1. 26 Apr, 2017 6 commits
    • Chris Wilson's avatar
      drm/i915: Fix use after free in lpe_audio_platdev_destroy() · dde7b00e
      Chris Wilson authored
      [31908.547136] BUG: KASAN: use-after-free in intel_lpe_audio_teardown+0x78/0xb0 [i915] at addr ffff8801f7788358
      [31908.547297] Read of size 8 by task drv_selftest/3781
      [31908.547405] CPU: 0 PID: 3781 Comm: drv_selftest Tainted: G    BU  W       4.10.0+ #451
      [31908.547553] Hardware name:                  /        , BIOS PYBSWCEL.86A.0027.2015.0507.1758 05/07/2015
      [31908.547682] Call Trace:
      [31908.547772]  dump_stack+0x68/0x9f
      [31908.547857]  kasan_object_err+0x1c/0x70
      [31908.547947]  kasan_report_error+0x1f1/0x4f0
      [31908.548038]  ? kfree+0xaa/0x170
      [31908.548121]  kasan_report+0x34/0x40
      [31908.548211]  ? klist_children_get+0x20/0x30
      [31908.548472]  ? intel_lpe_audio_teardown+0x78/0xb0 [i915]
      [31908.548567]  __asan_load8+0x5e/0x70
      [31908.548824]  intel_lpe_audio_teardown+0x78/0xb0 [i915]
      [31908.549080]  intel_audio_deinit+0x28/0x80 [i915]
      [31908.549315]  i915_driver_unload+0xe4/0x360 [i915]
      [31908.549551]  ? i915_driver_load+0x1d70/0x1d70 [i915]
      [31908.549651]  ? trace_hardirqs_on+0xd/0x10
      [31908.549885]  i915_pci_remove+0x23/0x30 [i915]
      [31908.549978]  pci_device_remove+0x5c/0x100
      [31908.550069]  device_release_driver_internal+0x1db/0x2e0
      [31908.550165]  driver_detach+0x68/0xc0
      [31908.550256]  bus_remove_driver+0x8b/0x150
      [31908.550346]  driver_unregister+0x3e/0x60
      [31908.550439]  pci_unregister_driver+0x1d/0x110
      [31908.550531]  ? find_module_all+0x7a/0xa0
      [31908.550791]  i915_exit+0x1a/0x87 [i915]
      [31908.550881]  SyS_delete_module+0x264/0x2c0
      [31908.550971]  ? free_module+0x430/0x430
      [31908.551064]  ? trace_hardirqs_off_caller+0x16/0x110
      [31908.551159]  ? trace_hardirqs_on_caller+0x16/0x280
      [31908.551256]  ? trace_hardirqs_on_thunk+0x1a/0x1c
      [31908.551350]  entry_SYSCALL_64_fastpath+0x1c/0xb1
      [31908.551440] RIP: 0033:0x7f1d67312ec7
      [31908.551520] RSP: 002b:00007ffebe34e888 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
      [31908.551650] RAX: ffffffffffffffda RBX: ffffffff811123f6 RCX: 00007f1d67312ec7
      [31908.551743] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 0000560d0af476b8
      [31908.551837] RBP: ffff880233d87f98 R08: 0000000000000000 R09: 00007ffebe34e8b8
      [31908.551930] R10: 00007f1d68adf8c0 R11: 0000000000000206 R12: 0000000000000000
      [31908.552023] R13: 0000560d0af46440 R14: 0000000000000034 R15: 00007ffebe34d860
      [31908.552121]  ? trace_hardirqs_off_caller+0x16/0x110
      [31908.552217] Object at ffff8801f7788000, in cache kmalloc-2048 size: 2048
      [31908.552306] Allocated:
      [31908.552377] PID = 3781
      [31908.552456]  save_stack_trace+0x16/0x20
      [31908.552539]  kasan_kmalloc+0xee/0x190
      [31908.552627]  __kmalloc+0xdb/0x1b0
      [31908.552713]  platform_device_alloc+0x27/0x90
      [31908.552804]  platform_device_register_full+0x36/0x220
      [31908.553066]  intel_lpe_audio_init+0x41e/0x570 [i915]
      [31908.553320]  intel_audio_init+0xd/0x40 [i915]
      [31908.553552]  i915_driver_load+0x13f5/0x1d70 [i915]
      [31908.553788]  i915_pci_probe+0x65/0xe0 [i915]
      [31908.553881]  pci_device_probe+0xda/0x140
      [31908.553969]  driver_probe_device+0x400/0x660
      [31908.554058]  __driver_attach+0x11c/0x120
      [31908.554147]  bus_for_each_dev+0xe6/0x150
      [31908.554237]  driver_attach+0x26/0x30
      [31908.554325]  bus_add_driver+0x26b/0x3b0
      [31908.554412]  driver_register+0xce/0x190
      [31908.554502]  __pci_register_driver+0xaf/0xc0
      [31908.554589]  0xffffffffa0550063
      [31908.554675]  do_one_initcall+0x8b/0x1e0
      [31908.554764]  do_init_module+0x102/0x325
      [31908.554852]  load_module+0x3aad/0x45e0
      [31908.554944]  SyS_finit_module+0x169/0x1a0
      [31908.555033]  entry_SYSCALL_64_fastpath+0x1c/0xb1
      [31908.555119] Freed:
      [31908.555188] PID = 3781
      [31908.555266]  save_stack_trace+0x16/0x20
      [31908.555349]  kasan_slab_free+0xb0/0x180
      [31908.555436]  kfree+0xaa/0x170
      [31908.555520]  platform_device_release+0x76/0x80
      [31908.555610]  device_release+0x45/0xe0
      [31908.555698]  kobject_put+0x11f/0x260
      [31908.555785]  put_device+0x12/0x20
      [31908.555871]  platform_device_unregister+0x1b/0x20
      [31908.556135]  intel_lpe_audio_teardown+0x5c/0xb0 [i915]
      [31908.556390]  intel_audio_deinit+0x28/0x80 [i915]
      [31908.556622]  i915_driver_unload+0xe4/0x360 [i915]
      [31908.556858]  i915_pci_remove+0x23/0x30 [i915]
      [31908.556948]  pci_device_remove+0x5c/0x100
      [31908.557037]  device_release_driver_internal+0x1db/0x2e0
      [31908.557129]  driver_detach+0x68/0xc0
      [31908.557217]  bus_remove_driver+0x8b/0x150
      [31908.557304]  driver_unregister+0x3e/0x60
      [31908.557394]  pci_unregister_driver+0x1d/0x110
      [31908.557653]  i915_exit+0x1a/0x87 [i915]
      [31908.557741]  SyS_delete_module+0x264/0x2c0
      [31908.557834]  entry_SYSCALL_64_fastpath+0x1c/0xb1
      [31908.557919] Memory state around the buggy address:
      [31908.558005]  ffff8801f7788200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [31908.558127]  ffff8801f7788280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [31908.558255] >ffff8801f7788300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [31908.558374]                                                     ^
      [31908.558467]  ffff8801f7788380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [31908.558595]  ffff8801f7788400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      
      v2: Just leak the memory (8 bytes) as freeing it ourselves is not safe,
      and we need to coordinate a proper fix in platform_device itself.
      
      Fixes: eef57324 ("drm/i915: setup bridge for HDMI LPE audio driver")
      Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=99952Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
      Cc: Jerome Anand <jerome.anand@intel.com>
      Cc: Jani Nikula <jani.nikula@intel.com>
      Cc: Takashi Iwai <tiwai@suse.de>
      Link: http://patchwork.freedesktop.org/patch/msgid/20170412080251.30648-1-chris@chris-wilson.co.ukReviewed-by: default avatarTakashi Iwai <tiwai@suse.de>
      Reviewed-by: default avatarVille Syrjälä <ville.syrjala@linux.intel.com>
      (cherry picked from commit 48ae8074)
      Signed-off-by: default avatarJani Nikula <jani.nikula@intel.com>
      dde7b00e
    • Chris Wilson's avatar
      drm/i915: Use the right mapping_gfp_mask for final shmem allocation · bdb57b8d
      Chris Wilson authored
      Many sightings report the greater prevalence of allocation failures.
      This is all due to the incorrect use of mapping_gfp_constraint(), so
      remove it in favour of just querying the mapping_gfp_mask() which are
      the exact gfp_t we wanted in the first place.
      
      We still do expect a higher chance of reporting ENOMEM, as that is the
      intention of using __GFP_NORETRY -- to fail rather than oom after having
      reclaimed from our bo caches, and having done a direct|kswapd reclaim
      pass.
      Reported-by: default avatarJason Ekstrand <jason.ekstrand@intel.com>
      Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=100594
      Fixes: 24f8e00a ("drm/i915: Prefer to report ENOMEM rather than incur the oom for gfx allocations")
      Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
      Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
      Link: http://patchwork.freedesktop.org/patch/msgid/20170405221514.23251-1-chris@chris-wilson.co.ukReviewed-by: default avatarJoonas Lahtinen <joonas.lahtinen@linux.intel.com>
      (cherry picked from commit b268d9fe)
      Signed-off-by: default avatarJani Nikula <jani.nikula@intel.com>
      bdb57b8d
    • Ville Syrjälä's avatar
      drm/i915: Make legacy cursor updates more unsynced · 440df938
      Ville Syrjälä authored
      We're clearing the legacy_cursor_update flag before calling
      drm_atomic_helper_setup_commit() which means the helper will
      wait for the flip to complete before cleaning up the framebuffers.
      That's not what we want for the legacy cursor, so let's clear
      the flag after setting up the commit.
      
      Also toss in a FIXME about solving these problems in a nicer
      way using the fabled vblank workers.
      
      v2: Also unsync with legacy page flips
      
      Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
      Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
      Cc: Uwe Kleine-König <uwe@kleine-koenig.org>
      Cc: Rafael Ristovski <rafael.ristovski@gmail.com>
      Fixes: a5509abd ("drm/i915: Fix legacy cursor vs. watermarks for ILK-BDW")
      Signed-off-by: default avatarVille Syrjälä <ville.syrjala@linux.intel.com>
      Link: http://patchwork.freedesktop.org/patch/msgid/20170329142123.5923-1-ville.syrjala@linux.intel.comReviewed-by: default avatarMaarten Lankhorst <maarten.lankhorst@linux.intel.com>
      (cherry picked from commit 89520304)
      Signed-off-by: default avatarJani Nikula <jani.nikula@intel.com>
      440df938
    • Chris Wilson's avatar
      drm/i915: Apply a cond_resched() to the saturated signaler · d445aaaa
      Chris Wilson authored
      If the engine is continually completing nops, we can saturate the
      signaler and keep it working indefinitely. This angers the NMI watchdog!
      
      A good example is to disable semaphores on snb and run igt/gem_exec_nop -
      the parallel, multi-engine workloads are more than sufficient to hog the
      CPU, preventing the system from even processing ICMP echo replies.
      
      v2: Tvrtko dug into cond_resched() on x86 and found that it only
      depended upon preempt_count and not tif_need_resched() - which means
      that we would always call schedule() at that point.
      
      Fixes: c81d4613 ("drm/i915: Convert trace-irq to the breadcrumb waiter")
      Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Mika Kuoppala <mika.kuoppala@intel.com>
      Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
      Link: http://patchwork.freedesktop.org/patch/msgid/20170404120531.10737-1-chris@chris-wilson.co.ukReviewed-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
      (cherry picked from commit a7980a64)
      Signed-off-by: default avatarJani Nikula <jani.nikula@intel.com>
      d445aaaa
    • Chris Wilson's avatar
      drm/i915: Park the signaler before sleeping · 1676a2b3
      Chris Wilson authored
      If the signal to park arrives before we sleep, then we need to check
      kthread_should_park() before sleeping to avoid missing the signal.
      Otherwise, if the signal arrives whilst we are processing completed
      requests, we will reset the current->state back to TASK_INTERRUPTIBLE
      and so miss the wakeup.
      
      Fixes: fe3288b5 ("drm/i915: Park the breadcrumbs signaler across a GPU reset")
      Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Mika Kuoppala <mika.kuoppala@intel.com>
      Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
      Link: http://patchwork.freedesktop.org/patch/msgid/20170403105124.8969-1-chris@chris-wilson.co.ukReviewed-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
      (cherry picked from commit b1becb88)
      Signed-off-by: default avatarJani Nikula <jani.nikula@intel.com>
      1676a2b3
    • Jani Nikula's avatar
      Merge tag 'gvt-next-fixes-2017-04-20' of https://github.com/01org/gvt-linux... · f8a77153
      Jani Nikula authored
      Merge tag 'gvt-next-fixes-2017-04-20' of https://github.com/01org/gvt-linux into drm-intel-next-fixes
      
      gvt-next-fixes-2017-04-20
      
      - some code optimization from Changbin
      - debug message cleanup after QoS merge
      - misc fixes for display mmio init, reset vgpu warning, etc.
      Signed-off-by: default avatarJani Nikula <jani.nikula@intel.com>
      f8a77153
  2. 18 Apr, 2017 1 commit
  3. 13 Apr, 2017 2 commits
    • Zhenyu Wang's avatar
      drm/i915/gvt: Fix PTE write flush for taking runtime pm properly · 5ad59bf0
      Zhenyu Wang authored
      Make sure to take runtime pm when write PTE flush which ensure to
      write to hw properly. This fixes warning during mdev/vgpu creation
      which will do ggtt reset.
      
      ------------[ cut here ]------------
      WARNING: CPU: 1 PID: 9375 at drivers/gpu/drm/i915/intel_drv.h:1748 fwtable_write32+0x1c2/0x1e0 [i915]
       RPM wakelock ref not held during HW access
      Call Trace:
        ? dump_stack+0x5c/0x81
        ? __warn+0xbe/0xe0
        ? warn_slowpath_fmt+0x5a/0x80
        ? wake_up_klogd+0x37/0x40
        ? vprintk_emit+0x2ef/0x370
        ? fwtable_write32+0x1c2/0x1e0 [i915]
        ? gtt_set_entry64+0xbb/0xd0 [i915]
        ? intel_vgpu_reset_ggtt+0x88/0xf0 [i915]
        ? intel_vgpu_init_gtt+0xa5/0x4f0 [i915]
        ? intel_gvt_create_vgpu+0x1b5/0x250 [i915]
        ? kobject_put+0x1b/0x50
        ? intel_vgpu_create+0x4e/0x130 [kvmgt]
        ? mdev_device_create+0x186/0x2a0 [mdev]
        ? create_store+0xba/0xe0 [mdev]
        ? create_store+0xba/0xe0 [mdev]
        ? kernfs_fop_write+0x109/0x1a0
        ? kernfs_fop_write+0x109/0x1a0
        ? __vfs_write+0x33/0x160
        ? __fput+0x161/0x1d0
        ? vfs_write+0xb0/0x190
        ? SyS_write+0x52/0xc0
        ? exit_to_usermode_loop+0x7a/0xa0
        ? entry_SYSCALL_64_fastpath+0x1e/0xad
      
      v2: remove unrelated oops info
      
      v3: change to take runtime pm for ggtt reset instead of get/put for
          each pte write flush
      
      Fixes: d650ac06 ("drm/i915/gvt: reset the GGTT entry when vGPU created")
      Cc: Ping Gao <ping.a.gao@intel.com>
      Signed-off-by: default avatarZhenyu Wang <zhenyuw@linux.intel.com>
      5ad59bf0
    • Zhenyu Wang's avatar
      drm/i915/gvt: remove some debug messages in scheduler timer handler · 954180aa
      Zhenyu Wang authored
      As those debug messages might appear in every timer call for scheduler,
      it's too noisy, eat too much log and aren't meaningful. So remove them.
      
      Cc: Ping Gao <ping.a.gao@intel.com>
      Signed-off-by: default avatarZhenyu Wang <zhenyuw@linux.intel.com>
      954180aa
  4. 12 Apr, 2017 6 commits
  5. 10 Apr, 2017 6 commits
    • Dave Airlie's avatar
      Merge branch 'msm-next' of git://people.freedesktop.org/~robclark/linux into drm-next · d455937e
      Dave Airlie authored
      Noteworthy changes this time:
      1) 4k support for newer chips (ganging up hwpipes and mixers)
      2) using OPP bindings for gpu
      3) more prep work towards per-process pagetables
      
      * 'msm-next' of git://people.freedesktop.org/~robclark/linux: (47 commits)
        msm/drm: gpu: Dynamically locate the clocks from the device tree
        drm/msm: gpu: Use OPP tables if we can
        drm/msm: Hard code the GPU "slow frequency"
        drm/msm: Add MSM_PARAM_GMEM_BASE
        drm/msm: Reference count address spaces
        drm/msm: Make sure to detach the MMU during GPU cleanup
        drm/msm/mdp5: Enable 3D mux in mdp5_ctl
        drm/msm/mdp5: Reset CTL blend registers before configuring them
        drm/msm/mdp5: Assign 'right' mixer to CRTC state
        drm/msm/mdp5: Stage border out on base stage if CRTC has 2 LMs
        drm/msm/mdp5: Stage right side hwpipes on Right-side Layer Mixer
        drm/msm/mdp5: Prepare Layer Mixers for source split
        drm/msm/mdp5: Configure 'right' hwpipe
        drm/msm/mdp5: Assign a 'right hwpipe' to plane state
        drm/msm/mdp5: Create mdp5_hwpipe_mode_set
        drm/msm/mdp5: Add optional 'right' Layer Mixer in CRTC state
        drm/msm/mdp5: Add a CAP for Source Split
        drm/msm/mdp5: Remove mixer/intf pointers from mdp5_ctl
        drm/msm/mdp5: Start using parameters from CRTC state
        drm/msm/mdp5: Add more stuff to CRTC state
        ...
      d455937e
    • Dave Airlie's avatar
      Merge tag 'drm-misc-next-2017-04-07' of git://anongit.freedesktop.org/git/drm-misc into drm-next · df45eaca
      Dave Airlie authored
      Last drm-misc-next pull req for 4.12
      
      Core changes:
       - fb_helper checkpatch cleanup and simplified _add_one_connector() (Thierry)
       - drm_ioctl and drm_sysfs improved/gained documentation (Daniel)
       - [ABI] Repurpose reserved field in drm_event_vblank for crtc_id (Ander)
       - Plumb acquire ctx through legacy paths to avoid lock_all and legacy_backoff
         (Daniel)
       - Add connector_atomic_check to check conn constraints on modeset (Maarten)
       - Add drm_of_find_panel_or_bridge to remove boilerplate in drivers (Rob)
      
      Driver changes:
       - meson moved to drm-misc (Neil)
       - Added support for Amlogic GX SoCs in dw-hdmi (Neil)
       - Rockchip unbind actually cleans up the things bind initializes (Jeffy)
       - A couple misc fixes in virtio, dw-hdmi
      
      NOTE: this also includes a backmerge of drm-next as well rc5 (we needed vmwgfx
            as well as the new synopsys media formats)
      
      * tag 'drm-misc-next-2017-04-07' of git://anongit.freedesktop.org/git/drm-misc: (77 commits)
        Revert "drm: Don't allow interruptions when opening debugfs/crc"
        drm: Only take cursor locks when the cursor plane exists
        drm/vmwgfx: Fix fbdev emulation using legacy functions
        drm/rockchip: Shutdown all crtcs when unbinding drm
        drm/rockchip: Reorder drm bind/unbind sequence
        drm/rockchip: analogix_dp: Disable clock when unbinding
        drm/rockchip: vop: Unprepare clocks when unbinding
        drm/rockchip: vop: Enable pm domain before vop_initial
        drm/rockchip: cdn-dp: Don't unregister audio dev when unbinding
        drm/rockchip: cdn-dp: Don't try to release firmware when not loaded
        drm: bridge: analogix: Destroy connector & encoder when unbinding
        drm: bridge: analogix: Disable clock when unbinding
        drm: bridge: analogix: Unregister dp aux when unbinding
        drm: bridge: analogix: Detach panel when unbinding analogix dp
        drm: Don't allow interruptions when opening debugfs/crc
        drm/virtio: don't leak bo on drm_gem_object_init failure
        drm: bridge: dw-hdmi: fix input format/encoding from plat_data
        drm: omap: use common OF graph helpers
        drm: convert drivers to use drm_of_find_panel_or_bridge
        drm: convert drivers to use of_graph_get_remote_node
        ...
      df45eaca
    • Dave Airlie's avatar
      Backmerge tag 'v4.11-rc6' into drm-next · b769fefb
      Dave Airlie authored
      Linux 4.11-rc6
      
      drm-misc needs 4.11-rc5, may as well fix conflicts with rc6.
      b769fefb
    • Dave Airlie's avatar
      Merge branch 'drm-next-4.12' of git://people.freedesktop.org/~agd5f/linux into drm-next · 1420f63b
      Dave Airlie authored
      Just some bug fixes and vega10 updates for 4.12.
      
      * 'drm-next-4.12' of git://people.freedesktop.org/~agd5f/linux:
        drm/amdgpu: fix fence memory leak in wait_all_fence V2
        drm/amdgpu: fix "fix 64bit division"
        drm/amd/powerplay: add fan controller table v11 support.
        drm/amd/powerplay: port newest process pptable code for vega10.
        drm/amdgpu: set vm size and block size by individual gmc by default (v3)
        drm/amdgpu: Avoid overflows/divide-by-zero in latency_watermark calculations.
        drm/amdgpu: Make display watermark calculations more accurate
        drm/radeon: fix typo in bandwidth calculation
        drm/radeon: Refuse to migrate a prime BO to VRAM. (v2)
        drm/radeon: Maintain prime import/export refcount for BOs
        drm/amdgpu: Refuse to pin or change acceptable domains of prime BOs to VRAM. (v2)
        drm/amdgpu: Fail fb creation from imported dma-bufs. (v2)
        drm/radeon: Fail fb creation from imported dma-bufs.
      1420f63b
    • Dave Airlie's avatar
      Merge tag 'drm-intel-testing-2017-04-03' of... · 2b2fc72a
      Dave Airlie authored
      Merge tag 'drm-intel-testing-2017-04-03' of git://anongit.freedesktop.org/git/drm-intel into drm-next
      
      Last 4.12 feature pile:
      
      GVT updates:
      - Add mdev attribute group for per-vgpu info
      - Time slice based vGPU scheduling QoS support (Gao Ping)
      - Initial KBL support for E3 server (Han Xu)
      - other misc.
      
      i915:
      - lots and lots of small fixes and improvements all over
      - refactor fw_domain code (Chris Wilson)
      - improve guc code (Oscar Mateo)
      - refactor cursor/sprite code, precompute more for less overhead in
        the critical path (Ville)
      - refactor guc/huc fw loading code a bit (Michal Wajdeczko)
      
      * tag 'drm-intel-testing-2017-04-03' of git://anongit.freedesktop.org/git/drm-intel: (121 commits)
        drm/i915: Update DRIVER_DATE to 20170403
        drm/i915: Clear gt.active_requests before checking idle status
        drm/i915/uc: Drop use of MISSING_CASE on trivial enums
        drm/i915: make a few DDI functions static
        drm/i915: Combine reset_all_global_seqno() loops into one
        drm/i915: Remove redudant wait for each engine to idle from seqno wrap
        drm/i915: Wait for all engines to be idle as part of i915_gem_wait_for_idle()
        drm/i915: Move retire-requests into i915_gem_wait_for_idle()
        drm/i915/uc: Move fw path check to fetch_uc_fw()
        drm/i915/huc: Remove unused intel_huc_fini()
        drm/i915/uc: Add intel_uc_fw_fini()
        drm/i915/uc: Add intel_uc_fw_type_repr()
        drm/i915/uc: Move intel_uc_fw_status_repr() to intel_uc.h
        drivers: gpu: drm: i915L intel_lpe_audio: Fix kerneldoc comments
        drm/i915: Suppress busy status for engines if wedged
        drm/i915: Do request retirement before marking engines as wedged
        drm/i915: Drop verbose and archaic "ring" from our internal engine names
        drm/i915: Use a dummy timeline name for a signaled fence
        drm/i915: Ironlake do_idle_maps w/a may be called w/o struct_mutex
        drm/i915/guc: Take enable_guc_loading check out of GEM core code
        ...
      2b2fc72a
    • Dave Airlie's avatar
      Merge branch 'drm-next-4.12' of https://github.com/ckhu-mediatek/linux.git-tags into drm-next · cdf5316b
      Dave Airlie authored
      This series is MT2701 DRM support.
      
      * 'drm-next-4.12' of https://github.com/ckhu-mediatek/linux.git-tags:
        drm/mediatek: add support for Mediatek SoC MT2701
        drm/mediatek: update DSI sub driver flow for sending commands to panel
        drm/mediatek: add non-continuous clock mode and EOT packet control
        drm/mediatek: add dsi transfer function
        drm/mediatek: add dsi interrupt control
        drm/mediatek: cleaning up and refine
        drm/mediatek: update display module connections
        drm/mediatek: add BLS component
        drm/mediatek: add shadow register support
        drm/mediatek: add *driver_data for different hardware settings
        drm/mediatek: add helpers for coverting from the generic components
        dt-bindings: display: mediatek: update supported chips
      cdf5316b
  6. 09 Apr, 2017 6 commits
    • Linus Torvalds's avatar
      Linux 4.11-rc6 · 39da7c50
      Linus Torvalds authored
      39da7c50
    • Linus Torvalds's avatar
      Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6 · 84ced7fd
      Linus Torvalds authored
      Pull CIFS fixes from Steve French:
       "This is a set of CIFS/SMB3 fixes for stable.
      
        There is another set of four SMB3 reconnect fixes for stable in
        progress but they are still being reviewed/tested, so didn't want to
        wait any longer to send these five below"
      
      * 'for-next' of git://git.samba.org/sfrench/cifs-2.6:
        Reset TreeId to zero on SMB2 TREE_CONNECT
        CIFS: Fix build failure with smb2
        Introduce cifs_copy_file_range()
        SMB3: Rename clone_range to copychunk_range
        Handle mismatched open calls
      84ced7fd
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm · 462e9a35
      Linus Torvalds authored
      Pull ARM fixes from Russell King:
       "A number of ARM fixes:
      
         - prevent oopses caused by dma_get_sgtable() and declared DMA
           coherent memory
      
         - fix boot failure on nommu caused by ID_PFR1 access
      
         - a number of kprobes fixes from Jon Medhurst and Masami Hiramatsu"
      
      * 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm:
        ARM: 8665/1: nommu: access ID_PFR1 only if CPUID scheme
        ARM: dma-mapping: disallow dma_get_sgtable() for non-kernel managed memory
        arm: kprobes: Align stack to 8-bytes in test code
        arm: kprobes: Fix the return address of multiple kretprobes
        arm: kprobes: Skip single-stepping in recursing path if possible
        arm: kprobes: Allow to handle reentered kprobe on single-stepping
      462e9a35
    • Linus Torvalds's avatar
      Merge tag 'driver-core-4.11-rc6' of... · 5b50be74
      Linus Torvalds authored
      Merge tag 'driver-core-4.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core
      
      Pull driver core fixes from Greg KH:
       "Here are 3 small fixes for 4.11-rc6.
      
        One resolves a reported issue with sysfs files that NeilBrown found,
        one is a documenatation fix for the stable kernel rules, and the last
        is a small MAINTAINERS file update for kernfs"
      
      * tag 'driver-core-4.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
        MAINTAINERS: separate out kernfs maintainership
        sysfs: be careful of error returns from ops->show()
        Documentation: stable-kernel-rules: fix stable-tag format
      5b50be74
    • Linus Torvalds's avatar
      Merge tag 'staging-4.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · 62e1fd08
      Linus Torvalds authored
      Pull staging/IIO driver rfixes from Greg KH:
       "Here are a number of small IIO and staging driver fixes for 4.11-rc6.
        Nothing big here, just iio fixes for reported issues, and an ashmem
        fix for a very old bug that has been reported by a number of Android
        vendors"
      
      * tag 'staging-4.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        staging: android: ashmem: lseek failed due to no FMODE_LSEEK.
        iio: hid-sensor-attributes: Fix sensor property setting failure.
        iio: accel: hid-sensor-accel-3d: Fix duplicate scan index error
        iio: core: Fix IIO_VAL_FRACTIONAL_LOG2 for negative values
        iio: st_pressure: initialize lps22hb bootime
        iio: bmg160: reset chip when probing
        iio: cros_ec_sensors: Fix return value to get raw and calibbias data.
      62e1fd08
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 2a610b8a
      Linus Torvalds authored
      Pull VFS fixes from Al Viro:
       "statx followup fixes and a fix for stack-smashing on alpha"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        alpha: fix stack smashing in old_adjtimex(2)
        statx: Include a mask for stx_attributes in struct statx
        statx: Reserve the top bit of the mask for future struct expansion
        xfs: report crtime and attribute flags to statx
        ext4: Add statx support
        statx: optimize copy of struct statx to userspace
        statx: remove incorrect part of vfs_statx() comment
        statx: reject unknown flags when using NULL path
        Documentation/filesystems: fix documentation for ->getattr()
      2a610b8a
  7. 08 Apr, 2017 13 commits
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.dk/linux-block · 78d91a75
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "Here's a pull request for 4.11-rc, fixing a set of issues mostly
        centered around the new scheduling framework. These have been brewing
        for a while, but split up into what we absolutely need in 4.11, and
        what we can defer until 4.12. These are well tested, on both single
        queue and multiqueue setups, and with and without shared tags. They
        fix several hangs that have happened in testing.
      
        This is obviously larger than I would have preferred at this point in
        time, but I don't think we can shave much off this and still get the
        desired results.
      
        In detail, this pull request contains:
      
         - a set of five fixes for NVMe, mostly from Christoph and one from
           Roland.
      
         - a series from Bart, fixing issues with dm-mq and SCSI shared tags
           and scheduling. Note that one of those patches commit messages may
           read like an optimization, but it is in fact an important fix for
           queue restarts in particular.
      
         - a series from Omar, most importantly fixing a hang with multiple
           hardware queues when we fail to get a driver tag. Another important
           fix in there is for resizing hardware queues, which nbd does when
           handling multiple sockets for one connection.
      
         - fixing an imbalance in putting the ctx for hctx request allocations
           from Minchan"
      
      * 'for-linus' of git://git.kernel.dk/linux-block:
        blk-mq: Restart a single queue if tag sets are shared
        dm rq: Avoid that request processing stalls sporadically
        scsi: Avoid that SCSI queues get stuck
        blk-mq: Introduce blk_mq_delay_run_hw_queue()
        blk-mq: remap queues when adding/removing hardware queues
        blk-mq-sched: fix crash in switch error path
        blk-mq-sched: set up scheduler tags when bringing up new queues
        blk-mq-sched: refactor scheduler initialization
        blk-mq: use the right hctx when getting a driver tag fails
        nvmet: fix byte swap in nvmet_parse_io_cmd
        nvmet: fix byte swap in nvmet_execute_write_zeroes
        nvmet: add missing byte swap in nvmet_get_smart_log
        nvme: add missing byte swap in nvme_setup_discard
        nvme: Correct NVMF enum values to match NVMe-oF rev 1.0
        block: do not put mq context in blk_mq_alloc_request_hctx
      78d91a75
    • Linus Torvalds's avatar
      Merge tag 'pinctrl-v4.11-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl · c3df1c7c
      Linus Torvalds authored
      Pull pin control fix from Linus Walleij:
       "This late fix for pin control is hopefully the last I send this cycle.
      
        The problem was detected early in the v4.11 release cycle and there
        has been some back and forth on how to solve it. Sadly the proper fix
        arrives late, but at least not too late.
      
        An issue was detected with pin control on the Freescale i.MX after the
        refactorings for more general group and function handling.
      
        We now have the proper fix for this"
      
      * tag 'pinctrl-v4.11-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
        pinctrl: core: Fix pinctrl_register_and_init() with pinctrl_enable()
      c3df1c7c
    • Linus Torvalds's avatar
      Merge tag 'powerpc-4.11-7' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · 894ca30c
      Linus Torvalds authored
      Pull powerpc fixes from Michael Ellerman:
       "Some more powerpc fixes for 4.11:
      
        Headed to stable:
      
         - disable HFSCR[TM] if TM is not supported, fixes a potential host
           kernel crash triggered by a hostile guest, but only in
           configurations that no one uses
      
         - don't try to fix up misaligned load-with-reservation instructions
      
         - fix flush_(d|i)cache_range() called from modules on little endian
           kernels
      
         - add missing global TLB invalidate if cxl is active
      
         - fix missing preempt_disable() in crc32c-vpmsum
      
        And a fix for selftests build changes that went in this release:
      
         - selftests/powerpc: Fix standalone powerpc build
      
        Thanks to: Benjamin Herrenschmidt, Frederic Barrat, Oliver O'Halloran,
        Paul Mackerras"
      
      * tag 'powerpc-4.11-7' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        powerpc/crypto/crc32c-vpmsum: Fix missing preempt_disable()
        powerpc/mm: Add missing global TLB invalidate if cxl is active
        powerpc/64: Fix flush_(d|i)cache_range() called from modules
        powerpc: Don't try to fix up misaligned load-with-reservation instructions
        powerpc: Disable HFSCR[TM] if TM is not supported
        selftests/powerpc: Fix standalone powerpc build
      894ca30c
    • Chris Salls's avatar
      mm/mempolicy.c: fix error handling in set_mempolicy and mbind. · cf01fb99
      Chris Salls authored
      In the case that compat_get_bitmap fails we do not want to copy the
      bitmap to the user as it will contain uninitialized stack data and leak
      sensitive data.
      Signed-off-by: default avatarChris Salls <salls@cs.ucsb.edu>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      cf01fb99
    • Liping Zhang's avatar
      sysctl: report EINVAL if value is larger than UINT_MAX for proc_douintvec · 425fffd8
      Liping Zhang authored
      Currently, inputting the following command will succeed but actually the
      value will be truncated:
      
        # echo 0x12ffffffff > /proc/sys/net/ipv4/tcp_notsent_lowat
      
      This is not friendly to the user, so instead, we should report error
      when the value is larger than UINT_MAX.
      
      Fixes: e7d316a0 ("sysctl: handle error writing UINT_MAX to u32 fields")
      Signed-off-by: default avatarLiping Zhang <zlpnobody@gmail.com>
      Cc: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Eric W. Biederman <ebiederm@xmission.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      425fffd8
    • Tejun Heo's avatar
      MAINTAINERS: separate out kernfs maintainership · 27f395b8
      Tejun Heo authored
      Separate out kernfs from driver core and add myself as a
      co-maintainer.
      Signed-off-by: default avatarTejun Heo <tj@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      27f395b8
    • NeilBrown's avatar
      sysfs: be careful of error returns from ops->show() · c8a139d0
      NeilBrown authored
      ops->show() can return a negative error code.
      Commit 65da3484 ("sysfs: correctly handle short reads on PREALLOC attrs.")
      (in v4.4) caused this to be stored in an unsigned 'size_t' variable, so errors
      would look like large numbers.
      As a result, if an error is returned, sysfs_kf_read() will return the
      value of 'count', typically 4096.
      
      Commit 17d0774f ("sysfs: correctly handle read offset on PREALLOC attrs")
      (in v4.8) extended this error to use the unsigned large 'len' as a size for
      memmove().
      Consequently, if ->show returns an error, then the first read() on the
      sysfs file will return 4096 and could return uninitialized memory to
      user-space.
      If the application performs a subsequent read, this will trigger a memmove()
      with extremely large count, and is likely to crash the machine is bizarre ways.
      
      This bug can currently only be triggered by reading from an md
      sysfs attribute declared with __ATTR_PREALLOC() during the
      brief period between when mddev_put() deletes an mddev from
      the ->all_mddevs list, and when mddev_delayed_delete() - which is
      scheduled on a workqueue - completes.
      Before this, an error won't be returned by the ->show()
      After this, the ->show() won't be called.
      
      I can reproduce it reliably only by putting delay like
      	usleep_range(500000,700000);
      early in mddev_delayed_delete(). Then after creating an
      md device md0 run
        echo clear > /sys/block/md0/md/array_state; cat /sys/block/md0/md/array_state
      
      The bug can be triggered without the usleep.
      
      Fixes: 65da3484 ("sysfs: correctly handle short reads on PREALLOC attrs.")
      Fixes: 17d0774f ("sysfs: correctly handle read offset on PREALLOC attrs")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarNeilBrown <neilb@suse.com>
      Acked-by: default avatarTejun Heo <tj@kernel.org>
      Reported-and-tested-by: default avatarMiroslav Benes <mbenes@suse.cz>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      c8a139d0
    • Johan Hovold's avatar
      Documentation: stable-kernel-rules: fix stable-tag format · cf903e9d
      Johan Hovold authored
      A patch documenting how to specify which kernels a particular fix should
      be backported to (seemingly) inadvertently added a minus sign after the
      kernel version. This particular stable-tag format had never been used
      prior to this patch, and was neither present when the patch in question
      was first submitted (it was added in v2 without any comment).
      
      Drop the minus sign to avoid any confusion.
      
      Fixes: fdc81b79 ("stable_kernel_rules: Add clause about specification of kernel versions to patch.")
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      cf903e9d
    • Jordan Crouse's avatar
      msm/drm: gpu: Dynamically locate the clocks from the device tree · 98db803f
      Jordan Crouse authored
      Instead of using a fixed list of clock names use the clock-names
      list in the device tree to discover and get the list of clocks
      that we need.
      Signed-off-by: default avatarJordan Crouse <jcrouse@codeaurora.org>
      Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
      98db803f
    • Jordan Crouse's avatar
      drm/msm: gpu: Use OPP tables if we can · e2af8b6b
      Jordan Crouse authored
      If a OPP table is defined for the GPU device in the device tree use
      that in lieu of the downstream style GPU frequency table. If we do
      use the downstream table convert it to a OPP table so that we can
      take advantage of the OPP lookup facilities later.
      Signed-off-by: default avatarJordan Crouse <jcrouse@codeaurora.org>
      Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
      e2af8b6b
    • Jordan Crouse's avatar
      drm/msm: Hard code the GPU "slow frequency" · bf5af4ae
      Jordan Crouse authored
      Some A3XX and A4XX GPU targets required that the GPU clock be
      programmed to a non zero value when it was disabled so
      27Mhz was chosen as the "invalid" frequency.
      
      Even though newer targets do not have the same clock restrictions
      we still write 27Mhz on clock disable and expect the clock subsystem
      to round down to zero.
      
      For unknown reasons even though the slow clock speed is always
      27Mhz and it isn't actually a functional level the legacy device tree
      frequency tables always defined it and then did gymnastics to work
      around it.
      
      Instead of playing the same silly games just hard code the "slow" clock
      speed in the code as 27MHz and save ourselves a bit of infrastructure.
      Signed-off-by: default avatarJordan Crouse <jcrouse@codeaurora.org>
      Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
      bf5af4ae
    • Jordan Crouse's avatar
      drm/msm: Add MSM_PARAM_GMEM_BASE · e3689e47
      Jordan Crouse authored
      User space needs to know where the GMEM whole starts so that they
      can set up the addressing correctly.
      Signed-off-by: default avatarJordan Crouse <jcrouse@codeaurora.org>
      Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
      e3689e47
    • Jordan Crouse's avatar
      drm/msm: Reference count address spaces · ee546cd3
      Jordan Crouse authored
      There are reasons for a memory object to outlive the file descriptor
      that created it and so the address space that a buffer object is
      attached to must also outlive the file descriptor. Reference count
      the address space so that it can remain viable until all the objects
      have released their addresses.
      Signed-off-by: default avatarJordan Crouse <jcrouse@codeaurora.org>
      Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
      ee546cd3