1. 11 Jul, 2017 1 commit
  2. 10 Jul, 2017 3 commits
  3. 07 Jul, 2017 5 commits
  4. 06 Jul, 2017 16 commits
  5. 05 Jul, 2017 1 commit
  6. 04 Jul, 2017 8 commits
  7. 03 Jul, 2017 5 commits
    • John Brooks's avatar
      drm/amdgpu: Don't call amd_powerplay_destroy() if we don't have powerplay · 7bc7b777
      John Brooks authored
      amd_powerplay_destroy() expects a handle pointing to a struct pp_instance.
      On chips without PowerPlay, pp_handle points to a struct amdgpu_device. The
      resulting attempt to kfree() fields of the wrong struct ends in fire:
      
      [   91.560405] BUG: unable to handle kernel paging request at ffffebe000000620
      [   91.560414] IP: kfree+0x57/0x160
      [   91.560416] PGD 0
      [   91.560416] P4D 0
      
      [   91.560420] Oops: 0000 [#1] SMP
      [   91.560422] Modules linked in: tun x86_pkg_temp_thermal crc32_pclmul ghash_clmulni_intel efivarfs amdgpu(-) i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm drm
      [   91.560438] CPU: 6 PID: 3598 Comm: rmmod Not tainted 4.12.0-rc5-drm-next-4.13-ttmpatch+ #1
      [   91.560443] Hardware name: Gigabyte Technology Co., Ltd. Z97X-UD3H-BK/Z97X-UD3H-BK-CF, BIOS F6 06/17/2014
      [   91.560448] task: ffff8805063d6a00 task.stack: ffffc90003400000
      [   91.560451] RIP: 0010:kfree+0x57/0x160
      [   91.560454] RSP: 0018:ffffc90003403cc0 EFLAGS: 00010286
      [   91.560457] RAX: 000077ff80000000 RBX: 00000000000186a0 RCX: 0000000180400035
      [   91.560460] RDX: 0000000180400036 RSI: ffffea001418e740 RDI: ffffea0000000000
      [   91.560463] RBP: ffffc90003403cd8 R08: 000000000639d201 R09: 0000000180400035
      [   91.560467] R10: ffffebe000000600 R11: 0000000000000300 R12: ffff880500530030
      [   91.560470] R13: ffffffffa01e70fc R14: 00000000ffffffff R15: ffff880500530000
      [   91.560473] FS:  00007f7e500c3700(0000) GS:ffff88051ed80000(0000) knlGS:0000000000000000
      [   91.560478] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [   91.560480] CR2: ffffebe000000620 CR3: 0000000503103000 CR4: 00000000001406e0
      [   91.560483] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      [   91.560487] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      [   91.560489] Call Trace:
      [   91.560530]  amd_powerplay_destroy+0x1c/0x60 [amdgpu]
      [   91.560558]  amdgpu_pp_late_fini+0x44/0x60 [amdgpu]
      [   91.560575]  amdgpu_fini+0x254/0x490 [amdgpu]
      [   91.560593]  amdgpu_device_fini+0x58/0x1b0 [amdgpu]
      [   91.560610]  amdgpu_driver_unload_kms+0x4f/0xa0 [amdgpu]
      [   91.560622]  drm_dev_unregister+0x3c/0xe0 [drm]
      [   91.560638]  amdgpu_pci_remove+0x19/0x30 [amdgpu]
      [   91.560643]  pci_device_remove+0x39/0xc0
      [   91.560648]  device_release_driver_internal+0x155/0x210
      [   91.560651]  driver_detach+0x38/0x70
      [   91.560655]  bus_remove_driver+0x4c/0xa0
      [   91.560658]  driver_unregister+0x2c/0x40
      [   91.560662]  pci_unregister_driver+0x21/0x90
      [   91.560689]  amdgpu_exit+0x15/0x406 [amdgpu]
      [   91.560694]  SyS_delete_module+0x1a8/0x270
      [   91.560698]  ? exit_to_usermode_loop+0x92/0xa0
      [   91.560702]  entry_SYSCALL_64_fastpath+0x13/0x94
      [   91.560705] RIP: 0033:0x7f7e4fc118e7
      [   91.560708] RSP: 002b:00007fff978ca118 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
      [   91.560713] RAX: ffffffffffffffda RBX: 000055afe21bc200 RCX: 00007f7e4fc118e7
      [   91.560716] RDX: 000000000000000a RSI: 0000000000000800 RDI: 000055afe21bc268
      [   91.560719] RBP: 0000000000000003 R08: 0000000000000000 R09: 1999999999999999
      [   91.560722] R10: 0000000000000883 R11: 0000000000000206 R12: 00007fff978c9100
      [   91.560725] R13: 0000000000000000 R14: 0000000000000000 R15: 000055afe21bc200
      [   91.560728] Code: 00 00 00 80 ff 77 00 00 48 bf 00 00 00 00 00 ea ff ff 49 01 da 48 0f 42 05 57 33 bd 00 49 01 c2 49 c1 ea 0c 49 c1 e2 06 49 01 fa <49> 8b 42 20 48 8d 78 ff a8 01 4c 0f 45 d7 49 8b 52 20 48 8d 42
      [   91.560759] RIP: kfree+0x57/0x160 RSP: ffffc90003403cc0
      [   91.560761] CR2: ffffebe000000620
      [   91.560765] ---[ end trace 08a9f3cd82223c1d ]---
      
      Fixes: 1c863802 (drm/amd/powerplay: refine powerplay interface.)
      Signed-off-by: default avatarJohn Brooks <john@fastquake.com>
      Acked-by: default avatarChristian König <christian.koenig@amd.com>
      Reviewed-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Cc: stable@vger.kernel.org
      7bc7b777
    • John Brooks's avatar
      drm/ttm: Fix use-after-free in ttm_bo_clean_mm · 8046e195
      John Brooks authored
      We unref the man->move fence in ttm_bo_clean_mm() and then call
      ttm_bo_force_list_clean() which waits on it, except the refcount is now
      zero so a warning is generated (or worse):
      
      [149492.279301] refcount_t: increment on 0; use-after-free.
      [149492.279309] ------------[ cut here ]------------
      [149492.279315] WARNING: CPU: 3 PID: 18726 at lib/refcount.c:150 refcount_inc+0x2b/0x30
      [149492.279315] Modules linked in: vhost_net vhost tun x86_pkg_temp_thermal crc32_pclmul ghash_clmulni_intel efivarfs amdgpu(
      -) i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm drm
      [149492.279326] CPU: 3 PID: 18726 Comm: rmmod Not tainted 4.12.0-rc5-drm-next-4.13-ttmpatch+ #1
      [149492.279326] Hardware name: Gigabyte Technology Co., Ltd. Z97X-UD3H-BK/Z97X-UD3H-BK-CF, BIOS F6 06/17/2014
      [149492.279327] task: ffff8804ddfedcc0 task.stack: ffffc90008d20000
      [149492.279329] RIP: 0010:refcount_inc+0x2b/0x30
      [149492.279330] RSP: 0018:ffffc90008d23c30 EFLAGS: 00010286
      [149492.279331] RAX: 000000000000002b RBX: 0000000000000170 RCX: 0000000000000000
      [149492.279331] RDX: 0000000000000000 RSI: ffff88051ecccbe8 RDI: ffff88051ecccbe8
      [149492.279332] RBP: ffffc90008d23c30 R08: 0000000000000001 R09: 00000000000003ee
      [149492.279333] R10: ffffc90008d23bb0 R11: 00000000000003ee R12: ffff88043aaac960
      [149492.279333] R13: ffff8805005e28a8 R14: 0000000000000002 R15: ffff88050115e178
      [149492.279334] FS:  00007fc540168700(0000) GS:ffff88051ecc0000(0000) knlGS:0000000000000000
      [149492.279335] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [149492.279336] CR2: 00007fc3e8654140 CR3: 000000027ba77000 CR4: 00000000001426e0
      [149492.279337] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      [149492.279337] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      [149492.279338] Call Trace:
      [149492.279345]  ttm_bo_force_list_clean+0xb9/0x110 [ttm]
      [149492.279348]  ttm_bo_clean_mm+0x7a/0xe0 [ttm]
      [149492.279375]  amdgpu_ttm_fini+0xc9/0x1f0 [amdgpu]
      [149492.279392]  amdgpu_bo_fini+0x12/0x40 [amdgpu]
      [149492.279415]  gmc_v7_0_sw_fini+0x32/0x40 [amdgpu]
      [149492.279430]  amdgpu_fini+0x2c9/0x490 [amdgpu]
      [149492.279445]  amdgpu_device_fini+0x58/0x1b0 [amdgpu]
      [149492.279461]  amdgpu_driver_unload_kms+0x4f/0xa0 [amdgpu]
      [149492.279470]  drm_dev_unregister+0x3c/0xe0 [drm]
      [149492.279485]  amdgpu_pci_remove+0x19/0x30 [amdgpu]
      [149492.279487]  pci_device_remove+0x39/0xc0
      [149492.279490]  device_release_driver_internal+0x155/0x210
      [149492.279491]  driver_detach+0x38/0x70
      [149492.279493]  bus_remove_driver+0x4c/0xa0
      [149492.279494]  driver_unregister+0x2c/0x40
      [149492.279496]  pci_unregister_driver+0x21/0x90
      [149492.279520]  amdgpu_exit+0x15/0x406 [amdgpu]
      [149492.279523]  SyS_delete_module+0x1a8/0x270
      [149492.279525]  ? exit_to_usermode_loop+0x92/0xa0
      [149492.279528]  entry_SYSCALL_64_fastpath+0x13/0x94
      [149492.279529] RIP: 0033:0x7fc53fcb68e7
      [149492.279529] RSP: 002b:00007ffcfbfaabb8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
      [149492.279531] RAX: ffffffffffffffda RBX: 0000563117adb200 RCX: 00007fc53fcb68e7
      [149492.279531] RDX: 000000000000000a RSI: 0000000000000800 RDI: 0000563117adb268
      [149492.279532] RBP: 0000000000000003 R08: 0000000000000000 R09: 1999999999999999
      [149492.279533] R10: 0000000000000883 R11: 0000000000000206 R12: 00007ffcfbfa9ba0
      [149492.279533] R13: 0000000000000000 R14: 0000000000000000 R15: 0000563117adb200
      [149492.279534] Code: 55 48 89 e5 e8 77 fe ff ff 84 c0 74 02 5d c3 80 3d 40 f2 a4 00 00 75 f5 48 c7 c7 20 3c ca 81 c6 05 30 f2 a4 00 01 e8 91 f0 d7 ff <0f> ff 5d c3 90 55 48 89 fe bf 01 00 00 00 48 89 e5 e8 9f fe ff
      [149492.279557] ---[ end trace 2d4e0ffcb66a1016 ]---
      
      Unref the fence *after* waiting for it.
      
      v2: Set man->move to NULL after dropping the last ref (Christian König)
      
      Fixes: aff98ba1 (drm/ttm: wait for eviction in ttm_bo_force_list_clean)
      Signed-off-by: default avatarJohn Brooks <john@fastquake.com>
      Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
      Reviewed-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Cc: stable@vger.kernel.org
      8046e195
    • Maarten Lankhorst's avatar
      drm/i915: Prevent kernel panic when reading/writing compliance debugfs files, v2. · a874b6a3
      Maarten Lankhorst authored
      When reading all debugfs files on a system with DP-MST the kernel panics
      on a null pointer dereference because intel_dp is null for a DP-MST
      connector. Detect this case and skip those connectors.
      
      Also fix the write for the DP compliance file in the same way.
      
      Changes since v1:
      - Fix i915_displayport_test_active_write too. (DK)
      Signed-off-by: default avatarMaarten Lankhorst <maarten.lankhorst@linux.intel.com>
      Cc: Dhinakaran Pandiyan <dhinakaran.pandiyan@intel.com>
      Cc: Manasi Navare <manasi.d.navare@intel.com>
      Reviewed-by: default avatarDhinakaran Pandiyan <dhinakaran.pandiyan@intel.com>
      Link: http://patchwork.freedesktop.org/patch/msgid/20170626081835.24251-1-maarten.lankhorst@linux.intel.com
      a874b6a3
    • sagar.a.kamble@intel.com's avatar
      drm/i915: Hold RPM wakelock while initializing OA buffer · 987f8c44
      sagar.a.kamble@intel.com authored
      OA buffer initialization involves access to HW registers to set
      the OA base, head and tail. Ensure device is awake while setting
      these. With this, all oa.ops are covered under RPM and forcewake
      wakelock.
      
      Cc: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
      Signed-off-by: default avatarSagar Arun Kamble <sagar.a.kamble@intel.com>
      Reviewed-by: default avatarLionel Landwerlin <lionel.g.landwerlin@intel.com>
      Signed-off-by: default avatarMaarten Lankhorst <maarten.lankhorst@linux.intel.com>
      Link: http://patchwork.freedesktop.org/patch/msgid/1498585181-23048-1-git-send-email-sagar.a.kamble@intel.com
      Fixes: d7965152 ("drm/i915: Enable i915 perf stream for Haswell OA unit")
      Cc: <stable@vger.kernel.org> # v4.11+
      987f8c44
    • Daniel Vetter's avatar
      2c4b8519
  8. 30 Jun, 2017 1 commit