<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/kernel/time, branch v3.10.78</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>ntp: Fixup adjtimex freq validation on 32-bit systems</title>
<updated>2015-03-06T22:40:52+00:00</updated>
<author>
<name>John Stultz</name>
<email>john.stultz@linaro.org</email>
</author>
<published>2015-02-10T07:30:36+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=72e2d609260a5a7515d4c9d2d709759fc282e552'/>
<id>72e2d609260a5a7515d4c9d2d709759fc282e552</id>
<content type='text'>
commit 29183a70b0b828500816bd794b3fe192fce89f73 upstream.

Additional validation of adjtimex freq values to avoid
potential multiplication overflows were added in commit
5e5aeb4367b (time: adjtimex: Validate the ADJ_FREQUENCY values)

Unfortunately the patch used LONG_MAX/MIN instead of
LLONG_MAX/MIN, which was fine on 64-bit systems, but being
much smaller on 32-bit systems caused false positives
resulting in most direct frequency adjustments to fail w/
EINVAL.

ntpd only does direct frequency adjustments at startup, so
the issue was not as easily observed there, but other time
sync applications like ptpd and chrony were more effected by
the bug.

See bugs:

  https://bugzilla.kernel.org/show_bug.cgi?id=92481
  https://bugzilla.redhat.com/show_bug.cgi?id=1188074

This patch changes the checks to use LLONG_MAX for
clarity, and additionally the checks are disabled
on 32-bit systems since LLONG_MAX/PPM_SCALE is always
larger then the 32-bit long freq value, so multiplication
overflows aren't possible there.

Reported-by: Josh Boyer &lt;jwboyer@fedoraproject.org&gt;
Reported-by: George Joseph &lt;george.joseph@fairview5.com&gt;
Tested-by: George Joseph &lt;george.joseph@fairview5.com&gt;
Signed-off-by: John Stultz &lt;john.stultz@linaro.org&gt;
Signed-off-by: Peter Zijlstra (Intel) &lt;peterz@infradead.org&gt;
Cc: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
Cc: Sasha Levin &lt;sasha.levin@oracle.com&gt;
Link: http://lkml.kernel.org/r/1423553436-29747-1-git-send-email-john.stultz@linaro.org
[ Prettified the changelog and the comments a bit. ]
Signed-off-by: Ingo Molnar &lt;mingo@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 29183a70b0b828500816bd794b3fe192fce89f73 upstream.

Additional validation of adjtimex freq values to avoid
potential multiplication overflows were added in commit
5e5aeb4367b (time: adjtimex: Validate the ADJ_FREQUENCY values)

Unfortunately the patch used LONG_MAX/MIN instead of
LLONG_MAX/MIN, which was fine on 64-bit systems, but being
much smaller on 32-bit systems caused false positives
resulting in most direct frequency adjustments to fail w/
EINVAL.

ntpd only does direct frequency adjustments at startup, so
the issue was not as easily observed there, but other time
sync applications like ptpd and chrony were more effected by
the bug.

See bugs:

  https://bugzilla.kernel.org/show_bug.cgi?id=92481
  https://bugzilla.redhat.com/show_bug.cgi?id=1188074

This patch changes the checks to use LLONG_MAX for
clarity, and additionally the checks are disabled
on 32-bit systems since LLONG_MAX/PPM_SCALE is always
larger then the 32-bit long freq value, so multiplication
overflows aren't possible there.

Reported-by: Josh Boyer &lt;jwboyer@fedoraproject.org&gt;
Reported-by: George Joseph &lt;george.joseph@fairview5.com&gt;
Tested-by: George Joseph &lt;george.joseph@fairview5.com&gt;
Signed-off-by: John Stultz &lt;john.stultz@linaro.org&gt;
Signed-off-by: Peter Zijlstra (Intel) &lt;peterz@infradead.org&gt;
Cc: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
Cc: Sasha Levin &lt;sasha.levin@oracle.com&gt;
Link: http://lkml.kernel.org/r/1423553436-29747-1-git-send-email-john.stultz@linaro.org
[ Prettified the changelog and the comments a bit. ]
Signed-off-by: Ingo Molnar &lt;mingo@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>time: adjtimex: Validate the ADJ_FREQUENCY values</title>
<updated>2015-01-30T01:40:56+00:00</updated>
<author>
<name>Sasha Levin</name>
<email>sasha.levin@oracle.com</email>
</author>
<published>2014-12-04T00:25:05+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=2497402c9ad62e91897fed5310f7df48bf3bca1f'/>
<id>2497402c9ad62e91897fed5310f7df48bf3bca1f</id>
<content type='text'>
commit 5e5aeb4367b450a28f447f6d5ab57d8f2ab16a5f upstream.

Verify that the frequency value from userspace is valid and makes sense.

Unverified values can cause overflows later on.

Cc: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Cc: Ingo Molnar &lt;mingo@kernel.org&gt;
Signed-off-by: Sasha Levin &lt;sasha.levin@oracle.com&gt;
[jstultz: Fix up bug for negative values and drop redunent cap check]
Signed-off-by: John Stultz &lt;john.stultz@linaro.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 5e5aeb4367b450a28f447f6d5ab57d8f2ab16a5f upstream.

Verify that the frequency value from userspace is valid and makes sense.

Unverified values can cause overflows later on.

Cc: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Cc: Ingo Molnar &lt;mingo@kernel.org&gt;
Signed-off-by: Sasha Levin &lt;sasha.levin@oracle.com&gt;
[jstultz: Fix up bug for negative values and drop redunent cap check]
Signed-off-by: John Stultz &lt;john.stultz@linaro.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>alarmtimer: Lock k_itimer during timer callback</title>
<updated>2014-10-05T21:54:14+00:00</updated>
<author>
<name>Richard Larocque</name>
<email>rlarocque@google.com</email>
</author>
<published>2014-09-10T01:31:05+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=3c47864204b4df3e0d506c5a53cc7f1111467411'/>
<id>3c47864204b4df3e0d506c5a53cc7f1111467411</id>
<content type='text'>
commit 474e941bed9262f5fa2394f9a4a67e24499e5926 upstream.

Locks the k_itimer's it_lock member when handling the alarm timer's
expiry callback.

The regular posix timers defined in posix-timers.c have this lock held
during timout processing because their callbacks are routed through
posix_timer_fn().  The alarm timers follow a different path, so they
ought to grab the lock somewhere else.

Cc: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Cc: Ingo Molnar &lt;mingo@kernel.org&gt;
Cc: Richard Cochran &lt;richardcochran@gmail.com&gt;
Cc: Prarit Bhargava &lt;prarit@redhat.com&gt;
Cc: Sharvil Nanavati &lt;sharvil@google.com&gt;
Signed-off-by: Richard Larocque &lt;rlarocque@google.com&gt;
Signed-off-by: John Stultz &lt;john.stultz@linaro.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 474e941bed9262f5fa2394f9a4a67e24499e5926 upstream.

Locks the k_itimer's it_lock member when handling the alarm timer's
expiry callback.

The regular posix timers defined in posix-timers.c have this lock held
during timout processing because their callbacks are routed through
posix_timer_fn().  The alarm timers follow a different path, so they
ought to grab the lock somewhere else.

Cc: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Cc: Ingo Molnar &lt;mingo@kernel.org&gt;
Cc: Richard Cochran &lt;richardcochran@gmail.com&gt;
Cc: Prarit Bhargava &lt;prarit@redhat.com&gt;
Cc: Sharvil Nanavati &lt;sharvil@google.com&gt;
Signed-off-by: Richard Larocque &lt;rlarocque@google.com&gt;
Signed-off-by: John Stultz &lt;john.stultz@linaro.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>alarmtimer: Do not signal SIGEV_NONE timers</title>
<updated>2014-10-05T21:54:14+00:00</updated>
<author>
<name>Richard Larocque</name>
<email>rlarocque@google.com</email>
</author>
<published>2014-09-10T01:31:04+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=5cebda5d05729708008637b3161076beb5855a71'/>
<id>5cebda5d05729708008637b3161076beb5855a71</id>
<content type='text'>
commit 265b81d23a46c39df0a735a3af4238954b41a4c2 upstream.

Avoids sending a signal to alarm timers created with sigev_notify set to
SIGEV_NONE by checking for that special case in the timeout callback.

The regular posix timers avoid sending signals to SIGEV_NONE timers by
not scheduling any callbacks for them in the first place.  Although it
would be possible to do something similar for alarm timers, it's simpler
to handle this as a special case in the timeout.

Prior to this patch, the alarm timer would ignore the sigev_notify value
and try to deliver signals to the process anyway.  Even worse, the
sanity check for the value of sigev_signo is skipped when SIGEV_NONE was
specified, so the signal number could be bogus.  If sigev_signo was an
unitialized value (as it often would be if SIGEV_NONE is used), then
it's hard to predict which signal will be sent.

Cc: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Cc: Ingo Molnar &lt;mingo@kernel.org&gt;
Cc: Richard Cochran &lt;richardcochran@gmail.com&gt;
Cc: Prarit Bhargava &lt;prarit@redhat.com&gt;
Cc: Sharvil Nanavati &lt;sharvil@google.com&gt;
Signed-off-by: Richard Larocque &lt;rlarocque@google.com&gt;
Signed-off-by: John Stultz &lt;john.stultz@linaro.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 265b81d23a46c39df0a735a3af4238954b41a4c2 upstream.

Avoids sending a signal to alarm timers created with sigev_notify set to
SIGEV_NONE by checking for that special case in the timeout callback.

The regular posix timers avoid sending signals to SIGEV_NONE timers by
not scheduling any callbacks for them in the first place.  Although it
would be possible to do something similar for alarm timers, it's simpler
to handle this as a special case in the timeout.

Prior to this patch, the alarm timer would ignore the sigev_notify value
and try to deliver signals to the process anyway.  Even worse, the
sanity check for the value of sigev_signo is skipped when SIGEV_NONE was
specified, so the signal number could be bogus.  If sigev_signo was an
unitialized value (as it often would be if SIGEV_NONE is used), then
it's hard to predict which signal will be sent.

Cc: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Cc: Ingo Molnar &lt;mingo@kernel.org&gt;
Cc: Richard Cochran &lt;richardcochran@gmail.com&gt;
Cc: Prarit Bhargava &lt;prarit@redhat.com&gt;
Cc: Sharvil Nanavati &lt;sharvil@google.com&gt;
Signed-off-by: Richard Larocque &lt;rlarocque@google.com&gt;
Signed-off-by: John Stultz &lt;john.stultz@linaro.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>timer: Fix lock inversion between hrtimer_bases.lock and scheduler locks</title>
<updated>2014-08-07T21:30:26+00:00</updated>
<author>
<name>Jan Kara</name>
<email>jack@suse.cz</email>
</author>
<published>2014-08-01T10:20:02+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=562eebeb9c07101e49f6803fd018ac45a01e3f43'/>
<id>562eebeb9c07101e49f6803fd018ac45a01e3f43</id>
<content type='text'>
commit 504d58745c9ca28d33572e2d8a9990b43e06075d upstream.

clockevents_increase_min_delta() calls printk() from under
hrtimer_bases.lock. That causes lock inversion on scheduler locks because
printk() can call into the scheduler. Lockdep puts it as:

======================================================
[ INFO: possible circular locking dependency detected ]
3.15.0-rc8-06195-g939f04b #2 Not tainted
-------------------------------------------------------
trinity-main/74 is trying to acquire lock:
 (&amp;port_lock_key){-.....}, at: [&lt;811c60be&gt;] serial8250_console_write+0x8c/0x10c

but task is already holding lock:
 (hrtimer_bases.lock){-.-...}, at: [&lt;8103caeb&gt;] hrtimer_try_to_cancel+0x13/0x66

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-&gt; #5 (hrtimer_bases.lock){-.-...}:
       [&lt;8104a942&gt;] lock_acquire+0x92/0x101
       [&lt;8142f11d&gt;] _raw_spin_lock_irqsave+0x2e/0x3e
       [&lt;8103c918&gt;] __hrtimer_start_range_ns+0x1c/0x197
       [&lt;8107ec20&gt;] perf_swevent_start_hrtimer.part.41+0x7a/0x85
       [&lt;81080792&gt;] task_clock_event_start+0x3a/0x3f
       [&lt;810807a4&gt;] task_clock_event_add+0xd/0x14
       [&lt;8108259a&gt;] event_sched_in+0xb6/0x17a
       [&lt;810826a2&gt;] group_sched_in+0x44/0x122
       [&lt;81082885&gt;] ctx_sched_in.isra.67+0x105/0x11f
       [&lt;810828e6&gt;] perf_event_sched_in.isra.70+0x47/0x4b
       [&lt;81082bf6&gt;] __perf_install_in_context+0x8b/0xa3
       [&lt;8107eb8e&gt;] remote_function+0x12/0x2a
       [&lt;8105f5af&gt;] smp_call_function_single+0x2d/0x53
       [&lt;8107e17d&gt;] task_function_call+0x30/0x36
       [&lt;8107fb82&gt;] perf_install_in_context+0x87/0xbb
       [&lt;810852c9&gt;] SYSC_perf_event_open+0x5c6/0x701
       [&lt;810856f9&gt;] SyS_perf_event_open+0x17/0x19
       [&lt;8142f8ee&gt;] syscall_call+0x7/0xb

-&gt; #4 (&amp;ctx-&gt;lock){......}:
       [&lt;8104a942&gt;] lock_acquire+0x92/0x101
       [&lt;8142f04c&gt;] _raw_spin_lock+0x21/0x30
       [&lt;81081df3&gt;] __perf_event_task_sched_out+0x1dc/0x34f
       [&lt;8142cacc&gt;] __schedule+0x4c6/0x4cb
       [&lt;8142cae0&gt;] schedule+0xf/0x11
       [&lt;8142f9a6&gt;] work_resched+0x5/0x30

-&gt; #3 (&amp;rq-&gt;lock){-.-.-.}:
       [&lt;8104a942&gt;] lock_acquire+0x92/0x101
       [&lt;8142f04c&gt;] _raw_spin_lock+0x21/0x30
       [&lt;81040873&gt;] __task_rq_lock+0x33/0x3a
       [&lt;8104184c&gt;] wake_up_new_task+0x25/0xc2
       [&lt;8102474b&gt;] do_fork+0x15c/0x2a0
       [&lt;810248a9&gt;] kernel_thread+0x1a/0x1f
       [&lt;814232a2&gt;] rest_init+0x1a/0x10e
       [&lt;817af949&gt;] start_kernel+0x303/0x308
       [&lt;817af2ab&gt;] i386_start_kernel+0x79/0x7d

-&gt; #2 (&amp;p-&gt;pi_lock){-.-...}:
       [&lt;8104a942&gt;] lock_acquire+0x92/0x101
       [&lt;8142f11d&gt;] _raw_spin_lock_irqsave+0x2e/0x3e
       [&lt;810413dd&gt;] try_to_wake_up+0x1d/0xd6
       [&lt;810414cd&gt;] default_wake_function+0xb/0xd
       [&lt;810461f3&gt;] __wake_up_common+0x39/0x59
       [&lt;81046346&gt;] __wake_up+0x29/0x3b
       [&lt;811b8733&gt;] tty_wakeup+0x49/0x51
       [&lt;811c3568&gt;] uart_write_wakeup+0x17/0x19
       [&lt;811c5dc1&gt;] serial8250_tx_chars+0xbc/0xfb
       [&lt;811c5f28&gt;] serial8250_handle_irq+0x54/0x6a
       [&lt;811c5f57&gt;] serial8250_default_handle_irq+0x19/0x1c
       [&lt;811c56d8&gt;] serial8250_interrupt+0x38/0x9e
       [&lt;810510e7&gt;] handle_irq_event_percpu+0x5f/0x1e2
       [&lt;81051296&gt;] handle_irq_event+0x2c/0x43
       [&lt;81052cee&gt;] handle_level_irq+0x57/0x80
       [&lt;81002a72&gt;] handle_irq+0x46/0x5c
       [&lt;810027df&gt;] do_IRQ+0x32/0x89
       [&lt;8143036e&gt;] common_interrupt+0x2e/0x33
       [&lt;8142f23c&gt;] _raw_spin_unlock_irqrestore+0x3f/0x49
       [&lt;811c25a4&gt;] uart_start+0x2d/0x32
       [&lt;811c2c04&gt;] uart_write+0xc7/0xd6
       [&lt;811bc6f6&gt;] n_tty_write+0xb8/0x35e
       [&lt;811b9beb&gt;] tty_write+0x163/0x1e4
       [&lt;811b9cd9&gt;] redirected_tty_write+0x6d/0x75
       [&lt;810b6ed6&gt;] vfs_write+0x75/0xb0
       [&lt;810b7265&gt;] SyS_write+0x44/0x77
       [&lt;8142f8ee&gt;] syscall_call+0x7/0xb

-&gt; #1 (&amp;tty-&gt;write_wait){-.....}:
       [&lt;8104a942&gt;] lock_acquire+0x92/0x101
       [&lt;8142f11d&gt;] _raw_spin_lock_irqsave+0x2e/0x3e
       [&lt;81046332&gt;] __wake_up+0x15/0x3b
       [&lt;811b8733&gt;] tty_wakeup+0x49/0x51
       [&lt;811c3568&gt;] uart_write_wakeup+0x17/0x19
       [&lt;811c5dc1&gt;] serial8250_tx_chars+0xbc/0xfb
       [&lt;811c5f28&gt;] serial8250_handle_irq+0x54/0x6a
       [&lt;811c5f57&gt;] serial8250_default_handle_irq+0x19/0x1c
       [&lt;811c56d8&gt;] serial8250_interrupt+0x38/0x9e
       [&lt;810510e7&gt;] handle_irq_event_percpu+0x5f/0x1e2
       [&lt;81051296&gt;] handle_irq_event+0x2c/0x43
       [&lt;81052cee&gt;] handle_level_irq+0x57/0x80
       [&lt;81002a72&gt;] handle_irq+0x46/0x5c
       [&lt;810027df&gt;] do_IRQ+0x32/0x89
       [&lt;8143036e&gt;] common_interrupt+0x2e/0x33
       [&lt;8142f23c&gt;] _raw_spin_unlock_irqrestore+0x3f/0x49
       [&lt;811c25a4&gt;] uart_start+0x2d/0x32
       [&lt;811c2c04&gt;] uart_write+0xc7/0xd6
       [&lt;811bc6f6&gt;] n_tty_write+0xb8/0x35e
       [&lt;811b9beb&gt;] tty_write+0x163/0x1e4
       [&lt;811b9cd9&gt;] redirected_tty_write+0x6d/0x75
       [&lt;810b6ed6&gt;] vfs_write+0x75/0xb0
       [&lt;810b7265&gt;] SyS_write+0x44/0x77
       [&lt;8142f8ee&gt;] syscall_call+0x7/0xb

-&gt; #0 (&amp;port_lock_key){-.....}:
       [&lt;8104a62d&gt;] __lock_acquire+0x9ea/0xc6d
       [&lt;8104a942&gt;] lock_acquire+0x92/0x101
       [&lt;8142f11d&gt;] _raw_spin_lock_irqsave+0x2e/0x3e
       [&lt;811c60be&gt;] serial8250_console_write+0x8c/0x10c
       [&lt;8104e402&gt;] call_console_drivers.constprop.31+0x87/0x118
       [&lt;8104f5d5&gt;] console_unlock+0x1d7/0x398
       [&lt;8104fb70&gt;] vprintk_emit+0x3da/0x3e4
       [&lt;81425f76&gt;] printk+0x17/0x19
       [&lt;8105bfa0&gt;] clockevents_program_min_delta+0x104/0x116
       [&lt;8105c548&gt;] clockevents_program_event+0xe7/0xf3
       [&lt;8105cc1c&gt;] tick_program_event+0x1e/0x23
       [&lt;8103c43c&gt;] hrtimer_force_reprogram+0x88/0x8f
       [&lt;8103c49e&gt;] __remove_hrtimer+0x5b/0x79
       [&lt;8103cb21&gt;] hrtimer_try_to_cancel+0x49/0x66
       [&lt;8103cb4b&gt;] hrtimer_cancel+0xd/0x18
       [&lt;8107f102&gt;] perf_swevent_cancel_hrtimer.part.60+0x2b/0x30
       [&lt;81080705&gt;] task_clock_event_stop+0x20/0x64
       [&lt;81080756&gt;] task_clock_event_del+0xd/0xf
       [&lt;81081350&gt;] event_sched_out+0xab/0x11e
       [&lt;810813e0&gt;] group_sched_out+0x1d/0x66
       [&lt;81081682&gt;] ctx_sched_out+0xaf/0xbf
       [&lt;81081e04&gt;] __perf_event_task_sched_out+0x1ed/0x34f
       [&lt;8142cacc&gt;] __schedule+0x4c6/0x4cb
       [&lt;8142cae0&gt;] schedule+0xf/0x11
       [&lt;8142f9a6&gt;] work_resched+0x5/0x30

other info that might help us debug this:

Chain exists of:
  &amp;port_lock_key --&gt; &amp;ctx-&gt;lock --&gt; hrtimer_bases.lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(hrtimer_bases.lock);
                               lock(&amp;ctx-&gt;lock);
                               lock(hrtimer_bases.lock);
  lock(&amp;port_lock_key);

 *** DEADLOCK ***

4 locks held by trinity-main/74:
 #0:  (&amp;rq-&gt;lock){-.-.-.}, at: [&lt;8142c6f3&gt;] __schedule+0xed/0x4cb
 #1:  (&amp;ctx-&gt;lock){......}, at: [&lt;81081df3&gt;] __perf_event_task_sched_out+0x1dc/0x34f
 #2:  (hrtimer_bases.lock){-.-...}, at: [&lt;8103caeb&gt;] hrtimer_try_to_cancel+0x13/0x66
 #3:  (console_lock){+.+...}, at: [&lt;8104fb5d&gt;] vprintk_emit+0x3c7/0x3e4

stack backtrace:
CPU: 0 PID: 74 Comm: trinity-main Not tainted 3.15.0-rc8-06195-g939f04b #2
 00000000 81c3a310 8b995c14 81426f69 8b995c44 81425a99 8161f671 8161f570
 8161f538 8161f559 8161f538 8b995c78 8b142bb0 00000004 8b142fdc 8b142bb0
 8b995ca8 8104a62d 8b142fac 000016f2 81c3a310 00000001 00000001 00000003
Call Trace:
 [&lt;81426f69&gt;] dump_stack+0x16/0x18
 [&lt;81425a99&gt;] print_circular_bug+0x18f/0x19c
 [&lt;8104a62d&gt;] __lock_acquire+0x9ea/0xc6d
 [&lt;8104a942&gt;] lock_acquire+0x92/0x101
 [&lt;811c60be&gt;] ? serial8250_console_write+0x8c/0x10c
 [&lt;811c6032&gt;] ? wait_for_xmitr+0x76/0x76
 [&lt;8142f11d&gt;] _raw_spin_lock_irqsave+0x2e/0x3e
 [&lt;811c60be&gt;] ? serial8250_console_write+0x8c/0x10c
 [&lt;811c60be&gt;] serial8250_console_write+0x8c/0x10c
 [&lt;8104af87&gt;] ? lock_release+0x191/0x223
 [&lt;811c6032&gt;] ? wait_for_xmitr+0x76/0x76
 [&lt;8104e402&gt;] call_console_drivers.constprop.31+0x87/0x118
 [&lt;8104f5d5&gt;] console_unlock+0x1d7/0x398
 [&lt;8104fb70&gt;] vprintk_emit+0x3da/0x3e4
 [&lt;81425f76&gt;] printk+0x17/0x19
 [&lt;8105bfa0&gt;] clockevents_program_min_delta+0x104/0x116
 [&lt;8105cc1c&gt;] tick_program_event+0x1e/0x23
 [&lt;8103c43c&gt;] hrtimer_force_reprogram+0x88/0x8f
 [&lt;8103c49e&gt;] __remove_hrtimer+0x5b/0x79
 [&lt;8103cb21&gt;] hrtimer_try_to_cancel+0x49/0x66
 [&lt;8103cb4b&gt;] hrtimer_cancel+0xd/0x18
 [&lt;8107f102&gt;] perf_swevent_cancel_hrtimer.part.60+0x2b/0x30
 [&lt;81080705&gt;] task_clock_event_stop+0x20/0x64
 [&lt;81080756&gt;] task_clock_event_del+0xd/0xf
 [&lt;81081350&gt;] event_sched_out+0xab/0x11e
 [&lt;810813e0&gt;] group_sched_out+0x1d/0x66
 [&lt;81081682&gt;] ctx_sched_out+0xaf/0xbf
 [&lt;81081e04&gt;] __perf_event_task_sched_out+0x1ed/0x34f
 [&lt;8104416d&gt;] ? __dequeue_entity+0x23/0x27
 [&lt;81044505&gt;] ? pick_next_task_fair+0xb1/0x120
 [&lt;8142cacc&gt;] __schedule+0x4c6/0x4cb
 [&lt;81047574&gt;] ? trace_hardirqs_off_caller+0xd7/0x108
 [&lt;810475b0&gt;] ? trace_hardirqs_off+0xb/0xd
 [&lt;81056346&gt;] ? rcu_irq_exit+0x64/0x77

Fix the problem by using printk_deferred() which does not call into the
scheduler.

Reported-by: Fengguang Wu &lt;fengguang.wu@intel.com&gt;
Signed-off-by: Jan Kara &lt;jack@suse.cz&gt;
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 504d58745c9ca28d33572e2d8a9990b43e06075d upstream.

clockevents_increase_min_delta() calls printk() from under
hrtimer_bases.lock. That causes lock inversion on scheduler locks because
printk() can call into the scheduler. Lockdep puts it as:

======================================================
[ INFO: possible circular locking dependency detected ]
3.15.0-rc8-06195-g939f04b #2 Not tainted
-------------------------------------------------------
trinity-main/74 is trying to acquire lock:
 (&amp;port_lock_key){-.....}, at: [&lt;811c60be&gt;] serial8250_console_write+0x8c/0x10c

but task is already holding lock:
 (hrtimer_bases.lock){-.-...}, at: [&lt;8103caeb&gt;] hrtimer_try_to_cancel+0x13/0x66

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-&gt; #5 (hrtimer_bases.lock){-.-...}:
       [&lt;8104a942&gt;] lock_acquire+0x92/0x101
       [&lt;8142f11d&gt;] _raw_spin_lock_irqsave+0x2e/0x3e
       [&lt;8103c918&gt;] __hrtimer_start_range_ns+0x1c/0x197
       [&lt;8107ec20&gt;] perf_swevent_start_hrtimer.part.41+0x7a/0x85
       [&lt;81080792&gt;] task_clock_event_start+0x3a/0x3f
       [&lt;810807a4&gt;] task_clock_event_add+0xd/0x14
       [&lt;8108259a&gt;] event_sched_in+0xb6/0x17a
       [&lt;810826a2&gt;] group_sched_in+0x44/0x122
       [&lt;81082885&gt;] ctx_sched_in.isra.67+0x105/0x11f
       [&lt;810828e6&gt;] perf_event_sched_in.isra.70+0x47/0x4b
       [&lt;81082bf6&gt;] __perf_install_in_context+0x8b/0xa3
       [&lt;8107eb8e&gt;] remote_function+0x12/0x2a
       [&lt;8105f5af&gt;] smp_call_function_single+0x2d/0x53
       [&lt;8107e17d&gt;] task_function_call+0x30/0x36
       [&lt;8107fb82&gt;] perf_install_in_context+0x87/0xbb
       [&lt;810852c9&gt;] SYSC_perf_event_open+0x5c6/0x701
       [&lt;810856f9&gt;] SyS_perf_event_open+0x17/0x19
       [&lt;8142f8ee&gt;] syscall_call+0x7/0xb

-&gt; #4 (&amp;ctx-&gt;lock){......}:
       [&lt;8104a942&gt;] lock_acquire+0x92/0x101
       [&lt;8142f04c&gt;] _raw_spin_lock+0x21/0x30
       [&lt;81081df3&gt;] __perf_event_task_sched_out+0x1dc/0x34f
       [&lt;8142cacc&gt;] __schedule+0x4c6/0x4cb
       [&lt;8142cae0&gt;] schedule+0xf/0x11
       [&lt;8142f9a6&gt;] work_resched+0x5/0x30

-&gt; #3 (&amp;rq-&gt;lock){-.-.-.}:
       [&lt;8104a942&gt;] lock_acquire+0x92/0x101
       [&lt;8142f04c&gt;] _raw_spin_lock+0x21/0x30
       [&lt;81040873&gt;] __task_rq_lock+0x33/0x3a
       [&lt;8104184c&gt;] wake_up_new_task+0x25/0xc2
       [&lt;8102474b&gt;] do_fork+0x15c/0x2a0
       [&lt;810248a9&gt;] kernel_thread+0x1a/0x1f
       [&lt;814232a2&gt;] rest_init+0x1a/0x10e
       [&lt;817af949&gt;] start_kernel+0x303/0x308
       [&lt;817af2ab&gt;] i386_start_kernel+0x79/0x7d

-&gt; #2 (&amp;p-&gt;pi_lock){-.-...}:
       [&lt;8104a942&gt;] lock_acquire+0x92/0x101
       [&lt;8142f11d&gt;] _raw_spin_lock_irqsave+0x2e/0x3e
       [&lt;810413dd&gt;] try_to_wake_up+0x1d/0xd6
       [&lt;810414cd&gt;] default_wake_function+0xb/0xd
       [&lt;810461f3&gt;] __wake_up_common+0x39/0x59
       [&lt;81046346&gt;] __wake_up+0x29/0x3b
       [&lt;811b8733&gt;] tty_wakeup+0x49/0x51
       [&lt;811c3568&gt;] uart_write_wakeup+0x17/0x19
       [&lt;811c5dc1&gt;] serial8250_tx_chars+0xbc/0xfb
       [&lt;811c5f28&gt;] serial8250_handle_irq+0x54/0x6a
       [&lt;811c5f57&gt;] serial8250_default_handle_irq+0x19/0x1c
       [&lt;811c56d8&gt;] serial8250_interrupt+0x38/0x9e
       [&lt;810510e7&gt;] handle_irq_event_percpu+0x5f/0x1e2
       [&lt;81051296&gt;] handle_irq_event+0x2c/0x43
       [&lt;81052cee&gt;] handle_level_irq+0x57/0x80
       [&lt;81002a72&gt;] handle_irq+0x46/0x5c
       [&lt;810027df&gt;] do_IRQ+0x32/0x89
       [&lt;8143036e&gt;] common_interrupt+0x2e/0x33
       [&lt;8142f23c&gt;] _raw_spin_unlock_irqrestore+0x3f/0x49
       [&lt;811c25a4&gt;] uart_start+0x2d/0x32
       [&lt;811c2c04&gt;] uart_write+0xc7/0xd6
       [&lt;811bc6f6&gt;] n_tty_write+0xb8/0x35e
       [&lt;811b9beb&gt;] tty_write+0x163/0x1e4
       [&lt;811b9cd9&gt;] redirected_tty_write+0x6d/0x75
       [&lt;810b6ed6&gt;] vfs_write+0x75/0xb0
       [&lt;810b7265&gt;] SyS_write+0x44/0x77
       [&lt;8142f8ee&gt;] syscall_call+0x7/0xb

-&gt; #1 (&amp;tty-&gt;write_wait){-.....}:
       [&lt;8104a942&gt;] lock_acquire+0x92/0x101
       [&lt;8142f11d&gt;] _raw_spin_lock_irqsave+0x2e/0x3e
       [&lt;81046332&gt;] __wake_up+0x15/0x3b
       [&lt;811b8733&gt;] tty_wakeup+0x49/0x51
       [&lt;811c3568&gt;] uart_write_wakeup+0x17/0x19
       [&lt;811c5dc1&gt;] serial8250_tx_chars+0xbc/0xfb
       [&lt;811c5f28&gt;] serial8250_handle_irq+0x54/0x6a
       [&lt;811c5f57&gt;] serial8250_default_handle_irq+0x19/0x1c
       [&lt;811c56d8&gt;] serial8250_interrupt+0x38/0x9e
       [&lt;810510e7&gt;] handle_irq_event_percpu+0x5f/0x1e2
       [&lt;81051296&gt;] handle_irq_event+0x2c/0x43
       [&lt;81052cee&gt;] handle_level_irq+0x57/0x80
       [&lt;81002a72&gt;] handle_irq+0x46/0x5c
       [&lt;810027df&gt;] do_IRQ+0x32/0x89
       [&lt;8143036e&gt;] common_interrupt+0x2e/0x33
       [&lt;8142f23c&gt;] _raw_spin_unlock_irqrestore+0x3f/0x49
       [&lt;811c25a4&gt;] uart_start+0x2d/0x32
       [&lt;811c2c04&gt;] uart_write+0xc7/0xd6
       [&lt;811bc6f6&gt;] n_tty_write+0xb8/0x35e
       [&lt;811b9beb&gt;] tty_write+0x163/0x1e4
       [&lt;811b9cd9&gt;] redirected_tty_write+0x6d/0x75
       [&lt;810b6ed6&gt;] vfs_write+0x75/0xb0
       [&lt;810b7265&gt;] SyS_write+0x44/0x77
       [&lt;8142f8ee&gt;] syscall_call+0x7/0xb

-&gt; #0 (&amp;port_lock_key){-.....}:
       [&lt;8104a62d&gt;] __lock_acquire+0x9ea/0xc6d
       [&lt;8104a942&gt;] lock_acquire+0x92/0x101
       [&lt;8142f11d&gt;] _raw_spin_lock_irqsave+0x2e/0x3e
       [&lt;811c60be&gt;] serial8250_console_write+0x8c/0x10c
       [&lt;8104e402&gt;] call_console_drivers.constprop.31+0x87/0x118
       [&lt;8104f5d5&gt;] console_unlock+0x1d7/0x398
       [&lt;8104fb70&gt;] vprintk_emit+0x3da/0x3e4
       [&lt;81425f76&gt;] printk+0x17/0x19
       [&lt;8105bfa0&gt;] clockevents_program_min_delta+0x104/0x116
       [&lt;8105c548&gt;] clockevents_program_event+0xe7/0xf3
       [&lt;8105cc1c&gt;] tick_program_event+0x1e/0x23
       [&lt;8103c43c&gt;] hrtimer_force_reprogram+0x88/0x8f
       [&lt;8103c49e&gt;] __remove_hrtimer+0x5b/0x79
       [&lt;8103cb21&gt;] hrtimer_try_to_cancel+0x49/0x66
       [&lt;8103cb4b&gt;] hrtimer_cancel+0xd/0x18
       [&lt;8107f102&gt;] perf_swevent_cancel_hrtimer.part.60+0x2b/0x30
       [&lt;81080705&gt;] task_clock_event_stop+0x20/0x64
       [&lt;81080756&gt;] task_clock_event_del+0xd/0xf
       [&lt;81081350&gt;] event_sched_out+0xab/0x11e
       [&lt;810813e0&gt;] group_sched_out+0x1d/0x66
       [&lt;81081682&gt;] ctx_sched_out+0xaf/0xbf
       [&lt;81081e04&gt;] __perf_event_task_sched_out+0x1ed/0x34f
       [&lt;8142cacc&gt;] __schedule+0x4c6/0x4cb
       [&lt;8142cae0&gt;] schedule+0xf/0x11
       [&lt;8142f9a6&gt;] work_resched+0x5/0x30

other info that might help us debug this:

Chain exists of:
  &amp;port_lock_key --&gt; &amp;ctx-&gt;lock --&gt; hrtimer_bases.lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(hrtimer_bases.lock);
                               lock(&amp;ctx-&gt;lock);
                               lock(hrtimer_bases.lock);
  lock(&amp;port_lock_key);

 *** DEADLOCK ***

4 locks held by trinity-main/74:
 #0:  (&amp;rq-&gt;lock){-.-.-.}, at: [&lt;8142c6f3&gt;] __schedule+0xed/0x4cb
 #1:  (&amp;ctx-&gt;lock){......}, at: [&lt;81081df3&gt;] __perf_event_task_sched_out+0x1dc/0x34f
 #2:  (hrtimer_bases.lock){-.-...}, at: [&lt;8103caeb&gt;] hrtimer_try_to_cancel+0x13/0x66
 #3:  (console_lock){+.+...}, at: [&lt;8104fb5d&gt;] vprintk_emit+0x3c7/0x3e4

stack backtrace:
CPU: 0 PID: 74 Comm: trinity-main Not tainted 3.15.0-rc8-06195-g939f04b #2
 00000000 81c3a310 8b995c14 81426f69 8b995c44 81425a99 8161f671 8161f570
 8161f538 8161f559 8161f538 8b995c78 8b142bb0 00000004 8b142fdc 8b142bb0
 8b995ca8 8104a62d 8b142fac 000016f2 81c3a310 00000001 00000001 00000003
Call Trace:
 [&lt;81426f69&gt;] dump_stack+0x16/0x18
 [&lt;81425a99&gt;] print_circular_bug+0x18f/0x19c
 [&lt;8104a62d&gt;] __lock_acquire+0x9ea/0xc6d
 [&lt;8104a942&gt;] lock_acquire+0x92/0x101
 [&lt;811c60be&gt;] ? serial8250_console_write+0x8c/0x10c
 [&lt;811c6032&gt;] ? wait_for_xmitr+0x76/0x76
 [&lt;8142f11d&gt;] _raw_spin_lock_irqsave+0x2e/0x3e
 [&lt;811c60be&gt;] ? serial8250_console_write+0x8c/0x10c
 [&lt;811c60be&gt;] serial8250_console_write+0x8c/0x10c
 [&lt;8104af87&gt;] ? lock_release+0x191/0x223
 [&lt;811c6032&gt;] ? wait_for_xmitr+0x76/0x76
 [&lt;8104e402&gt;] call_console_drivers.constprop.31+0x87/0x118
 [&lt;8104f5d5&gt;] console_unlock+0x1d7/0x398
 [&lt;8104fb70&gt;] vprintk_emit+0x3da/0x3e4
 [&lt;81425f76&gt;] printk+0x17/0x19
 [&lt;8105bfa0&gt;] clockevents_program_min_delta+0x104/0x116
 [&lt;8105cc1c&gt;] tick_program_event+0x1e/0x23
 [&lt;8103c43c&gt;] hrtimer_force_reprogram+0x88/0x8f
 [&lt;8103c49e&gt;] __remove_hrtimer+0x5b/0x79
 [&lt;8103cb21&gt;] hrtimer_try_to_cancel+0x49/0x66
 [&lt;8103cb4b&gt;] hrtimer_cancel+0xd/0x18
 [&lt;8107f102&gt;] perf_swevent_cancel_hrtimer.part.60+0x2b/0x30
 [&lt;81080705&gt;] task_clock_event_stop+0x20/0x64
 [&lt;81080756&gt;] task_clock_event_del+0xd/0xf
 [&lt;81081350&gt;] event_sched_out+0xab/0x11e
 [&lt;810813e0&gt;] group_sched_out+0x1d/0x66
 [&lt;81081682&gt;] ctx_sched_out+0xaf/0xbf
 [&lt;81081e04&gt;] __perf_event_task_sched_out+0x1ed/0x34f
 [&lt;8104416d&gt;] ? __dequeue_entity+0x23/0x27
 [&lt;81044505&gt;] ? pick_next_task_fair+0xb1/0x120
 [&lt;8142cacc&gt;] __schedule+0x4c6/0x4cb
 [&lt;81047574&gt;] ? trace_hardirqs_off_caller+0xd7/0x108
 [&lt;810475b0&gt;] ? trace_hardirqs_off+0xb/0xd
 [&lt;81056346&gt;] ? rcu_irq_exit+0x64/0x77

Fix the problem by using printk_deferred() which does not call into the
scheduler.

Reported-by: Fengguang Wu &lt;fengguang.wu@intel.com&gt;
Signed-off-by: Jan Kara &lt;jack@suse.cz&gt;
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>alarmtimer: Fix bug where relative alarm timers were treated as absolute</title>
<updated>2014-07-28T15:00:07+00:00</updated>
<author>
<name>John Stultz</name>
<email>john.stultz@linaro.org</email>
</author>
<published>2014-07-07T21:06:11+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=c933192733ddf436c578183ca0687c7db5fff468'/>
<id>c933192733ddf436c578183ca0687c7db5fff468</id>
<content type='text'>
commit 16927776ae757d0d132bdbfabbfe2c498342bd59 upstream.

Sharvil noticed with the posix timer_settime interface, using the
CLOCK_REALTIME_ALARM or CLOCK_BOOTTIME_ALARM clockid, if the users
tried to specify a relative time timer, it would incorrectly be
treated as absolute regardless of the state of the flags argument.

This patch corrects this, properly checking the absolute/relative flag,
as well as adds further error checking that no invalid flag bits are set.

Reported-by: Sharvil Nanavati &lt;sharvil@google.com&gt;
Signed-off-by: John Stultz &lt;john.stultz@linaro.org&gt;
Cc: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Cc: Ingo Molnar &lt;mingo@kernel.org&gt;
Cc: Prarit Bhargava &lt;prarit@redhat.com&gt;
Cc: Sharvil Nanavati &lt;sharvil@google.com&gt;
Link: http://lkml.kernel.org/r/1404767171-6902-1-git-send-email-john.stultz@linaro.org
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 16927776ae757d0d132bdbfabbfe2c498342bd59 upstream.

Sharvil noticed with the posix timer_settime interface, using the
CLOCK_REALTIME_ALARM or CLOCK_BOOTTIME_ALARM clockid, if the users
tried to specify a relative time timer, it would incorrectly be
treated as absolute regardless of the state of the flags argument.

This patch corrects this, properly checking the absolute/relative flag,
as well as adds further error checking that no invalid flag bits are set.

Reported-by: Sharvil Nanavati &lt;sharvil@google.com&gt;
Signed-off-by: John Stultz &lt;john.stultz@linaro.org&gt;
Cc: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Cc: Ingo Molnar &lt;mingo@kernel.org&gt;
Cc: Prarit Bhargava &lt;prarit@redhat.com&gt;
Cc: Sharvil Nanavati &lt;sharvil@google.com&gt;
Link: http://lkml.kernel.org/r/1404767171-6902-1-git-send-email-john.stultz@linaro.org
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>nohz: Fix another inconsistency between CONFIG_NO_HZ=n and nohz=off</title>
<updated>2014-06-26T19:12:41+00:00</updated>
<author>
<name>Thomas Gleixner</name>
<email>tglx@linutronix.de</email>
</author>
<published>2013-11-29T11:18:13+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=ec804bd9e1ecad7a6d9f9428eaf388e3dac9cb63'/>
<id>ec804bd9e1ecad7a6d9f9428eaf388e3dac9cb63</id>
<content type='text'>
commit 0e576acbc1d9600cf2d9b4a141a2554639959d50 upstream.

If CONFIG_NO_HZ=n tick_nohz_get_sleep_length() returns NSEC_PER_SEC/HZ.

If CONFIG_NO_HZ=y and the nohz functionality is disabled via the
command line option "nohz=off" or not enabled due to missing hardware
support, then tick_nohz_get_sleep_length() returns 0. That happens
because ts-&gt;sleep_length is never set in that case.

Set it to NSEC_PER_SEC/HZ when the NOHZ mode is inactive.

Reported-by: Michal Hocko &lt;mhocko@suse.cz&gt;
Reported-by: Borislav Petkov &lt;bp@alien8.de&gt;
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Cc: Rui Xiang &lt;rui.xiang@huawei.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 0e576acbc1d9600cf2d9b4a141a2554639959d50 upstream.

If CONFIG_NO_HZ=n tick_nohz_get_sleep_length() returns NSEC_PER_SEC/HZ.

If CONFIG_NO_HZ=y and the nohz functionality is disabled via the
command line option "nohz=off" or not enabled due to missing hardware
support, then tick_nohz_get_sleep_length() returns 0. That happens
because ts-&gt;sleep_length is never set in that case.

Set it to NSEC_PER_SEC/HZ when the NOHZ mode is inactive.

Reported-by: Michal Hocko &lt;mhocko@suse.cz&gt;
Reported-by: Borislav Petkov &lt;bp@alien8.de&gt;
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Cc: Rui Xiang &lt;rui.xiang@huawei.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>tick: Make oneshot broadcast robust vs. CPU offlining</title>
<updated>2014-03-24T04:38:21+00:00</updated>
<author>
<name>Thomas Gleixner</name>
<email>tglx@linutronix.de</email>
</author>
<published>2013-06-26T10:17:32+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=a191212af8f4895d6a40c9d53fa84e9ae575ecd0'/>
<id>a191212af8f4895d6a40c9d53fa84e9ae575ecd0</id>
<content type='text'>
commit c9b5a266b103af873abb9ac03bc3d067702c8f4b upstream.

In periodic mode we remove offline cpus from the broadcast propagation
mask. In oneshot mode we fail to do so. This was not a problem so far,
but the recent changes to the broadcast propagation introduced a
constellation which can result in a NULL pointer dereference.

What happens is:

CPU0			CPU1
			idle()
			  arch_idle()
			    tick_broadcast_oneshot_control(OFF);
			      set cpu1 in tick_broadcast_force_mask
			  if (cpu_offline())
			     arch_cpu_dead()

cpu_dead_cleanup(cpu1)
 cpu1 tickdevice pointer = NULL

broadcast interrupt
  dereference cpu1 tickdevice pointer -&gt; OOPS

We dereference the pointer because cpu1 is still set in
tick_broadcast_force_mask and tick_do_broadcast() expects a valid
cpumask and therefor lacks any further checks.

Remove the cpu from the tick_broadcast_force_mask before we set the
tick device pointer to NULL. Also add a sanity check to the oneshot
broadcast function, so we can detect such issues w/o crashing the
machine.

Reported-by: Prarit Bhargava &lt;prarit@redhat.com&gt;
Cc: athorlton@sgi.com
Cc: CAI Qian &lt;caiqian@redhat.com&gt;
Link: http://lkml.kernel.org/r/alpine.DEB.2.02.1306261303260.4013@ionos.tec.linutronix.de
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Signed-off-by: Preeti U Murthy &lt;preeti@linux.vnet.ibm.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit c9b5a266b103af873abb9ac03bc3d067702c8f4b upstream.

In periodic mode we remove offline cpus from the broadcast propagation
mask. In oneshot mode we fail to do so. This was not a problem so far,
but the recent changes to the broadcast propagation introduced a
constellation which can result in a NULL pointer dereference.

What happens is:

CPU0			CPU1
			idle()
			  arch_idle()
			    tick_broadcast_oneshot_control(OFF);
			      set cpu1 in tick_broadcast_force_mask
			  if (cpu_offline())
			     arch_cpu_dead()

cpu_dead_cleanup(cpu1)
 cpu1 tickdevice pointer = NULL

broadcast interrupt
  dereference cpu1 tickdevice pointer -&gt; OOPS

We dereference the pointer because cpu1 is still set in
tick_broadcast_force_mask and tick_do_broadcast() expects a valid
cpumask and therefor lacks any further checks.

Remove the cpu from the tick_broadcast_force_mask before we set the
tick device pointer to NULL. Also add a sanity check to the oneshot
broadcast function, so we can detect such issues w/o crashing the
machine.

Reported-by: Prarit Bhargava &lt;prarit@redhat.com&gt;
Cc: athorlton@sgi.com
Cc: CAI Qian &lt;caiqian@redhat.com&gt;
Link: http://lkml.kernel.org/r/alpine.DEB.2.02.1306261303260.4013@ionos.tec.linutronix.de
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Signed-off-by: Preeti U Murthy &lt;preeti@linux.vnet.ibm.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>time: Fix overflow when HZ is smaller than 60</title>
<updated>2014-02-22T20:41:29+00:00</updated>
<author>
<name>Mikulas Patocka</name>
<email>mpatocka@redhat.com</email>
</author>
<published>2014-01-24T21:41:36+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=ea7dfc423c1a4a33232f99c401fda77129619289'/>
<id>ea7dfc423c1a4a33232f99c401fda77129619289</id>
<content type='text'>
commit 80d767d770fd9c697e434fd080c2db7b5c60c6dd upstream.

When compiling for the IA-64 ski emulator, HZ is set to 32 because the
emulation is slow and we don't want to waste too many cycles processing
timers. Alpha also has an option to set HZ to 32.

This causes integer underflow in
kernel/time/jiffies.c:
kernel/time/jiffies.c:66:2: warning: large integer implicitly truncated to unsigned type [-Woverflow]
  .mult  = NSEC_PER_JIFFY &lt;&lt; JIFFIES_SHIFT, /* details above */
  ^

This patch reduces the JIFFIES_SHIFT value to avoid the overflow.

Signed-off-by: Mikulas Patocka &lt;mikulas@artax.karlin.mff.cuni.cz&gt;
Link: http://lkml.kernel.org/r/alpine.LRH.2.02.1401241639100.23871@file01.intranet.prod.int.rdu2.redhat.com
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 80d767d770fd9c697e434fd080c2db7b5c60c6dd upstream.

When compiling for the IA-64 ski emulator, HZ is set to 32 because the
emulation is slow and we don't want to waste too many cycles processing
timers. Alpha also has an option to set HZ to 32.

This causes integer underflow in
kernel/time/jiffies.c:
kernel/time/jiffies.c:66:2: warning: large integer implicitly truncated to unsigned type [-Woverflow]
  .mult  = NSEC_PER_JIFFY &lt;&lt; JIFFIES_SHIFT, /* details above */
  ^

This patch reduces the JIFFIES_SHIFT value to avoid the overflow.

Signed-off-by: Mikulas Patocka &lt;mikulas@artax.karlin.mff.cuni.cz&gt;
Link: http://lkml.kernel.org/r/alpine.LRH.2.02.1401241639100.23871@file01.intranet.prod.int.rdu2.redhat.com
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>tick: Clear broadcast pending bit when switching to oneshot</title>
<updated>2014-02-22T20:41:29+00:00</updated>
<author>
<name>Thomas Gleixner</name>
<email>tglx@linutronix.de</email>
</author>
<published>2014-02-11T13:35:40+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=dbd515879a94273d4a6e1e6195d20951af2a65af'/>
<id>dbd515879a94273d4a6e1e6195d20951af2a65af</id>
<content type='text'>
commit dd5fd9b91a77b4c9c28b7ef9c181b1a875820d0a upstream.

AMD systems which use the C1E workaround in the amd_e400_idle routine
trigger the WARN_ON_ONCE in the broadcast code when onlining a CPU.

The reason is that the idle routine of those AMD systems switches the
cpu into forced broadcast mode early on before the newly brought up
CPU can switch over to high resolution / NOHZ mode. The timer related
CPU1 bringup looks like this:

  clockevent_register_device(local_apic);
  tick_setup(local_apic);
  ...
  idle()
	tick_broadcast_on_off(FORCE);
	tick_broadcast_oneshot_control(ENTER)
	  cpumask_set(cpu, broadcast_oneshot_mask);
	halt();

Now the broadcast interrupt on CPU0 sets CPU1 in the
broadcast_pending_mask and wakes CPU1. So CPU1 continues:

	local_apic_timer_interrupt()
	   tick_handle_periodic();
	   softirq()
	     tick_init_highres();
	       cpumask_clr(cpu, broadcast_oneshot_mask);

	tick_broadcast_oneshot_control(ENTER)
	   WARN_ON(cpumask_test(cpu, broadcast_pending_mask);

So while we remove CPU1 from the broadcast_oneshot_mask when we switch
over to highres mode, we do not clear the pending bit, which then
triggers the warning when we go back to idle.

The reason why this is only visible on C1E affected AMD systems is
that the other machines enter the deep sleep states via
acpi_idle/intel_idle and exit the broadcast mode before executing the
remote triggered local_apic_timer_interrupt. So the pending bit is
already cleared when the switch over to highres mode is clearing the
oneshot mask.

The solution is simple: Clear the pending bit together with the mask
bit when we switch over to highres mode.

Stanislaw came up independently with the same patch by enforcing the
C1E workaround and debugging the fallout. I picked mine, because mine
has a changelog :)

Reported-by: poma &lt;pomidorabelisima@gmail.com&gt;
Debugged-by: Stanislaw Gruszka &lt;sgruszka@redhat.com&gt;
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Cc: Olaf Hering &lt;olaf@aepfle.de&gt;
Cc: Dave Jones &lt;davej@redhat.com&gt;
Cc: Justin M. Forbes &lt;jforbes@redhat.com&gt;
Cc: Josh Boyer &lt;jwboyer@redhat.com&gt;
Link: http://lkml.kernel.org/r/alpine.DEB.2.02.1402111434180.21991@ionos.tec.linutronix.de
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit dd5fd9b91a77b4c9c28b7ef9c181b1a875820d0a upstream.

AMD systems which use the C1E workaround in the amd_e400_idle routine
trigger the WARN_ON_ONCE in the broadcast code when onlining a CPU.

The reason is that the idle routine of those AMD systems switches the
cpu into forced broadcast mode early on before the newly brought up
CPU can switch over to high resolution / NOHZ mode. The timer related
CPU1 bringup looks like this:

  clockevent_register_device(local_apic);
  tick_setup(local_apic);
  ...
  idle()
	tick_broadcast_on_off(FORCE);
	tick_broadcast_oneshot_control(ENTER)
	  cpumask_set(cpu, broadcast_oneshot_mask);
	halt();

Now the broadcast interrupt on CPU0 sets CPU1 in the
broadcast_pending_mask and wakes CPU1. So CPU1 continues:

	local_apic_timer_interrupt()
	   tick_handle_periodic();
	   softirq()
	     tick_init_highres();
	       cpumask_clr(cpu, broadcast_oneshot_mask);

	tick_broadcast_oneshot_control(ENTER)
	   WARN_ON(cpumask_test(cpu, broadcast_pending_mask);

So while we remove CPU1 from the broadcast_oneshot_mask when we switch
over to highres mode, we do not clear the pending bit, which then
triggers the warning when we go back to idle.

The reason why this is only visible on C1E affected AMD systems is
that the other machines enter the deep sleep states via
acpi_idle/intel_idle and exit the broadcast mode before executing the
remote triggered local_apic_timer_interrupt. So the pending bit is
already cleared when the switch over to highres mode is clearing the
oneshot mask.

The solution is simple: Clear the pending bit together with the mask
bit when we switch over to highres mode.

Stanislaw came up independently with the same patch by enforcing the
C1E workaround and debugging the fallout. I picked mine, because mine
has a changelog :)

Reported-by: poma &lt;pomidorabelisima@gmail.com&gt;
Debugged-by: Stanislaw Gruszka &lt;sgruszka@redhat.com&gt;
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Cc: Olaf Hering &lt;olaf@aepfle.de&gt;
Cc: Dave Jones &lt;davej@redhat.com&gt;
Cc: Justin M. Forbes &lt;jforbes@redhat.com&gt;
Cc: Josh Boyer &lt;jwboyer@redhat.com&gt;
Link: http://lkml.kernel.org/r/alpine.DEB.2.02.1402111434180.21991@ionos.tec.linutronix.de
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
</feed>
