Commit Graph

388728 Commits

Author SHA1 Message Date
Alex Deucher
42a21826dc drm/radeon/atom: initialize more atom interpretor elements to 0
The ProcessAuxChannel table on some rv635 boards assumes
the divmul members are initialized to 0 otherwise we get
an invalid fb offset since it has a bad mask set when
setting the fb base.  While here initialize all the
atom interpretor elements to 0.

Fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=60639

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
2013-07-30 17:24:12 -04:00
Ingo Molnar
f155b6303d * The size of memory that gets freed by free_pages() needs to be
specified in pages, not bytes - Roy Franz.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.13 (GNU/Linux)
 
 iQIcBAABAgAGBQJR8o2aAAoJEC84WcCNIz1VmC8QAKTvaLsaAkg603K1AOtNBRLq
 OIRxffV78Xw2mpVnJR0oWcKdGkh0R1QyXY/epxezuZ72gOZFPbjlt6o26FWpR4wD
 0vzxDZatvpW6+b0nm65IcXA2dOBKyHkgpQH1hB0N++Vze7aMvNaCnzWehzTK7QQr
 Ns2t7ZzXIzDMzbBxDr7WFJu/QBmfByDpHS2/w56+kKr8LiZoz4SP6F+c62l+dKW5
 SoQ4ZEir/khd2sCeebjK4OKJcAqpPByJrpJY6uYcNrXCaykKyHEebAeWMx+9aIEq
 kZ3jl8D1sP1lYeHj/gJfLiDs5gW+39rao5+HrToU/BC6ghBGnEHSCQcecgWYmmUG
 Z3KXt7KfyThe+Xbw1JnBwc649Cx7rw7sks3POlgKxsyvoRCXMTj5/KxImydY4fbG
 HTMgtgJhuhwsXGuUeJnR7JUMBqjR3k6EMgGbRqFwkn/UXD6thlJuoRJwqSurc4Lh
 Tkekivbw5OgNEL44ZzCXzmBw7VN0Rt0+esKxbAhnEPAzwFjB18F5AzfONuUX/ull
 9k/Ed1tVsMgIFmzmCx2LTwj/U3QJ1uCdpIeouzN+jvS86vPo6HB9launENRjcj/X
 fA6cLgypfIj5qYD/SCPMq4nysC2ab551XABWidvkmbaDCiJgch5TXksuIcbpnZqJ
 s8I8gub6hqh+9VFcw+5R
 =QwjF
 -----END PGP SIGNATURE-----

Merge tag 'efi-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/mfleming/efi into x86/urgent

Pull EFI fix from Matt Fleming:

 * The size of memory that gets freed by free_pages() needs to be
   specified in pages, not bytes - by Roy Franz.

Signed-off-by: Ingo Molnar <mingo@kernel.org>
2013-07-30 20:50:33 +02:00
Stefano Stabellini
741ddbcfd2 xen/tmem: do not allow XEN_TMEM on ARM64
tmem is not supported on arm or arm64 yet. Will revert this
once the Xen hypervisor supports it.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
2013-07-30 13:44:02 -04:00
Mike Marciniszyn
b268e4db3d IB/qib: Add err_decode() call for ring dump
Commit 0b3ddf380c ("Log all SDMA errors unconditionally") missed
part of the patch.

This also corrects a format warning when dma_addr_t is 32 bits
on a 64 bit system.

Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
2013-07-30 10:13:00 -07:00
Dan Carpenter
246fcdbc9d RDMA/cxgb3: Fix stack info leak in iwch_create_cq()
The "uresp.reserved" field isn't initialized on this path so it could
leak uninitialized stack information to the user.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
2013-07-30 10:11:33 -07:00
Dan Carpenter
604296303f RDMA/nes: Fix info leaks in nes_create_qp() and nes_create_cq()
We pass a few bytes of uninitialized stack memory to the user here.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
2013-07-30 10:10:35 -07:00
Dan Carpenter
63ea374957 RDMA/ocrdma: Fix several stack info leaks
A grab bag of places which don't properly initialize stack data.  I
removed one place which cleared ".rsvd" because it's not needed now
that I have added a memset() earlier in the function.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
2013-07-30 10:09:16 -07:00
Dan Carpenter
ae1fe07f3f RDMA/cxgb4: Fix stack info leak in c4iw_create_qp()
"uresp.ma_sync_key" doesn't get set on this path so we leak 8 bytes of data.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
2013-07-30 10:07:56 -07:00
Florian Fainelli
ff5fadaff3 MIPS: BMIPS: fix slave CPU booting when physical CPU is not 0
The current BMIPS SMP code assumes that the slave CPU is physical and
logical CPU 1, but on some systems such as BCM3368, the slave CPU is
physical CPU0. Fix the code to read the physical CPU (thread ID) we are
running this code on, and adjust the relocation vector address based on
it. This allows bringing up the second CPU on BCM3368 for instance.

Signed-off-by: Florian Fainelli <florian@openwrt.org>
Cc: linux-mips@linux-mips.org
Cc: cernekee@gmail.com
Cc: jogo@openwrt.org
Cc: blogic@openwrt.org
Patchwork: https://patchwork.linux-mips.org/patch/5621/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2013-07-30 18:54:29 +02:00
Florian Fainelli
c4091d3fbb MIPS: BMIPS: do not change interrupt routing depending on boot CPU
Commit 4df715aa ("MIPS: BMIPS: support booting from physical CPU other
than 0") changed the interupt routing when we are booting from physical
CPU 0, but the settings are actually correct if we are booting from
physical CPU 0 or CPU 1. Revert that specific change.

Signed-off-by: Florian Fainelli <florian@openwrt.org>
Cc: linux-mips@linux-mips.org
Cc: cernekee@gmail.com
Cc: jogo@openwrt.org
Cc: blogic@openwrt.org
Patchwork: https://patchwork.linux-mips.org/patch/5622/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2013-07-30 18:54:09 +02:00
Markos Chandras
c055629b27 MIPS: powertv: Fix arguments for free_reserved_area()
Commit 6e7582bf35
"MIPS: PowerTV: use free_reserved_area() to simplify code"

merged in 3.11-rc1, broke the build for the powertv defconfig with
the following build error:

arch/mips/powertv/asic/asic_devices.c: In function 'platform_release_memory':
arch/mips/powertv/asic/asic_devices.c:533:7: error: passing argument 1 of
'free_reserved_area' makes pointer from integer without a cast [-Werror]

The free_reserved_area() function expects a void * pointer for the start
address and a void * pointer for the end one.

Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/5624/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2013-07-30 18:50:31 +02:00
Markos Chandras
314878d246 MIPS: Set default CPU type for BCM47XX platforms
If neither BCM47XX_SSD nor BCM47XX_BCMA is selected, then no
CPU type is available leading to build problems. We fix
this problem by using MIPS32r1 as the default CPU type for
the BCM47XX platform.

Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
Acked-by: Steven J. Hill <Steven.Hill@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/5618/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2013-07-30 18:48:50 +02:00
Maciej W. Rozycki
1d3e2d79a7 MIPS: uapi/asm/siginfo.h: Fix GCC 4.1.2 compilation
It wasn't until GCC 4.3 I believe that the __SIZEOF_*__ predefined macros
were added.  The change below switches <uapi/asm/siginfo.h> to the
_MIPS_SZLONG macro so that compilation with e.g. GCC 4.1.2 succeeds.
This is a user API header so I think this is even more important, for
older userland support.  The change adds an unsuccessful default too, to
catch any compiler configuration oddities.

Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/5630/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2013-07-30 18:40:40 +02:00
Steven J. Hill
7ad18dd03c MIPS: Fix multiple definitions of UNCAC_BASE.
Fix build error below:

arch/mips/include/asm/mach-generic/spaces.h:29:0: warning:
"UNCAC_BASE" redefined [enabled by default]
In file included from arch/mips/include/asm/addrspace.h:13:0,
                 from arch/mips/include/asm/barrier.h:11,
                 from arch/mips/include/asm/bitops.h:18,
                 from include/linux/bitops.h:22,
                 from include/linux/kernel.h:10,
                 from include/asm-generic/bug.h:13,
                 from arch/mips/include/asm/bug.h:41,
                 from include/linux/bug.h:4,
                 from include/linux/page-flags.h:9,
                 from kernel/bounds.c:9:
arch/mips/include/asm/mach-ar7/spaces.h:20:0: note: this is the
location of the previous definition

Signed-off-by: Steven J. Hill <Steven.Hill@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/5583/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2013-07-30 18:40:40 +02:00
Stefan Haberland
0e003b709e s390/dasd: fix hanging devices after path events
The processing of the dasd_block tasklet may have been interrupted
by a path event.
Restart the dasd tasklets in sleep_on_immediately function.

Signed-off-by: Stefan Haberland <stefan.haberland@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2013-07-30 16:17:25 +02:00
David Vrabel
179fbd5a45 xen/evtchn: avoid a deadlock when unbinding an event channel
Unbinding an event channel (either with the ioctl or when the evtchn
device is closed) may deadlock because disable_irq() is called with
port_user_lock held which is also locked by the interrupt handler.

Think of the IOCTL_EVTCHN_UNBIND is being serviced, the routine has
just taken the lock, and an interrupt happens. The evtchn_interrupt
is invoked, tries to take the lock and spins forever.

A quick glance at the code shows that the spinlock is a local IRQ
variant. Unfortunately that does not help as "disable_irq() waits for
the interrupt handler on all CPUs to stop running.  If the irq occurs
on another VCPU, it tries to take port_user_lock and can't because
the unbind ioctl is holding it." (from David). Hence we cannot
depend on the said spinlock to protect us. We could make it a system
wide IRQ disable spinlock but there is a better way.

We can piggyback on the fact that the existence of the spinlock is
to make get_port_user() checks be up-to-date. And we can alter those
checks to not depend on the spin lock (as it's protected by u->bind_mutex
in the ioctl) and can remove the unnecessary locking (this is
IOCTL_EVTCHN_UNBIND) path.

In the interrupt handler we cannot use the mutex, but we do not
need it.

"The unbind disables the irq before making the port user stale, so when
you clear it you are guaranteed that the interrupt handler that might
use that port cannot be running." (from David).

Hence this patch removes the spinlock usage on the teardown path
and piggybacks on disable_irq happening before we muck with the
get_port_user() data. This ensures that the interrupt handler will
never run on stale data.

Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
[v1: Expanded the commit description a bit]
2013-07-30 09:21:14 -04:00
Colin Cross
2b44c4db2e freezer: set PF_SUSPEND_TASK flag on tasks that call freeze_processes
Calling freeze_processes sets a global flag that will cause any
process that calls try_to_freeze to enter the refrigerator.  It
skips sending a signal to the current task, but if the current
task ever hits try_to_freeze, all threads will be frozen and the
system will deadlock.

Set a new flag, PF_SUSPEND_TASK, on the task that calls
freeze_processes.  The flag notifies the freezer that the thread
is involved in suspend and should not be frozen.  Also add a
WARN_ON in thaw_processes if the caller does not have the
PF_SUSPEND_TASK flag set to catch if a different task calls
thaw_processes than the one that called freeze_processes, leaving
a task with PF_SUSPEND_TASK permanently set on it.

Threads that spawn off a task with PF_SUSPEND_TASK set (which
swsusp does) will also have PF_SUSPEND_TASK set, preventing them
from freezing while they are helping with suspend, but they need
to be dead by the time suspend is triggered, otherwise they may
run when userspace is expected to be frozen.  Add a WARN_ON in
thaw_processes if more than one thread has the PF_SUSPEND_TASK
flag set.

Reported-and-tested-by: Michael Leun <lkml20130126@newton.leun.net>
Signed-off-by: Colin Cross <ccross@android.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-07-30 14:05:06 +02:00
Lan Tianyu
016d5baad0 ACPI / battery: Fix parsing _BIX return value
The _BIX method returns extended battery info as a package.
According the ACPI spec (ACPI 5, Section 10.2.2.2), the first member
of that package should be "Revision".  However, the current ACPI
battery driver treats the first member as "Power Unit" which should
be the second member.  This causes the result of _BIX return data
parsing to be incorrect.

Fix this by adding a new member called 'revision' to struct
acpi_battery and adding the offsetof() information on it to
extended_info_offsets[] as the first row.

[rjw: Changelog]
Reported-and-tested-by: Jan Hoffmann <jan.christian.hoffmann@gmail.com>
References: http://bugzilla.kernel.org/show_bug.cgi?id=60519
Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
Cc: 2.6.34+ <stable@vger.kernel.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-07-30 14:00:42 +02:00
Lars-Peter Clausen
610d80eaa9 ASoC: bf5xx-ac97: Fix compile error with SND_BF5XX_HAVE_COLD_RESET
If CONFIG_SND_BF5XX_HAVE_COLD_RESET is enabled building the blackfin ac97 driver
fails with the following compile error:
	sound/soc/blackfin/bf5xx-ac97.c: In function ‘asoc_bfin_ac97_probe’:
	sound/soc/blackfin/bf5xx-ac97.c:297: error: expected ‘;’ before ‘{’ token
	sound/soc/blackfin/bf5xx-ac97.c:302: error: label ‘gpio_err’ used but not defined

The issue was introduced in commit 6dab2fd7 ("ASoC: bf5xx-ac97: Convert to
devm_gpio_request_one()").

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Mark Brown <broonie@linaro.org>
2013-07-30 12:51:02 +01:00
David S. Miller
a0db856a95 net_sched: Fix stack info leak in cbq_dump_wrr().
Make sure the reserved fields, and padding (if any), are
fully initialized.

Based upon a patch by Dan Carpenter and feedback from
Joe Perches.

Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-30 00:16:21 -07:00
Dave Airlie
e9e3c8a20b Merge branch 'drm-nouveau-next' of git://anongit.freedesktop.org/git/nouveau/linux-2.6
nouveau fixes a number of regressions and a few user triggerable oops
since -rc1. Along with a few mpeg engine fixes.

* 'drm-nouveau-next' of git://anongit.freedesktop.org/git/nouveau/linux-2.6:
  drm/nouveau: fix semaphore dmabuf obj
  drm/nouveau/vm: make vm refcount into a kref
  drm/nv31/mpeg: don't recognize nv3x cards as having nv44 graph class
  drm/nv40/mpeg: write magic value to channel object to make it work
  drm/nouveau: fix size check for cards without vm
  drm/nv50-/disp: remove dcb_outp_match call, and related variables
  drm/nva3-/disp: fix hda eld writing, needs to be padded
  drm/nv31/mpeg: fix mpeg engine initialization
  drm/nv50/mc: include vp in the fb error reporting mask
  drm/nouveau: fix null pointer dereference in poll_changed
  drm/nv50/gpio: post-nv92 cards have 32 interrupt lines
  drm/nvc0/fb: take lock in nvc0_ram_put()
  drm/nouveau/core: xtensa firmware size needs to be 0x40000 no matter what
2013-07-30 16:49:57 +10:00
Maarten Lankhorst
7a7da592cb drm/nouveau: fix semaphore dmabuf obj
Fixes some dmabuf object errors on nv50 chipset and below.

Cc: stable@vger.kernel.org [3.7+]
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2013-07-30 16:46:55 +10:00
Ben Skeggs
e0bacd2f7e drm/nouveau/vm: make vm refcount into a kref
Never used to be required, but a recent change made it necessary.

Reported-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2013-07-30 16:42:29 +10:00
Dave Airlie
ca089b7266 Merge branch 'exynos-drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos
This pull request fixes module build and g2d clock
   control issues, and includes related cleanup.

* 'exynos-drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos:
  drm/exynos: Remove module.h header inclusion
  drm/exynos: consider common clock framework to g2d driver.
  drm/exynos: fix module build error
  drm/exynos: exynos_drm_ipp: fix return value check
2013-07-30 14:04:44 +10:00
Steven Rostedt (Red Hat)
1c80c43290 ftrace: Consolidate some duplicate code for updating ftrace ops
When ftrace ops modifies the functions that it will trace, the update
to the function mcount callers may need to be modified. Consolidate
the two places that do the checks to see if an update is required
with a wrapper function for those checks.

Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2013-07-29 23:56:00 -04:00
Ilia Mirkin
dc409df944 drm/nv31/mpeg: don't recognize nv3x cards as having nv44 graph class
Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2013-07-30 13:05:06 +10:00
Ilia Mirkin
3d8b2b489e drm/nv40/mpeg: write magic value to channel object to make it work
Looks like the rewrite in commit ebb945a94b ("drm/nouveau: port all
engines to new engine module format") missed that one little detail.

Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2013-07-30 13:05:00 +10:00
Maarten Lankhorst
35095f7529 drm/nouveau: fix size check for cards without vm
Op 24-07-13 17:55, Dan Carpenter schreef:
> Hello Maarten Lankhorst,
>
> This is a semi-automatic email about new static checker warnings.
>
> The patch 0108bc808107: "drm/nouveau: do not allow negative sizes for
> now" from Jul 7, 2013, leads to the following Smatch complaint:
>
> drivers/gpu/drm/nouveau/nouveau_bo.c:222 nouveau_bo_new()
> 	 warn: variable dereferenced before check 'drm->client.base.vm' (see line 201)
>
> drivers/gpu/drm/nouveau/nouveau_bo.c
>    200		int type = ttm_bo_type_device;
>    201		int max_size = INT_MAX & ~((1 << drm->client.base.vm->vmm->lpg_shift) - 1);
>                                                  ^^^^^^^^^^^^^^^^^^^
> New dereference.
>
>    202
>    203		if (size <= 0 || size > max_size) {
>    204			nv_warn(drm, "skipped size %x\n", (u32)size);
>    205			return -EINVAL;
>    206		}
>    207
>    208		if (sg)
>    209			type = ttm_bo_type_sg;
>    210
>    211		nvbo = kzalloc(sizeof(struct nouveau_bo), GFP_KERNEL);
>    212		if (!nvbo)
>    213			return -ENOMEM;
>    214		INIT_LIST_HEAD(&nvbo->head);
>    215		INIT_LIST_HEAD(&nvbo->entry);
>    216		INIT_LIST_HEAD(&nvbo->vma_list);
>    217		nvbo->tile_mode = tile_mode;
>    218		nvbo->tile_flags = tile_flags;
>    219		nvbo->bo.bdev = &drm->ttm.bdev;
>    220
>    221		nvbo->page_shift = 12;
>    222		if (drm->client.base.vm) {
>                     ^^^^^^^^^^^^^^^^^^^
> Old check.
>
>    223			if (!(flags & TTM_PL_FLAG_TT) && size > 256 * 1024)
>    224				nvbo->page_shift = drm->client.base.vm->vmm->lpg_shift;
>
> regards,
> dan carpenter

8<-----
Commit 0108bc808107: "drm/nouveau: do not allow negative sizes for now" broke
older nvidia gpu's that lack a vm. Add an explicit check to handle this.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Reported-by: konrad wilk <konrad.wilk@oracle.com>
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2013-07-30 13:04:52 +10:00
Emil Velikov
9a7046d55f drm/nv50-/disp: remove dcb_outp_match call, and related variables
Unused and irrelavant since the code move of DP training/linkcontrol interrupt

Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2013-07-30 13:04:45 +10:00
Ilia Mirkin
02d69294a1 drm/nva3-/disp: fix hda eld writing, needs to be padded
Commits 0a9e2b959 (drm/nvd0/disp: move HDA codec setup to core) and
a4feaf4ea (drm/nva3/disp: move hda codec handling to core) moved code
around but neglected to fill data up to 0x60 as before. This caused
/proc/asound/cardN/eld#3.0 to show eld_valid as 0. With this patch, that
file is again populated with the correct data.

See https://bugs.freedesktop.org/show_bug.cgi?id=67051

Reported-and-tested-by: Alex <alupu01@gmail.com>
Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2013-07-30 13:04:38 +10:00
Ilia Mirkin
18f35fa658 drm/nv31/mpeg: fix mpeg engine initialization
object->engine is null, which leads to a null deref down the line

Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2013-07-30 13:04:32 +10:00
Ilia Mirkin
921837634d drm/nv50/mc: include vp in the fb error reporting mask
Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2013-07-30 13:04:25 +10:00
Maarten Lankhorst
8a258353ed drm/nouveau: fix null pointer dereference in poll_changed
Fixes vgaswitcheroo on a card without display.

Signed-off-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2013-07-30 13:04:19 +10:00
Emil Velikov
8ff8605640 drm/nv50/gpio: post-nv92 cards have 32 interrupt lines
Since the original merge of nouveau to upstream kernel, we were assuming
that nv90 (and later) cards have 32 lines.

Based on mmio traces of the binary driver, as well as PBUS error messages
during read/write of the e070/e074 registers, we can conclude that nv92
has only 16 lines whereas nv94 (and later) cards have 32.

Reported-and-tested-by: David M. Lloyd <david.lloyd@redhat.com>
Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
Cc: dri-devel@lists.freedesktop.org
Cc: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2013-07-30 13:04:14 +10:00
Roy Spliet
dedaa8f0e6 drm/nvc0/fb: take lock in nvc0_ram_put()
Kernel panic caused by list corruption in ltcg seems to indicate a
concurrency issue.

Take mutex of pfb like nv50_ram_put() to eliminate concurrency.

V2: Separate critical section into separate function, avoid taking the
    lock twice on NVC0

Signed-off-by: Roy Spliet <r.spliet@student.tudelft.nl>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2013-07-30 13:04:07 +10:00
Ilia Mirkin
bfcd92a0ae drm/nouveau/core: xtensa firmware size needs to be 0x40000 no matter what
The current logic is wrong since we send fw->size >> 8 to the
card. Rounding the size up by 0x100 and 0x1000 didn't seem to help,
the card still hung, so go back to what the blob does -- 0x40000.

Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2013-07-30 13:03:59 +10:00
Oleg Nesterov
bf682c3159 tracing: Change remove_event_file_dir() to clear "d_subdirs"->i_private
Change remove_event_file_dir() to clear ->i_private for every
file we are going to remove.

We need to check file->dir != NULL because event_create_dir()
can fail. debugfs_remove_recursive(NULL) is fine but the patch
moves it under the same check anyway for readability.

spin_lock(d_lock) and "d_inode != NULL" check are not needed
afaics, but I do not understand this code enough.

tracing_open_generic_file() and tracing_release_generic_file()
can go away, ftrace_enable_fops and ftrace_event_filter_fops()
use tracing_open_generic() but only to check tracing_disabled.

This fixes all races with event_remove() or instance_delete().
f_op->read/write/whatever can never use the freed file/call,
all event/* files were changed to check and use ->i_private
under event_mutex.

Note: this doesn't not fix other problems, event_remove() can
destroy the active ftrace_event_call, we need more changes but
those changes are completely orthogonal.

Link: http://lkml.kernel.org/r/20130728183527.GB16723@redhat.com

Reviewed-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2013-07-29 22:57:11 -04:00
Oleg Nesterov
f6a84bdc75 tracing: Introduce remove_event_file_dir()
Preparation for the next patch. Extract the common code from
remove_event_from_tracers() and __trace_remove_event_dirs()
into the new helper, remove_event_file_dir().

The patch looks more complicated than it actually is, it also
moves remove_subsystem() up to avoid the forward declaration.

Link: http://lkml.kernel.org/r/20130726172547.GA3629@redhat.com

Reviewed-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2013-07-29 22:57:10 -04:00
Oleg Nesterov
c5a44a1200 tracing: Change f_start() to take event_mutex and verify i_private != NULL
trace_format_open() and trace_format_seq_ops are racy, nothing
protects ftrace_event_call from trace_remove_event_call().

Change f_start() to take event_mutex and verify i_private != NULL,
change f_stop() to drop this lock.

This fixes nothing, but now we can change debugfs_remove("format")
callers to nullify ->i_private and fix the the problem.

Note: the usage of event_mutex is sub-optimal but simple, we can
change this later.

Link: http://lkml.kernel.org/r/20130726172543.GA3622@redhat.com

Reviewed-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2013-07-29 22:57:10 -04:00
Oleg Nesterov
e2912b091c tracing: Change event_filter_read/write to verify i_private != NULL
event_filter_read/write() are racy, ftrace_event_call can be already
freed by trace_remove_event_call() callers.

1. Shift mutex_lock(event_mutex) from print/apply_event_filter to
   the callers.

2. Change the callers, event_filter_read() and event_filter_write()
   to read i_private under this mutex and abort if it is NULL.

This fixes nothing, but now we can change debugfs_remove("filter")
callers to nullify ->i_private and fix the the problem.

Link: http://lkml.kernel.org/r/20130726172540.GA3619@redhat.com

Reviewed-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2013-07-29 22:56:59 -04:00
Oleg Nesterov
bc6f6b08de tracing: Change event_enable/disable_read() to verify i_private != NULL
tracing_open_generic_file() is racy, ftrace_event_file can be
already freed by rmdir or trace_remove_event_call().

Change event_enable_read() and event_disable_read() to read and
verify "file = i_private" under event_mutex.

This fixes nothing, but now we can change debugfs_remove("enable")
callers to nullify ->i_private and fix the the problem.

Link: http://lkml.kernel.org/r/20130726172536.GA3612@redhat.com

Reviewed-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2013-07-29 22:05:40 -04:00
Oleg Nesterov
1a11126bcb tracing: Turn event/id->i_private into call->event.type
event_id_read() is racy, ftrace_event_call can be already freed
by trace_remove_event_call() callers.

Change event_create_dir() to pass "data = call->event.type", this
is all event_id_read() needs. ftrace_event_id_fops no longer needs
tracing_open_generic().

We add the new helper, event_file_data(), to read ->i_private, it
will have more users.

Note: currently ACCESS_ONCE() and "id != 0" check are not needed,
but we are going to change event_remove/rmdir to clear ->i_private.

Link: http://lkml.kernel.org/r/20130726172532.GA3605@redhat.com

Reviewed-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2013-07-29 22:04:30 -04:00
Linus Torvalds
36f571e9ed This fixes corrupted video capture, seen with IIDC/DCAM video and certain
buffer settings.  (Regression since v3.4 inclusive.)
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.20 (GNU/Linux)
 
 iQIcBAABAgAGBQJR9s/GAAoJEHnzb7JUXXnQUQ0QAL+E3JIrifLNLvkWLPzBc/hP
 VyFqrBWvpMWGrAXmF6HtyTkSsvde7q2sTgwwFg4wamSctXT7jVNCaoS0vJ+tXv4F
 +mXlGtyQcQV6RrCTeHnH4lwsEe2sb3YbHbwZ8/GPVJQOWpmwXqM7Ikj6mG2p6qVU
 bOBztCnkbugSzcp+bdF0DtMyNkh8gDombnqyCKMjDvJq5oAR8l/wHPPqMed0r+kZ
 Yk66p2LqqMqs6yOGC6ftNSRCO8D9KlGCQH4ydwUgiN7vSElZClDqpb8mVYzhPj0H
 35rE+gc2SGcbvJO3ypWmQDPlT0kwU52KO9t0KLKNbHYbutzw5jRmYjkiGwy4GqMC
 cGWNTakuDyUK2hStXKwVEmdGI/5bl7UPTGYresczNxQlaYr9JtEy85QYadW2sNPZ
 BL4psLTbcM4ovoLdtqxsHeD8vtYZIfd4ajPuvczQu/W9NgsjScL3x67Nq/bK1mBo
 uybrwaJR4U7ulfxjNME+ed7NiJMrppaweT5vFnM7/JbmcOgfiakuoOf2gxAU7y7D
 xCU4PqvO/mSR+BRN8oYQDTkyzXtdgxhr7od1vGQHLwnSq7IhBybaSZkoTtDahtVY
 L7L9TGT5cQ1fZbhtZbgIxrjr0RIVKF/ZLmR/s5vm1Y7UyPvDbbGxYXfeqsuypFy/
 /Y8FZqlSE60MivSVpyAA
 =L5a0
 -----END PGP SIGNATURE-----

Merge tag 'firewire-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394

Pull firewire regression fix from Stefan Richter:
 "This fixes corrupted video capture, seen with IIDC/DCAM video and
  certain buffer settings.  (Regression since v3.4 inclusive.)"

* tag 'firewire-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:
  firewire: fix libdc1394/FlyCap2 iso event regression
2013-07-29 17:08:22 -07:00
Linus Torvalds
8027678202 SMP build breakage
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQIcBAABAgAGBQJR96y2AAoJEGnX8d3iisJeukcP/1Gu0KDCU1ahAqkP29I6xfMS
 DSgl/VdKx8r4OWeALOjzOObNVkE8B4xDauQlVlETeYrqE5Lck9aAH6n3KRwMRNBc
 EJXkvcNfcVfSA0ufTMKVeGVbSSq+5k5cts/MRBzkzrFRiJAn6cI3/UIpWatrQ3a6
 GceZOQzfWOki9YGnJH630n3ZtE3i/7KoI9WZRxGzj8MATLdFggYrKs0bl5sT0n+G
 oh6iv2/Hvb0VH+teM4eiJi9O733aptEPXXZKjCutUHDSxsQvLv358/+7iW9PqtHX
 71W7xr8cVUckguqs/QLBFRbx3zENCpu/e40HbxkVIcCRP4179H6wwkkkpHfV7crV
 9WZAR+5xBvt5CWl1NwKwdSsWj5solT0rc8XAVD3RGxs30W4WSYfkJkOT+e2/Uage
 6EyNvlq9I6XFRS6berGvCsSENVefamPqwDJ3haH0pHMi2R4P24u+DIDa2Q6wNagJ
 jR9+2b8v0Lucb0MVsdt/oM01zWhOLKtrVRsJnxkhd1cdEj+Ka6Fh3E8kZK6a5dBi
 shGa6riCaboDdLVx0G1vQo8i628fTdHyJyJ7YhKNPQ7xAviUz0n+ybdrYR9MaEYo
 zELXnh9o0Zy1M8N2jZaLntVFcD4QfyyoSNdIIBvfV522XzAJrD8/9+Xel8QpbPiu
 YVQu45w20ZpUKuKrAn/i
 =RdoE
 -----END PGP SIGNATURE-----

Merge tag 'arc-v3.11-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc

Pull ARC fix from Vineet Gupta:
 "SMP build breakage fix"

* tag 'arc-v3.11-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:
  ARC: SMP build breakage
2013-07-29 17:07:45 -07:00
Egbert Eich
de7500eafc drm/mgag200: Fix LUT programming for 16bpp
Since there are only 32 (64) distinct color values for each color
in 16bpp Matrox hardware expects those in a 'dense' manner, ie in
the first 32 (64) entries of the respective color.

Signed-off-by: Egbert Eich <eich@suse.de>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2013-07-30 09:44:42 +10:00
Takashi Iwai
da55839870 drm/mgag200: Fix framebuffer pitch calculation
The framebuffer pitch calculation needs to be done differently for bpp == 24
- check xf86-video-mga for reference.

Signed-off-by: Egbert Eich <eich@suse.de>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2013-07-30 09:44:30 +10:00
Egbert Eich
3d5a1c5e30 drm/mgag200: Add sysfs support for connectors
Signed-off-by: Egbert Eich <eich@suse.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2013-07-30 09:44:24 +10:00
Egbert Eich
64c2907664 drm/mgag200: Add an crtc_disable callback to the crtc helper funcs
Signed-off-by: Egbert Eich <eich@suse.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2013-07-30 09:44:20 +10:00
Egbert Eich
030f19f0e2 drm/mgag200: Fix logic in mgag200_bo_pin() (v2)
Add missing 'return 0;'.

v2: Simplified patch as suggested by Dave Airlie <airlied@redhat.com>

Signed-off-by: Egbert Eich <eich@suse.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2013-07-30 09:43:59 +10:00
Dave Airlie
782cf7d84a Merge branch 'drm-fixes-3.11' of git://people.freedesktop.org/~agd5f/linux
Alex writes:
A few more radeon bug fixes, mostly for SI dpm.  At this point dpm is
pretty solid across the majority of asics.  I think we mostly just have
corner cases and fixing up some of the trickier features at this point.

* 'drm-fixes-3.11' of git://people.freedesktop.org/~agd5f/linux:
  drm/radeon/dpm: fix and enable reclocking on SI
  drm/radeon/dpm: disable cac setup on SI
  drm/radeon/si: disable cgcg and pg for now
  drm/radeon/dpm: fix forcing performance state to low on cayman
  drm/radeon/atom: fix fb when fetching engine params
  drm/radeon: properly handle cg on asics without UVD
  drm/radeon/dpm: fix powertune handling for pci id 0x6835
  drm/radeon/dpm: fix si_calculate_memory_refresh_rate()
  drm/radeon/dpm: fix display gap programming on SI
  drm/radeon: fix audio dto programming on DCE4+
2013-07-30 09:43:28 +10:00