From: Greg Kroah-Hartman Date: Fri, 17 Apr 2015 09:40:57 +0000 (+0200) Subject: 3.19-stable patches X-Git-Tag: v3.10.75~25 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2faba640db164ee9545007ced19e4aa2e2649fc5;p=thirdparty%2Fkernel%2Fstable-queue.git 3.19-stable patches added patches: arc-sa_siginfo-ucontext-regs-off-by-one.patch arc-signal-handling-robustify.patch arm-sunxi-have-arch_sunxi-select-reset_controller-for-clock-driver-usage.patch blk-mq-fix-use-of-incorrect-goto-label-in-blk_mq_init_queue-error-path.patch blkmq-fix-null-pointer-deref-when-all-reserved-tags-in.patch block-fix-blk_stack_limits-regression-due-to-lcm-change.patch drm-amdkfd-initialize-only-amdkfd-s-assigned-pipelines.patch drm-edid-set-eld-for-firmware-and-debugfs-override-edids.patch drm-fixup-racy-refcounting-in-plane_force_disable.patch drm-i915-align-initial-plane-backing-objects-correctly.patch drm-i915-chv-remove-wait-for-a-previous-gfx-force-off.patch drm-i915-reject-the-colorkey-ioctls-for-primary-and-cursor-planes.patch drm-i915-vlv-remove-wait-for-previous-gfx-clk-disable-request.patch drm-i915-vlv-save-restore-the-power-context-base-reg.patch drm-radeon-add-extra-check-in-radeon_ttm_tt_unpin_userptr.patch drm-radeon-dpm-fix-120hz-handling-harder.patch drm-radeon-fix-wait-in-radeon_mn_invalidate_range_start.patch fix-bug-in-blk_rq_merge_ok.patch pci-aer-avoid-info-leak-in-__print_tlp_header.patch pci-cpcihp-add-missing-curly-braces-in-cpci_configure_slot.patch pci-don-t-look-for-acpi-hotplug-parameters-if-acpi-is-disabled.patch pci-spear-drop-__initdata-from-spear13xx_pcie_driver.patch revert-sparc-pci-clip-bridge-windows-to-fit-in-upstream-windows.patch selinux-fix-sel_write_enforce-broken-return-value.patch --- diff --git a/queue-3.19/arc-sa_siginfo-ucontext-regs-off-by-one.patch b/queue-3.19/arc-sa_siginfo-ucontext-regs-off-by-one.patch new file mode 100644 index 00000000000..7009f02f257 --- /dev/null +++ b/queue-3.19/arc-sa_siginfo-ucontext-regs-off-by-one.patch @@ -0,0 +1,92 @@ +From 6914e1e3f63caa829431160f0f7093292daef2d5 Mon Sep 17 00:00:00 2001 +From: Vineet Gupta +Date: Thu, 26 Mar 2015 09:25:44 +0530 +Subject: ARC: SA_SIGINFO ucontext regs off-by-one + +From: Vineet Gupta + +commit 6914e1e3f63caa829431160f0f7093292daef2d5 upstream. + +The regfile provided to SA_SIGINFO signal handler as ucontext was off by +one due to pt_regs gutter cleanups in 2013. + +Before handling signal, user pt_regs are copied onto user_regs_struct and copied +back later. Both structs are binary compatible. This was all fine until +commit 2fa919045b72 (ARC: pt_regs update #2) which removed the empty stack slot +at top of pt_regs (corresponding to first pad) and made the corresponding +fixup in struct user_regs_struct (the pad in there was moved out of +@scratch - not removed altogether as it is part of ptrace ABI) + + struct user_regs_struct { ++ long pad; + struct { +- long pad; + long bta, lp_start, lp_end,.... + } scratch; + ... + } + +This meant that now user_regs_struct was off by 1 reg w.r.t pt_regs and +signal code needs to user_regs_struct.scratch to reflect it as pt_regs, +which is what this commit does. + +This problem was hidden for 2 years, because both save/restore, despite +using wrong location, were using the same location. Only an interim +inspection (reproducer below) exposed the issue. + + void handle_segv(int signo, siginfo_t *info, void *context) + { + ucontext_t *uc = context; + struct user_regs_struct *regs = &(uc->uc_mcontext.regs); + + printf("regs %x %x\n", <=== prints 7 8 (vs. 8 9) + regs->scratch.r8, regs->scratch.r9); + } + + int main() + { + struct sigaction sa; + + sa.sa_sigaction = handle_segv; + sa.sa_flags = SA_SIGINFO; + sigemptyset(&sa.sa_mask); + sigaction(SIGSEGV, &sa, NULL); + + asm volatile( + "mov r7, 7 \n" + "mov r8, 8 \n" + "mov r9, 9 \n" + "mov r10, 10 \n" + :::"r7","r8","r9","r10"); + + *((unsigned int*)0x10) = 0; + } + +Fixes: 2fa919045b72ec892e "ARC: pt_regs update #2: Remove unused gutter at start of pt_regs" +Signed-off-by: Vineet Gupta +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arc/kernel/signal.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arc/kernel/signal.c ++++ b/arch/arc/kernel/signal.c +@@ -67,7 +67,7 @@ stash_usr_regs(struct rt_sigframe __user + sigset_t *set) + { + int err; +- err = __copy_to_user(&(sf->uc.uc_mcontext.regs), regs, ++ err = __copy_to_user(&(sf->uc.uc_mcontext.regs.scratch), regs, + sizeof(sf->uc.uc_mcontext.regs.scratch)); + err |= __copy_to_user(&sf->uc.uc_sigmask, set, sizeof(sigset_t)); + +@@ -83,7 +83,7 @@ static int restore_usr_regs(struct pt_re + if (!err) + set_current_blocked(&set); + +- err |= __copy_from_user(regs, &(sf->uc.uc_mcontext.regs), ++ err |= __copy_from_user(regs, &(sf->uc.uc_mcontext.regs.scratch), + sizeof(sf->uc.uc_mcontext.regs.scratch)); + + return err; diff --git a/queue-3.19/arc-signal-handling-robustify.patch b/queue-3.19/arc-signal-handling-robustify.patch new file mode 100644 index 00000000000..54924a0662d --- /dev/null +++ b/queue-3.19/arc-signal-handling-robustify.patch @@ -0,0 +1,99 @@ +From e4140819dadc3624accac8294881bca8a3cba4ed Mon Sep 17 00:00:00 2001 +From: Vineet Gupta +Date: Thu, 26 Mar 2015 11:14:41 +0530 +Subject: ARC: signal handling robustify + +From: Vineet Gupta + +commit e4140819dadc3624accac8294881bca8a3cba4ed upstream. + +A malicious signal handler / restorer can DOS the system by fudging the +user regs saved on stack, causing weird things such as sigreturn returning +to user mode PC but cpu state still being kernel mode.... + +Ensure that in sigreturn path status32 always has U bit; any other bogosity +(gargbage PC etc) will be taken care of by normal user mode exceptions mechanisms. + +Reproducer signal handler: + + void handle_sig(int signo, siginfo_t *info, void *context) + { + ucontext_t *uc = context; + struct user_regs_struct *regs = &(uc->uc_mcontext.regs); + + regs->scratch.status32 = 0; + } + +Before the fix, kernel would go off to weeds like below: + + --------->8----------- + [ARCLinux]$ ./signal-test + Path: /signal-test + CPU: 0 PID: 61 Comm: signal-test Not tainted 4.0.0-rc5+ #65 + task: 8f177880 ti: 5ffe6000 task.ti: 8f15c000 + + [ECR ]: 0x00220200 => Invalid Write @ 0x00000010 by insn @ 0x00010698 + [EFA ]: 0x00000010 + [BLINK ]: 0x2007c1ee + [ERET ]: 0x10698 + [STAT32]: 0x00000000 : <-------- + BTA: 0x00010680 SP: 0x5ffe7e48 FP: 0x00000000 + LPS: 0x20003c6c LPE: 0x20003c70 LPC: 0x00000000 + ... + --------->8----------- + +Reported-by: Alexey Brodkin +Signed-off-by: Vineet Gupta +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arc/kernel/signal.c | 20 ++++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +--- a/arch/arc/kernel/signal.c ++++ b/arch/arc/kernel/signal.c +@@ -131,6 +131,15 @@ SYSCALL_DEFINE0(rt_sigreturn) + /* Don't restart from sigreturn */ + syscall_wont_restart(regs); + ++ /* ++ * Ensure that sigreturn always returns to user mode (in case the ++ * regs saved on user stack got fudged between save and sigreturn) ++ * Otherwise it is easy to panic the kernel with a custom ++ * signal handler and/or restorer which clobberes the status32/ret ++ * to return to a bogus location in kernel mode. ++ */ ++ regs->status32 |= STATUS_U_MASK; ++ + return regs->r0; + + badframe: +@@ -229,8 +238,11 @@ setup_rt_frame(struct ksignal *ksig, sig + + /* + * handler returns using sigreturn stub provided already by userpsace ++ * If not, nuke the process right away + */ +- BUG_ON(!(ksig->ka.sa.sa_flags & SA_RESTORER)); ++ if(!(ksig->ka.sa.sa_flags & SA_RESTORER)) ++ return 1; ++ + regs->blink = (unsigned long)ksig->ka.sa.sa_restorer; + + /* User Stack for signal handler will be above the frame just carved */ +@@ -296,12 +308,12 @@ static void + handle_signal(struct ksignal *ksig, struct pt_regs *regs) + { + sigset_t *oldset = sigmask_to_save(); +- int ret; ++ int failed; + + /* Set up the stack frame */ +- ret = setup_rt_frame(ksig, oldset, regs); ++ failed = setup_rt_frame(ksig, oldset, regs); + +- signal_setup_done(ret, ksig, 0); ++ signal_setup_done(failed, ksig, 0); + } + + void do_signal(struct pt_regs *regs) diff --git a/queue-3.19/arm-sunxi-have-arch_sunxi-select-reset_controller-for-clock-driver-usage.patch b/queue-3.19/arm-sunxi-have-arch_sunxi-select-reset_controller-for-clock-driver-usage.patch new file mode 100644 index 00000000000..d1d228d8b9d --- /dev/null +++ b/queue-3.19/arm-sunxi-have-arch_sunxi-select-reset_controller-for-clock-driver-usage.patch @@ -0,0 +1,80 @@ +From fdc0074c5fc8c7adb8186cbb123fe2082d9bd05f Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Mon, 9 Feb 2015 18:23:20 +0800 +Subject: ARM: sunxi: Have ARCH_SUNXI select RESET_CONTROLLER for clock driver usage + +From: Chen-Yu Tsai + +commit fdc0074c5fc8c7adb8186cbb123fe2082d9bd05f upstream. + +As the sunxi usb clocks all contain a reset controller, it is not +possible to build the sunxi clock driver without RESET_CONTROLLER +enabled. Doing so results in an undefined symbol error: + + drivers/built-in.o: In function `sunxi_gates_clk_setup': + linux/drivers/clk/sunxi/clk-sunxi.c:1071: undefined reference to + `reset_controller_register' + +This is possible if building a minimal kernel without PHY_SUN4I_USB. + +The dependency issue is made visible at compile time instead of +link time by the new A80 mmc clocks, which also use a reset control +itself. + +This patch makes ARCH_SUNXI select ARCH_HAS_RESET_CONTROLLER and +RESET_CONTROLLER. + +Fixes: 559482d1f950 ARM: sunxi: Split the various SoCs support in Kconfig +Reported-by: Lourens Rozema +Acked-by: Arnd Bergmann +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-sunxi/Kconfig | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +--- a/arch/arm/mach-sunxi/Kconfig ++++ b/arch/arm/mach-sunxi/Kconfig +@@ -1,10 +1,12 @@ + menuconfig ARCH_SUNXI + bool "Allwinner SoCs" if ARCH_MULTI_V7 + select ARCH_REQUIRE_GPIOLIB ++ select ARCH_HAS_RESET_CONTROLLER + select CLKSRC_MMIO + select GENERIC_IRQ_CHIP + select PINCTRL + select SUN4I_TIMER ++ select RESET_CONTROLLER + + if ARCH_SUNXI + +@@ -20,10 +22,8 @@ config MACH_SUN5I + config MACH_SUN6I + bool "Allwinner A31 (sun6i) SoCs support" + default ARCH_SUNXI +- select ARCH_HAS_RESET_CONTROLLER + select ARM_GIC + select MFD_SUN6I_PRCM +- select RESET_CONTROLLER + select SUN5I_HSTIMER + + config MACH_SUN7I +@@ -37,16 +37,12 @@ config MACH_SUN7I + config MACH_SUN8I + bool "Allwinner A23 (sun8i) SoCs support" + default ARCH_SUNXI +- select ARCH_HAS_RESET_CONTROLLER + select ARM_GIC + select MFD_SUN6I_PRCM +- select RESET_CONTROLLER + + config MACH_SUN9I + bool "Allwinner (sun9i) SoCs support" + default ARCH_SUNXI +- select ARCH_HAS_RESET_CONTROLLER + select ARM_GIC +- select RESET_CONTROLLER + + endif diff --git a/queue-3.19/blk-mq-fix-use-of-incorrect-goto-label-in-blk_mq_init_queue-error-path.patch b/queue-3.19/blk-mq-fix-use-of-incorrect-goto-label-in-blk_mq_init_queue-error-path.patch new file mode 100644 index 00000000000..f716432a6ce --- /dev/null +++ b/queue-3.19/blk-mq-fix-use-of-incorrect-goto-label-in-blk_mq_init_queue-error-path.patch @@ -0,0 +1,50 @@ +From 9a30b096b543932de218dd3501b5562e00a8792d Mon Sep 17 00:00:00 2001 +From: Mike Snitzer +Date: Thu, 12 Mar 2015 23:53:26 -0400 +Subject: blk-mq: fix use of incorrect goto label in blk_mq_init_queue error path + +From: Mike Snitzer + +commit 9a30b096b543932de218dd3501b5562e00a8792d upstream. + +If percpu_ref_init() fails the allocated q and hctxs must get cleaned +up; using 'err_map' doesn't allow that to happen. + +Signed-off-by: Mike Snitzer +Reviewed-by: Ming Lei +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/blk-mq.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1937,7 +1937,7 @@ struct request_queue *blk_mq_init_queue( + */ + if (percpu_ref_init(&q->mq_usage_counter, blk_mq_usage_counter_release, + PERCPU_REF_INIT_ATOMIC, GFP_KERNEL)) +- goto err_map; ++ goto err_mq_usage; + + setup_timer(&q->timeout, blk_mq_rq_timer, (unsigned long) q); + blk_queue_rq_timeout(q, 30000); +@@ -1980,7 +1980,7 @@ struct request_queue *blk_mq_init_queue( + blk_mq_init_cpu_queues(q, set->nr_hw_queues); + + if (blk_mq_init_hw_queues(q, set)) +- goto err_hw; ++ goto err_mq_usage; + + mutex_lock(&all_q_mutex); + list_add_tail(&q->all_q_node, &all_q_list); +@@ -1992,7 +1992,7 @@ struct request_queue *blk_mq_init_queue( + + return q; + +-err_hw: ++err_mq_usage: + blk_cleanup_queue(q); + err_hctxs: + kfree(map); diff --git a/queue-3.19/blkmq-fix-null-pointer-deref-when-all-reserved-tags-in.patch b/queue-3.19/blkmq-fix-null-pointer-deref-when-all-reserved-tags-in.patch new file mode 100644 index 00000000000..bfeac4bd6f3 --- /dev/null +++ b/queue-3.19/blkmq-fix-null-pointer-deref-when-all-reserved-tags-in.patch @@ -0,0 +1,44 @@ +From bc188d818edf325ae38cfa43254a0b10a4defd65 Mon Sep 17 00:00:00 2001 +From: Sam Bradshaw +Date: Wed, 18 Mar 2015 17:06:18 -0600 +Subject: blkmq: Fix NULL pointer deref when all reserved tags in + +From: Sam Bradshaw + +commit bc188d818edf325ae38cfa43254a0b10a4defd65 upstream. + +When allocating from the reserved tags pool, bt_get() is called with +a NULL hctx. If all tags are in use, the hw queue is kicked to push +out any pending IO, potentially freeing tags, and tag allocation is +retried. The problem is that blk_mq_run_hw_queue() doesn't check for +a NULL hctx. So we avoid it with a simple NULL hctx test. + +Tested by hammering mtip32xx with concurrent smartctl/hdparm. + +Signed-off-by: Sam Bradshaw +Signed-off-by: Selvan Mani +Fixes: b32232073e80 ("blk-mq: fix hang in bt_get()") +Added appropriate comment. +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/blk-mq-tag.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/block/blk-mq-tag.c ++++ b/block/blk-mq-tag.c +@@ -265,9 +265,11 @@ static int bt_get(struct blk_mq_alloc_da + /* + * We're out of tags on this hardware queue, kick any + * pending IO submits before going to sleep waiting for +- * some to complete. ++ * some to complete. Note that hctx can be NULL here for ++ * reserved tag allocation. + */ +- blk_mq_run_hw_queue(hctx, false); ++ if (hctx) ++ blk_mq_run_hw_queue(hctx, false); + + /* + * Retry tag allocation after running the hardware queue, diff --git a/queue-3.19/block-fix-blk_stack_limits-regression-due-to-lcm-change.patch b/queue-3.19/block-fix-blk_stack_limits-regression-due-to-lcm-change.patch new file mode 100644 index 00000000000..ac4e7dd091c --- /dev/null +++ b/queue-3.19/block-fix-blk_stack_limits-regression-due-to-lcm-change.patch @@ -0,0 +1,103 @@ +From e9637415a92cf25ad800b7fdeddcd30cce7b44ab Mon Sep 17 00:00:00 2001 +From: Mike Snitzer +Date: Mon, 30 Mar 2015 13:39:09 -0400 +Subject: block: fix blk_stack_limits() regression due to lcm() change + +From: Mike Snitzer + +commit e9637415a92cf25ad800b7fdeddcd30cce7b44ab upstream. + +Linux 3.19 commit 69c953c ("lib/lcm.c: lcm(n,0)=lcm(0,n) is 0, not n") +caused blk_stack_limits() to not properly stack queue_limits for stacked +devices (e.g. DM). + +Fix this regression by establishing lcm_not_zero() and switching +blk_stack_limits() over to using it. + +DM uses blk_set_stacking_limits() to establish the initial top-level +queue_limits that are then built up based on underlying devices' limits +using blk_stack_limits(). In the case of optimal_io_size (io_opt) +blk_set_stacking_limits() establishes a default value of 0. With commit +69c953c, lcm(0, n) is no longer n, which compromises proper stacking of +the underlying devices' io_opt. + +Test: +$ modprobe scsi_debug dev_size_mb=10 num_tgts=1 opt_blks=1536 +$ cat /sys/block/sde/queue/optimal_io_size +786432 +$ dmsetup create node --table "0 100 linear /dev/sde 0" + +Before this fix: +$ cat /sys/block/dm-5/queue/optimal_io_size +0 + +After this fix: +$ cat /sys/block/dm-5/queue/optimal_io_size +786432 + +Signed-off-by: Mike Snitzer +Acked-by: Martin K. Petersen +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/blk-settings.c | 6 +++--- + include/linux/lcm.h | 1 + + lib/lcm.c | 11 +++++++++++ + 3 files changed, 15 insertions(+), 3 deletions(-) + +--- a/block/blk-settings.c ++++ b/block/blk-settings.c +@@ -585,7 +585,7 @@ int blk_stack_limits(struct queue_limits + b->physical_block_size); + + t->io_min = max(t->io_min, b->io_min); +- t->io_opt = lcm(t->io_opt, b->io_opt); ++ t->io_opt = lcm_not_zero(t->io_opt, b->io_opt); + + t->cluster &= b->cluster; + t->discard_zeroes_data &= b->discard_zeroes_data; +@@ -616,7 +616,7 @@ int blk_stack_limits(struct queue_limits + b->raid_partial_stripes_expensive); + + /* Find lowest common alignment_offset */ +- t->alignment_offset = lcm(t->alignment_offset, alignment) ++ t->alignment_offset = lcm_not_zero(t->alignment_offset, alignment) + % max(t->physical_block_size, t->io_min); + + /* Verify that new alignment_offset is on a logical block boundary */ +@@ -643,7 +643,7 @@ int blk_stack_limits(struct queue_limits + b->max_discard_sectors); + t->discard_granularity = max(t->discard_granularity, + b->discard_granularity); +- t->discard_alignment = lcm(t->discard_alignment, alignment) % ++ t->discard_alignment = lcm_not_zero(t->discard_alignment, alignment) % + t->discard_granularity; + } + +--- a/include/linux/lcm.h ++++ b/include/linux/lcm.h +@@ -4,5 +4,6 @@ + #include + + unsigned long lcm(unsigned long a, unsigned long b) __attribute_const__; ++unsigned long lcm_not_zero(unsigned long a, unsigned long b) __attribute_const__; + + #endif /* _LCM_H */ +--- a/lib/lcm.c ++++ b/lib/lcm.c +@@ -12,3 +12,14 @@ unsigned long lcm(unsigned long a, unsig + return 0; + } + EXPORT_SYMBOL_GPL(lcm); ++ ++unsigned long lcm_not_zero(unsigned long a, unsigned long b) ++{ ++ unsigned long l = lcm(a, b); ++ ++ if (l) ++ return l; ++ ++ return (b ? : a); ++} ++EXPORT_SYMBOL_GPL(lcm_not_zero); diff --git a/queue-3.19/drm-amdkfd-initialize-only-amdkfd-s-assigned-pipelines.patch b/queue-3.19/drm-amdkfd-initialize-only-amdkfd-s-assigned-pipelines.patch new file mode 100644 index 00000000000..4d668d9e75f --- /dev/null +++ b/queue-3.19/drm-amdkfd-initialize-only-amdkfd-s-assigned-pipelines.patch @@ -0,0 +1,56 @@ +From 1365aa6266fad0669487240af3f098593796172c Mon Sep 17 00:00:00 2001 +From: Oded Gabbay +Date: Tue, 17 Feb 2015 11:58:27 +0200 +Subject: drm/amdkfd: Initialize only amdkfd's assigned pipelines +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Oded Gabbay + +commit 1365aa6266fad0669487240af3f098593796172c upstream. + +This patch fixes a bug in the initialization of the pipelines. The +init_pipelines() function was called with a constant value of 0 in the +first_pipe argument. This is an error because amdkfd doesn't handle pipe 0. + +The correct way is to pass the value that get_first_pipe() returns as the +argument for first_pipe. + +This bug appeared in 3.19 (first version with amdkfd) and it causes around 15% +drop in CPU performance of Kaveri (A10-7850). + +v2: Don't set get_first_pipe() as inline because it calls BUG_ON() + +Signed-off-by: Oded Gabbay +Tested-by: Michel Dänzer +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +@@ -56,9 +56,9 @@ static inline unsigned int get_pipes_num + return dqm->dev->shared_resources.compute_pipe_count; + } + +-static inline unsigned int get_first_pipe(struct device_queue_manager *dqm) ++unsigned int get_first_pipe(struct device_queue_manager *dqm) + { +- BUG_ON(!dqm); ++ BUG_ON(!dqm || !dqm->dev); + return dqm->dev->shared_resources.first_compute_pipe; + } + +@@ -693,7 +693,7 @@ static int initialize_cpsch(struct devic + INIT_LIST_HEAD(&dqm->queues); + dqm->queue_count = dqm->processes_count = 0; + dqm->active_runlist = false; +- retval = init_pipelines(dqm, get_pipes_num(dqm), 0); ++ retval = init_pipelines(dqm, get_pipes_num(dqm), get_first_pipe(dqm)); + if (retval != 0) + goto fail_init_pipelines; + diff --git a/queue-3.19/drm-edid-set-eld-for-firmware-and-debugfs-override-edids.patch b/queue-3.19/drm-edid-set-eld-for-firmware-and-debugfs-override-edids.patch new file mode 100644 index 00000000000..d5e04d4a45b --- /dev/null +++ b/queue-3.19/drm-edid-set-eld-for-firmware-and-debugfs-override-edids.patch @@ -0,0 +1,50 @@ +From ad692b46dbf122ef90aadce3b389ef64c90e861d Mon Sep 17 00:00:00 2001 +From: Jani Nikula +Date: Thu, 26 Mar 2015 10:42:00 +0200 +Subject: drm/edid: set ELD for firmware and debugfs override EDIDs + +From: Jani Nikula + +commit ad692b46dbf122ef90aadce3b389ef64c90e861d upstream. + +If the user supplies EDID through firmware or debugfs override, the +driver callbacks are bypassed and the connector ELD does not get +updated, and audio fails. Set ELD for firmware and debugfs EDIDs too. + +There should be no harm in gratuitously doing this for non HDMI/DP +connectors, as it's still up to the driver to use the ELD, if any. + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=82349 +Reference: https://bugs.freedesktop.org/show_bug.cgi?id=80691 +Reported-by: Emil +Reported-by: Rob Engle +Tested-by: Jolan Luff +Reviewed-by: Daniel Vetter +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_edid_load.c | 1 + + drivers/gpu/drm/drm_probe_helper.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/gpu/drm/drm_edid_load.c ++++ b/drivers/gpu/drm/drm_edid_load.c +@@ -287,6 +287,7 @@ int drm_load_edid_firmware(struct drm_co + + drm_mode_connector_update_edid_property(connector, edid); + ret = drm_add_edid_modes(connector, edid); ++ drm_edid_to_eld(connector, edid); + kfree(edid); + + return ret; +--- a/drivers/gpu/drm/drm_probe_helper.c ++++ b/drivers/gpu/drm/drm_probe_helper.c +@@ -152,6 +152,7 @@ static int drm_helper_probe_single_conne + struct edid *edid = (struct edid *) connector->edid_blob_ptr->data; + + count = drm_add_edid_modes(connector, edid); ++ drm_edid_to_eld(connector, edid); + } else + count = (*connector_funcs->get_modes)(connector); + } diff --git a/queue-3.19/drm-fixup-racy-refcounting-in-plane_force_disable.patch b/queue-3.19/drm-fixup-racy-refcounting-in-plane_force_disable.patch new file mode 100644 index 00000000000..b821e3043e8 --- /dev/null +++ b/queue-3.19/drm-fixup-racy-refcounting-in-plane_force_disable.patch @@ -0,0 +1,73 @@ +From 8218c3f4df3bb1c637c17552405039a6dd3c1ee1 Mon Sep 17 00:00:00 2001 +From: Daniel Vetter +Date: Fri, 27 Feb 2015 12:58:13 +0100 +Subject: drm: Fixup racy refcounting in plane_force_disable + +From: Daniel Vetter + +commit 8218c3f4df3bb1c637c17552405039a6dd3c1ee1 upstream. + +Originally it was impossible to be dropping the last refcount in this +function since there was always one around still from the idr. But in + +commit 83f45fc360c8e16a330474860ebda872d1384c8c +Author: Daniel Vetter +Date: Wed Aug 6 09:10:18 2014 +0200 + + drm: Don't grab an fb reference for the idr + +we've switched to weak references, broke that assumption but forgot to +fix it up. + +Since we still force-disable planes it's only possible to hit this +when racing multiple rmfb with fbdev restoring or similar evil things. +As long as userspace is nice it's impossible to hit the BUG_ON. + +But the BUG_ON would most likely be hit from fbdev code, which usually +invovles the console_lock besides all modeset locks. So very likely +we'd never get the bug reports if this was hit in the wild, hence +better be safe than sorry and backport. + +Spotted by Matt Roper while reviewing other patches. + +[airlied: pull this back into 4.0 - the oops happens there] + +Cc: Matt Roper +Reviewed-by: Matt Roper +Signed-off-by: Daniel Vetter +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_crtc.c | 13 +------------ + 1 file changed, 1 insertion(+), 12 deletions(-) + +--- a/drivers/gpu/drm/drm_crtc.c ++++ b/drivers/gpu/drm/drm_crtc.c +@@ -531,17 +531,6 @@ void drm_framebuffer_reference(struct dr + } + EXPORT_SYMBOL(drm_framebuffer_reference); + +-static void drm_framebuffer_free_bug(struct kref *kref) +-{ +- BUG(); +-} +- +-static void __drm_framebuffer_unreference(struct drm_framebuffer *fb) +-{ +- DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount)); +- kref_put(&fb->refcount, drm_framebuffer_free_bug); +-} +- + /** + * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr + * @fb: fb to unregister +@@ -1322,7 +1311,7 @@ void drm_plane_force_disable(struct drm_ + return; + } + /* disconnect the plane from the fb and crtc: */ +- __drm_framebuffer_unreference(plane->old_fb); ++ drm_framebuffer_unreference(plane->old_fb); + plane->old_fb = NULL; + plane->fb = NULL; + plane->crtc = NULL; diff --git a/queue-3.19/drm-i915-align-initial-plane-backing-objects-correctly.patch b/queue-3.19/drm-i915-align-initial-plane-backing-objects-correctly.patch new file mode 100644 index 00000000000..4de6280d3cc --- /dev/null +++ b/queue-3.19/drm-i915-align-initial-plane-backing-objects-correctly.patch @@ -0,0 +1,92 @@ +From f37b5c2be8979993efee2da50b51126e3908eb8b Mon Sep 17 00:00:00 2001 +From: Daniel Vetter +Date: Tue, 10 Feb 2015 23:12:27 +0100 +Subject: drm/i915: Align initial plane backing objects correctly + +From: Daniel Vetter + +commit f37b5c2be8979993efee2da50b51126e3908eb8b upstream. + +Some bios really like to joke and start the planes at an offset ... +hooray! + +Align start and end to fix this. + +v2: Fixup calculation of size, spotted by Chris Wilson. + +v3: Fix serious fumble I've just spotted. + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=86883 +Cc: Johannes W +Cc: Chris Wilson +Cc: Jani Nikula +Reported-and-tested-by: Johannes W +Signed-off-by: Daniel Vetter +[Jani: split WARN_ONs, rebase on v4.0-rc1] +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_gem_stolen.c | 5 +---- + drivers/gpu/drm/i915/intel_display.c | 18 +++++++++++------- + 2 files changed, 12 insertions(+), 11 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_gem_stolen.c ++++ b/drivers/gpu/drm/i915/i915_gem_stolen.c +@@ -485,10 +485,7 @@ i915_gem_object_create_stolen_for_preall + stolen_offset, gtt_offset, size); + + /* KISS and expect everything to be page-aligned */ +- BUG_ON(stolen_offset & 4095); +- BUG_ON(size & 4095); +- +- if (WARN_ON(size == 0)) ++ if (WARN_ON(size == 0 || stolen_offset & 4095 || size & 4095)) + return NULL; + + stolen = kzalloc(sizeof(*stolen), GFP_KERNEL); +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -2339,13 +2339,19 @@ static bool intel_alloc_plane_obj(struct + struct drm_device *dev = crtc->base.dev; + struct drm_i915_gem_object *obj = NULL; + struct drm_mode_fb_cmd2 mode_cmd = { 0 }; +- u32 base = plane_config->base; ++ u32 base_aligned = round_down(plane_config->base, PAGE_SIZE); ++ u32 size_aligned = round_up(plane_config->base + plane_config->size, ++ PAGE_SIZE); ++ ++ size_aligned -= base_aligned; + + if (plane_config->size == 0) + return false; + +- obj = i915_gem_object_create_stolen_for_preallocated(dev, base, base, +- plane_config->size); ++ obj = i915_gem_object_create_stolen_for_preallocated(dev, ++ base_aligned, ++ base_aligned, ++ size_aligned); + if (!obj) + return false; + +@@ -6660,8 +6666,7 @@ static void i9xx_get_plane_config(struct + aligned_height = intel_align_height(dev, crtc->base.primary->fb->height, + plane_config->tiled); + +- plane_config->size = PAGE_ALIGN(crtc->base.primary->fb->pitches[0] * +- aligned_height); ++ plane_config->size = crtc->base.primary->fb->pitches[0] * aligned_height; + + DRM_DEBUG_KMS("pipe/plane %d/%d with fb: size=%dx%d@%d, offset=%x, pitch %d, size 0x%x\n", + pipe, plane, crtc->base.primary->fb->width, +@@ -7711,8 +7716,7 @@ static void ironlake_get_plane_config(st + aligned_height = intel_align_height(dev, crtc->base.primary->fb->height, + plane_config->tiled); + +- plane_config->size = PAGE_ALIGN(crtc->base.primary->fb->pitches[0] * +- aligned_height); ++ plane_config->size = crtc->base.primary->fb->pitches[0] * aligned_height; + + DRM_DEBUG_KMS("pipe/plane %d/%d with fb: size=%dx%d@%d, offset=%x, pitch %d, size 0x%x\n", + pipe, plane, crtc->base.primary->fb->width, diff --git a/queue-3.19/drm-i915-chv-remove-wait-for-a-previous-gfx-force-off.patch b/queue-3.19/drm-i915-chv-remove-wait-for-a-previous-gfx-force-off.patch new file mode 100644 index 00000000000..ca3b5b11334 --- /dev/null +++ b/queue-3.19/drm-i915-chv-remove-wait-for-a-previous-gfx-force-off.patch @@ -0,0 +1,45 @@ +From c9c52e24194a741f9fca96e7aa965f0fa36af504 Mon Sep 17 00:00:00 2001 +From: Deepak S +Date: Sat, 28 Mar 2015 15:23:34 +0530 +Subject: drm/i915/chv: Remove Wait for a previous gfx force-off +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Deepak S + +commit c9c52e24194a741f9fca96e7aa965f0fa36af504 upstream. + +On CHV, PUNIT team confirmed that 'VLV_GFX_CLK_STATUS_BIT' is not a +sticky bit and it will always be set. So ignore Check for previous +Gfx force off during suspend and allow the force clk as part S0ix +Sequence + +Signed-off-by: Deepak S +Reviewed-by: Ville Syrjälä +Signed-off-by: Daniel Vetter +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_drv.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_drv.c ++++ b/drivers/gpu/drm/i915/i915_drv.c +@@ -1196,11 +1196,13 @@ int vlv_force_gfx_clock(struct drm_i915_ + int err; + + val = I915_READ(VLV_GTLC_SURVIVABILITY_REG); +- WARN_ON(!!(val & VLV_GFX_CLK_FORCE_ON_BIT) == force_on); + + #define COND (I915_READ(VLV_GTLC_SURVIVABILITY_REG) & VLV_GFX_CLK_STATUS_BIT) + /* Wait for a previous force-off to settle */ +- if (force_on) { ++ if (force_on && !IS_CHERRYVIEW(dev_priv->dev)) { ++ /* WARN_ON only for the Valleyview */ ++ WARN_ON(!!(val & VLV_GFX_CLK_FORCE_ON_BIT) == force_on); ++ + err = wait_for(!COND, 20); + if (err) { + DRM_ERROR("timeout waiting for GFX clock force-off (%08x)\n", diff --git a/queue-3.19/drm-i915-reject-the-colorkey-ioctls-for-primary-and-cursor-planes.patch b/queue-3.19/drm-i915-reject-the-colorkey-ioctls-for-primary-and-cursor-planes.patch new file mode 100644 index 00000000000..32b7ae274cb --- /dev/null +++ b/queue-3.19/drm-i915-reject-the-colorkey-ioctls-for-primary-and-cursor-planes.patch @@ -0,0 +1,50 @@ +From 840a1cf0cd533f30da792527ca5ff6a023d4a727 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Fri, 27 Mar 2015 19:59:40 +0200 +Subject: drm/i915: Reject the colorkey ioctls for primary and cursor planes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= + +commit 840a1cf0cd533f30da792527ca5ff6a023d4a727 upstream. + +The legcy colorkey ioctls are only implemented for sprite planes, so +reject the ioctl for primary/cursor planes. If we want to support +colorkeying with these planes (assuming we have hw support of course) +we should just move ahead with the colorkey property conversion. + +Testcase: kms_legacy_colorkey +Cc: Tommi Rantala +Reference: http://mid.gmane.org/CA+ydwtr+bCo7LJ44JFmUkVRx144UDFgOS+aJTfK6KHtvBDVuAw@mail.gmail.com +Reported-and-tested-by: Tommi Rantala +Signed-off-by: Ville Syrjälä +Reviewed-by: Daniel Vetter +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_sprite.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_sprite.c ++++ b/drivers/gpu/drm/i915/intel_sprite.c +@@ -1495,7 +1495,7 @@ int intel_sprite_set_colorkey(struct drm + drm_modeset_lock_all(dev); + + plane = drm_plane_find(dev, set->plane_id); +- if (!plane) { ++ if (!plane || plane->type != DRM_PLANE_TYPE_OVERLAY) { + ret = -ENOENT; + goto out_unlock; + } +@@ -1522,7 +1522,7 @@ int intel_sprite_get_colorkey(struct drm + drm_modeset_lock_all(dev); + + plane = drm_plane_find(dev, get->plane_id); +- if (!plane) { ++ if (!plane || plane->type != DRM_PLANE_TYPE_OVERLAY) { + ret = -ENOENT; + goto out_unlock; + } diff --git a/queue-3.19/drm-i915-vlv-remove-wait-for-previous-gfx-clk-disable-request.patch b/queue-3.19/drm-i915-vlv-remove-wait-for-previous-gfx-clk-disable-request.patch new file mode 100644 index 00000000000..36135787967 --- /dev/null +++ b/queue-3.19/drm-i915-vlv-remove-wait-for-previous-gfx-clk-disable-request.patch @@ -0,0 +1,57 @@ +From 5df0582bf036bb5f9a8ad8db5884fe13a55347d1 Mon Sep 17 00:00:00 2001 +From: Jesse Barnes +Date: Wed, 1 Apr 2015 14:22:58 -0700 +Subject: drm/i915/vlv: remove wait for previous GFX clk disable request + +From: Jesse Barnes + +commit 5df0582bf036bb5f9a8ad8db5884fe13a55347d1 upstream. + +Looks like it was introduced in: + +commit 650ad970a39f8b6164fe8613edc150f585315289 +Author: Imre Deak +Date: Fri Apr 18 16:35:02 2014 +0300 + + drm/i915: vlv: factor out vlv_force_gfx_clock and check for pending force-of + +but I'm not sure why. It has caused problems for us in the past (see +85250ddff7a6 "drm/i915/chv: Remove Wait for a previous gfx force-off" +and 8d4eee9cd7a1 "drm/i915: vlv: increase timeout when forcing on the +GFX clock") and doesn't seem to be required, so let's just drop it. + +References: https://bugs.freedesktop.org/show_bug.cgi?id=89611 +Signed-off-by: Jesse Barnes +Tested-by: Darren Hart +Reviewed-by: Deepak S +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_drv.c | 14 -------------- + 1 file changed, 14 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_drv.c ++++ b/drivers/gpu/drm/i915/i915_drv.c +@@ -1197,21 +1197,7 @@ int vlv_force_gfx_clock(struct drm_i915_ + u32 val; + int err; + +- val = I915_READ(VLV_GTLC_SURVIVABILITY_REG); +- + #define COND (I915_READ(VLV_GTLC_SURVIVABILITY_REG) & VLV_GFX_CLK_STATUS_BIT) +- /* Wait for a previous force-off to settle */ +- if (force_on && !IS_CHERRYVIEW(dev_priv->dev)) { +- /* WARN_ON only for the Valleyview */ +- WARN_ON(!!(val & VLV_GFX_CLK_FORCE_ON_BIT) == force_on); +- +- err = wait_for(!COND, 20); +- if (err) { +- DRM_ERROR("timeout waiting for GFX clock force-off (%08x)\n", +- I915_READ(VLV_GTLC_SURVIVABILITY_REG)); +- return err; +- } +- } + + val = I915_READ(VLV_GTLC_SURVIVABILITY_REG); + val &= ~VLV_GFX_CLK_FORCE_ON_BIT; diff --git a/queue-3.19/drm-i915-vlv-save-restore-the-power-context-base-reg.patch b/queue-3.19/drm-i915-vlv-save-restore-the-power-context-base-reg.patch new file mode 100644 index 00000000000..753d7e3e868 --- /dev/null +++ b/queue-3.19/drm-i915-vlv-save-restore-the-power-context-base-reg.patch @@ -0,0 +1,56 @@ +From 9c25210fd30991e68f93e2ec0857de2d967b5766 Mon Sep 17 00:00:00 2001 +From: Jesse Barnes +Date: Wed, 1 Apr 2015 14:22:57 -0700 +Subject: drm/i915/vlv: save/restore the power context base reg + +From: Jesse Barnes + +commit 9c25210fd30991e68f93e2ec0857de2d967b5766 upstream. + +Some BIOSes (e.g. the one on the Minnowboard) don't save/restore this +reg. If it's unlocked, we can just restore the previous value, and if +it's locked (in case the BIOS re-programmed it for us) the write will be +ignored and we'll still have "did it move" sanity check in the PM code to +warn us if something is still amiss. + +References: https://bugs.freedesktop.org/show_bug.cgi?id=89611 +Signed-off-by: Jesse Barnes +Tested-by: Darren Hart +Reviewed-by: Imre Deak +Reviewed-by: Deepak S +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_drv.c | 2 ++ + drivers/gpu/drm/i915/i915_drv.h | 1 + + 2 files changed, 3 insertions(+) + +--- a/drivers/gpu/drm/i915/i915_drv.c ++++ b/drivers/gpu/drm/i915/i915_drv.c +@@ -1093,6 +1093,7 @@ static void vlv_save_gunit_s0ix_state(st + /* Gunit-Display CZ domain, 0x182028-0x1821CF */ + s->gu_ctl0 = I915_READ(VLV_GU_CTL0); + s->gu_ctl1 = I915_READ(VLV_GU_CTL1); ++ s->pcbr = I915_READ(VLV_PCBR); + s->clock_gate_dis2 = I915_READ(VLV_GUNIT_CLOCK_GATE2); + + /* +@@ -1187,6 +1188,7 @@ static void vlv_restore_gunit_s0ix_state + /* Gunit-Display CZ domain, 0x182028-0x1821CF */ + I915_WRITE(VLV_GU_CTL0, s->gu_ctl0); + I915_WRITE(VLV_GU_CTL1, s->gu_ctl1); ++ I915_WRITE(VLV_PCBR, s->pcbr); + I915_WRITE(VLV_GUNIT_CLOCK_GATE2, s->clock_gate_dis2); + } + +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -985,6 +985,7 @@ struct vlv_s0ix_state { + /* Display 2 CZ domain */ + u32 gu_ctl0; + u32 gu_ctl1; ++ u32 pcbr; + u32 clock_gate_dis2; + }; + diff --git a/queue-3.19/drm-radeon-add-extra-check-in-radeon_ttm_tt_unpin_userptr.patch b/queue-3.19/drm-radeon-add-extra-check-in-radeon_ttm_tt_unpin_userptr.patch new file mode 100644 index 00000000000..063fdf972c2 --- /dev/null +++ b/queue-3.19/drm-radeon-add-extra-check-in-radeon_ttm_tt_unpin_userptr.patch @@ -0,0 +1,37 @@ +From 863653fed0f449fb738295255cc834b271cfa088 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20K=C3=B6nig?= +Date: Tue, 31 Mar 2015 17:36:57 +0200 +Subject: drm/radeon: add extra check in radeon_ttm_tt_unpin_userptr +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Christian=20K=C3=B6nig?= + +commit 863653fed0f449fb738295255cc834b271cfa088 upstream. + +We somehow try to free the SG table twice. + +Bugs: https://bugs.freedesktop.org/show_bug.cgi?id=89734 + +Signed-off-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_ttm.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/gpu/drm/radeon/radeon_ttm.c ++++ b/drivers/gpu/drm/radeon/radeon_ttm.c +@@ -598,6 +598,10 @@ static void radeon_ttm_tt_unpin_userptr( + enum dma_data_direction direction = write ? + DMA_BIDIRECTIONAL : DMA_TO_DEVICE; + ++ /* double check that we don't free the table twice */ ++ if (!ttm->sg->sgl) ++ return; ++ + /* free the sg table and pages again */ + dma_unmap_sg(rdev->dev, ttm->sg->sgl, ttm->sg->nents, direction); + diff --git a/queue-3.19/drm-radeon-dpm-fix-120hz-handling-harder.patch b/queue-3.19/drm-radeon-dpm-fix-120hz-handling-harder.patch new file mode 100644 index 00000000000..6a307ab8b11 --- /dev/null +++ b/queue-3.19/drm-radeon-dpm-fix-120hz-handling-harder.patch @@ -0,0 +1,93 @@ +From 3899ca844b82fb201fb764f56eec483acb59a29c Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 18 Mar 2015 17:05:10 -0400 +Subject: drm/radeon/dpm: fix 120hz handling harder + +From: Alex Deucher + +commit 3899ca844b82fb201fb764f56eec483acb59a29c upstream. + +Need to expand the check to handle short circuiting +if the selected state is the same as current state. + +bug: +https://bugs.freedesktop.org/show_bug.cgi?id=87796 + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon.h | 1 + + drivers/gpu/drm/radeon/radeon_pm.c | 22 +++++++++++++++++----- + 2 files changed, 18 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon.h ++++ b/drivers/gpu/drm/radeon/radeon.h +@@ -1565,6 +1565,7 @@ struct radeon_dpm { + int new_active_crtc_count; + u32 current_active_crtcs; + int current_active_crtc_count; ++ bool single_display; + struct radeon_dpm_dynamic_state dyn_state; + struct radeon_dpm_fan fan; + u32 tdp_limit; +--- a/drivers/gpu/drm/radeon/radeon_pm.c ++++ b/drivers/gpu/drm/radeon/radeon_pm.c +@@ -704,12 +704,8 @@ static void radeon_dpm_thermal_work_hand + radeon_pm_compute_clocks(rdev); + } + +-static struct radeon_ps *radeon_dpm_pick_power_state(struct radeon_device *rdev, +- enum radeon_pm_state_type dpm_state) ++static bool radeon_dpm_single_display(struct radeon_device *rdev) + { +- int i; +- struct radeon_ps *ps; +- u32 ui_class; + bool single_display = (rdev->pm.dpm.new_active_crtc_count < 2) ? + true : false; + +@@ -719,6 +715,17 @@ static struct radeon_ps *radeon_dpm_pick + single_display = false; + } + ++ return single_display; ++} ++ ++static struct radeon_ps *radeon_dpm_pick_power_state(struct radeon_device *rdev, ++ enum radeon_pm_state_type dpm_state) ++{ ++ int i; ++ struct radeon_ps *ps; ++ u32 ui_class; ++ bool single_display = radeon_dpm_single_display(rdev); ++ + /* certain older asics have a separare 3D performance state, + * so try that first if the user selected performance + */ +@@ -844,6 +851,7 @@ static void radeon_dpm_change_power_stat + struct radeon_ps *ps; + enum radeon_pm_state_type dpm_state; + int ret; ++ bool single_display = radeon_dpm_single_display(rdev); + + /* if dpm init failed */ + if (!rdev->pm.dpm_enabled) +@@ -868,6 +876,9 @@ static void radeon_dpm_change_power_stat + /* vce just modifies an existing state so force a change */ + if (ps->vce_active != rdev->pm.dpm.vce_active) + goto force; ++ /* user has made a display change (such as timing) */ ++ if (rdev->pm.dpm.single_display != single_display) ++ goto force; + if ((rdev->family < CHIP_BARTS) || (rdev->flags & RADEON_IS_IGP)) { + /* for pre-BTC and APUs if the num crtcs changed but state is the same, + * all we need to do is update the display configuration. +@@ -930,6 +941,7 @@ force: + + rdev->pm.dpm.current_active_crtcs = rdev->pm.dpm.new_active_crtcs; + rdev->pm.dpm.current_active_crtc_count = rdev->pm.dpm.new_active_crtc_count; ++ rdev->pm.dpm.single_display = single_display; + + /* wait for the rings to drain */ + for (i = 0; i < RADEON_NUM_RINGS; i++) { diff --git a/queue-3.19/drm-radeon-fix-wait-in-radeon_mn_invalidate_range_start.patch b/queue-3.19/drm-radeon-fix-wait-in-radeon_mn_invalidate_range_start.patch new file mode 100644 index 00000000000..8bc5a7aef97 --- /dev/null +++ b/queue-3.19/drm-radeon-fix-wait-in-radeon_mn_invalidate_range_start.patch @@ -0,0 +1,49 @@ +From 22e2e86560c5fca6f9b9d078f221fcdab9947a5e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20K=C3=B6nig?= +Date: Tue, 31 Mar 2015 17:36:58 +0200 +Subject: drm/radeon: fix wait in radeon_mn_invalidate_range_start +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Christian=20K=C3=B6nig?= + +commit 22e2e86560c5fca6f9b9d078f221fcdab9947a5e upstream. + +We need to wait for all fences, not just the exclusive one. + +Signed-off-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_mn.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon_mn.c ++++ b/drivers/gpu/drm/radeon/radeon_mn.c +@@ -122,7 +122,6 @@ static void radeon_mn_invalidate_range_s + it = interval_tree_iter_first(&rmn->objects, start, end); + while (it) { + struct radeon_bo *bo; +- struct fence *fence; + int r; + + bo = container_of(it, struct radeon_bo, mn_it); +@@ -134,12 +133,10 @@ static void radeon_mn_invalidate_range_s + continue; + } + +- fence = reservation_object_get_excl(bo->tbo.resv); +- if (fence) { +- r = radeon_fence_wait((struct radeon_fence *)fence, false); +- if (r) +- DRM_ERROR("(%d) failed to wait for user bo\n", r); +- } ++ r = reservation_object_wait_timeout_rcu(bo->tbo.resv, true, ++ false, MAX_SCHEDULE_TIMEOUT); ++ if (r) ++ DRM_ERROR("(%d) failed to wait for user bo\n", r); + + radeon_ttm_placement_from_domain(bo, RADEON_GEM_DOMAIN_CPU); + r = ttm_bo_validate(&bo->tbo, &bo->placement, false, false); diff --git a/queue-3.19/fix-bug-in-blk_rq_merge_ok.patch b/queue-3.19/fix-bug-in-blk_rq_merge_ok.patch new file mode 100644 index 00000000000..5a834c4990d --- /dev/null +++ b/queue-3.19/fix-bug-in-blk_rq_merge_ok.patch @@ -0,0 +1,33 @@ +From 7ee8e4f3983c4ff700958a6099c8fd212ea67b94 Mon Sep 17 00:00:00 2001 +From: Wenbo Wang +Date: Fri, 20 Mar 2015 01:04:54 -0400 +Subject: Fix bug in blk_rq_merge_ok + +From: Wenbo Wang + +commit 7ee8e4f3983c4ff700958a6099c8fd212ea67b94 upstream. + +Use the right array index to reference the last +element of rq->biotail->bi_io_vec[] + +Signed-off-by: Wenbo Wang +Reviewed-by: Chong Yuan +Fixes: 66cb45aa41315 ("block: add support for limiting gaps in SG lists") +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/blk-merge.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/block/blk-merge.c ++++ b/block/blk-merge.c +@@ -609,7 +609,7 @@ bool blk_rq_merge_ok(struct request *rq, + if (q->queue_flags & (1 << QUEUE_FLAG_SG_GAPS)) { + struct bio_vec *bprev; + +- bprev = &rq->biotail->bi_io_vec[bio->bi_vcnt - 1]; ++ bprev = &rq->biotail->bi_io_vec[rq->biotail->bi_vcnt - 1]; + if (bvec_gap_to_prev(bprev, bio->bi_io_vec[0].bv_offset)) + return false; + } diff --git a/queue-3.19/pci-aer-avoid-info-leak-in-__print_tlp_header.patch b/queue-3.19/pci-aer-avoid-info-leak-in-__print_tlp_header.patch new file mode 100644 index 00000000000..a92bd092003 --- /dev/null +++ b/queue-3.19/pci-aer-avoid-info-leak-in-__print_tlp_header.patch @@ -0,0 +1,53 @@ +From a1b7f2f6367944d445c6853035830a35c6343939 Mon Sep 17 00:00:00 2001 +From: Rasmus Villemoes +Date: Thu, 26 Feb 2015 09:55:03 +0100 +Subject: PCI/AER: Avoid info leak in __print_tlp_header() + +From: Rasmus Villemoes + +commit a1b7f2f6367944d445c6853035830a35c6343939 upstream. + +Commit fab4c256a58b ("PCI/AER: Add a TLP header print helper") introduced +the helper function __print_tlp_header(), but contrary to the intention, +the behaviour did change: Since we're taking the address of the parameter +t, the first 4 or 8 bytes printed will be the value of the pointer t +itself, and the remaining 12 or 8 bytes will be who-knows-what (something +from the stack). + +We want to show the values of the four members of the struct +aer_header_log_regs; that can be done without ugly and error-prone casts. +On little-endian this should produce the same output as originally +intended, and since no-one has complained about getting garbage output so +far, I think big-endian should be ok too. + +Fixes: fab4c256a58b ("PCI/AER: Add a TLP header print helper") +Signed-off-by: Rasmus Villemoes +Signed-off-by: Bjorn Helgaas +Acked-by: Borislav Petkov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/pcie/aer/aerdrv_errprint.c | 12 ++---------- + 1 file changed, 2 insertions(+), 10 deletions(-) + +--- a/drivers/pci/pcie/aer/aerdrv_errprint.c ++++ b/drivers/pci/pcie/aer/aerdrv_errprint.c +@@ -132,16 +132,8 @@ static const char *aer_agent_string[] = + static void __print_tlp_header(struct pci_dev *dev, + struct aer_header_log_regs *t) + { +- unsigned char *tlp = (unsigned char *)&t; +- +- dev_err(&dev->dev, " TLP Header:" +- " %02x%02x%02x%02x %02x%02x%02x%02x" +- " %02x%02x%02x%02x %02x%02x%02x%02x\n", +- *(tlp + 3), *(tlp + 2), *(tlp + 1), *tlp, +- *(tlp + 7), *(tlp + 6), *(tlp + 5), *(tlp + 4), +- *(tlp + 11), *(tlp + 10), *(tlp + 9), +- *(tlp + 8), *(tlp + 15), *(tlp + 14), +- *(tlp + 13), *(tlp + 12)); ++ dev_err(&dev->dev, " TLP Header: %08x %08x %08x %08x\n", ++ t->dw0, t->dw1, t->dw2, t->dw3); + } + + static void __aer_print_error(struct pci_dev *dev, diff --git a/queue-3.19/pci-cpcihp-add-missing-curly-braces-in-cpci_configure_slot.patch b/queue-3.19/pci-cpcihp-add-missing-curly-braces-in-cpci_configure_slot.patch new file mode 100644 index 00000000000..dad1b9182da --- /dev/null +++ b/queue-3.19/pci-cpcihp-add-missing-curly-braces-in-cpci_configure_slot.patch @@ -0,0 +1,38 @@ +From bc3b5b47c80da8838758731d423179262c9c36ec Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 25 Feb 2015 16:23:22 +0300 +Subject: PCI: cpcihp: Add missing curly braces in cpci_configure_slot() + +From: Dan Carpenter + +commit bc3b5b47c80da8838758731d423179262c9c36ec upstream. + +I don't have this hardware but it looks like we weren't adding bridge +devices as intended. Maybe the bridge is always the last device? + +Fixes: 05b125004815 ("PCI: cpcihp: Iterate over all devices in slot, not functions 0-7") +Signed-off-by: Dan Carpenter +Signed-off-by: Bjorn Helgaas +Acked-by: Yijing Wang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/hotplug/cpci_hotplug_pci.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/pci/hotplug/cpci_hotplug_pci.c ++++ b/drivers/pci/hotplug/cpci_hotplug_pci.c +@@ -286,11 +286,12 @@ int cpci_configure_slot(struct slot *slo + } + parent = slot->dev->bus; + +- list_for_each_entry(dev, &parent->devices, bus_list) ++ list_for_each_entry(dev, &parent->devices, bus_list) { + if (PCI_SLOT(dev->devfn) != PCI_SLOT(slot->devfn)) + continue; + if (pci_is_bridge(dev)) + pci_hp_add_bridge(dev); ++ } + + + pci_assign_unassigned_bridge_resources(parent->self); diff --git a/queue-3.19/pci-don-t-look-for-acpi-hotplug-parameters-if-acpi-is-disabled.patch b/queue-3.19/pci-don-t-look-for-acpi-hotplug-parameters-if-acpi-is-disabled.patch new file mode 100644 index 00000000000..38f30fea711 --- /dev/null +++ b/queue-3.19/pci-don-t-look-for-acpi-hotplug-parameters-if-acpi-is-disabled.patch @@ -0,0 +1,54 @@ +From 8647ca9ad5a0065ad53a2ad7e39163592b6ed35e Mon Sep 17 00:00:00 2001 +From: Bjorn Helgaas +Date: Tue, 24 Mar 2015 11:12:45 -0500 +Subject: PCI: Don't look for ACPI hotplug parameters if ACPI is disabled + +From: Bjorn Helgaas + +commit 8647ca9ad5a0065ad53a2ad7e39163592b6ed35e upstream. + +Booting a v3.18 or newer Xen domU kernel with PCI devices passed through +results in an oops (this is a 32-bit 3.13.11 dom0 with a 64-bit 4.4.0 +hypervisor and 32-bit domU): + + BUG: unable to handle kernel paging request at 0030303e + IP: [] acpi_ns_validate_handle+0x12/0x1a + Call Trace: + [] ? acpi_evaluate_object+0x31/0x1fc + [] ? pci_get_hp_params+0x111/0x4e0 + [] ? xen_force_evtchn_callback+0x17/0x30 + [] ? xen_restore_fl_direct_reloc+0x4/0x4 + [] ? pci_device_add+0x24/0x450 + +Don't look for ACPI configuration information if ACPI has been disabled. + +I don't think this is the best fix, because we can boot plain Linux (no +Xen) with "acpi=off", and we don't need this check in pci_get_hp_params(). +There should be a better fix that would make Xen domU work the same way. +The domU kernel has ACPI support but it has no AML. There should be a way +to initialize the ACPI data structures so things fail gracefully rather +than oopsing. This is an interim fix to address the regression. + +Fixes: 6cd33649fa83 ("PCI: Add pci_configure_device() during enumeration") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=96301 +Reported-by: Michael D Labriola +Tested-by: Michael D Labriola +Signed-off-by: Bjorn Helgaas +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/pci-acpi.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/pci/pci-acpi.c ++++ b/drivers/pci/pci-acpi.c +@@ -248,6 +248,9 @@ int pci_get_hp_params(struct pci_dev *de + acpi_handle handle, phandle; + struct pci_bus *pbus; + ++ if (acpi_pci_disabled) ++ return -ENODEV; ++ + handle = NULL; + for (pbus = dev->bus; pbus; pbus = pbus->parent) { + handle = acpi_pci_get_bridge_handle(pbus); diff --git a/queue-3.19/pci-spear-drop-__initdata-from-spear13xx_pcie_driver.patch b/queue-3.19/pci-spear-drop-__initdata-from-spear13xx_pcie_driver.patch new file mode 100644 index 00000000000..b8dcc125cc2 --- /dev/null +++ b/queue-3.19/pci-spear-drop-__initdata-from-spear13xx_pcie_driver.patch @@ -0,0 +1,68 @@ +From a43f32d647273023edddb0dc8f91c4c6378b252b Mon Sep 17 00:00:00 2001 +From: "Matwey V. Kornilov" +Date: Thu, 19 Feb 2015 20:41:48 +0300 +Subject: PCI: spear: Drop __initdata from spear13xx_pcie_driver + +From: "Matwey V. Kornilov" + +commit a43f32d647273023edddb0dc8f91c4c6378b252b upstream. + +Struct spear13xx_pcie_driver was in initdata, but we passed a pointer to it +to platform_driver_register(), which can use the pointer at arbitrary times +in the future, even after the initdata is freed. That leads to crashes. + +Move spear13xx_pcie_driver and things referenced by it +(spear13xx_pcie_probe() and dw_pcie_host_init()) out of initdata. + +[bhelgaas: changelog] +Fixes: 6675ef212dac ("PCI: spear: Fix Section mismatch compilation warning for probe()") +Signed-off-by: Matwey V. Kornilov +Signed-off-by: Bjorn Helgaas +Acked-by: Viresh Kumar +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/host/pcie-designware.c | 2 +- + drivers/pci/host/pcie-spear13xx.c | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/pci/host/pcie-designware.c ++++ b/drivers/pci/host/pcie-designware.c +@@ -342,7 +342,7 @@ static const struct irq_domain_ops msi_d + .map = dw_pcie_msi_map, + }; + +-int __init dw_pcie_host_init(struct pcie_port *pp) ++int dw_pcie_host_init(struct pcie_port *pp) + { + struct device_node *np = pp->dev->of_node; + struct platform_device *pdev = to_platform_device(pp->dev); +--- a/drivers/pci/host/pcie-spear13xx.c ++++ b/drivers/pci/host/pcie-spear13xx.c +@@ -269,7 +269,7 @@ static struct pcie_host_ops spear13xx_pc + .host_init = spear13xx_pcie_host_init, + }; + +-static int __init spear13xx_add_pcie_port(struct pcie_port *pp, ++static int spear13xx_add_pcie_port(struct pcie_port *pp, + struct platform_device *pdev) + { + struct device *dev = &pdev->dev; +@@ -299,7 +299,7 @@ static int __init spear13xx_add_pcie_por + return 0; + } + +-static int __init spear13xx_pcie_probe(struct platform_device *pdev) ++static int spear13xx_pcie_probe(struct platform_device *pdev) + { + struct spear13xx_pcie *spear13xx_pcie; + struct pcie_port *pp; +@@ -370,7 +370,7 @@ static const struct of_device_id spear13 + }; + MODULE_DEVICE_TABLE(of, spear13xx_pcie_of_match); + +-static struct platform_driver spear13xx_pcie_driver __initdata = { ++static struct platform_driver spear13xx_pcie_driver = { + .probe = spear13xx_pcie_probe, + .driver = { + .name = "spear-pcie", diff --git a/queue-3.19/revert-sparc-pci-clip-bridge-windows-to-fit-in-upstream-windows.patch b/queue-3.19/revert-sparc-pci-clip-bridge-windows-to-fit-in-upstream-windows.patch new file mode 100644 index 00000000000..c0aa704defa --- /dev/null +++ b/queue-3.19/revert-sparc-pci-clip-bridge-windows-to-fit-in-upstream-windows.patch @@ -0,0 +1,39 @@ +From d10b730f97a7f1fa58c9ec300828f87157cd6b95 Mon Sep 17 00:00:00 2001 +From: Bjorn Helgaas +Date: Wed, 8 Apr 2015 10:04:55 -0500 +Subject: Revert "sparc/PCI: Clip bridge windows to fit in upstream windows" + +From: Bjorn Helgaas + +commit d10b730f97a7f1fa58c9ec300828f87157cd6b95 upstream. + +This reverts commit d63e2e1f3df904bf6bd150bdafb42ddbb3257ea8. + +David Ahern reported that d63e2e1f3df9 breaks booting on an 8-socket T5 +sparc system. He also verified that the system boots with d63e2e1f3df9 +reverted. Yinghai has some fixes, but they need a little more polishing +than we can do before v4.0. + +Link: http://lkml.kernel.org/r/5514391F.2030300@oracle.com # report +Link: http://lkml.kernel.org/r/1427857069-6789-1-git-send-email-yinghai@kernel.org # patches +Signed-off-by: Bjorn Helgaas +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sparc/kernel/pci.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +--- a/arch/sparc/kernel/pci.c ++++ b/arch/sparc/kernel/pci.c +@@ -639,10 +639,7 @@ static void pci_claim_bus_resources(stru + (unsigned long long)r->end, + (unsigned int)r->flags); + +- if (pci_claim_resource(dev, i) == 0) +- continue; +- +- pci_claim_bridge_resource(dev, i); ++ pci_claim_resource(dev, i); + } + } + diff --git a/queue-3.19/selinux-fix-sel_write_enforce-broken-return-value.patch b/queue-3.19/selinux-fix-sel_write_enforce-broken-return-value.patch new file mode 100644 index 00000000000..91db0e6fc22 --- /dev/null +++ b/queue-3.19/selinux-fix-sel_write_enforce-broken-return-value.patch @@ -0,0 +1,32 @@ +From 6436a123a147db51a0b06024a8350f4c230e73ff Mon Sep 17 00:00:00 2001 +From: Joe Perches +Date: Mon, 23 Mar 2015 18:01:35 -0700 +Subject: selinux: fix sel_write_enforce broken return value + +From: Joe Perches + +commit 6436a123a147db51a0b06024a8350f4c230e73ff upstream. + +Return a negative error value like the rest of the entries in this function. + +Signed-off-by: Joe Perches +Acked-by: Stephen Smalley +[PM: tweaked subject line] +Signed-off-by: Paul Moore +Signed-off-by: Greg Kroah-Hartman + +--- + security/selinux/selinuxfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/security/selinux/selinuxfs.c ++++ b/security/selinux/selinuxfs.c +@@ -152,7 +152,7 @@ static ssize_t sel_write_enforce(struct + goto out; + + /* No partial writes. */ +- length = EINVAL; ++ length = -EINVAL; + if (*ppos != 0) + goto out; + diff --git a/queue-3.19/series b/queue-3.19/series index 27b94cd460d..662b5a05c04 100644 --- a/queue-3.19/series +++ b/queue-3.19/series @@ -4,3 +4,27 @@ alsa-usb-creative-usb-x-fi-pro-sb1095-volume-knob-support.patch alsa-bebob-fix-to-processing-in-big-endian-machine-for-sending-cue.patch alsa-hda-realtek-make-more-stable-to-get-pin-sense-for-alc283.patch alsa-hda-fix-headphone-pin-config-for-lifebook-t731.patch +pci-aer-avoid-info-leak-in-__print_tlp_header.patch +pci-cpcihp-add-missing-curly-braces-in-cpci_configure_slot.patch +revert-sparc-pci-clip-bridge-windows-to-fit-in-upstream-windows.patch +pci-don-t-look-for-acpi-hotplug-parameters-if-acpi-is-disabled.patch +pci-spear-drop-__initdata-from-spear13xx_pcie_driver.patch +arc-sa_siginfo-ucontext-regs-off-by-one.patch +arc-signal-handling-robustify.patch +arm-sunxi-have-arch_sunxi-select-reset_controller-for-clock-driver-usage.patch +selinux-fix-sel_write_enforce-broken-return-value.patch +blk-mq-fix-use-of-incorrect-goto-label-in-blk_mq_init_queue-error-path.patch +blkmq-fix-null-pointer-deref-when-all-reserved-tags-in.patch +fix-bug-in-blk_rq_merge_ok.patch +block-fix-blk_stack_limits-regression-due-to-lcm-change.patch +drm-fixup-racy-refcounting-in-plane_force_disable.patch +drm-edid-set-eld-for-firmware-and-debugfs-override-edids.patch +drm-i915-reject-the-colorkey-ioctls-for-primary-and-cursor-planes.patch +drm-radeon-dpm-fix-120hz-handling-harder.patch +drm-radeon-add-extra-check-in-radeon_ttm_tt_unpin_userptr.patch +drm-radeon-fix-wait-in-radeon_mn_invalidate_range_start.patch +drm-i915-chv-remove-wait-for-a-previous-gfx-force-off.patch +drm-i915-vlv-save-restore-the-power-context-base-reg.patch +drm-i915-vlv-remove-wait-for-previous-gfx-clk-disable-request.patch +drm-amdkfd-initialize-only-amdkfd-s-assigned-pipelines.patch +drm-i915-align-initial-plane-backing-objects-correctly.patch