Skip to content
This repository has been archived by the owner on Oct 5, 2018. It is now read-only.

Hikey: Mali 450 kernel driver support #23

Merged
merged 8 commits into from
Mar 13, 2015
Merged

Hikey: Mali 450 kernel driver support #23

merged 8 commits into from
Mar 13, 2015

Conversation

ldts
Copy link

@ldts ldts commented Mar 13, 2015

No description provided.

hzhuang1 and others added 8 commits March 13, 2015 17:11
This api is added by hisilicon.

Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>
Add ARM Mali Utgard driver from this release:

  DX910-SW-99002-r5p0-01rel0

This is a direct file drop from the public release archive
and it has not been tested on any hardware.

Signed-off-by: Guillaume Tucker <guillaume.tucker@arm.com>
* fix Kconfig so the driver can be built on ARM64 with Device
  Tree enabled

* remove "Compiled" message which causes build errors due to date
  and time which prevent reproducible binary builds

* add message with raw GPU version which is necessary during development

* fix minor indentation issue

Signed-off-by: Guillaume Tucker <guillaume.tucker@arm.com>
Some Mali 450 Utgard GPU platform integration files like
the HiKey need a custom Device Tree entry.  This config
option is to disable the standard driver code that expects
things in the device tree which conflict with what the
platform files need.

This is only an interim solution, tne platform files should
really be tidied-up to enable the standard device tree
instead (would require adding more IRQ and other resources).

Signed-off-by: Guillaume Tucker <guillaume.tucker@arm.com>
Add the Mali-450 GPU entry in the HI6220 device tree based on the 3.10
kernel.  Also fix the mtcmos1 and mtcmos2 entries so they match the
regulator drivers and actually get initialised and usable by the GPU
driver.

Signed-off-by: Guillaume Tucker <guillaume.tucker@arm.com>
Add mali_hikey_hi6220_registers_gpu.h with the list of Hi6220 SoC
registers that are needed to use the Mali Utgard GPU.

Signed-off-by: Guillaume Tucker <guillaume.tucker@arm.com>
Add Mali Utgard GPU driver platform files to support the
HiKey board (HI6220), based on the Balong platform.

Note: GPU DVFS is not implemented and a custom Device Tree
      entry is needed by these platform files.  This is a
      first working version that needs to be improved.

Signed-off-by: Guillaume Tucker <guillaume.tucker@arm.com>
This makes the ARM Mali Utgard GPU driver built as a loadable
module, with GPU DVFS disabled as it is not yet available.

Signed-off-by: Guillaume Tucker <guillaume.tucker@arm.com>
ldts added a commit that referenced this pull request Mar 13, 2015
Tested with the Debian snapshot #128 and the binary user-side drivers available at the public download page:
http://malideveloper.arm.com/develop-for-mali/features/mali-t6xx-gpu-user-space-drivers/
@ldts ldts merged commit 31916f9 into 96boards:hikey-mali Mar 13, 2015
@ldts ldts changed the title Hikey mali Hikey: Mali 450 kernel driver support Mar 13, 2015
johnstultz-work pushed a commit that referenced this pull request Jan 5, 2016
commit ecf5fc6 upstream.

Nikolay has reported a hang when a memcg reclaim got stuck with the
following backtrace:

PID: 18308  TASK: ffff883d7c9b0a30  CPU: 1   COMMAND: "rsync"
  #0 __schedule at ffffffff815ab152
  #1 schedule at ffffffff815ab76e
  #2 schedule_timeout at ffffffff815ae5e5
  #3 io_schedule_timeout at ffffffff815aad6a
  #4 bit_wait_io at ffffffff815abfc6
  #5 __wait_on_bit at ffffffff815abda5
  #6 wait_on_page_bit at ffffffff8111fd4f
  #7 shrink_page_list at ffffffff81135445
  #8 shrink_inactive_list at ffffffff81135845
  #9 shrink_lruvec at ffffffff81135ead
 #10 shrink_zone at ffffffff811360c3
 #11 shrink_zones at ffffffff81136eff
 #12 do_try_to_free_pages at ffffffff8113712f
 #13 try_to_free_mem_cgroup_pages at ffffffff811372be
 #14 try_charge at ffffffff81189423
 #15 mem_cgroup_try_charge at ffffffff8118c6f5
 #16 __add_to_page_cache_locked at ffffffff8112137d
 #17 add_to_page_cache_lru at ffffffff81121618
 #18 pagecache_get_page at ffffffff8112170b
 #19 grow_dev_page at ffffffff811c8297
 #20 __getblk_slow at ffffffff811c91d6
 #21 __getblk_gfp at ffffffff811c92c1
 #22 ext4_ext_grow_indepth at ffffffff8124565c
 #23 ext4_ext_create_new_leaf at ffffffff81246ca8
 #24 ext4_ext_insert_extent at ffffffff81246f09
 #25 ext4_ext_map_blocks at ffffffff8124a848
 #26 ext4_map_blocks at ffffffff8121a5b7
 #27 mpage_map_one_extent at ffffffff8121b1fa
 #28 mpage_map_and_submit_extent at ffffffff8121f07b
 #29 ext4_writepages at ffffffff8121f6d5
 #30 do_writepages at ffffffff8112c490
 #31 __filemap_fdatawrite_range at ffffffff81120199
 #32 filemap_flush at ffffffff8112041c
 #33 ext4_alloc_da_blocks at ffffffff81219da1
 #34 ext4_rename at ffffffff81229b91
 #35 ext4_rename2 at ffffffff81229e32
 #36 vfs_rename at ffffffff811a08a5
 #37 SYSC_renameat2 at ffffffff811a3ffc
 #38 sys_renameat2 at ffffffff811a408e
 #39 sys_rename at ffffffff8119e51e
 #40 system_call_fastpath at ffffffff815afa89

Dave Chinner has properly pointed out that this is a deadlock in the
reclaim code because ext4 doesn't submit pages which are marked by
PG_writeback right away.

The heuristic was introduced by commit e62e384 ("memcg: prevent OOM
with too many dirty pages") and it was applied only when may_enter_fs
was specified.  The code has been changed by c3b94f4 ("memcg:
further prevent OOM with too many dirty pages") which has removed the
__GFP_FS restriction with a reasoning that we do not get into the fs
code.  But this is not sufficient apparently because the fs doesn't
necessarily submit pages marked PG_writeback for IO right away.

ext4_bio_write_page calls io_submit_add_bh but that doesn't necessarily
submit the bio.  Instead it tries to map more pages into the bio and
mpage_map_one_extent might trigger memcg charge which might end up
waiting on a page which is marked PG_writeback but hasn't been submitted
yet so we would end up waiting for something that never finishes.

Fix this issue by replacing __GFP_IO by may_enter_fs check (for case 2)
before we go to wait on the writeback.  The page fault path, which is
the only path that triggers memcg oom killer since 3.12, shouldn't
require GFP_NOFS and so we shouldn't reintroduce the premature OOM
killer issue which was originally addressed by the heuristic.

As per David Chinner the xfs is doing similar thing since 2.6.15 already
so ext4 is not the only affected filesystem.  Moreover he notes:

: For example: IO completion might require unwritten extent conversion
: which executes filesystem transactions and GFP_NOFS allocations. The
: writeback flag on the pages can not be cleared until unwritten
: extent conversion completes. Hence memory reclaim cannot wait on
: page writeback to complete in GFP_NOFS context because it is not
: safe to do so, memcg reclaim or otherwise.

Cc: stable@vger.kernel.org # 3.9+
[tytso@mit.edu: corrected the control flow]
Fixes: c3b94f4 ("memcg: further prevent OOM with too many dirty pages")
Reported-by: Nikolay Borisov <kernel@kyup.com>
Signed-off-by: Michal Hocko <mhocko@suse.cz>
Signed-off-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
nyadla-sys pushed a commit to nyadla-sys/linux that referenced this pull request Apr 24, 2017
[ Upstream commit 45caeaa ]

As Eric Dumazet pointed out this also needs to be fixed in IPv6.
v2: Contains the IPv6 tcp/Ipv6 dccp patches as well.

We have seen a few incidents lately where a dst_enty has been freed
with a dangling TCP socket reference (sk->sk_dst_cache) pointing to that
dst_entry. If the conditions/timings are right a crash then ensues when the
freed dst_entry is referenced later on. A Common crashing back trace is:

 96boards#8 [] page_fault at ffffffff8163e648
    [exception RIP: __tcp_ack_snd_check+74]
.
.
 96boards#9 [] tcp_rcv_established at ffffffff81580b64
96boards#10 [] tcp_v4_do_rcv at ffffffff8158b54a
96boards#11 [] tcp_v4_rcv at ffffffff8158cd02
96boards#12 [] ip_local_deliver_finish at ffffffff815668f4
96boards#13 [] ip_local_deliver at ffffffff81566bd9
96boards#14 [] ip_rcv_finish at ffffffff8156656d
96boards#15 [] ip_rcv at ffffffff81566f06
#16 [] __netif_receive_skb_core at ffffffff8152b3a2
#17 [] __netif_receive_skb at ffffffff8152b608
#18 [] netif_receive_skb at ffffffff8152b690
#19 [] vmxnet3_rq_rx_complete at ffffffffa015eeaf [vmxnet3]
#20 [] vmxnet3_poll_rx_only at ffffffffa015f32a [vmxnet3]
96boards#21 [] net_rx_action at ffffffff8152bac2
96boards#22 [] __do_softirq at ffffffff81084b4f
96boards#23 [] call_softirq at ffffffff8164845c
96boards#24 [] do_softirq at ffffffff81016fc5
96boards#25 [] irq_exit at ffffffff81084ee5
96boards#26 [] do_IRQ at ffffffff81648ff8

Of course it may happen with other NIC drivers as well.

It's found the freed dst_entry here:

 224 static bool tcp_in_quickack_mode(struct sock *sk)↩
 225 {↩
 226 ▹       const struct inet_connection_sock *icsk = inet_csk(sk);↩
 227 ▹       const struct dst_entry *dst = __sk_dst_get(sk);↩
 228 ↩
 229 ▹       return (dst && dst_metric(dst, RTAX_QUICKACK)) ||↩
 230 ▹       ▹       (icsk->icsk_ack.quick && !icsk->icsk_ack.pingpong);↩
 231 }↩

But there are other backtraces attributed to the same freed dst_entry in
netfilter code as well.

All the vmcores showed 2 significant clues:

- Remote hosts behind the default gateway had always been redirected to a
different gateway. A rtable/dst_entry will be added for that host. Making
more dst_entrys with lower reference counts. Making this more probable.

- All vmcores showed a postitive LockDroppedIcmps value, e.g:

LockDroppedIcmps                  267

A closer look at the tcp_v4_err() handler revealed that do_redirect() will run
regardless of whether user space has the socket locked. This can result in a
race condition where the same dst_entry cached in sk->sk_dst_entry can be
decremented twice for the same socket via:

do_redirect()->__sk_dst_check()-> dst_release().

Which leads to the dst_entry being prematurely freed with another socket
pointing to it via sk->sk_dst_cache and a subsequent crash.

To fix this skip do_redirect() if usespace has the socket locked. Instead let
the redirect take place later when user space does not have the socket
locked.

The dccp/IPv6 code is very similar in this respect, so fixing it there too.

As Eric Garver pointed out the following commit now invalidates routes. Which
can set the dst->obsolete flag so that ipv4_dst_check() returns null and
triggers the dst_release().

Fixes: ceb3320 ("ipv4: Kill routes during PMTU/redirect updates.")
Cc: Eric Garver <egarver@redhat.com>
Cc: Hannes Sowa <hsowa@redhat.com>
Signed-off-by: Jon Maxwell <jmaxwell37@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants