1. 04 Oct, 2012 2 commits
    • Anton Blanchard's avatar
      powerpc/iommu: Fix multiple issues with IOMMU pools code · d900bd73
      Anton Blanchard authored
      There are a number of issues in the recent IOMMU pools code:
      
      - On a preempt kernel we might switch CPUs in the middle of building
        a scatter gather list. When this happens the handle hint passed in
        no longer falls within the local CPU's pool. Check for this and
        fall back to the pool hint.
      
      - We were missing a spin_unlock/spin_lock in one spot where we
        switch pools.
      
      - We need to provide locking around dart_tlb_invalidate_all and
        dart_tlb_invalidate_one now that the global lock is gone.
      Reported-by: default avatarAlexander Graf <agraf@suse.de>
      Signed-off-by: default avatarAnton Blanchard <anton@samba.org>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      CC: <stable@kernel.org> [v3.6]
      d900bd73
    • Nishanth Aravamudan's avatar
      powerpc: Fix VMX fix for memcpy case · c8adfecc
      Nishanth Aravamudan authored
      In 2fae7cdb ("powerpc: Fix VMX in
      interrupt check in POWER7 copy loops"), Anton inadvertently
      introduced a regression for memcpy on POWER7 machines. copyuser and
      memcpy diverge slightly in their use of cr1 (copyuser doesn't use it,
      but memcpy does) and you end up clobbering that register with your fix.
      That results in (taken from an FC18 kernel):
      
      [   18.824604] Unrecoverable VMX/Altivec Unavailable Exception f20 at c000000000052f40
      [   18.824618] Oops: Unrecoverable VMX/Altivec Unavailable Exception, sig: 6 [#1]
      [   18.824623] SMP NR_CPUS=1024 NUMA pSeries
      [   18.824633] Modules linked in: tg3(+) be2net(+) cxgb4(+) ipr(+) sunrpc xts lrw gf128mul dm_crypt dm_round_robin dm_multipath linear raid10 raid456 async_raid6_recov async_memcpy async_pq raid6_pq async_xor xor async_tx raid1 raid0 scsi_dh_rdac scsi_dh_hp_sw scsi_dh_emc scsi_dh_alua squashfs cramfs
      [   18.824705] NIP: c000000000052f40 LR: c00000000020b874 CTR: 0000000000000512
      [   18.824709] REGS: c000001f1fef7790 TRAP: 0f20   Not tainted  (3.6.0-0.rc6.git0.2.fc18.ppc64)
      [   18.824713] MSR: 8000000000009032 <SF,EE,ME,IR,DR,RI>  CR: 4802802e  XER: 20000010
      [   18.824726] SOFTE: 0
      [   18.824728] CFAR: 0000000000000f20
      [   18.824731] TASK = c000000fa7128400[0] 'swapper/24' THREAD: c000000fa7480000 CPU: 24
      GPR00: 00000000ffffffc0 c000001f1fef7a10 c00000000164edc0 c000000f9b9a8120
      GPR04: c000000f9b9a8124 0000000000001438 0000000000000060 03ffffff064657ee
      GPR08: 0000000080000000 0000000000000010 0000000000000020 0000000000000030
      GPR12: 0000000028028022 c00000000ff25400 0000000000000001 0000000000000000
      GPR16: 0000000000000000 7fffffffffffffff c0000000016b2180 c00000000156a500
      GPR20: c000000f968c7a90 c0000000131c31d8 c000001f1fef4000 c000000001561d00
      GPR24: 000000000000000a 0000000000000000 0000000000000001 0000000000000012
      GPR28: c000000fa5c04f80 00000000000008bc c0000000015c0a28 000000000000022e
      [   18.824792] NIP [c000000000052f40] .memcpy_power7+0x5a0/0x7c4
      [   18.824797] LR [c00000000020b874] .pcpu_free_area+0x174/0x2d0
      [   18.824800] Call Trace:
      [   18.824803] [c000001f1fef7a10] [c000000000052c14] .memcpy_power7+0x274/0x7c4 (unreliable)
      [   18.824809] [c000001f1fef7b10] [c00000000020b874] .pcpu_free_area+0x174/0x2d0
      [   18.824813] [c000001f1fef7bb0] [c00000000020ba88] .free_percpu+0xb8/0x1b0
      [   18.824819] [c000001f1fef7c50] [c00000000043d144] .throtl_pd_exit+0x94/0xd0
      [   18.824824] [c000001f1fef7cf0] [c00000000043acf8] .blkg_free+0x88/0xe0
      [   18.824829] [c000001f1fef7d90] [c00000000018c048] .rcu_process_callbacks+0x2e8/0x8a0
      [   18.824835] [c000001f1fef7e90] [c0000000000a8ce8] .__do_softirq+0x158/0x4d0
      [   18.824840] [c000001f1fef7f90] [c000000000025ecc] .call_do_softirq+0x14/0x24
      [   18.824845] [c000000fa7483650] [c000000000010e80] .do_softirq+0x160/0x1a0
      [   18.824850] [c000000fa74836f0] [c0000000000a94a4] .irq_exit+0xf4/0x120
      [   18.824854] [c000000fa7483780] [c000000000020c44] .timer_interrupt+0x154/0x4d0
      [   18.824859] [c000000fa7483830] [c000000000003be0] decrementer_common+0x160/0x180
      [   18.824866] --- Exception: 901 at .plpar_hcall_norets+0x84/0xd4
      [   18.824866]     LR = .check_and_cede_processor+0x48/0x80
      [   18.824871] [c000000fa7483b20] [c00000000007f018] .check_and_cede_processor+0x18/0x80 (unreliable)
      [   18.824877] [c000000fa7483b90] [c00000000007f104] .dedicated_cede_loop+0x84/0x150
      [   18.824883] [c000000fa7483c50] [c0000000006bc030] .cpuidle_enter+0x30/0x50
      [   18.824887] [c000000fa7483cc0] [c0000000006bc9f4] .cpuidle_idle_call+0x104/0x720
      [   18.824892] [c000000fa7483d80] [c000000000070af8] .pSeries_idle+0x18/0x40
      [   18.824897] [c000000fa7483df0] [c000000000019084] .cpu_idle+0x1a4/0x380
      [   18.824902] [c000000fa7483ec0] [c0000000008a4c18] .start_secondary+0x520/0x528
      [   18.824907] [c000000fa7483f90] [c0000000000093f0] .start_secondary_prolog+0x10/0x14
      [   18.824911] Instruction dump:
      [   18.824914] 38840008 90030000 90e30004 38630008 7ca62850 7cc300d0 78c7e102 7cf01120
      [   18.824923] 78c60660 39200010 39400020 39600030 <7e00200c> 7c0020ce 38840010 409f001c
      [   18.824935] ---[ end trace 0bb95124affaaa45 ]---
      [   18.825046] Unrecoverable VMX/Altivec Unavailable Exception f20 at c000000000052d08
      
      I believe the right fix is to make memcpy match usercopy and not use
      cr1.
      Signed-off-by: default avatarNishanth Aravamudan <nacc@us.ibm.com>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      CC: <stable@kernel.org> [v3.6]
      c8adfecc
  2. 27 Sep, 2012 8 commits
  3. 19 Sep, 2012 4 commits
  4. 18 Sep, 2012 11 commits
    • Benjamin Herrenschmidt's avatar
    • Gavin Shan's avatar
      powerpc/eeh: Fix crash on converting OF node to edev · 1e38b714
      Gavin Shan authored
      The kernel crash was reported by Alexy. He was testing some feature
      with private kernel, in which Alexy added some code in pci_pm_reset()
      to read the CSR after writting it. The bug could be reproduced on
      Fiber Channel card (Fibre Channel: Emulex Corporation Saturn-X:
      LightPulse Fibre Channel Host Adapter (rev 03)) by the following
      commands.
      
      	# echo 1 > /sys/devices/pci0004:01/0004:01:00.0/reset
      	# rmmod lpfc
      	# modprobe lpfc
      
      The history behind the test case is that those additional config
      space reading operations in pci_pm_reset() would cause EEH error,
      but we didn't detect EEH error until "modprobe lpfc". For the case,
      all the PCI devices on PCI bus (0004:01) were removed and added after
      PE reset. Then the EEH devices would be figured out again based on
      the OF nodes. Unfortunately, there were some child OF nodes under
      PCI device (0004:01:00.0), but they didn't have attached PCI_DN since
      they're invisible from PCI domain. However, we were still trying to
      convert OF node to EEH device without checking on the attached PCI_DN.
      Eventually, it caused the kernel crash as follows:
      
      Unable to handle kernel paging request for data at address 0x00000030
      Faulting instruction address: 0xc00000000004d888
      cpu 0x0: Vector: 300 (Data Access) at [c000000fc797b950]
          pc: c00000000004d888: .eeh_add_device_tree_early+0x78/0x140
          lr: c00000000004d880: .eeh_add_device_tree_early+0x70/0x140
          sp: c000000fc797bbd0
         msr: 8000000000009032
         dar: 30
       dsisr: 40000000
        current = 0xc000000fc78d9f70
        paca    = 0xc00000000edb0000   softe: 0        irq_happened: 0x00
          pid   = 2951, comm = eehd
      enter ? for help
      [c000000fc797bc50] c00000000004d848 .eeh_add_device_tree_early+0x38/0x140
      [c000000fc797bcd0] c00000000004d848 .eeh_add_device_tree_early+0x38/0x140
      [c000000fc797bd50] c000000000051b54 .pcibios_add_pci_devices+0x34/0x190
      [c000000fc797bde0] c00000000004fb10 .eeh_reset_device+0x100/0x160
      [c000000fc797be70] c0000000000502dc .eeh_handle_event+0x19c/0x300
      [c000000fc797bf00] c000000000050570 .eeh_event_handler+0x130/0x1a0
      [c000000fc797bf90] c000000000020138 .kernel_thread+0x54/0x70
      
      The patch changes of_node_to_eeh_dev() and just returns NULL if the
      passed OF node doesn't have attached PCI_DN.
      
      Cc: stable@vger.kernel.org
      Reported-by: default avatarAlexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: default avatarGavin Shan <shangw@linux.vnet.ibm.com>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      1e38b714
    • Gavin Shan's avatar
      powerpc/eeh: Lock module while handling EEH event · feadf7c0
      Gavin Shan authored
      The EEH core is talking with the PCI device driver to determine the
      action (purely reset, or PCI device removal). During the period, the
      driver might be unloaded and in turn causes kernel crash as follows:
      
      EEH: Detected PCI bus error on PHB#4-PE#10000
      EEH: This PCI device has failed 3 times in the last hour
      lpfc 0004:01:00.0: 0:2710 PCI channel disable preparing for reset
      Unable to handle kernel paging request for data at address 0x00000490
      Faulting instruction address: 0xd00000000e682c90
      cpu 0x1: Vector: 300 (Data Access) at [c000000fc75ffa20]
          pc: d00000000e682c90: .lpfc_io_error_detected+0x30/0x240 [lpfc]
          lr: d00000000e682c8c: .lpfc_io_error_detected+0x2c/0x240 [lpfc]
          sp: c000000fc75ffca0
         msr: 8000000000009032
         dar: 490
       dsisr: 40000000
        current = 0xc000000fc79b88b0
        paca    = 0xc00000000edb0380	 softe: 0	 irq_happened: 0x00
          pid   = 3386, comm = eehd
      enter ? for help
      [c000000fc75ffca0] c000000fc75ffd30 (unreliable)
      [c000000fc75ffd30] c00000000004fd3c .eeh_report_error+0x7c/0xf0
      [c000000fc75ffdc0] c00000000004ee00 .eeh_pe_dev_traverse+0xa0/0x180
      [c000000fc75ffe70] c00000000004ffd8 .eeh_handle_event+0x68/0x300
      [c000000fc75fff00] c0000000000503a0 .eeh_event_handler+0x130/0x1a0
      [c000000fc75fff90] c000000000020138 .kernel_thread+0x54/0x70
      1:mon>
      
      The patch increases the reference of the corresponding driver modules
      while EEH core does the negotiation with PCI device driver so that the
      corresponding driver modules can't be unloaded during the period and
      we're safe to refer the callbacks.
      
      Cc: stable@vger.kernel.org
      Reported-by: default avatarAlexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: default avatarGavin Shan <shangw@linux.vnet.ibm.com>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      feadf7c0
    • Tiejun Chen's avatar
      powerpc/kprobe: Don't emulate store when kprobe stwu r1 · 8e9f6937
      Tiejun Chen authored
      We don't do the real store operation for kprobing 'stwu Rx,(y)R1'
      since this may corrupt the exception frame, now we will do this
      operation safely in exception return code after migrate current
      exception frame below the kprobed function stack.
      
      So we only update gpr[1] here and trigger a thread flag to mask
      this.
      
      Note we should make sure if we trigger kernel stack over flow.
      Signed-off-by: default avatarTiejun Chen <tiejun.chen@windriver.com>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      8e9f6937
    • Tiejun Chen's avatar
      powerpc/kprobe: Complete kprobe and migrate exception frame · a9c4e541
      Tiejun Chen authored
      We can't emulate stwu since that may corrupt current exception stack.
      So we will have to do real store operation in the exception return code.
      
      Firstly we'll allocate a trampoline exception frame below the kprobed
      function stack and copy the current exception frame to the trampoline.
      Then we can do this real store operation to implement 'stwu', and reroute
      the trampoline frame to r1 to complete this exception migration.
      Signed-off-by: default avatarTiejun Chen <tiejun.chen@windriver.com>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      a9c4e541
    • Tiejun Chen's avatar
      powerpc/kprobe: Introduce a new thread flag · f0d1128f
      Tiejun Chen authored
      We need to add a new thread flag, TIF_EMULATE_STACK_STORE,
      for emulating stack store operation while exiting exception.
      Signed-off-by: default avatarTiejun Chen <tiejun.chen@windriver.com>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      f0d1128f
    • Bharat Bhushan's avatar
      powerpc: Remove unused __get_user64() and __put_user64() · 52ab3b2b
      Bharat Bhushan authored
      __get_user64()  and __put_user64() are not used.
      Signed-off-by: default avatarBharat Bhushan <bharat.bhushan@freescale.com>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      52ab3b2b
    • Gavin Shan's avatar
      powerpc/eeh: Global mutex to protect PE tree · ea81245c
      Gavin Shan authored
      We have missed lots of situations where the PE hierarchy tree need
      protection through the EEH global mutex. The patch fixes that for
      those public APIs implemented in eeh_pe.c. The only exception is
      eeh_pe_restore_bars() because it calls eeh_pe_dev_traverse(), which
      has been protected by the mutex.
      Signed-off-by: default avatarGavin Shan <shangw@linux.vnet.ibm.com>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      ea81245c
    • Gavin Shan's avatar
      powerpc/eeh: Remove EEH PE for normal PCI hotplug · 20ee6a97
      Gavin Shan authored
      Function eeh_rmv_from_parent_pe() could be called by the path of
      either normal PCI hotplug, or EEH recovery. For the former case,
      we need purge the corresponding PE on removal of the associated
      PE bus.
      
      The patch tries to cover that by passing more information to function
      pcibios_remove_pci_devices() so that we know if the corresponding PE
      needs to be purged or be marked as "invalid".
      Signed-off-by: default avatarGavin Shan <shangw@linux.vnet.ibm.com>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      20ee6a97
    • Gavin Shan's avatar
      powerpc/eeh: Introduce EEH_PE_INVALID type PE · 5efc3ad7
      Gavin Shan authored
      When EEH error happens on the PE whose PCI devices don't have
      attached drivers. In function eeh_handle_event(), the default
      value PCI_ERS_RESULT_NONE will be returned after iterating all
      drivers of those PCI devices belonging to the PE. Actually, we
      don't have installed drivers for the PCI devices. Under the
      circumstance, we will remove the corresponding PCI bus of the PE,
      including the associated EEH devices and PE instance. However,
      we still need the information stored in the PE instance to do PE
      reset after that. So it's unsafe to free the PE instance.
      
      The patch introduces EEH_PE_INVALID type PE to address the issue.
      When the PCI bus and the corresponding attached EEH devices are
      removed, we will mark the PE as EEH_PE_INVALID. At later point,
      the PE will be changed to EEH_PE_DEVICE or EEH_PE_BUS when the
      corresponding EEH devices are attached again.
      Signed-off-by: default avatarGavin Shan <shangw@linux.vnet.ibm.com>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      5efc3ad7
    • Michael Ellerman's avatar
      powerpc: Add an xmon command to dump one or all pacas · ddadb6b8
      Michael Ellerman authored
      This was originally motivated by a desire to see the mapping between
      logical and hardware cpu numbers.
      
      But it seemed that it made more sense to just add a command to dump
      (most of) the paca.
      
      With no arguments "dp" will dump the paca for the current cpu.
      
      It also takes an argument, eg. "dp 3" which is the logical cpu number
      in hex. This form does not check if the cpu is possible, but displays
      the paca regardless, as well as the cpu's state in the possible, present
      and online masks.
      
      Thirdly, "dpa" will display the paca for all possible cpus. If there are
      no possible cpus, like early in boot, it will tell you that.
      
      Sample output, number in brackets is the offset into the struct:
      
      2:mon> dp 3
      paca for cpu 0x3 @ c00000000ff20a80:
       possible         = yes
       present          = yes
       online           = yes
       lock_token       = 0x8000            	(0x8)
       paca_index       = 0x3               	(0xa)
       kernel_toc       = 0xc00000000144f990	(0x10)
       kernelbase       = 0xc000000000000000	(0x18)
       kernel_msr       = 0xb000000000001032	(0x20)
       stab_real        = 0x0               	(0x28)
       stab_addr        = 0x0               	(0x30)
       emergency_sp     = 0xc00000003ffe4000	(0x38)
       data_offset      = 0xa40000          	(0x40)
       hw_cpu_id        = 0x9               	(0x50)
       cpu_start        = 0x1               	(0x52)
       kexec_state      = 0x0               	(0x53)
       __current        = 0xc00000007e568680	(0x218)
       kstack           = 0xc00000007e5a3e30	(0x220)
       stab_rr          = 0x1a              	(0x228)
       saved_r1         = 0xc00000007e7cb450	(0x230)
       trap_save        = 0x0               	(0x240)
       soft_enabled     = 0x0               	(0x242)
       irq_happened     = 0x0               	(0x243)
       io_sync          = 0x0               	(0x244)
       irq_work_pending = 0x0               	(0x245)
       nap_state_lost   = 0x0               	(0x246)
      Signed-off-by: default avatarMichael Ellerman <michael@ellerman.id.au>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      ddadb6b8
  5. 17 Sep, 2012 15 commits