Commit Graph

904226 Commits

Author SHA1 Message Date
Paolo Bonzini
d332945418 KVM: x86: remove bogus user-triggerable WARN_ON
The WARN_ON is essentially comparing a user-provided value with 0.  It is
trivial to trigger it just by passing garbage to KVM_SET_CLOCK.  Guests
can break if you do so, but the same applies to every KVM_SET_* ioctl.
So, if it hurts when you do like this, just do not do it.

Reported-by: syzbot+00be5da1d75f1cc95f6b@syzkaller.appspotmail.com
Fixes: 9446e6fce0 ("KVM: x86: fix WARN_ON check of an unsigned less than zero")
Cc: Sean Christopherson <sean.j.christopherson@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-03-20 13:43:21 -04:00
Lucas Stach
f232d9ec02 drm/etnaviv: fix TS cache flushing on GPUs with BLT engine
As seen in the Vivante kernel driver, most GPUs with the BLT engine have
a broken TS cache flush. The workaround is to temporarily set the BLT
command to CLEAR_IMAGE, without actually executing the clear. Apparently
this state change is enough to trigger the required TS cache flush. As
the BLT engine is completely asychronous, we also need a few more stall
states to synchronize the flush with the frontend.

Root-caused-by: Jonathan Marek <jonathan@marek.ca>
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
2020-03-20 18:40:44 +01:00
Lucas Stach
b72af445cd drm/etnaviv: request pages from DMA32 zone when needed
Some Vivante GPUs are found in systems that have interconnects restricted
to 32 address bits, but may have system memory mapped above the 4GB mark.
As this region isn't accessible to the GPU via DMA any GPU memory allocated
in the upper part needs to go through SWIOTLB bounce buffering. This kills
performance if it happens too often, as well as overrunning the available
bounce buffer space, as the GPU buffer may stay mapped for a long time.

Avoid bounce buffering by checking the addressing restrictions. If the
GPU is unable to access memory above the 4GB mark, request our SHM buffers
to be located in the DMA32 zone.

Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
2020-03-20 18:40:44 +01:00
Linus Torvalds
5ad0ec0b86 arm64 fixes for -rc7
- Fix panic() when it occurs during secondary CPU startup
 
 - Fix "kpti=off" when KASLR is enabled
 
 - Fix howler in compat syscall table for vDSO clock_getres() fallback
 -----BEGIN PGP SIGNATURE-----
 
 iQFEBAABCgAuFiEEPxTL6PPUbjXGY88ct6xw3ITBYzQFAl5zxtcQHHdpbGxAa2Vy
 bmVsLm9yZwAKCRC3rHDchMFjNG/BB/9BVSLbqBdm6Op14J9zi3S8Qs7udcbo6dAr
 vBkBvIl6JK4e284DSoPdCQoXp4QgExm6QEYzl2EjBYMqKCmCzng4w14ctm9FnCry
 W8LNKRBaKyml7nDdT2UH1PnKB+Nh6ufv1PZQttN2e664bUl28pqC7MgJ3meJAjj8
 a+lVRxIOVFKD5AwV1jfbS1Byx/w8n9Lo/C4wbswFrbHdq6puTuEZbtJiYbkxfqa3
 wMXwNeIj1Xh2yVgz2gC02QLuTtLqJlPelhGHYec1hTQkmaSeNy0WvQr6t3oc6c5T
 Bngzv7dM5lwXxjT82AqQhSpBUAp+MjYxnWW+hRpy+2BIEnbgGnDR
 =w1Z9
 -----END PGP SIGNATURE-----

Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

Pull arm64 fixes from Will Deacon:

 - Fix panic() when it occurs during secondary CPU startup

 - Fix "kpti=off" when KASLR is enabled

 - Fix howler in compat syscall table for vDSO clock_getres() fallback

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64: compat: Fix syscall number of compat_clock_getres
  arm64: kpti: Fix "kpti=off" when KASLR is enabled
  arm64: smp: fix crash_smp_send_stop() behaviour
  arm64: smp: fix smp_send_stop() behaviour
2020-03-20 09:28:25 -07:00
Linus Torvalds
f014d2b858 Char/misc driver fixes for 5.6-rc7
Here are some small different driver fixes for 5.6-rc7
   - binderfs fix, yet again
   - slimbus new device id added
   - hwtracing bugfixes for reported issues and a new device id
 
 All of these have been in linux-next with no reported issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCXnTQmw8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ymASwCeLhlhgP/F9W7WqG1hWzJ0Dq8mkEUAn3W7GZs6
 0FrrI5ksBmjd0kTX5dbt
 =vMc6
 -----END PGP SIGNATURE-----

Merge tag 'char-misc-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char/misc driver fixes from Greg KH:
 "Here are some small different driver fixes for 5.6-rc7:

   - binderfs fix, yet again

   - slimbus new device id added

   - hwtracing bugfixes for reported issues and a new device id

  All of these have been in linux-next with no reported issues"

* tag 'char-misc-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  intel_th: pci: Add Elkhart Lake CPU support
  intel_th: Fix user-visible error codes
  intel_th: msu: Fix the unexpected state warning
  stm class: sys-t: Fix the use of time_after()
  slimbus: ngd: add v2.1.0 compatible
  binderfs: use refcount for binder control devices too
2020-03-20 09:24:22 -07:00
Linus Torvalds
3bd14829d3 Staging/IIO fixes for 5.6-rc7
Here are a number of small staging and IIO driver fixes for 5.6-rc7
 
 Nothing major here, just resolutions for some reported problems:
 	- iio bugfixes for a number of different drivers
 	- greybus loopback_test fixes
 	- wfx driver fixes
 
 All of these have been in linux-next with no reported issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCXnTRmQ8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ykkCwCfS8zLibsZtuv655yAK17C/6YghPQAoJ3iSew+
 EkzEDWQ9j2NLE+lpWtKQ
 =fZ2X
 -----END PGP SIGNATURE-----

Merge tag 'staging-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Pull staging/IIO fixes from Greg KH:
 "Here are a number of small staging and IIO driver fixes for 5.6-rc7

  Nothing major here, just resolutions for some reported problems:
   - iio bugfixes for a number of different drivers
   - greybus loopback_test fixes
   - wfx driver fixes

  All of these have been in linux-next with no reported issues"

* tag 'staging-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: rtl8188eu: Add device id for MERCUSYS MW150US v2
  staging: greybus: loopback_test: fix potential path truncations
  staging: greybus: loopback_test: fix potential path truncation
  staging: greybus: loopback_test: fix poll-mask build breakage
  staging: wfx: fix RCU usage between hif_join() and ieee80211_bss_get_ie()
  staging: wfx: fix RCU usage in wfx_join_finalize()
  staging: wfx: make warning about pending frame less scary
  staging: wfx: fix lines ending with a comma instead of a semicolon
  staging: wfx: fix warning about freeing in-use mutex during device unregister
  staging/speakup: fix get_word non-space look-ahead
  iio: ping: set pa_laser_ping_cfg in of_ping_match
  iio: chemical: sps30: fix missing triggered buffer dependency
  iio: st_sensors: remap SMO8840 to LIS2DH12
  iio: light: vcnl4000: update sampling periods for vcnl4040
  iio: light: vcnl4000: update sampling periods for vcnl4200
  iio: accel: adxl372: Set iio_chan BE
  iio: magnetometer: ak8974: Fix negative raw values in sysfs
  iio: trigger: stm32-timer: disable master mode when stopping
  iio: adc: stm32-dfsdm: fix sleep in atomic context
  iio: adc: at91-sama5d2_adc: fix differential channels in triggered mode
2020-03-20 09:20:38 -07:00
Linus Torvalds
b07c2e76c4 USB fixes for 5.6-rc7
Here are some small USB fixes for 5.6-rc7.  And there's a thunderbolt
 driver fix thrown in for good measure as well.
 
 These fixes are:
 	- new device ids for usb-serial drivers
 	- thunderbolt error code fix
 	- xhci driver fixes
 	- typec fixes
 	- cdc-acm driver fixes
 	- chipidea driver fix
 	- more USB quirks added for devices that need them.
 
 All of these have been in linux-next with no reported issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iGwEABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCXnTSfQ8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+yni+QCVEoBjFNoMaMgtQJ5Ogr0dYOLILwCeLRP7Ce0K
 GTeo+M+qrTz4DN+Ejqo=
 =xWvw
 -----END PGP SIGNATURE-----

Merge tag 'usb-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH:
 "Here are some small USB fixes for 5.6-rc7. And there's a thunderbolt
  driver fix thrown in for good measure as well.

  These fixes are:
   - new device ids for usb-serial drivers
   - thunderbolt error code fix
   - xhci driver fixes
   - typec fixes
   - cdc-acm driver fixes
   - chipidea driver fix
   - more USB quirks added for devices that need them.

  All of these have been in linux-next with no reported issues"

* tag 'usb-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  USB: cdc-acm: fix rounding error in TIOCSSERIAL
  USB: cdc-acm: fix close_delay and closing_wait units in TIOCSSERIAL
  usb: quirks: add NO_LPM quirk for RTL8153 based ethernet adapters
  usb: chipidea: udc: fix sleeping function called from invalid context
  USB: serial: pl2303: add device-id for HP LD381
  USB: serial: option: add ME910G1 ECM composition 0x110b
  usb: host: xhci-plat: add a shutdown
  usb: typec: ucsi: displayport: Fix a potential race during registration
  usb: typec: ucsi: displayport: Fix NULL pointer dereference
  USB: Disable LPM on WD19's Realtek Hub
  usb: xhci: apply XHCI_SUSPEND_DELAY to AMD XHCI controller 1022:145c
  xhci: Do not open code __print_symbolic() in xhci trace events
  thunderbolt: Fix error code in tb_port_is_width_supported()
2020-03-20 09:16:35 -07:00
Linus Torvalds
fa91418b72 TTY fixes for 5.6-rc7
Here are 3 small tty_io bugfixes for reported issues that Eric has
 resolved for 5.6-rc7
 
 All of these have been in linux-next with no reported issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCXnTR9A8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ylsYACfZM/J2PW6TXpZfCv01feD3Rx/prkAnj+2DCI7
 FeV2J/iXPTulT2eItbsJ
 =xkaZ
 -----END PGP SIGNATURE-----

Merge tag 'tty-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

Pull tty fixes from Greg KH:
 "Here are three small tty_io bugfixes for reported issues that Eric has
  resolved for 5.6-rc7

  All of these have been in linux-next with no reported issues"

* tag 'tty-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  tty: fix compat TIOCGSERIAL checking wrong function ptr
  tty: fix compat TIOCGSERIAL leaking uninitialized memory
  tty: drop outdated comments about release_tty() locking
2020-03-20 09:13:35 -07:00
Linus Torvalds
12bf19c926 sound fixes for 5.6-rc7
A few fixes covering the issues reported by syzkaller, a couple of
 fixes for the MIDI decoding bug, and a few usual HD-audio quirks.
 Some of them are about ALSA core stuff, but they are small fixes just
 for corner cases, and nothing thrilling.
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAl50gKMOHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE9+vRAAlPwrUSIWAmOtTPTozX9kqJmTspC5FJqXEZZK
 2XW3eaaRaYePiRRt2l7cqCiZUDySmZCJF6VivAt3Hx1n4nDRubs+p6JzHtJ+Swqk
 vRVZaM7GI5uUcrbVGSGteVGzXsjodaD+p811AdM3hzgzxooa5LOCkKOXGxWUXP05
 tsURjTPlRXvmYzm8vlINeQKE9M9aKHt1USthVxRg9iuyXxugFfZVWn4xMCmF4lPH
 +Z5B+DGbJfp8FUdYBFjMTew67mm6a760kOwm86bBcCMDbafiVtWb181ZCsnST4YG
 4IwRcIr+8XnJhufeOX3tkRJu8+TJvzTVUoJ8d5kr/fNpSBFuM+rB0GcwSANm5k6d
 cQKTpkKutDt7F22kk1rRkBqiD+JeCZgcOq+5rM0OcDtgT97rcvb4Ddx/ckppIpeu
 w3HSsfuq+tzoJp0EF56ruFUGEnlJcNFAM0wJqiAvnUQQDfowEU3qGb5WiU2Jjgs1
 LarcAoTKi3Wz/Sa6eIt+D139YqvgvZ5oEmDMdU9yLWeFvQNLlR5UqqXTGgVwGndm
 GL2nanMtK3k/rWaqZHDvmtLRtj/cq5so+7/VGCrAYfp9sFYZt9y4xfmzwRkNveE/
 0cDFdE1s1v3dwoZmq+/HY5gIAwn8vYATNlXG+dDDGsdwAGhtE+XoIn+WOFGZh5Dz
 ClyqYbI=
 =ejlI
 -----END PGP SIGNATURE-----

Merge tag 'sound-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "A few fixes covering the issues reported by syzkaller, a couple of
  fixes for the MIDI decoding bug, and a few usual HD-audio quirks.

  Some of them are about ALSA core stuff, but they are small fixes just
  for corner cases, and nothing thrilling"

* tag 'sound-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: hda/realtek - Enable the headset of Acer N50-600 with ALC662
  ALSA: hda/realtek - Enable headset mic of Acer X2660G with ALC662
  ALSA: seq: oss: Fix running status after receiving sysex
  ALSA: seq: virmidi: Fix running status after receiving sysex
  ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc() checks
  ALSA: hda/realtek: Fix pop noise on ALC225
  ALSA: line6: Fix endless MIDI read loop
  ALSA: pcm: oss: Avoid plugin buffer overflow
2020-03-20 09:10:29 -07:00
Linus Torvalds
69d3e5a5a6 drm fixes for 5.6-rc7
core:
 - fix lease warning
 
 i915:
 - Track active elements during dequeue
 - Fix failure to handle all MCR ranges
 - Revert unnecessary workaround
 
 amdgpu:
 - Pageflip fix
 - VCN clockgating fixes
 - GPR debugfs fix for umr
 - GPU reset fix
 - eDP fix for MBP
 - DCN2.x fix
 
 dw-hdmi:
 - fix AVI frame colorimetry
 
 komeda:
 - fix compiler warning
 
 bochs:
 - downgrade a binding failure to a warning
 -----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJedDFEAAoJEAx081l5xIa+Z8QP/iWnU8skiMi3SPnO/ki/2y1D
 ryJMMnnS7tQBW8hJ7UGCakimWq9VBuNEzOM7xYeTkKJ2vu2oT7gJkhlpscnPkPrn
 zJgaWZh31PbtnusP+8PdQiG1N3EN/FKnzx9P3WMjDrG85CNm745GRrU8VMUsPCvf
 W57QdX1LfQeajkNeBdqpYNDhP5Tu00AMeqq3KuR7je14juui8EOzSKGADkHpKqSw
 9UqnPMRrum9CHbSBGAQ3qQcAYA4vWrSxsHQdbwd4jN4+pxDZbtZscvxn28VKRd7k
 TR6YnLaXAciDRxe3gvfbEbE1zn72Lrt6R97d5ojV+VDV9sdrkN9eDYwhoYXRRIA0
 sQFg29WwBRHMeI+3ucsEDdDKx5hLR+fxD6JcGDv8dZeHzTCWZ7PFFG9YtZVUmkQq
 bMXWlvNzm7fQIA9DwfQt0nkDqt/Re6qbqRnd/ayOz/IzthMmIyPfIzA5d5u/b354
 GZVOLaD9iimCIWMD3qkwfGgZsn0Ss+jewBQ6navKaY15ADDM0OEF9Oa/RBi97DUC
 QGcpHYe6eNaMByef7/GVyDfZU1GmTAa8PepAe9x9ItRQxCICFl9fb19iyXu25ZCx
 wpSNFgHKfxMigjuLe3czW3If1SbctVMVl2BDeXh5TMFXUGKXHQZa9uf8AhtuHjj4
 F6D1JOZQPBfuoY1xukv+
 =odvv
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2020-03-20' of git://anongit.freedesktop.org/drm/drm

Pull drm fixes from Dave Airlie:
 "Hope you are well hiding out above the garage. A few amdgpu changes
  but nothing too major. I've had a wisdom tooth out this week so
  haven't been to on top of things, but all seems good.

  core:
   - fix lease warning

  i915:
   - Track active elements during dequeue
   - Fix failure to handle all MCR ranges
   - Revert unnecessary workaround

  amdgpu:
   - Pageflip fix
   - VCN clockgating fixes
   - GPR debugfs fix for umr
   - GPU reset fix
   - eDP fix for MBP
   - DCN2.x fix

  dw-hdmi:
   - fix AVI frame colorimetry

  komeda:
   - fix compiler warning

  bochs:
   - downgrade a binding failure to a warning"

* tag 'drm-fixes-2020-03-20' of git://anongit.freedesktop.org/drm/drm:
  drm/amd/display: Fix pageflip event race condition for DCN.
  drm/amdgpu: fix typo for vcn2.5/jpeg2.5 idle check
  drm/amdgpu: fix typo for vcn2/jpeg2 idle check
  drm/amdgpu: fix typo for vcn1 idle check
  drm/lease: fix WARNING in idr_destroy
  drm/i915: Handle all MCR ranges
  Revert "drm/i915/tgl: Add extra hdc flush workaround"
  drm/i915/execlists: Track active elements during dequeue
  drm/bochs: downgrade pci_request_region failure from error to warning
  drm/amd/display: Add link_rate quirk for Apple 15" MBP 2017
  drm/amdgpu: add fbdev suspend/resume on gpu reset
  drm/amd/amdgpu: Fix GPR read from debugfs (v2)
  drm/amd/display: fix typos for dcn20_funcs and dcn21_funcs struct
  drm/komeda: mark PM functions as __maybe_unused
  drm/bridge: dw-hdmi: fix AVI frame colorimetry
2020-03-20 09:03:54 -07:00
Jens Axboe
09952e3e78 io_uring: make sure accept honor rlimit nofile
Just like commit 4022e7af86, this fixes the fact that
IORING_OP_ACCEPT ends up using get_unused_fd_flags(), which checks
current->signal->rlim[] for limits.

Add an extra argument to __sys_accept4_file() that allows us to pass
in the proper nofile limit, and grab it at request prep time.

Acked-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2020-03-20 08:48:36 -06:00
Jens Axboe
4022e7af86 io_uring: make sure openat/openat2 honor rlimit nofile
Dmitry reports that a test case shows that io_uring isn't honoring a
modified rlimit nofile setting. get_unused_fd_flags() checks the task
signal->rlimi[] for the limits. As this isn't easily inheritable,
provide a __get_unused_fd_flags() that takes the value instead. Then we
can grab it when the request is prepared (from the original task), and
pass that in when we do the async part part of the open.

Reported-by: Dmitry Kadashev <dkadashev@gmail.com>
Tested-by: Dmitry Kadashev <dkadashev@gmail.com>
Acked-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2020-03-20 08:47:27 -06:00
shaoyunl
02be064823 drm/amdgpu/sriov : Don't resume RLCG for SRIOV guest
RLCG is enabled by host driver, no need to enable it in guest for none-PSP load path

Signed-off-by: shaoyunl <shaoyun.liu@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2020-03-20 10:45:00 -04:00
John Clements
43c4d57618 drm/amdgpu: protect RAS sysfs during GPU reset
MMHub EDC becomes dirty after BACO reset

EDC registers should be cleared early on in reset phase

Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: John Clements <john.clements@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2020-03-20 10:45:00 -04:00
Jordan Crouse
a5fb8b9189 drm/msm/a6xx: Use the DMA API for GMU memory objects
The GMU has very few memory allocations and uses a flat memory space so
there is no good reason to go out of our way to bypass the DMA APIs which
were basically designed for this exact scenario.

v7: Check return value of dma_set_mask_and_coherent
v4: Use dma_alloc_wc()
v3: Set the dma mask correctly and use dma_addr_t for the iova type
v2: Pass force_dma false to of_dma_configure to require that the DMA
region be set up and return error from of_dma_configure to fail probe.

Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
2020-03-20 07:13:05 -07:00
Jordan Crouse
a168b512de dt-bindings: display: msm: Convert GMU bindings to YAML
Convert display/msm/gmu.txt to display/msm/gmu.yaml and remove the old
text bindings.  The 'sram' text from the old binding never applied to
the GMU so it was not converted but all the other properties were correct.

Acked-by: Sam Ravnborg <sam@ravnborg.org>
Reviewed-by: Rob Herring <robh@kernel.org>
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
2020-03-20 07:13:05 -07:00
Umesh Nerlige Ramappa
c06aa1b438 drm/i915/perf: Invalidate OA TLB on when closing perf stream
On running several back to back perf capture sessions involving closing
and opening the perf stream, invalid OA reports are seen in the
beginning of the OA buffer in some sessions. Fix this by invalidating OA
TLB when the perf stream is closed or disabled on gen12.

Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
Reviewed-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Fixes: 00a7f0d715 ("drm/i915/tgl: Add perf support on TGL")
Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200309211057.38575-1-umesh.nerlige.ramappa@intel.com
(cherry picked from commit a639b0c150)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2020-03-20 07:04:44 -07:00
Chris Wilson
16e5c2f0d3 drm/i915/gem: Check for a closed context when looking up an engine
Beware that the context may already be closed as we try to lookup an
engine.

Closes: https://gitlab.freedesktop.org/drm/intel/issues/1389
Fixes: 130a95e909 ("drm/i915/gem: Consolidate ctx->engines[] release")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200316161447.18410-1-chris@chris-wilson.co.uk
(cherry picked from commit a22f347834)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2020-03-20 07:04:41 -07:00
Chris Wilson
e50c951ea6 drm/i915/gt: Restrict gen7 w/a batch to Haswell
The residual w/a batch is causing system instablity on Ivybridge and
Baytrail under some workloads, so disable until resolved.

Closes: https://gitlab.freedesktop.org/drm/intel/issues/1405
Fixes: 47f8253d2b ("drm/i915/gen7: Clear all EU/L3 residual contexts")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
Cc: Prathap Kumar Valsan <prathap.kumar.valsan@intel.com>
Cc: Akeem G Abodunrin <akeem.g.abodunrin@intel.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Acked-by: Mika Kuoppala <mika.kuoppala@linux.intel.com>
Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200311103640.26572-1-chris@chris-wilson.co.uk
(cherry picked from commit a62774782b)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2020-03-20 07:04:38 -07:00
Ilie Halip
6f5459da2b arm64: alternative: fix build with clang integrated assembler
Building an arm64 defconfig with clang's integrated assembler, this error
occurs:
    <instantiation>:2:2: error: unrecognized instruction mnemonic
     _ASM_EXTABLE 9999b, 9f
     ^
    arch/arm64/mm/cache.S:50:1: note: while in macro instantiation
    user_alt 9f, "dc cvau, x4", "dc civac, x4", 0
    ^

While GNU as seems fine with case-sensitive macro instantiations, clang
doesn't, so use the actual macro name (_asm_extable) as in the rest of
the file.

Also checked that the generated assembly matches the GCC output.

Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Tested-by: Nick Desaulniers <ndesaulniers@google.com>
Fixes: 290622efc7 ("arm64: fix "dc cvau" cache operation on errata-affected core")
Link: https://github.com/ClangBuiltLinux/linux/issues/924
Signed-off-by: Ilie Halip <ilie.halip@gmail.com>
Signed-off-by: Will Deacon <will@kernel.org>
2020-03-20 10:01:28 +00:00
Eric Dumazet
b738a185be tcp: ensure skb->dev is NULL before leaving TCP stack
skb->rbnode is sharing three skb fields : next, prev, dev

When a packet is sent, TCP keeps the original skb (master)
in a rtx queue, which was converted to rbtree a while back.

__tcp_transmit_skb() is responsible to clone the master skb,
and add the TCP header to the clone before sending it
to network layer.

skb_clone() already clears skb->next and skb->prev, but copies
the master oskb->dev into the clone.

We need to clear skb->dev, otherwise lower layers could interpret
the value as a pointer to a netdev.

This old bug surfaced recently when commit 28f8bfd1ac
("netfilter: Support iif matches in POSTROUTING") was merged.

Before this netfilter commit, skb->dev value was ignored and
changed before reaching dev_queue_xmit()

Fixes: 75c119afe1 ("tcp: implement rb-tree based retransmit queue")
Fixes: 28f8bfd1ac ("netfilter: Support iif matches in POSTROUTING")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Martin Zaharinov <micron10@gmail.com>
Cc: Florian Westphal <fw@strlen.de>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-03-19 21:35:55 -07:00
Len Brown
fcaa681c03 tools/power turbostat: Fix 32-bit capabilities warning
warning: `turbostat' uses 32-bit capabilities (legacy support in use)

Signed-off-by: Len Brown <len.brown@intel.com>
2020-03-20 00:32:28 -04:00
Len Brown
1f81c5efc0 tools/power turbostat: Fix missing SYS_LPI counter on some Chromebooks
Some Chromebook BIOS' do not export an ACPI LPIT, which is how
Linux finds the residency counter for CPU and SYSTEM low power states,
that is exports in /sys/devices/system/cpu/cpuidle/*residency_us

When these sysfs attributes are missing, check the debugfs attrubte
from the pmc_core driver, which accesses the same counter value.

Signed-off-by: Len Brown <len.brown@intel.com>
2020-03-20 00:32:28 -04:00
Chen Yu
f670840070 tools/power turbostat: Support Elkhart Lake
From a turbostat point of view the Tremont-based Elkhart Lake
is very similar to Goldmont, reuse the code of Goldmont.

Elkhart Lake does not support 'group turbo limit counter'
nor C3, adjust the code accordingly.

Signed-off-by: Chen Yu <yu.c.chen@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
2020-03-20 00:32:27 -04:00
Chen Yu
d7814c3098 tools/power turbostat: Support Jasper Lake
Jasper Lake, like Elkhart Lake, uses a Tremont CPU.
So reuse the code.

Signed-off-by: Chen Yu <yu.c.chen@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
2020-03-20 00:32:27 -04:00
Chen Yu
23274faf96 tools/power turbostat: Support Ice Lake server
From a turbostat point of view, Ice Lake server looks like Sky Lake server.

Signed-off-by: Chen Yu <yu.c.chen@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
2020-03-20 00:32:27 -04:00
Chen Yu
4bf7132a0a tools/power turbostat: Support Tiger Lake
From a turbostat point of view, Tiger Lake looks like Ice Lake.

Signed-off-by: Chen Yu <yu.c.chen@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
2020-03-20 00:32:27 -04:00
Len Brown
d8d005ba6a tools/power turbostat: Fix gcc build warnings
Warning: ‘__builtin_strncpy’ specified bound 20 equals destination size
	[-Wstringop-truncation]

reduce param to strncpy, to guarantee that a null byte is always copied
into destination buffer.

Signed-off-by: Len Brown <len.brown@intel.com>
2020-03-20 00:32:27 -04:00
Chen Yu
081c54323b tools/power turbostat: Support Cometlake
From a turbostat point of view, Cometlake is like Kabylake.

Suggested-by: Rui Zhang <rui.zhang@intel.com>
Signed-off-by: Chen Yu <yu.c.chen@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
2020-03-20 00:32:27 -04:00
Rahul Lakkireddy
f1f20a8666 cxgb4: fix Txq restart check during backpressure
Driver reclaims descriptors in much smaller batches, even if hardware
indicates more to reclaim, during backpressure. So, fix the check to
restart the Txq during backpressure, by looking at how many
descriptors hardware had indicated to reclaim, and not on how many
descriptors that driver had actually reclaimed. Once the Txq is
restarted, driver will reclaim even more descriptors when Tx path
is entered again.

Fixes: d429005fdf ("cxgb4/cxgb4vf: Add support for SGE doorbell queue timer")
Signed-off-by: Rahul Lakkireddy <rahul.lakkireddy@chelsio.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-03-19 21:30:14 -07:00
Rahul Lakkireddy
7affd80802 cxgb4: fix throughput drop during Tx backpressure
commit 7c3bebc3d8 ("cxgb4: request the TX CIDX updates to status page")
reverted back to getting Tx CIDX updates via DMA, instead of interrupts,
introduced by commit d429005fdf ("cxgb4/cxgb4vf: Add support for SGE
doorbell queue timer")

However, it missed reverting back several code changes where Tx CIDX
updates are not explicitly requested during backpressure when using
interrupt mode. These missed changes cause slow recovery during
backpressure because the corresponding interrupt no longer comes and
hence results in Tx throughput drop.

So, revert back these missed code changes, as well, which will allow
explicitly requesting Tx CIDX updates when backpressure happens.
This enables the corresponding interrupt with Tx CIDX update message
to get generated and hence speed up recovery and restore back
throughput.

Fixes: 7c3bebc3d8 ("cxgb4: request the TX CIDX updates to status page")
Fixes: d429005fdf ("cxgb4/cxgb4vf: Add support for SGE doorbell queue timer")
Signed-off-by: Rahul Lakkireddy <rahul.lakkireddy@chelsio.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-03-19 21:29:07 -07:00
René van Dorst
22259471b5 net: dsa: mt7530: Change the LINK bit to reflect the link status
Andrew reported:

After a number of network port link up/down changes, sometimes the switch
port gets stuck in a state where it thinks it is still transmitting packets
but the cpu port is not actually transmitting anymore. In this state you
will see a message on the console
"mtk_soc_eth 1e100000.ethernet eth0: transmit timed out" and the Tx counter
in ifconfig will be incrementing on virtual port, but not incrementing on
cpu port.

The issue is that MAC TX/RX status has no impact on the link status or
queue manager of the switch. So the queue manager just queues up packets
of a disabled port and sends out pause frames when the queue is full.

Change the LINK bit to reflect the link status.

Fixes: b8f126a8d5 ("net-next: dsa: add dsa support for Mediatek MT7530 switch")
Reported-by: Andrew Smith <andrew.smith@digi.com>
Signed-off-by: René van Dorst <opensource@vdorst.com>
Reviewed-by: Vivien Didelot <vivien.didelot@gmail.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-03-19 21:10:49 -07:00
Jason A. Donenfeld
c8cfcb78c6 crypto: arm64/chacha - correctly walk through blocks
Prior, passing in chunks of 2, 3, or 4, followed by any additional
chunks would result in the chacha state counter getting out of sync,
resulting in incorrect encryption/decryption, which is a pretty nasty
crypto vuln: "why do images look weird on webpages?" WireGuard users
never experienced this prior, because we have always, out of tree, used
a different crypto library, until the recent Frankenzinc addition. This
commit fixes the issue by advancing the pointers and state counter by
the actual size processed. It also fixes up a bug in the (optional,
costly) stride test that prevented it from running on arm64.

Fixes: b3aad5bad2 ("crypto: arm64/chacha - expose arm64 ChaCha routine as library function")
Reported-and-tested-by: Emil Renner Berthing <kernel@esmil.dk>
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: stable@vger.kernel.org # v5.5+
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2020-03-20 14:35:27 +11:00
David S. Miller
3ac9eb4210 RxRPC fixes
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEqG5UsNXhtOCrfGQP+7dXa6fLC2sFAl5zWDsACgkQ+7dXa6fL
 C2upyg/+KFOmCLFEAgwRnBn4zDDcdDT9du25Duv2d/XfAo2Zx+Nbwm7jjKR/mrRZ
 mRbcvb8qj92O4dzMCwcqDGpKT3xJmCZhxJQORBm55Bjme7tJDqXuQVYp1fZVy3Ka
 XJS0jr4n5HTorW8iGSIPJmE76XpIPq0ANhPnLbq8wZELyw87K7+J5ZdHcnUh+myd
 uKs8sIQ8PQZg6JBBj5wPRgrAkOFUTTINiUqy37ADIY1oZyzW1rUlAeAxVXV7Dnx7
 G1HvlVaDw72G1XG4pn0pNBCdGJuNF0dG2zRbdjS+kGCmf6MB6x8e22JjWW9r+r9m
 iJd4B2R/3V/kUn4i3B+jfOWD5DKzCW4lDixh9D2LzM16GUinYQTkrH9e8jMBBJGW
 7p7X9Vl3o0Nt6NDVLmTKuyomvvtT/jMYiDtKjPuvxlPCGduXB8HvNRFxsKIEVRHi
 4RcdTqUSOsyUnOvTfDTfyBu1srKFqTC3HzAunntV88UfGtWdhXRCWMejHdNK3uI9
 BC4Ym6jkmFnbQzytW/6noprvVlDfgAuyplcyhnnJ5fVNm4YQ7lZLZPgf5TS+gchI
 fMwDfRz3hOLDZ5WjCx6QLT1NHaowQLTrzTq0X3uj2ZrcnRORURvk8GfamzZoS9a5
 omyQgBfm+1YpF2VwCyU42DytdmFDUCDofKondOXh8QciwhXqaRs=
 =bvsn
 -----END PGP SIGNATURE-----

Merge tag 'rxrpc-fixes-20200319' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs

David Howells says:

====================
rxrpc, afs: Interruptibility fixes

Here are a number of fixes for AF_RXRPC and AFS that make AFS system calls
less interruptible and so less likely to leave the filesystem in an
uncertain state.  There's also a miscellaneous patch to make tracing
consistent.

 (1) Firstly, abstract out the Tx space calculation in sendmsg.  Much the
     same code is replicated in a number of places that subsequent patches
     are going to alter, including adding another copy.

 (2) Fix Tx interruptibility by allowing a kernel service, such as AFS, to
     request that a call be interruptible only when waiting for a call slot
     to become available (ie. the call has not taken place yet) or that a
     call be not interruptible at all (e.g. when we want to do writeback
     and don't want a signal interrupting a VM-induced writeback).

 (3) Increase the minimum delay on MSG_WAITALL for userspace sendmsg() when
     waiting for Tx buffer space as a 2*RTT delay is really small over 10G
     ethernet and a 1 jiffy timeout might be essentially 0 if at the end of
     the jiffy period.

 (4) Fix some tracing output in AFS to make it consistent with rxrpc.

 (5) Make sure aborted asynchronous AFS operations are tidied up properly
     so we don't end up with stuck rxrpc calls.

 (6) Make AFS client calls uninterruptible in the Rx phase.  If we don't
     wait for the reply to be fully gathered, we can't update the local VFS
     state and we end up in an indeterminate state with respect to the
     server.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2020-03-19 20:28:34 -07:00
Ido Schimmel
6002059d78 mlxsw: pci: Only issue reset when system is ready
During initialization the driver issues a software reset command and
then waits for the system status to change back to "ready" state.

However, before issuing the reset command the driver does not check that
the system is actually in "ready" state. On Spectrum-{1,2} systems this
was always the case as the hardware initialization time is very short.
On Spectrum-3 systems this is no longer the case. This results in the
software reset command timing-out and the driver failing to load:

[ 6.347591] mlxsw_spectrum3 0000:06:00.0: Cmd exec timed-out (opcode=40(ACCESS_REG),opcode_mod=0,in_mod=0)
[ 6.358382] mlxsw_spectrum3 0000:06:00.0: Reg cmd access failed (reg_id=9023(mrsr),type=write)
[ 6.368028] mlxsw_spectrum3 0000:06:00.0: cannot register bus device
[ 6.375274] mlxsw_spectrum3: probe of 0000:06:00.0 failed with error -110

Fix this by waiting for the system to become ready both before issuing
the reset command and afterwards. In case of failure, print the last
system status to aid in debugging.

Fixes: da382875c6 ("mlxsw: spectrum: Extend to support Spectrum-3 ASIC")
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Reviewed-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-03-19 20:23:27 -07:00
Dave Airlie
cb7adfd6ad Mediatek DRM Next for Linux 5.7
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJecsTUAAoJEOHKc6PJWU4kU5oP/AiCUq+idM8GX8krcB9gNEHI
 QYuyhqtkhlZwNaix+kFw0BB/XYCDv0E+2+gPQfE8B8tEVtiitWZs2Mkl08JUZbgq
 kdEjNEf/B1Qi9K/B4l9PCWCWgiETZW4FCDun8lg5acSrQTaV+uKfofFL4/Czz1jJ
 yvP2KbOpy30JFKfoA6cmnIf7+6eyzhcwaSxtpXB4n3JPP+tPt12FHRlyBYrcE4J4
 IIMoq7MUOtiHJBWQBVDXV7Id4yFtbXmfj/nFhB7axAhlDCd3300UR/tlZ0Kpl8/W
 r9bFcIFbL5VS+KeJEtPuRCVN773kPnAWhRqgA89eoYePFJaTDySdOS1IjD6GaM2K
 IcIfUjePoFIB9A4KXstTzDlB015Y8mOxg+V2w2YpPn+Nd2Nz4ZTC1XcZQ+4H2vxe
 eurEdPi9yIxyw98FJ5zHr/VXyz0xBZcOkOnFo8fTKkZG9xvcHY8hEpG3vzgYeYGH
 5w97kDXAMnloJbLqvh1/k+rkJNDAEX6k2v1j6n2JbD0aZGOvxCuWePurCdOd+csB
 7Jypd7Q0YawsmBuhrJUmizRUhHRHVhbCJy8hDfIbXizEg3uwgeSGGhqAaJIV/h7Y
 24+tuPqGVmKpzkyYqBVRmNho01jlD1/fNPCXiZMVBX74UxsIN2loX+mV+zdn/9AA
 FQy6p0lnGIBWM172syI1
 =UrsU
 -----END PGP SIGNATURE-----

Merge tag 'mediatek-drm-next-5.7' of https://github.com/ckhu-mediatek/linux.git-tags into drm-next

Mediatek DRM Next for Linux 5.7

This include MT8183 DPI support.

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: CK Hu <ck.hu@mediatek.com>
Link: https://patchwork.freedesktop.org/patch/msgid/1584580683.29614.5.camel@mtksdaap41
2020-03-20 13:08:38 +10:00
Dave Airlie
042539396a Merge tag 'amd-drm-next-5.7-2020-03-19' of git://people.freedesktop.org/~agd5f/linux into drm-next
amd-drm-next-5.7-2020-03-19:

amdgpu:
- SR-IOV fixes
- RAS fixes
- Fallthrough cleanups
- Kconfig fix for ACP
- Fix load balancing with VCN
- DC fixes
- GPU reset fixes
- Various cleanups

scheduler:
- Revert job distribution optimization
- Add a helper to pick the least loaded scheduler

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Alex Deucher <alexdeucher@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200319175418.4237-1-alexander.deucher@amd.com
2020-03-20 12:54:51 +10:00
Dave Airlie
5366b96b19 drm/i915 fixes for v5.6-rc7:
- Track active elements during dequeue
 - Fix failure to handle all MCR ranges
 - Revert unnecessary workaround
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEFWWmW3ewYy4RJOWc05gHnSar7m8FAl5zJl4ACgkQ05gHnSar
 7m+wJhAAreffDNdNJQ7aNspMJiysrSaknCGQGdFtgih0qb3f9t/A7VccpHBNN2GB
 d5CKrBE72PWQT6r4PYux56Fg1mj0wq8ajkvyqvVImkG2NWGWN6hl2Vo7vwGBa35Z
 INSCSKSMOfQfWzJGhl5SAp8ieF12gFTB251THFQ/4lt0DlMlYDfq48UxXyr7TdXs
 1Cmrgch4zDzntqMXvCrSkX3WjoPrWXqpHJFIO3AuQ6+EA14Zb4TVB7VetbpKqm26
 4TUtKPjDYaNQ2JHE9KW82vq4P1Hw55fuP0P4umL4l2M5NXkbGkWGCQiOaoaKfzM9
 u6JRhSGtg5ho4Hj05L2ai7082tH2ME1/o4nC2Wi2DHR8FW6QnMl3XC6oSmK3lpDx
 3P72D1jxW15lFpmarT/BTP9C4Puk8iyDtdkf6XRtFy2SkfEtfG8qBlBuXEcK8sz7
 LEJbJDbBr1CAWSqVkQfno1hQWdRY4847OeksVgLgAufI4bhPNxQNrZvENv1IdOwx
 78tf+y0L1dlArvYuCzNjTNotedsJcDBCgqIeMsBUYvlw7mJuWnWScU5eK7YRFviK
 AxZ0ZLxCyj9mBZp1S9Y20awjUTjjR6O1TMVmpFWYoK7UZm97CfoIAkV5Fl1Bm1CT
 epssLTY7Bbp7NdGY5bcEMRmslJj94Wm13VCtL+h7jY6rjE8h7IU=
 =ELTv
 -----END PGP SIGNATURE-----

Merge tag 'drm-intel-fixes-2020-03-19' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes

drm/i915 fixes for v5.6-rc7:
- Track active elements during dequeue
- Fix failure to handle all MCR ranges
- Revert unnecessary workaround

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/877dzgepvu.fsf@intel.com
2020-03-20 12:52:35 +10:00
Dave Airlie
362b86a3d3 Merge tag 'amd-drm-fixes-5.6-2020-03-19' of git://people.freedesktop.org/~agd5f/linux into drm-fixes
amd-drm-fixes-5.6-2020-03-19:

amdgpu:
- Pageflip fix
- VCN clockgating fixes
- GPR debugfs fix for umr
- GPU reset fix
- eDP fix for MBP
- DCN2.x fix

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Alex Deucher <alexdeucher@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200319204054.1036478-1-alexander.deucher@amd.com
2020-03-20 12:48:17 +10:00
Greg Kurz
1d0c32ec3b KVM: PPC: Fix kernel crash with PR KVM
With PR KVM, shutting down a VM causes the host kernel to crash:

[  314.219284] BUG: Unable to handle kernel data access on read at 0xc00800000176c638
[  314.219299] Faulting instruction address: 0xc008000000d4ddb0
cpu 0x0: Vector: 300 (Data Access) at [c00000036da077a0]
    pc: c008000000d4ddb0: kvmppc_mmu_pte_flush_all+0x68/0xd0 [kvm_pr]
    lr: c008000000d4dd94: kvmppc_mmu_pte_flush_all+0x4c/0xd0 [kvm_pr]
    sp: c00000036da07a30
   msr: 900000010280b033
   dar: c00800000176c638
 dsisr: 40000000
  current = 0xc00000036d4c0000
  paca    = 0xc000000001a00000   irqmask: 0x03   irq_happened: 0x01
    pid   = 1992, comm = qemu-system-ppc
Linux version 5.6.0-master-gku+ (greg@palmb) (gcc version 7.5.0 (Ubuntu 7.5.0-3ubuntu1~18.04)) #17 SMP Wed Mar 18 13:49:29 CET 2020
enter ? for help
[c00000036da07ab0] c008000000d4fbe0 kvmppc_mmu_destroy_pr+0x28/0x60 [kvm_pr]
[c00000036da07ae0] c0080000009eab8c kvmppc_mmu_destroy+0x34/0x50 [kvm]
[c00000036da07b00] c0080000009e50c0 kvm_arch_vcpu_destroy+0x108/0x140 [kvm]
[c00000036da07b30] c0080000009d1b50 kvm_vcpu_destroy+0x28/0x80 [kvm]
[c00000036da07b60] c0080000009e4434 kvm_arch_destroy_vm+0xbc/0x190 [kvm]
[c00000036da07ba0] c0080000009d9c2c kvm_put_kvm+0x1d4/0x3f0 [kvm]
[c00000036da07c00] c0080000009da760 kvm_vm_release+0x38/0x60 [kvm]
[c00000036da07c30] c000000000420be0 __fput+0xe0/0x310
[c00000036da07c90] c0000000001747a0 task_work_run+0x150/0x1c0
[c00000036da07cf0] c00000000014896c do_exit+0x44c/0xd00
[c00000036da07dc0] c0000000001492f4 do_group_exit+0x64/0xd0
[c00000036da07e00] c000000000149384 sys_exit_group+0x24/0x30
[c00000036da07e20] c00000000000b9d0 system_call+0x5c/0x68

This is caused by a use-after-free in kvmppc_mmu_pte_flush_all()
which dereferences vcpu->arch.book3s which was previously freed by
kvmppc_core_vcpu_free_pr(). This happens because kvmppc_mmu_destroy()
is called after kvmppc_core_vcpu_free() since commit ff030fdf55
("KVM: PPC: Move kvm_vcpu_init() invocation to common code").

The kvmppc_mmu_destroy() helper calls one of the following depending
on the KVM backend:

- kvmppc_mmu_destroy_hv() which does nothing (Book3s HV)

- kvmppc_mmu_destroy_pr() which undoes the effects of
  kvmppc_mmu_init() (Book3s PR 32-bit)

- kvmppc_mmu_destroy_pr() which undoes the effects of
  kvmppc_mmu_init() (Book3s PR 64-bit)

- kvmppc_mmu_destroy_e500() which does nothing (BookE e500/e500mc)

It turns out that this is only relevant to PR KVM actually. And both
32 and 64 backends need vcpu->arch.book3s to be valid when calling
kvmppc_mmu_destroy_pr(). So instead of calling kvmppc_mmu_destroy()
from kvm_arch_vcpu_destroy(), call kvmppc_mmu_destroy_pr() at the
beginning of kvmppc_core_vcpu_free_pr(). This is consistent with
kvmppc_mmu_init() being the last call in kvmppc_core_vcpu_create_pr().

For the same reason, if kvmppc_core_vcpu_create_pr() returns an
error then this means that kvmppc_mmu_init() was either not called
or failed, in which case kvmppc_mmu_destroy() should not be called.
Drop the line in the error path of kvm_arch_vcpu_create().

Fixes: ff030fdf55 ("KVM: PPC: Move kvm_vcpu_init() invocation to common code")
Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Sean Christopherson <sean.j.christopherson@intel.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/158455341029.178873.15248663726399374882.stgit@bahia.lan
2020-03-20 13:39:10 +11:00
Edward Cree
15ff197237 netfilter: flowtable: populate addr_type mask
nf_flow_rule_match() sets control.addr_type in key, so needs to also set
 the corresponding mask.  An exact match is wanted, so mask is all ones.

Fixes: c29f74e0df ("netfilter: nf_flow_table: hardware offload support")
Signed-off-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2020-03-19 21:20:04 +01:00
Mario Kleiner
eb916a5a93 drm/amd/display: Fix pageflip event race condition for DCN.
Commit '16f17eda8bad ("drm/amd/display: Send vblank and user
events at vsartup for DCN")' introduces a new way of pageflip
completion handling for DCN, and some trouble.

The current implementation introduces a race condition, which
can cause pageflip completion events to be sent out one vblank
too early, thereby confusing userspace and causing flicker:

prepare_flip_isr():

1. Pageflip programming takes the ddev->event_lock.
2. Sets acrtc->pflip_status == AMDGPU_FLIP_SUBMITTED
3. Releases ddev->event_lock.

--> Deadline for surface address regs double-buffering passes on
    target pipe.

4. dc_commit_updates_for_stream() MMIO programs the new pageflip
   into hw, but too late for current vblank.

=> pflip_status == AMDGPU_FLIP_SUBMITTED, but flip won't complete
   in current vblank due to missing the double-buffering deadline
   by a tiny bit.

5. VSTARTUP trigger point in vblank is reached, VSTARTUP irq fires,
   dm_dcn_crtc_high_irq() gets called.

6. Detects pflip_status == AMDGPU_FLIP_SUBMITTED and assumes the
   pageflip has been completed/will complete in this vblank and
   sends out pageflip completion event to userspace and resets
   pflip_status = AMDGPU_FLIP_NONE.

=> Flip completion event sent out one vblank too early.

This behaviour has been observed during my testing with measurement
hardware a couple of time.

The commit message says that the extra flip event code was added to
dm_dcn_crtc_high_irq() to prevent missing to send out pageflip events
in case the pflip irq doesn't fire, because the "DCH HUBP" component
is clock gated and doesn't fire pflip irqs in that state. Also that
this clock gating may happen if no planes are active. This suggests
that the problem addressed by that commit can't happen if planes
are active.

The proposed solution is therefore to only execute the extra pflip
completion code iff the count of active planes is zero and otherwise
leave pflip completion handling to the pflip irq handler, for a
more race-free experience.

Note that i don't know if this fixes the problem the original commit
tried to address, as i don't know what the test scenario was. It
does fix the observed too early pageflip events though and points
out the problem introduced.

Fixes: 16f17eda8b ("drm/amd/display: Send vblank and user events at vsartup for DCN")
Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2020-03-19 16:18:45 -04:00
Paul Blakey
c921ffe853 netfilter: flowtable: Fix flushing of offloaded flows on free
Freeing a flowtable with offloaded flows, the flow are deleted from
hardware but are not deleted from the flow table, leaking them,
and leaving their offload bit on.

Add a second pass of the disabled gc to delete the these flows from
the flow table before freeing it.

Fixes: c29f74e0df ("netfilter: nf_flow_table: hardware offload support")
Signed-off-by: Paul Blakey <paulb@mellanox.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2020-03-19 21:05:30 +01:00
Haishuang Yan
41e9ec5a54 netfilter: flowtable: reload ip{v6}h in nf_flow_tuple_ip{v6}
Since pskb_may_pull may change skb->data, so we need to reload ip{v6}h at
the right place.

Fixes: a908fdec3d ("netfilter: nf_flow_table: move ipv6 offload hook code to nf_flow_table")
Fixes: 7d20868717 ("netfilter: nf_flow_table: move ipv4 offload hook code to nf_flow_table")
Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2020-03-19 21:05:05 +01:00
Haishuang Yan
61abaf02d2 netfilter: flowtable: reload ip{v6}h in nf_flow_nat_ip{v6}
Since nf_flow_snat_port and nf_flow_snat_ip{v6} call pskb_may_pull()
which may change skb->data, so we need to reload ip{v6}h at the right
place.

Fixes: a908fdec3d ("netfilter: nf_flow_table: move ipv6 offload hook code to nf_flow_table")
Fixes: 7d20868717 ("netfilter: nf_flow_table: move ipv4 offload hook code to nf_flow_table")
Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2020-03-19 21:04:50 +01:00
Linus Torvalds
6c90b86a74 MMC host:
- rtsx_pci: Fix support for some various speed modes
  - sdhci-of-at91: Fix support for GPIO card detect on SAMA5D2
  - sdhci-cadence: Fix support for DDR52 speed mode for eMMC on UniPhier
  - sdhci-acpi: Fix broken WP support on Acer Aspire Switch 10
  - sdhci-acpi: Workaround FW bug for suspend on Lenovo Miix 320
 -----BEGIN PGP SIGNATURE-----
 
 iQJLBAABCgA1FiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAl5zyeEXHHVsZi5oYW5z
 c29uQGxpbmFyby5vcmcACgkQ/iaEJXNYjCn/vA//XKlCkEtNbF9ll7FlC1e3k9OY
 RgG6C+C0HHgIpff2dl/7eUOYVDIE9TiP77mc+3ViiDcN4BeZpJCixp/obFUTj7tP
 LpbiRoop+VaCQpvoB4CB4qGfx6q1WBXWzErhupXF4JKG3sEH8cqHXTygch6fDq60
 qktkBDIQRuwKKN+YxdKymSSb0kac5t9o+Lg6WDFMWWr3T2gzXQ4l61B+wJ1Zc5cN
 KgbbMPA9sc6DpQBuIfS9KrY+z7ofbqlJ70Ur1mnbHGByuyyri/amSSVT/vIzpiJU
 iSd1jxbpCuXE5Kfyf75oGfz+ijbz1JHw9lsKi9jrwjkTn40LarljOWlMB4Bbr/Ki
 m2Ywe4OnGWHaQpDnm4WThjFUgLaH6dh/WWOCe82W7XAWC5D2cpUH4TJfsCh6tp1z
 MwNQk7j0nmFU+SA87TAoAPpidMJ/fW3XAYWGmCehLGHAN/7WR5awnEpDYJD0dqN0
 lFC7ptWk2Qb4tYX0R2Vxu3q/NbavA+BaE9qNPH4SLrFpINn6Hcy7uIzv+mDTgX3q
 QFiYl6PE3RkylMEO103LqF/p5Efg2Vlm0IdGFYrph5rrcOd5VCY/zxi9zZsLWhlo
 CjCd5BbNCPXhHoG7bAxSFPgyBaUNpogcYD6MTLsBTxcmZRjB9DbckdTjhKrKWBlx
 UyeQ3zLGVZwgt5pjMZM=
 =jupi
 -----END PGP SIGNATURE-----

Merge tag 'mmc-v5.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc

Pull MMC fixes from Ulf Hansson:

 - rtsx_pci: Fix support for some various speed modes

 - sdhci-of-at91: Fix support for GPIO card detect on SAMA5D2

 - sdhci-cadence: Fix support for DDR52 speed mode for eMMC on UniPhier

 - sdhci-acpi: Fix broken WP support on Acer Aspire Switch 10

 - sdhci-acpi: Workaround FW bug for suspend on Lenovo Miix 320

* tag 'mmc-v5.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
  mmc: rtsx_pci: Fix support for speed-modes that relies on tuning
  mmc: sdhci-of-at91: fix cd-gpios for SAMA5D2
  mmc: sdhci-cadence: set SDHCI_QUIRK2_PRESET_VALUE_BROKEN for UniPhier
  mmc: sdhci-acpi: Disable write protect detection on Acer Aspire Switch 10 (SW5-012)
  mmc: sdhci-acpi: Switch signal voltage back to 3.3V on suspend on external microSD on Lenovo Miix 320
2020-03-19 12:45:14 -07:00
Vincenzo Frascino
3568b88944 arm64: compat: Fix syscall number of compat_clock_getres
The syscall number of compat_clock_getres was erroneously set to 247
(__NR_io_cancel!) instead of 264. This causes the vDSO fallback of
clock_getres() to land on the wrong syscall for compat tasks.

Fix the numbering.

Cc: <stable@vger.kernel.org>
Fixes: 53c489e1df ("arm64: compat: Add missing syscall numbers")
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>
2020-03-19 19:23:46 +00:00
Brian Masney
00d9220ec5 dt-bindings: display: msm: gmu: move sram property to gpu bindings
The sram property was incorrectly added to the GMU binding when it
really belongs with the GPU binding instead. Let's go ahead and
move it.

While changes are being made here, let's update the sram property
description to mention that this property is only valid for a3xx and
a4xx GPUs. The a3xx/a4xx example in the GPU is replaced with what was
in the GMU.

Signed-off-by: Brian Masney <masneyb@onstation.org>
Fixes: 198a72c8f9 ("dt-bindings: display: msm: gmu: add optional ocmem property")
Acked-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
2020-03-19 12:23:31 -07:00
Rob Clark
e6cada895a drm/msm/a6xx: Fix CP_MEMPOOL state name
Signed-off-by: Rob Clark <robdclark@chromium.org>
Reviewed-by: Jordan Crouse <jcrouse@codeaurora.org>
2020-03-19 12:19:10 -07:00
Rob Clark
e515af8d4a drm/msm: devcoredump should dump MSM_SUBMIT_BO_DUMP buffers
Also log buffers with the DUMP flag set, to ensure we capture all useful
cmdstream in crashdump state with modern mesa.

Otherwise we miss out on the contents of "state object" cmdstream
buffers.

v2: add missing 'inline'

Signed-off-by: Rob Clark <robdclark@chromium.org>
Reviewed-by: Jordan Crouse <jcrouse@codeaurora.org>
2020-03-19 12:18:44 -07:00