Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

HDMI I2C does not work for some users #14

Open
abrasive opened this issue Mar 24, 2013 · 7 comments
Open

HDMI I2C does not work for some users #14

abrasive opened this issue Mar 24, 2013 · 7 comments
Labels

Comments

@abrasive
Copy link
Member

Some people (eg. jorgegeorge on IRC) have reported issues with:

  • HDMI audio not working
  • HDMI video defaulting to fixed res (eg. 640x480 with newer kernels or 1280x720 with older)

jorgegeorge reported that the edid read as all zeroes. This seems to be an I2C issue causing both of these.

@HSTe
Copy link
Member

HSTe commented Mar 25, 2013

Looks like others with same problem:
https://community.freescale.com/thread/305063

@abrasive
Copy link
Member Author

That's a different issue - I fixed it here: 6ea2512#L1L1542

Essentially only CEA modes were permitted (ie. TV modes).

@abrasive
Copy link
Member Author

This also can't be worked around using the video= kernel parameter, as it only selects from the modelist read from the monitor rather than setting a mode from scratch. Should probably add a ,force, parameter.

@HSTe
Copy link
Member

HSTe commented Apr 15, 2013

hdmi audio works when setting video= resolution in boot.scr.
I tried setting 1080 and 720 resolution and audio worked.
When not setting resolution my screen default to a higher resolution and audio doesn't work

@abrasive
Copy link
Member Author

I've had a poke at the DDC bus, and everything looks healthy at 100kHz.
The voltage on the monitor detect pin with my monitors is only 2.45V though, even though it should be pulled to 5 in the monitor - and that's close to the spec's threshold of 2.4. I've also had issues with certain video modes where the thing continuously rereads the EDID. So perhaps there is an overly small pulldown in the stick?

Workaround would be to force HDMI detection to on. Has anyone got a troublesome monitor or TV we can work with?

@abrasive
Copy link
Member Author

hp__ tested this and found HDMI detection reports correctly.

@HSTe
Copy link
Member

HSTe commented Jun 4, 2013

There is single method to set clock-rate for both audio and video pll-s
in i.MX6q clock system implementation. That's possible due to they have
similar set of registers with a different bases. But there is also one
common register: CCM_ANALOG_MISC2, which contains post-dividers.

From mailing list. Could this be sth for the video audio problem?

[meta-freescale] [PATCH] arm/mach-mx6: fix pll4 set_rate callback
Innboks
x
Alexander Smirnov [email protected] via yoctoproject.org

  1. mai (For 6 dager siden)

til meta-freescale

In current implementation, independently of whether audio or video clock
is going to be set, the mask 0xc0000000 is applied to MISC2 register.
This means, that if the audio clock rate is changed, the video clock
post-dividers possibly will be corrupted.

This patch fixes the issue described above.

Signed-off-by: Alexander Smirnov [email protected]

arch/arm/mach-mx6/clock.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/arch/arm/mach-mx6/clock.c b/arch/arm/mach-mx6/clock.c
index 8c590b7..8706c32 100644
--- a/arch/arm/mach-mx6/clock.c
+++ b/arch/arm/mach-mx6/clock.c
@@ -1023,7 +1023,8 @@ static int _clk_audio_video_set_rate(struct clk *clk, unsigned long rate)
__raw_writel(mfn, pllbase + PLL_NUM_DIV_OFFSET);
__raw_writel(mfd, pllbase + PLL_DENOM_DIV_OFFSET);

  •   if (rev >= IMX_CHIP_REVISION_1_1) {
    
  •   if ((rev >= IMX_CHIP_REVISION_1_1) &&
    
  •       (pllbase == PLL5_VIDEO_BASE_ADDR)) {
            reg = __raw_readl(ANA_MISC2_BASE_ADDR)
                    & ~ANADIG_ANA_MISC2_CONTROL3_MASK;
            reg |= control3 << ANADIG_ANA_MISC2_CONTROL3_OFFSET;
    

mtx512 pushed a commit to mtx512/linux-imx that referenced this issue Sep 22, 2013
The warning below triggers on AMD MCM packages because physical package
IDs on the cores of a _physical_ socket are the same. I.e., this field
says which CPUs belong to the same physical package.

However, the same two CPUs belong to two different internal, i.e.
"logical" nodes in the same physical socket which is reflected in the
CPU-to-node map on x86 with NUMA.

Which makes this check wrong on the above topologies so circumvent it.

[    0.444413] Booting Node   0, Processors  #1 imx6-dongle#2 imx6-dongle#3 imx6-dongle#4 imx6-dongle#5 Ok.
[    0.461388] ------------[ cut here ]------------
[    0.465997] WARNING: at arch/x86/kernel/smpboot.c:310 topology_sane.clone.1+0x6e/0x81()
[    0.473960] Hardware name: Dinar
[    0.477170] sched: CPU imx6-dongle#6's mc-sibling CPU #0 is not on the same node! [node: 1 != 0]. Ignoring dependency.
[    0.486860] Booting Node   1, Processors  imx6-dongle#6
[    0.491104] Modules linked in:
[    0.494141] Pid: 0, comm: swapper/6 Not tainted 3.4.0+ #1
[    0.499510] Call Trace:
[    0.501946]  [<ffffffff8144bf92>] ? topology_sane.clone.1+0x6e/0x81
[    0.508185]  [<ffffffff8102f1fc>] warn_slowpath_common+0x85/0x9d
[    0.514163]  [<ffffffff8102f2b7>] warn_slowpath_fmt+0x46/0x48
[    0.519881]  [<ffffffff8144bf92>] topology_sane.clone.1+0x6e/0x81
[    0.525943]  [<ffffffff8144c234>] set_cpu_sibling_map+0x251/0x371
[    0.532004]  [<ffffffff8144c4ee>] start_secondary+0x19a/0x218
[    0.537729] ---[ end trace 4eaa2a86a8e2da22 ]---
[    0.628197]  imx6-dongle#7 imx6-dongle#8 imx6-dongle#9 imx6-dongle#10 imx6-dongle#11 Ok.
[    0.807108] Booting Node   3, Processors  imx6-dongle#12 imx6-dongle#13 imx6-dongle#14 imx6-dongle#15 imx6-dongle#16 imx6-dongle#17 Ok.
[    0.897587] Booting Node   2, Processors  imx6-dongle#18 imx6-dongle#19 #20 #21 #22 #23 Ok.
[    0.917443] Brought up 24 CPUs

We ran a topology sanity check test we have here on it and
it all looks ok... hopefully :).

Signed-off-by: Borislav Petkov <[email protected]>
Cc: Andreas Herrmann <[email protected]>
Signed-off-by: Peter Zijlstra <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Ingo Molnar <[email protected]>
mtx512 pushed a commit to mtx512/linux-imx that referenced this issue Sep 22, 2013
Denys Fedoryshchenko reported a LOCKDEP issue with l2tp code.

[ 8683.927442] ======================================================
[ 8683.927555] [ INFO: possible circular locking dependency detected ]
[ 8683.927672] 3.4.1-build-0061 imx6-dongle#14 Not tainted
[ 8683.927782] -------------------------------------------------------
[ 8683.927895] swapper/0/0 is trying to acquire lock:
[ 8683.928007]  (slock-AF_INET){+.-...}, at: [<e0fc73ec>]
l2tp_xmit_skb+0x173/0x47e [l2tp_core]
[ 8683.928121]
[ 8683.928121] but task is already holding lock:
[ 8683.928121]  (_xmit_ETHER#2){+.-...}, at: [<c02f062d>]
sch_direct_xmit+0x36/0x119
[ 8683.928121]
[ 8683.928121] which lock already depends on the new lock.
[ 8683.928121]
[ 8683.928121]
[ 8683.928121] the existing dependency chain (in reverse order) is:
[ 8683.928121]
[ 8683.928121] -> #1 (_xmit_ETHER#2){+.-...}:
[ 8683.928121]        [<c015a561>] lock_acquire+0x71/0x85
[ 8683.928121]        [<c034da2d>] _raw_spin_lock+0x33/0x40
[ 8683.928121]        [<c0304e0c>] ip_send_reply+0xf2/0x1ce
[ 8683.928121]        [<c0317dbc>] tcp_v4_send_reset+0x153/0x16f
[ 8683.928121]        [<c0317f4a>] tcp_v4_do_rcv+0x172/0x194
[ 8683.928121]        [<c031929b>] tcp_v4_rcv+0x387/0x5a0
[ 8683.928121]        [<c03001d0>] ip_local_deliver_finish+0x13a/0x1e9
[ 8683.928121]        [<c0300645>] NF_HOOK.clone.11+0x46/0x4d
[ 8683.928121]        [<c030075b>] ip_local_deliver+0x41/0x45
[ 8683.928121]        [<c03005dd>] ip_rcv_finish+0x31a/0x33c
[ 8683.928121]        [<c0300645>] NF_HOOK.clone.11+0x46/0x4d
[ 8683.928121]        [<c0300960>] ip_rcv+0x201/0x23d
[ 8683.928121]        [<c02de91b>] __netif_receive_skb+0x329/0x378
[ 8683.928121]        [<c02deae8>] netif_receive_skb+0x4e/0x7d
[ 8683.928121]        [<e08d5ef3>] rtl8139_poll+0x243/0x33d [8139too]
[ 8683.928121]        [<c02df103>] net_rx_action+0x90/0x15d
[ 8683.928121]        [<c012b2b5>] __do_softirq+0x7b/0x118
[ 8683.928121]
[ 8683.928121] -> #0 (slock-AF_INET){+.-...}:
[ 8683.928121]        [<c0159f1b>] __lock_acquire+0x9a3/0xc27
[ 8683.928121]        [<c015a561>] lock_acquire+0x71/0x85
[ 8683.928121]        [<c034da2d>] _raw_spin_lock+0x33/0x40
[ 8683.928121]        [<e0fc73ec>] l2tp_xmit_skb+0x173/0x47e
[l2tp_core]
[ 8683.928121]        [<e0fe31fb>] l2tp_eth_dev_xmit+0x1a/0x2f
[l2tp_eth]
[ 8683.928121]        [<c02e01e7>] dev_hard_start_xmit+0x333/0x3f2
[ 8683.928121]        [<c02f064c>] sch_direct_xmit+0x55/0x119
[ 8683.928121]        [<c02e0528>] dev_queue_xmit+0x282/0x418
[ 8683.928121]        [<c031f4fb>] NF_HOOK.clone.19+0x45/0x4c
[ 8683.928121]        [<c031f524>] arp_xmit+0x22/0x24
[ 8683.928121]        [<c031f567>] arp_send+0x41/0x48
[ 8683.928121]        [<c031fa7d>] arp_process+0x289/0x491
[ 8683.928121]        [<c031f4fb>] NF_HOOK.clone.19+0x45/0x4c
[ 8683.928121]        [<c031f7a0>] arp_rcv+0xb1/0xc3
[ 8683.928121]        [<c02de91b>] __netif_receive_skb+0x329/0x378
[ 8683.928121]        [<c02de9d3>] process_backlog+0x69/0x130
[ 8683.928121]        [<c02df103>] net_rx_action+0x90/0x15d
[ 8683.928121]        [<c012b2b5>] __do_softirq+0x7b/0x118
[ 8683.928121]
[ 8683.928121] other info that might help us debug this:
[ 8683.928121]
[ 8683.928121]  Possible unsafe locking scenario:
[ 8683.928121]
[ 8683.928121]        CPU0                    CPU1
[ 8683.928121]        ----                    ----
[ 8683.928121]   lock(_xmit_ETHER#2);
[ 8683.928121]                                lock(slock-AF_INET);
[ 8683.928121]                                lock(_xmit_ETHER#2);
[ 8683.928121]   lock(slock-AF_INET);
[ 8683.928121]
[ 8683.928121]  *** DEADLOCK ***
[ 8683.928121]
[ 8683.928121] 3 locks held by swapper/0/0:
[ 8683.928121]  #0:  (rcu_read_lock){.+.+..}, at: [<c02dbc10>]
rcu_lock_acquire+0x0/0x30
[ 8683.928121]  #1:  (rcu_read_lock_bh){.+....}, at: [<c02dbc10>]
rcu_lock_acquire+0x0/0x30
[ 8683.928121]  imx6-dongle#2:  (_xmit_ETHER#2){+.-...}, at: [<c02f062d>]
sch_direct_xmit+0x36/0x119
[ 8683.928121]
[ 8683.928121] stack backtrace:
[ 8683.928121] Pid: 0, comm: swapper/0 Not tainted 3.4.1-build-0061 imx6-dongle#14
[ 8683.928121] Call Trace:
[ 8683.928121]  [<c034bdd2>] ? printk+0x18/0x1a
[ 8683.928121]  [<c0158904>] print_circular_bug+0x1ac/0x1b6
[ 8683.928121]  [<c0159f1b>] __lock_acquire+0x9a3/0xc27
[ 8683.928121]  [<c015a561>] lock_acquire+0x71/0x85
[ 8683.928121]  [<e0fc73ec>] ? l2tp_xmit_skb+0x173/0x47e [l2tp_core]
[ 8683.928121]  [<c034da2d>] _raw_spin_lock+0x33/0x40
[ 8683.928121]  [<e0fc73ec>] ? l2tp_xmit_skb+0x173/0x47e [l2tp_core]
[ 8683.928121]  [<e0fc73ec>] l2tp_xmit_skb+0x173/0x47e [l2tp_core]
[ 8683.928121]  [<e0fe31fb>] l2tp_eth_dev_xmit+0x1a/0x2f [l2tp_eth]
[ 8683.928121]  [<c02e01e7>] dev_hard_start_xmit+0x333/0x3f2
[ 8683.928121]  [<c02f064c>] sch_direct_xmit+0x55/0x119
[ 8683.928121]  [<c02e0528>] dev_queue_xmit+0x282/0x418
[ 8683.928121]  [<c02e02a6>] ? dev_hard_start_xmit+0x3f2/0x3f2
[ 8683.928121]  [<c031f4fb>] NF_HOOK.clone.19+0x45/0x4c
[ 8683.928121]  [<c031f524>] arp_xmit+0x22/0x24
[ 8683.928121]  [<c02e02a6>] ? dev_hard_start_xmit+0x3f2/0x3f2
[ 8683.928121]  [<c031f567>] arp_send+0x41/0x48
[ 8683.928121]  [<c031fa7d>] arp_process+0x289/0x491
[ 8683.928121]  [<c031f7f4>] ? __neigh_lookup.clone.20+0x42/0x42
[ 8683.928121]  [<c031f4fb>] NF_HOOK.clone.19+0x45/0x4c
[ 8683.928121]  [<c031f7a0>] arp_rcv+0xb1/0xc3
[ 8683.928121]  [<c031f7f4>] ? __neigh_lookup.clone.20+0x42/0x42
[ 8683.928121]  [<c02de91b>] __netif_receive_skb+0x329/0x378
[ 8683.928121]  [<c02de9d3>] process_backlog+0x69/0x130
[ 8683.928121]  [<c02df103>] net_rx_action+0x90/0x15d
[ 8683.928121]  [<c012b2b5>] __do_softirq+0x7b/0x118
[ 8683.928121]  [<c012b23a>] ? local_bh_enable+0xd/0xd
[ 8683.928121]  <IRQ>  [<c012b4d0>] ? irq_exit+0x41/0x91
[ 8683.928121]  [<c0103c6f>] ? do_IRQ+0x79/0x8d
[ 8683.928121]  [<c0157ea1>] ? trace_hardirqs_off_caller+0x2e/0x86
[ 8683.928121]  [<c034ef6e>] ? common_interrupt+0x2e/0x34
[ 8683.928121]  [<c0108a33>] ? default_idle+0x23/0x38
[ 8683.928121]  [<c01091a8>] ? cpu_idle+0x55/0x6f
[ 8683.928121]  [<c033df25>] ? rest_init+0xa1/0xa7
[ 8683.928121]  [<c033de84>] ? __read_lock_failed+0x14/0x14
[ 8683.928121]  [<c0498745>] ? start_kernel+0x303/0x30a
[ 8683.928121]  [<c0498209>] ? repair_env_string+0x51/0x51
[ 8683.928121]  [<c04980a8>] ? i386_start_kernel+0xa8/0xaf

It appears that like most virtual devices, l2tp should be converted to
LLTX mode.

This patch takes care of statistics using atomic_long in both RX and TX
paths, and fix a bug in l2tp_eth_dev_recv(), which was caching skb->data
before a pskb_may_pull() call.

Signed-off-by: Eric Dumazet <[email protected]>
Reported-by: Denys Fedoryshchenko <[email protected]>
Cc: James Chapman <[email protected]>
Cc: Hong zhi guo <[email protected]>
Cc: Francois Romieu <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
mtx512 pushed a commit to mtx512/linux-imx that referenced this issue Sep 22, 2013
…d reasons

commit 5cf02d0 upstream.

We've had some reports of a deadlock where rpciod ends up with a stack
trace like this:

    PID: 2507   TASK: ffff88103691ab40  CPU: 14  COMMAND: "rpciod/14"
     #0 [ffff8810343bf2f0] schedule at ffffffff814dabd9
     #1 [ffff8810343bf3b8] nfs_wait_bit_killable at ffffffffa038fc04 [nfs]
     imx6-dongle#2 [ffff8810343bf3c8] __wait_on_bit at ffffffff814dbc2f
     imx6-dongle#3 [ffff8810343bf418] out_of_line_wait_on_bit at ffffffff814dbcd8
     imx6-dongle#4 [ffff8810343bf488] nfs_commit_inode at ffffffffa039e0c1 [nfs]
     imx6-dongle#5 [ffff8810343bf4f8] nfs_release_page at ffffffffa038bef6 [nfs]
     imx6-dongle#6 [ffff8810343bf528] try_to_release_page at ffffffff8110c670
     imx6-dongle#7 [ffff8810343bf538] shrink_page_list.clone.0 at ffffffff81126271
     imx6-dongle#8 [ffff8810343bf668] shrink_inactive_list at ffffffff81126638
     imx6-dongle#9 [ffff8810343bf818] shrink_zone at ffffffff8112788f
    imx6-dongle#10 [ffff8810343bf8c8] do_try_to_free_pages at ffffffff81127b1e
    imx6-dongle#11 [ffff8810343bf958] try_to_free_pages at ffffffff8112812f
    imx6-dongle#12 [ffff8810343bfa08] __alloc_pages_nodemask at ffffffff8111fdad
    imx6-dongle#13 [ffff8810343bfb28] kmem_getpages at ffffffff81159942
    imx6-dongle#14 [ffff8810343bfb58] fallback_alloc at ffffffff8115a55a
    imx6-dongle#15 [ffff8810343bfbd8] ____cache_alloc_node at ffffffff8115a2d9
    imx6-dongle#16 [ffff8810343bfc38] kmem_cache_alloc at ffffffff8115b09b
    imx6-dongle#17 [ffff8810343bfc78] sk_prot_alloc at ffffffff81411808
    imx6-dongle#18 [ffff8810343bfcb8] sk_alloc at ffffffff8141197c
    imx6-dongle#19 [ffff8810343bfce8] inet_create at ffffffff81483ba6
    #20 [ffff8810343bfd38] __sock_create at ffffffff8140b4a7
    #21 [ffff8810343bfd98] xs_create_sock at ffffffffa01f649b [sunrpc]
    #22 [ffff8810343bfdd8] xs_tcp_setup_socket at ffffffffa01f6965 [sunrpc]
    #23 [ffff8810343bfe38] worker_thread at ffffffff810887d0
    #24 [ffff8810343bfee8] kthread at ffffffff8108dd96
    #25 [ffff8810343bff48] kernel_thread at ffffffff8100c1ca

rpciod is trying to allocate memory for a new socket to talk to the
server. The VM ends up calling ->releasepage to get more memory, and it
tries to do a blocking commit. That commit can't succeed however without
a connected socket, so we deadlock.

Fix this by setting PF_FSTRANS on the workqueue task prior to doing the
socket allocation, and having nfs_release_page check for that flag when
deciding whether to do a commit call. Also, set PF_FSTRANS
unconditionally in rpc_async_schedule since that function can also do
allocations sometimes.

Signed-off-by: Jeff Layton <[email protected]>
Signed-off-by: Trond Myklebust <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
mtx512 pushed a commit to mtx512/linux-imx that referenced this issue Jan 9, 2014
This will fix the following oops:

[    6.169981] genirq: Flags mismatch irq 5. 00000000 (ES1688) vs. 00000000 (ES1688)
[    6.170851] Pid: 1, comm: swapper Not tainted 3.5.0-00004-gceee0e9 imx6-dongle#14
[    6.170851] Call Trace:
[    6.170851]  [<c1062237>] ? __setup_irq+0x3c7/0x420
[    6.170851]  [<c1062486>] ? request_threaded_irq+0x76/0x140
[    6.170851]  [<c1290220>] ? snd_es1688_ioctl+0x10/0x10
[    6.170851]  [<c10624c2>] ? request_threaded_irq+0xb2/0x140
[    6.170851]  [<c1291196>] ? snd_es1688_create+0x96/0x330
[    6.170851]  [<c138365d>] ? snd_gusextreme_probe+0x18d/0x5a2
[    6.170851]  [<c11c9d80>] ? __driver_attach+0x80/0x80
[    6.170851]  [<c10db22f>] ? sysfs_create_link+0xf/0x20
[    6.170851]  [<c11c9d80>] ? __driver_attach+0x80/0x80
[    6.170851]  [<c11d1502>] ? isa_bus_probe+0x12/0x20
[    6.170851]  [<c11c9b95>] ? driver_probe_device+0x55/0x1c0
[    6.170851]  [<c13ae04f>] ? _raw_spin_unlock+0xf/0x30
[    6.170851]  [<c13705ea>] ? klist_next+0x6a/0xe0
[    6.170851]  [<c11d15c1>] ? isa_bus_match+0x21/0x40
[    6.170851]  [<c11c8a24>] ? bus_for_each_drv+0x34/0x70
[    6.170851]  [<c11c9e4b>] ? device_attach+0x7b/0x90
[    6.170851]  [<c11c9d80>] ? __driver_attach+0x80/0x80
[    6.170851]  [<c11c8bff>] ? bus_probe_device+0x5f/0x80
[    6.170851]  [<c11c7493>] ? device_add+0x573/0x620
[    6.170851]  [<c1042820>] ? complete_all+0x40/0x60
[    6.170851]  [<c13ae08a>] ? _raw_spin_unlock_irqrestore+0x1a/0x30
[    6.170851]  [<c11d16c6>] ? isa_register_driver+0xb6/0x150
[    6.170851]  [<c15c9002>] ? alsa_card_gusmax_init+0xf/0xf
[    6.170851]  [<c15a99bc>] ? do_one_initcall+0x7f/0x12b
[    6.170851]  [<c15a9b7a>] ? kernel_init+0x112/0x1a9
[    6.170851]  [<c15a9423>] ? do_early_param+0x77/0x77
[    6.170851]  [<c15a9a68>] ? do_one_initcall+0x12b/0x12b
[    6.170851]  [<c13aefbe>] ? kernel_thread_helper+0x6/0xd
[    6.190170] es1688: can't grab IRQ 5
[    6.190613] genirq: Flags mismatch irq 5. 00000000 (ES1688) vs. 00000000 (ES1688)
[    6.191566] Pid: 1, comm: swapper Not tainted 3.5.0-00004-gceee0e9 imx6-dongle#14
[    6.192394] Call Trace:
[    6.192685]  [<c1062237>] ? __setup_irq+0x3c7/0x420
[    6.193342]  [<c1062486>] ? request_threaded_irq+0x76/0x140
[    6.194081]  [<c1290220>] ? snd_es1688_ioctl+0x10/0x10
[    6.194607]  [<c10624c2>] ? request_threaded_irq+0xb2/0x140
[    6.194607]  [<c1291196>] ? snd_es1688_create+0x96/0x330
[    6.194607]  [<c138365d>] ? snd_gusextreme_probe+0x18d/0x5a2
[    6.194607]  [<c11c9d80>] ? __driver_attach+0x80/0x80
[    6.194607]  [<c10db22f>] ? sysfs_create_link+0xf/0x20
[    6.194607]  [<c11c9d80>] ? __driver_attach+0x80/0x80
[    6.194607]  [<c11d1502>] ? isa_bus_probe+0x12/0x20
[    6.194607]  [<c11c9b95>] ? driver_probe_device+0x55/0x1c0
[    6.194607]  [<c13ae04f>] ? _raw_spin_unlock+0xf/0x30
[    6.194607]  [<c13705ea>] ? klist_next+0x6a/0xe0
[    6.194607]  [<c11d15c1>] ? isa_bus_match+0x21/0x40
[    6.194607]  [<c11c8a24>] ? bus_for_each_drv+0x34/0x70
[    6.194607]  [<c11c9e4b>] ? device_attach+0x7b/0x90
[    6.194607]  [<c11c9d80>] ? __driver_attach+0x80/0x80
[    6.194607]  [<c11c8bff>] ? bus_probe_device+0x5f/0x80
[    6.194607]  [<c11c7493>] ? device_add+0x573/0x620
[    6.194607]  [<c1042820>] ? complete_all+0x40/0x60
[    6.194607]  [<c13ae08a>] ? _raw_spin_unlock_irqrestore+0x1a/0x30
[    6.194607]  [<c11d16c6>] ? isa_register_driver+0xb6/0x150
[    6.194607]  [<c15c9002>] ? alsa_card_gusmax_init+0xf/0xf
[    6.194607]  [<c15a99bc>] ? do_one_initcall+0x7f/0x12b
[    6.194607]  [<c15a9b7a>] ? kernel_init+0x112/0x1a9
[    6.194607]  [<c15a9423>] ? do_early_param+0x77/0x77
[    6.194607]  [<c15a9a68>] ? do_one_initcall+0x12b/0x12b
[    6.194607]  [<c13aefbe>] ? kernel_thread_helper+0x6/0xd
[    6.210779] es1688: can't grab IRQ 5
[    6.211305] gusextreme: probe of gusextreme.0 failed with error -16

Signed-off-by: Daniel Mack <[email protected]>
Signed-off-by: Fengguang Wu <[email protected]>
Signed-off-by: Takashi Iwai <[email protected]>
mtx512 pushed a commit to mtx512/linux-imx that referenced this issue Jan 9, 2014
…d reasons

We've had some reports of a deadlock where rpciod ends up with a stack
trace like this:

    PID: 2507   TASK: ffff88103691ab40  CPU: 14  COMMAND: "rpciod/14"
     #0 [ffff8810343bf2f0] schedule at ffffffff814dabd9
     #1 [ffff8810343bf3b8] nfs_wait_bit_killable at ffffffffa038fc04 [nfs]
     imx6-dongle#2 [ffff8810343bf3c8] __wait_on_bit at ffffffff814dbc2f
     imx6-dongle#3 [ffff8810343bf418] out_of_line_wait_on_bit at ffffffff814dbcd8
     imx6-dongle#4 [ffff8810343bf488] nfs_commit_inode at ffffffffa039e0c1 [nfs]
     imx6-dongle#5 [ffff8810343bf4f8] nfs_release_page at ffffffffa038bef6 [nfs]
     imx6-dongle#6 [ffff8810343bf528] try_to_release_page at ffffffff8110c670
     imx6-dongle#7 [ffff8810343bf538] shrink_page_list.clone.0 at ffffffff81126271
     imx6-dongle#8 [ffff8810343bf668] shrink_inactive_list at ffffffff81126638
     imx6-dongle#9 [ffff8810343bf818] shrink_zone at ffffffff8112788f
    imx6-dongle#10 [ffff8810343bf8c8] do_try_to_free_pages at ffffffff81127b1e
    imx6-dongle#11 [ffff8810343bf958] try_to_free_pages at ffffffff8112812f
    imx6-dongle#12 [ffff8810343bfa08] __alloc_pages_nodemask at ffffffff8111fdad
    imx6-dongle#13 [ffff8810343bfb28] kmem_getpages at ffffffff81159942
    imx6-dongle#14 [ffff8810343bfb58] fallback_alloc at ffffffff8115a55a
    imx6-dongle#15 [ffff8810343bfbd8] ____cache_alloc_node at ffffffff8115a2d9
    imx6-dongle#16 [ffff8810343bfc38] kmem_cache_alloc at ffffffff8115b09b
    imx6-dongle#17 [ffff8810343bfc78] sk_prot_alloc at ffffffff81411808
    imx6-dongle#18 [ffff8810343bfcb8] sk_alloc at ffffffff8141197c
    imx6-dongle#19 [ffff8810343bfce8] inet_create at ffffffff81483ba6
    #20 [ffff8810343bfd38] __sock_create at ffffffff8140b4a7
    #21 [ffff8810343bfd98] xs_create_sock at ffffffffa01f649b [sunrpc]
    #22 [ffff8810343bfdd8] xs_tcp_setup_socket at ffffffffa01f6965 [sunrpc]
    #23 [ffff8810343bfe38] worker_thread at ffffffff810887d0
    #24 [ffff8810343bfee8] kthread at ffffffff8108dd96
    #25 [ffff8810343bff48] kernel_thread at ffffffff8100c1ca

rpciod is trying to allocate memory for a new socket to talk to the
server. The VM ends up calling ->releasepage to get more memory, and it
tries to do a blocking commit. That commit can't succeed however without
a connected socket, so we deadlock.

Fix this by setting PF_FSTRANS on the workqueue task prior to doing the
socket allocation, and having nfs_release_page check for that flag when
deciding whether to do a commit call. Also, set PF_FSTRANS
unconditionally in rpc_async_schedule since that function can also do
allocations sometimes.

Signed-off-by: Jeff Layton <[email protected]>
Signed-off-by: Trond Myklebust <[email protected]>
Cc: [email protected]
mtx512 pushed a commit to mtx512/linux-imx that referenced this issue Jan 9, 2014
Cancel work of the xfs_sync_worker before teardown of the log in
xfs_unmountfs.  This prevents occasional crashes on unmount like so:

PID: 21602  TASK: ee9df060  CPU: 0   COMMAND: "kworker/0:3"
 #0 [c5377d28] crash_kexec at c0292c94
 #1 [c5377d80] oops_end at c07090c2
 imx6-dongle#2 [c5377d98] no_context at c06f614e
 imx6-dongle#3 [c5377dbc] __bad_area_nosemaphore at c06f6281
 imx6-dongle#4 [c5377df4] bad_area_nosemaphore at c06f629b
 imx6-dongle#5 [c5377e00] do_page_fault at c070b0cb
 imx6-dongle#6 [c5377e7c] error_code (via page_fault) at c070892c
    EAX: f300c6a8  EBX: f300c6a8  ECX: 000000c0  EDX: 000000c0  EBP: c5377ed0
    DS:  007b      ESI: 00000000  ES:  007b      EDI: 00000001  GS:  ffffad20
    CS:  0060      EIP: c0481ad0  ERR: ffffffff  EFLAGS: 00010246
 imx6-dongle#7 [c5377eb0] atomic64_read_cx8 at c0481ad0
 imx6-dongle#8 [c5377ebc] xlog_assign_tail_lsn_locked at f7cc7c6e [xfs]
 imx6-dongle#9 [c5377ed4] xfs_trans_ail_delete_bulk at f7ccd520 [xfs]
imx6-dongle#10 [c5377f0c] xfs_buf_iodone at f7ccb602 [xfs]
imx6-dongle#11 [c5377f24] xfs_buf_do_callbacks at f7cca524 [xfs]
imx6-dongle#12 [c5377f30] xfs_buf_iodone_callbacks at f7cca5da [xfs]
imx6-dongle#13 [c5377f4c] xfs_buf_iodone_work at f7c718d0 [xfs]
imx6-dongle#14 [c5377f58] process_one_work at c024ee4c
imx6-dongle#15 [c5377f98] worker_thread at c024f43d
imx6-dongle#16 [c5377fbc] kthread at c025326b
imx6-dongle#17 [c5377fe8] kernel_thread_helper at c070e834

PID: 26653  TASK: e79143b0  CPU: 3   COMMAND: "umount"
 #0 [cde0fda0] __schedule at c0706595
 #1 [cde0fe28] schedule at c0706b89
 imx6-dongle#2 [cde0fe30] schedule_timeout at c0705600
 imx6-dongle#3 [cde0fe94] __down_common at c0706098
 imx6-dongle#4 [cde0fec8] __down at c0706122
 imx6-dongle#5 [cde0fed0] down at c025936f
 imx6-dongle#6 [cde0fee0] xfs_buf_lock at f7c7131d [xfs]
 imx6-dongle#7 [cde0ff00] xfs_freesb at f7cc2236 [xfs]
 imx6-dongle#8 [cde0ff10] xfs_fs_put_super at f7c80f21 [xfs]
 imx6-dongle#9 [cde0ff1c] generic_shutdown_super at c0333d7a
imx6-dongle#10 [cde0ff38] kill_block_super at c0333e0f
imx6-dongle#11 [cde0ff48] deactivate_locked_super at c0334218
imx6-dongle#12 [cde0ff58] deactivate_super at c033495d
imx6-dongle#13 [cde0ff68] mntput_no_expire at c034bc13
imx6-dongle#14 [cde0ff7c] sys_umount at c034cc69
imx6-dongle#15 [cde0ffa0] sys_oldumount at c034ccd4
imx6-dongle#16 [cde0ffb0] system_call at c0707e66

commit 11159a0 added this to xfs_log_unmount and needs to be cleaned up
at a later date.

Signed-off-by: Ben Myers <[email protected]>
Reviewed-by: Dave Chinner <[email protected]>
Reviewed-by: Mark Tinguely <[email protected]>
mtx512 pushed a commit to mtx512/linux-imx that referenced this issue Jan 9, 2014
Cancel work of the xfs_sync_worker before teardown of the log in
xfs_unmountfs.  This prevents occasional crashes on unmount like so:

PID: 21602  TASK: ee9df060  CPU: 0   COMMAND: "kworker/0:3"
 #0 [c5377d28] crash_kexec at c0292c94
 #1 [c5377d80] oops_end at c07090c2
 imx6-dongle#2 [c5377d98] no_context at c06f614e
 imx6-dongle#3 [c5377dbc] __bad_area_nosemaphore at c06f6281
 imx6-dongle#4 [c5377df4] bad_area_nosemaphore at c06f629b
 imx6-dongle#5 [c5377e00] do_page_fault at c070b0cb
 imx6-dongle#6 [c5377e7c] error_code (via page_fault) at c070892c
    EAX: f300c6a8  EBX: f300c6a8  ECX: 000000c0  EDX: 000000c0  EBP: c5377ed0
    DS:  007b      ESI: 00000000  ES:  007b      EDI: 00000001  GS:  ffffad20
    CS:  0060      EIP: c0481ad0  ERR: ffffffff  EFLAGS: 00010246
 imx6-dongle#7 [c5377eb0] atomic64_read_cx8 at c0481ad0
 imx6-dongle#8 [c5377ebc] xlog_assign_tail_lsn_locked at f7cc7c6e [xfs]
 imx6-dongle#9 [c5377ed4] xfs_trans_ail_delete_bulk at f7ccd520 [xfs]
imx6-dongle#10 [c5377f0c] xfs_buf_iodone at f7ccb602 [xfs]
imx6-dongle#11 [c5377f24] xfs_buf_do_callbacks at f7cca524 [xfs]
imx6-dongle#12 [c5377f30] xfs_buf_iodone_callbacks at f7cca5da [xfs]
imx6-dongle#13 [c5377f4c] xfs_buf_iodone_work at f7c718d0 [xfs]
imx6-dongle#14 [c5377f58] process_one_work at c024ee4c
imx6-dongle#15 [c5377f98] worker_thread at c024f43d
imx6-dongle#16 [c5377fbc] kthread at c025326b
imx6-dongle#17 [c5377fe8] kernel_thread_helper at c070e834

PID: 26653  TASK: e79143b0  CPU: 3   COMMAND: "umount"
 #0 [cde0fda0] __schedule at c0706595
 #1 [cde0fe28] schedule at c0706b89
 imx6-dongle#2 [cde0fe30] schedule_timeout at c0705600
 imx6-dongle#3 [cde0fe94] __down_common at c0706098
 imx6-dongle#4 [cde0fec8] __down at c0706122
 imx6-dongle#5 [cde0fed0] down at c025936f
 imx6-dongle#6 [cde0fee0] xfs_buf_lock at f7c7131d [xfs]
 imx6-dongle#7 [cde0ff00] xfs_freesb at f7cc2236 [xfs]
 imx6-dongle#8 [cde0ff10] xfs_fs_put_super at f7c80f21 [xfs]
 imx6-dongle#9 [cde0ff1c] generic_shutdown_super at c0333d7a
imx6-dongle#10 [cde0ff38] kill_block_super at c0333e0f
imx6-dongle#11 [cde0ff48] deactivate_locked_super at c0334218
imx6-dongle#12 [cde0ff58] deactivate_super at c033495d
imx6-dongle#13 [cde0ff68] mntput_no_expire at c034bc13
imx6-dongle#14 [cde0ff7c] sys_umount at c034cc69
imx6-dongle#15 [cde0ffa0] sys_oldumount at c034ccd4
imx6-dongle#16 [cde0ffb0] system_call at c0707e66

commit 11159a0 added this to xfs_log_unmount and needs to be cleaned up
at a later date.

Signed-off-by: Ben Myers <[email protected]>
Reviewed-by: Dave Chinner <[email protected]>
Reviewed-by: Mark Tinguely <[email protected]>
mtx512 pushed a commit to mtx512/linux-imx that referenced this issue Jan 9, 2014
On Wed, 2012-12-12 at 23:16 -0500, Dave Jones wrote:
> Since todays net merge, I see this when I start openvpn..
>
> general protection fault: 0000 [#1] PREEMPT SMP
> Modules linked in: ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_conntrack nf_conntrack ip6table_filter ip6_tables xfs iTCO_wdt iTCO_vendor_support snd_emu10k1 snd_util_mem snd_ac97_codec coretemp ac97_bus microcode snd_hwdep snd_seq pcspkr snd_pcm snd_page_alloc snd_timer lpc_ich i2c_i801 snd_rawmidi mfd_core snd_seq_device snd e1000e soundcore emu10k1_gp gameport i82975x_edac edac_core vhost_net tun macvtap macvlan kvm_intel kvm binfmt_misc nfsd auth_rpcgss nfs_acl lockd sunrpc btrfs libcrc32c zlib_deflate firewire_ohci sata_sil firewire_core crc_itu_t radeon i2c_algo_bit drm_kms_helper ttm drm i2c_core floppy
> CPU 0
> Pid: 1381, comm: openvpn Not tainted 3.7.0+ imx6-dongle#14                  /D975XBX
> RIP: 0010:[<ffffffff815b54a4>]  [<ffffffff815b54a4>] skb_flow_dissect+0x314/0x3e0
> RSP: 0018:ffff88007d0d9c48  EFLAGS: 00010206
> RAX: 000000000000055d RBX: 6b6b6b6b6b6b6b4b RCX: 1471030a0180040a
> RDX: 0000000000000005 RSI: 00000000ffffffe0 RDI: ffff8800ba83fa80
> RBP: ffff88007d0d9cb8 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000101 R12: ffff8800ba83fa80
> R13: 0000000000000008 R14: ffff88007d0d9cc8 R15: ffff8800ba83fa80
> FS:  00007f6637104800(0000) GS:ffff8800bf600000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f563f5b01c4 CR3: 000000007d140000 CR4: 00000000000007f0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
> Process openvpn (pid: 1381, threadinfo ffff88007d0d8000, task ffff8800a540cd60)
> Stack:
>  ffff8800ba83fa80 0000000000000296 0000000000000000 0000000000000000
>  ffff88007d0d9cc8 ffffffff815bcff4 ffff88007d0d9ce8 ffffffff815b1831
>  ffff88007d0d9ca8 00000000703f6364 ffff8800ba83fa80 0000000000000000
> Call Trace:
>  [<ffffffff815bcff4>] ? netif_rx+0x114/0x4c0
>  [<ffffffff815b1831>] ? skb_copy_datagram_from_iovec+0x61/0x290
>  [<ffffffff815b672a>] __skb_get_rxhash+0x1a/0xd0
>  [<ffffffffa03b9538>] tun_get_user+0x418/0x810 [tun]
>  [<ffffffff8135f468>] ? delay_tsc+0x98/0xf0
>  [<ffffffff8109605c>] ? __rcu_read_unlock+0x5c/0xa0
>  [<ffffffffa03b9a41>] tun_chr_aio_write+0x81/0xb0 [tun]
>  [<ffffffff81145011>] ? __buffer_unlock_commit+0x41/0x50
>  [<ffffffff811db917>] do_sync_write+0xa7/0xe0
>  [<ffffffff811dc01f>] vfs_write+0xaf/0x190
>  [<ffffffff811dc375>] sys_write+0x55/0xa0
>  [<ffffffff81705540>] tracesys+0xdd/0xe2
> Code: 41 8b 44 24 68 41 2b 44 24 6c 01 de 29 f0 83 f8 03 0f 8e a0 00 00 00 48 63 de 49 03 9c 24 e0 00 00 00 48 85 db 0f 84 72 fe ff ff <8b> 03 41 89 46 08 b8 01 00 00 00 e9 43 fd ff ff 0f 1f 40 00 48
> RIP  [<ffffffff815b54a4>] skb_flow_dissect+0x314/0x3e0
>  RSP <ffff88007d0d9c48>
> ---[ end trace 6d42c834c72c002e ]---
>
>
> Faulting instruction is
>
>    0:	8b 03                	mov    (%rbx),%eax
>
> rbx is slab poison (-20) so this looks like a use-after-free here...
>
>                         flow->ports = *ports;
>  314:   8b 03                   mov    (%rbx),%eax
>  316:   41 89 46 08             mov    %eax,0x8(%r14)
>
> in the inlined skb_header_pointer in skb_flow_dissect
>
> 	Dave
>

commit 96442e4 (tuntap: choose the txq based on rxq) added
a use after free.

Cache rxhash in a temp variable before calling netif_rx_ni()

Reported-by: Dave Jones <[email protected]>
Signed-off-by: Eric Dumazet <[email protected]>
Cc: Jason Wang <[email protected]>
Acked-by: Jason Wang <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
mtx512 pushed a commit to mtx512/linux-imx that referenced this issue Jan 9, 2014
…s struct file

commit e4daf1ffbe6cc3b12aab4d604e627829e93e9914 upstream.

The following call chain:
------------------------------------------------------------
nfs4_get_vfs_file
- nfsd_open
  - dentry_open
    - do_dentry_open
      - __get_file_write_access
        - get_write_access
          - return atomic_inc_unless_negative(&inode->i_writecount) ? 0 : -ETXTBSY;
------------------------------------------------------------

can result in the following state:
------------------------------------------------------------
struct nfs4_file {
...
  fi_fds = {0xffff880c1fa65c80, 0xffffffffffffffe6, 0x0},
  fi_access = {{
      counter = 0x1
    }, {
      counter = 0x0
    }},
...
------------------------------------------------------------

1) First time around, in nfs4_get_vfs_file() fp->fi_fds[O_WRONLY] is
NULL, hence nfsd_open() is called where we get status set to an error
and fp->fi_fds[O_WRONLY] to -ETXTBSY. Thus we do not reach
nfs4_file_get_access() and fi_access[O_WRONLY] is not incremented.

2) Second time around, in nfs4_get_vfs_file() fp->fi_fds[O_WRONLY] is
NOT NULL (-ETXTBSY), so nfsd_open() is NOT called, but
nfs4_file_get_access() IS called and fi_access[O_WRONLY] is incremented.
Thus we leave a landmine in the form of the nfs4_file data structure in
an incorrect state.

3) Eventually, when __nfs4_file_put_access() is called it finds
fi_access[O_WRONLY] being non-zero, it decrements it and calls
nfs4_file_put_fd() which tries to fput -ETXTBSY.
------------------------------------------------------------
...
     [exception RIP: fput+0x9]
     RIP: ffffffff81177fa9  RSP: ffff88062e365c90  RFLAGS: 00010282
     RAX: ffff880c2b3d99cc  RBX: ffff880c2b3d9978  RCX: 0000000000000002
     RDX: dead000000100101  RSI: 0000000000000001  RDI: ffffffffffffffe6
     RBP: ffff88062e365c90   R8: ffff88041fe797d8   R9: ffff88062e365d58
     R10: 0000000000000008  R11: 0000000000000000  R12: 0000000000000001
     R13: 0000000000000007  R14: 0000000000000000  R15: 0000000000000000
     ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
  imx6-dongle#9 [ffff88062e365c98] __nfs4_file_put_access at ffffffffa0562334 [nfsd]
 imx6-dongle#10 [ffff88062e365cc8] nfs4_file_put_access at ffffffffa05623ab [nfsd]
 imx6-dongle#11 [ffff88062e365ce8] free_generic_stateid at ffffffffa056634d [nfsd]
 imx6-dongle#12 [ffff88062e365d18] release_open_stateid at ffffffffa0566e4b [nfsd]
 imx6-dongle#13 [ffff88062e365d38] nfsd4_close at ffffffffa0567401 [nfsd]
 imx6-dongle#14 [ffff88062e365d88] nfsd4_proc_compound at ffffffffa0557f28 [nfsd]
 imx6-dongle#15 [ffff88062e365dd8] nfsd_dispatch at ffffffffa054543e [nfsd]
 imx6-dongle#16 [ffff88062e365e18] svc_process_common at ffffffffa04ba5a4 [sunrpc]
 imx6-dongle#17 [ffff88062e365e98] svc_process at ffffffffa04babe0 [sunrpc]
 imx6-dongle#18 [ffff88062e365eb8] nfsd at ffffffffa0545b62 [nfsd]
 imx6-dongle#19 [ffff88062e365ee8] kthread at ffffffff81090886
 #20 [ffff88062e365f48] kernel_thread at ffffffff8100c14a
------------------------------------------------------------

Signed-off-by: Harshula Jayasuriya <[email protected]>
Signed-off-by: J. Bruce Fields <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants