Allow pl330_enable_dma to be called from interrupt context #1
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
We do this from the device tree.
The I2C core really likes to act up, so fall back to GPIO I2C bitbanging for now.
of_property_read_bool Search for a property in a device node. Returns true if the property exist false otherwise. Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com> Acked-by: Rob Herring <rob.herring@calxeda.com> Acked-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Grant Likely <grant.likely@secretlab.ca>
To achieve DT support, we need to populate a custom platform_data in a private struct from DT information. To simplify code, the adapter and algorithm are also put into the private struct. Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com> Acked-by: Grant Likely <grant.likely@secretlab.ca> Acked-by: Rob Herring <rob.herring@calxeda.com> Acked-by: Wolfram Sang <w.sang@pengutronix.de> Cc: Nicolas Ferre <nicolas.ferre@atmel.com>
And adjust all callers. The new device parameter is used in the next patch to initialize the mux's of_node so that its children may be automatically populated. Signed-off-by: David Daney <david.daney@cavium.com> Cc: Lars-Peter Clausen <lars@metafoo.de>
For 'normal' i2c bus drivers, we can call of_i2c_register_devices() and have the device tree framework automatically populate the bus with the devices specified in the device tree. This patch adds a common code to the i2c mux framework to have the mux sub-busses be populated by the of_i2c_register_devices() too. If the mux device has an of_node, we populate the sub-bus' of_node so that the subsequent call to of_i2c_register_devices() will find the corresponding devices. It seemed better to put this logic in i2c_add_mux_adapter() rather than the individual mux drivers, as they will all probably want to do the same thing. Signed-off-by: David Daney <david.daney@cavium.com> Cc: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Always use 32bit access to avoid endianess issues. Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Not all I2C controllers support reading 256 byte blocks, so split the reading into multiple smaller blocks.
Similar to the existing helper function to lookup a I2C device by node. Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Although the dma controller expects the exact number of frames it was configured for we can allow transfers with less than that number of frames, if the total number of frames is a multiple of it. This is done by repeating the frames until the total number of frames has been reached. Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Add a small helper function for generating a new cookie. Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
This is a hack!
The code should obviously check the EDID feature field for EDID feature flags and not the color_formats field of the drm_display_info struct. Also update the color_formats field with new modes instead of overwriting the current mode. Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
The CEA extension block has a field which describes which YCbCr modes are supported by the device, use it to fill the drm_display_info color_formats fields. Also the existence of a CEA extension block is used as indication that the device supports RGB. Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Michael Hennerich <michael.hennerich@analog.com>
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
This patch adds a driver for the Analog Devices adv7511. The adv7511 is a standalone HDMI transmitter chip. It features a HDMI output interface on one end and video and audio input interfaces on the other. Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Enable DRM debugging by default for now.
This patch adds a set of functions which are intended to be used when implementing a dmaengine based sound PCM driver. Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
The code currently passes the register offset in the current block to regcache_lookup_reg. This works fine as long as there is only one block and with base register of 0, but in all other cases it will look-up the default for a wrong register, which can cause unnecessary register writes. This patch fixes it by passing the actual register number to regcache_lookup_reg. Signed-off-by: Lars-Peter Clausen <lars@metafoo.de> Cc: <stable@vger.kernel.org>
jameyhicks
pushed a commit
to cambridgehackers/device_xilinx_kernel
that referenced
this pull request
Apr 30, 2014
The recent 3.12 pull request for apparmor was missing a couple rcu _protected
access modifiers. Resulting in the follow suspicious RCU usage
[ 29.804534] [ INFO: suspicious RCU usage. ]
[ 29.804539] 3.11.0+ #5 Not tainted
[ 29.804541] -------------------------------
[ 29.804545] security/apparmor/include/policy.h:363 suspicious rcu_dereference_check() usage!
[ 29.804548]
[ 29.804548] other info that might help us debug this:
[ 29.804548]
[ 29.804553]
[ 29.804553] rcu_scheduler_active = 1, debug_locks = 1
[ 29.804558] 2 locks held by apparmor_parser/1268:
[ 29.804560] #0: (sb_writers#9){.+.+.+}, at: [<ffffffff81120a4c>] file_start_write+0x27/0x29
[ 29.804576] Digilent#1: (&ns->lock){+.+.+.}, at: [<ffffffff811f5d88>] aa_replace_profiles+0x166/0x57c
[ 29.804589]
[ 29.804589] stack backtrace:
[ 29.804595] CPU: 0 PID: 1268 Comm: apparmor_parser Not tainted 3.11.0+ #5
[ 29.804599] Hardware name: ASUSTeK Computer Inc. UL50VT /UL50VT , BIOS 217 03/01/2010
[ 29.804602] 0000000000000000 ffff8800b95a1d90 ffffffff8144eb9b ffff8800b94db540
[ 29.804611] ffff8800b95a1dc0 ffffffff81087439 ffff880138cc3a18 ffff880138cc3a18
[ 29.804619] ffff8800b9464a90 ffff880138cc3a38 ffff8800b95a1df0 ffffffff811f5084
[ 29.804628] Call Trace:
[ 29.804636] [<ffffffff8144eb9b>] dump_stack+0x4e/0x82
[ 29.804642] [<ffffffff81087439>] lockdep_rcu_suspicious+0xfc/0x105
[ 29.804649] [<ffffffff811f5084>] __aa_update_replacedby+0x53/0x7f
[ 29.804655] [<ffffffff811f5408>] __replace_profile+0x11f/0x1ed
[ 29.804661] [<ffffffff811f6032>] aa_replace_profiles+0x410/0x57c
[ 29.804668] [<ffffffff811f16d4>] profile_replace+0x35/0x4c
[ 29.804674] [<ffffffff81120fa3>] vfs_write+0xad/0x113
[ 29.804680] [<ffffffff81121609>] SyS_write+0x44/0x7a
[ 29.804687] [<ffffffff8145bfd2>] system_call_fastpath+0x16/0x1b
[ 29.804691]
[ 29.804694] ===============================
[ 29.804697] [ INFO: suspicious RCU usage. ]
[ 29.804700] 3.11.0+ #5 Not tainted
[ 29.804703] -------------------------------
[ 29.804706] security/apparmor/policy.c:566 suspicious rcu_dereference_check() usage!
[ 29.804709]
[ 29.804709] other info that might help us debug this:
[ 29.804709]
[ 29.804714]
[ 29.804714] rcu_scheduler_active = 1, debug_locks = 1
[ 29.804718] 2 locks held by apparmor_parser/1268:
[ 29.804721] #0: (sb_writers#9){.+.+.+}, at: [<ffffffff81120a4c>] file_start_write+0x27/0x29
[ 29.804733] Digilent#1: (&ns->lock){+.+.+.}, at: [<ffffffff811f5d88>] aa_replace_profiles+0x166/0x57c
[ 29.804744]
[ 29.804744] stack backtrace:
[ 29.804750] CPU: 0 PID: 1268 Comm: apparmor_parser Not tainted 3.11.0+ #5
[ 29.804753] Hardware name: ASUSTeK Computer Inc. UL50VT /UL50VT , BIOS 217 03/01/2010
[ 29.804756] 0000000000000000 ffff8800b95a1d80 ffffffff8144eb9b ffff8800b94db540
[ 29.804764] ffff8800b95a1db0 ffffffff81087439 ffff8800b95b02b0 0000000000000000
[ 29.804772] ffff8800b9efba08 ffff880138cc3a38 ffff8800b95a1dd0 ffffffff811f4f94
[ 29.804779] Call Trace:
[ 29.804786] [<ffffffff8144eb9b>] dump_stack+0x4e/0x82
[ 29.804791] [<ffffffff81087439>] lockdep_rcu_suspicious+0xfc/0x105
[ 29.804798] [<ffffffff811f4f94>] aa_free_replacedby_kref+0x4d/0x62
[ 29.804804] [<ffffffff811f4f47>] ? aa_put_namespace+0x17/0x17
[ 29.804810] [<ffffffff811f4f0b>] kref_put+0x36/0x40
[ 29.804816] [<ffffffff811f5423>] __replace_profile+0x13a/0x1ed
[ 29.804822] [<ffffffff811f6032>] aa_replace_profiles+0x410/0x57c
[ 29.804829] [<ffffffff811f16d4>] profile_replace+0x35/0x4c
[ 29.804835] [<ffffffff81120fa3>] vfs_write+0xad/0x113
[ 29.804840] [<ffffffff81121609>] SyS_write+0x44/0x7a
[ 29.804847] [<ffffffff8145bfd2>] system_call_fastpath+0x16/0x1b
Reported-by: miles.lane@gmail.com
CC: paulmck@linux.vnet.ibm.com
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
jameyhicks
pushed a commit
to cambridgehackers/device_xilinx_kernel
that referenced
this pull request
Apr 30, 2014
Isolated balloon pages can wrongly end up in LRU lists when migrate_pages() finishes its round without draining all the isolated page list. The same issue can happen when reclaim_clean_pages_from_list() tries to reclaim pages from an isolated page list, before migration, in the CMA path. Such balloon page leak opens a race window against LRU lists shrinkers that leads us to the following kernel panic: BUG: unable to handle kernel NULL pointer dereference at 0000000000000028 IP: [<ffffffff810c2625>] shrink_page_list+0x24e/0x897 PGD 3cda2067 PUD 3d713067 PMD 0 Oops: 0000 [Digilent#1] SMP CPU: 0 PID: 340 Comm: kswapd0 Not tainted 3.12.0-rc1-22626-g4367597 #87 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 RIP: shrink_page_list+0x24e/0x897 RSP: 0000:ffff88003da499b8 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff88003e82bd60 RCX: 00000000000657d5 RDX: 0000000000000000 RSI: 000000000000031f RDI: ffff88003e82bd40 RBP: ffff88003da49ab0 R08: 0000000000000001 R09: 0000000081121a45 R10: ffffffff81121a45 R11: ffff88003c4a9a28 R12: ffff88003e82bd40 R13: ffff88003da0e800 R14: 0000000000000001 R15: ffff88003da49d58 FS: 0000000000000000(0000) GS:ffff88003fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000067d9000 CR3: 000000003ace5000 CR4: 00000000000407b0 Call Trace: shrink_inactive_list+0x240/0x3de shrink_lruvec+0x3e0/0x566 __shrink_zone+0x94/0x178 shrink_zone+0x3a/0x82 balance_pgdat+0x32a/0x4c2 kswapd+0x2f0/0x372 kthread+0xa2/0xaa ret_from_fork+0x7c/0xb0 Code: 80 7d 8f 01 48 83 95 68 ff ff ff 00 4c 89 e7 e8 5a 7b 00 00 48 85 c0 49 89 c5 75 08 80 7d 8f 00 74 3e eb 31 48 8b 80 18 01 00 00 <48> 8b 74 0d 48 8b 78 30 be 02 00 00 00 ff d2 eb RIP [<ffffffff810c2625>] shrink_page_list+0x24e/0x897 RSP <ffff88003da499b8> CR2: 0000000000000028 ---[ end trace 703d2451af6ffbfd ]--- Kernel panic - not syncing: Fatal exception This patch fixes the issue, by assuring the proper tests are made at putback_movable_pages() & reclaim_clean_pages_from_list() to avoid isolated balloon pages being wrongly reinserted in LRU lists. [akpm@linux-foundation.org: clarify awkward comment text] Signed-off-by: Rafael Aquini <aquini@redhat.com> Reported-by: Luiz Capitulino <lcapitulino@redhat.com> Tested-by: Luiz Capitulino <lcapitulino@redhat.com> Cc: Mel Gorman <mel@csn.ul.ie> Cc: Rik van Riel <riel@redhat.com> Cc: Hugh Dickins <hughd@google.com> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
jameyhicks
pushed a commit
to cambridgehackers/device_xilinx_kernel
that referenced
this pull request
Apr 30, 2014
The commit facd8b8 ("irq: Sanitize invoke_softirq") converted irq exit calls of do_softirq() to __do_softirq() on all architectures, assuming it was only used there for its irq disablement properties. But as a side effect, the softirqs processed in the end of the hardirq are always called on the inline current stack that is used by irq_exit() instead of the softirq stack provided by the archs that override do_softirq(). The result is mostly safe if the architecture runs irq_exit() on a separate irq stack because then softirqs are processed on that same stack that is near empty at this stage (assuming hardirq aren't nesting). Otherwise irq_exit() runs in the task stack and so does the softirq too. The interrupted call stack can be randomly deep already and the softirq can dig through it even further. To add insult to the injury, this softirq can be interrupted by a new hardirq, maximizing the chances for a stack overrun as reported in powerpc for example: do_IRQ: stack overflow: 1920 CPU: 0 PID: 1602 Comm: qemu-system-ppc Not tainted 3.10.4-300.1.fc19.ppc64p7 Digilent#1 Call Trace: [c0000000050a8740] .show_stack+0x130/0x200 (unreliable) [c0000000050a8810] .dump_stack+0x28/0x3c [c0000000050a8880] .do_IRQ+0x2b8/0x2c0 [c0000000050a8930] hardware_interrupt_common+0x154/0x180 --- Exception: 501 at .cp_start_xmit+0x3a4/0x820 [8139cp] LR = .cp_start_xmit+0x390/0x820 [8139cp] [c0000000050a8d40] .dev_hard_start_xmit+0x394/0x640 [c0000000050a8e00] .sch_direct_xmit+0x110/0x260 [c0000000050a8ea0] .dev_queue_xmit+0x260/0x630 [c0000000050a8f40] .br_dev_queue_push_xmit+0xc4/0x130 [bridge] [c0000000050a8fc0] .br_dev_xmit+0x198/0x270 [bridge] [c0000000050a9070] .dev_hard_start_xmit+0x394/0x640 [c0000000050a9130] .dev_queue_xmit+0x428/0x630 [c0000000050a91d0] .ip_finish_output+0x2a4/0x550 [c0000000050a9290] .ip_local_out+0x50/0x70 [c0000000050a9310] .ip_queue_xmit+0x148/0x420 [c0000000050a93b0] .tcp_transmit_skb+0x4e4/0xaf0 [c0000000050a94a0] .__tcp_ack_snd_check+0x7c/0xf0 [c0000000050a9520] .tcp_rcv_established+0x1e8/0x930 [c0000000050a95f0] .tcp_v4_do_rcv+0x21c/0x570 [c0000000050a96c0] .tcp_v4_rcv+0x734/0x930 [c0000000050a97a0] .ip_local_deliver_finish+0x184/0x360 [c0000000050a9840] .ip_rcv_finish+0x148/0x400 [c0000000050a98d0] .__netif_receive_skb_core+0x4f8/0xb00 [c0000000050a99d0] .netif_receive_skb+0x44/0x110 [c0000000050a9a70] .br_handle_frame_finish+0x2bc/0x3f0 [bridge] [c0000000050a9b20] .br_nf_pre_routing_finish+0x2ac/0x420 [bridge] [c0000000050a9bd0] .br_nf_pre_routing+0x4dc/0x7d0 [bridge] [c0000000050a9c70] .nf_iterate+0x114/0x130 [c0000000050a9d30] .nf_hook_slow+0xb4/0x1e0 [c0000000050a9e00] .br_handle_frame+0x290/0x330 [bridge] [c0000000050a9ea0] .__netif_receive_skb_core+0x34c/0xb00 [c0000000050a9fa0] .netif_receive_skb+0x44/0x110 [c0000000050aa040] .napi_gro_receive+0xe8/0x120 [c0000000050aa0c0] .cp_rx_poll+0x31c/0x590 [8139cp] [c0000000050aa1d0] .net_rx_action+0x1dc/0x310 [c0000000050aa2b0] .__do_softirq+0x158/0x330 [c0000000050aa3b0] .irq_exit+0xc8/0x110 [c0000000050aa430] .do_IRQ+0xdc/0x2c0 [c0000000050aa4e0] hardware_interrupt_common+0x154/0x180 --- Exception: 501 at .bad_range+0x1c/0x110 LR = .get_page_from_freelist+0x908/0xbb0 [c0000000050aa7d0] .list_del+0x18/0x50 (unreliable) [c0000000050aa850] .get_page_from_freelist+0x908/0xbb0 [c0000000050aa9e0] .__alloc_pages_nodemask+0x21c/0xae0 [c0000000050aaba0] .alloc_pages_vma+0xd0/0x210 [c0000000050aac60] .handle_pte_fault+0x814/0xb70 [c0000000050aad50] .__get_user_pages+0x1a4/0x640 [c0000000050aae60] .get_user_pages_fast+0xec/0x160 [c0000000050aaf10] .__gfn_to_pfn_memslot+0x3b0/0x430 [kvm] [c0000000050aafd0] .kvmppc_gfn_to_pfn+0x64/0x130 [kvm] [c0000000050ab070] .kvmppc_mmu_map_page+0x94/0x530 [kvm] [c0000000050ab190] .kvmppc_handle_pagefault+0x174/0x610 [kvm] [c0000000050ab270] .kvmppc_handle_exit_pr+0x464/0x9b0 [kvm] [c0000000050ab320] kvm_start_lightweight+0x1ec/0x1fc [kvm] [c0000000050ab4f0] .kvmppc_vcpu_run_pr+0x168/0x3b0 [kvm] [c0000000050ab9c0] .kvmppc_vcpu_run+0xc8/0xf0 [kvm] [c0000000050aba50] .kvm_arch_vcpu_ioctl_run+0x5c/0x1a0 [kvm] [c0000000050abae0] .kvm_vcpu_ioctl+0x478/0x730 [kvm] [c0000000050abc90] .do_vfs_ioctl+0x4ec/0x7c0 [c0000000050abd80] .SyS_ioctl+0xd4/0xf0 [c0000000050abe30] syscall_exit+0x0/0x98 Since this is a regression, this patch proposes a minimalistic and low-risk solution by blindly forcing the hardirq exit processing of softirqs on the softirq stack. This way we should reduce significantly the opportunities for task stack overflow dug by softirqs. Longer term solutions may involve extending the hardirq stack coverage to irq_exit(), etc... Reported-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Acked-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com> Cc: #3.9.. <stable@vger.kernel.org> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Paul Mackerras <paulus@au1.ibm.com> Cc: Ingo Molnar <mingo@kernel.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Peter Zijlstra <peterz@infradead.org> Cc: H. Peter Anvin <hpa@zytor.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Paul Mackerras <paulus@au1.ibm.com> Cc: James Hogan <james.hogan@imgtec.com> Cc: James E.J. Bottomley <jejb@parisc-linux.org> Cc: Helge Deller <deller@gmx.de> Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Cc: Heiko Carstens <heiko.carstens@de.ibm.com> Cc: David S. Miller <davem@davemloft.net> Cc: Andrew Morton <akpm@linux-foundation.org>
jameyhicks
pushed a commit
to cambridgehackers/device_xilinx_kernel
that referenced
this pull request
Apr 30, 2014
[ 1.904000] BUG: scheduling while atomic: swapper/1/0x00000002 [ 1.908000] Modules linked in: [ 1.916000] CPU: 0 PID: 1 Comm: swapper Not tainted 3.12.0-rc2-lemote-los.git-5318619-dirty Digilent#1 [ 1.920000] Stack : 0000000031aac000 ffffffff810d0000 0000000000000052 ffffffff802730a4 0000000000000000 0000000000000001 ffffffff810cdf90 ffffffff810d0000 ffffffff8068b968 ffffffff806f5537 ffffffff810cdf90 980000009f0782e8 0000000000000001 ffffffff80720000 ffffffff806b0000 980000009f078000 980000009f290000 ffffffff805f312c 980000009f05b5d8 ffffffff80233518 980000009f05b5e8 ffffffff80274b7c 980000009f078000 ffffffff8068b968 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 980000009f05b520 0000000000000000 ffffffff805f2f6c 0000000000000000 ffffffff80700000 ffffffff80700000 ffffffff806fc758 ffffffff80700000 ffffffff8020be98 ffffffff806fceb0 ffffffff805f2f6c ... [ 2.028000] Call Trace: [ 2.032000] [<ffffffff8020be98>] show_stack+0x80/0x98 [ 2.036000] [<ffffffff805f2f6c>] __schedule_bug+0x44/0x6c [ 2.040000] [<ffffffff805fac58>] __schedule+0x518/0x5b0 [ 2.044000] [<ffffffff805f8a58>] schedule_timeout+0x128/0x1f0 [ 2.048000] [<ffffffff80240314>] msleep+0x3c/0x60 [ 2.052000] [<ffffffff80495400>] do_probe+0x238/0x3a8 [ 2.056000] [<ffffffff804958b0>] ide_probe_port+0x340/0x7e8 [ 2.060000] [<ffffffff80496028>] ide_host_register+0x2d0/0x7a8 [ 2.064000] [<ffffffff8049c65c>] ide_pci_init_two+0x4e4/0x790 [ 2.068000] [<ffffffff8049f9b8>] amd74xx_probe+0x148/0x2c8 [ 2.072000] [<ffffffff803f571c>] pci_device_probe+0xc4/0x130 [ 2.076000] [<ffffffff80478f60>] driver_probe_device+0x98/0x270 [ 2.080000] [<ffffffff80479298>] __driver_attach+0xe0/0xe8 [ 2.084000] [<ffffffff80476ab0>] bus_for_each_dev+0x78/0xe0 [ 2.088000] [<ffffffff80478468>] bus_add_driver+0x230/0x310 [ 2.092000] [<ffffffff80479b44>] driver_register+0x84/0x158 [ 2.096000] [<ffffffff80200504>] do_one_initcall+0x104/0x160 Signed-off-by: Yoichi Yuasa <yuasa@linux-mips.org> Reported-by: Aaro Koskinen <aaro.koskinen@iki.fi> Tested-by: Aaro Koskinen <aaro.koskinen@iki.fi> Cc: linux-mips@linux-mips.org Cc: Linux Kernel Mailing List <linux-kernel@vger.kernel.org> Patchwork: https://patchwork.linux-mips.org/patch/5941/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
jameyhicks
pushed a commit
to cambridgehackers/device_xilinx_kernel
that referenced
this pull request
Apr 30, 2014
IPv4 mapped addresses cause kernel panic. The patch juste check whether the IPv6 address is an IPv4 mapped address. If so, use IPv4 API instead of IPv6. [ 940.026915] general protection fault: 0000 [Digilent#1] [ 940.026915] Modules linked in: l2tp_ppp l2tp_netlink l2tp_core pppox ppp_generic slhc loop psmouse [ 940.026915] CPU: 0 PID: 3184 Comm: memcheck-amd64- Not tainted 3.11.0+ Digilent#1 [ 940.026915] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007 [ 940.026915] task: ffff880007130e20 ti: ffff88000737e000 task.ti: ffff88000737e000 [ 940.026915] RIP: 0010:[<ffffffff81333780>] [<ffffffff81333780>] ip6_xmit+0x276/0x326 [ 940.026915] RSP: 0018:ffff88000737fd28 EFLAGS: 00010286 [ 940.026915] RAX: c748521a75ceff48 RBX: ffff880000c30800 RCX: 0000000000000000 [ 940.026915] RDX: ffff88000075cc4e RSI: 0000000000000028 RDI: ffff8800060e5a40 [ 940.026915] RBP: ffff8800060e5a40 R08: 0000000000000000 R09: ffff88000075cc90 [ 940.026915] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88000737fda0 [ 940.026915] R13: 0000000000000000 R14: 0000000000002000 R15: ffff880005d3b580 [ 940.026915] FS: 00007f163dc5e800(0000) GS:ffffffff81623000(0000) knlGS:0000000000000000 [ 940.026915] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 940.026915] CR2: 00000004032dc940 CR3: 0000000005c25000 CR4: 00000000000006f0 [ 940.026915] Stack: [ 940.026915] ffff88000075cc4e ffffffff81694e90 ffff880000c30b38 0000000000000020 [ 940.026915] 11000000523c4bac ffff88000737fdb4 0000000000000000 ffff880000c30800 [ 940.026915] ffff880005d3b580 ffff880000c30b38 ffff8800060e5a40 0000000000000020 [ 940.026915] Call Trace: [ 940.026915] [<ffffffff81356cc3>] ? inet6_csk_xmit+0xa4/0xc4 [ 940.026915] [<ffffffffa0038535>] ? l2tp_xmit_skb+0x503/0x55a [l2tp_core] [ 940.026915] [<ffffffff812b8d3b>] ? pskb_expand_head+0x161/0x214 [ 940.026915] [<ffffffffa003e91d>] ? pppol2tp_xmit+0xf2/0x143 [l2tp_ppp] [ 940.026915] [<ffffffffa00292e0>] ? ppp_channel_push+0x36/0x8b [ppp_generic] [ 940.026915] [<ffffffffa00293fe>] ? ppp_write+0xaf/0xc5 [ppp_generic] [ 940.026915] [<ffffffff8110ead4>] ? vfs_write+0xa2/0x106 [ 940.026915] [<ffffffff8110edd6>] ? SyS_write+0x56/0x8a [ 940.026915] [<ffffffff81378ac0>] ? system_call_fastpath+0x16/0x1b [ 940.026915] Code: 00 49 8b 8f d8 00 00 00 66 83 7c 11 02 00 74 60 49 8b 47 58 48 83 e0 fe 48 8b 80 18 01 00 00 48 85 c0 74 13 48 8b 80 78 02 00 00 <48> ff 40 28 41 8b 57 68 48 01 50 30 48 8b 54 24 08 49 c7 c1 51 [ 940.026915] RIP [<ffffffff81333780>] ip6_xmit+0x276/0x326 [ 940.026915] RSP <ffff88000737fd28> [ 940.057945] ---[ end trace be8aba9a61c8b7f3 ]--- [ 940.058583] Kernel panic - not syncing: Fatal exception in interrupt Signed-off-by: François CACHEREUL <f.cachereul@alphalink.fr> Signed-off-by: David S. Miller <davem@davemloft.net>
jameyhicks
pushed a commit
to cambridgehackers/device_xilinx_kernel
that referenced
this pull request
Apr 30, 2014
With DT-based boot, the GPMC OneNAND sync mode setup does not work
correctly. During the async mode setup, sync flags gets incorrectly
set in the onenand_async data and the system crashes during the async
setup. Also, the sync mode never gets set in gpmc_onenand_data->flags, so
even without the crash, the actual sync mode setup would never be called.
The patch fixes this by adjusting the gpmc_onenand_data->flags when the
data is read from the DT. Also while doing this we force the onenand_async
to be always async.
The patch enables to use the following DTS chunk (that should correspond
the arch/arm/mach-omap2/board-rm680.c board file setup) with Nokia N950,
which currently crashes with 3.12-rc1. The crash output can be also
found below.
&gpmc {
ranges = <0 0 0x04000000 0x20000000>;
onenand@0,0 {
#address-cells = <1>;
#size-cells = <1>;
reg = <0 0 0x20000000>;
gpmc,sync-read;
gpmc,sync-write;
gpmc,burst-length = <16>;
gpmc,burst-read;
gpmc,burst-wrap;
gpmc,burst-write;
gpmc,device-width = <2>;
gpmc,mux-add-data = <2>;
gpmc,cs-on-ns = <0>;
gpmc,cs-rd-off-ns = <87>;
gpmc,cs-wr-off-ns = <87>;
gpmc,adv-on-ns = <0>;
gpmc,adv-rd-off-ns = <10>;
gpmc,adv-wr-off-ns = <10>;
gpmc,oe-on-ns = <15>;
gpmc,oe-off-ns = <87>;
gpmc,we-on-ns = <0>;
gpmc,we-off-ns = <87>;
gpmc,rd-cycle-ns = <112>;
gpmc,wr-cycle-ns = <112>;
gpmc,access-ns = <81>;
gpmc,page-burst-access-ns = <15>;
gpmc,bus-turnaround-ns = <0>;
gpmc,cycle2cycle-delay-ns = <0>;
gpmc,wait-monitoring-ns = <0>;
gpmc,clk-activation-ns = <5>;
gpmc,wr-data-mux-bus-ns = <30>;
gpmc,wr-access-ns = <81>;
gpmc,sync-clk-ps = <15000>;
};
};
[ 1.467559] GPMC CS0: cs_on : 0 ticks, 0 ns (was 0 ticks) 0 ns
[ 1.474822] GPMC CS0: cs_rd_off : 1 ticks, 5 ns (was 24 ticks) 5 ns
[ 1.482116] GPMC CS0: cs_wr_off : 14 ticks, 71 ns (was 24 ticks) 71 ns
[ 1.489349] GPMC CS0: adv_on : 0 ticks, 0 ns (was 0 ticks) 0 ns
[ 1.496582] GPMC CS0: adv_rd_off: 3 ticks, 15 ns (was 3 ticks) 15 ns
[ 1.503845] GPMC CS0: adv_wr_off: 3 ticks, 15 ns (was 3 ticks) 15 ns
[ 1.511077] GPMC CS0: oe_on : 3 ticks, 15 ns (was 4 ticks) 15 ns
[ 1.518310] GPMC CS0: oe_off : 1 ticks, 5 ns (was 24 ticks) 5 ns
[ 1.525543] GPMC CS0: we_on : 0 ticks, 0 ns (was 0 ticks) 0 ns
[ 1.532806] GPMC CS0: we_off : 8 ticks, 40 ns (was 24 ticks) 40 ns
[ 1.540039] GPMC CS0: rd_cycle : 4 ticks, 20 ns (was 29 ticks) 20 ns
[ 1.547302] GPMC CS0: wr_cycle : 4 ticks, 20 ns (was 29 ticks) 20 ns
[ 1.554504] GPMC CS0: access : 0 ticks, 0 ns (was 23 ticks) 0 ns
[ 1.561767] GPMC CS0: page_burst_access: 0 ticks, 0 ns (was 3 ticks) 0 ns
[ 1.569641] GPMC CS0: bus_turnaround: 0 ticks, 0 ns (was 0 ticks) 0 ns
[ 1.577270] GPMC CS0: cycle2cycle_delay: 0 ticks, 0 ns (was 0 ticks) 0 ns
[ 1.585144] GPMC CS0: wait_monitoring: 0 ticks, 0 ns (was 0 ticks) 0 ns
[ 1.592834] GPMC CS0: clk_activation: 0 ticks, 0 ns (was 0 ticks) 0 ns
[ 1.600463] GPMC CS0: wr_data_mux_bus: 5 ticks, 25 ns (was 8 ticks) 25 ns
[ 1.608154] GPMC CS0: wr_access : 0 ticks, 0 ns (was 23 ticks) 0 ns
[ 1.615386] GPMC CS0 CLK period is 5 ns (div 1)
[ 1.625122] Unhandled fault: external abort on non-linefetch (0x1008) at 0xf009e442
[ 1.633178] Internal error: : 1008 [Digilent#1] ARM
[ 1.637573] Modules linked in:
[ 1.640777] CPU: 0 PID: 1 Comm: swapper Not tainted 3.12.0-rc1-n9xx-los.git-5318619-00006-g4baa700-dirty #26
[ 1.651123] task: ef04c000 ti: ef050000 task.ti: ef050000
[ 1.656799] PC is at gpmc_onenand_setup+0x98/0x1e0
[ 1.661865] LR is at gpmc_cs_set_timings+0x494/0x5a4
[ 1.667083] pc : [<c002e040>] lr : [<c001f384>] psr: 60000113
[ 1.667083] sp : ef051d10 ip : ef051ce0 fp : ef051d94
[ 1.679138] r10: c0caaf60 r9 : ef050000 r8 : ef18b32c
[ 1.684631] r7 : f0080000 r6 : c0caaf60 r5 : 00000000 r4 : f009e400
[ 1.691497] r3 : f009e442 r2 : 80050000 r1 : 00000014 r0 : 00000000
[ 1.698333] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel
[ 1.706024] Control: 10c5387d Table: af290019 DAC: 00000015
[ 1.712066] Process swapper (pid: 1, stack limit = 0xef050240)
[ 1.718200] Stack: (0xef051d10 to 0xef052000)
[ 1.722778] 1d00: 00004000 00001402 00000000 00000005
[ 1.731384] 1d20: 00000047 00000000 0000000f 0000000f 00000000 00000028 0000000f 00000005
[ 1.739990] 1d40: 00000000 00000000 00000014 00000014 00000000 00000000 00000000 00000000
[ 1.748596] 1d60: 00000000 00000019 00000000 00000000 ef18b000 ef099c50 c0c8cb30 00000000
[ 1.757171] 1d80: c0488074 c048f868 ef051dcc ef051d98 c024447c c002dfb4 00000000 c048f868
[ 1.765777] 1da0: 00000000 00000000 c010e4a4 c0dbbb7c c0c8cb40 00000000 c0ca2500 c0488074
[ 1.774383] 1dc0: ef051ddc ef051dd0 c01fd508 c0244370 ef051dfc ef051de0 c01fc204 c01fd4f4
[ 1.782989] 1de0: c0c8cb40 c0ca2500 c0c8cb74 00000000 ef051e1c ef051e00 c01fc3b0 c01fc104
[ 1.791595] 1e00: ef0983bc 00000000 c0ca2500 c01fc31c ef051e44 ef051e20 c01fa794 c01fc328
[ 1.800201] 1e20: ef03634c ef0983b0 ef27d534 c0ca2500 ef27d500 c0c9a2f8 ef051e54 ef051e48
[ 1.808807] 1e40: c01fbcfc c01fa744 ef051e84 ef051e58 c01fb838 c01fbce4 c0411df8 c0caa040
[ 1.817413] 1e60: ef051e84 c0ca2500 00000006 c0caa040 00000066 c0488074 ef051e9c ef051e88
[ 1.825988] 1e80: c01fca30 c01fb768 c04975b8 00000006 ef051eac ef051ea0 c01fd728 c01fc9bc
[ 1.834594] 1ea0: ef051ebc ef051eb0 c048808c c01fd6e4 ef051f4c ef051ec0 c0008888 c0488080
[ 1.843200] 1ec0: 0000006f c046bae8 00000000 00000000 ef051efc ef051ee0 ef051f04 ef051ee8
[ 1.851806] 1ee0: c046d400 c0181218 c046d410 c18da8d5 c036a8e4 00000066 ef051f4c ef051f08
[ 1.860412] 1f00: c004b9a8 c046d41c c048f840 00000006 00000006 c046b488 00000000 c043ec08
[ 1.869018] 1f20: ef051f4c c04975b8 00000006 c0caa040 00000066 c046d410 c048f85c c048f868
[ 1.877593] 1f40: ef051f94 ef051f50 c046db8c c00087a0 00000006 00000006 c046d410 ffffffff
[ 1.886199] 1f60: ffffffff ffffffff ffffffff 00000000 c0348fd0 00000000 00000000 00000000
[ 1.894805] 1f80: 00000000 00000000 ef051fac ef051f98 c0348fe0 c046daa8 00000000 00000000
[ 1.903411] 1fa0: 00000000 ef051fb0 c000e7f8 c0348fdc 00000000 00000000 00000000 00000000
[ 1.912017] 1fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 1.920623] 1fe0: 00000000 00000000 00000000 00000000 00000013 00000000 ffffffff ffffffff
[ 1.929199] Backtrace:
[ 1.931793] [<c002dfa8>] (gpmc_onenand_setup+0x0/0x1e0) from [<c024447c>] (omap2_onenand_probe+0x118/0x49c)
[ 1.942047] [<c0244364>] (omap2_onenand_probe+0x0/0x49c) from [<c01fd508>] (platform_drv_probe+0x20/0x24)
[ 1.952117] r8:c0488074 r7:c0ca2500 r6:00000000 r5:c0c8cb40 r4:c0dbbb7c
[ 1.959197] [<c01fd4e8>] (platform_drv_probe+0x0/0x24) from [<c01fc204>] (driver_probe_device+0x10c/0x224)
[ 1.969360] [<c01fc0f8>] (driver_probe_device+0x0/0x224) from [<c01fc3b0>] (__driver_attach+0x94/0x98)
[ 1.979125] r7:00000000 r6:c0c8cb74 r5:c0ca2500 r4:c0c8cb40
[ 1.985107] [<c01fc31c>] (__driver_attach+0x0/0x98) from [<c01fa794>] (bus_for_each_dev+0x5c/0x90)
[ 1.994506] r6:c01fc31c r5:c0ca2500 r4:00000000 r3:ef0983bc
[ 2.000488] [<c01fa738>] (bus_for_each_dev+0x0/0x90) from [<c01fbcfc>] (driver_attach+0x24/0x28)
[ 2.009735] r6:c0c9a2f8 r5:ef27d500 r4:c0ca2500
[ 2.014587] [<c01fbcd8>] (driver_attach+0x0/0x28) from [<c01fb838>] (bus_add_driver+0xdc/0x260)
[ 2.023742] [<c01fb75c>] (bus_add_driver+0x0/0x260) from [<c01fca30>] (driver_register+0x80/0xfc)
[ 2.033081] r8:c0488074 r7:00000066 r6:c0caa040 r5:00000006 r4:c0ca2500
[ 2.040161] [<c01fc9b0>] (driver_register+0x0/0xfc) from [<c01fd728>] (__platform_driver_register+0x50/0x64)
[ 2.050476] r5:00000006 r4:c04975b8
[ 2.054260] [<c01fd6d8>] (__platform_driver_register+0x0/0x64) from [<c048808c>] (omap2_onenand_driver_init+0x18/0x20)
[ 2.065490] [<c0488074>] (omap2_onenand_driver_init+0x0/0x20) from [<c0008888>] (do_one_initcall+0xf4/0x150)
[ 2.075836] [<c0008794>] (do_one_initcall+0x0/0x150) from [<c046db8c>] (kernel_init_freeable+0xf0/0x1b4)
[ 2.085815] [<c046da9c>] (kernel_init_freeable+0x0/0x1b4) from [<c0348fe0>] (kernel_init+0x10/0xec)
[ 2.095336] [<c0348fd0>] (kernel_init+0x0/0xec) from [<c000e7f8>] (ret_from_fork+0x14/0x3c)
[ 2.104125] r4:00000000 r3:00000000
[ 2.107879] Code: ebffc3ae e2505000 ba00002e e2843042 (e1d320b0)
[ 2.114318] ---[ end trace b8ee3e3e5e002451 ]---
Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Signed-off-by: Tony Lindgren <tony@atomide.com>
jameyhicks
pushed a commit
to cambridgehackers/device_xilinx_kernel
that referenced
this pull request
Apr 30, 2014
The current test for an attached enabled encoder fails if we have multiple connectors aliased to the same encoder - both connectors believe they own the enabled encoder and so we attempt to both enable and disable DPMS on the encoder, leading to hilarity and an OOPs: [ 354.803064] WARNING: CPU: 0 PID: 482 at /usr/src/linux/dist/3.11.2/drivers/gpu/drm/i915/intel_display.c:3869 intel_modeset_check_state+0x764/0x770 [i915]() [ 354.803064] wrong connector dpms state [ 354.803084] Modules linked in: nfsd auth_rpcgss oid_registry exportfs nfs lockd sunrpc xt_nat iptable_nat nf_nat_ipv4 nf_nat xt_limit xt_LOG xt_tcpudp nf_conntrack_ipv4 nf_defrag_ipv4 ipt_REJECT ipv6 xt_recent xt_conntrack nf_conntrack iptable_filter ip_tables x_tables snd_hda_codec_realtek snd_hda_codec_hdmi x86_pkg_temp_thermal snd_hda_intel coretemp kvm_intel snd_hda_codec i915 kvm snd_hwdep snd_pcm_oss snd_mixer_oss crc32_pclmul snd_pcm crc32c_intel e1000e intel_agp igb ghash_clmulni_intel intel_gtt aesni_intel cfbfillrect aes_x86_64 cfbimgblt lrw cfbcopyarea drm_kms_helper ptp video thermal processor gf128mul snd_page_alloc drm snd_timer glue_helper 8250_pci snd pps_core ablk_helper agpgart cryptd sg soundcore fan i2c_algo_bit sr_mod thermal_sys 8250 i2c_i801 serial_core hwmon cdrom i2c_core evdev button [ 354.803086] CPU: 0 PID: 482 Comm: kworker/0:1 Not tainted 3.11.2 Digilent#1 [ 354.803087] Hardware name: Supermicro X10SAE/X10SAE, BIOS 1.00 05/03/2013 [ 354.803091] Workqueue: events console_callback [ 354.803092] 0000000000000009 ffff88023611db48 ffffffff814048ac ffff88023611db90 [ 354.803093] ffff88023611db80 ffffffff8103d4e3 ffff880230d82800 ffff880230f9b800 [ 354.803094] ffff880230f99000 ffff880230f99448 ffff8802351c0e00 ffff88023611dbe0 [ 354.803094] Call Trace: [ 354.803098] [<ffffffff814048ac>] dump_stack+0x54/0x8d [ 354.803101] [<ffffffff8103d4e3>] warn_slowpath_common+0x73/0x90 [ 354.803103] [<ffffffff8103d547>] warn_slowpath_fmt+0x47/0x50 [ 354.803109] [<ffffffffa089f1be>] ? intel_ddi_connector_get_hw_state+0x5e/0x110 [i915] [ 354.803114] [<ffffffffa0896974>] intel_modeset_check_state+0x764/0x770 [i915] [ 354.803117] [<ffffffffa08969bb>] intel_connector_dpms+0x3b/0x60 [i915] [ 354.803120] [<ffffffffa037e1d0>] drm_fb_helper_dpms.isra.11+0x120/0x160 [drm_kms_helper] [ 354.803122] [<ffffffffa037e24e>] drm_fb_helper_blank+0x3e/0x80 [drm_kms_helper] [ 354.803123] [<ffffffff812116c2>] fb_blank+0x52/0xc0 [ 354.803125] [<ffffffff8121e04b>] fbcon_blank+0x21b/0x2d0 [ 354.803127] [<ffffffff81062243>] ? update_rq_clock.part.74+0x13/0x30 [ 354.803129] [<ffffffff81047486>] ? lock_timer_base.isra.30+0x26/0x50 [ 354.803130] [<ffffffff810472b2>] ? internal_add_timer+0x12/0x40 [ 354.803131] [<ffffffff81047f48>] ? mod_timer+0xf8/0x1c0 [ 354.803133] [<ffffffff81266d61>] do_unblank_screen+0xa1/0x1c0 [ 354.803134] [<ffffffff81268087>] poke_blanked_console+0xc7/0xd0 [ 354.803136] [<ffffffff812681cf>] console_callback+0x13f/0x160 [ 354.803137] [<ffffffff81053258>] process_one_work+0x148/0x3d0 [ 354.803138] [<ffffffff81053f19>] worker_thread+0x119/0x3a0 [ 354.803140] [<ffffffff81053e00>] ? manage_workers.isra.30+0x2a0/0x2a0 [ 354.803141] [<ffffffff8105994b>] kthread+0xbb/0xc0 [ 354.803142] [<ffffffff81059890>] ? kthread_create_on_node+0x120/0x120 [ 354.803144] [<ffffffff8140b32c>] ret_from_fork+0x7c/0xb0 [ 354.803145] [<ffffffff81059890>] ? kthread_create_on_node+0x120/0x120 This regression goes back to the big modeset rework and the conversion to the new dpms helpers which started with: commit 5ab432e Author: Daniel Vetter <daniel.vetter@ffwll.ch> Date: Sat Jun 30 08:59:56 2012 +0200 drm/i915/hdmi: convert to encoder->disable/enable Fixes: igt/kms_flip/dpms-off-confusion Reported-and-tested-by: Wakko Warner <wakko@animx.eu.org> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=68030 Link: http://lkml.kernel.org/r/20130928185023.GA21672@animx.eu.org Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: stable@vger.kernel.org [danvet: Add regression citation, mention the igt testcase this fixes and slap a cc: stable on the patch.] Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
jameyhicks
pushed a commit
to cambridgehackers/device_xilinx_kernel
that referenced
this pull request
Apr 30, 2014
Michael Semon reported that xfs/299 generated this lockdep warning: ============================================= [ INFO: possible recursive locking detected ] 3.12.0-rc2+ Digilent#2 Not tainted --------------------------------------------- touch/21072 is trying to acquire lock: (&xfs_dquot_other_class){+.+...}, at: [<c12902fb>] xfs_trans_dqlockedjoin+0x57/0x64 but task is already holding lock: (&xfs_dquot_other_class){+.+...}, at: [<c12902fb>] xfs_trans_dqlockedjoin+0x57/0x64 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&xfs_dquot_other_class); lock(&xfs_dquot_other_class); *** DEADLOCK *** May be due to missing lock nesting notation 7 locks held by touch/21072: #0: (sb_writers#10){++++.+}, at: [<c11185b6>] mnt_want_write+0x1e/0x3e Digilent#1: (&type->i_mutex_dir_key#4){+.+.+.}, at: [<c11078ee>] do_last+0x245/0xe40 Digilent#2: (sb_internal#2){++++.+}, at: [<c122c9e0>] xfs_trans_alloc+0x1f/0x35 #3: (&(&ip->i_lock)->mr_lock/1){+.+...}, at: [<c126cd1b>] xfs_ilock+0x100/0x1f1 #4: (&(&ip->i_lock)->mr_lock){++++-.}, at: [<c126cf52>] xfs_ilock_nowait+0x105/0x22f #5: (&dqp->q_qlock){+.+...}, at: [<c12902fb>] xfs_trans_dqlockedjoin+0x57/0x64 #6: (&xfs_dquot_other_class){+.+...}, at: [<c12902fb>] xfs_trans_dqlockedjoin+0x57/0x64 The lockdep annotation for dquot lock nesting only understands locking for user and "other" dquots, not user, group and quota dquots. Fix the annotations to match the locking heirarchy we now have. Reported-by: Michael L. Semon <mlsemon35@gmail.com> Signed-off-by: Dave Chinner <dchinner@redhat.com> Reviewed-by: Ben Myers <bpm@sgi.com> Signed-off-by: Ben Myers <bpm@sgi.com> (cherry picked from commit f112a04)
jameyhicks
pushed a commit
to cambridgehackers/device_xilinx_kernel
that referenced
this pull request
Apr 30, 2014
When btrfs creates a bioset, we must also allocate the integrity data pool. Otherwise btrfs will crash when it tries to submit a bio to a checksumming disk: BUG: unable to handle kernel NULL pointer dereference at 0000000000000018 IP: [<ffffffff8111e28a>] mempool_alloc+0x4a/0x150 PGD 2305e4067 PUD 23063d067 PMD 0 Oops: 0000 [Digilent#1] PREEMPT SMP Modules linked in: btrfs scsi_debug xfs ext4 jbd2 ext3 jbd mbcache sch_fq_codel eeprom lpc_ich mfd_core nfsd exportfs auth_rpcgss af_packet raid6_pq xor zlib_deflate libcrc32c [last unloaded: scsi_debug] CPU: 1 PID: 4486 Comm: mount Not tainted 3.12.0-rc1-mcsum Digilent#2 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 task: ffff8802451c9720 ti: ffff880230698000 task.ti: ffff880230698000 RIP: 0010:[<ffffffff8111e28a>] [<ffffffff8111e28a>] mempool_alloc+0x4a/0x150 RSP: 0018:ffff880230699688 EFLAGS: 00010286 RAX: 0000000000000001 RBX: 0000000000000000 RCX: 00000000005f8445 RDX: 0000000000000001 RSI: 0000000000000010 RDI: 0000000000000000 RBP: ffff8802306996f8 R08: 0000000000011200 R09: 0000000000000008 R10: 0000000000000020 R11: ffff88009d6e8000 R12: 0000000000011210 R13: 0000000000000030 R14: ffff8802306996b8 R15: ffff8802451c9720 FS: 00007f25b8a16800(0000) GS:ffff88024fc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000018 CR3: 0000000230576000 CR4: 00000000000007e0 Stack: ffff8802451c9720 0000000000000002 ffffffff81a97100 0000000000281250 ffffffff81a96480 ffff88024fc99150 ffff880228d18200 0000000000000000 0000000000000000 0000000000000040 ffff880230e8c2e8 ffff8802459dc900 Call Trace: [<ffffffff811b2208>] bio_integrity_alloc+0x48/0x1b0 [<ffffffff811b26fc>] bio_integrity_prep+0xac/0x360 [<ffffffff8111e298>] ? mempool_alloc+0x58/0x150 [<ffffffffa03e8041>] ? alloc_extent_state+0x31/0x110 [btrfs] [<ffffffff81241579>] blk_queue_bio+0x1c9/0x460 [<ffffffff8123e58a>] generic_make_request+0xca/0x100 [<ffffffff8123e639>] submit_bio+0x79/0x160 [<ffffffffa03f865e>] btrfs_map_bio+0x48e/0x5b0 [btrfs] [<ffffffffa03c821a>] btree_submit_bio_hook+0xda/0x110 [btrfs] [<ffffffffa03e7eba>] submit_one_bio+0x6a/0xa0 [btrfs] [<ffffffffa03ef450>] read_extent_buffer_pages+0x250/0x310 [btrfs] [<ffffffff8125eef6>] ? __radix_tree_preload+0x66/0xf0 [<ffffffff8125f1c5>] ? radix_tree_insert+0x95/0x260 [<ffffffffa03c66f6>] btree_read_extent_buffer_pages.constprop.128+0xb6/0x120 [btrfs] [<ffffffffa03c8c1a>] read_tree_block+0x3a/0x60 [btrfs] [<ffffffffa03caefd>] open_ctree+0x139d/0x2030 [btrfs] [<ffffffffa03a282a>] btrfs_mount+0x53a/0x7d0 [btrfs] [<ffffffff8113ab0b>] ? pcpu_alloc+0x8eb/0x9f0 [<ffffffff81167305>] ? __kmalloc_track_caller+0x35/0x1e0 [<ffffffff81176ba0>] mount_fs+0x20/0xd0 [<ffffffff81191096>] vfs_kern_mount+0x76/0x120 [<ffffffff81193320>] do_mount+0x200/0xa40 [<ffffffff81135cdb>] ? strndup_user+0x5b/0x80 [<ffffffff81193bf0>] SyS_mount+0x90/0xe0 [<ffffffff8156d31d>] system_call_fastpath+0x1a/0x1f Code: 4c 8d 75 a8 4c 89 6d e8 45 89 e0 4c 8d 6f 30 48 89 5d d8 41 83 e0 af 48 89 fb 49 83 c6 18 4c 89 7d f8 65 4c 8b 3c 25 c0 b8 00 00 <48> 8b 73 18 44 89 c7 44 89 45 98 ff 53 20 48 85 c0 48 89 c2 74 RIP [<ffffffff8111e28a>] mempool_alloc+0x4a/0x150 RSP <ffff880230699688> CR2: 0000000000000018 ---[ end trace 7a96042017ed21e2 ]--- Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Josef Bacik <jbacik@fusionio.com> Signed-off-by: Chris Mason <chris.mason@fusionio.com>
jameyhicks
pushed a commit
to cambridgehackers/device_xilinx_kernel
that referenced
this pull request
Apr 30, 2014
Commit 1400eb6 (MIPS: r4k,octeon,r2300: stack protector: change canary per task) was merged in v3.11 and introduced assembly in the MIPS resume functions to update the value of the current canary in __stack_chk_guard. However it used PTR_L resulting in a load of the canary value, instead of PTR_LA to construct its address. The value is intended to be random but is then treated as an address in the subsequent LONG_S (store). This was observed to cause a fault and panic: CPU 0 Unable to handle kernel paging request at virtual address 139fea20, epc == 8000cc0c, ra == 8034f2a4 Oops[Digilent#1]: ... $24 : 139fea20 1e1f7cb6 ... Call Trace: [<8000cc0c>] resume+0xac/0x118 [<8034f2a4>] __schedule+0x5f8/0x78c [<8034f4e0>] schedule_preempt_disabled+0x20/0x2c [<80348eec>] rest_init+0x74/0x84 [<804dc990>] start_kernel+0x43c/0x454 Code: 3c18804b 8f184030 8cb901f8 <af190000> 00c0e021 8cb002f0 8cb102f4 8cb202f8 8cb302fc This can also be forced by modifying arch/mips/include/asm/stackprotector.h so that the default __stack_chk_guard value is more likely to be a bad (or unaligned) pointer. Fix it to use PTR_LA instead, to load the address of the canary value, which the LONG_S can then use to write into it. Reported-by: bobjones (via #mipslinux on IRC) Signed-off-by: James Hogan <james.hogan@imgtec.com> Cc: Ralf Baechle <ralf@linux-mips.org> Cc: Gregory Fong <gregory.0xf0@gmail.com> Cc: linux-mips@linux-mips.org Cc: stable@vger.kernel.org Patchwork: https://patchwork.linux-mips.org/patch/6026/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
jameyhicks
pushed a commit
to cambridgehackers/device_xilinx_kernel
that referenced
this pull request
Apr 30, 2014
François Cachereul made a very nice bug report and suspected the bh_lock_sock() / bh_unlok_sock() pair used in l2tp_xmit_skb() from process context was not good. This problem was added by commit 6af88da ("l2tp: Fix locking in l2tp_core.c"). l2tp_eth_dev_xmit() runs from BH context, so we must disable BH from other l2tp_xmit_skb() users. [ 452.060011] BUG: soft lockup - CPU#1 stuck for 23s! [accel-pppd:6662] [ 452.061757] Modules linked in: l2tp_ppp l2tp_netlink l2tp_core pppoe pppox ppp_generic slhc ipv6 ext3 mbcache jbd virtio_balloon xfs exportfs dm_mod virtio_blk ata_generic virtio_net floppy ata_piix libata virtio_pci virtio_ring virtio [last unloaded: scsi_wait_scan] [ 452.064012] CPU 1 [ 452.080015] BUG: soft lockup - CPU#2 stuck for 23s! [accel-pppd:6643] [ 452.080015] CPU 2 [ 452.080015] [ 452.080015] Pid: 6643, comm: accel-pppd Not tainted 3.2.46.mini Digilent#1 Bochs Bochs [ 452.080015] RIP: 0010:[<ffffffff81059f6c>] [<ffffffff81059f6c>] do_raw_spin_lock+0x17/0x1f [ 452.080015] RSP: 0018:ffff88007125fc18 EFLAGS: 00000293 [ 452.080015] RAX: 000000000000aba9 RBX: ffffffff811d0703 RCX: 0000000000000000 [ 452.080015] RDX: 00000000000000ab RSI: ffff8800711f6896 RDI: ffff8800745c8110 [ 452.080015] RBP: ffff88007125fc18 R08: 0000000000000020 R09: 0000000000000000 [ 452.080015] R10: 0000000000000000 R11: 0000000000000280 R12: 0000000000000286 [ 452.080015] R13: 0000000000000020 R14: 0000000000000240 R15: 0000000000000000 [ 452.080015] FS: 00007fdc0cc24700(0000) GS:ffff8800b6f00000(0000) knlGS:0000000000000000 [ 452.080015] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 452.080015] CR2: 00007fdb054899b8 CR3: 0000000074404000 CR4: 00000000000006a0 [ 452.080015] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 452.080015] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 452.080015] Process accel-pppd (pid: 6643, threadinfo ffff88007125e000, task ffff8800b27e6dd0) [ 452.080015] Stack: [ 452.080015] ffff88007125fc28 ffffffff81256559 ffff88007125fc98 ffffffffa01b2bd1 [ 452.080015] ffff88007125fc58 000000000000000c 00000000029490d0 0000009c71dbe25e [ 452.080015] 000000000000005c 000000080000000e 0000000000000000 ffff880071170600 [ 452.080015] Call Trace: [ 452.080015] [<ffffffff81256559>] _raw_spin_lock+0xe/0x10 [ 452.080015] [<ffffffffa01b2bd1>] l2tp_xmit_skb+0x189/0x4ac [l2tp_core] [ 452.080015] [<ffffffffa01c2d36>] pppol2tp_sendmsg+0x15e/0x19c [l2tp_ppp] [ 452.080015] [<ffffffff811c7872>] __sock_sendmsg_nosec+0x22/0x24 [ 452.080015] [<ffffffff811c83bd>] sock_sendmsg+0xa1/0xb6 [ 452.080015] [<ffffffff81254e88>] ? __schedule+0x5c1/0x616 [ 452.080015] [<ffffffff8103c7c6>] ? __dequeue_signal+0xb7/0x10c [ 452.080015] [<ffffffff810bbd21>] ? fget_light+0x75/0x89 [ 452.080015] [<ffffffff811c8444>] ? sockfd_lookup_light+0x20/0x56 [ 452.080015] [<ffffffff811c9b34>] sys_sendto+0x10c/0x13b [ 452.080015] [<ffffffff8125cac2>] system_call_fastpath+0x16/0x1b [ 452.080015] Code: 81 48 89 e5 72 0c 31 c0 48 81 ff 45 66 25 81 0f 92 c0 5d c3 55 b8 00 01 00 00 48 89 e5 f0 66 0f c1 07 0f b6 d4 38 d0 74 06 f3 90 <8a> 07 eb f6 5d c3 90 90 55 48 89 e5 9c 58 0f 1f 44 00 00 5d c3 [ 452.080015] Call Trace: [ 452.080015] [<ffffffff81256559>] _raw_spin_lock+0xe/0x10 [ 452.080015] [<ffffffffa01b2bd1>] l2tp_xmit_skb+0x189/0x4ac [l2tp_core] [ 452.080015] [<ffffffffa01c2d36>] pppol2tp_sendmsg+0x15e/0x19c [l2tp_ppp] [ 452.080015] [<ffffffff811c7872>] __sock_sendmsg_nosec+0x22/0x24 [ 452.080015] [<ffffffff811c83bd>] sock_sendmsg+0xa1/0xb6 [ 452.080015] [<ffffffff81254e88>] ? __schedule+0x5c1/0x616 [ 452.080015] [<ffffffff8103c7c6>] ? __dequeue_signal+0xb7/0x10c [ 452.080015] [<ffffffff810bbd21>] ? fget_light+0x75/0x89 [ 452.080015] [<ffffffff811c8444>] ? sockfd_lookup_light+0x20/0x56 [ 452.080015] [<ffffffff811c9b34>] sys_sendto+0x10c/0x13b [ 452.080015] [<ffffffff8125cac2>] system_call_fastpath+0x16/0x1b [ 452.064012] [ 452.064012] Pid: 6662, comm: accel-pppd Not tainted 3.2.46.mini Digilent#1 Bochs Bochs [ 452.064012] RIP: 0010:[<ffffffff81059f6e>] [<ffffffff81059f6e>] do_raw_spin_lock+0x19/0x1f [ 452.064012] RSP: 0018:ffff8800b6e83ba0 EFLAGS: 00000297 [ 452.064012] RAX: 000000000000aaa9 RBX: ffff8800b6e83b40 RCX: 0000000000000002 [ 452.064012] RDX: 00000000000000aa RSI: 000000000000000a RDI: ffff8800745c8110 [ 452.064012] RBP: ffff8800b6e83ba0 R08: 000000000000c802 R09: 000000000000001c [ 452.064012] R10: ffff880071096c4e R11: 0000000000000006 R12: ffff8800b6e83b18 [ 452.064012] R13: ffffffff8125d51e R14: ffff8800b6e83ba0 R15: ffff880072a589c0 [ 452.064012] FS: 00007fdc0b81e700(0000) GS:ffff8800b6e80000(0000) knlGS:0000000000000000 [ 452.064012] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 452.064012] CR2: 0000000000625208 CR3: 0000000074404000 CR4: 00000000000006a0 [ 452.064012] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 452.064012] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 452.064012] Process accel-pppd (pid: 6662, threadinfo ffff88007129a000, task ffff8800744f7410) [ 452.064012] Stack: [ 452.064012] ffff8800b6e83bb0 ffffffff81256559 ffff8800b6e83bc0 ffffffff8121c64a [ 452.064012] ffff8800b6e83bf0 ffffffff8121ec7a ffff880072a589c0 ffff880071096c62 [ 452.064012] 0000000000000011 ffffffff81430024 ffff8800b6e83c80 ffffffff8121f276 [ 452.064012] Call Trace: [ 452.064012] <IRQ> [ 452.064012] [<ffffffff81256559>] _raw_spin_lock+0xe/0x10 [ 452.064012] [<ffffffff8121c64a>] spin_lock+0x9/0xb [ 452.064012] [<ffffffff8121ec7a>] udp_queue_rcv_skb+0x186/0x269 [ 452.064012] [<ffffffff8121f276>] __udp4_lib_rcv+0x297/0x4ae [ 452.064012] [<ffffffff8121c178>] ? raw_rcv+0xe9/0xf0 [ 452.064012] [<ffffffff8121f4a7>] udp_rcv+0x1a/0x1c [ 452.064012] [<ffffffff811fe385>] ip_local_deliver_finish+0x12b/0x1a5 [ 452.064012] [<ffffffff811fe54e>] ip_local_deliver+0x53/0x84 [ 452.064012] [<ffffffff811fe1d0>] ip_rcv_finish+0x2bc/0x2f3 [ 452.064012] [<ffffffff811fe78f>] ip_rcv+0x210/0x269 [ 452.064012] [<ffffffff8101911e>] ? kvm_clock_get_cycles+0x9/0xb [ 452.064012] [<ffffffff811d88cd>] __netif_receive_skb+0x3a5/0x3f7 [ 452.064012] [<ffffffff811d8eba>] netif_receive_skb+0x57/0x5e [ 452.064012] [<ffffffff811cf30f>] ? __netdev_alloc_skb+0x1f/0x3b [ 452.064012] [<ffffffffa0049126>] virtnet_poll+0x4ba/0x5a4 [virtio_net] [ 452.064012] [<ffffffff811d9417>] net_rx_action+0x73/0x184 [ 452.064012] [<ffffffffa01b2cc2>] ? l2tp_xmit_skb+0x27a/0x4ac [l2tp_core] [ 452.064012] [<ffffffff810343b9>] __do_softirq+0xc3/0x1a8 [ 452.064012] [<ffffffff81013b56>] ? ack_APIC_irq+0x10/0x12 [ 452.064012] [<ffffffff81256559>] ? _raw_spin_lock+0xe/0x10 [ 452.064012] [<ffffffff8125e0ac>] call_softirq+0x1c/0x26 [ 452.064012] [<ffffffff81003587>] do_softirq+0x45/0x82 [ 452.064012] [<ffffffff81034667>] irq_exit+0x42/0x9c [ 452.064012] [<ffffffff8125e146>] do_IRQ+0x8e/0xa5 [ 452.064012] [<ffffffff8125676e>] common_interrupt+0x6e/0x6e [ 452.064012] <EOI> [ 452.064012] [<ffffffff810b82a1>] ? kfree+0x8a/0xa3 [ 452.064012] [<ffffffffa01b2cc2>] ? l2tp_xmit_skb+0x27a/0x4ac [l2tp_core] [ 452.064012] [<ffffffffa01b2c25>] ? l2tp_xmit_skb+0x1dd/0x4ac [l2tp_core] [ 452.064012] [<ffffffffa01c2d36>] pppol2tp_sendmsg+0x15e/0x19c [l2tp_ppp] [ 452.064012] [<ffffffff811c7872>] __sock_sendmsg_nosec+0x22/0x24 [ 452.064012] [<ffffffff811c83bd>] sock_sendmsg+0xa1/0xb6 [ 452.064012] [<ffffffff81254e88>] ? __schedule+0x5c1/0x616 [ 452.064012] [<ffffffff8103c7c6>] ? __dequeue_signal+0xb7/0x10c [ 452.064012] [<ffffffff810bbd21>] ? fget_light+0x75/0x89 [ 452.064012] [<ffffffff811c8444>] ? sockfd_lookup_light+0x20/0x56 [ 452.064012] [<ffffffff811c9b34>] sys_sendto+0x10c/0x13b [ 452.064012] [<ffffffff8125cac2>] system_call_fastpath+0x16/0x1b [ 452.064012] Code: 89 e5 72 0c 31 c0 48 81 ff 45 66 25 81 0f 92 c0 5d c3 55 b8 00 01 00 00 48 89 e5 f0 66 0f c1 07 0f b6 d4 38 d0 74 06 f3 90 8a 07 <eb> f6 5d c3 90 90 55 48 89 e5 9c 58 0f 1f 44 00 00 5d c3 55 48 [ 452.064012] Call Trace: [ 452.064012] <IRQ> [<ffffffff81256559>] _raw_spin_lock+0xe/0x10 [ 452.064012] [<ffffffff8121c64a>] spin_lock+0x9/0xb [ 452.064012] [<ffffffff8121ec7a>] udp_queue_rcv_skb+0x186/0x269 [ 452.064012] [<ffffffff8121f276>] __udp4_lib_rcv+0x297/0x4ae [ 452.064012] [<ffffffff8121c178>] ? raw_rcv+0xe9/0xf0 [ 452.064012] [<ffffffff8121f4a7>] udp_rcv+0x1a/0x1c [ 452.064012] [<ffffffff811fe385>] ip_local_deliver_finish+0x12b/0x1a5 [ 452.064012] [<ffffffff811fe54e>] ip_local_deliver+0x53/0x84 [ 452.064012] [<ffffffff811fe1d0>] ip_rcv_finish+0x2bc/0x2f3 [ 452.064012] [<ffffffff811fe78f>] ip_rcv+0x210/0x269 [ 452.064012] [<ffffffff8101911e>] ? kvm_clock_get_cycles+0x9/0xb [ 452.064012] [<ffffffff811d88cd>] __netif_receive_skb+0x3a5/0x3f7 [ 452.064012] [<ffffffff811d8eba>] netif_receive_skb+0x57/0x5e [ 452.064012] [<ffffffff811cf30f>] ? __netdev_alloc_skb+0x1f/0x3b [ 452.064012] [<ffffffffa0049126>] virtnet_poll+0x4ba/0x5a4 [virtio_net] [ 452.064012] [<ffffffff811d9417>] net_rx_action+0x73/0x184 [ 452.064012] [<ffffffffa01b2cc2>] ? l2tp_xmit_skb+0x27a/0x4ac [l2tp_core] [ 452.064012] [<ffffffff810343b9>] __do_softirq+0xc3/0x1a8 [ 452.064012] [<ffffffff81013b56>] ? ack_APIC_irq+0x10/0x12 [ 452.064012] [<ffffffff81256559>] ? _raw_spin_lock+0xe/0x10 [ 452.064012] [<ffffffff8125e0ac>] call_softirq+0x1c/0x26 [ 452.064012] [<ffffffff81003587>] do_softirq+0x45/0x82 [ 452.064012] [<ffffffff81034667>] irq_exit+0x42/0x9c [ 452.064012] [<ffffffff8125e146>] do_IRQ+0x8e/0xa5 [ 452.064012] [<ffffffff8125676e>] common_interrupt+0x6e/0x6e [ 452.064012] <EOI> [<ffffffff810b82a1>] ? kfree+0x8a/0xa3 [ 452.064012] [<ffffffffa01b2cc2>] ? l2tp_xmit_skb+0x27a/0x4ac [l2tp_core] [ 452.064012] [<ffffffffa01b2c25>] ? l2tp_xmit_skb+0x1dd/0x4ac [l2tp_core] [ 452.064012] [<ffffffffa01c2d36>] pppol2tp_sendmsg+0x15e/0x19c [l2tp_ppp] [ 452.064012] [<ffffffff811c7872>] __sock_sendmsg_nosec+0x22/0x24 [ 452.064012] [<ffffffff811c83bd>] sock_sendmsg+0xa1/0xb6 [ 452.064012] [<ffffffff81254e88>] ? __schedule+0x5c1/0x616 [ 452.064012] [<ffffffff8103c7c6>] ? __dequeue_signal+0xb7/0x10c [ 452.064012] [<ffffffff810bbd21>] ? fget_light+0x75/0x89 [ 452.064012] [<ffffffff811c8444>] ? sockfd_lookup_light+0x20/0x56 [ 452.064012] [<ffffffff811c9b34>] sys_sendto+0x10c/0x13b [ 452.064012] [<ffffffff8125cac2>] system_call_fastpath+0x16/0x1b Reported-by: François Cachereul <f.cachereul@alphalink.fr> Tested-by: François Cachereul <f.cachereul@alphalink.fr> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: James Chapman <jchapman@katalix.com> Signed-off-by: David S. Miller <davem@davemloft.net>
jameyhicks
pushed a commit
to cambridgehackers/device_xilinx_kernel
that referenced
this pull request
Apr 30, 2014
If EM Transmit bit is busy during init ata_msleep() is called. It is wrong - msleep() should be used instead of ata_msleep(), because if EM Transmit bit is busy for one port, it will be busy for all other ports too, so using ata_msleep() causes wasting tries for another ports. The most common scenario looks like that now (six ports try to transmit a LED meaasege): - port #0 tries for the 1st time and succeeds - ports Digilent#1-5 try for the 1st time and sleeps - port Digilent#1 tries for the 2nd time and succeeds - ports Digilent#2-5 try for the 2nd time and sleeps - port Digilent#2 tries for the 3rd time and succeeds - ports #3-5 try for the 3rd time and sleeps - port #3 tries for the 4th time and succeeds - ports #4-5 try for the 4th time and sleeps - port #4 tries for the 5th time and succeeds - port #5 tries for the 5th time and sleeps At this moment port #5 wasted all its five tries and failed to initialize. Because there are only 5 (EM_MAX_RETRY) tries available usually only five ports succeed to initialize. The sixth port and next ones usually will fail. If msleep() is used instead of ata_msleep() the first port succeeds to initialize in the first try and next ones usually succeed to initialize in the second try. tj: updated comment Signed-off-by: Lukasz Dorau <lukasz.dorau@intel.com> Signed-off-by: Tejun Heo <tj@kernel.org>
jameyhicks
pushed a commit
to cambridgehackers/device_xilinx_kernel
that referenced
this pull request
Apr 30, 2014
This fixes an oops caused by buslogic driver when initializing a BusLogic MultiMaster adapter. Initialization code used scope of a variable incorrectly which created a NULL pointer. Oops message is below: BUG: unable to handle kernel NULL pointer dereference at 0000000c IP: [<c150c137>] blogic_init_mm_probeinfo.isra.17+0x20a/0x583 *pde = 00000000 Oops: 002 [Digilent#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 1 Comm: swapper/0 Not tainted 3.11.1.puz1 Digilent#1 Hardware name: /Canterwood, BIOS 6.00 PG 05/16/2003 task: f7050000 ti: f7054000 task.ti: f7054000 EIP: 0060:[<c150c137>] EFLAGS: 00010246 CPU:1 EIP is at blogic_init_mm_probeinfo.isra.17+0x20a/0x583 EAX: 00000013 EBX: 00000000 ECX: 00000000 EDX: f8001000 ESI: f71cb800 EDI: f7388000 EBP: 00007800 ESP: f7055c84 DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 CR0: 8005003b CR2: 0000000c CR3: 0154f000 CR4: 000007d0 Stack: 0000001c 00000000 c11a59f6 f7055c98 00008130 ffffffff ffffffff 00000000 00000003 00000000 00000000 00000000 00000013 f8001000 00000001 000003d0 00000000 00000000 00000000 c14e3f84 f78803c8 00000000 f738c000 000000e9 Call Trace: [<c11a59f6>] ? pci_get_subsys+0x33/0x38 [<c150c4fb>] ? blogic_init_probeinfo_list+0x4b/0x19e [<c108d593>] ? __alloc_pages_nodemask+0xe3/0x623 [<c108d593>] ? __alloc_pages_nodemask+0xe3/0x623 [<c10fb99e>] ? sysfs_link_sibling+0x61/0x8d [<c10b0519>] ? kmem_cache_alloc+0x8b/0xb5 [<c150cce5>] ? blogic_init+0xa1/0x10e8 [<c10fc0a8>] ? sysfs_add_one+0x10/0x9d [<c10fc18a>] ? sysfs_addrm_finish+0x12/0x85 [<c10fca37>] ? sysfs_do_create_link_sd+0x9d/0x1b4 [<c117c272>] ? blk_register_queue+0x69/0xb3 [<c10fcb68>] ? sysfs_create_link+0x1a/0x2c [<c1181a07>] ? add_disk+0x1a1/0x3c7 [<c138737b>] ? klist_next+0x60/0xc3 [<c122cc3a>] ? scsi_dh_detach+0x68/0x68 [<c1213e36>] ? bus_for_each_dev+0x51/0x61 [<c1000356>] ? do_one_initcall+0x22/0x12c [<c10f3688>] ? __proc_create+0x8c/0xba [<c150cc44>] ? blogic_setup+0x5f6/0x5f6 [<c14e94aa>] ? repair_env_string+0xf/0x4d [<c14e949b>] ? do_early_param+0x71/0x71 [<c103efaa>] ? parse_args+0x21f/0x33d [<c14e9a54>] ? kernel_init_freeable+0xdf/0x17d [<c14e949b>] ? do_early_param+0x71/0x71 [<c1388b64>] ? kernel_init+0x8/0xc0 [<c1392222>] ? ret_from_kernel_thread+0x6/0x28 [<c1392227>] ? ret_from_kernel_thread+0x1b/0x28 [<c1388b5c>] ? rest_init+0x6c/0x6c Code: 89 44 24 10 0f b6 44 24 3d 89 44 24 0c c7 44 24 08 00 00 00 00 c7 44 24 04 38 62 46 c1 c7 04 24 02 00 00 00 e8 78 13 d2 ff 31 db <89> 6b 0c b0 20 89 ea ee c7 44 24 08 04 00 00 00 8d 44 24 4c 89 EIP: [<c150c137>] blogic_init_mm_probeinfo.isra.17+0x20a/0x583 SS:ESP 0068:f7055c84 CR2: 000000000000000c ---[ end trace 17f45f5196d40487 ]--- Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009 Signed-off-by: Khalid Aziz <khalid.aziz@oracle.com> Cc: <stable@vger.kernel.org> # 3.11.x Reported-by: Pierre Uszynski <pierre@rahul.net> Tested-by: Pierre Uszynski <pierre@rahul.net> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
jameyhicks
pushed a commit
to cambridgehackers/device_xilinx_kernel
that referenced
this pull request
Apr 30, 2014
When CMA fails to initialize in v3.12-rc4, the chipidea driver oopses the kernel while trying to remove and put the HCD which doesn't exist: WARNING: CPU: 0 PID: 6 at /home/rmk/git/linux-rmk/arch/arm/mm/dma-mapping.c:511 __dma_alloc+0x200/0x240() coherent pool not initialised! Modules linked in: CPU: 0 PID: 6 Comm: kworker/u2:0 Tainted: G W 3.12.0-rc4+ #56 Workqueue: deferwq deferred_probe_work_func Backtrace: [<c001218c>] (dump_backtrace+0x0/0x10c) from [<c0012328>] (show_stack+0x18/0x1c) r6:c05fd9cc r5:000001ff r4:00000000 r3:df86ad00 [<c0012310>] (show_stack+0x0/0x1c) from [<c05f3a4c>] (dump_stack+0x70/0x8c) [<c05f39dc>] (dump_stack+0x0/0x8c) from [<c00230a8>] (warn_slowpath_common+0x6c/0x8c) r4:df883a60 r3:df86ad00 [<c002303c>] (warn_slowpath_common+0x0/0x8c) from [<c002316c>] (warn_slowpath_fmt+0x38/0x40) r8:ffffffff r7:00001000 r6:c083b808 r5:00000000 r4:df2efe80 [<c0023134>] (warn_slowpath_fmt+0x0/0x40) from [<c00196bc>] (__dma_alloc+0x200/0x240) r3:00000000 r2:c05fda00 [<c00194bc>] (__dma_alloc+0x0/0x240) from [<c001982c>] (arm_dma_alloc+0x88/0xa0) [<c00197a4>] (arm_dma_alloc+0x0/0xa0) from [<c03e2904>] (ehci_setup+0x1f4/0x438) [<c03e2710>] (ehci_setup+0x0/0x438) from [<c03cbd60>] (usb_add_hcd+0x18c/0x664) [<c03cbbd4>] (usb_add_hcd+0x0/0x664) from [<c03e89f4>] (host_start+0xf0/0x180) [<c03e8904>] (host_start+0x0/0x180) from [<c03e7c34>] (ci_hdrc_probe+0x360/0x670 ) r6:df2ef410 r5:00000000 r4:df2c3010 r3:c03e8904 [<c03e78d4>] (ci_hdrc_probe+0x0/0x670) from [<c0311044>] (platform_drv_probe+0x20/0x24) [<c0311024>] (platform_drv_probe+0x0/0x24) from [<c030fcac>] (driver_probe_device+0x9c/0x234) ... ---[ end trace c88ccaf3969e8422 ]--- Unable to handle kernel NULL pointer dereference at virtual address 00000028 pgd = c0004000 [00000028] *pgd=00000000 Internal error: Oops: 17 [Digilent#1] SMP ARM Modules linked in: CPU: 0 PID: 6 Comm: kworker/u2:0 Tainted: G W 3.12.0-rc4+ #56 Workqueue: deferwq deferred_probe_work_func task: df86ad00 ti: df882000 task.ti: df882000 PC is at usb_remove_hcd+0x10/0x150 LR is at host_stop+0x1c/0x3c pc : [<c03cacec>] lr : [<c03e88e4>] psr: 60000013 sp : df883b50 ip : df883b78 fp : df883b74 r10: c11f4c54 r9 : c0836450 r8 : df30c400 r7 : fffffff4 r6 : df2ef410 r5 : 00000000 r4 : df2c3010 r3 : 00000000 r2 : 00000000 r1 : df86b0a0 r0 : 00000000 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel Control: 10c53c7d Table: 2f29404a DAC: 00000015 Process kworker/u2:0 (pid: 6, stack limit = 0xdf882240) Stack: (0xdf883b50 to 0xdf884000) ... Backtrace: [<c03cacdc>] (usb_remove_hcd+0x0/0x150) from [<c03e88e4>] (host_stop+0x1c/0x3c) r6:df2ef410 r5:00000000 r4:df2c3010 [<c03e88c8>] (host_stop+0x0/0x3c) from [<c03e8aa0>] (ci_hdrc_host_destroy+0x1c/0x20) r5:00000000 r4:df2c3010 [<c03e8a84>] (ci_hdrc_host_destroy+0x0/0x20) from [<c03e7c80>] (ci_hdrc_probe+0x3ac/0x670) [<c03e78d4>] (ci_hdrc_probe+0x0/0x670) from [<c0311044>] (platform_drv_probe+0x20/0x24) [<c0311024>] (platform_drv_probe+0x0/0x24) from [<c030fcac>] (driver_probe_device+0x9c/0x234) [<c030fc10>] (driver_probe_device+0x0/0x234) from [<c030ff28>] (__device_attach+0x44/0x48) ... ---[ end trace c88ccaf3969e8423 ]--- Fix this so at least we can continue booting and get to a shell prompt. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Tested-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
jameyhicks
pushed a commit
to cambridgehackers/device_xilinx_kernel
that referenced
this pull request
Apr 30, 2014
When walk_page_range walk a memory map's page tables, it'll skip VM_PFNMAP area, then variable 'next' will to assign to vma->vm_end, it maybe larger than 'end'. In next loop, 'addr' will be larger than 'next'. Then in /proc/XXXX/pagemap file reading procedure, the 'addr' will growing forever in pagemap_pte_range, pte_to_pagemap_entry will access the wrong pte. BUG: Bad page map in process procrank pte:8437526f pmd:785de067 addr:9108d000 vm_flags:00200073 anon_vma:f0d99020 mapping: (null) index:9108d CPU: 1 PID: 4974 Comm: procrank Tainted: G B W O 3.10.1+ Digilent#1 Call Trace: dump_stack+0x16/0x18 print_bad_pte+0x114/0x1b0 vm_normal_page+0x56/0x60 pagemap_pte_range+0x17a/0x1d0 walk_page_range+0x19e/0x2c0 pagemap_read+0x16e/0x200 vfs_read+0x84/0x150 SyS_read+0x4a/0x80 syscall_call+0x7/0xb Signed-off-by: Liu ShuoX <shuox.liu@intel.com> Signed-off-by: Chen LinX <linx.z.chen@intel.com> Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> Reviewed-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com> Cc: <stable@vger.kernel.org> [3.10.x+] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
jameyhicks
pushed a commit
to cambridgehackers/device_xilinx_kernel
that referenced
this pull request
Apr 30, 2014
Unable to handle kernel NULL pointer dereference at virtual address 00000008 pgd = d5300000 [00000008] *pgd=0d265831, *pte=00000000, *ppte=00000000 Internal error: Oops: 17 [Digilent#1] PREEMPT ARM CPU: 0 PID: 2295 Comm: vlc Not tainted 3.11.0+ #755 task: dee74800 ti: e213c000 task.ti: e213c000 PC is at snd_pcm_info+0xc8/0xd8 LR is at 0x30232065 pc : [<c031b52c>] lr : [<30232065>] psr: a0070013 sp : e213dea8 ip : d81cb0d0 fp : c05f7678 r10: c05f7770 r9 : fffffdfd r8 : 00000000 r7 : d8a968a8 r6 : d8a96800 r5 : d8a96200 r4 : d81cb000 r3 : 00000000 r2 : d81cb000 r1 : 00000001 r0 : d8a96200 Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 10c5387d Table: 15300019 DAC: 00000015 Process vlc (pid: 2295, stack limit = 0xe213c248) [<c031b52c>] (snd_pcm_info) from [<c031b570>] (snd_pcm_info_user+0x34/0x9c) [<c031b570>] (snd_pcm_info_user) from [<c03164a4>] (snd_pcm_control_ioctl+0x274/0x280) [<c03164a4>] (snd_pcm_control_ioctl) from [<c0311458>] (snd_ctl_ioctl+0xc0/0x55c) [<c0311458>] (snd_ctl_ioctl) from [<c00eca84>] (do_vfs_ioctl+0x80/0x31c) [<c00eca84>] (do_vfs_ioctl) from [<c00ecd5c>] (SyS_ioctl+0x3c/0x60) [<c00ecd5c>] (SyS_ioctl) from [<c000e500>] (ret_fast_syscall+0x0/0x48) Code: e1a00005 e59530dc e3a01001 e1a02004 (e5933008) ---[ end trace cb3d9bdb8dfefb3c ]--- This is provoked when the ASoC front end is open along with its backend, (which causes the backend to have a runtime assigned to it) and then the SNDRV_CTL_IOCTL_PCM_INFO is requested for the (visible) backend device. Resolve this by ensuring that ASoC internal backend devices are not visible to userspace, just as the commentry for snd_pcm_new_internal() says it should be. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Acked-by: Mark Brown <broonie@linaro.org> Cc: <stable@vger.kernel.org> [v3.4+] Signed-off-by: Takashi Iwai <tiwai@suse.de>
socnix-lab
pushed a commit
that referenced
this pull request
Aug 15, 2016
This commit bd0b9ac ("genirq: Remove irq argument from irq flow handlers") Modified the number of arguments of the irq flow handlers. With the current driver we are seeing a kernel crash because of the above commit. Crash log: Unable to handle kernel NULL pointer dereference at virtual address 0000002c pgd = c0004000 [0000002c] *pgd=00000000 Internal error: Oops - BUG: 17 [#1] PREEMPT SMP ARM Modules linked in: axi_timer CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.4.0-xilinx #5 Hardware name: Xilinx Zynq Platform task: c0923870 ti: c091e000 task.ti: c091e000 PC is at intc_handler+0x18/0x8c LR is at 0x1 pc : [<c01e91cc>] lr : [<00000001>] psr: 60010193 sp : c091fee0 ip : 00000002 fp : 00000001 r10: 00000000 r9 : 00000008 r8 : 00000001 r7 : ef002600 r6 : c091a464 r5 : 00000010 r4 : 00000000 r3 : 00000000 r2 : 00000000 r1 : ef003c40 r0 : 00000000 Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none Control: 18c5387d Table: 2f16c04a DAC: 00000051 Process swapper/0 (pid: 0, stack limit = 0xc091e210) Stack: (0xc091fee0 to 0xc0920000) fee0: 00000000 00000000 c091a464 ef002600 00000001 c00576ec 00000000 c00579a8 ff00: f8f00100 c0920f7c c091ff30 c092ec00 f8f01100 c00093ac c0383918 60010013 ff20: ffffffff c091ff64 638ff226 c0013014 00000000 00000008 c091d000 ef7d7000 ff40: ef7d6618 00000001 7725eac9 00000008 638ff226 00000008 00000000 00000001 ff60: 00000008 c091ff80 c03838f4 c0383918 60010013 ffffffff 00000051 c03838e8 ff80: 3b993807 00000000 7725eac9 00000008 c091e000 ef7d6618 c091e000 c094d0e0 ffa0: c0919364 c091ffb8 c06aba30 00000000 00000000 c0050538 c0920400 c067ebdc ffc0: ffffffff ffffffff 00000000 c067e66c 00000000 c06aba30 00000000 c0954b94 ffe0: c0920480 c06aba2c c0924984 0000406a 413fc090 0000807c 00000000 00000000 [<c01e91cc>] (intc_handler) from [<c00576ec>] (generic_handle_irq+0x18/0x28) [<c00576ec>] (generic_handle_irq) from [<c00579a8>] (__handle_domain_irq+0x88/0xb0) [<c00579a8>] (__handle_domain_irq) from [<c00093ac>] (gic_handle_irq+0x50/0x90) [<c00093ac>] (gic_handle_irq) from [<c0013014>] (__irq_svc+0x54/0x90) Exception stack(0xc091ff30 to 0xc091ff78) ff20: 00000000 00000008 c091d000 ef7d7000 ff40: ef7d6618 00000001 7725eac9 00000008 638ff226 00000008 00000000 00000001 ff60: 00000008 c091ff80 c03838f4 c0383918 60010013 ffffffff [<c0013014>] (__irq_svc) from [<c0383918>] (cpuidle_enter_state+0xe8/0x1bc) [<c0383918>] (cpuidle_enter_state) from [<c0050538>] (cpu_startup_entry+0x19c/0x1ec) [<c0050538>] (cpu_startup_entry) from [<c067ebdc>] (start_kernel+0x328/0x388) Code: ebf9c52b e3500000 15904010 01a04000 (e595301c) ---[ end trace 1b82d42394b8ee22 ]--- Kernel panic - not syncing: Fatal exception in interrupt CPU1: stopping CPU: 1 PID: 0 Comm: swapper/1 Tainted: G D 4.4.0-xilinx #5 Hardware name: Xilinx Zynq Platform [<c00163b8>] (unwind_backtrace) from [<c0012620>] (show_stack+0x10/0x14) [<c0012620>] (show_stack) from [<c01c824c>] (dump_stack+0x80/0xcc) [<c01c824c>] (dump_stack) from [<c0014c2c>] (ipi_cpu_stop+0x3c/0x6c) [<c0014c2c>] (ipi_cpu_stop) from [<c0015344>] (handle_IPI+0x64/0x84) [<c0015344>] (handle_IPI) from [<c00093d0>] (gic_handle_irq+0x74/0x90) [<c00093d0>] (gic_handle_irq) from [<c0013014>] (__irq_svc+0x54/0x90) Exception stack(0xef06bf68 to 0xef06bfb0) bf60: 00000000 00000008 c091d000 ef7e3000 ef7e2618 00000001 bf80: 845530d3 00000008 668ca7c3 00000008 00000000 00000001 00000008 ef06bfb8 bfa0: c03838f4 c0383918 600d0013 ffffffff [<c0013014>] (__irq_svc) from [<c0383918>] (cpuidle_enter_state+0xe8/0x1bc) [<c0383918>] (cpuidle_enter_state) from [<c0050538>] (cpu_startup_entry+0x19c/0x1ec) [<c0050538>] (cpu_startup_entry) from [<0000948c>] (0x948c) ---[ end Kernel panic - not syncing: Fatal exception in interrupt This patch fixes this issue in the driver --> By updating the number of arguments in the flow handler to one. --> Use irq_desc_get_chip instead of irq_get_chip Signed-off-by: Kedareswara rao Appana <appanad@xilinx.com> Signed-off-by: Michal Simek <michal.simek@xilinx.com>
sbobrowicz
pushed a commit
to sbobrowicz/linux-digilent
that referenced
this pull request
Jun 22, 2018
Add a check for external phy driver to be probed before dereferencing phy driver pointer. This fixes the following crash: [ 2.439334] libphy: MACB_mii_bus: probed [ 2.444797] Unable to handle kernel NULL pointer dereference at virtual address 00000000 [ 2.452689] Mem abort info: [ 2.455453] Exception class = DABT (current EL), IL = 32 bits [ 2.461334] SET = 0, FnV = 0 [ 2.464361] EA = 0, S1PTW = 0 [ 2.467474] Data abort info: [ 2.470325] ISV = 0, ISS = 0x00000005 [ 2.474135] CM = 0, WnR = 0 [ 2.477077] [0000000000000000] user address but active_mm is swapper [ 2.483392] Internal error: Oops: 96000005 1 SMP [ 2.488232] Modules linked in: [ 2.491261] CPU: 3 PID: 1 Comm: swapper/0 Not tainted 4.14.0-xilinx-v2018.2 Digilent#1 [ 2.498438] Hardware name: ZynqMP ZC1275 RevB (DT) [ 2.503196] task: ffffffc06d846d00 task.stack: ffffff8008038000 [ 2.509085] PC is at __memcpy+0x100/0x180 [ 2.513061] LR is at xgmiitorgmii_probe+0x7c/0xf0 Signed-off-by: Harini Katakam <harini.katakam@xilinx.com> Signed-off-by: Michal Simek <monstr@monstr.eu>
ionel-badisor
pushed a commit
that referenced
this pull request
Nov 15, 2021
The function xilinx_dpdma_chan_alloc_tx_desc can be called from atomic context, hence use GFP_ATOMIC instead of GFP_KERNEL, or else it will cause the calltrace as below: BUG: sleeping function called from invalid context at mm/slab.h:418 in_atomic(): 1, irqs_disabled(): 128, pid: 416, name: alsa-sink-(null Preemption disabled at: [<ffffff80109f4560>] snd_pcm_stream_lock_irq+0x40/0x50 CPU: 2 PID: 416 Comm: alsa-sink-(null Tainted: G O 5.2.17-yocto-standard #1 Hardware name: ZynqMP ZCU102 Rev1.0 (DT) Call trace: dump_backtrace+0x0/0x138 show_stack+0x24/0x30 dump_stack+0x94/0xbc ___might_sleep+0x14c/0x178 __might_sleep+0x58/0x90 kmem_cache_alloc_trace+0x1a4/0x300 xilinx_dpdma_chan_alloc_tx_desc.isra.0+0x24/0x40 xilinx_dpdma_prep_dma_cyclic+0xc0/0x208 snd_dmaengine_pcm_trigger+0xf8/0x198 soc_pcm_trigger+0xb4/0x128 snd_pcm_do_start+0x48/0x58 snd_pcm_action_single+0x4c/0xa0 snd_pcm_action+0x78/0x90 snd_pcm_action_lock_irq+0x3c/0x60 snd_pcm_common_ioctl+0x4ac/0x10c8 snd_pcm_ioctl+0x48/0x68 do_vfs_ioctl+0x6d4/0x968 ksys_ioctl+0x84/0xb8 __arm64_sys_ioctl+0x28/0x38 el0_svc_common.constprop.0+0x74/0x180 el0_svc_handler+0x70/0x90 el0_svc+0x8/0xc Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com> Reviewed-by: Hyun Kwon <hyun.kwon@xilinx.com> Signed-off-by: Michal Simek <michal.simek@xilinx.com> State: pending
ionel-badisor
pushed a commit
that referenced
this pull request
Nov 15, 2021
In a scenario when the multiple iperf3 transmit streams are executed there is a high probability to overflow the transmit FIFO buffer and generate async abort(SError) which might lead to kernel panic. In the transmit path, add proper locking to ensure updates to TX FIFO are atomic and also check transmit data FIFO vacancy before writing to the TX FIFO. This is inline with recommended programming sequence for transmitting a packet using axistream FIFO and as a side effect it also fixes the below iperf3 crash: [ 283.692957] SError Interrupt on CPU1, code 0xbf000002 – SError [ 283.692960] CPU: 1 PID: 515 Comm: udhcpc Not tainted 5.4.0-xilinx-v2020.1 #1 [ 283.692961] Hardware name: xlnx,zynqmp (DT) [ 283.692963] pstate: 80000085 (Nzcv daIf -PAN -UAO) [ 283.692964] pc : dma_direct_map_page+0x20/0x130 [ 283.692966] lr : axienet_start_xmit+0x1ac/0x6b0 [ 283.692967] sp : ffffffc01000b860 [ 283.692968] x29: ffffffc01000b860 x28: 0000000000000001 [ 283.692971] x27: ffffffc0112c5400 x26: ffffff8876f047c0 [ 283.692974] x25: ffffffc0112c5000 x24: 0000000000000000 [ 283.692977] x23: ffffff8876f04000 x22: 0000000000000000 [ 283.692980] x21: ffffffc0112c5400 x20: ffffff8876012700 [ 283.692983] x19: ffffff887ab48c10 x18: 0000000000000000 [ 283.692985] x17: 0000000000000000 x16: 0000000000000000 [ 283.692988] x15: 0000000000000000 x14: 0000000000000000 [ 283.692991] x13: 0000000000000000 x12: 0000000000000000 [ 283.692994] x11: 0000000000000000 x10: 0000000000000000 [ 283.692997] x9 : 0000000000000000 x8 : 0000000000000000 [ 283.693000] x7 : 0000000000000000 x6 : fffffffeffe00000 [ 283.693002] x5 : 0000000000000000 x4 : 0000000000000001 [ 283.693005] x3 : 00000000000005ea x2 : 00000000000000ce [ 283.693008] x1 : 0000000021d86040 x0 : ffffff887ab48c10 [ 283.693012] SError Interrupt on CPU2, code 0xbf000002 – SError [ 283.693014] CPU: 2 PID: 622 Comm: iperf3 Not tainted 5.4.0-xilinx-v2020.1 #1 [ 283.693015] Hardware name: xlnx,zynqmp (DT) [ 283.693016] pstate: 80000085 (Nzcv daIf -PAN -UAO) [ 283.693018] pc : dma_direct_map_page+0x20/0x130 [ 283.693019] lr : axienet_start_xmit+0x1ac/0x6b0 [ 283.693020] sp : ffffffc011d4b4a0 [ 283.693021] x29: ffffffc011d4b4a0 x28: 0000000000000001 [ 283.693024] x27: ffffffc01130dd80 x26: ffffff8876f047c0 Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com> Reviewed-by: Harini Katakam <harini.katakam@xilinx.com> State: pending
ionel-badisor
pushed a commit
that referenced
this pull request
Nov 15, 2021
This patch fixes the below kernel crash by initializing the notifier. [ 8.921633] Unable to handle kernel paging request at virtual address ffffffffffffffd8 [ 8.929552] Mem abort info: [ 8.932335] ESR = 0x96000005 [ 8.935380] EC = 0x25: DABT (current EL), IL = 32 bits [ 8.940686] SET = 0, FnV = 0 [ 8.943739] EA = 0, S1PTW = 0 [ 8.946871] Data abort info: [ 8.949745] ISV = 0, ISS = 0x00000005 [ 8.953574] CM = 0, WnR = 0 [ 8.956530] swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000000f3b000 [ 8.963229] [ffffffffffffffd8] pgd=0000000000000000, pud=0000000000000000 [ 8.970020] Internal error: Oops: 96000005 [#1] SMP [ 8.974889] Modules linked in: [ 8.977939] CPU: 3 PID: 58 Comm: kworker/3:1 Not tainted 5.4.0-00190-g32df9bde2d74 #84 [ 8.985847] Hardware name: ZynqMP ZCU102 Rev1.0 (DT) [ 8.990810] Workqueue: events deferred_probe_work_func [ 8.995942] pstate: a0000005 (NzCv daif -PAN -UAO) [ 9.000730] pc : v4l2_async_notifier_asd_valid+0x88/0x1d8 [ 9.006117] lr : v4l2_async_notifier_add_subdev+0x38/0x78 [ 9.011504] sp : ffffffc0112bbad0 [ 9.014811] x29: ffffffc0112bbad0 x28: 0000000000000438 [ 9.020116] x27: 0000000000000001 x26: 0000000000000001 [ 9.025420] x25: ffffff80068369a8 x24: 0000000000000003 [ 9.030724] x23: 00000000ffffffff x22: ffffff80068369a0 [ 9.036028] x21: 0000000000000000 x20: ffffff80068393b8 [ 9.041332] x19: ffffffffffffffd8 x18: 0000000000000000 [ 9.046636] x17: ffffff806d401508 x16: ffffff806d401528 [ 9.051940] x15: ffffffffffffffff x14: ffffff0000000000 [ 9.057244] x13: ffffffffffffffff x12: 0000000000000028 [ 9.062548] x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f [ 9.067852] x9 : 7f7f7f7f7f7f7f7f x8 : fefeff7273716e6f [ 9.073156] x7 : 0000000000ffffff x6 : 0000000000000000 [ 9.078460] x5 : 0000000000000000 x4 : 0000000000000000 [ 9.083764] x3 : ffffffffffffffd8 x2 : 00000000ffffffff [ 9.089068] x1 : ffffff80068369a8 x0 : 0000000000000003 [ 9.094372] Call trace: [ 9.096814] v4l2_async_notifier_asd_valid+0x88/0x1d8 [ 9.101858] v4l2_async_notifier_add_subdev+0x38/0x78 [ 9.106902] xvip_m2m_probe+0x338/0x548 [ 9.110729] platform_drv_probe+0x50/0xa0 [ 9.114730] really_probe+0xd8/0x2f8 [ 9.118297] driver_probe_device+0x54/0xe8 [ 9.122386] __device_attach_driver+0x80/0xb8 [ 9.126738] bus_for_each_drv+0x74/0xc0 [ 9.130564] __device_attach+0xdc/0x138 [ 9.134392] device_initial_probe+0x10/0x18 [ 9.138567] bus_probe_device+0x90/0x98 [ 9.142396] deferred_probe_work_func+0x6c/0xa0 [ 9.146920] process_one_work+0x1c4/0x338 [ 9.150920] worker_thread+0x260/0x488 [ 9.154663] kthread+0x120/0x128 [ 9.157883] ret_from_fork+0x10/0x18 [ 9.161454] Code: 37f80097 6b1502ff 110006b5 5400018d (b8408462) [ 9.167537] ---[ end trace 1ec282f3f6f1bd3f ]--- Signed-off-by: Vishal Sagar <vishal.sagar@xilinx.com> Reviewed-by: Hyun Kwon <hyun.kwon@xilinx.com> State: pending
ionel-badisor
pushed a commit
that referenced
this pull request
Nov 15, 2021
This patch fixes the below kernel crash. [ 8.921579] xilinx-mem2mem amba_pl@0:video_m2m: mem2mem device registered [ 8.928646] xilinx-mem2mem amba_pl@0:video_m2m: Entity type for entity a0100000.v_proc_ss was not initialized! [ 8.938679] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 8.947464] Mem abort info: [ 8.950253] ESR = 0x96000045 [ 8.953305] EC = 0x25: DABT (current EL), IL = 32 bits [ 8.958615] SET = 0, FnV = 0 [ 8.961660] EA = 0, S1PTW = 0 [ 8.964788] Data abort info: [ 8.967658] ISV = 0, ISS = 0x00000045 [ 8.971488] CM = 0, WnR = 1 [ 8.974448] [0000000000000000] user address but active_mm is swapper [ 8.980797] Internal error: Oops: 96000045 [#1] SMP [ 8.985668] Modules linked in: [ 8.988717] CPU: 3 PID: 58 Comm: kworker/3:1 Not tainted 5.4.0-00191-g259740c195d4 #85 [ 8.996625] Hardware name: ZynqMP ZCU102 Rev1.0 (DT) [ 9.001588] Workqueue: events deferred_probe_work_func [ 9.006721] pstate: 40000005 (nZcv daif -PAN -UAO) [ 9.011506] pc : media_create_pad_link+0xf0/0x188 [ 9.016199] lr : media_create_pad_link+0xd0/0x188 [ 9.020894] sp : ffffffc0112bb9d0 [ 9.024201] x29: ffffffc0112bb9d0 x28: ffffff8006870080 [ 9.029505] x27: ffffff806fafe548 x26: ffffff806cdfc0d0 [ 9.034809] x25: 0000000000000038 x24: ffffffc010ebc548 [ 9.040113] x23: 0000000000000001 x22: 0000000000000000 [ 9.045417] x21: ffffff800683a980 x20: ffffff8006870080 [ 9.050721] x19: ffffff806cdfc080 x18: 0000000000000010 [ 9.056025] x17: ffffff806d401508 x16: ffffff806d401528 [ 9.061329] x15: ffffffffffffffff x14: ffffff0000000000 [ 9.066633] x13: ffffffffffffffff x12: 0000000000000028 [ 9.071937] x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f [ 9.077241] x9 : 0000000000000000 x8 : ffffff800683a900 [ 9.082545] x7 : 0000000000000000 x6 : 000000000000003f [ 9.087849] x5 : 0000000000000040 x4 : 0000000000000001 [ 9.093153] x3 : ffffff800683a8a0 x2 : ffffff800683a880 [ 9.098457] x1 : 0000000000000002 x0 : 0000000000000000 [ 9.103761] Call trace: [ 9.106202] media_create_pad_link+0xf0/0x188 [ 9.110553] xvip_graph_notify_complete+0x2e0/0x528 [ 9.115425] v4l2_async_notifier_try_complete.part.0+0x44/0x60 [ 9.121248] v4l2_async_register_subdev+0xf4/0x1b0 [ 9.126030] xscaler_probe+0x5a8/0x8d8 [ 9.129771] platform_drv_probe+0x50/0xa0 [ 9.133772] really_probe+0xd8/0x2f8 [ 9.137340] driver_probe_device+0x54/0xe8 [ 9.141429] __device_attach_driver+0x80/0xb8 [ 9.145780] bus_for_each_drv+0x74/0xc0 [ 9.149606] __device_attach+0xdc/0x138 [ 9.153434] device_initial_probe+0x10/0x18 [ 9.157610] bus_probe_device+0x90/0x98 [ 9.161438] deferred_probe_work_func+0x6c/0xa0 [ 9.165962] process_one_work+0x1c4/0x338 [ 9.169963] worker_thread+0x260/0x488 [ 9.173705] kthread+0x120/0x128 [ 9.176926] ret_from_fork+0x10/0x18 [ 9.180496] Code: f9402e60 a902005a 52800041 f9002e63 (f9000003) [ 9.186579] ---[ end trace 80ce257d3f6f8213 ]--- This is caused because the media entity for the m2m video device is not registered correctly in newer kernels due to a check in video_register_media_controller() called from video_device_register(). This is fixed by adding the registration code to the driver. Using m2m framework is not feasible as it would lead to a different media pipeline where media source and sink are different elements and only one processing element entity is allowed between them. New framework m2m source -> processing element -> m2m sink Our pipeline video entity ----> vpss scaler <---- Add xvideo_register_media_controller() to fix media entity registration. Signed-off-by: Vishal Sagar <vishal.sagar@xilinx.com> Reviewed-by: Hyun Kwon <hyun.kwon@xilinx.com> State: pending
ionel-badisor
pushed a commit
that referenced
this pull request
Nov 16, 2021
Phy read status hook will not be assigned if generic phy is attached. Add a check for the hook and then call genphy's implementation in case hook isn't present. This is a fix for the following kernel oops: [ 6.806251] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 6.815033] Mem abort info: [ 6.817809] ESR = 0x86000005 [ 6.820854] Exception class = IABT (current EL), IL = 32 bits [ 6.826766] SET = 0, FnV = 0 [ 6.829805] EA = 0, S1PTW = 0 [ 6.832938] user pgtable: 4k pages, 39-bit VAs, pgdp = (____ptrval____) [ 6.839540] [0000000000000000] pgd=0000000000000000, pud=0000000000000000 [ 6.846322] Internal error: Oops: 86000005 [#1] SMP [ 6.851184] Modules linked in: uio_pdrv_genirq [ 6.855623] CPU: 2 PID: 42 Comm: kworker/2:1 Not tainted 4.19.0-xilinx-v2018.3 #1 [ 6.863093] Hardware name: ZynqMP ZC1275 RevB (DT) [ 6.867876] Workqueue: events_power_efficient phy_state_machine [ 6.873780] pstate: 60000005 (nZCv daif -PAN -UAO) [ 6.878552] pc : (null) [ 6.881853] lr : xgmiitorgmii_read_status+0x30/0x98 [ 6.886720] sp : ffffff800a79bd40 [ 6.890018] x29: ffffff800a79bd40 x28: 0000000000000000 [ 6.895321] x27: ffffffc06da5fb38 x26: ffffff8008d088a0 [ 6.900616] x25: 0000000000000000 x24: ffffffc06bed6be8 [ 6.905911] x23: ffffffc06bed6800 x22: ffffffc06bed6c38 [ 6.911206] x21: 0000000000000008 x20: ffffffc06bed5000 [ 6.916501] x19: ffffffc06bed6800 x18: 0000000000000400 [ 6.921795] x17: 0000000000000000 x16: 0000000000000000 [ 6.927090] x15: 0000000000000400 x14: 00000000000003b8 [ 6.932385] x13: 0000000000000000 x12: 0000000000000001 [ 6.937680] x11: 0000000000000000 x10: 00000000000007f0 [ 6.942975] x9 : ffffffc06d9f5d60 x8 : fefefefefefefeff [ 6.948269] x7 : 0000000000000018 x6 : 0000000000000018 [ 6.953564] x5 : 0000746e65696369 x4 : 000000000000002f [ 6.958859] x3 : ffffffc06bed6c38 x2 : 0000000000000000 [ 6.964154] x1 : ffffffc06bc1b000 x0 : ffffffc06bed6800 [ 6.969450] Process kworker/2:1 (pid: 42, stack limit = 0x(____ptrval____)) [ 6.976392] Call trace: [ 6.978823] (null) [ 6.981777] phy_state_machine+0x244/0x528 [ 6.985857] process_one_work+0x1e4/0x340 [ 6.989857] worker_thread+0x3c/0x488 [ 6.993504] kthread+0x124/0x128 [ 6.996715] ret_from_fork+0x10/0x18 [ 7.000274] Code: bad PC value [ 7.003312] ---[ end trace 058be319ffdbcfb0 ]--- Signed-off-by: Harini Katakam <harini.katakam@xilinx.com> Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com> Signed-off-by: Michal Simek <michal.simek@xilinx.com>
ionel-badisor
pushed a commit
that referenced
this pull request
Nov 16, 2021
For 10G subsystem there is no phy driver support hence driver doesn't connect to phy and phydev instance is always NULL. When user invokes mii-tool on the ethernet interface it throws NULL pointer dereference. To fix below crash, check for phydev instance before calling MII ioctl. --------------------------------------------------------------------- [ 17.707697] Unable to handle kernel NULL pointer dereference at virtual address 00000330 [ 17.715764] Mem abort info: [ 17.718534] Exception class = DABT (current EL), IL = 32 bits [ 17.724444] SET = 0, FnV = 0 [ 17.727473] EA = 0, S1PTW = 0 [ 17.730603] Data abort info: [ 17.733467] ISV = 0, ISS = 0x00000006 [ 17.737288] CM = 0, WnR = 0 [ 17.740239] user pgtable: 4k pages, 39-bit VAs, pgd = ffffffc87badc000 [ 17.746750] [0000000000000330] *pgd=0000000875ccd003, *pud=0000000875ccd003, *pmd=0000000000000000 [ 17.755693] Internal error: Oops: 96000006 [#1] SMP -- [ 17.775475] task: ffffffc87bb76300 task.stack: ffffff800db10000 [ 17.781382] PC is at phy_mii_ioctl+0xd4/0x298 [ 17.785719] LR is at axienet_ioctl+0x6c/0x78 [ 17.789971] pc : [<ffffff80085e94e4>] lr : [<ffffff8008607fdc>] pstate: 60000145 [ 17.797350] sp : ffffff800db13c80 <snip> Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com> Signed-off-by: Michal Simek <michal.simek@xilinx.com>
ionel-badisor
pushed a commit
that referenced
this pull request
Nov 16, 2021
In USXGMII configuration, if block lock/auto-negotiation is not completed we return -ENODEV from ndo_open without proper cleanup. As a result napi context is still enabled and on subsequent ifconfig up we hit napi_enable BUG_ON condition. To fix it add proper cleanup. [ 769.771340] ------------[ cut here ]------------ [ 769.775965] kernel BUG at /kernel-source//include/linux/netdevice.h:502! [ 769.782661] Internal error: Oops - BUG: 0 [#1] SMP [ 769.787440] Modules linked in: uio_pdrv_genirq [ 769.791880] CPU: 1 PID: 2212 Comm: ifconfig Not tainted 4.14.0-xilinx-v2018.3 #14 [ 769.799351] Hardware name: xlnx,zynqmp (DT) [ 769.803525] task: ffffffc87b25e280 task.stack: ffffff800c0a0000 [ 769.809444] PC is at axienet_open+0x164/0x6d0 [ 769.813795] LR is at axienet_open+0x15c/0x6d0 [ 769.818142] pc : [<ffffff8008636ff4>] lr : [<ffffff8008636fec>] pstate: 80000145 [ 769.825530] sp : ffffff800c0a3bf0 [ 769.828834] x29: ffffff800c0a3bf0 x28: ffffff800863a1e0 [ 769.834139] x27: 0000000000000000 x26: ffffffc87b3d7538 [ 769.839442] x25: 0000000000000043 x24: 0000000000000000 [ 769.844746] x23: ffffffc87b3d7538 x22: ffffffc87b3d6830 [ 769.850049] x21: ffffffc87b3d6ab0 x20: ffffffc87b3d6800 [ 769.855353] x19: ffffffc87b3d6000 x18: ffffffc87ff92460 [ 769.860656] x17: 0000007f9f71def0 x16: 0000000000000001 [ 769.865960] x15: ffffff8008e18000 x14: 0000000000000000 [ 769.871263] x13: ffffffc87ff92400 x12: 000000b339f1c013 [ 769.876567] x11: 0000000000000003 x10: 0000000000000880 [ 769.881871] x9 : ffffff800c0a3a50 x8 : ffffffc87b25eb60 [ 769.887174] x7 : ffffff800b210000 x6 : 0000000000000032 [ 769.892477] x5 : 0000000000000000 x4 : ffffff8008e5f930 [ 769.897781] x3 : 00000000ffff3051 x2 : ffffffc87987e400 [ 769.903084] x1 : ffffff800863a1e0 x0 : 0000000000000010 [ 769.908389] Process ifconfig (pid: 2212, stack limit = 0xffffff800c0a0000) [ 769.915255] Call trace: <snip> [ 770.007206] [<ffffff8008636ff4>] axienet_open+0x164/0x6d0 [ 770.012598] [<ffffff8008832a80>] __dev_open+0xc8/0x140 [ 770.017726] [<ffffff8008832e18>] __dev_change_flags+0x130/0x170 [ 770.023637] [<ffffff8008832e78>] dev_change_flags+0x20/0x60 [ 770.029203] [<ffffff80088aa2d0>] devinet_ioctl+0x748/0x810 [ 770.034678] [<ffffff80088ac3e4>] inet_ioctl+0x104/0x118 [ 770.039896] [<ffffff80088105c0>] sock_do_ioctl.constprop.18+0x20/0x60 [ 770.046326] [<ffffff8008810db4>] sock_ioctl+0x1e4/0x348 [ 770.051545] [<ffffff80081af764>] do_vfs_ioctl+0xa4/0x7d8 [ 770.056846] [<ffffff80081afedc>] SyS_ioctl+0x44/0x80 Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com> Acked-by: Harini Katakam <harini.katakam@xilinx.com> Signed-off-by: Michal Simek <michal.simek@xilinx.com>
ionel-badisor
pushed a commit
that referenced
this pull request
Nov 16, 2021
Generic dma test client driver(dmatest) supports DMA_SG and DMA_MEMCPY. Hence there is no need of keeping xilinx specific cdma client driver in the tree. This patch removes cdmatest client and from now onwards it's mandatory to use dmatest client for CDMA verification. Usage: echo 1 > /sys/module/dmatest/parameters/verbose echo dma1chan0 > /sys/module/dmatest/parameters/channel echo 2000 > /sys/module/dmatest/parameters/timeout echo 1 > /sys/module/dmatest/parameters/iterations echo 1 > /sys/module/dmatest/parameters/run [ 359.611486] dmatest: Started 1 threads using dma1chan0 [ 359.617245] dmatest: dma1chan0-copy0: result #1: 'test passed' with src_off=0x830 dst_off=0x368 len=0x3560 (0) [ 359.629924] dmatest: dma1chan0-copy0: summary 1 tests, 0 failures 77 iops 1002 KB/s (0) Reference: DMAEngine documentation » DMA Test Guide Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com> Acked-for-series: Appana Durga Kedareswara rao <appana.durga.rao@xilinx.com>
ionel-badisor
pushed a commit
that referenced
this pull request
Nov 16, 2021
According to the PCI Local Bus specification Revision 3.0, section 6.8.1.3 (Message Control for MSI), endpoints that are Multiple Message Capable as defined by bits [3:1] in the Message Control for MSI can request a number of vectors that is power of two aligned. As specified in section 6.8.1.6 "Message data for MSI", the Multiple Message Enable field (bits [6:4] of the Message Control register) defines the number of low order message data bits the function is permitted to modify to generate its system software allocated vectors. The MSI controller in the Xilinx NWL PCIe controller supports a number of MSI vectors specified through a bitmap and the hwirq number for an MSI, that is the value written in the MSI data TLP is determined by the bitmap allocation. For instance, in a situation where two endpoints sitting on the PCI bus request the following MSI configuration, with the current PCI Xilinx bitmap allocation code (that does not align MSI vector allocation on a power of two boundary): Endpoint #1: Requesting 1 MSI vector - allocated bitmap bits 0 Endpoint #2: Requesting 2 MSI vectors - allocated bitmap bits [1,2] The bitmap value(s) corresponds to the hwirq number that is programmed into the Message Data for MSI field in the endpoint MSI capability and is detected by the root complex to fire the corresponding MSI irqs. The value written in Message Data for MSI field corresponds to the first bit allocated in the bitmap for Multi MSI vectors. The current Xilinx NWL MSI allocation code allows a bitmap allocation that is not a power of two boundaries, so endpoint #2, is allowed to toggle Message Data bit[0] to differentiate between its two vectors (meaning that the MSI data will be respectively 0x0 and 0x1 for the two vectors allocated to endpoint #2). This clearly aliases with the Endpoint #1 vector allocation, resulting in a broken Multi MSI implementation. Update the code to allocate MSI bitmap ranges with a power of two alignment, fixing the bug. Fixes: ab597d3 ("PCI: xilinx-nwl: Add support for Xilinx NWL PCIe Host Controller") Suggested-by: Marc Zyngier <marc.zyngier@arm.com> Signed-off-by: Bharat Kumar Gogada <bharat.kumar.gogada@xilinx.com> [lorenzo.pieralisi@arm.com: updated commit log] Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com> Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.