--- /dev/null
+From 1fc2e41f7af4572b07190f9dec28396b418e9a36 Mon Sep 17 00:00:00 2001
+From: Alexander Tsoy <alexander@tsoy.me>
+Date: Mon, 22 May 2017 20:58:11 +0300
+Subject: ALSA: hda - apply STAC_9200_DELL_M22 quirk for Dell Latitude D430
+
+From: Alexander Tsoy <alexander@tsoy.me>
+
+commit 1fc2e41f7af4572b07190f9dec28396b418e9a36 upstream.
+
+This model is actually called 92XXM2-8 in Windows driver. But since pin
+configs for M22 and M28 are identical, just reuse M22 quirk.
+
+Fixes external microphone (tested) and probably docking station ports
+(not tested).
+
+Signed-off-by: Alexander Tsoy <alexander@tsoy.me>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -1537,6 +1537,8 @@ static const struct snd_pci_quirk stac92
+ "Dell Inspiron 1501", STAC_9200_DELL_M26),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01f6,
+ "unknown Dell", STAC_9200_DELL_M26),
++ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0201,
++ "Dell Latitude D430", STAC_9200_DELL_M22),
+ /* Panasonic */
+ SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-74", STAC_9200_PANASONIC),
+ /* Gateway machines needs EAPD to be set on resume */
--- /dev/null
+From 82bc9a42cf854fdf63155759c0aa790bd1f361b0 Mon Sep 17 00:00:00 2001
+From: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Date: Tue, 18 Apr 2017 13:43:32 +0200
+Subject: drm/gma500/psb: Actually use VBT mode when it is found
+
+From: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+
+commit 82bc9a42cf854fdf63155759c0aa790bd1f361b0 upstream.
+
+With LVDS we were incorrectly picking the pre-programmed mode instead of
+the prefered mode provided by VBT. Make sure we pick the VBT mode if
+one is provided. It is likely that the mode read-out code is still wrong
+but this patch fixes the immediate problem on most machines.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=78562
+Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/20170418114332.12183-1-patrik.r.jakobsson@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/gma500/psb_intel_lvds.c | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/gma500/psb_intel_lvds.c
++++ b/drivers/gpu/drm/gma500/psb_intel_lvds.c
+@@ -783,20 +783,23 @@ void psb_intel_lvds_init(struct drm_devi
+ if (scan->type & DRM_MODE_TYPE_PREFERRED) {
+ mode_dev->panel_fixed_mode =
+ drm_mode_duplicate(dev, scan);
++ DRM_DEBUG_KMS("Using mode from DDC\n");
+ goto out; /* FIXME: check for quirks */
+ }
+ }
+
+ /* Failed to get EDID, what about VBT? do we need this? */
+- if (mode_dev->vbt_mode)
++ if (dev_priv->lfp_lvds_vbt_mode) {
+ mode_dev->panel_fixed_mode =
+- drm_mode_duplicate(dev, mode_dev->vbt_mode);
++ drm_mode_duplicate(dev, dev_priv->lfp_lvds_vbt_mode);
+
+- if (!mode_dev->panel_fixed_mode)
+- if (dev_priv->lfp_lvds_vbt_mode)
+- mode_dev->panel_fixed_mode =
+- drm_mode_duplicate(dev,
+- dev_priv->lfp_lvds_vbt_mode);
++ if (mode_dev->panel_fixed_mode) {
++ mode_dev->panel_fixed_mode->type |=
++ DRM_MODE_TYPE_PREFERRED;
++ DRM_DEBUG_KMS("Using mode from VBT\n");
++ goto out;
++ }
++ }
+
+ /*
+ * If we didn't get EDID, try checking if the panel is already turned
+@@ -813,6 +816,7 @@ void psb_intel_lvds_init(struct drm_devi
+ if (mode_dev->panel_fixed_mode) {
+ mode_dev->panel_fixed_mode->type |=
+ DRM_MODE_TYPE_PREFERRED;
++ DRM_DEBUG_KMS("Using pre-programmed mode\n");
+ goto out; /* FIXME: check for quirks */
+ }
+ }
--- /dev/null
+From 58d7e3e427db1bd68f33025519a9468140280a75 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Thu, 11 May 2017 13:14:14 -0400
+Subject: drm/radeon/ci: disable mclk switching for high refresh rates (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 58d7e3e427db1bd68f33025519a9468140280a75 upstream.
+
+Even if the vblank period would allow it, it still seems to
+be problematic on some cards.
+
+v2: fix logic inversion (Nils)
+
+bug: https://bugs.freedesktop.org/show_bug.cgi?id=96868
+
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/ci_dpm.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/ci_dpm.c
++++ b/drivers/gpu/drm/radeon/ci_dpm.c
+@@ -776,6 +776,12 @@ bool ci_dpm_vblank_too_short(struct rade
+ u32 vblank_time = r600_dpm_get_vblank_time(rdev);
+ u32 switch_limit = pi->mem_gddr5 ? 450 : 300;
+
++ /* disable mclk switching if the refresh is >120Hz, even if the
++ * blanking period would allow it
++ */
++ if (r600_dpm_get_vrefresh(rdev) > 120)
++ return true;
++
+ if (vblank_time < switch_limit)
+ return true;
+ else
--- /dev/null
+From 3d18e33735a02b1a90aecf14410bf3edbfd4d3dc Mon Sep 17 00:00:00 2001
+From: Lyude <lyude@redhat.com>
+Date: Thu, 11 May 2017 19:31:12 -0400
+Subject: drm/radeon: Unbreak HPD handling for r600+
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lyude <lyude@redhat.com>
+
+commit 3d18e33735a02b1a90aecf14410bf3edbfd4d3dc upstream.
+
+We end up reading the interrupt register for HPD5, and then writing it
+to HPD6 which on systems without anything using HPD5 results in
+permanently disabling hotplug on one of the display outputs after the
+first time we acknowledge a hotplug interrupt from the GPU.
+
+This code is really bad. But for now, let's just fix this. I will
+hopefully have a large patch series to refactor all of this soon.
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Lyude <lyude@redhat.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/cik.c | 4 ++--
+ drivers/gpu/drm/radeon/evergreen.c | 4 ++--
+ drivers/gpu/drm/radeon/r600.c | 2 +-
+ drivers/gpu/drm/radeon/si.c | 4 ++--
+ 4 files changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -7762,7 +7762,7 @@ static inline void cik_irq_ack(struct ra
+ WREG32(DC_HPD5_INT_CONTROL, tmp);
+ }
+ if (rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_INTERRUPT) {
+- tmp = RREG32(DC_HPD5_INT_CONTROL);
++ tmp = RREG32(DC_HPD6_INT_CONTROL);
+ tmp |= DC_HPDx_INT_ACK;
+ WREG32(DC_HPD6_INT_CONTROL, tmp);
+ }
+@@ -7792,7 +7792,7 @@ static inline void cik_irq_ack(struct ra
+ WREG32(DC_HPD5_INT_CONTROL, tmp);
+ }
+ if (rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) {
+- tmp = RREG32(DC_HPD5_INT_CONTROL);
++ tmp = RREG32(DC_HPD6_INT_CONTROL);
+ tmp |= DC_HPDx_RX_INT_ACK;
+ WREG32(DC_HPD6_INT_CONTROL, tmp);
+ }
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -4924,7 +4924,7 @@ static void evergreen_irq_ack(struct rad
+ WREG32(DC_HPD5_INT_CONTROL, tmp);
+ }
+ if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT) {
+- tmp = RREG32(DC_HPD5_INT_CONTROL);
++ tmp = RREG32(DC_HPD6_INT_CONTROL);
+ tmp |= DC_HPDx_INT_ACK;
+ WREG32(DC_HPD6_INT_CONTROL, tmp);
+ }
+@@ -4955,7 +4955,7 @@ static void evergreen_irq_ack(struct rad
+ WREG32(DC_HPD5_INT_CONTROL, tmp);
+ }
+ if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) {
+- tmp = RREG32(DC_HPD5_INT_CONTROL);
++ tmp = RREG32(DC_HPD6_INT_CONTROL);
+ tmp |= DC_HPDx_RX_INT_ACK;
+ WREG32(DC_HPD6_INT_CONTROL, tmp);
+ }
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -3945,7 +3945,7 @@ static void r600_irq_ack(struct radeon_d
+ WREG32(DC_HPD5_INT_CONTROL, tmp);
+ }
+ if (rdev->irq.stat_regs.r600.disp_int_cont2 & DC_HPD6_INTERRUPT) {
+- tmp = RREG32(DC_HPD5_INT_CONTROL);
++ tmp = RREG32(DC_HPD6_INT_CONTROL);
+ tmp |= DC_HPDx_INT_ACK;
+ WREG32(DC_HPD6_INT_CONTROL, tmp);
+ }
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -6335,7 +6335,7 @@ static inline void si_irq_ack(struct rad
+ WREG32(DC_HPD5_INT_CONTROL, tmp);
+ }
+ if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT) {
+- tmp = RREG32(DC_HPD5_INT_CONTROL);
++ tmp = RREG32(DC_HPD6_INT_CONTROL);
+ tmp |= DC_HPDx_INT_ACK;
+ WREG32(DC_HPD6_INT_CONTROL, tmp);
+ }
+@@ -6366,7 +6366,7 @@ static inline void si_irq_ack(struct rad
+ WREG32(DC_HPD5_INT_CONTROL, tmp);
+ }
+ if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) {
+- tmp = RREG32(DC_HPD5_INT_CONTROL);
++ tmp = RREG32(DC_HPD6_INT_CONTROL);
+ tmp |= DC_HPDx_RX_INT_ACK;
+ WREG32(DC_HPD6_INT_CONTROL, tmp);
+ }
--- /dev/null
+From 2ac97f0f6654da14312d125005c77a6010e0ea38 Mon Sep 17 00:00:00 2001
+From: Jason Gerecke <killertofu@gmail.com>
+Date: Tue, 25 Apr 2017 11:29:56 -0700
+Subject: HID: wacom: Have wacom_tpc_irq guard against possible NULL dereference
+
+From: Jason Gerecke <killertofu@gmail.com>
+
+commit 2ac97f0f6654da14312d125005c77a6010e0ea38 upstream.
+
+The following Smatch complaint was generated in response to commit
+2a6cdbd ("HID: wacom: Introduce new 'touch_input' device"):
+
+ drivers/hid/wacom_wac.c:1586 wacom_tpc_irq()
+ error: we previously assumed 'wacom->touch_input' could be null (see line 1577)
+
+The 'touch_input' and 'pen_input' variables point to the 'struct input_dev'
+used for relaying touch and pen events to userspace, respectively. If a
+device does not have a touch interface or pen interface, the associated
+input variable is NULL. The 'wacom_tpc_irq()' function is responsible for
+forwarding input reports to a more-specific IRQ handler function. An
+unknown report could theoretically be mistaken as e.g. a touch report
+on a device which does not have a touch interface. This can be prevented
+by only calling the pen/touch functions are called when the pen/touch
+pointers are valid.
+
+Fixes: 2a6cdbd ("HID: wacom: Introduce new 'touch_input' device")
+Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
+Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/wacom_wac.c | 47 ++++++++++++++++++++++++-----------------------
+ 1 file changed, 24 insertions(+), 23 deletions(-)
+
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -1440,37 +1440,38 @@ static int wacom_tpc_irq(struct wacom_wa
+ {
+ unsigned char *data = wacom->data;
+
+- if (wacom->pen_input)
++ if (wacom->pen_input) {
+ dev_dbg(wacom->pen_input->dev.parent,
+ "%s: received report #%d\n", __func__, data[0]);
+- else if (wacom->touch_input)
++
++ if (len == WACOM_PKGLEN_PENABLED ||
++ data[0] == WACOM_REPORT_PENABLED)
++ return wacom_tpc_pen(wacom);
++ }
++ else if (wacom->touch_input) {
+ dev_dbg(wacom->touch_input->dev.parent,
+ "%s: received report #%d\n", __func__, data[0]);
+
+- switch (len) {
+- case WACOM_PKGLEN_TPC1FG:
+- return wacom_tpc_single_touch(wacom, len);
+-
+- case WACOM_PKGLEN_TPC2FG:
+- return wacom_tpc_mt_touch(wacom);
+-
+- case WACOM_PKGLEN_PENABLED:
+- return wacom_tpc_pen(wacom);
+-
+- default:
+- switch (data[0]) {
+- case WACOM_REPORT_TPC1FG:
+- case WACOM_REPORT_TPCHID:
+- case WACOM_REPORT_TPCST:
+- case WACOM_REPORT_TPC1FGE:
++ switch (len) {
++ case WACOM_PKGLEN_TPC1FG:
+ return wacom_tpc_single_touch(wacom, len);
+
+- case WACOM_REPORT_TPCMT:
+- case WACOM_REPORT_TPCMT2:
+- return wacom_mt_touch(wacom);
++ case WACOM_PKGLEN_TPC2FG:
++ return wacom_tpc_mt_touch(wacom);
+
+- case WACOM_REPORT_PENABLED:
+- return wacom_tpc_pen(wacom);
++ default:
++ switch (data[0]) {
++ case WACOM_REPORT_TPC1FG:
++ case WACOM_REPORT_TPCHID:
++ case WACOM_REPORT_TPCST:
++ case WACOM_REPORT_TPC1FGE:
++ return wacom_tpc_single_touch(wacom, len);
++
++ case WACOM_REPORT_TPCMT:
++ case WACOM_REPORT_TPCMT2:
++ return wacom_mt_touch(wacom);
++
++ }
+ }
+ }
+
--- /dev/null
+From ff5a20169b98d84ad8d7f99f27c5ebbb008204d6 Mon Sep 17 00:00:00 2001
+From: Nicolas Iooss <nicolas.iooss_linux@m4x.org>
+Date: Fri, 2 Jun 2017 14:46:28 -0700
+Subject: pcmcia: remove left-over %Z format
+
+From: Nicolas Iooss <nicolas.iooss_linux@m4x.org>
+
+commit ff5a20169b98d84ad8d7f99f27c5ebbb008204d6 upstream.
+
+Commit 5b5e0928f742 ("lib/vsprintf.c: remove %Z support") removed some
+usages of format %Z but forgot "%.2Zx". This makes clang 4.0 reports a
+-Wformat-extra-args warning because it does not know about %Z.
+
+Replace %Z with %z.
+
+Link: http://lkml.kernel.org/r/20170520090946.22562-1-nicolas.iooss_linux@m4x.org
+Signed-off-by: Nicolas Iooss <nicolas.iooss_linux@m4x.org>
+Cc: Harald Welte <laforge@gnumonks.org>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/pcmcia/cm4040_cs.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/char/pcmcia/cm4040_cs.c
++++ b/drivers/char/pcmcia/cm4040_cs.c
+@@ -374,7 +374,7 @@ static ssize_t cm4040_write(struct file
+
+ rc = write_sync_reg(SCR_HOST_TO_READER_START, dev);
+ if (rc <= 0) {
+- DEBUGP(5, dev, "write_sync_reg c=%.2Zx\n", rc);
++ DEBUGP(5, dev, "write_sync_reg c=%.2zx\n", rc);
+ DEBUGP(2, dev, "<- cm4040_write (failed)\n");
+ if (rc == -ERESTARTSYS)
+ return rc;
+@@ -387,7 +387,7 @@ static ssize_t cm4040_write(struct file
+ for (i = 0; i < bytes_to_write; i++) {
+ rc = wait_for_bulk_out_ready(dev);
+ if (rc <= 0) {
+- DEBUGP(5, dev, "wait_for_bulk_out_ready rc=%.2Zx\n",
++ DEBUGP(5, dev, "wait_for_bulk_out_ready rc=%.2zx\n",
+ rc);
+ DEBUGP(2, dev, "<- cm4040_write (failed)\n");
+ if (rc == -ERESTARTSYS)
+@@ -403,7 +403,7 @@ static ssize_t cm4040_write(struct file
+ rc = write_sync_reg(SCR_HOST_TO_READER_DONE, dev);
+
+ if (rc <= 0) {
+- DEBUGP(5, dev, "write_sync_reg c=%.2Zx\n", rc);
++ DEBUGP(5, dev, "write_sync_reg c=%.2zx\n", rc);
+ DEBUGP(2, dev, "<- cm4040_write (failed)\n");
+ if (rc == -ERESTARTSYS)
+ return rc;
--- /dev/null
+From f2e767bb5d6ee0d988cb7d4e54b0b21175802b6b Mon Sep 17 00:00:00 2001
+From: Ram Pai <linuxram@us.ibm.com>
+Date: Thu, 26 Jan 2017 16:37:01 -0200
+Subject: scsi: mpt3sas: Force request partial completion alignment
+
+From: Ram Pai <linuxram@us.ibm.com>
+
+commit f2e767bb5d6ee0d988cb7d4e54b0b21175802b6b upstream.
+
+The firmware or device, possibly under a heavy I/O load, can return on a
+partial unaligned boundary. Scsi-ml expects these requests to be
+completed on an alignment boundary. Scsi-ml blindly requeues the I/O
+without checking the alignment boundary of the I/O request for the
+remaining bytes. This leads to errors, since devices cannot perform
+non-aligned read/write operations.
+
+This patch fixes the issue in the driver. It aligns unaligned
+completions of FS requests, by truncating them to the nearest alignment
+boundary.
+
+[mkp: simplified if statement]
+
+Reported-by: Mauricio Faria De Oliveira <mauricfo@linux.vnet.ibm.com>
+Signed-off-by: Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>
+Signed-off-by: Ram Pai <linuxram@us.ibm.com>
+Acked-by: Sreekanth Reddy <Sreekanth.Reddy@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/mpt3sas/mpt3sas_scsih.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -4452,6 +4452,7 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *i
+ struct MPT3SAS_DEVICE *sas_device_priv_data;
+ u32 response_code = 0;
+ unsigned long flags;
++ unsigned int sector_sz;
+
+ mpi_reply = mpt3sas_base_get_reply_virt_addr(ioc, reply);
+ scmd = _scsih_scsi_lookup_get_clear(ioc, smid);
+@@ -4510,6 +4511,20 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *i
+ }
+
+ xfer_cnt = le32_to_cpu(mpi_reply->TransferCount);
++
++ /* In case of bogus fw or device, we could end up having
++ * unaligned partial completion. We can force alignment here,
++ * then scsi-ml does not need to handle this misbehavior.
++ */
++ sector_sz = scmd->device->sector_size;
++ if (unlikely(scmd->request->cmd_type == REQ_TYPE_FS && sector_sz &&
++ xfer_cnt % sector_sz)) {
++ sdev_printk(KERN_INFO, scmd->device,
++ "unaligned partial completion avoided (xfer_cnt=%u, sector_sz=%u)\n",
++ xfer_cnt, sector_sz);
++ xfer_cnt = round_down(xfer_cnt, sector_sz);
++ }
++
+ scsi_set_resid(scmd, scsi_bufflen(scmd) - xfer_cnt);
+ if (ioc_status & MPI2_IOCSTATUS_FLAG_LOG_INFO_AVAILABLE)
+ log_info = le32_to_cpu(mpi_reply->IOCLogInfo);
vlan-fix-tcp-checksum-offloads-in-q-in-q-vlans.patch
i2c-i2c-tiny-usb-fix-buffer-not-being-dma-capable.patch
mmc-sdhci-iproc-suppress-spurious-interrupt-with-multiblock-read.patch
+hid-wacom-have-wacom_tpc_irq-guard-against-possible-null-dereference.patch
+scsi-mpt3sas-force-request-partial-completion-alignment.patch
+drm-radeon-ci-disable-mclk-switching-for-high-refresh-rates-v2.patch
+drm-radeon-unbreak-hpd-handling-for-r600.patch
+pcmcia-remove-left-over-z-format.patch
+alsa-hda-apply-stac_9200_dell_m22-quirk-for-dell-latitude-d430.patch
+x86-pat-fix-xorg-regression-on-cpus-that-don-t-support-pat.patch
+slub-memcg-cure-the-brainless-abuse-of-sysfs-attributes.patch
+drm-gma500-psb-actually-use-vbt-mode-when-it-is-found.patch
--- /dev/null
+From 478fe3037b2278d276d4cd9cd0ab06c4cb2e9b32 Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Fri, 2 Jun 2017 14:46:25 -0700
+Subject: slub/memcg: cure the brainless abuse of sysfs attributes
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 478fe3037b2278d276d4cd9cd0ab06c4cb2e9b32 upstream.
+
+memcg_propagate_slab_attrs() abuses the sysfs attribute file functions
+to propagate settings from the root kmem_cache to a newly created
+kmem_cache. It does that with:
+
+ attr->show(root, buf);
+ attr->store(new, buf, strlen(bug);
+
+Aside of being a lazy and absurd hackery this is broken because it does
+not check the return value of the show() function.
+
+Some of the show() functions return 0 w/o touching the buffer. That
+means in such a case the store function is called with the stale content
+of the previous show(). That causes nonsense like invoking
+kmem_cache_shrink() on a newly created kmem_cache. In the worst case it
+would cause handing in an uninitialized buffer.
+
+This should be rewritten proper by adding a propagate() callback to
+those slub_attributes which must be propagated and avoid that insane
+conversion to and from ASCII, but that's too large for a hot fix.
+
+Check at least the return value of the show() function, so calling
+store() with stale content is prevented.
+
+Steven said:
+ "It can cause a deadlock with get_online_cpus() that has been uncovered
+ by recent cpu hotplug and lockdep changes that Thomas and Peter have
+ been doing.
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(cpu_hotplug.lock);
+ lock(slab_mutex);
+ lock(cpu_hotplug.lock);
+ lock(slab_mutex);
+
+ *** DEADLOCK ***"
+
+Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1705201244540.2255@nanos
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reported-by: Steven Rostedt <rostedt@goodmis.org>
+Acked-by: David Rientjes <rientjes@google.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Christoph Lameter <cl@linux.com>
+Cc: Pekka Enberg <penberg@kernel.org>
+Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
+Cc: Christoph Hellwig <hch@infradead.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/slub.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -5261,6 +5261,7 @@ static void memcg_propagate_slab_attrs(s
+ char mbuf[64];
+ char *buf;
+ struct slab_attribute *attr = to_slab_attr(slab_attrs[i]);
++ ssize_t len;
+
+ if (!attr || !attr->store || !attr->show)
+ continue;
+@@ -5285,8 +5286,9 @@ static void memcg_propagate_slab_attrs(s
+ buf = buffer;
+ }
+
+- attr->show(root_cache, buf);
+- attr->store(s, buf, strlen(buf));
++ len = attr->show(root_cache, buf);
++ if (len > 0)
++ attr->store(s, buf, len);
+ }
+
+ if (buffer)
--- /dev/null
+From cbed27cdf0e3f7ea3b2259e86b9e34df02be3fe4 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Tue, 18 Apr 2017 15:07:11 -0400
+Subject: x86/PAT: Fix Xorg regression on CPUs that don't support PAT
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit cbed27cdf0e3f7ea3b2259e86b9e34df02be3fe4 upstream.
+
+In the file arch/x86/mm/pat.c, there's a '__pat_enabled' variable. The
+variable is set to 1 by default and the function pat_init() sets
+__pat_enabled to 0 if the CPU doesn't support PAT.
+
+However, on AMD K6-3 CPUs, the processor initialization code never calls
+pat_init() and so __pat_enabled stays 1 and the function pat_enabled()
+returns true, even though the K6-3 CPU doesn't support PAT.
+
+The result of this bug is that a kernel warning is produced when attempting to
+start the Xserver and the Xserver doesn't start (fork() returns ENOMEM).
+Another symptom of this bug is that the framebuffer driver doesn't set the
+K6-3 MTRR registers:
+
+ x86/PAT: Xorg:3891 map pfn expected mapping type uncached-minus for [mem 0xe4000000-0xe5ffffff], got write-combining
+ ------------[ cut here ]------------
+ WARNING: CPU: 0 PID: 3891 at arch/x86/mm/pat.c:1020 untrack_pfn+0x5c/0x9f
+ ...
+ x86/PAT: Xorg:3891 map pfn expected mapping type uncached-minus for [mem 0xe4000000-0xe5ffffff], got write-combining
+
+To fix the bug change pat_enabled() so that it returns true only if PAT
+initialization was actually done.
+
+Also, I changed boot_cpu_has(X86_FEATURE_PAT) to
+this_cpu_has(X86_FEATURE_PAT) in pat_ap_init(), so that we check the PAT
+feature on the processor that is being initialized.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Brian Gerst <brgerst@gmail.com>
+Cc: Denys Vlasenko <dvlasenk@redhat.com>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Luis R. Rodriguez <mcgrof@suse.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Toshi Kani <toshi.kani@hp.com>
+Link: http://lkml.kernel.org/r/alpine.LRH.2.02.1704181501450.26399@file01.intranet.prod.int.rdu2.redhat.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/mm/pat.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/mm/pat.c
++++ b/arch/x86/mm/pat.c
+@@ -64,9 +64,11 @@ static int __init nopat(char *str)
+ }
+ early_param("nopat", nopat);
+
++static bool __read_mostly __pat_initialized = false;
++
+ bool pat_enabled(void)
+ {
+- return !!__pat_enabled;
++ return __pat_initialized;
+ }
+ EXPORT_SYMBOL_GPL(pat_enabled);
+
+@@ -224,13 +226,14 @@ static void pat_bsp_init(u64 pat)
+ }
+
+ wrmsrl(MSR_IA32_CR_PAT, pat);
++ __pat_initialized = true;
+
+ __init_cache_modes(pat);
+ }
+
+ static void pat_ap_init(u64 pat)
+ {
+- if (!boot_cpu_has(X86_FEATURE_PAT)) {
++ if (!this_cpu_has(X86_FEATURE_PAT)) {
+ /*
+ * If this happens we are on a secondary CPU, but switched to
+ * PAT on the boot CPU. We have no way to undo PAT.
+@@ -305,7 +308,7 @@ void pat_init(void)
+ u64 pat;
+ struct cpuinfo_x86 *c = &boot_cpu_data;
+
+- if (!pat_enabled()) {
++ if (!__pat_enabled) {
+ init_cache_modes();
+ return;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
