Commit Graph

798727 Commits

Author SHA1 Message Date
Heiner Kallweit
d2a36971ef net: phy: don't allow __set_phy_supported to add unsupported modes
Currently __set_phy_supported allows to add modes w/o checking whether
the PHY supports them. This is wrong, it should never add modes but
only remove modes we don't want to support.

The commit marked as fixed didn't do anything wrong, it just copied
existing functionality to the helper which is being fixed now.

Fixes: f3a6bd393c ("phylib: Add phy_set_max_speed helper")
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-12-03 13:50:38 -08:00
Olof Johansson
d9536e8098 This pull request contains Broadcom ARM-based SoCs Device Tree fixes,
please pull the following for 4.20:
 
 - Stefan fixes the polariy of the Wi-Fi reset GPIOs signals which would
   break on Raspberry Pi 3B and 3B+
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEm+Rq3+YGJdiR9yuFh9CWnEQHBwQFAlwFiboACgkQh9CWnEQH
 BwT4BA/+LdPEp2mvT5fF6XzLMDOaHR3Zpzesi/J4uIGSKmzuiIzHriPI25wOoLAD
 P5GdULO9FH1FIqOJ8ysdQ8maDhgsMJTa0B1zYzjWkANr9x3Oj+2PYj+zfg9zi1jd
 pmTh/bUHEjnAfrsQtVp0vnNv3klzaGolxhWDIPzOQ3FI20VLpfXe3gqzMu0nUo5W
 8gxVrl6SE4C2JdReYMqjF+iphuVKc9YNczlDs4MlTPmMfW+sKej40WDmE4cacr91
 uDykpIahyEkvolEAG+gbEFOZbR52tjLxQnDYInQjqTzcpGc0Rbt6lK+Ftmy9Mq6S
 hc4zA5b1tLuPmHCxVvOeoyr0ZQNey2/GvSk5npgDnLcw6KQD/59Bafvoi/s1PE8m
 EIKU9FyjGSfQdnAL5vU8IVaD59rKOjtdkXZWzlgmcrPx3ydc/BaJlwZ7kAbWwXTN
 5GDzWf4HiyAwCWkX9mGF91MfUJextN6GNYtBDAh9HnS6HglErQpwaVQdjc95pToz
 SoGzfiBUsp8NZtoAyV/Pa+apsdmrD1JppKqg7Tab9lfARQmS8P1/p0xvO3yJs7z3
 FNazPCzgMAmrClpTzjGCTvEswCOmhX7krld4KsdRW0NHvIpT6JglCQqvQDTF5IuY
 XLam4mmsgcCQ44FXD18XUWR/A5HZj9UzajTIaP1tKFyK9aiPpFg=
 =iFMZ
 -----END PGP SIGNATURE-----

Merge tag 'arm-soc/for-4.20/devicetree-fixes' of https://github.com/Broadcom/stblinux into fixes

This pull request contains Broadcom ARM-based SoCs Device Tree fixes,
please pull the following for 4.20:

- Stefan fixes the polariy of the Wi-Fi reset GPIOs signals which would
  break on Raspberry Pi 3B and 3B+

* tag 'arm-soc/for-4.20/devicetree-fixes' of https://github.com/Broadcom/stblinux:
  ARM: dts: bcm2837: Fix polarity of wifi reset GPIOs

Signed-off-by: Olof Johansson <olof@lixom.net>
2018-12-03 13:05:34 -08:00
Piotr Stankiewicz
36d842194a IB/hfi1: Fix an out-of-bounds access in get_hw_stats
When running with KASAN, the following trace is produced:

[   62.535888]

==================================================================
[   62.544930] BUG: KASAN: slab-out-of-bounds in
gut_hw_stats+0x122/0x230 [hfi1]
[   62.553856] Write of size 8 at addr ffff88080e8d6330 by task
kworker/0:1/14

[   62.565333] CPU: 0 PID: 14 Comm: kworker/0:1 Not tainted
4.19.0-test-build-kasan+ #8
[   62.575087] Hardware name: Intel Corporation S2600KPR/S2600KPR, BIOS
SE5C610.86B.01.01.0019.101220160604 10/12/2016
[   62.587951] Workqueue: events work_for_cpu_fn
[   62.594050] Call Trace:
[   62.598023]  dump_stack+0xc6/0x14c
[   62.603089]  ? dump_stack_print_info.cold.1+0x2f/0x2f
[   62.610041]  ? kmsg_dump_rewind_nolock+0x59/0x59
[   62.616615]  ? get_hw_stats+0x122/0x230 [hfi1]
[   62.622985]  print_address_description+0x6c/0x23c
[   62.629744]  ? get_hw_stats+0x122/0x230 [hfi1]
[   62.636108]  kasan_report.cold.6+0x241/0x308
[   62.642365]  get_hw_stats+0x122/0x230 [hfi1]
[   62.648703]  ? hfi1_alloc_rn+0x40/0x40 [hfi1]
[   62.655088]  ? __kmalloc+0x110/0x240
[   62.660695]  ? hfi1_alloc_rn+0x40/0x40 [hfi1]
[   62.667142]  setup_hw_stats+0xd8/0x430 [ib_core]
[   62.673972]  ? show_hfi+0x50/0x50 [hfi1]
[   62.680026]  ib_device_register_sysfs+0x165/0x180 [ib_core]
[   62.687995]  ib_register_device+0x5a2/0xa10 [ib_core]
[   62.695340]  ? show_hfi+0x50/0x50 [hfi1]
[   62.701421]  ? ib_unregister_device+0x2e0/0x2e0 [ib_core]
[   62.709222]  ? __vmalloc_node_range+0x2d0/0x380
[   62.716131]  ? rvt_driver_mr_init+0x11f/0x2d0 [rdmavt]
[   62.723735]  ? vmalloc_node+0x5c/0x70
[   62.729697]  ? rvt_driver_mr_init+0x11f/0x2d0 [rdmavt]
[   62.737347]  ? rvt_driver_mr_init+0x1f5/0x2d0 [rdmavt]
[   62.744998]  ? __rvt_alloc_mr+0x110/0x110 [rdmavt]
[   62.752315]  ? rvt_rc_error+0x140/0x140 [rdmavt]
[   62.759434]  ? rvt_vma_open+0x30/0x30 [rdmavt]
[   62.766364]  ? mutex_unlock+0x1d/0x40
[   62.772445]  ? kmem_cache_create_usercopy+0x15d/0x230
[   62.780115]  rvt_register_device+0x1f6/0x360 [rdmavt]
[   62.787823]  ? rvt_get_port_immutable+0x180/0x180 [rdmavt]
[   62.796058]  ? __get_txreq+0x400/0x400 [hfi1]
[   62.802969]  ? memcpy+0x34/0x50
[   62.808611]  hfi1_register_ib_device+0xde6/0xeb0 [hfi1]
[   62.816601]  ? hfi1_get_npkeys+0x10/0x10 [hfi1]
[   62.823760]  ? hfi1_init+0x89f/0x9a0 [hfi1]
[   62.830469]  ? hfi1_setup_eagerbufs+0xad0/0xad0 [hfi1]
[   62.838204]  ? pcie_capability_clear_and_set_word+0xcd/0xe0
[   62.846429]  ? pcie_capability_read_word+0xd0/0xd0
[   62.853791]  ? hfi1_pcie_init+0x187/0x4b0 [hfi1]
[   62.860958]  init_one+0x67f/0xae0 [hfi1]
[   62.867301]  ? hfi1_init+0x9a0/0x9a0 [hfi1]
[   62.873876]  ? wait_woken+0x130/0x130
[   62.879860]  ? read_word_at_a_time+0xe/0x20
[   62.886329]  ? strscpy+0x14b/0x280
[   62.891998]  ? hfi1_init+0x9a0/0x9a0 [hfi1]
[   62.898405]  local_pci_probe+0x70/0xd0
[   62.904295]  ? pci_device_shutdown+0x90/0x90
[   62.910833]  work_for_cpu_fn+0x29/0x40
[   62.916750]  process_one_work+0x584/0x960
[   62.922974]  ? rcu_work_rcufn+0x40/0x40
[   62.928991]  ? __schedule+0x396/0xdc0
[   62.934806]  ? __sched_text_start+0x8/0x8
[   62.941020]  ? pick_next_task_fair+0x68b/0xc60
[   62.947674]  ? run_rebalance_domains+0x260/0x260
[   62.954471]  ? __list_add_valid+0x29/0xa0
[   62.960607]  ? move_linked_works+0x1c7/0x230
[   62.967077]  ?
trace_event_raw_event_workqueue_execute_start+0x140/0x140
[   62.976248]  ? mutex_lock+0xa6/0x100
[   62.982029]  ? __mutex_lock_slowpath+0x10/0x10
[   62.988795]  ? __switch_to+0x37a/0x710
[   62.994731]  worker_thread+0x62e/0x9d0
[   63.000602]  ? max_active_store+0xf0/0xf0
[   63.006828]  ? __switch_to_asm+0x40/0x70
[   63.012932]  ? __switch_to_asm+0x34/0x70
[   63.019013]  ? __switch_to_asm+0x40/0x70
[   63.025042]  ? __switch_to_asm+0x34/0x70
[   63.031030]  ? __switch_to_asm+0x40/0x70
[   63.037006]  ? __schedule+0x396/0xdc0
[   63.042660]  ? kmem_cache_alloc_trace+0xf3/0x1f0
[   63.049323]  ? kthread+0x59/0x1d0
[   63.054594]  ? ret_from_fork+0x35/0x40
[   63.060257]  ? __sched_text_start+0x8/0x8
[   63.066212]  ? schedule+0xcf/0x250
[   63.071529]  ? __wake_up_common+0x110/0x350
[   63.077794]  ? __schedule+0xdc0/0xdc0
[   63.083348]  ? wait_woken+0x130/0x130
[   63.088963]  ? finish_task_switch+0x1f1/0x520
[   63.095258]  ? kasan_unpoison_shadow+0x30/0x40
[   63.101792]  ? __init_waitqueue_head+0xa0/0xd0
[   63.108183]  ? replenish_dl_entity.cold.60+0x18/0x18
[   63.115151]  ? _raw_spin_lock_irqsave+0x25/0x50
[   63.121754]  ? max_active_store+0xf0/0xf0
[   63.127753]  kthread+0x1ae/0x1d0
[   63.132894]  ? kthread_bind+0x30/0x30
[   63.138422]  ret_from_fork+0x35/0x40

[   63.146973] Allocated by task 14:
[   63.152077]  kasan_kmalloc+0xbf/0xe0
[   63.157471]  __kmalloc+0x110/0x240
[   63.162804]  init_cntrs+0x34d/0xdf0 [hfi1]
[   63.168883]  hfi1_init_dd+0x29a3/0x2f90 [hfi1]
[   63.175244]  init_one+0x551/0xae0 [hfi1]
[   63.181065]  local_pci_probe+0x70/0xd0
[   63.186759]  work_for_cpu_fn+0x29/0x40
[   63.192310]  process_one_work+0x584/0x960
[   63.198163]  worker_thread+0x62e/0x9d0
[   63.203843]  kthread+0x1ae/0x1d0
[   63.208874]  ret_from_fork+0x35/0x40

[   63.217203] Freed by task 1:
[   63.221844]  __kasan_slab_free+0x12e/0x180
[   63.227844]  kfree+0x92/0x1a0
[   63.232570]  single_release+0x3a/0x60
[   63.238024]  __fput+0x1d9/0x480
[   63.242911]  task_work_run+0x139/0x190
[   63.248440]  exit_to_usermode_loop+0x191/0x1a0
[   63.254814]  do_syscall_64+0x301/0x330
[   63.260283]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

[   63.270199] The buggy address belongs to the object at
ffff88080e8d5500
 which belongs to the cache kmalloc-4096 of size 4096
[   63.287247] The buggy address is located 3632 bytes inside of
 4096-byte region [ffff88080e8d5500, ffff88080e8d6500)
[   63.303564] The buggy address belongs to the page:
[   63.310447] page:ffffea00203a3400 count:1 mapcount:0
mapping:ffff88081380e840 index:0x0 compound_mapcount: 0
[   63.323102] flags: 0x2fffff80008100(slab|head)
[   63.329775] raw: 002fffff80008100 0000000000000000 0000000100000001
ffff88081380e840
[   63.340175] raw: 0000000000000000 0000000000070007 00000001ffffffff
0000000000000000
[   63.350564] page dumped because: kasan: bad access detected

[   63.361974] Memory state around the buggy address:
[   63.369137]  ffff88080e8d6200: 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00
[   63.379082]  ffff88080e8d6280: 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00
[   63.389032] >ffff88080e8d6300: 00 00 00 00 00 00 fc fc fc fc fc fc fc
fc fc fc
[   63.398944]                                      ^
[   63.406141]  ffff88080e8d6380: fc fc fc fc fc fc fc fc fc fc fc fc fc
fc fc fc
[   63.416109]  ffff88080e8d6400: fc fc fc fc fc fc fc fc fc fc fc fc fc
fc fc fc
[   63.426099]
==================================================================

The trace happens because get_hw_stats() assumes there is room in the
memory allocated in init_cntrs() to accommodate the driver counters.
Unfortunately, that routine only allocated space for the device
counters.

Fix by insuring the allocation has room for the additional driver
counters.

Cc: <Stable@vger.kernel.org> # v4.14+
Fixes: b7481944b0 ("IB/hfi1: Show statistics counters under IB stats interface")
Reviewed-by: Mike Marciniczyn <mike.marciniszyn@intel.com>
Reviewed-by: Mike Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Piotr Stankiewicz <piotr.stankiewicz@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2018-12-03 16:05:19 -05:00
Michael J. Ruhl
90b2620e6a IB/hfi1: Fix a latency issue for small messages
A recent performance enhancement introduced a latency issue in the
HFI message path.  The new algorithm removed a forced call send for
PIO messages and added a forced schedule event for messages larger
than the MTU.

For PIO, the schedule path can introduce thrashing that can
significantly impact the throughput for small messages.

If a message size is within the PIO threshold, always take the send
path.

Fixes: 0b79b27748 ("IB/{hfi1, qib, rdmavt}: Schedule multi RC/UC packets instead of posting")
Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2018-12-03 16:05:19 -05:00
Rob Herring
f3b2f758ec ARM: dts: realview: Fix some more duplicate regulator nodes
There's a bug in dtc in checking for duplicate node names when there's
another section (e.g. "/ { };"). In this case, skeleton.dtsi provides
another section. Upon removal of skeleton.dtsi, the dtb fails to build
due to a duplicate node 'fixedregulator@0'. As both nodes were pretty
much the same 3.3V fixed regulator, it hasn't really mattered. Fix this
by renaming the nodes to something unique. In the process, drop the
unit-address which shouldn't be present wtihout reg property.

Signed-off-by: Rob Herring <robh@kernel.org>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Olof Johansson <olof@lixom.net>
2018-12-03 12:43:42 -08:00
Lubomir Rintel
f6936d029c MAINTAINERS: update entry for MMP platform
Move Eric Miao and Haojian Zhuang over to CREDITS, since they're AWOL
for some time already. The git trees have gone away too.

I'm adding myself as a reviewer. I'd like to be Cc'd on patches and will
be able to test them, but I don't possess a data sheet thus there might
be things I'll be unable to review. Hence the Odd-Fixes status.

Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
Signed-off-by: Olof Johansson <olof@lixom.net>
2018-12-03 12:39:57 -08:00
Lubomir Rintel
76f4e2c3b6 ARM: mmp/mmp2: fix cpu_is_mmp2() on mmp2-dt
cpu_is_mmp2() was equivalent to cpu_is_pj4(), wouldn't be correct for
multiplatform kernels. Fix it by also considering mmp_chip_id, as is
done for cpu_is_pxa168() and cpu_is_pxa910() above.

Moreover, it is only available with CONFIG_CPU_MMP2 and thus doesn't work
on DT-based MMP2 machines. Enable it on CONFIG_MACH_MMP2_DT too.

Note: CONFIG_CPU_MMP2 is only used for machines that use board files
instead of DT. It should perhaps be renamed. I'm not doing it now, because
I don't have a better idea.

Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Cc: stable@vger.kernel.org
Signed-off-by: Olof Johansson <olof@lixom.net>
2018-12-03 12:39:21 -08:00
Olof Johansson
358b5f73ce DT mt7622:
- kernelci awaits a working stdout-path.
   Fix the path for reference board and bananapi-r64
 - general propouse timer has issues with clocks that didn't
   get probed early. Delete the DT node as the timer isn't
   need, a ARM arch timer exists on the system.
 -----BEGIN PGP SIGNATURE-----
 
 iQJLBAABCAA1FiEEiUuSfQSYnG8EMsBltDliWyzx00MFAlv7yygXHG1hdHRoaWFz
 LmJnZ0BnbWFpbC5jb20ACgkQtDliWyzx00NH1w//fT6Tell3XQ5oOqwMHp4d44zK
 A5mCylaD5E4svlw/LQInc8EZX2V2jr0zdzT/51PN1KrgE/Bw/QPFv61V2nO1Zsn6
 SOn9eC3lsvbfxL45yjSONY/kbs1ceUQbpvbd19Xy9RS7pakCOt6SFiEIReRoat7Q
 Hhdq5aG6c6cnzElSa81saAia2Y9nlprqBZCgAuJRXp7w2Zd5qArponOhDaiuC8Z3
 HLLbu0OgHiBWCFlQ6Efa28oYj+ZqofueGbDpzDlekLJdmcZfYy1Y+dYRfUfo4I6c
 eQl06R8SSueJFzqFx8onHts0XHO+53UCEziThJU2qM7MxWdgvproEfXvb26fM04W
 HmrSrHj0vdBPnJ5wo4kCQIbxioUDMEAGuLq/LBthvQ0GU8dVob+ccGe0ifwVK1R0
 XsjsUqbb7u8gUT1A6nqRPjgDoD+VYka6Kz/HndpXM9xJ104BQdV87RRFrLrRXh5I
 s5MOwQE6pzOiuwP3pUVX9GnQdEaq6Mc5i97URlZi7rzPT8fcu/q52l7U/aBOWCnQ
 j+bgkc5Uat7wLL1bxAPStbh264AYQ4WE8BNAWaWKmzRQDfGKc1TCQKBz1nCcLDOq
 UG9LZIfPJ2bKWG+mcloT6xF+Uugy31EGVCDCIPMgL22ft05DT7vaZNfsb7EPzWCY
 fnRgmeYyEL9kTztTfvE=
 =9YyV
 -----END PGP SIGNATURE-----

Merge tag 'v4.19-next-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/matthias.bgg/linux into fixes

DT mt7622:
- Kernelci awaits a working stdout-path.
  Fix the path for reference board and bananapi-r64
- General propouse timer has issues with clocks that didn't
  get probed early. Delete the DT node as the timer isn't
  need, a ARM arch timer exists on the system.

* tag 'v4.19-next-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/matthias.bgg/linux:
  arm64: dts: mt7622: Drop the general purpose timer node
  arm64: dts: mt7622: fix no more console output on BPI-R64 board
  arm64: dts: mt7622: fix no more console output on rfb1

Signed-off-by: Olof Johansson <olof@lixom.net>
2018-12-03 12:37:41 -08:00
Matthias Brugger
7bb64d55fd MAINTAINERS: mediatek: Update SoC entry
Add IRC channel and URL of the wiki.
Also add soc drivers folder and regex to catch more
mediatek components.

Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Olof Johansson <olof@lixom.net>
2018-12-03 12:36:58 -08:00
Hans Verkuil
daa3fc4454 media: vicodec: set state resolution from raw format
The state structure contains the resolution expected by the decoder
and encoder. For an encoder that resolution should be taken from the
OUTPUT format, and for a decoder from the CAPTURE format.

If the wrong format is picked, a buffer overrun can occur if there is
a mismatch between the CAPTURE and OUTPUT formats.

The real fix would be to correctly implement the stateful codec
specification, but that will take more time. For now just prevent the
buffer overrun.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2018-12-03 15:04:36 -05:00
Hans Verkuil
e714c92f42 media: vivid: drop v4l2_ctrl_request_complete() from start_streaming
If start_streaming() fails and all queued buffers are returned to
vb2, then do not call v4l2_ctrl_request_complete(). Nothing happened
to the request and the state should remain as it was before
start_streaming was called.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2018-12-03 15:04:07 -05:00
Hans Verkuil
dde6bdcc97 media: vb2: don't unbind/put the object when going to state QUEUED
When a buffer is returned to state QUEUED (that happens when
start_streaming fails), then do not unbind and put the object
from the request. Nothing has changed yet, so just keep it as
is.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2018-12-03 15:02:53 -05:00
Hans Verkuil
6093d3002e media: vb2: keep a reference to the request until dqbuf
When vb2_buffer_done is called the buffer is unbound from the
request and put. The media_request_object_put also 'put's the
request reference. If the application has already closed the
request fd, then that means that the request reference at that
point goes to 0 and the whole request is released.

This means that the control handler associated with the request is
also freed and that causes this kernel oops:

[174705.995401] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:908
[174705.995411] in_atomic(): 1, irqs_disabled(): 1, pid: 28071, name: vivid-000-vid-o
[174705.995416] 2 locks held by vivid-000-vid-o/28071:
[174705.995420]  #0: 000000001ea3a232 (&dev->mutex#3){....}, at: vivid_thread_vid_out+0x3f5/0x550 [vivid]
[174705.995447]  #1: 00000000e30a0d1e (&(&q->done_lock)->rlock){....}, at: vb2_buffer_done+0x92/0x1d0 [videobuf2_common]
[174705.995460] Preemption disabled at:
[174705.995461] [<0000000000000000>]           (null)
[174705.995472] CPU: 11 PID: 28071 Comm: vivid-000-vid-o Tainted: G        W         4.20.0-rc1-test-no #88
[174705.995476] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/19/2017
[174705.995481] Call Trace:
[174705.995500]  dump_stack+0x46/0x60
[174705.995512]  ___might_sleep.cold.79+0xe1/0xf1
[174705.995523]  __mutex_lock+0x50/0x8f0
[174705.995531]  ? find_held_lock+0x2d/0x90
[174705.995536]  ? find_held_lock+0x2d/0x90
[174705.995542]  ? find_held_lock+0x2d/0x90
[174705.995564]  ? v4l2_ctrl_handler_free.part.13+0x44/0x1d0 [videodev]
[174705.995576]  v4l2_ctrl_handler_free.part.13+0x44/0x1d0 [videodev]
[174705.995590]  v4l2_ctrl_request_release+0x1c/0x30 [videodev]
[174705.995600]  media_request_clean+0x64/0xe0 [media]
[174705.995609]  media_request_release+0x19/0x40 [media]
[174705.995617]  vb2_buffer_done+0xef/0x1d0 [videobuf2_common]
[174705.995630]  vivid_thread_vid_out+0x2c1/0x550 [vivid]
[174705.995645]  ? vivid_stop_generating_vid_cap+0x1c0/0x1c0 [vivid]
[174705.995653]  kthread+0x113/0x130
[174705.995659]  ? kthread_park+0x80/0x80
[174705.995667]  ret_from_fork+0x35/0x40

The vb2_buffer_done function can be called from interrupt context, so
anything that sleeps is not allowed.

The solution is to increment the request refcount when the buffer is
queued and decrement it when the buffer is dequeued. Releasing the
request is fine if that happens from VIDIOC_DQBUF.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2018-12-03 15:02:22 -05:00
Hans Verkuil
b7ff0b0990 media: vb2: skip request checks for VIDIOC_PREPARE_BUF
VIDIOC_PREPARE_BUF should ignore V4L2_BUF_FLAG_REQUEST_FD since it isn't
doing anything with requests. So inform vb2_queue_or_prepare_buf whether
it is called from vb2_prepare_buf or vb2_qbuf and just return 0 in the
first case.

This was found when adding new v4l2-compliance checks.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2018-12-03 15:01:38 -05:00
Hans Verkuil
04990215de media: vb2: don't call __vb2_queue_cancel if vb2_start_streaming failed
vb2_start_streaming() already rolls back the buffers, so there is no
need to call __vb2_queue_cancel(). Especially since __vb2_queue_cancel()
does too much, such as zeroing the q->queued_count value, causing vb2
to think that no buffers have been queued.

It appears that this call to __vb2_queue_cancel() is a left-over from
before commit b3379c6201.

Fixes: b3379c6201 ('vb2: only call start_streaming if sufficient buffers are queued')

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Cc: <stable@vger.kernel.org>      # for v4.16 and up
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2018-12-03 15:00:50 -05:00
Dan Carpenter
53e9d83827 media: cedrus: Fix a NULL vs IS_ERR() check
The devm_ioremap_resource() function doesn't return NULL pointers, it
returns error pointers.

Fixes: 50e761516f ("media: platform: Add Cedrus VPU decoder driver")

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2018-12-03 14:59:26 -05:00
Laurent Pinchart
230bce5511 media: vsp1: Fix LIF buffer thresholds
Commit de2bc45c84 ("media: vsp1: Update LIF buffer thresholds")
updated the LIF buffer thresholds based on the VSP version, but used the
wrong model mask. This resulted in all VSP instances to be treated as a
Gen3 VSPD, breaking operation on all Gen2 platforms as well as on
H3 ES2.0, M3-N, V3M and V3H. Fix it.

Fixes: de2bc45c84 ("media: vsp1: Update LIF buffer thresholds")

Reported-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2018-12-03 14:57:30 -05:00
Juha-Matti Tilli
fd6f32f786 libata: whitelist all SAMSUNG MZ7KM* solid-state disks
These devices support read zero after trim (RZAT), as they advertise to
the OS. However, the OS doesn't believe the SSDs unless they are
explicitly whitelisted.

Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Juha-Matti Tilli <juha-matti.tilli@iki.fi>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2018-12-03 12:54:39 -07:00
Stefan Wahren
e25b6783c7 ARM: dts: bcm2837: Fix polarity of wifi reset GPIOs
The commit b1b8f45b31 ("ARM: dts: bcm2837: Add missing GPIOs of Expander")
introduced a wifi power sequence. Unfortunately the polarity of the reset
GPIOs were wrong and broke the wifi support on Raspberry Pi 3 B and
later in 3 B+. This wasn't discovered before since the power sequence
takes only effect in case the relevant MMC driver is compiled as a module.

Fixes: b1b8f45b31 ("ARM: dts: bcm2837: Add missing GPIOs of Expander")
Cc: stable@vger.kernel.org
Reported-by: Matthias Lueschner <lueschem@gmail.com>
Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=911443
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
2018-12-03 11:51:26 -08:00
Tony Lindgren
6c3516fed7 Input: omap-keypad - fix keyboard debounce configuration
I noticed that the Android v3.0.8 kernel on droid4 is using different
keypad values from the mainline kernel and does not have issues with
keys occasionally being stuck until pressed again. Turns out there was
an earlier patch posted to fix this as "Input: omap-keypad: errata i689:
Correct debounce time", but it was never reposted to fix use macros
for timing calculations.

This updated version is using macros, and also fixes the use of the
input clock rate to use 32768KiHz instead of 32000KiHz. And we want to
use the known good Android kernel values of 3 and 6 instead of 2 and 6
in the earlier patch.

Reported-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2018-12-03 11:37:55 -08:00
Cameron Gutman
a6754fae1e Input: xpad - quirk all PDP Xbox One gamepads
Since we continue to find tons of new variants [0,1,2,3,4,5,6] that
need the PDP quirk, let's just quirk all devices from PDP.

[0]: https://github.com/paroj/xpad/pull/104
[1]: https://github.com/paroj/xpad/pull/105
[2]: https://github.com/paroj/xpad/pull/108
[3]: https://github.com/paroj/xpad/pull/109
[4]: https://github.com/paroj/xpad/pull/112
[5]: https://github.com/paroj/xpad/pull/115
[6]: https://github.com/paroj/xpad/pull/116

Fixes: e5c9c6a885 ("Input: xpad - add support for PDP Xbox One controllers")
Cc: stable@vger.kernel.org
Signed-off-by: Cameron Gutman <aicommander@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2018-12-03 11:37:54 -08:00
Teika Kazura
5a6dab15f7 Input: synaptics - enable SMBus for HP 15-ay000
SMBus works fine for the touchpad with id SYN3221, used in the HP 15-ay000
series,

This device has been reported in these messages in the "linux-input"
mailing list:
* https://marc.info/?l=linux-input&m=152016683003369&w=2
* https://www.spinics.net/lists/linux-input/msg52525.html

Reported-by: Nitesh Debnath <niteshkd1999@gmail.com>
Reported-by: Teika Kazura <teika@gmx.com>
Signed-off-by: Teika Kazura <teika@gmx.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2018-12-03 11:37:17 -08:00
Lyude Paul
9df39bedbf Input: synaptics - add PNP ID for ThinkPad P50 to SMBus
Noticed the other day the trackpoint felt different on my P50, then
realized it was because rmi4 wasn't loading for this machine
automatically. Suspend/resume, hibernate, and everything else seem to
work perfectly fine on here.

Signed-off-by: Lyude Paul <lyude@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2018-12-03 11:37:17 -08:00
Noah Westervelt
ad33429cd0 Input: elan_i2c - add ACPI ID for Lenovo IdeaPad 330-15ARR
Add ELAN061E to the ACPI table to support Elan touchpad found in Lenovo
IdeaPad 330-15ARR.

Signed-off-by: Noah Westervelt <nwestervelt@outlook.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2018-12-03 11:37:16 -08:00
Adam Wong
bf87ade0dd Input: elan_i2c - add support for ELAN0621 touchpad
Added the ability to detect the ELAN0621 touchpad found in some Lenovo
laptops.

Signed-off-by: Adam Wong <adam@adamwong.me>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2018-12-03 11:37:15 -08:00
Linus Torvalds
0072a0c14d media fixes for v4.20-rc4
-----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJcBW/HAAoJEAhfPr2O5OEVr1YP/Rggag8uQS365rYzRlau1tQY
 VeCuYsmW4IZTRLk7IgLctRDJ6XShwnwpWJCfo8Uvf0LHk1q1dxPyJMZ/ycNujG/B
 AxAZlURF4Kqx1iMaG8thwJt5LqT2yzpas34mmSvX7Xxa9FnV7tb3FyadclVW3tjL
 Dg8P/6ryY2I0UtzzFGtepXoWz0G76xNEjPqpyVMzjQzzpdmtX1GX/ObtmnjkNQmS
 qFRTJ+TFL4i61vdmz64ReVHJ5yMXo32wOxbYtSB7xiU8ZZvRrrD//Z5/15QUIz3p
 rQO2zUsnUaqMFx3qdnMRYY//BYo/WVTATIxOeAEjOyinc3Op03IRV4FYGTlb9mqG
 RLnhl6PAxN2En9KQBBSunaf9/iJtjSH1EWyAfrAM1gUsYQmnSmFf0P+EogNMCbbR
 hZGCzp9nr35OZ02g5XroMZ4DlqqGDqY6uvbeH7fm7eCDQ67O2yPynPzSWYBbymP4
 q/vIrxIBAQRq/3PGO4kgwUn+d6T8B3O1GnufPLJvHAoXHfDZ32ahlv6JcKN0qf0q
 IYyCXW0m2rTmkZRkmmkFmCUx0T8U4jen9pFEd6iRVAp3hrU9mgdv90R7Cjn7w/KC
 A0S1EcCUOiz7mt20U0fypWt0oyj6se8ltLy0wyNd/TePuFJfJ4n7pnC3rFojHCyN
 ejprmuE8ft9DC6W6hIrP
 =44JZ
 -----END PGP SIGNATURE-----

Merge tag 'media/v4.20-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

Pull media fixes from Mauro Carvalho Chehab:

 - Revert a dt-bindings patch whose driver didn't make for 4.20

 - fix a kernel oops at vicodec driver

 - fix a frame overflow at gspca with was causing regressions on some
   cameras, making them to not work

 - use the proper type for wait_queue head

 - make media request API compatible with 32-bit userspace on 64-bit
   kernel

 - fix a regression on Kernel 4.19 at dvb-pll

 - don't use SPDX headers yet for GFDL

* tag 'media/v4.20-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  media: mediactl docs: Fix licensing message
  media: dvb-pll: don't re-validate tuner frequencies
  media: dvb-pll: fix tuner frequency ranges
  media: Revert "media: dt-bindings: Document the Rockchip VPU bindings"
  media: gspca: fix frame overflow error
  media: vicodec: fix memchr() kernel oops
  media: cedrus: add action item to the TODO
  media: media-request: Add compat ioctl
  media: Use wait_queue_head_t for media_request
2018-12-03 11:29:20 -08:00
Dan Carpenter
9a43be9ced clk: zynqmp: Off by one in zynqmp_is_valid_clock()
The > comparison should be >= to prevent reading beyond the end of the
clock[] array.

(The clock[] array is allocated in zynqmp_clk_setup() and has
clock_max_idx elements.)

Fixes: 3fde0e16d0 ("drivers: clk: Add ZynqMP clock driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2018-12-03 09:54:48 -08:00
Dan Carpenter
2e85c57493 clk: mmp: Off by one in mmp_clk_add()
The > comparison should be >= or we write one element beyond the end of
the unit->clk_table[] array.

(The unit->clk_table[] array is allocated in the mmp_clk_init() function
and it has unit->nr_clks elements).

Fixes: 4661fda10f ("clk: mmp: add basic support functions for DT support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2018-12-03 09:54:48 -08:00
Dan Carpenter
d9f5b7f5dd clk: mvebu: Off by one bugs in cp110_of_clk_get()
These > comparisons should be >= to prevent reading beyond the end of
of the clk_data->hws[] buffer.

The clk_data->hws[] array is allocated in cp110_syscon_common_probe()
when we do:
	cp110_clk_data = devm_kzalloc(dev, sizeof(*cp110_clk_data) +
				      sizeof(struct clk_hw *) * CP110_CLK_NUM,
				      GFP_KERNEL);
As you can see, it has CP110_CLK_NUM elements which is equivalent to
CP110_MAX_CORE_CLOCKS + CP110_MAX_GATABLE_CLOCKS.

Fixes: d3da3eaef7 ("clk: mvebu: new driver for Armada CP110 system controller")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2018-12-03 09:54:48 -08:00
Linus Torvalds
f3f950dba3 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide
Pull IDE fixes from David Miller:
 "A missing of_node_put() and a small cleanup"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide:
  ide: Change to use DEFINE_SHOW_ATTRIBUTE macro
  ide: pmac: add of_node_put()
2018-12-03 09:43:24 -08:00
Linus Torvalds
9099ff769f Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc
Pull sparc fixes from David Miller:

 1) Some implicit switch fallthrough fixes from Stephen Rothwell.

 2) Missing of_node_put() in various sparc drivers from Yangtao Li.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
  drivers/tty: add missing of_node_put()
  drivers/sbus/char: add of_node_put()
  sbus: char: add of_node_put()
  sparc32: supress another implicit-fallthrough warning
  sparc32: suppress an implicit-fallthrough warning
  sparc: suppress the implicit-fallthrough warning
  arch/sparc: Use kzalloc_node
2018-12-03 09:35:27 -08:00
Evan Quan
106ea7feb9 drm/amd/powerplay: support SoftMin/Max setting for some specific DPM
For some case, no need to force SoftMin/Max settings for all DPMs.
It's OK to force on some specific DPM only.

Signed-off-by: Evan Quan <evan.quan@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-12-03 11:40:21 -05:00
Evan Quan
10cb3e6b63 drm/amd/powerplay: issue pre-display settings for display change event
For display config change event only, pre-display config settings are
needed.

Signed-off-by: Evan Quan <evan.quan@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-12-03 11:40:20 -05:00
Evan Quan
f02be8279a drm/amd/powerplay: support new pptable upload on Vega20
New pptable upload through sysfs interface is supported.

Signed-off-by: Evan Quan <evan.quan@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-12-03 11:40:20 -05:00
Alex Deucher
b52b6738cc drm/amdgpu/gmc8: always load MC firmware in the driver
Some power features rely on the driver loaded version so always
load the MC firmware from the driver even if the vbios loaded
a version already.

Acked-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Junwei Zhang <Jerry.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
2018-12-03 11:40:14 -05:00
Alex Deucher
a81a7c9c9e drm/amdgpu/gmc8: update MC firmware for polaris
Some variants require different MC firmware images.

Acked-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Junwei Zhang <Jerry.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
2018-12-03 11:40:01 -05:00
Hui Peng
5f8cf71258 ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c
If a USB sound card reports 0 interfaces, an error condition is triggered
and the function usb_audio_probe errors out. In the error path, there was a
use-after-free vulnerability where the memory object of the card was first
freed, followed by a decrement of the number of active chips. Moving the
decrement above the atomic_dec fixes the UAF.

[ The original problem was introduced in 3.1 kernel, while it was
  developed in a different form.  The Fixes tag below indicates the
  original commit but it doesn't mean that the patch is applicable
  cleanly. -- tiwai ]

Fixes: 362e4e49ab ("ALSA: usb-audio - clear chip->probing on error exit")
Reported-by: Hui Peng <benquike@gmail.com>
Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Signed-off-by: Hui Peng <benquike@gmail.com>
Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-12-03 16:09:38 +01:00
Junwei Zhang
d7fd67653f drm/amdgpu: update mc firmware image for polaris12 variants
Some new variants require updated firmware.

Signed-off-by: Junwei Zhang <Jerry.Zhang@amd.com>
Reviewed-by: Evan Quan <evan.quan@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
2018-12-03 09:55:52 -05:00
Wen Yang
098336deb9 drm/msm: Fix error return checking
The error checks on ret for a negative error return always fails because
the return value of iommu_map_sg() is unsigned and can never be negative.

Detected with Coccinelle:
drivers/gpu/drm/msm/msm_iommu.c:69:9-12: WARNING: Unsigned expression
compared with zero: ret < 0

Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
CC: Rob Clark <robdclark@gmail.com>
CC: David Airlie <airlied@linux.ie>
CC: Julia Lawall <julia.lawall@lip6.fr>
CC: linux-arm-msm@vger.kernel.org
CC: dri-devel@lists.freedesktop.org
CC: freedreno@lists.freedesktop.org
CC: linux-kernel@vger.kernel.org
Signed-off-by: Sean Paul <seanpaul@chromium.org>
2018-12-03 08:46:14 -05:00
Jayant Shekhar
d9a75a6201 drm/msm/dpu: Ignore alpha for XBGR8888 format
Alpha enable in the pixel format will help in
selecting the blend rule. By keeping alpha enable
to true we are allowing foreground alpha to blend
with the layer. If alpha is don't care, then we
should not allow pixel alpha to be part of blend
equation.

Signed-off-by: Jayant Shekhar <jshekhar@codeaurora.org>
Signed-off-by: Sean Paul <seanpaul@chromium.org>
2018-12-03 08:46:14 -05:00
YueHaibing
ce25aa3ee6 drm/msm: dpu: Fix "WARNING: invalid free of devm_ allocated data"
'dpu_enc' is a member of 'drm_enc'
And 'drm_enc' got allocated with devm_kzalloc in dpu_encoder_init.

This gives this error message:
./drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c:459:1-6:
 WARNING: invalid free of devm_ allocated data

Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Rob Clark <robdclark@gmail.com>
Signed-off-by: Sean Paul <seanpaul@chromium.org>
2018-12-03 08:46:14 -05:00
YueHaibing
671465198e drm/msm/hdmi: Drop pointless static qualifier in msm_hdmi_bind()
There is no need to have the 'struct hdmi_platform_config *hdmi_cfg'
variable static since new value always be assigned before use it.

Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Rob Clark <robdclark@gmail.com>
Signed-off-by: Sean Paul <seanpaul@chromium.org>
2018-12-03 08:46:14 -05:00
Robert Foss
2189463dba drm/msm: Move fence put to where failure occurs
If dma_fence_wait fails to wait for a supplied in-fence in
msm_ioctl_gem_submit, make sure we release that in-fence.

Also remove this dma_fence_put() from the 'out' label.

Signed-off-by: Robert Foss <robert.foss@collabora.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: stable@vger.kernel.org
Signed-off-by: Rob Clark <robdclark@gmail.com>
Signed-off-by: Sean Paul <seanpaul@chromium.org>
2018-12-03 08:46:13 -05:00
Sean Paul
081679c51e drm/msm: dpu: Don't set legacy plane->crtc pointer
It causes a WARN in drm_atomic_get_plane_state(), and is not used by
atomic (or dpu).

Signed-off-by: Sean Paul <seanpaul@chromium.org>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Rob Clark <robdclark@gmail.com>
2018-12-03 08:46:13 -05:00
Jordan Crouse
d52900437e drm/msm/gpu: Don't map command buffers with nr_relocs equal to 0
If a command buffer doesn't have any relocs assigned to it there then
is no need to map it in the kernel address space.

Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
Signed-off-by: Sean Paul <seanpaul@chromium.org>
2018-12-03 08:46:13 -05:00
Todor Tomov
ee44563596 drm/msm/hdmi: Enable HPD after HDMI IRQ is set up
SoCs that contain MDP5 have a top level wrapper called MDSS that
manages locks, power and irq for the sub-blocks within it.

Irq for HDMI is also routed through the MDSS.

Shortly after the Hot Plug Detection (HPD) is enabled in HDMI,
HDMI interrupts are recieved by the MDSS interrupt handler.
However at this moment the HDMI irq is still not mapped to
the MDSS irq domain so the HDMI irq handler cannot be called
to process the interrupts.

This leads to a flood of HDMI interrupts on CPU 0.

If we are lucky to have the HDMI initialization running on a
different CPU, it will eventually map the HDMI irq to MDSS irq
domain, the next HDMI interrupt will be handled by the HDMI irq
handler, the interrupt flood will stop and we will recover.

If the HDMI initialization is running on CPU 0, then it cannot
complete and there is nothing to stop the interrupt flood on
CPU 0. The system is stuck.

Fix this by moving the HPD enablement after the HDMI irq is
mapped to the MDSS irq domain.

Signed-off-by: Todor Tomov <todor.tomov@linaro.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
Signed-off-by: Sean Paul <seanpaul@chromium.org>
2018-12-03 08:46:13 -05:00
Jeykumar Sankaran
7f9743abaa drm/msm: validate display and event threads
While creating display and event threads per crtc, validate
them before setting their priorities.

changes in v2:
	- use dev_warn (Abhinav Kumar)
changes in v3:
	- fix compilation error
changes in v4:
	- Remove Change-Id (Sean Paul)
	- Keep logging within 80 char limit (Sean Paul)

Reviewed-by: Sean Paul <seanpaul@chromium.org>
Signed-off-by: Jeykumar Sankaran <jsanka@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
Signed-off-by: Sean Paul <seanpaul@chromium.org>
2018-12-03 08:46:07 -05:00
Sebastian Reichel
3c613a3bdd drm/omap: fix incorrect union usage
The DSI encoder sets dssdev->ops->dsi.set_config, which is stored at the
same offset as dssdev->ops->hdmi.set_hdmi_mode. The code in omap_encoder
only checks if dssdev->ops->hdmi.set_hdmi_mode is NULL. Due to the way
union works, it won't be NULL if dsi.set_config is set. This means
dsi_set_config will be called with config=hdmi_mode=false=NULL parameter
resulting in a NULL dereference. Also the dereference happens while
console is locked, so kernel hangs without any debug output without
"fb.lockless_register_fb=1" parameter.

This restructures the code, so that the HDMI mode is only configured
for HDMI output types.

Fixes: 83910ad3f5 ("drm/omap: Move most omap_dss_driver operations to omap_dss_device_ops")
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Tested-by: Tony Lindgren <tony@atomide.com>
[tomi.valkeinen@ti.com: dropped the safeguard]
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20181121160916.22017-5-sebastian.reichel@collabora.com
2018-12-03 14:46:30 +02:00
Sebastian Reichel
0a02d49553 drm/omap: populate DSI platform bus earlier
After the changes from 4.20 the DSI encoder tries to find the
attached panel before populating the DSI bus. If the panel is
not found -EPROBE_DEFER is returned, so the DSI bus is never
populated and the panel never added.

Fix this by populating the DSI bus before searching for the
video sink in dsi_init_output().

Fixes: 27d624527d ("drm/omap: dss: Acquire next dssdev at probe time")
Acked-by: Pavel Machek <pavel@ucw.cz>
Tested-by: Tony Lindgren <tony@atomide.com>
Tested-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20181121160916.22017-3-sebastian.reichel@collabora.com
2018-12-03 14:46:30 +02:00
Tomi Valkeinen
0a7f54ea0e drm/omap: fix bus_flags for panel-dpi
panel-dpi used to convey the bus-flags via the videomode, but recent
changes changed the use of videomode to DRM's drm_display_mode which
does not contain bus-flags. This broke panel-dpi, which didn't
explicitly store the bus-flags into dssdev->bus_flags.

Fix this by setting dssdev->bus_flags. Also change the bus_flags type to
u32, as that is the type used in the DRM framework, and we would get a
warning with drm_bus_flags_from_videomode() otherwise.

Fixes: 3fbda31e81 ("drm/omap: Split mode fixup and mode set from encoder enable")
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Reported-by: H. Nikolaus Schaller <hns@goldelico.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20181126092447.11864-1-tomi.valkeinen@ti.com
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
2018-12-03 14:36:05 +02:00