]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
.36 patches
authorGreg Kroah-Hartman <gregkh@suse.de>
Tue, 15 Feb 2011 20:34:57 +0000 (12:34 -0800)
committerGreg Kroah-Hartman <gregkh@suse.de>
Tue, 15 Feb 2011 20:34:57 +0000 (12:34 -0800)
queue-2.6.36/drm-i915-add-dependency-on-config_tmpfs.patch [new file with mode: 0644]
queue-2.6.36/drm-i915-fix-calculation-of-edp-signal-levels-on-sandybridge.patch [new file with mode: 0644]
queue-2.6.36/drm-i915-lvds-add-aopen-i915gmm-hfs-to-the-list-of-false-positive-lvds.patch [new file with mode: 0644]
queue-2.6.36/drm-i915-recognise-non-vga-display-devices.patch [new file with mode: 0644]
queue-2.6.36/drm-restore-the-old_fb-upon-modeset-failure.patch [new file with mode: 0644]
queue-2.6.36/series
queue-2.6.36/x86-mm-avoid-possible-bogus-tlb-entries-by-clearing-prev-mm_cpumask-after-switching-mm.patch [new file with mode: 0644]

diff --git a/queue-2.6.36/drm-i915-add-dependency-on-config_tmpfs.patch b/queue-2.6.36/drm-i915-add-dependency-on-config_tmpfs.patch
new file mode 100644 (file)
index 0000000..25768ae
--- /dev/null
@@ -0,0 +1,57 @@
+From f7ab9b407b3bc83161c2aa74c992ba4782e87c9c Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Thu, 20 Jan 2011 10:03:24 +0000
+Subject: drm/i915: Add dependency on CONFIG_TMPFS
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit f7ab9b407b3bc83161c2aa74c992ba4782e87c9c upstream.
+
+Without tmpfs, shmem_readpage() is not compiled in causing an OOPS as
+soon as we try to allocate some swappable pages for GEM.
+
+Jan 19 22:52:26 harlie kernel: Modules linked in: i915(+) drm_kms_helper cfbcopyarea video backlight cfbimgblt cfbfillrect
+Jan 19 22:52:26 harlie kernel:
+Jan 19 22:52:26 harlie kernel: Pid: 1125, comm: modprobe Not tainted 2.6.37Harlie #10 To be filled by O.E.M./To be filled by O.E.M.
+Jan 19 22:52:26 harlie kernel: EIP: 0060:[<00000000>] EFLAGS: 00010246 CPU: 3
+Jan 19 22:52:26 harlie kernel: EIP is at 0x0
+Jan 19 22:52:26 harlie kernel: EAX: 00000000 EBX: f7b7d000 ECX: f3383100 EDX: f7b7d000
+Jan 19 22:52:26 harlie kernel: ESI: f1456118 EDI: 00000000 EBP: f2303c98 ESP: f2303c7c
+Jan 19 22:52:26 harlie kernel:  DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
+Jan 19 22:52:26 harlie kernel: Process modprobe (pid: 1125, ti=f2302000 task=f259cd80 task.ti=f2302000)
+Jan 19 22:52:26 harlie kernel: Stack:
+Jan 19 22:52:26 harlie udevd-work[1072]: '/sbin/modprobe -b pci:v00008086d00000046sv00000000sd00000000bc03sc00i00' unexpected exit with status 0x0009
+Jan 19 22:52:26 harlie kernel:  c1074061 000000d0 f2f42b80 00000000 000a13d2 f2d5dcc0 00000001 f2303cac
+Jan 19 22:52:26 harlie kernel:  c107416f 00000000 000a13d2 00000000 f2303cd4 f8d620ed f2cee620 00001000
+Jan 19 22:52:26 harlie kernel:  00000000 000a13d2 f1456118 f2d5dcc0 f1a40000 00001000 f2303d04 f8d637ab
+Jan 19 22:52:26 harlie kernel: Call Trace:
+Jan 19 22:52:26 harlie kernel:  [<c1074061>] ? do_read_cache_page+0x71/0x160
+Jan 19 22:52:26 harlie kernel:  [<c107416f>] ? read_cache_page_gfp+0x1f/0x30
+Jan 19 22:52:26 harlie kernel:  [<f8d620ed>] ? i915_gem_object_get_pages+0xad/0x1d0 [i915]
+Jan 19 22:52:26 harlie kernel:  [<f8d637ab>] ? i915_gem_object_bind_to_gtt+0xeb/0x2d0 [i915]
+Jan 19 22:52:26 harlie kernel:  [<f8d65961>] ? i915_gem_object_pin+0x151/0x190 [i915]
+Jan 19 22:52:26 harlie kernel:  [<c11e16ed>] ? drm_gem_object_init+0x3d/0x60
+Jan 19 22:52:26 harlie kernel:  [<f8d65aa5>] ? i915_gem_init_ringbuffer+0x105/0x1e0 [i915]
+Jan 19 22:52:26 harlie kernel:  [<f8d571b7>] ? i915_driver_load+0x667/0x1160 [i915]
+
+Reported-by: John J. Stimson-III <john@idsfa.net>
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/Kconfig |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/Kconfig
++++ b/drivers/gpu/drm/Kconfig
+@@ -97,7 +97,10 @@ config DRM_I830
+ config DRM_I915
+       tristate "i915 driver"
+       depends on AGP_INTEL
++      # we need shmfs for the swappable backing store, and in particular
++      # the shmem_readpage() which depends upon tmpfs
+       select SHMEM
++      select TMPFS
+       select DRM_KMS_HELPER
+       select FB_CFB_FILLRECT
+       select FB_CFB_COPYAREA
diff --git a/queue-2.6.36/drm-i915-fix-calculation-of-edp-signal-levels-on-sandybridge.patch b/queue-2.6.36/drm-i915-fix-calculation-of-edp-signal-levels-on-sandybridge.patch
new file mode 100644 (file)
index 0000000..80f1121
--- /dev/null
@@ -0,0 +1,78 @@
+From 3c5a62b5226ca5db993660281e9c2a7275d9fb02 Mon Sep 17 00:00:00 2001
+From: Yuanhan Liu <yuanhan.liu@linux.intel.com>
+Date: Thu, 6 Jan 2011 18:26:08 +0800
+Subject: drm/i915: fix calculation of eDP signal levels on Sandybridge
+
+From: Yuanhan Liu <yuanhan.liu@linux.intel.com>
+
+commit 3c5a62b5226ca5db993660281e9c2a7275d9fb02 upstream.
+
+Some voltage swing/pre-emphasis level use the same value on eDP
+Sandybridge, like 400mv_0db and 600mv_0db are with the same value
+of (0x0 << 22). So, fix them, and point out the value if it isn't
+a supported voltage swing/pre-emphasis level.
+
+Signed-off-by: Yuanhan Liu <yuanhan.liu@linux.intel.com>
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_reg.h |    9 +++++----
+ drivers/gpu/drm/i915/intel_dp.c |   23 ++++++++++++++++-------
+ 2 files changed, 21 insertions(+), 11 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -2967,10 +2967,11 @@
+ #define  EDP_LINK_TRAIN_600MV_3_5DB_SNB_A     (0x01<<22)
+ #define  EDP_LINK_TRAIN_800MV_0DB_SNB_A               (0x0<<22)
+ /* SNB B-stepping */
+-#define  EDP_LINK_TRAIN_400MV_0DB_SNB_B               (0x0<<22)
+-#define  EDP_LINK_TRAIN_400MV_6DB_SNB_B               (0x3a<<22)
+-#define  EDP_LINK_TRAIN_600MV_3_5DB_SNB_B     (0x39<<22)
+-#define  EDP_LINK_TRAIN_800MV_0DB_SNB_B               (0x38<<22)
++#define  EDP_LINK_TRAIN_400_600MV_0DB_SNB_B   (0x0<<22)
++#define  EDP_LINK_TRAIN_400MV_3_5DB_SNB_B     (0x1<<22)
++#define  EDP_LINK_TRAIN_400_600MV_6DB_SNB_B   (0x3a<<22)
++#define  EDP_LINK_TRAIN_600_800MV_3_5DB_SNB_B (0x39<<22)
++#define  EDP_LINK_TRAIN_800_1200MV_0DB_SNB_B  (0x38<<22)
+ #define  EDP_LINK_TRAIN_VOL_EMP_MASK_SNB      (0x3f<<22)
+ #endif /* _I915_REG_H_ */
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -1093,18 +1093,27 @@ intel_dp_signal_levels(uint8_t train_set
+ static uint32_t
+ intel_gen6_edp_signal_levels(uint8_t train_set)
+ {
+-      switch (train_set & (DP_TRAIN_VOLTAGE_SWING_MASK|DP_TRAIN_PRE_EMPHASIS_MASK)) {
++      int signal_levels = train_set & (DP_TRAIN_VOLTAGE_SWING_MASK |
++                                       DP_TRAIN_PRE_EMPHASIS_MASK);
++      switch (signal_levels) {
+       case DP_TRAIN_VOLTAGE_SWING_400 | DP_TRAIN_PRE_EMPHASIS_0:
+-              return EDP_LINK_TRAIN_400MV_0DB_SNB_B;
++      case DP_TRAIN_VOLTAGE_SWING_600 | DP_TRAIN_PRE_EMPHASIS_0:
++              return EDP_LINK_TRAIN_400_600MV_0DB_SNB_B;
++      case DP_TRAIN_VOLTAGE_SWING_400 | DP_TRAIN_PRE_EMPHASIS_3_5:
++              return EDP_LINK_TRAIN_400MV_3_5DB_SNB_B;
+       case DP_TRAIN_VOLTAGE_SWING_400 | DP_TRAIN_PRE_EMPHASIS_6:
+-              return EDP_LINK_TRAIN_400MV_6DB_SNB_B;
++      case DP_TRAIN_VOLTAGE_SWING_600 | DP_TRAIN_PRE_EMPHASIS_6:
++              return EDP_LINK_TRAIN_400_600MV_6DB_SNB_B;
+       case DP_TRAIN_VOLTAGE_SWING_600 | DP_TRAIN_PRE_EMPHASIS_3_5:
+-              return EDP_LINK_TRAIN_600MV_3_5DB_SNB_B;
++      case DP_TRAIN_VOLTAGE_SWING_800 | DP_TRAIN_PRE_EMPHASIS_3_5:
++              return EDP_LINK_TRAIN_600_800MV_3_5DB_SNB_B;
+       case DP_TRAIN_VOLTAGE_SWING_800 | DP_TRAIN_PRE_EMPHASIS_0:
+-              return EDP_LINK_TRAIN_800MV_0DB_SNB_B;
++      case DP_TRAIN_VOLTAGE_SWING_1200 | DP_TRAIN_PRE_EMPHASIS_0:
++              return EDP_LINK_TRAIN_800_1200MV_0DB_SNB_B;
+       default:
+-              DRM_DEBUG_KMS("Unsupported voltage swing/pre-emphasis level\n");
+-              return EDP_LINK_TRAIN_400MV_0DB_SNB_B;
++              DRM_DEBUG_KMS("Unsupported voltage swing/pre-emphasis level:"
++                            "0x%x\n", signal_levels);
++              return EDP_LINK_TRAIN_400_600MV_0DB_SNB_B;
+       }
+ }
diff --git a/queue-2.6.36/drm-i915-lvds-add-aopen-i915gmm-hfs-to-the-list-of-false-positive-lvds.patch b/queue-2.6.36/drm-i915-lvds-add-aopen-i915gmm-hfs-to-the-list-of-false-positive-lvds.patch
new file mode 100644 (file)
index 0000000..ad6c3a0
--- /dev/null
@@ -0,0 +1,34 @@
+From 22ab70d3262ddb6e69b3c246a34e2967ba5eb1e8 Mon Sep 17 00:00:00 2001
+From: Knut Petersen <knut_petersen@t-online.de>
+Date: Fri, 14 Jan 2011 15:38:10 +0000
+Subject: drm/i915/lvds: Add AOpen i915GMm-HFS to the list of false-positive LVDS
+
+From: Knut Petersen <knut_petersen@t-online.de>
+
+commit 22ab70d3262ddb6e69b3c246a34e2967ba5eb1e8 upstream.
+
+Signed-off-by: Knut Petersen <knut_petersen@t-online.de>
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_lvds.c |    8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -701,6 +701,14 @@ static const struct dmi_system_id intel_
+       },
+       {
+               .callback = intel_no_lvds_dmi_callback,
++              .ident = "AOpen i915GMm-HFS",
++              .matches = {
++                      DMI_MATCH(DMI_BOARD_VENDOR, "AOpen"),
++                      DMI_MATCH(DMI_BOARD_NAME, "i915GMm-HFS"),
++              },
++      },
++      {
++              .callback = intel_no_lvds_dmi_callback,
+               .ident = "Aopen i945GTt-VFA",
+               .matches = {
+                       DMI_MATCH(DMI_PRODUCT_VERSION, "AO00001JW"),
diff --git a/queue-2.6.36/drm-i915-recognise-non-vga-display-devices.patch b/queue-2.6.36/drm-i915-recognise-non-vga-display-devices.patch
new file mode 100644 (file)
index 0000000..737abbb
--- /dev/null
@@ -0,0 +1,69 @@
+From 934f992c763ae1e5eefcce8af769c16444085df7 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Thu, 20 Jan 2011 13:09:12 +0000
+Subject: drm/i915: Recognise non-VGA display devices
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 934f992c763ae1e5eefcce8af769c16444085df7 upstream.
+
+Starting with SandyBridge (though possible with earlier hacked BIOSes),
+the BIOS may initialise the IGFX as secondary to a discrete GPU. Prior,
+it would simply disable the integrated GPU. So we adjust our PCI class
+mask to match any DISPLAY_CLASS device.
+
+In such a configuration, the IGFX is not a primary VGA controller and
+so should not take part in VGA arbitration, and the error return from
+vga_client_register() is expected.
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_dma.c |   10 ++++++++--
+ drivers/gpu/drm/i915/i915_drv.c |    2 +-
+ drivers/gpu/vga/vgaarb.c        |    2 +-
+ 3 files changed, 10 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_dma.c
++++ b/drivers/gpu/drm/i915/i915_dma.c
+@@ -1419,9 +1419,15 @@ static int i915_load_modeset_init(struct
+       if (ret)
+               DRM_INFO("failed to find VBIOS tables\n");
+-      /* if we have > 1 VGA cards, then disable the radeon VGA resources */
++      /* If we have > 1 VGA cards, then we need to arbitrate access
++       * to the common VGA resources.
++       *
++       * If we are a secondary display controller (!PCI_DISPLAY_CLASS_VGA),
++       * then we do not take part in VGA arbitration and the
++       * vga_client_register() fails with -ENODEV.
++       */
+       ret = vga_client_register(dev->pdev, dev, NULL, i915_vga_set_decode);
+-      if (ret)
++      if (ret && ret != -ENODEV)
+               goto cleanup_ringbuffer;
+       ret = vga_switcheroo_register_client(dev->pdev,
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -53,7 +53,7 @@ extern int intel_agp_enabled;
+ #define INTEL_VGA_DEVICE(id, info) {          \
+       .class = PCI_CLASS_DISPLAY_VGA << 8,    \
+-      .class_mask = 0xffff00,                 \
++      .class_mask = 0xff0000,                 \
+       .vendor = 0x8086,                       \
+       .device = id,                           \
+       .subvendor = PCI_ANY_ID,                \
+--- a/drivers/gpu/vga/vgaarb.c
++++ b/drivers/gpu/vga/vgaarb.c
+@@ -636,7 +636,7 @@ int vga_client_register(struct pci_dev *
+                       void (*irq_set_state)(void *cookie, bool state),
+                       unsigned int (*set_vga_decode)(void *cookie, bool decode))
+ {
+-      int ret = -1;
++      int ret = -ENODEV;
+       struct vga_device *vgadev;
+       unsigned long flags;
diff --git a/queue-2.6.36/drm-restore-the-old_fb-upon-modeset-failure.patch b/queue-2.6.36/drm-restore-the-old_fb-upon-modeset-failure.patch
new file mode 100644 (file)
index 0000000..6cda92b
--- /dev/null
@@ -0,0 +1,77 @@
+From 0ba41e449fd0f45f5b29c1009020ab1b298bedda Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Sat, 8 Jan 2011 15:10:41 +0000
+Subject: drm: Restore the old_fb upon modeset failure
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 0ba41e449fd0f45f5b29c1009020ab1b298bedda upstream.
+
+... or else we may end up disabling the wrong framebuffer, leading to an
+OOPS, e.g:
+
+[ 6033.229012] kernel BUG at drivers/gpu/drm/i915/i915_gem.c:3271!
+[ 6033.229012] invalid opcode: 0000 [#1] SMP
+[ 6033.229012] last sysfs file:
+/sys/devices/virtual/backlight/acpi_video0/uevent
+[ 6033.229012] Modules linked in: sunrpc cpufreq_ondemand acpi_cpufreq
+mperf snd_hda_codec_analog snd_hda_intel snd_hda_codec snd_hwdep snd_seq
+snd_seq_device snd_pcm snd_timer thinkpad_acpi ppdev snd r852 sm_common
+iTCO_wdt uvcvideo i2c_i801 iTCO_vendor_support microcode wmi nand
+videodev nand_ids nand_ecc snd_page_alloc parport_pc parport mtd
+soundcore joydev v4l1_compat pcspkr uinput ipv6 sdhci_pci sdhci mmc_core
+yenta_socket i915 drm_kms_helper drm i2c_algo_bit i2c_core video output
+[last unloaded: scsi_wait_scan]
+[ 6033.229012]
+[ 6033.229012] Pid: 4834, comm: Xorg Not tainted 2.6.37-rc8+ #25 7661BL5/7661BL5
+[ 6033.229012] EIP: 0060:[<f86fda5e>] EFLAGS: 00013246 CPU: 0
+[ 6033.229012] EIP is at i915_gem_object_unpin+0x23/0x76 [i915]
+[ 6033.229012] EAX: f68a4000 EBX: f6831f00 ECX: 000600fa EDX: f68a8000
+[ 6033.229012] ESI: f68a4014 EDI: f68a42b8 EBP: f2169c44 ESP: f2169c3c
+[ 6033.229012]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
+[ 6033.229012] Process Xorg (pid: 4834, ti=f2168000 task=f21c8000 task.ti=f2168000)
+[ 6033.229012] Stack:
+[ 6033.229012]  f3a84800 f68a4014 f2169c54 f87045d8 f3a84800 f872d9a8 f2169c68 f7fd8091
+[ 6033.229012]  f3b952a4 00000000 f68a414c f2169cf0 f7fd9377 00000000 00000000 f7fd98b0
+[ 6033.229012]  f7fd9f4e 0000000f f7f328a0 00000000 00000000 00000000 f2169ca4 f68a414c
+[ 6033.229012] Call Trace:
+[ 6033.229012]  [<f87045d8>] ? intel_crtc_disable+0x36/0x41 [i915]
+[ 6033.229012]  [<f7fd8091>] ?  drm_helper_disable_unused_functions+0xcd/0xf9 [drm_kms_helper]
+[ 6033.229012]  [<f7fd9377>] ? drm_crtc_helper_set_config+0x62a/0x7f7 [drm_kms_helper]
+[ 6033.229012]  [<c04daa10>] ? __slab_free+0x1b/0xa4
+[ 6033.229012]  [<f7fd7e62>] ? drm_fb_helper_initial_config+0x466/0x497 [drm_kms_helper]
+[ 6033.229012]  [<f7fd7ea3>] ? drm_fb_helper_restore+0x10/0x2a [drm_kms_helper]
+[ 6033.229012]  [<f86f2577>] ? i915_driver_lastclose+0x2a/0x57 [i915]
+[ 6033.229012]  [<f7f1989f>] ? drm_lastclose+0x45/0x23e [drm]
+[ 6033.229012]  [<f7f1a0b4>] ? drm_release+0x462/0x4d7 [drm]
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/drm_crtc_helper.c |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_crtc_helper.c
++++ b/drivers/gpu/drm/drm_crtc_helper.c
+@@ -649,6 +649,7 @@ int drm_crtc_helper_set_config(struct dr
+                                                     old_fb)) {
+                               DRM_ERROR("failed to set mode on [CRTC:%d]\n",
+                                         set->crtc->base.id);
++                              set->crtc->fb = old_fb;
+                               ret = -EINVAL;
+                               goto fail;
+                       }
+@@ -663,8 +664,10 @@ int drm_crtc_helper_set_config(struct dr
+                       set->crtc->fb = set->fb;
+               ret = crtc_funcs->mode_set_base(set->crtc,
+                                               set->x, set->y, old_fb);
+-              if (ret != 0)
++              if (ret != 0) {
++                      set->crtc->fb = old_fb;
+                       goto fail;
++              }
+       }
+       kfree(save_connectors);
index 56d7c5182df43300233eafb899b42789a79985fb..f00dacd11632e7a8ac1e82c05f5591d0cdfbc371 100644 (file)
@@ -163,3 +163,9 @@ radeon-kms-fix-dp-displayport-mode-validation.patch
 drm-radeon-kms-add-pll-debugging-output.patch
 drm-radeon-remove-0x4243-pci-id.patch
 drm-radeon-kms-fix-s-r-issues-with-bios-scratch-regs.patch
+drm-restore-the-old_fb-upon-modeset-failure.patch
+drm-i915-fix-calculation-of-edp-signal-levels-on-sandybridge.patch
+drm-i915-lvds-add-aopen-i915gmm-hfs-to-the-list-of-false-positive-lvds.patch
+drm-i915-add-dependency-on-config_tmpfs.patch
+drm-i915-recognise-non-vga-display-devices.patch
+x86-mm-avoid-possible-bogus-tlb-entries-by-clearing-prev-mm_cpumask-after-switching-mm.patch
diff --git a/queue-2.6.36/x86-mm-avoid-possible-bogus-tlb-entries-by-clearing-prev-mm_cpumask-after-switching-mm.patch b/queue-2.6.36/x86-mm-avoid-possible-bogus-tlb-entries-by-clearing-prev-mm_cpumask-after-switching-mm.patch
new file mode 100644 (file)
index 0000000..cf77a7e
--- /dev/null
@@ -0,0 +1,75 @@
+From 831d52bc153971b70e64eccfbed2b232394f22f8 Mon Sep 17 00:00:00 2001
+From: Suresh Siddha <suresh.b.siddha@intel.com>
+Date: Thu, 3 Feb 2011 12:20:04 -0800
+Subject: x86, mm: avoid possible bogus tlb entries by clearing prev mm_cpumask after switching mm
+
+From: Suresh Siddha <suresh.b.siddha@intel.com>
+
+commit 831d52bc153971b70e64eccfbed2b232394f22f8 upstream.
+
+Clearing the cpu in prev's mm_cpumask early will avoid the flush tlb
+IPI's while the cr3 is still pointing to the prev mm.  And this window
+can lead to the possibility of bogus TLB fills resulting in strange
+failures.  One such problematic scenario is mentioned below.
+
+ T1. CPU-1 is context switching from mm1 to mm2 context and got a NMI
+     etc between the point of clearing the cpu from the mm_cpumask(mm1)
+     and before reloading the cr3 with the new mm2.
+
+ T2. CPU-2 is tearing down a specific vma for mm1 and will proceed with
+     flushing the TLB for mm1.  It doesn't send the flush TLB to CPU-1
+     as it doesn't see that cpu listed in the mm_cpumask(mm1).
+
+ T3. After the TLB flush is complete, CPU-2 goes ahead and frees the
+     page-table pages associated with the removed vma mapping.
+
+ T4. CPU-2 now allocates those freed page-table pages for something
+     else.
+
+ T5. As the CR3 and TLB caches for mm1 is still active on CPU-1, CPU-1
+     can potentially speculate and walk through the page-table caches
+     and can insert new TLB entries.  As the page-table pages are
+     already freed and being used on CPU-2, this page walk can
+     potentially insert a bogus global TLB entry depending on the
+     (random) contents of the page that is being used on CPU-2.
+
+ T6. This bogus TLB entry being global will be active across future CR3
+     changes and can result in weird memory corruption etc.
+
+To avoid this issue, for the prev mm that is handing over the cpu to
+another mm, clear the cpu from the mm_cpumask(prev) after the cr3 is
+changed.
+
+Marking it for -stable, though we haven't seen any reported failure that
+can be attributed to this.
+
+Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
+Acked-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/mmu_context.h |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/include/asm/mmu_context.h
++++ b/arch/x86/include/asm/mmu_context.h
+@@ -36,8 +36,6 @@ static inline void switch_mm(struct mm_s
+       unsigned cpu = smp_processor_id();
+       if (likely(prev != next)) {
+-              /* stop flush ipis for the previous mm */
+-              cpumask_clear_cpu(cpu, mm_cpumask(prev));
+ #ifdef CONFIG_SMP
+               percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
+               percpu_write(cpu_tlbstate.active_mm, next);
+@@ -47,6 +45,9 @@ static inline void switch_mm(struct mm_s
+               /* Re-load page tables */
+               load_cr3(next->pgd);
++              /* stop flush ipis for the previous mm */
++              cpumask_clear_cpu(cpu, mm_cpumask(prev));
++
+               /*
+                * load the LDT, if the LDT is different:
+                */