1. 27 May, 2017 8 commits
    • Philipp Zabel's avatar
      drm/msm: for array in-fences, check if all backing fences are from our own context before waiting · 3cfac69c
      Philipp Zabel authored
      Use the dma_fence_match_context helper to check if all backing fences
      are from our own context, in which case we don't have to wait.
      Signed-off-by: default avatarPhilipp Zabel <p.zabel@pengutronix.de>
      Cc: Rob Clark <robdclark@gmail.com>
      Cc: Gustavo Padovan <gustavo.padovan@collabora.com>
      [rebased on code-motion]
      Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
      3cfac69c
    • Tobias Klauser's avatar
      drm/msm: constify irq_domain_ops · c43dd227
      Tobias Klauser authored
      struct irq_domain_ops is not modified, so it can be made const.
      Signed-off-by: default avatarTobias Klauser <tklauser@distanz.ch>
      Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
      c43dd227
    • Rob Clark's avatar
      drm/msm/mdp5: release hwpipe(s) for unused planes · adcbae31
      Rob Clark authored
      Otherwise, if userspace doesn't re-use a given plane, it's hwpipe(s)
      could stay permanently assigned.
      Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
      adcbae31
    • Eric Anholt's avatar
      drm/msm: Reuse dma_fence_release. · 3c30cc41
      Eric Anholt authored
      If we follow the typical pattern of the base class being the first
      member, we can use the default dma_fence_free function.
      Signed-off-by: default avatarEric Anholt <eric@anholt.net>
      Cc: Rob Clark <robdclark@gmail.com>
      Cc: linux-arm-msm@vger.kernel.org
      Cc: freedreno@lists.freedesktop.org
      Reviewed-by: default avatarRob Clark <robdclark@gmail.com>
      Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
      3c30cc41
    • Eric Anholt's avatar
      drm/msm: Expose our reservation object when exporting a dmabuf. · 43523eba
      Eric Anholt authored
      Without this, polling on the dma-buf (and presumably other devices
      synchronizing against our rendering) would return immediately, even
      while the BO was busy.
      Signed-off-by: default avatarEric Anholt <eric@anholt.net>
      Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Cc: stable@vger.kernel.org
      Cc: Rob Clark <robdclark@gmail.com>
      Cc: linux-arm-msm@vger.kernel.org
      Cc: freedreno@lists.freedesktop.org
      Reviewed-by: default avatarRob Clark <robdclark@gmail.com>
      Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
      43523eba
    • Rob Clark's avatar
      drm/msm/gpu: check legacy clk names in get_clocks() · 134ccada
      Rob Clark authored
      Otherwise if someone was using old bindings with "core_clk" instead of
      "core" as the clock name, we'd never find it and gpu would be stuck at
      27MHz (or whatever it's slowest rate is).
      
      Fixes: 98db803f ("msm/drm: gpu: Dynamically locate the clocks from the device tree")
      Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
      134ccada
    • Rob Clark's avatar
      drm/msm/mdp5: use __drm_atomic_helper_plane_duplicate_state() · 786813c3
      Rob Clark authored
      Somehow the helper was never retrofitted for mdp5.  Which meant when
      plane_state->fence was added, it could get copied into new state in
      mdp5_plane_duplicate_state().
      
      If an update to disable the plane (for example on rmfb) managed to sneak
      in after an nonblock update had swapped state, but before it was
      committed, we'd get a splat:
      
          WARNING: CPU: 1 PID: 69 at ../drivers/gpu/drm/drm_atomic_helper.c:1061 drm_atomic_helper_wait_for_fences+0xe0/0xf8
         Modules linked in:
      
         CPU: 1 PID: 69 Comm: kworker/1:1 Tainted: G        W       4.11.0-rc8+ #1187
         Hardware name: Qualcomm Technologies, Inc. APQ 8016 SBC (DT)
         Workqueue: events drm_mode_rmfb_work_fn
         task: ffffffc036560d00 task.stack: ffffffc036550000
         PC is at drm_atomic_helper_wait_for_fences+0xe0/0xf8
         LR is at complete_commit.isra.1+0x44/0x1c0
         pc : [<ffffff80084f6040>] lr : [<ffffff800854176c>] pstate: 20000145
         sp : ffffffc036553b60
         x29: ffffffc036553b60 x28: ffffffc0264e6a00
         x27: ffffffc035659000 x26: 0000000000000000
         x25: ffffffc0240e8000 x24: 0000000000000038
         x23: 0000000000000000 x22: ffffff800858f200
         x21: ffffffc0240e8000 x20: ffffffc02f56a800
         x19: 0000000000000000 x18: 0000000000000000
         x17: 0000000000000000 x16: 0000000000000000
         x15: 0000000000000000 x14: ffffffc00a192700
         x13: 0000000000000004 x12: 0000000000000000
         x11: ffffff80089a1690 x10: 00000000000008f0
         x9 : ffffffc036553b20 x8 : ffffffc036561650
         x7 : ffffffc03fe6cb40 x6 : 0000000000000000
         x5 : 0000000000000001 x4 : 0000000000000002
         x3 : ffffffc035659000 x2 : ffffffc0240e8c80
         x1 : 0000000000000000 x0 : ffffffc02adbe588
      
         ---[ end trace 13aeec77c3fb55e2 ]---
         Call trace:
         Exception stack(0xffffffc036553990 to 0xffffffc036553ac0)
         3980:                                   0000000000000000 0000008000000000
         39a0: ffffffc036553b60 ffffff80084f6040 0000000000004ff0 0000000000000038
         39c0: ffffffc0365539d0 ffffff800857e098 ffffffc036553a00 ffffff800857e1b0
         39e0: ffffffc036553a10 ffffff800857c554 ffffffc0365e8400 ffffffc0365e8400
         3a00: ffffffc036553a20 ffffff8008103358 000000000001aad7 ffffff800851b72c
         3a20: ffffffc036553a50 ffffff80080e9228 ffffffc02adbe588 0000000000000000
         3a40: ffffffc0240e8c80 ffffffc035659000 0000000000000002 0000000000000001
         3a60: 0000000000000000 ffffffc03fe6cb40 ffffffc036561650 ffffffc036553b20
         3a80: 00000000000008f0 ffffff80089a1690 0000000000000000 0000000000000004
         3aa0: ffffffc00a192700 0000000000000000 0000000000000000 0000000000000000
         [<ffffff80084f6040>] drm_atomic_helper_wait_for_fences+0xe0/0xf8
         [<ffffff800854176c>] complete_commit.isra.1+0x44/0x1c0
         [<ffffff8008541c64>] msm_atomic_commit+0x32c/0x350
         [<ffffff8008516230>] drm_atomic_commit+0x50/0x60
         [<ffffff8008517548>] drm_atomic_remove_fb+0x158/0x250
         [<ffffff80085186d0>] drm_framebuffer_remove+0x50/0x158
         [<ffffff8008518818>] drm_mode_rmfb_work_fn+0x40/0x58
         [<ffffff80080d5668>] process_one_work+0x1d0/0x378
         [<ffffff80080d5a54>] worker_thread+0x244/0x488
         [<ffffff80080db7fc>] kthread+0xfc/0x128
         [<ffffff8008082ec0>] ret_from_fork+0x10/0x50
      
      Fixes: 96260142 ("drm/fence: add in-fences support")
      Cc: stable@vger.kernel.org
      Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Reported-by: default avatarStanimir Varbanov <stanimir.varbanov@linaro.org>
      Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
      786813c3
    • Rob Clark's avatar
      drm/msm: select PM_OPP · ac20fa0a
      Rob Clark authored
      Otherwise, if nothing else enabled selects it, dev_pm_opp_of_add_table()
      will return -ENOTSUPP.
      
      Fixes: e2af8b6b ("drm/msm: gpu: Use OPP tables if we can")
      Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
      ac20fa0a
  2. 26 May, 2017 2 commits
    • Dave Airlie's avatar
      Merge branch 'drm-fixes-4.12' of git://people.freedesktop.org/~agd5f/linux into drm-fixes · bc1f0e04
      Dave Airlie authored
      A bunch of bug fixes:
      - Fix display flickering on some chips at high refresh rates
      - suspend/resume fix
      - hotplug fix
      - a couple of segfault fixes for certain cases
      
      * 'drm-fixes-4.12' of git://people.freedesktop.org/~agd5f/linux:
        drm/amdgpu: fix null point error when rmmod amdgpu.
        drm/amd/powerplay: fix a signedness bugs
        drm/amdgpu: fix NULL pointer panic of emit_gds_switch
        drm/radeon: Unbreak HPD handling for r600+
        drm/amd/powerplay/smu7: disable mclk switching for high refresh rates
        drm/amd/powerplay/smu7: add vblank check for mclk switching (v2)
        drm/radeon/ci: disable mclk switching for high refresh rates (v2)
        drm/amdgpu/ci: disable mclk switching for high refresh rates (v2)
        drm/amdgpu: fix fundamental suspend/resume issue
      bc1f0e04
    • Dave Airlie's avatar
      Merge tag 'drm-misc-fixes-2017-05-25' of git://anongit.freedesktop.org/git/drm-misc into drm-fixes · 538fd19e
      Dave Airlie authored
      Core Changes:
      - Don't drop vblank reference more than once in cases of ww retry (Daniel)
      
      Driver Changes:
      - radeon: Fix oops during radeon probe trying to reference wrong device (Lukas)
      - qxl: Avoid sleeping while in atomic context on cursor update (Gabriel)
      - gma500: Use VBT mode instead of pre-programmed mode for LVDS (Patrik)
      
      Cc: Lukas Wunner <lukas@wunner.de>
      Cc: Gabriel Krisman Bertazi <krisman@collabora.co.uk>
      Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
      Cc: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
      
      * tag 'drm-misc-fixes-2017-05-25' of git://anongit.freedesktop.org/git/drm-misc:
        drm/gma500/psb: Actually use VBT mode when it is found
        drm: Fix deadlock retry loop in page_flip_ioctl
        drm: qxl: Delay entering atomic context during cursor update
        drm/radeon: Fix oops upon driver load on PowerXpress laptops
      538fd19e
  3. 25 May, 2017 1 commit
    • Rex Zhu's avatar
      drm/amdgpu: fix null point error when rmmod amdgpu. · b62ce397
      Rex Zhu authored
      this bug happened when amdgpu load failed.
      
      [   75.740951] BUG: unable to handle kernel paging request at 00000000000031c0
      [   75.748167] IP: [<ffffffffa064a0e0>] amdgpu_fbdev_restore_mode+0x20/0x60 [amdgpu]
      [   75.755774] PGD 0
      
      [   75.759185] Oops: 0000 [#1] SMP
      [   75.762408] Modules linked in: amdgpu(OE-) ttm(OE) drm_kms_helper(OE) drm(OE) i2c_algo_bit(E) fb_sys_fops(E) syscopyarea(E) sysfillrect(E) sysimgblt(E) rpcsec_gss_krb5(E) nfsv4(E) nfs(E) fscache(E) eeepc_wmi(E) asus_wmi(E) sparse_keymap(E) intel_rapl(E) snd_hda_codec_hdmi(E) snd_hda_codec_realtek(E) snd_hda_codec_generic(E) snd_hda_intel(E) snd_hda_codec(E) snd_hda_core(E) x86_pkg_temp_thermal(E) intel_powerclamp(E) snd_hwdep(E) snd_pcm(E) snd_seq_midi(E) coretemp(E) kvm_intel(E) snd_seq_midi_event(E) snd_rawmidi(E) kvm(E) snd_seq(E) joydev(E) snd_seq_device(E) snd_timer(E) irqbypass(E) crct10dif_pclmul(E) crc32_pclmul(E) mei_me(E) ghash_clmulni_intel(E) snd(E) aesni_intel(E) mei(E) soundcore(E) aes_x86_64(E) shpchp(E) serio_raw(E) lrw(E) acpi_pad(E) gf128mul(E) glue_helper(E) ablk_helper(E) mac_hid(E)
      [   75.835574]  cryptd(E) parport_pc(E) ppdev(E) lp(E) nfsd(E) parport(E) auth_rpcgss(E) nfs_acl(E) lockd(E) grace(E) sunrpc(E) autofs4(E) hid_generic(E) usbhid(E) mxm_wmi(E) psmouse(E) e1000e(E) ptp(E) pps_core(E) ahci(E) libahci(E) wmi(E) video(E) i2c_hid(E) hid(E)
      [   75.858489] CPU: 5 PID: 1603 Comm: rmmod Tainted: G           OE   4.9.0-custom #2
      [   75.866183] Hardware name: System manufacturer System Product Name/Z170-A, BIOS 0901 08/31/2015
      [   75.875050] task: ffff88045d1bbb80 task.stack: ffffc90002de4000
      [   75.881094] RIP: 0010:[<ffffffffa064a0e0>]  [<ffffffffa064a0e0>] amdgpu_fbdev_restore_mode+0x20/0x60 [amdgpu]
      [   75.891238] RSP: 0018:ffffc90002de7d48  EFLAGS: 00010286
      [   75.896648] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000001
      [   75.903933] RDX: 0000000000000000 RSI: ffff88045d1bbb80 RDI: 0000000000000286
      [   75.911183] RBP: ffffc90002de7d50 R08: 0000000000000502 R09: 0000000000000004
      [   75.918449] R10: 0000000000000000 R11: 0000000000000001 R12: ffff880464bf0000
      [   75.925675] R13: ffffffffa0853000 R14: 0000000000000000 R15: 0000564e44f88210
      [   75.932980] FS:  00007f13d5400700(0000) GS:ffff880476540000(0000) knlGS:0000000000000000
      [   75.941238] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [   75.947088] CR2: 00000000000031c0 CR3: 000000045fd0b000 CR4: 00000000003406e0
      [   75.954332] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      [   75.961566] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      [   75.968834] Stack:
      [   75.970881]  ffff880464bf0000 ffffc90002de7d60 ffffffffa0636592 ffffc90002de7d80
      [   75.978454]  ffffffffa059015f ffff880464bf0000 ffff880464bf0000 ffffc90002de7da8
      [   75.986076]  ffffffffa0595216 ffff880464bf0000 ffff880460f4d000 ffffffffa0853000
      [   75.993692] Call Trace:
      [   75.996177]  [<ffffffffa0636592>] amdgpu_driver_lastclose_kms+0x12/0x20 [amdgpu]
      [   76.003700]  [<ffffffffa059015f>] drm_lastclose+0x2f/0xd0 [drm]
      [   76.009777]  [<ffffffffa0595216>] drm_dev_unregister+0x16/0xd0 [drm]
      [   76.016255]  [<ffffffffa0595944>] drm_put_dev+0x34/0x70 [drm]
      [   76.022139]  [<ffffffffa062f365>] amdgpu_pci_remove+0x15/0x20 [amdgpu]
      [   76.028800]  [<ffffffff81416499>] pci_device_remove+0x39/0xc0
      [   76.034661]  [<ffffffff81531caa>] __device_release_driver+0x9a/0x140
      [   76.041121]  [<ffffffff81531e58>] driver_detach+0xb8/0xc0
      [   76.046575]  [<ffffffff81530c95>] bus_remove_driver+0x55/0xd0
      [   76.052401]  [<ffffffff815325fc>] driver_unregister+0x2c/0x50
      [   76.058244]  [<ffffffff81416289>] pci_unregister_driver+0x29/0x90
      [   76.064466]  [<ffffffffa0596c5e>] drm_pci_exit+0x9e/0xb0 [drm]
      [   76.070507]  [<ffffffffa0796d71>] amdgpu_exit+0x1c/0x32 [amdgpu]
      [   76.076609]  [<ffffffff81104810>] SyS_delete_module+0x1a0/0x200
      [   76.082627]  [<ffffffff810e2b1a>] ? rcu_eqs_enter.isra.36+0x4a/0x50
      [   76.089001]  [<ffffffff8100392e>] do_syscall_64+0x6e/0x180
      [   76.094583]  [<ffffffff817e1d2f>] entry_SYSCALL64_slow_path+0x25/0x25
      [   76.101114] Code: 94 c0 c3 31 c0 5d c3 0f 1f 40 00 0f 1f 44 00 00 55 31 c0 48 89 e5 53 48 89 fb 48 c7 c7 1d 21 84 a0 e8 ab 77 b3 e0 e8 fc 8b d7 e0 <48> 8b bb c0 31 00 00 48 85 ff 74 09 e8 ff eb fc ff 85 c0 75 03
      [   76.121432] RIP  [<ffffffffa064a0e0>] amdgpu_fbdev_restore_mode+0x20/0x60 [amdgpu]
      Signed-off-by: default avatarRex Zhu <Rex.Zhu@amd.com>
      Reviewed-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      b62ce397
  4. 24 May, 2017 8 commits
  5. 23 May, 2017 3 commits
    • Patrik Jakobsson's avatar
      drm/gma500/psb: Actually use VBT mode when it is found · 82bc9a42
      Patrik Jakobsson authored
      With LVDS we were incorrectly picking the pre-programmed mode instead of
      the prefered mode provided by VBT. Make sure we pick the VBT mode if
      one is provided. It is likely that the mode read-out code is still wrong
      but this patch fixes the immediate problem on most machines.
      
      Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=78562
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarPatrik Jakobsson <patrik.r.jakobsson@gmail.com>
      Link: http://patchwork.freedesktop.org/patch/msgid/20170418114332.12183-1-patrik.r.jakobsson@gmail.com
      82bc9a42
    • Daniel Vetter's avatar
      drm: Fix deadlock retry loop in page_flip_ioctl · f9285434
      Daniel Vetter authored
      I failed to properly onion-wrap the unwind code: We acquire the vblank
      reference before we start with the wait-wound locking dance, hence we
      must make sure we retry before we drop the reference. Oops.
      
      v2: The vblank_put must be after the frambuffer_put (Michel). I suck at
      unwrapping code that doesn't use separate labels for each stage, but
      checks each pointer first ... While re-reading everything I also
      realized that we must clean up the fb refcounts, and specifically
      plane->old_fb before we drop the locks, either in the final unlocking,
      or in the w/w retry path. Hence the correct fix is to drop the
      vblank_put to the very bottom.
      
      Fixes: 29dc0d1d ("drm: Roll out acquire context for the page_flip ioctl")
      Cc: Harry Wentland <harry.wentland@amd.com>
      Cc: Daniel Vetter <daniel.vetter@intel.com>
      Cc: Jani Nikula <jani.nikula@linux.intel.com>
      Cc: Sean Paul <seanpaul@chromium.org>
      Cc: David Airlie <airlied@linux.ie>
      Cc: dri-devel@lists.freedesktop.org
      Reported-by: default avatarTommi Rantala <tt.rantala@gmail.com>
      Cc: Tommi Rantala <tt.rantala@gmail.com>
      Cc: Michel Dänzer <michel@daenzer.net>
      Tested-by: default avatarTommi Rantala <tt.rantala@gmail.com>
      Reviewed-by: default avatarMichel Dänzer <michel.daenzer@amd.com>
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@intel.com>
      Link: http://patchwork.freedesktop.org/patch/msgid/20170522135945.28831-1-daniel.vetter@ffwll.ch
      f9285434
    • Gabriel Krisman Bertazi's avatar
      drm: qxl: Delay entering atomic context during cursor update · 429030bc
      Gabriel Krisman Bertazi authored
      qxl_release_map will enter an atomic context, but since we still need to
      alloc memory for BOs, we better delay that until we have everything we
      need, in case we need to sleep inside the allocation.  This avoids the
      Sleep in atomic state below, which was reported by Mike.
      
       [   43.910362] BUG: sleeping function called from invalid context at mm/slab.h:432
       [   43.910955] in_atomic(): 1, irqs_disabled(): 0, pid: 2077, name: Xorg
       [   43.911472] Preemption disabled at:
       [   43.911478] [<ffffffffa02b1c45>] qxl_bo_kmap_atomic_page+0xa5/0x100 [qxl]
       [   43.912103] CPU: 0 PID: 2077 Comm: Xorg Tainted: G            E   4.12.0-master #38
       [ 43.912550] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
       rel-1.8.1-0-g4adadbd-20161202_174313-build11a 04/01/2014
       [   43.913202] Call Trace:
       [   43.913371]  dump_stack+0x65/0x89
       [   43.913581]  ? qxl_bo_kmap_atomic_page+0xa5/0x100 [qxl]
       [   43.913876]  ___might_sleep+0x11a/0x190
       [   43.914095]  __might_sleep+0x4a/0x80
       [   43.914319]  ? qxl_bo_create+0x50/0x190 [qxl]
       [   43.914565]  kmem_cache_alloc_trace+0x46/0x180
       [   43.914836]  qxl_bo_create+0x50/0x190 [qxl]
       [   43.915082]  ? refcount_dec_and_test+0x11/0x20
       [   43.915332]  ? ttm_mem_io_reserve+0x41/0xe0 [ttm]
       [   43.915595]  qxl_alloc_bo_reserved+0x37/0xb0 [qxl]
       [   43.915884]  qxl_cursor_atomic_update+0x8f/0x260 [qxl]
       [   43.916172]  ? drm_atomic_helper_update_legacy_modeset_state+0x1d6/0x210 [drm_kms_helper]
       [   43.916623]  drm_atomic_helper_commit_planes+0xec/0x230 [drm_kms_helper]
       [   43.916995]  drm_atomic_helper_commit_tail+0x2b/0x60 [drm_kms_helper]
       [   43.917398]  commit_tail+0x65/0x70 [drm_kms_helper]
       [   43.917693]  drm_atomic_helper_commit+0xa9/0x100 [drm_kms_helper]
       [   43.918039]  drm_atomic_commit+0x4b/0x50 [drm]
       [   43.918334]  drm_atomic_helper_update_plane+0xf1/0x110 [drm_kms_helper]
       [   43.918902]  __setplane_internal+0x19f/0x280 [drm]
       [   43.919240]  drm_mode_cursor_universal+0x101/0x1c0 [drm]
       [   43.919541]  drm_mode_cursor_common+0x15b/0x1d0 [drm]
       [   43.919858]  drm_mode_cursor2_ioctl+0xe/0x10 [drm]
       [   43.920157]  drm_ioctl+0x211/0x460 [drm]
       [   43.920383]  ? drm_mode_cursor_ioctl+0x50/0x50 [drm]
       [   43.920664]  ? handle_mm_fault+0x93/0x160
       [   43.920893]  do_vfs_ioctl+0x96/0x6e0
       [   43.921117]  ? __fget+0x73/0xa0
       [   43.921322]  SyS_ioctl+0x41/0x70
       [   43.921545]  entry_SYSCALL_64_fastpath+0x1a/0xa5
       [   43.922188] RIP: 0033:0x7f1145804bc7
       [   43.922526] RSP: 002b:00007ffcd3e50508 EFLAGS: 00003246 ORIG_RAX: 0000000000000010
       [   43.923367] RAX: ffffffffffffffda RBX: 0000000000000040 RCX: 00007f1145804bc7
       [   43.923852] RDX: 00007ffcd3e50540 RSI: 00000000c02464bb RDI: 000000000000000b
       [   43.924299] RBP: 0000000000000040 R08: 0000000000000040 R09: 000000000000000c
       [   43.924694] R10: 00007ffcd3e50340 R11: 0000000000003246 R12: 0000000000000018
       [   43.925128] R13: 00000000022bc390 R14: 0000000000000040 R15: 00007ffcd3e5062c
      Reported-by: default avatarMike Galbraith <efault@gmx.de>
      Signed-off-by: default avatarGabriel Krisman Bertazi <krisman@collabora.co.uk>
      Link: http://patchwork.freedesktop.org/patch/msgid/20170519175819.15682-1-krisman@collabora.co.ukSigned-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
      429030bc
  6. 22 May, 2017 3 commits
    • Lukas Wunner's avatar
      drm/radeon: Fix oops upon driver load on PowerXpress laptops · e480eaba
      Lukas Wunner authored
      Nicolai Stange reports the following oops which is caused by
      dereferencing rdev->pdev before it's subsequently set by
      radeon_device_init().  Fix it.
      
        BUG: unable to handle kernel NULL pointer dereference at 00000000000007cb
        IP: radeon_driver_load_kms+0xeb/0x230 [radeon]
        ...
        Call Trace:
         drm_dev_register+0x146/0x1d0 [drm]
         drm_get_pci_dev+0x9a/0x180 [drm]
         radeon_pci_probe+0xb8/0xe0 [radeon]
         local_pci_probe+0x45/0xa0
         pci_device_probe+0x14f/0x1a0
         driver_probe_device+0x29c/0x450
         __driver_attach+0xdf/0xf0
         ? driver_probe_device+0x450/0x450
         bus_for_each_dev+0x6c/0xc0
         driver_attach+0x1e/0x20
         bus_add_driver+0x170/0x270
         driver_register+0x60/0xe0
         ? 0xffffffffc0508000
         __pci_register_driver+0x4c/0x50
         drm_pci_init+0xeb/0x100 [drm]
         ? vga_switcheroo_register_handler+0x6a/0x90
         ? 0xffffffffc0508000
         radeon_init+0x98/0xb6 [radeon]
         do_one_initcall+0x52/0x1a0
         ? __vunmap+0x81/0xb0
         ? kmem_cache_alloc_trace+0x159/0x1b0
         ? do_init_module+0x27/0x1f8
         do_init_module+0x5f/0x1f8
         load_module+0x27ce/0x2be0
         SYSC_finit_module+0xdf/0x110
         ? SYSC_finit_module+0xdf/0x110
         SyS_finit_module+0xe/0x10
         do_syscall_64+0x67/0x150
         entry_SYSCALL64_slow_path+0x25/0x25
      
      Fixes: 7ffb0ce3 ("drm/radeon: Don't register Thunderbolt eGPU with vga_switcheroo")
      Reported-and-tested-by: default avatarNicolai Stange <nicstange@gmail.com>
      Signed-off-by: default avatarLukas Wunner <lukas@wunner.de>
      Link: http://patchwork.freedesktop.org/patch/msgid/cfb91ba052af06117137eec0637543a2626a7979.1495135190.git.lukas@wunner.de
      e480eaba
    • Linus Torvalds's avatar
      Linux 4.12-rc2 · 08332893
      Linus Torvalds authored
      08332893
    • Linus Torvalds's avatar
      x86: fix 32-bit case of __get_user_asm_u64() · 33c9e972
      Linus Torvalds authored
      The code to fetch a 64-bit value from user space was entirely buggered,
      and has been since the code was merged in early 2016 in commit
      b2f68038 ("x86/mm/32: Add support for 64-bit __get_user() on 32-bit
      kernels").
      
      Happily the buggered routine is almost certainly entirely unused, since
      the normal way to access user space memory is just with the non-inlined
      "get_user()", and the inlined version didn't even historically exist.
      
      The normal "get_user()" case is handled by external hand-written asm in
      arch/x86/lib/getuser.S that doesn't have either of these issues.
      
      There were two independent bugs in __get_user_asm_u64():
      
       - it still did the STAC/CLAC user space access marking, even though
         that is now done by the wrapper macros, see commit 11f1a4b9
         ("x86: reorganize SMAP handling in user space accesses").
      
         This didn't result in a semantic error, it just means that the
         inlined optimized version was hugely less efficient than the
         allegedly slower standard version, since the CLAC/STAC overhead is
         quite high on modern Intel CPU's.
      
       - the double register %eax/%edx was marked as an output, but the %eax
         part of it was touched early in the asm, and could thus clobber other
         inputs to the asm that gcc didn't expect it to touch.
      
         In particular, that meant that the generated code could look like
         this:
      
              mov    (%eax),%eax
              mov    0x4(%eax),%edx
      
         where the load of %edx obviously was _supposed_ to be from the 32-bit
         word that followed the source of %eax, but because %eax was
         overwritten by the first instruction, the source of %edx was
         basically random garbage.
      
      The fixes are trivial: remove the extraneous STAC/CLAC entries, and mark
      the 64-bit output as early-clobber to let gcc know that no inputs should
      alias with the output register.
      
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: Benjamin LaHaise <bcrl@kvack.org>
      Cc: Ingo Molnar <mingo@kernel.org>
      Cc: stable@kernel.org   # v4.8+
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      33c9e972
  7. 21 May, 2017 7 commits
    • Linus Torvalds's avatar
      Clean up x86 unsafe_get/put_user() type handling · 334a023e
      Linus Torvalds authored
      Al noticed that unsafe_put_user() had type problems, and fixed them in
      commit a7cc722f ("fix unsafe_put_user()"), which made me look more
      at those functions.
      
      It turns out that unsafe_get_user() had a type issue too: it limited the
      largest size of the type it could handle to "unsigned long".  Which is
      fine with the current users, but doesn't match our existing normal
      get_user() semantics, which can also handle "u64" even when that does
      not fit in a long.
      
      While at it, also clean up the type cast in unsafe_put_user().  We
      actually want to just make it an assignment to the expected type of the
      pointer, because we actually do want warnings from types that don't
      convert silently.  And it makes the code more readable by not having
      that one very long and complex line.
      
      [ This patch might become stable material if we ever end up back-porting
        any new users of the unsafe uaccess code, but as things stand now this
        doesn't matter for any current existing uses. ]
      
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      334a023e
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · f3926e4c
      Linus Torvalds authored
      Pull misc uaccess fixes from Al Viro:
       "Fix for unsafe_put_user() (no callers currently in mainline, but
        anyone starting to use it will step into that) + alpha osf_wait4()
        infoleak fix"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        osf_wait4(): fix infoleak
        fix unsafe_put_user()
      f3926e4c
    • Linus Torvalds's avatar
      Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 970c305a
      Linus Torvalds authored
      Pull scheduler fix from Thomas Gleixner:
       "A single scheduler fix:
      
        Prevent idle task from ever being preempted. That makes sure that
        synchronize_rcu_tasks() which is ignoring idle task does not pretend
        that no task is stuck in preempted state. If that happens and idle was
        preempted on a ftrace trampoline the machine crashes due to
        inconsistent state"
      
      * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        sched/core: Call __schedule() from do_idle() without enabling preemption
      970c305a
    • Linus Torvalds's avatar
      Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · e7a3d627
      Linus Torvalds authored
      Pull irq fixes from Thomas Gleixner:
       "A set of small fixes for the irq subsystem:
      
         - Cure a data ordering problem with chained interrupts
      
         - Three small fixlets for the mbigen irq chip"
      
      * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        genirq: Fix chained interrupt data ordering
        irqchip/mbigen: Fix the clear register offset calculation
        irqchip/mbigen: Fix potential NULL dereferencing
        irqchip/mbigen: Fix memory mapping code
      e7a3d627
    • Al Viro's avatar
      osf_wait4(): fix infoleak · a8c39544
      Al Viro authored
      failing sys_wait4() won't fill struct rusage...
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      a8c39544
    • Al Viro's avatar
      fix unsafe_put_user() · a7cc722f
      Al Viro authored
      __put_user_size() relies upon its first argument having the same type as what
      the second one points to; the only other user makes sure of that and
      unsafe_put_user() should do the same.
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      a7cc722f
    • Linus Torvalds's avatar
      Merge tag 'trace-v4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · 56f410cf
      Linus Torvalds authored
      Pull tracing fixes from Steven Rostedt:
      
       - Fix a bug caused by not cleaning up the new instance unique triggers
         when deleting an instance. It also creates a selftest that triggers
         that bug.
      
       - Fix the delayed optimization happening after kprobes boot up self
         tests being removed by freeing of init memory.
      
       - Comment kprobes on why the delay optimization is not a problem for
         removal of modules, to keep other developers from searching that
         riddle.
      
       - Fix another case of rcu not watching in stack trace tracing.
      
      * tag 'trace-v4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        tracing: Make sure RCU is watching before calling a stack trace
        kprobes: Document how optimized kprobes are removed from module unload
        selftests/ftrace: Add test to remove instance with active event triggers
        selftests/ftrace: Fix bashisms
        ftrace: Remove #ifdef from code and add clear_ftrace_function_probes() stub
        ftrace/instances: Clear function triggers when removing instances
        ftrace: Simplify glob handling in unregister_ftrace_function_probe_func()
        tracing/kprobes: Enforce kprobes teardown after testing
        tracing: Move postpone selftests to core from early_initcall
      56f410cf
  8. 20 May, 2017 8 commits