-
Notifications
You must be signed in to change notification settings - Fork 22
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
HDMI I2C does not work for some users #14
Comments
Looks like others with same problem: |
That's a different issue - I fixed it here: 6ea2512#L1L1542 Essentially only CEA modes were permitted (ie. TV modes). |
This also can't be worked around using the video= kernel parameter, as it only selects from the modelist read from the monitor rather than setting a mode from scratch. Should probably add a ,force, parameter. |
hdmi audio works when setting video= resolution in boot.scr. |
I've had a poke at the DDC bus, and everything looks healthy at 100kHz. Workaround would be to force HDMI detection to on. Has anyone got a troublesome monitor or TV we can work with? |
hp__ tested this and found HDMI detection reports correctly. |
There is single method to set clock-rate for both audio and video pll-s From mailing list. Could this be sth for the video audio problem? [meta-freescale] [PATCH] arm/mach-mx6: fix pll4 set_rate callback
til meta-freescale In current implementation, independently of whether audio or video clock This patch fixes the issue described above. Signed-off-by: Alexander Smirnov [email protected]arch/arm/mach-mx6/clock.c | 3 ++- diff --git a/arch/arm/mach-mx6/clock.c b/arch/arm/mach-mx6/clock.c
|
The warning below triggers on AMD MCM packages because physical package IDs on the cores of a _physical_ socket are the same. I.e., this field says which CPUs belong to the same physical package. However, the same two CPUs belong to two different internal, i.e. "logical" nodes in the same physical socket which is reflected in the CPU-to-node map on x86 with NUMA. Which makes this check wrong on the above topologies so circumvent it. [ 0.444413] Booting Node 0, Processors #1 imx6-dongle#2 imx6-dongle#3 imx6-dongle#4 imx6-dongle#5 Ok. [ 0.461388] ------------[ cut here ]------------ [ 0.465997] WARNING: at arch/x86/kernel/smpboot.c:310 topology_sane.clone.1+0x6e/0x81() [ 0.473960] Hardware name: Dinar [ 0.477170] sched: CPU imx6-dongle#6's mc-sibling CPU #0 is not on the same node! [node: 1 != 0]. Ignoring dependency. [ 0.486860] Booting Node 1, Processors imx6-dongle#6 [ 0.491104] Modules linked in: [ 0.494141] Pid: 0, comm: swapper/6 Not tainted 3.4.0+ #1 [ 0.499510] Call Trace: [ 0.501946] [<ffffffff8144bf92>] ? topology_sane.clone.1+0x6e/0x81 [ 0.508185] [<ffffffff8102f1fc>] warn_slowpath_common+0x85/0x9d [ 0.514163] [<ffffffff8102f2b7>] warn_slowpath_fmt+0x46/0x48 [ 0.519881] [<ffffffff8144bf92>] topology_sane.clone.1+0x6e/0x81 [ 0.525943] [<ffffffff8144c234>] set_cpu_sibling_map+0x251/0x371 [ 0.532004] [<ffffffff8144c4ee>] start_secondary+0x19a/0x218 [ 0.537729] ---[ end trace 4eaa2a86a8e2da22 ]--- [ 0.628197] imx6-dongle#7 imx6-dongle#8 imx6-dongle#9 imx6-dongle#10 imx6-dongle#11 Ok. [ 0.807108] Booting Node 3, Processors imx6-dongle#12 imx6-dongle#13 imx6-dongle#14 imx6-dongle#15 imx6-dongle#16 imx6-dongle#17 Ok. [ 0.897587] Booting Node 2, Processors imx6-dongle#18 imx6-dongle#19 #20 #21 #22 #23 Ok. [ 0.917443] Brought up 24 CPUs We ran a topology sanity check test we have here on it and it all looks ok... hopefully :). Signed-off-by: Borislav Petkov <[email protected]> Cc: Andreas Herrmann <[email protected]> Signed-off-by: Peter Zijlstra <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Ingo Molnar <[email protected]>
Denys Fedoryshchenko reported a LOCKDEP issue with l2tp code. [ 8683.927442] ====================================================== [ 8683.927555] [ INFO: possible circular locking dependency detected ] [ 8683.927672] 3.4.1-build-0061 imx6-dongle#14 Not tainted [ 8683.927782] ------------------------------------------------------- [ 8683.927895] swapper/0/0 is trying to acquire lock: [ 8683.928007] (slock-AF_INET){+.-...}, at: [<e0fc73ec>] l2tp_xmit_skb+0x173/0x47e [l2tp_core] [ 8683.928121] [ 8683.928121] but task is already holding lock: [ 8683.928121] (_xmit_ETHER#2){+.-...}, at: [<c02f062d>] sch_direct_xmit+0x36/0x119 [ 8683.928121] [ 8683.928121] which lock already depends on the new lock. [ 8683.928121] [ 8683.928121] [ 8683.928121] the existing dependency chain (in reverse order) is: [ 8683.928121] [ 8683.928121] -> #1 (_xmit_ETHER#2){+.-...}: [ 8683.928121] [<c015a561>] lock_acquire+0x71/0x85 [ 8683.928121] [<c034da2d>] _raw_spin_lock+0x33/0x40 [ 8683.928121] [<c0304e0c>] ip_send_reply+0xf2/0x1ce [ 8683.928121] [<c0317dbc>] tcp_v4_send_reset+0x153/0x16f [ 8683.928121] [<c0317f4a>] tcp_v4_do_rcv+0x172/0x194 [ 8683.928121] [<c031929b>] tcp_v4_rcv+0x387/0x5a0 [ 8683.928121] [<c03001d0>] ip_local_deliver_finish+0x13a/0x1e9 [ 8683.928121] [<c0300645>] NF_HOOK.clone.11+0x46/0x4d [ 8683.928121] [<c030075b>] ip_local_deliver+0x41/0x45 [ 8683.928121] [<c03005dd>] ip_rcv_finish+0x31a/0x33c [ 8683.928121] [<c0300645>] NF_HOOK.clone.11+0x46/0x4d [ 8683.928121] [<c0300960>] ip_rcv+0x201/0x23d [ 8683.928121] [<c02de91b>] __netif_receive_skb+0x329/0x378 [ 8683.928121] [<c02deae8>] netif_receive_skb+0x4e/0x7d [ 8683.928121] [<e08d5ef3>] rtl8139_poll+0x243/0x33d [8139too] [ 8683.928121] [<c02df103>] net_rx_action+0x90/0x15d [ 8683.928121] [<c012b2b5>] __do_softirq+0x7b/0x118 [ 8683.928121] [ 8683.928121] -> #0 (slock-AF_INET){+.-...}: [ 8683.928121] [<c0159f1b>] __lock_acquire+0x9a3/0xc27 [ 8683.928121] [<c015a561>] lock_acquire+0x71/0x85 [ 8683.928121] [<c034da2d>] _raw_spin_lock+0x33/0x40 [ 8683.928121] [<e0fc73ec>] l2tp_xmit_skb+0x173/0x47e [l2tp_core] [ 8683.928121] [<e0fe31fb>] l2tp_eth_dev_xmit+0x1a/0x2f [l2tp_eth] [ 8683.928121] [<c02e01e7>] dev_hard_start_xmit+0x333/0x3f2 [ 8683.928121] [<c02f064c>] sch_direct_xmit+0x55/0x119 [ 8683.928121] [<c02e0528>] dev_queue_xmit+0x282/0x418 [ 8683.928121] [<c031f4fb>] NF_HOOK.clone.19+0x45/0x4c [ 8683.928121] [<c031f524>] arp_xmit+0x22/0x24 [ 8683.928121] [<c031f567>] arp_send+0x41/0x48 [ 8683.928121] [<c031fa7d>] arp_process+0x289/0x491 [ 8683.928121] [<c031f4fb>] NF_HOOK.clone.19+0x45/0x4c [ 8683.928121] [<c031f7a0>] arp_rcv+0xb1/0xc3 [ 8683.928121] [<c02de91b>] __netif_receive_skb+0x329/0x378 [ 8683.928121] [<c02de9d3>] process_backlog+0x69/0x130 [ 8683.928121] [<c02df103>] net_rx_action+0x90/0x15d [ 8683.928121] [<c012b2b5>] __do_softirq+0x7b/0x118 [ 8683.928121] [ 8683.928121] other info that might help us debug this: [ 8683.928121] [ 8683.928121] Possible unsafe locking scenario: [ 8683.928121] [ 8683.928121] CPU0 CPU1 [ 8683.928121] ---- ---- [ 8683.928121] lock(_xmit_ETHER#2); [ 8683.928121] lock(slock-AF_INET); [ 8683.928121] lock(_xmit_ETHER#2); [ 8683.928121] lock(slock-AF_INET); [ 8683.928121] [ 8683.928121] *** DEADLOCK *** [ 8683.928121] [ 8683.928121] 3 locks held by swapper/0/0: [ 8683.928121] #0: (rcu_read_lock){.+.+..}, at: [<c02dbc10>] rcu_lock_acquire+0x0/0x30 [ 8683.928121] #1: (rcu_read_lock_bh){.+....}, at: [<c02dbc10>] rcu_lock_acquire+0x0/0x30 [ 8683.928121] imx6-dongle#2: (_xmit_ETHER#2){+.-...}, at: [<c02f062d>] sch_direct_xmit+0x36/0x119 [ 8683.928121] [ 8683.928121] stack backtrace: [ 8683.928121] Pid: 0, comm: swapper/0 Not tainted 3.4.1-build-0061 imx6-dongle#14 [ 8683.928121] Call Trace: [ 8683.928121] [<c034bdd2>] ? printk+0x18/0x1a [ 8683.928121] [<c0158904>] print_circular_bug+0x1ac/0x1b6 [ 8683.928121] [<c0159f1b>] __lock_acquire+0x9a3/0xc27 [ 8683.928121] [<c015a561>] lock_acquire+0x71/0x85 [ 8683.928121] [<e0fc73ec>] ? l2tp_xmit_skb+0x173/0x47e [l2tp_core] [ 8683.928121] [<c034da2d>] _raw_spin_lock+0x33/0x40 [ 8683.928121] [<e0fc73ec>] ? l2tp_xmit_skb+0x173/0x47e [l2tp_core] [ 8683.928121] [<e0fc73ec>] l2tp_xmit_skb+0x173/0x47e [l2tp_core] [ 8683.928121] [<e0fe31fb>] l2tp_eth_dev_xmit+0x1a/0x2f [l2tp_eth] [ 8683.928121] [<c02e01e7>] dev_hard_start_xmit+0x333/0x3f2 [ 8683.928121] [<c02f064c>] sch_direct_xmit+0x55/0x119 [ 8683.928121] [<c02e0528>] dev_queue_xmit+0x282/0x418 [ 8683.928121] [<c02e02a6>] ? dev_hard_start_xmit+0x3f2/0x3f2 [ 8683.928121] [<c031f4fb>] NF_HOOK.clone.19+0x45/0x4c [ 8683.928121] [<c031f524>] arp_xmit+0x22/0x24 [ 8683.928121] [<c02e02a6>] ? dev_hard_start_xmit+0x3f2/0x3f2 [ 8683.928121] [<c031f567>] arp_send+0x41/0x48 [ 8683.928121] [<c031fa7d>] arp_process+0x289/0x491 [ 8683.928121] [<c031f7f4>] ? __neigh_lookup.clone.20+0x42/0x42 [ 8683.928121] [<c031f4fb>] NF_HOOK.clone.19+0x45/0x4c [ 8683.928121] [<c031f7a0>] arp_rcv+0xb1/0xc3 [ 8683.928121] [<c031f7f4>] ? __neigh_lookup.clone.20+0x42/0x42 [ 8683.928121] [<c02de91b>] __netif_receive_skb+0x329/0x378 [ 8683.928121] [<c02de9d3>] process_backlog+0x69/0x130 [ 8683.928121] [<c02df103>] net_rx_action+0x90/0x15d [ 8683.928121] [<c012b2b5>] __do_softirq+0x7b/0x118 [ 8683.928121] [<c012b23a>] ? local_bh_enable+0xd/0xd [ 8683.928121] <IRQ> [<c012b4d0>] ? irq_exit+0x41/0x91 [ 8683.928121] [<c0103c6f>] ? do_IRQ+0x79/0x8d [ 8683.928121] [<c0157ea1>] ? trace_hardirqs_off_caller+0x2e/0x86 [ 8683.928121] [<c034ef6e>] ? common_interrupt+0x2e/0x34 [ 8683.928121] [<c0108a33>] ? default_idle+0x23/0x38 [ 8683.928121] [<c01091a8>] ? cpu_idle+0x55/0x6f [ 8683.928121] [<c033df25>] ? rest_init+0xa1/0xa7 [ 8683.928121] [<c033de84>] ? __read_lock_failed+0x14/0x14 [ 8683.928121] [<c0498745>] ? start_kernel+0x303/0x30a [ 8683.928121] [<c0498209>] ? repair_env_string+0x51/0x51 [ 8683.928121] [<c04980a8>] ? i386_start_kernel+0xa8/0xaf It appears that like most virtual devices, l2tp should be converted to LLTX mode. This patch takes care of statistics using atomic_long in both RX and TX paths, and fix a bug in l2tp_eth_dev_recv(), which was caching skb->data before a pskb_may_pull() call. Signed-off-by: Eric Dumazet <[email protected]> Reported-by: Denys Fedoryshchenko <[email protected]> Cc: James Chapman <[email protected]> Cc: Hong zhi guo <[email protected]> Cc: Francois Romieu <[email protected]> Signed-off-by: David S. Miller <[email protected]>
…d reasons commit 5cf02d0 upstream. We've had some reports of a deadlock where rpciod ends up with a stack trace like this: PID: 2507 TASK: ffff88103691ab40 CPU: 14 COMMAND: "rpciod/14" #0 [ffff8810343bf2f0] schedule at ffffffff814dabd9 #1 [ffff8810343bf3b8] nfs_wait_bit_killable at ffffffffa038fc04 [nfs] imx6-dongle#2 [ffff8810343bf3c8] __wait_on_bit at ffffffff814dbc2f imx6-dongle#3 [ffff8810343bf418] out_of_line_wait_on_bit at ffffffff814dbcd8 imx6-dongle#4 [ffff8810343bf488] nfs_commit_inode at ffffffffa039e0c1 [nfs] imx6-dongle#5 [ffff8810343bf4f8] nfs_release_page at ffffffffa038bef6 [nfs] imx6-dongle#6 [ffff8810343bf528] try_to_release_page at ffffffff8110c670 imx6-dongle#7 [ffff8810343bf538] shrink_page_list.clone.0 at ffffffff81126271 imx6-dongle#8 [ffff8810343bf668] shrink_inactive_list at ffffffff81126638 imx6-dongle#9 [ffff8810343bf818] shrink_zone at ffffffff8112788f imx6-dongle#10 [ffff8810343bf8c8] do_try_to_free_pages at ffffffff81127b1e imx6-dongle#11 [ffff8810343bf958] try_to_free_pages at ffffffff8112812f imx6-dongle#12 [ffff8810343bfa08] __alloc_pages_nodemask at ffffffff8111fdad imx6-dongle#13 [ffff8810343bfb28] kmem_getpages at ffffffff81159942 imx6-dongle#14 [ffff8810343bfb58] fallback_alloc at ffffffff8115a55a imx6-dongle#15 [ffff8810343bfbd8] ____cache_alloc_node at ffffffff8115a2d9 imx6-dongle#16 [ffff8810343bfc38] kmem_cache_alloc at ffffffff8115b09b imx6-dongle#17 [ffff8810343bfc78] sk_prot_alloc at ffffffff81411808 imx6-dongle#18 [ffff8810343bfcb8] sk_alloc at ffffffff8141197c imx6-dongle#19 [ffff8810343bfce8] inet_create at ffffffff81483ba6 #20 [ffff8810343bfd38] __sock_create at ffffffff8140b4a7 #21 [ffff8810343bfd98] xs_create_sock at ffffffffa01f649b [sunrpc] #22 [ffff8810343bfdd8] xs_tcp_setup_socket at ffffffffa01f6965 [sunrpc] #23 [ffff8810343bfe38] worker_thread at ffffffff810887d0 #24 [ffff8810343bfee8] kthread at ffffffff8108dd96 #25 [ffff8810343bff48] kernel_thread at ffffffff8100c1ca rpciod is trying to allocate memory for a new socket to talk to the server. The VM ends up calling ->releasepage to get more memory, and it tries to do a blocking commit. That commit can't succeed however without a connected socket, so we deadlock. Fix this by setting PF_FSTRANS on the workqueue task prior to doing the socket allocation, and having nfs_release_page check for that flag when deciding whether to do a commit call. Also, set PF_FSTRANS unconditionally in rpc_async_schedule since that function can also do allocations sometimes. Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Trond Myklebust <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
This will fix the following oops: [ 6.169981] genirq: Flags mismatch irq 5. 00000000 (ES1688) vs. 00000000 (ES1688) [ 6.170851] Pid: 1, comm: swapper Not tainted 3.5.0-00004-gceee0e9 imx6-dongle#14 [ 6.170851] Call Trace: [ 6.170851] [<c1062237>] ? __setup_irq+0x3c7/0x420 [ 6.170851] [<c1062486>] ? request_threaded_irq+0x76/0x140 [ 6.170851] [<c1290220>] ? snd_es1688_ioctl+0x10/0x10 [ 6.170851] [<c10624c2>] ? request_threaded_irq+0xb2/0x140 [ 6.170851] [<c1291196>] ? snd_es1688_create+0x96/0x330 [ 6.170851] [<c138365d>] ? snd_gusextreme_probe+0x18d/0x5a2 [ 6.170851] [<c11c9d80>] ? __driver_attach+0x80/0x80 [ 6.170851] [<c10db22f>] ? sysfs_create_link+0xf/0x20 [ 6.170851] [<c11c9d80>] ? __driver_attach+0x80/0x80 [ 6.170851] [<c11d1502>] ? isa_bus_probe+0x12/0x20 [ 6.170851] [<c11c9b95>] ? driver_probe_device+0x55/0x1c0 [ 6.170851] [<c13ae04f>] ? _raw_spin_unlock+0xf/0x30 [ 6.170851] [<c13705ea>] ? klist_next+0x6a/0xe0 [ 6.170851] [<c11d15c1>] ? isa_bus_match+0x21/0x40 [ 6.170851] [<c11c8a24>] ? bus_for_each_drv+0x34/0x70 [ 6.170851] [<c11c9e4b>] ? device_attach+0x7b/0x90 [ 6.170851] [<c11c9d80>] ? __driver_attach+0x80/0x80 [ 6.170851] [<c11c8bff>] ? bus_probe_device+0x5f/0x80 [ 6.170851] [<c11c7493>] ? device_add+0x573/0x620 [ 6.170851] [<c1042820>] ? complete_all+0x40/0x60 [ 6.170851] [<c13ae08a>] ? _raw_spin_unlock_irqrestore+0x1a/0x30 [ 6.170851] [<c11d16c6>] ? isa_register_driver+0xb6/0x150 [ 6.170851] [<c15c9002>] ? alsa_card_gusmax_init+0xf/0xf [ 6.170851] [<c15a99bc>] ? do_one_initcall+0x7f/0x12b [ 6.170851] [<c15a9b7a>] ? kernel_init+0x112/0x1a9 [ 6.170851] [<c15a9423>] ? do_early_param+0x77/0x77 [ 6.170851] [<c15a9a68>] ? do_one_initcall+0x12b/0x12b [ 6.170851] [<c13aefbe>] ? kernel_thread_helper+0x6/0xd [ 6.190170] es1688: can't grab IRQ 5 [ 6.190613] genirq: Flags mismatch irq 5. 00000000 (ES1688) vs. 00000000 (ES1688) [ 6.191566] Pid: 1, comm: swapper Not tainted 3.5.0-00004-gceee0e9 imx6-dongle#14 [ 6.192394] Call Trace: [ 6.192685] [<c1062237>] ? __setup_irq+0x3c7/0x420 [ 6.193342] [<c1062486>] ? request_threaded_irq+0x76/0x140 [ 6.194081] [<c1290220>] ? snd_es1688_ioctl+0x10/0x10 [ 6.194607] [<c10624c2>] ? request_threaded_irq+0xb2/0x140 [ 6.194607] [<c1291196>] ? snd_es1688_create+0x96/0x330 [ 6.194607] [<c138365d>] ? snd_gusextreme_probe+0x18d/0x5a2 [ 6.194607] [<c11c9d80>] ? __driver_attach+0x80/0x80 [ 6.194607] [<c10db22f>] ? sysfs_create_link+0xf/0x20 [ 6.194607] [<c11c9d80>] ? __driver_attach+0x80/0x80 [ 6.194607] [<c11d1502>] ? isa_bus_probe+0x12/0x20 [ 6.194607] [<c11c9b95>] ? driver_probe_device+0x55/0x1c0 [ 6.194607] [<c13ae04f>] ? _raw_spin_unlock+0xf/0x30 [ 6.194607] [<c13705ea>] ? klist_next+0x6a/0xe0 [ 6.194607] [<c11d15c1>] ? isa_bus_match+0x21/0x40 [ 6.194607] [<c11c8a24>] ? bus_for_each_drv+0x34/0x70 [ 6.194607] [<c11c9e4b>] ? device_attach+0x7b/0x90 [ 6.194607] [<c11c9d80>] ? __driver_attach+0x80/0x80 [ 6.194607] [<c11c8bff>] ? bus_probe_device+0x5f/0x80 [ 6.194607] [<c11c7493>] ? device_add+0x573/0x620 [ 6.194607] [<c1042820>] ? complete_all+0x40/0x60 [ 6.194607] [<c13ae08a>] ? _raw_spin_unlock_irqrestore+0x1a/0x30 [ 6.194607] [<c11d16c6>] ? isa_register_driver+0xb6/0x150 [ 6.194607] [<c15c9002>] ? alsa_card_gusmax_init+0xf/0xf [ 6.194607] [<c15a99bc>] ? do_one_initcall+0x7f/0x12b [ 6.194607] [<c15a9b7a>] ? kernel_init+0x112/0x1a9 [ 6.194607] [<c15a9423>] ? do_early_param+0x77/0x77 [ 6.194607] [<c15a9a68>] ? do_one_initcall+0x12b/0x12b [ 6.194607] [<c13aefbe>] ? kernel_thread_helper+0x6/0xd [ 6.210779] es1688: can't grab IRQ 5 [ 6.211305] gusextreme: probe of gusextreme.0 failed with error -16 Signed-off-by: Daniel Mack <[email protected]> Signed-off-by: Fengguang Wu <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
…d reasons We've had some reports of a deadlock where rpciod ends up with a stack trace like this: PID: 2507 TASK: ffff88103691ab40 CPU: 14 COMMAND: "rpciod/14" #0 [ffff8810343bf2f0] schedule at ffffffff814dabd9 #1 [ffff8810343bf3b8] nfs_wait_bit_killable at ffffffffa038fc04 [nfs] imx6-dongle#2 [ffff8810343bf3c8] __wait_on_bit at ffffffff814dbc2f imx6-dongle#3 [ffff8810343bf418] out_of_line_wait_on_bit at ffffffff814dbcd8 imx6-dongle#4 [ffff8810343bf488] nfs_commit_inode at ffffffffa039e0c1 [nfs] imx6-dongle#5 [ffff8810343bf4f8] nfs_release_page at ffffffffa038bef6 [nfs] imx6-dongle#6 [ffff8810343bf528] try_to_release_page at ffffffff8110c670 imx6-dongle#7 [ffff8810343bf538] shrink_page_list.clone.0 at ffffffff81126271 imx6-dongle#8 [ffff8810343bf668] shrink_inactive_list at ffffffff81126638 imx6-dongle#9 [ffff8810343bf818] shrink_zone at ffffffff8112788f imx6-dongle#10 [ffff8810343bf8c8] do_try_to_free_pages at ffffffff81127b1e imx6-dongle#11 [ffff8810343bf958] try_to_free_pages at ffffffff8112812f imx6-dongle#12 [ffff8810343bfa08] __alloc_pages_nodemask at ffffffff8111fdad imx6-dongle#13 [ffff8810343bfb28] kmem_getpages at ffffffff81159942 imx6-dongle#14 [ffff8810343bfb58] fallback_alloc at ffffffff8115a55a imx6-dongle#15 [ffff8810343bfbd8] ____cache_alloc_node at ffffffff8115a2d9 imx6-dongle#16 [ffff8810343bfc38] kmem_cache_alloc at ffffffff8115b09b imx6-dongle#17 [ffff8810343bfc78] sk_prot_alloc at ffffffff81411808 imx6-dongle#18 [ffff8810343bfcb8] sk_alloc at ffffffff8141197c imx6-dongle#19 [ffff8810343bfce8] inet_create at ffffffff81483ba6 #20 [ffff8810343bfd38] __sock_create at ffffffff8140b4a7 #21 [ffff8810343bfd98] xs_create_sock at ffffffffa01f649b [sunrpc] #22 [ffff8810343bfdd8] xs_tcp_setup_socket at ffffffffa01f6965 [sunrpc] #23 [ffff8810343bfe38] worker_thread at ffffffff810887d0 #24 [ffff8810343bfee8] kthread at ffffffff8108dd96 #25 [ffff8810343bff48] kernel_thread at ffffffff8100c1ca rpciod is trying to allocate memory for a new socket to talk to the server. The VM ends up calling ->releasepage to get more memory, and it tries to do a blocking commit. That commit can't succeed however without a connected socket, so we deadlock. Fix this by setting PF_FSTRANS on the workqueue task prior to doing the socket allocation, and having nfs_release_page check for that flag when deciding whether to do a commit call. Also, set PF_FSTRANS unconditionally in rpc_async_schedule since that function can also do allocations sometimes. Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Trond Myklebust <[email protected]> Cc: [email protected]
Cancel work of the xfs_sync_worker before teardown of the log in xfs_unmountfs. This prevents occasional crashes on unmount like so: PID: 21602 TASK: ee9df060 CPU: 0 COMMAND: "kworker/0:3" #0 [c5377d28] crash_kexec at c0292c94 #1 [c5377d80] oops_end at c07090c2 imx6-dongle#2 [c5377d98] no_context at c06f614e imx6-dongle#3 [c5377dbc] __bad_area_nosemaphore at c06f6281 imx6-dongle#4 [c5377df4] bad_area_nosemaphore at c06f629b imx6-dongle#5 [c5377e00] do_page_fault at c070b0cb imx6-dongle#6 [c5377e7c] error_code (via page_fault) at c070892c EAX: f300c6a8 EBX: f300c6a8 ECX: 000000c0 EDX: 000000c0 EBP: c5377ed0 DS: 007b ESI: 00000000 ES: 007b EDI: 00000001 GS: ffffad20 CS: 0060 EIP: c0481ad0 ERR: ffffffff EFLAGS: 00010246 imx6-dongle#7 [c5377eb0] atomic64_read_cx8 at c0481ad0 imx6-dongle#8 [c5377ebc] xlog_assign_tail_lsn_locked at f7cc7c6e [xfs] imx6-dongle#9 [c5377ed4] xfs_trans_ail_delete_bulk at f7ccd520 [xfs] imx6-dongle#10 [c5377f0c] xfs_buf_iodone at f7ccb602 [xfs] imx6-dongle#11 [c5377f24] xfs_buf_do_callbacks at f7cca524 [xfs] imx6-dongle#12 [c5377f30] xfs_buf_iodone_callbacks at f7cca5da [xfs] imx6-dongle#13 [c5377f4c] xfs_buf_iodone_work at f7c718d0 [xfs] imx6-dongle#14 [c5377f58] process_one_work at c024ee4c imx6-dongle#15 [c5377f98] worker_thread at c024f43d imx6-dongle#16 [c5377fbc] kthread at c025326b imx6-dongle#17 [c5377fe8] kernel_thread_helper at c070e834 PID: 26653 TASK: e79143b0 CPU: 3 COMMAND: "umount" #0 [cde0fda0] __schedule at c0706595 #1 [cde0fe28] schedule at c0706b89 imx6-dongle#2 [cde0fe30] schedule_timeout at c0705600 imx6-dongle#3 [cde0fe94] __down_common at c0706098 imx6-dongle#4 [cde0fec8] __down at c0706122 imx6-dongle#5 [cde0fed0] down at c025936f imx6-dongle#6 [cde0fee0] xfs_buf_lock at f7c7131d [xfs] imx6-dongle#7 [cde0ff00] xfs_freesb at f7cc2236 [xfs] imx6-dongle#8 [cde0ff10] xfs_fs_put_super at f7c80f21 [xfs] imx6-dongle#9 [cde0ff1c] generic_shutdown_super at c0333d7a imx6-dongle#10 [cde0ff38] kill_block_super at c0333e0f imx6-dongle#11 [cde0ff48] deactivate_locked_super at c0334218 imx6-dongle#12 [cde0ff58] deactivate_super at c033495d imx6-dongle#13 [cde0ff68] mntput_no_expire at c034bc13 imx6-dongle#14 [cde0ff7c] sys_umount at c034cc69 imx6-dongle#15 [cde0ffa0] sys_oldumount at c034ccd4 imx6-dongle#16 [cde0ffb0] system_call at c0707e66 commit 11159a0 added this to xfs_log_unmount and needs to be cleaned up at a later date. Signed-off-by: Ben Myers <[email protected]> Reviewed-by: Dave Chinner <[email protected]> Reviewed-by: Mark Tinguely <[email protected]>
Cancel work of the xfs_sync_worker before teardown of the log in xfs_unmountfs. This prevents occasional crashes on unmount like so: PID: 21602 TASK: ee9df060 CPU: 0 COMMAND: "kworker/0:3" #0 [c5377d28] crash_kexec at c0292c94 #1 [c5377d80] oops_end at c07090c2 imx6-dongle#2 [c5377d98] no_context at c06f614e imx6-dongle#3 [c5377dbc] __bad_area_nosemaphore at c06f6281 imx6-dongle#4 [c5377df4] bad_area_nosemaphore at c06f629b imx6-dongle#5 [c5377e00] do_page_fault at c070b0cb imx6-dongle#6 [c5377e7c] error_code (via page_fault) at c070892c EAX: f300c6a8 EBX: f300c6a8 ECX: 000000c0 EDX: 000000c0 EBP: c5377ed0 DS: 007b ESI: 00000000 ES: 007b EDI: 00000001 GS: ffffad20 CS: 0060 EIP: c0481ad0 ERR: ffffffff EFLAGS: 00010246 imx6-dongle#7 [c5377eb0] atomic64_read_cx8 at c0481ad0 imx6-dongle#8 [c5377ebc] xlog_assign_tail_lsn_locked at f7cc7c6e [xfs] imx6-dongle#9 [c5377ed4] xfs_trans_ail_delete_bulk at f7ccd520 [xfs] imx6-dongle#10 [c5377f0c] xfs_buf_iodone at f7ccb602 [xfs] imx6-dongle#11 [c5377f24] xfs_buf_do_callbacks at f7cca524 [xfs] imx6-dongle#12 [c5377f30] xfs_buf_iodone_callbacks at f7cca5da [xfs] imx6-dongle#13 [c5377f4c] xfs_buf_iodone_work at f7c718d0 [xfs] imx6-dongle#14 [c5377f58] process_one_work at c024ee4c imx6-dongle#15 [c5377f98] worker_thread at c024f43d imx6-dongle#16 [c5377fbc] kthread at c025326b imx6-dongle#17 [c5377fe8] kernel_thread_helper at c070e834 PID: 26653 TASK: e79143b0 CPU: 3 COMMAND: "umount" #0 [cde0fda0] __schedule at c0706595 #1 [cde0fe28] schedule at c0706b89 imx6-dongle#2 [cde0fe30] schedule_timeout at c0705600 imx6-dongle#3 [cde0fe94] __down_common at c0706098 imx6-dongle#4 [cde0fec8] __down at c0706122 imx6-dongle#5 [cde0fed0] down at c025936f imx6-dongle#6 [cde0fee0] xfs_buf_lock at f7c7131d [xfs] imx6-dongle#7 [cde0ff00] xfs_freesb at f7cc2236 [xfs] imx6-dongle#8 [cde0ff10] xfs_fs_put_super at f7c80f21 [xfs] imx6-dongle#9 [cde0ff1c] generic_shutdown_super at c0333d7a imx6-dongle#10 [cde0ff38] kill_block_super at c0333e0f imx6-dongle#11 [cde0ff48] deactivate_locked_super at c0334218 imx6-dongle#12 [cde0ff58] deactivate_super at c033495d imx6-dongle#13 [cde0ff68] mntput_no_expire at c034bc13 imx6-dongle#14 [cde0ff7c] sys_umount at c034cc69 imx6-dongle#15 [cde0ffa0] sys_oldumount at c034ccd4 imx6-dongle#16 [cde0ffb0] system_call at c0707e66 commit 11159a0 added this to xfs_log_unmount and needs to be cleaned up at a later date. Signed-off-by: Ben Myers <[email protected]> Reviewed-by: Dave Chinner <[email protected]> Reviewed-by: Mark Tinguely <[email protected]>
On Wed, 2012-12-12 at 23:16 -0500, Dave Jones wrote: > Since todays net merge, I see this when I start openvpn.. > > general protection fault: 0000 [#1] PREEMPT SMP > Modules linked in: ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_conntrack nf_conntrack ip6table_filter ip6_tables xfs iTCO_wdt iTCO_vendor_support snd_emu10k1 snd_util_mem snd_ac97_codec coretemp ac97_bus microcode snd_hwdep snd_seq pcspkr snd_pcm snd_page_alloc snd_timer lpc_ich i2c_i801 snd_rawmidi mfd_core snd_seq_device snd e1000e soundcore emu10k1_gp gameport i82975x_edac edac_core vhost_net tun macvtap macvlan kvm_intel kvm binfmt_misc nfsd auth_rpcgss nfs_acl lockd sunrpc btrfs libcrc32c zlib_deflate firewire_ohci sata_sil firewire_core crc_itu_t radeon i2c_algo_bit drm_kms_helper ttm drm i2c_core floppy > CPU 0 > Pid: 1381, comm: openvpn Not tainted 3.7.0+ imx6-dongle#14 /D975XBX > RIP: 0010:[<ffffffff815b54a4>] [<ffffffff815b54a4>] skb_flow_dissect+0x314/0x3e0 > RSP: 0018:ffff88007d0d9c48 EFLAGS: 00010206 > RAX: 000000000000055d RBX: 6b6b6b6b6b6b6b4b RCX: 1471030a0180040a > RDX: 0000000000000005 RSI: 00000000ffffffe0 RDI: ffff8800ba83fa80 > RBP: ffff88007d0d9cb8 R08: 0000000000000000 R09: 0000000000000000 > R10: 0000000000000000 R11: 0000000000000101 R12: ffff8800ba83fa80 > R13: 0000000000000008 R14: ffff88007d0d9cc8 R15: ffff8800ba83fa80 > FS: 00007f6637104800(0000) GS:ffff8800bf600000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00007f563f5b01c4 CR3: 000000007d140000 CR4: 00000000000007f0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 > Process openvpn (pid: 1381, threadinfo ffff88007d0d8000, task ffff8800a540cd60) > Stack: > ffff8800ba83fa80 0000000000000296 0000000000000000 0000000000000000 > ffff88007d0d9cc8 ffffffff815bcff4 ffff88007d0d9ce8 ffffffff815b1831 > ffff88007d0d9ca8 00000000703f6364 ffff8800ba83fa80 0000000000000000 > Call Trace: > [<ffffffff815bcff4>] ? netif_rx+0x114/0x4c0 > [<ffffffff815b1831>] ? skb_copy_datagram_from_iovec+0x61/0x290 > [<ffffffff815b672a>] __skb_get_rxhash+0x1a/0xd0 > [<ffffffffa03b9538>] tun_get_user+0x418/0x810 [tun] > [<ffffffff8135f468>] ? delay_tsc+0x98/0xf0 > [<ffffffff8109605c>] ? __rcu_read_unlock+0x5c/0xa0 > [<ffffffffa03b9a41>] tun_chr_aio_write+0x81/0xb0 [tun] > [<ffffffff81145011>] ? __buffer_unlock_commit+0x41/0x50 > [<ffffffff811db917>] do_sync_write+0xa7/0xe0 > [<ffffffff811dc01f>] vfs_write+0xaf/0x190 > [<ffffffff811dc375>] sys_write+0x55/0xa0 > [<ffffffff81705540>] tracesys+0xdd/0xe2 > Code: 41 8b 44 24 68 41 2b 44 24 6c 01 de 29 f0 83 f8 03 0f 8e a0 00 00 00 48 63 de 49 03 9c 24 e0 00 00 00 48 85 db 0f 84 72 fe ff ff <8b> 03 41 89 46 08 b8 01 00 00 00 e9 43 fd ff ff 0f 1f 40 00 48 > RIP [<ffffffff815b54a4>] skb_flow_dissect+0x314/0x3e0 > RSP <ffff88007d0d9c48> > ---[ end trace 6d42c834c72c002e ]--- > > > Faulting instruction is > > 0: 8b 03 mov (%rbx),%eax > > rbx is slab poison (-20) so this looks like a use-after-free here... > > flow->ports = *ports; > 314: 8b 03 mov (%rbx),%eax > 316: 41 89 46 08 mov %eax,0x8(%r14) > > in the inlined skb_header_pointer in skb_flow_dissect > > Dave > commit 96442e4 (tuntap: choose the txq based on rxq) added a use after free. Cache rxhash in a temp variable before calling netif_rx_ni() Reported-by: Dave Jones <[email protected]> Signed-off-by: Eric Dumazet <[email protected]> Cc: Jason Wang <[email protected]> Acked-by: Jason Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]>
…s struct file commit e4daf1ffbe6cc3b12aab4d604e627829e93e9914 upstream. The following call chain: ------------------------------------------------------------ nfs4_get_vfs_file - nfsd_open - dentry_open - do_dentry_open - __get_file_write_access - get_write_access - return atomic_inc_unless_negative(&inode->i_writecount) ? 0 : -ETXTBSY; ------------------------------------------------------------ can result in the following state: ------------------------------------------------------------ struct nfs4_file { ... fi_fds = {0xffff880c1fa65c80, 0xffffffffffffffe6, 0x0}, fi_access = {{ counter = 0x1 }, { counter = 0x0 }}, ... ------------------------------------------------------------ 1) First time around, in nfs4_get_vfs_file() fp->fi_fds[O_WRONLY] is NULL, hence nfsd_open() is called where we get status set to an error and fp->fi_fds[O_WRONLY] to -ETXTBSY. Thus we do not reach nfs4_file_get_access() and fi_access[O_WRONLY] is not incremented. 2) Second time around, in nfs4_get_vfs_file() fp->fi_fds[O_WRONLY] is NOT NULL (-ETXTBSY), so nfsd_open() is NOT called, but nfs4_file_get_access() IS called and fi_access[O_WRONLY] is incremented. Thus we leave a landmine in the form of the nfs4_file data structure in an incorrect state. 3) Eventually, when __nfs4_file_put_access() is called it finds fi_access[O_WRONLY] being non-zero, it decrements it and calls nfs4_file_put_fd() which tries to fput -ETXTBSY. ------------------------------------------------------------ ... [exception RIP: fput+0x9] RIP: ffffffff81177fa9 RSP: ffff88062e365c90 RFLAGS: 00010282 RAX: ffff880c2b3d99cc RBX: ffff880c2b3d9978 RCX: 0000000000000002 RDX: dead000000100101 RSI: 0000000000000001 RDI: ffffffffffffffe6 RBP: ffff88062e365c90 R8: ffff88041fe797d8 R9: ffff88062e365d58 R10: 0000000000000008 R11: 0000000000000000 R12: 0000000000000001 R13: 0000000000000007 R14: 0000000000000000 R15: 0000000000000000 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 imx6-dongle#9 [ffff88062e365c98] __nfs4_file_put_access at ffffffffa0562334 [nfsd] imx6-dongle#10 [ffff88062e365cc8] nfs4_file_put_access at ffffffffa05623ab [nfsd] imx6-dongle#11 [ffff88062e365ce8] free_generic_stateid at ffffffffa056634d [nfsd] imx6-dongle#12 [ffff88062e365d18] release_open_stateid at ffffffffa0566e4b [nfsd] imx6-dongle#13 [ffff88062e365d38] nfsd4_close at ffffffffa0567401 [nfsd] imx6-dongle#14 [ffff88062e365d88] nfsd4_proc_compound at ffffffffa0557f28 [nfsd] imx6-dongle#15 [ffff88062e365dd8] nfsd_dispatch at ffffffffa054543e [nfsd] imx6-dongle#16 [ffff88062e365e18] svc_process_common at ffffffffa04ba5a4 [sunrpc] imx6-dongle#17 [ffff88062e365e98] svc_process at ffffffffa04babe0 [sunrpc] imx6-dongle#18 [ffff88062e365eb8] nfsd at ffffffffa0545b62 [nfsd] imx6-dongle#19 [ffff88062e365ee8] kthread at ffffffff81090886 #20 [ffff88062e365f48] kernel_thread at ffffffff8100c14a ------------------------------------------------------------ Signed-off-by: Harshula Jayasuriya <[email protected]> Signed-off-by: J. Bruce Fields <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
Some people (eg. jorgegeorge on IRC) have reported issues with:
jorgegeorge reported that the edid read as all zeroes. This seems to be an I2C issue causing both of these.
The text was updated successfully, but these errors were encountered: