--- /dev/null
+From ce4b4f228e51219b0b79588caf73225b08b5b779 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <michel.daenzer@amd.com>
+Date: Fri, 24 Mar 2017 19:01:09 +0900
+Subject: drm/radeon: Override fpfn for all VRAM placements in radeon_evict_flags
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michel Dänzer <michel.daenzer@amd.com>
+
+commit ce4b4f228e51219b0b79588caf73225b08b5b779 upstream.
+
+We were accidentally only overriding the first VRAM placement. For BOs
+with the RADEON_GEM_NO_CPU_ACCESS flag set,
+radeon_ttm_placement_from_domain creates a second VRAM placment with
+fpfn == 0. If VRAM is almost full, the first VRAM placement with
+fpfn > 0 may not work, but the second one with fpfn == 0 always will
+(the BO's current location trivially satisfies it). Because "moving"
+the BO to its current location puts it back on the LRU list, this
+results in an infinite loop.
+
+Fixes: 2a85aedd117c ("drm/radeon: Try evicting from CPU accessible to
+ inaccessible VRAM first")
+Reported-by: Zachary Michaels <zmichaels@oblong.com>
+Reported-and-Tested-by: Julien Isorce <jisorce@oblong.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_ttm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_ttm.c
++++ b/drivers/gpu/drm/radeon/radeon_ttm.c
+@@ -213,8 +213,8 @@ static void radeon_evict_flags(struct tt
+ rbo->placement.num_busy_placement = 0;
+ for (i = 0; i < rbo->placement.num_placement; i++) {
+ if (rbo->placements[i].flags & TTM_PL_FLAG_VRAM) {
+- if (rbo->placements[0].fpfn < fpfn)
+- rbo->placements[0].fpfn = fpfn;
++ if (rbo->placements[i].fpfn < fpfn)
++ rbo->placements[i].fpfn = fpfn;
+ } else {
+ rbo->placement.busy_placement =
+ &rbo->placements[i];
--- /dev/null
+From df630b8c1e851b5e265dc2ca9c87222e342c093b Mon Sep 17 00:00:00 2001
+From: Peter Xu <peterx@redhat.com>
+Date: Wed, 15 Mar 2017 16:01:17 +0800
+Subject: KVM: x86: clear bus pointer when destroyed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Peter Xu <peterx@redhat.com>
+
+commit df630b8c1e851b5e265dc2ca9c87222e342c093b upstream.
+
+When releasing the bus, let's clear the bus pointers to mark it out. If
+any further device unregister happens on this bus, we know that we're
+done if we found the bus being released already.
+
+Signed-off-by: Peter Xu <peterx@redhat.com>
+Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ virt/kvm/kvm_main.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -654,8 +654,10 @@ static void kvm_destroy_vm(struct kvm *k
+ list_del(&kvm->vm_list);
+ spin_unlock(&kvm_lock);
+ kvm_free_irq_routing(kvm);
+- for (i = 0; i < KVM_NR_BUSES; i++)
++ for (i = 0; i < KVM_NR_BUSES; i++) {
+ kvm_io_bus_destroy(kvm->buses[i]);
++ kvm->buses[i] = NULL;
++ }
+ kvm_coalesced_mmio_free(kvm);
+ #if defined(CONFIG_MMU_NOTIFIER) && defined(KVM_ARCH_WANT_MMU_NOTIFIER)
+ mmu_notifier_unregister(&kvm->mmu_notifier, kvm->mm);
+@@ -3376,6 +3378,14 @@ int kvm_io_bus_unregister_dev(struct kvm
+ struct kvm_io_bus *new_bus, *bus;
+
+ bus = kvm->buses[bus_idx];
++
++ /*
++ * It's possible the bus being released before hand. If so,
++ * we're done here.
++ */
++ if (!bus)
++ return 0;
++
+ r = -ENOENT;
+ for (i = 0; i < bus->dev_count; i++)
+ if (bus->range[i].dev == dev) {
--- /dev/null
+From c9d398fa237882ea07167e23bcfc5e6847066518 Mon Sep 17 00:00:00 2001
+From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Date: Fri, 31 Mar 2017 15:11:55 -0700
+Subject: mm, hugetlb: use pte_present() instead of pmd_present() in follow_huge_pmd()
+
+From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+
+commit c9d398fa237882ea07167e23bcfc5e6847066518 upstream.
+
+I found the race condition which triggers the following bug when
+move_pages() and soft offline are called on a single hugetlb page
+concurrently.
+
+ Soft offlining page 0x119400 at 0x700000000000
+ BUG: unable to handle kernel paging request at ffffea0011943820
+ IP: follow_huge_pmd+0x143/0x190
+ PGD 7ffd2067
+ PUD 7ffd1067
+ PMD 0
+ [61163.582052] Oops: 0000 [#1] SMP
+ Modules linked in: binfmt_misc ppdev virtio_balloon parport_pc pcspkr i2c_piix4 parport i2c_core acpi_cpufreq ip_tables xfs libcrc32c ata_generic pata_acpi virtio_blk 8139too crc32c_intel ata_piix serio_raw libata virtio_pci 8139cp virtio_ring virtio mii floppy dm_mirror dm_region_hash dm_log dm_mod [last unloaded: cap_check]
+ CPU: 0 PID: 22573 Comm: iterate_numa_mo Tainted: P OE 4.11.0-rc2-mm1+ #2
+ Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
+ RIP: 0010:follow_huge_pmd+0x143/0x190
+ RSP: 0018:ffffc90004bdbcd0 EFLAGS: 00010202
+ RAX: 0000000465003e80 RBX: ffffea0004e34d30 RCX: 00003ffffffff000
+ RDX: 0000000011943800 RSI: 0000000000080001 RDI: 0000000465003e80
+ RBP: ffffc90004bdbd18 R08: 0000000000000000 R09: ffff880138d34000
+ R10: ffffea0004650000 R11: 0000000000c363b0 R12: ffffea0011943800
+ R13: ffff8801b8d34000 R14: ffffea0000000000 R15: 000077ff80000000
+ FS: 00007fc977710740(0000) GS:ffff88007dc00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: ffffea0011943820 CR3: 000000007a746000 CR4: 00000000001406f0
+ Call Trace:
+ follow_page_mask+0x270/0x550
+ SYSC_move_pages+0x4ea/0x8f0
+ SyS_move_pages+0xe/0x10
+ do_syscall_64+0x67/0x180
+ entry_SYSCALL64_slow_path+0x25/0x25
+ RIP: 0033:0x7fc976e03949
+ RSP: 002b:00007ffe72221d88 EFLAGS: 00000246 ORIG_RAX: 0000000000000117
+ RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc976e03949
+ RDX: 0000000000c22390 RSI: 0000000000001400 RDI: 0000000000005827
+ RBP: 00007ffe72221e00 R08: 0000000000c2c3a0 R09: 0000000000000004
+ R10: 0000000000c363b0 R11: 0000000000000246 R12: 0000000000400650
+ R13: 00007ffe72221ee0 R14: 0000000000000000 R15: 0000000000000000
+ Code: 81 e4 ff ff 1f 00 48 21 c2 49 c1 ec 0c 48 c1 ea 0c 4c 01 e2 49 bc 00 00 00 00 00 ea ff ff 48 c1 e2 06 49 01 d4 f6 45 bc 04 74 90 <49> 8b 7c 24 20 40 f6 c7 01 75 2b 4c 89 e7 8b 47 1c 85 c0 7e 2a
+ RIP: follow_huge_pmd+0x143/0x190 RSP: ffffc90004bdbcd0
+ CR2: ffffea0011943820
+ ---[ end trace e4f81353a2d23232 ]---
+ Kernel panic - not syncing: Fatal exception
+ Kernel Offset: disabled
+
+This bug is triggered when pmd_present() returns true for non-present
+hugetlb, so fixing the present check in follow_huge_pmd() prevents it.
+Using pmd_present() to determine present/non-present for hugetlb is not
+correct, because pmd_present() checks multiple bits (not only
+_PAGE_PRESENT) for historical reason and it can misjudge hugetlb state.
+
+Fixes: e66f17ff7177 ("mm/hugetlb: take page table lock in follow_huge_pmd()")
+Link: http://lkml.kernel.org/r/1490149898-20231-1-git-send-email-n-horiguchi@ah.jp.nec.com
+Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Acked-by: Hillf Danton <hillf.zj@alibaba-inc.com>
+Cc: Hugh Dickins <hughd@google.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
+Cc: Mike Kravetz <mike.kravetz@oracle.com>
+Cc: Christian Borntraeger <borntraeger@de.ibm.com>
+Cc: Gerald Schaefer <gerald.schaefer@de.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/hugetlb.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -4362,6 +4362,7 @@ follow_huge_pmd(struct mm_struct *mm, un
+ {
+ struct page *page = NULL;
+ spinlock_t *ptl;
++ pte_t pte;
+ retry:
+ ptl = pmd_lockptr(mm, pmd);
+ spin_lock(ptl);
+@@ -4371,12 +4372,13 @@ retry:
+ */
+ if (!pmd_huge(*pmd))
+ goto out;
+- if (pmd_present(*pmd)) {
++ pte = huge_ptep_get((pte_t *)pmd);
++ if (pte_present(pte)) {
+ page = pmd_page(*pmd) + ((address & ~PMD_MASK) >> PAGE_SHIFT);
+ if (flags & FOLL_GET)
+ get_page(page);
+ } else {
+- if (is_hugetlb_entry_migration(huge_ptep_get((pte_t *)pmd))) {
++ if (is_hugetlb_entry_migration(pte)) {
+ spin_unlock(ptl);
+ __migration_entry_wait(mm, (pte_t *)pmd, ptl);
+ goto retry;
tty-serial-atmel-fix-race-condition-tx-dma.patch
tty-serial-atmel-fix-tx-path-in-atmel_console_write.patch
usb-fix-linked-list-corruption-in-rh_call_control.patch
+kvm-x86-clear-bus-pointer-when-destroyed.patch
+drm-radeon-override-fpfn-for-all-vram-placements-in-radeon_evict_flags.patch
+mm-hugetlb-use-pte_present-instead-of-pmd_present-in-follow_huge_pmd.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
