The plane reset handler frees the plane state and allocates a new
default state, but when doing so attempt to free the plane state using
the base plane state pointer instead of casting it to the
driver-specific state object that has been allocated. Fix it by using
the omap_plane_atomic_destroy_state() function to destroy the plane
state instead of duplicating the code.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
[tomi.valkeinen@ti.com: move of the func into separate patch]
Signed-off-by: NTomi Valkeinen <tomi.valkeinen@ti.com>

Move omap_plane_reset() function to avoid forward declarations in the
next patch.
Signed-off-by: NTomi Valkeinen <tomi.valkeinen@ti.com>

These new helpers simplify implementing multi-driver modules and
properly handle failure to register one driver by unregistering all
previously registered drivers.
Signed-off-by: NThierry Reding <treding@nvidia.com>
Signed-off-by: NTomi Valkeinen <tomi.valkeinen@ti.com>

omap_dmm_tiler.c can't be compiled as a module and it is built
unconditionally as part of omapdrm. Since it can't be used as a module,
there is no need for it to have an unused MODULE_ALIAS().
Signed-off-by: NLuis de Bethencourt <luisbg@osg.samsung.com>
Signed-off-by: NTomi Valkeinen <tomi.valkeinen@ti.com>

Fixes: a67719d1 ("drm/rockchip: vop: spilt register related into rockchip_reg_vop.c")
Signed-off-by: NStephen Rothwell <sfr@canb.auug.org.au>
Acked-by: NMark Yao <mark.yao@rock-chips.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

Merge branch 'drm-rockchip-next-2015-12-28' of https://github.com/markyzq/kernel-drm-rockchip into drm-next

These patches convert drm/rockchip to atomic API and add rk3036 vop support.

* 'drm-rockchip-next-2015-12-28' of https://github.com/markyzq/kernel-drm-rockchip:
  dt-bindings: add document for rk3036-vop
  drm/rockchip: vop: add rk3036 vop support
  drm/rockchip: vop: spilt scale regsters
  drm/rockchip: vop: spilt register related into rockchip_reg_vop.c
  drm/rockchip: vop: move interrupt registers into vop_data
  drm/rockchip: vop: merge vop cfg_done into vop_data
  drm/rockchip: dw_hdmi: use encoder enable function
  drm: bridge/dw_hdmi: add atomic API support
  drm/rockchip: direct config connecter gate and out_mode
  drm/rockchip: support atomic asynchronous commit
  drm/rockchip: Optimization vop mode set
  drm/rockchip: Convert to support atomic API
  drm/rockchip: vop: replace dpms with enable/disable
  drm/rockchip: Use new vblank api drm_crtc_vblank_*

Cc: Rob Herring <robh+dt@kernel.org>
Cc: Pawel Moll <pawel.moll@arm.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Ian Campbell <ijc+devicetree@hellion.org.uk>
Cc: Kumar Gala <galak@codeaurora.org>
Cc: devicetree@vger.kernel.org
Signed-off-by: NMark Yao <mark.yao@rock-chips.com>
Acked-by: NRob Herring <robh@kernel.org>

RK3036 registers layout is quite difference with rk3288 layout,
The IC design with different framework, rk3036 vop is VOP LITE,
and rk3288 is VOP FULL.

RK3036 support two overlay plane and one hwc plane, max output
resolution is 1080p. it support IOMMU, and its IOMMU same as
rk3288's.
Signed-off-by: NMark Yao <mark.yao@rock-chips.com>

There are two version scale control register found on vop,
scale full version found on rk3288, support extension registers.
and scale little version found on rk3036, only support common scale.
Signed-off-by: NMark Yao <mark.yao@rock-chips.com>

No functional updates. Spilt register related into another file
would be nice to multi vop driver,
Signed-off-by: NMark Yao <mark.yao@rock-chips.com>

Move interrupt registers into vop_data, so it can use at multi-vop driver
Signed-off-by: NMark Yao <mark.yao@rock-chips.com>

Move cfg_done register into vop_data, so it can use at multi-vop driver
Signed-off-by: NMark Yao <mark.yao@rock-chips.com>

encoder.enable is more compatible to atomic api than encoder.prepare/commit
Signed-off-by: NMark Yao <mark.yao@rock-chips.com>

Fill atomic needed funcs with default atomic helper library.

Rockchip use dw_hdmi, and drm/rockchip will covert to atomic api,
we need dw_hdmi support atomic funcs.

Now another drm driver use dw_hdmi is imx, not yet atomic, so
check DRIVER_ATOMIC at runtime to spilt atomic and not atomic.
Signed-off-by: NMark Yao <mark.yao@rock-chips.com>

Both connecter gate and out_mode are not conflict with mode set
configure. Direct setting connecter gate and out_mode, that allow
connector do rockchip_drm_crtc_mode_config after mode set.
Signed-off-by: NMark Yao <mark.yao@rock-chips.com>

If drm core requests a async commit, rockchip_drm_atomic_commit
will schedule a work task to update later.
Signed-off-by: NMark Yao <mark.yao@rock-chips.com>

Rk3288 vop timing registers is immediately register, when configure
timing on display active time, will cause tearing. use dclk reset is
not a good idea to avoid this tearing. we can avoid tearing by using
standby register.

Vop standby register will take effect at end of current frame, and
go back to work immediately when exit standby.

So we can use standby register to protect this context.
Signed-off-by: NMark Yao <mark.yao@rock-chips.com>

Rockchip vop not support hw vblank counter, needed check the committed
register if it's really take effect.
Signed-off-by: NMark Yao <mark.yao@rock-chips.com>

For vop, power by enable/disable is more suitable then legacy dpms
function, and enable/disable more closely to the new atomic API.
Signed-off-by: NMark Yao <mark.yao@rock-chips.com>

No functional update, drm_vblank_* is the legacy version of
drm_crtc_vblank_*. and use new api make driver more clean.
Signed-off-by: NMark Yao <mark.yao@rock-chips.com>

This merges '5b726e06' into drm-next

Just to resolve some merges to make Daniel's life easier.
Signed-off-by: NDAve Airlie <airlied@redhat.com>

Pull i915 drm fixes from Jani Nikula:
 "Here's a batch of i915 fixes all around.  It may be slightly bigger
  than one would hope for at this stage, but they've all been through
  testing in our -next before being picked up for v4.4.  Also, I missed
  Dave's fixes pull earlier today just because I wanted an extra testing
  round on this.  So I'm fairly confident.

  Wishing you all the things it is customary to wish this time of the
  year"

* tag 'drm-intel-fixes-2015-12-23' of git://anongit.freedesktop.org/drm-intel:
  drm/i915: Correct max delay for HDMI hotplug live status checking
  drm/i915: mdelay(10) considered harmful
  drm/i915: Kill intel_crtc->cursor_bo
  drm/i915: Workaround CHV pipe C cursor fail
  drm/i915: Only spin whilst waiting on the current request
  drm/i915: Limit the busy wait on requests to 5us not 10ms!
  drm/i915: Break busywaiting for requests on pending signals
  drm/i915: Disable primary plane if we fail to reconstruct BIOS fb (v2)
  drm/i915: Set the map-and-fenceable flag for preallocated objects
  drm/i915: Drop the broken cursor base==0 special casing

Pull drm fixes from Dave Airlie:
 "Not much happening, should have dequeued this lot earlier.

  One amdgpu, one nouveau and one exynos fix"

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  drm/exynos: atomic check only enabled crtc states
  drm/nouveau/bios/fan: hardcode the fan mode to linear
  drm/amdgpu: fix user fence handling

- fix atomic watermark recomputation logic (Maarten)
- modeset sequence fixes for LPT (Ville)
- more kbl enabling&prep work (Rodrigo, Wayne)
- first bits for mst audio
- page dirty tracking fixes from Dave Gordon
- new get_eld hook from Takashi, also included in the sound tree
- fixup cursor handling when placed at address 0 (Ville)
- refactor VBT parsing code (Jani)
- rpm wakelock debug infrastructure ( Imre)
- fbdev is pinned again (Chris)
- tune the busywait logic to avoid wasting cpu cycles (Chris)

* tag 'drm-intel-next-2015-12-18' of git://anongit.freedesktop.org/drm-intel: (81 commits)
  drm/i915: Update DRIVER_DATE to 20151218
  drm/i915/skl: Default to noncoherent access up to F0
  drm/i915: Only spin whilst waiting on the current request
  drm/i915: Limit the busy wait on requests to 5us not 10ms!
  drm/i915: Break busywaiting for requests on pending signals
  drm/i915: don't enable autosuspend on platforms without RPM support
  drm/i915/backlight: prefer dev_priv over dev pointer
  drm/i915: Disable primary plane if we fail to reconstruct BIOS fb (v2)
  drm/i915: Pin the ifbdev for the info->system_base GGTT mmapping
  drm/i915: Set the map-and-fenceable flag for preallocated objects
  drm/i915: mdelay(10) considered harmful
  drm/i915: check that we are in an RPM atomic section in GGTT PTE updaters
  drm/i915: add support for checking RPM atomic sections
  drm/i915: check that we hold an RPM wakelock ref before we put it
  drm/i915: add support for checking if we hold an RPM reference
  drm/i915: use assert_rpm_wakelock_held instead of opencoding it
  drm/i915: add assert_rpm_wakelock_held helper
  drm/i915: remove HAS_RUNTIME_PM check from RPM get/put/assert helpers
  drm/i915: get a permanent RPM reference on platforms w/o RPM support
  drm/i915: refactor RPM disabling due to RC6 being disabled
  ...

[airlied: fixup build problems on arm - added errno.h include]
* 'drm-next-4.5' of git://people.freedesktop.org/~agd5f/linux: (152 commits)
  amd/powerplay: fix copy paste typo in hardwaremanager.c
  amd/powerplay: disable powerplay by default initially
  amd/powerplay: don't enable ucode fan control if vbios has no fan table
  drm/amd/powerplay: show gpu load when print gpu performance for Cz. (v2)
  drm/amd/powerplay: check whether need to enable thermal control. (v2)
  drm/amd/powerplay: add point check to avoid NULL point hang.
  drm/amdgpu/powerplay: Program a calculated value as Deep Sleep clock.
  drm/amd/powerplay: Don't return an error if fan table is missing
  drm/powerplay/hwmgr: log errors in tonga_hwmgr_backend_init
  drm/powerplay: add debugging output to processpptables.c
  drm/powerplay: add debugging output to tonga_processpptables.c
  amd/powerplay: Add structures required to report configuration change
  amd/powerplay: Fix get dal power level
  amd\powerplay Implement get dal power level
  drm/amd/powerplay: display gpu load when print performance for tonga.
  drm/amdgpu/powerplay: enable sysfs and debugfs interfaces late
  drm/amd/powerplay: move shared function of vi to hwmgr. (v2)
  drm/amd/powerplay: check whether enable dpm in powerplay.
  drm/amd/powerplay: fix bug that dpm funcs in debugfs/sysfs missing.
  drm/amd/powerplay: fix boolreturn.cocci warnings
  ...

Pull block layer fixes from Jens Axboe:
 "Three small fixes for 4.4 final. Specifically:

   - The segment issue fix from Junichi, where the old IO path does a
     bio limit split before potentially bouncing the pages.  We need to
     do that in the right order, to ensure that limitations are met.

   - A NVMe surprise removal IO hang fix from Keith.

   - A use-after-free in null_blk, introduced by a previous patch in
     this series.  From Mike Krinkin"

* 'for-linus' of git://git.kernel.dk/linux-block:
  null_blk: fix use-after-free error
  block: ensure to split after potentially bouncing a bio
  NVMe: IO ending fixes on surprise removal

Pull nfsd fix from Bruce Fields:
 "Just one fix for a NFSv4 callback bug introduced in 4.4"

* tag 'nfsd-4.4-1' of git://linux-nfs.org/~bfields/linux:
  nfsd: don't hold ls_mutex across a layout recall

Pull kvm fixes from Paolo Bonzini:

 - A series of fixes to the MTRR emulation, tested in the BZ by several
   users so they should be safe this late

 - A fix for a division by zero

 - Two very simple ARM and PPC fixes

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: x86: Reload pit counters for all channels when restoring state
  KVM: MTRR: treat memory as writeback if MTRR is disabled in guest CPUID
  KVM: MTRR: observe maxphyaddr from guest CPUID, not host
  KVM: MTRR: fix fixed MTRR segment look up
  KVM: VMX: Fix host initiated access to guest MSR_TSC_AUX
  KVM: arm/arm64: vgic: Fix kvm_vgic_map_is_active's dist check
  kvm: x86: move tracepoints outside extended quiescent state
  KVM: PPC: Book3S HV: Prohibit setting illegal transaction state in MSR

Pull s390 fixes from Martin Schwidefsky:
 "Two late bug fixes for kernel 4.4.

  Merry Christmas"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/dis: Fix handling of format specifiers
  s390/zcrypt: Fix AP queue handling if queue is full

Pull virtio fix from Michael Tsirkin:
 "This includes a single fix for virtio ccw error handling"

* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
  virtio/s390: handle error values in irb

Fix a pointer cast typo introduced in v4.4-rc5 especially visible for
the i386 subarchitecture where it results in a kernel crash.

[ Also removed pointless cast as per Al Viro - Linus ]

Fixes: 8090bfd2 ("um: Fix fpstate handling")
Signed-off-by: NMickaël Salaün <mic@digikod.net>
Cc: Jeff Dike <jdike@addtoit.com>
Acked-by: NRichard Weinberger <richard@nod.at>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

These changes from Liviu add support for atomic mode setting, add the
TMDS clock limitation according to the device, and ensure that we
correctly clean up in the unbind function.

* 'drm-tda998x-devel' of git://ftp.arm.linux.org.uk/~rmk/linux-arm:
  drm/i2c: tda998x: Add support for atomic modesetting
  drm/i2c: tda998x: increase the supported dotclock frequency to 165MHz for TDA19988
  drm/i2c: tda998x: unregister the connector in the unbind function

These are the patches from Daniel Vetter, getting rid of struct_mutex
from the Armada DRM driver.

* 'drm-armada-devel' of git://ftp.arm.linux.org.uk/~rmk/linux-arm:
  drm/armada: use a private mutex to protect priv->linear
  drm/armada: drop struct_mutex from cursor paths
  drm/armada: don't grab dev->struct_mutex for in mmap offset ioctl
  drm/armada: plug leak in dumb_map_offset
  drm/armada: use unlocked gem unreferencing

blk_end_request_all may free request, so we need to save
request_queue pointer before blk_end_request_all call.

The problem was introduced in commit cf8ecc5a
("null_blk: guarantee device restart in all irq modes")
and causes general protection fault with slab poisoning
enabled.

Fixes: cf8ecc5a ("null_blk: guarantee device
       restart in all irq modes")
Signed-off-by: NMike Krinkin <krinkin.m.u@gmail.com>
Reviewed-by: NMing Lei <tom.leiming@gmail.com>
Signed-off-by: NJens Axboe <axboe@fb.com>

blk_queue_bio() does split then bounce, which makes the segment
counting based on pages before bouncing and could go wrong. Move
the split to after bouncing, like we do for blk-mq, and the we
fix the issue of having the bio count for segments be wrong.

Fixes: 54efd50b ("block: make generic_make_request handle arbitrarily sized bios")
Cc: stable@vger.kernel.org
Tested-by: NArtem S. Tashkinov <t.artem@lycos.com>
Signed-off-by: NJens Axboe <axboe@fb.com>

This patch fixes a lost request discovered during IO + hot removal.

The driver's pci removal deletes gendisks prior to shutting down the
controller to allow dirty data to sync. Dirty data can not be synced on
a surprise removal, though, and would potentially block indefinitely.

The driver previously had marked the queue as dying in this scenario
to prevent new requests from attempting, however it will still block
for requests that already entered the queue. This patch fixes this by
quiescing IO first, then aborting the requeued requests before deleting
disks.
Reported-by: NSujith Pandel <sujith_pandel@dell.com>
Signed-off-by: NKeith Busch <keith.busch@intel.com>
Tested-by: NSujith Pandel <sujith_pandel@dell.com>
Signed-off-by: NJens Axboe <axboe@fb.com>

Currently if userspace restores the pit counters with a count of 0
on channels 1 or 2 and the guest attempts to read the count on those
channels, then KVM will perform a mod of 0 and crash.  This will ensure
that 0 values are converted to 65536 as per the spec.

This is CVE-2015-7513.
Signed-off-by: NAndy Honig <ahonig@google.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Virtual machines can be run with CPUID such that there are no MTRRs.
In that case, the firmware will never enable MTRRs and it is obviously
undesirable to run the guest entirely with UC memory.  Check out guest
CPUID, and use WB memory if MTRR do not exist.

Cc: qemu-stable@nongnu.org
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=107561Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Conversion of MTRRs to ranges used the maxphyaddr from the boot CPU.
This is wrong, because var_mtrr_range's mask variable then is discontiguous
(like FF00FFFF000, where the first run of 0s corresponds to the bits
between host and guest maxphyaddr).  Instead always set up the masks
to be full 64-bit values---we know that the reserved bits at the top
are zero, and we can restore them when reading the MSR.  This way
var_mtrr_range gets a mask that just works.

Fixes: a13842dc
Cc: qemu-stable@nongnu.org
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=107561Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This fixes the slow-down of VM running with pci-passthrough, since some MTRR
range changed from MTRR_TYPE_WRBACK to MTRR_TYPE_UNCACHABLE.  Memory in the
0K-640K range was incorrectly treated as uncacheable.

Fixes: f7bfb57b
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=107561
Cc: qemu-stable@nongnu.org
Signed-off-by: NAlexis Dambricourt <alexis.dambricourt@gmail.com>
[Use correct BZ for "Fixes" annotation.  - Paolo]
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>