--- /dev/null
+From d59a1f71ff1aeda4b4630df92d3ad4e3b1dfc885 Mon Sep 17 00:00:00 2001
+From: John Keeping <john@metanate.com>
+Date: Wed, 18 Nov 2015 11:17:25 +0000
+Subject: drm/qxl: fix cursor position with non-zero hotspot
+
+From: John Keeping <john@metanate.com>
+
+commit d59a1f71ff1aeda4b4630df92d3ad4e3b1dfc885 upstream.
+
+The SPICE protocol considers the position of a cursor to be the location
+of its active pixel on the display, so the cursor is drawn with its
+top-left corner at "(x - hot_spot_x, y - hot_spot_y)" but the DRM cursor
+position gives the location where the top-left corner should be drawn,
+with the hotspot being a hint for drivers that need it.
+
+This fixes the location of the window resize cursors when using Fluxbox
+with the QXL DRM driver and both the QXL and modesetting X drivers.
+
+Signed-off-by: John Keeping <john@metanate.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/1447845445-2116-1-git-send-email-john@metanate.com
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/qxl/qxl_display.c | 13 +++++++++----
+ drivers/gpu/drm/qxl/qxl_drv.h | 2 ++
+ 2 files changed, 11 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/qxl/qxl_display.c
++++ b/drivers/gpu/drm/qxl/qxl_display.c
+@@ -295,10 +295,15 @@ static int qxl_crtc_cursor_set2(struct d
+
+ qxl_bo_kunmap(user_bo);
+
++ qcrtc->cur_x += qcrtc->hot_spot_x - hot_x;
++ qcrtc->cur_y += qcrtc->hot_spot_y - hot_y;
++ qcrtc->hot_spot_x = hot_x;
++ qcrtc->hot_spot_y = hot_y;
++
+ cmd = (struct qxl_cursor_cmd *)qxl_release_map(qdev, release);
+ cmd->type = QXL_CURSOR_SET;
+- cmd->u.set.position.x = qcrtc->cur_x;
+- cmd->u.set.position.y = qcrtc->cur_y;
++ cmd->u.set.position.x = qcrtc->cur_x + qcrtc->hot_spot_x;
++ cmd->u.set.position.y = qcrtc->cur_y + qcrtc->hot_spot_y;
+
+ cmd->u.set.shape = qxl_bo_physical_address(qdev, cursor_bo, 0);
+
+@@ -361,8 +366,8 @@ static int qxl_crtc_cursor_move(struct d
+
+ cmd = (struct qxl_cursor_cmd *)qxl_release_map(qdev, release);
+ cmd->type = QXL_CURSOR_MOVE;
+- cmd->u.position.x = qcrtc->cur_x;
+- cmd->u.position.y = qcrtc->cur_y;
++ cmd->u.position.x = qcrtc->cur_x + qcrtc->hot_spot_x;
++ cmd->u.position.y = qcrtc->cur_y + qcrtc->hot_spot_y;
+ qxl_release_unmap(qdev, release, &cmd->release_info);
+
+ qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false);
+--- a/drivers/gpu/drm/qxl/qxl_drv.h
++++ b/drivers/gpu/drm/qxl/qxl_drv.h
+@@ -139,6 +139,8 @@ struct qxl_crtc {
+ int index;
+ int cur_x;
+ int cur_y;
++ int hot_spot_x;
++ int hot_spot_y;
+ };
+
+ struct qxl_output {
--- /dev/null
+From fe1bce9e2107ba3a8faffe572483b6974201a0e6 Mon Sep 17 00:00:00 2001
+From: Davidlohr Bueso <dave@stgolabs.net>
+Date: Wed, 20 Apr 2016 20:09:24 -0700
+Subject: futex: Acknowledge a new waiter in counter before plist
+
+From: Davidlohr Bueso <dave@stgolabs.net>
+
+commit fe1bce9e2107ba3a8faffe572483b6974201a0e6 upstream.
+
+Otherwise an incoming waker on the dest hash bucket can miss
+the waiter adding itself to the plist during the lockless
+check optimization (small window but still the correct way
+of doing this); similarly to the decrement counterpart.
+
+Suggested-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
+Cc: Davidlohr Bueso <dave@stgolabs.net>
+Cc: bigeasy@linutronix.de
+Cc: dvhart@infradead.org
+Link: http://lkml.kernel.org/r/1461208164-29150-1-git-send-email-dave@stgolabs.net
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/futex.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -1378,8 +1378,8 @@ void requeue_futex(struct futex_q *q, st
+ if (likely(&hb1->chain != &hb2->chain)) {
+ plist_del(&q->list, &hb1->chain);
+ hb_waiters_dec(hb1);
+- plist_add(&q->list, &hb2->chain);
+ hb_waiters_inc(hb2);
++ plist_add(&q->list, &hb2->chain);
+ q->lock_ptr = &hb2->lock;
+ }
+ get_futex_key_refs(key2);
usb-xhci-fix-wild-pointers-in-xhci_mem_cleanup.patch
usb-hcd-out-of-bounds-access-in-for_each_companion.patch
lib-lz4-fixed-zram-with-lz4-on-big-endian-machines.patch
+x86-iopl-64-properly-context-switch-iopl-on-xen-pv.patch
+futex-acknowledge-a-new-waiter-in-counter-before-plist.patch
+drm-qxl-fix-cursor-position-with-non-zero-hotspot.patch
--- /dev/null
+From b7a584598aea7ca73140cb87b40319944dd3393f Mon Sep 17 00:00:00 2001
+From: Andy Lutomirski <luto@kernel.org>
+Date: Wed, 16 Mar 2016 14:14:21 -0700
+Subject: x86/iopl/64: Properly context-switch IOPL on Xen PV
+
+From: Andy Lutomirski <luto@kernel.org>
+
+commit b7a584598aea7ca73140cb87b40319944dd3393f upstream.
+
+On Xen PV, regs->flags doesn't reliably reflect IOPL and the
+exit-to-userspace code doesn't change IOPL. We need to context
+switch it manually.
+
+I'm doing this without going through paravirt because this is
+specific to Xen PV. After the dust settles, we can merge this with
+the 32-bit code, tidy up the iopl syscall implementation, and remove
+the set_iopl pvop entirely.
+
+Fixes XSA-171.
+
+Reviewewd-by: Jan Beulich <JBeulich@suse.com>
+Signed-off-by: Andy Lutomirski <luto@kernel.org>
+Cc: Andrew Cooper <andrew.cooper3@citrix.com>
+Cc: Andy Lutomirski <luto@amacapital.net>
+Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Brian Gerst <brgerst@gmail.com>
+Cc: David Vrabel <david.vrabel@citrix.com>
+Cc: Denys Vlasenko <dvlasenk@redhat.com>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Jan Beulich <JBeulich@suse.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/693c3bd7aeb4d3c27c92c622b7d0f554a458173c.1458162709.git.luto@kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+[ kamal: backport to 3.19-stable: no X86_FEATURE_XENPV so just call
+ xen_pv_domain() directly ]
+Acked-by: Andy Lutomirski <luto@kernel.org>
+Signed-off-by: Kamal Mostafa <kamal@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/include/asm/xen/hypervisor.h | 2 ++
+ arch/x86/kernel/process_64.c | 12 ++++++++++++
+ arch/x86/xen/enlighten.c | 2 +-
+ 3 files changed, 15 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/include/asm/xen/hypervisor.h
++++ b/arch/x86/include/asm/xen/hypervisor.h
+@@ -57,4 +57,6 @@ static inline bool xen_x2apic_para_avail
+ }
+ #endif
+
++extern void xen_set_iopl_mask(unsigned mask);
++
+ #endif /* _ASM_X86_XEN_HYPERVISOR_H */
+--- a/arch/x86/kernel/process_64.c
++++ b/arch/x86/kernel/process_64.c
+@@ -49,6 +49,7 @@
+ #include <asm/syscalls.h>
+ #include <asm/debugreg.h>
+ #include <asm/switch_to.h>
++#include <asm/xen/hypervisor.h>
+
+ asmlinkage extern void ret_from_fork(void);
+
+@@ -427,6 +428,17 @@ __switch_to(struct task_struct *prev_p,
+ task_thread_info(prev_p)->flags & _TIF_WORK_CTXSW_PREV))
+ __switch_to_xtra(prev_p, next_p, tss);
+
++#ifdef CONFIG_XEN
++ /*
++ * On Xen PV, IOPL bits in pt_regs->flags have no effect, and
++ * current_pt_regs()->flags may not match the current task's
++ * intended IOPL. We need to switch it manually.
++ */
++ if (unlikely(xen_pv_domain() &&
++ prev->iopl != next->iopl))
++ xen_set_iopl_mask(next->iopl);
++#endif
++
+ return prev_p;
+ }
+
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -956,7 +956,7 @@ static void xen_load_sp0(struct tss_stru
+ xen_mc_issue(PARAVIRT_LAZY_CPU);
+ }
+
+-static void xen_set_iopl_mask(unsigned mask)
++void xen_set_iopl_mask(unsigned mask)
+ {
+ struct physdev_set_iopl set_iopl;
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
