| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
In
commit 7a3f3d6667f5f9ffd1517f6b21d64bbf5312042c
Author: Daniel Vetter <[email protected]>
Date: Thu Jul 9 23:44:28 2015 +0200
drm: Check locking in drm_for_each_connector
I added locking checks to drm_for_each_connector but failed that
through drm_helper_connector_dpms -> drm_helper_choose_encoder_dpms
it's used in a few more places in the amdgpu resume/suspend code.
Fix them up.
Note that we could use the connector iterator macros in there too, but
that's for the future.
Port of radeon commit:
drm/radeon: Sprinkle drm_modeset_lock_all to appease locking checks
Signed-off-by: Alex Deucher <[email protected]>
|
|
In
commit 7a3f3d6667f5f9ffd1517f6b21d64bbf5312042c
Author: Daniel Vetter <[email protected]>
Date: Thu Jul 9 23:44:28 2015 +0200
drm: Check locking in drm_for_each_connector
I added locking checks to drm_for_each_connector but failed that
through drm_helper_connector_dpms -> drm_helper_choose_encoder_dpms
it's used in a few more places in the radeon resume/suspend code.
Fix them up.
Note that we could use the connector iterator macros in there too, but
that's for the future.
Reported-and-tested-by: Borislav Petkov <[email protected]>
Cc: Borislav Petkov <[email protected]>
Cc: Alex Deucher <[email protected]>
Signed-off-by: Daniel Vetter <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
|
|
we used to adopt wait_reg_mem to let CE wait before DE finish page
updating, but from Tonga+, CE doesn't support wait_reg_mem package so
this logic no longer works.
so here is another approach to do same thing:
Insert two of SWITCH_BUFFER at both front and end of vm_flush can
guarantee that CE not go further to process IB_const before vm_flush
done.
Insert two of SWITCH_BUFFER also works on CI, so remove legency method
to sync CE and ME
v2:
Insert double SWITCH_BUFFER at front of vm flush as well.
Signed-off-by: monk.liu <[email protected]>
Reviewed-by: Christian König <[email protected]>
|
|
args->size is a u64. arg->pitch and args->height are u32. The
multiplication will overflow instead of using the high 32 bits as
intended.
Reviewed-by: Christian König <[email protected]>
Signed-off-by: Dan Carpenter <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
|
|
There is no limit on args->data.data_size_bytes so we could read beyond
the end of the args->data.data[] array.
Reviewed-by: Christian König <[email protected]>
Reported-by: Ilja Van Sprundel <[email protected]>
Signed-off-by: Dan Carpenter <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
|
|
The "alloc_size" calculation can overflow leading to memory corruption.
Reviewed-by: Christian König <[email protected]>
Reported-by: Ilja Van Sprundel <[email protected]>
Signed-off-by: Dan Carpenter <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
|
|
The amdgpu_cs_parser_init() function doesn't clean up after itself but
instead the caller uses a free everything function amdgpu_cs_parser_fini()
on failure. This style of error handling is often buggy. In this
example, we call "drm_free_large(parser->chunks[i].kdata);" when it is
an unintialized pointer or when "parser->chunks" is NULL.
I fixed this bug by adding unwind code so that it frees everything that
it allocates.
I also mode some other very minor changes:
1) Renamed "r" to "ret".
2) Moved the chunk_array allocation to the start of the function.
3) Removed some initializers which are no longer needed.
Reviewed-by: Christian König <[email protected]>
Reported-by: Ilja Van Sprundel <[email protected]>
Signed-off-by: Dan Carpenter <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
|
|
The value was much too low, which could cause the userspace visible
vblank counter to move backwards when the hardware counter wrapped
around.
Ported from radeon commit:
b0b9bb4dd51f396dcf843831905f729e74b0c8c0
Reviewed-by: Christian König <[email protected]>
Reviewed-by: Jammy Zhou <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
Cc: [email protected]
|
|
The patch was generated using fixed coccinelle semantic patch
scripts/coccinelle/api/memdup.cocci [1].
[1]: http://permalink.gmane.org/gmane.linux.kernel/2014320
Signed-off-by: Andrzej Hajda <[email protected]>
Reviewed-by: Christian König <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
|
|
User space passed the same handle before suspend and after resume,
so we have remove the session and handle destroy, and keep the
firmware untouched.
Signed-off-by: Leo Liu <[email protected]>
Reviewed-by: Christian König <[email protected]>
Cc: [email protected]
|
|
Fixes suspend issues with UVD.
Signed-off-by: Leo Liu <[email protected]>
Reviewed-by: Christian König <[email protected]>
Cc: [email protected]
|
|
Invalid messages can crash the hw otherwise
Ported from radeon commit a1b403da70e038ca6c6c6fe434d1d873546873a3
Signed-off-by: Leo Liu <[email protected]>
Reviewed-by: Christian König <[email protected]>
Cc: [email protected]
|
|
This causes problems with multiple suspend/resume cycles.
Signed-off-by: Leo Liu <[email protected]>
Reviewed-by: Christian König <[email protected]>
Cc: [email protected]
|
|
Embed the scheduler into the ring structure instead of allocating it.
Use the ring name directly instead of the id.
v2: rebased, whitespace cleanup
Signed-off-by: Christian König <[email protected]>
Reviewed-by: Junwei Zhang <[email protected]>
Reviewed-by: Chunming Zhou<[email protected]>
|
|
Move the fence related stuff into amdgpu_fence.c
v2: rework commit message, cause this is actually not a bug
Signed-off-by: Christian König <[email protected]>
Reviewed-by: Chunming Zhou<[email protected]>
Reviewed-by: Junwei Zhang <[email protected]>
|
|
Just to be consistent with the other members.
v2: rename the ring member as well.
Signed-off-by: Christian König <[email protected]>
Reviewed-by: Junwei Zhang <[email protected]> (v1)
Reviewed-by: Chunming Zhou<[email protected]>
|
|
Reorder the fields and properly return the kfifo_alloc error code.
Signed-off-by: Christian König <[email protected]>
Reviewed-by: Junwei Zhang <[email protected]>
Reviewed-by: Chunming Zhou<[email protected]>
|
|
Use container_of rather than casting.
Reviewed-by: Christian König <[email protected]>
Reviewed-by: David Zhou <[email protected]>
Signed-off-by: Junwei Zhang <[email protected]>
|
|
Use consistent naming across functions.
Reviewed-by: Christian König <[email protected]>
Reviewed-by: David Zhou <[email protected]>
Signed-off-by: Junwei Zhang <[email protected]>
|
|
Reduces the locking and fencing overhead.
v2: add comment why we need the duplicates list in the GEM op.
Signed-off-by: Christian König <[email protected]>
Reviewed-by: Alex Deucher <[email protected]>
Reviewed-by: Jammy Zhou <[email protected]>
|
|
This allows for multiple BOs to have the same reservation object.
Signed-off-by: Christian König <[email protected]>
Reviewed-by: Jammy Zhou <[email protected]>
Reviewed-by: Alex Deucher <[email protected]>
|
|
Adds an extra argument to amdgpu_bo_create, which is only used in amdgpu_prime.c.
Port of radeon commit 831b6966a60fe72d85ae3576056b4e4e0775b112.
v2: fix up kfd.
Signed-off-by: Christian König <[email protected]>
Reviewed-by: Jammy Zhou <[email protected]>
Reviewed-by: Alex Deucher <[email protected]>
|
|
mem->start is a long, so this can overflow on 32bit systems.
Signed-off-by: Christian König <[email protected]>
Reviewed-by: Jammy Zhou <[email protected]>
Cc: [email protected]
|
|
Just free the resources immediately after submitting the job.
Signed-off-by: Christian König <[email protected]>
Reviewed-by: Chunming Zhou <[email protected]>
Reviewed-by: Junwei Zhang <[email protected]>
Reviewed-by: Jammy Zhou <[email protected]>
|
|
And call the processed callback directly after submitting the job.
v2: split adding error handling into separate patch.
Signed-off-by: Christian König <[email protected]>
Reviewed-by: Chunming Zhou <[email protected]>
Reviewed-by: Junwei Zhang <[email protected]>
Reviewed-by: Jammy Zhou <[email protected]>
|
|
Otherwise the resource blocked by it will never be reclaimed.
v2: add DRM_ERROR.
v3: fix typo in commit message
Signed-off-by: Christian König <[email protected]>
Reviewed-by: Junwei Zhang <[email protected]>
Reviewed-by: Chunming Zhou<[email protected]>
Reviewed-by: Jammy Zhou <[email protected]>
|
|
track sched job status like the length of job queue and hw job queue.
v2: fix build after rebase
Signed-off-by: Chunming Zhou <[email protected]>
Reviewed-by: Jammy Zhou <[email protected]>
Reviewed-by: Christian König <[email protected]>
|
|
Make sure the CP waits for the write to be confirmed before
invalidating.
Signed-off-by: Christian König <[email protected]>
Reviewed-by: Alex Deucher <[email protected]>
|
|
Insert wait for reg mem after EOP to fix potential issue with vm context switch
v2: move wait to vm_flush() use equal instead of greater than.
Signed-off-by: Anatoli Antonovitch <[email protected]>
Signed-off-by: Christian König <[email protected]>
Reviewed-by: Alex Deucher <[email protected]>
|
|
Provide module parameter to enable/disable them. Still
enabled by default.
Signed-off-by: Christian König <[email protected]>
Reviewed-by: Alex Deucher <[email protected]>
|
|
Fix potential null-pointer dereference at probe by making sure that the
required endpoints are present.
The whiteheat driver assumes there are at least five pairs of bulk
endpoints, of which the final pair is used for the "command port". An
attempt to bind to an interface with fewer bulk endpoints would
currently lead to an oops.
Fixes CVE-2015-5257.
Reported-by: Moein Ghasemzadeh <[email protected]>
Cc: stable <[email protected]>
Signed-off-by: Johan Hovold <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
asoc-linus
|
|
'asoc/fix/pxa', 'asoc/fix/spear', 'asoc/fix/sti' and 'asoc/fix/wm0010' into asoc-linus
|
|
'asoc/fix/fsl-card', 'asoc/fix/fsl-ssi', 'asoc/fix/intel' and 'asoc/fix/maintainers' into asoc-linus
|
|
|
|
|
|
Signed-off-by: Oder Chiou <[email protected]>
Signed-off-by: Mark Brown <[email protected]>
|
|
Signed-off-by: Oder Chiou <[email protected]>
Signed-off-by: Mark Brown <[email protected]>
|
|
sound in runtime of power up
Signed-off-by: Oder Chiou <[email protected]>
Signed-off-by: Mark Brown <[email protected]>
|
|
This patch adds stubs for the SCM functions exposed in the QCOM SCM API.
Signed-off-by: Andy Gross <[email protected]>
Acked-by: Russell King <[email protected]>
Acked-by: Bjorn Andersson <[email protected]>
|
|
The VBT MIPI Sequence Block version 3 has forward incompatible changes:
First, the block size in the header has been specified reserved, and the
actual size is a separate 32-bit value within the block. The current
find_section() function to will only look at the size in the block
header, and, depending on what's in that now reserved size field,
continue looking for other sections in the wrong place.
Fix this by taking the new block size field into account. This will
ensure that the lookups for other sections will work properly, as long
as the new 32-bit size does not go beyond the opregion VBT mailbox size.
Second, the contents of the block have been completely
changed. Gracefully refuse parsing the yet unknown data version.
Cc: Deepak M <[email protected]>
Cc: [email protected]
Reviewed-by: Deepak M <[email protected]>
Signed-off-by: Jani Nikula <[email protected]>
|
|
If we send a layoutreturn asynchronously before close, the close
might reach server first and layoutreturn would fail with BADSTATEID
because there is nothing keeping the layout stateid alive.
Also do not pretend sending layoutreturn if we are not.
Signed-off-by: Peng Tao <[email protected]>
Signed-off-by: Trond Myklebust <[email protected]>
|
|
Presently a lockdep warning is reported during creation of afu_err_buff
bin_attribute for the afu. This is caused due to the variable attr.key
not pointing to a static class key, hence the function lockdep_init_map
reports this warning:
BUG: key <some-address> not in .data!
The patch fixes this issue by calling sysfs_attr_init on the
attr_eb.attr structure before populating it with the afu_err_buff file
details. This will populate the attr.key variable with a static class
key so that lockdep_init_map stops complaining about the lockdep key not
being static.
Reported-by: Daniel Axtens <[email protected]>
Signed-off-by: Vaibhav Jain <[email protected]>
Acked-by: Ian Munsie <[email protected]>
Reviewed-by: Daniel Axtens <[email protected]>
Signed-off-by: Michael Ellerman <[email protected]>
|
|
This fixes the warnings like
"plane A assertion failure, should be disabled but not"
that on the initial modeset during boot. This can happen if
the primary plane is enabled by the firmware, but inheriting
it fails because the DMAR is active or for other reasons.
Most likely caused by
commit 36750f284b3a4f19b304fda1bb7d6e9e1275ea8d
Author: Maarten Lankhorst <[email protected]>
Date: Mon Jun 1 12:49:54 2015 +0200
drm/i915: update plane state during init
Reported-by: Andreas Reis <[email protected]>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91429
Reported-and-tested-by: Emil Renner Berthing <[email protected]>
Tested-by: Andreas Reis <[email protected]>
Reviewed-by: Daniel Vetter <[email protected]>
Signed-off-by: Jani Nikula <[email protected]>
|
|
On HSW at least (still testing other platforms, but should be harmless
elsewhere), the DSL reg reads back as 0 when read around vblank start
time. This ends up confusing the atomic start/end checking code, since
it causes the update to appear as if it crossed a frame count boundary.
Avoid the problem by making sure we don't return scanline_offset from
the get_crtc_scanline function. In moving the code there, I add to add
an additional delay since it could be called and have a legitimate 0
result for some time (depending on the pixel clock).
v2: move hsw dsl read hack to get_crtc_scanline (Ville)
v3: use break instead of goto (Ville)
update comment with workaround details (Ville)
References: https://bugs.freedesktop.org/show_bug.cgi?id=91579
Signed-off-by: Jesse Barnes <[email protected]>
Reviewed-by: Ville Syrjälä <[email protected]>
Signed-off-by: Jani Nikula <[email protected]>
|
|
The Marvell Egress rx trailer check must be fixed to
correctly detect bad bits in the third byte of the
Eggress trailer as described in the Table 28 of the
88E6060 datasheet.
The current code incorrectly omits to check the third
byte and checks the fourth byte twice.
Signed-off-by: Neil Armstrong <[email protected]>
Acked-by: Guenter Roeck <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
rhashtable_rehash_one() uses complex logic to update entry->next field,
after INIT_RHT_NULLS_HEAD and NULLS_MARKER expansion:
entry->next = 1 | ((base + off) << 1)
This can be compiled along the lines of:
entry->next = base + off
entry->next <<= 1
entry->next |= 1
Which will break concurrent readers.
NULLS value recomputation is not needed here, so just remove
the complex logic.
The data race was found with KernelThreadSanitizer (KTSAN).
Signed-off-by: Dmitry Vyukov <[email protected]>
Acked-by: Eric Dumazet <[email protected]>
Acked-by: Thomas Graf <[email protected]>
Acked-by: Herbert Xu <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
Converts the ch9200 driver to use the module_usb_driver() macro which
makes the code smaller and a bit simpler.
Signed-off-by: Tobias Klauser <[email protected]>
Acked-by: Matthew Garrett <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
When support for megaflows was introduced, OVS needed to start
installing flows with a mask applied to them. Since masking is an
expensive operation, OVS also had an optimization that would only
take the parts of the flow keys that were covered by a non-zero
mask. The values stored in the remaining pieces should not matter
because they are masked out.
While this works fine for the purposes of matching (which must always
look at the mask), serialization to netlink can be problematic. Since
the flow and the mask are serialized separately, the uninitialized
portions of the flow can be encoded with whatever values happen to be
present.
In terms of functionality, this has little effect since these fields
will be masked out by definition. However, it leaks kernel memory to
userspace, which is a potential security vulnerability. It is also
possible that other code paths could look at the masked key and get
uninitialized data, although this does not currently appear to be an
issue in practice.
This removes the mask optimization for flows that are being installed.
This was always intended to be the case as the mask optimizations were
really targetting per-packet flow operations.
Fixes: 03f0d916 ("openvswitch: Mega flow implementation")
Signed-off-by: Jesse Gross <[email protected]>
Acked-by: Pravin B Shelar <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
Commit 54d792f257c6 ("net: dsa: Centralise global and port setup
code into mv88e6xxx.") merged in the 4.2 merge window broke the link
speed forcing for the CPU port of Marvell DSA switches. The original
code was:
/* MAC Forcing register: don't force link, speed, duplex
* or flow control state to any particular values on physical
* ports, but force the CPU port and all DSA ports to 1000 Mb/s
* full duplex.
*/
if (dsa_is_cpu_port(ds, p) || ds->dsa_port_mask & (1 << p))
REG_WRITE(addr, 0x01, 0x003e);
else
REG_WRITE(addr, 0x01, 0x0003);
but the new code does a read-modify-write:
reg = _mv88e6xxx_reg_read(ds, REG_PORT(port), PORT_PCS_CTRL);
if (dsa_is_cpu_port(ds, port) ||
ds->dsa_port_mask & (1 << port)) {
reg |= PORT_PCS_CTRL_FORCE_LINK |
PORT_PCS_CTRL_LINK_UP |
PORT_PCS_CTRL_DUPLEX_FULL |
PORT_PCS_CTRL_FORCE_DUPLEX;
if (mv88e6xxx_6065_family(ds))
reg |= PORT_PCS_CTRL_100;
else
reg |= PORT_PCS_CTRL_1000;
The link speed in the PCS control register is a two bit field. Forcing
the link speed in this way doesn't ensure that the bit field is set to
the correct value - on the hardware I have here, the speed bitfield
remains set to 0x03, resulting in the speed not being forced to gigabit.
We must clear both bits before forcing the link speed.
Fixes: 54d792f257c6 ("net: dsa: Centralise global and port setup code into mv88e6xxx.")
Signed-off-by: Russell King <[email protected]>
Acked-by: Andrew Lunn <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|