1. 17 Jun, 2016 4 commits
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 2668bc77
      Linus Torvalds authored
      Pull KVM fixes from Paolo Bonzini:
      
       - miscellaneous fixes for MIPS and s390
      
       - one new kvm_stat for s390
      
       - correctly disable VT-d posted interrupts with the rest of posted
         interrupts
      
       - "make randconfig" fix for x86 AMD
      
       - off-by-one in irq route check (the "good" kind that errors out a bit
         too early!)
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        kvm: vmx: check apicv is active before using VT-d posted interrupt
        kvm: Fix irq route entries exceeding KVM_MAX_IRQ_ROUTES
        kvm: svm: Do not support AVIC if not CONFIG_X86_LOCAL_APIC
        kvm: svm: Fix implicit declaration for __default_cpu_present_to_apicid()
        MIPS: KVM: Fix CACHE triggered exception emulation
        MIPS: KVM: Don't unwind PC when emulating CACHE
        MIPS: KVM: Include bit 31 in segment matches
        MIPS: KVM: Fix modular KVM under QEMU
        KVM: s390: Add stats for PEI events
        KVM: s390: ignore IBC if zero
      2668bc77
    • Linus Torvalds's avatar
      Merge tag 'nfsd-4.7-1' of git://linux-nfs.org/~bfields/linux · 41ef7218
      Linus Torvalds authored
      Pull nfsd bugfixes from Bruce Fields:
       "Oleg Drokin found and fixed races in the nfsd4 state code that go back
        to the big nfs4_lock_state removal around 3.17 (but that were also
        probably hard to reproduce before client changes in 3.20 allowed the
        client to perform parallel opens).
      
        Also fix a 4.1 backchannel crash due to rpc multipath changes in 4.6.
        Trond acked the client-side rpc fixes going through my tree"
      
      * tag 'nfsd-4.7-1' of git://linux-nfs.org/~bfields/linux:
        nfsd: Make init_open_stateid() a bit more whole
        nfsd: Extend the mutex holding region around in nfsd4_process_open2()
        nfsd: Always lock state exclusively.
        rpc: share one xps between all backchannels
        nfsd4/rpc: move backchannel create logic into rpc code
        SUNRPC: fix xprt leak on xps allocation failure
        nfsd: Fix NFSD_MDS_PR_KEY on 32-bit by adding ULL postfix
      41ef7218
    • Linus Torvalds's avatar
      Merge branch 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs · 9c514bed
      Linus Torvalds authored
      Pull overlayfs fixes from Miklos Szeredi:
       "This contains two regression fixes: one for the xattr API update and
        one for using the mounter's creds in file creation in overlayfs.
      
        There's also a fix for a bug in handling hard linked AF_UNIX sockets
        that's been there from day one.  This fix is overlayfs only despite
        the fact that it touches code outside the overlay filesystem: d_real()
        is an identity function for all except overlay dentries"
      
      * 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs:
        ovl: fix uid/gid when creating over whiteout
        ovl: xattr filter fix
        af_unix: fix hard linked sockets on overlay
        vfs: add d_real_inode() helper
      9c514bed
    • Dan Carpenter's avatar
      KEYS: potential uninitialized variable · 38327424
      Dan Carpenter authored
      If __key_link_begin() failed then "edit" would be uninitialized.  I've
      added a check to fix that.
      
      This allows a random user to crash the kernel, though it's quite
      difficult to achieve.  There are three ways it can be done as the user
      would have to cause an error to occur in __key_link():
      
       (1) Cause the kernel to run out of memory.  In practice, this is difficult
           to achieve without ENOMEM cropping up elsewhere and aborting the
           attempt.
      
       (2) Revoke the destination keyring between the keyring ID being looked up
           and it being tested for revocation.  In practice, this is difficult to
           time correctly because the KEYCTL_REJECT function can only be used
           from the request-key upcall process.  Further, users can only make use
           of what's in /sbin/request-key.conf, though this does including a
           rejection debugging test - which means that the destination keyring
           has to be the caller's session keyring in practice.
      
       (3) Have just enough key quota available to create a key, a new session
           keyring for the upcall and a link in the session keyring, but not then
           sufficient quota to create a link in the nominated destination keyring
           so that it fails with EDQUOT.
      
      The bug can be triggered using option (3) above using something like the
      following:
      
      	echo 80 >/proc/sys/kernel/keys/root_maxbytes
      	keyctl request2 user debug:fred negate @t
      
      The above sets the quota to something much lower (80) to make the bug
      easier to trigger, but this is dependent on the system.  Note also that
      the name of the keyring created contains a random number that may be
      between 1 and 10 characters in size, so may throw the test off by
      changing the amount of quota used.
      
      Assuming the failure occurs, something like the following will be seen:
      
      	kfree_debugcheck: out of range ptr 6b6b6b6b6b6b6b68h
      	------------[ cut here ]------------
      	kernel BUG at ../mm/slab.c:2821!
      	...
      	RIP: 0010:[<ffffffff811600f9>] kfree_debugcheck+0x20/0x25
      	RSP: 0018:ffff8804014a7de8  EFLAGS: 00010092
      	RAX: 0000000000000034 RBX: 6b6b6b6b6b6b6b68 RCX: 0000000000000000
      	RDX: 0000000000040001 RSI: 00000000000000f6 RDI: 0000000000000300
      	RBP: ffff8804014a7df0 R08: 0000000000000001 R09: 0000000000000000
      	R10: ffff8804014a7e68 R11: 0000000000000054 R12: 0000000000000202
      	R13: ffffffff81318a66 R14: 0000000000000000 R15: 0000000000000001
      	...
      	Call Trace:
      	  kfree+0xde/0x1bc
      	  assoc_array_cancel_edit+0x1f/0x36
      	  __key_link_end+0x55/0x63
      	  key_reject_and_link+0x124/0x155
      	  keyctl_reject_key+0xb6/0xe0
      	  keyctl_negate_key+0x10/0x12
      	  SyS_keyctl+0x9f/0xe7
      	  do_syscall_64+0x63/0x13a
      	  entry_SYSCALL64_slow_path+0x25/0x25
      
      Fixes: f70e2e06 ('KEYS: Do preallocation for __key_link()')
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      cc: stable@vger.kernel.org
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      38327424
  2. 16 Jun, 2016 13 commits
  3. 15 Jun, 2016 17 commits
    • Suravee Suthikulpanit's avatar
      kvm: svm: Do not support AVIC if not CONFIG_X86_LOCAL_APIC · 5b8abf1f
      Suravee Suthikulpanit authored
      Add logic to disable AVIC #ifndef CONFIG_X86_LOCAL_APIC.
      Suggested-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: default avatarSuravee Suthikulpanit <suravee.suthikulpanit@amd.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      5b8abf1f
    • Suravee Suthikulpanit's avatar
      kvm: svm: Fix implicit declaration for __default_cpu_present_to_apicid() · 7d669f50
      Suravee Suthikulpanit authored
      The commit 8221c137 ("svm: Manage vcpu load/unload when enable AVIC")
      introduces a build error due to implicit function declaration
      when #ifdef CONFIG_X86_32 and #ifndef CONFIG_X86_LOCAL_APIC
      (as reported by Kbuild test robot i386-randconfig-x0-06121009).
      
      So, this patch introduces kvm_cpu_get_apicid() wrapper
      around __default_cpu_present_to_apicid() with additional
      handling if CONFIG_X86_LOCAL_APIC is not defined.
      Reported-by: default avatarkbuild test robot <fengguang.wu@intel.com>
      Fixes: commit 8221c137 ("svm: Manage vcpu load/unload when enable AVIC")
      Signed-off-by: default avatarSuravee Suthikulpanit <suravee.suthikulpanit@amd.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      7d669f50
    • Dave Airlie's avatar
      Merge branch 'drm-etnaviv-fixes' of git://git.pengutronix.de/git/lst/linux into drm-fixes · d9724d3b
      Dave Airlie authored
      just a single fix for a regression introduced by IOMMU API changes in
      v4.7.
      
      * 'drm-etnaviv-fixes' of git://git.pengutronix.de/git/lst/linux:
        drm/etnaviv: initialize iommu domain page size
      d9724d3b
    • J. Bruce Fields's avatar
      rpc: share one xps between all backchannels · 39a9beab
      J. Bruce Fields authored
      The spec allows backchannels for multiple clients to share the same tcp
      connection.  When that happens, we need to use the same xprt for all of
      them.  Similarly, we need the same xps.
      
      This fixes list corruption introduced by the multipath code.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
      Acked-by: default avatarTrond Myklebust <trondmy@primarydata.com>
      39a9beab
    • J. Bruce Fields's avatar
      nfsd4/rpc: move backchannel create logic into rpc code · d50039ea
      J. Bruce Fields authored
      Also simplify the logic a bit.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
      Acked-by: default avatarTrond Myklebust <trondmy@primarydata.com>
      d50039ea
    • J. Bruce Fields's avatar
      SUNRPC: fix xprt leak on xps allocation failure · 1208fd56
      J. Bruce Fields authored
      Callers of rpc_create_xprt expect it to put the xprt on success and
      failure.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
      Acked-by: default avatarTrond Myklebust <trondmy@primarydata.com>
      1208fd56
    • Miklos Szeredi's avatar
      ovl: fix uid/gid when creating over whiteout · d0e13f5b
      Miklos Szeredi authored
      Fix a regression when creating a file over a whiteout.  The new
      file/directory needs to use the current fsuid/fsgid, not the ones from the
      mounter's credentials.
      
      The refcounting is a bit tricky: prepare_creds() sets an original refcount,
      override_creds() gets one more, which revert_cred() drops.  So
      
        1) we need to expicitly put the mounter's credentials when overriding
           with the updated one
      
        2) we need to put the original ref to the updated creds (and this can
           safely be done before revert_creds(), since we'll still have the ref
           from override_creds()).
      Reported-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
      Fixes: 3fe6e52f ("ovl: override creds with the ones from the superblock mounter")
      Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
      d0e13f5b
    • Lucas Stach's avatar
      drm/etnaviv: initialize iommu domain page size · 13c34fe5
      Lucas Stach authored
      Since d16e0faa (iommu: Allow selecting page sizes per domain) the
      iommu core demands the page size to be set per domain, otherwise any
      mapping attempts will be dropped. Make sure to set a valid page size
      for the etnaviv iommu.
      Signed-off-by: default avatarLucas Stach <l.stach@pengutronix.de>
      13c34fe5
    • Dave Airlie's avatar
      Merge branch 'linux-4.7' of git://github.com/skeggsb/linux into drm-fixes · e43fc946
      Dave Airlie authored
      * 'linux-4.7' of git://github.com/skeggsb/linux:
        drm/nouveau/iccsense: fix memory leak
        drm/nouveau/Revert "drm/nouveau/device/pci: set as non-CPU-coherent on ARM64"
      e43fc946
    • Ben Skeggs's avatar
      drm/nouveau/iccsense: fix memory leak · 6aa85f11
      Ben Skeggs authored
      Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      6aa85f11
    • Robin Murphy's avatar
      drm/nouveau/Revert "drm/nouveau/device/pci: set as non-CPU-coherent on ARM64" · 539aae6e
      Robin Murphy authored
      This reverts commit 1733a2ad.
      
      There is apparently something amiss with the way the TTM code handles
      DMA buffers, which the above commit was attempting to work around for
      arm64 systems with non-coherent PCI. Unfortunately, this completely
      breaks systems *with* coherent PCI (which appear to be the majority).
      
      Booting a plain arm64 defconfig + CONFIG_DRM + CONFIG_DRM_NOUVEAU on
      a machine with a PCI GPU having coherent dma_map_ops (in this case a
      7600GT card plugged into an ARM Juno board) results in a fatal crash:
      
      [    2.803438] nouveau 0000:06:00.0: DRM: allocated 1024x768 fb: 0x9000, bo ffffffc976141c00
      [    2.897662] Unable to handle kernel NULL pointer dereference at virtual address 000001ac
      [    2.897666] pgd = ffffff8008e00000
      [    2.897675] [000001ac] *pgd=00000009ffffe003, *pud=00000009ffffe003, *pmd=0000000000000000
      [    2.897680] Internal error: Oops: 96000045 [#1] PREEMPT SMP
      [    2.897685] Modules linked in:
      [    2.897692] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.6.0-rc5+ #543
      [    2.897694] Hardware name: ARM Juno development board (r1) (DT)
      [    2.897699] task: ffffffc9768a0000 ti: ffffffc9768a8000 task.ti: ffffffc9768a8000
      [    2.897711] PC is at __memcpy+0x7c/0x180
      [    2.897719] LR is at OUT_RINGp+0x34/0x70
      [    2.897724] pc : [<ffffff80083465fc>] lr : [<ffffff800854248c>] pstate: 80000045
      [    2.897726] sp : ffffffc9768ab360
      [    2.897732] x29: ffffffc9768ab360 x28: 0000000000000001
      [    2.897738] x27: ffffffc97624c000 x26: 0000000000000000
      [    2.897744] x25: 0000000000000080 x24: 0000000000006c00
      [    2.897749] x23: 0000000000000005 x22: ffffffc97624c010
      [    2.897755] x21: 0000000000000004 x20: 0000000000000004
      [    2.897761] x19: ffffffc9763da000 x18: ffffffc976b2491c
      [    2.897766] x17: 0000000000000007 x16: 0000000000000006
      [    2.897771] x15: 0000000000000001 x14: 0000000000000001
      [    2.897777] x13: 0000000000e31b70 x12: ffffffc9768a0080
      [    2.897783] x11: 0000000000000000 x10: fffffffffffffb00
      [    2.897788] x9 : 0000000000000000 x8 : 0000000000000000
      [    2.897793] x7 : 0000000000000000 x6 : 00000000000001ac
      [    2.897799] x5 : 00000000ffffffff x4 : 0000000000000000
      [    2.897804] x3 : 0000000000000010 x2 : 0000000000000010
      [    2.897810] x1 : ffffffc97624c010 x0 : 00000000000001ac
      ...
      [    2.898494] Call trace:
      [    2.898499] Exception stack(0xffffffc9768ab1a0 to 0xffffffc9768ab2c0)
      [    2.898506] b1a0: ffffffc9763da000 0000000000000004 ffffffc9768ab360 ffffff80083465fc
      [    2.898513] b1c0: ffffffc976801e00 ffffffc9762b8000 ffffffc9768ab1f0 ffffff80080ec158
      [    2.898520] b1e0: ffffffc9768ab230 ffffff8008496d04 ffffffc975ce6d80 ffffffc9768ab36e
      [    2.898527] b200: ffffffc9768ab36f ffffffc9768ab29d ffffffc9768ab29e ffffffc9768a0000
      [    2.898533] b220: ffffffc9768ab250 ffffff80080e70c0 ffffffc9768ab270 ffffff8008496e44
      [    2.898540] b240: 00000000000001ac ffffffc97624c010 0000000000000010 0000000000000010
      [    2.898546] b260: 0000000000000000 00000000ffffffff 00000000000001ac 0000000000000000
      [    2.898552] b280: 0000000000000000 0000000000000000 fffffffffffffb00 0000000000000000
      [    2.898558] b2a0: ffffffc9768a0080 0000000000e31b70 0000000000000001 0000000000000001
      [    2.898566] [<ffffff80083465fc>] __memcpy+0x7c/0x180
      [    2.898574] [<ffffff800853e164>] nv04_fbcon_imageblit+0x1d4/0x2e8
      [    2.898582] [<ffffff800853d6d0>] nouveau_fbcon_imageblit+0xd8/0xe0
      [    2.898591] [<ffffff80083c4db4>] soft_cursor+0x154/0x1d8
      [    2.898598] [<ffffff80083c47b4>] bit_cursor+0x4fc/0x538
      [    2.898605] [<ffffff80083c0cfc>] fbcon_cursor+0x134/0x1a8
      [    2.898613] [<ffffff800841c280>] hide_cursor+0x38/0xa0
      [    2.898620] [<ffffff800841d420>] redraw_screen+0x120/0x228
      [    2.898628] [<ffffff80083bf268>] fbcon_prepare_logo+0x370/0x3f8
      [    2.898635] [<ffffff80083bf640>] fbcon_init+0x350/0x560
      [    2.898641] [<ffffff800841c634>] visual_init+0xac/0x108
      [    2.898648] [<ffffff800841df14>] do_bind_con_driver+0x1c4/0x3a8
      [    2.898655] [<ffffff800841e4f4>] do_take_over_console+0x174/0x1e8
      [    2.898662] [<ffffff80083bf8c4>] do_fbcon_takeover+0x74/0x100
      [    2.898669] [<ffffff80083c3e44>] fbcon_event_notify+0x8cc/0x920
      [    2.898680] [<ffffff80080d7e38>] notifier_call_chain+0x50/0x90
      [    2.898685] [<ffffff80080d8214>] __blocking_notifier_call_chain+0x4c/0x90
      [    2.898691] [<ffffff80080d826c>] blocking_notifier_call_chain+0x14/0x20
      [    2.898696] [<ffffff80083c5e1c>] fb_notifier_call_chain+0x1c/0x28
      [    2.898703] [<ffffff80083c81ac>] register_framebuffer+0x1cc/0x2e0
      [    2.898712] [<ffffff800845da80>] drm_fb_helper_initial_config+0x288/0x3e8
      [    2.898719] [<ffffff800853da20>] nouveau_fbcon_init+0xe0/0x118
      [    2.898727] [<ffffff800852d2f8>] nouveau_drm_load+0x268/0x890
      [    2.898734] [<ffffff8008466e24>] drm_dev_register+0xbc/0xc8
      [    2.898740] [<ffffff8008468a88>] drm_get_pci_dev+0xa0/0x180
      [    2.898747] [<ffffff800852cb28>] nouveau_drm_probe+0x1a0/0x1e0
      [    2.898755] [<ffffff80083a32e0>] pci_device_probe+0x98/0x110
      [    2.898763] [<ffffff800858e434>] driver_probe_device+0x204/0x2b0
      [    2.898770] [<ffffff800858e58c>] __driver_attach+0xac/0xb0
      [    2.898777] [<ffffff800858c3e0>] bus_for_each_dev+0x60/0xa0
      [    2.898783] [<ffffff800858dbc0>] driver_attach+0x20/0x28
      [    2.898789] [<ffffff800858d7b0>] bus_add_driver+0x1d0/0x238
      [    2.898796] [<ffffff800858ed50>] driver_register+0x60/0xf8
      [    2.898802] [<ffffff80083a20dc>] __pci_register_driver+0x3c/0x48
      [    2.898809] [<ffffff8008468eb4>] drm_pci_init+0xf4/0x120
      [    2.898818] [<ffffff8008c56fc0>] nouveau_drm_init+0x21c/0x230
      [    2.898825] [<ffffff80080829d4>] do_one_initcall+0x8c/0x190
      [    2.898832] [<ffffff8008c31af4>] kernel_init_freeable+0x14c/0x1f0
      [    2.898839] [<ffffff80088a0c20>] kernel_init+0x10/0x100
      [    2.898845] [<ffffff8008085e10>] ret_from_fork+0x10/0x40
      [    2.898853] Code: a88120c7 a8c12027 a88120c7 a8c12027 (a88120c7)
      [    2.898871] ---[ end trace d5713dcad023ee04 ]---
      [    2.898888] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
      
      In a toss-up between the GPU seeing stale data artefacts on some systems
      vs. catastrophic kernel crashes on other systems, the latter would seem
      to take precedence, so revert this change until the real underlying
      problem can be fixed.
      Signed-off-by: default avatarRobin Murphy <robin.murphy@arm.com>
      Acked-by: default avatarAlexandre Courbot <acourbot@nvidia.com>
      [acourbot@nvidia.com: port to Nouveau tree, remove bits in lib/]
      Signed-off-by: default avatarAlexandre Courbot <acourbot@nvidia.com>
      Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      Cc: stable@vger.kernel.org
      539aae6e
    • Rex Zhu's avatar
    • Rex Zhu's avatar
      drm/amd/powerplay: update powerplay table parsing · 3ff21127
      Rex Zhu authored
      to handle pptable format change on Polaris boards
      Signed-off-by: default avatarRex Zhu <Rex.Zhu@amd.com>
      Reviewed-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      3ff21127
    • Andrey Grodzovsky's avatar
      drm/dp/mst: Always clear proposed vcpi table for port. · fd2d2bac
      Andrey Grodzovsky authored
      Not clearing mst manager's proposed vcpis table for destroyed connectors when the manager is stopped leaves it pointing to unrefernced memory, this causes pagefault when the manager is restarted when plugging back a branch.
      
      Fixes: 91a25e46 ("drm/dp/mst: deallocate payload on port destruction")
      Signed-off-by: default avatarAndrey Grodzovsky <Andrey.Grodzovsky@amd.com>
      Reviewed-by: default avatarLyude <cpaul@redhat.com>
      Cc: stable@vger.kernel.org
      Cc: Mykola Lysenko <Mykola.Lysenko@amd.com>
      Cc: Alex Deucher <alexander.deucher@amd.com>
      fd2d2bac
    • Philipp Zabel's avatar
      drm/crtc: only store the necessary data for set_config rollback · 93f55972
      Philipp Zabel authored
      drm_crtc_helper_set_config only potentially touches connector->encoder
      and encoder->crtc, so we only have to store those for all connectors
      and encoders, respectively.
      Suggested-by: default avatarDaniel Vetter <daniel@ffwll.ch>
      Signed-off-by: default avatarPhilipp Zabel <p.zabel@pengutronix.de>
      Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      93f55972
    • Philipp Zabel's avatar
      drm/crtc: fix connector reference counting mismatch in drm_crtc_helper_set_config · fffc5f59
      Philipp Zabel authored
      Since commit 0955c125 ("drm/crtc: take references to connectors used
      in a modeset. (v2)"), the reference counts of all connectors in the
      drm_mode_set given to drm_crtc_helper_set_config are incremented, and then
      the reference counts of all connectors are decremented on success, but in a
      temporary copy of the connector structure. This leads to the following
      error after the first modeset on imx-drm:
      
          Unable to handle kernel NULL pointer dereference at virtual address 00000004
          pgd = ad8c4000
          [00000004] *pgd=3d9c5831, *pte=00000000, *ppte=00000000
          Internal error: Oops: 817 [#1] PREEMPT SMP ARM
          Modules linked in:
          CPU: 1 PID: 190 Comm: kmsfb-manage Not tainted 4.7.0-rc1+ #657
          Hardware name: Freescale i.MX6 Quad/DualLit: [<80506098>]    lr : [<80252e94>]    psr: 200c0013
          sp : adca7ca8  ip : adca7b90  fp : adca7cd4
          r10: 00000000  r9 : 00000100  r8 : 00000200
          r7 : af3c9800  r6 : aded7848  r5 : aded7800  r4 : 00000000
          r3 : af3ca058  r2 : 00000200  r1 : af3ca058  r0 : 00000000
          Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
          Control: 10c5387d  Table: 3d8c404a  DAC: 00000051
          Process kmsfb-manage (pid: 190, stack limit = 0xadca6210)
          Stack: (0xadca7ca8 to 0xadca8000)
          7ca0:                   805190e0 aded7800 aded7820 80501a88 8155a290 af3c9c6c
          7cc0: adca7ddc 0000000f adca7cec adca7cd8 80519104 80506044 805190e0 aded7800
          7ce0: adca7d04 adca7cf0 80501ac0 805190ec aded7820 aded7814 adca7d24 adca7d08
          7d00: 804fdb80 80501a94 aded7800 af3ca010 aded7afc af3c9c60 adca7d94 adca7d28
          7d20: 804e3518 804fdb20 00000000 af3c9b1c adca7d50 81506f44 00000000 8093c500
          7d40: af3c9c6c ae4f2ca8 ae4f2c18 00000000 00000000 ae637f00 00000000 aded7800
          7d60: 00000001 af3c9800 af23c300 ae77fcc0 ae4f2c18 00000001 af3c9800 8155a290
          7d80: af1af700 adca6000 adca7db4 adca7d98 804fea6c 804e2de4 adca7e50 adb3d940
          7da0: 00000001 af3c9800 adca7e24 adca7db8 8050440c 804fea0c ae77fcc0 00000003
          7dc0: adca7e24 adb3d940 af1af700 ae77fcc0 ae77fccc ae4f2c18 8083d44c ae77fcc0
          7de0: ae4002 80d03040 adca7e64 adca7e40 adca7e50 80503f08
          7e40: 7ebd5630 adca7e50 00000068 c06864a2 7ebd5be8 00000000 00000001 00000018
          7e60: 00000026 00000000 00000000 00000000 00000001 000115bc 05010500 05a0059f
          7e80: 03200000 03360321 00000337 0000003c 00000000 00000040 30383231 30303878
          7ea0: 00000000 00000000 00000000 00000000 00000000 00000000 80173058 80172e30
          7ec0: 80d77d32 00004000 adf7d900 00000003 00000000 7ebd5630 af342bb0 adfe3b80
          7ee0: 80272f50 00000003 adca6000 00000000 adca7f7c adca7f00 802725ec 804f52cc
          7f00: 802809cc 80178450 00000000 00000000 80280880 80145904 adb3d8c0 adf7d990
          7f20: ffffffff 00000003 00004000 01614c10 c06864a2 00000003 adca6000 00000000
          7f40: adca7f6c adca7f50 80280b04 8028088c 000115bc adfe3b81 7ebd5630 adfe3b80
          7f60: c06864a2 00000003 adca6000 00000000 adca7fa4 adca7f80 80272f50 80272548
          7f80: 000115bc 00017050 00000001 01614c10 00000036 801089e4 00000000 adca7fa8
          7fa0: 80108840 80272f18 00017050 00000001 00000003 c06864a2 7ebd5630 000115bc
          7fc0: 00017050 00000001 01614c10 00000036 00000003 00000000 00000026 00000018
          7fe0: 00016f38 7ebd562c 0000b5e9 76ef31e6 400c0030 00000003 ff5f37db bfe7dd4d
          Backtrace:
          [<80506038>] (drm_connector_cleanup) from [<80519104>] (dw_hdmi_connector_destroy+0x24/0x28)
           r10:0000000f r9:adca7ddc r8:af3c9c6c r7:8155a290 r6:80501a88 r5:aded7820
           r4:aded7800 r3:805190e0
          [<805190e0>] (dw_hdmi_connector_destroy) from [<80501ac0>] (drm_connector_free+0x38/0x3c)
           r4:aded7800 nreference) from [<804e3518>] (drm_crtc_helper_set_config+0x740/0xbf4)
           r6:af3c9c60 r5:aded7afc r4:af3ca010 r3:aded7800
          [<804e2dd8>] (drm_crtc_helper_set_config) from [<804fea6c>] (drm_mode_set_config_internal+0x6c/0xf4)
           r10:adca6000 r9:af1af700 r8:8155a290 r7:af3c9800 r6:00000001 r5:ae4f2c18
           r4:ae77fcc0
          [<804fea00>] (drm_mode_set_config_internal) from [<8050440c>] (drm_mode_setcrtc+0x504/0x57c)
           r7:af3c9800 r6:00000001 r5:adb3d940 r4:adca7e50
          [<80503f08>] (drm_mode_setcrtc) from [<804f5404>] (drm_ioctl+0x144/0x4dc)
           r10:ada2e000 r9:000000a2 r8:af3c9800 r7:8155a290 r6:809320b4 r5:00000051
           r4:adca7e50
          [<804f52c0>] (drm_ioctl) from [<802725ec>] (do_vfs_ioctl+0xb0/0x9d0)
           r10:00000000 r9:adca6000 r8:00000003 r7:80272f50 r6:adfe3b80 r5:af342bb0
           r4:7ebd5630
          [<8027253c>] (do_vfs_ioctl) from [<80272f50>] (SyS_ioctl+0x44/0x6c)
           r10:00000000 r9:adca6000 r8:00000003 r7:c06864a2 r6:adfe3b80 r5:7ebd5630
           r4:adfe3b81
          [<80272f0c>] (SyS_ioctl) from [<80108840>] (ret_fast_syscall+0x0/0x1c)
           r8:801089e4 r7:00000036 r6:01614c10 r5:00000001 r4:00017050 r3:000115bc
          Code: 0a00000c e5932004 e1a01003 e1a0a004 (e5842004)
          ---[ end trace 9a7257572ccacb16 ]---
      
      Only the reference count of connectors that weren't previously bound to
      an encoder should be incremented after a call to drm_crtc_helper_set_config.
      And only the reference count of connectors that were previously bound to
      an encoder and are unbound afterwards should ever be decremented.
      The reference counts of the temporary copies in the save_connectors
      should not be touched at all.
      
      This patch fixes the above error by only incrementing the reference count
      of those connectors in the set that are initially not bound to any encoder,
      and also by restoring the reference count of only those connectors in the
      set in the failure case.
      
      "Note that this can only be hit when fbdev emulation is disabled, since
      then the refcount drops from 1 to 0 and we call the connector destroy
      functions on the backup copy, which eventually results in tears. With
      fbdev emulation the refcount only goes down from 2 to 1 ever. And since we
      unconditionally increment the refcount on the real object, the refcount of
      that will slowly increase. The backup connector's refcount doesn't matter,
      since we kfree() that either way in the end of
      drm_crtc_helper_set_config()."
      
      Fixes: 0955c125 ("drm/crtc: take references to connectors used in a modeset. (v2)")
      Signed-off-by: default avatarPhilipp Zabel <p.zabel@pengutronix.de>
      Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      fffc5f59
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2016-06-14' of git://anongit.freedesktop.org/drm-intel into drm-fixes · 902daaac
      Dave Airlie authored
      "Pretty much all regression fixes, or black screens."
      
      * tag 'drm-intel-fixes-2016-06-14' of git://anongit.freedesktop.org/drm-intel:
        drm/i915/ilk: Don't disable SSC source if it's in use
        drm/i915: Extract physical display dimensions from VBT
        drm/i915: Check VBT for port presence in addition to the strap on VLV/CHV
        drm/i915: Only ignore eDP ports that are connected
        drm/i915: Silence "unexpected child device config size" for VBT on 845g
        drm/i915: Fix NULL pointer deference when out of PLLs in IVB
      902daaac
  4. 14 Jun, 2016 6 commits
    • Lyude's avatar
      drm/i915/ilk: Don't disable SSC source if it's in use · 476490a9
      Lyude authored
      Thanks to Ville Syrjälä for pointing me towards the cause of this issue.
      
      Unfortunately one of the sideaffects of having the refclk for a DPLL set
      to SSC is that as long as it's set to SSC, the GPU will prevent us from
      powering down any of the pipes or transcoders using it. A couple of
      BIOSes enable SSC in both PCH_DREF_CONTROL and in the DPLL
      configurations. This causes issues on the first modeset, since we don't
      expect SSC to be left on and as a result, can't successfully power down
      the pipes or the transcoders using it. Here's an example from this Dell
      OptiPlex 990:
      
      [drm:intel_modeset_init] SSC enabled by BIOS, overriding VBT which says disabled
      [drm:intel_modeset_init] 2 display pipes available.
      [drm:intel_update_cdclk] Current CD clock rate: 400000 kHz
      [drm:intel_update_max_cdclk] Max CD clock rate: 400000 kHz
      [drm:intel_update_max_cdclk] Max dotclock rate: 360000 kHz
      vgaarb: device changed decodes: PCI:0000:00:02.0,olddecodes=io+mem,decodes=io+mem:owns=io+mem
      [drm:intel_crt_reset] crt adpa set to 0xf40000
      [drm:intel_dp_init_connector] Adding DP connector on port C
      [drm:intel_dp_aux_init] registering DPDDC-C bus for card0-DP-1
      [drm:ironlake_init_pch_refclk] has_panel 0 has_lvds 0 has_ck505 0
      [drm:ironlake_init_pch_refclk] Disabling SSC entirely
      … later we try committing the first modeset …
      [drm:intel_dump_pipe_config] [CRTC:26][modeset] config ffff88041b02e800 for pipe A
      [drm:intel_dump_pipe_config] cpu_transcoder: A
      …
      [drm:intel_dump_pipe_config] dpll_hw_state: dpll: 0xc4016001, dpll_md: 0x0, fp0: 0x20e08, fp1: 0x30d07
      [drm:intel_dump_pipe_config] planes on this crtc
      [drm:intel_dump_pipe_config] STANDARD PLANE:23 plane: 0.0 idx: 0 enabled
      [drm:intel_dump_pipe_config]     FB:42, fb = 800x600 format = 0x34325258
      [drm:intel_dump_pipe_config]     scaler:0 src (0, 0) 800x600 dst (0, 0) 800x600
      [drm:intel_dump_pipe_config] CURSOR PLANE:25 plane: 0.1 idx: 1 disabled, scaler_id = 0
      [drm:intel_dump_pipe_config] STANDARD PLANE:27 plane: 0.1 idx: 2 disabled, scaler_id = 0
      [drm:intel_get_shared_dpll] CRTC:26 allocated PCH DPLL A
      [drm:intel_get_shared_dpll] using PCH DPLL A for pipe A
      [drm:ilk_audio_codec_disable] Disable audio codec on port C, pipe A
      [drm:intel_disable_pipe] disabling pipe A
      ------------[ cut here ]------------
      WARNING: CPU: 1 PID: 130 at drivers/gpu/drm/i915/intel_display.c:1146 intel_disable_pipe+0x297/0x2d0 [i915]
      pipe_off wait timed out
      …
      ---[ end trace 94fc8aa03ae139e8 ]---
      [drm:intel_dp_link_down]
      [drm:ironlake_crtc_disable [i915]] *ERROR* failed to disable transcoder A
      
      Later modesets succeed since they reset the DPLL's configuration anyway,
      but this is enough to get stuck with a big fat warning in dmesg.
      
      A better solution would be to add refcounts for the SSC source, but for
      now leaving the source clock on should suffice.
      
      Changes since v4:
       - Fix calculation of final for systems with LVDS panels (fixes BUG() on
         CI test suite)
      Changes since v3:
       - Move temp variable into loop
       - Move checks for using_ssc_source to after we've figured out has_ck505
       - Add using_ssc_source to debug output
      Changes since v2:
       - Fix debug output for when we disable the CPU source
      Changes since v1:
       - Leave the SSC source clock on instead of just shutting it off on all
         of the DPLL configurations.
      
      Cc: stable@vger.kernel.org
      Reviewed-by: default avatarVille Syrjälä <ville.syrjala@linux.intel.com>
      Signed-off-by: default avatarLyude <cpaul@redhat.com>
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Link: http://patchwork.freedesktop.org/patch/msgid/1465916649-10228-1-git-send-email-cpaul@redhat.comSigned-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      476490a9
    • Geert Uytterhoeven's avatar
      nfsd: Fix NFSD_MDS_PR_KEY on 32-bit by adding ULL postfix · eee93016
      Geert Uytterhoeven authored
      On 32-bit:
      
          fs/nfsd/blocklayout.c: In function ‘nfsd4_block_get_device_info_scsi’:
          fs/nfsd/blocklayout.c:337: warning: integer constant is too large for ‘long’ type
          fs/nfsd/blocklayout.c:344: warning: integer constant is too large for ‘long’ type
          fs/nfsd/blocklayout.c: In function ‘nfsd4_scsi_fence_client’:
          fs/nfsd/blocklayout.c:385: warning: integer constant is too large for ‘long’ type
      
      Add the missing "ULL" postfix to 64-bit constant NFSD_MDS_PR_KEY to fix
      this.
      
      Fixes: f99d4fbd ("nfsd: add SCSI layout support")
      Signed-off-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
      eee93016
    • Paolo Bonzini's avatar
      Merge branch 'kvm-mips-fixes' into HEAD · 0699fdb3
      Paolo Bonzini authored
      Merge MIPS patches destined to both 4.7 and kvm/next, to avoid
      unnecessary conflicts.
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      0699fdb3
    • James Hogan's avatar
      MIPS: KVM: Fix CACHE triggered exception emulation · 6df82a7b
      James Hogan authored
      When emulating TLB miss / invalid exceptions during CACHE instruction
      emulation, be sure to set up the correct PC and host_cp0_badvaddr state
      for the kvm_mips_emlulate_tlb*_ld() function to pick up for guest EPC
      and BadVAddr.
      
      PC needs to be rewound otherwise the guest EPC will end up pointing at
      the next instruction after the faulting CACHE instruction.
      
      host_cp0_badvaddr must be set because guest CACHE instructions trap with
      a Coprocessor Unusable exception, which doesn't update the host BadVAddr
      as a TLB exception would.
      
      This doesn't tend to get hit when dynamic translation of emulated
      instructions is enabled, since only the first execution of each CACHE
      instruction actually goes through this code path, with subsequent
      executions hitting the SYNCI instruction that it gets replaced with.
      Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Radim Krčmář <rkrcmar@redhat.com>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: kvm@vger.kernel.org
      Cc: linux-mips@linux-mips.org
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      6df82a7b
    • James Hogan's avatar
      MIPS: KVM: Don't unwind PC when emulating CACHE · cc81e948
      James Hogan authored
      When a CACHE instruction is emulated by kvm_mips_emulate_cache(), the PC
      is first updated to point to the next instruction, and afterwards it
      falls through the "dont_update_pc" label, which rewinds the PC back to
      its original address.
      
      This works when dynamic translation of emulated instructions is enabled,
      since the CACHE instruction is replaced with a SYNCI which works without
      trapping, however when dynamic translation is disabled the guest hangs
      on CACHE instructions as they always trap and are never stepped over.
      
      Roughly swap the meanings of the "done" and "dont_update_pc" to match
      kvm_mips_emulate_CP0(), so that "done" will roll back the PC on failure,
      and "dont_update_pc" won't change PC at all (for the sake of exceptions
      that have already modified the PC).
      Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Radim Krčmář <rkrcmar@redhat.com>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: kvm@vger.kernel.org
      Cc: linux-mips@linux-mips.org
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      cc81e948
    • James Hogan's avatar
      MIPS: KVM: Include bit 31 in segment matches · 7f5a1ddc
      James Hogan authored
      When faulting guest addresses are matched against guest segments with
      the KVM_GUEST_KSEGX() macro, change the mask to 0xe0000000 so as to
      include bit 31.
      
      This is mainly for safety's sake, as it prevents a rogue BadVAddr in the
      host kseg2/kseg3 segments (e.g. 0xC*******) after a TLB exception from
      matching the guest kseg0 segment (e.g. 0x4*******), triggering an
      internal KVM error instead of allowing the corresponding guest kseg0
      page to be mapped into the host vmalloc space.
      
      Such a rogue BadVAddr was observed to happen with the host MIPS kernel
      running under QEMU with KVM built as a module, due to a not entirely
      transparent optimisation in the QEMU TLB handling. This has already been
      worked around properly in a previous commit.
      Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Radim Krčmář <rkrcmar@redhat.com>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: kvm@vger.kernel.org
      Cc: linux-mips@linux-mips.org
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      7f5a1ddc