summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-12-13drm/i915: Mark up potential allocation paths within i915_sw_fence as might_sleepChris Wilson
As kmalloc is allowed to block (if given the right flags), mark up the two i915_sw_fence routines that may call kmalloc as potential sleeping routines. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Reviewed-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20171212180652.22061-1-chris@chris-wilson.co.uk
2017-12-13drm/tegra: sor: Parameterize register offsetsThierry Reding
Future Tegra generations have an increased number of display controllers that can drive individual SORs. In order to support that, the offset and layout of some registers has changed in backwards-incompatible ways. Use parameterized register offsets to support this. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13drm/tegra: Support ARGB and ABGR formatsThierry Reding
These formats can easily be supported on all generations of Tegra. Note that the XRGB and XBGR formats that we supported were in fact using the ARGB and ABGR Tegra formats. This happened to work in cases where no alpha was being considered. This change is also a fix for those formats. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13drm/tegra: dc: Add Tegra186 supportThierry Reding
The display architecture has changed in several signifcant ways with the new Tegra186 SoC. Display controllers are a completely different design, but have been given a frontend that simulates the register interface for earlier chips. Unfortunately the frontend isn't completely backwards compatible, so the driver needs parameterization to take the changes into account. One big change is that the total number of display controllers has been increased to three. At the same time the number of planes available has remained constant. However, planes can now be freely assigned between the display controllers, giving applications more flexibility in making the best use of the available resources. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13drm/tegra: Add Tegra186 display hub supportThierry Reding
The display architecture has changed in several significant ways with the new Tegra186 SoC. Shared between all display controllers is a set of common resources referred to as the display hub. The hub generates accesses to memory and feeds them into various composition pipelines, each of which being a window that can be assigned to arbitrary heads. Atomic state is subclassed in order to track the global bandwidth requirements and select and adjust the hub clocks appropriately. The plane code is shared to a large degree with earlier SoC generations, except where the programming differs. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13drm/tegra: Move common plane code to separate fileThierry Reding
Subsequent patches will add support for Tegra186 which has a different architecture and needs different plane code but which can share a lot of code with earlier Tegra support. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13drm/tegra: dc: Move state definition to headerThierry Reding
Move the display controller state definition to the header file so that it can be referenced by other files. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13drm/tegra: dc: Remove duplicate plane funcsThierry Reding
Both tegra_overlay_plane_funcs is identical to tegra_plane_funcs. Get rid of the duplicate and use one set of function pointers for all planes. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13drm/tegra: dc: Remove tegra_overlay_plane_destroy()Thierry Reding
This function is a simple wrapper around tegra_plane_destroy(), so it can be dropped. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13drm/tegra: dc: Remove duplicate plane funcsThierry Reding
Both tegra_primary_plane_funcs and tegra_cursor_plane_funcs are identical. Get rid of the duplicate and use one set of function pointers for all planes. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13drm/tegra: dc: Remove tegra_primary_plane_destroy()Thierry Reding
This function is a simple wrapper around tegra_plane_destroy(), so it can be dropped. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13drm/tegra: Remove custom page-flip handlerThierry Reding
Tegra display hardware has GO bits and meets all the requirements to use drm_crtc_arm_vblank_event(). Use it instead and get rid of the hand- rolled implementation. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13drm/tegra: Use atomic commit helpersThierry Reding
There's no reason not to use them, and they already get all the semantics right, so rip out all of the custom code and replace it by the helpers. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13drm/tegra: dc: Support background colorThierry Reding
Starting with Tegra124, the interface to set the background color (the value generated for pixels that are not sourced from any window) is via a different register. Earlier generations called this the border color. Reverse the feature flag and assume that IP revisions that don't have support for background color will support border color instead. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13drm/tegra: vic: Properly align argumentsThierry Reding
Properly align function arguments on subsequent lines with the first argument on the first line. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13drm/tegra: Do not wrap lines unnecessarilyThierry Reding
The tegra_drm_alloc() function signature fits on a single line, no need to wrap it. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13drm/tegra: sor: Register debugfs in ->late_register()Thierry Reding
The ->late_register() and ->early_unregister() callbacks are called at the right time to make sure userspace only accesses interfaces when it should. Move debugfs registration and unregistration to these callback functions to avoid potential races with userspace. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13drm/tegra: sor: Root debugfs files at the connectorThierry Reding
Rather create new files within the top-level DRM device's debugfs node, add the SOR specific files to the connector's debugfs node. This avoids the need to come up with subdirectory names and is also more intuitive. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13drm/tegra: hdmi: Register debugfs in ->late_register()Thierry Reding
The ->late_register() and ->early_unregister() callbacks are called at the right time to make sure userspace only accesses interfaces when it should. Move debugfs registration and unregistration to these callback functions to avoid potential races with userspace. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13drm/tegra: dsi: Register debugfs in ->late_register()Thierry Reding
The ->late_register() and ->early_unregister() callbacks are called at the right time to make sure userspace only accesses interfaces when it should. Move debugfs registration and unregistration to these callback functions to avoid potential races with userspace. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13drm/tegra: dc: Register debugfs in ->late_register()Thierry Reding
The ->late_register() and ->early_unregister() callbacks are called at the right time to make sure userspace only accesses interfaces when it should. Move debugfs registration and unregistration to these callback functions to avoid potential races with userspace. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13drm/tegra: dc: Reshuffle some codeThierry Reding
Reshuffle some code so that functions are defined closer to where they are used. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13drm/tegra: sor: Move register definitions into a tableThierry Reding
After commit 932f6529139e ("drm/tegra: sor: Trace register accesses"), the debugfs register dump implementation causes excessive stack usage and can result in build warnings. To fix this, move the register definitions into a table and iterate over the table while dumping the registers to debugfs. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13drm/tegra: hdmi: Move register definitions into a tableThierry Reding
After commit 07a8aab89927 ("drm/tegra: hdmi: Trace register accesses"), the debugfs register dump implementation causes excessive stack usage and can result in build warnings. To fix this, move the register definitions into a table and iterate over the table while dumping the registers to debugfs. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13drm/tegra: dsi: Move register definitions into a tableThierry Reding
After commit 75af8fa7fd47 ("drm/tegra: dsi: Trace register accesses"), the debugfs register dump implementation causes excessive stack usage and can result in build warnings. To fix this, move the register definitions into a table and iterate over the table while dumping the registers to debugfs. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13drm/tegra: dc: Move register definitions into a tableThierry Reding
After commit 67e04d1ab19b ("drm/tegra: dc: Trace register accesses"), the debugfs register dump implementation causes excessive stack usage and can result in build warnings. To fix this, move the register definitions into a table and iterate over the table while dumping the registers to debugfs. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13dt-bindings: display: tegra: Update SOR for Tegra186Thierry Reding
Update the SOR bindings for Tegra186, in which a new property is required to identify the instance of the SOR interface and the clock tree has slightly changed as well. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13gpu: host1x: Cleanup on initialization failureThierry Reding
When an error happens during the initialization of one of the sub- devices, make sure to properly cleanup all sub-devices that have been initialized up to that point. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13gpu: host1x: Rewrite conditional for better readabilityThierry Reding
The current check is slightly difficult to read, rewrite it to improve that a little. Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13drm/tegra: Sanitize format modifiersThierry Reding
The existing format modifier definitions were merged prematurely, and recent work has unveiled that the definitions are suboptimal in several ways: - The format specifiers, except for one, are not Tegra specific, but the names don't reflect that. - The number space is split into two, reserving 32 bits for some "parameter" which most of the modifiers are not going to have. - Symbolic names for the modifiers are not using the standard DRM_FORMAT_MOD_* prefix, which makes them awkward to use. - The vendor prefix NV is somewhat ambiguous. Fortunately, nobody's started using these modifiers, so we can still fix the above issues. Do so by using the standard prefix. Also, remove TEGRA from the name of those modifiers that exist on NVIDIA GPUs as well. In case of the block linear modifiers, make the "parameter" smaller (4 bits, though only 6 values are valid) and don't let that leak into any of the other modifiers. Finally, also use the more canonical NVIDIA instead of the ambiguous NV prefix. Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13drm/fourcc: Fix fourcc_mod_code() definitionThierry Reding
Avoid a compiler warnings when the val parameter is an expression. Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Thierry Reding <treding@nvidia.com>
2017-12-13USB: core: prevent malicious bNumInterfaces overflowAlan Stern
A malicious USB device with crafted descriptors can cause the kernel to access unallocated memory by setting the bNumInterfaces value too high in a configuration descriptor. Although the value is adjusted during parsing, this adjustment is skipped in one of the error return paths. This patch prevents the problem by setting bNumInterfaces to 0 initially. The existing code already sets it to the proper value after parsing is complete. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Reported-by: Andrey Konovalov <andreyknvl@google.com> CC: <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-12-13drm/i915: Don't check #active_requests from i915_gem_wait_for_idle()Chris Wilson
i915_gem_wait_for_idle() is called from inside the shrinker, to ensure that we drain the last resources from the GPU in dire circumstances (OOM). As we may allocate whilst building a request, it is then possible to hit the shrinker with a request under construction, and so we must account for the incomplete request whilst waiting. In particular, we preincrement (in reserve_engine) the i915->gt.active_requests counter and mark the GPU as busy, therefore we can not use that counter for shortcircuiting the wait-for-idle. [ 950.859024] GEM_BUG_ON(i915->gt.active_requests) [ 950.859041] WARNING: CPU: 2 PID: 2178 at drivers/gpu/drm/i915/i915_gem.c:3615 i915_gem_wait_for_idle.part.56+0x166/0x4e0 [ 950.859041] Modules linked in: ccm tun fuse nf_conntrack_netbios_ns nf_conntrack_broadcast ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack libcrc32c ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_mangle iptable_security iptable_raw arc4 iwldvm mac80211 snd_hda_codec_hdmi snd_hda_codec_idt snd_hda_codec_generic snd_hda_intel snd_hda_codec btusb snd_hda_core btrtl btbcm iwlwifi snd_hwdep btintel bluetooth snd_seq snd_seq_device snd_pcm ecdh_generic x86_pkg_temp_thermal tpm_infineon coretemp tpm_tis crc32_pclmul wmi_bmof crc32c_intel iTCO_wdt hp_wmi snd_timer iTCO_vendor_support sparse_keymap tpm_tis_core mei_me cfg80211 [ 950.859082] snd joydev tpm mei rfkill pcspkr wmi soundcore lpc_ich hp_accel lis3lv02d input_polldev binfmt_misc e1000e ptp serio_raw pps_core [ 950.859094] CPU: 2 PID: 2178 Comm: gem_exec_nop Tainted: G U 4.15.0-rc2+ #900 [ 950.859102] Hardware name: Hewlett-Packard HP ProBook 6360b/1620, BIOS 68SCF Ver. B.42 12/29/2010 [ 950.859107] task: c5119cb4 task.stack: f3ccb8d8 [ 950.859112] EIP: i915_gem_wait_for_idle.part.56+0x166/0x4e0 [ 950.859113] EFLAGS: 00010296 CPU: 2 [ 950.859114] EAX: 00000024 EBX: f36c1888 ECX: f777a044 EDX: 00000007 [ 950.859115] ESI: f36c1888 EDI: edd53958 EBP: edd53970 ESP: edd53938 [ 950.859116] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 [ 950.859117] CR0: 80050033 CR2: b7f39000 CR3: 2f2b3000 CR4: 000406d0 [ 950.859118] Call Trace: [ 950.859125] ? drm_printk+0x70/0x70 [ 950.859129] i915_gem_wait_for_idle+0x18/0x30 [ 950.859133] i915_gem_shrink+0x360/0x410 [ 950.859138] ? vmpressure+0xa8/0xf0 [ 950.859142] ? ktime_get+0x4a/0x100 [ 950.859147] i915_gem_shrink_all+0x21/0x40 [ 950.859151] i915_gem_shrinker_oom+0x23/0x130 [ 950.859156] notifier_call_chain+0x4e/0x70 [ 950.859160] __blocking_notifier_call_chain+0x2f/0x60 [ 950.859164] blocking_notifier_call_chain+0x11/0x20 [ 950.859169] out_of_memory+0x207/0x280 [ 950.859174] __alloc_pages_nodemask+0xd47/0xe60 [ 950.859179] new_slab+0x32d/0x450 [ 950.859183] ___slab_alloc.constprop.81+0x358/0x4e0 [ 950.859189] ? i915_sw_fence_await_dma_fence+0x53/0x160 [ 950.859193] ? __slab_free+0x1fe/0x310 [ 950.859197] ? native_sched_clock+0x1e/0xc0 [ 950.859201] ? i915_gem_request_alloc+0xcf/0x510 [ 950.859205] ? sched_clock+0x9/0x10 [ 950.859209] __slab_alloc.constprop.80+0x29/0x40 [ 950.859212] ? __slab_alloc.constprop.80+0x29/0x40 [ 950.859216] kmem_cache_alloc_trace+0x160/0x1a0 [ 950.859220] ? i915_sw_fence_await_dma_fence+0x53/0x160 [ 950.859224] i915_sw_fence_await_dma_fence+0x53/0x160 [ 950.859229] i915_gem_request_await_dma_fence+0x1eb/0x390 [ 950.859233] i915_gem_request_await_object+0xee/0x230 [ 950.859239] i915_gem_do_execbuffer+0xc16/0x1200 [ 950.859246] ? irqtime_account_irq+0x3e/0xc0 [ 950.859251] ? irq_exit+0x4f/0xb0 [ 950.859257] ? smp_apic_timer_interrupt+0x5f/0x110 [ 950.859261] ? apic_timer_interrupt+0x35/0x3c [ 950.859266] i915_gem_execbuffer2_ioctl+0x212/0x440 [ 950.859270] ? apic_timer_interrupt+0x35/0x3c [ 950.859274] ? i915_gem_do_execbuffer+0x1200/0x1200 [ 950.859279] ? insn_get_seg_base+0x1b/0x50 [ 950.859283] ? i915_gem_do_execbuffer+0x1200/0x1200 [ 950.859287] drm_ioctl_kernel+0x51/0xa0 [ 950.859291] drm_ioctl+0x2a3/0x350 [ 950.859294] ? i915_gem_do_execbuffer+0x1200/0x1200 [ 950.859300] ? sched_clock+0x9/0x10 [ 950.859303] ? drm_getunique+0x70/0x70 [ 950.859308] do_vfs_ioctl+0x7d/0x640 [ 950.859311] ? native_sched_clock+0x1e/0xc0 [ 950.859315] ? sched_clock+0x9/0x10 [ 950.859319] ? sched_clock_cpu+0x13/0x120 [ 950.859323] SyS_ioctl+0x4e/0x80 [ 950.859326] do_fast_syscall_32+0x75/0x250 [ 950.859331] ? irq_exit+0x4f/0xb0 [ 950.859334] entry_SYSENTER_32+0x47/0x71 [ 950.859338] EIP: 0xb7f81d11 [ 950.859339] EFLAGS: 00000296 CPU: 2 [ 950.859340] EAX: ffffffda EBX: 00000003 ECX: 40406469 EDX: bfde4c20 [ 950.859340] ESI: 00000003 EDI: 40406469 EBP: 00000003 ESP: bfde4b38 [ 950.859341] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 007b [ 950.859343] Code: e8 30 60 01 00 83 c4 10 83 c3 04 39 f3 75 e0 8b 45 d8 8b 80 14 37 00 00 85 c0 74 13 68 dd 33 e4 c0 68 49 6f e3 c0 e8 4a 55 be ff <0f> ff 5e 5f b8 fe ff ff 3f bb 0a 00 00 00 e8 b7 14 c4 ff 8b 15 Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20171212132148.8124-1-chris@chris-wilson.co.uk Reviewed-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2017-12-13drm/i915/fence: Use rcu to defer freeing of irq_workChris Wilson
It is illegal to perform an immediate free of the struct irq_work from inside the irq_work callback (as irq_work_run_list modifies work->flags after execution of the work->func()). As we use the irq_work to coordinate the freeing of the callback from two different softirq paths, we need to defer the kfree from inside our irq_work callback, for which we can use kfree_rcu. Fixes: 81c0ed21aa91 ("drm/i915/fence: Avoid del_timer_sync() from inside a timer") Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20171213094802.28243-1-chris@chris-wilson.co.uk
2017-12-13Revert "USB: core: only clean up what we allocated"Greg Kroah-Hartman
This reverts commit 32fd87b3bbf5f7a045546401dfe2894dbbf4d8c3. Alan wrote a better fix for this... Cc: Andrey Konovalov <andreyknvl@google.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-12-13MAINTAINERS: Remove Jani as drm-misc co-maintainerJani Nikula
I'm juggling too many things, and drm-misc maintenance is one that I keep dropping on the floor. Admit reality and remove myself as maintainer. This still leaves us with a nice team of three who are actually doing the drm-misc work, while I focus on drm-intel. Cc: Daniel Vetter <daniel.vetter@intel.com> Cc: Gustavo Padovan <gustavo@padovan.org> Cc: Sean Paul <seanpaul@chromium.org> Cc: Dave Airlie <airlied@redhat.com> Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch> Relunctantly-Acked-By: Sean Paul <seanpaul@chromium.org> Acked-by: Gustavo Padovan <gustavo.padovan@collabora.com> Signed-off-by: Jani Nikula <jani.nikula@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20171123121308.12818-1-jani.nikula@intel.com
2017-12-13tools/lib/lockdep: Add missing declaration of 'pr_cont()'Mengting Zhang
Commit: 681fbec881de ("lockdep: Use consistent printing primitives") has moved lockdep away from using printk() for printing. The commit added usage of pr_cont() which wasn't wrapped in the userspace headers, causing the following warning for the liblockdep build: ../../../kernel/locking/lockdep.c:3544:2: warning: implicit declaration of function 'pr_cont' [-Wimplicit-function-declaration] Adding an empty declaration of 'pr_cont' fixes the problem. Signed-off-by: Mengting Zhang <zhangmengting@huawei.com> Signed-off-by: Sasha Levin <alexander.levin@verizon.com> Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: a.p.zijlstra@chello.nl Link: http://lkml.kernel.org/r/20171212181644.11913-2-alexander.levin@verizon.com Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-12-13arm64: fault: avoid send SIGBUS two timesDongjiu Geng
do_sea() calls arm64_notify_die() which will always signal user-space. It also returns whether APEI claimed the external abort as a RAS notification. If it returns failure do_mem_abort() will signal user-space too. do_mem_abort() wants to know if we handled the error, we always call arm64_notify_die() so can always return success. Signed-off-by: Dongjiu Geng <gengdongjiu@huawei.com> Reviewed-by: James Morse <james.morse@arm.com> Reviewed-by: Xie XiuQi <xiexiuqi@huawei.com> Signed-off-by: Will Deacon <will.deacon@arm.com>
2017-12-13s390/pci: handle insufficient resources during dma tlb flushSebastian Ott
In a virtualized setup lazy flushing can lead to the hypervisor running out of resources when lots of guest pages need to be pinned. In this situation simply trigger a global flush to give the hypervisor a chance to free some of these resources. Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com> Reviewed-by: Gerald Schaefer <gerald.schaefer@de.ibm.com> Reviewed-by: Pierre Morel <pmorel@linux.vnet.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2017-12-13powerpc/perf: Fix kfree memory allocated for nest pmusAnju T Sudhakar
imc_common_cpuhp_mem_free() is the common function for all IMC (In-memory Collection counters) domains to unregister cpuhotplug callback and free memory. Since kfree of memory allocated for nest-imc (per_nest_pmu_arr) is in the common code, all domains (core/nest/thread) can do the kfree in the failure case. This could potentially create a call trace as shown below, where core(/thread/nest) imc pmu initialization fails and in the failure path imc_common_cpuhp_mem_free() free the memory(per_nest_pmu_arr), which is allocated by successfully registered nest units. The call trace is generated in a scenario where core-imc initialization is made to fail and a cpuhotplug is performed in a p9 system. During cpuhotplug ppc_nest_imc_cpu_offline() tries to access per_nest_pmu_arr, which is already freed by core-imc. NIP [c000000000cb6a94] mutex_lock+0x34/0x90 LR [c000000000cb6a88] mutex_lock+0x28/0x90 Call Trace: mutex_lock+0x28/0x90 (unreliable) perf_pmu_migrate_context+0x90/0x3a0 ppc_nest_imc_cpu_offline+0x190/0x1f0 cpuhp_invoke_callback+0x160/0x820 cpuhp_thread_fun+0x1bc/0x270 smpboot_thread_fn+0x250/0x290 kthread+0x1a8/0x1b0 ret_from_kernel_thread+0x5c/0x74 To address this scenario do the kfree(per_nest_pmu_arr) only in case of nest-imc initialization failure, and when there is no other nest units registered. Fixes: 73ce9aec65b1 ("powerpc/perf: Fix IMC_MAX_PMU macro") Signed-off-by: Anju T Sudhakar <anju@linux.vnet.ibm.com> Reviewed-by: Madhavan Srinivasan <maddy@linux.vnet.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2017-12-13powerpc/perf/imc: Fix nest-imc cpuhotplug callback failureAnju T Sudhakar
Oops is observed during boot: Faulting instruction address: 0xc000000000248340 cpu 0x0: Vector: 380 (Data Access Out of Range) at [c000000ff66fb850] pc: c000000000248340: event_function_call+0x50/0x1f0 lr: c00000000024878c: perf_remove_from_context+0x3c/0x100 sp: c000000ff66fbad0 msr: 9000000000009033 dar: 7d20e2a6f92d03c0 pid = 14, comm = cpuhp/0 While registering the cpuhotplug callbacks for nest-imc, if we fail in the cpuhotplug online path for any random node in a multi node system (because the opal call to stop nest-imc counters fails for that node), ppc_nest_imc_cpu_offline() will get invoked for other nodes who successfully returned from cpuhotplug online path. This call trace is generated since in the ppc_nest_imc_cpu_offline() path we are trying to migrate the event context, when nest-imc counters are not even initialized. Patch to add a check to ensure that nest-imc is registered before migrating the event context. Fixes: 885dcd709ba9 ("powerpc/perf: Add nest IMC PMU support") Signed-off-by: Anju T Sudhakar <anju@linux.vnet.ibm.com> Reviewed-by: Madhavan Srinivasan <maddy@linux.vnet.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2017-12-13powerpc/perf: Dereference BHRB entries safelyRavi Bangoria
It's theoretically possible that branch instructions recorded in BHRB (Branch History Rolling Buffer) entries have already been unmapped before they are processed by the kernel. Hence, trying to dereference such memory location will result in a crash. eg: Unable to handle kernel paging request for data at address 0xd000000019c41764 Faulting instruction address: 0xc000000000084a14 NIP [c000000000084a14] branch_target+0x4/0x70 LR [c0000000000eb828] record_and_restart+0x568/0x5c0 Call Trace: [c0000000000eb3b4] record_and_restart+0xf4/0x5c0 (unreliable) [c0000000000ec378] perf_event_interrupt+0x298/0x460 [c000000000027964] performance_monitor_exception+0x54/0x70 [c000000000009ba4] performance_monitor_common+0x114/0x120 Fix it by deferefencing the addresses safely. Fixes: 691231846ceb ("powerpc/perf: Fix setting of "to" addresses for BHRB") Cc: stable@vger.kernel.org # v3.10+ Suggested-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com> Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com> Reviewed-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com> [mpe: Use probe_kernel_read() which is clearer, tweak change log] Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2017-12-13USB: chipidea: msm: fix ulpi-node lookupJohan Hovold
Fix child-node lookup during probe, which ended up searching the whole device tree depth-first starting at the parent rather than just matching on its children. Note that the original premature free of the parent node has already been fixed separately, but that fix was apparently never backported to stable. Fixes: 47654a162081 ("usb: chipidea: msm: Restore wrapper settings after reset") Fixes: b74c43156c0c ("usb: chipidea: msm: ci_hdrc_msm_probe() missing of_node_get()") Cc: stable <stable@vger.kernel.org> # 4.10: b74c43156c0c Cc: Stephen Boyd <stephen.boyd@linaro.org> Cc: Frank Rowand <frank.rowand@sony.com> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2017-12-12Merge tag 'platform-drivers-x86-v4.15-3' of ↵Linus Torvalds
git://git.infradead.org/linux-platform-drivers-x86 Pull x86 platform driver fixes from Darren Hart: - Correct an error in the evdev protocol in asus-wireless which results in dropped key events in recent versions of libinput - Add a quirk for keyboard lighting for a specific Dell laptop - Silence a static analysis warning regarding unchecked return values of small kmalloc() allocations in dell-wmi * tag 'platform-drivers-x86-v4.15-3' of git://git.infradead.org/linux-platform-drivers-x86: platform/x86: dell-wmi: check for kmalloc() errors platform/x86: asus-wireless: send an EV_SYN/SYN_REPORT between state changes platform/x86: dell-laptop: Fix keyboard max lighting for Dell Latitude E6410
2017-12-12bpf: add schedule points to map alloc/freeEric Dumazet
While using large percpu maps, htab_map_alloc() can hold cpu for hundreds of ms. This patch adds cond_resched() calls to percpu alloc/free call sites, all running in process context. Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2017-12-12i2c: piix4: Fix port number check on releaseJean Delvare
The port number shift is still hard-coded to 1 while it now depends on the hardware. Thankfully 0 is always 0 no matter how you shift it, so this was a bug without consequences. Signed-off-by: Jean Delvare <jdelvare@suse.de> Fixes: 0fe16195f891 ("i2c: piix4: Fix SMBus port selection for AMD Family 17h chips") Reviewed-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
2017-12-12i2c: stm32: Fix copyrightsBenjamin Gaignard
Uniformize STMicroelectronics copyrights headers and add SPDX identifier. Signed-off-by: Benjamin Gaignard <benjamin.gaignard@st.com> Acked-by: Alexandre TORGUE <alexandre.torgue@st.com> Acked-by: Pierre-Yves MORDRET <pierre-yves.mordret@st.com> Acked-by: M'boumba Cedric Madianga <cedric.madianga@gmail.com> Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
2017-12-12Merge tag 'at24-4.15-rc3-fixes-for-wolfram' of ↵Wolfram Sang
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into i2c/for-current Sakari fixed a regression introduced during the 4.15 merge window and David submitted a fix for an issue that has existed in at24 since introducing nvmem.
2017-12-12drm/i915: Dump the engine state before declaring wedged from wait_for_engines()Chris Wilson
If wait_for_engines() fails and we resort to declaring the HW wedged, dump the engine state for debugging. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com> Reviewed-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20171211194135.27095-2-chris@chris-wilson.co.uk
2017-12-12drm/i915: Bump timeout for wait_for_engines()Chris Wilson
Extract the timeout we use in i915_gem_idle_work_handler() and reuse it for wait_for_engines() in i915_gem_wait_for_idle(). It too has the same problem in sometimes having to wait for an extended period before the HW settles, so make use of the same timeout. References: 5427f207852d ("drm/i915: Bump wait-times for the final CS interrupt before parking") Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com> Reviewed-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20171211194135.27095-1-chris@chris-wilson.co.uk