Sorry, I forgot the "fixes:" in commit
6726ca1a2d531f5a6efc1f785b15606ce837c4dc
I was hoping DRM maintainers would pick it up before it hit mainline,
but it hasn't happened.
Please apply to 5.6.x
The driver is new in 5.6 and this fix is merged for 5.7 already.
Sorry for the inconvenience,
Torsten
commit 4900dda90af2cb13bc1d4c12ce94b98acc8fe64e upstream
Due to async need_flush updating via other buffer mapping, checking
gpu->need_flush in 3 places within etnaviv_buffer_queue can cause GPU
hangs.
This occurs due to need_flush being false for the first 2 checks in that
function, so that the extra dword does not get accounted for, but by the
time we come to check for the third time, gpu->mmu->need_flish is true,
which outputs the flush instruction. This causes the prefetch during the
final link to be off by 1. This causes GPU hangs.
It causes the ring to contain patterns like this:
0x40000005, /* LINK (8) PREFETCH=0x5,OP=LINK */
0x70040010, /* ADDRESS *0x70040010 */
0x40000002, /* LINK (8) PREFETCH=0x2,OP=LINK */
0x70040000, /* ADDRESS *0x70040000 */
0x08010e04, /* LOAD_STATE (1) Base: 0x03810 Size: 1 Fixp: 0 */
0x0000001f, /* GL.FLUSH_MMU := FLUSH_FEMMU=1,FLUSH_UNK1=1,FLUSH_UNK2=1,FLUSH_PEMMU=1,FLUSH_UNK4=1 */
0x08010e03, /* LOAD_STATE (1) Base: 0x0380C Size: 1 Fixp: 0 */
0x00000000, /* GL.FLUSH_CACHE := DEPTH=0,COLOR=0,TEXTURE=0,PE2D=0,TEXTUREVS=0,SHADER_L1=0,SHADER_L2=0,UNK10=0,UNK11=0,DESCRIPTOR_UNK12=0,DESCRIPTOR_UNK13=0 */
0x08010e02, /* LOAD_STATE (1) Base: 0x03808 Size: 1 Fixp: 0 */
0x00000701, /* GL.SEMAPHORE_TOKEN := FROM=FE,TO=PE,UNK28=0x0 */
0x48000000, /* STALL (9) OP=STALL */
0x00000701, /* TOKEN FROM=FE,TO=PE,UNK28=0x0 */
0x08010e00, /* LOAD_STATE (1) Base: 0x03800 Size: 1 Fixp: 0 */
0x00000000, /* GL.PIPE_SELECT := PIPE=PIPE_3D */
0x40000035, /* LINK (8) PREFETCH=0x35,OP=LINK */
0x70041000, /* ADDRESS *0x70041000 */
Here we see a link with prefetch of 5 dwords starting with the 3rd
instruction. It only loads the 5 dwords up and including the final
LOAD_STATE. It needs to include the final LINK instruction.
This was seen on imx6q, and the fix is confirmed to stop the GPU hangs.
The commit referenced inadvertently fixed this issue by checking
gpu->mmu->need_flush once at the start of the function.
Given that this commit is independant, and useful for all version, it
seems sensible to backport it to the stable branches.
Hi Greg,
Syzbot has been complaining about KASAN splats due to use-after-free
issues in the l2tp code on 4.9 Android kernels (although I reproduced
with latest 4.9 stable on my laptop):
https://syzkaller.appspot.com/bug?id=3c27eae7bdba97293b68e79c9700ac110f977e…
These have been fixed upstream, but for some reason didn't get picked up
for stable. This series applies to 4.9.y and I'll send patches for 4.4.y
separately as there are a few dependencies to deal with over there.
Thanks,
Will
--->8
Guillaume Nault (2):
l2tp: ensure sessions are freed after their PPPOL2TP socket
l2tp: fix race between l2tp_session_delete() and
l2tp_tunnel_closeall()
net/l2tp/l2tp_core.c | 6 ++++++
net/l2tp/l2tp_core.h | 1 +
net/l2tp/l2tp_ppp.c | 8 ++++----
3 files changed, 11 insertions(+), 4 deletions(-)
--
2.26.0.rc2.310.g2932bb562d-goog
This patch partially reverts the commit for
nvme_fc: add module to ops template to allow module references
The original patch:
Added an ops parameter of "module" to be set by the lldd, and the
lldds were updated to provide their value.
Used the parameter to take module references when a controller was
created or terminated.
The original patch was to resolve the lldd being able to be unloaded
while being used to talk to the boot device of the system. However, the
end result of the original patch is that any driver unload while a nvme
controller is live via the lldd is not being prohibited. Given the module
reference, the module teardown routine can't be called, thus there's no
way, other than manual actions to terminate the controllers.
This patch reverts the portion of the patch that takes module references
on controller creation. It leaves the module parameter so that it could
be used in the future.
As such, there will still remain the issue of detaching from the boot
device, yet needing boot device access to load a new module to replace
the lldd that was unloaded. A solution will be looked for later.
-- james
Fixes: 863fbae929c7 ("nvme_fc: add module to ops template to allow module references")
Cc: <stable(a)vger.kernel.org> # v5.4+
Signed-off-by: James Smart <jsmart2021(a)gmail.com>
Cc: Himanshu Madhani <himanshu.madhani(a)oracle.com>
CC: Christoph Hellwig <hch(a)lst.de>
CC: Keith Busch <kbusch(a)kernel.org>
---
drivers/nvme/host/fc.c | 11 +----------
1 file changed, 1 insertion(+), 10 deletions(-)
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index a8bf2fb1287b..1419c8c41fd8 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -2016,7 +2016,6 @@ nvme_fc_ctrl_free(struct kref *ref)
{
struct nvme_fc_ctrl *ctrl =
container_of(ref, struct nvme_fc_ctrl, ref);
- struct nvme_fc_lport *lport = ctrl->lport;
unsigned long flags;
if (ctrl->ctrl.tagset) {
@@ -2043,7 +2042,6 @@ nvme_fc_ctrl_free(struct kref *ref)
if (ctrl->ctrl.opts)
nvmf_free_options(ctrl->ctrl.opts);
kfree(ctrl);
- module_put(lport->ops->module);
}
static void
@@ -3074,15 +3072,10 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
goto out_fail;
}
- if (!try_module_get(lport->ops->module)) {
- ret = -EUNATCH;
- goto out_free_ctrl;
- }
-
idx = ida_simple_get(&nvme_fc_ctrl_cnt, 0, 0, GFP_KERNEL);
if (idx < 0) {
ret = -ENOSPC;
- goto out_mod_put;
+ goto out_free_ctrl;
}
ctrl->ctrl.opts = opts;
@@ -3232,8 +3225,6 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
out_free_ida:
put_device(ctrl->dev);
ida_simple_remove(&nvme_fc_ctrl_cnt, ctrl->cnum);
-out_mod_put:
- module_put(lport->ops->module);
out_free_ctrl:
kfree(ctrl);
out_fail:
--
2.16.4