Commit Graph

637175 Commits

Author SHA1 Message Date
Daniel Vetter
75e75cbd55 Merge remote-tracking branch 'airlied/drm-next' into drm-misc-next
Backmerge v4.9-rc8 to get at

commit e94bd1736f
Author: Michel Dänzer <michel.daenzer@amd.com>
Date:   Wed Nov 30 17:30:01 2016 +0900

drm: Don't call drm_for_each_crtc with a non-KMS driver

so I can apply Michel's follow-up patch.

Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
2016-12-06 10:26:48 +01:00
Nicolai Stange
58309befa8 drm/amdgpu: don't add files at control minor debugfs directory
Since commit 8a357d1004 ("drm: Nerf DRM_CONTROL nodes"), a
struct drm_device's ->control member is always NULL.

In the case of CONFIG_DEBUG_FS=y, amdgpu_debugfs_add_files() accesses
->control->debugfs_root though. This results in a NULL pointer
dereference.

Fix this by omitting the drm_debugfs_create_files() call for the
control minor debugfs directory which is now non-existent anyway.

Fixes: 8a357d1004 ("drm: Nerf DRM_CONTROL nodes")
Signed-off-by: Nicolai Stange <nicstange@gmail.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=98915
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Tested-by: Mike Lothian <mike@fireburn.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/20161205203022.11671-1-nicstange@gmail.com
2016-12-06 10:03:28 +01:00
Marta Lofstedt
8f5040e421 drm: allow changing DPMS mode
The drm_atomic_helper_connector_dpms
will set the connector back the old DPMS state
before returning. This makes it impossible to change
DPMS state of the connector.

Fixes: 0853695c3b
v2: edit of commit message
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Eric Engestrom <eric.engestrom@imgtec.com>
Cc: Sean Paul <seanpaul@chromium.org>
Cc: dri-devel@lists.freedesktop.org
Cc: <drm-intel-fixes@lists.freedesktop.org>
Signed-off-by: Marta Lofstedt <marta.lofstedt@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/20161205120408.13056-1-marta.lofstedt@intel.com
2016-12-06 10:03:28 +01:00
Neil Armstrong
1de7ac686b MAINTAINERS: add entry for Amlogic DRM drivers
Add myself as maintainer for Amlogic DRM drivers.

Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
2016-12-06 09:54:15 +01:00
Neil Armstrong
42a7119b51 dt-bindings: display: add Amlogic Meson DRM Bindings
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
2016-12-06 09:53:56 +01:00
Dave Airlie
51007df383 Merge branch 'drm-next/mxsfb' of git://git.kernel.org/pub/scm/linux/kernel/git/marex/linux-2.6 into drm-next
Add new driver for MXSFB.

* 'drm-next/mxsfb' of git://git.kernel.org/pub/scm/linux/kernel/git/marex/linux-2.6:
  drm: Add new driver for MXSFB controller
  dt-bindings: mxsfb: Add new bindings for the MXSFB driver
  dt-bindings: mxsfb: Indentation cleanup
2016-12-06 14:40:50 +10:00
Marek Vasut
45d59d7040 drm: Add new driver for MXSFB controller
Add new driver for the MXSFB controller found in i.MX23/28/6SX .
The MXSFB controller is a simple framebuffer controller with one
parallel LCD output. Unlike the MXSFB fbdev driver that is used
on these systems now, this driver uses the DRM/KMS framework.

Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Lucas Stach <l.stach@pengutronix.de>
Cc: Fabio Estevam <fabio.estevam@nxp.com>
Cc: Shawn Guo <shawnguo@kernel.org>
2016-12-06 03:02:26 +01:00
Marek Vasut
7b920aae91 dt-bindings: mxsfb: Add new bindings for the MXSFB driver
Add new DT bindings for new MXSFB driver that is using the
OF graph to parse the video output structure instead of
hard-coding the display properties into the MXSFB node.
The old MXSFB fbdev driver bindings are preserved in the
same file in the "Old bindings" section.

Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Rob Herring <robh@kernel.org>
Cc: Lucas Stach <l.stach@pengutronix.de>
Cc: Fabio Estevam <fabio.estevam@nxp.com>
Cc: Shawn Guo <shawnguo@kernel.org>
Acked-by: Rob Herring <robh@kernel.org>
2016-12-06 03:02:25 +01:00
Marek Vasut
9c8f2eed73 dt-bindings: mxsfb: Indentation cleanup
Clean up the ad-hoc indentation in the documentation, no functional change.

Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Lucas Stach <l.stach@pengutronix.de>
Cc: Fabio Estevam <fabio.estevam@nxp.com>
Cc: Shawn Guo <shawnguo@kernel.org>
Acked-by: Rob Herring <robh@kernel.org>
2016-12-06 03:02:25 +01:00
Dave Airlie
197aa6ed52 Merge branch 'exynos-drm-next' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-next
Just refactoring HDMI driver by using infoframe helper
function, fixing GSC Kconfig dependency issue and including trivial
cleanups.

* 'exynos-drm-next' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos:
  drm/exynos: Use VIDEO_SAMSUNG_EXYNOS_GSC=n as GSC Kconfig dependency
  drm/exynos: gsc: fix spelling mistakes
  exynos-drm: Fix error messages to print flags and size
  drm/exynos/hdmi: refactor infoframe code
2016-12-06 11:09:21 +10:00
Dave Airlie
17f1dfd01c Merge branch 'drm-next-4.10' of git://people.freedesktop.org/~agd5f/linux into drm-next
- lots of code cleanup
- lots of bug fixes
- expose rpm based fan info via hwmon
- lots of clock and powergating fixes
- SI register header cleanup and conversion to common format used by newer asics

* 'drm-next-4.10' of git://people.freedesktop.org/~agd5f/linux: (54 commits)
  drm/amdgpu: drop is_display_hung from display funcs
  drm/amdgpu/uvd: reduce IB parsing overhead on UVD5+ (v2)
  drm/amdgpu/uvd: consolidate code for fetching addr from ctx
  drm/amdgpu: Disable DPM in virtualization
  drm/amdgpu: use AMDGPU_GEM_CREATE_VRAM_CLEARED for VM PD/PTs (v2)
  drm/amdgpu: improve AMDGPU_GEM_CREATE_VRAM_CLEARED handling (v2)
  drm/amdgpu: fix error handling in amdgpu_bo_create_restricted
  drm/amdgpu: fix amdgpu_fill_buffer (v2)
  drm/amdgpu: remove amdgpu_irq_get_delayed
  amdgpu: Wrap dev_err() calls on vm faults with printk_ratelimit()
  amdgpu: Use dev_err() over vanilla printk() in vm_decode_fault()
  drm/amd/amdgpu: port of DCE v6 to new headers (v3)
  drm/amdgpu: cleanup unused iterator members for sdma v2.4
  drm/amdgpu: cleanup unused iterator members for sdma v3
  drm/amdgpu:impl vgt_flush for VI(V5)
  drm/amdgpu: enable uvd mgcg for Fiji.
  drm/amdgpu: refine cz uvd clock gate logic.
  drm/amdgpu: change log level to KERN_INFO in ci_dpm.c
  drm/amdgpu: always un-gate UVD REGS path.
  drm/amdgpu/sdma: fix typo in packet setup
  ...
2016-12-06 11:01:33 +10:00
Dave Airlie
770ac20413 Merge branch 'drm-etnaviv-next' of git://git.pengutronix.de/lst/linux into drm-next
- fix dma-buf export path to return correct SG table
- trivially implement direct dma-buf mapping
- allow DRAW_INSTANCED commands in validator
- make the driver work on i.MX6SX, yielding a working 2D/3D stack
together with Mareks MXS DRM driver

* 'drm-etnaviv-next' of git://git.pengutronix.de/lst/linux:
  MAINTAINERS: add etnaviv mailinglist
  drm/etnaviv: move linear window on MC1.0 parts if necessary
  drm/etnaviv: don't invoke OOM killer from dump code
  drm/etnaviv: fix gem_prime_get_sg_table to return new SG table
  drm/etnaviv: Allow DRAW_INSTANCED commands
  drm/etnaviv: implement dma-buf mmap
2016-12-06 11:00:16 +10:00
Dave Airlie
9ac63d9973 Merge branch 'linux-4.10' of git://github.com/skeggsb/linux into drm-next
- BIT_PERF_PTRS uses 32-bit pointers to its subtables, we were parsing
them as 16-bit, causing various issues on newer boards.
- Support for MXM on GM20x and up.
- More display-related fixes.

* 'linux-4.10' of git://github.com/skeggsb/linux:
  drm/nouveau/mxm: warn more loudly on unsupported DCB version
  drm/nouveau/mxm: handle DCB 4.1 modification
  drm/nouveau/bios/mxm: handle digital connector table 1.1
  drm/nouveau: Queue hpd_work on (runtime) resume
  drm/nouveau: Rename acpi_work to hpd_work
  drm/nouveau/kms/nv50: Fix atomic pageflip events.
  drm/nouveau/fb/ram/gp100-: fix memory detection where FBP_NUM != FBPA_NUM
  drm/nouveau/bios/volt: pointers are 32-bit
  drm/nouveau/bios/vmap: pointers are 32-bit
  drm/nouveau/bios/timing: pointers are 32-bit
  drm/nouveau/bios/therm: pointers are 32-bit
  drm/nouveau/bios/perf: pointers are 32-bit
  drm/nouveau/bios/iccsense: pointers are 32-bit
  drm/nouveau/bios/fan: pointers are 32-bit
  drm/nouveau/bios/cstep: pointers are 32-bit
  drm/nouveau/bios/boost: pointers are 32-bit
2016-12-06 09:34:43 +10:00
Ben Skeggs
a8f6cb7bb3 drm/nouveau/mxm: warn more loudly on unsupported DCB version
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2016-12-06 09:08:23 +10:00
Ben Skeggs
f6bf17391f drm/nouveau/mxm: handle DCB 4.1 modification
Allows MXM DCB modification to be handled on GM20x and newer boards.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2016-12-06 09:08:23 +10:00
Ben Skeggs
8ca99316fd drm/nouveau/bios/mxm: handle digital connector table 1.1
I suspect the version bump is just to signify that the table now specifies
pad macro/links instead of SOR/sublinks.

For our usage of the table, just recognising the new version is enough.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2016-12-06 09:08:23 +10:00
Mauro Carvalho Chehab
0f60724f53 docs: 00-INDEX: document directories/files with no docs
There are a number of files/directories that don't contain
any documentation. They're related to ReST file conversion.

As a matter of completeness, since Makefile is also documented
there, add an entry for those files too.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2016-12-05 14:21:42 -07:00
Mauro Carvalho Chehab
a240bfedee docs: 00-INDEX: remove non-existing entries
Several entries were moved to a directory; others got simply
removed. Get rid of those entries.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2016-12-05 14:21:39 -07:00
Mauro Carvalho Chehab
822d289f28 docs: 00-INDEX: add missing entries for documentation files/dirs
Several directories and individual files don't have entries at
00-INDEX. Add them, using, as reference, the initial text inside
the documentation file(s).

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2016-12-05 14:21:35 -07:00
Mauro Carvalho Chehab
79c87c30d0 docs: 00-INDEX: consolidate process/ and admin-guide/ description
Instead of having descriptions for individual files inside
the process/ and admin-guide/ documentation, consolidate them
into one entry per directory, just like other descriptions
inside 00-INDEX.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2016-12-05 14:21:29 -07:00
Mauro Carvalho Chehab
f15c323397 scripts: add a script to check if Documentation/00-INDEX is sane
It is easy to forget adding/removing entries at the
Documentation/00-INDEX file. In a matter of fact, even before
ReST conversion, people use to forget adding things here, as
there are lots of missing stuff out there.

Now that we're doing a hard work converting entries to ReST,
and while this hole file is not outdated, it is good to have
some tool that would help to verify that this file is kept
updated.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2016-12-05 14:21:24 -07:00
Kevin Peng
20b786eb25 Docs: change sh -> awk in REPORTING-BUGS
scripts/ver_linux has been rewritten as an awk script; update
documentation to reflect this fact.

Signed-off-by: Kevin Peng <kkpengboy@gmail.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2016-12-05 14:18:48 -07:00
Lukas Wunner
aad800403a Documentation/core-api/device_link: Add initial documentation
Document device links as introduced in v4.10 with commits:
    4bdb35506b ("driver core: Add a wrapper around
                   __device_release_driver()")
    9ed9895370 ("driver core: Functional dependencies tracking
                   support")
    8c73b42884 ("PM / sleep: Make async suspend/resume of devices use
                   device links")
    21d5c57b37 ("PM / runtime: Use device links")
    baa8809f60 ("PM / runtime: Optimize the use of device links")

Signed-off-by: Lukas Wunner <lukas@wunner.de>
[ jc: Moved from core-api to driver-api ]
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2016-12-05 14:14:55 -07:00
Pan Bian
16571a8a43 drm/qxl: fix use of uninitialized variable
In function qxl_release_alloc(), when kmalloc() returns a NULL pointer,
it returns value 0 and parameter *ret is uninitialized. 0 means no error
to the callers of qxl_release_alloc(). The callers keep going and will
try to reference the uninitialized variable. This patch fixes the bug,
returning "-ENOMEM" when kmalloc() fails.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188911

Signed-off-by: Pan Bian <bianpan2016@163.com>
[seanpaul fixed up subject prefix]
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Link: http://patchwork.freedesktop.org/patch/msgid/1480777902-7648-1-git-send-email-bianpan2016@163.com
2016-12-05 13:14:13 -05:00
Javier Martinez Canillas
4e77524926 drm/exynos: Use VIDEO_SAMSUNG_EXYNOS_GSC=n as GSC Kconfig dependency
Commit aeefb36832 ("drm/exynos: gsc: add device tree support and remove
usage of static mappings") made the DRM_EXYNOS_GSC Kconfig symbol to only
be selectable if the exynos-gsc V4L2 driver isn't enabled, since both use
the same HW IP block.

But added the dependency as depends on !VIDEO_SAMSUNG_EXYNOS_GSC which is
not correct since Kconfig expressions are not boolean but tristate. So it
will only evaluate to 'n' if VIDEO_SAMSUNG_EXYNOS_GSC=y but will evaluate
to 'm' if VIDEO_SAMSUNG_EXYNOS_GSC=m.

This means that both the V4L2 and DRM drivers can be enabled if the former
is enabled as a module, which isn't what we want since otherwise 2 drivers
could attempt to use the hardware at the same time.

Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
2016-12-05 22:08:59 +09:00
Colin Ian King
1bb399360f drm/exynos: gsc: fix spelling mistakes
Trivial fixes to spelling mistakes "precalser" to "prescaler"
in dev_err messages

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Javier Martinez Canillas <javier@osg.samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
2016-12-05 22:08:58 +09:00
Shuah Khan
63eb0a12d1 exynos-drm: Fix error messages to print flags and size
Fix exynos_drm_gem_create() error messages to include flags and size when
flags and size are invalid.

Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
2016-12-05 22:08:58 +09:00
Andrzej Hajda
5f9e228d1c drm/exynos/hdmi: refactor infoframe code
Use core helpers to generate infoframes and generate vendor frame if necessary.

Changelog:
- changed 'ret >= 0' checks to '!ret'

Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
2016-12-05 22:08:58 +09:00
Chris Wilson
7a9e10253e drm/i915: Move priority bumping for flips earlier
David found another issue with priority bumping from mmioflips, where we
are accessing the requests concurrently to them being retired and freed.
Whilst we are skipping the dependency if has been submitted, that is not
sufficient to stop the dependency from disappearing if another thread
retires that request. To prevent we can either employ the struct_mutex (or a
request mutex in the future) to serialise retiring before it is freed.
Alternatively, we need to keep the dependencies alive using RCU whilst
they are being accessed via the DFS.

[ 1746.698111] general protection fault: 0000 [#1] PREEMPT SMP
[ 1746.698305] Modules linked in: snd_hda_intel snd_hda_codec snd_hwdep x86_pkg_temp_thermal snd_hda_core coretemp crct10dif_pclmul crc32_pclmul snd_pcm ghash_clmulni_intel mei_me mei i915 e1000e ptp pps_core i2c_hid
[ 1746.698750] CPU: 1 PID: 6716 Comm: kworker/u8:2 Not tainted 4.9.0-rc6-CI-Nightly_816+ #1
[ 1746.698871] Hardware name: GIGABYTE GB-BKi7A-7500/MFLP7AP-00, BIOS F1 07/27/2016
[ 1746.699125] Workqueue: events_unbound intel_mmio_flip_work_func [i915]
[ 1746.699266] task: ffff880260a5e800 task.stack: ffffc90000f6c000
[ 1746.699361] RIP: 0010:[<ffffffffa006595d>]  [<ffffffffa006595d>] execlists_schedule+0x8d/0x300 [i915]
[ 1746.699632] RSP: 0018:ffffc90000f6fcd8  EFLAGS: 00010206
[ 1746.699724] RAX: dead0000000000f8 RBX: ffff8801f64b2bf0 RCX: ffff8801f64b2c10
[ 1746.699842] RDX: dead000000000100 RSI: 0000000000000000 RDI: ffff8801f64b0458
[ 1746.699972] RBP: ffffc90000f6fd68 R08: ffff88026488dc00 R09: 0000000000000002
[ 1746.700090] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000400
[ 1746.700195] R13: ffffc90000f6fcf0 R14: ffff88020955aa40 R15: ffff88020955aa68
[ 1746.700307] FS:  0000000000000000(0000) GS:ffff88026dc80000(0000) knlGS:0000000000000000
[ 1746.700435] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1746.700532] CR2: 0000000002a69e90 CR3: 0000000002c07000 CR4: 00000000003406e0
[ 1746.700635] Stack:
[ 1746.700682]  ffff880260a5e880 ffffc90000f6fd50 ffffffff810af69a ffffc90000f6fd28
[ 1746.700827]  ffff88020955a628 ffff8801e1eaebf0 0000000000000020 0000000000000000
[ 1746.700947]  00000196af1edc96 ffff88025dfa4000 ffff8801f0b030a8 ffffc90000f6fcf0
[ 1746.701071] Call Trace:
[ 1746.701117]  [<ffffffff810af69a>] ? dequeue_entity+0x25a/0xb50
[ 1746.701260]  [<ffffffffa00516be>] fence_set_priority+0x7e/0x80 [i915]
[ 1746.701406]  [<ffffffffa0051a15>] i915_gem_object_wait_priority+0x85/0x160 [i915]
[ 1746.701599]  [<ffffffffa008ccd7>] intel_mmio_flip_work_func+0x47/0x2b0 [i915]
[ 1746.701717]  [<ffffffff81094c4d>] process_one_work+0x14d/0x470
[ 1746.701809]  [<ffffffff81094fb3>] worker_thread+0x43/0x4e0
[ 1746.701888]  [<ffffffff81094f70>] ? process_one_work+0x470/0x470
[ 1746.701969]  [<ffffffff81094f70>] ? process_one_work+0x470/0x470
[ 1746.702072]  [<ffffffff8109a4d5>] kthread+0xc5/0xe0
[ 1746.702152]  [<ffffffff81771c59>] ? _raw_spin_unlock_irq+0x9/0x10
[ 1746.702234]  [<ffffffff8109a410>] ? kthread_park+0x60/0x60
[ 1746.702318]  [<ffffffff81772272>] ret_from_fork+0x22/0x30
[ 1746.702387] Code: 89 42 08 48 8b 45 88 48 89 55 c0 4c 89 6d c8 4c 8d 70 d8 4d 8d 7e 28 4d 39 ef 74 72 49 8b 1e 48 8b 13 48 39 d3 48 8d 42 f8 74 3e <48> 8b 10 8b 52 38 41 39 d4 7e 26 48 8b 50 30 48 8b 78 28 48 8d
[ 1746.702921] RIP  [<ffffffffa006595d>] execlists_schedule+0x8d/0x300 [i915]
Nov 25 21:42:54 kbl-gbbki7 kernel: [ 1746.703027]  RSP <ffffc90000f6fcd8>

Fixes: 27745e829a ("drm/i915/execlists: Use a local lock for dfs_link access")
Fixes: 9a151987d7 ("drm/i915: Add execution priority boosting for mmioflips")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: David Weinehall <david.weinehall@linux.intel.com>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20161128143649.4289-1-chris@chris-wilson.co.uk
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
(cherry picked from commit 92117f0bce)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2016-12-05 11:00:32 +02:00
Chris Wilson
0e932c080c drm/i915: Hold a reference on the request for its fence chain
Currently, we have an active reference for the request until it is
retired. Though it cannot be retired before it has been executed by
hardware, the request may be completed before we have finished
processing the execute fence, i.e. we may continue to process that fence
as we free the request.

Fixes: 5590af3e11 ("drm/i915: Drive request submission through fence callbacks")
Fixes: 23902e49c9 ("drm/i915: Split request submit/execute phase into two")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20161125131718.20978-3-chris@chris-wilson.co.uk
(cherry picked from commit 48bc2a4a42)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2016-12-05 11:00:32 +02:00
Libin Yang
b9f16ff273 drm/i915/audio: fix hdmi audio noise issue
Some monitors will have noise or even no sound after
applying the patch 6014ac12.

In patch 6014ac12, it will reset the cts value to 0 for HDMI.
However, we need to disable Enable CTS or M Prog bit. This is
the initial setting after HW reset.

Fixes: 6014ac122e ("drm/i915/audio: set proper N/M in modeset")
Signed-off-by: Libin Yang <libin.yang@intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1478853988-139842-1-git-send-email-libin.yang@intel.com
(cherry picked from commit 60abfbb86a)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2016-12-05 11:00:31 +02:00
Chris Wilson
3acd240175 drm/i915/debugfs: Increment return value of gt.next_seqno
The i915_next_seqno read value is to be the next seqno used by the
kernel. However, in the conversion to atomics ops for gt.next_seqno, in
commit 28176ef4cf ("drm/i915: Reserve space in the global seqno during
request allocation"), this was changed from a post-increment to a
pre-increment. This increment was missed from the value reported by
debugfs, so in effect it was reporting the current seqno (last
assigned), not the next seqno.

Fixes: 28176ef4cf ("drm/i915: Reserve space in the global seqno during request allocation")
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=81209
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20161124094752.19129-1-chris@chris-wilson.co.uk
Reviewed-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
(cherry picked from commit 9607ae7971)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2016-12-05 11:00:31 +02:00
Chris Wilson
6cef2f8477 drm/i915/debugfs: Drop i915_hws_info
i915_hws_info() has not been kept upto date (missing new engines) and so
I consider it to be unused. HWS is included in the error state, which
would be an avenue to retrieving it if required in future (possibly via
i915_engine_info). As it is currently oopsing with an rpm testcase, just
remove it.

Fixes: 3b3f1650b1 ("drm/i915: Allocate intel_engine_cs structure only for the enabled engines")
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=98838
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20161124093401.18852-1-chris@chris-wilson.co.uk
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
(cherry picked from commit 30576a2c46)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2016-12-05 11:00:31 +02:00
Ville Syrjälä
1f3dc3e334 drm/i915: Initialize dev_priv->atomic_cdclk_freq at init time
Looks like we're only initializing dev_priv->atomic_cdclk_freq
at resume and commit times, not at init time. Let's do that as
well.

We're now hitting the 'WARN_ON(intel_state->cdclk == 0)' in
hsw_compute_linetime_wm() on account of populating
intel_state->cdclk from dev_priv->atomic_cdclk_freq.
Previously we were mispopulating intel_state->cdclk with
dev_priv->cdclk_freq which always had a proper value at init
time and hence the WARN_ON() didn't trigger.

Cc: <stable@vger.kernel.org> # 4.6+: 14676ec6b1 drm/i915: Fix cdclk vs. dev_cdclk mess when not recomputing things
Cc: <stable@vger.kernel.org> # 4.6+
Cc: Matthew Auld <matthew.auld@intel.com>
Reported-by: Matthew Auld <matthew.auld@intel.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=98902
Fixes: 14676ec6b1 ("drm/i915: Fix cdclk vs. dev_cdclk mess when not recomputing things")
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1480428837-4207-1-git-send-email-ville.syrjala@linux.intel.com
Tested-by: Matthew Auld <matthew.auld@intel.com>
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
(cherry picked from commit 6a259b1f8a)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2016-12-05 10:58:31 +02:00
Ville Syrjälä
14676ec6b1 drm/i915: Fix cdclk vs. dev_cdclk mess when not recomputing things
When we end up not recomputing the cdclk, we need to populate
intel_state->cdclk with the "atomic_cdclk_freq" instead of the
current cdclk_freq. When no pipes are active, the actual cdclk_freq
may be lower than what the configuration of the planes and
pipes would require from the point of view of the software state.

This fixes bogus WARNS from skl_max_scale() which is trying to check
the plane software state against the cdclk frequency. So any time
it got called during DPMS off for instance, we might have tripped
the warn if the current mode would have required a higher than
minimum cdclk.

v2: Drop the dev_cdclk stuff (Maarten)

Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Mika Kahola <mika.kahola@intel.com>
Cc: bruno.pagani@ens-lyon.org
Cc: Daniel J Blueman <daniel.blueman@gmail.com>
Cc: Paul Bolle <pebolle@tiscali.nl>
Cc: Joseph Yasi <joe.yasi@gmail.com>
Tested-by: Paul Bolle <pebolle@tiscali.nl>
Tested-by: Joseph Yasi <joe.yasi@gmail.com> (v1)
Cc: <stable@vger.kernel.org> # v4.6+
Fixes: 1a617b7765 ("drm/i915: Keep track of the cdclk as if all crtc's were active.")
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=98214
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1479141311-11904-2-git-send-email-ville.syrjala@linux.intel.com
(cherry picked from commit e0ca7a6be3)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2016-12-05 10:55:07 +02:00
Ville Syrjälä
9910157432 drm/i915: Make skl_write_{plane,cursor}_wm() static
Someone forgot to make skl_write_{plane,cursor}_wm() static when
removing the prototypes from the header. Sparse isn't pleased.

Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Lyude <cpaul@redhat.com>
Cc: Matt Roper <matthew.d.roper@intel.com>
Fixes: e62929b3f6 ("drm/i915/gen9+: Program watermarks as a separate step during evasion, v3.")
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1479846113-24745-1-git-send-email-ville.syrjala@linux.intel.com
Reviewed-by: Lyude <lyude@redhat.com>
Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
(cherry picked from commit d9348dec90)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2016-12-05 10:38:14 +02:00
Chris Wilson
ce1135c7de drm/i915: Complete requests in nop_submit_request
Since the submit/execute split in commit d55ac5bf97 ("drm/i915: Defer
transfer onto execution timeline to actual hw submission") the
global seqno advance was deferred until the submit_request callback.
After wedging the GPU, we were installing a nop_submit_request handler
(to avoid waking up the dead hw) but I had missed converting this over
to the new scheme. Under the new scheme, we have to explicitly call
i915_gem_submit_request() from the submit_request handler to mark the
request as on the hardware. If we don't the request is always pending,
and any waiter will continue to wait indefinitely and hangcheck will not
be able to resolve the lockup.

References: https://bugs.freedesktop.org/show_bug.cgi?id=98748
Testcase: igt/gem_eio/in-flight
Fixes: d55ac5bf97 ("drm/i915: Defer transfer onto execution timeline to actual hw submission")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20161122144121.7379-3-chris@chris-wilson.co.uk
(cherry picked from commit 3dcf93f7f2)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2016-12-05 10:38:01 +02:00
Daniel Vetter
48d9831627 drm/qxl: Don't register debugfs for control minors
They're gone since 8a357d1004 ("drm: Nerf DRM_CONTROL nodes").
Spotted while doing a full audit when revieng a similar patch from
Nicolai for radeon.

v2: Drink coffee first aka don't forget the unregister side.

Cc: Dave Airlie <airlied@redhat.com>
Fixes: 8a357d1004 ("drm: Nerf DRM_CONTROL nodes")
Cc: Nicolai Stange <nicstange@gmail.com>
Acked-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20161205072926.12546-1-daniel.vetter@ffwll.ch
2016-12-05 08:30:35 +01:00
Nicolai Stange
1f32478f8f drm/radeon: don't add files at control minor debugfs directory
Since commit 8a357d1004 ("drm: Nerf DRM_CONTROL nodes"), a
struct drm_device's ->control member is always NULL.

In the case of CONFIG_DEBUG_FS=y, radeon_debugfs_add_files() accesses
->control->debugfs_root though. This results in the following Oops:

  BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
  IP: radeon_debugfs_add_files+0x90/0x100 [radeon]
  PGD 0
  Oops: 0000 [#1] SMP
  [...]
  Call Trace:
   ? work_on_cpu+0xb0/0xb0
   radeon_fence_driver_init+0x120/0x150 [radeon]
   si_init+0x122/0xd50 [radeon]
   ? _raw_spin_unlock_irq+0x2c/0x40
   ? device_pm_check_callbacks+0xb3/0xc0
   radeon_device_init+0x958/0xda0 [radeon]
   radeon_driver_load_kms+0x9a/0x210 [radeon]
   drm_dev_register+0xa9/0xd0 [drm]
   drm_get_pci_dev+0x9c/0x1e0 [drm]
   radeon_pci_probe+0xb8/0xe0 [radeon]
  [...]

Fix this by omitting the drm_debugfs_create_files() call for the
control minor debugfs directory which is now non-existent anyway.

Fixes: 8a357d1004 ("drm: Nerf DRM_CONTROL nodes")
Signed-off-by: Nicolai Stange <nicstange@gmail.com>
Acked-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/20161203144700.2307-1-nicstange@gmail.com
2016-12-05 08:28:37 +01:00
Dave Airlie
f03ee46be9 Linux 4.9-rc8
-----BEGIN PGP SIGNATURE-----
 
 iQEcBAABAgAGBQJYRIGyAAoJEHm+PkMAQRiG2ksH/jwMUT9j6glbwESxbn1YTqTM
 QcBT5AMc7D0wNuidQe0hWZMtG4RbC+4ZhxzZl2wPgA2gueJ+rBnyX7bgtA7ka8ka
 Fdc3u/Q1v38HPzf8iBnxcdCs40VgsoMLjFYCXrpOxuGDNKYzRd+Q8aI2TeGvzbyi
 X8+6oAWifBwo2oA06jfcuUncEWbyDDyK9aQksmfKOpjHdb26yELPEhsPOlds1g7E
 jYLnvUVnU2CoFaumta+rZQ0kzLdc4Ntu0wEao6WzJuQKsgoID+tS/6iudi8cUhDp
 YowGAVoOfr6rAJB0mwrDVfugpamaT3386XKyocdNsK0/jR60UIJ8x+WzvvSU+lY=
 =JTBj
 -----END PGP SIGNATURE-----

Backmerge tag 'v4.9-rc8' into drm-next

Linux 4.9-rc8

Daniel requested this so we could apply some follow on fixes cleanly to -next.
2016-12-05 17:11:48 +10:00
Linus Torvalds
3e5de27e94 Linux 4.9-rc8 2016-12-04 12:50:51 -08:00
Linus Torvalds
0cb65c8330 Merge tag 'drm-fixes-for-v4.9-rc8' of git://people.freedesktop.org/~airlied/linux
Pull drm fixes from Dave Airlie:
 "A pretty small pull request: a couple of AMD powerxpress regression
  fixes and a power management fix, a couple of i915 fixes and one hdlcd
  fix, along with one core don't oops because of incorrect API usage fix"

* tag 'drm-fixes-for-v4.9-rc8' of git://people.freedesktop.org/~airlied/linux:
  drm/i915: drop the struct_mutex when wedged or trying to reset
  drm/i915: Don't touch NULL sg on i915_gem_object_get_pages_gtt() error
  drm: Don't call drm_for_each_crtc with a non-KMS driver
  drm/radeon: fix check for port PM availability
  drm/amdgpu: fix check for port PM availability
  drm/amd/powerplay: initialize the soft_regs offset in struct smu7_hwmgr
  drm: hdlcd: Fix cleanup order
2016-12-03 16:40:21 -08:00
Dave Airlie
ab7cd8d83e Merge tag 'drm-intel-fixes-2016-12-01' of git://anongit.freedesktop.org/git/drm-intel into drm-fixes
2 intel fixes.

* tag 'drm-intel-fixes-2016-12-01' of git://anongit.freedesktop.org/git/drm-intel:
  drm/i915: drop the struct_mutex when wedged or trying to reset
  drm/i915: Don't touch NULL sg on i915_gem_object_get_pages_gtt() error
2016-12-04 06:31:26 +10:00
Linus Torvalds
3c49de52d5 Merge branch 'akpm' (patches from Andrew)
Merge more fixes from Andrew Morton:
 "2 fixes"

* emailed patches from Andrew Morton <akpm@linux-foundation.org>:
  mm, vmscan: add cond_resched() into shrink_node_memcg()
  mm: workingset: fix NULL ptr in count_shadow_nodes
2016-12-02 18:48:11 -08:00
Michal Hocko
bd041733c9 mm, vmscan: add cond_resched() into shrink_node_memcg()
Boris Zhmurov has reported RCU stalls during the kswapd reclaim:

  INFO: rcu_sched detected stalls on CPUs/tasks:
   23-...: (22 ticks this GP) idle=92f/140000000000000/0 softirq=2638404/2638404 fqs=23
   (detected by 4, t=6389 jiffies, g=786259, c=786258, q=42115)
  Task dump for CPU 23:
  kswapd1         R  running task        0   148      2 0x00000008
  Call Trace:
    shrink_node+0xd2/0x2f0
    kswapd+0x2cb/0x6a0
    mem_cgroup_shrink_node+0x160/0x160
    kthread+0xbd/0xe0
    __switch_to+0x1fa/0x5c0
    ret_from_fork+0x1f/0x40
    kthread_create_on_node+0x180/0x180

a closer code inspection has shown that we might indeed miss all the
scheduling points in the reclaim path if no pages can be isolated from
the LRU list.  This is a pathological case but other reports from Donald
Buczek have shown that we might indeed hit such a path:

        clusterd-989   [009] .... 118023.654491: mm_vmscan_direct_reclaim_end: nr_reclaimed=193
         kswapd1-86    [001] dN.. 118023.987475: mm_vmscan_lru_isolate: isolate_mode=0 classzone=0 order=0 nr_requested=32 nr_scanned=4239830 nr_taken=0 file=1
         kswapd1-86    [001] dN.. 118024.320968: mm_vmscan_lru_isolate: isolate_mode=0 classzone=0 order=0 nr_requested=32 nr_scanned=4239844 nr_taken=0 file=1
         kswapd1-86    [001] dN.. 118024.654375: mm_vmscan_lru_isolate: isolate_mode=0 classzone=0 order=0 nr_requested=32 nr_scanned=4239858 nr_taken=0 file=1
         kswapd1-86    [001] dN.. 118024.987036: mm_vmscan_lru_isolate: isolate_mode=0 classzone=0 order=0 nr_requested=32 nr_scanned=4239872 nr_taken=0 file=1
         kswapd1-86    [001] dN.. 118025.319651: mm_vmscan_lru_isolate: isolate_mode=0 classzone=0 order=0 nr_requested=32 nr_scanned=4239886 nr_taken=0 file=1
         kswapd1-86    [001] dN.. 118025.652248: mm_vmscan_lru_isolate: isolate_mode=0 classzone=0 order=0 nr_requested=32 nr_scanned=4239900 nr_taken=0 file=1
         kswapd1-86    [001] dN.. 118025.984870: mm_vmscan_lru_isolate: isolate_mode=0 classzone=0 order=0 nr_requested=32 nr_scanned=4239914 nr_taken=0 file=1
  [...]
         kswapd1-86    [001] dN.. 118084.274403: mm_vmscan_lru_isolate: isolate_mode=0 classzone=0 order=0 nr_requested=32 nr_scanned=4241133 nr_taken=0 file=1

this is minute long snapshot which didn't take a single page from the
LRU.  It is not entirely clear why only 1303 pages have been scanned
during that time (maybe there was a heavy IRQ activity interfering).

In any case it looks like we can really hit long periods without
scheduling on non preemptive kernels so an explicit cond_resched() in
shrink_node_memcg which is independent on the reclaim operation is due.

Link: http://lkml.kernel.org/r/20161202095841.16648-1-mhocko@kernel.org
Signed-off-by: Michal Hocko <mhocko@suse.com>
Reported-by: Boris Zhmurov <bb@kernelpanic.ru>
Tested-by: Boris Zhmurov <bb@kernelpanic.ru>
Reported-by: Donald Buczek <buczek@molgen.mpg.de>
Reported-by: "Christopher S. Aker" <caker@theshore.net>
Reported-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-12-02 18:48:03 -08:00
Michal Hocko
20ab67a563 mm: workingset: fix NULL ptr in count_shadow_nodes
Commit 0a6b76dd23 ("mm: workingset: make shadow node shrinker memcg
aware") has made the workingset shadow nodes shrinker memcg aware.  The
implementation is not correct though because memcg_kmem_enabled() might
become true while we are doing a global reclaim when the sc->memcg might
be NULL which is exactly what Marek has seen:

  BUG: unable to handle kernel NULL pointer dereference at 0000000000000400
  IP: [<ffffffff8122d520>] mem_cgroup_node_nr_lru_pages+0x20/0x40
  PGD 0
  Oops: 0000 [#1] SMP
  CPU: 0 PID: 60 Comm: kswapd0 Tainted: G           O   4.8.10-12.pvops.qubes.x86_64 #1
  task: ffff880011863b00 task.stack: ffff880011868000
  RIP: mem_cgroup_node_nr_lru_pages+0x20/0x40
  RSP: e02b:ffff88001186bc70  EFLAGS: 00010293
  RAX: 0000000000000000 RBX: ffff88001186bd20 RCX: 0000000000000002
  RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000
  RBP: ffff88001186bc70 R08: 28f5c28f5c28f5c3 R09: 0000000000000000
  R10: 0000000000006c34 R11: 0000000000000333 R12: 00000000000001f6
  R13: ffffffff81c6f6a0 R14: 0000000000000000 R15: 0000000000000000
  FS:  0000000000000000(0000) GS:ffff880013c00000(0000) knlGS:ffff880013d00000
  CS:  e033 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 0000000000000400 CR3: 00000000122f2000 CR4: 0000000000042660
  Call Trace:
    count_shadow_nodes+0x9a/0xa0
    shrink_slab.part.42+0x119/0x3e0
    shrink_node+0x22c/0x320
    kswapd+0x32c/0x700
    kthread+0xd8/0xf0
    ret_from_fork+0x1f/0x40
  Code: 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 3b 35 dd eb b1 00 55 48 89 e5 73 2c 89 d2 31 c9 31 c0 4c 63 ce 48 0f a3 ca 73 13 <4a> 8b b4 cf 00 04 00 00 41 89 c8 4a 03 84 c6 80 00 00 00 83 c1
  RIP  mem_cgroup_node_nr_lru_pages+0x20/0x40
   RSP <ffff88001186bc70>
  CR2: 0000000000000400
  ---[ end trace 100494b9edbdfc4d ]---

This patch fixes the issue by checking sc->memcg rather than
memcg_kmem_enabled() which is sufficient because shrink_slab makes sure
that only memcg aware shrinkers will get non-NULL memcgs and only if
memcg_kmem_enabled is true.

Fixes: 0a6b76dd23 ("mm: workingset: make shadow node shrinker memcg aware")
Link: http://lkml.kernel.org/r/20161201132156.21450-1-mhocko@kernel.org
Signed-off-by: Michal Hocko <mhocko@suse.com>
Reported-by: Marek Marczykowski-Górecki <marmarek@mimuw.edu.pl>
Tested-by: Marek Marczykowski-Górecki <marmarek@mimuw.edu.pl>
Acked-by: Vladimir Davydov <vdavydov.dev@gmail.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Balbir Singh <bsingharora@gmail.com>
Cc: <stable@vger.kernel.org>	[4.6+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-12-02 18:48:03 -08:00
Nicolas Pitre
8655639240 kbuild: fix building bzImage with CONFIG_TRIM_UNUSED_KSYMS enabled
When building a specific target such as bzImage, modules aren't normally
built.  However if CONFIG_TRIM_UNUSED_KSYMS is enabled, no built modules
means none of the exported symbols are used and therefore they will all
be trimmed away from the final kernel.  A subsequent "make modules" will
fail because modpost cannot find the needed symbols for those modules in
the kernel binary.

Let's make sure modules are also built whenever CONFIG_TRIM_UNUSED_KSYMS
is enabled and that the kernel binary is properly rebuilt accordingly.

Signed-off-by: Nicolas Pitre <nico@linaro.org>
Tested-by: Jarod Wilson <jarod@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-12-02 14:46:42 -08:00
Linus Torvalds
8dc0f265d3 ARM: SoC fixes for v4.9
This should be the last set of bugfixes for arm-soc in v4.9.
 None of these are critical regressions, but it would be nice
 to still get them merged.
 
 - On the Juno platform, the idle latency was described wrong,
   leading to suboptimal cpuidle tuning.
 
 - Also on the same platform, PCI I/O space was set up incorrectly
   and could not work.
 
 - On the sti platform, a syntactically incorrect DT entry caused
   warnings.
 
 - The newly added 'gr8' platform has somewhat confusing file
   names, which we rename for consistency.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIVAwUAWEHbGWCrR//JCVInAQKDbg//RRY2HqrkaRhEk9ZKFlWA4TiOqp61vuB9
 FheAld7gwtY7fnqsfiWrXWQz6oIa/MGq0BYvvcemrUaVAjDA8PP3M8LoeC797bnP
 pPsmlVgjq86wWBAgHyTTEQsmuIMAZaaVoSCrrk9GFpNstNrPBVLm/yDs0A5/Ft87
 se9Mvm/X8SErDB7GcOjyaH3rYk+pFr9irDvJzup0A/JeESohdLQOsWFi+WUg9sSr
 9fiAkSIHyivHoNwvNGXgg2+PV9EyAtStEvzTe60zElRVtwKeVX+CwBt56neHMzIE
 yqKrayJ0ZAeTeobtYZtV+jgqFnv9h8anXostty3nlsqOxlZ/wxrQRLkly5UJFiuF
 yXP0850ocIzsiBtInbbv1w4+08YP84i7CMIU1GGrPfUBguarAJrWWhfhPnMLiy0F
 PZABUqeKgA+nEuM1gwTnC+pR+73CBPPn4B0Li2pRedA42rCXJIzFkEMuxEupyrcL
 LZMxwK5C5iUkJMFPIM/q9par4gkIjbLoYLC1yMPY0OziaT5WHG5qpfSmbXBsLo2S
 yezdNS9BKts3stOXfcH9ZeuqeaiZyZ3hi4Ry+cXoVmVs26zE0QHv4uVm5h0gc2J8
 BcgovfCJd/sTPL+FwZQB8BjCGOrkZW95Lg+79kSmxZyV6hvMglu6kJ1K2M3KTO7l
 7J+g5f790+k=
 =0ZGG
 -----END PGP SIGNATURE-----

Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc

Pull ARM SoC fixes from Arnd Bergmann:
 "This should be the last set of bugfixes for arm-soc in v4.9. None of
  these are critical regressions, but it would be nice to still get them
  merged.

   - On the Juno platform, the idle latency was described wrong, leading
     to suboptimal cpuidle tuning.

   - Also on the same platform, PCI I/O space was set up incorrectly and
     could not work.

   - On the sti platform, a syntactically incorrect DT entry caused
     warnings.

   - The newly added 'gr8' platform has somewhat confusing file names,
     which we rename for consistency"

* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  arm64: dts: juno: fix cluster sleep state entry latency on all SoC versions
  arm64: dts: juno: Correct PCI IO window
  ARM: dts: STiH407-family: fix i2c nodes
  ARM: gr8: Rename the DTSI and relevant DTS
2016-12-02 13:34:37 -08:00
Linus Torvalds
8bca927f13 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller:

 1) Lots more phydev and probe error path leaks in various drivers by
    Johan Hovold.

 2) Fix race in packet_set_ring(), from Philip Pettersson.

 3) Use after free in dccp_invalid_packet(), from Eric Dumazet.

 4) Signnedness overflow in SO_{SND,RCV}BUFFORCE, also from Eric
    Dumazet.

 5) When tunneling between ipv4 and ipv6 we can be left with the wrong
    skb->protocol value as we enter the IPSEC engine and this causes all
    kinds of problems. Set it before the output path does any
    dst_output() calls, from Eli Cooper.

 6) bcmgenet uses wrong device struct pointer in DMA API calls, fix from
    Florian Fainelli.

 7) Various netfilter nat bug fixes from FLorian Westphal.

 8) Fix memory leak in ipvlan_link_new(), from Gao Feng.

 9) Locking fixes, particularly wrt. socket lookups, in l2tp from
    Guillaume Nault.

10) Avoid invoking rhash teardowns in atomic context by moving netlink
    cb->done() dump completion from a worker thread. Fix from Herbert
    Xu.

11) Buffer refcount problems in tun and macvtap on errors, from Jason
    Wang.

12) We don't set Kconfig symbol DEFAULT_TCP_CONG properly when the user
    selects BBR. Fix from Julian Wollrath.

13) Fix deadlock in transmit path on altera TSE driver, from Lino
    Sanfilippo.

14) Fix unbalanced reference counting in dsa_switch_tree, from Nikita
    Yushchenko.

15) tc_tunnel_key needs to be properly exported to userspace via uapi,
    fix from Roi Dayan.

16) rds_tcp_init_net() doesn't unregister notifier in error path, fix
    from Sowmini Varadhan.

17) Stale packet header pointer access after pskb_expand_head() in
    genenve driver, fix from Sabrina Dubroca.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (103 commits)
  net: avoid signed overflows for SO_{SND|RCV}BUFFORCE
  geneve: avoid use-after-free of skb->data
  tipc: check minimum bearer MTU
  net: renesas: ravb: unintialized return value
  sh_eth: remove unchecked interrupts for RZ/A1
  net: bcmgenet: Utilize correct struct device for all DMA operations
  NET: usb: qmi_wwan: add support for Telit LE922A PID 0x1040
  cdc_ether: Fix handling connection notification
  ip6_offload: check segs for NULL in ipv6_gso_segment.
  RDS: TCP: unregister_netdevice_notifier() in error path of rds_tcp_init_net
  Revert: "ip6_tunnel: Update skb->protocol to ETH_P_IPV6 in ip6_tnl_xmit()"
  ipv6: Set skb->protocol properly for local output
  ipv4: Set skb->protocol properly for local output
  packet: fix race condition in packet_set_ring
  net: ethernet: altera: TSE: do not use tx queue lock in tx completion handler
  net: ethernet: altera: TSE: Remove unneeded dma sync for tx buffers
  net: ethernet: stmmac: fix of-node and fixed-link-phydev leaks
  net: ethernet: stmmac: platform: fix outdated function header
  net: ethernet: stmmac: dwmac-meson8b: fix probe error path
  net: ethernet: stmmac: dwmac-generic: fix probe error path
  ...
2016-12-02 11:45:27 -08:00
Eric Dumazet
b98b0bc8c4 net: avoid signed overflows for SO_{SND|RCV}BUFFORCE
CAP_NET_ADMIN users should not be allowed to set negative
sk_sndbuf or sk_rcvbuf values, as it can lead to various memory
corruptions, crashes, OOM...

Note that before commit 8298193012 ("net: cleanups in
sock_setsockopt()"), the bug was even more serious, since SO_SNDBUF
and SO_RCVBUF were vulnerable.

This needs to be backported to all known linux kernels.

Again, many thanks to syzkaller team for discovering this gem.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-12-02 14:10:14 -05:00