From: Greg Kroah-Hartman Date: Thu, 6 Apr 2017 08:07:00 +0000 (+0200) Subject: 4.10-stable patches X-Git-Tag: v4.9.21~5 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9eae20e0e88b1c15a6bcdfe285863622d788a59e;p=thirdparty%2Fkernel%2Fstable-queue.git 4.10-stable patches added patches: drm-i915-a-hotfix-for-making-aliasing-ppgtt-work-for-gvt-g.patch drm-i915-let-execlist_update_context-cover-full_ppgtt-mode.patch drm-i915-move-the-release-of-pt-page-to-the-upper-caller.patch nvme-core-fix-race-kicking-freed-request_queue.patch nvme-pci-disable-on-removal-when-disconnected.patch padata-avoid-race-in-reordering.patch --- diff --git a/queue-4.10/drm-i915-a-hotfix-for-making-aliasing-ppgtt-work-for-gvt-g.patch b/queue-4.10/drm-i915-a-hotfix-for-making-aliasing-ppgtt-work-for-gvt-g.patch new file mode 100644 index 00000000000..9d817bcae5a --- /dev/null +++ b/queue-4.10/drm-i915-a-hotfix-for-making-aliasing-ppgtt-work-for-gvt-g.patch @@ -0,0 +1,50 @@ +From 3e52d71ede206df75b56208e7c7a277ef157bb71 Mon Sep 17 00:00:00 2001 +From: Zhi Wang +Date: Wed, 8 Feb 2017 21:03:33 +0800 +Subject: drm/i915: A hotfix for making aliasing PPGTT work for GVT-g + +From: Zhi Wang + +commit 3e52d71ede206df75b56208e7c7a277ef157bb71 upstream. + +This patch makes PPGTT page table non-shrinkable when using aliasing PPGTT +mode. It's just a temporary solution for making GVT-g work. + +Fixes: 2ce5179fe826 ("drm/i915/gtt: Free unused lower-level page tables") +Cc: Tvrtko Ursulin +Cc: Michal Winiarski +Cc: Michel Thierry +Cc: Mika Kuoppala +Cc: Joonas Lahtinen +Cc: Chris Wilson +Cc: Daniel Vetter +Cc: Zhenyu Wang +Cc: Zhiyuan Lv +Signed-off-by: Zhi Wang +Link: http://patchwork.freedesktop.org/patch/msgid/1486559013-25251-2-git-send-email-zhi.a.wang@intel.com +Reviewed-by: Chris Wilson +Signed-off-by: Chris Wilson +(cherry picked from commit e81ecb5e31db6c2a259d694738cf620d9fa70861) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_gem_gtt.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_gem_gtt.c ++++ b/drivers/gpu/drm/i915/i915_gem_gtt.c +@@ -735,9 +735,10 @@ static bool gen8_ppgtt_clear_pt(struct i + GEM_BUG_ON(pte_end > GEN8_PTES); + + bitmap_clear(pt->used_ptes, pte, num_entries); +- +- if (bitmap_empty(pt->used_ptes, GEN8_PTES)) +- return true; ++ if (USES_FULL_PPGTT(vm->i915)) { ++ if (bitmap_empty(pt->used_ptes, GEN8_PTES)) ++ return true; ++ } + + pt_vaddr = kmap_px(pt); + diff --git a/queue-4.10/drm-i915-let-execlist_update_context-cover-full_ppgtt-mode.patch b/queue-4.10/drm-i915-let-execlist_update_context-cover-full_ppgtt-mode.patch new file mode 100644 index 00000000000..3ec667ec957 --- /dev/null +++ b/queue-4.10/drm-i915-let-execlist_update_context-cover-full_ppgtt-mode.patch @@ -0,0 +1,46 @@ +From 26d12c619476ccbc6725aa4a17dcb1d41d5774e7 Mon Sep 17 00:00:00 2001 +From: Zhi Wang +Date: Mon, 6 Feb 2017 18:37:16 +0800 +Subject: drm/i915: Let execlist_update_context() cover !FULL_PPGTT mode. + +From: Zhi Wang + +commit 26d12c619476ccbc6725aa4a17dcb1d41d5774e7 upstream. + +execlist_update_context() will try to update PDPs in a context before a +ELSP submission only for full PPGTT mode, while PDPs was populated during +context initialization. Now the latter code path is removed. Let +execlist_update_context() also cover !FULL_PPGTT mode. + +Fixes: 34869776c76b ("drm/i915: check ppgtt validity when init reg state") +Cc: Tvrtko Ursulin +Cc: Michal Winiarski +Cc: Michel Thierry +Cc: Joonas Lahtinen +Cc: Chris Wilson +Cc: Zhenyu Wang +Cc: Zhiyuan Lv +Signed-off-by: Zhi Wang +Link: http://patchwork.freedesktop.org/patch/msgid/1486377436-15380-1-git-send-email-zhi.a.wang@intel.com +Reviewed-by: Chris Wilson +Signed-off-by: Chris Wilson +(cherry picked from commit 04da811b3d821567e7a9a8a0baf48a6c1718b582) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_lrc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/intel_lrc.c ++++ b/drivers/gpu/drm/i915/intel_lrc.c +@@ -362,7 +362,8 @@ execlists_update_context_pdps(struct i91 + static u64 execlists_update_context(struct drm_i915_gem_request *rq) + { + struct intel_context *ce = &rq->ctx->engine[rq->engine->id]; +- struct i915_hw_ppgtt *ppgtt = rq->ctx->ppgtt; ++ struct i915_hw_ppgtt *ppgtt = ++ rq->ctx->ppgtt ?: rq->i915->mm.aliasing_ppgtt; + u32 *reg_state = ce->lrc_reg_state; + + reg_state[CTX_RING_TAIL+1] = rq->tail; diff --git a/queue-4.10/drm-i915-move-the-release-of-pt-page-to-the-upper-caller.patch b/queue-4.10/drm-i915-move-the-release-of-pt-page-to-the-upper-caller.patch new file mode 100644 index 00000000000..f4358db5123 --- /dev/null +++ b/queue-4.10/drm-i915-move-the-release-of-pt-page-to-the-upper-caller.patch @@ -0,0 +1,117 @@ +From a18dbba8f01ffae229d00517994f84e7bfad4c49 Mon Sep 17 00:00:00 2001 +From: Zhi Wang +Date: Tue, 29 Nov 2016 14:55:16 +0800 +Subject: drm/i915: Move the release of PT page to the upper caller +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Zhi Wang + +commit a18dbba8f01ffae229d00517994f84e7bfad4c49 upstream. + +a PT page will be released if it doesn't contain any meaningful mappings +during PPGTT page table shrinking. The PT entry in the upper level will +be set to a scratch entry. + +Normally this works nicely, but in virtualization world, the PPGTT page +table is tracked by hypervisor. Releasing the PT page before modifying +the upper level PT entry would cause extra efforts. + +As the tracked page has been returned to OS before losing track from +hypervisor, it could be written in any pattern. Hypervisor has to recognize +if a page is still being used as a PT page by validating these writing +patterns. It's complicated. Better let the guest modify the PT entry in +upper level PT first, then release the PT page. + +Reviewed-by: Chris Wilson +Reviewed-by: Michał Winiarski +Cc: Michał Winiarski +Cc: Michel Thierry +Cc: Joonas Lahtinen +Cc: Chris Wilson +Cc: Zhenyu Wang +Cc: Zhiyuan Lv +Signed-off-by: Zhi Wang +Link: https://patchwork.freedesktop.org/patch/122697/msgid/1479728666-25333-1-git-send-email-zhi.a.wang@intel.com +Signed-off-by: Chris Wilson +Link: http://patchwork.freedesktop.org/patch/msgid/1480402516-22275-1-git-send-email-zhi.a.wang@intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_gem_gtt.c | 18 +++++++----------- + 1 file changed, 7 insertions(+), 11 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_gem_gtt.c ++++ b/drivers/gpu/drm/i915/i915_gem_gtt.c +@@ -736,10 +736,8 @@ static bool gen8_ppgtt_clear_pt(struct i + + bitmap_clear(pt->used_ptes, pte, num_entries); + +- if (bitmap_empty(pt->used_ptes, GEN8_PTES)) { +- free_pt(to_i915(vm->dev), pt); ++ if (bitmap_empty(pt->used_ptes, GEN8_PTES)) + return true; +- } + + pt_vaddr = kmap_px(pt); + +@@ -775,13 +773,12 @@ static bool gen8_ppgtt_clear_pd(struct i + pde_vaddr = kmap_px(pd); + pde_vaddr[pde] = scratch_pde; + kunmap_px(ppgtt, pde_vaddr); ++ free_pt(to_i915(vm->dev), pt); + } + } + +- if (bitmap_empty(pd->used_pdes, I915_PDES)) { +- free_pd(to_i915(vm->dev), pd); ++ if (bitmap_empty(pd->used_pdes, I915_PDES)) + return true; +- } + + return false; + } +@@ -795,7 +792,6 @@ static bool gen8_ppgtt_clear_pdp(struct + uint64_t length) + { + struct i915_hw_ppgtt *ppgtt = i915_vm_to_ppgtt(vm); +- struct drm_i915_private *dev_priv = to_i915(vm->dev); + struct i915_page_directory *pd; + uint64_t pdpe; + gen8_ppgtt_pdpe_t *pdpe_vaddr; +@@ -813,16 +809,14 @@ static bool gen8_ppgtt_clear_pdp(struct + pdpe_vaddr[pdpe] = scratch_pdpe; + kunmap_px(ppgtt, pdpe_vaddr); + } ++ free_pd(to_i915(vm->dev), pd); + } + } + + mark_tlbs_dirty(ppgtt); + +- if (USES_FULL_48BIT_PPGTT(dev_priv) && +- bitmap_empty(pdp->used_pdpes, I915_PDPES_PER_PDP(dev_priv))) { +- free_pdp(dev_priv, pdp); ++ if (bitmap_empty(pdp->used_pdpes, I915_PDPES_PER_PDP(dev_priv))) + return true; +- } + + return false; + } +@@ -836,6 +830,7 @@ static void gen8_ppgtt_clear_pml4(struct + uint64_t start, + uint64_t length) + { ++ struct drm_i915_private *dev_priv = to_i915(vm->dev); + struct i915_hw_ppgtt *ppgtt = i915_vm_to_ppgtt(vm); + struct i915_page_directory_pointer *pdp; + uint64_t pml4e; +@@ -854,6 +849,7 @@ static void gen8_ppgtt_clear_pml4(struct + pml4e_vaddr = kmap_px(pml4); + pml4e_vaddr[pml4e] = scratch_pml4e; + kunmap_px(ppgtt, pml4e_vaddr); ++ free_pdp(dev_priv, pdp); + } + } + } diff --git a/queue-4.10/nvme-core-fix-race-kicking-freed-request_queue.patch b/queue-4.10/nvme-core-fix-race-kicking-freed-request_queue.patch new file mode 100644 index 00000000000..04994d4a13f --- /dev/null +++ b/queue-4.10/nvme-core-fix-race-kicking-freed-request_queue.patch @@ -0,0 +1,38 @@ +From f33447b90e96076483525b21cc4e0a8977cdd07c Mon Sep 17 00:00:00 2001 +From: Keith Busch +Date: Fri, 10 Feb 2017 18:15:51 -0500 +Subject: nvme/core: Fix race kicking freed request_queue + +From: Keith Busch + +commit f33447b90e96076483525b21cc4e0a8977cdd07c upstream. + +If a namespace has already been marked dead, we don't want to kick the +request_queue again since we may have just freed it from another thread. + +Signed-off-by: Keith Busch +Reviewed-by: Johannes Thumshirn +Reviewed-by: Christoph Hellwig +Signed-off-by: Sagi Grimberg +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/nvme/host/core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -2034,9 +2034,9 @@ void nvme_kill_queues(struct nvme_ctrl * + * Revalidating a dead namespace sets capacity to 0. This will + * end buffered writers dirtying pages that can't be synced. + */ +- if (ns->disk && !test_and_set_bit(NVME_NS_DEAD, &ns->flags)) +- revalidate_disk(ns->disk); +- ++ if (!ns->disk || test_and_set_bit(NVME_NS_DEAD, &ns->flags)) ++ continue; ++ revalidate_disk(ns->disk); + blk_set_queue_dying(ns->queue); + blk_mq_abort_requeue_list(ns->queue); + blk_mq_start_stopped_hw_queues(ns->queue, true); diff --git a/queue-4.10/nvme-pci-disable-on-removal-when-disconnected.patch b/queue-4.10/nvme-pci-disable-on-removal-when-disconnected.patch new file mode 100644 index 00000000000..0caa0f7a781 --- /dev/null +++ b/queue-4.10/nvme-pci-disable-on-removal-when-disconnected.patch @@ -0,0 +1,39 @@ +From 6db28eda266052f86a6b402422de61eeb7d2e351 Mon Sep 17 00:00:00 2001 +From: Keith Busch +Date: Fri, 10 Feb 2017 18:15:49 -0500 +Subject: nvme/pci: Disable on removal when disconnected + +From: Keith Busch + +commit 6db28eda266052f86a6b402422de61eeb7d2e351 upstream. + +If the device is not present, the driver should disable the queues +immediately. Prior to this, the driver was relying on the watchdog timer +to kill the queues if requests were outstanding to the device, and that +just delays removal up to one second. + +Signed-off-by: Keith Busch +Reviewed-by: Johannes Thumshirn +Reviewed-by: Christoph Hellwig +Signed-off-by: Sagi Grimberg +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/nvme/host/pci.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -1990,8 +1990,10 @@ static void nvme_remove(struct pci_dev * + + pci_set_drvdata(pdev, NULL); + +- if (!pci_device_is_present(pdev)) ++ if (!pci_device_is_present(pdev)) { + nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_DEAD); ++ nvme_dev_disable(dev, false); ++ } + + flush_work(&dev->reset_work); + nvme_uninit_ctrl(&dev->ctrl); diff --git a/queue-4.10/padata-avoid-race-in-reordering.patch b/queue-4.10/padata-avoid-race-in-reordering.patch new file mode 100644 index 00000000000..10e25b19b6a --- /dev/null +++ b/queue-4.10/padata-avoid-race-in-reordering.patch @@ -0,0 +1,96 @@ +From de5540d088fe97ad583cc7d396586437b32149a5 Mon Sep 17 00:00:00 2001 +From: "Jason A. Donenfeld" +Date: Thu, 23 Mar 2017 12:24:43 +0100 +Subject: padata: avoid race in reordering + +From: Jason A. Donenfeld + +commit de5540d088fe97ad583cc7d396586437b32149a5 upstream. + +Under extremely heavy uses of padata, crashes occur, and with list +debugging turned on, this happens instead: + +[87487.298728] WARNING: CPU: 1 PID: 882 at lib/list_debug.c:33 +__list_add+0xae/0x130 +[87487.301868] list_add corruption. prev->next should be next +(ffffb17abfc043d0), but was ffff8dba70872c80. (prev=ffff8dba70872b00). +[87487.339011] [] dump_stack+0x68/0xa3 +[87487.342198] [] ? console_unlock+0x281/0x6d0 +[87487.345364] [] __warn+0xff/0x140 +[87487.348513] [] warn_slowpath_fmt+0x4a/0x50 +[87487.351659] [] __list_add+0xae/0x130 +[87487.354772] [] ? _raw_spin_lock+0x64/0x70 +[87487.357915] [] padata_reorder+0x1e6/0x420 +[87487.361084] [] padata_do_serial+0xa5/0x120 + +padata_reorder calls list_add_tail with the list to which its adding +locked, which seems correct: + +spin_lock(&squeue->serial.lock); +list_add_tail(&padata->list, &squeue->serial.list); +spin_unlock(&squeue->serial.lock); + +This therefore leaves only place where such inconsistency could occur: +if padata->list is added at the same time on two different threads. +This pdata pointer comes from the function call to +padata_get_next(pd), which has in it the following block: + +next_queue = per_cpu_ptr(pd->pqueue, cpu); +padata = NULL; +reorder = &next_queue->reorder; +if (!list_empty(&reorder->list)) { + padata = list_entry(reorder->list.next, + struct padata_priv, list); + spin_lock(&reorder->lock); + list_del_init(&padata->list); + atomic_dec(&pd->reorder_objects); + spin_unlock(&reorder->lock); + + pd->processed++; + + goto out; +} +out: +return padata; + +I strongly suspect that the problem here is that two threads can race +on reorder list. Even though the deletion is locked, call to +list_entry is not locked, which means it's feasible that two threads +pick up the same padata object and subsequently call list_add_tail on +them at the same time. The fix is thus be hoist that lock outside of +that block. + +Signed-off-by: Jason A. Donenfeld +Acked-by: Steffen Klassert +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/padata.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/kernel/padata.c ++++ b/kernel/padata.c +@@ -186,19 +186,20 @@ static struct padata_priv *padata_get_ne + + reorder = &next_queue->reorder; + ++ spin_lock(&reorder->lock); + if (!list_empty(&reorder->list)) { + padata = list_entry(reorder->list.next, + struct padata_priv, list); + +- spin_lock(&reorder->lock); + list_del_init(&padata->list); + atomic_dec(&pd->reorder_objects); +- spin_unlock(&reorder->lock); + + pd->processed++; + ++ spin_unlock(&reorder->lock); + goto out; + } ++ spin_unlock(&reorder->lock); + + if (__this_cpu_read(pd->pqueue->cpu_index) == next_queue->cpu_index) { + padata = ERR_PTR(-ENODATA); diff --git a/queue-4.10/series b/queue-4.10/series index b2998180a45..92c7368d79c 100644 --- a/queue-4.10/series +++ b/queue-4.10/series @@ -73,3 +73,9 @@ arm-dts-bcm5301x-correct-gic_ppi-interrupt-flags.patch mips-lantiq-fix-cascaded-irq-setup.patch blk-improve-order-of-bio-handling-in-generic_make_request.patch blk-ensure-users-for-current-bio_list-can-see-the-full-list.patch +padata-avoid-race-in-reordering.patch +nvme-core-fix-race-kicking-freed-request_queue.patch +nvme-pci-disable-on-removal-when-disconnected.patch +drm-i915-move-the-release-of-pt-page-to-the-upper-caller.patch +drm-i915-let-execlist_update_context-cover-full_ppgtt-mode.patch +drm-i915-a-hotfix-for-making-aliasing-ppgtt-work-for-gvt-g.patch