From: Greg Kroah-Hartman Date: Sat, 9 Nov 2013 06:33:51 +0000 (-0800) Subject: 3.11-stable patches X-Git-Tag: v3.4.69~1 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=51ac58831cf186a585e04b89470f979d3aa37abd;p=thirdparty%2Fkernel%2Fstable-queue.git 3.11-stable patches added patches: drm-i915-add-hsw-crt-output-readout-support.patch drm-i915-add-support-for-pipe_bpp-readout.patch drm-i915-fix-the-ppt-fdi-lane-bifurcate-state-handling-on-ivb.patch drm-i915-no-lvds-hardware-on-intel-d410pt-and-d425kt.patch drm-i915-retry-dp-aux_ch-communications-with-a-different-clock-after-failure.patch drm-i915-split-aux_clock_divider-logic-in-a-separated-function-for-reuse.patch drm-pad-drm_mode_get_connector-to-64-bit-boundary.patch drm-prevent-overwriting-from-userspace-underallocating-core-ioctl-structs.patch drm-radeon-atom-workaround-vbios-bug-in-transmitter-table-on-rs780.patch drm-radeon-make-missing-smc-ucode-non-fatal-r7xx-si.patch drm-vmwgfx-don-t-kill-clients-on-vt-switch.patch drm-vmwgfx-don-t-put-resources-with-invalid-id-s-on-lru-list.patch mm-pagewalk.c-fix-walk_page_range-access-of-wrong-ptes.patch mutex-avoid-gcc-version-dependent-__builtin_constant_p-usage.patch ntb-add-error-handling-in-ntb_device_setup.patch ntb-correct-debugfs-to-work-with-more-than-1-ntb-device.patch ntb-correct-number-of-scratch-pad-registers.patch ntb-correct-usd-dsd-identification.patch seq_file-always-update-file-f_pos-in-seq_lseek.patch --- diff --git a/queue-3.11/drm-i915-add-hsw-crt-output-readout-support.patch b/queue-3.11/drm-i915-add-hsw-crt-output-readout-support.patch new file mode 100644 index 00000000000..4470ca4c34f --- /dev/null +++ b/queue-3.11/drm-i915-add-hsw-crt-output-readout-support.patch @@ -0,0 +1,116 @@ +From 7195a50b5c7e00cc3312934fd022c3006b533d12 Mon Sep 17 00:00:00 2001 +From: Ville Syrjälä +Date: Tue, 24 Sep 2013 14:24:05 +0300 +Subject: drm/i915: Add HSW CRT output readout support + +From: Ville Syrjälä + +commit 7195a50b5c7e00cc3312934fd022c3006b533d12 upstream. + +Call intel_ddi_get_config() to get the pipe_bpp settings from +DDI. + +The sync polarity settings from DDI are irrelevant for CRT +output, so override them with data from the ADPA register. + +Note: This is already merged in drm-intel-next-queued as + +commit 6801c18c0a43386bb44712cbc028a7e05adb9f0d +Author: Ville Syrjälä +Date: Tue Sep 24 14:24:05 2013 +0300 + + drm/i915: Add HSW CRT output readout support + +but is required for the following edp bpp bugfix. + +v2: Extract intel_crt_get_flags() + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=69691 +Tested-by: Qingshuai Tian +Signed-off-by: Ville Syrjälä +Signed-off-by: Daniel Vetter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_crt.c | 30 ++++++++++++++++++++++++++---- + drivers/gpu/drm/i915/intel_ddi.c | 4 ++-- + drivers/gpu/drm/i915/intel_drv.h | 2 ++ + 3 files changed, 30 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_crt.c ++++ b/drivers/gpu/drm/i915/intel_crt.c +@@ -84,8 +84,7 @@ static bool intel_crt_get_hw_state(struc + return true; + } + +-static void intel_crt_get_config(struct intel_encoder *encoder, +- struct intel_crtc_config *pipe_config) ++static unsigned int intel_crt_get_flags(struct intel_encoder *encoder) + { + struct drm_i915_private *dev_priv = encoder->base.dev->dev_private; + struct intel_crt *crt = intel_encoder_to_crt(encoder); +@@ -103,7 +102,27 @@ static void intel_crt_get_config(struct + else + flags |= DRM_MODE_FLAG_NVSYNC; + +- pipe_config->adjusted_mode.flags |= flags; ++ return flags; ++} ++ ++static void intel_crt_get_config(struct intel_encoder *encoder, ++ struct intel_crtc_config *pipe_config) ++{ ++ struct drm_device *dev = encoder->base.dev; ++ ++ pipe_config->adjusted_mode.flags |= intel_crt_get_flags(encoder); ++} ++ ++static void hsw_crt_get_config(struct intel_encoder *encoder, ++ struct intel_crtc_config *pipe_config) ++{ ++ intel_ddi_get_config(encoder, pipe_config); ++ ++ pipe_config->adjusted_mode.flags &= ~(DRM_MODE_FLAG_PHSYNC | ++ DRM_MODE_FLAG_NHSYNC | ++ DRM_MODE_FLAG_PVSYNC | ++ DRM_MODE_FLAG_NVSYNC); ++ pipe_config->adjusted_mode.flags |= intel_crt_get_flags(encoder); + } + + /* Note: The caller is required to filter out dpms modes not supported by the +@@ -802,7 +821,10 @@ void intel_crt_init(struct drm_device *d + crt->base.compute_config = intel_crt_compute_config; + crt->base.disable = intel_disable_crt; + crt->base.enable = intel_enable_crt; +- crt->base.get_config = intel_crt_get_config; ++ if (IS_HASWELL(dev)) ++ crt->base.get_config = hsw_crt_get_config; ++ else ++ crt->base.get_config = intel_crt_get_config; + if (I915_HAS_HOTPLUG(dev)) + crt->base.hpd_pin = HPD_CRT; + if (HAS_DDI(dev)) +--- a/drivers/gpu/drm/i915/intel_ddi.c ++++ b/drivers/gpu/drm/i915/intel_ddi.c +@@ -1261,8 +1261,8 @@ static void intel_ddi_hot_plug(struct in + intel_dp_check_link_status(intel_dp); + } + +-static void intel_ddi_get_config(struct intel_encoder *encoder, +- struct intel_crtc_config *pipe_config) ++void intel_ddi_get_config(struct intel_encoder *encoder, ++ struct intel_crtc_config *pipe_config) + { + struct drm_i915_private *dev_priv = encoder->base.dev->dev_private; + struct intel_crtc *intel_crtc = to_intel_crtc(encoder->base.crtc); +--- a/drivers/gpu/drm/i915/intel_drv.h ++++ b/drivers/gpu/drm/i915/intel_drv.h +@@ -816,6 +816,8 @@ extern void intel_ddi_prepare_link_retra + extern bool + intel_ddi_connector_get_hw_state(struct intel_connector *intel_connector); + extern void intel_ddi_fdi_disable(struct drm_crtc *crtc); ++extern void intel_ddi_get_config(struct intel_encoder *encoder, ++ struct intel_crtc_config *pipe_config); + + extern void intel_display_handle_reset(struct drm_device *dev); + extern bool intel_set_cpu_fifo_underrun_reporting(struct drm_device *dev, diff --git a/queue-3.11/drm-i915-add-support-for-pipe_bpp-readout.patch b/queue-3.11/drm-i915-add-support-for-pipe_bpp-readout.patch new file mode 100644 index 00000000000..ee01c869108 --- /dev/null +++ b/queue-3.11/drm-i915-add-support-for-pipe_bpp-readout.patch @@ -0,0 +1,121 @@ +From 4f56d12ebb28fceac4c6e60c8993fbfc122e1399 Mon Sep 17 00:00:00 2001 +From: Ville Syrjälä +Date: Mon, 21 Oct 2013 10:52:06 +0300 +Subject: drm/i915: Add support for pipe_bpp readout + +From: Ville Syrjälä + +commit 4f56d12ebb28fceac4c6e60c8993fbfc122e1399 upstream. + +On CTG+ read out the pipe bpp setting from hardware and fill it into +pipe config. Also check it appropriately. + +v2: Don't do the pipe_bpp extraction inside the PCH only code block on + ILK+. + Avoid the PIPECONF read as we already have read it for the + PIPECONF_EANBLE check. + +Note: This is already in drm-intel-next-queued as +commit 42571aefafb1d330ef84eb29418832f72e7dfb4c +Author: Ville Syrjälä +Date: Fri Sep 6 23:29:00 2013 +0300 + + drm/i915: Add support for pipe_bpp readout + +but is needed for the following bugfix. + +Signed-off-by: Ville Syrjälä +Reviewed-by: Jani Nikula +Signed-off-by: Daniel Vetter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_ddi.c | 17 ++++++++++++++++ + drivers/gpu/drm/i915/intel_display.c | 36 +++++++++++++++++++++++++++++++++++ + 2 files changed, 53 insertions(+) + +--- a/drivers/gpu/drm/i915/intel_ddi.c ++++ b/drivers/gpu/drm/i915/intel_ddi.c +@@ -1280,6 +1280,23 @@ void intel_ddi_get_config(struct intel_e + flags |= DRM_MODE_FLAG_NVSYNC; + + pipe_config->adjusted_mode.flags |= flags; ++ ++ switch (temp & TRANS_DDI_BPC_MASK) { ++ case TRANS_DDI_BPC_6: ++ pipe_config->pipe_bpp = 18; ++ break; ++ case TRANS_DDI_BPC_8: ++ pipe_config->pipe_bpp = 24; ++ break; ++ case TRANS_DDI_BPC_10: ++ pipe_config->pipe_bpp = 30; ++ break; ++ case TRANS_DDI_BPC_12: ++ pipe_config->pipe_bpp = 36; ++ break; ++ default: ++ break; ++ } + } + + static void intel_ddi_destroy(struct drm_encoder *encoder) +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -4943,6 +4943,22 @@ static bool i9xx_get_pipe_config(struct + if (!(tmp & PIPECONF_ENABLE)) + return false; + ++ if (IS_G4X(dev) || IS_VALLEYVIEW(dev)) { ++ switch (tmp & PIPECONF_BPC_MASK) { ++ case PIPECONF_6BPC: ++ pipe_config->pipe_bpp = 18; ++ break; ++ case PIPECONF_8BPC: ++ pipe_config->pipe_bpp = 24; ++ break; ++ case PIPECONF_10BPC: ++ pipe_config->pipe_bpp = 30; ++ break; ++ default: ++ break; ++ } ++ } ++ + intel_get_pipe_timings(crtc, pipe_config); + + i9xx_get_pfit_config(crtc, pipe_config); +@@ -5821,6 +5837,23 @@ static bool ironlake_get_pipe_config(str + if (!(tmp & PIPECONF_ENABLE)) + return false; + ++ switch (tmp & PIPECONF_BPC_MASK) { ++ case PIPECONF_6BPC: ++ pipe_config->pipe_bpp = 18; ++ break; ++ case PIPECONF_8BPC: ++ pipe_config->pipe_bpp = 24; ++ break; ++ case PIPECONF_10BPC: ++ pipe_config->pipe_bpp = 30; ++ break; ++ case PIPECONF_12BPC: ++ pipe_config->pipe_bpp = 36; ++ break; ++ default: ++ break; ++ } ++ + if (I915_READ(PCH_TRANSCONF(crtc->pipe)) & TRANS_ENABLE) { + struct intel_shared_dpll *pll; + +@@ -8147,6 +8180,9 @@ intel_pipe_config_compare(struct drm_dev + PIPE_CONF_CHECK_X(dpll_hw_state.fp0); + PIPE_CONF_CHECK_X(dpll_hw_state.fp1); + ++ if (IS_G4X(dev) || INTEL_INFO(dev)->gen >= 5) ++ PIPE_CONF_CHECK_I(pipe_bpp); ++ + #undef PIPE_CONF_CHECK_X + #undef PIPE_CONF_CHECK_I + #undef PIPE_CONF_CHECK_FLAGS diff --git a/queue-3.11/drm-i915-fix-the-ppt-fdi-lane-bifurcate-state-handling-on-ivb.patch b/queue-3.11/drm-i915-fix-the-ppt-fdi-lane-bifurcate-state-handling-on-ivb.patch new file mode 100644 index 00000000000..e11fae9decf --- /dev/null +++ b/queue-3.11/drm-i915-fix-the-ppt-fdi-lane-bifurcate-state-handling-on-ivb.patch @@ -0,0 +1,179 @@ +From 1fbc0d789d12fec313c91912fc11733fdfbab863 Mon Sep 17 00:00:00 2001 +From: Daniel Vetter +Date: Tue, 29 Oct 2013 12:04:08 +0100 +Subject: drm/i915: Fix the PPT fdi lane bifurcate state handling on ivb + +From: Daniel Vetter + +commit 1fbc0d789d12fec313c91912fc11733fdfbab863 upstream. + +Originally I've thought that this is leftover hw state dirt from the +BIOS. But after way too much helpless flailing around on my part I've +noticed that the actual bug is when we change the state of an already +active pipe. + +For example when we change the fdi lines from 2 to 3 without switching +off outputs in-between we'll never see the crucial on->off transition +in the ->modeset_global_resources hook the current logic relies on. + +Patch version 2 got this right by instead also checking whether the +pipe is indeed active. But that in turn broke things when pipes have +been turned off through dpms since the bifurcate enabling is done in +the ->crtc_mode_set callback. + +To address this issues discussed with Ville in the patch review move +the setting of the bifurcate bit into the ->crtc_enable hook. That way +we won't wreak havoc with this state when userspace puts all other +outputs into dpms off state. This also moves us forward with our +overall goal to unify the modeset and dpms on paths (which we need to +have to allow runtime pm in the dpms off state). + +Unfortunately this requires us to move the bifurcate helpers around a +bit. + +Also update the commit message, I've misanalyzed the bug rather badly. + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=70507 +Tested-by: Jan-Michael Brummer +Cc: Ville Syrjälä +Reviewed-by: Ville Syrjälä +Signed-off-by: Daniel Vetter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_display.c | 95 +++++++++++++++++------------------ + 1 file changed, 48 insertions(+), 47 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -2251,9 +2251,10 @@ static void intel_fdi_normal_train(struc + FDI_FE_ERRC_ENABLE); + } + +-static bool pipe_has_enabled_pch(struct intel_crtc *intel_crtc) ++static bool pipe_has_enabled_pch(struct intel_crtc *crtc) + { +- return intel_crtc->base.enabled && intel_crtc->config.has_pch_encoder; ++ return crtc->base.enabled && crtc->active && ++ crtc->config.has_pch_encoder; + } + + static void ivb_modeset_global_resources(struct drm_device *dev) +@@ -2901,6 +2902,48 @@ static void ironlake_pch_transcoder_set_ + I915_READ(VSYNCSHIFT(cpu_transcoder))); + } + ++static void cpt_enable_fdi_bc_bifurcation(struct drm_device *dev) ++{ ++ struct drm_i915_private *dev_priv = dev->dev_private; ++ uint32_t temp; ++ ++ temp = I915_READ(SOUTH_CHICKEN1); ++ if (temp & FDI_BC_BIFURCATION_SELECT) ++ return; ++ ++ WARN_ON(I915_READ(FDI_RX_CTL(PIPE_B)) & FDI_RX_ENABLE); ++ WARN_ON(I915_READ(FDI_RX_CTL(PIPE_C)) & FDI_RX_ENABLE); ++ ++ temp |= FDI_BC_BIFURCATION_SELECT; ++ DRM_DEBUG_KMS("enabling fdi C rx\n"); ++ I915_WRITE(SOUTH_CHICKEN1, temp); ++ POSTING_READ(SOUTH_CHICKEN1); ++} ++ ++static void ivybridge_update_fdi_bc_bifurcation(struct intel_crtc *intel_crtc) ++{ ++ struct drm_device *dev = intel_crtc->base.dev; ++ struct drm_i915_private *dev_priv = dev->dev_private; ++ ++ switch (intel_crtc->pipe) { ++ case PIPE_A: ++ break; ++ case PIPE_B: ++ if (intel_crtc->config.fdi_lanes > 2) ++ WARN_ON(I915_READ(SOUTH_CHICKEN1) & FDI_BC_BIFURCATION_SELECT); ++ else ++ cpt_enable_fdi_bc_bifurcation(dev); ++ ++ break; ++ case PIPE_C: ++ cpt_enable_fdi_bc_bifurcation(dev); ++ ++ break; ++ default: ++ BUG(); ++ } ++} ++ + /* + * Enable PCH resources required for PCH ports: + * - PCH PLLs +@@ -2919,6 +2962,9 @@ static void ironlake_pch_enable(struct d + + assert_pch_transcoder_disabled(dev_priv, pipe); + ++ if (IS_IVYBRIDGE(dev)) ++ ivybridge_update_fdi_bc_bifurcation(intel_crtc); ++ + /* Write the TU size bits before fdi link training, so that error + * detection works. */ + I915_WRITE(FDI_RX_TUSIZE1(pipe), +@@ -5512,48 +5558,6 @@ static bool ironlake_compute_clocks(stru + return true; + } + +-static void cpt_enable_fdi_bc_bifurcation(struct drm_device *dev) +-{ +- struct drm_i915_private *dev_priv = dev->dev_private; +- uint32_t temp; +- +- temp = I915_READ(SOUTH_CHICKEN1); +- if (temp & FDI_BC_BIFURCATION_SELECT) +- return; +- +- WARN_ON(I915_READ(FDI_RX_CTL(PIPE_B)) & FDI_RX_ENABLE); +- WARN_ON(I915_READ(FDI_RX_CTL(PIPE_C)) & FDI_RX_ENABLE); +- +- temp |= FDI_BC_BIFURCATION_SELECT; +- DRM_DEBUG_KMS("enabling fdi C rx\n"); +- I915_WRITE(SOUTH_CHICKEN1, temp); +- POSTING_READ(SOUTH_CHICKEN1); +-} +- +-static void ivybridge_update_fdi_bc_bifurcation(struct intel_crtc *intel_crtc) +-{ +- struct drm_device *dev = intel_crtc->base.dev; +- struct drm_i915_private *dev_priv = dev->dev_private; +- +- switch (intel_crtc->pipe) { +- case PIPE_A: +- break; +- case PIPE_B: +- if (intel_crtc->config.fdi_lanes > 2) +- WARN_ON(I915_READ(SOUTH_CHICKEN1) & FDI_BC_BIFURCATION_SELECT); +- else +- cpt_enable_fdi_bc_bifurcation(dev); +- +- break; +- case PIPE_C: +- cpt_enable_fdi_bc_bifurcation(dev); +- +- break; +- default: +- BUG(); +- } +-} +- + int ironlake_get_lanes_required(int target_clock, int link_bw, int bpp) + { + /* +@@ -5768,9 +5772,6 @@ static int ironlake_crtc_mode_set(struct + &intel_crtc->config.fdi_m_n); + } + +- if (IS_IVYBRIDGE(dev)) +- ivybridge_update_fdi_bc_bifurcation(intel_crtc); +- + ironlake_set_pipeconf(crtc); + + /* Set up the display plane register */ diff --git a/queue-3.11/drm-i915-no-lvds-hardware-on-intel-d410pt-and-d425kt.patch b/queue-3.11/drm-i915-no-lvds-hardware-on-intel-d410pt-and-d425kt.patch new file mode 100644 index 00000000000..b6e40abd0ca --- /dev/null +++ b/queue-3.11/drm-i915-no-lvds-hardware-on-intel-d410pt-and-d425kt.patch @@ -0,0 +1,51 @@ +From 645378d85ee524e429aa4cf52806047b56cdc596 Mon Sep 17 00:00:00 2001 +From: Rob Pearce +Date: Sun, 27 Oct 2013 16:13:42 +0000 +Subject: drm/i915: No LVDS hardware on Intel D410PT and D425KT + +From: Rob Pearce + +commit 645378d85ee524e429aa4cf52806047b56cdc596 upstream. + +The Intel D410PT(LW) and D425KT Mini-ITX desktop boards both show up as +having LVDS but the hardware is not populated. This patch adds them to +the list of such systems. Patch is against 3.11.4 + +v2: Patch revised to match the D425KT exactly as the D425KTW does have +LVDS. According to Intel's documentation, the D410PTL and D410PLTW +don't. + +Signed-off-by: Rob Pearce +[danvet: Pimp commit message to my liking and add cc: stable.] +Signed-off-by: Daniel Vetter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_lvds.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- a/drivers/gpu/drm/i915/intel_lvds.c ++++ b/drivers/gpu/drm/i915/intel_lvds.c +@@ -696,6 +696,22 @@ static const struct dmi_system_id intel_ + }, + { + .callback = intel_no_lvds_dmi_callback, ++ .ident = "Intel D410PT", ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "Intel"), ++ DMI_MATCH(DMI_BOARD_NAME, "D410PT"), ++ }, ++ }, ++ { ++ .callback = intel_no_lvds_dmi_callback, ++ .ident = "Intel D425KT", ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "Intel"), ++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "D425KT"), ++ }, ++ }, ++ { ++ .callback = intel_no_lvds_dmi_callback, + .ident = "Intel D510MO", + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "Intel"), diff --git a/queue-3.11/drm-i915-retry-dp-aux_ch-communications-with-a-different-clock-after-failure.patch b/queue-3.11/drm-i915-retry-dp-aux_ch-communications-with-a-different-clock-after-failure.patch new file mode 100644 index 00000000000..d06b85b96bc --- /dev/null +++ b/queue-3.11/drm-i915-retry-dp-aux_ch-communications-with-a-different-clock-after-failure.patch @@ -0,0 +1,158 @@ +From bc86625a4ff7574d4d4dba79723457711eb784e0 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Sun, 21 Jul 2013 16:00:03 +0100 +Subject: drm/i915: Retry DP aux_ch communications with a different clock after failure + +From: Chris Wilson + +commit bc86625a4ff7574d4d4dba79723457711eb784e0 upstream. + +The w/a db makes the recommendation to both use a non-default value for +the initial clock and then to retry with an alternative clock for +Haswell with the Lakeport PCH. + +"On LPT:H, use a divider value of 63 decimal (03Fh). If there is a +failure, retry at least three times with 63, then retry at least three +times with 72 decimal (048h)." + +Signed-off-by: Chris Wilson +Reviewed-by: Jani Nikula +Signed-off-by: Daniel Vetter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_dp.c | 90 ++++++++++++++++++++++------------------ + 1 file changed, 50 insertions(+), 40 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_dp.c ++++ b/drivers/gpu/drm/i915/intel_dp.c +@@ -276,7 +276,8 @@ intel_dp_aux_wait_done(struct intel_dp * + return status; + } + +-static uint32_t get_aux_clock_divider(struct intel_dp *intel_dp) ++static uint32_t get_aux_clock_divider(struct intel_dp *intel_dp, ++ int index) + { + struct intel_digital_port *intel_dig_port = dp_to_dig_port(intel_dp); + struct drm_device *dev = intel_dig_port->base.base.dev; +@@ -290,22 +291,27 @@ static uint32_t get_aux_clock_divider(st + * clock divider. + */ + if (IS_VALLEYVIEW(dev)) { +- return 100; ++ return index ? 0 : 100; + } else if (intel_dig_port->port == PORT_A) { ++ if (index) ++ return 0; + if (HAS_DDI(dev)) +- return DIV_ROUND_CLOSEST( +- intel_ddi_get_cdclk_freq(dev_priv), 2000); ++ return DIV_ROUND_CLOSEST(intel_ddi_get_cdclk_freq(dev_priv), 2000); + else if (IS_GEN6(dev) || IS_GEN7(dev)) + return 200; /* SNB & IVB eDP input clock at 400Mhz */ + else + return 225; /* eDP input clock at 450Mhz */ + } else if (dev_priv->pch_id == INTEL_PCH_LPT_DEVICE_ID_TYPE) { + /* Workaround for non-ULT HSW */ +- return 74; ++ switch (index) { ++ case 0: return 63; ++ case 1: return 72; ++ default: return 0; ++ } + } else if (HAS_PCH_SPLIT(dev)) { +- return DIV_ROUND_UP(intel_pch_rawclk(dev), 2); ++ return index ? 0 : DIV_ROUND_UP(intel_pch_rawclk(dev), 2); + } else { +- return intel_hrawclk(dev) / 2; ++ return index ? 0 :intel_hrawclk(dev) / 2; + } + } + +@@ -319,10 +325,10 @@ intel_dp_aux_ch(struct intel_dp *intel_d + struct drm_i915_private *dev_priv = dev->dev_private; + uint32_t ch_ctl = intel_dp->aux_ch_ctl_reg; + uint32_t ch_data = ch_ctl + 4; ++ uint32_t aux_clock_divider; + int i, ret, recv_bytes; + uint32_t status; +- uint32_t aux_clock_divider = get_aux_clock_divider(intel_dp); +- int try, precharge; ++ int try, precharge, clock = 0; + bool has_aux_irq = INTEL_INFO(dev)->gen >= 5 && !IS_VALLEYVIEW(dev); + + /* dp aux is extremely sensitive to irq latency, hence request the +@@ -353,37 +359,41 @@ intel_dp_aux_ch(struct intel_dp *intel_d + goto out; + } + +- /* Must try at least 3 times according to DP spec */ +- for (try = 0; try < 5; try++) { +- /* Load the send data into the aux channel data registers */ +- for (i = 0; i < send_bytes; i += 4) +- I915_WRITE(ch_data + i, +- pack_aux(send + i, send_bytes - i)); +- +- /* Send the command and wait for it to complete */ +- I915_WRITE(ch_ctl, +- DP_AUX_CH_CTL_SEND_BUSY | +- (has_aux_irq ? DP_AUX_CH_CTL_INTERRUPT : 0) | +- DP_AUX_CH_CTL_TIME_OUT_400us | +- (send_bytes << DP_AUX_CH_CTL_MESSAGE_SIZE_SHIFT) | +- (precharge << DP_AUX_CH_CTL_PRECHARGE_2US_SHIFT) | +- (aux_clock_divider << DP_AUX_CH_CTL_BIT_CLOCK_2X_SHIFT) | +- DP_AUX_CH_CTL_DONE | +- DP_AUX_CH_CTL_TIME_OUT_ERROR | +- DP_AUX_CH_CTL_RECEIVE_ERROR); +- +- status = intel_dp_aux_wait_done(intel_dp, has_aux_irq); +- +- /* Clear done status and any errors */ +- I915_WRITE(ch_ctl, +- status | +- DP_AUX_CH_CTL_DONE | +- DP_AUX_CH_CTL_TIME_OUT_ERROR | +- DP_AUX_CH_CTL_RECEIVE_ERROR); +- +- if (status & (DP_AUX_CH_CTL_TIME_OUT_ERROR | +- DP_AUX_CH_CTL_RECEIVE_ERROR)) +- continue; ++ while ((aux_clock_divider = get_aux_clock_divider(intel_dp, clock++))) { ++ /* Must try at least 3 times according to DP spec */ ++ for (try = 0; try < 5; try++) { ++ /* Load the send data into the aux channel data registers */ ++ for (i = 0; i < send_bytes; i += 4) ++ I915_WRITE(ch_data + i, ++ pack_aux(send + i, send_bytes - i)); ++ ++ /* Send the command and wait for it to complete */ ++ I915_WRITE(ch_ctl, ++ DP_AUX_CH_CTL_SEND_BUSY | ++ (has_aux_irq ? DP_AUX_CH_CTL_INTERRUPT : 0) | ++ DP_AUX_CH_CTL_TIME_OUT_400us | ++ (send_bytes << DP_AUX_CH_CTL_MESSAGE_SIZE_SHIFT) | ++ (precharge << DP_AUX_CH_CTL_PRECHARGE_2US_SHIFT) | ++ (aux_clock_divider << DP_AUX_CH_CTL_BIT_CLOCK_2X_SHIFT) | ++ DP_AUX_CH_CTL_DONE | ++ DP_AUX_CH_CTL_TIME_OUT_ERROR | ++ DP_AUX_CH_CTL_RECEIVE_ERROR); ++ ++ status = intel_dp_aux_wait_done(intel_dp, has_aux_irq); ++ ++ /* Clear done status and any errors */ ++ I915_WRITE(ch_ctl, ++ status | ++ DP_AUX_CH_CTL_DONE | ++ DP_AUX_CH_CTL_TIME_OUT_ERROR | ++ DP_AUX_CH_CTL_RECEIVE_ERROR); ++ ++ if (status & (DP_AUX_CH_CTL_TIME_OUT_ERROR | ++ DP_AUX_CH_CTL_RECEIVE_ERROR)) ++ continue; ++ if (status & DP_AUX_CH_CTL_DONE) ++ break; ++ } + if (status & DP_AUX_CH_CTL_DONE) + break; + } diff --git a/queue-3.11/drm-i915-split-aux_clock_divider-logic-in-a-separated-function-for-reuse.patch b/queue-3.11/drm-i915-split-aux_clock_divider-logic-in-a-separated-function-for-reuse.patch new file mode 100644 index 00000000000..ab45036391e --- /dev/null +++ b/queue-3.11/drm-i915-split-aux_clock_divider-logic-in-a-separated-function-for-reuse.patch @@ -0,0 +1,110 @@ +From b84a1cf8950ed075c4ab2630514d4caaae504176 Mon Sep 17 00:00:00 2001 +From: Rodrigo Vivi +Date: Thu, 11 Jul 2013 18:44:57 -0300 +Subject: drm/i915: split aux_clock_divider logic in a separated function for reuse. + +From: Rodrigo Vivi + +commit b84a1cf8950ed075c4ab2630514d4caaae504176 upstream. + +Prep patch for reuse aux_clock_divider with EDP_PSR_AUX_CTL setup. + +Reviewed-by: Paulo Zanoni +Signed-off-by: Rodrigo Vivi +Reviewed-by: Shobhit Kumar +Signed-off-by: Daniel Vetter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_dp.c | 58 ++++++++++++++++++++++------------------ + 1 file changed, 33 insertions(+), 25 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_dp.c ++++ b/drivers/gpu/drm/i915/intel_dp.c +@@ -276,29 +276,12 @@ intel_dp_aux_wait_done(struct intel_dp * + return status; + } + +-static int +-intel_dp_aux_ch(struct intel_dp *intel_dp, +- uint8_t *send, int send_bytes, +- uint8_t *recv, int recv_size) ++static uint32_t get_aux_clock_divider(struct intel_dp *intel_dp) + { + struct intel_digital_port *intel_dig_port = dp_to_dig_port(intel_dp); + struct drm_device *dev = intel_dig_port->base.base.dev; + struct drm_i915_private *dev_priv = dev->dev_private; +- uint32_t ch_ctl = intel_dp->aux_ch_ctl_reg; +- uint32_t ch_data = ch_ctl + 4; +- int i, ret, recv_bytes; +- uint32_t status; +- uint32_t aux_clock_divider; +- int try, precharge; +- bool has_aux_irq = INTEL_INFO(dev)->gen >= 5 && !IS_VALLEYVIEW(dev); + +- /* dp aux is extremely sensitive to irq latency, hence request the +- * lowest possible wakeup latency and so prevent the cpu from going into +- * deep sleep states. +- */ +- pm_qos_update_request(&dev_priv->pm_qos, 0); +- +- intel_dp_check_edp(intel_dp); + /* The clock divider is based off the hrawclk, + * and would like to run at 2MHz. So, take the + * hrawclk value and divide by 2 and use that +@@ -307,23 +290,48 @@ intel_dp_aux_ch(struct intel_dp *intel_d + * clock divider. + */ + if (IS_VALLEYVIEW(dev)) { +- aux_clock_divider = 100; ++ return 100; + } else if (intel_dig_port->port == PORT_A) { + if (HAS_DDI(dev)) +- aux_clock_divider = DIV_ROUND_CLOSEST( ++ return DIV_ROUND_CLOSEST( + intel_ddi_get_cdclk_freq(dev_priv), 2000); + else if (IS_GEN6(dev) || IS_GEN7(dev)) +- aux_clock_divider = 200; /* SNB & IVB eDP input clock at 400Mhz */ ++ return 200; /* SNB & IVB eDP input clock at 400Mhz */ + else +- aux_clock_divider = 225; /* eDP input clock at 450Mhz */ ++ return 225; /* eDP input clock at 450Mhz */ + } else if (dev_priv->pch_id == INTEL_PCH_LPT_DEVICE_ID_TYPE) { + /* Workaround for non-ULT HSW */ +- aux_clock_divider = 74; ++ return 74; + } else if (HAS_PCH_SPLIT(dev)) { +- aux_clock_divider = DIV_ROUND_UP(intel_pch_rawclk(dev), 2); ++ return DIV_ROUND_UP(intel_pch_rawclk(dev), 2); + } else { +- aux_clock_divider = intel_hrawclk(dev) / 2; ++ return intel_hrawclk(dev) / 2; + } ++} ++ ++static int ++intel_dp_aux_ch(struct intel_dp *intel_dp, ++ uint8_t *send, int send_bytes, ++ uint8_t *recv, int recv_size) ++{ ++ struct intel_digital_port *intel_dig_port = dp_to_dig_port(intel_dp); ++ struct drm_device *dev = intel_dig_port->base.base.dev; ++ struct drm_i915_private *dev_priv = dev->dev_private; ++ uint32_t ch_ctl = intel_dp->aux_ch_ctl_reg; ++ uint32_t ch_data = ch_ctl + 4; ++ int i, ret, recv_bytes; ++ uint32_t status; ++ uint32_t aux_clock_divider = get_aux_clock_divider(intel_dp); ++ int try, precharge; ++ bool has_aux_irq = INTEL_INFO(dev)->gen >= 5 && !IS_VALLEYVIEW(dev); ++ ++ /* dp aux is extremely sensitive to irq latency, hence request the ++ * lowest possible wakeup latency and so prevent the cpu from going into ++ * deep sleep states. ++ */ ++ pm_qos_update_request(&dev_priv->pm_qos, 0); ++ ++ intel_dp_check_edp(intel_dp); + + if (IS_GEN6(dev)) + precharge = 3; diff --git a/queue-3.11/drm-pad-drm_mode_get_connector-to-64-bit-boundary.patch b/queue-3.11/drm-pad-drm_mode_get_connector-to-64-bit-boundary.patch new file mode 100644 index 00000000000..2d80b0f7285 --- /dev/null +++ b/queue-3.11/drm-pad-drm_mode_get_connector-to-64-bit-boundary.patch @@ -0,0 +1,52 @@ +From bc5bd37ce48c66e9192ad2e7231e9678880f6f8e Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Wed, 16 Oct 2013 09:49:02 +0100 +Subject: drm: Pad drm_mode_get_connector to 64-bit boundary + +From: Chris Wilson + +commit bc5bd37ce48c66e9192ad2e7231e9678880f6f8e upstream. + +Pavel Roskin reported that DRM_IOCTL_MODE_GETCONNECTOR was overwritting +the 4 bytes beyond the end of its structure with a 32-bit userspace +running on a 64-bit kernel. This is due to the padding gcc inserts as +the drm_mode_get_connector struct includes a u64 and its size is not a +natural multiple of u64s. + +64-bit kernel: + +sizeof(drm_mode_get_connector)=80, alignof=8 +sizeof(drm_mode_get_encoder)=20, alignof=4 +sizeof(drm_mode_modeinfo)=68, alignof=4 + +32-bit userspace: + +sizeof(drm_mode_get_connector)=76, alignof=4 +sizeof(drm_mode_get_encoder)=20, alignof=4 +sizeof(drm_mode_modeinfo)=68, alignof=4 + +Fortuituously we can insert explicit padding to the tail of our +structures without breaking ABI. + +Reported-by: Pavel Roskin +Signed-off-by: Chris Wilson +Cc: Dave Airlie +Cc: dri-devel@lists.freedesktop.org +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + include/uapi/drm/drm_mode.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/include/uapi/drm/drm_mode.h ++++ b/include/uapi/drm/drm_mode.h +@@ -223,6 +223,8 @@ struct drm_mode_get_connector { + __u32 connection; + __u32 mm_width, mm_height; /**< HxW in millimeters */ + __u32 subpixel; ++ ++ __u32 pad; + }; + + #define DRM_MODE_PROP_PENDING (1<<0) diff --git a/queue-3.11/drm-prevent-overwriting-from-userspace-underallocating-core-ioctl-structs.patch b/queue-3.11/drm-prevent-overwriting-from-userspace-underallocating-core-ioctl-structs.patch new file mode 100644 index 00000000000..80027b5135e --- /dev/null +++ b/queue-3.11/drm-prevent-overwriting-from-userspace-underallocating-core-ioctl-structs.patch @@ -0,0 +1,52 @@ +From b062672e305ce071f21eb9e18b102c2a430e0999 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Wed, 16 Oct 2013 11:22:44 +0100 +Subject: drm: Prevent overwriting from userspace underallocating core ioctl structs + +From: Chris Wilson + +commit b062672e305ce071f21eb9e18b102c2a430e0999 upstream. + +Apply the protections from + +commit 1b2f1489633888d4a06028315dc19d65768a1c05 +Author: Dave Airlie +Date: Sat Aug 14 20:20:34 2010 +1000 + + drm: block userspace under allocating buffer and having drivers overwrite it (v2) + +to the core ioctl structs as well, for we found one instance where there +is a 32-/64-bit size mismatch and were guilty of writing beyond the end +of the user's buffer. + +Signed-off-by: Chris Wilson +Cc: Dave Airlie +Reviewed-by: Ville Syrjälä +Cc: dri-devel@lists.freedesktop.org +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_drv.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_drv.c ++++ b/drivers/gpu/drm/drm_drv.c +@@ -407,9 +407,16 @@ long drm_ioctl(struct file *filp, + cmd = ioctl->cmd_drv; + } + else if ((nr >= DRM_COMMAND_END) || (nr < DRM_COMMAND_BASE)) { ++ u32 drv_size; ++ + ioctl = &drm_ioctls[nr]; +- cmd = ioctl->cmd; ++ ++ drv_size = _IOC_SIZE(ioctl->cmd); + usize = asize = _IOC_SIZE(cmd); ++ if (drv_size > asize) ++ asize = drv_size; ++ ++ cmd = ioctl->cmd; + } else + goto err_i1; + diff --git a/queue-3.11/drm-radeon-atom-workaround-vbios-bug-in-transmitter-table-on-rs780.patch b/queue-3.11/drm-radeon-atom-workaround-vbios-bug-in-transmitter-table-on-rs780.patch new file mode 100644 index 00000000000..2bd447972d0 --- /dev/null +++ b/queue-3.11/drm-radeon-atom-workaround-vbios-bug-in-transmitter-table-on-rs780.patch @@ -0,0 +1,35 @@ +From c23632d4e57c0dd20bf50eca08fa0eb8ad3ff680 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Thu, 10 Oct 2013 16:45:27 -0400 +Subject: drm/radeon/atom: workaround vbios bug in transmitter table on rs780 + +From: Alex Deucher + +commit c23632d4e57c0dd20bf50eca08fa0eb8ad3ff680 upstream. + +Some rs780 asics seem to be affected as well. + +See: +http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=91f3a6aaf280294b07c05dfe606e6c27b7ba3c72 + +Fixes: +https://bugzilla.kernel.org/show_bug.cgi?id=60791 + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/atombios_encoders.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/atombios_encoders.c ++++ b/drivers/gpu/drm/radeon/atombios_encoders.c +@@ -1657,7 +1657,7 @@ radeon_atom_encoder_dpms_dig(struct drm_ + * does the same thing and more. + */ + if ((rdev->family != CHIP_RV710) && (rdev->family != CHIP_RV730) && +- (rdev->family != CHIP_RS880)) ++ (rdev->family != CHIP_RS780) && (rdev->family != CHIP_RS880)) + atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0); + } + if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && connector) { diff --git a/queue-3.11/drm-radeon-make-missing-smc-ucode-non-fatal-r7xx-si.patch b/queue-3.11/drm-radeon-make-missing-smc-ucode-non-fatal-r7xx-si.patch new file mode 100644 index 00000000000..93b65a7481d --- /dev/null +++ b/queue-3.11/drm-radeon-make-missing-smc-ucode-non-fatal-r7xx-si.patch @@ -0,0 +1,54 @@ +From d83671126dc8e7c0b56c9970ea5ffd08c3b0c645 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 16 Oct 2013 11:36:30 -0400 +Subject: drm/radeon: make missing smc ucode non-fatal (r7xx-SI) + +From: Alex Deucher + +commit d83671126dc8e7c0b56c9970ea5ffd08c3b0c645 upstream. + +Prevent driver load problems if the smc is missing. + +bug: +https://bugzilla.kernel.org/show_bug.cgi?id=63011 + +Signed-off-by: Alex Deucher +Tested-by: Mikko Rapeli +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/ni.c | 1 + + drivers/gpu/drm/radeon/r600.c | 1 + + drivers/gpu/drm/radeon/si.c | 1 + + 3 files changed, 3 insertions(+) + +--- a/drivers/gpu/drm/radeon/ni.c ++++ b/drivers/gpu/drm/radeon/ni.c +@@ -800,6 +800,7 @@ int ni_init_microcode(struct radeon_devi + fw_name); + release_firmware(rdev->smc_fw); + rdev->smc_fw = NULL; ++ err = 0; + } else if (rdev->smc_fw->size != smc_req_size) { + printk(KERN_ERR + "ni_mc: Bogus length %zu in firmware \"%s\"\n", +--- a/drivers/gpu/drm/radeon/r600.c ++++ b/drivers/gpu/drm/radeon/r600.c +@@ -2310,6 +2310,7 @@ int r600_init_microcode(struct radeon_de + fw_name); + release_firmware(rdev->smc_fw); + rdev->smc_fw = NULL; ++ err = 0; + } else if (rdev->smc_fw->size != smc_req_size) { + printk(KERN_ERR + "smc: Bogus length %zu in firmware \"%s\"\n", +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -1669,6 +1669,7 @@ static int si_init_microcode(struct rade + fw_name); + release_firmware(rdev->smc_fw); + rdev->smc_fw = NULL; ++ err = 0; + } else if (rdev->smc_fw->size != smc_req_size) { + printk(KERN_ERR + "si_smc: Bogus length %zu in firmware \"%s\"\n", diff --git a/queue-3.11/drm-vmwgfx-don-t-kill-clients-on-vt-switch.patch b/queue-3.11/drm-vmwgfx-don-t-kill-clients-on-vt-switch.patch new file mode 100644 index 00000000000..f1afdaea408 --- /dev/null +++ b/queue-3.11/drm-vmwgfx-don-t-kill-clients-on-vt-switch.patch @@ -0,0 +1,62 @@ +From c4249855ac5b2a383704d31e040d3831d6a25c6f Mon Sep 17 00:00:00 2001 +From: Thomas Hellstrom +Date: Wed, 9 Oct 2013 01:42:51 -0700 +Subject: drm/vmwgfx: Don't kill clients on VT switch + +From: Thomas Hellstrom + +commit c4249855ac5b2a383704d31e040d3831d6a25c6f upstream. + +DRI clients that tried to grab the TTM lock when the master (X server) was +switched away during a VT switch were sent the SIGTERM signal by the +kernel. Fix this so that they are only sent that signal when the master has +exited. + +Signed-off-by: Thomas Hellstrom +Reviewed-by: Jakob Bornecrantz +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c +@@ -738,9 +738,17 @@ static void vmw_postclose(struct drm_dev + struct vmw_fpriv *vmw_fp; + + vmw_fp = vmw_fpriv(file_priv); +- ttm_object_file_release(&vmw_fp->tfile); +- if (vmw_fp->locked_master) ++ ++ if (vmw_fp->locked_master) { ++ struct vmw_master *vmaster = ++ vmw_master(vmw_fp->locked_master); ++ ++ ttm_lock_set_kill(&vmaster->lock, true, SIGTERM); ++ ttm_vt_unlock(&vmaster->lock); + drm_master_put(&vmw_fp->locked_master); ++ } ++ ++ ttm_object_file_release(&vmw_fp->tfile); + kfree(vmw_fp); + } + +@@ -940,14 +948,13 @@ static void vmw_master_drop(struct drm_d + + vmw_fp->locked_master = drm_master_get(file_priv->master); + ret = ttm_vt_lock(&vmaster->lock, false, vmw_fp->tfile); +- vmw_execbuf_release_pinned_bo(dev_priv); +- + if (unlikely((ret != 0))) { + DRM_ERROR("Unable to lock TTM at VT switch.\n"); + drm_master_put(&vmw_fp->locked_master); + } + +- ttm_lock_set_kill(&vmaster->lock, true, SIGTERM); ++ ttm_lock_set_kill(&vmaster->lock, false, SIGTERM); ++ vmw_execbuf_release_pinned_bo(dev_priv); + + if (!dev_priv->enable_fb) { + ret = ttm_bo_evict_mm(&dev_priv->bdev, TTM_PL_VRAM); diff --git a/queue-3.11/drm-vmwgfx-don-t-put-resources-with-invalid-id-s-on-lru-list.patch b/queue-3.11/drm-vmwgfx-don-t-put-resources-with-invalid-id-s-on-lru-list.patch new file mode 100644 index 00000000000..24342f20807 --- /dev/null +++ b/queue-3.11/drm-vmwgfx-don-t-put-resources-with-invalid-id-s-on-lru-list.patch @@ -0,0 +1,32 @@ +From 26682480c202e7360cbcdc3bc9e962bf749c6b8d Mon Sep 17 00:00:00 2001 +From: Thomas Hellstrom +Date: Wed, 9 Oct 2013 01:42:50 -0700 +Subject: drm/vmwgfx: Don't put resources with invalid id's on lru list + +From: Thomas Hellstrom + +commit 26682480c202e7360cbcdc3bc9e962bf749c6b8d upstream. + +The evict code may try to swap them out causing a BUG in the destroy +function. + +Signed-off-by: Thomas Hellstrom +Reviewed-by: Jakob Bornecrantz +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c +@@ -970,7 +970,7 @@ void vmw_resource_unreserve(struct vmw_r + if (new_backup) + res->backup_offset = new_backup_offset; + +- if (!res->func->may_evict) ++ if (!res->func->may_evict || res->id == -1) + return; + + write_lock(&dev_priv->resource_lock); diff --git a/queue-3.11/mm-pagewalk.c-fix-walk_page_range-access-of-wrong-ptes.patch b/queue-3.11/mm-pagewalk.c-fix-walk_page_range-access-of-wrong-ptes.patch new file mode 100644 index 00000000000..44e79faaaf8 --- /dev/null +++ b/queue-3.11/mm-pagewalk.c-fix-walk_page_range-access-of-wrong-ptes.patch @@ -0,0 +1,53 @@ +From 3017f079efd6af199b0852b5c425364513db460e Mon Sep 17 00:00:00 2001 +From: Chen LinX +Date: Wed, 30 Oct 2013 13:56:18 -0700 +Subject: mm/pagewalk.c: fix walk_page_range() access of wrong PTEs + +From: Chen LinX + +commit 3017f079efd6af199b0852b5c425364513db460e upstream. + +When walk_page_range walk a memory map's page tables, it'll skip +VM_PFNMAP area, then variable 'next' will to assign to vma->vm_end, it +maybe larger than 'end'. In next loop, 'addr' will be larger than +'next'. Then in /proc/XXXX/pagemap file reading procedure, the 'addr' +will growing forever in pagemap_pte_range, pte_to_pagemap_entry will +access the wrong pte. + + BUG: Bad page map in process procrank pte:8437526f pmd:785de067 + addr:9108d000 vm_flags:00200073 anon_vma:f0d99020 mapping: (null) index:9108d + CPU: 1 PID: 4974 Comm: procrank Tainted: G B W O 3.10.1+ #1 + Call Trace: + dump_stack+0x16/0x18 + print_bad_pte+0x114/0x1b0 + vm_normal_page+0x56/0x60 + pagemap_pte_range+0x17a/0x1d0 + walk_page_range+0x19e/0x2c0 + pagemap_read+0x16e/0x200 + vfs_read+0x84/0x150 + SyS_read+0x4a/0x80 + syscall_call+0x7/0xb + +Signed-off-by: Liu ShuoX +Signed-off-by: Chen LinX +Acked-by: Kirill A. Shutemov +Reviewed-by: Naoya Horiguchi +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/pagewalk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/pagewalk.c ++++ b/mm/pagewalk.c +@@ -242,7 +242,7 @@ int walk_page_range(unsigned long addr, + if (err) + break; + pgd++; +- } while (addr = next, addr != end); ++ } while (addr = next, addr < end); + + return err; + } diff --git a/queue-3.11/mutex-avoid-gcc-version-dependent-__builtin_constant_p-usage.patch b/queue-3.11/mutex-avoid-gcc-version-dependent-__builtin_constant_p-usage.patch new file mode 100644 index 00000000000..0a151ba5f44 --- /dev/null +++ b/queue-3.11/mutex-avoid-gcc-version-dependent-__builtin_constant_p-usage.patch @@ -0,0 +1,181 @@ +From b0267507dfd0187fb7840a0ec461a510a7f041c5 Mon Sep 17 00:00:00 2001 +From: Tetsuo Handa +Date: Thu, 17 Oct 2013 19:45:29 +0900 +Subject: mutex: Avoid gcc version dependent __builtin_constant_p() usage + +From: Tetsuo Handa + +commit b0267507dfd0187fb7840a0ec461a510a7f041c5 upstream. + +Commit 040a0a37 ("mutex: Add support for wound/wait style locks") +used "!__builtin_constant_p(p == NULL)" but gcc 3.x cannot +handle such expression correctly, leading to boot failure when +built with CONFIG_DEBUG_MUTEXES=y. + +Fix it by explicitly passing a bool which tells whether p != NULL +or not. + +[ PeterZ: This is a sad patch, but provided it actually generates + similar code I suppose its the best we can do bar whole + sale deprecating gcc-3. ] + +Signed-off-by: Tetsuo Handa +Acked-by: Peter Zijlstra +Acked-by: Maarten Lankhorst +Cc: peterz@infradead.org +Cc: imirkin@alum.mit.edu +Cc: daniel.vetter@ffwll.ch +Cc: robdclark@gmail.com +Cc: Linus Torvalds +Cc: Andrew Morton +Link: http://lkml.kernel.org/r/201310171945.AGB17114.FSQVtHOJFOOFML@I-love.SAKURA.ne.jp +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/mutex.c | 32 ++++++++++++++++---------------- + 1 file changed, 16 insertions(+), 16 deletions(-) + +--- a/kernel/mutex.c ++++ b/kernel/mutex.c +@@ -408,7 +408,7 @@ ww_mutex_set_context_fastpath(struct ww_ + static __always_inline int __sched + __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass, + struct lockdep_map *nest_lock, unsigned long ip, +- struct ww_acquire_ctx *ww_ctx) ++ struct ww_acquire_ctx *ww_ctx, const bool use_ww_ctx) + { + struct task_struct *task = current; + struct mutex_waiter waiter; +@@ -448,7 +448,7 @@ __mutex_lock_common(struct mutex *lock, + struct task_struct *owner; + struct mspin_node node; + +- if (!__builtin_constant_p(ww_ctx == NULL) && ww_ctx->acquired > 0) { ++ if (use_ww_ctx && ww_ctx->acquired > 0) { + struct ww_mutex *ww; + + ww = container_of(lock, struct ww_mutex, base); +@@ -478,7 +478,7 @@ __mutex_lock_common(struct mutex *lock, + if ((atomic_read(&lock->count) == 1) && + (atomic_cmpxchg(&lock->count, 1, 0) == 1)) { + lock_acquired(&lock->dep_map, ip); +- if (!__builtin_constant_p(ww_ctx == NULL)) { ++ if (use_ww_ctx) { + struct ww_mutex *ww; + ww = container_of(lock, struct ww_mutex, base); + +@@ -548,7 +548,7 @@ slowpath: + goto err; + } + +- if (!__builtin_constant_p(ww_ctx == NULL) && ww_ctx->acquired > 0) { ++ if (use_ww_ctx && ww_ctx->acquired > 0) { + ret = __mutex_lock_check_stamp(lock, ww_ctx); + if (ret) + goto err; +@@ -568,7 +568,7 @@ done: + mutex_remove_waiter(lock, &waiter, current_thread_info()); + mutex_set_owner(lock); + +- if (!__builtin_constant_p(ww_ctx == NULL)) { ++ if (use_ww_ctx) { + struct ww_mutex *ww = container_of(lock, + struct ww_mutex, + base); +@@ -618,7 +618,7 @@ mutex_lock_nested(struct mutex *lock, un + { + might_sleep(); + __mutex_lock_common(lock, TASK_UNINTERRUPTIBLE, +- subclass, NULL, _RET_IP_, NULL); ++ subclass, NULL, _RET_IP_, NULL, 0); + } + + EXPORT_SYMBOL_GPL(mutex_lock_nested); +@@ -628,7 +628,7 @@ _mutex_lock_nest_lock(struct mutex *lock + { + might_sleep(); + __mutex_lock_common(lock, TASK_UNINTERRUPTIBLE, +- 0, nest, _RET_IP_, NULL); ++ 0, nest, _RET_IP_, NULL, 0); + } + + EXPORT_SYMBOL_GPL(_mutex_lock_nest_lock); +@@ -638,7 +638,7 @@ mutex_lock_killable_nested(struct mutex + { + might_sleep(); + return __mutex_lock_common(lock, TASK_KILLABLE, +- subclass, NULL, _RET_IP_, NULL); ++ subclass, NULL, _RET_IP_, NULL, 0); + } + EXPORT_SYMBOL_GPL(mutex_lock_killable_nested); + +@@ -647,7 +647,7 @@ mutex_lock_interruptible_nested(struct m + { + might_sleep(); + return __mutex_lock_common(lock, TASK_INTERRUPTIBLE, +- subclass, NULL, _RET_IP_, NULL); ++ subclass, NULL, _RET_IP_, NULL, 0); + } + + EXPORT_SYMBOL_GPL(mutex_lock_interruptible_nested); +@@ -685,7 +685,7 @@ __ww_mutex_lock(struct ww_mutex *lock, s + + might_sleep(); + ret = __mutex_lock_common(&lock->base, TASK_UNINTERRUPTIBLE, +- 0, &ctx->dep_map, _RET_IP_, ctx); ++ 0, &ctx->dep_map, _RET_IP_, ctx, 1); + if (!ret && ctx->acquired > 1) + return ww_mutex_deadlock_injection(lock, ctx); + +@@ -700,7 +700,7 @@ __ww_mutex_lock_interruptible(struct ww_ + + might_sleep(); + ret = __mutex_lock_common(&lock->base, TASK_INTERRUPTIBLE, +- 0, &ctx->dep_map, _RET_IP_, ctx); ++ 0, &ctx->dep_map, _RET_IP_, ctx, 1); + + if (!ret && ctx->acquired > 1) + return ww_mutex_deadlock_injection(lock, ctx); +@@ -812,28 +812,28 @@ __mutex_lock_slowpath(atomic_t *lock_cou + struct mutex *lock = container_of(lock_count, struct mutex, count); + + __mutex_lock_common(lock, TASK_UNINTERRUPTIBLE, 0, +- NULL, _RET_IP_, NULL); ++ NULL, _RET_IP_, NULL, 0); + } + + static noinline int __sched + __mutex_lock_killable_slowpath(struct mutex *lock) + { + return __mutex_lock_common(lock, TASK_KILLABLE, 0, +- NULL, _RET_IP_, NULL); ++ NULL, _RET_IP_, NULL, 0); + } + + static noinline int __sched + __mutex_lock_interruptible_slowpath(struct mutex *lock) + { + return __mutex_lock_common(lock, TASK_INTERRUPTIBLE, 0, +- NULL, _RET_IP_, NULL); ++ NULL, _RET_IP_, NULL, 0); + } + + static noinline int __sched + __ww_mutex_lock_slowpath(struct ww_mutex *lock, struct ww_acquire_ctx *ctx) + { + return __mutex_lock_common(&lock->base, TASK_UNINTERRUPTIBLE, 0, +- NULL, _RET_IP_, ctx); ++ NULL, _RET_IP_, ctx, 1); + } + + static noinline int __sched +@@ -841,7 +841,7 @@ __ww_mutex_lock_interruptible_slowpath(s + struct ww_acquire_ctx *ctx) + { + return __mutex_lock_common(&lock->base, TASK_INTERRUPTIBLE, 0, +- NULL, _RET_IP_, ctx); ++ NULL, _RET_IP_, ctx, 1); + } + + #endif diff --git a/queue-3.11/ntb-add-error-handling-in-ntb_device_setup.patch b/queue-3.11/ntb-add-error-handling-in-ntb_device_setup.patch new file mode 100644 index 00000000000..25424b14405 --- /dev/null +++ b/queue-3.11/ntb-add-error-handling-in-ntb_device_setup.patch @@ -0,0 +1,40 @@ +From 3b12a0d15bd1559e72ad21d9d807fd2a6706f0ab Mon Sep 17 00:00:00 2001 +From: Jon Mason +Date: Mon, 15 Jul 2013 13:23:47 -0700 +Subject: NTB: Add Error Handling in ntb_device_setup + +From: Jon Mason + +commit 3b12a0d15bd1559e72ad21d9d807fd2a6706f0ab upstream. + +If an error is encountered in ntb_device_setup, it is possible that the +spci_cmd isn't populated. Writes to the offset can result in a NULL +pointer dereference. This issue is easily encountered by running in +NTB-RP mode, as it currently is not supported and will generate an +error. To get around this issue, return if an error is encountered +prior to attempting to write to the spci_cmd offset. + +Signed-off-by: Jon Mason +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ntb/ntb_hw.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/ntb/ntb_hw.c ++++ b/drivers/ntb/ntb_hw.c +@@ -644,10 +644,13 @@ static int ntb_device_setup(struct ntb_d + rc = -ENODEV; + } + ++ if (rc) ++ return rc; ++ + /* Enable Bus Master and Memory Space on the secondary side */ + writew(PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER, ndev->reg_ofs.spci_cmd); + +- return rc; ++ return 0; + } + + static void ntb_device_free(struct ntb_device *ndev) diff --git a/queue-3.11/ntb-correct-debugfs-to-work-with-more-than-1-ntb-device.patch b/queue-3.11/ntb-correct-debugfs-to-work-with-more-than-1-ntb-device.patch new file mode 100644 index 00000000000..185372dee2f --- /dev/null +++ b/queue-3.11/ntb-correct-debugfs-to-work-with-more-than-1-ntb-device.patch @@ -0,0 +1,187 @@ +From 1517a3f21a1dd321f16bcf44204bddff9d21abd0 Mon Sep 17 00:00:00 2001 +From: Jon Mason +Date: Tue, 30 Jul 2013 15:58:49 -0700 +Subject: NTB: Correct debugfs to work with more than 1 NTB Device + +From: Jon Mason + +commit 1517a3f21a1dd321f16bcf44204bddff9d21abd0 upstream. + +Debugfs was setup in NTB to only have a single debugfs directory. This +resulted in the leaking of debugfs directories and files when multiple +NTB devices were present, due to each device stomping on the variables +containing the previous device's values (thus preventing them from being +freed on cleanup). Correct this by creating a secondary directory of +the PCI BDF for each device present, and nesting the previously existing +information in those directories. + +Signed-off-by: Jon Mason +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ntb/ntb_hw.c | 27 +++++++++++++++++++++++++++ + drivers/ntb/ntb_hw.h | 16 ++++++++++++++++ + drivers/ntb/ntb_transport.c | 17 +++++------------ + 3 files changed, 48 insertions(+), 12 deletions(-) + +--- a/drivers/ntb/ntb_hw.c ++++ b/drivers/ntb/ntb_hw.c +@@ -78,6 +78,8 @@ enum { + BWD_HW, + }; + ++static struct dentry *debugfs_dir; ++ + /* Translate memory window 0,1 to BAR 2,4 */ + #define MW_TO_BAR(mw) (mw * 2 + 2) + +@@ -998,6 +1000,28 @@ static void ntb_free_callbacks(struct nt + kfree(ndev->db_cb); + } + ++static void ntb_setup_debugfs(struct ntb_device *ndev) ++{ ++ if (!debugfs_initialized()) ++ return; ++ ++ if (!debugfs_dir) ++ debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL); ++ ++ ndev->debugfs_dir = debugfs_create_dir(pci_name(ndev->pdev), ++ debugfs_dir); ++} ++ ++static void ntb_free_debugfs(struct ntb_device *ndev) ++{ ++ debugfs_remove_recursive(ndev->debugfs_dir); ++ ++ if (debugfs_dir && simple_empty(debugfs_dir)) { ++ debugfs_remove_recursive(debugfs_dir); ++ debugfs_dir = NULL; ++ } ++} ++ + static int ntb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + { + struct ntb_device *ndev; +@@ -1010,6 +1034,7 @@ static int ntb_pci_probe(struct pci_dev + ndev->pdev = pdev; + ndev->link_status = NTB_LINK_DOWN; + pci_set_drvdata(pdev, ndev); ++ ntb_setup_debugfs(ndev); + + rc = pci_enable_device(pdev); + if (rc) +@@ -1106,6 +1131,7 @@ err2: + err1: + pci_disable_device(pdev); + err: ++ ntb_free_debugfs(ndev); + kfree(ndev); + + dev_err(&pdev->dev, "Error loading %s module\n", KBUILD_MODNAME); +@@ -1135,6 +1161,7 @@ static void ntb_pci_remove(struct pci_de + iounmap(ndev->reg_base); + pci_release_selected_regions(pdev, NTB_BAR_MASK); + pci_disable_device(pdev); ++ ntb_free_debugfs(ndev); + kfree(ndev); + } + +--- a/drivers/ntb/ntb_hw.h ++++ b/drivers/ntb/ntb_hw.h +@@ -127,6 +127,8 @@ struct ntb_device { + unsigned char link_status; + struct delayed_work hb_timer; + unsigned long last_ts; ++ ++ struct dentry *debugfs_dir; + }; + + /** +@@ -155,6 +157,20 @@ static inline struct pci_dev *ntb_query_ + return ndev->pdev; + } + ++/** ++ * ntb_query_debugfs() - return the debugfs pointer ++ * @ndev: pointer to ntb_device instance ++ * ++ * Given the ntb pointer, return the debugfs directory pointer for the NTB ++ * hardware device ++ * ++ * RETURNS: a pointer to the debugfs directory ++ */ ++static inline struct dentry *ntb_query_debugfs(struct ntb_device *ndev) ++{ ++ return ndev->debugfs_dir; ++} ++ + struct ntb_device *ntb_register_transport(struct pci_dev *pdev, + void *transport); + void ntb_unregister_transport(struct ntb_device *ndev); +--- a/drivers/ntb/ntb_transport.c ++++ b/drivers/ntb/ntb_transport.c +@@ -157,7 +157,6 @@ struct ntb_transport { + bool transport_link; + struct delayed_work link_work; + struct work_struct link_cleanup; +- struct dentry *debugfs_dir; + }; + + enum { +@@ -824,12 +823,12 @@ static void ntb_transport_init_queue(str + qp->tx_max_frame = min(transport_mtu, tx_size / 2); + qp->tx_max_entry = tx_size / qp->tx_max_frame; + +- if (nt->debugfs_dir) { ++ if (ntb_query_debugfs(nt->ndev)) { + char debugfs_name[4]; + + snprintf(debugfs_name, 4, "qp%d", qp_num); + qp->debugfs_dir = debugfs_create_dir(debugfs_name, +- nt->debugfs_dir); ++ ntb_query_debugfs(nt->ndev)); + + qp->debugfs_stats = debugfs_create_file("stats", S_IRUSR, + qp->debugfs_dir, qp, +@@ -857,11 +856,6 @@ int ntb_transport_init(struct pci_dev *p + if (!nt) + return -ENOMEM; + +- if (debugfs_initialized()) +- nt->debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL); +- else +- nt->debugfs_dir = NULL; +- + nt->ndev = ntb_register_transport(pdev, nt); + if (!nt->ndev) { + rc = -EIO; +@@ -907,7 +901,6 @@ err2: + err1: + ntb_unregister_transport(nt->ndev); + err: +- debugfs_remove_recursive(nt->debugfs_dir); + kfree(nt); + return rc; + } +@@ -921,16 +914,16 @@ void ntb_transport_free(void *transport) + nt->transport_link = NTB_LINK_DOWN; + + /* verify that all the qp's are freed */ +- for (i = 0; i < nt->max_qps; i++) ++ for (i = 0; i < nt->max_qps; i++) { + if (!test_bit(i, &nt->qp_bitmap)) + ntb_transport_free_queue(&nt->qps[i]); ++ debugfs_remove_recursive(nt->qps[i].debugfs_dir); ++ } + + ntb_bus_remove(nt); + + cancel_delayed_work_sync(&nt->link_work); + +- debugfs_remove_recursive(nt->debugfs_dir); +- + ntb_unregister_event_callback(nt->ndev); + + pdev = ntb_query_pdev(nt->ndev); diff --git a/queue-3.11/ntb-correct-number-of-scratch-pad-registers.patch b/queue-3.11/ntb-correct-number-of-scratch-pad-registers.patch new file mode 100644 index 00000000000..cb6abc0f8c6 --- /dev/null +++ b/queue-3.11/ntb-correct-number-of-scratch-pad-registers.patch @@ -0,0 +1,45 @@ +From 87034511519815259e37336f52edf06d114d43b6 Mon Sep 17 00:00:00 2001 +From: Jon Mason +Date: Mon, 15 Jul 2013 15:26:14 -0700 +Subject: NTB: Correct Number of Scratch Pad Registers + +From: Jon Mason + +commit 87034511519815259e37336f52edf06d114d43b6 upstream. + +The NTB Xeon hardware has 16 scratch pad registers and 16 back-to-back +scratch pad registers. Correct the #define to represent this and update +the variable names to reflect their usage. + +Signed-off-by: Jon Mason +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ntb/ntb_hw.c | 2 +- + drivers/ntb/ntb_regs.h | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/ntb/ntb_hw.c ++++ b/drivers/ntb/ntb_hw.c +@@ -547,7 +547,7 @@ static int ntb_xeon_setup(struct ntb_dev + if (ndev->conn_type == NTB_CONN_B2B) { + ndev->reg_ofs.sdb = ndev->reg_base + SNB_B2B_DOORBELL_OFFSET; + ndev->reg_ofs.spad_write = ndev->reg_base + SNB_B2B_SPAD_OFFSET; +- ndev->limits.max_spads = SNB_MAX_SPADS; ++ ndev->limits.max_spads = SNB_MAX_B2B_SPADS; + } else { + ndev->reg_ofs.sdb = ndev->reg_base + SNB_SDOORBELL_OFFSET; + ndev->reg_ofs.spad_write = ndev->reg_base + SNB_SPAD_OFFSET; +--- a/drivers/ntb/ntb_regs.h ++++ b/drivers/ntb/ntb_regs.h +@@ -53,8 +53,8 @@ + #define NTB_LINK_WIDTH_MASK 0x03f0 + + #define SNB_MSIX_CNT 4 +-#define SNB_MAX_SPADS 16 +-#define SNB_MAX_COMPAT_SPADS 8 ++#define SNB_MAX_B2B_SPADS 16 ++#define SNB_MAX_COMPAT_SPADS 16 + /* Reserve the uppermost bit for link interrupt */ + #define SNB_MAX_DB_BITS 15 + #define SNB_DB_BITS_PER_VEC 5 diff --git a/queue-3.11/ntb-correct-usd-dsd-identification.patch b/queue-3.11/ntb-correct-usd-dsd-identification.patch new file mode 100644 index 00000000000..dbe6db6dd3f --- /dev/null +++ b/queue-3.11/ntb-correct-usd-dsd-identification.patch @@ -0,0 +1,44 @@ +From b6750cfe0710a14fd147ba27fddbecae8ba88c77 Mon Sep 17 00:00:00 2001 +From: Jon Mason +Date: Fri, 31 May 2013 14:05:53 -0700 +Subject: NTB: Correct USD/DSD Identification + +From: Jon Mason + +commit b6750cfe0710a14fd147ba27fddbecae8ba88c77 upstream. + +Due to ambiguous documentation, the USD/DSD identification is backward +when compared to the setting in BIOS. Correct the bits to match the +BIOS setting. + +Signed-off-by: Jon Mason +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ntb/ntb_hw.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/ntb/ntb_hw.c ++++ b/drivers/ntb/ntb_hw.c +@@ -531,9 +531,9 @@ static int ntb_xeon_setup(struct ntb_dev + } + + if (val & SNB_PPD_DEV_TYPE) +- ndev->dev_type = NTB_DEV_DSD; +- else + ndev->dev_type = NTB_DEV_USD; ++ else ++ ndev->dev_type = NTB_DEV_DSD; + + ndev->reg_ofs.pdb = ndev->reg_base + SNB_PDOORBELL_OFFSET; + ndev->reg_ofs.pdb_mask = ndev->reg_base + SNB_PDBMSK_OFFSET; +@@ -647,6 +647,9 @@ static int ntb_device_setup(struct ntb_d + if (rc) + return rc; + ++ dev_info(&ndev->pdev->dev, "Device Type = %s\n", ++ ndev->dev_type == NTB_DEV_USD ? "USD/DSP" : "DSD/USP"); ++ + /* Enable Bus Master and Memory Space on the secondary side */ + writew(PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER, ndev->reg_ofs.spci_cmd); + diff --git a/queue-3.11/seq_file-always-update-file-f_pos-in-seq_lseek.patch b/queue-3.11/seq_file-always-update-file-f_pos-in-seq_lseek.patch new file mode 100644 index 00000000000..ace1fc4b752 --- /dev/null +++ b/queue-3.11/seq_file-always-update-file-f_pos-in-seq_lseek.patch @@ -0,0 +1,70 @@ +From 05e16745c0c471bba313961b605b6da3b21a853d Mon Sep 17 00:00:00 2001 +From: Gu Zheng +Date: Fri, 25 Oct 2013 18:15:06 +0800 +Subject: seq_file: always update file->f_pos in seq_lseek() + +From: Gu Zheng + +commit 05e16745c0c471bba313961b605b6da3b21a853d upstream. + +This issue was first pointed out by Jiaxing Wang several months ago, but no +further comments: +https://lkml.org/lkml/2013/6/29/41 + +As we know pread() does not change f_pos, so after pread(), file->f_pos +and m->read_pos become different. And seq_lseek() does not update file->f_pos +if offset equals to m->read_pos, so after pread() and seq_lseek()(lseek to +m->read_pos), then a subsequent read may read from a wrong position, the +following program produces the problem: + + char str1[32] = { 0 }; + char str2[32] = { 0 }; + int poffset = 10; + int count = 20; + + /*open any seq file*/ + int fd = open("/proc/modules", O_RDONLY); + + pread(fd, str1, count, poffset); + printf("pread:%s\n", str1); + + /*seek to where m->read_pos is*/ + lseek(fd, poffset+count, SEEK_SET); + + /*supposed to read from poffset+count, but this read from position 0*/ + read(fd, str2, count); + printf("read:%s\n", str2); + +out put: +pread: + ck_netbios_ns 12665 +read: + nf_conntrack_netbios + +/proc/modules: +nf_conntrack_netbios_ns 12665 0 - Live 0xffffffffa038b000 +nf_conntrack_broadcast 12589 1 nf_conntrack_netbios_ns, Live 0xffffffffa0386000 + +So we always update file->f_pos to offset in seq_lseek() to fix this issue. + +Signed-off-by: Jiaxing Wang +Signed-off-by: Gu Zheng +Signed-off-by: Al Viro +Cc: Jonghwan Choi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/seq_file.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/seq_file.c ++++ b/fs/seq_file.c +@@ -328,6 +328,8 @@ loff_t seq_lseek(struct file *file, loff + m->read_pos = offset; + retval = file->f_pos = offset; + } ++ } else { ++ file->f_pos = offset; + } + } + file->f_version = m->version; diff --git a/queue-3.11/series b/queue-3.11/series index a85b5a5bae6..e59018dd19e 100644 --- a/queue-3.11/series +++ b/queue-3.11/series @@ -73,3 +73,22 @@ mm-numa-sanitize-task_numa_fault-callsites.patch mm-close-races-between-thp-migration-and-pmd-numa-clearing.patch mm-account-for-a-thp-numa-hinting-update-as-one-pte-update.patch mm-proc-pid-pagemap-inspect-_page_soft_dirty-only-on-present-pages.patch +mm-pagewalk.c-fix-walk_page_range-access-of-wrong-ptes.patch +drm-vmwgfx-don-t-put-resources-with-invalid-id-s-on-lru-list.patch +drm-vmwgfx-don-t-kill-clients-on-vt-switch.patch +drm-i915-split-aux_clock_divider-logic-in-a-separated-function-for-reuse.patch +drm-i915-retry-dp-aux_ch-communications-with-a-different-clock-after-failure.patch +drm-prevent-overwriting-from-userspace-underallocating-core-ioctl-structs.patch +drm-pad-drm_mode_get_connector-to-64-bit-boundary.patch +drm-radeon-atom-workaround-vbios-bug-in-transmitter-table-on-rs780.patch +drm-radeon-make-missing-smc-ucode-non-fatal-r7xx-si.patch +drm-i915-add-hsw-crt-output-readout-support.patch +drm-i915-add-support-for-pipe_bpp-readout.patch +drm-i915-no-lvds-hardware-on-intel-d410pt-and-d425kt.patch +drm-i915-fix-the-ppt-fdi-lane-bifurcate-state-handling-on-ivb.patch +mutex-avoid-gcc-version-dependent-__builtin_constant_p-usage.patch +seq_file-always-update-file-f_pos-in-seq_lseek.patch +ntb-add-error-handling-in-ntb_device_setup.patch +ntb-correct-number-of-scratch-pad-registers.patch +ntb-correct-usd-dsd-identification.patch +ntb-correct-debugfs-to-work-with-more-than-1-ntb-device.patch