--- /dev/null
+From 4c7e309340ff85072e96f529582d159002c36734 Mon Sep 17 00:00:00 2001
+From: Dennis Yang <shinrairis@gmail.com>
+Date: Fri, 26 Jun 2015 15:25:48 +0100
+Subject: dm btree remove: fix bug in redistribute3
+
+From: Dennis Yang <shinrairis@gmail.com>
+
+commit 4c7e309340ff85072e96f529582d159002c36734 upstream.
+
+redistribute3() shares entries out across 3 nodes. Some entries were
+being moved the wrong way, breaking the ordering. This manifested as a
+BUG() in dm-btree-remove.c:shift() when entries were removed from the
+btree.
+
+For additional context see:
+https://www.redhat.com/archives/dm-devel/2015-May/msg00113.html
+
+Signed-off-by: Dennis Yang <shinrairis@gmail.com>
+Signed-off-by: Joe Thornber <ejt@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/persistent-data/dm-btree-remove.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/md/persistent-data/dm-btree-remove.c
++++ b/drivers/md/persistent-data/dm-btree-remove.c
+@@ -309,8 +309,8 @@ static void redistribute3(struct dm_btre
+
+ if (s < 0 && nr_center < -s) {
+ /* not enough in central node */
+- shift(left, center, nr_center);
+- s = nr_center - target;
++ shift(left, center, -nr_center);
++ s += nr_center;
+ shift(left, right, s);
+ nr_right += s;
+ } else
+@@ -323,7 +323,7 @@ static void redistribute3(struct dm_btre
+ if (s > 0 && nr_center < s) {
+ /* not enough in central node */
+ shift(center, right, nr_center);
+- s = target - nr_center;
++ s -= nr_center;
+ shift(left, right, s);
+ nr_left -= s;
+ } else
--- /dev/null
+From 1c7518794a3647eb345d59ee52844e8a40405198 Mon Sep 17 00:00:00 2001
+From: Joe Thornber <ejt@redhat.com>
+Date: Fri, 3 Jul 2015 14:51:32 +0100
+Subject: dm btree: silence lockdep lock inversion in dm_btree_del()
+
+From: Joe Thornber <ejt@redhat.com>
+
+commit 1c7518794a3647eb345d59ee52844e8a40405198 upstream.
+
+Allocate memory using GFP_NOIO when deleting a btree. dm_btree_del()
+can be called via an ioctl and we don't want to recurse into the FS or
+block layer.
+
+Signed-off-by: Joe Thornber <ejt@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/persistent-data/dm-btree.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/persistent-data/dm-btree.c
++++ b/drivers/md/persistent-data/dm-btree.c
+@@ -240,7 +240,7 @@ int dm_btree_del(struct dm_btree_info *i
+ int r;
+ struct del_stack *s;
+
+- s = kmalloc(sizeof(*s), GFP_KERNEL);
++ s = kmalloc(sizeof(*s), GFP_NOIO);
+ if (!s)
+ return -ENOMEM;
+ s->tm = info->tm;
--- /dev/null
+From 01447e9f04ba1c49a9534ae6a5a6f26c2bb05226 Mon Sep 17 00:00:00 2001
+From: Zhao Junwang <zhjwpku@gmail.com>
+Date: Tue, 7 Jul 2015 17:08:35 +0800
+Subject: drm: add a check for x/y in drm_mode_setcrtc
+
+From: Zhao Junwang <zhjwpku@gmail.com>
+
+commit 01447e9f04ba1c49a9534ae6a5a6f26c2bb05226 upstream.
+
+legacy setcrtc ioctl does take a 32 bit value which might indeed
+overflow
+
+the checks of crtc_req->x > INT_MAX and crtc_req->y > INT_MAX aren't
+needed any more with this
+
+v2: -polish the annotation according to Daniel's comment
+
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Zhao Junwang <zhjwpku@gmail.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_crtc.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/drm_crtc.c
++++ b/drivers/gpu/drm/drm_crtc.c
+@@ -1955,8 +1955,11 @@ int drm_mode_setcrtc(struct drm_device *
+ if (!drm_core_check_feature(dev, DRIVER_MODESET))
+ return -EINVAL;
+
+- /* For some reason crtc x/y offsets are signed internally. */
+- if (crtc_req->x > INT_MAX || crtc_req->y > INT_MAX)
++ /*
++ * Universal plane src offsets are only 16.16, prevent havoc for
++ * drivers using universal plane code internally.
++ */
++ if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000)
+ return -ERANGE;
+
+ drm_modeset_lock_all(dev);
--- /dev/null
+From 2fa19535ca6abcbfd1ccc9ef694db52f49f77747 Mon Sep 17 00:00:00 2001
+From: Frediano Ziglio <fziglio@redhat.com>
+Date: Wed, 3 Jun 2015 12:09:09 +0100
+Subject: drm/qxl: Do not cause spice-server to clean our objects
+
+From: Frediano Ziglio <fziglio@redhat.com>
+
+commit 2fa19535ca6abcbfd1ccc9ef694db52f49f77747 upstream.
+
+If objects are moved back from system memory to VRAM (and spice id
+created again) memory is already initialized so we need to set flag
+to not clear memory.
+If you don't do it after a while using desktop many images turns to
+black or transparents.
+
+Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
+Reviewed-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/qxl/qxl_cmd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/qxl/qxl_cmd.c
++++ b/drivers/gpu/drm/qxl/qxl_cmd.c
+@@ -500,6 +500,7 @@ int qxl_hw_surface_alloc(struct qxl_devi
+
+ cmd = (struct qxl_surface_cmd *)qxl_release_map(qdev, release);
+ cmd->type = QXL_SURFACE_CMD_CREATE;
++ cmd->flags = QXL_SURF_FLAG_KEEP_DATA;
+ cmd->u.surface_create.format = surf->surf.format;
+ cmd->u.surface_create.width = surf->surf.width;
+ cmd->u.surface_create.height = surf->surf.height;
--- /dev/null
+From 233709d2cd6bbaaeda0aeb8d11f6ca7f98563b39 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <michel.daenzer@amd.com>
+Date: Fri, 3 Jul 2015 10:02:27 +0900
+Subject: drm/radeon: Don't flush the GART TLB if rdev->gart.ptr == NULL
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <michel.daenzer@amd.com>
+
+commit 233709d2cd6bbaaeda0aeb8d11f6ca7f98563b39 upstream.
+
+This can be the case when the GPU is powered off, e.g. via vgaswitcheroo
+or runpm. When the GPU is powered up again, radeon_gart_table_vram_pin
+flushes the TLB after setting rdev->gart.ptr to non-NULL.
+
+Fixes panic on powering off R7xx GPUs.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=61529
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_gart.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_gart.c
++++ b/drivers/gpu/drm/radeon/radeon_gart.c
+@@ -251,8 +251,10 @@ void radeon_gart_unbind(struct radeon_de
+ }
+ }
+ }
+- mb();
+- radeon_gart_tlb_flush(rdev);
++ if (rdev->gart.ptr) {
++ mb();
++ radeon_gart_tlb_flush(rdev);
++ }
+ }
+
+ /**
+@@ -294,8 +296,10 @@ int radeon_gart_bind(struct radeon_devic
+ }
+ }
+ }
+- mb();
+- radeon_gart_tlb_flush(rdev);
++ if (rdev->gart.ptr) {
++ mb();
++ radeon_gart_tlb_flush(rdev);
++ }
+ return 0;
+ }
+
--- /dev/null
+From 39fa10f7e21574a70cecf1fed0f9b36535aa68a0 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 15 May 2015 11:48:52 -0400
+Subject: drm/radeon: take the mode_config mutex when dealing with hpds (v2)
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 39fa10f7e21574a70cecf1fed0f9b36535aa68a0 upstream.
+
+Since we are messing with state in the worker.
+
+v2: drop the changes in the mst worker
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_irq_kms.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
+@@ -73,10 +73,12 @@ static void radeon_hotplug_work_func(str
+ struct drm_mode_config *mode_config = &dev->mode_config;
+ struct drm_connector *connector;
+
++ mutex_lock(&mode_config->mutex);
+ if (mode_config->num_connector) {
+ list_for_each_entry(connector, &mode_config->connector_list, head)
+ radeon_connector_hotplug(connector);
+ }
++ mutex_unlock(&mode_config->mutex);
+ /* Just fire off a uevent and let userspace tell us what to do */
+ drm_helper_hpd_irq_event(dev);
+ }
--- /dev/null
+From 9098f84cced870f54d8c410dd2444cfa61467fa0 Mon Sep 17 00:00:00 2001
+From: Tomas Winkler <tomas.winkler@intel.com>
+Date: Thu, 16 Jul 2015 15:50:45 +0200
+Subject: mmc: block: Add missing mmc_blk_put() in power_ro_lock_show()
+
+From: Tomas Winkler <tomas.winkler@intel.com>
+
+commit 9098f84cced870f54d8c410dd2444cfa61467fa0 upstream.
+
+Enclosing mmc_blk_put() is missing in power_ro_lock_show() sysfs handler,
+let's add it.
+
+Fixes: add710eaa886 ("mmc: boot partition ro lock support")
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/card/block.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/mmc/card/block.c
++++ b/drivers/mmc/card/block.c
+@@ -202,6 +202,8 @@ static ssize_t power_ro_lock_show(struct
+
+ ret = snprintf(buf, PAGE_SIZE, "%d\n", locked);
+
++ mmc_blk_put(md);
++
+ return ret;
+ }
+
usb-cp210x-add-id-for-aruba-networks-controllers.patch
usb-option-add-2020-4000-id.patch
usb-xhci-bugfix-for-null-pointer-deference-in-xhci_endpoint_init-function.patch
+dm-btree-remove-fix-bug-in-redistribute3.patch
+dm-btree-silence-lockdep-lock-inversion-in-dm_btree_del.patch
+mmc-block-add-missing-mmc_blk_put-in-power_ro_lock_show.patch
+drm-qxl-do-not-cause-spice-server-to-clean-our-objects.patch
+drm-radeon-take-the-mode_config-mutex-when-dealing-with-hpds-v2.patch
+drm-radeon-don-t-flush-the-gart-tlb-if-rdev-gart.ptr-null.patch
+drm-add-a-check-for-x-y-in-drm_mode_setcrtc.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
