--- /dev/null
+From 2420489bcb8910188578acc0c11c75445c2e4b92 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Mon, 14 Nov 2016 11:29:30 +0000
+Subject: drm/i915: Don't touch NULL sg on i915_gem_object_get_pages_gtt() error
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 2420489bcb8910188578acc0c11c75445c2e4b92 upstream.
+
+On the DMA mapping error path, sg may be NULL (it has already been
+marked as the last scatterlist entry), and we should avoid dereferencing
+it again.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Fixes: e227330223a7 ("drm/i915: avoid leaking DMA mappings")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Imre Deak <imre.deak@intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/20161114112930.2033-1-chris@chris-wilson.co.uk
+Reviewed-by: Matthew Auld <matthew.auld@intel.com>
+(cherry picked from commit b17993b7b29612369270567643bcff814f4b3d7f)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_gem.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -2540,7 +2540,7 @@ i915_gem_object_get_pages_gtt(struct drm
+ page = shmem_read_mapping_page(mapping, i);
+ if (IS_ERR(page)) {
+ ret = PTR_ERR(page);
+- goto err_pages;
++ goto err_sg;
+ }
+ }
+ #ifdef CONFIG_SWIOTLB
+@@ -2583,8 +2583,9 @@ i915_gem_object_get_pages_gtt(struct drm
+
+ return 0;
+
+-err_pages:
++err_sg:
+ sg_mark_end(sg);
++err_pages:
+ for_each_sgt_page(page, sgt_iter, st)
+ put_page(page);
+ sg_free_table(st);
--- /dev/null
+From e411072d5740a49cdc9d0713798c30440757e451 Mon Sep 17 00:00:00 2001
+From: Matthew Auld <matthew.auld@intel.com>
+Date: Mon, 28 Nov 2016 10:36:48 +0000
+Subject: drm/i915: drop the struct_mutex when wedged or trying to reset
+
+From: Matthew Auld <matthew.auld@intel.com>
+
+commit e411072d5740a49cdc9d0713798c30440757e451 upstream.
+
+We grab the struct_mutex in intel_crtc_page_flip, but if we are wedged
+or a reset is in progress we bail early but never seem to actually
+release the lock.
+
+Fixes: 7f1847ebf48b ("drm/i915: Simplify checking of GPU reset_counter in display pageflips")
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Matthew Auld <matthew.auld@intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/20161128103648.9235-1-matthew.auld@intel.com
+Reviewed-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+(cherry picked from commit ddbb271aea87fc6004d3c8bcdb0710e980c7ec85)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_display.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -11791,7 +11791,7 @@ static int intel_crtc_page_flip(struct d
+ intel_crtc->reset_counter = i915_reset_counter(&dev_priv->gpu_error);
+ if (__i915_reset_in_progress_or_wedged(intel_crtc->reset_counter)) {
+ ret = -EIO;
+- goto cleanup;
++ goto unlock;
+ }
+
+ atomic_inc(&intel_crtc->unpin_work_count);
+@@ -11877,6 +11877,7 @@ cleanup_pending:
+ if (!IS_ERR_OR_NULL(request))
+ i915_add_request_no_flush(request);
+ atomic_dec(&intel_crtc->unpin_work_count);
++unlock:
+ mutex_unlock(&dev->struct_mutex);
+ cleanup:
+ crtc->primary->fb = old_fb;
--- /dev/null
+From 8ca18eec2b2276b449c1dc86b98bf083c5fe4e09 Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <marc.zyngier@arm.com>
+Date: Wed, 23 Nov 2016 10:11:21 +0000
+Subject: KVM: arm/arm64: vgic: Don't notify EOI for non-SPIs
+
+From: Marc Zyngier <marc.zyngier@arm.com>
+
+commit 8ca18eec2b2276b449c1dc86b98bf083c5fe4e09 upstream.
+
+When we inject a level triggerered interrupt (and unless it
+is backed by the physical distributor - timer style), we request
+a maintenance interrupt. Part of the processing for that interrupt
+is to feed to the rest of KVM (and to the eventfd subsystem) the
+information that the interrupt has been EOIed.
+
+But that notification only makes sense for SPIs, and not PPIs
+(such as the PMU interrupt). Skip over the notification if
+the interrupt is not an SPI.
+
+Fixes: 140b086dd197 ("KVM: arm/arm64: vgic-new: Add GICv2 world switch backend")
+Fixes: 59529f69f504 ("KVM: arm/arm64: vgic-new: Add GICv3 world switch backend")
+Reported-by: Catalin Marinas <catalin.marinas@arm.com>
+Tested-by: Catalin Marinas <catalin.marinas@arm.com>
+Acked-by: Christoffer Dall <christoffer.dall@linaro.org>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ virt/kvm/arm/vgic/vgic-v2.c | 6 ++++--
+ virt/kvm/arm/vgic/vgic-v3.c | 6 ++++--
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+--- a/virt/kvm/arm/vgic/vgic-v2.c
++++ b/virt/kvm/arm/vgic/vgic-v2.c
+@@ -50,8 +50,10 @@ void vgic_v2_process_maintenance(struct
+
+ WARN_ON(cpuif->vgic_lr[lr] & GICH_LR_STATE);
+
+- kvm_notify_acked_irq(vcpu->kvm, 0,
+- intid - VGIC_NR_PRIVATE_IRQS);
++ /* Only SPIs require notification */
++ if (vgic_valid_spi(vcpu->kvm, intid))
++ kvm_notify_acked_irq(vcpu->kvm, 0,
++ intid - VGIC_NR_PRIVATE_IRQS);
+ }
+ }
+
+--- a/virt/kvm/arm/vgic/vgic-v3.c
++++ b/virt/kvm/arm/vgic/vgic-v3.c
+@@ -41,8 +41,10 @@ void vgic_v3_process_maintenance(struct
+
+ WARN_ON(cpuif->vgic_lr[lr] & ICH_LR_STATE);
+
+- kvm_notify_acked_irq(vcpu->kvm, 0,
+- intid - VGIC_NR_PRIVATE_IRQS);
++ /* Only SPIs require notification */
++ if (vgic_valid_spi(vcpu->kvm, intid))
++ kvm_notify_acked_irq(vcpu->kvm, 0,
++ intid - VGIC_NR_PRIVATE_IRQS);
+ }
+
+ /*
mm-workingset-fix-null-ptr-in-count_shadow_nodes.patch
pci-set-read-completion-boundary-to-128-iff-root-port-supports-it-_hpx.patch
mwifiex-printk-overflow-with-32-byte-ssids.patch
+kvm-arm-arm64-vgic-don-t-notify-eoi-for-non-spis.patch
+drm-i915-don-t-touch-null-sg-on-i915_gem_object_get_pages_gtt-error.patch
+drm-i915-drop-the-struct_mutex-when-wedged-or-trying-to-reset.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
