1. 21 Sep, 2018 1 commit
    • Greg Kroah-Hartman's avatar
      Merge tag 'drm-fixes-2018-09-21' of git://anongit.freedesktop.org/drm/drm · a38fd7d8
      Greg Kroah-Hartman authored
      David writes:
        "drm fixes for 4.19-rc5:
      
         - core: fix debugfs for atomic, fix the check for atomic for
           non-modesetting drivers
         - amdgpu: adds a new PCI id, some kfd fixes and a sdma fix
         - i915: a bunch of GVT fixes.
         - vc4: scaling fix
         - vmwgfx: modesetting fixes and a old buffer eviction fix
         - udl: framebuffer destruction fix
         - sun4i: disable on R40 fix until next kernel
         - pl111: NULL termination on table fix"
      
      * tag 'drm-fixes-2018-09-21' of git://anongit.freedesktop.org/drm/drm: (21 commits)
        drm/amdkfd: Fix ATS capablity was not reported correctly on some APUs
        drm/amdkfd: Change the control stack MTYPE from UC to NC on GFX9
        drm/amdgpu: Fix SDMA HQD destroy error on gfx_v7
        drm/vmwgfx: Fix buffer object eviction
        drm/vmwgfx: Don't impose STDU limits on framebuffer size
        drm/vmwgfx: limit mode size for all display unit to texture_max
        drm/vmwgfx: limit screen size to stdu_max during check_modeset
        drm/vmwgfx: don't check for old_crtc_state enable status
        drm/amdgpu: add new polaris pci id
        drm: sun4i: drop second PLL from A64 HDMI PHY
        drm: fix drm_drv_uses_atomic_modeset on non modesetting drivers.
        drm/i915/gvt: clear ggtt entries when destroy vgpu
        drm/i915/gvt: request srcu_read_lock before checking if one gfn is valid
        drm/i915/gvt: Add GEN9_CLKGATE_DIS_4 to default BXT mmio handler
        drm/i915/gvt: Init PHY related registers for BXT
        drm/atomic: Use drm_drv_uses_atomic_modeset() for debugfs creation
        drm/fb-helper: Remove set but not used variable 'connector_funcs'
        drm: udl: Destroy framebuffer only if it was initialized
        drm/sun4i: Remove R40 display pipeline compatibles
        drm/pl111: Make sure of_device_id tables are NULL terminated
        ...
      a38fd7d8
  2. 20 Sep, 2018 24 commits
    • Dave Airlie's avatar
      Merge branch 'drm-fixes-4.19' of git://people.freedesktop.org/~agd5f/linux into drm-fixes · 4fcb7f8b
      Dave Airlie authored
      A few fixes for 4.19:
      - Add a new polaris pci id
      - KFD fixes for raven and gfx7
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Alex Deucher <alexdeucher@gmail.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20180920155850.5455-1-alexander.deucher@amd.com
      4fcb7f8b
    • Dave Airlie's avatar
      Merge branch 'vmwgfx-fixes-4.19' of git://people.freedesktop.org/~thomash/linux into drm-fixes · 618cc151
      Dave Airlie authored
      A couple of modesetting fixes and a fix for a long-standing buffer-eviction
      problem cc'd stable.
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Thomas Hellstrom <thellstrom@vmware.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20180920063935.35492-1-thellstrom@vmware.com
      618cc151
    • Junxiao Bi's avatar
      ocfs2: fix ocfs2 read block panic · 234b69e3
      Junxiao Bi authored
      While reading block, it is possible that io error return due to underlying
      storage issue, in this case, BH_NeedsValidate was left in the buffer head.
      Then when reading the very block next time, if it was already linked into
      journal, that will trigger the following panic.
      
      [203748.702517] kernel BUG at fs/ocfs2/buffer_head_io.c:342!
      [203748.702533] invalid opcode: 0000 [#1] SMP
      [203748.702561] Modules linked in: ocfs2 ocfs2_dlmfs ocfs2_stack_o2cb ocfs2_dlm ocfs2_nodemanager ocfs2_stackglue configfs sunrpc dm_switch dm_queue_length dm_multipath bonding be2iscsi iscsi_boot_sysfs bnx2i cnic uio cxgb4i iw_cxgb4 cxgb4 cxgb3i libcxgbi iw_cxgb3 cxgb3 mdio ib_iser rdma_cm ib_cm iw_cm ib_sa ib_mad ib_core ib_addr ipv6 iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi ipmi_devintf iTCO_wdt iTCO_vendor_support dcdbas ipmi_ssif i2c_core ipmi_si ipmi_msghandler acpi_pad pcspkr sb_edac edac_core lpc_ich mfd_core shpchp sg tg3 ptp pps_core ext4 jbd2 mbcache2 sr_mod cdrom sd_mod ahci libahci megaraid_sas wmi dm_mirror dm_region_hash dm_log dm_mod
      [203748.703024] CPU: 7 PID: 38369 Comm: touch Not tainted 4.1.12-124.18.6.el6uek.x86_64 #2
      [203748.703045] Hardware name: Dell Inc. PowerEdge R620/0PXXHP, BIOS 2.5.2 01/28/2015
      [203748.703067] task: ffff880768139c00 ti: ffff88006ff48000 task.ti: ffff88006ff48000
      [203748.703088] RIP: 0010:[<ffffffffa05e9f09>]  [<ffffffffa05e9f09>] ocfs2_read_blocks+0x669/0x7f0 [ocfs2]
      [203748.703130] RSP: 0018:ffff88006ff4b818  EFLAGS: 00010206
      [203748.703389] RAX: 0000000008620029 RBX: ffff88006ff4b910 RCX: 0000000000000000
      [203748.703885] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 00000000023079fe
      [203748.704382] RBP: ffff88006ff4b8d8 R08: 0000000000000000 R09: ffff8807578c25b0
      [203748.704877] R10: 000000000f637376 R11: 000000003030322e R12: 0000000000000000
      [203748.705373] R13: ffff88006ff4b910 R14: ffff880732fe38f0 R15: 0000000000000000
      [203748.705871] FS:  00007f401992c700(0000) GS:ffff880bfebc0000(0000) knlGS:0000000000000000
      [203748.706370] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [203748.706627] CR2: 00007f4019252440 CR3: 00000000a621e000 CR4: 0000000000060670
      [203748.707124] Stack:
      [203748.707371]  ffff88006ff4b828 ffffffffa0609f52 ffff88006ff4b838 0000000000000001
      [203748.707885]  0000000000000000 0000000000000000 ffff880bf67c3800 ffffffffa05eca00
      [203748.708399]  00000000023079ff ffffffff81c58b80 0000000000000000 0000000000000000
      [203748.708915] Call Trace:
      [203748.709175]  [<ffffffffa0609f52>] ? ocfs2_inode_cache_io_unlock+0x12/0x20 [ocfs2]
      [203748.709680]  [<ffffffffa05eca00>] ? ocfs2_empty_dir_filldir+0x80/0x80 [ocfs2]
      [203748.710185]  [<ffffffffa05ec0cb>] ocfs2_read_dir_block_direct+0x3b/0x200 [ocfs2]
      [203748.710691]  [<ffffffffa05f0fbf>] ocfs2_prepare_dx_dir_for_insert.isra.57+0x19f/0xf60 [ocfs2]
      [203748.711204]  [<ffffffffa065660f>] ? ocfs2_metadata_cache_io_unlock+0x1f/0x30 [ocfs2]
      [203748.711716]  [<ffffffffa05f4f3a>] ocfs2_prepare_dir_for_insert+0x13a/0x890 [ocfs2]
      [203748.712227]  [<ffffffffa05f442e>] ? ocfs2_check_dir_for_entry+0x8e/0x140 [ocfs2]
      [203748.712737]  [<ffffffffa061b2f2>] ocfs2_mknod+0x4b2/0x1370 [ocfs2]
      [203748.713003]  [<ffffffffa061c385>] ocfs2_create+0x65/0x170 [ocfs2]
      [203748.713263]  [<ffffffff8121714b>] vfs_create+0xdb/0x150
      [203748.713518]  [<ffffffff8121b225>] do_last+0x815/0x1210
      [203748.713772]  [<ffffffff812192e9>] ? path_init+0xb9/0x450
      [203748.714123]  [<ffffffff8121bca0>] path_openat+0x80/0x600
      [203748.714378]  [<ffffffff811bcd45>] ? handle_pte_fault+0xd15/0x1620
      [203748.714634]  [<ffffffff8121d7ba>] do_filp_open+0x3a/0xb0
      [203748.714888]  [<ffffffff8122a767>] ? __alloc_fd+0xa7/0x130
      [203748.715143]  [<ffffffff81209ffc>] do_sys_open+0x12c/0x220
      [203748.715403]  [<ffffffff81026ddb>] ? syscall_trace_enter_phase1+0x11b/0x180
      [203748.715668]  [<ffffffff816f0c9f>] ? system_call_after_swapgs+0xe9/0x190
      [203748.715928]  [<ffffffff8120a10e>] SyS_open+0x1e/0x20
      [203748.716184]  [<ffffffff816f0d5e>] system_call_fastpath+0x18/0xd7
      [203748.716440] Code: 00 00 48 8b 7b 08 48 83 c3 10 45 89 f8 44 89 e1 44 89 f2 4c 89 ee e8 07 06 11 e1 48 8b 03 48 85 c0 75 df 8b 5d c8 e9 4d fa ff ff <0f> 0b 48 8b 7d a0 e8 dc c6 06 00 48 b8 00 00 00 00 00 00 00 10
      [203748.717505] RIP  [<ffffffffa05e9f09>] ocfs2_read_blocks+0x669/0x7f0 [ocfs2]
      [203748.717775]  RSP <ffff88006ff4b818>
      
      Joesph ever reported a similar panic.
      Link: https://oss.oracle.com/pipermail/ocfs2-devel/2013-May/008931.html
      
      Link: http://lkml.kernel.org/r/20180912063207.29484-1-junxiao.bi@oracle.comSigned-off-by: default avatarJunxiao Bi <junxiao.bi@oracle.com>
      Cc: Joseph Qi <jiangqi903@gmail.com>
      Cc: Mark Fasheh <mark@fasheh.com>
      Cc: Joel Becker <jlbec@evilplan.org>
      Cc: Changwei Ge <ge.changwei@h3c.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      234b69e3
    • Roman Gushchin's avatar
      mm: slowly shrink slabs with a relatively small number of objects · 172b06c3
      Roman Gushchin authored
      9092c71b ("mm: use sc->priority for slab shrink targets") changed the
      way that the target slab pressure is calculated and made it
      priority-based:
      
          delta = freeable >> priority;
          delta *= 4;
          do_div(delta, shrinker->seeks);
      
      The problem is that on a default priority (which is 12) no pressure is
      applied at all, if the number of potentially reclaimable objects is less
      than 4096 (1<<12).
      
      This causes the last objects on slab caches of no longer used cgroups to
      (almost) never get reclaimed.  It's obviously a waste of memory.
      
      It can be especially painful, if these stale objects are holding a
      reference to a dying cgroup.  Slab LRU lists are reparented on memcg
      offlining, but corresponding objects are still holding a reference to the
      dying cgroup.  If we don't scan these objects, the dying cgroup can't go
      away.  Most likely, the parent cgroup hasn't any directly charged objects,
      only remaining objects from dying children cgroups.  So it can easily hold
      a reference to hundreds of dying cgroups.
      
      If there are no big spikes in memory pressure, and new memory cgroups are
      created and destroyed periodically, this causes the number of dying
      cgroups grow steadily, causing a slow-ish and hard-to-detect memory
      "leak".  It's not a real leak, as the memory can be eventually reclaimed,
      but it could not happen in a real life at all.  I've seen hosts with a
      steadily climbing number of dying cgroups, which doesn't show any signs of
      a decline in months, despite the host is loaded with a production
      workload.
      
      It is an obvious waste of memory, and to prevent it, let's apply a minimal
      pressure even on small shrinker lists.  E.g.  if there are freeable
      objects, let's scan at least min(freeable, scan_batch) objects.
      
      This fix significantly improves a chance of a dying cgroup to be
      reclaimed, and together with some previous patches stops the steady growth
      of the dying cgroups number on some of our hosts.
      
      Link: http://lkml.kernel.org/r/20180905230759.12236-1-guro@fb.com
      Fixes: 9092c71b ("mm: use sc->priority for slab shrink targets")
      Signed-off-by: default avatarRoman Gushchin <guro@fb.com>
      Acked-by: default avatarRik van Riel <riel@surriel.com>
      Cc: Josef Bacik <jbacik@fb.com>
      Cc: Johannes Weiner <hannes@cmpxchg.org>
      Cc: Shakeel Butt <shakeelb@google.com>
      Cc: Michal Hocko <mhocko@kernel.org>
      Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      172b06c3
    • YueHaibing's avatar
    • Joel Fernandes (Google)'s avatar
      mm: shmem.c: Correctly annotate new inodes for lockdep · b45d71fb
      Joel Fernandes (Google) authored
      Directories and inodes don't necessarily need to be in the same lockdep
      class.  For ex, hugetlbfs splits them out too to prevent false positives
      in lockdep.  Annotate correctly after new inode creation.  If its a
      directory inode, it will be put into a different class.
      
      This should fix a lockdep splat reported by syzbot:
      
      > ======================================================
      > WARNING: possible circular locking dependency detected
      > 4.18.0-rc8-next-20180810+ #36 Not tainted
      > ------------------------------------------------------
      > syz-executor900/4483 is trying to acquire lock:
      > 00000000d2bfc8fe (&sb->s_type->i_mutex_key#9){++++}, at: inode_lock
      > include/linux/fs.h:765 [inline]
      > 00000000d2bfc8fe (&sb->s_type->i_mutex_key#9){++++}, at:
      > shmem_fallocate+0x18b/0x12e0 mm/shmem.c:2602
      >
      > but task is already holding lock:
      > 0000000025208078 (ashmem_mutex){+.+.}, at: ashmem_shrink_scan+0xb4/0x630
      > drivers/staging/android/ashmem.c:448
      >
      > which lock already depends on the new lock.
      >
      > -> #2 (ashmem_mutex){+.+.}:
      >        __mutex_lock_common kernel/locking/mutex.c:925 [inline]
      >        __mutex_lock+0x171/0x1700 kernel/locking/mutex.c:1073
      >        mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1088
      >        ashmem_mmap+0x55/0x520 drivers/staging/android/ashmem.c:361
      >        call_mmap include/linux/fs.h:1844 [inline]
      >        mmap_region+0xf27/0x1c50 mm/mmap.c:1762
      >        do_mmap+0xa10/0x1220 mm/mmap.c:1535
      >        do_mmap_pgoff include/linux/mm.h:2298 [inline]
      >        vm_mmap_pgoff+0x213/0x2c0 mm/util.c:357
      >        ksys_mmap_pgoff+0x4da/0x660 mm/mmap.c:1585
      >        __do_sys_mmap arch/x86/kernel/sys_x86_64.c:100 [inline]
      >        __se_sys_mmap arch/x86/kernel/sys_x86_64.c:91 [inline]
      >        __x64_sys_mmap+0xe9/0x1b0 arch/x86/kernel/sys_x86_64.c:91
      >        do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
      >        entry_SYSCALL_64_after_hwframe+0x49/0xbe
      >
      > -> #1 (&mm->mmap_sem){++++}:
      >        __might_fault+0x155/0x1e0 mm/memory.c:4568
      >        _copy_to_user+0x30/0x110 lib/usercopy.c:25
      >        copy_to_user include/linux/uaccess.h:155 [inline]
      >        filldir+0x1ea/0x3a0 fs/readdir.c:196
      >        dir_emit_dot include/linux/fs.h:3464 [inline]
      >        dir_emit_dots include/linux/fs.h:3475 [inline]
      >        dcache_readdir+0x13a/0x620 fs/libfs.c:193
      >        iterate_dir+0x48b/0x5d0 fs/readdir.c:51
      >        __do_sys_getdents fs/readdir.c:231 [inline]
      >        __se_sys_getdents fs/readdir.c:212 [inline]
      >        __x64_sys_getdents+0x29f/0x510 fs/readdir.c:212
      >        do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
      >        entry_SYSCALL_64_after_hwframe+0x49/0xbe
      >
      > -> #0 (&sb->s_type->i_mutex_key#9){++++}:
      >        lock_acquire+0x1e4/0x540 kernel/locking/lockdep.c:3924
      >        down_write+0x8f/0x130 kernel/locking/rwsem.c:70
      >        inode_lock include/linux/fs.h:765 [inline]
      >        shmem_fallocate+0x18b/0x12e0 mm/shmem.c:2602
      >        ashmem_shrink_scan+0x236/0x630 drivers/staging/android/ashmem.c:455
      >        ashmem_ioctl+0x3ae/0x13a0 drivers/staging/android/ashmem.c:797
      >        vfs_ioctl fs/ioctl.c:46 [inline]
      >        file_ioctl fs/ioctl.c:501 [inline]
      >        do_vfs_ioctl+0x1de/0x1720 fs/ioctl.c:685
      >        ksys_ioctl+0xa9/0xd0 fs/ioctl.c:702
      >        __do_sys_ioctl fs/ioctl.c:709 [inline]
      >        __se_sys_ioctl fs/ioctl.c:707 [inline]
      >        __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:707
      >        do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
      >        entry_SYSCALL_64_after_hwframe+0x49/0xbe
      >
      > other info that might help us debug this:
      >
      > Chain exists of:
      >   &sb->s_type->i_mutex_key#9 --> &mm->mmap_sem --> ashmem_mutex
      >
      >  Possible unsafe locking scenario:
      >
      >        CPU0                    CPU1
      >        ----                    ----
      >   lock(ashmem_mutex);
      >                                lock(&mm->mmap_sem);
      >                                lock(ashmem_mutex);
      >   lock(&sb->s_type->i_mutex_key#9);
      >
      >  *** DEADLOCK ***
      >
      > 1 lock held by syz-executor900/4483:
      >  #0: 0000000025208078 (ashmem_mutex){+.+.}, at:
      > ashmem_shrink_scan+0xb4/0x630 drivers/staging/android/ashmem.c:448
      
      Link: http://lkml.kernel.org/r/20180821231835.166639-1-joel@joelfernandes.orgSigned-off-by: default avatarJoel Fernandes (Google) <joel@joelfernandes.org>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Reviewed-by: default avatarNeilBrown <neilb@suse.com>
      Suggested-by: default avatarNeilBrown <neilb@suse.com>
      Cc: Matthew Wilcox <willy@infradead.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Hugh Dickins <hughd@google.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      b45d71fb
    • Dominique Martinet's avatar
      fs/proc/kcore.c: fix invalid memory access in multi-page read optimization · a1b3d2f2
      Dominique Martinet authored
      The 'm' kcore_list item could point to kclist_head, and it is incorrect to
      look at m->addr / m->size in this case.
      
      There is no choice but to run through the list of entries for every
      address if we did not find any entry in the previous iteration
      
      Reset 'm' to NULL in that case at Omar Sandoval's suggestion.
      
      [akpm@linux-foundation.org: add comment]
      Link: http://lkml.kernel.org/r/1536100702-28706-1-git-send-email-asmadeus@codewreck.org
      Fixes: bf991c22 ("proc/kcore: optimize multiple page reads")
      Signed-off-by: default avatarDominique Martinet <asmadeus@codewreck.org>
      Reviewed-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Cc: Omar Sandoval <osandov@osandov.com>
      Cc: Alexey Dobriyan <adobriyan@gmail.com>
      Cc: Eric Biederman <ebiederm@xmission.com>
      Cc: James Morse <james.morse@arm.com>
      Cc: Bhupesh Sharma <bhsharma@redhat.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      a1b3d2f2
    • Pasha Tatashin's avatar
      mm: disable deferred struct page for 32-bit arches · 889c695d
      Pasha Tatashin authored
      Deferred struct page init is needed only on systems with large amount of
      physical memory to improve boot performance.  32-bit systems do not
      benefit from this feature.
      
      Jiri reported a problem where deferred struct pages do not work well with
      x86-32:
      
      [    0.035162] Dentry cache hash table entries: 131072 (order: 7, 524288 bytes)
      [    0.035725] Inode-cache hash table entries: 65536 (order: 6, 262144 bytes)
      [    0.036269] Initializing CPU#0
      [    0.036513] Initializing HighMem for node 0 (00036ffe:0007ffe0)
      [    0.038459] page:f6780000 is uninitialized and poisoned
      [    0.038460] raw: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
      [    0.039509] page dumped because: VM_BUG_ON_PAGE(1 && PageCompound(page))
      [    0.040038] ------------[ cut here ]------------
      [    0.040399] kernel BUG at include/linux/page-flags.h:293!
      [    0.040823] invalid opcode: 0000 [#1] SMP PTI
      [    0.041166] CPU: 0 PID: 0 Comm: swapper Not tainted 4.19.0-rc1_pt_jiri #9
      [    0.041694] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-20171110_100015-anatol 04/01/2014
      [    0.042496] EIP: free_highmem_page+0x64/0x80
      [    0.042839] Code: 13 46 d8 c1 e8 18 5d 83 e0 03 8d 04 c0 c1 e0 06 ff 80 ec 5f 44 d8 c3 8d b4 26 00 00 00 00 ba 08 65 28 d8 89 d8 e8 fc 71 02 00 <0f> 0b 8d 76 00 8d bc 27 00 00 00 00 ba d0 b1 26 d8 89 d8 e8 e4 71
      [    0.044338] EAX: 0000003c EBX: f6780000 ECX: 00000000 EDX: d856cbe8
      [    0.044868] ESI: 0007ffe0 EDI: d838df20 EBP: d838df00 ESP: d838defc
      [    0.045372] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 EFLAGS: 00210086
      [    0.045913] CR0: 80050033 CR2: 00000000 CR3: 18556000 CR4: 00040690
      [    0.046413] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
      [    0.046913] DR6: fffe0ff0 DR7: 00000400
      [    0.047220] Call Trace:
      [    0.047419]  add_highpages_with_active_regions+0xbd/0x10d
      [    0.047854]  set_highmem_pages_init+0x5b/0x71
      [    0.048202]  mem_init+0x2b/0x1e8
      [    0.048460]  start_kernel+0x1d2/0x425
      [    0.048757]  i386_start_kernel+0x93/0x97
      [    0.049073]  startup_32_smp+0x164/0x168
      [    0.049379] Modules linked in:
      [    0.049626] ---[ end trace 337949378db0abbb ]---
      
      We free highmem pages before their struct pages are initialized:
      
      mem_init()
       set_highmem_pages_init()
        add_highpages_with_active_regions()
         free_highmem_page()
          .. Access uninitialized struct page here..
      
      Because there is no reason to have this feature on 32-bit systems, just
      disable it.
      
      Link: http://lkml.kernel.org/r/20180831150506.31246-1-pavel.tatashin@microsoft.com
      Fixes: 2e3ca40f ("mm: relax deferred struct page requirements")
      Signed-off-by: default avatarPavel Tatashin <pavel.tatashin@microsoft.com>
      Reported-by: default avatarJiri Slaby <jslaby@suse.cz>
      Acked-by: default avatarMichal Hocko <mhocko@suse.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      889c695d
    • KJ Tsanaktsidis's avatar
      fork: report pid exhaustion correctly · f83606f5
      KJ Tsanaktsidis authored
      Make the clone and fork syscalls return EAGAIN when the limit on the
      number of pids /proc/sys/kernel/pid_max is exceeded.
      
      Currently, when the pid_max limit is exceeded, the kernel will return
      ENOSPC from the fork and clone syscalls.  This is contrary to the
      documented behaviour, which explicitly calls out the pid_max case as one
      where EAGAIN should be returned.  It also leads to really confusing error
      messages in userspace programs which will complain about a lack of disk
      space when they fail to create processes/threads for this reason.
      
      This error is being returned because alloc_pid() uses the idr api to find
      a new pid; when there are none available, idr_alloc_cyclic() returns
      -ENOSPC, and this is being propagated back to userspace.
      
      This behaviour has been broken before, and was explicitly fixed in
      commit 35f71bc0 ("fork: report pid reservation failure properly"),
      so I think -EAGAIN is definitely the right thing to return in this case.
      The current behaviour change dates from commit 95846ecf ("pid:
      replace pid bitmap implementation with IDR AIP") and was I believe
      unintentional.
      
      This patch has no impact on the case where allocating a pid fails because
      the child reaper for the namespace is dead; that case will still return
      -ENOMEM.
      
      Link: http://lkml.kernel.org/r/20180903111016.46461-1-ktsanaktsidis@zendesk.com
      Fixes: 95846ecf ("pid: replace pid bitmap implementation with IDR AIP")
      Signed-off-by: default avatarKJ Tsanaktsidis <ktsanaktsidis@zendesk.com>
      Reviewed-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Acked-by: default avatarMichal Hocko <mhocko@suse.com>
      Cc: Gargi Sharma <gs051095@gmail.com>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Oleg Nesterov <oleg@redhat.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      f83606f5
    • Yong Zhao's avatar
      drm/amdkfd: Fix ATS capablity was not reported correctly on some APUs · 44d8cc6f
      Yong Zhao authored
      Because CRAT_CU_FLAGS_IOMMU_PRESENT was not set in some BIOS crat, we
      need to workaround this.
      
      For future compatibility, we also overwrite the bit in capability according
      to the value of needs_iommu_device.
      Acked-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Signed-off-by: default avatarYong Zhao <Yong.Zhao@amd.com>
      Reviewed-by: default avatarFelix Kuehling <Felix.Kuehling@amd.com>
      Signed-off-by: default avatarFelix Kuehling <Felix.Kuehling@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      44d8cc6f
    • Yong Zhao's avatar
      drm/amdkfd: Change the control stack MTYPE from UC to NC on GFX9 · 15426dbb
      Yong Zhao authored
      CWSR fails on Raven if the control stack is MTYPE_UC, which is used
      for regular GART mappings. As a workaround we map it using MTYPE_NC.
      
      The MEC firmware expects the control stack at one page offset from the
      start of the MQD so it is part of the MQD allocation on GFXv9. AMDGPU
      added a memory allocation flag just for this purpose.
      Acked-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Signed-off-by: default avatarYong Zhao <yong.zhao@amd.com>
      Reviewed-by: default avatarFelix Kuehling <Felix.Kuehling@amd.com>
      Signed-off-by: default avatarFelix Kuehling <Felix.Kuehling@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      15426dbb
    • Amber Lin's avatar
      drm/amdgpu: Fix SDMA HQD destroy error on gfx_v7 · caaa4c8a
      Amber Lin authored
      A wrong register bit was examinated for checking SDMA status so it reports
      false failures. This typo only appears on gfx_v7. gfx_v8 checks the correct
      bit.
      Acked-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Signed-off-by: default avatarAmber Lin <Amber.Lin@amd.com>
      Reviewed-by: default avatarFelix Kuehling <Felix.Kuehling@amd.com>
      Signed-off-by: default avatarFelix Kuehling <Felix.Kuehling@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      caaa4c8a
    • Miguel Ojeda's avatar
      Compiler Attributes: naked can be shared · ae596de1
      Miguel Ojeda authored
      The naked attribute is supported by at least gcc >= 4.6 (for ARM,
      which is the only current user), gcc >= 8 (for x86), clang >= 3.1
      and icc >= 13. See https://godbolt.org/z/350Dyc
      
      Therefore, move it out of compiler-gcc.h so that the definition
      is shared by all compilers.
      
      This also fixes Clang support for ARM32 --- 815f0ddb
      ("include/linux/compiler*.h: make compiler-*.h mutually exclusive").
      
      Fixes: 815f0ddb ("include/linux/compiler*.h: make compiler-*.h mutually exclusive")
      Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
      Cc: Eli Friedman <efriedma@codeaurora.org>
      Cc: Christopher Li <sparse@chrisli.org>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Ingo Molnar <mingo@kernel.org>
      Cc: Geert Uytterhoeven <geert@linux-m68k.org>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
      Cc: Joe Perches <joe@perches.com>
      Cc: Dominique Martinet <asmadeus@codewreck.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: linux-sparse@vger.kernel.org
      Suggested-by: default avatarArnd Bergmann <arnd@arndb.de>
      Tested-by: default avatarStefan Agner <stefan@agner.ch>
      Reviewed-by: default avatarStefan Agner <stefan@agner.ch>
      Reviewed-by: default avatarLuc Van Oostenryck <luc.vanoostenryck@gmail.com>
      Reviewed-by: default avatarNick Desaulniers <ndesaulniers@google.com>
      Signed-off-by: default avatarMiguel Ojeda <miguel.ojeda.sandonis@gmail.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      ae596de1
    • Miguel Ojeda's avatar
      Compiler Attributes: naked was fixed in gcc 4.6 · d124b44f
      Miguel Ojeda authored
      Commit 9c695203 ("compiler-gcc.h: gcc-4.5 needs noclone
      and noinline on __naked functions") added noinline and noclone
      as a workaround for a gcc 4.5 bug, which was resolved in 4.6.0.
      
      Since now the minimum gcc supported version is 4.6,
      we can clean it up.
      
      See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=44290
      and https://godbolt.org/z/h6NMIL
      
      Fixes: 815f0ddb ("include/linux/compiler*.h: make compiler-*.h mutually exclusive")
      Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
      Cc: Eli Friedman <efriedma@codeaurora.org>
      Cc: Christopher Li <sparse@chrisli.org>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Ingo Molnar <mingo@kernel.org>
      Cc: Geert Uytterhoeven <geert@linux-m68k.org>
      Cc: Arnd Bergmann <arnd@arndb.de>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
      Cc: Joe Perches <joe@perches.com>
      Cc: Dominique Martinet <asmadeus@codewreck.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: linux-sparse@vger.kernel.org
      Tested-by: default avatarStefan Agner <stefan@agner.ch>
      Reviewed-by: default avatarStefan Agner <stefan@agner.ch>
      Reviewed-by: default avatarLuc Van Oostenryck <luc.vanoostenryck@gmail.com>
      Reviewed-by: default avatarNick Desaulniers <ndesaulniers@google.com>
      Signed-off-by: default avatarMiguel Ojeda <miguel.ojeda.sandonis@gmail.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      d124b44f
    • Greg Kroah-Hartman's avatar
      Merge tag 'mtd/fixes-for-4.19-rc5' of git://git.infradead.org/linux-mtd · 4b92e7fd
      Greg Kroah-Hartman authored
      Boris writes:
        "- Fixes a bug in the ->read/write_reg() implementation of the m25p80
           driver
         - Make sure of_node_get/put() calls are balanced in the partition
           parsing code
         - Fix a race in the denali NAND controller driver
         - Fix false positive WARN_ON() in the marvell NAND controller driver"
      
      * tag 'mtd/fixes-for-4.19-rc5' of git://git.infradead.org/linux-mtd:
        mtd: devices: m25p80: Make sure the buffer passed in op is DMA-able
        mtd: partitions: fix unbalanced of_node_get/put()
        mtd: rawnand: denali: fix a race condition when DMA is kicked
        mtd: rawnand: marvell: prevent harmless warnings
      4b92e7fd
    • Greg Kroah-Hartman's avatar
      Merge tag 'sound-4.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · d8292084
      Greg Kroah-Hartman authored
      Takashi writes:
        "sound fixes for 4.19-rc5
      
         here comes a collection of various fixes, mostly for stable-tree
         or regression fixes.
      
         Two relatively high LOCs are about the (rather simple) conversion of
         uapi integer types in topology API, and a regression fix about HDMI
         hotplug notification on AMD HD-audio.  The rest are all small
         individual fixes like ASoC Intel Skylake race condition, minor
         uninitialized page leak in emu10k1 ioctl, Firewire audio error paths,
         and so on."
      
      * tag 'sound-4.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (33 commits)
        ALSA: fireworks: fix memory leak of response buffer at error path
        ALSA: oxfw: fix memory leak of discovered stream formats at error path
        ALSA: oxfw: fix memory leak for model-dependent data at error path
        ALSA: bebob: fix memory leak for M-Audio FW1814 and ProjectMix I/O at error path
        ALSA: hda - Enable runtime PM only for discrete GPU
        ALSA: oxfw: fix memory leak of private data
        ALSA: firewire-tascam: fix memory leak of private data
        ALSA: firewire-digi00x: fix memory leak of private data
        sound: don't call skl_init_chip() to reset intel skl soc
        sound: enable interrupt after dma buffer initialization
        Revert "ASoC: Intel: Skylake: Acquire irq after RIRB allocation"
        ALSA: emu10k1: fix possible info leak to userspace on SNDRV_EMU10K1_IOCTL_INFO
        ASoC: cs4265: fix MMTLR Data switch control
        ASoC: AMD: Ensure reset bit is cleared before configuring
        ALSA: fireface: fix memory leak in ff400_switch_fetching_mode()
        ALSA: bebob: use address returned by kmalloc() instead of kernel stack for streaming DMA mapping
        ASoC: rsnd: don't fallback to PIO mode when -EPROBE_DEFER
        ASoC: rsnd: adg: care clock-frequency size
        ASoC: uniphier: change status to orphan
        ASoC: rsnd: fixup not to call clk_get/set under non-atomic
        ...
      d8292084
    • Thomas Hellstrom's avatar
      drm/vmwgfx: Fix buffer object eviction · e71cf591
      Thomas Hellstrom authored
      Commit 19be5570 ("drm/ttm: add operation ctx to ttm_bo_validate v2")
      introduced a regression where the vmwgfx driver refused to evict a
      buffer that was still busy instead of waiting for it to become idle.
      
      Fix this.
      
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarThomas Hellstrom <thellstrom@vmware.com>
      Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
      e71cf591
    • Deepak Rawat's avatar
      drm/vmwgfx: Don't impose STDU limits on framebuffer size · a4bd815a
      Deepak Rawat authored
      If framebuffers are larger, we create bounce surfaces that are within
      STDU limits.
      Signed-off-by: default avatarDeepak Rawat <drawat@vmware.com>
      Reviewed-by: default avatarThomas Hellstrom <thellstrom@vmware.com>
      Signed-off-by: default avatarThomas Hellstrom <thellstrom@vmware.com>
      a4bd815a
    • Deepak Rawat's avatar
      drm/vmwgfx: limit mode size for all display unit to texture_max · 140b4e67
      Deepak Rawat authored
      For all display units, limit mode size exposed to texture_max_width/
      height as this is the maximum framebuffer size that virtual device can
      create.
      Signed-off-by: default avatarDeepak Rawat <drawat@vmware.com>
      Reviewed-by: default avatarSinclair Yeh <syeh@vmware.com>
      Reviewed-by: default avatarThomas Hellstrom <thellstrom@vmware.com>
      Signed-off-by: default avatarThomas Hellstrom <thellstrom@vmware.com>
      140b4e67
    • Deepak Rawat's avatar
      drm/vmwgfx: limit screen size to stdu_max during check_modeset · 0c1b174b
      Deepak Rawat authored
      For STDU individual screen target size is limited by
      SVGA_REG_SCREENTARGET_MAX_WIDTH/HEIGHT registers so add that limit
      during atomic check_modeset.
      
      An additional limit is placed in the update_layout ioctl to avoid
      requesting layouts that current user-space typically can't support.
      Also modified the comments to reflect current limitation on topology.
      Signed-off-by: default avatarDeepak Rawat <drawat@vmware.com>
      Reviewed-by: default avatarSinclair Yeh <syeh@vmware.com>
      Reviewed-by: default avatarThomas Hellstrom <thellstrom@vmware.com>
      Signed-off-by: default avatarThomas Hellstrom <thellstrom@vmware.com>
      0c1b174b
    • Deepak Rawat's avatar
      drm/vmwgfx: don't check for old_crtc_state enable status · bfc88826
      Deepak Rawat authored
      During atomic check to prepare the new topology no need to check if
      old_crtc_state was enabled or not. This will cause atomic_check to fail
      because due to connector routing a crtc can be in atomic_state even if
      there was no change to enable status.
      
      Detected this issue with igt run.
      Signed-off-by: default avatarDeepak Rawat <drawat@vmware.com>
      Reviewed-by: default avatarSinclair Yeh <syeh@vmware.com>
      Signed-off-by: default avatarThomas Hellstrom <thellstrom@vmware.com>
      bfc88826
    • Alex Deucher's avatar
      drm/amdgpu: add new polaris pci id · 30f3984e
      Alex Deucher authored
      Add new pci id.
      Reviewed-by: default avatarRex Zhu <Rex.Zhu@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Cc: stable@vger.kernel.org
      30f3984e
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2018-09-19' of... · 8ca4fff9
      Dave Airlie authored
      Merge tag 'drm-intel-fixes-2018-09-19' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes
      
      Only fixes coming from gvt containing "Two more BXT fixes from Colin,
      one srcu locking fix and one fix for GGTT clear when destroy vGPU."
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      
      From: Rodrigo Vivi <rodrigo.vivi@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20180919151915.GA6309@intel.com
      8ca4fff9
    • Dave Airlie's avatar
      Merge tag 'drm-misc-fixes-2018-09-19' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes · d5b3a31b
      Dave Airlie authored
      drm-misc-fixes for v4.19-rc5:
      - Fix crash in vgem in drm_drv_uses_atomic_modeset.
      - Allow atomic drivers that don't set DRIVER_ATOMIC to create debugfs entries.
      - Fix compiler warning for unused connector_funcs.
      - Fix null pointer deref on UDL unplug.
      - Disable DRM support for sun4i's R40 for now.
        (Not all patches went in for v4.19, so it has to wait a cycle.)
      - NULL-terminate the of_device_id table in pl111.
      - Make sure vc4 NV12 planar format works when displaying an unscaled fb.
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      
      From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/dda393bb-f13f-8d36-711b-cacfc578e5a3@linux.intel.com
      d5b3a31b
  3. 19 Sep, 2018 6 commits
  4. 18 Sep, 2018 9 commits
    • Rodrigo Vivi's avatar
      Merge tag 'gvt-fixes-2018-09-18' of https://github.com/intel/gvt-linux into drm-intel-fixes · a530bf94
      Rodrigo Vivi authored
      gvt-fixes-2018-09-18
      
      - Fix initial DPIO PHY register state for BXT (Colin)
      - BXT untracked GEN9_CLKGATE_DIS_4 warning fix (Colin)
      - Fix srcu lock for GFN valid check (Weinan)
      - Should clear GGTT entry value after vGPU destroy (Zhipeng)
      Signed-off-by: default avatarRodrigo Vivi <rodrigo.vivi@intel.com>
      From: Zhenyu Wang <zhenyuw@linux.intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20180918073349.GQ20737@zhen-hp.sh.intel.com
      a530bf94
    • Dave Airlie's avatar
      drm: fix drm_drv_uses_atomic_modeset on non modesetting drivers. · 57078338
      Dave Airlie authored
      vgem seems to oops on the intel CI due to the vgem debugfs init
      hitting this path now.
      
      Check if we have mode_config funcs before checking one.
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Link: https://patchwork.freedesktop.org/patch/msgid/20180918062018.24942-1-airlied@gmail.com
      57078338
    • Boris Brezillon's avatar
      mtd: devices: m25p80: Make sure the buffer passed in op is DMA-able · 4a3e85f2
      Boris Brezillon authored
      As documented in spi-mem.h, spi_mem_op->data.buf.{in,out} must be
      DMA-able, and commit 4120f8d1 ("mtd: spi-nor: Use the spi_mem_xx()
      API") failed to follow this rule as buffers passed to
      ->{read,write}_reg() are usually placed on the stack.
      
      Fix that by allocating a scratch buffer and copying the data around.
      
      Fixes: 4120f8d1 ("mtd: spi-nor: Use the spi_mem_xx() API")
      Reported-by: default avatarJarkko Nikula <jarkko.nikula@linux.intel.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarBoris Brezillon <boris.brezillon@bootlin.com>
      Tested-by: default avatarJarkko Nikula <jarkko.nikula@linux.intel.com>
      Reviewed-by: default avatarJarkko Nikula <jarkko.nikula@linux.intel.com>
      4a3e85f2
    • Greg Kroah-Hartman's avatar
      Merge gitolite.kernel.org:/pub/scm/linux/kernel/git/davem/net · 5211da9c
      Greg Kroah-Hartman authored
      Dave writes:
        "Various fixes, all over the place:
      
         1) OOB data generation fix in bluetooth, from Matias Karhumaa.
      
         2) BPF BTF boundary calculation fix, from Martin KaFai Lau.
      
         3) Don't bug on excessive frags, to be compatible in situations mixing
            older and newer kernels on each end.  From Juergen Gross.
      
         4) Scheduling in RCU fix in hv_netvsc, from Stephen Hemminger.
      
         5) Zero keying information in TLS layer before freeing copies
            of them, from Sabrina Dubroca.
      
         6) Fix NULL deref in act_sample, from Davide Caratti.
      
         7) Orphan SKB before GRO in veth to prevent crashes with XDP,
            from Toshiaki Makita.
      
         8) Fix use after free in ip6_xmit, from Eric Dumazet.
      
         9) Fix VF mac address regression in bnxt_en, from Micahel Chan.
      
         10) Fix MSG_PEEK behavior in TLS layer, from Daniel Borkmann.
      
         11) Programming adjustments to r8169 which fix not being to enter deep
             sleep states on some machines, from Kai-Heng Feng and Hans de
             Goede.
      
         12) Fix DST_NOCOUNT flag handling for ipv6 routes, from Peter
             Oskolkov."
      
      * gitolite.kernel.org:/pub/scm/linux/kernel/git/davem/net: (45 commits)
        net/ipv6: do not copy dst flags on rt init
        qmi_wwan: set DTR for modems in forced USB2 mode
        clk: x86: Stop marking clocks as CLK_IS_CRITICAL
        r8169: Get and enable optional ether_clk clock
        clk: x86: add "ether_clk" alias for Bay Trail / Cherry Trail
        r8169: enable ASPM on RTL8106E
        r8169: Align ASPM/CLKREQ setting function with vendor driver
        Revert "kcm: remove any offset before parsing messages"
        kcm: remove any offset before parsing messages
        net: ethernet: Fix a unused function warning.
        net: dsa: mv88e6xxx: Fix ATU Miss Violation
        tls: fix currently broken MSG_PEEK behavior
        hv_netvsc: pair VF based on serial number
        PCI: hv: support reporting serial number as slot information
        bnxt_en: Fix VF mac address regression.
        ipv6: fix possible use-after-free in ip6_xmit()
        net: hp100: fix always-true check for link up state
        ARM: dts: at91: add new compatibility string for macb on sama5d3
        net: macb: disable scatter-gather for macb on sama5d3
        net: mvpp2: let phylink manage the carrier state
        ...
      5211da9c
    • Peter Oskolkov's avatar
      net/ipv6: do not copy dst flags on rt init · 30bfd930
      Peter Oskolkov authored
      DST_NOCOUNT in dst_entry::flags tracks whether the entry counts
      toward route cache size (net->ipv6.sysctl.ip6_rt_max_size).
      
      If the flag is NOT set, dst_ops::pcpuc_entries counter is incremented
      in dist_init() and decremented in dst_destroy().
      
      This flag is tied to allocation/deallocation of dst_entry and
      should not be copied from another dst/route. Otherwise it can happen
      that dst_ops::pcpuc_entries counter grows until no new routes can
      be allocated because the counter reached ip6_rt_max_size due to
      DST_NOCOUNT not set and thus no counter decrements on gc-ed routes.
      
      Fixes: 3b6761d1 ("net/ipv6: Move dst flags to booleans in fib entries")
      Cc: David Ahern <dsahern@gmail.com>
      Acked-by: default avatarWei Wang <weiwan@google.com>
      Signed-off-by: default avatarPeter Oskolkov <posk@google.com>
      Reviewed-by: default avatarDavid Ahern <dsahern@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      30bfd930
    • Zhipeng Gong's avatar
      drm/i915/gvt: clear ggtt entries when destroy vgpu · 7759ca3a
      Zhipeng Gong authored
      When one vgpu is destroyed, its ggtt entries are not cleared.
      This patch clears ggtt entries to avoid information leak.
      
      v2: add 'Fixes' tag (Zhenyu)
      
      Fixes: 2707e444 ("drm/i915/gvt: vGPU graphics memory virtualization")
      Signed-off-by: default avatarZhipeng Gong <zhipeng.gong@intel.com>
      Reviewed-by: default avatarHang Yuan <hang.yuan@intel.com>
      Signed-off-by: default avatarZhenyu Wang <zhenyuw@linux.intel.com>
      7759ca3a
    • Weinan Li's avatar
      drm/i915/gvt: request srcu_read_lock before checking if one gfn is valid · a1ac5f09
      Weinan Li authored
      Fix the suspicious RCU usage issue in intel_vgpu_emulate_mmio_write.
      Here need to request the srcu read lock of kvm->srcu before doing
      gfn_to_memslot(). The detailed log is as below:
      [  218.710688] =============================
      [  218.710690] WARNING: suspicious RCU usage
      [  218.710693] 4.14.15-dd+ #314 Tainted: G     U
      [  218.710695] -----------------------------
      [  218.710697] ./include/linux/kvm_host.h:575 suspicious rcu_dereference_check() usage!
      [  218.710699]
                     other info that might help us debug this:
      
      [  218.710702]
                     rcu_scheduler_active = 2, debug_locks = 1
      [  218.710704] 1 lock held by qemu-system-x86/2144:
      [  218.710706]  #0:  (&gvt->lock){+.+.}, at: [<ffffffff816a1eea>] intel_vgpu_emulate_mmio_write+0x5a/0x2d0
      [  218.710721]
                     stack backtrace:
      [  218.710724] CPU: 0 PID: 2144 Comm: qemu-system-x86 Tainted: G     U 4.14.15-dd+ #314
      [  218.710727] Hardware name: Dell Inc. OptiPlex 7040/0Y7WYT, BIOS 1.1.1 10/07/2015
      [  218.710729] Call Trace:
      [  218.710734]  dump_stack+0x7c/0xb3
      [  218.710739]  gfn_to_memslot+0x15f/0x170
      [  218.710743]  kvm_is_visible_gfn+0xa/0x30
      [  218.710746]  intel_vgpu_emulate_gtt_mmio_write+0x267/0x3c0
      [  218.710751]  ? __mutex_unlock_slowpath+0x3b/0x260
      [  218.710754]  intel_vgpu_emulate_mmio_write+0x182/0x2d0
      [  218.710759]  intel_vgpu_rw+0xba/0x170 [kvmgt]
      [  218.710763]  intel_vgpu_write+0x14d/0x1a0 [kvmgt]
      [  218.710767]  __vfs_write+0x23/0x130
      [  218.710770]  vfs_write+0xb0/0x1b0
      [  218.710774]  SyS_pwrite64+0x73/0x90
      [  218.710777]  entry_SYSCALL_64_fastpath+0x25/0x9c
      [  218.710780] RIP: 0033:0x7f33e8a91da3
      [  218.710783] RSP: 002b:00007f33dddc8700 EFLAGS: 00000293
      
      v2: add 'Fixes' tag, refine log format.(Zhenyu)
      Fixes: cc753fbe ("drm/i915/gvt: validate gfn before set shadow page")
      Reviewed-by: default avatarZhenyu Wang <zhenyuw@linux.intel.com>
      Signed-off-by: default avatarWeinan Li <weinan.z.li@intel.com>
      Signed-off-by: default avatarZhenyu Wang <zhenyuw@linux.intel.com>
      a1ac5f09
    • Colin Xu's avatar
      drm/i915/gvt: Add GEN9_CLKGATE_DIS_4 to default BXT mmio handler · d817de3b
      Colin Xu authored
      Host prints lots of untracked MMIO at 0x4653c when creating linux guest.
      "gvt: vgpu 2: untracked MMIO 0004653c len 4"
      
      GEN9_CLKGATE_DIS_4 (0x4653c) is accessed by i915 for gmbus clockgating.
      However vgpu doesn't support any clockgating powergating operations
      on related mmio access trap so need add it to default handler.
      GEN9_CLKGATE_DIS_4 is accessed in bxt_gmbus_clock_gating() which only
      applies to GEN9_LP so doens't show the warning on other platforms.
      
      The solution is to add it to default handler init_bxt_mmio_info().
      Reviewed-by: default avatarHe, Min <min.he@intel.com>
      Signed-off-by: default avatarColin Xu <colin.xu@intel.com>
      Signed-off-by: default avatarZhenyu Wang <zhenyuw@linux.intel.com>
      d817de3b
    • Colin Xu's avatar
      drm/i915/gvt: Init PHY related registers for BXT · db7c8f1e
      Colin Xu authored
      Recent patch fixed the call trace
      "ERROR Port B enabled but PHY powered down? (PHY_CTL 00000000)".
      but introduced another similar call trace shown as:
      "ERROR Port C enabled but PHY powered down? (PHY_CTL 00000200)".
      The call trace will appear when host and guest enabled different ports,
      i.e. host using PORT C or neither PORT is enabled, while guest is always
      using PORT B as simulated by gvt. The issue is actually covered previously
      before the commit and reverals now when the commit do the right thing.
      
      On BXT, some PHY registers are initialized by vbios, before i915 loaded.
      Later i915 will re-program some, or skip some based on the implementation.
      The initialized mmio for guest i915 is done by gvt, based on the snapshot
      taken from host. If host and guest have different PORT enabled, some
      DPIO PHY mmios that gvt initialized for guest i915 will not match the
      simualted monitor for guest, which leads to guest i915 print the calltrace
      when it's trying to enable PHY and PORT.
      
      The solution is to init these DPIO PHY registers to default value, then
      guest i915 will program them to reasonable value based on the default
      powerwell table and enabled PORT. Together with the old patch, all similar
      call trace in guest kernel on BXT can be resolved.
      
      v2: Move PHY register init to intel_vgpu_reset_mmio (Min)
      v3: Do not delete empty line in issue fix patch. (zhenyu)
      
      Fixes: c8ab5ac3 ("drm/i915/gvt: Make correct handling to vreg
      BXT_PHY_CTL_FAMILY")
      Reviewed-by: default avatarHe, Min <min.he@intel.com>
      Signed-off-by: default avatarColin Xu <colin.xu@intel.com>
      Signed-off-by: default avatarZhenyu Wang <zhenyuw@linux.intel.com>
      db7c8f1e