From: Greg Kroah-Hartman Date: Sun, 1 May 2016 22:15:24 +0000 (-0700) Subject: 4.5-stable patches X-Git-Tag: v3.14.68~44 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0281e1430de73d690ac49d164d219b299136da7a;p=thirdparty%2Fkernel%2Fstable-queue.git 4.5-stable patches added patches: alsa-hda-add-dock-support-for-thinkpad-x260.patch alsa-hda-add-pci-id-for-intel-broxton-t.patch alsa-hda-don-t-trust-the-reported-actual-power-state.patch alsa-hda-keep-powering-up-adcs-on-cirrus-codecs.patch alsa-hda-realtek-add-alc3234-headset-mode-for-optiplex-9020m.patch alsa-hda-update-bclk-also-at-hotplug-for-i915-hsw-bdw.patch alsa-pcxhr-fix-missing-mutex-unlock.patch asm-generic-futex-re-enable-preemption-in-futex_atomic_cmpxchg_inatomic.patch cpufreq-intel_pstate-fix-processing-for-turbo-activation-ratio.patch drm-i915-exit-cherryview_irq_handler-after-one-pass.patch drm-i915-fix-race-condition-in-intel_dp_destroy_mst_connector.patch drm-nouveau-core-use-vzalloc-for-allocating-ramht.patch drm-qxl-fix-cursor-position-with-non-zero-hotspot.patch futex-acknowledge-a-new-waiter-in-counter-before-plist.patch futex-handle-unlock_pi-race-gracefully.patch revert-drm-amdgpu-disable-runtime-pm-on-px-laptops-without-dgpu-power-control.patch revert-drm-radeon-disable-runtime-pm-on-px-laptops-without-dgpu-power-control.patch revert-pci-imx6-add-support-for-active-low-reset-gpio.patch usbvision-revert-commit-588afcc1.patch x86-edac-sb_edac.c-repair-damage-introduced-when-fixing-channel-address.patch x86-edac-sb_edac.c-take-account-of-channel-hashing-when-needed.patch x86-mm-xen-suppress-hugetlbfs-in-pv-guests.patch --- diff --git a/queue-4.5/alsa-hda-add-dock-support-for-thinkpad-x260.patch b/queue-4.5/alsa-hda-add-dock-support-for-thinkpad-x260.patch new file mode 100644 index 00000000000..1587556b395 --- /dev/null +++ b/queue-4.5/alsa-hda-add-dock-support-for-thinkpad-x260.patch @@ -0,0 +1,30 @@ +From 037e119738120c1cdc460c6ae33871c3000531f3 Mon Sep 17 00:00:00 2001 +From: Conrad Kostecki +Date: Tue, 26 Apr 2016 10:08:10 +0200 +Subject: ALSA: hda - Add dock support for ThinkPad X260 + +From: Conrad Kostecki + +commit 037e119738120c1cdc460c6ae33871c3000531f3 upstream. + +Fixes audio output on a ThinkPad X260, when using Lenovo CES 2013 +docking station series (basic, pro, ultra). + +Signed-off-by: Conrad Kostecki +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5584,6 +5584,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x17aa, 0x5034, "Thinkpad T450", ALC292_FIXUP_TPT440_DOCK), + SND_PCI_QUIRK(0x17aa, 0x5036, "Thinkpad T450s", ALC292_FIXUP_TPT440_DOCK), + SND_PCI_QUIRK(0x17aa, 0x503c, "Thinkpad L450", ALC292_FIXUP_TPT440_DOCK), ++ SND_PCI_QUIRK(0x17aa, 0x504a, "ThinkPad X260", ALC292_FIXUP_TPT440_DOCK), + SND_PCI_QUIRK(0x17aa, 0x504b, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE), + SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K), diff --git a/queue-4.5/alsa-hda-add-pci-id-for-intel-broxton-t.patch b/queue-4.5/alsa-hda-add-pci-id-for-intel-broxton-t.patch new file mode 100644 index 00000000000..a9bb54384e8 --- /dev/null +++ b/queue-4.5/alsa-hda-add-pci-id-for-intel-broxton-t.patch @@ -0,0 +1,32 @@ +From 9859a971ca228725425238756ee89c6133306ec8 Mon Sep 17 00:00:00 2001 +From: "Lu, Han" +Date: Wed, 20 Apr 2016 10:08:43 +0800 +Subject: ALSA: hda - add PCI ID for Intel Broxton-T + +From: Lu, Han + +commit 9859a971ca228725425238756ee89c6133306ec8 upstream. + +Add HD Audio Device PCI ID for the Intel Broxton-T platform. +It is an HDA Intel PCH controller. + +Signed-off-by: Lu, Han +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_intel.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2232,6 +2232,9 @@ static const struct pci_device_id azx_id + /* Broxton-P(Apollolake) */ + { PCI_DEVICE(0x8086, 0x5a98), + .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_BROXTON }, ++ /* Broxton-T */ ++ { PCI_DEVICE(0x8086, 0x1a98), ++ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_BROXTON }, + /* Haswell */ + { PCI_DEVICE(0x8086, 0x0a0c), + .driver_data = AZX_DRIVER_HDMI | AZX_DCAPS_INTEL_HASWELL }, diff --git a/queue-4.5/alsa-hda-don-t-trust-the-reported-actual-power-state.patch b/queue-4.5/alsa-hda-don-t-trust-the-reported-actual-power-state.patch new file mode 100644 index 00000000000..54cba46fd40 --- /dev/null +++ b/queue-4.5/alsa-hda-don-t-trust-the-reported-actual-power-state.patch @@ -0,0 +1,58 @@ +From 50fd4987c4f3c3ebf0ce94d932732011bbdc7c71 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sun, 17 Apr 2016 09:39:41 +0200 +Subject: ALSA: hda - Don't trust the reported actual power state + +From: Takashi Iwai + +commit 50fd4987c4f3c3ebf0ce94d932732011bbdc7c71 upstream. + +We've got a regression report that the recording on Mac with a cirrus +codec doesn't work any longer. This turned out to be the missing +power up to D0 by power_save_node enablement. + +After analyzing the traces, we found out that the culprit is that the +codec advertises the "actual" power state of a few nodes to be D0 +while the "target" power state is D3. This inconsistency is usually +OK, as it implies the power transition. But in the case of cirrus +codec, this seems to be stuck to D3 while it's not actually D0. + +This patch addresses the issue by checking the power state difference +more strictly. It sends the power-state change verb unless both the +target and the actual power states show the given value. + +We may introduce yet another flag indicating the possible broken +hardware power state, but it's anyway safer to set the proper power +state even in a transition (at least it's harmless as long as the +target state is same). So this simpler change was applied now. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=116171 +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_generic.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/sound/pci/hda/hda_generic.c ++++ b/sound/pci/hda/hda_generic.c +@@ -826,7 +826,7 @@ static hda_nid_t path_power_update(struc + bool allow_powerdown) + { + hda_nid_t nid, changed = 0; +- int i, state; ++ int i, state, power; + + for (i = 0; i < path->depth; i++) { + nid = path->path[i]; +@@ -838,7 +838,9 @@ static hda_nid_t path_power_update(struc + state = AC_PWRST_D0; + else + state = AC_PWRST_D3; +- if (!snd_hda_check_power_state(codec, nid, state)) { ++ power = snd_hda_codec_read(codec, nid, 0, ++ AC_VERB_GET_POWER_STATE, 0); ++ if (power != (state | (state << 4))) { + snd_hda_codec_write(codec, nid, 0, + AC_VERB_SET_POWER_STATE, state); + changed = nid; diff --git a/queue-4.5/alsa-hda-keep-powering-up-adcs-on-cirrus-codecs.patch b/queue-4.5/alsa-hda-keep-powering-up-adcs-on-cirrus-codecs.patch new file mode 100644 index 00000000000..cef3c6a4c2c --- /dev/null +++ b/queue-4.5/alsa-hda-keep-powering-up-adcs-on-cirrus-codecs.patch @@ -0,0 +1,61 @@ +From de3df8a986b635082a1d94bae2c361d043c57106 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 19 Apr 2016 22:07:50 +0200 +Subject: ALSA: hda - Keep powering up ADCs on Cirrus codecs + +From: Takashi Iwai + +commit de3df8a986b635082a1d94bae2c361d043c57106 upstream. + +Although one weird behavior about the input path (inconsistent D0/D3 +switch) on Cirrus CS420x codecs was fixed in the previous commit, +there is still an issue on some Mac machines: the capture stream +stalls when switching the ADCs on the fly. More badly, this keeps +stuck until the next reboot. + +The dynamic ADC switching is already a bit fragile and assuming +optimistically that the chip accepts the frequent power changes. On +Cirrus codecs, this doesn't seem applicable. + +As a quick workaround, we pin down the ADCs to keep up in D0 when +spec->dyn_adc_switch is set. In this way, the ADCs are kept up only +for the system that were confirmed to be broken. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=116171 +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_cirrus.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/sound/pci/hda/patch_cirrus.c ++++ b/sound/pci/hda/patch_cirrus.c +@@ -361,6 +361,7 @@ static int cs_parse_auto_config(struct h + { + struct cs_spec *spec = codec->spec; + int err; ++ int i; + + err = snd_hda_parse_pin_defcfg(codec, &spec->gen.autocfg, NULL, 0); + if (err < 0) +@@ -370,6 +371,19 @@ static int cs_parse_auto_config(struct h + if (err < 0) + return err; + ++ /* keep the ADCs powered up when it's dynamically switchable */ ++ if (spec->gen.dyn_adc_switch) { ++ unsigned int done = 0; ++ for (i = 0; i < spec->gen.input_mux.num_items; i++) { ++ int idx = spec->gen.dyn_adc_idx[i]; ++ if (done & (1 << idx)) ++ continue; ++ snd_hda_gen_fix_pin_power(codec, ++ spec->gen.adc_nids[idx]); ++ done |= 1 << idx; ++ } ++ } ++ + return 0; + } + diff --git a/queue-4.5/alsa-hda-realtek-add-alc3234-headset-mode-for-optiplex-9020m.patch b/queue-4.5/alsa-hda-realtek-add-alc3234-headset-mode-for-optiplex-9020m.patch new file mode 100644 index 00000000000..c47c6b2ea64 --- /dev/null +++ b/queue-4.5/alsa-hda-realtek-add-alc3234-headset-mode-for-optiplex-9020m.patch @@ -0,0 +1,40 @@ +From afecb146d8d8a60a1dde9cdf570c278649617fde Mon Sep 17 00:00:00 2001 +From: Bastien Nocera +Date: Mon, 18 Apr 2016 11:10:42 +0200 +Subject: ALSA: hda/realtek - Add ALC3234 headset mode for Optiplex 9020m + +From: Bastien Nocera + +commit afecb146d8d8a60a1dde9cdf570c278649617fde upstream. + +The Optiplex 9020m with Haswell-DT processor needs a quirk for the +headset jack at the front of the machine to be able to use microphones. + +A quirk for this model was originally added in 3127899, but c77900e +removed it in favour of a more generic version. + +Unfortunately, pin configurations can changed based on firmware/BIOS +versions, and the generic version doesn't have any effect on newer +versions of the machine/firmware anymore. + +With help from David Henningsson + +Signed-off-by: Bastien Nocera +Tested-by: Bastien Nocera +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5449,6 +5449,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1028, 0x064a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x064b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x0665, "Dell XPS 13", ALC288_FIXUP_DELL_XPS_13), ++ SND_PCI_QUIRK(0x1028, 0x0669, "Dell Optiplex 9020m", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x069a, "Dell Vostro 5480", ALC290_FIXUP_SUBWOOFER_HSJACK), + SND_PCI_QUIRK(0x1028, 0x06c7, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x06d9, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), diff --git a/queue-4.5/alsa-hda-update-bclk-also-at-hotplug-for-i915-hsw-bdw.patch b/queue-4.5/alsa-hda-update-bclk-also-at-hotplug-for-i915-hsw-bdw.patch new file mode 100644 index 00000000000..5e4aabe710a --- /dev/null +++ b/queue-4.5/alsa-hda-update-bclk-also-at-hotplug-for-i915-hsw-bdw.patch @@ -0,0 +1,242 @@ +From bb03ed216370cb021f377f923471e56d1de3ff5d Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 21 Apr 2016 16:39:17 +0200 +Subject: ALSA: hda - Update BCLK also at hotplug for i915 HSW/BDW + +From: Takashi Iwai + +commit bb03ed216370cb021f377f923471e56d1de3ff5d upstream. + +The recent bug report suggests that BCLK setup for i915 HSW/BDW needs +to be updated at each HDMI hotplug, not only at initialization and +resume. That is, we need to update HSW_EM4 and HSW_EM5 registers at +ELD notification, too. Otherwise the HDMI audio may be out of sync +and played in a wrong pitch. + +However, the HDA codec driver has no access to the controller +registers, and currently the code managing these registers is in +hda_intel.c, i.e. local to the controller driver. For allowing the +explicit BCLK update from the codec driver, as in this patch, the +former haswell_set_bclk() in hda_intel.c is moved to hdac_i915.c and +exposed as snd_hdac_i915_set_bclk(). This is called from both the HDA +controller driver and intel_pin_eld_notify() in HDMI codec driver. + +Along with this change, snd_hdac_get_display_clk() gets dropped as +it's no longer used. + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91410 +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + include/sound/hda_i915.h | 5 +-- + sound/hda/hdac_i915.c | 62 +++++++++++++++++++++++++++++++++++++-------- + sound/pci/hda/hda_intel.c | 56 ++-------------------------------------- + sound/pci/hda/patch_hdmi.c | 1 + 4 files changed, 58 insertions(+), 66 deletions(-) + +--- a/include/sound/hda_i915.h ++++ b/include/sound/hda_i915.h +@@ -9,7 +9,7 @@ + #ifdef CONFIG_SND_HDA_I915 + int snd_hdac_set_codec_wakeup(struct hdac_bus *bus, bool enable); + int snd_hdac_display_power(struct hdac_bus *bus, bool enable); +-int snd_hdac_get_display_clk(struct hdac_bus *bus); ++void snd_hdac_i915_set_bclk(struct hdac_bus *bus); + int snd_hdac_sync_audio_rate(struct hdac_bus *bus, hda_nid_t nid, int rate); + int snd_hdac_acomp_get_eld(struct hdac_bus *bus, hda_nid_t nid, + bool *audio_enabled, char *buffer, int max_bytes); +@@ -25,9 +25,8 @@ static inline int snd_hdac_display_power + { + return 0; + } +-static inline int snd_hdac_get_display_clk(struct hdac_bus *bus) ++static inline void snd_hdac_i915_set_bclk(struct hdac_bus *bus) + { +- return 0; + } + static inline int snd_hdac_sync_audio_rate(struct hdac_bus *bus, hda_nid_t nid, + int rate) +--- a/sound/hda/hdac_i915.c ++++ b/sound/hda/hdac_i915.c +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + + static struct i915_audio_component *hdac_acomp; + +@@ -97,26 +98,65 @@ int snd_hdac_display_power(struct hdac_b + } + EXPORT_SYMBOL_GPL(snd_hdac_display_power); + ++#define CONTROLLER_IN_GPU(pci) (((pci)->device == 0x0a0c) || \ ++ ((pci)->device == 0x0c0c) || \ ++ ((pci)->device == 0x0d0c) || \ ++ ((pci)->device == 0x160c)) ++ + /** +- * snd_hdac_get_display_clk - Get CDCLK in kHz ++ * snd_hdac_i915_set_bclk - Reprogram BCLK for HSW/BDW + * @bus: HDA core bus + * +- * This function is supposed to be used only by a HD-audio controller +- * driver that needs the interaction with i915 graphics. ++ * Intel HSW/BDW display HDA controller is in GPU. Both its power and link BCLK ++ * depends on GPU. Two Extended Mode registers EM4 (M value) and EM5 (N Value) ++ * are used to convert CDClk (Core Display Clock) to 24MHz BCLK: ++ * BCLK = CDCLK * M / N ++ * The values will be lost when the display power well is disabled and need to ++ * be restored to avoid abnormal playback speed. + * +- * This function queries CDCLK value in kHz from the graphics driver and +- * returns the value. A negative code is returned in error. ++ * Call this function at initializing and changing power well, as well as ++ * at ELD notifier for the hotplug. + */ +-int snd_hdac_get_display_clk(struct hdac_bus *bus) ++void snd_hdac_i915_set_bclk(struct hdac_bus *bus) + { + struct i915_audio_component *acomp = bus->audio_component; ++ struct pci_dev *pci = to_pci_dev(bus->dev); ++ int cdclk_freq; ++ unsigned int bclk_m, bclk_n; ++ ++ if (!acomp || !acomp->ops || !acomp->ops->get_cdclk_freq) ++ return; /* only for i915 binding */ ++ if (!CONTROLLER_IN_GPU(pci)) ++ return; /* only HSW/BDW */ ++ ++ cdclk_freq = acomp->ops->get_cdclk_freq(acomp->dev); ++ switch (cdclk_freq) { ++ case 337500: ++ bclk_m = 16; ++ bclk_n = 225; ++ break; ++ ++ case 450000: ++ default: /* default CDCLK 450MHz */ ++ bclk_m = 4; ++ bclk_n = 75; ++ break; ++ ++ case 540000: ++ bclk_m = 4; ++ bclk_n = 90; ++ break; ++ ++ case 675000: ++ bclk_m = 8; ++ bclk_n = 225; ++ break; ++ } + +- if (!acomp || !acomp->ops) +- return -ENODEV; +- +- return acomp->ops->get_cdclk_freq(acomp->dev); ++ snd_hdac_chip_writew(bus, HSW_EM4, bclk_m); ++ snd_hdac_chip_writew(bus, HSW_EM5, bclk_n); + } +-EXPORT_SYMBOL_GPL(snd_hdac_get_display_clk); ++EXPORT_SYMBOL_GPL(snd_hdac_i915_set_bclk); + + /* There is a fixed mapping between audio pin node and display port + * on current Intel platforms: +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -857,50 +857,6 @@ static int param_set_xint(const char *va + #define azx_del_card_list(chip) /* NOP */ + #endif /* CONFIG_PM */ + +-/* Intel HSW/BDW display HDA controller is in GPU. Both its power and link BCLK +- * depends on GPU. Two Extended Mode registers EM4 (M value) and EM5 (N Value) +- * are used to convert CDClk (Core Display Clock) to 24MHz BCLK: +- * BCLK = CDCLK * M / N +- * The values will be lost when the display power well is disabled and need to +- * be restored to avoid abnormal playback speed. +- */ +-static void haswell_set_bclk(struct hda_intel *hda) +-{ +- struct azx *chip = &hda->chip; +- int cdclk_freq; +- unsigned int bclk_m, bclk_n; +- +- if (!hda->need_i915_power) +- return; +- +- cdclk_freq = snd_hdac_get_display_clk(azx_bus(chip)); +- switch (cdclk_freq) { +- case 337500: +- bclk_m = 16; +- bclk_n = 225; +- break; +- +- case 450000: +- default: /* default CDCLK 450MHz */ +- bclk_m = 4; +- bclk_n = 75; +- break; +- +- case 540000: +- bclk_m = 4; +- bclk_n = 90; +- break; +- +- case 675000: +- bclk_m = 8; +- bclk_n = 225; +- break; +- } +- +- azx_writew(chip, HSW_EM4, bclk_m); +- azx_writew(chip, HSW_EM5, bclk_n); +-} +- + #if defined(CONFIG_PM_SLEEP) || defined(SUPPORT_VGA_SWITCHEROO) + /* + * power management +@@ -958,7 +914,7 @@ static int azx_resume(struct device *dev + if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL + && hda->need_i915_power) { + snd_hdac_display_power(azx_bus(chip), true); +- haswell_set_bclk(hda); ++ snd_hdac_i915_set_bclk(azx_bus(chip)); + } + if (chip->msi) + if (pci_enable_msi(pci) < 0) +@@ -1058,7 +1014,7 @@ static int azx_runtime_resume(struct dev + bus = azx_bus(chip); + if (hda->need_i915_power) { + snd_hdac_display_power(bus, true); +- haswell_set_bclk(hda); ++ snd_hdac_i915_set_bclk(bus); + } else { + /* toggle codec wakeup bit for STATESTS read */ + snd_hdac_set_codec_wakeup(bus, true); +@@ -1796,12 +1752,8 @@ static int azx_first_init(struct azx *ch + /* initialize chip */ + azx_init_pci(chip); + +- if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) { +- struct hda_intel *hda; +- +- hda = container_of(chip, struct hda_intel, chip); +- haswell_set_bclk(hda); +- } ++ if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) ++ snd_hdac_i915_set_bclk(bus); + + hda_intel_init_chip(chip, (probe_only[dev] & 2) == 0); + +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -2452,6 +2452,7 @@ static void intel_pin_eld_notify(void *a + if (atomic_read(&(codec)->core.in_pm)) + return; + ++ snd_hdac_i915_set_bclk(&codec->bus->core); + check_presence_and_report(codec, pin_nid); + } + diff --git a/queue-4.5/alsa-pcxhr-fix-missing-mutex-unlock.patch b/queue-4.5/alsa-pcxhr-fix-missing-mutex-unlock.patch new file mode 100644 index 00000000000..2f1a7022345 --- /dev/null +++ b/queue-4.5/alsa-pcxhr-fix-missing-mutex-unlock.patch @@ -0,0 +1,31 @@ +From 67f3754b51f22b18c4820fb84062f658c30e8644 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 21 Apr 2016 17:37:54 +0200 +Subject: ALSA: pcxhr: Fix missing mutex unlock + +From: Takashi Iwai + +commit 67f3754b51f22b18c4820fb84062f658c30e8644 upstream. + +The commit [9bef72bdb26e: ALSA: pcxhr: Use nonatomic PCM ops] +converted to non-atomic PCM ops, but shamelessly with an unbalanced +mutex locking, which leads to the hangup easily. Fix it. + +Fixes: 9bef72bdb26e ('ALSA: pcxhr: Use nonatomic PCM ops') +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=116441 +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/pcxhr/pcxhr_core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/pcxhr/pcxhr_core.c ++++ b/sound/pci/pcxhr/pcxhr_core.c +@@ -1341,5 +1341,6 @@ irqreturn_t pcxhr_threaded_irq(int irq, + } + + pcxhr_msg_thread(mgr); ++ mutex_unlock(&mgr->lock); + return IRQ_HANDLED; + } diff --git a/queue-4.5/asm-generic-futex-re-enable-preemption-in-futex_atomic_cmpxchg_inatomic.patch b/queue-4.5/asm-generic-futex-re-enable-preemption-in-futex_atomic_cmpxchg_inatomic.patch new file mode 100644 index 00000000000..03fd872b44c --- /dev/null +++ b/queue-4.5/asm-generic-futex-re-enable-preemption-in-futex_atomic_cmpxchg_inatomic.patch @@ -0,0 +1,56 @@ +From fba7cd681b6155e2d93e7862fcd6f970336b83c3 Mon Sep 17 00:00:00 2001 +From: Romain Perier +Date: Thu, 14 Apr 2016 15:36:03 +0200 +Subject: asm-generic/futex: Re-enable preemption in futex_atomic_cmpxchg_inatomic() + +From: Romain Perier + +commit fba7cd681b6155e2d93e7862fcd6f970336b83c3 upstream. + +The recent decoupling of pagefault disable and preempt disable added an +explicit preempt_disable/enable() pair to the futex_atomic_cmpxchg_inatomic() +implementation in asm-generic/futex.h. But it forgot to add preempt_enable() +calls to the error handling code pathes, which results in a preemption count +imbalance. + +This is observable on boot when the test for atomic_cmpxchg() is calling +futex_atomic_cmpxchg_inatomic() on a NULL pointer. + +Add the missing preempt_enable() calls to the error handling code pathes. + +[ tglx: Massaged changelog ] + +Fixes: d9b9ff8c1889 ("sched/preempt, futex: Disable preemption in UP futex_atomic_cmpxchg_inatomic() explicitly") +Signed-off-by: Romain Perier +Cc: linux-arch@vger.kernel.org +Cc: Thomas Petazzoni +Cc: Arnd Bergmann +Cc: Peter Zijlstra +Link: http://lkml.kernel.org/r/1460640963-690-1-git-send-email-romain.perier@free-electrons.com +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + include/asm-generic/futex.h | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/include/asm-generic/futex.h ++++ b/include/asm-generic/futex.h +@@ -108,11 +108,15 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, + u32 val; + + preempt_disable(); +- if (unlikely(get_user(val, uaddr) != 0)) ++ if (unlikely(get_user(val, uaddr) != 0)) { ++ preempt_enable(); + return -EFAULT; ++ } + +- if (val == oldval && unlikely(put_user(newval, uaddr) != 0)) ++ if (val == oldval && unlikely(put_user(newval, uaddr) != 0)) { ++ preempt_enable(); + return -EFAULT; ++ } + + *uval = val; + preempt_enable(); diff --git a/queue-4.5/cpufreq-intel_pstate-fix-processing-for-turbo-activation-ratio.patch b/queue-4.5/cpufreq-intel_pstate-fix-processing-for-turbo-activation-ratio.patch new file mode 100644 index 00000000000..531d02ef16b --- /dev/null +++ b/queue-4.5/cpufreq-intel_pstate-fix-processing-for-turbo-activation-ratio.patch @@ -0,0 +1,37 @@ +From 1becf03545a0859ceaaf9e8c2d9861882a71cb01 Mon Sep 17 00:00:00 2001 +From: Srinivas Pandruvada +Date: Fri, 22 Apr 2016 19:53:59 -0700 +Subject: cpufreq: intel_pstate: Fix processing for turbo activation ratio + +From: Srinivas Pandruvada + +commit 1becf03545a0859ceaaf9e8c2d9861882a71cb01 upstream. + +When the config TDP level is not nominal (level = 0), the MSR values for +reading level 1 and level 2 ratios contain power in low 14 bits and actual +ratio bits are at bits [23:16]. The current processing for level 1 and +level 2 is wrong as there is no shift done to get actual ratio. + +Fixes: 6a35fc2d6c22 (cpufreq: intel_pstate: get P1 from TAR when available) +Signed-off-by: Srinivas Pandruvada +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpufreq/intel_pstate.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -673,6 +673,11 @@ static int core_get_max_pstate(void) + if (err) + goto skip_tar; + ++ /* For level 1 and 2, bits[23:16] contain the ratio */ ++ if (tdp_ctrl) ++ tdp_ratio >>= 16; ++ ++ tdp_ratio &= 0xff; /* ratios are only 8 bits long */ + if (tdp_ratio - 1 == tar) { + max_pstate = tar; + pr_debug("max_pstate=TAC %x\n", max_pstate); diff --git a/queue-4.5/drm-i915-exit-cherryview_irq_handler-after-one-pass.patch b/queue-4.5/drm-i915-exit-cherryview_irq_handler-after-one-pass.patch new file mode 100644 index 00000000000..468a5946fb2 --- /dev/null +++ b/queue-4.5/drm-i915-exit-cherryview_irq_handler-after-one-pass.patch @@ -0,0 +1,105 @@ +From 9dbaab56ac09f07a73fe83bf69bec3e31060080a Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Mon, 14 Mar 2016 09:01:57 +0000 +Subject: drm/i915: Exit cherryview_irq_handler() after one pass +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chris Wilson + +commit 9dbaab56ac09f07a73fe83bf69bec3e31060080a upstream. + +This effectively reverts + +commit 8e5fd599eb219f1054e39b40d18b217af669eea9 +Author: Ville Syrjälä +Date: Wed Apr 9 13:28:50 2014 +0300 + + drm/i915/chv: Make CHV irq handler loop until all interrupts are consumed + +as under continuous execlists load we can saturate the IRQ handler, +destablising the tsc clock and triggering the NMI watchdog to declare a hung +CPU. + +[ 552.756051] clocksource: timekeeping watchdog on CPU0: Marking clocksource 'tsc' as unstable because the skew is too large: +[ 552.756080] clocksource: 'refined-jiffies' wd_now: 10003b480 wd_last: 10003b28c mask: ffffffff +[ 552.756091] clocksource: 'tsc' cs_now: d55d31aa50 cs_last: d17446166c mask: ffffffffffffffff +[ 552.756210] clocksource: Switched to clocksource refined-jiffies +[ 575.217870] NMI watchdog: Watchdog detected hard LOCKUP on cpu 1 +[ 575.217893] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.5.0-rc7+ #18 +[ 575.217905] Hardware name: /NUC5CPYB, BIOS PYBSWCEL.86A.0027.2015.0507.1758 05/07/2015 +[ 575.217915] 0000000000000000 ffff88027fd05bc0 ffffffff81288c6d 0000000000000000 +[ 575.217935] 0000000000000001 ffff88027fd05be0 ffffffff810e72d1 0000000000000000 +[ 575.217951] ffff88027fd05c80 ffff88027fd05c20 ffffffff81114b60 0000000181015f1e +[ 575.217967] Call Trace: +[ 575.217973] [] dump_stack+0x4f/0x72 +[ 575.217994] [] watchdog_overflow_callback+0x151/0x160 +[ 575.218003] [] __perf_event_overflow+0xa0/0x1e0 +[ 575.218016] [] perf_event_overflow+0x14/0x20 +[ 575.218028] [] intel_pmu_handle_irq+0x1da/0x460 +[ 575.218042] [] ? poll_idle+0x3e/0x70 +[ 575.218052] [] ? poll_idle+0x3e/0x70 +[ 575.218064] [] perf_event_nmi_handler+0x28/0x50 +[ 575.218075] [] nmi_handle+0x60/0x130 +[ 575.218086] [] ? poll_idle+0x3e/0x70 +[ 575.218096] [] do_nmi+0x140/0x470 +[ 575.218108] [] end_repeat_nmi+0x1a/0x1e +[ 575.218119] [] ? poll_idle+0x3e/0x70 +[ 575.218129] [] ? poll_idle+0x3e/0x70 +[ 575.218139] [] ? poll_idle+0x3e/0x70 +[ 575.218148] <> [] cpuidle_enter_state+0xf3/0x2f0 +[ 575.218164] [] cpuidle_enter+0x17/0x20 +[ 575.218175] [] call_cpuidle+0x2a/0x40 +[ 575.218185] [] cpu_startup_entry+0x273/0x330 +[ 575.218196] [] start_secondary+0x10e/0x130 + +However, not servicing all available IIR within the handler does hurt the +throughput of pathological nop execbuf by about 20%, with a similar effect +upon the dispatch latency of a series of execbuf. + +v2: use do {} while(0) for a smaller patch, and easier to revert again + +I have reasonable confidence that we do not miss GT interrupts (as +execlists provides a stress case with a failure mechanism easily +detected by igt), however I have less confidence about all the other +sources of interrupts and worry that may lose a display hotplug +interrupt, for example. + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=93467 +Testcase: igt/gem_exec_nop/basic # requires NMI watchdog +Signed-off-by: Chris Wilson +Cc: Ville Syrjälä +Cc: Antti Koskipää +Cc: Tvrtko Ursulin +Reviewed-by: Tvrtko Ursulin +Reviewed-by: Ville Syrjälä +Link: http://patchwork.freedesktop.org/patch/msgid/1457946117-6714-1-git-send-email-chris@chris-wilson.co.uk +(cherry picked from commit 579de73b048a0a4c66c25a033ac76a2836e0cf73) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_irq.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_irq.c ++++ b/drivers/gpu/drm/i915/i915_irq.c +@@ -1823,7 +1823,7 @@ static irqreturn_t cherryview_irq_handle + /* IRQs are synced during runtime_suspend, we don't require a wakeref */ + disable_rpm_wakeref_asserts(dev_priv); + +- for (;;) { ++ do { + master_ctl = I915_READ(GEN8_MASTER_IRQ) & ~GEN8_MASTER_IRQ_CONTROL; + iir = I915_READ(VLV_IIR); + +@@ -1851,7 +1851,7 @@ static irqreturn_t cherryview_irq_handle + + I915_WRITE(GEN8_MASTER_IRQ, DE_MASTER_IRQ_CONTROL); + POSTING_READ(GEN8_MASTER_IRQ); +- } ++ } while (0); + + enable_rpm_wakeref_asserts(dev_priv); + diff --git a/queue-4.5/drm-i915-fix-race-condition-in-intel_dp_destroy_mst_connector.patch b/queue-4.5/drm-i915-fix-race-condition-in-intel_dp_destroy_mst_connector.patch new file mode 100644 index 00000000000..cae9358023a --- /dev/null +++ b/queue-4.5/drm-i915-fix-race-condition-in-intel_dp_destroy_mst_connector.patch @@ -0,0 +1,85 @@ +From 9e60290dbafdf577766e5fc5f2fdb3be450cf9a6 Mon Sep 17 00:00:00 2001 +From: Lyude +Date: Wed, 16 Mar 2016 15:18:04 -0400 +Subject: drm/i915: Fix race condition in intel_dp_destroy_mst_connector() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lyude + +commit 9e60290dbafdf577766e5fc5f2fdb3be450cf9a6 upstream. + +After unplugging a DP MST display from the system, we have to go through +and destroy all of the DRM connectors associated with it since none of +them are valid anymore. Unfortunately, intel_dp_destroy_mst_connector() +doesn't do a good enough job of ensuring that throughout the destruction +process that no modesettings can be done with the connectors. As it is +right now, intel_dp_destroy_mst_connector() works like this: + +* Take all modeset locks +* Clear the configuration of the crtc on the connector, if there is one +* Drop all modeset locks, this is required because of circular + dependency issues that arise with trying to remove the connector from + sysfs with modeset locks held +* Unregister the connector +* Take all modeset locks, again +* Do the rest of the required cleaning for destroying the connector +* Finally drop all modeset locks for good + +This only works sometimes. During the destruction process, it's very +possible that a userspace application will attempt to do a modesetting +using the connector. When we drop the modeset locks, an ioctl handler +such as drm_mode_setcrtc has the oppurtunity to take all of the modeset +locks from us. When this happens, one thing leads to another and +eventually we end up committing a mode with the non-existent connector: + + [drm:intel_dp_link_training_clock_recovery [i915]] *ERROR* failed to enable link training + [drm:intel_dp_aux_ch] dp_aux_ch timeout status 0x7cf0001f + [drm:intel_dp_start_link_train [i915]] *ERROR* failed to start channel equalization + [drm:intel_dp_aux_ch] dp_aux_ch timeout status 0x7cf0001f + [drm:intel_mst_pre_enable_dp [i915]] *ERROR* failed to allocate vcpi + +And in some cases, such as with the T460s using an MST dock, this +results in breaking modesetting and/or panicking the system. + +To work around this, we now unregister the connector at the very +beginning of intel_dp_destroy_mst_connector(), grab all the modesetting +locks, and then hold them until we finish the rest of the function. + +Signed-off-by: Lyude +Signed-off-by: Rob Clark +Reviewed-by: Ville Syrjälä +Signed-off-by: Daniel Vetter +Link: http://patchwork.freedesktop.org/patch/msgid/1458155884-13877-1-git-send-email-cpaul@redhat.com +(cherry picked from commit 1f7717552ef1306be3b7ed28c66c6eff550e3a23) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_dp_mst.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_dp_mst.c ++++ b/drivers/gpu/drm/i915/intel_dp_mst.c +@@ -499,6 +499,8 @@ static void intel_dp_destroy_mst_connect + struct intel_connector *intel_connector = to_intel_connector(connector); + struct drm_device *dev = connector->dev; + ++ intel_connector->unregister(intel_connector); ++ + /* need to nuke the connector */ + drm_modeset_lock_all(dev); + if (connector->state->crtc) { +@@ -512,11 +514,7 @@ static void intel_dp_destroy_mst_connect + + WARN(ret, "Disabling mst crtc failed with %i\n", ret); + } +- drm_modeset_unlock_all(dev); + +- intel_connector->unregister(intel_connector); +- +- drm_modeset_lock_all(dev); + intel_connector_remove_from_fbdev(intel_connector); + drm_connector_cleanup(connector); + drm_modeset_unlock_all(dev); diff --git a/queue-4.5/drm-nouveau-core-use-vzalloc-for-allocating-ramht.patch b/queue-4.5/drm-nouveau-core-use-vzalloc-for-allocating-ramht.patch new file mode 100644 index 00000000000..2efeeff60ed --- /dev/null +++ b/queue-4.5/drm-nouveau-core-use-vzalloc-for-allocating-ramht.patch @@ -0,0 +1,45 @@ +From 78a121d82da8aff3aca2a6a1c40f5061081760f0 Mon Sep 17 00:00:00 2001 +From: Ilia Mirkin +Date: Sun, 6 Mar 2016 16:06:06 -0500 +Subject: drm/nouveau/core: use vzalloc for allocating ramht + +From: Ilia Mirkin + +commit 78a121d82da8aff3aca2a6a1c40f5061081760f0 upstream. + +Most calls to nvkm_ramht_new use 0x8000 as the size. This results in a +fairly sizeable chunk of memory to be allocated, which may not be +available with kzalloc. Since this is done fairly rarely (once per +channel), use vzalloc instead. + +Signed-off-by: Ilia Mirkin +Signed-off-by: Ben Skeggs +Cc: Sven Joachim +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/nouveau/nvkm/core/ramht.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/nouveau/nvkm/core/ramht.c ++++ b/drivers/gpu/drm/nouveau/nvkm/core/ramht.c +@@ -131,7 +131,7 @@ nvkm_ramht_del(struct nvkm_ramht **pramh + struct nvkm_ramht *ramht = *pramht; + if (ramht) { + nvkm_gpuobj_del(&ramht->gpuobj); +- kfree(*pramht); ++ vfree(*pramht); + *pramht = NULL; + } + } +@@ -143,8 +143,8 @@ nvkm_ramht_new(struct nvkm_device *devic + struct nvkm_ramht *ramht; + int ret, i; + +- if (!(ramht = *pramht = kzalloc(sizeof(*ramht) + (size >> 3) * +- sizeof(*ramht->data), GFP_KERNEL))) ++ if (!(ramht = *pramht = vzalloc(sizeof(*ramht) + ++ (size >> 3) * sizeof(*ramht->data)))) + return -ENOMEM; + + ramht->device = device; diff --git a/queue-4.5/drm-qxl-fix-cursor-position-with-non-zero-hotspot.patch b/queue-4.5/drm-qxl-fix-cursor-position-with-non-zero-hotspot.patch new file mode 100644 index 00000000000..933c5c827b2 --- /dev/null +++ b/queue-4.5/drm-qxl-fix-cursor-position-with-non-zero-hotspot.patch @@ -0,0 +1,71 @@ +From d59a1f71ff1aeda4b4630df92d3ad4e3b1dfc885 Mon Sep 17 00:00:00 2001 +From: John Keeping +Date: Wed, 18 Nov 2015 11:17:25 +0000 +Subject: drm/qxl: fix cursor position with non-zero hotspot + +From: John Keeping + +commit d59a1f71ff1aeda4b4630df92d3ad4e3b1dfc885 upstream. + +The SPICE protocol considers the position of a cursor to be the location +of its active pixel on the display, so the cursor is drawn with its +top-left corner at "(x - hot_spot_x, y - hot_spot_y)" but the DRM cursor +position gives the location where the top-left corner should be drawn, +with the hotspot being a hint for drivers that need it. + +This fixes the location of the window resize cursors when using Fluxbox +with the QXL DRM driver and both the QXL and modesetting X drivers. + +Signed-off-by: John Keeping +Reviewed-by: Daniel Vetter +Link: http://patchwork.freedesktop.org/patch/msgid/1447845445-2116-1-git-send-email-john@metanate.com +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/qxl/qxl_display.c | 13 +++++++++---- + drivers/gpu/drm/qxl/qxl_drv.h | 2 ++ + 2 files changed, 11 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/qxl/qxl_display.c ++++ b/drivers/gpu/drm/qxl/qxl_display.c +@@ -375,10 +375,15 @@ static int qxl_crtc_cursor_set2(struct d + + qxl_bo_kunmap(user_bo); + ++ qcrtc->cur_x += qcrtc->hot_spot_x - hot_x; ++ qcrtc->cur_y += qcrtc->hot_spot_y - hot_y; ++ qcrtc->hot_spot_x = hot_x; ++ qcrtc->hot_spot_y = hot_y; ++ + cmd = (struct qxl_cursor_cmd *)qxl_release_map(qdev, release); + cmd->type = QXL_CURSOR_SET; +- cmd->u.set.position.x = qcrtc->cur_x; +- cmd->u.set.position.y = qcrtc->cur_y; ++ cmd->u.set.position.x = qcrtc->cur_x + qcrtc->hot_spot_x; ++ cmd->u.set.position.y = qcrtc->cur_y + qcrtc->hot_spot_y; + + cmd->u.set.shape = qxl_bo_physical_address(qdev, cursor_bo, 0); + +@@ -441,8 +446,8 @@ static int qxl_crtc_cursor_move(struct d + + cmd = (struct qxl_cursor_cmd *)qxl_release_map(qdev, release); + cmd->type = QXL_CURSOR_MOVE; +- cmd->u.position.x = qcrtc->cur_x; +- cmd->u.position.y = qcrtc->cur_y; ++ cmd->u.position.x = qcrtc->cur_x + qcrtc->hot_spot_x; ++ cmd->u.position.y = qcrtc->cur_y + qcrtc->hot_spot_y; + qxl_release_unmap(qdev, release, &cmd->release_info); + + qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); +--- a/drivers/gpu/drm/qxl/qxl_drv.h ++++ b/drivers/gpu/drm/qxl/qxl_drv.h +@@ -135,6 +135,8 @@ struct qxl_crtc { + int index; + int cur_x; + int cur_y; ++ int hot_spot_x; ++ int hot_spot_y; + }; + + struct qxl_output { diff --git a/queue-4.5/futex-acknowledge-a-new-waiter-in-counter-before-plist.patch b/queue-4.5/futex-acknowledge-a-new-waiter-in-counter-before-plist.patch new file mode 100644 index 00000000000..ab079065ab4 --- /dev/null +++ b/queue-4.5/futex-acknowledge-a-new-waiter-in-counter-before-plist.patch @@ -0,0 +1,39 @@ +From fe1bce9e2107ba3a8faffe572483b6974201a0e6 Mon Sep 17 00:00:00 2001 +From: Davidlohr Bueso +Date: Wed, 20 Apr 2016 20:09:24 -0700 +Subject: futex: Acknowledge a new waiter in counter before plist + +From: Davidlohr Bueso + +commit fe1bce9e2107ba3a8faffe572483b6974201a0e6 upstream. + +Otherwise an incoming waker on the dest hash bucket can miss +the waiter adding itself to the plist during the lockless +check optimization (small window but still the correct way +of doing this); similarly to the decrement counterpart. + +Suggested-by: Peter Zijlstra +Signed-off-by: Davidlohr Bueso +Cc: Davidlohr Bueso +Cc: bigeasy@linutronix.de +Cc: dvhart@infradead.org +Link: http://lkml.kernel.org/r/1461208164-29150-1-git-send-email-dave@stgolabs.net +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/futex.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -1452,8 +1452,8 @@ void requeue_futex(struct futex_q *q, st + if (likely(&hb1->chain != &hb2->chain)) { + plist_del(&q->list, &hb1->chain); + hb_waiters_dec(hb1); +- plist_add(&q->list, &hb2->chain); + hb_waiters_inc(hb2); ++ plist_add(&q->list, &hb2->chain); + q->lock_ptr = &hb2->lock; + } + get_futex_key_refs(key2); diff --git a/queue-4.5/futex-handle-unlock_pi-race-gracefully.patch b/queue-4.5/futex-handle-unlock_pi-race-gracefully.patch new file mode 100644 index 00000000000..511eea421a7 --- /dev/null +++ b/queue-4.5/futex-handle-unlock_pi-race-gracefully.patch @@ -0,0 +1,86 @@ +From 89e9e66ba1b3bde9d8ea90566c2aee20697ad681 Mon Sep 17 00:00:00 2001 +From: Sebastian Andrzej Siewior +Date: Fri, 15 Apr 2016 14:35:39 +0200 +Subject: futex: Handle unlock_pi race gracefully + +From: Sebastian Andrzej Siewior + +commit 89e9e66ba1b3bde9d8ea90566c2aee20697ad681 upstream. + +If userspace calls UNLOCK_PI unconditionally without trying the TID -> 0 +transition in user space first then the user space value might not have the +waiters bit set. This opens the following race: + +CPU0 CPU1 +uval = get_user(futex) + lock(hb) +lock(hb) + futex |= FUTEX_WAITERS + .... + unlock(hb) + +cmpxchg(futex, uval, newval) + +So the cmpxchg fails and returns -EINVAL to user space, which is wrong because +the futex value is valid. + +To handle this (yes, yet another) corner case gracefully, check for a flag +change and retry. + +[ tglx: Massaged changelog and slightly reworked implementation ] + +Fixes: ccf9e6a80d9e ("futex: Make unlock_pi more robust") +Signed-off-by: Sebastian Andrzej Siewior +Cc: Davidlohr Bueso +Cc: Darren Hart +Cc: Peter Zijlstra +Link: http://lkml.kernel.org/r/1460723739-5195-1-git-send-email-bigeasy@linutronix.de +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/futex.c | 25 ++++++++++++++++++++++--- + 1 file changed, 22 insertions(+), 3 deletions(-) + +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -1212,10 +1212,20 @@ static int wake_futex_pi(u32 __user *uad + if (unlikely(should_fail_futex(true))) + ret = -EFAULT; + +- if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval)) ++ if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval)) { + ret = -EFAULT; +- else if (curval != uval) +- ret = -EINVAL; ++ } else if (curval != uval) { ++ /* ++ * If a unconditional UNLOCK_PI operation (user space did not ++ * try the TID->0 transition) raced with a waiter setting the ++ * FUTEX_WAITERS flag between get_user() and locking the hash ++ * bucket lock, retry the operation. ++ */ ++ if ((FUTEX_TID_MASK & curval) == uval) ++ ret = -EAGAIN; ++ else ++ ret = -EINVAL; ++ } + if (ret) { + raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock); + return ret; +@@ -2536,6 +2546,15 @@ retry: + if (ret == -EFAULT) + goto pi_faulted; + /* ++ * A unconditional UNLOCK_PI op raced against a waiter ++ * setting the FUTEX_WAITERS bit. Try again. ++ */ ++ if (ret == -EAGAIN) { ++ spin_unlock(&hb->lock); ++ put_futex_key(&key); ++ goto retry; ++ } ++ /* + * wake_futex_pi has detected invalid state. Tell user + * space. + */ diff --git a/queue-4.5/revert-drm-amdgpu-disable-runtime-pm-on-px-laptops-without-dgpu-power-control.patch b/queue-4.5/revert-drm-amdgpu-disable-runtime-pm-on-px-laptops-without-dgpu-power-control.patch new file mode 100644 index 00000000000..50108346368 --- /dev/null +++ b/queue-4.5/revert-drm-amdgpu-disable-runtime-pm-on-px-laptops-without-dgpu-power-control.patch @@ -0,0 +1,68 @@ +From e9bef455af8eb0e837e179aab8988ae2649fd8d3 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 25 Apr 2016 13:12:18 -0400 +Subject: Revert "drm/amdgpu: disable runtime pm on PX laptops without dGPU power control" + +From: Alex Deucher + +commit e9bef455af8eb0e837e179aab8988ae2649fd8d3 upstream. + +This reverts commit bedf2a65c1aa8fb29ba8527fd00c0f68ec1f55f1. + +See the radeon revert for an extended description. + +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c | 8 ++++---- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 +------- + 2 files changed, 5 insertions(+), 11 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c +@@ -63,10 +63,6 @@ bool amdgpu_has_atpx(void) { + return amdgpu_atpx_priv.atpx_detected; + } + +-bool amdgpu_has_atpx_dgpu_power_cntl(void) { +- return amdgpu_atpx_priv.atpx.functions.power_cntl; +-} +- + /** + * amdgpu_atpx_call - call an ATPX method + * +@@ -146,6 +142,10 @@ static void amdgpu_atpx_parse_functions( + */ + static int amdgpu_atpx_validate(struct amdgpu_atpx *atpx) + { ++ /* make sure required functions are enabled */ ++ /* dGPU power control is required */ ++ atpx->functions.power_cntl = true; ++ + if (atpx->functions.px_params) { + union acpi_object *info; + struct atpx_px_params output; +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -62,12 +62,6 @@ static const char *amdgpu_asic_name[] = + "LAST", + }; + +-#if defined(CONFIG_VGA_SWITCHEROO) +-bool amdgpu_has_atpx_dgpu_power_cntl(void); +-#else +-static inline bool amdgpu_has_atpx_dgpu_power_cntl(void) { return false; } +-#endif +- + bool amdgpu_device_is_px(struct drm_device *dev) + { + struct amdgpu_device *adev = dev->dev_private; +@@ -1517,7 +1511,7 @@ int amdgpu_device_init(struct amdgpu_dev + + if (amdgpu_runtime_pm == 1) + runtime = true; +- if (amdgpu_device_is_px(ddev) && amdgpu_has_atpx_dgpu_power_cntl()) ++ if (amdgpu_device_is_px(ddev)) + runtime = true; + vga_switcheroo_register_client(adev->pdev, &amdgpu_switcheroo_ops, runtime); + if (runtime) diff --git a/queue-4.5/revert-drm-radeon-disable-runtime-pm-on-px-laptops-without-dgpu-power-control.patch b/queue-4.5/revert-drm-radeon-disable-runtime-pm-on-px-laptops-without-dgpu-power-control.patch new file mode 100644 index 00000000000..ff741adc87c --- /dev/null +++ b/queue-4.5/revert-drm-radeon-disable-runtime-pm-on-px-laptops-without-dgpu-power-control.patch @@ -0,0 +1,88 @@ +From bfaddd9fc8ac048b99475f000dbef6f08297417f Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 18 Apr 2016 11:19:19 -0400 +Subject: Revert "drm/radeon: disable runtime pm on PX laptops without dGPU power control" + +From: Alex Deucher + +commit bfaddd9fc8ac048b99475f000dbef6f08297417f upstream. + +This reverts commit e64c952efb8e0c15ae82cec8e455ab4910690ef1. + +ATPX is the ACPI method for controlling AMD PowerXpress laptops. +There are flags to indicate which methods are supported. If +the dGPU power down flag is not supported, the driver needs to +implement the dGPU power down manually. We had previously +always forced the driver to assume the ATPX dGPU power down +was present, but this causes problems on boards where it is +not, leading to GPU hangs when attempting to power down the +dGPU. Manual dGPU power down is not currently supported in +the Linux driver. Some laptops indicate that the ATPX +dGPU power down method is not present, but it actually +apparently is. I'm not sure if this is a bios bug and it should +be set or if there is a reason it was unset and the method should +not be used. This is not an issue on other OSes since both the +ATPX and the manual driver power down methods are supported. + +This is apparently fairly widespread, so just revert for now. + +bugs: +https://bugzilla.kernel.org/show_bug.cgi?id=115321 +https://bugzilla.kernel.org/show_bug.cgi?id=116581 +https://bugzilla.kernel.org/show_bug.cgi?id=116251 + +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_atpx_handler.c | 8 ++++---- + drivers/gpu/drm/radeon/radeon_device.c | 8 +------- + 2 files changed, 5 insertions(+), 11 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c ++++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c +@@ -62,10 +62,6 @@ bool radeon_has_atpx(void) { + return radeon_atpx_priv.atpx_detected; + } + +-bool radeon_has_atpx_dgpu_power_cntl(void) { +- return radeon_atpx_priv.atpx.functions.power_cntl; +-} +- + /** + * radeon_atpx_call - call an ATPX method + * +@@ -145,6 +141,10 @@ static void radeon_atpx_parse_functions( + */ + static int radeon_atpx_validate(struct radeon_atpx *atpx) + { ++ /* make sure required functions are enabled */ ++ /* dGPU power control is required */ ++ atpx->functions.power_cntl = true; ++ + if (atpx->functions.px_params) { + union acpi_object *info; + struct atpx_px_params output; +--- a/drivers/gpu/drm/radeon/radeon_device.c ++++ b/drivers/gpu/drm/radeon/radeon_device.c +@@ -103,12 +103,6 @@ static const char radeon_family_name[][1 + "LAST", + }; + +-#if defined(CONFIG_VGA_SWITCHEROO) +-bool radeon_has_atpx_dgpu_power_cntl(void); +-#else +-static inline bool radeon_has_atpx_dgpu_power_cntl(void) { return false; } +-#endif +- + #define RADEON_PX_QUIRK_DISABLE_PX (1 << 0) + #define RADEON_PX_QUIRK_LONG_WAKEUP (1 << 1) + +@@ -1439,7 +1433,7 @@ int radeon_device_init(struct radeon_dev + * ignore it */ + vga_client_register(rdev->pdev, rdev, NULL, radeon_vga_set_decode); + +- if ((rdev->flags & RADEON_IS_PX) && radeon_has_atpx_dgpu_power_cntl()) ++ if (rdev->flags & RADEON_IS_PX) + runtime = true; + vga_switcheroo_register_client(rdev->pdev, &radeon_switcheroo_ops, runtime); + if (runtime) diff --git a/queue-4.5/revert-pci-imx6-add-support-for-active-low-reset-gpio.patch b/queue-4.5/revert-pci-imx6-add-support-for-active-low-reset-gpio.patch new file mode 100644 index 00000000000..539dd3db84d --- /dev/null +++ b/queue-4.5/revert-pci-imx6-add-support-for-active-low-reset-gpio.patch @@ -0,0 +1,87 @@ +From b2d7a9cd3ff8ec561348267c2ef7d47b2b91e801 Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Mon, 28 Mar 2016 18:45:36 -0300 +Subject: Revert "PCI: imx6: Add support for active-low reset GPIO" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Fabio Estevam + +commit b2d7a9cd3ff8ec561348267c2ef7d47b2b91e801 upstream. + +Commit 5c5fb40de8f1 ("PCI: imx6: Add support for active-low reset GPIO") +cause regressions on some boards like MX6 Gateworks Ventana, for example. + +The reason for the breakage is that this commit sets the GPIO polarity in +the wrong logic level. + +Also, the commit log is wrong because active-low reset GPIO is what the +driver used to support since the beginning. + +So keep the old behavior that ignores the GPIO polarity specified in the +device tree and treat the PCI reset GPIO as active-low. + +Reported-by: Krzysztof Hałasa +Tested-by: Tim Harvey # Gateworks Ventana +Signed-off-by: Fabio Estevam +Signed-off-by: Bjorn Helgaas +Acked-by: Tim Harvey +Acked-by: Lucas Stach +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/host/pci-imx6.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +--- a/drivers/pci/host/pci-imx6.c ++++ b/drivers/pci/host/pci-imx6.c +@@ -32,7 +32,7 @@ + #define to_imx6_pcie(x) container_of(x, struct imx6_pcie, pp) + + struct imx6_pcie { +- struct gpio_desc *reset_gpio; ++ int reset_gpio; + struct clk *pcie_bus; + struct clk *pcie_phy; + struct clk *pcie; +@@ -287,10 +287,10 @@ static int imx6_pcie_deassert_core_reset + usleep_range(200, 500); + + /* Some boards don't have PCIe reset GPIO. */ +- if (imx6_pcie->reset_gpio) { +- gpiod_set_value_cansleep(imx6_pcie->reset_gpio, 0); ++ if (gpio_is_valid(imx6_pcie->reset_gpio)) { ++ gpio_set_value_cansleep(imx6_pcie->reset_gpio, 0); + msleep(100); +- gpiod_set_value_cansleep(imx6_pcie->reset_gpio, 1); ++ gpio_set_value_cansleep(imx6_pcie->reset_gpio, 1); + } + return 0; + +@@ -561,6 +561,7 @@ static int __init imx6_pcie_probe(struct + { + struct imx6_pcie *imx6_pcie; + struct pcie_port *pp; ++ struct device_node *np = pdev->dev.of_node; + struct resource *dbi_base; + int ret; + +@@ -581,8 +582,15 @@ static int __init imx6_pcie_probe(struct + return PTR_ERR(pp->dbi_base); + + /* Fetch GPIOs */ +- imx6_pcie->reset_gpio = devm_gpiod_get_optional(&pdev->dev, "reset", +- GPIOD_OUT_LOW); ++ imx6_pcie->reset_gpio = of_get_named_gpio(np, "reset-gpio", 0); ++ if (gpio_is_valid(imx6_pcie->reset_gpio)) { ++ ret = devm_gpio_request_one(&pdev->dev, imx6_pcie->reset_gpio, ++ GPIOF_OUT_INIT_LOW, "PCIe reset"); ++ if (ret) { ++ dev_err(&pdev->dev, "unable to get reset gpio\n"); ++ return ret; ++ } ++ } + + /* Fetch clocks */ + imx6_pcie->pcie_phy = devm_clk_get(&pdev->dev, "pcie_phy"); diff --git a/queue-4.5/series b/queue-4.5/series index d19fb066ada..510ad328880 100644 --- a/queue-4.5/series +++ b/queue-4.5/series @@ -32,3 +32,25 @@ dmaengine-edma-remove-dynamic-tptc-power-management-feature.patch dmaengine-pxa_dma-fix-the-maximum-requestor-line.patch mtd-nand-pxa3xx_nand-fix-dmaengine-initialization.patch sched-cgroup-fix-cleanup-cgroup-teardown-init.patch +x86-mm-xen-suppress-hugetlbfs-in-pv-guests.patch +x86-edac-sb_edac.c-repair-damage-introduced-when-fixing-channel-address.patch +x86-edac-sb_edac.c-take-account-of-channel-hashing-when-needed.patch +alsa-hda-don-t-trust-the-reported-actual-power-state.patch +alsa-hda-realtek-add-alc3234-headset-mode-for-optiplex-9020m.patch +alsa-hda-keep-powering-up-adcs-on-cirrus-codecs.patch +alsa-hda-add-pci-id-for-intel-broxton-t.patch +alsa-pcxhr-fix-missing-mutex-unlock.patch +alsa-hda-add-dock-support-for-thinkpad-x260.patch +alsa-hda-update-bclk-also-at-hotplug-for-i915-hsw-bdw.patch +asm-generic-futex-re-enable-preemption-in-futex_atomic_cmpxchg_inatomic.patch +futex-handle-unlock_pi-race-gracefully.patch +futex-acknowledge-a-new-waiter-in-counter-before-plist.patch +drm-nouveau-core-use-vzalloc-for-allocating-ramht.patch +drm-qxl-fix-cursor-position-with-non-zero-hotspot.patch +drm-i915-exit-cherryview_irq_handler-after-one-pass.patch +drm-i915-fix-race-condition-in-intel_dp_destroy_mst_connector.patch +revert-drm-radeon-disable-runtime-pm-on-px-laptops-without-dgpu-power-control.patch +revert-pci-imx6-add-support-for-active-low-reset-gpio.patch +usbvision-revert-commit-588afcc1.patch +revert-drm-amdgpu-disable-runtime-pm-on-px-laptops-without-dgpu-power-control.patch +cpufreq-intel_pstate-fix-processing-for-turbo-activation-ratio.patch diff --git a/queue-4.5/usbvision-revert-commit-588afcc1.patch b/queue-4.5/usbvision-revert-commit-588afcc1.patch new file mode 100644 index 00000000000..2870b620f9b --- /dev/null +++ b/queue-4.5/usbvision-revert-commit-588afcc1.patch @@ -0,0 +1,61 @@ +From d5468d7afaa9c9e961e150f0455a14a9f4872a98 Mon Sep 17 00:00:00 2001 +From: Vladis Dronov +Date: Sun, 31 Jan 2016 14:14:52 -0200 +Subject: [media] usbvision: revert commit 588afcc1 + +From: Vladis Dronov + +commit d5468d7afaa9c9e961e150f0455a14a9f4872a98 upstream. + +Commit 588afcc1c0e4 ("[media] usbvision fix overflow of interfaces +array")' should be reverted, because: + +* "!dev->actconfig->interface[ifnum]" won't catch a case where the value +is not NULL but some garbage. This way the system may crash later with +GPF. + +* "(ifnum >= USB_MAXINTERFACES)" does not cover all the error +conditions. "ifnum" should be compared to "dev->actconfig-> +desc.bNumInterfaces", i.e. compared to the number of "struct +usb_interface" kzalloc()-ed, not to USB_MAXINTERFACES. + +* There is a "struct usb_device" leak in this error path, as there is +usb_get_dev(), but no usb_put_dev() on this path. + +* There is a bug of the same type several lines below with number of +endpoints. The code is accessing hard-coded second endpoint +("interface->endpoint[1].desc") which may not exist. It would be great +to handle this in the same patch too. + +* All the concerns above are resolved by already-accepted commit fa52bd50 +("[media] usbvision: fix crash on detecting device with invalid +configuration") + +* Mailing list message: +http://www.spinics.net/lists/linux-media/msg94832.html + +Signed-off-by: Vladis Dronov +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/usbvision/usbvision-video.c | 7 ------- + 1 file changed, 7 deletions(-) + +--- a/drivers/media/usb/usbvision/usbvision-video.c ++++ b/drivers/media/usb/usbvision/usbvision-video.c +@@ -1461,13 +1461,6 @@ static int usbvision_probe(struct usb_in + printk(KERN_INFO "%s: %s found\n", __func__, + usbvision_device_data[model].model_string); + +- /* +- * this is a security check. +- * an exploit using an incorrect bInterfaceNumber is known +- */ +- if (ifnum >= USB_MAXINTERFACES || !dev->actconfig->interface[ifnum]) +- return -ENODEV; +- + if (usbvision_device_data[model].interface >= 0) + interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0]; + else if (ifnum < dev->actconfig->desc.bNumInterfaces) diff --git a/queue-4.5/x86-edac-sb_edac.c-repair-damage-introduced-when-fixing-channel-address.patch b/queue-4.5/x86-edac-sb_edac.c-repair-damage-introduced-when-fixing-channel-address.patch new file mode 100644 index 00000000000..61950bdcd9e --- /dev/null +++ b/queue-4.5/x86-edac-sb_edac.c-repair-damage-introduced-when-fixing-channel-address.patch @@ -0,0 +1,63 @@ +From ff15e95c82768d589957dbb17d7eb7dba7904659 Mon Sep 17 00:00:00 2001 +From: Tony Luck +Date: Thu, 14 Apr 2016 10:21:52 -0700 +Subject: x86 EDAC, sb_edac.c: Repair damage introduced when "fixing" channel address + +From: Tony Luck + +commit ff15e95c82768d589957dbb17d7eb7dba7904659 upstream. + +In commit: + + eb1af3b71f9d ("Fix computation of channel address") + +I switched the "sck_way" variable from holding the log2 value read +from the h/w to instead be the actual number. Unfortunately it +is needed in log2 form when used to shift the address. + +Tested-by: Patrick Geary +Signed-off-by: Tony Luck +Acked-by: Mauro Carvalho Chehab +Cc: Aristeu Rozanski +Cc: Borislav Petkov +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: linux-edac@vger.kernel.org +Fixes: eb1af3b71f9d ("Fix computation of channel address") +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/edac/sb_edac.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/edac/sb_edac.c ++++ b/drivers/edac/sb_edac.c +@@ -2118,7 +2118,7 @@ static int get_memory_error_data(struct + } + + ch_way = TAD_CH(reg) + 1; +- sck_way = 1 << TAD_SOCK(reg); ++ sck_way = TAD_SOCK(reg); + + if (ch_way == 3) + idx = addr >> 6; +@@ -2157,7 +2157,7 @@ static int get_memory_error_data(struct + switch(ch_way) { + case 2: + case 4: +- sck_xch = 1 << sck_way * (ch_way >> 1); ++ sck_xch = (1 << sck_way) * (ch_way >> 1); + break; + default: + sprintf(msg, "Invalid mirror set. Can't decode addr"); +@@ -2193,7 +2193,7 @@ static int get_memory_error_data(struct + + ch_addr = addr - offset; + ch_addr >>= (6 + shiftup); +- ch_addr /= ch_way * sck_way; ++ ch_addr /= sck_xch; + ch_addr <<= (6 + shiftup); + ch_addr |= addr & ((1 << (6 + shiftup)) - 1); + diff --git a/queue-4.5/x86-edac-sb_edac.c-take-account-of-channel-hashing-when-needed.patch b/queue-4.5/x86-edac-sb_edac.c-take-account-of-channel-hashing-when-needed.patch new file mode 100644 index 00000000000..f5fdce066ad --- /dev/null +++ b/queue-4.5/x86-edac-sb_edac.c-take-account-of-channel-hashing-when-needed.patch @@ -0,0 +1,89 @@ +From ea5dfb5fae81939f777ca569d8cfb599252da2e8 Mon Sep 17 00:00:00 2001 +From: Tony Luck +Date: Thu, 14 Apr 2016 10:22:02 -0700 +Subject: x86 EDAC, sb_edac.c: Take account of channel hashing when needed + +From: Tony Luck + +commit ea5dfb5fae81939f777ca569d8cfb599252da2e8 upstream. + +Haswell and Broadwell can be configured to hash the channel +interleave function using bits [27:12] of the physical address. + +On those processor models we must check to see if hashing is +enabled (bit21 of the HASWELL_HASYSDEFEATURE2 register) and +act accordingly. + +Based on a patch by patrickg + +Tested-by: Patrick Geary +Signed-off-by: Tony Luck +Acked-by: Mauro Carvalho Chehab +Cc: Aristeu Rozanski +Cc: Borislav Petkov +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: linux-edac@vger.kernel.org +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/edac/sb_edac.c | 24 +++++++++++++++++++++++- + 1 file changed, 23 insertions(+), 1 deletion(-) + +--- a/drivers/edac/sb_edac.c ++++ b/drivers/edac/sb_edac.c +@@ -362,6 +362,7 @@ struct sbridge_pvt { + + /* Memory type detection */ + bool is_mirrored, is_lockstep, is_close_pg; ++ bool is_chan_hash; + + /* Fifo double buffers */ + struct mce mce_entry[MCE_LOG_LEN]; +@@ -1060,6 +1061,20 @@ static inline u8 sad_pkg_ha(u8 pkg) + return (pkg >> 2) & 0x1; + } + ++static int haswell_chan_hash(int idx, u64 addr) ++{ ++ int i; ++ ++ /* ++ * XOR even bits from 12:26 to bit0 of idx, ++ * odd bits from 13:27 to bit1 ++ */ ++ for (i = 12; i < 28; i += 2) ++ idx ^= (addr >> i) & 3; ++ ++ return idx; ++} ++ + /**************************************************************************** + Memory check routines + ****************************************************************************/ +@@ -1616,6 +1631,10 @@ static int get_dimm_config(struct mem_ct + KNL_MAX_CHANNELS : NUM_CHANNELS; + u64 knl_mc_sizes[KNL_MAX_CHANNELS]; + ++ if (pvt->info.type == HASWELL || pvt->info.type == BROADWELL) { ++ pci_read_config_dword(pvt->pci_ha0, HASWELL_HASYSDEFEATURE2, ®); ++ pvt->is_chan_hash = GET_BITFIELD(reg, 21, 21); ++ } + if (pvt->info.type == HASWELL || pvt->info.type == BROADWELL || + pvt->info.type == KNIGHTS_LANDING) + pci_read_config_dword(pvt->pci_sad1, SAD_TARGET, ®); +@@ -2122,8 +2141,11 @@ static int get_memory_error_data(struct + + if (ch_way == 3) + idx = addr >> 6; +- else ++ else { + idx = (addr >> (6 + sck_way + shiftup)) & 0x3; ++ if (pvt->is_chan_hash) ++ idx = haswell_chan_hash(idx, addr); ++ } + idx = idx % ch_way; + + /* diff --git a/queue-4.5/x86-mm-xen-suppress-hugetlbfs-in-pv-guests.patch b/queue-4.5/x86-mm-xen-suppress-hugetlbfs-in-pv-guests.patch new file mode 100644 index 00000000000..a758450c490 --- /dev/null +++ b/queue-4.5/x86-mm-xen-suppress-hugetlbfs-in-pv-guests.patch @@ -0,0 +1,72 @@ +From 103f6112f253017d7062cd74d17f4a514ed4485c Mon Sep 17 00:00:00 2001 +From: Jan Beulich +Date: Thu, 21 Apr 2016 00:27:04 -0600 +Subject: x86/mm/xen: Suppress hugetlbfs in PV guests + +From: Jan Beulich + +commit 103f6112f253017d7062cd74d17f4a514ed4485c upstream. + +Huge pages are not normally available to PV guests. Not suppressing +hugetlbfs use results in an endless loop of page faults when user mode +code tries to access a hugetlbfs mapped area (since the hypervisor +denies such PTEs to be created, but error indications can't be +propagated out of xen_set_pte_at(), just like for various of its +siblings), and - once killed in an oops like this: + + kernel BUG at .../fs/hugetlbfs/inode.c:428! + invalid opcode: 0000 [#1] SMP + ... + RIP: e030:[] [] remove_inode_hugepages+0x25b/0x320 + ... + Call Trace: + [] hugetlbfs_evict_inode+0x15/0x40 + [] evict+0xbd/0x1b0 + [] __dentry_kill+0x19a/0x1f0 + [] dput+0x1fe/0x220 + [] __fput+0x155/0x200 + [] task_work_run+0x60/0xa0 + [] do_exit+0x160/0x400 + [] do_group_exit+0x3b/0xa0 + [] get_signal+0x1ed/0x470 + [] do_signal+0x14/0x110 + [] prepare_exit_to_usermode+0xe9/0xf0 + [] retint_user+0x8/0x13 + +This is CVE-2016-3961 / XSA-174. + +Reported-by: Vitaly Kuznetsov +Signed-off-by: Jan Beulich +Cc: Andrew Morton +Cc: Andy Lutomirski +Cc: Boris Ostrovsky +Cc: Borislav Petkov +Cc: Brian Gerst +Cc: David Vrabel +Cc: Denys Vlasenko +Cc: H. Peter Anvin +Cc: Juergen Gross +Cc: Linus Torvalds +Cc: Luis R. Rodriguez +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Toshi Kani +Cc: xen-devel +Link: http://lkml.kernel.org/r/57188ED802000078000E431C@prv-mh.provo.novell.com +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/hugetlb.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/x86/include/asm/hugetlb.h ++++ b/arch/x86/include/asm/hugetlb.h +@@ -4,6 +4,7 @@ + #include + #include + ++#define hugepages_supported() cpu_has_pse + + static inline int is_hugepage_only_range(struct mm_struct *mm, + unsigned long addr,