6", "tree": "514a45eb575cd093043fe1471ff579ffe439db3f", "parents": [ "521c180874dae86f675d23c4eade4dba8b1f2cc8" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Wed May 20 09:18:50 2009 +0200" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Wed May 20 10:28:45 2009 +0200" }, "message": "futex: cleanup error exit\n\nReuse the put_key_ref(key2) call in the exit path.\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n" }, { "commit": "521c180874dae86f675d23c4eade4dba8b1f2cc8", "tree": "7509303da3a9a1b40a26f6811f321c89cd31737b", "parents": [ "f1a11e0576c7a73d759d05d776692b2b2d37172b", "64d1304a64477629cb16b75491a77bafe6f86963" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Wed May 20 09:02:28 2009 +0200" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Wed May 20 09:02:28 2009 +0200" }, "message": "Merge branch \u0027core/urgent\u0027 into core/futexes\n\nMerge reason: this branch was on an pre -rc1 base, merge it up to -rc6+\n to get the latest upstream fixes.\n\nConflicts:\n\tkernel/futex.c\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n" }, { "commit": "64d1304a64477629cb16b75491a77bafe6f86963", "tree": "f9bf95141429174d3e4596d3c4f5b167b6c0e745", "parents": [ "279e677faa775ad16e75c32e1bf4a37f8158bc61" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Mon May 18 21:20:10 2009 +0200" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Tue May 19 23:36:52 2009 +0200" }, "message": "futex: setup writeable mapping for futex ops which modify user space data\n\nThe futex code installs a read only mapping via get_user_pages_fast()\neven if the futex op function has to modify user space data. The\neventual fault was fixed up by futex_handle_fault() which walked the\nVMA with mmap_sem held.\n\nAfter the cleanup patches which removed the mmap_sem dependency of the\nfutex code commit 4dc5b7a36a49eff97050894cf1b3a9a02523717 (futex:\nclean up fault logic) removed the private VMA walk logic from the\nfutex code. This change results in a stale RO mapping which is not\nfixed up.\n\nInstead of reintroducing the previous fault logic we set up the\nmapping in get_user_pages_fast() read/write for all operations which\nmodify user space data. Also handle private futexes in the same way\nand make the current unconditional access_ok(VERIFY_WRITE) depend on\nthe futex op.\n\nReported-by: Andreas Schwab \u003cschwab@linux-m68k.org\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCC: stable@kernel.org\n\n" }, { "commit": "f1a11e0576c7a73d759d05d776692b2b2d37172b", "tree": "3cb845c4cfd48cdbe0755d057c2698657fb965b5", "parents": [ "b30505c81a9d4adea8b70ecff512b0216929b797" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Tue May 05 19:21:40 2009 +0200" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Fri May 15 15:24:18 2009 +0200" }, "message": "futex: remove the wait queue\n\nThe waitqueue which is used in struct futex_q is a leftover from the\nfutexfd implementation. There is no need to use a waitqueue at all, as\nthe waiting task is the only user of it. The waitqueue just adds\nadditional locking and a loop in the wake up path which both can be\navoided.\n\nWe have already a task reference in struct futex_q which is used for\nPI futexes. Use it for normal futexes as well and just wake up the\ntask directly.\n\nThe logic of signalling the futex wakeup via setting q-\u003elock_ptr to\nNULL is kept with the difference that we set it NULL before doing the\nwakeup. This opens an exit race window vs. a non futex wake up of the\nto be woken up task, which we prevent with get_task_struct /\nput_task_struct on the waiter.\n\n[ Impact: simplification ]\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n" }, { "commit": "ba9c22f2c01cf5c88beed5a6b9e07d42e10bd358", "tree": "77664171b51bb6b03eac13ee946b6d894b2da01d", "parents": [ "a5a2a0c7fa039c59619bc908b3b1ed24734d442a" ], "author": { "name": "Darren Hart", "email": "dvhltc@us.ibm.com", "time": "Mon Apr 20 22:22:22 2009 -0700" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Thu Apr 30 11:41:35 2009 +0200" }, "message": "futex: remove FUTEX_REQUEUE_PI (non CMP)\n\nThe new requeue PI futex op codes were modeled after the existing\nFUTEX_REQUEUE and FUTEX_CMP_REQUEUE calls. I was unaware at the time\nthat FUTEX_REQUEUE was only around for compatibility reasons and\nshouldn\u0027t be used in new code. Ulrich Drepper elaborates on this in his\nFutexes are Tricky paper: http://people.redhat.com/drepper/futex.pdf.\nThe deprecated call doesn\u0027t catch changes to the futex corresponding to\nthe destination futex which can lead to deadlock.\n\nTherefor, I feel it best to remove FUTEX_REQUEUE_PI and leave only\nFUTEX_CMP_REQUEUE_PI as there are not yet any existing users of the API.\nThis patch does change the OP code value of FUTEX_CMP_REQUEUE_PI to 12\nfrom 13. Since my test case is the only known user of this API, I felt\nthis was the right thing to do, rather than leave a hole in the\nenumeration.\n\nI chose to continue using the _CMP_ modifier in the OP code to make it\nexplicit to the user that the test is being done.\n\nBuilds, boots, and ran several hundred iterations requeue_pi.c.\n\nSigned-off-by: Darren Hart \u003cdvhltc@us.ibm.com\u003e\nLKML-Reference: \u003c49ED580E.1050502@us.ibm.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n" }, { "commit": "a5a2a0c7fa039c59619bc908b3b1ed24734d442a", "tree": "893dd52f07866834e84e63cb940e1dae1623e259", "parents": [ "d2de688891909b148efe83a6fc9520a9cd6015f0" ], "author": { "name": "Darren Hart", "email": "dvhltc@us.ibm.com", "time": "Fri Apr 10 09:50:05 2009 -0700" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Fri Apr 10 22:04:24 2009 +0200" }, "message": "futex: fix futex_wait_setup key handling\n\nIf the get_futex_key() call were to fail, the existing code would\ntry and put_futex_key() prior to returning. This patch makes sure\nwe only put_futex_key() if get_futex_key() succeeded.\n\nReported-by: Clark Williams \u003cwilliams@redhat.com\u003e\nSigned-off-by: Darren Hart \u003cdvhltc@us.ibm.com\u003e\nLKML-Reference: \u003c20090410165005.14342.16973.stgit@Aeon\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n\n" }, { "commit": "bab5bc9e857638880facef76e4b4c3fa807f8c73", "tree": "8129a3fc18f770021bfe202900ecc2cb144d18c7", "parents": [ "52400ba946759af28442dee6265c5c0180ac7122" ], "author": { "name": "Darren Hart", "email": "dvhltc@us.ibm.com", "time": "Tue Apr 07 23:23:50 2009 -0700" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Wed Apr 08 12:58:20 2009 +0200" }, "message": "futex: fixup unlocked requeue pi case\n\nThomas\u0027s testing caught a problem when the requeue target futex is\nunowned and multiple tasks are requeued to it. This patch ensures\nthe FUTEX_WAITERS bit gets set if futex_requeue() will requeue one\nor more tasks in addition to the one acquiring the lock.\n\nSigned-off-by: Darren Hart \u003cdvhltc@us.ibm.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n" }, { "commit": "52400ba946759af28442dee6265c5c0180ac7122", "tree": "4c9abe885b3cae3cb47b33826b3c5838fc9761b7", "parents": [ "f801073f87aa22ddf0e9146355fec3993163790f" ], "author": { "name": "Darren Hart", "email": "dvhltc@us.ibm.com", "time": "Fri Apr 03 13:40:49 2009 -0700" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Mon Apr 06 11:14:03 2009 +0200" }, "message": "futex: add requeue_pi functionality\n\nPI Futexes and their underlying rt_mutex cannot be left ownerless if\nthere are pending waiters as this will break the PI boosting logic, so\nthe standard requeue commands aren\u0027t sufficient. The new commands\nproperly manage pi futex ownership by ensuring a futex with waiters\nhas an owner at all times. This will allow glibc to properly handle\npi mutexes with pthread_condvars.\n\nThe approach taken here is to create two new futex op codes:\n\nFUTEX_WAIT_REQUEUE_PI:\nTasks will use this op code to wait on a futex (such as a non-pi waitqueue)\nand wake after they have been requeued to a pi futex. Prior to returning to\nuserspace, they will acquire this pi futex (and the underlying rt_mutex).\n\nfutex_wait_requeue_pi() is the result of a high speed collision between\nfutex_wait() and futex_lock_pi() (with the first part of futex_lock_pi() being\ndone by futex_proxy_trylock_atomic() on behalf of the top_waiter).\n\nFUTEX_REQUEUE_PI (and FUTEX_CMP_REQUEUE_PI):\nThis call must be used to wake tasks waiting with FUTEX_WAIT_REQUEUE_PI,\nregardless of how many tasks the caller intends to wake or requeue.\npthread_cond_broadcast() should call this with nr_wake\u003d1 and\nnr_requeue\u003dINT_MAX. pthread_cond_signal() should call this with nr_wake\u003d1 and\nnr_requeue\u003d0. The reason being we need both callers to get the benefit of the\nfutex_proxy_trylock_atomic() routine. futex_requeue() also enqueues the\ntop_waiter on the rt_mutex via rt_mutex_start_proxy_lock().\n\nSigned-off-by: Darren Hart \u003cdvhltc@us.ibm.com\u003e\nReviewed-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n" }, { "commit": "f801073f87aa22ddf0e9146355fec3993163790f", "tree": "5499760cfb1abcebdda8868ec0074ae3ff4da0d5", "parents": [ "9121e4783cd5c7e2a407763f3b61c2d573891133" ], "author": { "name": "Darren Hart", "email": "dvhltc@us.ibm.com", "time": "Fri Apr 03 13:40:40 2009 -0700" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Mon Apr 06 11:14:02 2009 +0200" }, "message": "futex: split out futex value validation code\n\nRefactor the code to validate the expected futex value in order to\nreuse it with the requeue_pi code.\n\nSigned-off-by: Darren Hart \u003cdvhltc@us.ibm.com\u003e\nReviewed-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n" }, { "commit": "9121e4783cd5c7e2a407763f3b61c2d573891133", "tree": "0a3079a738d199514d1ecdb479567e772ca1e03d", "parents": [ "a72188d8a64ebe74722f1cf7ffac41b41ffdba21" ], "author": { "name": "Darren Hart", "email": "dvhltc@us.ibm.com", "time": "Fri Apr 03 13:40:31 2009 -0700" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Mon Apr 06 11:14:02 2009 +0200" }, "message": "futex: distangle futex_requeue()\n\nfutex_requeue() is getting a bit long-winded, and will be getting more\nso after the requeue_pi patch. Factor out the actual requeueing into a\nnicely contained inline function to reduce function length and improve\nlegibility.\n\nSigned-off-by: Darren Hart \u003cdvhltc@us.ibm.com\u003e\nReviewed-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n" }, { "commit": "a72188d8a64ebe74722f1cf7ffac41b41ffdba21", "tree": "5283404345b270bf5ca95ce8d792baacdf8cf7dc", "parents": [ "8dac456a681bd94272ff50ecb31be6b669382c2b" ], "author": { "name": "Darren Hart", "email": "dvhltc@us.ibm.com", "time": "Fri Apr 03 13:40:22 2009 -0700" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Mon Apr 06 11:14:02 2009 +0200" }, "message": "futex: add FUTEX_HAS_TIMEOUT flag to restart.futex.flags\n\nCurrently restart is only used if there is a timeout. The requeue_pi\nfunctionality requires restarting to futex_lock_pi() on signal after\nwakeup in futex_wait_requeue_pi() regardless of if there was a timeout\nor not. Using 0 for the timeout value is confusing as that could\nindicate an expired timer. The flag makes this explicit. While the\ncheck is not technically needed in futex_wait_restart(), doing so\nmakes the code consistent with and will avoid confusion should the\nneed arise to restart wait without a timeout.\n\nSigned-off-by: Darren Hart \u003cdvhltc@us.ibm.com\u003e\nReviewed-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n" }, { "commit": "dd9739980b50c8cde33e1f8eb08b7e0140bcd61e", "tree": "d263d1632397e74c60bc3102853ccc437a65aabf", "parents": [ "1a52084d0919c2799258737c21fb328a9de159b5" ], "author": { "name": "Darren Hart", "email": "dvhltc@us.ibm.com", "time": "Fri Apr 03 13:40:02 2009 -0700" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Mon Apr 06 11:14:02 2009 +0200" }, "message": "futex: split out fixup owner logic from futex_lock_pi()\n\nRefactor the post lock acquisition logic from futex_lock_pi(). This\ncode will be reused in futex_wait_requeue_pi().\n\nSigned-off-by: Darren Hart \u003cdvhltc@us.ibm.com\u003e\nReviewed-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n" }, { "commit": "1a52084d0919c2799258737c21fb328a9de159b5", "tree": "1b5351a83913d1c583912b933ad838d2a024286b", "parents": [ "4b1c486b3587d2abf50bee4a05eb488cd4045f2c" ], "author": { "name": "Darren Hart", "email": "dvhltc@us.ibm.com", "time": "Fri Apr 03 13:39:52 2009 -0700" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Mon Apr 06 11:14:01 2009 +0200" }, "message": "futex: split out atomic logic from futex_lock_pi()\n\nRefactor the atomic portion of futex_lock_pi() into futex_lock_pi_atomic().\n\nThis logic will be needed by requeue_pi, so modularize it to reduce\ncode duplication. The only significant change is passing of the task\nto try and take the lock for. This simplifies the -EDEADLK test as if\nthe lock is owned by task t, it\u0027s a deadlock, regardless of if we are\ndoing requeue pi or not. This patch updates the corresponding comment\naccordingly.\n\nSigned-off-by: Darren Hart \u003cdvhltc@us.ibm.com\u003e\nReviewed-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n" }, { "commit": "4b1c486b3587d2abf50bee4a05eb488cd4045f2c", "tree": "17b2a04c34787cb8af37d8d73d27710a42b870de", "parents": [ "ca5f9524d61f54b1f618293ab92fc6b49cac864d" ], "author": { "name": "Darren Hart", "email": "dvhltc@us.ibm.com", "time": "Fri Apr 03 13:39:42 2009 -0700" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Mon Apr 06 11:14:01 2009 +0200" }, "message": "futex: add helper to find the top prio waiter of a futex\n\nImprove legibility by wrapping finding the top waiter in a function.\nThis will be used by the follow-on patches for enabling requeue pi.\n\nSigned-off-by: Darren Hart \u003cdvhltc@us.ibm.com\u003e\nReviewed-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n" }, { "commit": "ca5f9524d61f54b1f618293ab92fc6b49cac864d", "tree": "5c7b464dc98257670b815da85e03a1f674a50f2f", "parents": [ "6bb597507f9839b13498781e481f5458aea33620" ], "author": { "name": "Darren Hart", "email": "dvhltc@us.ibm.com", "time": "Fri Apr 03 13:39:33 2009 -0700" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Mon Apr 06 11:14:01 2009 +0200" }, "message": "futex: separate futex_wait_queue_me() logic from futex_wait()\n\nRefactor futex_wait() in preparation for futex_wait_requeue_pi(). In\norder to reuse a good chunk of the futex_wait() code for the upcoming\nfutex_wait_requeue_pi() function, this patch breaks out the\nqueue-to-wakeup section of futex_wait() into futex_wait_queue_me().\n\nSigned-off-by: Darren Hart \u003cdvhltc@us.ibm.com\u003e\nReviewed-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n" }, { "commit": "cd84a42f315e50edd454c27a3da3951ccd3d735a", "tree": "fa13b2faa6c2f73255f52a65cd4f572d9bd95e1a", "parents": [ "833bb3046b6cb320e775ea2160ddca87d53260d5" ], "author": { "name": "Darren Hart", "email": "dvhltc@us.ibm.com", "time": "Thu Apr 02 14:19:38 2009 -0700" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Thu Apr 02 23:39:53 2009 +0200" }, "message": "futex: comment requeue key reference semantics\n\nWe\u0027ve tripped over the futex_requeue drop_count refering to key2\ninstead of key1. The code is actually correct, but is non-intuitive.\nThis patch adds an explicit comment explaining the requeue.\n\nSigned-off-by: Darren Hart \u003cdvhltc@us.ibm.com\u003e\nCc: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nCc: Nick Piggin \u003cnickpiggin@yahoo.com.au\u003e\nCc: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n" }, { "commit": "88f502fedba82eff252b6420e8b8328e4ae25c67", "tree": "5063980d641f077da073ce972028c2b07ccb1bbc", "parents": [ "f061d35150003b7fd5b133d14d66a74500fdaa60" ], "author": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Fri Mar 13 10:32:07 2009 +0100" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Fri Mar 13 10:32:07 2009 +0100" }, "message": "futex: remove the pointer math from double_unlock_hb, fix\n\nImpact: fix double unlock crash\n\nThomas Gleixner noticed that the simplified double_unlock_hb()\nbecame ... too unsophisticated: in the hb1 \u003d\u003d hb2 case it will\ndo a double unlock.\n\nReported-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Darren Hart \u003cdvhltc@us.ibm.com\u003e\nLKML-Reference: \u003c20090312221118.11146.68610.stgit@Aeon\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n" }, { "commit": "f061d35150003b7fd5b133d14d66a74500fdaa60", "tree": "4181a2a13841804ed6ccb4345d2b340eeba941a2", "parents": [ "e4dc5b7a36a49eff97050894cf1b3a9a02523717" ], "author": { "name": "Darren Hart", "email": "dvhltc@us.ibm.com", "time": "Thu Mar 12 15:11:18 2009 -0700" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Fri Mar 13 01:15:46 2009 +0100" }, "message": "futex: remove the pointer math from double_unlock_hb\n\nImpact: simplify code\n\nI mistakenly included the pointer value ordering in the\ndouble_unlock_hb() in my previous patch. It\u0027s only necessary\nin the double_lock_hb() function. This patch removes it.\n\nSigned-off-by: Darren Hart \u003cdvhltc@us.ibm.com\u003e\nAcked-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nLKML-Reference: \u003c20090312221118.11146.68610.stgit@Aeon\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n" }, { "commit": "e4dc5b7a36a49eff97050894cf1b3a9a02523717", "tree": "91a0aceb21b1869385507c2631bf97fbf180697b", "parents": [ "e8f6386c01a5699c115bdad10271a24076364c97" ], "author": { "name": "Darren Hart", "email": "dvhltc@us.ibm.com", "time": "Thu Mar 12 00:56:13 2009 -0700" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Thu Mar 12 11:20:57 2009 +0100" }, "message": "futex: clean up fault logic\n\nImpact: cleanup\n\nOlder versions of the futex code held the mmap_sem which had to\nbe dropped in order to call get_user(), so a two-pronged fault\nhandling mechanism was employed to handle faults of the atomic\noperations. The mmap_sem is no longer held, so get_user()\nshould be adequate. This patch greatly simplifies the logic and\nimproves legibility.\n\nBuild and boot tested on a 4 way Intel x86_64 workstation.\nPasses basic pthread_mutex and PI tests out of\nltp/testcases/realtime.\n\nSigned-off-by: Darren Hart \u003cdvhltc@us.ibm.com\u003e\nAcked-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nLKML-Reference: \u003c20090312075612.9856.48612.stgit@Aeon\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n" }, { "commit": "e8f6386c01a5699c115bdad10271a24076364c97", "tree": "7375a9b8961c0e0fd8e25176c7912375aaaa4d1e", "parents": [ "16f4993f4e9860715918efd4eeac928f8de1218b" ], "author": { "name": "Darren Hart", "email": "dvhltc@us.ibm.com", "time": "Thu Mar 12 00:56:06 2009 -0700" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Thu Mar 12 11:20:57 2009 +0100" }, "message": "futex: unlock before returning -EFAULT\n\nImpact: rt-mutex failure case fix\n\nfutex_lock_pi can potentially return -EFAULT with the rt_mutex\nheld. This seems like the wrong thing to do as userspace should\nassume -EFAULT means the lock was not taken. Even if it could\nfigure this out, we\u0027d be leaving the pi_state-\u003eowner in an\ninconsistent state. This patch unlocks the rt_mutex prior to\nreturning -EFAULT to userspace.\n\nBuild and boot tested on a 4 way Intel x86_64 workstation.\nPasses basic pthread_mutex and PI tests out of\nltp/testcases/realtime.\n\nSigned-off-by: Darren Hart \u003cdvhltc@us.ibm.com\u003e\nAcked-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nLKML-Reference: \u003c20090312075606.9856.88729.stgit@Aeon\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n" }, { "commit": "16f4993f4e9860715918efd4eeac928f8de1218b", "tree": "d5416de0cd3df09700e58c8148f67d6963ba19e9", "parents": [ "5eb3dc62fc5986e85715041c23dcf3832812be4b" ], "author": { "name": "Darren Hart", "email": "dvhltc@us.ibm.com", "time": "Thu Mar 12 00:55:59 2009 -0700" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Thu Mar 12 11:20:57 2009 +0100" }, "message": "futex: use current-\u003etime_slack_ns for rt tasks too\n\nRT tasks should set their timer slack to 0 on their own. This\npatch removes the \u0027if (rt_task()) slack \u003d 0;\u0027 block in\nfutex_wait.\n\nBuild and boot tested on a 4 way Intel x86_64 workstation.\nPasses basic pthread_mutex and PI tests out of\nltp/testcases/realtime.\n\nSigned-off-by: Darren Hart \u003cdvhltc@us.ibm.com\u003e\nAcked-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nCc: Arjan van de Ven \u003carjan@linux.intel.com\u003e\nLKML-Reference: \u003c20090312075559.9856.28822.stgit@Aeon\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n" }, { "commit": "5eb3dc62fc5986e85715041c23dcf3832812be4b", "tree": "e8b55b84cc50841ab7f7c87afdcc3d5e419cb4e9", "parents": [ "de87fcc124a5d4a171aa32707b3265608ebda6e7" ], "author": { "name": "Darren Hart", "email": "dvhltc@us.ibm.com", "time": "Thu Mar 12 00:55:52 2009 -0700" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Thu Mar 12 11:20:56 2009 +0100" }, "message": "futex: add double_unlock_hb()\n\nImpact: cleanup\n\nThe futex code uses double_lock_hb() which locks the hb-\u003elock\u0027s\nin pointer value order. There is no parallel unlock routine,\nand the code unlocks them in name order, ignoring pointer value.\n\nThis patch adds double_unlock_hb() to refactor the duplicated\ncode segments.\n\nBuild and boot tested on a 4 way Intel x86_64 workstation.\nPasses basic pthread_mutex and PI tests out of\nltp/testcases/realtime.\n\nSigned-off-by: Darren Hart \u003cdvhltc@us.ibm.com\u003e\nAcked-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nLKML-Reference: \u003c20090312075552.9856.48021.stgit@Aeon\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n" }, { "commit": "de87fcc124a5d4a171aa32707b3265608ebda6e7", "tree": "5ba695dc0b13c7613c8e9306f9703c1b61ef41fc", "parents": [ "b2d0994b1301fc3a6a89e1889578dac9227840e3" ], "author": { "name": "Darren Hart", "email": "dvhltc@us.ibm.com", "time": "Thu Mar 12 00:55:46 2009 -0700" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Thu Mar 12 11:20:56 2009 +0100" }, "message": "futex: additional (get|put)_futex_key() fixes\n\nImpact: fix races\n\nfutex_requeue and futex_lock_pi still had some bad\n(get|put)_futex_key() usage. This patch adds the missing\nput_futex_keys() and corrects a goto in futex_lock_pi() to avoid\na double get.\n\nBuild and boot tested on a 4 way Intel x86_64 workstation.\nPasses basic pthread_mutex and PI tests out of\nltp/testcases/realtime.\n\nSigned-off-by: Darren Hart \u003cdvhltc@us.ibm.com\u003e\nAcked-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nLKML-Reference: \u003c20090312075545.9856.75152.stgit@Aeon\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n" }, { "commit": "b2d0994b1301fc3a6a89e1889578dac9227840e3", "tree": "176a417a86d7072b014f1f872787eff7da2034de", "parents": [ "ebdcc81c71937b30e09110c02a1e8a21fa770b6f" ], "author": { "name": "Darren Hart", "email": "dvhltc@us.ibm.com", "time": "Thu Mar 12 00:55:37 2009 -0700" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Thu Mar 12 11:20:55 2009 +0100" }, "message": "futex: update futex commentary\n\nImpact: cleanup\n\nThe futex_hash_bucket can be a bit confusing when first looking\nat the code as it is a shared queue (and futex_q isn\u0027t a queue\nat all, but rather an element on the queue).\n\nThe mmap_sem is no longer held outside of the\nfutex_handle_fault() routine, yet numerous comments refer to it.\nThe fshared argument is no an integer. I left some of these\ncomments along as they are simply removed in future patches.\n\nSome of the commentary refering to futexes by virtual page\nmappings was not very clear, and completely accurate (as for\nshared futexes both the page and the offset are used to\ndetermine the key). For the purposes of the function\ndescription, just referring to \"the futex\" seems sufficient.\n\nWith hashed futexes we now access the page after the hash-bucket\nis locked, and not only after it is enqueued.\n\nSigned-off-by: Darren Hart \u003cdvhltc@us.ibm.com\u003e\nAcked-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nLKML-Reference: \u003c20090312075537.9856.29954.stgit@Aeon\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n" }, { "commit": "2fff78c784ed97a8e5aa225ef5228f0a6d862d82", "tree": "2adfba52dbd8e410909a538b7c27189932acc995", "parents": [ "6c6f1f0f4db31a192916eaa31ec2f114fda7d5e5" ], "author": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Wed Feb 11 18:10:10 2009 +0100" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Wed Feb 11 18:24:08 2009 +0100" }, "message": "futex: fix reference leak\n\nCatalin noticed that (38d47c1b7075: futex: rely on get_user_pages() for\nshared futexes) caused an mm_struct leak.\n\nSome tracing with the function graph tracer quickly pointed out that\nfutex_wait() has exit paths with unbalanced reference counts.\n\nThis regression was discovered by kmemleak.\n\nReported-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nTested-by: \"Pallipadi, Venkatesh\" \u003cvenkatesh.pallipadi@intel.com\u003e\nTested-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n" }, { "commit": "836f92adf121f806e9beb5b6b88bd5c9c4ea3f24", "tree": "0deccad6d01b7761a8d96cbc12b8e9541317380e", "parents": [ "6559eed8ca7db0531a207cd80be5e28cd6f213c5" ], "author": { "name": "Heiko Carstens", "email": "heiko.carstens@de.ibm.com", "time": "Wed Jan 14 14:14:33 2009 +0100" }, "committer": { "name": "Heiko Carstens", "email": "heiko.carstens@de.ibm.com", "time": "Wed Jan 14 14:15:31 2009 +0100" }, "message": "[CVE-2009-0029] System call wrappers part 31\n\nSigned-off-by: Heiko Carstens \u003cheiko.carstens@de.ibm.com\u003e\n" }, { "commit": "17da2bd90abf428523de0fb98f7075e00e3ed42e", "tree": "4f2daf3cb792b7da62e6ae771b58902cc5ea24ab", "parents": [ "754fe8d297bfae7b77f7ce866e2fb0c5fb186506" ], "author": { "name": "Heiko Carstens", "email": "heiko.carstens@de.ibm.com", "time": "Wed Jan 14 14:14:10 2009 +0100" }, "committer": { "name": "Heiko Carstens", "email": "heiko.carstens@de.ibm.com", "time": "Wed Jan 14 14:15:21 2009 +0100" }, "message": "[CVE-2009-0029] System call wrappers part 08\n\nSigned-off-by: Heiko Carstens \u003cheiko.carstens@de.ibm.com\u003e\n" }, { "commit": "fdbc0450df12cc9cb397f3497db4b0cad7c1a8ff", "tree": "3d266bd156f140f06b22f27784a7487bba6d6da5", "parents": [ "46483d10e5123d78cf9abf37577aa8e75f18b8a4", "90621c40cc4ab7b0a414311ce37e7cc7173403b6", "ea319518ba3de282c13ae1cf4bf2215c5e03e67e", "238c6d54830c624f34ac9cf123ac04aebfca5013" ], "author": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Tue Jan 06 09:32:11 2009 +0100" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Tue Jan 06 09:32:11 2009 +0100" }, "message": "Merge branches \u0027core/futexes\u0027, \u0027core/locking\u0027, \u0027core/rcu\u0027 and \u0027linus\u0027 into core/urgent\n" }, { "commit": "90621c40cc4ab7b0a414311ce37e7cc7173403b6", "tree": "3f5797462898f3f85bad1a31df04e671df8aadd3", "parents": [ "42d35d48ce7cefb9429880af19d1c329d1554e7a" ], "author": { "name": "Darren Hart", "email": "dvhltc@us.ibm.com", "time": "Mon Dec 29 19:43:21 2008 -0800" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Fri Jan 02 23:10:44 2009 +0100" }, "message": "futex: catch certain assymetric (get|put)_futex_key calls\n\nImpact: add debug check\n\nFollowing up on my previous key reference accounting patches, this patch\nwill catch puts on keys that haven\u0027t been \"got\". This won\u0027t catch nested\nget/put mismatches though.\n\nBuild and boot tested, with minimal desktop activity and a run of the\nopen_posix_testsuite in LTP for testing. No warnings logged.\n\nSigned-off-by: Darren Hart \u003cdvhltc@us.ibm.com\u003e\nCc: \u003cstable@kernel.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n" }, { "commit": "5f34fe1cfc1bdd8b4711bbe37421fba4ed0d1ed4", "tree": "85b21c8bb0e53005bd970d648ca093acfd0584a3", "parents": [ "eca1bf5b4fab56d2feb1572d34d59fcd92ea7df3", "6638101c1124c19c8a65b1645e4ecd09e0572f3e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 30 16:10:19 2008 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 30 16:10:19 2008 -0800" }, "message": "Merge branch \u0027core-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip\n\n* \u0027core-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: (63 commits)\n stacktrace: provide save_stack_trace_tsk() weak alias\n rcu: provide RCU options on non-preempt architectures too\n printk: fix discarding message when recursion_bug\n futex: clean up futex_(un)lock_pi fault handling\n \"Tree RCU\": scalable classic RCU implementation\n futex: rename field in futex_q to clarify single waiter semantics\n x86/swiotlb: add default swiotlb_arch_range_needs_mapping\n x86/swiotlb: add default phys\u003c-\u003ebus conversion\n x86: unify pci iommu setup and allow swiotlb to compile for 32 bit\n x86: add swiotlb allocation functions\n swiotlb: consolidate swiotlb info message printing\n swiotlb: support bouncing of HighMem pages\n swiotlb: factor out copy to/from device\n swiotlb: add arch hook to force mapping\n swiotlb: allow architectures to override phys\u003c-\u003ebus\u003c-\u003ephys conversions\n swiotlb: add comment where we handle the overflow of a dma mask on 32 bit\n rcu: fix rcutorture behavior during reboot\n resources: skip sanity check of busy resources\n swiotlb: move some definitions to header\n swiotlb: allow architectures to override swiotlb pool allocation\n ...\n\nFix up trivial conflicts in\n arch/x86/kernel/Makefile\n arch/x86/mm/init_32.c\n include/linux/hardirq.h\nas per Ingo\u0027s suggestions.\n" }, { "commit": "42d35d48ce7cefb9429880af19d1c329d1554e7a", "tree": "a8c73b7ffd1e481e3b5152e3142c9feb5f7464a1", "parents": [ "b56863630ddbdea6e22df8835f78f0b1da037103" ], "author": { "name": "Darren Hart", "email": "dvhltc@us.ibm.com", "time": "Mon Dec 29 15:49:53 2008 -0800" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Tue Dec 30 06:38:15 2008 +0100" }, "message": "futex: make futex_(get|put)_key() calls symmetric\n\nImpact: cleanup\n\nThis patch makes the calls to futex_get_key_refs() and futex_drop_key_refs()\nexplicitly symmetric by only \"putting\" keys we successfully \"got\". Also\ncleanup a couple return points that didn\u0027t \"put\" after a successful \"get\".\n\nBuild and boot tested on an x86_64 system.\n\nSigned-off-by: Darren Hart \u003cdvhltc@us.ibm.com\u003e\nCc: \u003cstable@kernel.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n" }, { "commit": "b56863630ddbdea6e22df8835f78f0b1da037103", "tree": "7b04a35cc94be4e40708855ec644bdaf69e77d65", "parents": [ "73500ac545d24610eb2cf8579ffc88957e9c5847" ], "author": { "name": "Darren Hart", "email": "dvhltc@us.ibm.com", "time": "Thu Dec 18 15:06:34 2008 -0800" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Fri Dec 19 09:20:21 2008 +0100" }, "message": "futex: clean up futex_(un)lock_pi fault handling\n\nImpact: cleanup\n\nSome apparently left over cruft code was complicating the fault logic:\n\nTesting if uval !\u003d -EFAULT doesn\u0027t have any meaning, get_user() sets ret\nto either 0 or -EFAULT, there\u0027s no need to compare uval, especially not\nagainst EFAULT which it will never be. This patch removes the superfluous\ntest and clarifies the comment blocks.\n\nBuild and boot tested on an 8way x86_64 system.\n\nSigned-off-by: Darren Hart \u003cdvhltc@us.ibm.com\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n" }, { "commit": "73500ac545d24610eb2cf8579ffc88957e9c5847", "tree": "1e36cc5585bd25a1d8cbe973d229250bee0cef32", "parents": [ "1acdac104668a0834cfa267de9946fac7764d486" ], "author": { "name": "Darren Hart", "email": "dvhltc@us.ibm.com", "time": "Wed Dec 17 17:29:56 2008 -0800" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Thu Dec 18 11:42:23 2008 +0100" }, "message": "futex: rename field in futex_q to clarify single waiter semantics\n\nImpact: simplify code\n\nI\u0027ve tripped over the naming of this field a couple times.\n\nThe futex_q uses a \"waiters\" list to represent a single blocked task and\nthen calles wake_up_all().\n\nThis can lead to confusion in trying to understand the intent of the code,\nwhich is to have a single futex_q for every task waiting on a futex.\n\nThis patch corrects the problem, using a single pointer to the waiting\ntask, and an appropriate call to wake_up, rather than wake_up_all.\n\nCompile and boot tested on an 8way x86_64 machine.\n\nSigned-off-by: Darren Hart \u003cdvhltc@us.ibm.com\u003e\nAcked-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n" }, { "commit": "1acdac104668a0834cfa267de9946fac7764d486", "tree": "bae8ffeb2425412c0bffbdf728b45104fe3178f2", "parents": [ "3e1d7a6219ab64e13b10b1a77c0625db9a8bd8db" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Thu Nov 20 10:02:53 2008 -0800" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Mon Nov 24 20:00:40 2008 +0100" }, "message": "futex: make clock selectable for FUTEX_WAIT_BITSET\n\nFUTEX_WAIT_BITSET could be used instead of FUTEX_WAIT by setting the\nbit set to FUTEX_BITSET_MATCH_ANY, but FUTEX_WAIT uses CLOCK_REALTIME\nwhile FUTEX_WAIT_BITSET uses CLOCK_MONOTONIC.\n\nAdd a flag to select CLOCK_REALTIME for FUTEX_WAIT_BITSET so glibc can\nreplace the FUTEX_WAIT logic which needs to do gettimeofday() calls\nbefore and after the syscall to convert the absolute timeout to a\nrelative timeout for FUTEX_WAIT.\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Ulrich Drepper \u003cdrepper@redhat.com\u003e\n\n" }, { "commit": "3e1d7a6219ab64e13b10b1a77c0625db9a8bd8db", "tree": "c682da7317845d7b1336e3d8498cf83bdf8f5900", "parents": [ "42569c39917a08e8de1e8b5685463be7b74baebd", "13d428afc007fcfcd6deeb215618f54cf9c0cae6" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Mon Nov 24 19:54:37 2008 +0100" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Mon Nov 24 19:54:37 2008 +0100" }, "message": "Merge branch \u0027linus\u0027 into core/futexes\n" }, { "commit": "c69e8d9c01db2adc503464993c358901c9af9de4", "tree": "bed94aaa9aeb7a7834d1c880f72b62a11a752c78", "parents": [ "86a264abe542cfececb4df129bc45a0338d8cdb9" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Nov 14 10:39:19 2008 +1100" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Fri Nov 14 10:39:19 2008 +1100" }, "message": "CRED: Use RCU to access another task\u0027s creds and to release a task\u0027s own creds\n\nUse RCU to access another task\u0027s creds and to release a task\u0027s own creds.\nThis means that it will be possible for the credentials of a task to be\nreplaced without another task (a) requiring a full lock to read them, and (b)\nseeing deallocated memory.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\nAcked-by: Serge Hallyn \u003cserue@us.ibm.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "b6dff3ec5e116e3af6f537d4caedcad6b9e5082a", "tree": "9e76f972eb7ce9b84e0146c8e4126a3f86acb428", "parents": [ "15a2460ed0af7538ca8e6c610fe607a2cd9da142" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Nov 14 10:39:16 2008 +1100" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Fri Nov 14 10:39:16 2008 +1100" }, "message": "CRED: Separate task security context from task_struct\n\nSeparate the task security context from task_struct. At this point, the\nsecurity data is temporarily embedded in the task_struct with two pointers\npointing to it.\n\nNote that the Alpha arch is altered as it refers to (E)UID and (E)GID in\nentry.S via asm-offsets.\n\nWith comment fixes Signed-off-by: Marc Dionne \u003cmarc.c.dionne@gmail.com\u003e\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\nAcked-by: Serge Hallyn \u003cserue@us.ibm.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "76aac0e9a17742e60d408be1a706e9aaad370891", "tree": "e873a000d9c96209726e0958e311f005c13b2ed5", "parents": [ "b103c59883f1ec6e4d548b25054608cb5724453c" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Nov 14 10:39:12 2008 +1100" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Fri Nov 14 10:39:12 2008 +1100" }, "message": "CRED: Wrap task credential accesses in the core kernel\n\nWrap access to task credentials so that they can be separated more easily from\nthe task_struct during the introduction of COW creds.\n\nChange most current-\u003e(|e|s|fs)[ug]id to current_(|e|s|fs)[ug]id().\n\nChange some task-\u003ee?[ug]id to task_e?[ug]id(). In some places it makes more\nsense to use RCU directly rather than a convenient wrapper; these will be\naddressed by later patches.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nReviewed-by: James Morris \u003cjmorris@namei.org\u003e\nAcked-by: Serge Hallyn \u003cserue@us.ibm.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: linux-audit@redhat.com\nCc: containers@lists.linux-foundation.org\nCc: linux-mm@kvack.org\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "42569c39917a08e8de1e8b5685463be7b74baebd", "tree": "94c451340cd59bf30d226fdc10068f4dd46b27a4", "parents": [ "c2f9f20154bfb137ccdf8c9159992429a40dfe20" ], "author": { "name": "Peter Zijlstra", "email": "a.p.zijlstra@chello.nl", "time": "Tue Sep 30 12:33:07 2008 +0200" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Tue Sep 30 12:36:02 2008 +0200" }, "message": "futex: fixup get_futex_key() for private futexes\n\nWith the get_user_pages_fast() patches we made get_futex_key() obtain a\nreference on the returned key, but failed to do so for private futexes.\n\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nAcked-by: Nick Piggin \u003cnickpiggin@yahoo.com.au\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n" }, { "commit": "c2f9f20154bfb137ccdf8c9159992429a40dfe20", "tree": "d9f38f55b9c490967393919a10929bac3d6a7dff", "parents": [ "734b05b10e51d4ba38c8fc3ee02e846aab09eedf" ], "author": { "name": "Peter Zijlstra", "email": "a.p.zijlstra@chello.nl", "time": "Fri Sep 26 19:32:23 2008 +0200" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Tue Sep 30 12:35:54 2008 +0200" }, "message": "futex: cleanup fshared\n\nfshared doesn\u0027t need to be a rw_sem pointer anymore, so clean that up.\n\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nAcked-by: Nick Piggin \u003cnickpiggin@yahoo.com.au\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n" }, { "commit": "734b05b10e51d4ba38c8fc3ee02e846aab09eedf", "tree": "f9d98cdeb64e2077a77fb8f65b4ab7e331b6fca9", "parents": [ "61270708ecf1cda148e84fbf6e0703ee5aa81814" ], "author": { "name": "Peter Zijlstra", "email": "a.p.zijlstra@chello.nl", "time": "Fri Sep 26 19:32:22 2008 +0200" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Tue Sep 30 12:35:46 2008 +0200" }, "message": "futex: use fast_gup()\n\nChange the get_user_pages() call with fast_gup() which doesn\u0027t require holding\nthe mmap_sem thereby removing the mmap_sem from all fast paths.\n\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nAcked-by: Nick Piggin \u003cnickpiggin@yahoo.com.au\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n" }, { "commit": "61270708ecf1cda148e84fbf6e0703ee5aa81814", "tree": "4c5bf27f99e5371da667e8c4105d2839e664409a", "parents": [ "38d47c1b7075bd7ec3881141bb3629da58f88dab" ], "author": { "name": "Peter Zijlstra", "email": "a.p.zijlstra@chello.nl", "time": "Fri Sep 26 19:32:21 2008 +0200" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Tue Sep 30 12:35:36 2008 +0200" }, "message": "futex: reduce mmap_sem usage\n\nnow that we rely on get_user_pages() for the shared key handling\nmove all the mmap_sem stuff closely around the slow paths.\n\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nAcked-by: Nick Piggin \u003cnickpiggin@yahoo.com.au\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n" }, { "commit": "38d47c1b7075bd7ec3881141bb3629da58f88dab", "tree": "44c6ddc753738e69c908706a6b0cad04a7b59f95", "parents": [ "94aca1dac6f6d21f4b07e4864baf7768cabcc6e7" ], "author": { "name": "Peter Zijlstra", "email": "a.p.zijlstra@chello.nl", "time": "Fri Sep 26 19:32:20 2008 +0200" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Tue Sep 30 12:35:20 2008 +0200" }, "message": "futex: rely on get_user_pages() for shared futexes\n\nOn the way of getting rid of the mmap_sem requirement for shared futexes,\nstart by relying on get_user_pages().\n\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nAcked-by: Nick Piggin \u003cnickpiggin@yahoo.com.au\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n" }, { "commit": "ae4b748e81b7e366f04f55229d5e372e372c33af", "tree": "27ce1d7a205df69c79bbdd35fc721401d79a13cb", "parents": [ "3bd012060f962567aadb52b27b2fc8fdc91102c7" ], "author": { "name": "Arjan van de Ven", "email": "arjan@linux.intel.com", "time": "Mon Sep 08 09:03:57 2008 -0700" }, "committer": { "name": "Arjan van de Ven", "email": "arjan@linux.intel.com", "time": "Thu Sep 11 07:17:00 2008 -0700" }, "message": "hrtimer: make the futex() system call use the per process slack value\n\nThis patch makes the futex() system call use the per process\nslack value; with this users are able to externally control existing\napplications to reduce the wakeup rate.\n\nSigned-off-by: Arjan van de Ven \u003carjan@linux.intel.com\u003e\n" }, { "commit": "cc584b213f252bf698849cf4be2377cd3ec7501a", "tree": "621ba11da6a2ab8598f9ed453836cd2c44192260", "parents": [ "23dd7bb09bd8d7efd8a602aed97b93d52f85e675" ], "author": { "name": "Arjan van de Ven", "email": "arjan@linux.intel.com", "time": "Mon Sep 01 15:02:30 2008 -0700" }, "committer": { "name": "Arjan van de Ven", "email": "arjan@linux.intel.com", "time": "Fri Sep 05 21:35:13 2008 -0700" }, "message": "hrtimer: convert kernel/* to the new hrtimer apis\n\nIn order to be able to do range hrtimers we need to use accessor functions\nto the \"expire\" member of the hrtimer struct.\nThis patch converts kernel/* to these accessors.\n\nSigned-off-by: Arjan van de Ven \u003carjan@linux.intel.com\u003e\n" }, { "commit": "1b7558e457ed0de61023cfc913d2c342c7c3d9f2", "tree": "fcd456b1633bfd3e68ba2f6631831fbc5336108d", "parents": [ "481c5346d0981940ee63037eb53e4e37b0735c10" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Mon Jun 23 11:21:58 2008 +0200" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Mon Jun 23 13:31:15 2008 +0200" }, "message": "futexes: fix fault handling in futex_lock_pi\n\nThis patch addresses a very sporadic pi-futex related failure in\nhighly threaded java apps on large SMP systems.\n\nDavid Holmes reported that the pi_state consistency check in\nlookup_pi_state triggered with his test application. This means that\nthe kernel internal pi_state and the user space futex variable are out\nof sync. First we assumed that this is a user space data corruption,\nbut deeper investigation revieled that the problem happend because the\npi-futex code is not handling a fault in the futex_lock_pi path when\nthe user space variable needs to be fixed up.\n\nThe fault happens when a fork mapped the anon memory which contains\nthe futex readonly for COW or the page got swapped out exactly between\nthe unlock of the futex and the return of either the new futex owner\nor the task which was the expected owner but failed to acquire the\nkernel internal rtmutex. The current futex_lock_pi() code drops out\nwith an inconsistent in case it faults and returns -EFAULT to user\nspace. User space has no way to fixup that state.\n\nWhen we wrote this code we thought that we could not drop the hash\nbucket lock at this point to handle the fault.\n\nAfter analysing the code again it turned out to be wrong because there\nare only two tasks involved which might modify the pi_state and the\nuser space variable:\n\n - the task which acquired the rtmutex\n - the pending owner of the pi_state which did not get the rtmutex\n\nBoth tasks drop into the fixup_pi_state() function before returning to\nuser space. The first task which acquired the hash bucket lock faults\nin the fixup of the user space variable, drops the spinlock and calls\nfutex_handle_fault() to fault in the page. Now the second task could\nacquire the hash bucket lock and tries to fixup the user space\nvariable as well. It either faults as well or it succeeds because the\nfirst task already faulted the page in.\n\nOne caveat is to avoid a double fixup. After returning from the fault\nhandling we reacquire the hash bucket lock and check whether the\npi_state owner has been modified already.\n\nReported-by: David Holmes \u003cdavid.holmes@sun.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: David Holmes \u003cdavid.holmes@sun.com\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: \u003cstable@kernel.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n\n kernel/futex.c | 93 ++++++++++++++++++++++++++++++++++++++++++++-------------\n 1 file changed, 73 insertions(+), 20 deletions(-)\n" }, { "commit": "82af7aca56c67061420d618cc5a30f0fd4106b80", "tree": "7542ae2436336f6cfafb4b9dc1e8bc66637a1cc9", "parents": [ "f74d505b58d36ceeef10e459094f0eb760681165" ], "author": { "name": "Eric Sesterhenn", "email": "snakebyte@gmx.de", "time": "Fri Jan 25 10:40:46 2008 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 05 08:18:45 2008 -0700" }, "message": "Removal of FUTEX_FD\n\nSince FUTEX_FD was scheduled for removal in June 2007 lets remove it.\n\nGoogle Code search found no users for it and NGPT was abandoned in 2003\naccording to IBM. futex.h is left untouched to make sure the id does\nnot get reassigned. Since queue_me() has no users left it is commented\nout to avoid a warning, i didnt remove it completely since it is part of\nthe internal api (matching unqueue_me())\n\nSigned-off-by: Eric Sesterhenn \u003csnakebyte@gmx.de\u003e\nSigned-off-by: Rusty Russell \u003crusty@rustcorp.com.au\u003e (removed rest)\nAcked-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "237fc6e7a35076f584b9d0794a5204fe4bd9b9e5", "tree": "078de7357c118b5bb84eedb38ba829205941b03b", "parents": [ "c6f3a97f86a5c97be0ca255976110bb9c3cfe669" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Wed Apr 30 00:55:04 2008 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 30 08:29:53 2008 -0700" }, "message": "add hrtimer specific debugobjects code\n\nhrtimers have now dynamic users in the network code. Put them under\ndebugobjects surveillance as well.\n\nAdd calls to the generic object debugging infrastructure and provide fixup\nfunctions which allow to keep the system alive when recoverable problems have\nbeen detected by the object debugging core code.\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Greg KH \u003cgreg@kroah.com\u003e\nCc: Randy Dunlap \u003crandy.dunlap@oracle.com\u003e\nCc: Kay Sievers \u003ckay.sievers@vrfy.org\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "9dce07f1a441b77a15631cf0ed0238e0baa7ed64", "tree": "2131d670d31ae4727b4234e3e0ad176ae103d571", "parents": [ "1076d17ac70d1bb28fadc6f4bd96977b56897025" ], "author": { "name": "Al Viro", "email": "viro@ftp.linux.org.uk", "time": "Sat Mar 29 03:07:28 2008 +0000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 30 14:18:41 2008 -0700" }, "message": "NULL noise: fs/*, mm/*, kernel/*\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "f6d107fb10def502522b10bfb7af9533afbb8274", "tree": "7fcf68e80a964a71b642d2bc1886c8060ae78fd3", "parents": [ "ee20a0dd5400e771ff93eb7f2bcc731eab1f377e" ], "author": { "name": "Benjamin Herrenschmidt", "email": "benh@ozlabs.org", "time": "Thu Mar 27 14:52:15 2008 +1100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 27 08:02:13 2008 -0700" }, "message": "Give futex init a proper name\n\nThe futex init function is called init(). This is a pain in the neck\nwhen debugging when you code dies in ... init :-)\n\nThis renames it to futex_init().\n\nSigned-off-by: Benjamin Herrenschmidt \u003cbenh@kernel.crashing.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "a0c1e9073ef7428a14309cba010633a6cd6719ea", "tree": "05ce792ddcde92e73d1bae4c8e20f607a2e7db40", "parents": [ "3e4ab747efa8e78562ec6782b08bbf21a00aba1b" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Sat Feb 23 15:23:57 2008 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Sat Feb 23 17:12:15 2008 -0800" }, "message": "futex: runtime enable pi and robust functionality\n\nNot all architectures implement futex_atomic_cmpxchg_inatomic(). The default\nimplementation returns -ENOSYS, which is currently not handled inside of the\nfutex guts.\n\nFutex PI calls and robust list exits with a held futex result in an endless\nloop in the futex code on architectures which have no support.\n\nFixing up every place where futex_atomic_cmpxchg_inatomic() is called would\nadd a fair amount of extra if/else constructs to the already complex code. It\nis also not possible to disable the robust feature before user space tries to\nregister robust lists.\n\nCompile time disabling is not a good idea either, as there are already\narchitectures with runtime detection of futex_atomic_cmpxchg_inatomic support.\n\nDetect the functionality at runtime instead by calling\ncmpxchg_futex_value_locked() with a NULL pointer from the futex initialization\ncode. This is guaranteed to fail, but the call of\nfutex_atomic_cmpxchg_inatomic() happens with pagefaults disabled.\n\nOn architectures, which use the asm-generic implementation or have a runtime\nCPU feature detection, a -ENOSYS return value disables the PI/robust features.\n\nOn architectures with a working implementation the call returns -EFAULT and\nthe PI/robust features are enabled.\n\nThe relevant syscalls return -ENOSYS and the robust list exit code is blocked,\nwhen the detection fails.\n\nFixes http://lkml.org/lkml/2008/2/11/149\nOriginally reported by: Lennart Buytenhek\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nAcked-by: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Lennert Buytenhek \u003cbuytenh@wantstofly.org\u003e\nCc: Riku Voipio \u003criku.voipio@movial.fi\u003e\nCc: \u003cstable@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "3e4ab747efa8e78562ec6782b08bbf21a00aba1b", "tree": "755b76c9f382a808c718a0289193602038b14c9b", "parents": [ "43fe105a5c91b2f00ea7f900ed307fe980410612" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Sat Feb 23 15:23:55 2008 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Sat Feb 23 17:12:15 2008 -0800" }, "message": "futex: fix init order\n\nWhen the futex init code fails to initialize the futex pseudo file system it\nreturns early without initializing the hash queues. Should the boot succeed\nthen a futex syscall which tries to enqueue a waiter on the hashqueue will\ncrash due to the unitilialized plist heads.\n\nInitialize the hash queues before the filesystem.\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nAcked-by: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Lennert Buytenhek \u003cbuytenh@wantstofly.org\u003e\nCc: Riku Voipio \u003criku.voipio@movial.fi\u003e\nCc: \u003cstable@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "5a7780e725d1bb4c3094fcc12f1c5c5faea1e988", "tree": "50fc5cde427f3854d0b84ba1037fef3fb4693e11", "parents": [ "e760e716d47b48caf98da348368fd41b4a9b9e7e" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Wed Feb 13 09:20:43 2008 +0100" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Thu Feb 14 22:08:30 2008 +0100" }, "message": "hrtimer: check relative timeouts for overflow\n\nVarious user space callers ask for relative timeouts. While we fixed\nthat overflow issue in hrtimer_start(), the sites which convert\nrelative user space values to absolute timeouts themself were uncovered.\n\nInstead of putting overflow checks into each place add a function\nwhich does the sanity checking and convert all affected callers to use\nit.\n\nThanks to Frans Pop, who reported the problem and tested the fixes.\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nAcked-by: Ingo Molnar \u003cmingo@elte.hu\u003e\nTested-by: Frans Pop \u003celendil@planet.nl\u003e\n\n" }, { "commit": "cd689985cf49f6ff5c8eddc48d98b9d581d9475d", "tree": "a1a119402f5208c45c21b855e8d2fbbaf18cfd72", "parents": [ "83e96c604e781098a2f61b8a294919bcf3abfab4" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Fri Feb 01 17:45:14 2008 +0100" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Fri Feb 01 17:45:14 2008 +0100" }, "message": "futex: Add bitset conditional wait/wakeup functionality\n\nTo allow the implementation of optimized rw-locks in user space, glibc\nneeds a possibility to select waiters for wakeup depending on a bitset\nmask.\n\nThis requires two new futex OPs: FUTEX_WAIT_BITS and FUTEX_WAKE_BITS\nThese OPs are basically the same as FUTEX_WAIT and FUTEX_WAKE plus an\nadditional argument - a bitset. Further the FUTEX_WAIT_BITS OP is\nexpecting an absolute timeout value instead of the relative one, which\nis used for the FUTEX_WAIT OP.\n\nFUTEX_WAIT_BITS calls into the kernel with a bitset. The bitset is\nstored in the futex_q structure, which is used to enqueue the waiter\ninto the hashed futex waitqueue.\n\nFUTEX_WAKE_BITS also calls into the kernel with a bitset. The wakeup\nfunction logically ANDs the bitset with the bitset stored in each\nwaiters futex_q structure. If the result is zero (i.e. none of the set\nbits in the bitsets is matching), then the waiter is not woken up. If\nthe result is not zero (i.e. one of the set bits in the bitsets is\nmatching), then the waiter is woken.\n\nThe bitset provided by the caller must be non zero. In case the\nprovided bitset is zero the kernel returns EINVAL.\n\nInternaly the new OPs are only extensions to the existing FUTEX_WAIT\nand FUTEX_WAKE functions. The existing OPs hand a bitset with all bits\nset into the futex_wait() and futex_wake() functions.\n\nSigned-off-by: Thomas Gleixner \u003ctgxl@linutronix.de\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n" }, { "commit": "83e96c604e781098a2f61b8a294919bcf3abfab4", "tree": "67c5a97b30784cdc8297dc888b1135c4f127e964", "parents": [ "9d55b9923a1b7ea8193b8875c57ec940dc2ff027" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Fri Feb 01 17:45:14 2008 +0100" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Fri Feb 01 17:45:14 2008 +0100" }, "message": "futex: Remove warn on in return fixup path\n\nThe WARN_ON() in the fixup return path of futex_lock_pi() can\ntrigger with false positives.\n\nThe following scenario happens:\nt1 holds the futex and t2 and t3 are blocked on the kernel side rt_mutex.\nt1 releases the futex (and the rt_mutex) and assigned t2 to be the next\nowner of the futex.\n\nt2 is interrupted and returns w/o acquiring the rt_mutex, before t1 can\nrelease the rtmutex.\n\nt1 releases the rtmutex and t3 becomes the pending owner of the rtmutex.\n\nt2 notices that it is the designated owner (user space variable) and\nfails to acquire the rt_mutex via trylock, because it is not allowed to\nsteal the rt_mutex from t3. Now it looks at the rt_mutex pending owner (t3)\nand assigns the futex and the pi_state to it.\n\nDuring the fixup t4 steals the rtmutex from t3.\n\nt2 returns from the fixup and the owner of the rt_mutex has changed from\nt3 to t4.\n\nThere is no need to do another round of fixups from t2. The important\npart (t2 is not returning as the user space visible owner) is\ndone. The further fixups are done, before either t3 or t4 return to\nuser space.\n\nFor the user space it is not relevant which task (t3 or t4) is the real\nowner, as long as those are both in the kernel, which is guaranteed by\nthe serialization of the hash bucket lock. Both tasks (which ever returns\nfirst to userspace - t4 because it locked the rt_mutex or t3 due to a signal)\nare going through the lock_futex_pi() return path where the ownership is\nfixed before the return to user space.\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n" }, { "commit": "3588a085cd52ef080bf72df772378e1ba6bb292f", "tree": "9c013c37431eb3a0d0da3ab14cbc4985600e82a2", "parents": [ "24e1c13c93cbdd05e4b7ea921c0050b036555adc" ], "author": { "name": "Peter Zijlstra", "email": "a.p.zijlstra@chello.nl", "time": "Fri Feb 01 17:45:13 2008 +0100" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Fri Feb 01 17:45:13 2008 +0100" }, "message": "hrtimer: fix hrtimer_init_sleeper() users\n\nthis patch:\n\n commit 37bb6cb4097e29ffee970065b74499cbf10603a3\n Author: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\n Date: Fri Jan 25 21:08:32 2008 +0100\n\n hrtimer: unlock hrtimer_wakeup\n\nBroke hrtimer_init_sleeper() users. It forgot to fix up the futex\ncaller of this function to detect the failed queueing and messed up\nthe do_nanosleep() caller in that it could leak a TASK_INTERRUPTIBLE\nstate.\n\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n" }, { "commit": "cdf71a10c7b6432d9b48e292cca2c62a0b9fa6cf", "tree": "9ddb693f20dbd2bf2dbb172b7f4ab1160238e63b", "parents": [ "bf5e5834bffc62b50cd4a201804506eb11ef1af8" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Tue Jan 08 19:47:38 2008 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Tue Jan 08 16:21:39 2008 -0800" }, "message": "futex: Prevent stale futex owner when interrupted/timeout\n\nRoland Westrelin did a great analysis of a long standing thinko in the\nreturn path of futex_lock_pi.\n\nWhile we fixed the lock steal case long ago, which was easy to trigger,\nwe never had a test case which exposed this problem and stupidly never\nthought about the reverse lock stealing scenario and the return to user\nspace with a stale state.\n\nWhen a blocked tasks returns from rt_mutex_timed_locked without holding\nthe rt_mutex (due to a signal or timeout) and at the same time the task\nholding the futex is releasing the futex and assigning the ownership of\nthe futex to the returning task, then it might happen that a third task\nacquires the rt_mutex before the final rt_mutex_trylock() of the\nreturning task happens under the futex hash bucket lock. The returning\ntask returns to user space with ETIMEOUT or EINTR, but the user space\nfutex value is assigned to this task. The task which acquired the\nrt_mutex fixes the user space futex value right after the hash bucket\nlock has been released by the returning task, but for a short period of\ntime the user space value is wrong.\n\nDetailed description is available at:\n\n https://bugzilla.redhat.com/show_bug.cgi?id\u003d400541\n\nThe fix for this is the same as we do when the rt_mutex was acquired by\na higher priority task via lock stealing from the designated new owner.\nIn that case we already fix the user space value and the internal\npi_state up before we return. This mechanism can be used to fixup the\nabove corner case as well. When the returning task, which failed to\nacquire the rt_mutex, notices that it is the designated owner of the\nfutex, then it fixes up the stale user space value and the pi_state,\nbefore returning to user space. This happens with the futex hash bucket\nlock held, so the task which acquired the rt_mutex is guaranteed to be\nblocked on the hash bucket lock. We can access the rt_mutex owner, which\ngives us the pid of the new owner, safely here as the owner is not able\nto modify (release) it while waiting on the hash bucket lock.\n\nRename the \"curr\" argument of fixup_pi_state_owner() to \"newowner\" to\navoid confusion with current and add the check for the stale state into\nthe failure path of rt_mutex_trylock() in the return path of\nunlock_futex_pi(). If the situation is detected use\nfixup_pi_state_owner() to assign everything to the owner of the\nrt_mutex.\n\nPointed-out-and-tested-by: Roland Westrelin \u003croland.westrelin@sun.com\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "cde898fa80a45bb23eab2a060fc79d0913081409", "tree": "be72916afee134f9b81b0162ae20db1b009e9762", "parents": [ "54561783ee99d73a086f3abbda3e44f87f6bf65b" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Wed Dec 05 15:46:09 2007 +0100" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Wed Dec 05 15:46:09 2007 +0100" }, "message": "futex: correctly return -EFAULT not -EINVAL\n\nreturn -EFAULT not -EINVAL. Found by review.\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n" }, { "commit": "ce6bd420f43b28038a2c6e8fbb86ad24014727b6", "tree": "e35e86507e11c375c2668a0391f4cf66bb581783", "parents": [ "e3c0ac04f980750a368f7cd5f1b8d1d2cdc1f735" ], "author": { "name": "Steven Rostedt", "email": "srostedt@redhat.com", "time": "Wed Dec 05 15:46:09 2007 +0100" }, "committer": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Wed Dec 05 15:46:09 2007 +0100" }, "message": "futex: fix for futex_wait signal stack corruption\n\nDavid Holmes found a bug in the -rt tree with respect to\npthread_cond_timedwait. After trying his test program on the latest git\nfrom mainline, I found the bug was there too. The bug he was seeing\nthat his test program showed, was that if one were to do a \"Ctrl-Z\" on a\nprocess that was in the pthread_cond_timedwait, and then did a \"bg\" on\nthat process, it would return with a \"-ETIMEDOUT\" but early. That is,\nthe timer would go off early.\n\nLooking into this, I found the source of the problem. And it is a rather\nnasty bug at that.\n\nHere\u0027s the relevant code from kernel/futex.c: (not in order in the file)\n\n[...]\nsmlinkage long sys_futex(u32 __user *uaddr, int op, u32 val,\n struct timespec __user *utime, u32 __user *uaddr2,\n u32 val3)\n{\n struct timespec ts;\n ktime_t t, *tp \u003d NULL;\n u32 val2 \u003d 0;\n int cmd \u003d op \u0026 FUTEX_CMD_MASK;\n\n if (utime \u0026\u0026 (cmd \u003d\u003d FUTEX_WAIT || cmd \u003d\u003d FUTEX_LOCK_PI)) {\n if (copy_from_user(\u0026ts, utime, sizeof(ts)) !\u003d 0)\n return -EFAULT;\n if (!timespec_valid(\u0026ts))\n return -EINVAL;\n\n t \u003d timespec_to_ktime(ts);\n if (cmd \u003d\u003d FUTEX_WAIT)\n t \u003d ktime_add(ktime_get(), t);\n tp \u003d \u0026t;\n }\n[...]\n return do_futex(uaddr, op, val, tp, uaddr2, val2, val3);\n}\n\n[...]\n\nlong do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,\n u32 __user *uaddr2, u32 val2, u32 val3)\n{\n int ret;\n int cmd \u003d op \u0026 FUTEX_CMD_MASK;\n struct rw_semaphore *fshared \u003d NULL;\n\n if (!(op \u0026 FUTEX_PRIVATE_FLAG))\n fshared \u003d \u0026current-\u003emm-\u003emmap_sem;\n\n switch (cmd) {\n case FUTEX_WAIT:\n ret \u003d futex_wait(uaddr, fshared, val, timeout);\n\n[...]\n\nstatic int futex_wait(u32 __user *uaddr, struct rw_semaphore *fshared,\n u32 val, ktime_t *abs_time)\n{\n[...]\n struct restart_block *restart;\n restart \u003d \u0026current_thread_info()-\u003erestart_block;\n restart-\u003efn \u003d futex_wait_restart;\n restart-\u003earg0 \u003d (unsigned long)uaddr;\n restart-\u003earg1 \u003d (unsigned long)val;\n restart-\u003earg2 \u003d (unsigned long)abs_time;\n restart-\u003earg3 \u003d 0;\n if (fshared)\n restart-\u003earg3 |\u003d ARG3_SHARED;\n return -ERESTART_RESTARTBLOCK;\n[...]\n\nstatic long futex_wait_restart(struct restart_block *restart)\n{\n u32 __user *uaddr \u003d (u32 __user *)restart-\u003earg0;\n u32 val \u003d (u32)restart-\u003earg1;\n ktime_t *abs_time \u003d (ktime_t *)restart-\u003earg2;\n struct rw_semaphore *fshared \u003d NULL;\n\n restart-\u003efn \u003d do_no_restart_syscall;\n if (restart-\u003earg3 \u0026 ARG3_SHARED)\n fshared \u003d \u0026current-\u003emm-\u003emmap_sem;\n return (long)futex_wait(uaddr, fshared, val, abs_time);\n}\n\nSo when the futex_wait is interrupt by a signal we break out of the\nhrtimer code and set up or return from signal. This code does not return\nback to userspace, so we set up a RESTARTBLOCK. The bug here is that we\nsave the \"abs_time\" which is a pointer to the stack variable \"ktime_t t\"\nfrom sys_futex.\n\nThis returns and unwinds the stack before we get to call our signal. On\nreturn from the signal we go to futex_wait_restart, where we update all\nthe parameters for futex_wait and call it. But here we have a problem\nwhere abs_time is no longer valid.\n\nI verified this with print statements, and sure enough, what abs_time\nwas set to ends up being garbage when we get to futex_wait_restart.\n\nThe solution I did to solve this (with input from Linus Torvalds)\nwas to add unions to the restart_block to allow system calls to\nuse the restart with specific parameters. This way the futex code now\nsaves the time in a 64bit value in the restart block instead of storing\nit on the stack.\n\nNote: I\u0027m a bit nervious to add \"linux/types.h\" and use u32 and u64\nin thread_info.h, when there\u0027s a #ifdef __KERNEL__ just below that.\nNot sure what that is there for. If this turns out to be a problem, I\u0027ve\ntested this with using \"unsigned int\" for u32 and \"unsigned long long\" for\nu64 and it worked just the same. I\u0027m using u32 and u64 just to be\nconsistent with what the futex code uses.\n\nSigned-off-by: Steven Rostedt \u003csrostedt@redhat.com\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nAcked-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "fad23fc78b959dae89768e523c3a6f5edb83bbe9", "tree": "b4a5f9844b5d2c412a92c528a84ce9cf6d2299da", "parents": [ "02c3530da6b926b31f89ba589da72eca49557edd" ], "author": { "name": "Adrian Bunk", "email": "bunk@kernel.org", "time": "Fri Nov 02 16:43:22 2007 +0100" }, "committer": { "name": "Rusty Russell", "email": "rusty@rustcorp.com.au", "time": "Mon Nov 05 21:53:46 2007 +1100" }, "message": "kernel/futex.c: make 3 functions static\n\nThe following functions can now become static again:\n- get_futex_key()\n- get_futex_key_refs()\n- drop_futex_key_refs()\n\nSigned-off-by: Adrian Bunk \u003cbunk@kernel.org\u003e\nSigned-off-by: Rusty Russell \u003crusty@rustcorp.com.au\u003e\n" }, { "commit": "228ebcbe634a30aec35132ea4375721bcc41bec0", "tree": "a875976fd5bde6e2f931aa235c34c88a2738493f", "parents": [ "b488893a390edfe027bae7a46e9af8083e740668" ], "author": { "name": "Pavel Emelyanov", "email": "xemul@openvz.org", "time": "Thu Oct 18 23:40:16 2007 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Fri Oct 19 11:53:40 2007 -0700" }, "message": "Uninline find_task_by_xxx set of functions\n\nThe find_task_by_something is a set of macros are used to find task by pid\ndepending on what kind of pid is proposed - global or virtual one. All of\nthem are wrappers above the most generic one - find_task_by_pid_type_ns() -\nand just substitute some args for it.\n\nIt turned out, that dereferencing the current-\u003ensproxy-\u003epid_ns construction\nand pushing one more argument on the stack inline cause kernel text size to\ngrow.\n\nThis patch moves all this stuff out-of-line into kernel/pid.c. Together\nwith the next patch it saves a bit less than 400 bytes from the .text\nsection.\n\nSigned-off-by: Pavel Emelyanov \u003cxemul@openvz.org\u003e\nCc: Sukadev Bhattiprolu \u003csukadev@us.ibm.com\u003e\nCc: Oleg Nesterov \u003coleg@tv-sign.ru\u003e\nCc: Paul Menage \u003cmenage@google.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nAcked-by: Ingo Molnar \u003cmingo@elte.hu\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "b488893a390edfe027bae7a46e9af8083e740668", "tree": "c469a7f99ad01005a73011c029eb5e5d15454559", "parents": [ "3eb07c8c8adb6f0572baba844ba2d9e501654316" ], "author": { "name": "Pavel Emelyanov", "email": "xemul@openvz.org", "time": "Thu Oct 18 23:40:14 2007 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Fri Oct 19 11:53:40 2007 -0700" }, "message": "pid namespaces: changes to show virtual ids to user\n\nThis is the largest patch in the set. Make all (I hope) the places where\nthe pid is shown to or get from user operate on the virtual pids.\n\nThe idea is:\n - all in-kernel data structures must store either struct pid itself\n or the pid\u0027s global nr, obtained with pid_nr() call;\n - when seeking the task from kernel code with the stored id one\n should use find_task_by_pid() call that works with global pids;\n - when showing pid\u0027s numerical value to the user the virtual one\n should be used, but however when one shows task\u0027s pid outside this\n task\u0027s namespace the global one is to be used;\n - when getting the pid from userspace one need to consider this as\n the virtual one and use appropriate task/pid-searching functions.\n\n[akpm@linux-foundation.org: build fix]\n[akpm@linux-foundation.org: nuther build fix]\n[akpm@linux-foundation.org: yet nuther build fix]\n[akpm@linux-foundation.org: remove unneeded casts]\nSigned-off-by: Pavel Emelyanov \u003cxemul@openvz.org\u003e\nSigned-off-by: Alexey Dobriyan \u003cadobriyan@openvz.org\u003e\nCc: Sukadev Bhattiprolu \u003csukadev@us.ibm.com\u003e\nCc: Oleg Nesterov \u003coleg@tv-sign.ru\u003e\nCc: Paul Menage \u003cmenage@google.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "c80544dc0b87bb65038355e7aafdc30be16b26ab", "tree": "176349304bec88a9de16e650c9919462e0dd453c", "parents": [ "0e9663ee452ffce0d429656ebbcfe69417a30e92" ], "author": { "name": "Stephen Hemminger", "email": "shemminger@linux-foundation.org", "time": "Thu Oct 18 03:07:05 2007 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Thu Oct 18 14:37:31 2007 -0700" }, "message": "sparse pointer use of zero as null\n\nGet rid of sparse related warnings from places that use integer as NULL\npointer.\n\n[akpm@linux-foundation.org: coding-style fixes]\nSigned-off-by: Stephen Hemminger \u003cshemminger@linux-foundation.org\u003e\nCc: Andi Kleen \u003cak@suse.de\u003e\nCc: Jeff Garzik \u003cjeff@garzik.org\u003e\nCc: Matt Mackall \u003cmpm@selenic.com\u003e\nCc: Ian Kent \u003craven@themaw.net\u003e\nCc: Arnd Bergmann \u003carnd@arndb.de\u003e\nCc: Davide Libenzi \u003cdavidel@xmailserver.org\u003e\nCc: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "fd5eea4214f72bd7ac77c1c5346a9c096319131a", "tree": "a92c7d1ac79a59777be72fbfdb16d4a410df6de6", "parents": [ "4f9a58d75bfe82ab2b8ba5b8506dfb190a267834" ], "author": { "name": "Andrey Mirkin", "email": "major@openvz.org", "time": "Tue Oct 16 23:30:13 2007 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Wed Oct 17 08:43:00 2007 -0700" }, "message": "change inotifyfs magic as the same magic is used for futexfs\n\nRight now futexfs and inotifyfs have one magic 0xBAD1DEA, that looks a\nlittle bit confusing. Use 0xBAD1DEA as magic for futexfs and 0x2BAD1DEA as\nmagic for inotifyfs.\n\nSigned-off-by: Andrey Mirkin \u003cmajor@openvz.org\u003e\nAcked-by: Randy Dunlap \u003crandy.dunlap@oracle.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "9f96cb1e8bca179a92afa40dfc3c49990f1cfc71", "tree": "7d1f921f488aa570083420dc3846856b17a7b2b6", "parents": [ "8792f961ba8057d9f27987def3600253a3ba060f" ], "author": { "name": "Martin Schwidefsky", "email": "schwidefsky@de.ibm.com", "time": "Mon Oct 01 01:20:13 2007 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Mon Oct 01 07:52:23 2007 -0700" }, "message": "robust futex thread exit race\n\nCalling handle_futex_death in exit_robust_list for the different robust\nmutexes of a thread basically frees the mutex. Another thread might grab\nthe lock immediately which updates the next pointer of the mutex.\nfetch_robust_entry over the next pointer might therefore branch into the\nrobust mutex list of a different thread. This can cause two problems: 1)\nsome mutexes held by the dead thread are not getting freed and 2) some\nmutexs held by a different thread are freed.\n\nThe next point need to be read before calling handle_futex_death.\n\nSigned-off-by: Martin Schwidefsky \u003cschwidefsky@de.ibm.com\u003e\nAcked-by: Ingo Molnar \u003cmingo@elte.hu\u003e\nAcked-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "187226f57f1381cfc63216979b4375f30e593795", "tree": "0bda40993e1794363bf6570614584b03f1de55e9", "parents": [ "42b88e6ad4014d290d6b59dfeb5d6949c5a3f346" ], "author": { "name": "john stultz", "email": "johnstul@us.ibm.com", "time": "Wed Aug 22 14:01:10 2007 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Wed Aug 22 19:52:44 2007 -0700" }, "message": "futex_unlock_pi() hurts my brain and may cause application deadlock\n\nAvoid futex_unlock_pi returning -EFAULT (which results in deadlock), by\nclearing uval before jumping to retry_locked.\n\nSigned-off-by: John Stultz \u003cjohnstul@us.ibm.com\u003e\nAcked-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "f54f098612d7f86463b5fb4763d03533d634de73", "tree": "22c18dd521e6a182647ad8304ab28434060f0c8c", "parents": [ "c0f3358621dc746219d49a9dee1799704d3a32f8" ], "author": { "name": "Andreas Schwab", "email": "schwab@suse.de", "time": "Tue Jul 31 00:38:51 2007 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Tue Jul 31 15:39:40 2007 -0700" }, "message": "futex: pass nr_wake2 to futex_wake_op\n\nThe fourth argument of sys_futex is ignored when op \u003d\u003d FUTEX_WAKE_OP,\nbut futex_wake_op expects it as its nr_wake2 parameter.\n\nThe only user of this operation in glibc is always passing 1, so this\nbug had no consequences so far.\n\nSigned-off-by: Andreas Schwab \u003cschwab@suse.de\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nSigned-off-by: Ulrich Drepper \u003cdrepper@redhat.com\u003e\nCc: \u003cstable@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "83c54070ee1a2d05c89793884bea1a03f2851ed4", "tree": "dc732f5a9b93fb7004ed23f551bd98b77cc580e0", "parents": [ "d0217ac04ca6591841e5665f518e38064f4e65bd" ], "author": { "name": "Nick Piggin", "email": "npiggin@suse.de", "time": "Thu Jul 19 01:47:05 2007 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Thu Jul 19 10:04:41 2007 -0700" }, "message": "mm: fault feedback #2\n\nThis patch completes Linus\u0027s wish that the fault return codes be made into\nbit flags, which I agree makes everything nicer. This requires requires\nall handle_mm_fault callers to be modified (possibly the modifications\nshould go further and do things like fault accounting in handle_mm_fault --\nhowever that would be for another patch).\n\n[akpm@linux-foundation.org: fix alpha build]\n[akpm@linux-foundation.org: fix s390 build]\n[akpm@linux-foundation.org: fix sparc build]\n[akpm@linux-foundation.org: fix sparc64 build]\n[akpm@linux-foundation.org: fix ia64 build]\nSigned-off-by: Nick Piggin \u003cnpiggin@suse.de\u003e\nCc: Richard Henderson \u003crth@twiddle.net\u003e\nCc: Ivan Kokshaysky \u003cink@jurassic.park.msu.ru\u003e\nCc: Russell King \u003crmk@arm.linux.org.uk\u003e\nCc: Ian Molton \u003cspyro@f2s.com\u003e\nCc: Bryan Wu \u003cbryan.wu@analog.com\u003e\nCc: Mikael Starvik \u003cstarvik@axis.com\u003e\nCc: David Howells \u003cdhowells@redhat.com\u003e\nCc: Yoshinori Sato \u003cysato@users.sourceforge.jp\u003e\nCc: \"Luck, Tony\" \u003ctony.luck@intel.com\u003e\nCc: Hirokazu Takata \u003ctakata@linux-m32r.org\u003e\nCc: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\nCc: Roman Zippel \u003czippel@linux-m68k.org\u003e\nCc: Greg Ungerer \u003cgerg@uclinux.org\u003e\nCc: Matthew Wilcox \u003cwilly@debian.org\u003e\nCc: Paul Mackerras \u003cpaulus@samba.org\u003e\nCc: Benjamin Herrenschmidt \u003cbenh@kernel.crashing.org\u003e\nCc: Heiko Carstens \u003cheiko.carstens@de.ibm.com\u003e\nCc: Martin Schwidefsky \u003cschwidefsky@de.ibm.com\u003e\nCc: Paul Mundt \u003clethal@linux-sh.org\u003e\nCc: Kazumoto Kojima \u003ckkojima@rr.iij4u.or.jp\u003e\nCc: Richard Curnow \u003crc@rc0.org.uk\u003e\nCc: William Lee Irwin III \u003cwli@holomorphy.com\u003e\nCc: \"David S. Miller\" \u003cdavem@davemloft.net\u003e\nCc: Jeff Dike \u003cjdike@addtoit.com\u003e\nCc: Paolo \u0027Blaisorblade\u0027 Giarrusso \u003cblaisorblade@yahoo.it\u003e\nCc: Miles Bader \u003cuclinux-v850@lsi.nec.co.jp\u003e\nCc: Chris Zankel \u003cchris@zankel.net\u003e\nAcked-by: Kyle McMartin \u003ckyle@mcmartin.ca\u003e\nAcked-by: Haavard Skinnemoen \u003chskinnemoen@atmel.com\u003e\nAcked-by: Ralf Baechle \u003cralf@linux-mips.org\u003e\nAcked-by: Andi Kleen \u003cak@muc.de\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n[ Still apparently needs some ARM and PPC loving - Linus ]\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "36cf3b5c3b7228bcf5124c530d50080b61a59f69", "tree": "c131870530e22371da47ad7b717f61d7cb00a84e", "parents": [ "0746aec3c75f23de0148774ac50cf73161f09d68" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Sun Jul 15 23:41:20 2007 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Mon Jul 16 09:05:49 2007 -0700" }, "message": "FUTEX: Tidy up the code\n\nThe recent PRIVATE and REQUEUE_PI changes to the futex code made it hard to\nread. Tidy it up.\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "a06381fec77bf88ec6c5eb6324457cb04e9ffd69", "tree": "0762df31cf5e20cc52705cf7960b065922eeb1f3", "parents": [ "b2510b1696730307e7a388ea04132236ab45ac20" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Sat Jun 23 11:48:40 2007 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Sun Jun 24 12:08:53 2007 -0700" }, "message": "FUTEX: Restore the dropped ERSCH fix\n\nThe return value of futex_find_get_task() needs to be -ESRCH in case\nthat the search fails. This was part of the original futex fixes and\ngot accidentally dropped, when the futex-tidy-up patch was split out.\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Stable Team \u003cstable@kernel.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "bd197234b0a616c8f04f6b682326a5a24b33ca92", "tree": "1c31f8934b0d5472c9038c042ff27d08b52ffdc6", "parents": [ "188e1f81ba31af1b65a2f3611df4c670b092bbac" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Sun Jun 17 21:11:10 2007 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Mon Jun 18 09:48:41 2007 -0700" }, "message": "Revert \"futex_requeue_pi optimization\"\n\nThis reverts commit d0aa7a70bf03b9de9e995ab272293be1f7937822.\n\nIt not only introduced user space visible changes to the futex syscall,\nit is also non-functional and there is no way to fix it proper before\nthe 2.6.22 release.\n\nThe breakage report ( http://lkml.org/lkml/2007/5/12/17 ) went\nunanswered, and unfortunately it turned out that the concept is not\nfeasible at all. It violates the rtmutex semantics badly by introducing\na virtual owner, which hacks around the coupling of the user-space\npi_futex and the kernel internal rt_mutex representation.\n\nAt the moment the only safe option is to remove it fully as it contains\nuser-space visible changes to broken kernel code, which we do not want\nto expose in the 2.6.22 release.\n\nThe patch reverts the original patch mostly 1:1, but contains a couple\nof trivial manual cleanups which were necessary due to patches, which\ntouched the same area of code later.\n\nVerified against the glibc tests and my own PI futex tests.\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nAcked-by: Ingo Molnar \u003cmingo@elte.hu\u003e\nAcked-by: Ulrich Drepper \u003cdrepper@redhat.com\u003e\nCc: Pierre Peiffer \u003cpierre.peiffer@bull.net\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "778e9a9c3e7193ea9f434f382947155ffb59c755", "tree": "2ceb8c7ce1d55124982b77966dcd65cee5cc623b", "parents": [ "1a539a87280b3032fd12bc93a4a82f1d8aa97ca8" ], "author": { "name": "Alexey Kuznetsov", "email": "kuznet@ms2.inr.ac.ru", "time": "Fri Jun 08 13:47:00 2007 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Fri Jun 08 17:23:34 2007 -0700" }, "message": "pi-futex: fix exit races and locking problems\n\n1. New entries can be added to tsk-\u003epi_state_list after task completed\n exit_pi_state_list(). The result is memory leakage and deadlocks.\n\n2. handle_mm_fault() is called under spinlock. The result is obvious.\n\n3. results in self-inflicted deadlock inside glibc.\n Sometimes futex_lock_pi returns -ESRCH, when it is not expected\n and glibc enters to for(;;) sleep() to simulate deadlock. This problem\n is quite obvious and I think the patch is right. Though it looks like\n each \"if\" in futex_lock_pi() got some stupid special case \"else if\". :-)\n\n4. sometimes futex_lock_pi() returns -EDEADLK,\n when nobody has the lock. The reason is also obvious (see comment\n in the patch), but correct fix is far beyond my comprehension.\n I guess someone already saw this, the chunk:\n\n if (rt_mutex_trylock(\u0026q.pi_state-\u003epi_mutex))\n ret \u003d 0;\n\n is obviously from the same opera. But it does not work, because the\n rtmutex is really taken at this point: wake_futex_pi() of previous\n owner reassigned it to us. My fix works. But it looks very stupid.\n I would think about removal of shift of ownership in wake_futex_pi()\n and making all the work in context of process taking lock.\n\nFrom: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n\nFix 1) Avoid the tasklist lock variant of the exit race fix by adding\n an additional state transition to the exit code.\n\n This fixes also the issue, when a task with recursive segfaults\n is not able to release the futexes.\n\nFix 2) Cleanup the lookup_pi_state() failure path and solve the -ESRCH\n problem finally.\n\nFix 3) Solve the fixup_pi_state_owner() problem which needs to do the fixup\n in the lock protected section by using the in_atomic userspace access\n functions.\n\n This removes also the ugly lock drop / unqueue inside of fixup_pi_state()\n\nFix 4) Fix a stale lock in the error path of futex_wake_pi()\n\nAdded some error checks for verification.\n\nThe -EDEADLK problem is solved by the rtmutex fixups.\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nAcked-by: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Steven Rostedt \u003crostedt@goodmis.org\u003e\nCc: Ulrich Drepper \u003cdrepper@redhat.com\u003e\nCc: Eric Dumazet \u003cdada1@cosmosbay.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "34f01cc1f512fa783302982776895c73714ebbc2", "tree": "776b50ee9592803853b3b4c1845f8ba527b868b9", "parents": [ "d0aa7a70bf03b9de9e995ab272293be1f7937822" ], "author": { "name": "Eric Dumazet", "email": "dada1@cosmosbay.com", "time": "Wed May 09 02:35:04 2007 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Wed May 09 12:30:55 2007 -0700" }, "message": "FUTEX: new PRIVATE futexes\n\n Analysis of current linux futex code :\n --------------------------------------\n\nA central hash table futex_queues[] holds all contexts (futex_q) of waiting\nthreads.\n\nEach futex_wait()/futex_wait() has to obtain a spinlock on a hash slot to\nperform lookups or insert/deletion of a futex_q.\n\nWhen a futex_wait() is done, calling thread has to :\n\n1) - Obtain a read lock on mmap_sem to be able to validate the user pointer\n (calling find_vma()). This validation tells us if the futex uses\n an inode based store (mapped file), or mm based store (anonymous mem)\n\n2) - compute a hash key\n\n3) - Atomic increment of reference counter on an inode or a mm_struct\n\n4) - lock part of futex_queues[] hash table\n\n5) - perform the test on value of futex.\n\t(rollback is value !\u003d expected_value, returns EWOULDBLOCK)\n\t(various loops if test triggers mm faults)\n\n6) queue the context into hash table, release the lock got in 4)\n\n7) - release the read_lock on mmap_sem\n\n \u003cblock\u003e\n\n8) Eventually unqueue the context (but rarely, as this part  may be done\n by the futex_wake())\n\nFutexes were designed to improve scalability but current implementation has\nvarious problems :\n\n- Central hashtable :\n\n This means scalability problems if many processes/threads want to use\n futexes at the same time.\n This means NUMA unbalance because this hashtable is located on one node.\n\n- Using mmap_sem on every futex() syscall :\n\n Even if mmap_sem is a rw_semaphore, up_read()/down_read() are doing atomic\n ops on mmap_sem, dirtying cache line :\n - lot of cache line ping pongs on SMP configurations.\n\n mmap_sem is also extensively used by mm code (page faults, mmap()/munmap())\n Highly threaded processes might suffer from mmap_sem contention.\n\n mmap_sem is also used by oprofile code. Enabling oprofile hurts threaded\n programs because of contention on the mmap_sem cache line.\n\n- Using an atomic_inc()/atomic_dec() on inode ref counter or mm ref counter:\n It\u0027s also a cache line ping pong on SMP. It also increases mmap_sem hold time\n because of cache misses.\n\nMost of these scalability problems come from the fact that futexes are in\none global namespace. As we use a central hash table, we must make sure\nthey are all using the same reference (given by the mm subsystem). We\nchose to force all futexes be \u0027shared\u0027. This has a cost.\n\nBut fact is POSIX defined PRIVATE and SHARED, allowing clear separation,\nand optimal performance if carefuly implemented. Time has come for linux\nto have better threading performance.\n\nThe goal is to permit new futex commands to avoid :\n - Taking the mmap_sem semaphore, conflicting with other subsystems.\n - Modifying a ref_count on mm or an inode, still conflicting with mm or fs.\n\nThis is possible because, for one process using PTHREAD_PROCESS_PRIVATE\nfutexes, we only need to distinguish futexes by their virtual address, no\nmatter the underlying mm storage is.\n\nIf glibc wants to exploit this new infrastructure, it should use new\n_PRIVATE futex subcommands for PTHREAD_PROCESS_PRIVATE futexes. And be\nprepared to fallback on old subcommands for old kernels. Using one global\nvariable with the FUTEX_PRIVATE_FLAG or 0 value should be OK.\n\nPTHREAD_PROCESS_SHARED futexes should still use the old subcommands.\n\nCompatibility with old applications is preserved, they still hit the\nscalability problems, but new applications can fly :)\n\nNote : the same SHARED futex (mapped on a file) can be used by old binaries\n*and* new binaries, because both binaries will use the old subcommands.\n\nNote : Vast majority of futexes should be using PROCESS_PRIVATE semantic,\nas this is the default semantic. Almost all applications should benefit\nof this changes (new kernel and updated libc)\n\nSome bench results on a Pentium M 1.6 GHz (SMP kernel on a UP machine)\n\n/* calling futex_wait(addr, value) with value !\u003d *addr */\n433 cycles per futex(FUTEX_WAIT) call (mixing 2 futexes)\n424 cycles per futex(FUTEX_WAIT) call (using one futex)\n334 cycles per futex(FUTEX_WAIT_PRIVATE) call (mixing 2 futexes)\n334 cycles per futex(FUTEX_WAIT_PRIVATE) call (using one futex)\nFor reference :\n187 cycles per getppid() call\n188 cycles per umask() call\n181 cycles per ni_syscall() call\n\nSigned-off-by: Eric Dumazet \u003cdada1@cosmosbay.com\u003e\nPierre Peiffer \u003cpierre.peiffer@bull.net\u003e\nCc: \"Ulrich Drepper\" \u003cdrepper@gmail.com\u003e\nCc: \"Nick Piggin\" \u003cnickpiggin@yahoo.com.au\u003e\nCc: \"Ingo Molnar\" \u003cmingo@elte.hu\u003e\nCc: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "d0aa7a70bf03b9de9e995ab272293be1f7937822", "tree": "194b30b7b8374b946f166996cb99fb95eb3b7819", "parents": [ "c19384b5b296905d4988c7c684ff540a0f9d65be" ], "author": { "name": "Pierre Peiffer", "email": "pierre.peiffer@bull.net", "time": "Wed May 09 02:35:02 2007 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Wed May 09 12:30:55 2007 -0700" }, "message": "futex_requeue_pi optimization\n\nThis patch provides the futex_requeue_pi functionality, which allows some\nthreads waiting on a normal futex to be requeued on the wait-queue of a\nPI-futex.\n\nThis provides an optimization, already used for (normal) futexes, to be used\nwith the PI-futexes.\n\nThis optimization is currently used by the glibc in pthread_broadcast, when\nusing \"normal\" mutexes. With futex_requeue_pi, it can be used with\nPRIO_INHERIT mutexes too.\n\nSigned-off-by: Pierre Peiffer \u003cpierre.peiffer@bull.net\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Ulrich Drepper \u003cdrepper@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "c19384b5b296905d4988c7c684ff540a0f9d65be", "tree": "071cfe0855d409d63de80ec1b9b663738efb09de", "parents": [ "ec92d08292d3e9b0823eba138a4564d2d39f25c7" ], "author": { "name": "Pierre Peiffer", "email": "pierre.peiffer@bull.net", "time": "Wed May 09 02:35:02 2007 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Wed May 09 12:30:55 2007 -0700" }, "message": "Make futex_wait() use an hrtimer for timeout\n\nThis patch modifies futex_wait() to use an hrtimer + schedule() in place of\nschedule_timeout().\n\nschedule_timeout() is tick based, therefore the timeout granularity is the\ntick (1 ms, 4 ms or 10 ms depending on HZ). By using a high resolution timer\nfor timeout wakeup, we can attain a much finer timeout granularity (in the\nmicrosecond range). This parallels what is already done for futex_lock_pi().\n\nThe timeout passed to the syscall is no longer converted to jiffies and is\ntherefore passed to do_futex() and futex_wait() as an absolute ktime_t\ntherefore keeping nanosecond resolution.\n\nAlso this removes the need to pass the nanoseconds timeout part to\nfutex_lock_pi() in val2.\n\nIn futex_wait(), if there is no timeout then a regular schedule() is\nperformed. Otherwise, an hrtimer is fired before schedule() is called.\n\n[akpm@linux-foundation.org: fix `make headers_check\u0027]\nSigned-off-by: Sebastien Dugue \u003csebastien.dugue@bull.net\u003e\nSigned-off-by: Pierre Peiffer \u003cpierre.peiffer@bull.net\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Ulrich Drepper \u003cdrepper@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "ec92d08292d3e9b0823eba138a4564d2d39f25c7", "tree": "4dc94792e83d51b036d52e92e8d4f137a2efce97", "parents": [ "f34c506b0385b43abd25c490335036ecbb173aed" ], "author": { "name": "Pierre Peiffer", "email": "pierre.peiffer@bull.net", "time": "Wed May 09 02:35:00 2007 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Wed May 09 12:30:55 2007 -0700" }, "message": "futex priority based wakeup\n\nToday, all threads waiting for a given futex are woken in FIFO order (first\nwaiter woken first) instead of priority order.\n\nThis patch makes use of plist (pirotity ordered lists) instead of simple list\nin futex_hash_bucket.\n\nAll non-RT threads are stored with priority MAX_RT_PRIO, causing them to be\nwoken last, in FIFO order (RT-threads are woken first, in priority order).\n\nSigned-off-by: Sebastien Dugue \u003csebastien.dugue@bull.net\u003e\nSigned-off-by: Pierre Peiffer \u003cpierre.peiffer@bull.net\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Ulrich Drepper \u003cdrepper@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "72c1bbf308c75a136803d2d76d0e18258be14c7a", "tree": "647fe566121ba004590e5b639ae791ec4af7955d", "parents": [ "9adef58b1d4fbb58d7daed931b6790c5a3b7543a" ], "author": { "name": "Nick Piggin", "email": "npiggin@suse.de", "time": "Tue May 08 00:26:43 2007 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Tue May 08 11:15:03 2007 -0700" }, "message": "futex: restartable futex_wait\n\nLTP test sigaction_16_24 fails, because it expects sem_wait to be restarted\nif SA_RESTART is set. sem_wait is implemented with futex_wait, that\ncurrently doesn\u0027t support being restarted. Ulrich confirms that the call\nshould be restartable.\n\nImplement a restart_block method to handle the relative timeout, and allow\nrestarts.\n\nSigned-off-by: Nick Piggin \u003cnpiggin@suse.de\u003e\nCc: Ulrich Drepper \u003cdrepper@redhat.com\u003e\nCc: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nCc: Roland McGrath \u003croland@redhat.com\u003e\nCc: Oleg Nesterov \u003coleg@tv-sign.ru\u003e\nAcked-by: Ingo Molnar \u003cmingo@elte.hu\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "9adef58b1d4fbb58d7daed931b6790c5a3b7543a", "tree": "23e5ea2b0a140d244f2ed203b4954309d052e43d", "parents": [ "aa5bd7e929325dbb48be43c3dccf7d1da433e38e" ], "author": { "name": "Rusty Russell", "email": "rusty@rustcorp.com.au", "time": "Tue May 08 00:26:42 2007 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Tue May 08 11:15:03 2007 -0700" }, "message": "futex: get_futex_key, get_key_refs and drop_key_refs\n\nlguest uses the convenient futex infrastructure for inter-domain I/O, so\nexpose get_futex_key, get_key_refs (renamed get_futex_key_refs) and\ndrop_key_refs (renamed drop_futex_key_refs). Also means we need to expose the\nunion that these use.\n\nNo code changes.\n\nSigned-off-by: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nCc: Andi Kleen \u003cak@suse.de\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "21778867b1c8e0feb567addb6dc0a7e2ca6ecdec", "tree": "a88a1a8f9a469f0b9e94a2025a6d1990ee9fc407", "parents": [ "d3a7b6df4951170079252402fd0c2dc70cb0ca2a" ], "author": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Fri Mar 16 13:38:31 2007 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Fri Mar 16 19:25:06 2007 -0700" }, "message": "[PATCH] futex: PI state locking fix\n\nTesting of -rt by IBM uncovered a locking bug in wake_futex_pi(): the PI\nstate needs to be locked before we access it.\n\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\nAcked-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Chuck Ebbert \u003ccebbert@redhat.com\u003e\nCc: \u003cstable@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "c9cb2e3d7c9178ab75d0942f96abb3abe0369906", "tree": "2d4a5470ece5efe82463653678c491c2f249d560", "parents": [ "fd064b9b7770d5c7705bf9542950c7bd81c30f98" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Fri Feb 16 01:27:49 2007 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Fri Feb 16 08:13:58 2007 -0800" }, "message": "[PATCH] hrtimers: namespace and enum cleanup\n\n- hrtimers did not use the hrtimer_restart enum and relied on the implict\n int representation. Fix the prototypes and the functions using the enums.\n- Use seperate name spaces for the enumerations\n- Convert hrtimer_restart macro to inline function\n- Add comments\n\nNo functional changes.\n\n[akpm@osdl.org: fix input driver]\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: john stultz \u003cjohnstul@us.ibm.com\u003e\nCc: Roman Zippel \u003czippel@linux-m68k.org\u003e\nCc: Dmitry Torokhov \u003cdtor@mail.ru\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "f3a43f3f64bff8e205c3702f6b4804d66e306848", "tree": "355a340fa26d3b72aa967119a6948ff45d46a0d0", "parents": [ "c941192aafe053ae445fb22f5d89bd34794c5442" ], "author": { "name": "Josef \"Jeff\" Sipek", "email": "jsipek@cs.sunysb.edu", "time": "Fri Dec 08 02:36:43 2006 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.osdl.org", "time": "Fri Dec 08 08:28:42 2006 -0800" }, "message": "[PATCH] kernel: change uses of f_{dentry, vfsmnt} to use f_path\n\nChange all the uses of f_{dentry,vfsmnt} to f_path.{dentry,mnt} in\nlinux/kernel/.\n\nSigned-off-by: Josef \"Jeff\" Sipek \u003cjsipek@cs.sunysb.edu\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "15ad7cdcfd76450d4beebc789ec646664238184d", "tree": "279d05a76ae0906c23ee2de8c5684d95d9886ad3", "parents": [ "4a08a9f68168e547c2baf100020e9b96cae5fbd1" ], "author": { "name": "Helge Deller", "email": "deller@gmx.de", "time": "Wed Dec 06 20:40:36 2006 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.osdl.org", "time": "Thu Dec 07 08:39:46 2006 -0800" }, "message": "[PATCH] struct seq_operations and struct file_operations constification\n\n - move some file_operations structs into the .rodata section\n\n - move static strings from policy_types[] array into the .rodata section\n\n - fix generic seq_operations usages, so that those structs may be defined\n as \"const\" as well\n\n[akpm@osdl.org: couple of fixes]\nSigned-off-by: Helge Deller \u003cdeller@gmx.de\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "ccdea2f88b5689f0fd29c3804be43a3acf0311e3", "tree": "573e44a4107850e6e8a61c5845c7e60beeecb27a", "parents": [ "e384bd1692bab6a1d9aa40c849ac373a68769de2" ], "author": { "name": "Ralf Baechle", "email": "ralf@linux-mips.org", "time": "Wed Dec 06 20:40:26 2006 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.osdl.org", "time": "Thu Dec 07 08:39:45 2006 -0800" }, "message": "[PATCH] futex: remove unneeded barrier\n\nWhen disassembling a kernel I found around over 90 sync Instructions from\nmb, rmb and wmb calls in the kernel and only few of those make any sense to\nme. So here\u0027s the first one - I think the wmb() in kernel/futex.c is not\nneeded on uniprocessors so should become an smb_wmb().\n\nSigned-off-by: Ralf Baechle \u003cralf@linux-mips.org\u003e\nAcked-by: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "95362fa90312ff2d52c0b4d42412cd7ceeb3b89b", "tree": "9cb55f4dd53324500b84953f17490abea45cdf72", "parents": [ "01afb2134ed079fa4551b4d26f62423df6790c09" ], "author": { "name": "Akinobu Mita", "email": "akinobu.mita@gmail.com", "time": "Wed Dec 06 20:39:03 2006 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.osdl.org", "time": "Thu Dec 07 08:39:41 2006 -0800" }, "message": "[PATCH] futex: init error check\n\nCheck register_filesystem() and kern_mount() return values.\n\nCc: Ingo Molnar \u003cmingo@redhat.com\u003e\nSigned-off-by: Akinobu Mita \u003cakinobu.mita@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "4668edc334ee90cf50c382c3e423cfc510b5a126", "tree": "ee25ca93e72031f7f333b6c251a57a55ef089c90", "parents": [ "304e61e6fbadec586dfe002b535f169a04248e49" ], "author": { "name": "Burman Yan", "email": "yan_952@hotmail.com", "time": "Wed Dec 06 20:38:51 2006 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.osdl.org", "time": "Thu Dec 07 08:39:41 2006 -0800" }, "message": "[PATCH] kernel core: replace kmalloc+memset with kzalloc\n\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "a866374aecc90c7d90619727ccd851ac096b2fc7", "tree": "eabae0b36b5281dcef20563470c7f05549689b8c", "parents": [ "6edaf68a87d17570790fd55f0c451a29ec1d6703" ], "author": { "name": "Peter Zijlstra", "email": "a.p.zijlstra@chello.nl", "time": "Wed Dec 06 20:32:20 2006 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.osdl.org", "time": "Thu Dec 07 08:39:21 2006 -0800" }, "message": "[PATCH] mm: pagefault_{disable,enable}()\n\nIntroduce pagefault_{disable,enable}() and use these where previously we did\nmanual preempt increments/decrements to make the pagefault handler do the\natomic thing.\n\nCurrently they still rely on the increased preempt count, but do not rely on\nthe disabled preemption, this might go away in the future.\n\n(NOTE: the extra barrier() in pagefault_disable might fix some holes on\n machines which have too many registers for their own good)\n\n[heiko.carstens@de.ibm.com: s390 fix]\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nAcked-by: Nick Piggin \u003cnpiggin@suse.de\u003e\nCc: Martin Schwidefsky \u003cschwidefsky@de.ibm.com\u003e\nSigned-off-by: Heiko Carstens \u003cheiko.carstens@de.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "19c6b6ed3f597a583f58e3fc99256cc01ae8c394", "tree": "3d466c426c1f91cfc1a0a883bda8faffbdac9626", "parents": [ "f46c483357c2d87606bbefb511321e3efd4baae0" ], "author": { "name": "Andrew Morton", "email": "akpm@osdl.org", "time": "Thu Nov 02 22:07:17 2006 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Fri Nov 03 12:27:58 2006 -0800" }, "message": "[PATCH] schedule removal of FUTEX_FD\n\nApparently FUTEX_FD is unfixably racy and nothing uses it (or if it does, it\nshouldn\u0027t).\n\nAdd a warning printk, give any remaining users six months to migrate off it.\n\nCc: Ulrich Drepper \u003cdrepper@redhat.com\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nAcked-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nCc: Alan Cox \u003calan@lxorguk.ukuu.org.uk\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "ba46df984b8e8114c3cf19c51670fab084bd4196", "tree": "ed41e3a2278dfc22bd7fda59e99d8c74af8f429d", "parents": [ "28c4dadd3a7221f5b9cd5c7d03c499788b193353" ], "author": { "name": "Al Viro", "email": "viro@ftp.linux.org.uk", "time": "Tue Oct 10 22:46:07 2006 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Tue Oct 10 15:37:22 2006 -0700" }, "message": "[PATCH] __user annotations: futex\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "609d7fa9565c754428d2520cac2accc9052e1245", "tree": "1c5114ec3720166fe99ce3885e8767929a8a84e0", "parents": [ "bde0d2c98bcfc9acc83ac79c33a6ac1335b95a92" ], "author": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Mon Oct 02 02:17:15 2006 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Mon Oct 02 07:57:14 2006 -0700" }, "message": "[PATCH] file: modify struct fown_struct to use a struct pid\n\nFile handles can be requested to send sigio and sigurg to processes. By\ntracking the destination processes using struct pid instead of pid_t we make\nthe interface safe from all potential pid wrap around problems.\n\nSigned-off-by: Eric W. Biederman \u003cebiederm@xmission.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "aaa2a97eb9c0e91d7abc66bf76811a9599fdb3ee", "tree": "90d45393fe0116e53412f8f8afa4e8b538177832", "parents": [ "d359b549bf3d7f42f0084918a4816ea4572e507c" ], "author": { "name": "Oleg Nesterov", "email": "oleg@tv-sign.ru", "time": "Fri Sep 29 02:00:55 2006 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Fri Sep 29 09:18:18 2006 -0700" }, "message": "[PATCH] sys_get_robust_list(): don\u0027t take tasklist_lock\n\nuse rcu locks for find_task_by_pid().\n\nSigned-off-by: Oleg Nesterov \u003coleg@tv-sign.ru\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "d359b549bf3d7f42f0084918a4816ea4572e507c", "tree": "a154a9b1913a459bdaed49c623d39f1e73689295", "parents": [ "44938af6e08580514abce8bea23ae1c034ea0b1d" ], "author": { "name": "Oleg Nesterov", "email": "oleg@tv-sign.ru", "time": "Fri Sep 29 02:00:55 2006 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Fri Sep 29 09:18:18 2006 -0700" }, "message": "[PATCH] futex_find_get_task(): don\u0027t take tasklist_lock\n\nIt is ok to do find_task_by_pid() + get_task_struct() under\nrcu_read_lock(), we cand drop tasklist_lock.\n\nNote that testing of -\u003eexit_state is racy with or without tasklist anyway.\n\nSigned-off-by: Oleg Nesterov \u003coleg@tv-sign.ru\u003e\nAcked-by: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "c5780e976e19faff345fcef4a01db87108b51a44", "tree": "1e75fc4cd3765beb575fb3196a477d97ed1905a4", "parents": [ "3a459756810912d2c2bf188cef566af255936b4d" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Fri Sep 08 09:47:15 2006 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Fri Sep 08 10:22:50 2006 -0700" }, "message": "[PATCH] Use the correct restart option for futex_lock_pi\n\nThe current implementation of futex_lock_pi returns -ERESTART_RESTARTBLOCK\nin case that the lock operation has been interrupted by a signal. This\nresults in a return of -EINTR to userspace in case there is an handler for\nthe signal. This is wrong, because userspace expects that the lock\nfunction does not return in any case of signal delivery.\n\nThis was not caught by my insufficient test case, but triggered a nasty\nuserspace problem in an high load application scenario. Unfortunately also\nglibc does not check for this invalid return value.\n\nUsing -ERSTARTNOINTR makes sure, that the interrupted syscall is restarted.\n The restart block related code can be safely removed, as the possible\ntimeout argument is an absolute time value.\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nAcked-by: Ingo Molnar \u003cmingo@elte.hu\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "d015baebba44613ef59ddffeae2114fa4ede7104", "tree": "24fb1e84890da3dbbd391b79f91426e3de274480", "parents": [ "533475d3d48eb839be2b57f6b020150abae91063" ], "author": { "name": "Oleg Nesterov", "email": "oleg@tv-sign.ru", "time": "Sun Aug 27 01:23:40 2006 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Sun Aug 27 11:01:30 2006 -0700" }, "message": "[PATCH] futex_find_get_task(): remove an obscure EXIT_ZOMBIE check\n\nfutex_find_get_task:\n\n\tif (p-\u003estate \u003d\u003d EXIT_ZOMBIE || p-\u003eexit_state \u003d\u003d EXIT_ZOMBIE)\n\t\treturn NULL;\n\nI can\u0027t understand this. First, p-\u003estate can\u0027t be EXIT_ZOMBIE. The\n-\u003eexit_state check looks strange too. Sub-threads or tasks whose -\u003eparent\nignores SIGCHLD go directly to EXIT_DEAD state (I am ignoring a ptrace\ncase). Why EXIT_DEAD tasks should be ok? Yes, EXIT_ZOMBIE is more\nimportant (a task may stay zombie for a long time), but this doesn\u0027t mean\nwe should explicitely ignore other EXIT_XXX states.\n\nSigned-off-by: Oleg Nesterov \u003coleg@tv-sign.ru\u003e\nAcked-by: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "e579dcbf23604cb33c08b5c3c3ac06ca36e7c683", "tree": "293581684fc47260a4610e4a77510b459346e2aa", "parents": [ "6997a6faaa129a1c91775f7344c8d371a05178ea" ], "author": { "name": "john stultz", "email": "johnstul@us.ibm.com", "time": "Sun Aug 13 23:24:24 2006 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Aug 14 12:54:29 2006 -0700" }, "message": "[PATCH] futex_handle_fault always fails\n\nWe found this issue last week w/ the -RT kernel, but it seems the same\nissue is in mainline as well.\n\nBasically it is possible for futex_unlock_pi to return without actually\nfreeing the lock. This is due to buggy logic in the use of\nfutex_handle_fault() and its attempt argument in a failure case.\n\nLooking at futex.c the logic is as follows:\n\n1) In futex_unlock_pi() we start w/ ret\u003d0 and we go down to the first\n futex_atomic_cmpxchg_inatomic(), where we find uval\u003d\u003d-EFAULT. We then\n jump to the pi_faulted label.\n\n2) From pi_faulted: We increment attempt, unlock the sem and hit the\n retry label.\n\n3) From the retry label, with ret still zero, we again hit EFAULT on the\n first futex_atomic_cmpxchg_inatomic(), and again goto the pi_faulted\n label.\n\n4) Again from pi_faulted: we increment attempt and enter the\n conditional, where we call futex_handle_fault.\n\n5) futex_handle_fault fails, and we goto the out_unlock_release_sem\n label.\n\n6) From out_unlock_release_sem we return, and since ret is still zero,\n we return without error, while never actually unlocking the lock.\n\nIssue #1: at the first futex_atomic_cmpxchg_inatomic() we should probably\nbe setting ret\u003d-EFAULT before jumping to pi_faulted: However in our case\nthis doesn\u0027t really affect anything, as the glibc we\u0027re using ignores the\nerror value from futex_unlock_pi().\n\nIssue #2: Look at futex_handle_fault(), its first conditional will return\n-EFAULT if attempt is \u003e\u003d 2. However, from the \"if(attempt++)\nfutex_handle_fault(attempt)\" logic above, we\u0027ll *never* call\nfutex_handle_fault when attempt is less then two. So we never get a chance\nto even try to fault the page in.\n\nThe following patch addresses these two issues by 1) Always setting ret to\n-EFAULT if futex_handle_fault fails, and 2) Removing the \u003d in\nfutex_handle_fault\u0027s (attempt \u003e\u003d 2) check.\n\nI\u0027m really not sure this is the right fix, but wanted to bring it up so\nfolks knew the issue is alive and well in the current -git tree. From\nlooking at the git logs the logic was first introduced (then later copied\nto other places) in the following commit almost a year ago:\n\nhttp://www.kernel.org/git/?p\u003dlinux/kernel/git/torvalds/linux-2.6.git;a\u003dcommitdiff;h\u003d4732efbeb997189d9f9b04708dc26bf8613ed721;hp\u003d5b039e681b8c5f30aac9cc04385cc94be45d0823\n\nCc: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nAcked-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "e91467ecd1ef381377fd327c0ded922835ec52ab", "tree": "b80a9c5d4b86df9c766c6a9613ae596d19ed0abf", "parents": [ "72f0b4e2133ba1d65147d06016c0b6d2202235ca" ], "author": { "name": "Christian Borntraeger", "email": "borntrae@de.ibm.com", "time": "Sat Aug 05 12:13:52 2006 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Sun Aug 06 08:57:46 2006 -0700" }, "message": "[PATCH] bug in futex unqueue_me\n\nThis patch adds a barrier() in futex unqueue_me to avoid aliasing of two\npointers.\n\nOn my s390x system I saw the following oops:\n\nUnable to handle kernel pointer dereference at virtual kernel address\n0000000000000000\nOops: 0004 [#1]\nCPU: 0 Not tainted\nProcess mytool (pid: 13613, task: 000000003ecb6ac0, ksp: 00000000366bdbd8)\nKrnl PSW : 0704d00180000000 00000000003c9ac2 (_spin_lock+0xe/0x30)\nKrnl GPRS: 00000000ffffffff 000000003ecb6ac0 0000000000000000 0700000000000000\n 0000000000000000 0000000000000000 000001fe00002028 00000000000c091f\n 000001fe00002054 000001fe00002054 0000000000000000 00000000366bddc0\n 00000000005ef8c0 00000000003d00e8 0000000000144f91 00000000366bdcb8\nKrnl Code: ba 4e 20 00 12 44 b9 16 00 3e a7 84 00 08 e3 e0 f0 88 00 04\nCall Trace:\n([\u003c0000000000144f90\u003e] unqueue_me+0x40/0xe4)\n [\u003c0000000000145a0c\u003e] do_futex+0x33c/0xc40\n [\u003c000000000014643e\u003e] sys_futex+0x12e/0x144\n [\u003c000000000010bb00\u003e] sysc_noemu+0x10/0x16\n [\u003c000002000003741c\u003e] 0x2000003741c\n\nThe code in question is:\n\nstatic int unqueue_me(struct futex_q *q)\n{\n int ret \u003d 0;\n spinlock_t *lock_ptr;\n\n /* In the common case we don\u0027t take the spinlock, which is nice. */\n retry:\n lock_ptr \u003d q-\u003elock_ptr;\n if (lock_ptr !\u003d 0) {\n spin_lock(lock_ptr);\n\t\t/*\n * q-\u003elock_ptr can change between reading it and\n * spin_lock(), causing us to take the wrong lock. This\n * corrects the race condition.\n[...]\n\nand my compiler (gcc 4.1.0) makes the following out of it:\n\n00000000000003c8 \u003cunqueue_me\u003e:\n 3c8: eb bf f0 70 00 24 stmg %r11,%r15,112(%r15)\n 3ce: c0 d0 00 00 00 00 larl %r13,3ce \u003cunqueue_me+0x6\u003e\n 3d0: R_390_PC32DBL .rodata+0x2a\n 3d4: a7 f1 1e 00 tml %r15,7680\n 3d8: a7 84 00 01 je 3da \u003cunqueue_me+0x12\u003e\n 3dc: b9 04 00 ef lgr %r14,%r15\n 3e0: a7 fb ff d0 aghi %r15,-48\n 3e4: b9 04 00 b2 lgr %r11,%r2\n 3e8: e3 e0 f0 98 00 24 stg %r14,152(%r15)\n 3ee: e3 c0 b0 28 00 04 lg %r12,40(%r11)\n\t\t/* write q-\u003elock_ptr in r12 */\n 3f4: b9 02 00 cc ltgr %r12,%r12\n 3f8: a7 84 00 4b je 48e \u003cunqueue_me+0xc6\u003e\n\t\t/* if r12 is zero then jump over the code.... */\n 3fc: e3 20 b0 28 00 04 lg %r2,40(%r11)\n\t\t/* write q-\u003elock_ptr in r2 */\n 402: c0 e5 00 00 00 00 brasl %r14,402 \u003cunqueue_me+0x3a\u003e\n 404: R_390_PC32DBL _spin_lock+0x2\n\t\t/* use r2 as parameter for spin_lock */\n\nSo the code becomes more or less:\nif (q-\u003elock_ptr !\u003d 0) spin_lock(q-\u003elock_ptr)\ninstead of\nif (lock_ptr !\u003d 0) spin_lock(lock_ptr)\n\nWhich caused the oops from above.\nAfter adding a barrier gcc creates code without this problem:\n[...] (the same)\n 3ee: e3 c0 b0 28 00 04 lg %r12,40(%r11)\n 3f4: b9 02 00 cc ltgr %r12,%r12\n 3f8: b9 04 00 2c lgr %r2,%r12\n 3fc: a7 84 00 48 je 48c \u003cunqueue_me+0xc4\u003e\n 400: c0 e5 00 00 00 00 brasl %r14,400 \u003cunqueue_me+0x38\u003e\n 402: R_390_PC32DBL _spin_lock+0x2\n\nAs a general note, this code of unqueue_me seems a bit fishy. The retry logic\nof unqueue_me only works if we can guarantee, that the original value of\nq-\u003elock_ptr is always a spinlock (Otherwise we overwrite kernel memory). We\nknow that q-\u003elock_ptr can change. I dont know what happens with the original\nspinlock, as I am not an expert with the futex code.\n\nCc: Martin Schwidefsky \u003cschwidefsky@de.ibm.com\u003e\nCc: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nAcked-by: Ingo Molnar \u003cmingo@redhat.com\u003e\nCc: Thomas Gleixner \u003ctglx@timesys.com\u003e\nSigned-off-by: Christian Borntraeger \u003cborntrae@de.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "e3f2ddeac718c768fdac4b7fe69d465172f788a8", "tree": "5428532dc6c87710c35a71858425f6d726f0e44c", "parents": [ "627371d73cdd04ed23fe098755b4f855138ad9e0" ], "author": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Sat Jul 29 05:17:57 2006 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Fri Jul 28 21:02:00 2006 -0700" }, "message": "[PATCH] pi-futex: robust-futex exit\n\nFix robust PI-futexes to be properly unlocked on unexpected exit.\n\nFor this to work the kernel has to know whether a futex is a PI or a\nnon-PI one, because the semantics are different. Since the space in\nrelevant glibc data structures is extremely scarce, the best solution is\nto encode the \u0027PI\u0027 information in bit 0 of the robust list pointer.\nExisting (non-PI) glibc robust futexes have this bit always zero, so the\nABI is kept. New glibc with PI-robust-futexes will set this bit.\n\nFurther fixes from Thomas Gleixner \u003ctglx@linutronix.de\u003e\n\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\nSigned-off-by: Ulrich Drepper \u003cdrepper@redhat.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "627371d73cdd04ed23fe098755b4f855138ad9e0", "tree": "2371684c61f91c39f562a6570784a1bae50f53a5", "parents": [ "c97d20a6c51067a38f53680d9609b4cf2867d077" ], "author": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Sat Jul 29 05:16:20 2006 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Fri Jul 28 21:02:00 2006 -0700" }, "message": "[PATCH] pi-futex: robust-futex exit crash fix\n\nFix pi_state-\u003elist handling bugs: list handling mishap, locking error.\nPlus add more debug checks and fix a few style issues i noticed while\ndebugging this.\n\n(reported by Ulrich Drepper and Jakub Jelinek.)\n\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" } ], "next": "06a9ec291b3aec9c7e36af0a10ad2b556bd7e84f" }