kernel/arch/powerpc/sysdev, branch linux-3.2.y

powerpc/MSI: Fix race condition in tearing down MSI interrupts

2015-10-13T02:46:08Z

commit e297c939b745e420ef0b9dc989cb87bda617b399 upstream. This fixes a race which can result in the same virtual IRQ number being assigned to two different MSI interrupts. The most visible consequence of that is usually a warning and stack trace from the sysfs code about an attempt to create a duplicate entry in sysfs. The race happens when one CPU (say CPU 0) is disposing of an MSI while another CPU (say CPU 1) is setting up an MSI. CPU 0 calls (for example) pnv_teardown_msi_irqs(), which calls msi_bitmap_free_hwirqs() to indicate that the MSI (i.e. its hardware IRQ number) is no longer in use. Then, before CPU 0 gets to calling irq_dispose_mapping() to free up the virtal IRQ number, CPU 1 comes in and calls msi_bitmap_alloc_hwirqs() to allocate an MSI, and gets the same hardware IRQ number that CPU 0 just freed. CPU 1 then calls irq_create_mapping() to get a virtual IRQ number, which sees that there is currently a mapping for that hardware IRQ number and returns the corresponding virtual IRQ number (which is the same virtual IRQ number that CPU 0 was using). CPU 0 then calls irq_dispose_mapping() and frees that virtual IRQ number. Now, if another CPU comes along and calls irq_create_mapping(), it is likely to get the virtual IRQ number that was just freed, resulting in the same virtual IRQ number apparently being used for two different hardware interrupts. To fix this race, we just move the call to msi_bitmap_free_hwirqs() to after the call to irq_dispose_mapping(). Since virq_to_hw() doesn't work for the virtual IRQ number after irq_dispose_mapping() has been called, we need to call it before irq_dispose_mapping() and remember the result for the msi_bitmap_free_hwirqs() call. The pattern of calling msi_bitmap_free_hwirqs() before irq_dispose_mapping() appears in 5 places under arch/powerpc, and appears to have originated in commit 05af7bd2d75e ("[POWERPC] MPIC U3/U4 MSI backend") from 2007. Fixes: 05af7bd2d75e ("[POWERPC] MPIC U3/U4 MSI backend") Reported-by: Alexey Kardashevskiy Signed-off-by: Paul Mackerras Signed-off-by: Michael Ellerman [bwh: Backported to 3.2: - powernv uses a private functions instead of msi_bitmap_free_hwirqs() - Adjust filename, context] Signed-off-by: Ben Hutchings

axonram: Fix bug in direct_access

2015-05-09T22:16:12Z

commit 91117a20245b59f70b563523edbf998a62fc6383 upstream. The 'pfn' returned by axonram was completely bogus, and has been since 2008. Signed-off-by: Matthew Wilcox Reviewed-by: Jan Kara Reviewed-by: Mathieu Desnoyers Signed-off-by: Jens Axboe Signed-off-by: Ben Hutchings

powerpc: Make sure IPI handlers see data written by IPI senders

2012-09-19T14:04:42Z

commit 9fb1b36ca1234e64a5d1cc573175303395e3354d upstream. We have been observing hangs, both of KVM guest vcpu tasks and more generally, where a process that is woken doesn't properly wake up and continue to run, but instead sticks in TASK_WAKING state. This happens because the update of rq->wake_list in ttwu_queue_remote() is not ordered with the update of ipi_message in smp_muxed_ipi_message_pass(), and the reading of rq->wake_list in scheduler_ipi() is not ordered with the reading of ipi_message in smp_ipi_demux(). Thus it is possible for the IPI receiver not to see the updated rq->wake_list and therefore conclude that there is nothing for it to do. In order to make sure that anything done before smp_send_reschedule() is ordered before anything done in the resulting call to scheduler_ipi(), this adds barriers in smp_muxed_message_pass() and smp_ipi_demux(). The barrier in smp_muxed_message_pass() is a full barrier to ensure that there is a full ordering between the smp_send_reschedule() caller and scheduler_ipi(). In smp_ipi_demux(), we use xchg() rather than xchg_local() because xchg() includes release and acquire barriers. Using xchg() rather than xchg_local() makes sense given that ipi_message is not just accessed locally. This moves the barrier between setting the message and calling the cause_ipi() function into the individual cause_ipi implementations. Most of them -- those that used outb, out_8 or similar -- already had a full barrier because out_8 etc. include a sync before the MMIO store. This adds an explicit barrier in the two remaining cases. These changes made no measurable difference to the speed of IPIs as measured using a simple ping-pong latency test across two CPUs on different cores of a POWER7 machine. The analysis of the reason why processes were not waking up properly is due to Milton Miller. Reported-by: Milton Miller Signed-off-by: Paul Mackerras Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Ben Hutchings

powerpc/xics: Harden xics hypervisor backend

2012-09-19T14:04:42Z

commit 3ce21cdfe93efffa4ffba9cf3ca2576d3d60d6dc upstream. During kdump stress testing I sometimes see the kdump kernel panic with: Interrupt 0x306 (real) is invalid, disabling it. Kernel panic - not syncing: bad return code EOI - rc = -4, value=ff000306 Instead of panicing print the error message, dump the stack the first time it happens and continue on. Add some more information to the debug messages as well. Signed-off-by: Anton Blanchard Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Ben Hutchings

arch/powerpc/sysdev/ehv_pic.c: add missing kfree

2011-11-24T08:01:24Z

At this point, ehv_pic has been allocated but not stored anywhere, so it should be freed before leaving the function. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // @exists@ local idexpression x; statement S,S1; expression E; identifier fl; expression *ptr != NULL; @@ x = \(kmalloc\|kzalloc\|kcalloc\)(...); ... if (x == NULL) S <... when != x when != if (...) { <+...kfree(x)...+> } when any when != true x == NULL x->fl ...> ( if (x == NULL) S1 | if (...) { ... when != x when forall ( return \(0\|<+...x...+>\|ptr\); | * return ...; ) } ) // Signed-off-by: Julia Lawall Acked-by: Timur Tabi Signed-off-by: Kumar Gala

powerpc/fsl-lbc: Fix for fsl_upm

2011-11-24T08:00:42Z

If Freescale LBC driver fails to initialise itself from device tree, then internal structure is freed only but not NULL-fied. As result functions fsl_lbc_find() after checking the structure is not NULL are trying to access device registers. Signed-off-by: Alexandre Rusev Signed-off-by: Kumar Gala

powerpc/qe: Fixup QE_General4 errata

2011-11-24T07:28:42Z

QE_General4 should only round up the divisor iff divisor is > 3. Rounding up lower divisors makes the error too big, causing USB on MPC832x to fail. Signed-off-by: Joakim Tjernlund Acked-by: Timur Tabi Signed-off-by: Kumar Gala

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux

2011-11-15T16:47:28Z

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux: fsl-rio: fix compile error

fsl-rio: fix compile error

2011-11-14T17:43:17Z

The "#include " was replaced by "#include " in the patch "powerpc: various straight conversions from module.h --> export.h". This will cause the following compile problem: arch/powerpc/sysdev/fsl_rio.c: In function 'fsl_rio_mcheck_exception': arch/powerpc/sysdev/fsl_rio.c:296: error: implicit declaration of function 'search_exception_tables'. The file fsl_rio.c needs the declaration of function "search_exception_tables" in the header file "linux/module.h". Signed-off-by: Liu Gang Signed-off-by: Paul Gortmaker

powerpc/irq: Remove IRQF_DISABLED

2011-11-08T03:51:46Z

Since commit [e58aa3d2: genirq: Run irq handlers with interrupts disabled], We run all interrupt handlers with interrupts disabled and we even check and yell when an interrupt handler returns with interrupts enabled (see commit [b738a50a: genirq: Warn when handler enables interrupts]). So now this flag is a NOOP and can be removed. Signed-off-by: Yong Zhang Acked-by: Arnd Bergmann Acked-by: Geoff Levand Signed-off-by: Benjamin Herrenschmidt