Commit Graph

709115 Commits

Author SHA1 Message Date
Xin Long
978aa04741 sctp: fix some type cast warnings introduced since very beginning
These warnings were found by running 'make C=2 M=net/sctp/'.
They are there since very beginning.

Note after this patch, there still one warning left in
sctp_outq_flush():
  sctp_chunk_fail(chunk, SCTP_ERROR_INV_STRM)

Since it has been moved to sctp_stream_outq_migrate on net-next,
to avoid the extra job when merging net-next to net, I will post
the fix for it after the merging is done.

Reported-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-29 18:03:24 +09:00
Xin Long
f6fc6bc0b8 sctp: fix a type cast warnings that causes a_rwnd gets the wrong value
These warnings were found by running 'make C=2 M=net/sctp/'.

Commit d4d6fb5787 ("sctp: Try not to change a_rwnd when faking a
SACK from SHUTDOWN.") expected to use the peers old rwnd and add
our flight size to the a_rwnd. But with the wrong Endian, it may
not work as well as expected.

So fix it by converting to the right value.

Fixes: d4d6fb5787 ("sctp: Try not to change a_rwnd when faking a SACK from SHUTDOWN.")
Reported-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-29 18:03:24 +09:00
Xin Long
8d32503efd sctp: fix some type cast warnings introduced by transport rhashtable
These warnings were found by running 'make C=2 M=net/sctp/'.

They are introduced by not aware of Endian for the port when
coding transport rhashtable patches.

Fixes: 7fda702f93 ("sctp: use new rhlist interface on sctp transport rhashtable")
Reported-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-29 18:03:24 +09:00
Xin Long
1da4fc97cb sctp: fix some type cast warnings introduced by stream reconf
These warnings were found by running 'make C=2 M=net/sctp/'.

They are introduced by not aware of Endian when coding stream
reconf patches.

Since commit c0d8bab6ae ("sctp: add get and set sockopt for
reconf_enable") enabled stream reconf feature for users, the
Fixes tag below would use it.

Fixes: c0d8bab6ae ("sctp: add get and set sockopt for reconf_enable")
Reported-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-29 18:03:24 +09:00
Cong Wang
50317fce2c net_sched: avoid matching qdisc with zero handle
Davide found the following script triggers a NULL pointer
dereference:

ip l a name eth0 type dummy
tc q a dev eth0 parent :1 handle 1: htb

This is because for a freshly created netdevice noop_qdisc
is attached and when passing 'parent :1', kernel actually
tries to match the major handle which is 0 and noop_qdisc
has handle 0 so is matched by mistake. Commit 69012ae425
tries to fix a similar bug but still misses this case.

Handle 0 is not a valid one, should be just skipped. In
fact, kernel uses it as TC_H_UNSPEC.

Fixes: 69012ae425 ("net: sched: fix handling of singleton qdiscs with qdisc_hash")
Fixes: 59cc1f61f0 ("net: sched:convert qdisc linked list to hashtable")
Reported-by: Davide Caratti <dcaratti@redhat.com>
Cc: Jiri Kosina <jkosina@suse.cz>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-29 17:55:03 +09:00
Xin Long
d04adf1b35 sctp: reset owner sk for data chunks on out queues when migrating a sock
Now when migrating sock to another one in sctp_sock_migrate(), it only
resets owner sk for the data in receive queues, not the chunks on out
queues.

It would cause that data chunks length on the sock is not consistent
with sk sk_wmem_alloc. When closing the sock or freeing these chunks,
the old sk would never be freed, and the new sock may crash due to
the overflow sk_wmem_alloc.

syzbot found this issue with this series:

  r0 = socket$inet_sctp()
  sendto$inet(r0)
  listen(r0)
  accept4(r0)
  close(r0)

Although listen() should have returned error when one TCP-style socket
is in connecting (I may fix this one in another patch), it could also
be reproduced by peeling off an assoc.

This issue is there since very beginning.

This patch is to reset owner sk for the chunks on out queues so that
sk sk_wmem_alloc has correct value after accept one sock or peeloff
an assoc to one sock.

Note that when resetting owner sk for chunks on outqueue, it has to
sctp_clear_owner_w/skb_orphan chunks before changing assoc->base.sk
first and then sctp_set_owner_w them after changing assoc->base.sk,
due to that sctp_wfree and it's callees are using assoc->base.sk.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-29 12:06:57 +09:00
David S. Miller
151516fab4 Merge branch 'sockmap-fixes'
John Fastabend says:

====================
net: sockmap fixes

Last two fixes (as far as I know) for sockmap code this round.

First, we are using the qdisc cb structure when making the data end
calculation. This is really just wrong so, store it with the other
metadata in the correct tcp_skb_cb sturct to avoid breaking things.

Next, with recent work to attach multiple programs to a cgroup a
specific enumeration of return codes was agreed upon. However,
I wrote the sk_skb program types before seeing this work and used
a different convention. Patch 2 in the series aligns the return
codes to avoid breaking with this infrastructure and also aligns
with other programming conventions to avoid being the odd duck out
forcing programs to remember SK_SKB programs are different. Pusing
to net because its a user visible change. With this SK_SKB program
return codes are the same as other cgroup program types.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-29 11:18:49 +09:00
John Fastabend
bfa640757e bpf: rename sk_actions to align with bpf infrastructure
Recent additions to support multiple programs in cgroups impose
a strict requirement, "all yes is yes, any no is no". To enforce
this the infrastructure requires the 'no' return code, SK_DROP in
this case, to be 0.

To apply these rules to SK_SKB program types the sk_actions return
codes need to be adjusted.

This fix adds SK_PASS and makes 'SK_DROP = 0'. Finally, remove
SK_ABORTED to remove any chance that the API may allow aborted
program flows to be passed up the stack. This would be incorrect
behavior and allow programs to break existing policies.

Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-29 11:18:48 +09:00
John Fastabend
8108a77515 bpf: bpf_compute_data uses incorrect cb structure
SK_SKB program types use bpf_compute_data to store the end of the
packet data. However, bpf_compute_data assumes the cb is stored in the
qdisc layer format. But, for SK_SKB this is the wrong layer of the
stack for this type.

It happens to work (sort of!) because in most cases nothing happens
to be overwritten today. This is very fragile and error prone.
Fortunately, we have another hole in tcp_skb_cb we can use so lets
put the data_end value there.

Note, SK_SKB program types do not use data_meta, they are failed by
sk_skb_is_valid_access().

Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-29 11:18:48 +09:00
Archit Taneja
18075d0d48 drm/msm/mdp5: Don't use async plane update path if plane visibility changes
When a plane moves out of bounds (i.e, outside the crtc clip region), the
plane state's "visible" parameter changes to false. When this happens, we
(a) release the hwpipe resources away from it, and
(b) unstage the corresponding hwpipe(s) from the Layer Mixers in the CRTC.

(a) requires use to acquire the global atomic state and assign a new
hwpipe. (b) requires us to re-configure the Layer Mixer, which is done in
the CRTC. We don't want to do these things in the async plane update path,
so return an error if the new state's "visible" isn't the same as the
current state's "visible".

Cc: Gustavo Padovan <gustavo.padovan@collabora.com>
Signed-off-by: Archit Taneja <architt@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-10-28 14:02:59 -04:00
Archit Taneja
aa649e875d drm/msm/mdp5: mdp5_crtc: Restore cursor state only if LM cursors are enabled
MDP5 on newer SoCs support cursor planes (i.e, cursor SSPPs). They are a
separate entity unlike the cursors within LM.

Do not try to restore the MDP5 LM cursor registers, or the corresponding
CTL bits if we are not using LM cursors.

Also, since we've introduced a new variable 'lm_cursor_enabled', we can
now use it to avoid creating a different sets of crtc_funcs for CRTCs
with LM cursors and CRTCs with cursor planes.

Fixes: "drm/msm/mdp5: restore cursor state when enabling crtc"
Signed-off-by: Archit Taneja <architt@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-10-28 14:02:58 -04:00
Archit Taneja
b148928010 drm/msm/mdp5: Update mdp5_pipe_assign to spit out both planes
We currently call mdp5_pipe_assign() twice to assign the left and right
hwpipes for our drm_plane. When merging 2 hwpipes, there are a few
constraints that we need to keep in mind:

- Only the same types of SSPPs are preferred. I.e, a RGB pipe should
  be paired with another RGB pipe, VIG with VIG etc.
- The hwpipe staged on the left should have a higher priority than
  the hwpipe staged on the right. The priorities are as follows:
  VIG0 > VIG1 > VIG2 > VIG3
  RGB0 > RGB1 > RGB2 > RGB3
  DMA0 > DMA1

We can't apply these constraints easily if mdp5_pipe_assign() is
called twice. Update mdp5_pipe_assign() to find both hwpipes in
one go, and add the extra constraints needed.

Signed-off-by: Archit Taneja <architt@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-10-28 14:02:58 -04:00
Archit Taneja
9866601e67 drm/msm/mdp5: Prepare mdp5_pipe_assign for some rework
mdp5_pipe_assign currently returns the hwpipe pointer for the drm_plane.
Return it indirectly by setting a pointer passed as an argument. This
is needed because we want the func to find out the right hwpipe too.

Signed-off-by: Archit Taneja <architt@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-10-28 14:02:57 -04:00
Gustavo Padovan
ba49f0623d drm/msm: remove mdp5_cursor_plane_funcs
After converting legacy cursor updates to atomic async commits
mdp5_cursor_plane_funcs just duplicates mdp5_plane_funcs now.

Cc: Rob Clark <robdclark@gmail.com>
Cc: Archit Taneja <architt@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.com>
Tested-by: Archit Taneja <architt@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-10-28 14:02:57 -04:00
Gustavo Padovan
224a4c9709 drm/msm: update cursors asynchronously through atomic
Add support to async updates of cursors by using the new atomic
interface for that. Basically what this commit does is do what
mdp5_update_cursor_plane_legacy() did but through atomic.

v5: call drm_atomic_helper_async_check() from the check hook

v4: add missing atomic async commit call to msm_atomic_commit(Archit Taneja)

v3: move size checks back to drivers (Ville Syrjälä)

v2: move fb setting to core and use new state (Eric Anholt)

Cc: Rob Clark <robdclark@gmail.com>
Cc: Archit Taneja <architt@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.com>
Tested-by: Archit Taneja <architt@codeaurora.org> (v4)
[added comment about not hitting async update path if hwpipes are
 re-assigned or global state is touched]
Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-10-28 14:02:56 -04:00
Rob Clark
1f920175ff drm/msm/atomic: switch to drm_atomic_helper_check
Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-10-28 14:02:56 -04:00
Rob Clark
9d9ea7a9c6 drm/msm/mdp5: restore cursor state when enabling crtc
Since we enabled runtime PM, we cannot count on cursor registers to
retain their values.  This can result in situations where we think the
cursor is enabled when we enable the CRTC but it is trying to scan out
null (and the rest of cursor position/size is lost), resulting in faults
and generally angering the hw when coming out of DPMS with a cursor
enabled.

stable backport note: reverting 774e39ee35 is also a suitable fix

Fixes: 774e39ee35 drm/msm/mdp5: Set up runtime PM for MDSS
Signed-off-by: Rob Clark <robdclark@gmail.com>
Reviewed-by: Archit Taneja <architt@codeaurora.org>
2017-10-28 14:02:55 -04:00
Rob Clark
3c352b6690 drm/msm/mdp5: don't use autosuspend
It's only likely to paper over bugs.  Unlike the gpu, where we want to
keep things alive a bit longer in expectation of the next frame's
submit, when the display is shut down we can power off immediately.

Signed-off-by: Rob Clark <robdclark@gmail.com>
Acked-by: Archit Taneja <architt@codeaurora.org>
2017-10-28 14:02:55 -04:00
Rob Clark
a055cf3a97 drm/msm/mdp5: ignore planes that are not visible
Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-10-28 14:02:54 -04:00
Rob Clark
96169f4e75 drm/msm: dump submits which triggered gpu hang
Note we need to move update_fences() to after msm_rd_dump_submit(),
otherwise the bo's referenced by the submit may no longer be valid.

Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-10-28 14:02:50 -04:00
Linus Torvalds
25a5d23b47 Kbuild fixes for v4.14 (2nd)
- fix O= building on dash
 
 - remove unused dependency in Makefile
 
 - fix default of a choice in Kconfig
 
 - fix typos and documentation style
 
 - fix command options unrecognized by sparse
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJZ9KBpAAoJED2LAQed4NsG85AP/RNrH/uyiLsBWfmicpTOt6Vx
 tHik2cn3TN5TBKcLcdh214zSBCPiJSp/dIvjOmIEssOqxJS001O+jlrnbB938hCn
 xVNs3aeBOx1StNB6DOplRtVe/pEIhSMMsXbIilz5a0kAn1mud73FqWmdXSRVA8zT
 JjI9gCl4pQTkv32Pz9w5HRWI8fweMnvbHfMUJhCaYcIIyN/hqfEzupPAeww4sKkg
 P5z60iif1OMlGgB9ZdWI+giblgLJOV+KoaUh181YEICenpsaf6rpdroP3X879N7i
 Y/le65xLVtc3rUZXoggNcGj04nZ7seSBHDbmicgWu0Fbj8+4nQ9mplVr1g1fLCVc
 Ml3joe24XO0PwXOrOTxCHQHRjqWSRv6cn8X9qIQqSLHkJgryxhZ5DiCGqQRxExLN
 gbKQ82UZSc4jNsOhcfcZ3ls7Ve5ao7rSUueL97acdDRhm+t0OWLmF9cQrX+eBzpj
 NOMaPvym+ucPNSRrhEgwFxDjB8dzVfO8tuYTuwX8HxQc7v5SUWuwsnurAXc3fKF2
 2D+VsU8EHk9IKDmQMIlvlj6R4bSr0bjecedA6czcRLMr83h1fCxvQxBw4UIQIzY0
 4y6QIUX7paMAo/OOqqOm10mBJM6Sr+y2JiGvL4gFhiGbCi3+xvOa7P4hRgPCe2Lq
 +FGPIdh+skAypoc/1VfA
 =0Rbk
 -----END PGP SIGNATURE-----

Merge tag 'kbuild-fixes-v4.14-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild

Pull Kbuild fixes from Masahiro Yamada:

 - fix O= building on dash

 - remove unused dependency in Makefile

 - fix default of a choice in Kconfig

 - fix typos and documentation style

 - fix command options unrecognized by sparse

* tag 'kbuild-fixes-v4.14-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
  kbuild: clang: fix build failures with sparse check
  kbuild doc: a bundle of fixes on makefiles.txt
  Makefile: kselftest: fix grammar typo
  kbuild: Fix optimization level choice default
  kbuild: drop unused symverfile in Makefile.modpost
  kbuild: revert $(realpath ...) to $(shell cd ... && /bin/pwd)
2017-10-28 11:01:57 -07:00
Rob Clark
544a32dbf0 drm/msm: preserve IOVAs in submit's bo table
We need this if we want to dump the submit after cleanup (ie. from hang
or fault).  But in the backoff/unpin case we want to clear them.  So add
a flag so we can skip clearing the IOVAs in at cleanup.

Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-10-28 13:59:18 -04:00
Rob Clark
998b9a5883 drm/msm/rd: allow adding addition msg to top of dump
For faults or hangs, it is nice to be able to include a bit more
information.

Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-10-28 13:59:18 -04:00
Rob Clark
2165e2b9cb drm/msm: split rd debugfs file
Split into two instances, the existing $debugfs/rd which continues to
dump all submits, and $debugfs/hangrd which will be used to dump just
submits that cause gpu hangs (and eventually faults, but that will
require some iommu framework enhancements).

Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-10-28 13:59:18 -04:00
Rob Clark
fad33f4b10 drm/msm: add special _get_vaddr_active() for cmdstream dumps
Prep work for adding a debugfs file that dumps just submits which
trigger hangs/faults.  In this case the bo may already be in the
MADV_DONTNEED state, but will be still on the active list (since
the submit hasn't completed yet).  So the normal check that the
bo is in the WILLNEED state does not apply.  (But of course the bo
should definitely not be in the PURGED state!)

Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-10-28 13:59:17 -04:00
Rob Clark
18bb8a6c89 drm/msm: show task cmdline in gpu recovery messages
Now that freedreno gallium driver defaults to using submit_queue task
(render reordering), just showing task->comm is not so useful (ie. it is
always "flush_queue:0"), so also dump the cmdline.  This should also be
more useful for piglit/shader_runner.

Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-10-28 13:59:15 -04:00
Linus Torvalds
a7d3e63f84 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input fixes from Dmitry Torokhov:

 - fix gtco tablet driver, tightening parsing of HID descriptors

 - add ACPI ID added to Elan driver to be able to handle touchpads found
   in Lenovo Ideapad 320/520

 - fix the Symaptics RMI4 driver to adjust handling of buttons

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: synaptics-rmi4 - limit the range of what GPIOs are buttons
  Input: gtco - fix potential out-of-bound access
  Input: elan_i2c - add ELAN0611 to the ACPI table
2017-10-28 10:56:13 -07:00
Linus Torvalds
22450e03ac pci-v4.14-fixes-6
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJZ83R4AAoJEFmIoMA60/r8RGIQAL/b2IX5UgeI31Ub+4IDqJa9
 C6CR1FqdBj9dMDGQElJGeQ9omPMrMB8f/MGWrVl2pLwp5leYMg9NtjeybmkOqQwn
 CfmyD9qkuEpsX7aFAXz0gy6yaE1+2YZ6ZWJirCR1IN/nkc1iaSIzVgBjBvrn3TiN
 WIWZVzsQEyGUEcFe+P/faSNaAplT92TOC09mhD4OrbjchDGTxzvXvnOYO+bf2+K0
 89If683jMLv9hJbnWXJRl3/zL2Zs/v8EV96F55hT5Yz1Tbb1qHOs+TxNYwKbxgTL
 U7L/rOHx9SRd+Rmw2vKAL0ka7wKKKVsuBxA27ipaRlCGrn+vwrNP86EIlk3qUbiT
 JOu07b69kkeZNzVgf+XHZfZle7+aobq1YgCkvp54yZwTNTdIvTIYw6ahqRwHP3vx
 AyhMK1ALsRZpbkmrfqQxRHjlWYRGdmVj6RDTThg/xsJ1+jFl78eA0foSy8Eubke2
 Y+UKyOCXaLb2UNFkcJhDCzAf4jvqTEULbLRCr7r0cJqfPL92/3g6Bqob6AJZLbpt
 mdlNTyMcg8Z/qJuA2uK1P87EYjpNzTBOMwORyph8C+EVIsgjcI1Ace0YqKxbVgfy
 YckVsuOH600L074sJVUxkV+WWQLORiayfOyUrsjVbm7eQXUFLgxw+wSz0QgM+MX5
 ZTYQH4J4eqXnKR/bahTu
 =edoi
 -----END PGP SIGNATURE-----

Merge tag 'pci-v4.14-fixes-6' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci

Pull PCI fix from Bjorn Helgaas:
 "Move alpha PCI IRQ map/swizzle functions out of initdata to fix
  regression from PCI core IRQ mapping changes (Lorenzo Pieralisi)"

* tag 'pci-v4.14-fixes-6' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
  alpha/PCI: Move pci_map_irq()/pci_swizzle() out of initdata
2017-10-28 10:53:24 -07:00
Linus Torvalds
b35f0ca74f i915 and amdgpu fixes
-----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJZ84v6AAoJEAx081l5xIa+imQQAKuQVzzMfjsuhif+TFVIe/wO
 fhKHUpRRA4YNi/iMyJFYlmNyr8f2G1qGFwVb6RfwnBll3mji/bX9eZEu1cW0RY+G
 ipiL4jmRG1rXWtDobQX0ZDcw+qGHTnZqYNH+sZ35bZgHwC1/bmrvEKF/upFwZukN
 qshLe7sImEY8e+LPZI8bG+bhQISB2Y76dGTH9uO7+5livz2NVPaD5o/bfcf6Yerk
 DvcHKVTt7vmU/6MzUU0U6EzlaTrl62jh0LOM6rLTenWR2jTk3K2gA5vWY5S4Og6E
 HA66dRTAYO3UQE97VGRqVdRqTV+KQ21MBzxVnVx4mFvZ3gtdA4YEWB2Qap8MXs0g
 vyGTi046EJw2+mwkDo63V5/mXYA7UX5NZ1XhrFUpUsnpCDaG7vK0soeWKp6siU/Z
 wGT/3zT8tFw7XtSJ9UI1+rGzDdq300ZSlsVZKpqeoxeq5/O/ZzziM+F4k1LQv09B
 4Ypzkne07RyJHXKxJetXoyMcSkV+Ulaxr5zH+Ku3aWSTWDeqil4Yh1EDBlPiVXMX
 qWK6A7zIUgJVwN8Y9XpxO0eo+ty0+zd5YGw6Bl1mFCfNC+Its9OezRdFrIr9L8Mt
 ht8lRGbRvoDw/iZ7hRYdEw8wrS+uEub3a6eeS8yqIuCh60O179aHAHmYf6tl3AFR
 fY0n/f9vFlyiZYBQ2Ry/
 =Nv2X
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-for-v4.14-rc7' of git://people.freedesktop.org/~airlied/linux

Pull drm fixes from Dave Airlie:
 "Two amd fixes, one i915 core and a few i915 GVT fixes, things seem
  fairly quiet"

* tag 'drm-fixes-for-v4.14-rc7' of git://people.freedesktop.org/~airlied/linux:
  drm/i915/gvt: Adding ACTHD mmio read handler
  drm/i915/gvt: Extract mmio_read_from_hw() common function
  drm/i915/gvt: Refine MMIO_RING_F()
  drm/i915/gvt: properly check per_ctx bb valid state
  drm/i915/perf: fix perf enable/disable ioctls with 32bits userspace
  drm/amd/amdgpu: Remove workaround check for UVD6 on APUs
  drm/amd/powerplay: fix uninitialized variable
2017-10-28 10:50:38 -07:00
Linus Torvalds
5345da892c SCSI fixes on 20171027
Six fixes for mostly minor issues, most of which have small race
 windows for occurring.
 
 Signed-off-by: James E.J. Bottomley <jejb@linux.vnet.ibm.com>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABAgAGBQJZ8zx3AAoJEAVr7HOZEZN4K9AP/2uTLQrPfn3GElSZEXcFsQDK
 zhvaLkoDXARlWb8wevw5od0VpcLvNPQKZxsPpQ2afIpt2PQNPNykbFsbxnvVV0rE
 SxUaHJg+hg2CmtKGmj30WN/9SKNp1vEuBbPKZFCvXhshc54m8VOKUhgaLpIj9NkC
 oiIqFl005obvEq6otGDUYpttZRScIpMkMML89hr9UMcfWqS9fYvTpu+xr8RDP77S
 lld8dKbWCk5Zk3w6Ag7s2gjjR01FnpV5cWEPOEwuVrjEE1hgmTv5oHPpJPc+mx+4
 q2kuvNmLsEuwlybqLTc4BBKwKtP4G6mZ5pq/um6DrTMjzLwkRGXSXejgl5mf5pPu
 1FxkHv2SUWjGCDdpGy5ozNCWuCjX/la+tc9LM56/Nuann3XisD5yYoWzAltspFPp
 84OmUilknJsdUBBzO3FaXHcEc+084wi5ntMf+FpCFc7gfMVZU0IaOC8/cgFsmQaa
 Ll07BWCxo0/JTqHqUZdAdS953zLw7izYk4GqHd7roUGYWDjWge01+VzKCJKW1SOF
 mY+jmPB5rnbTw5d/xE0aSPjfpkXLZqc2jGHNj4N8C27JG0grB2SXVNyDrcCm48b/
 6HQNKNjOxr0309mtwRDw9S9CoATRiOUHvHwYJQBhB2iMrkzu15CrbD0i5sAC+T4j
 iRnjW/tbyRjZCLGK69oS
 =6jlR
 -----END PGP SIGNATURE-----

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "Six fixes for mostly minor issues, most of which have small race
  windows for occurring"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: Suppress a kernel warning in case the prep function returns BLKPREP_DEFER
  scsi: sg: Re-fix off by one in sg_fill_request_table()
  scsi: aacraid: Fix controller initialization failure
  scsi: hpsa: Fix configured_logical_drive_count·check
  scsi: qla2xxx: Initialize Work element before requesting IRQs
  scsi: zfcp: fix erp_action use-before-initialize in REC action trace
2017-10-28 10:46:20 -07:00
David Howells
ea6789980f assoc_array: Fix a buggy node-splitting case
This fixes CVE-2017-12193.

Fix a case in the assoc_array implementation in which a new leaf is
added that needs to go into a node that happens to be full, where the
existing leaves in that node cluster together at that level to the
exclusion of new leaf.

What needs to happen is that the existing leaves get moved out to a new
node, N1, at level + 1 and the existing node needs replacing with one,
N0, that has pointers to the new leaf and to N1.

The code that tries to do this gets this wrong in two ways:

 (1) The pointer that should've pointed from N0 to N1 is set to point
     recursively to N0 instead.

 (2) The backpointer from N0 needs to be set correctly in the case N0 is
     either the root node or reached through a shortcut.

Fix this by removing this path and using the split_node path instead,
which achieves the same end, but in a more general way (thanks to Eric
Biggers for spotting the redundancy).

The problem manifests itself as:

  BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
  IP: assoc_array_apply_edit+0x59/0xe5

Fixes: 3cb989501c ("Add a generic associative array implementation.")
Reported-and-tested-by: WU Fan <u3536072@connect.hku.hk>
Signed-off-by: David Howells <dhowells@redhat.com>
Cc: stable@vger.kernel.org [v3.13-rc1+]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2017-10-28 10:31:07 -07:00
Linus Torvalds
7814023404 Various SMB3 fixes for 4.14 and stable
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQGcBAABAgAGBQJZ81hKAAoJEIosvXAHck9R7K4L/R4vPpYn19s/xPUf0fUYMOWO
 JOIghfeCmmfCd2kTZF+fcDRNBpGnJjjs4ZPloxIbF7bQF0VbjrkToxthF6f9aYIJ
 gt0jH1ntGUvraDpkZelTAGRj1BZou2IBzJF3Or1sL83ZX76fyXm9cJUx8Y+l2Mlx
 BJMOL0Au38oRKOGnGk3GPtrflgNxe+6cTpNhLmVa9CBNDMQYjobrALgGPpbGf5h3
 6l1i0IxMXuxeXjqFva0GKCjTsQSON44gNNHQoggIfHvE3nBVpSZLCwNwrVHOfd8q
 4FlEXPzr3ME4WzASWqw1kAX+aij2NqbaLgDs7USkn4mUheIvZcHhC0LPVZJrZ1b4
 2c3RHkOV0aZQunPJyq5vtO9B4TJC6MLcHS46iwQ6lao9hTVT8OqV7R40qmzQyt06
 KwdIGObEm76J7u4lgVlAsapVKgPLOPuObQKhYUdNvRarorNaxgtadnHOhXM20G3S
 PE23XvNJYwKl6SJbP97ih8Uq0//7vNCxd/khdnq4FQ==
 =8LHe
 -----END PGP SIGNATURE-----

Merge tag '4.14-smb3-fixes-for-stable' of git://git.samba.org/sfrench/cifs-2.6

Pull cifs fixes from Steve French:
 "Various SMB3 fixes for 4.14 and stable"

* tag '4.14-smb3-fixes-for-stable' of git://git.samba.org/sfrench/cifs-2.6:
  SMB3: Validate negotiate request must always be signed
  SMB: fix validate negotiate info uninitialised memory use
  SMB: fix leak of validate negotiate info response buffer
  CIFS: Fix NULL pointer deref on SMB2_tcon() failure
  CIFS: do not send invalid input buffer on QUERY_INFO requests
  cifs: Select all required crypto modules
  CIFS: SMBD: Fix the definition for SMB2_CHANNEL_RDMA_V1_INVALIDATE
  cifs: handle large EA requests more gracefully in smb2+
  Fix encryption labels and lengths for SMB3.1.1
2017-10-28 08:39:35 -07:00
Linus Torvalds
c9f27f9f85 Merge branch 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs
Pull overlayfs fixes from Miklos Szeredi:
 "Fix several issues, most of them introduced in the last release"

* 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs:
  ovl: do not cleanup unsupported index entries
  ovl: handle ENOENT on index lookup
  ovl: fix EIO from lookup of non-indexed upper
  ovl: Return -ENOMEM if an allocation fails ovl_lookup()
  ovl: add NULL check in ovl_alloc_inode
2017-10-28 08:29:29 -07:00
Linus Torvalds
a9af9835d3 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse
Pull fuse fix from Miklos Szeredi:
 "This fixes a longstanding bug, which can be triggered by interrupting
  a directory reading syscall"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse:
  fuse: fix READDIRPLUS skipping an entry
2017-10-28 08:27:46 -07:00
Jordan Crouse
78b8e5b847 drm/msm: dump a rd GPUADDR header for all buffers in the command
Currently the rd dump avoids any buffers marked as WRITE under
the assumption that the contents are not interesting.  While it
is true that the contents are uninteresting we should still print
the iova and size for all buffers so that any listening replay
tools can correctly construct the submission.

Print the header for all buffers but only dump the contents for
buffers marked as READ.

Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-10-28 11:01:40 -04:00
Jordan Crouse
3ceaa1411d drm/msm: Removed unused struct_mutex_task
Recent changes to locking have rendered struct_mutex_task
unused.

Unused since 0e08270a1f.

Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-10-28 11:01:39 -04:00
Jordan Crouse
b1fc2839d2 drm/msm: Implement preemption for A5XX targets
Implement preemption for A5XX targets - this allows multiple
ringbuffers for different priorities with automatic preemption
of a lower priority ringbuffer if a higher one is ready.

Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-10-28 11:01:38 -04:00
Jordan Crouse
4d87fc32df drm/msm: Make the value of RB_CNTL (almost) generic
We use a global ringbuffer size and block size for all targets and
at least for 5XX preemption we need to know the value the RB_CNTL
in several locations so it makes sense to calculate it once and use
it everywhere.

The only monkey wrench is that we need to disable the RPTR shadow
for A430 targets but that only needs to be done once and doesn't
affect A5XX so we can or in the value at init time.

Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-10-28 11:01:38 -04:00
Jordan Crouse
4c7085a5d5 drm/msm: Shadow current pointer in the ring until command is complete
Add a shadow pointer to track the current command being written into
the ring. Don't commit it as 'cur' until the command is submitted.
Because 'cur' is used to construct the software copy of the wptr this
ensures that somebody peeking in on the ring doesn't assume that a
command is inflight while it is being written. This isn't a huge deal
with a single ring (though technically the hangcheck could assume
the system is prematurely busy when it isn't) but it will be rather
important for preemption where the decision to preempt is based
on a non-empty ringbuffer. Without a shadow an aggressive preemption
scheme could assume that the ringbuffer is non empty and switch to it
before the CPU is done writing the command and boom.

Even though preemption won't be supported for all targets because of
the way the code is organized it is simpler to make this generic for
all targets. The extra load for non-preemption targets should be
minimal.

Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-10-28 11:01:37 -04:00
Jordan Crouse
a6e29a0eea drm/msm: Add a parameter query for the number of ringbuffers
In order to manage ringbuffer priority to its fullest userspace
should know how many ringbuffers it has to work with. Add a
parameter to return the number of active rings.

Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-10-28 11:01:37 -04:00
Jordan Crouse
f97decac5f drm/msm: Support multiple ringbuffers
Add the infrastructure to support the idea of multiple ringbuffers.
Assign each ringbuffer an id and use that as an index for the various
ring specific operations.

The biggest delta is to support legacy fences. Each fence gets its own
sequence number but the legacy functions expect to use a unique integer.
To handle this we return a unique identifier for each submission but
map it to a specific ring/sequence under the covers. Newer users use
a dma_fence pointer anyway so they don't care about the actual sequence
ID or ring.

The actual mechanics for multiple ringbuffers are very target specific
so this code just allows for the possibility but still only defines
one ringbuffer for each target family.

Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-10-28 11:01:36 -04:00
Jordan Crouse
cd414f3d93 drm/msm: Move memptrs to msm_gpu
When we move to multiple ringbuffers we're going to store the data
in the memptrs on a per-ring basis. In order to prepare for that
move the current memptrs from the adreno namespace into msm_gpu.
This is way cleaner and immediately lets us kill off some sub
functions so there is much less cost later when we do move to
per-ring structs.

Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-10-28 11:01:36 -04:00
Jordan Crouse
f7de15450e drm/msm: Add per-instance submit queues
Currently the behavior of a command stream is provided by the user
application during submission and the application is expected to internally
maintain the settings for each 'context' or 'rendering queue' and specify
the correct ones.

This works okay for simple cases but as applications become more
complex we will want to set context specific flags and do various
permission checks to allow certain contexts to enable additional
privileges.

Add kernel-side submit queues to be analogous to 'contexts' or
'rendering queues' on the application side. Each file descriptor
instance will maintain its own list of queues. Queues cannot be
shared between file descriptors.

For backwards compatibility context id '0' is defined as a default
context specifying no priority and no special flags. This is
intended to be the usual configuration for 99% of applications so
that a garden variety application can function correctly without
creating a queue. Only those applications requiring the specific
benefit of different queues need create one.

Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-10-28 11:01:35 -04:00
Rob Clark
0033e1b523 drm/msm/mdp5: disable vblanks when crtc is off
Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-10-28 11:01:35 -04:00
Rob Clark
cae923e6bf drm/msm/mdp4: disable vblanks when crtc is off
Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-10-28 11:01:34 -04:00
Rob Clark
63d51e36b5 dt-bindings: display: msm: update clk names
Now that drm/msm is converted over to use msm_get_clk() everywhere (that
matters), which handles falling back to looking for a clock with the
"_clk" suffix, we can remove "_clk" from the documentation so that new
dts files added do not include "_clk" in the name.

Previously we were doing this for the more recently upstreamed bindings
but not for (nearly) all.

Signed-off-by: Rob Clark <robdclark@gmail.com>
Acked-by: Rob Herring <robh@kernel.org>
2017-10-28 11:01:34 -04:00
Rob Clark
aede1e9ee4 drm/msm/hdmi: convert to msm_clk_get()
We already have, as a result of upstreaming the gpu bindings,
msm_clk_get() which will try to get the clock both without and with a
"_clk" suffix.  Use this in HDMI code so we can drop the "_clk" suffix
in bindings while maintaing backwards compatibility.

Signed-off-by: Rob Clark <robdclark@gmail.com>
Reviewed-by: Sean Paul <seanpaul@chromium.org>
2017-10-28 11:01:34 -04:00
Rob Clark
cf52ec24b2 drm/msm/edp: convert to msm_clk_get()
We already have, as a result of upstreaming the gpu bindings,
msm_clk_get() which will try to get the clock both without and with a
"_clk" suffix.  Use this in eDP code so we can drop the "_clk" suffix
in bindings while maintaing backwards compatibility.

Signed-off-by: Rob Clark <robdclark@gmail.com>
Reviewed-by: Sean Paul <seanpaul@chromium.org>
2017-10-28 11:01:33 -04:00
Rob Clark
db9a3750eb drm/msm/dsi: convert to msm_clk_get()
We already have, as a result of upstreaming the gpu bindings,
msm_clk_get() which will try to get the clock both without and with a
"_clk" suffix.  Use this in DSI code so we can drop the "_clk" suffix
in bindings while maintaing backwards compatibility.

Signed-off-by: Rob Clark <robdclark@gmail.com>
Reviewed-by: Sean Paul <seanpaul@chromium.org>
2017-10-28 11:01:33 -04:00
Rob Clark
e9acce2bb9 drm/msm/mdp5: always print mdp5 version
This is useful to see in the log, without requiring drm.debug.

Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-10-28 11:01:32 -04:00