Commit Graph

813677 Commits

Author SHA1 Message Date
Zachary Hays
dcf6e2e38a mmc: block: handle complete_work on separate workqueue
The kblockd workqueue is created with the WQ_MEM_RECLAIM flag set.
This generates a rescuer thread for that queue that will trigger when
the CPU is under heavy load and collect the uncompleted work.

In the case of mmc, this creates the possibility of a deadlock when
there are multiple partitions on the device as other blk-mq work is
also run on the same queue. For example:

- worker 0 claims the mmc host to work on partition 1
- worker 1 attempts to claim the host for partition 2 but has to wait
  for worker 0 to finish
- worker 0 schedules complete_work to release the host
- rescuer thread is triggered after time-out and collects the dangling
  work
- rescuer thread attempts to complete the work in order starting with
  claim host
- the task to release host is now blocked by a task to claim it and
  will never be called

The above results in multiple hung tasks that lead to failures to
mount partitions.

Handling complete_work on a separate workqueue avoids this by keeping
the work completion tasks separate from the other blk-mq work. This
allows the host to be released without getting blocked by other tasks
attempting to claim the host.

Signed-off-by: Zachary Hays <zhays@lexmark.com>
Fixes: 81196976ed ("mmc: block: Add blk-mq support")
Cc: <stable@vger.kernel.org>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-02-08 12:24:17 +01:00
Maxime Ripard
1c7c62a37a
drm/sun4i: dsi: Fix unitialized variable warning
Since the DPHY rework, one error path doesn't set the return error code
before jumping to its error label, which in turns make gcc (rightfully)
complain about the variable holding the error code being uninitialized.

Fix this.

Fixes: bb3b6fcb68 ("sun6i: dsi: Convert to generic phy handling")
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190208090540.19626-1-maxime.ripard@bootlin.com
2019-02-08 10:28:11 +01:00
Matti Kurkela
e8b22d0a32 Input: elantech - enable 3rd button support on Fujitsu CELSIUS H780
Like Fujitsu CELSIUS H760, the H780 also has a three-button Elantech
touchpad, but the driver needs to be told so to enable the middle touchpad
button.

The elantech_dmi_force_crc_enabled quirk was not necessary with the H780.

Also document the fw_version and caps values detected for both H760 and
H780 models.

Signed-off-by: Matti Kurkela <Matti.Kurkela@iki.fi>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2019-02-07 23:52:06 -08:00
Gilad Ben-Yossef
1358c13a48 crypto: ccree - fix resume race condition on init
We were enabling autosuspend, which is using data set by the
hash module, prior to the hash module being inited, casuing
a crash on resume as part of the startup sequence if the race
was lost.

This was never a real problem because the PM infra was using low
res timers so we were always winning the race, until commit 8234f6734c
("PM-runtime: Switch autosuspend over to using hrtimers") changed that :-)

Fix this by seperating the PM setup and enablement and doing the
latter only at the end of the init sequence.

Signed-off-by: Gilad Ben-Yossef <gilad@benyossef.com>
Cc: Vincent Guittot <vincent.guittot@linaro.org>
Cc: stable@kernel.org # v4.20
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2019-02-08 15:28:02 +08:00
Arun Parameswaran
39841cc1cb net: dsa: b53: Fix for failure when irq is not defined in dt
Fixes the issues with non BCM58XX chips in the b53 driver
failing, when the irq is not specified in the device tree.

Removed the check for BCM58XX in b53_srab_prepare_irq(),
so the 'port->irq' will be set to '-EXIO' if the irq is not
specified in the device tree.

Fixes: 16994374a6 ("net: dsa: b53: Make SRAB driver manage port interrupts")
Fixes: b2ddc48a81 ("net: dsa: b53: Do not fail when IRQ are not initialized")
Signed-off-by: Arun Parameswaran <arun.parameswaran@broadcom.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-02-07 18:18:37 -08:00
Dave Airlie
1e92a2261a - Add rotator support for s5pv210
. With this patch series, s5pv210 SoC can use rotator module but
     only NV12 and XRGB8888 formats are supported.
 - Modify e-mail address
   . It changes email address of scaler module author.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJcXBIAAAoJEFc4NIkMQxK4iAAP/0j3lQF8kVhfy5rLicpkwx01
 bWPdoFwSHn6dbkPsJOXHLewVDW0CEz089esowUQptE+ZkKNCghXmlRl9EApsRZGz
 AwNBwz4xrfDrojuEAeO0qeYYMpEZDth+y0LttWtVkhaQlk5hFXU9MkcOuS8hQ3ZH
 zAMd9hvw5GoqxChDhyzGIjkT0xDf1Pznw/6S+tHL39dcKiGivHW+RaRZ0PJHtJTe
 zSghSokC4CtMXcBxm3a1cfZ+WmQs16ZXcOl8HzaM1XIJ0G7UNnvvW3mxgq1XqDR2
 2nkOTRArO1jS8i5lcBafS7pkwyl3FiVt0H8vqzLjjSc0YJMhBMoIHwI9svy5xzh0
 +j66E6mYxzVKVykR2bo4Ny/F0tKdlx+KQkKi82TOnu1FWyI+uvmb6tR0ngeoCso6
 VUpXLoRg0IL6lbwqK+GKUVu16mG291XJSyv/WMXGmnmgc3QZWTEgXb227H9udNP4
 vQ+17R3RjVUPJQpQ6rkjXnKBad+UGmwr5qdPZND8INDnHtMtDTZyriTIHi312fi1
 MnqecZWkEDs6urSsExzdfEDdOSZ8XfM+NsBsyJr6034ZbNufva6mzocZ+ZDIYUY3
 6ma8EDwx+GtUkxJrdOsFDNkGdHYJGBGD+vDqAgnO5RWwJTWKiauj+QBuN2pDSRQz
 C+Nnev9GAExyEQ9Gv1TZ
 =RB/q
 -----END PGP SIGNATURE-----

Merge tag 'exynos-drm-next-for-v5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-next

- Add rotator support for s5pv210
  . With this patch series, s5pv210 SoC can use rotator module but
    only NV12 and XRGB8888 formats are supported.
- Modify e-mail address
  . It changes email address of scaler module author.

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Inki Dae <inki.dae@samsung.com>
Link: https://patchwork.freedesktop.org/patch/msgid/079a9586-9d85-7d38-2658-ce312b6d71e8@samsung.com
2019-02-08 10:35:34 +10:00
Dave Airlie
dada163c5e drm-misc-fixes for v5.0-rc6:
- Fixes to omap/dsi encoder.
 - Clock fix for sun4i.
 - Licensing header fix for rockchip.
 - Fix division by zero in the mode when trying to set a mode on
   i915 with GVT-g enabled.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEuXvWqAysSYEJGuVH/lWMcqZwE8MFAlxb6lcACgkQ/lWMcqZw
 E8OpAQ//VspiZ8iU5GO8beSu6HP92WFUVxHyJ0tZMYLrtcjqTltAM3PljMGJa7s1
 DMv0RWJrZP+Vo1Qr+oGRGsBftOvpJbu0/Nt0OfOiG6Qo1Hb+rJgoKqXSEbBlufXP
 A2DcBR6aio1RhPuSEqsw91LoWh6qXmyQPpy9gNerChNaOMCWLJCmjtiSEI8gkdHq
 EqRvnUWPn3Tlg6lPZKpOOxIlp5UR+BP1yWvipEDkPxtKUhoEvPy/ien9LCkgA8+0
 JFLv9yHOW5NVA4zrodSIFs3qk1yTFEifkce4JObme8YZ01ejT23PHwHOhP7BWdt9
 Yn3ESABcvxW1cUHvFUzP3jFyWrHyDcv/ZA2gAxDQ/utb7pB3mMzW0sdANU+BZ0tc
 SS9wQnl/q35z83L96GyBPNUFAb3QOLN7X8V+pghwmTJ/IOrvn/+qyYINbmQSXPcR
 +Od6qLx0n8kEmZOp6GgVcF/wSTULltPbR6heYYqYRbR+TN82IYMn+00UWWtVF2z+
 mfYpaFMbw9DBbO0A75q8PV15WbvR+dCX4ii5MWxMuv+m4gObwUkr5gV+eHs8Da6Q
 WmH8kiXak22Q1gu6ZdqO+dB2dew0gXqRXsNyeKA6JC0Z8feGpDwZUPt9gqQYHMUF
 fJoO/LPaQsIaZ+nnMFdbZcoHsdGbynxIML4SSpge/GerkA2XAUI=
 =ONtd
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2019-02-07' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes

drm-misc-fixes for v5.0-rc6:
- Fixes to omap/dsi encoder.
- Clock fix for sun4i.
- Licensing header fix for rockchip.
- Fix division by zero in the mode when trying to set a mode on
  i915 with GVT-g enabled.

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/84462cef-609f-e2af-084a-f9fe2b05c53e@linux.intel.com
2019-02-08 10:32:49 +10:00
Dave Airlie
151e3d6add drm/i915 fixes for v5.0-rc6:
- SNB DPLL sanitize
 - ICL DDI clock selection
 - SLK srckey mask
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEFWWmW3ewYy4RJOWc05gHnSar7m8FAlxb4ncACgkQ05gHnSar
 7m/8tg/+Kvp8ueti2ZdSfbtoOQML4r1Q8Mg4T8l5L41PHPtVvyvUxPeQd8t0nkum
 G1C++lq+qzoyHpLRB5hO5CciyuuWlzK9EXprYtaCu/4W1QJbECWwPMcU9hitdI5h
 fCAsLwPYTx9eiCsO+1cRIAbhEo/S9U5WJ0+SMPZtALLZItkKaCUAJ9qhyQPlLlYN
 ZdkZjTc416BLMNXxoclorMmg/5IMYgwdcovivifuDaZQ7TJLZDow0vBemIMNtnce
 FZPyeoyjHq04deG2CR1HQYgYCPRI9U0LoGaEYb7lltNJHCCHxWEZ/MmPCxdI9ZgK
 CJfkPPSyhFrEPrRYcOX5ERuADQdNk2BEBdrEpm5gvrGkZrH14QZza5PvEF+CoqQB
 9Xvh5Jeo7aZ8tXW71BgvV1WpHSnravrVwV2JPf51wEY47MBIj7YpGErIrFM1VdB+
 pw40pPk6VwD1qisqrj+dVeAYLkSgLZJgcHp7E0ACu6IWWoeNRKniKuSVn5hcyHNQ
 Ql6AK0Bj6MK+3opotdRCjhguS50rSd14nainEhp+t1qji/GnuYDBUqAJn0xhfhOo
 cpUgCp0oZCUzK4cJb/hLUBtiJCDolFkrRnGXhhsf34raPbjasky7ZBfS6DGrvLHT
 D/tZJY2wXW2EUROHvxuhTIpFebnE2y+GvMnKxhGPZa/+Mzv9WX8=
 =3RSQ
 -----END PGP SIGNATURE-----

Merge tag 'drm-intel-fixes-2019-02-07-1' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes

drm/i915 fixes for v5.0-rc6:
- SNB DPLL sanitize
- ICL DDI clock selection
- SLK srckey mask

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/87lg2s6nur.fsf@intel.com
2019-02-08 10:30:57 +10:00
Laurent Pinchart
a6cc417d3e drm: rcar-du: Turn LVDS clock output on/off for DPAD0 output on D3/E3
On the D3 and E3 SoCs the LVDS PLL clock output provides the dot clock
to the DU channels, even when the LVDS outputs are not in use. Enable
and disable the LVDS clock output when enabling or disabling a CRTC
connected to the DPAD0 output.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
2019-02-08 02:25:56 +02:00
Laurent Pinchart
02f2b30032 drm: rcar-du: lvds: Add API to enable/disable clock output
On the D3 and E3 platforms, the LVDS internal PLL supplies the pixel
clock to the DU. This works automatically for LVDS outputs as the LVDS
encoder is enabled through the bridge API, enabling the internal PLL and
clock output. However, when using the DU DPAD output with the LVDS
outputs turned off, the LVDS PLL needs to be controlled manually. Add an
API to do so, to be called by the DU driver.

The drivers/gpu/drm/rcar-du/ directory has to be treated as obj-y
unconditionally, as the LVDS driver could be built-in while the DU
driver is compiled as a module.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
2019-02-08 02:25:56 +02:00
Laurent Pinchart
6e1f855781 drm: rcar-du: lvds: Don't fail probe if output is not connected on D3/E3
On the D3 and E3 SoCs the LVDS encoder has an extended internal PLL and
supplies a clock to the DU. That clock is used not only for the LVDS
outputs but also for the DPAD output. The LVDS encoder thus needs to be
available to the DU even when its output is disabled. Don't fail probe
in that case on D3 and E3.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
2019-02-08 02:25:56 +02:00
Laurent Pinchart
5aebc852af drm: rcar-du: Simplify encoder registration
Before the driver fully moved to drm_bridge and drm_panel, it was
necessary to parse DT and locate encoder and connector nodes. The
connector node is now unused and can be removed as a parameter to
rcar_du_encoder_init(). As a consequence rcar_du_encoders_init_one() can
be greatly simplified, removing most of the DT parsing.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
2019-02-08 02:25:55 +02:00
Biju Das
fc59d7d491 drm: rcar-du: lvds: Add r8a7744 support
The LVDS encoders on RZ/G1N SoC is similar to RZ/G1M. Add support for
RZ/G1N (R8A7744) SoC to the LVDS encoder driver.

Signed-off-by: Biju Das <biju.das@bp.renesas.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
2019-02-08 02:25:55 +02:00
Biju Das
8a2fe6c09f dt-bindings: display: renesas: lvds: Document r8a7744 bindings
Document the RZ/G1N (R8A7744) LVDS bindings.

Signed-off-by: Biju Das <biju.das@bp.renesas.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Reviewed-by: Rob Herring <robh@kernel.org>
2019-02-08 02:25:55 +02:00
Julia Lawall
4c6d8fc20b drm: rcar-du: add missing of_node_put
Add an of_node_put when the result of of_graph_get_remote_port_parent is
not available.

Add a second of_node_put if no encoder is selected (encoder remains NULL).

The semantic match that finds the first problem is as follows
(http://coccinelle.lip6.fr):

// <smpl>
@r exists@
local idexpression e;
expression x;
@@
e = of_graph_get_remote_port_parent(...);
... when != x = e
    when != true e == NULL
    when != of_node_put(e)
    when != of_fwnode_handle(e)
(
return e;
|
*return ...;
)
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
2019-02-08 02:25:55 +02:00
Linus Torvalds
74e96711e3 platform-drivers-x86 for v5.0-2
Correct Documentation/ABI 4.21 KernelVersion to 5.0.
 
 The following is an automated git shortlog grouped by driver:
 
 Documentation/ABI:
  -  Correct mlxreg-io KernelVersion for 5.0
 -----BEGIN PGP SIGNATURE-----
 
 iQEcBAABAgAGBQJcXLDcAAoJEKbMaAwKp364z6wH/2sXsncu1ohf79YNXeeBlJKO
 Zy8MCU3uhwY78+x9FLphDRhR5PlvulFflJg1i/eHEWYZ8BTd6gI1CevbAb18XZ2F
 RGeHzGKvV40L+mn6ykGXWmCLAnEfCS1ICBLwpM9o9O22FKjNqPv0etryQE9whJ/J
 mH8tPL4tMU3Y41HxMPl/e/K1tGNsRD3WRQp3AvgS3GimtEQHm4uHqvpaijc/I5UZ
 7STLWIm6e60lwHUGyqg2O4MxWUEZ0D129qw2kG1Bj6EOx0y90htqTeZunwbJxCGt
 GvJG6PnGDfWakzHreyqb8pxNoJqO3dFzpIympZ5+lFRy47APxBxKYx1hLwYl1Rs=
 =DUJg
 -----END PGP SIGNATURE-----

Merge tag 'platform-drivers-x86-v5.0-2' of git://git.infradead.org/linux-platform-drivers-x86

Pull x86 platform driver fixlet from Darren Hart:
 "Correct Documentation/ABI 4.21 KernelVersion to 5.0"

* tag 'platform-drivers-x86-v5.0-2' of git://git.infradead.org/linux-platform-drivers-x86:
  Documentation/ABI: Correct mlxreg-io KernelVersion for 5.0
2019-02-07 15:54:45 -07:00
Linus Torvalds
e303a067ce Three security fixes.
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQEcBAABAgAGBQJcXHSEAAoJEL/70l94x66DpJUH/Rl3uJGdezeL/BgDkABruIuv
 kJwjWUPjjVtcrz1UPjc8YENDG7g0tLDlFajRXXxMJh+MWMDi/YED27ev4fbGJEnZ
 ApApV0pWNLev+Y5QK4GRn4T9iW4HSuqlDW3gjj9PP0E/93lX8DCALQ+yD1sGsmmE
 yG+0rGOcWqlxD3pPhVESHmi/AGzsD82GDe2in8z/iET8ucxy1lmFlISEYbSxXNa/
 o06C65The6sIn3IrqbP3aKEZ9mrpCe51pJm0YwJJpmg6UWcBiNuU+lbzg6qOthP7
 1fmYy+j/BM+9cFEnFxp8gUW4LWTtlta5cDcDJhTXdaw8XFroac+T1z6ZGQd7838=
 =iKIE
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull KVM fixes from Paolo Bonzini:
 "Three security fixes"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221)
  KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222)
  kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)
2019-02-07 15:53:26 -07:00
Linus Torvalds
ee6c0737a0 Two small nfsd bugfixes for 5.0, for an RDMA bug and a file clone bug.
-----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJcXJY6AAoJECebzXlCjuG+scAP/jm9ETUxC3E9ZcVetSLs7vf1
 AxHVsr3E3qf9uViq/+1NBRJ/BKE1Porzi1Uz01ie5MdY6SHWFMxvIvZrTRuEAhbc
 VA9xeRcnX+7RkPWik3sepSUieVy8KgJDMxdE07HwwyzST14I1s5Ev79wo6XiYlTw
 3+ZdZe19Y4owmTkbDiLsxJVsI2Y8b+9BIhZ9/ICRyFzZclnyLdO15HTDr4q7E9cw
 ZEZMOoljX4cjY8cD7tqf68QECxZYm4a8Ba+L6P+oqKajq/6yUrocXA2UG65EMtIQ
 LtMIdpkC+zHFagRQBC3ymqEWTpX9ED6TA4H4ZSdh6UH8NwYXHsxQUYfI4Oetju/B
 iqWBbXpwg2jMNRDhXS/KdNezYcGjYGJZ03dezeSP/GwojoiKALD0iXxWU2zyq0Qs
 crnhmc2j1wZZl5CFXLCYwjDjHbeH6gWGfLuzAv1Q9/jQUitQ2CpC4t1MCRdOlWBt
 cqjCleF6Rd3oVk51BdYPm5OyCHyQjrrXmOsx8aHkY774p7TqsaHBjSreTBjQWhO8
 wAfnr6yS4/21Hfrji52Nf4Q6UJ1FFEWB0wXJhYAHzem1RsPGSbnEDam6Bpd6Bh0d
 ZxAU4spoVhezQPjF4JCmHfiAJ7rbegfltJa669rE5L1kbUYYE6TAAcOm8RTSWoPZ
 iGxkg/en5XiGsOGH9AyB
 =++rV
 -----END PGP SIGNATURE-----

Merge tag 'nfsd-5.0-1' of git://linux-nfs.org/~bfields/linux

Pull nfsd fixes from Bruce Fields:
 "Two small nfsd bugfixes for 5.0, for an RDMA bug and a file clone bug"

* tag 'nfsd-5.0-1' of git://linux-nfs.org/~bfields/linux:
  svcrdma: Remove max_sge check at connect time
  nfsd: Fix error return values for nfsd4_clone_file_range()
2019-02-07 15:44:45 -07:00
Linus Torvalds
8b5cdbe595 - Fix DM core's missing memory barrier before waitqueue_active() calls.
- Fix DM core's clone_bio() to work when cloning a subset of a bio with
   an integrity payload; bio_integrity_trim() wasn't getting called due
   to bio_trim()'s early return.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJcXGHSAAoJEMUj8QotnQNaZMcIAMxj39Gvh/e2dx5zKuHBPO4+
 e5aMnCGzFwTdV4lfmfIU8pa5CAxAQXWOO5fH5IMzAI2rne5uczHK5a1V5YrL5OuP
 P0j0UNKt58FZlRiXxaMwURoRZeJ2nKe0R+LWw1W5cEGGM45C5okMaWrdmbdHOk9/
 G09yk8SsjXAGhuadCcY+aY7SrLi6KAaz3A9G/EzU8r9QirLkRVyaDmXIZrD8+Kgv
 8gmSlL3LvQbUUU70gPEU7yXp86+/lZi5VQysBSG7aOZcmBsZuNeXOTgt/7DWFJ7S
 Wj81Ib9pOg0PPYweB7PZ53BKRTydlTpzfEKaeG5+gFJgn6NPxR22SeOb1WnZ0Lg=
 =rtij
 -----END PGP SIGNATURE-----

Merge tag 'for-5.0/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm

Pull device mapper fixes from Mike Snitzer:
 "Both of these fixes address issues in changes merged for 5.0-rc4:

   - Fix DM core's missing memory barrier before waitqueue_active()
     calls.

   - Fix DM core's clone_bio() to work when cloning a subset of a bio
     with an integrity payload; bio_integrity_trim() wasn't getting
     called due to bio_trim()'s early return"

* tag 'for-5.0/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
  dm: don't use bio_trim() afterall
  dm: add memory barrier before waitqueue_active
2019-02-07 15:42:43 -07:00
Harry Wentland
0461221316 drm/amd/display: Check hpd_gpio for NULL before accessing it
dal_gpio_open and dal_gpio_unlock_pin dereference hpd_gpio.
Check for NULL before calling those functions.

Fixes: ac627caf6b ("drm/amd/display: add gpio lock/unlock")
Reported-by: Przemek Socha <soprwa@gmail.com>
CC: Chiawen Huang <chiawen.huang@amd.com>
CC: Tony Cheng <Tony.Cheng@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Tested-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2019-02-07 17:22:12 -05:00
Sam Ravnborg
e3b01f0d57 drm: remove drmP.h from drm_modeset_helper.h
With the removal of drmP.h from drm_modeset_helper.h
the drmP.h are no longer included by any include files
in include/drm.
The drmP.h file is thus only included explicit
either in .c files or in local .h files.
This makes the process of deleting the drmP.h includes easier
as we have a more local dependency chain.

v2:
- moved updates of .c files in drm/ to a dedicated
  patch. This allows the updates to the *.c files
  to be committed without the removal part.
  So this patch can wait if it causes build failures
  due to pending changes

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <maxime.ripard@bootlin.com>
Cc: Sean Paul <sean@poorly.run>
Cc: David Airlie <airlied@linux.ie>
Cc: Daniel Vetter <daniel@ffwll.ch>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20190126122527.11647-6-sam@ravnborg.org
2019-02-07 21:48:34 +01:00
Sam Ravnborg
d713e33096 drm: prepare for drmP.h removal from drm_modeset_helper.h
The use of drmP.h is discouraged and removal of it from
drm_modeset_helper.h caused drm/ to fail to build.

This patch introduce the necessary fixes to prepare for the
drmP.h removal from drm_modeset_helper.h.

Build tested on x86, arm, alpha, ia64 allmodconfig/allyesconfig.

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <maxime.ripard@bootlin.com>
Cc: Sean Paul <sean@poorly.run>
Cc: David Airlie <airlied@linux.ie>
Cc: Daniel Vetter <daniel@ffwll.ch>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20190126122527.11647-5-sam@ravnborg.org
2019-02-07 21:48:28 +01:00
Sam Ravnborg
7d0b0adaee drm/rcar-du: prepare for drmP.h removal from drm_modeset_helper.h
The use of drmP.h is discouraged and removal of it from
drm_modeset_helper.h caused rcar-du to fail to build.

This patch introduce the necessary fixes to prepare for the
drmP.h removal from drm_modeset_helper.h.

Build tested on arm allmodconfig/allyesconfig.

v2:
- new patch. Changes like drm_probe_helper and other
  required several updates

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Cc: David Airlie <airlied@linux.ie>
Cc: Daniel Vetter <daniel@ffwll.ch>
Cc: linux-renesas-soc@vger.kernel.org
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20190126122527.11647-4-sam@ravnborg.org
2019-02-07 21:48:19 +01:00
Sam Ravnborg
d0e93599d3 drm/i915: prepare for drmP.h removal from drm_modeset_helper.h
The use of drmP.h is discouraged and removal of it from
drm_modeset_helper.h caused i915 to fail to build.

This patch introduce the necessary fixes to prepare for the
drmP.h removal from drm_modeset_helper.h.

In the files touched the lists of include files was grouped
and sorted.

Build tested on x86 and arm allmodconfig / allyesconfig.

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: David Airlie <airlied@linux.ie>
Cc: Daniel Vetter <daniel@ffwll.ch>
Cc: intel-gfx@lists.freedesktop.org
Acked-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20190126122527.11647-3-sam@ravnborg.org
2019-02-07 21:47:51 +01:00
Sam Ravnborg
96bae04347 staging/vboxvideo: prepare for drmP.h removal from drm_modeset_helper.h
The use of drmP.h is discouraged and removal of it from
drm_modeset_helper.h caused vboxvideo to fail to build.

This patch introduce the necessary fixes to prepare for the
drmP.h removal from drm_modeset_helper.h.

In the files touched sort the include files

Build tested on x86 and arm allmodconfig / allyesconfig.

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Hans de Goede <hdegoede@redhat.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20190126122527.11647-2-sam@ravnborg.org
2019-02-07 21:47:29 +01:00
Rodrigo Vivi
c09d39166d drm/i915: Update DRIVER_DATE to 20190207
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2019-02-07 12:45:32 -08:00
Thomas Gleixner
8087f40736 irqchip update for 5.0-rc6
- Another GICv3 ITS fix for devices sharing the same DevID
 - Don't return invalid data on exhaustion of the GICv3 LPI pool
 - Fix a GICv3 field decoding bug leading to memory over-allocation
 - Init GICv4 at boot time instead of lazy init
 - Fix interrupt masking on PJ4
 -----BEGIN PGP SIGNATURE-----
 
 iQJJBAABCgAzFiEEn9UcU+C1Yxj9lZw9I9DQutE9ekMFAlxaspYVHG1hcmMuenlu
 Z2llckBhcm0uY29tAAoJECPQ0LrRPXpDMS8QAIUNTdbpgtCc/3Lr4n1qHlzGCR1N
 n4FHYgpR1txcPcVyu92jLxEwnlzSw2zjexuqUNaUYVUKe6wzEAXpDba+dDhvLrW5
 JfT1RE7cDMWu34iKAorGg1sqAb3yl67d6Oi88abbNdv3zSa9EVyVBRp3eTWotNzg
 EAtVorirI41CZNirt3ZU0TRMX0wAc5g7HTq0AwBcQSsg0P6ZCyVqZU5w/JNsPzWH
 VIpYue8XlDNQ8SDJHRppHhyrghVHG0tpSHKo9I8cA9+4CK6CMd8OwZhdNsf2ISiL
 vcEOyuOQfIIyTry59F11eiwlMNa4nmsLlmzezOZUeb3NafxsqMmDsbjbOiDMIkzh
 WUt8BlWOSyy2sWlokX3Qu9CLlWxa+QydGokNdUufLYOAVQG+VDUD5lpaposUSNAe
 0thGXenlBO43NqTdldZu2L6E0Wb0M0CTuILOSg6M+6olTR5hsGJiUaV+3WLJHQi3
 gLzbAFu5JRzpJWqOPh/9pF5dQQIZ8Ls/C2oJlYt+CTiYA3je4pzWzEsmP2CBTYUy
 WZEq/mhcze0kFu2b7FnYNhvYkSPool4t5GajwoBYb34N2rnJa7KVYsBDAV0gUJ1t
 MZbTTzWUeWpsm31uZlvKiPSDHqpUPucZ9HtqBH8OKef6IZz4tMK7v9qx1yZ/C2ZL
 dSNbXHBEI7X44Ea2
 =Crvb
 -----END PGP SIGNATURE-----

Merge tag 'irqchip-5.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/urgent

Pull irqchip updates from Marc Zyngier:

- Another GICv3 ITS fix for devices sharing the same DevID
- Don't return invalid data on exhaustion of the GICv3 LPI pool
- Fix a GICv3 field decoding bug leading to memory over-allocation
- Init GICv4 at boot time instead of lazy init
- Fix interrupt masking on PJ4
2019-02-07 21:12:40 +01:00
Jan Kara
0803de7804 blktrace: Show requests without sector
Currently, blktrace will not show requests that don't have any data as
rq->__sector is initialized to -1 which is out of device range and thus
discarded by act_log_check(). This is most notably the case for cache
flush requests sent to the device. Fix the problem by making
blk_rq_trace_sector() return 0 for requests without initialized sector.

Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2019-02-07 12:57:17 -07:00
Vladimir Kondratiev
05dc6001af
mips: cm: reprime error cause
Accordingly to the documentation
---cut---
The GCR_ERROR_CAUSE.ERR_TYPE field and the GCR_ERROR_MULT.ERR_TYPE
fields can be cleared by either a reset or by writing the current
value of GCR_ERROR_CAUSE.ERR_TYPE to the
GCR_ERROR_CAUSE.ERR_TYPE register.
---cut---
Do exactly this. Original value of cm_error may be safely written back;
it clears error cause and keeps other bits untouched.

Fixes: 3885c2b463 ("MIPS: CM: Add support for reporting CM cache errors")
Signed-off-by: Vladimir Kondratiev <vladimir.kondratiev@linux.intel.com>
Signed-off-by: Paul Burton <paul.burton@mips.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: James Hogan <jhogan@kernel.org>
Cc: linux-mips@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org # v4.3+
2019-02-07 11:55:24 -08:00
Yifeng Li
8a96669d77
mips: loongson64: remove unreachable(), fix loongson_poweroff().
On my Yeeloong 8089, I noticed the machine fails to shutdown
properly, and often, the function mach_prepare_reboot() is
unexpectedly executed, thus the machine reboots instead. A
wait loop is needed to ensure the system is in a well-defined
state before going down.

In commit 997e93d4df ("MIPS: Hang more efficiently on
halt/powerdown/restart"), a general superset of the wait loop for all
platforms is already provided, so we don't need to implement our own.

This commit simply removes the unreachable() compiler marco after
mach_prepare_reboot(), thus allowing the execution of machine_hang().
My test shows that the machine is now able to shutdown successfully.

Please note that there are two different bugs preventing the machine
from shutting down, another work-in-progress commit is needed to
fix a lockup in cpufreq / i8259 driver, please read Reference, this
commit does not fix that bug.

Reference: https://lkml.org/lkml/2019/2/5/908
Signed-off-by: Yifeng Li <tomli@tomli.me>
Signed-off-by: Paul Burton <paul.burton@mips.com>
Cc: linux-mips@vger.kernel.org
Cc: Huacai Chen <chenhc@lemote.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: James Hogan <jhogan@kernel.org>
Cc: linux-kernel@vger.kernel.org
Cc: Aaro Koskinen <aaro.koskinen@iki.fi>
Cc: stable@vger.kernel.org # v4.17+
2019-02-07 11:50:14 -08:00
Ville Syrjälä
051a6d8d3c drm/i915: Move LUT programming to happen after vblank waits
The LUTs are single buffered so we should program them after
the double buffered pipe updates have been latched by the
hardware.

We'll also fix up the IPS vs. split gamma w/a to do the IPS
disable like everyone else. Note that this is currently dead
code as we don't use the split gamma mode on HSW, but that
will be fixed up shortly.

Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190205160848.24662-7-ville.syrjala@linux.intel.com
Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
2019-02-07 21:45:44 +02:00
Ville Syrjälä
4d8ed54c04 drm/i915: Split color mgmt based on single vs. double buffered registers
Split the color management hooks along the single vs. double
buffered registers line. Of the currently programmed registers
GAMMA_MODE and the ilk+ pipe CSC are double buffered, the
LUTS and CHV CGM block are single buffered.

The double buffered register will be programmed during the
normal pipe update with evasion, and also during pipe enable
so that the settings will already be correct when the pipe
starts up before the planes are enabled.

The single buffered registers are currently programmed before
the vblank evade. Which is totally wrong, but we'll correct
that later.

v2: Add some docs to explain the two vfuncs (Matt,Uma)
    Rebase

Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190205160848.24662-6-ville.syrjala@linux.intel.com
Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
2019-02-07 21:45:44 +02:00
Ville Syrjälä
87cefd57c8 drm/i915: Pull GAMMA_MODE write out from haswell_load_luts()
For bdw+ let's move the GAMMA_MODE write for the legacy LUT
mode into the .load_luts() funciton directly, rather than
relying on haswell_load_luts(). We'll be getting rid of
haswell_load_luts() entirely soon, and it's anyway cleaner
to have the GAMMA_MODE write in a single place.

Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
Reviewed-by: Uma Shankar <uma.shankar@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190205160848.24662-5-ville.syrjala@linux.intel.com
Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
2019-02-07 21:45:39 +02:00
Ville Syrjälä
23b03a272c drm/i915: Constify the state arguments to the color management stuff
Pass the crtc state etc. as const to the color management commit
functions. And while at it polish some of the local variables.

v2: Rebase

Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
Reviewed-by: Uma Shankar <uma.shankar@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190205160848.24662-4-ville.syrjala@linux.intel.com
Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
2019-02-07 21:36:27 +02:00
Ville Syrjälä
5f4f3e386b drm/i915: Precompute gamma_mode
We shouldn't be computing gamma mode during the commit phase.
Move it to the check phase.

v2: Reword comments a bit (Matt)
    Rebase

Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
Reviewed-by: Uma Shankar <uma.shankar@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190205160848.24662-3-ville.syrjala@linux.intel.com
Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
2019-02-07 21:35:45 +02:00
Ville Syrjälä
7eb31a0bb2 drm/i915: Split the gamma/csc enable bits from the plane_ctl() function
On g4x+ the pipe gamma enable bit for the primary plane affects
the pipe bottom color as well. The same for the pipe csc enable
bit on ilk+. Thus we must configure those bits correctly even
when the primary plane is disabled.

To make the feasible let's split those settings from the
plane_ctl() function into a seprate funciton that we can
call from the ->disable_plane() hook as well.

For consistency we'll do that on all the plane types. While
that has no real benefits at this time, it'll become useful
when we start to control the pipe gamma/csc enable bits
dynamically when we overhaul the color management code.

On pre-g4x there doesn't appear to be any way to gamma
correct the pipe bottom color, but sticking to the same
pattern doesn't hurt. And it'll still help us to do
crtc state readout correctly for the pipe gamma enable
bit for the color management overhaul.

An alternative apporach would be to still precompute these
bits into plane_state->ctl, but that would require that we
run through the plane check even when the plane isn't logically
enabled on any crtc. Currently that condition causes us to
short circuit the entire thing and not call ->check_plane().
There would also be some chicken and egg problems with
->check_plane() vs. crtc color state check that would
requite splitting certain things into multiple steps.
So all in all this seems like the easier route.

Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190205160848.24662-2-ville.syrjala@linux.intel.com
Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
2019-02-07 21:34:29 +02:00
Manuel Reinhardt
2bc16b9f32 ALSA: usb-audio: Fix implicit fb endpoint setup by quirk
The commit a60945fd08 ("ALSA: usb-audio: move implicit fb quirks to
separate function") introduced an error in the handling of quirks for
implicit feedback endpoints. This commit fixes this.

If a quirk successfully sets up an implicit feedback endpoint, usb-audio
no longer tries to find the implicit fb endpoint itself.

Fixes: a60945fd08 ("ALSA: usb-audio: move implicit fb quirks to separate function")
Signed-off-by: Manuel Reinhardt <manuel.rhdt@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-02-07 20:04:43 +01:00
Christian König
7fbd31ccea drm/amdgpu: fix NULL ptr dref in the VM code
The exclusive fence is of course perfectly optional here.

Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2019-02-07 14:03:18 -05:00
Harish Kasiviswanathan
9d18c131ee drm/amd/powerplay: add override pcie parameters for Vega20 (v2)
v2: Fix SMU message format
    Send override message after SMU enable features

Signed-off-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
Reviewed-by: Eric Huang <JinhuiEric.Huang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2019-02-07 14:03:18 -05:00
Harish Kasiviswanathan
c53134577c drm/amdgpu: Fix pci platform speed and width
The new Vega series GPU cards have in-built bridges. To get the pcie
speed and width supported by the platform walk the hierarchy and get the
slowest link.

Signed-off-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
Acked-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2019-02-07 14:03:18 -05:00
David S. Miller
ec7fd009e8 Merge branch 'ipv6-fixes'
Hangbin Liu says:

====================
fix two kernel panics when disabled IPv6 on boot up

When disabled IPv6 on boot up, since there is no ipv6 route tables, we should
not call rt6_lookup. Fix them by checking if we have inet6_dev pointer on
netdevice.

v2: Fix idev reference leak, declarations and code mixing as Stefano,
    Eric pointed. Since we only want to check if idev exists and not
    reference it, use __in6_dev_get() insteand of in6_dev_get().
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2019-02-07 10:48:42 -08:00
Hangbin Liu
173656acca sit: check if IPv6 enabled before calling ip6_err_gen_icmpv6_unreach()
If we disabled IPv6 from the kernel command line (ipv6.disable=1), we should
not call ip6_err_gen_icmpv6_unreach(). This:

  ip link add sit1 type sit local 192.0.2.1 remote 192.0.2.2 ttl 1
  ip link set sit1 up
  ip addr add 198.51.100.1/24 dev sit1
  ping 198.51.100.2

if IPv6 is disabled at boot time, will crash the kernel.

v2: there's no need to use in6_dev_get(), use __in6_dev_get() instead,
    as we only need to check that idev exists and we are under
    rcu_read_lock() (from netif_receive_skb_internal()).

Reported-by: Jianlin Shi <jishi@redhat.com>
Fixes: ca15a078bd ("sit: generate icmpv6 error when receiving icmpv4 error")
Cc: Oussama Ghorbel <ghorbel@pivasoftware.com>
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-02-07 10:48:42 -08:00
Hangbin Liu
c0a47e44c0 geneve: should not call rt6_lookup() when ipv6 was disabled
When we add a new GENEVE device with IPv6 remote, checking only for
IS_ENABLED(CONFIG_IPV6) is not enough as we may disable IPv6 in the
kernel command line (ipv6.disable=1), and calling rt6_lookup() would
cause a NULL pointer dereference.

v2:
- don't mix declarations and code (reported by Stefano Brivio, Eric Dumazet)
- there's no need to use in6_dev_get() as we only need to check that
  idev exists (reported by David Ahern). This is under RTNL, so we can
  simply use __in6_dev_get() instead (Stefano, Eric).

Reported-by: Jianlin Shi <jishi@redhat.com>
Fixes: c40e89fd35 ("geneve: configure MTU based on a lower device")
Cc: Alexey Kodanev <alexey.kodanev@oracle.com>
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-02-07 10:48:42 -08:00
Peter Shier
ecec76885b KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221)
Bugzilla: 1671904

There are multiple code paths where an hrtimer may have been started to
emulate an L1 VMX preemption timer that can result in a call to free_nested
without an intervening L2 exit where the hrtimer is normally
cancelled. Unconditionally cancel in free_nested to cover all cases.

Embargoed until Feb 7th 2019.

Signed-off-by: Peter Shier <pshier@google.com>
Reported-by: Jim Mattson <jmattson@google.com>
Reviewed-by: Jim Mattson <jmattson@google.com>
Reported-by: Felix Wilhelm <fwilhelm@google.com>
Cc: stable@kernel.org
Message-Id: <20181011184646.154065-1-pshier@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2019-02-07 19:03:01 +01:00
Paolo Bonzini
353c0956a6 KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222)
Bugzilla: 1671930

Emulation of certain instructions (VMXON, VMCLEAR, VMPTRLD, VMWRITE with
memory operand, INVEPT, INVVPID) can incorrectly inject a page fault
when passed an operand that points to an MMIO address.  The page fault
will use uninitialized kernel stack memory as the CR2 and error code.

The right behavior would be to abort the VM with a KVM_EXIT_INTERNAL_ERROR
exit to userspace; however, it is not an easy fix, so for now just
ensure that the error code and CR2 are zero.

Embargoed until Feb 7th 2019.

Reported-by: Felix Wilhelm <fwilhelm@google.com>
Cc: stable@kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2019-02-07 19:02:56 +01:00
Jann Horn
cfa3938117 kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)
kvm_ioctl_create_device() does the following:

1. creates a device that holds a reference to the VM object (with a borrowed
   reference, the VM's refcount has not been bumped yet)
2. initializes the device
3. transfers the reference to the device to the caller's file descriptor table
4. calls kvm_get_kvm() to turn the borrowed reference to the VM into a real
   reference

The ownership transfer in step 3 must not happen before the reference to the VM
becomes a proper, non-borrowed reference, which only happens in step 4.
After step 3, an attacker can close the file descriptor and drop the borrowed
reference, which can cause the refcount of the kvm object to drop to zero.

This means that we need to grab a reference for the device before
anon_inode_getfd(), otherwise the VM can disappear from under us.

Fixes: 852b6d57dc ("kvm: add device control API")
Cc: stable@kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2019-02-07 19:02:38 +01:00
Dmitry Osipenko
79930bafe2 gpu: host1x: Continue CDMA execution starting with a next job
Currently gathers of a hung job are getting NOP'ed and a restarted CDMA
executes the NOP'ed gathers. There shouldn't be a reason to not restart
CDMA execution starting with a next job, avoiding the unnecessary churning
with gathers NOP'ing.

Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
2019-02-07 18:34:25 +01:00
Dmitry Osipenko
5d6f043685 gpu: host1x: Don't complete a completed job
There is a chance that the last job has been completed at the time of
CDMA timeout handler invocation. In this case there is no need to complete
the completed job.

Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
2019-02-07 18:30:58 +01:00
Dmitry Osipenko
e8bad65938 gpu: host1x: Cancel only job that actually got stuck
Host1x doesn't have information about jobs inter-dependency, that is
something that will become available once host1x will get a proper
jobs scheduler implementation. Currently a hang job causes other unrelated
jobs to be canceled, that is a relic from downstream driver which is
irrelevant to upstream. Let's cancel only the hanging job and not to touch
other jobs in queue.

Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
2019-02-07 18:30:24 +01:00
Thierry Reding
6d6c815daa drm/tegra: sor: Support device tree crossbar configuration
The crossbar configuration is usually the same across all designs for a
given SoC generation. But sometimes there are designs that require some
other configuration.

Implement support for parsing the crossbar configuration from a device
tree. If the crossbar configuration is not present in the device tree,
fall back to the default crossbar configuration.

Signed-off-by: Thierry Reding <treding@nvidia.com>
2019-02-07 18:29:02 +01:00