args->size is a u64. arg->pitch and args->height are u32. The
multiplication will overflow instead of using the high 32 bits as
intended.
Reviewed-by: Christian König <[email protected]>
Signed-off-by: Dan Carpenter <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
There is no limit on args->data.data_size_bytes so we could read beyond
the end of the args->data.data[] array.
Reviewed-by: Christian König <[email protected]>
Reported-by: Ilja Van Sprundel <[email protected]>
Signed-off-by: Dan Carpenter <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
The amdgpu_cs_parser_init() function doesn't clean up after itself but
instead the caller uses a free everything function amdgpu_cs_parser_fini()
on failure. This style of error handling is often buggy. In this
example, we call "drm_free_large(parser->chunks[i].kdata);" when it is
an unintialized pointer or when "parser->chunks" is NULL.
I fixed this bug by adding unwind code so that it frees everything that
it allocates.
I also mode some other very minor changes:
1) Renamed "r" to "ret".
2) Moved the chunk_array allocation to the start of the function.
3) Removed some initializers which are no longer needed.
Reviewed-by: Christian König <[email protected]>
Reported-by: Ilja Van Sprundel <[email protected]>
Signed-off-by: Dan Carpenter <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
The value was much too low, which could cause the userspace visible
vblank counter to move backwards when the hardware counter wrapped
around.
Ported from radeon commit:
b0b9bb4dd5
Reviewed-by: Christian König <[email protected]>
Reviewed-by: Jammy Zhou <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
Cc: [email protected]
User space passed the same handle before suspend and after resume,
so we have remove the session and handle destroy, and keep the
firmware untouched.
Signed-off-by: Leo Liu <[email protected]>
Reviewed-by: Christian König <[email protected]>
Cc: [email protected]
Embed the scheduler into the ring structure instead of allocating it.
Use the ring name directly instead of the id.
v2: rebased, whitespace cleanup
Signed-off-by: Christian König <[email protected]>
Reviewed-by: Junwei Zhang <[email protected]>
Reviewed-by: Chunming Zhou<[email protected]>
Move the fence related stuff into amdgpu_fence.c
v2: rework commit message, cause this is actually not a bug
Signed-off-by: Christian König <[email protected]>
Reviewed-by: Chunming Zhou<[email protected]>
Reviewed-by: Junwei Zhang <[email protected]>
Just to be consistent with the other members.
v2: rename the ring member as well.
Signed-off-by: Christian König <[email protected]>
Reviewed-by: Junwei Zhang <[email protected]> (v1)
Reviewed-by: Chunming Zhou<[email protected]>
Reorder the fields and properly return the kfifo_alloc error code.
Signed-off-by: Christian König <[email protected]>
Reviewed-by: Junwei Zhang <[email protected]>
Reviewed-by: Chunming Zhou<[email protected]>
Reduces the locking and fencing overhead.
v2: add comment why we need the duplicates list in the GEM op.
Signed-off-by: Christian König <[email protected]>
Reviewed-by: Alex Deucher <[email protected]>
Reviewed-by: Jammy Zhou <[email protected]>
This allows for multiple BOs to have the same reservation object.
Signed-off-by: Christian König <[email protected]>
Reviewed-by: Jammy Zhou <[email protected]>
Reviewed-by: Alex Deucher <[email protected]>
Adds an extra argument to amdgpu_bo_create, which is only used in amdgpu_prime.c.
Port of radeon commit 831b6966a6.
v2: fix up kfd.
Signed-off-by: Christian König <[email protected]>
Reviewed-by: Jammy Zhou <[email protected]>
Reviewed-by: Alex Deucher <[email protected]>
And call the processed callback directly after submitting the job.
v2: split adding error handling into separate patch.
Signed-off-by: Christian König <[email protected]>
Reviewed-by: Chunming Zhou <[email protected]>
Reviewed-by: Junwei Zhang <[email protected]>
Reviewed-by: Jammy Zhou <[email protected]>
Otherwise the resource blocked by it will never be reclaimed.
v2: add DRM_ERROR.
v3: fix typo in commit message
Signed-off-by: Christian König <[email protected]>
Reviewed-by: Junwei Zhang <[email protected]>
Reviewed-by: Chunming Zhou<[email protected]>
Reviewed-by: Jammy Zhou <[email protected]>
track sched job status like the length of job queue and hw job queue.
v2: fix build after rebase
Signed-off-by: Chunming Zhou <[email protected]>
Reviewed-by: Jammy Zhou <[email protected]>
Reviewed-by: Christian König <[email protected]>
Make sure the CP waits for the write to be confirmed before
invalidating.
Signed-off-by: Christian König <[email protected]>
Reviewed-by: Alex Deucher <[email protected]>
Insert wait for reg mem after EOP to fix potential issue with vm context switch
v2: move wait to vm_flush() use equal instead of greater than.
Signed-off-by: Anatoli Antonovitch <[email protected]>
Signed-off-by: Christian König <[email protected]>
Reviewed-by: Alex Deucher <[email protected]>
Provide module parameter to enable/disable them. Still
enabled by default.
Signed-off-by: Christian König <[email protected]>
Reviewed-by: Alex Deucher <[email protected]>
Fix potential null-pointer dereference at probe by making sure that the
required endpoints are present.
The whiteheat driver assumes there are at least five pairs of bulk
endpoints, of which the final pair is used for the "command port". An
attempt to bind to an interface with fewer bulk endpoints would
currently lead to an oops.
Fixes CVE-2015-5257.
Reported-by: Moein Ghasemzadeh <[email protected]>
Cc: stable <[email protected]>
Signed-off-by: Johan Hovold <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
This patch adds stubs for the SCM functions exposed in the QCOM SCM API.
Signed-off-by: Andy Gross <[email protected]>
Acked-by: Russell King <[email protected]>
Acked-by: Bjorn Andersson <[email protected]>
The VBT MIPI Sequence Block version 3 has forward incompatible changes:
First, the block size in the header has been specified reserved, and the
actual size is a separate 32-bit value within the block. The current
find_section() function to will only look at the size in the block
header, and, depending on what's in that now reserved size field,
continue looking for other sections in the wrong place.
Fix this by taking the new block size field into account. This will
ensure that the lookups for other sections will work properly, as long
as the new 32-bit size does not go beyond the opregion VBT mailbox size.
Second, the contents of the block have been completely
changed. Gracefully refuse parsing the yet unknown data version.
Cc: Deepak M <[email protected]>
Cc: [email protected]
Reviewed-by: Deepak M <[email protected]>
Signed-off-by: Jani Nikula <[email protected]>
If we send a layoutreturn asynchronously before close, the close
might reach server first and layoutreturn would fail with BADSTATEID
because there is nothing keeping the layout stateid alive.
Also do not pretend sending layoutreturn if we are not.
Signed-off-by: Peng Tao <[email protected]>
Signed-off-by: Trond Myklebust <[email protected]>
Presently a lockdep warning is reported during creation of afu_err_buff
bin_attribute for the afu. This is caused due to the variable attr.key
not pointing to a static class key, hence the function lockdep_init_map
reports this warning:
BUG: key <some-address> not in .data!
The patch fixes this issue by calling sysfs_attr_init on the
attr_eb.attr structure before populating it with the afu_err_buff file
details. This will populate the attr.key variable with a static class
key so that lockdep_init_map stops complaining about the lockdep key not
being static.
Reported-by: Daniel Axtens <[email protected]>
Signed-off-by: Vaibhav Jain <[email protected]>
Acked-by: Ian Munsie <[email protected]>
Reviewed-by: Daniel Axtens <[email protected]>
Signed-off-by: Michael Ellerman <[email protected]>
This fixes the warnings like
"plane A assertion failure, should be disabled but not"
that on the initial modeset during boot. This can happen if
the primary plane is enabled by the firmware, but inheriting
it fails because the DMAR is active or for other reasons.
Most likely caused by
commit 36750f284b
Author: Maarten Lankhorst <[email protected]>
Date: Mon Jun 1 12:49:54 2015 +0200
drm/i915: update plane state during init
Reported-by: Andreas Reis <[email protected]>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91429
Reported-and-tested-by: Emil Renner Berthing <[email protected]>
Tested-by: Andreas Reis <[email protected]>
Reviewed-by: Daniel Vetter <[email protected]>
Signed-off-by: Jani Nikula <[email protected]>
User visible:
- Fix a segfault in 'perf probe' when removing uprobe events (Masami Hiramatsu)
- Synthesize COMM event for workloads started from the command line in 'perf
record' so that we can have the pid->comm mapping before we get the real
PERF_RECORD_COMM switching from perf to the workload (Namhyung Kim)
- Fix build tools/vm/ due to removal of tools/lib/api/fs/debugfs.h
(Arnaldo Carvalho de Melo)
Developer stuff:
- Fix the make tarball targets by including the recently added err.h header in
the perf MANIFEST file (Jiri Olsa)
- Don't assume that the event parser returns a non empty evlist (Wang Nan)
- Add way to disambiguate feature detection state files, needed to use
tools/build feature detection for multiple components in a single O= output
dir, which will be the case with tools/perf/ and tools/lib/bpf/
(Arnaldo Carvalho de Melo)
- Fixup FEATURE_{TESTS,DISPLAY} inversion in tools/lib/bpf/ (Arnaldo Carvalho de Melo)
Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJWAgaZAAoJENZQFvNTUqpAsZ0P/AuZ92BE6yHPd8VwEYnREAIn
PGO3rmW7+dy/rE7pDvKYkHkSAu86VVGCB8Kjbn+7mGssBBNnnC21BwdJQRi3c/If
Upyl4w7jUB6UooXoAAt4tQqSIZV2fq0esN6ss7D2zpblB6ZBZ/TAC9sNWdDq9Yav
fU+Wks5AMSQDNmj4l9/q3K5v2U5gUBginHyHKvnrOF6fMAN4ZZRAOlB5viisyt+P
dRDol95SCnhTaOHoM3Eko7uNlHyWUW7HhXN9N5ZaoXeBn/QI2gwAzBz4snFpJPDm
1Ua9t6Kx4sCNOcuHMVL4Jy2c/kyRSKWyWnb9PBv//m0HKAJyGp39/XIRkRD1ngQ2
NXESfP4ljhLvUeU6zL5/q6qyNHvpXLxsi1y/tftGGpPXmLbjHiuPq57gdMyvRyOQ
UbCGQl8aj/08jEPloCeoXk5cGin5iJA0wZg9JkT2kbSlklTGWYVaphy0Nlgn2Ojn
S/vOVqpSBNlq2afT4lBicZ91QFl3AIfCWUGutbnaDdvZ/inTRfjBJoLJyvXikSSC
p+FQDOXxbiUH0POc6A0VfYZWJzvXax9XA8H62EA47CQS4GD+CygmUUOD5Gwro0iX
v9uXWFootRzvgD5ElG6gg7hgZgO1hqOp1xd+STlyGsYuyKIzu7Nk9GqoXf4vYLIV
JWoEW0N+kypOx4quwne8
=6DJ/
-----END PGP SIGNATURE-----
Merge tag 'perf-core-for-mingo' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/core
Pull perf/core improvements and fixes from Arnaldo Carvalho de Melo:
User visible changes:
- Fix a segfault in 'perf probe' when removing uprobe events. (Masami Hiramatsu)
- Synthesize COMM event for workloads started from the command line in 'perf
record' so that we can have the pid->comm mapping before we get the real
PERF_RECORD_COMM switching from perf to the workload. (Namhyung Kim)
- Fix build tools/vm/ due to removal of tools/lib/api/fs/debugfs.h.
(Arnaldo Carvalho de Melo)
Infrastructure changes:
- Fix the make tarball targets by including the recently added err.h header in
the perf MANIFEST file. (Jiri Olsa)
- Don't assume that the event parser returns a non empty evlist. (Wang Nan)
- Add way to disambiguate feature detection state files, needed to use
tools/build feature detection for multiple components in a single O= output
dir, which will be the case with tools/perf/ and tools/lib/bpf/.
(Arnaldo Carvalho de Melo)
- Fixup FEATURE_{TESTS,DISPLAY} inversion in tools/lib/bpf/. (Arnaldo Carvalho de Melo)
Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
Signed-off-by: Ingo Molnar <[email protected]>
On HSW at least (still testing other platforms, but should be harmless
elsewhere), the DSL reg reads back as 0 when read around vblank start
time. This ends up confusing the atomic start/end checking code, since
it causes the update to appear as if it crossed a frame count boundary.
Avoid the problem by making sure we don't return scanline_offset from
the get_crtc_scanline function. In moving the code there, I add to add
an additional delay since it could be called and have a legitimate 0
result for some time (depending on the pixel clock).
v2: move hsw dsl read hack to get_crtc_scanline (Ville)
v3: use break instead of goto (Ville)
update comment with workaround details (Ville)
References: https://bugs.freedesktop.org/show_bug.cgi?id=91579
Signed-off-by: Jesse Barnes <[email protected]>
Reviewed-by: Ville Syrjälä <[email protected]>
Signed-off-by: Jani Nikula <[email protected]>
When perf creates a new child to profile, the events are enabled on
exec(). And in this case, it doesn't synthesize any event for the
child since they'll be generated during exec(). But there's an window
between the enabling and the event generation.
It used to be overcome since samples are only in kernel (so we always
have the map) and the comm is overridden by a later COMM event.
However it won't work if events are processed and displayed before the
COMM event overrides like in 'perf script'. This leads to those early
samples (like native_write_msr_safe) not having a comm but pid (like
':15328').
So it needs to synthesize COMM event for the child explicitly before
enabling so that it can have a correct comm. But at this time, the
comm will be "perf" since it's not exec-ed yet.
Committer note:
Before this patch:
# perf record usleep 1
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.017 MB perf.data (7 samples) ]
# perf script --show-task-events
:4429 4429 27909.079372: 1 cycles: ffffffff8105f45a native_write_msr_safe (/lib/modules/4.
:4429 4429 27909.079375: 1 cycles: ffffffff8105f45a native_write_msr_safe (/lib/modules/4.
:4429 4429 27909.079376: 10 cycles: ffffffff8105f45a native_write_msr_safe (/lib/modules/4.
:4429 4429 27909.079377: 223 cycles: ffffffff8105f45a native_write_msr_safe (/lib/modules/4.
:4429 4429 27909.079378: 6571 cycles: ffffffff8105f45a native_write_msr_safe (/lib/modules/4.
usleep 4429 27909.079380: PERF_RECORD_COMM exec: usleep:4429/4429
usleep 4429 27909.079381: 185403 cycles: ffffffff810a72d3 flush_signal_handlers (/lib/modules/4.
usleep 4429 27909.079444: 2241110 cycles: 7fc575355be3 _dl_start (/usr/lib64/ld-2.20.so)
usleep 4429 27909.079875: PERF_RECORD_EXIT(4429:4429):(4429:4429)
After:
# perf record usleep 1
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.017 MB perf.data (7 samples) ]
# perf script --show-task
perf 0 0.000000: PERF_RECORD_COMM: perf:8446/8446
perf 8446 30154.038944: 1 cycles: ffffffff8105f45a native_write_msr_safe (/lib/modules/4.
perf 8446 30154.038948: 1 cycles: ffffffff8105f45a native_write_msr_safe (/lib/modules/4.
perf 8446 30154.038949: 9 cycles: ffffffff8105f45a native_write_msr_safe (/lib/modules/4.
perf 8446 30154.038950: 230 cycles: ffffffff8105f45a native_write_msr_safe (/lib/modules/4.
perf 8446 30154.038951: 6772 cycles: ffffffff8105f45a native_write_msr_safe (/lib/modules/4.
usleep 8446 30154.038952: PERF_RECORD_COMM exec: usleep:8446/8446
usleep 8446 30154.038954: 196923 cycles: ffffffff81766440 _raw_spin_lock (/lib/modules/4.3.0-rc1
usleep 8446 30154.039021: 2292130 cycles: 7f609a173dc4 memcpy (/usr/lib64/ld-2.20.so)
usleep 8446 30154.039349: PERF_RECORD_EXIT(8446:8446):(8446:8446)
#
Signed-off-by: Namhyung Kim <[email protected]>
Tested-by: Arnaldo Carvalho de Melo <[email protected]>
Cc: David Ahern <[email protected]>
Cc: Jiri Olsa <[email protected]>
Cc: Peter Zijlstra <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
There were some changes in how this debugfs mounting helper is
implemented/exported and we forgot to check if there were other users
besides perf, fix it.
Need to do a make -C tools/ everytime we do changes to
tools/{lib,include} and other places where we're moving things from
tools/perf/ to be used by other tools/ living code.
Fixed:
$ make -C tools/vm
make: Entering directory '/home/git/linux/tools/vm'
make -C ../lib/api
make[1]: Entering directory '/home/git/linux/tools/lib/api'
CC fd/array.o
LD fd/libapi-in.o
CC fs/fs.o
CC fs/tracing_path.o
LD fs/libapi-in.o
CC cpu.o
LD libapi-in.o
AR libapi.a
make[1]: Leaving directory '/home/git/linux/tools/lib/api'
gcc -Wall -Wextra -I../lib/ -o page-types page-types.c ../lib/api/libapi.a
make: Leaving directory '/home/git/linux/tools/vm'
$
Reported-by: Vinson Lee <[email protected]>
Tested-by: Vinson Lee <[email protected]>
Cc: Steven Rostedt <[email protected]>
Cc: Jiri Olsa <[email protected]>
Cc: Matt Fleming <[email protected]>
Cc: Raphael Beamonte <[email protected]>
Cc: H. Peter Anvin <[email protected]>
Cc: Peter Zijlstra <[email protected]>
Cc: David Ahern <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Cc: Namhyung Kim <[email protected]>
Fixes: 60a1133a5b ("tools lib api fs: Remove debugfs, tracefs and findfs objects")
Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
The Marvell Egress rx trailer check must be fixed to
correctly detect bad bits in the third byte of the
Eggress trailer as described in the Table 28 of the
88E6060 datasheet.
The current code incorrectly omits to check the third
byte and checks the fourth byte twice.
Signed-off-by: Neil Armstrong <[email protected]>
Acked-by: Guenter Roeck <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
rhashtable_rehash_one() uses complex logic to update entry->next field,
after INIT_RHT_NULLS_HEAD and NULLS_MARKER expansion:
entry->next = 1 | ((base + off) << 1)
This can be compiled along the lines of:
entry->next = base + off
entry->next <<= 1
entry->next |= 1
Which will break concurrent readers.
NULLS value recomputation is not needed here, so just remove
the complex logic.
The data race was found with KernelThreadSanitizer (KTSAN).
Signed-off-by: Dmitry Vyukov <[email protected]>
Acked-by: Eric Dumazet <[email protected]>
Acked-by: Thomas Graf <[email protected]>
Acked-by: Herbert Xu <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
