--- /dev/null
+From 7132813c384515c9dede1ae20e56f3895feb7f1e Mon Sep 17 00:00:00 2001
+From: "Suzuki K. Poulose" <suzuki.poulose@arm.com>
+Date: Thu, 19 Mar 2015 18:17:09 +0000
+Subject: arm64: Honor __GFP_ZERO in dma allocations
+
+From: "Suzuki K. Poulose" <suzuki.poulose@arm.com>
+
+commit 7132813c384515c9dede1ae20e56f3895feb7f1e upstream.
+
+Current implementation doesn't zero out the pages allocated.
+Honor the __GFP_ZERO flag and zero out if set.
+
+Acked-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Suzuki K. Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/mm/dma-mapping.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/arch/arm64/mm/dma-mapping.c
++++ b/arch/arm64/mm/dma-mapping.c
+@@ -51,7 +51,7 @@ static int __init early_coherent_pool(ch
+ }
+ early_param("coherent_pool", early_coherent_pool);
+
+-static void *__alloc_from_pool(size_t size, struct page **ret_page)
++static void *__alloc_from_pool(size_t size, struct page **ret_page, gfp_t flags)
+ {
+ unsigned long val;
+ void *ptr = NULL;
+@@ -67,6 +67,8 @@ static void *__alloc_from_pool(size_t si
+
+ *ret_page = phys_to_page(phys);
+ ptr = (void *)val;
++ if (flags & __GFP_ZERO)
++ memset(ptr, 0, size);
+ }
+
+ return ptr;
+@@ -101,6 +103,7 @@ static void *__dma_alloc_coherent(struct
+ flags |= GFP_DMA;
+ if (IS_ENABLED(CONFIG_DMA_CMA) && (flags & __GFP_WAIT)) {
+ struct page *page;
++ void *addr;
+
+ size = PAGE_ALIGN(size);
+ page = dma_alloc_from_contiguous(dev, size >> PAGE_SHIFT,
+@@ -109,7 +112,10 @@ static void *__dma_alloc_coherent(struct
+ return NULL;
+
+ *dma_handle = phys_to_dma(dev, page_to_phys(page));
+- return page_address(page);
++ addr = page_address(page);
++ if (flags & __GFP_ZERO)
++ memset(addr, 0, size);
++ return addr;
+ } else {
+ return swiotlb_alloc_coherent(dev, size, dma_handle, flags);
+ }
+@@ -145,7 +151,7 @@ static void *__dma_alloc_noncoherent(str
+
+ if (!(flags & __GFP_WAIT)) {
+ struct page *page = NULL;
+- void *addr = __alloc_from_pool(size, &page);
++ void *addr = __alloc_from_pool(size, &page, flags);
+
+ if (addr)
+ *dma_handle = phys_to_dma(dev, page_to_phys(page));
--- /dev/null
+From 285994a62c80f1d72c6924282bcb59608098d5ec Mon Sep 17 00:00:00 2001
+From: Catalin Marinas <catalin.marinas@arm.com>
+Date: Wed, 11 Mar 2015 12:20:39 +0000
+Subject: arm64: Invalidate the TLB corresponding to intermediate page table levels
+
+From: Catalin Marinas <catalin.marinas@arm.com>
+
+commit 285994a62c80f1d72c6924282bcb59608098d5ec upstream.
+
+The ARM architecture allows the caching of intermediate page table
+levels and page table freeing requires a sequence like:
+
+ pmd_clear()
+ TLB invalidation
+ pte page freeing
+
+With commit 5e5f6dc10546 (arm64: mm: enable HAVE_RCU_TABLE_FREE logic),
+the page table freeing batching was moved from tlb_remove_page() to
+tlb_remove_table(). The former takes care of TLB invalidation as this is
+also shared with pte clearing and page cache page freeing. The latter,
+however, does not invalidate the TLBs for intermediate page table levels
+as it probably relies on the architecture code to do it if required.
+When the mm->mm_users < 2, tlb_remove_table() does not do any batching
+and page table pages are freed before tlb_finish_mmu() which performs
+the actual TLB invalidation.
+
+This patch introduces __tlb_flush_pgtable() for arm64 and calls it from
+the {pte,pmd,pud}_free_tlb() directly without relying on deferred page
+table freeing.
+
+Fixes: 5e5f6dc10546 arm64: mm: enable HAVE_RCU_TABLE_FREE logic
+Reported-by: Jon Masters <jcm@redhat.com>
+Tested-by: Jon Masters <jcm@redhat.com>
+Tested-by: Steve Capper <steve.capper@linaro.org>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/include/asm/tlb.h | 3 +++
+ arch/arm64/include/asm/tlbflush.h | 13 +++++++++++++
+ 2 files changed, 16 insertions(+)
+
+--- a/arch/arm64/include/asm/tlb.h
++++ b/arch/arm64/include/asm/tlb.h
+@@ -48,6 +48,7 @@ static inline void tlb_flush(struct mmu_
+ static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
+ unsigned long addr)
+ {
++ __flush_tlb_pgtable(tlb->mm, addr);
+ pgtable_page_dtor(pte);
+ tlb_remove_entry(tlb, pte);
+ }
+@@ -56,6 +57,7 @@ static inline void __pte_free_tlb(struct
+ static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmdp,
+ unsigned long addr)
+ {
++ __flush_tlb_pgtable(tlb->mm, addr);
+ tlb_remove_entry(tlb, virt_to_page(pmdp));
+ }
+ #endif
+@@ -64,6 +66,7 @@ static inline void __pmd_free_tlb(struct
+ static inline void __pud_free_tlb(struct mmu_gather *tlb, pud_t *pudp,
+ unsigned long addr)
+ {
++ __flush_tlb_pgtable(tlb->mm, addr);
+ tlb_remove_entry(tlb, virt_to_page(pudp));
+ }
+ #endif
+--- a/arch/arm64/include/asm/tlbflush.h
++++ b/arch/arm64/include/asm/tlbflush.h
+@@ -149,6 +149,19 @@ static inline void flush_tlb_kernel_rang
+ }
+
+ /*
++ * Used to invalidate the TLB (walk caches) corresponding to intermediate page
++ * table levels (pgd/pud/pmd).
++ */
++static inline void __flush_tlb_pgtable(struct mm_struct *mm,
++ unsigned long uaddr)
++{
++ unsigned long addr = uaddr >> 12 | ((unsigned long)ASID(mm) << 48);
++
++ dsb(ishst);
++ asm("tlbi vae1is, %0" : : "r" (addr));
++ dsb(ish);
++}
++/*
+ * On AArch64, the cache coherency is handled via the set_pte_at() function.
+ */
+ static inline void update_mmu_cache(struct vm_area_struct *vma,
--- /dev/null
+From f2e0ea861117bda073d1d7ffbd3120c07c0d5d34 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Fri, 6 Mar 2015 10:49:21 +0000
+Subject: Change email address for 8250_pci
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit f2e0ea861117bda073d1d7ffbd3120c07c0d5d34 upstream.
+
+I'm still receiving reports to my email address, so let's point this
+at the linux-serial mailing list instead.
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/8250/8250_pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -69,7 +69,7 @@ static void moan_device(const char *str,
+ "Please send the output of lspci -vv, this\n"
+ "message (0x%04x,0x%04x,0x%04x,0x%04x), the\n"
+ "manufacturer and name of serial board or\n"
+- "modem board to rmk+serial@arm.linux.org.uk.\n",
++ "modem board to <linux-serial@vger.kernel.org>.\n",
+ pci_name(dev), str, dev->vendor, dev->device,
+ dev->subsystem_vendor, dev->subsystem_device);
+ }
--- /dev/null
+From 30a22c215a0007603ffc08021f2e8b64018517dd Mon Sep 17 00:00:00 2001
+From: Peter Hurley <peter@hurleysoftware.com>
+Date: Sun, 1 Mar 2015 10:11:05 -0500
+Subject: console: Fix console name size mismatch
+
+From: Peter Hurley <peter@hurleysoftware.com>
+
+commit 30a22c215a0007603ffc08021f2e8b64018517dd upstream.
+
+commit 6ae9200f2cab7 ("enlarge console.name") increased the storage
+for the console name to 16 bytes, but not the corresponding
+struct console_cmdline::name storage. Console names longer than
+8 bytes cause read beyond end-of-string and failure to match
+console; I'm not sure if there are other unexpected consequences.
+
+Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/printk/console_cmdline.h | 2 +-
+ kernel/printk/printk.c | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/printk/console_cmdline.h
++++ b/kernel/printk/console_cmdline.h
+@@ -3,7 +3,7 @@
+
+ struct console_cmdline
+ {
+- char name[8]; /* Name of the driver */
++ char name[16]; /* Name of the driver */
+ int index; /* Minor dev. to use */
+ char *options; /* Options for the driver */
+ #ifdef CONFIG_A11Y_BRAILLE_CONSOLE
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -2464,6 +2464,7 @@ void register_console(struct console *ne
+ for (i = 0, c = console_cmdline;
+ i < MAX_CMDLINECONSOLES && c->name[0];
+ i++, c++) {
++ BUILD_BUG_ON(sizeof(c->name) != sizeof(newcon->name));
+ if (strcmp(c->name, newcon->name) != 0)
+ continue;
+ if (newcon->index >= 0 &&
--- /dev/null
+From e405ca3a1bf166f741506c07c2a277b5d48af8f7 Mon Sep 17 00:00:00 2001
+From: Ben Goz <ben.goz@amd.com>
+Date: Sun, 8 Mar 2015 14:15:16 +0200
+Subject: drm/radeon: Changing number of compute pipe lines
+
+From: Ben Goz <ben.goz@amd.com>
+
+commit e405ca3a1bf166f741506c07c2a277b5d48af8f7 upstream.
+
+The current CP firmware can handle Usermode Queues only on MEC1.
+To reflect this firmware change, this commit reduces number of compute pipelines
+to 4 - 1, from 8 - 1 (the first pipeline is allocated for kgd).
+
+Signed-off-by: Ben Goz <ben.goz@amd.com>
+Signed-off-by: Oded Gabbay <oded.gabbay@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_kfd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_kfd.c
++++ b/drivers/gpu/drm/radeon/radeon_kfd.c
+@@ -152,7 +152,7 @@ void radeon_kfd_device_init(struct radeo
+ .compute_vmid_bitmap = 0xFF00,
+
+ .first_compute_pipe = 1,
+- .compute_pipe_count = 8 - 1,
++ .compute_pipe_count = 4 - 1,
+ };
+
+ radeon_doorbell_get_kfd_info(rdev,
--- /dev/null
+From cffefd9bb31cd35ab745d3b49005d10616d25bdc Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 2 Mar 2015 20:45:24 -0500
+Subject: drm/radeon: do a posting read in cik_set_irq
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit cffefd9bb31cd35ab745d3b49005d10616d25bdc upstream.
+
+To make sure the writes go through the pci bridge.
+
+bug:
+https://bugzilla.kernel.org/show_bug.cgi?id=90741
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/cik.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -7526,6 +7526,9 @@ int cik_irq_set(struct radeon_device *rd
+ WREG32(DC_HPD5_INT_CONTROL, hpd5);
+ WREG32(DC_HPD6_INT_CONTROL, hpd6);
+
++ /* posting read */
++ RREG32(SRBM_STATUS);
++
+ return 0;
+ }
+
--- /dev/null
+From c320bb5f6dc0cb88a811cbaf839303e0a3916a92 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 2 Mar 2015 20:42:53 -0500
+Subject: drm/radeon: do a posting read in evergreen_set_irq
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit c320bb5f6dc0cb88a811cbaf839303e0a3916a92 upstream.
+
+To make sure the writes go through the pci bridge.
+
+bug:
+https://bugzilla.kernel.org/show_bug.cgi?id=90741
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/evergreen.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -4589,6 +4589,9 @@ int evergreen_irq_set(struct radeon_devi
+ WREG32(AFMT_AUDIO_PACKET_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET, afmt5);
+ WREG32(AFMT_AUDIO_PACKET_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET, afmt6);
+
++ /* posting read */
++ RREG32(SRBM_STATUS);
++
+ return 0;
+ }
+
--- /dev/null
+From f957063fee6392bb9365370db6db74dc0b2dce0a Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 2 Mar 2015 20:36:26 -0500
+Subject: drm/radeon: do a posting read in r100_set_irq
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit f957063fee6392bb9365370db6db74dc0b2dce0a upstream.
+
+To make sure the writes go through the pci bridge.
+
+bug:
+https://bugzilla.kernel.org/show_bug.cgi?id=90741
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/r100.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/r100.c
++++ b/drivers/gpu/drm/radeon/r100.c
+@@ -728,6 +728,10 @@ int r100_irq_set(struct radeon_device *r
+ tmp |= RADEON_FP2_DETECT_MASK;
+ }
+ WREG32(RADEON_GEN_INT_CNTL, tmp);
++
++ /* read back to post the write */
++ RREG32(RADEON_GEN_INT_CNTL);
++
+ return 0;
+ }
+
--- /dev/null
+From 9d1393f23d5656cdd5f368efd60694d4aeed81d3 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 2 Mar 2015 20:41:31 -0500
+Subject: drm/radeon: do a posting read in r600_set_irq
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 9d1393f23d5656cdd5f368efd60694d4aeed81d3 upstream.
+
+To make sure the writes go through the pci bridge.
+
+bug:
+https://bugzilla.kernel.org/show_bug.cgi?id=90741
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/r600.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -3783,6 +3783,9 @@ int r600_irq_set(struct radeon_device *r
+ WREG32(RV770_CG_THERMAL_INT, thermal_int);
+ }
+
++ /* posting read */
++ RREG32(R_000E50_SRBM_STATUS);
++
+ return 0;
+ }
+
--- /dev/null
+From 54acf107e4e66d1f4a697e08a7f60dba9fcf07c3 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 2 Mar 2015 20:39:56 -0500
+Subject: drm/radeon: do a posting read in rs600_set_irq
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 54acf107e4e66d1f4a697e08a7f60dba9fcf07c3 upstream.
+
+To make sure the writes go through the pci bridge.
+
+bug:
+https://bugzilla.kernel.org/show_bug.cgi?id=90741
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/rs600.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/rs600.c
++++ b/drivers/gpu/drm/radeon/rs600.c
+@@ -693,6 +693,10 @@ int rs600_irq_set(struct radeon_device *
+ WREG32(R_007D18_DC_HOT_PLUG_DETECT2_INT_CONTROL, hpd2);
+ if (ASIC_IS_DCE2(rdev))
+ WREG32(R_007408_HDMI0_AUDIO_PACKET_CONTROL, hdmi0);
++
++ /* posting read */
++ RREG32(R_000040_GEN_INT_CNTL);
++
+ return 0;
+ }
+
--- /dev/null
+From 0586915ec10d0ae60de5cd3381ad25a704760402 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 2 Mar 2015 20:43:53 -0500
+Subject: drm/radeon: do a posting read in si_set_irq
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 0586915ec10d0ae60de5cd3381ad25a704760402 upstream.
+
+To make sure the writes go through the pci bridge.
+
+bug:
+https://bugzilla.kernel.org/show_bug.cgi?id=90741
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/si.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -6198,6 +6198,9 @@ int si_irq_set(struct radeon_device *rde
+
+ WREG32(CG_THERMAL_INT, thermal_int);
+
++ /* posting read */
++ RREG32(SRBM_STATUS);
++
+ return 0;
+ }
+
--- /dev/null
+From a17d4996e051e78d164989b894608cf37cd5110b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+Date: Thu, 19 Feb 2015 09:40:28 +0100
+Subject: drm/radeon: drop setting UPLL to sleep mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+
+commit a17d4996e051e78d164989b894608cf37cd5110b upstream.
+
+Just keep it working, seems to fix some PLL problems.
+
+Bug: https://bugs.freedesktop.org/show_bug.cgi?id=73378
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/si.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -7121,8 +7121,7 @@ int si_set_uvd_clocks(struct radeon_devi
+ WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_BYPASS_EN_MASK, ~UPLL_BYPASS_EN_MASK);
+
+ if (!vclk || !dclk) {
+- /* keep the Bypass mode, put PLL to sleep */
+- WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
++ /* keep the Bypass mode */
+ return 0;
+ }
+
+@@ -7138,8 +7137,7 @@ int si_set_uvd_clocks(struct radeon_devi
+ /* set VCO_MODE to 1 */
+ WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_VCO_MODE_MASK, ~UPLL_VCO_MODE_MASK);
+
+- /* toggle UPLL_SLEEP to 1 then back to 0 */
+- WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
++ /* disable sleep mode */
+ WREG32_P(CG_UPLL_FUNC_CNTL, 0, ~UPLL_SLEEP_MASK);
+
+ /* deassert UPLL_RESET */
--- /dev/null
+From a239118a24b3bf9089751068e431dfb63dc4168b Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 17 Mar 2015 11:53:33 -0400
+Subject: drm/radeon: drop ttm two ended allocation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit a239118a24b3bf9089751068e431dfb63dc4168b upstream.
+
+radeon_bo_create() calls radeon_ttm_placement_from_domain()
+before ttm_bo_init() is called. radeon_ttm_placement_from_domain()
+uses the ttm bo size to determine when to select top down
+allocation but since the ttm bo is not initialized yet the
+check is always false. It only took effect when buffers
+were validated later. It also seemed to regress suspend
+and resume on some systems possibly due to it not
+taking effect in radeon_bo_create().
+
+radeon_bo_create() and radeon_ttm_placement_from_domain()
+need to be reworked substantially for this to be optimally
+effective. Re-enable it at that point.
+
+Noticed-by: Oded Gabbay <oded.gabbay@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_object.c | 11 -----------
+ 1 file changed, 11 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_object.c
++++ b/drivers/gpu/drm/radeon/radeon_object.c
+@@ -173,17 +173,6 @@ void radeon_ttm_placement_from_domain(st
+ else
+ rbo->placements[i].lpfn = 0;
+ }
+-
+- /*
+- * Use two-ended allocation depending on the buffer size to
+- * improve fragmentation quality.
+- * 512kb was measured as the most optimal number.
+- */
+- if (rbo->tbo.mem.size > 512 * 1024) {
+- for (i = 0; i < c; i++) {
+- rbo->placements[i].flags |= TTM_PL_FLAG_TOPDOWN;
+- }
+- }
+ }
+
+ int radeon_bo_create(struct radeon_device *rdev,
--- /dev/null
+From a28b2a47edcd0cb7c051b445f71a426000394606 Mon Sep 17 00:00:00 2001
+From: Tommi Rantala <tt.rantala@gmail.com>
+Date: Mon, 2 Mar 2015 21:36:07 +0200
+Subject: drm/radeon: fix DRM_IOCTL_RADEON_CS oops
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tommi Rantala <tt.rantala@gmail.com>
+
+commit a28b2a47edcd0cb7c051b445f71a426000394606 upstream.
+
+Passing zeroed drm_radeon_cs struct to DRM_IOCTL_RADEON_CS produces the
+following oops.
+
+Fix by always calling INIT_LIST_HEAD() to avoid the crash in list_sort().
+
+----------------------------------
+
+ #include <stdint.h>
+ #include <fcntl.h>
+ #include <unistd.h>
+ #include <sys/ioctl.h>
+ #include <drm/radeon_drm.h>
+
+ static const struct drm_radeon_cs cs;
+
+ int main(int argc, char **argv)
+ {
+ return ioctl(open(argv[1], O_RDWR), DRM_IOCTL_RADEON_CS, &cs);
+ }
+
+----------------------------------
+
+[ttrantal@test2 ~]$ ./main /dev/dri/card0
+[ 46.904650] BUG: unable to handle kernel NULL pointer dereference at (null)
+[ 46.905022] IP: [<ffffffff814d6df2>] list_sort+0x42/0x240
+[ 46.905022] PGD 68f29067 PUD 688b5067 PMD 0
+[ 46.905022] Oops: 0002 [#1] SMP
+[ 46.905022] CPU: 0 PID: 2413 Comm: main Not tainted 4.0.0-rc1+ #58
+[ 46.905022] Hardware name: Hewlett-Packard HP Compaq dc5750 Small Form Factor/0A64h, BIOS 786E3 v02.10 01/25/2007
+[ 46.905022] task: ffff880058e2bcc0 ti: ffff880058e64000 task.ti: ffff880058e64000
+[ 46.905022] RIP: 0010:[<ffffffff814d6df2>] [<ffffffff814d6df2>] list_sort+0x42/0x240
+[ 46.905022] RSP: 0018:ffff880058e67998 EFLAGS: 00010246
+[ 46.905022] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
+[ 46.905022] RDX: ffffffff81644410 RSI: ffff880058e67b40 RDI: ffff880058e67a58
+[ 46.905022] RBP: ffff880058e67a88 R08: 0000000000000000 R09: 0000000000000000
+[ 46.905022] R10: ffff880058e2bcc0 R11: ffffffff828e6ca0 R12: ffffffff81644410
+[ 46.905022] R13: ffff8800694b8018 R14: 0000000000000000 R15: ffff880058e679b0
+[ 46.905022] FS: 00007fdc65a65700(0000) GS:ffff88006d600000(0000) knlGS:0000000000000000
+[ 46.905022] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 46.905022] CR2: 0000000000000000 CR3: 0000000058dd9000 CR4: 00000000000006f0
+[ 46.905022] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 46.905022] DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400
+[ 46.905022] Stack:
+[ 46.905022] ffff880058e67b40 ffff880058e2bcc0 ffff880058e67a78 0000000000000000
+[ 46.905022] 0000000000000000 0000000000000000 0000000000000000 0000000000000000
+[ 46.905022] 0000000000000000 0000000000000000 0000000000000000 0000000000000000
+[ 46.905022] Call Trace:
+[ 46.905022] [<ffffffff81644a65>] radeon_cs_parser_fini+0x195/0x220
+[ 46.905022] [<ffffffff81645069>] radeon_cs_ioctl+0xa9/0x960
+[ 46.905022] [<ffffffff815e1f7c>] drm_ioctl+0x19c/0x640
+[ 46.905022] [<ffffffff810f8fdd>] ? trace_hardirqs_on_caller+0xfd/0x1c0
+[ 46.905022] [<ffffffff810f90ad>] ? trace_hardirqs_on+0xd/0x10
+[ 46.905022] [<ffffffff8160c066>] radeon_drm_ioctl+0x46/0x80
+[ 46.905022] [<ffffffff81211868>] do_vfs_ioctl+0x318/0x570
+[ 46.905022] [<ffffffff81462ef6>] ? selinux_file_ioctl+0x56/0x110
+[ 46.905022] [<ffffffff81211b41>] SyS_ioctl+0x81/0xa0
+[ 46.905022] [<ffffffff81dc6312>] system_call_fastpath+0x12/0x17
+[ 46.905022] Code: 48 89 b5 10 ff ff ff 0f 84 03 01 00 00 4c 8d bd 28 ff ff
+ff 31 c0 48 89 fb b9 15 00 00 00 49 89 d4 4c 89 ff f3 48 ab 48 8b 46 08 <48> c7
+00 00 00 00 00 48 8b 0e 48 85 c9 0f 84 7d 00 00 00 c7 85
+[ 46.905022] RIP [<ffffffff814d6df2>] list_sort+0x42/0x240
+[ 46.905022] RSP <ffff880058e67998>
+[ 46.905022] CR2: 0000000000000000
+[ 47.149253] ---[ end trace 09576b4e8b2c20b8 ]---
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Tommi Rantala <tt.rantala@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_cs.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_cs.c
++++ b/drivers/gpu/drm/radeon/radeon_cs.c
+@@ -256,11 +256,13 @@ int radeon_cs_parser_init(struct radeon_
+ u32 ring = RADEON_CS_RING_GFX;
+ s32 priority = 0;
+
++ INIT_LIST_HEAD(&p->validated);
++
+ if (!cs->num_chunks) {
+ return 0;
+ }
++
+ /* get chunks */
+- INIT_LIST_HEAD(&p->validated);
+ p->idx = 0;
+ p->ib.sa_bo = NULL;
+ p->const_ib.sa_bo = NULL;
--- /dev/null
+From 77ae5f4b48a0445426c9c1ef7c0f28b717e35d55 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 3 Mar 2015 17:00:43 -0500
+Subject: drm/radeon: fix interlaced modes on DCE8
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 77ae5f4b48a0445426c9c1ef7c0f28b717e35d55 upstream.
+
+Need to double the viewport height.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/atombios_crtc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -1405,6 +1405,9 @@ static int dce4_crtc_do_set_base(struct
+ (x << 16) | y);
+ viewport_w = crtc->mode.hdisplay;
+ viewport_h = (crtc->mode.vdisplay + 1) & ~1;
++ if ((rdev->family >= CHIP_BONAIRE) &&
++ (crtc->mode.flags & DRM_MODE_FLAG_INTERLACE))
++ viewport_h *= 2;
+ WREG32(EVERGREEN_VIEWPORT_SIZE + radeon_crtc->crtc_offset,
+ (viewport_w << 16) | viewport_h);
+
--- /dev/null
+From b6610101718d4ab90d793c482625e98eb1262cad Mon Sep 17 00:00:00 2001
+From: Maarten Lankhorst <maarten.lankhorst@ubuntu.com>
+Date: Tue, 3 Mar 2015 09:56:42 +0100
+Subject: drm/radeon: fix wait to actually occur after the signaling callback
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maarten Lankhorst <maarten.lankhorst@ubuntu.com>
+
+commit b6610101718d4ab90d793c482625e98eb1262cad upstream.
+
+A normal wait adds to the front of the tail. By doing something
+similar to fence_default_wait the fence code can run without racing.
+
+This is a complete fix for "panic on suspend from KDE with radeon",
+and a partial fix for "Radeon: System pauses on TAHITI". On tahiti
+si_irq_set needs to be fixed too, to completely flush the writes
+before radeon_fence_activity is called in radeon_fence_enable_signaling.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=90741
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=90861
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@ubuntu.com>
+Reported-by: Jon Arne Jørgensen <jonjon.arnearne@gmail.com>
+Reported-and-tested-by: Gustaw Smolarczyk <wielkiegie@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_fence.c | 68 ++++++++++++++++++++++------------
+ 1 file changed, 45 insertions(+), 23 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_fence.c
++++ b/drivers/gpu/drm/radeon/radeon_fence.c
+@@ -1030,37 +1030,59 @@ static inline bool radeon_test_signaled(
+ return test_bit(FENCE_FLAG_SIGNALED_BIT, &fence->base.flags);
+ }
+
++struct radeon_wait_cb {
++ struct fence_cb base;
++ struct task_struct *task;
++};
++
++static void
++radeon_fence_wait_cb(struct fence *fence, struct fence_cb *cb)
++{
++ struct radeon_wait_cb *wait =
++ container_of(cb, struct radeon_wait_cb, base);
++
++ wake_up_process(wait->task);
++}
++
+ static signed long radeon_fence_default_wait(struct fence *f, bool intr,
+ signed long t)
+ {
+ struct radeon_fence *fence = to_radeon_fence(f);
+ struct radeon_device *rdev = fence->rdev;
+- bool signaled;
++ struct radeon_wait_cb cb;
++
++ cb.task = current;
++
++ if (fence_add_callback(f, &cb.base, radeon_fence_wait_cb))
++ return t;
+
+- fence_enable_sw_signaling(&fence->base);
++ while (t > 0) {
++ if (intr)
++ set_current_state(TASK_INTERRUPTIBLE);
++ else
++ set_current_state(TASK_UNINTERRUPTIBLE);
++
++ /*
++ * radeon_test_signaled must be called after
++ * set_current_state to prevent a race with wake_up_process
++ */
++ if (radeon_test_signaled(fence))
++ break;
++
++ if (rdev->needs_reset) {
++ t = -EDEADLK;
++ break;
++ }
++
++ t = schedule_timeout(t);
++
++ if (t > 0 && intr && signal_pending(current))
++ t = -ERESTARTSYS;
++ }
+
+- /*
+- * This function has to return -EDEADLK, but cannot hold
+- * exclusive_lock during the wait because some callers
+- * may already hold it. This means checking needs_reset without
+- * lock, and not fiddling with any gpu internals.
+- *
+- * The callback installed with fence_enable_sw_signaling will
+- * run before our wait_event_*timeout call, so we will see
+- * both the signaled fence and the changes to needs_reset.
+- */
+-
+- if (intr)
+- t = wait_event_interruptible_timeout(rdev->fence_queue,
+- ((signaled = radeon_test_signaled(fence)) ||
+- rdev->needs_reset), t);
+- else
+- t = wait_event_timeout(rdev->fence_queue,
+- ((signaled = radeon_test_signaled(fence)) ||
+- rdev->needs_reset), t);
++ __set_current_state(TASK_RUNNING);
++ fence_remove_callback(f, &cb.base);
+
+- if (t > 0 && !signaled)
+- return -EDEADLK;
+ return t;
+ }
+
--- /dev/null
+From b24d443b8f17d9776f5fc1f6c780a0a21eb02913 Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+Date: Wed, 4 Mar 2015 23:10:28 -0500
+Subject: ftrace: Clear REGS_EN and TRAMP_EN flags on disabling record via sysctl
+
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+
+commit b24d443b8f17d9776f5fc1f6c780a0a21eb02913 upstream.
+
+When /proc/sys/kernel/ftrace_enabled is set to zero, all function
+tracing is disabled. But the records that represent the functions
+still hold information about the ftrace_ops that are hooked to them.
+
+ftrace_ops may request "REGS" (have a full set of pt_regs passed to
+the callback), or "TRAMP" (the ops has its own trampoline to use).
+When the record is updated to represent the state of the ops hooked
+to it, it sets "REGS_EN" and/or "TRAMP_EN" to state that the callback
+points to the correct trampoline (REGS has its own trampoline).
+
+When ftrace_enabled is set to zero, all ftrace locations are a nop,
+so they do not point to any trampoline. But the _EN flags are still
+set. This can cause the accounting to go wrong when ftrace_enabled
+is cleared and an ops that has a trampoline is registered or unregistered.
+
+For example, the following will cause ftrace to crash:
+
+ # echo function_graph > /sys/kernel/debug/tracing/current_tracer
+ # echo 0 > /proc/sys/kernel/ftrace_enabled
+ # echo nop > /sys/kernel/debug/tracing/current_tracer
+ # echo 1 > /proc/sys/kernel/ftrace_enabled
+ # echo function_graph > /sys/kernel/debug/tracing/current_tracer
+
+As function_graph uses a trampoline, when ftrace_enabled is set to zero
+the updates to the record are not done. When enabling function_graph
+again, the record will still have the TRAMP_EN flag set, and it will
+look for an op that has a trampoline other than the function_graph
+ops, and fail to find one.
+
+Reported-by: Pratyush Anand <panand@redhat.com>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/ftrace.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -2041,8 +2041,12 @@ static int ftrace_check_record(struct dy
+ if (!ftrace_rec_count(rec))
+ rec->flags = 0;
+ else
+- /* Just disable the record (keep REGS state) */
+- rec->flags &= ~FTRACE_FL_ENABLED;
++ /*
++ * Just disable the record, but keep the ops TRAMP
++ * and REGS states. The _EN flags must be disabled though.
++ */
++ rec->flags &= ~(FTRACE_FL_ENABLED | FTRACE_FL_TRAMP_EN |
++ FTRACE_FL_REGS_EN);
+ }
+
+ return FTRACE_UPDATE_MAKE_NOP;
--- /dev/null
+From 1619dc3f8f555ee1cdd3c75db3885d5715442b12 Mon Sep 17 00:00:00 2001
+From: Pratyush Anand <panand@redhat.com>
+Date: Fri, 6 Mar 2015 23:58:06 +0530
+Subject: ftrace: Fix en(dis)able graph caller when en(dis)abling record via sysctl
+
+From: Pratyush Anand <panand@redhat.com>
+
+commit 1619dc3f8f555ee1cdd3c75db3885d5715442b12 upstream.
+
+When ftrace is enabled globally through the proc interface, we must check if
+ftrace_graph_active is set. If it is set, then we should also pass the
+FTRACE_START_FUNC_RET command to ftrace_run_update_code(). Similarly, when
+ftrace is disabled globally through the proc interface, we must check if
+ftrace_graph_active is set. If it is set, then we should also pass the
+FTRACE_STOP_FUNC_RET command to ftrace_run_update_code().
+
+Consider the following situation.
+
+ # echo 0 > /proc/sys/kernel/ftrace_enabled
+
+After this ftrace_enabled = 0.
+
+ # echo function_graph > /sys/kernel/debug/tracing/current_tracer
+
+Since ftrace_enabled = 0, ftrace_enable_ftrace_graph_caller() is never
+called.
+
+ # echo 1 > /proc/sys/kernel/ftrace_enabled
+
+Now ftrace_enabled will be set to true, but still
+ftrace_enable_ftrace_graph_caller() will not be called, which is not
+desired.
+
+Further if we execute the following after this:
+ # echo nop > /sys/kernel/debug/tracing/current_tracer
+
+Now since ftrace_enabled is set it will call
+ftrace_disable_ftrace_graph_caller(), which causes a kernel warning on
+the ARM platform.
+
+On the ARM platform, when ftrace_enable_ftrace_graph_caller() is called,
+it checks whether the old instruction is a nop or not. If it's not a nop,
+then it returns an error. If it is a nop then it replaces instruction at
+that address with a branch to ftrace_graph_caller.
+ftrace_disable_ftrace_graph_caller() behaves just the opposite. Therefore,
+if generic ftrace code ever calls either ftrace_enable_ftrace_graph_caller()
+or ftrace_disable_ftrace_graph_caller() consecutively two times in a row,
+then it will return an error, which will cause the generic ftrace code to
+raise a warning.
+
+Note, x86 does not have an issue with this because the architecture
+specific code for ftrace_enable_ftrace_graph_caller() and
+ftrace_disable_ftrace_graph_caller() does not check the previous state,
+and calling either of these functions twice in a row has no ill effect.
+
+Link: http://lkml.kernel.org/r/e4fbe64cdac0dd0e86a3bf914b0f83c0b419f146.1425666454.git.panand@redhat.com
+
+Signed-off-by: Pratyush Anand <panand@redhat.com>
+[
+ removed extra if (ftrace_start_up) and defined ftrace_graph_active as 0
+ if CONFIG_FUNCTION_GRAPH_TRACER is not set.
+]
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/ftrace.c | 28 ++++++++++++++++++++++------
+ 1 file changed, 22 insertions(+), 6 deletions(-)
+
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -1059,6 +1059,12 @@ static __init void ftrace_profile_debugf
+
+ static struct pid * const ftrace_swapper_pid = &init_struct_pid;
+
++#ifdef CONFIG_FUNCTION_GRAPH_TRACER
++static int ftrace_graph_active;
++#else
++# define ftrace_graph_active 0
++#endif
++
+ #ifdef CONFIG_DYNAMIC_FTRACE
+
+ static struct ftrace_ops *removed_ops;
+@@ -2692,24 +2698,36 @@ static int ftrace_shutdown(struct ftrace
+
+ static void ftrace_startup_sysctl(void)
+ {
++ int command;
++
+ if (unlikely(ftrace_disabled))
+ return;
+
+ /* Force update next time */
+ saved_ftrace_func = NULL;
+ /* ftrace_start_up is true if we want ftrace running */
+- if (ftrace_start_up)
+- ftrace_run_update_code(FTRACE_UPDATE_CALLS);
++ if (ftrace_start_up) {
++ command = FTRACE_UPDATE_CALLS;
++ if (ftrace_graph_active)
++ command |= FTRACE_START_FUNC_RET;
++ ftrace_run_update_code(command);
++ }
+ }
+
+ static void ftrace_shutdown_sysctl(void)
+ {
++ int command;
++
+ if (unlikely(ftrace_disabled))
+ return;
+
+ /* ftrace_start_up is true if ftrace is running */
+- if (ftrace_start_up)
+- ftrace_run_update_code(FTRACE_DISABLE_CALLS);
++ if (ftrace_start_up) {
++ command = FTRACE_DISABLE_CALLS;
++ if (ftrace_graph_active)
++ command |= FTRACE_STOP_FUNC_RET;
++ ftrace_run_update_code(command);
++ }
+ }
+
+ static cycle_t ftrace_update_time;
+@@ -5594,8 +5612,6 @@ static struct ftrace_ops graph_ops = {
+ ASSIGN_OPS_HASH(graph_ops, &global_ops.local_hash)
+ };
+
+-static int ftrace_graph_active;
+-
+ int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace)
+ {
+ return 0;
--- /dev/null
+From 524a38682573b2e15ab6317ccfe50280441514be Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+Date: Fri, 6 Mar 2015 19:55:13 -0500
+Subject: ftrace: Fix ftrace enable ordering of sysctl ftrace_enabled
+
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+
+commit 524a38682573b2e15ab6317ccfe50280441514be upstream.
+
+Some archs (specifically PowerPC), are sensitive with the ordering of
+the enabling of the calls to function tracing and setting of the
+function to use to be traced.
+
+That is, update_ftrace_function() sets what function the ftrace_caller
+trampoline should call. Some archs require this to be set before
+calling ftrace_run_update_code().
+
+Another bug was discovered, that ftrace_startup_sysctl() called
+ftrace_run_update_code() directly. If the function the ftrace_caller
+trampoline changes, then it will not be updated. Instead a call
+to ftrace_startup_enable() should be called because it tests to see
+if the callback changed since the code was disabled, and will
+tell the arch to update appropriately. Most archs do not need this
+notification, but PowerPC does.
+
+The problem could be seen by the following commands:
+
+ # echo 0 > /proc/sys/kernel/ftrace_enabled
+ # echo function > /sys/kernel/debug/tracing/current_tracer
+ # echo 1 > /proc/sys/kernel/ftrace_enabled
+ # cat /sys/kernel/debug/tracing/trace
+
+The trace will show that function tracing was not active.
+
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/ftrace.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -2710,7 +2710,7 @@ static void ftrace_startup_sysctl(void)
+ command = FTRACE_UPDATE_CALLS;
+ if (ftrace_graph_active)
+ command |= FTRACE_START_FUNC_RET;
+- ftrace_run_update_code(command);
++ ftrace_startup_enable(command);
+ }
+ }
+
+@@ -5580,12 +5580,12 @@ ftrace_enable_sysctl(struct ctl_table *t
+
+ if (ftrace_enabled) {
+
+- ftrace_startup_sysctl();
+-
+ /* we are starting ftrace again */
+ if (ftrace_ops_list != &ftrace_list_end)
+ update_ftrace_function();
+
++ ftrace_startup_sysctl();
++
+ } else {
+ /* stopping ftrace calls (just send to ftrace_stub) */
+ ftrace_trace_function = ftrace_stub;
--- /dev/null
+From 0d2783626a53d4c922f82d51fa675cb5d13f0d36 Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi@suse.cz>
+Date: Thu, 26 Feb 2015 11:45:47 +0100
+Subject: fuse: notify: don't move pages
+
+From: Miklos Szeredi <mszeredi@suse.cz>
+
+commit 0d2783626a53d4c922f82d51fa675cb5d13f0d36 upstream.
+
+fuse_try_move_page() is not prepared for replacing pages that have already
+been read.
+
+Reported-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/fuse/dev.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -1797,6 +1797,9 @@ copy_finish:
+ static int fuse_notify(struct fuse_conn *fc, enum fuse_notify_code code,
+ unsigned int size, struct fuse_copy_state *cs)
+ {
++ /* Don't try to move pages (yet) */
++ cs->move_pages = 0;
++
+ switch (code) {
+ case FUSE_NOTIFY_POLL:
+ return fuse_notify_poll(fc, size, cs);
--- /dev/null
+From aa991b3b267e24f578bac7b09cc57579b660304b Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi@suse.cz>
+Date: Thu, 26 Feb 2015 11:45:47 +0100
+Subject: fuse: set stolen page uptodate
+
+From: Miklos Szeredi <mszeredi@suse.cz>
+
+commit aa991b3b267e24f578bac7b09cc57579b660304b upstream.
+
+Regular pipe buffers' ->steal method (generic_pipe_buf_steal()) doesn't set
+PG_uptodate.
+
+Don't warn on this condition, just set the uptodate flag.
+
+Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/fuse/dev.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -890,8 +890,8 @@ static int fuse_try_move_page(struct fus
+
+ newpage = buf->page;
+
+- if (WARN_ON(!PageUptodate(newpage)))
+- return -EIO;
++ if (!PageUptodate(newpage))
++ SetPageUptodate(newpage);
+
+ ClearPageMappedToDisk(newpage);
+
--- /dev/null
+From d5e7cafd69da24e6d6cc988fab6ea313a2577efc Mon Sep 17 00:00:00 2001
+From: JeHyeon Yeon <tom.yeon@windriver.com>
+Date: Mon, 16 Mar 2015 01:03:19 +0000
+Subject: LZ4 : fix the data abort issue
+
+From: JeHyeon Yeon <tom.yeon@windriver.com>
+
+commit d5e7cafd69da24e6d6cc988fab6ea313a2577efc upstream.
+
+If the part of the compression data are corrupted, or the compression
+data is totally fake, the memory access over the limit is possible.
+
+This is the log from my system usning lz4 decompression.
+ [6502]data abort, halting
+ [6503]r0 0x00000000 r1 0x00000000 r2 0xdcea0ffc r3 0xdcea0ffc
+ [6509]r4 0xb9ab0bfd r5 0xdcea0ffc r6 0xdcea0ff8 r7 0xdce80000
+ [6515]r8 0x00000000 r9 0x00000000 r10 0x00000000 r11 0xb9a98000
+ [6522]r12 0xdcea1000 usp 0x00000000 ulr 0x00000000 pc 0x820149bc
+ [6528]spsr 0x400001f3
+and the memory addresses of some variables at the moment are
+ ref:0xdcea0ffc, op:0xdcea0ffc, oend:0xdcea1000
+
+As you can see, COPYLENGH is 8bytes, so @ref and @op can access the momory
+over @oend.
+
+Signed-off-by: JeHyeon Yeon <tom.yeon@windriver.com>
+Reviewed-by: David Sterba <dsterba@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ lib/lz4/lz4_decompress.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/lib/lz4/lz4_decompress.c
++++ b/lib/lz4/lz4_decompress.c
+@@ -139,6 +139,9 @@ static int lz4_uncompress(const char *so
+ /* Error: request to write beyond destination buffer */
+ if (cpy > oend)
+ goto _output_error;
++ if ((ref + COPYLENGTH) > oend ||
++ (op + COPYLENGTH) > oend)
++ goto _output_error;
+ LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
+ while (op < cpy)
+ *op++ = *ref++;
--- /dev/null
+From 7fd6f640f2dd17dac6ddd6702c378cb0bb9cfa11 Mon Sep 17 00:00:00 2001
+From: Peter Hurley <peter@hurleysoftware.com>
+Date: Wed, 11 Mar 2015 09:19:16 -0400
+Subject: serial: 8250_dw: Fix deadlock in LCR workaround
+
+From: Peter Hurley <peter@hurleysoftware.com>
+
+commit 7fd6f640f2dd17dac6ddd6702c378cb0bb9cfa11 upstream.
+
+Trying to write console output from within the serial console driver
+while the port->lock is held causes recursive deadlock:
+
+ CPU 0
+spin_lock_irqsave(&port->lock)
+printk()
+ console_unlock()
+ call_console_drivers()
+ serial8250_console_write()
+ spin_lock_irqsave(&port->lock)
+** DEADLOCK **
+
+The 8250_dw i/o accessors try to write a console error message if the
+LCR workaround was unsuccessful. When the port->lock is already held
+(eg., when called from serial8250_set_termios()), this deadlocks.
+
+Make the error message a FIXME until a general solution is devised.
+
+Cc: Tim Kryger <tim.kryger@gmail.com>
+Reported-by: Zhang Zhen <zhenzhang.zhang@huawei.com>
+Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/8250/8250_dw.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/drivers/tty/serial/8250/8250_dw.c
++++ b/drivers/tty/serial/8250/8250_dw.c
+@@ -111,7 +111,10 @@ static void dw8250_serial_out(struct uar
+ dw8250_force_idle(p);
+ writeb(value, p->membase + (UART_LCR << p->regshift));
+ }
+- dev_err(p->dev, "Couldn't set LCR to %d\n", value);
++ /*
++ * FIXME: this deadlocks if port->lock is already held
++ * dev_err(p->dev, "Couldn't set LCR to %d\n", value);
++ */
+ }
+ }
+
+@@ -155,7 +158,10 @@ static void dw8250_serial_outq(struct ua
+ __raw_writeq(value & 0xff,
+ p->membase + (UART_LCR << p->regshift));
+ }
+- dev_err(p->dev, "Couldn't set LCR to %d\n", value);
++ /*
++ * FIXME: this deadlocks if port->lock is already held
++ * dev_err(p->dev, "Couldn't set LCR to %d\n", value);
++ */
+ }
+ }
+ #endif /* CONFIG_64BIT */
+@@ -179,7 +185,10 @@ static void dw8250_serial_out32(struct u
+ dw8250_force_idle(p);
+ writel(value, p->membase + (UART_LCR << p->regshift));
+ }
+- dev_err(p->dev, "Couldn't set LCR to %d\n", value);
++ /*
++ * FIXME: this deadlocks if port->lock is already held
++ * dev_err(p->dev, "Couldn't set LCR to %d\n", value);
++ */
+ }
+ }
+
--- /dev/null
+From 2bb785169e9709d41220e5c18b0270883a82f85c Mon Sep 17 00:00:00 2001
+From: Peter Hurley <peter@hurleysoftware.com>
+Date: Sun, 1 Mar 2015 10:18:16 -0500
+Subject: serial: core: Fix iotype userspace breakage
+
+From: Peter Hurley <peter@hurleysoftware.com>
+
+commit 2bb785169e9709d41220e5c18b0270883a82f85c upstream.
+
+commit 3ffb1a8193bea ("serial: core: Add big-endian iotype")
+re-numbered userspace-dependent values; ioctl(TIOCSSERIAL) can
+assign the port iotype (which is expected to match the selected
+i/o accessors), so iotype values must not be changed.
+
+Cc: Kevin Cernekee <cernekee@gmail.com>
+Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
+Reviewed-by: Kevin Cernekee <cernekee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/serial_core.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/include/linux/serial_core.h
++++ b/include/linux/serial_core.h
+@@ -146,9 +146,9 @@ struct uart_port {
+ #define UPIO_HUB6 (1) /* Hub6 ISA card */
+ #define UPIO_MEM (2) /* 8b MMIO access */
+ #define UPIO_MEM32 (3) /* 32b little endian */
+-#define UPIO_MEM32BE (4) /* 32b big endian */
+-#define UPIO_AU (5) /* Au1x00 and RT288x type IO */
+-#define UPIO_TSI (6) /* Tsi108/109 type IO */
++#define UPIO_AU (4) /* Au1x00 and RT288x type IO */
++#define UPIO_TSI (5) /* Tsi108/109 type IO */
++#define UPIO_MEM32BE (6) /* 32b big endian */
+
+ unsigned int read_status_mask; /* driver specific */
+ unsigned int ignore_status_mask; /* driver specific */
tcp-fix-tcp-fin-memory-accounting.patch
net-compat-update-get_compat_msghdr-to-match-copy_msghdr_from_user-behaviour.patch
net-validate-the-range-we-feed-to-iov_iter_init-in-sys_sendto-sys_recvfrom.patch
+arm64-honor-__gfp_zero-in-dma-allocations.patch
+arm64-invalidate-the-tlb-corresponding-to-intermediate-page-table-levels.patch
+drm-radeon-fix-drm_ioctl_radeon_cs-oops.patch
+drm-radeon-do-a-posting-read-in-evergreen_set_irq.patch
+drm-radeon-do-a-posting-read-in-r100_set_irq.patch
+drm-radeon-do-a-posting-read-in-r600_set_irq.patch
+drm-radeon-do-a-posting-read-in-cik_set_irq.patch
+drm-radeon-do-a-posting-read-in-si_set_irq.patch
+drm-radeon-do-a-posting-read-in-rs600_set_irq.patch
+drm-radeon-fix-interlaced-modes-on-dce8.patch
+drm-radeon-drop-setting-upll-to-sleep-mode.patch
+drm-radeon-fix-wait-to-actually-occur-after-the-signaling-callback.patch
+drm-radeon-changing-number-of-compute-pipe-lines.patch
+drm-radeon-drop-ttm-two-ended-allocation.patch
+lz4-fix-the-data-abort-issue.patch
+fuse-set-stolen-page-uptodate.patch
+fuse-notify-don-t-move-pages.patch
+serial-core-fix-iotype-userspace-breakage.patch
+serial-8250_dw-fix-deadlock-in-lcr-workaround.patch
+console-fix-console-name-size-mismatch.patch
+virtio_console-init-work-unconditionally.patch
+virtio_console-avoid-config-access-from-irq.patch
+change-email-address-for-8250_pci.patch
+ftrace-clear-regs_en-and-tramp_en-flags-on-disabling-record-via-sysctl.patch
+ftrace-fix-en-dis-able-graph-caller-when-en-dis-abling-record-via-sysctl.patch
+ftrace-fix-ftrace-enable-ordering-of-sysctl-ftrace_enabled.patch
--- /dev/null
+From eeb8a7e8bb123e84daeef84f5a2eab99ad2839a2 Mon Sep 17 00:00:00 2001
+From: "Michael S. Tsirkin" <mst@redhat.com>
+Date: Thu, 5 Mar 2015 10:45:49 +1030
+Subject: virtio_console: avoid config access from irq
+
+From: "Michael S. Tsirkin" <mst@redhat.com>
+
+commit eeb8a7e8bb123e84daeef84f5a2eab99ad2839a2 upstream.
+
+when multiport is off, virtio console invokes config access from irq
+context, config access is blocking on s390.
+Fix this up by scheduling work from config irq - similar to what we do
+for multiport configs.
+
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Amit Shah <amit.shah@redhat.com>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/virtio_console.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/drivers/char/virtio_console.c
++++ b/drivers/char/virtio_console.c
+@@ -142,6 +142,7 @@ struct ports_device {
+ * notification
+ */
+ struct work_struct control_work;
++ struct work_struct config_work;
+
+ struct list_head ports;
+
+@@ -1837,10 +1838,21 @@ static void config_intr(struct virtio_de
+
+ portdev = vdev->priv;
+
++ if (!use_multiport(portdev))
++ schedule_work(&portdev->config_work);
++}
++
++static void config_work_handler(struct work_struct *work)
++{
++ struct ports_device *portdev;
++
++ portdev = container_of(work, struct ports_device, control_work);
+ if (!use_multiport(portdev)) {
++ struct virtio_device *vdev;
+ struct port *port;
+ u16 rows, cols;
+
++ vdev = portdev->vdev;
+ virtio_cread(vdev, struct virtio_console_config, cols, &cols);
+ virtio_cread(vdev, struct virtio_console_config, rows, &rows);
+
+@@ -2031,6 +2043,7 @@ static int virtcons_probe(struct virtio_
+
+ virtio_device_ready(portdev->vdev);
+
++ INIT_WORK(&portdev->config_work, &config_work_handler);
+ INIT_WORK(&portdev->control_work, &control_work_handler);
+
+ if (multiport) {
+@@ -2105,6 +2118,8 @@ static void virtcons_remove(struct virti
+ /* Finish up work that's lined up */
+ if (use_multiport(portdev))
+ cancel_work_sync(&portdev->control_work);
++ else
++ cancel_work_sync(&portdev->config_work);
+
+ list_for_each_entry_safe(port, port2, &portdev->ports, list)
+ unplug_port(port);
+@@ -2156,6 +2171,7 @@ static int virtcons_freeze(struct virtio
+
+ virtqueue_disable_cb(portdev->c_ivq);
+ cancel_work_sync(&portdev->control_work);
++ cancel_work_sync(&portdev->config_work);
+ /*
+ * Once more: if control_work_handler() was running, it would
+ * enable the cb as the last step.
--- /dev/null
+From 4f6e24ed9de8634d6471ef86b382cba6d4e57ca8 Mon Sep 17 00:00:00 2001
+From: "Michael S. Tsirkin" <mst@redhat.com>
+Date: Thu, 5 Mar 2015 10:45:30 +1030
+Subject: virtio_console: init work unconditionally
+
+From: "Michael S. Tsirkin" <mst@redhat.com>
+
+commit 4f6e24ed9de8634d6471ef86b382cba6d4e57ca8 upstream.
+
+when multiport is off, we don't initialize config work,
+but we then cancel uninitialized control_work on freeze.
+
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Amit Shah <amit.shah@redhat.com>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/virtio_console.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/char/virtio_console.c
++++ b/drivers/char/virtio_console.c
+@@ -2031,12 +2031,13 @@ static int virtcons_probe(struct virtio_
+
+ virtio_device_ready(portdev->vdev);
+
++ INIT_WORK(&portdev->control_work, &control_work_handler);
++
+ if (multiport) {
+ unsigned int nr_added_bufs;
+
+ spin_lock_init(&portdev->c_ivq_lock);
+ spin_lock_init(&portdev->c_ovq_lock);
+- INIT_WORK(&portdev->control_work, &control_work_handler);
+
+ nr_added_bufs = fill_queue(portdev->c_ivq,
+ &portdev->c_ivq_lock);
projects / thirdparty / kernel / stable-queue.git / commitdiff
