From: Greg Kroah-Hartman Date: Mon, 5 Sep 2016 13:55:00 +0000 (+0200) Subject: 4.7-stable patches X-Git-Tag: v3.14.78~5 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5a5e98cadbbeb71ea15c6909bda709afa8c2d39b;p=thirdparty%2Fkernel%2Fstable-queue.git 4.7-stable patches added patches: aacraid-check-size-values-after-double-fetch-from-user.patch arc-call-trace_hardirqs_on-before-enabling-irqs.patch arc-elide-redundant-setup-of-dma-callbacks.patch arc-mm-fix-build-breakage-with-strict_mm_typechecks.patch arc-use-correct-offset-in-pt_regs-for-saving-restoring-user-mode-r25.patch arm64-avoid-tlb-conflict-with-config_randomize_base.patch arm64-dts-rockchip-add-reset-saradc-node-for-rk3368-socs.patch arm64-kernel-avoid-literal-load-of-virtual-address-with-mmu-off.patch arm64-kernel-fix-unmasked-debug-exceptions-when-restoring-mdscr_el1.patch btrfs-don-t-create-or-leak-aliased-root-while-cleaning-up-orphans.patch btrfs-properly-track-when-rescan-worker-is-running.patch btrfs-waiting-on-qgroup-rescan-should-not-always-be-interruptible.patch cdc-acm-fix-wrong-pipe-type-on-rx-interrupt-xfers.patch dax-fix-device-dax-region-base.patch dm-round-robin-do-not-use-this_cpu_ptr-without-having-preemption-disabled.patch drm-amd-amdgpu-compute-ring-test-fail-during-s4-on-ci.patch drm-amd-amdgpu-sdma-resume-fail-during-s4-on-ci.patch drm-amdgpu-avoid-a-possible-array-overflow.patch drm-amdgpu-change-gart-offset-to-64-bit.patch drm-amdgpu-fix-amdgpu_move_blit-on-32bit-systems.patch drm-amdgpu-fix-lru-size-grouping-v2.patch drm-amdgpu-record-error-code-when-ring-test-failed.patch drm-amdgpu-skip-tv-cv-in-display-parsing.patch drm-i915-acquire-audio-powerwell-for-hd-audio-registers.patch drm-i915-enable-polling-when-we-don-t-have-hpd.patch drm-i915-fix-aliasing_ppgtt-leak.patch drm-i915-fix-iboost-setting-for-ddi-with-4-lanes-on-skl.patch drm-i915-fix-iboost-setting-for-skl-y-u-dp-ddi-buffer-translation-entry-2.patch drm-i915-program-iboost-settings-for-hdmi-dvi-on-skl.patch drm-i915-vlv-disable-hpd-in-valleyview_crt_detect_hotplug.patch drm-i915-vlv-make-intel_crt_reset-per-encoder.patch drm-i915-vlv-reset-the-adpa-in-vlv_display_power_well_init.patch edac-sb_edac-fix-channel-reporting-on-knights-landing.patch fs-seq_file-fix-out-of-bounds-read.patch gpio-fix-of-build-problem-on-um.patch gpio-max730x-set-gpiochip-data-pointer-before-using-it.patch i2c-cros-ec-tunnel-fix-usage-of-cros_ec_cmd_xfer.patch i2c-mux-demux-pinctrl-properly-roll-back-when-adding-adapter-fails.patch iio-fix-sched-warning-do-not-call-blocking-ops-when-task_running.patch iommu-arm-smmu-disable-stalling-faults-for-all-endpoints.patch iommu-arm-smmu-don-t-bug-if-we-find-aborting-stes-with-disable_bypass.patch iommu-arm-smmu-fix-cmdq-error-handling.patch iommu-dma-don-t-put-uninitialised-iova-domains.patch iommu-io-pgtable-arm-v7s-fix-attributes-when-splitting-blocks.patch mac80211-fix-purging-multicast-ps-buffer-queue.patch megaraid_sas-fix-probing-cards-without-io-port.patch mfd-cros_ec-add-cros_ec_cmd_xfer_status-helper.patch mm-silently-skip-readahead-for-dax-inodes.patch mpt3sas-fix-resume-on-warpdrive-flash-cards.patch of-fix-reference-counting-in-of_graph_get_endpoint_by_regs.patch perf-core-fix-event_function_local.patch perf-symbols-fix-annotation-of-objects-with-debuginfo-files.patch perf-tools-mem-fix-t-store-option-for-record-command.patch pinctrl-amd-remove-the-default-de-bounce-time.patch pinctrl-meson-drop-pinctrl_unregister-for-devm_-registered-device.patch s390-dasd-fix-hanging-device-after-clear-subchannel.patch sched-cputime-fix-no_hz_full-getrusage-monotonicity-regression.patch soft_dirty-fix-soft_dirty-during-thp-split.patch usb-renesas_usbhs-gadget-fix-return-value-check-in-usbhs_mod_gadget_probe.patch --- diff --git a/queue-4.7/aacraid-check-size-values-after-double-fetch-from-user.patch b/queue-4.7/aacraid-check-size-values-after-double-fetch-from-user.patch new file mode 100644 index 00000000000..2ab30e68bdc --- /dev/null +++ b/queue-4.7/aacraid-check-size-values-after-double-fetch-from-user.patch @@ -0,0 +1,65 @@ +From fa00c437eef8dc2e7b25f8cd868cfa405fcc2bb3 Mon Sep 17 00:00:00 2001 +From: Dave Carroll +Date: Fri, 5 Aug 2016 13:44:10 -0600 +Subject: aacraid: Check size values after double-fetch from user + +From: Dave Carroll + +commit fa00c437eef8dc2e7b25f8cd868cfa405fcc2bb3 upstream. + +In aacraid's ioctl_send_fib() we do two fetches from userspace, one the +get the fib header's size and one for the fib itself. Later we use the +size field from the second fetch to further process the fib. If for some +reason the size from the second fetch is different than from the first +fix, we may encounter an out-of- bounds access in aac_fib_send(). We +also check the sender size to insure it is not out of bounds. This was +reported in https://bugzilla.kernel.org/show_bug.cgi?id=116751 and was +assigned CVE-2016-6480. + +Reported-by: Pengfei Wang +Fixes: 7c00ffa31 '[SCSI] 2.6 aacraid: Variable FIB size (updated patch)' +Signed-off-by: Dave Carroll +Reviewed-by: Johannes Thumshirn +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/aacraid/commctrl.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/aacraid/commctrl.c ++++ b/drivers/scsi/aacraid/commctrl.c +@@ -63,7 +63,7 @@ static int ioctl_send_fib(struct aac_dev + struct fib *fibptr; + struct hw_fib * hw_fib = (struct hw_fib *)0; + dma_addr_t hw_fib_pa = (dma_addr_t)0LL; +- unsigned size; ++ unsigned int size, osize; + int retval; + + if (dev->in_reset) { +@@ -87,7 +87,8 @@ static int ioctl_send_fib(struct aac_dev + * will not overrun the buffer when we copy the memory. Return + * an error if we would. + */ +- size = le16_to_cpu(kfib->header.Size) + sizeof(struct aac_fibhdr); ++ osize = size = le16_to_cpu(kfib->header.Size) + ++ sizeof(struct aac_fibhdr); + if (size < le16_to_cpu(kfib->header.SenderSize)) + size = le16_to_cpu(kfib->header.SenderSize); + if (size > dev->max_fib_size) { +@@ -118,6 +119,14 @@ static int ioctl_send_fib(struct aac_dev + goto cleanup; + } + ++ /* Sanity check the second copy */ ++ if ((osize != le16_to_cpu(kfib->header.Size) + ++ sizeof(struct aac_fibhdr)) ++ || (size < le16_to_cpu(kfib->header.SenderSize))) { ++ retval = -EINVAL; ++ goto cleanup; ++ } ++ + if (kfib->header.Command == cpu_to_le16(TakeABreakPt)) { + aac_adapter_interrupt(dev); + /* diff --git a/queue-4.7/arc-call-trace_hardirqs_on-before-enabling-irqs.patch b/queue-4.7/arc-call-trace_hardirqs_on-before-enabling-irqs.patch new file mode 100644 index 00000000000..0113bdfb1a3 --- /dev/null +++ b/queue-4.7/arc-call-trace_hardirqs_on-before-enabling-irqs.patch @@ -0,0 +1,63 @@ +From 18b43e89d295cc65151c505c643c98fb2c320e59 Mon Sep 17 00:00:00 2001 +From: Daniel Mentz +Date: Thu, 4 Aug 2016 17:56:53 -0700 +Subject: ARC: Call trace_hardirqs_on() before enabling irqs + +From: Daniel Mentz + +commit 18b43e89d295cc65151c505c643c98fb2c320e59 upstream. + +trace_hardirqs_on_caller() in lockdep.c expects to be called before, not +after interrupts are actually enabled. + +The following comment in kernel/locking/lockdep.c substantiates this +claim: + +" +/* + * We're enabling irqs and according to our state above irqs weren't + * already enabled, yet we find the hardware thinks they are in fact + * enabled.. someone messed up their IRQ state tracing. + */ +" + +An example can be found in include/linux/irqflags.h: + + do { trace_hardirqs_on(); raw_local_irq_enable(); } while (0) + +Without this change, we hit the following DEBUG_LOCKS_WARN_ON. + +[ 7.760000] ------------[ cut here ]------------ +[ 7.760000] WARNING: CPU: 0 PID: 1 at kernel/locking/lockdep.c:2711 resume_user_mode_begin+0x48/0xf0 +[ 7.770000] DEBUG_LOCKS_WARN_ON(!irqs_disabled()) +[ 7.780000] Modules linked in: +[ 7.780000] CPU: 0 PID: 1 Comm: init Not tainted 4.7.0-00003-gc668bb9-dirty #366 +[ 7.790000] +[ 7.790000] Stack Trace: +[ 7.790000] arc_unwind_core.constprop.1+0xa4/0x118 +[ 7.800000] warn_slowpath_fmt+0x72/0x158 +[ 7.800000] resume_user_mode_begin+0x48/0xf0 +[ 7.810000] ---[ end trace 6f6a7a8fae20d2f0 ]--- + +Signed-off-by: Daniel Mentz +Signed-off-by: Vineet Gupta +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arc/include/asm/irqflags-compact.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arc/include/asm/irqflags-compact.h ++++ b/arch/arc/include/asm/irqflags-compact.h +@@ -188,10 +188,10 @@ static inline int arch_irqs_disabled(voi + .endm + + .macro IRQ_ENABLE scratch ++ TRACE_ASM_IRQ_ENABLE + lr \scratch, [status32] + or \scratch, \scratch, (STATUS_E1_MASK | STATUS_E2_MASK) + flag \scratch +- TRACE_ASM_IRQ_ENABLE + .endm + + #endif /* __ASSEMBLY__ */ diff --git a/queue-4.7/arc-elide-redundant-setup-of-dma-callbacks.patch b/queue-4.7/arc-elide-redundant-setup-of-dma-callbacks.patch new file mode 100644 index 00000000000..f8f702c2501 --- /dev/null +++ b/queue-4.7/arc-elide-redundant-setup-of-dma-callbacks.patch @@ -0,0 +1,37 @@ +From 45c3b08a117e2232fc8d7b9e849ead36386f4f96 Mon Sep 17 00:00:00 2001 +From: Vineet Gupta +Date: Mon, 13 Jun 2016 16:38:27 +0200 +Subject: ARC: Elide redundant setup of DMA callbacks + +From: Vineet Gupta + +commit 45c3b08a117e2232fc8d7b9e849ead36386f4f96 upstream. + +For resources shared by all cores such as SLC and IOC, only the master +core needs to do any setups / enabling / disabling etc. + +Signed-off-by: Vineet Gupta +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arc/mm/cache.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/arch/arc/mm/cache.c ++++ b/arch/arc/mm/cache.c +@@ -921,6 +921,15 @@ void arc_cache_init(void) + + printk(arc_cache_mumbojumbo(0, str, sizeof(str))); + ++ /* ++ * Only master CPU needs to execute rest of function: ++ * - Assume SMP so all cores will have same cache config so ++ * any geomtry checks will be same for all ++ * - IOC setup / dma callbacks only need to be setup once ++ */ ++ if (cpu) ++ return; ++ + if (IS_ENABLED(CONFIG_ARC_HAS_ICACHE)) { + struct cpuinfo_arc_cache *ic = &cpuinfo_arc700[cpu].icache; + diff --git a/queue-4.7/arc-mm-fix-build-breakage-with-strict_mm_typechecks.patch b/queue-4.7/arc-mm-fix-build-breakage-with-strict_mm_typechecks.patch new file mode 100644 index 00000000000..3bfd374b92e --- /dev/null +++ b/queue-4.7/arc-mm-fix-build-breakage-with-strict_mm_typechecks.patch @@ -0,0 +1,59 @@ +From 1c3c909303924d30145601f47b6c058fdd2cbc2e Mon Sep 17 00:00:00 2001 +From: Vineet Gupta +Date: Tue, 16 Aug 2016 18:27:07 -0700 +Subject: ARC: mm: fix build breakage with STRICT_MM_TYPECHECKS +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vineet Gupta + +commit 1c3c909303924d30145601f47b6c058fdd2cbc2e upstream. + +| CC mm/memory.o +| In file included from ../mm/memory.c:53:0: +| ../include/linux/pfn_t.h: In function ‘pfn_t_pte’: +| ../include/linux/pfn_t.h:78:2: error: conversion to non-scalar type requested +| return pfn_pte(pfn_t_to_pfn(pfn), pgprot); + +With STRICT_MM_TYPECHECKS pte_t is a struct and the offending code +forces a cast which ends up shifting a struct and hence the gcc warning. + +Note that in recent past some of the arches (aarch64, s390) made +STRICT_MM_TYPECHECKS default, but we don't for ARC as this leads to slightly +worse generated code, given ARC ABI definition of returning structs +(which pte_t would become) + +Quoting from ARC ABI... + + "Results of type struct are returned in a caller-supplied temporary + variable whose address is passed in r0. + For such functions, the arguments are shifted so that they are + passed in r1 and up." + +So + - struct to be returned would be allocated on stack requiring extra + code at call sites + - callee updates stack memory to facilitate the return (vs. simple + MOV into return reg r0) + +Hence STRICT_MM_TYPECHECKS is not enabled by default for ARC + +Signed-off-by: Vineet Gupta +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arc/include/asm/pgtable.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arc/include/asm/pgtable.h ++++ b/arch/arc/include/asm/pgtable.h +@@ -280,7 +280,7 @@ static inline void pmd_set(pmd_t *pmdp, + + #define pte_page(pte) pfn_to_page(pte_pfn(pte)) + #define mk_pte(page, prot) pfn_pte(page_to_pfn(page), prot) +-#define pfn_pte(pfn, prot) (__pte(((pte_t)(pfn) << PAGE_SHIFT) | pgprot_val(prot))) ++#define pfn_pte(pfn, prot) __pte(((pfn) << PAGE_SHIFT) | pgprot_val(prot)) + + /* Don't use virt_to_pfn for macros below: could cause truncations for PAE40*/ + #define pte_pfn(pte) (pte_val(pte) >> PAGE_SHIFT) diff --git a/queue-4.7/arc-use-correct-offset-in-pt_regs-for-saving-restoring-user-mode-r25.patch b/queue-4.7/arc-use-correct-offset-in-pt_regs-for-saving-restoring-user-mode-r25.patch new file mode 100644 index 00000000000..7813656dec3 --- /dev/null +++ b/queue-4.7/arc-use-correct-offset-in-pt_regs-for-saving-restoring-user-mode-r25.patch @@ -0,0 +1,48 @@ +From 86147e3cfa5e118b61e78f4f0bf29e920dcbd477 Mon Sep 17 00:00:00 2001 +From: Liav Rehana +Date: Tue, 16 Aug 2016 10:55:35 +0300 +Subject: ARC: use correct offset in pt_regs for saving/restoring user mode r25 + +From: Liav Rehana + +commit 86147e3cfa5e118b61e78f4f0bf29e920dcbd477 upstream. + +User mode callee regs are explicitly collected before signal delivery or +breakpoint trap. r25 is special for kernel as it serves as task pointer, +so user mode value is clobbered very early. It is saved in pt_regs where +generally only scratch (aka caller saved) regs are saved. + +The code to access the corresponding pt_regs location had a subtle bug as +it was using load/store with scaling of offset, whereas the offset was already +byte wise correct. So fix this by replacing LD.AS with a standard LD + +Signed-off-by: Liav Rehana +Reviewed-by: Alexey Brodkin +[vgupta: rewrote title and commit log] +Signed-off-by: Vineet Gupta +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arc/include/asm/entry.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arc/include/asm/entry.h ++++ b/arch/arc/include/asm/entry.h +@@ -142,7 +142,7 @@ + + #ifdef CONFIG_ARC_CURR_IN_REG + ; Retrieve orig r25 and save it with rest of callee_regs +- ld.as r12, [r12, PT_user_r25] ++ ld r12, [r12, PT_user_r25] + PUSH r12 + #else + PUSH r25 +@@ -198,7 +198,7 @@ + + ; SP is back to start of pt_regs + #ifdef CONFIG_ARC_CURR_IN_REG +- st.as r12, [sp, PT_user_r25] ++ st r12, [sp, PT_user_r25] + #endif + .endm + diff --git a/queue-4.7/arm64-avoid-tlb-conflict-with-config_randomize_base.patch b/queue-4.7/arm64-avoid-tlb-conflict-with-config_randomize_base.patch new file mode 100644 index 00000000000..79257a1f027 --- /dev/null +++ b/queue-4.7/arm64-avoid-tlb-conflict-with-config_randomize_base.patch @@ -0,0 +1,44 @@ +From fd363bd417ddb6103564c69cfcbd92d9a7877431 Mon Sep 17 00:00:00 2001 +From: Mark Rutland +Date: Wed, 24 Aug 2016 18:02:08 +0100 +Subject: arm64: avoid TLB conflict with CONFIG_RANDOMIZE_BASE + +From: Mark Rutland + +commit fd363bd417ddb6103564c69cfcbd92d9a7877431 upstream. + +When CONFIG_RANDOMIZE_BASE is selected, we modify the page tables to remap the +kernel at a newly-chosen VA range. We do this with the MMU disabled, but do not +invalidate TLBs prior to re-enabling the MMU with the new tables. Thus the old +mappings entries may still live in TLBs, and we risk violating +Break-Before-Make requirements, leading to TLB conflicts and/or other issues. + +We invalidate TLBs when we uninsall the idmap in early setup code, but prior to +this we are subject to issues relating to the Break-Before-Make violation. + +Avoid these issues by invalidating the TLBs before the new mappings can be +used by the hardware. + +Fixes: f80fb3a3d508 ("arm64: add support for kernel ASLR") +Acked-by: Ard Biesheuvel +Acked-by: Will Deacon +Signed-off-by: Mark Rutland +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/kernel/head.S | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/arm64/kernel/head.S ++++ b/arch/arm64/kernel/head.S +@@ -757,6 +757,9 @@ ENTRY(__enable_mmu) + isb + bl __create_page_tables // recreate kernel mapping + ++ tlbi vmalle1 // Remove any stale TLB entries ++ dsb nsh ++ + msr sctlr_el1, x19 // re-enable the MMU + isb + ic iallu // flush instructions fetched diff --git a/queue-4.7/arm64-dts-rockchip-add-reset-saradc-node-for-rk3368-socs.patch b/queue-4.7/arm64-dts-rockchip-add-reset-saradc-node-for-rk3368-socs.patch new file mode 100644 index 00000000000..d942cfa34fe --- /dev/null +++ b/queue-4.7/arm64-dts-rockchip-add-reset-saradc-node-for-rk3368-socs.patch @@ -0,0 +1,32 @@ +From 78ec79bfd59e126e1cb394302bfa531a420b3ecd Mon Sep 17 00:00:00 2001 +From: Caesar Wang +Date: Wed, 27 Jul 2016 22:24:06 +0800 +Subject: arm64: dts: rockchip: add reset saradc node for rk3368 SoCs + +From: Caesar Wang + +commit 78ec79bfd59e126e1cb394302bfa531a420b3ecd upstream. + +SARADC controller needs to be reset before programming it, otherwise +it will not function properly. + +Signed-off-by: Caesar Wang +Acked-by: Heiko Stuebner +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/boot/dts/rockchip/rk3368.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm64/boot/dts/rockchip/rk3368.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3368.dtsi +@@ -270,6 +270,8 @@ + #io-channel-cells = <1>; + clocks = <&cru SCLK_SARADC>, <&cru PCLK_SARADC>; + clock-names = "saradc", "apb_pclk"; ++ resets = <&cru SRST_SARADC>; ++ reset-names = "saradc-apb"; + status = "disabled"; + }; + diff --git a/queue-4.7/arm64-kernel-avoid-literal-load-of-virtual-address-with-mmu-off.patch b/queue-4.7/arm64-kernel-avoid-literal-load-of-virtual-address-with-mmu-off.patch new file mode 100644 index 00000000000..e182af559ba --- /dev/null +++ b/queue-4.7/arm64-kernel-avoid-literal-load-of-virtual-address-with-mmu-off.patch @@ -0,0 +1,52 @@ +From bc9f3d7788a88d080a30599bde68f383daf8f8a5 Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Wed, 17 Aug 2016 17:54:41 +0200 +Subject: arm64: kernel: avoid literal load of virtual address with MMU off + +From: Ard Biesheuvel + +commit bc9f3d7788a88d080a30599bde68f383daf8f8a5 upstream. + +Literal loads of virtual addresses are subject to runtime relocation when +CONFIG_RELOCATABLE=y, and given that the relocation routines run with the +MMU and caches enabled, literal loads of relocated values performed with +the MMU off are not guaranteed to return the latest value unless the +memory covering the literal is cleaned to the PoC explicitly. + +So defer the literal load until after the MMU has been enabled, just like +we do for primary_switch() and secondary_switch() in head.S. + +Fixes: 1e48ef7fcc37 ("arm64: add support for building vmlinux as a relocatable PIE binary") +Signed-off-by: Ard Biesheuvel +Acked-by: Mark Rutland +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/kernel/sleep.S | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/arch/arm64/kernel/sleep.S ++++ b/arch/arm64/kernel/sleep.S +@@ -101,12 +101,20 @@ ENTRY(cpu_resume) + bl el2_setup // if in EL2 drop to EL1 cleanly + /* enable the MMU early - so we can access sleep_save_stash by va */ + adr_l lr, __enable_mmu /* __cpu_setup will return here */ +- ldr x27, =_cpu_resume /* __enable_mmu will branch here */ ++ adr_l x27, _resume_switched /* __enable_mmu will branch here */ + adrp x25, idmap_pg_dir + adrp x26, swapper_pg_dir + b __cpu_setup + ENDPROC(cpu_resume) + ++ .pushsection ".idmap.text", "ax" ++_resume_switched: ++ ldr x8, =_cpu_resume ++ br x8 ++ENDPROC(_resume_switched) ++ .ltorg ++ .popsection ++ + ENTRY(_cpu_resume) + mrs x1, mpidr_el1 + adrp x8, mpidr_hash diff --git a/queue-4.7/arm64-kernel-fix-unmasked-debug-exceptions-when-restoring-mdscr_el1.patch b/queue-4.7/arm64-kernel-fix-unmasked-debug-exceptions-when-restoring-mdscr_el1.patch new file mode 100644 index 00000000000..3cfc925faab --- /dev/null +++ b/queue-4.7/arm64-kernel-fix-unmasked-debug-exceptions-when-restoring-mdscr_el1.patch @@ -0,0 +1,49 @@ +From 744c6c37cc18705d19e179622f927f5b781fe9cc Mon Sep 17 00:00:00 2001 +From: James Morse +Date: Fri, 26 Aug 2016 16:03:42 +0100 +Subject: arm64: kernel: Fix unmasked debug exceptions when restoring mdscr_el1 + +From: James Morse + +commit 744c6c37cc18705d19e179622f927f5b781fe9cc upstream. + +Changes to make the resume from cpu_suspend() code behave more like +secondary boot caused debug exceptions to be unmasked early by +__cpu_setup(). We then go on to restore mdscr_el1 in cpu_do_resume(), +potentially taking break or watch points based on uninitialised registers. + +Mask debug exceptions in cpu_do_resume(), which is specific to resume +from cpu_suspend(). Debug exceptions will be restored to their original +state by local_dbg_restore() in cpu_suspend(), which runs after +hw_breakpoint_restore() has re-initialised the other registers. + +Reported-by: Lorenzo Pieralisi +Fixes: cabe1c81ea5b ("arm64: Change cpu_resume() to enable mmu early then access sleep_sp by va") +Signed-off-by: James Morse +Acked-by: Will Deacon +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/mm/proc.S | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/arch/arm64/mm/proc.S ++++ b/arch/arm64/mm/proc.S +@@ -100,7 +100,16 @@ ENTRY(cpu_do_resume) + + msr tcr_el1, x8 + msr vbar_el1, x9 ++ ++ /* ++ * __cpu_setup() cleared MDSCR_EL1.MDE and friends, before unmasking ++ * debug exceptions. By restoring MDSCR_EL1 here, we may take a debug ++ * exception. Mask them until local_dbg_restore() in cpu_suspend() ++ * resets them. ++ */ ++ disable_dbg + msr mdscr_el1, x10 ++ + msr sctlr_el1, x12 + /* + * Restore oslsr_el1 by writing oslar_el1 diff --git a/queue-4.7/btrfs-don-t-create-or-leak-aliased-root-while-cleaning-up-orphans.patch b/queue-4.7/btrfs-don-t-create-or-leak-aliased-root-while-cleaning-up-orphans.patch new file mode 100644 index 00000000000..82a4b1dfcad --- /dev/null +++ b/queue-4.7/btrfs-don-t-create-or-leak-aliased-root-while-cleaning-up-orphans.patch @@ -0,0 +1,96 @@ +From 35bbb97fc898aeb874cb7c8b746f091caa359994 Mon Sep 17 00:00:00 2001 +From: Jeff Mahoney +Date: Wed, 17 Aug 2016 21:58:33 -0400 +Subject: btrfs: don't create or leak aliased root while cleaning up orphans + +From: Jeff Mahoney + +commit 35bbb97fc898aeb874cb7c8b746f091caa359994 upstream. + +commit 909c3a22da3 (Btrfs: fix loading of orphan roots leading to BUG_ON) +avoids the BUG_ON but can add an aliased root to the dead_roots list or +leak the root. + +Since we've already been loading roots into the radix tree, we should +use it before looking the root up on disk. + +Signed-off-by: Jeff Mahoney +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Chris Mason +Signed-off-by: Greg Kroah-Hartman + +--- + fs/btrfs/disk-io.c | 4 ++-- + fs/btrfs/disk-io.h | 2 ++ + fs/btrfs/root-tree.c | 27 ++++++++++++++++++--------- + 3 files changed, 22 insertions(+), 11 deletions(-) + +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -1626,8 +1626,8 @@ fail: + return ret; + } + +-static struct btrfs_root *btrfs_lookup_fs_root(struct btrfs_fs_info *fs_info, +- u64 root_id) ++struct btrfs_root *btrfs_lookup_fs_root(struct btrfs_fs_info *fs_info, ++ u64 root_id) + { + struct btrfs_root *root; + +--- a/fs/btrfs/disk-io.h ++++ b/fs/btrfs/disk-io.h +@@ -68,6 +68,8 @@ struct extent_buffer *btrfs_find_tree_bl + struct btrfs_root *btrfs_read_fs_root(struct btrfs_root *tree_root, + struct btrfs_key *location); + int btrfs_init_fs_root(struct btrfs_root *root); ++struct btrfs_root *btrfs_lookup_fs_root(struct btrfs_fs_info *fs_info, ++ u64 root_id); + int btrfs_insert_fs_root(struct btrfs_fs_info *fs_info, + struct btrfs_root *root); + void btrfs_free_fs_roots(struct btrfs_fs_info *fs_info); +--- a/fs/btrfs/root-tree.c ++++ b/fs/btrfs/root-tree.c +@@ -272,6 +272,23 @@ int btrfs_find_orphan_roots(struct btrfs + root_key.objectid = key.offset; + key.offset++; + ++ /* ++ * The root might have been inserted already, as before we look ++ * for orphan roots, log replay might have happened, which ++ * triggers a transaction commit and qgroup accounting, which ++ * in turn reads and inserts fs roots while doing backref ++ * walking. ++ */ ++ root = btrfs_lookup_fs_root(tree_root->fs_info, ++ root_key.objectid); ++ if (root) { ++ WARN_ON(!test_bit(BTRFS_ROOT_ORPHAN_ITEM_INSERTED, ++ &root->state)); ++ if (btrfs_root_refs(&root->root_item) == 0) ++ btrfs_add_dead_root(root); ++ continue; ++ } ++ + root = btrfs_read_fs_root(tree_root, &root_key); + err = PTR_ERR_OR_ZERO(root); + if (err && err != -ENOENT) { +@@ -310,16 +327,8 @@ int btrfs_find_orphan_roots(struct btrfs + set_bit(BTRFS_ROOT_ORPHAN_ITEM_INSERTED, &root->state); + + err = btrfs_insert_fs_root(root->fs_info, root); +- /* +- * The root might have been inserted already, as before we look +- * for orphan roots, log replay might have happened, which +- * triggers a transaction commit and qgroup accounting, which +- * in turn reads and inserts fs roots while doing backref +- * walking. +- */ +- if (err == -EEXIST) +- err = 0; + if (err) { ++ BUG_ON(err == -EEXIST); + btrfs_free_fs_root(root); + break; + } diff --git a/queue-4.7/btrfs-properly-track-when-rescan-worker-is-running.patch b/queue-4.7/btrfs-properly-track-when-rescan-worker-is-running.patch new file mode 100644 index 00000000000..497adc2b076 --- /dev/null +++ b/queue-4.7/btrfs-properly-track-when-rescan-worker-is-running.patch @@ -0,0 +1,89 @@ +From d2c609b834d62f1e91f1635a27dca29f7806d3d6 Mon Sep 17 00:00:00 2001 +From: Jeff Mahoney +Date: Mon, 15 Aug 2016 12:10:33 -0400 +Subject: btrfs: properly track when rescan worker is running + +From: Jeff Mahoney + +commit d2c609b834d62f1e91f1635a27dca29f7806d3d6 upstream. + +The qgroup_flags field is overloaded such that it reflects the on-disk +status of qgroups and the runtime state. The BTRFS_QGROUP_STATUS_FLAG_RESCAN +flag is used to indicate that a rescan operation is in progress, but if +the file system is unmounted while a rescan is running, the rescan +operation is paused. If the file system is then mounted read-only, +the flag will still be present but the rescan operation will not have +been resumed. When we go to umount, btrfs_qgroup_wait_for_completion +will see the flag and interpret it to mean that the rescan worker is +still running and will wait for a completion that will never come. + +This patch uses a separate flag to indicate when the worker is +running. The locking and state surrounding the qgroup rescan worker +needs a lot of attention beyond this patch but this is enough to +avoid a hung umount. + +Signed-off-by; Jeff Mahoney +Reviewed-by: Qu Wenruo +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman + +Signed-off-by: Chris Mason + +--- + fs/btrfs/ctree.h | 1 + + fs/btrfs/disk-io.c | 1 + + fs/btrfs/qgroup.c | 9 ++++++++- + 3 files changed, 10 insertions(+), 1 deletion(-) + +--- a/fs/btrfs/ctree.h ++++ b/fs/btrfs/ctree.h +@@ -1040,6 +1040,7 @@ struct btrfs_fs_info { + struct btrfs_workqueue *qgroup_rescan_workers; + struct completion qgroup_rescan_completion; + struct btrfs_work qgroup_rescan_work; ++ bool qgroup_rescan_running; /* protected by qgroup_rescan_lock */ + + /* filesystem state */ + unsigned long fs_state; +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -2306,6 +2306,7 @@ static void btrfs_init_qgroup(struct btr + fs_info->quota_enabled = 0; + fs_info->pending_quota_state = 0; + fs_info->qgroup_ulist = NULL; ++ fs_info->qgroup_rescan_running = false; + mutex_init(&fs_info->qgroup_rescan_lock); + } + +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -2302,6 +2302,10 @@ static void btrfs_qgroup_rescan_worker(s + int err = -ENOMEM; + int ret = 0; + ++ mutex_lock(&fs_info->qgroup_rescan_lock); ++ fs_info->qgroup_rescan_running = true; ++ mutex_unlock(&fs_info->qgroup_rescan_lock); ++ + path = btrfs_alloc_path(); + if (!path) + goto out; +@@ -2368,6 +2372,9 @@ out: + } + + done: ++ mutex_lock(&fs_info->qgroup_rescan_lock); ++ fs_info->qgroup_rescan_running = false; ++ mutex_unlock(&fs_info->qgroup_rescan_lock); + complete_all(&fs_info->qgroup_rescan_completion); + } + +@@ -2494,7 +2501,7 @@ int btrfs_qgroup_wait_for_completion(str + + mutex_lock(&fs_info->qgroup_rescan_lock); + spin_lock(&fs_info->qgroup_lock); +- running = fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_RESCAN; ++ running = fs_info->qgroup_rescan_running; + spin_unlock(&fs_info->qgroup_lock); + mutex_unlock(&fs_info->qgroup_rescan_lock); + diff --git a/queue-4.7/btrfs-waiting-on-qgroup-rescan-should-not-always-be-interruptible.patch b/queue-4.7/btrfs-waiting-on-qgroup-rescan-should-not-always-be-interruptible.patch new file mode 100644 index 00000000000..0a1e2aea703 --- /dev/null +++ b/queue-4.7/btrfs-waiting-on-qgroup-rescan-should-not-always-be-interruptible.patch @@ -0,0 +1,100 @@ +From d06f23d6a947c9abae41dc46be69a56baf36f436 Mon Sep 17 00:00:00 2001 +From: Jeff Mahoney +Date: Mon, 8 Aug 2016 22:08:06 -0400 +Subject: btrfs: waiting on qgroup rescan should not always be interruptible + +From: Jeff Mahoney + +commit d06f23d6a947c9abae41dc46be69a56baf36f436 upstream. + +We wait on qgroup rescan completion in three places: file system +shutdown, the quota disable ioctl, and the rescan wait ioctl. If the +user sends a signal while we're waiting, we continue happily along. This +is expected behavior for the rescan wait ioctl. It's racy in the shutdown +path but mostly works due to other unrelated synchronization points. +In the quota disable path, it Oopses the kernel pretty much immediately. + +Signed-off-by: Jeff Mahoney +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Chris Mason +Signed-off-by: Greg Kroah-Hartman + +--- + fs/btrfs/disk-io.c | 2 +- + fs/btrfs/ioctl.c | 2 +- + fs/btrfs/qgroup.c | 12 +++++++++--- + fs/btrfs/qgroup.h | 3 ++- + 4 files changed, 13 insertions(+), 6 deletions(-) + +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -3849,7 +3849,7 @@ void close_ctree(struct btrfs_root *root + smp_mb(); + + /* wait for the qgroup rescan worker to stop */ +- btrfs_qgroup_wait_for_completion(fs_info); ++ btrfs_qgroup_wait_for_completion(fs_info, false); + + /* wait for the uuid_scan task to finish */ + down(&fs_info->uuid_tree_rescan_sem); +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -5088,7 +5088,7 @@ static long btrfs_ioctl_quota_rescan_wai + if (!capable(CAP_SYS_ADMIN)) + return -EPERM; + +- return btrfs_qgroup_wait_for_completion(root->fs_info); ++ return btrfs_qgroup_wait_for_completion(root->fs_info, true); + } + + static long _btrfs_ioctl_set_received_subvol(struct file *file, +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -995,7 +995,7 @@ int btrfs_quota_disable(struct btrfs_tra + goto out; + fs_info->quota_enabled = 0; + fs_info->pending_quota_state = 0; +- btrfs_qgroup_wait_for_completion(fs_info); ++ btrfs_qgroup_wait_for_completion(fs_info, false); + spin_lock(&fs_info->qgroup_lock); + quota_root = fs_info->quota_root; + fs_info->quota_root = NULL; +@@ -2486,7 +2486,8 @@ btrfs_qgroup_rescan(struct btrfs_fs_info + return 0; + } + +-int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info) ++int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info, ++ bool interruptible) + { + int running; + int ret = 0; +@@ -2497,9 +2498,14 @@ int btrfs_qgroup_wait_for_completion(str + spin_unlock(&fs_info->qgroup_lock); + mutex_unlock(&fs_info->qgroup_rescan_lock); + +- if (running) ++ if (!running) ++ return 0; ++ ++ if (interruptible) + ret = wait_for_completion_interruptible( + &fs_info->qgroup_rescan_completion); ++ else ++ wait_for_completion(&fs_info->qgroup_rescan_completion); + + return ret; + } +--- a/fs/btrfs/qgroup.h ++++ b/fs/btrfs/qgroup.h +@@ -46,7 +46,8 @@ int btrfs_quota_disable(struct btrfs_tra + struct btrfs_fs_info *fs_info); + int btrfs_qgroup_rescan(struct btrfs_fs_info *fs_info); + void btrfs_qgroup_rescan_resume(struct btrfs_fs_info *fs_info); +-int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info); ++int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info, ++ bool interruptible); + int btrfs_add_qgroup_relation(struct btrfs_trans_handle *trans, + struct btrfs_fs_info *fs_info, u64 src, u64 dst); + int btrfs_del_qgroup_relation(struct btrfs_trans_handle *trans, diff --git a/queue-4.7/cdc-acm-fix-wrong-pipe-type-on-rx-interrupt-xfers.patch b/queue-4.7/cdc-acm-fix-wrong-pipe-type-on-rx-interrupt-xfers.patch new file mode 100644 index 00000000000..fdd86e88754 --- /dev/null +++ b/queue-4.7/cdc-acm-fix-wrong-pipe-type-on-rx-interrupt-xfers.patch @@ -0,0 +1,57 @@ +From add125054b8727103631dce116361668436ef6a7 Mon Sep 17 00:00:00 2001 +From: Gavin Li +Date: Fri, 12 Aug 2016 00:52:56 -0700 +Subject: cdc-acm: fix wrong pipe type on rx interrupt xfers + +From: Gavin Li + +commit add125054b8727103631dce116361668436ef6a7 upstream. + +This fixes the "BOGUS urb xfer" warning logged by usb_submit_urb(). + +Signed-off-by: Gavin Li +Acked-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-acm.c | 5 ++--- + drivers/usb/class/cdc-acm.h | 1 - + 2 files changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1405,7 +1405,6 @@ made_compressed_probe: + spin_lock_init(&acm->write_lock); + spin_lock_init(&acm->read_lock); + mutex_init(&acm->mutex); +- acm->rx_endpoint = usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress); + acm->is_int_ep = usb_endpoint_xfer_int(epread); + if (acm->is_int_ep) + acm->bInterval = epread->bInterval; +@@ -1445,14 +1444,14 @@ made_compressed_probe: + urb->transfer_dma = rb->dma; + if (acm->is_int_ep) { + usb_fill_int_urb(urb, acm->dev, +- acm->rx_endpoint, ++ usb_rcvintpipe(usb_dev, epread->bEndpointAddress), + rb->base, + acm->readsize, + acm_read_bulk_callback, rb, + acm->bInterval); + } else { + usb_fill_bulk_urb(urb, acm->dev, +- acm->rx_endpoint, ++ usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress), + rb->base, + acm->readsize, + acm_read_bulk_callback, rb); +--- a/drivers/usb/class/cdc-acm.h ++++ b/drivers/usb/class/cdc-acm.h +@@ -96,7 +96,6 @@ struct acm { + struct acm_rb read_buffers[ACM_NR]; + struct acm_wb *putbuffer; /* for acm_tty_put_char() */ + int rx_buflimit; +- int rx_endpoint; + spinlock_t read_lock; + int write_used; /* number of non-empty write buffers */ + int transmitting; diff --git a/queue-4.7/dax-fix-device-dax-region-base.patch b/queue-4.7/dax-fix-device-dax-region-base.patch new file mode 100644 index 00000000000..73cbdc24b32 --- /dev/null +++ b/queue-4.7/dax-fix-device-dax-region-base.patch @@ -0,0 +1,57 @@ +From d0e5845561c238619de9f5b77e0d763f4c331ca5 Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Thu, 25 Aug 2016 15:17:14 -0700 +Subject: dax: fix device-dax region base + +From: Dan Williams + +commit d0e5845561c238619de9f5b77e0d763f4c331ca5 upstream. + +The data offset for a dax region needs to account for a reservation in +the resource range. Otherwise, device-dax is allowing mappings directly +into the memmap or device-info-block area with crash signatures like the +following: + + BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 + IP: get_zone_device_page+0x11/0x30 + Call Trace: + follow_devmap_pmd+0x298/0x2c0 + follow_page_mask+0x275/0x530 + __get_user_pages+0xe3/0x750 + __gfn_to_pfn_memslot+0x1b2/0x450 [kvm] + tdp_page_fault+0x130/0x280 [kvm] + kvm_mmu_page_fault+0x5f/0xf0 [kvm] + handle_ept_violation+0x94/0x180 [kvm_intel] + vmx_handle_exit+0x1d3/0x1440 [kvm_intel] + kvm_arch_vcpu_ioctl_run+0x81d/0x16a0 [kvm] + kvm_vcpu_ioctl+0x33c/0x620 [kvm] + do_vfs_ioctl+0xa2/0x5d0 + SyS_ioctl+0x79/0x90 + entry_SYSCALL_64_fastpath+0x1a/0xa4 + +Fixes: ab68f2622136 ("/dev/dax, pmem: direct access to persistent memory") +Link: http://lkml.kernel.org/r/147205536732.1606.8994275381938837346.stgit@dwillia2-desk3.amr.corp.intel.com +Signed-off-by: Dan Williams +Reported-by: Abhilash Kumar Mulumudi +Reported-by: Toshi Kani +Tested-by: Toshi Kani +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dax/pmem.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/dax/pmem.c ++++ b/drivers/dax/pmem.c +@@ -118,6 +118,9 @@ static int dax_pmem_probe(struct device + return rc; + } + ++ /* adjust the dax_region resource to the start of data */ ++ res.start += le64_to_cpu(pfn_sb->dataoff); ++ + nd_region = to_nd_region(dev->parent); + dax_region = alloc_dax_region(dev, nd_region->id, &res, + le32_to_cpu(pfn_sb->align), addr, PFN_DEV|PFN_MAP); diff --git a/queue-4.7/dm-round-robin-do-not-use-this_cpu_ptr-without-having-preemption-disabled.patch b/queue-4.7/dm-round-robin-do-not-use-this_cpu_ptr-without-having-preemption-disabled.patch new file mode 100644 index 00000000000..796cfdeab82 --- /dev/null +++ b/queue-4.7/dm-round-robin-do-not-use-this_cpu_ptr-without-having-preemption-disabled.patch @@ -0,0 +1,44 @@ +From 802934b2cfde463b72cc1b9bc1c081895a90be53 Mon Sep 17 00:00:00 2001 +From: Mike Snitzer +Date: Fri, 5 Aug 2016 12:29:06 -0400 +Subject: dm round robin: do not use this_cpu_ptr() without having preemption disabled + +From: Mike Snitzer + +commit 802934b2cfde463b72cc1b9bc1c081895a90be53 upstream. + +Use local_irq_save() to disable preemption before calling +this_cpu_ptr(). + +Reported-by: Benjamin Block +Fixes: b0b477c7e0dd ("dm round robin: use percpu 'repeat_count' and 'current_path'") +Suggested-by: Jens Axboe +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-round-robin.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/md/dm-round-robin.c ++++ b/drivers/md/dm-round-robin.c +@@ -210,14 +210,17 @@ static struct dm_path *rr_select_path(st + struct path_info *pi = NULL; + struct dm_path *current_path = NULL; + ++ local_irq_save(flags); + current_path = *this_cpu_ptr(s->current_path); + if (current_path) { + percpu_counter_dec(&s->repeat_count); +- if (percpu_counter_read_positive(&s->repeat_count) > 0) ++ if (percpu_counter_read_positive(&s->repeat_count) > 0) { ++ local_irq_restore(flags); + return current_path; ++ } + } + +- spin_lock_irqsave(&s->lock, flags); ++ spin_lock(&s->lock); + if (!list_empty(&s->valid_paths)) { + pi = list_entry(s->valid_paths.next, struct path_info, list); + list_move_tail(&pi->list, &s->valid_paths); diff --git a/queue-4.7/drm-amd-amdgpu-compute-ring-test-fail-during-s4-on-ci.patch b/queue-4.7/drm-amd-amdgpu-compute-ring-test-fail-during-s4-on-ci.patch new file mode 100644 index 00000000000..3d5f81f3f95 --- /dev/null +++ b/queue-4.7/drm-amd-amdgpu-compute-ring-test-fail-during-s4-on-ci.patch @@ -0,0 +1,55 @@ +From 53960b4f89db58bc155d6f8aa0a44ccc59ccb26f Mon Sep 17 00:00:00 2001 +From: jimqu +Date: Tue, 30 Aug 2016 09:03:16 +0800 +Subject: drm/amd/amdgpu: compute ring test fail during S4 on CI + +From: jimqu + +commit 53960b4f89db58bc155d6f8aa0a44ccc59ccb26f upstream. + +unhalt Instrction Fetch Unit after all rings are inited. + +Signed-off-by: JimQu +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c +@@ -2777,8 +2777,7 @@ static int gfx_v7_0_cp_compute_resume(st + u64 wb_gpu_addr; + u32 *buf; + struct bonaire_mqd *mqd; +- +- gfx_v7_0_cp_compute_enable(adev, true); ++ struct amdgpu_ring *ring; + + /* fix up chicken bits */ + tmp = RREG32(mmCP_CPF_DEBUG); +@@ -2813,7 +2812,7 @@ static int gfx_v7_0_cp_compute_resume(st + + /* init the queues. Just two for now. */ + for (i = 0; i < adev->gfx.num_compute_rings; i++) { +- struct amdgpu_ring *ring = &adev->gfx.compute_ring[i]; ++ ring = &adev->gfx.compute_ring[i]; + + if (ring->mqd_obj == NULL) { + r = amdgpu_bo_create(adev, +@@ -2992,6 +2991,13 @@ static int gfx_v7_0_cp_compute_resume(st + amdgpu_bo_unreserve(ring->mqd_obj); + + ring->ready = true; ++ } ++ ++ gfx_v7_0_cp_compute_enable(adev, true); ++ ++ for (i = 0; i < adev->gfx.num_compute_rings; i++) { ++ ring = &adev->gfx.compute_ring[i]; ++ + r = amdgpu_ring_test_ring(ring); + if (r) + ring->ready = false; diff --git a/queue-4.7/drm-amd-amdgpu-sdma-resume-fail-during-s4-on-ci.patch b/queue-4.7/drm-amd-amdgpu-sdma-resume-fail-during-s4-on-ci.patch new file mode 100644 index 00000000000..f9dbec04799 --- /dev/null +++ b/queue-4.7/drm-amd-amdgpu-sdma-resume-fail-during-s4-on-ci.patch @@ -0,0 +1,40 @@ +From 10ea9434065e56fe14287f89258ecf2fb684ed1a Mon Sep 17 00:00:00 2001 +From: jimqu +Date: Tue, 30 Aug 2016 08:59:42 +0800 +Subject: drm/amd/amdgpu: sdma resume fail during S4 on CI + +From: jimqu + +commit 10ea9434065e56fe14287f89258ecf2fb684ed1a upstream. + +SDMA could be fail in the thaw() and restore() processes, do software reset +if each SDMA engine is busy. + +Signed-off-by: JimQu +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/cik_sdma.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c ++++ b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c +@@ -52,6 +52,7 @@ static void cik_sdma_set_ring_funcs(stru + static void cik_sdma_set_irq_funcs(struct amdgpu_device *adev); + static void cik_sdma_set_buffer_funcs(struct amdgpu_device *adev); + static void cik_sdma_set_vm_pte_funcs(struct amdgpu_device *adev); ++static int cik_sdma_soft_reset(void *handle); + + MODULE_FIRMWARE("radeon/bonaire_sdma.bin"); + MODULE_FIRMWARE("radeon/bonaire_sdma1.bin"); +@@ -1051,6 +1052,8 @@ static int cik_sdma_resume(void *handle) + { + struct amdgpu_device *adev = (struct amdgpu_device *)handle; + ++ cik_sdma_soft_reset(handle); ++ + return cik_sdma_hw_init(adev); + } + diff --git a/queue-4.7/drm-amdgpu-avoid-a-possible-array-overflow.patch b/queue-4.7/drm-amdgpu-avoid-a-possible-array-overflow.patch new file mode 100644 index 00000000000..4507267fcbd --- /dev/null +++ b/queue-4.7/drm-amdgpu-avoid-a-possible-array-overflow.patch @@ -0,0 +1,42 @@ +From e1718d97aa88ea44a6a8f50ff464253dd0dacf01 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 24 Aug 2016 12:31:36 -0400 +Subject: drm/amdgpu: avoid a possible array overflow +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +commit e1718d97aa88ea44a6a8f50ff464253dd0dacf01 upstream. + +When looking up the connector type make sure the index +is valid. Avoids a later crash if we read past the end +of the array. + +Workaround for bug: +https://bugs.freedesktop.org/show_bug.cgi?id=97460 + +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c +@@ -321,6 +321,12 @@ bool amdgpu_atombios_get_connector_info_ + (le16_to_cpu(path->usConnObjectId) & + OBJECT_TYPE_MASK) >> OBJECT_TYPE_SHIFT; + ++ if (con_obj_id >= ARRAY_SIZE(object_connector_convert)) { ++ DRM_ERROR("invalid con_obj_id %d for device tag 0x%04x\n", ++ con_obj_id, le16_to_cpu(path->usDeviceTag)); ++ continue; ++ } ++ + connector_type = + object_connector_convert[con_obj_id]; + connector_object_id = con_obj_id; diff --git a/queue-4.7/drm-amdgpu-change-gart-offset-to-64-bit.patch b/queue-4.7/drm-amdgpu-change-gart-offset-to-64-bit.patch new file mode 100644 index 00000000000..ad4666be898 --- /dev/null +++ b/queue-4.7/drm-amdgpu-change-gart-offset-to-64-bit.patch @@ -0,0 +1,60 @@ +From cab0b8d50e9bbef62c04067072c953433a87a9ff Mon Sep 17 00:00:00 2001 +From: Felix Kuehling +Date: Fri, 12 Aug 2016 19:25:21 -0400 +Subject: drm/amdgpu: Change GART offset to 64-bit +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Felix Kuehling + +commit cab0b8d50e9bbef62c04067072c953433a87a9ff upstream. + +The GART aperture size can be bigger than 4GB. Therefore the offset +used in amdgpu_gart_bind and amdgpu_gart_unbind must be 64-bit. + +Reviewed-by: Christian König +Signed-off-by: Felix Kuehling +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu.h | 4 ++-- + drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h +@@ -637,9 +637,9 @@ int amdgpu_gart_table_vram_pin(struct am + void amdgpu_gart_table_vram_unpin(struct amdgpu_device *adev); + int amdgpu_gart_init(struct amdgpu_device *adev); + void amdgpu_gart_fini(struct amdgpu_device *adev); +-void amdgpu_gart_unbind(struct amdgpu_device *adev, unsigned offset, ++void amdgpu_gart_unbind(struct amdgpu_device *adev, uint64_t offset, + int pages); +-int amdgpu_gart_bind(struct amdgpu_device *adev, unsigned offset, ++int amdgpu_gart_bind(struct amdgpu_device *adev, uint64_t offset, + int pages, struct page **pagelist, + dma_addr_t *dma_addr, uint32_t flags); + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c +@@ -221,7 +221,7 @@ void amdgpu_gart_table_vram_free(struct + * Unbinds the requested pages from the gart page table and + * replaces them with the dummy page (all asics). + */ +-void amdgpu_gart_unbind(struct amdgpu_device *adev, unsigned offset, ++void amdgpu_gart_unbind(struct amdgpu_device *adev, uint64_t offset, + int pages) + { + unsigned t; +@@ -268,7 +268,7 @@ void amdgpu_gart_unbind(struct amdgpu_de + * (all asics). + * Returns 0 for success, -EINVAL for failure. + */ +-int amdgpu_gart_bind(struct amdgpu_device *adev, unsigned offset, ++int amdgpu_gart_bind(struct amdgpu_device *adev, uint64_t offset, + int pages, struct page **pagelist, dma_addr_t *dma_addr, + uint32_t flags) + { diff --git a/queue-4.7/drm-amdgpu-fix-amdgpu_move_blit-on-32bit-systems.patch b/queue-4.7/drm-amdgpu-fix-amdgpu_move_blit-on-32bit-systems.patch new file mode 100644 index 00000000000..89a4e5cbafa --- /dev/null +++ b/queue-4.7/drm-amdgpu-fix-amdgpu_move_blit-on-32bit-systems.patch @@ -0,0 +1,36 @@ +From 815d27a46f3119f74fe01fe10bf683aa5bc55597 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20K=C3=B6nig?= +Date: Wed, 17 Aug 2016 09:45:25 +0200 +Subject: drm/amdgpu: fix amdgpu_move_blit on 32bit systems +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian König + +commit 815d27a46f3119f74fe01fe10bf683aa5bc55597 upstream. + +This bug seems to be present for a very long time. + +Signed-off-by: Christian König +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +@@ -251,8 +251,8 @@ static int amdgpu_move_blit(struct ttm_b + + adev = amdgpu_get_adev(bo->bdev); + ring = adev->mman.buffer_funcs_ring; +- old_start = old_mem->start << PAGE_SHIFT; +- new_start = new_mem->start << PAGE_SHIFT; ++ old_start = (u64)old_mem->start << PAGE_SHIFT; ++ new_start = (u64)new_mem->start << PAGE_SHIFT; + + switch (old_mem->mem_type) { + case TTM_PL_VRAM: diff --git a/queue-4.7/drm-amdgpu-fix-lru-size-grouping-v2.patch b/queue-4.7/drm-amdgpu-fix-lru-size-grouping-v2.patch new file mode 100644 index 00000000000..3f59592d6d1 --- /dev/null +++ b/queue-4.7/drm-amdgpu-fix-lru-size-grouping-v2.patch @@ -0,0 +1,69 @@ +From 5661538749511d4c2f7d33e1e179f10c545b24d5 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20K=C3=B6nig?= +Date: Wed, 17 Aug 2016 13:44:20 +0200 +Subject: drm/amdgpu: fix lru size grouping v2 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian König + +commit 5661538749511d4c2f7d33e1e179f10c545b24d5 upstream. + +Adding a BO can make it the insertion point for larger sizes as well. + +v2: add a comment about the guard structure. + +Signed-off-by: Christian König +Reviewed-by: Alex Deucher +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu.h | 2 ++ + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 8 ++++++++ + 2 files changed, 10 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h +@@ -415,6 +415,8 @@ struct amdgpu_mman { + + /* custom LRU management */ + struct amdgpu_mman_lru log2_size[AMDGPU_TTM_LRU_SIZE]; ++ /* guard for log2_size array, don't add anything in between */ ++ struct amdgpu_mman_lru guard; + }; + + int amdgpu_copy_buffer(struct amdgpu_ring *ring, +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +@@ -943,6 +943,8 @@ static struct list_head *amdgpu_ttm_lru_ + struct list_head *res = lru->lru[tbo->mem.mem_type]; + + lru->lru[tbo->mem.mem_type] = &tbo->lru; ++ while ((++lru)->lru[tbo->mem.mem_type] == res) ++ lru->lru[tbo->mem.mem_type] = &tbo->lru; + + return res; + } +@@ -953,6 +955,8 @@ static struct list_head *amdgpu_ttm_swap + struct list_head *res = lru->swap_lru; + + lru->swap_lru = &tbo->swap; ++ while ((++lru)->swap_lru == res) ++ lru->swap_lru = &tbo->swap; + + return res; + } +@@ -1004,6 +1008,10 @@ int amdgpu_ttm_init(struct amdgpu_device + lru->swap_lru = &adev->mman.bdev.glob->swap_lru; + } + ++ for (j = 0; j < TTM_NUM_MEM_TYPES; ++j) ++ adev->mman.guard.lru[j] = NULL; ++ adev->mman.guard.swap_lru = NULL; ++ + adev->mman.initialized = true; + r = ttm_bo_init_mm(&adev->mman.bdev, TTM_PL_VRAM, + adev->mc.real_vram_size >> PAGE_SHIFT); diff --git a/queue-4.7/drm-amdgpu-record-error-code-when-ring-test-failed.patch b/queue-4.7/drm-amdgpu-record-error-code-when-ring-test-failed.patch new file mode 100644 index 00000000000..e75d4d1ec73 --- /dev/null +++ b/queue-4.7/drm-amdgpu-record-error-code-when-ring-test-failed.patch @@ -0,0 +1,48 @@ +From 1f703e6679f373f5bba4efe7093aa82e91af4037 Mon Sep 17 00:00:00 2001 +From: Chunming Zhou +Date: Tue, 30 Aug 2016 17:59:11 +0800 +Subject: drm/amdgpu: record error code when ring test failed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chunming Zhou + +commit 1f703e6679f373f5bba4efe7093aa82e91af4037 upstream. + +Otherwise we may miss errors. + +Signed-off-by: Chunming Zhou +Reviewed-by: Christian König +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c +@@ -288,7 +288,7 @@ void amdgpu_ib_pool_fini(struct amdgpu_d + int amdgpu_ib_ring_tests(struct amdgpu_device *adev) + { + unsigned i; +- int r; ++ int r, ret = 0; + + for (i = 0; i < AMDGPU_MAX_RINGS; ++i) { + struct amdgpu_ring *ring = adev->rings[i]; +@@ -309,10 +309,11 @@ int amdgpu_ib_ring_tests(struct amdgpu_d + } else { + /* still not good, but we can live with it */ + DRM_ERROR("amdgpu: failed testing IB on ring %d (%d).\n", i, r); ++ ret = r; + } + } + } +- return 0; ++ return ret; + } + + /* diff --git a/queue-4.7/drm-amdgpu-skip-tv-cv-in-display-parsing.patch b/queue-4.7/drm-amdgpu-skip-tv-cv-in-display-parsing.patch new file mode 100644 index 00000000000..9478b43d183 --- /dev/null +++ b/queue-4.7/drm-amdgpu-skip-tv-cv-in-display-parsing.patch @@ -0,0 +1,41 @@ +From 611a1507fe8569ce1adab3abc982ea58ab559fb9 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 24 Aug 2016 13:04:15 -0400 +Subject: drm/amdgpu: skip TV/CV in display parsing +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +commit 611a1507fe8569ce1adab3abc982ea58ab559fb9 upstream. + +No asics supported by amdgpu support analog TV. + +Workaround for bug: +https://bugs.freedesktop.org/show_bug.cgi?id=97460 + +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c +@@ -321,6 +321,13 @@ bool amdgpu_atombios_get_connector_info_ + (le16_to_cpu(path->usConnObjectId) & + OBJECT_TYPE_MASK) >> OBJECT_TYPE_SHIFT; + ++ /* Skip TV/CV support */ ++ if ((le16_to_cpu(path->usDeviceTag) == ++ ATOM_DEVICE_TV1_SUPPORT) || ++ (le16_to_cpu(path->usDeviceTag) == ++ ATOM_DEVICE_CV_SUPPORT)) ++ continue; ++ + if (con_obj_id >= ARRAY_SIZE(object_connector_convert)) { + DRM_ERROR("invalid con_obj_id %d for device tag 0x%04x\n", + con_obj_id, le16_to_cpu(path->usDeviceTag)); diff --git a/queue-4.7/drm-i915-acquire-audio-powerwell-for-hd-audio-registers.patch b/queue-4.7/drm-i915-acquire-audio-powerwell-for-hd-audio-registers.patch new file mode 100644 index 00000000000..f890c1ff6b0 --- /dev/null +++ b/queue-4.7/drm-i915-acquire-audio-powerwell-for-hd-audio-registers.patch @@ -0,0 +1,75 @@ +From 3cffb0a44750726cdc1cc07399efe3cbb45e028b Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Wed, 3 Aug 2016 17:09:00 +0100 +Subject: drm/i915: Acquire audio powerwell for HD-Audio registers + +From: Chris Wilson + +commit 3cffb0a44750726cdc1cc07399efe3cbb45e028b upstream. + +On Haswell/Broadwell, the HD-Audio block is inside the HDMI/display +power well and so the sna-hda audio codec acquires the display power +well while it is operational. However, Skylake separates the powerwells +again, but yet we still need the audio powerwell to setup the registers. +(But then the hardware uses those registers even while powered off???) + +Acquiring the powerwell around setting the chicken bits when setting up +the audio channel does at least silence the WARNs from touching our +registers whilst unpowered. We silence our own test cases, but maybe +there is a latent bug in using the audio channel? + +v2: Grab both rpm wakelock and audio wakelock + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=96214 +Fixes: 03b135cebc47 "ALSA: hda - remove dependency on i915 power well for SKL") +Signed-off-by: Chris Wilson +Cc: Libin Yang +Cc: Takashi Iwai +Cc: Marius Vlad +Tested-by: Hans de Goede +Link: http://patchwork.freedesktop.org/patch/msgid/1470240540-29004-1-git-send-email-chris@chris-wilson.co.uk +Reviewed-by: Daniel Vetter +(cherry picked from commit d838a110f0b310d408ebe6b5a97e36ec27555ebf) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_audio.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/gpu/drm/i915/intel_audio.c ++++ b/drivers/gpu/drm/i915/intel_audio.c +@@ -600,6 +600,8 @@ static void i915_audio_component_codec_w + if (!IS_SKYLAKE(dev_priv) && !IS_KABYLAKE(dev_priv)) + return; + ++ i915_audio_component_get_power(dev); ++ + /* + * Enable/disable generating the codec wake signal, overriding the + * internal logic to generate the codec wake to controller. +@@ -615,6 +617,8 @@ static void i915_audio_component_codec_w + I915_WRITE(HSW_AUD_CHICKENBIT, tmp); + usleep_range(1000, 1500); + } ++ ++ i915_audio_component_put_power(dev); + } + + /* Get CDCLK in kHz */ +@@ -654,6 +658,7 @@ static int i915_audio_component_sync_aud + !IS_HASWELL(dev_priv)) + return 0; + ++ i915_audio_component_get_power(dev); + mutex_lock(&dev_priv->av_mutex); + /* 1. get the pipe */ + intel_encoder = dev_priv->dig_port_map[port]; +@@ -704,6 +709,7 @@ static int i915_audio_component_sync_aud + + unlock: + mutex_unlock(&dev_priv->av_mutex); ++ i915_audio_component_put_power(dev); + return err; + } + diff --git a/queue-4.7/drm-i915-enable-polling-when-we-don-t-have-hpd.patch b/queue-4.7/drm-i915-enable-polling-when-we-don-t-have-hpd.patch new file mode 100644 index 00000000000..2ee89c7a92f --- /dev/null +++ b/queue-4.7/drm-i915-enable-polling-when-we-don-t-have-hpd.patch @@ -0,0 +1,264 @@ +From 84c8e0963da434d37355079b568465cd121af295 Mon Sep 17 00:00:00 2001 +From: Lyude +Date: Tue, 21 Jun 2016 17:03:44 -0400 +Subject: drm/i915: Enable polling when we don't have hpd +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lyude + +commit 84c8e0963da434d37355079b568465cd121af295 upstream. + +Unfortunately, there's two situations where we lose hpd right now: +- Runtime suspend +- When we've shut off all of the power wells on Valleyview/Cherryview + +While it would be nice if this didn't cause issues, this has the +ability to get us in some awkward states where a user won't be able to +get their display to turn on. For instance; if we boot a Valleyview +system without any monitors connected, it won't need any of it's power +wells and thus shut them off. Since this causes us to lose HPD, this +means that unless the user knows how to ssh into their machine and do a +manual reprobe for monitors, none of the monitors they connect after +booting will actually work. + +Eventually we should come up with a better fix then having to enable +polling for this, since this makes rpm a lot less useful, but for now +the infrastructure in i915 just isn't there yet to get hpd in these +situations. + +Changes since v1: + - Add comment explaining the addition of the if + (!mode_config->poll_running) in intel_hpd_init() + - Remove unneeded if (!dev->mode_config.poll_enabled) in + i915_hpd_poll_init_work() + - Call to drm_helper_hpd_irq_event() after we disable polling + - Add cancel_work_sync() call to intel_hpd_cancel_work() + +Changes since v2: + - Apparently dev->mode_config.poll_running doesn't actually reflect + whether or not a poll is currently in progress, and is actually used + for dynamic module paramter enabling/disabling. So now we instead + keep track of our own poll_running variable in dev_priv->hotplug + - Clean i915_hpd_poll_init_work() a little bit + +Changes since v3: + - Remove the now-redundant connector loop in intel_hpd_init(), just + rely on intel_hpd_poll_enable() for setting connector->polled + correctly on each connector + - Get rid of poll_running + - Don't assign enabled in i915_hpd_poll_init_work before we actually + lock dev->mode_config.mutex + - Wrap enabled assignment in i915_hpd_poll_init_work() in READ_ONCE() + for doc purposes + - Do the same for dev_priv->hotplug.poll_enabled with WRITE_ONCE in + intel_hpd_poll_enable() + - Add some comments about racing not mattering in intel_hpd_poll_enable + +Changes since v4: + - Rename intel_hpd_poll_enable() to intel_hpd_poll_init() + - Drop the bool argument from intel_hpd_poll_init() + - Remove redundant calls to intel_hpd_poll_init() + - Rename poll_enable_work to poll_init_work + - Add some kerneldoc for intel_hpd_poll_init() + - Cross-reference intel_hpd_poll_init() in intel_hpd_init() + - Just copy the loop from intel_hpd_init() in intel_hpd_poll_init() + +Changes since v5: + - Minor kerneldoc nitpicks + +Cc: stable@vger.kernel.org +Cc: Ville Syrjälä +Reviewed-by: Daniel Vetter +Signed-off-by: Lyude +Signed-off-by: Daniel Vetter +(cherry picked from commit 19625e85c6ec56038368aa72c44f5f55b221f0fc) +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/i915_drv.c | 3 + + drivers/gpu/drm/i915/i915_drv.h | 3 + + drivers/gpu/drm/i915/intel_drv.h | 2 + drivers/gpu/drm/i915/intel_hotplug.c | 90 +++++++++++++++++++++++++++----- + drivers/gpu/drm/i915/intel_runtime_pm.c | 2 + 5 files changed, 88 insertions(+), 12 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_drv.c ++++ b/drivers/gpu/drm/i915/i915_drv.c +@@ -1578,6 +1578,9 @@ static int intel_runtime_suspend(struct + + assert_forcewakes_inactive(dev_priv); + ++ if (!IS_VALLEYVIEW(dev_priv) || !IS_CHERRYVIEW(dev_priv)) ++ intel_hpd_poll_init(dev_priv); ++ + DRM_DEBUG_KMS("Device suspended\n"); + return 0; + } +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -281,6 +281,9 @@ struct i915_hotplug { + u32 short_port_mask; + struct work_struct dig_port_work; + ++ struct work_struct poll_init_work; ++ bool poll_enabled; ++ + /* + * if we get a HPD irq from DP and a HPD irq from non-DP + * the non-DP HPD could block the workqueue on a mode config +--- a/drivers/gpu/drm/i915/intel_drv.h ++++ b/drivers/gpu/drm/i915/intel_drv.h +@@ -1346,6 +1346,8 @@ void intel_dsi_init(struct drm_device *d + + /* intel_dvo.c */ + void intel_dvo_init(struct drm_device *dev); ++/* intel_hotplug.c */ ++void intel_hpd_poll_init(struct drm_i915_private *dev_priv); + + + /* legacy fbdev emulation in intel_fbdev.c */ +--- a/drivers/gpu/drm/i915/intel_hotplug.c ++++ b/drivers/gpu/drm/i915/intel_hotplug.c +@@ -453,20 +453,47 @@ void intel_hpd_irq_handler(struct drm_de + * + * This is a separate step from interrupt enabling to simplify the locking rules + * in the driver load and resume code. ++ * ++ * Also see: intel_hpd_poll_init(), which enables connector polling + */ + void intel_hpd_init(struct drm_i915_private *dev_priv) + { +- struct drm_device *dev = dev_priv->dev; +- struct drm_mode_config *mode_config = &dev->mode_config; +- struct drm_connector *connector; + int i; + + for_each_hpd_pin(i) { + dev_priv->hotplug.stats[i].count = 0; + dev_priv->hotplug.stats[i].state = HPD_ENABLED; + } ++ ++ WRITE_ONCE(dev_priv->hotplug.poll_enabled, false); ++ schedule_work(&dev_priv->hotplug.poll_init_work); ++ ++ /* ++ * Interrupt setup is already guaranteed to be single-threaded, this is ++ * just to make the assert_spin_locked checks happy. ++ */ ++ spin_lock_irq(&dev_priv->irq_lock); ++ if (dev_priv->display.hpd_irq_setup) ++ dev_priv->display.hpd_irq_setup(dev_priv->dev); ++ spin_unlock_irq(&dev_priv->irq_lock); ++} ++ ++void i915_hpd_poll_init_work(struct work_struct *work) { ++ struct drm_i915_private *dev_priv = ++ container_of(work, struct drm_i915_private, ++ hotplug.poll_init_work); ++ struct drm_device *dev = dev_priv->dev; ++ struct drm_mode_config *mode_config = &dev->mode_config; ++ struct drm_connector *connector; ++ bool enabled; ++ ++ mutex_lock(&dev->mode_config.mutex); ++ ++ enabled = READ_ONCE(dev_priv->hotplug.poll_enabled); ++ + list_for_each_entry(connector, &mode_config->connector_list, head) { +- struct intel_connector *intel_connector = to_intel_connector(connector); ++ struct intel_connector *intel_connector = ++ to_intel_connector(connector); + connector->polled = intel_connector->polled; + + /* MST has a dynamic intel_connector->encoder and it's reprobing +@@ -475,24 +502,62 @@ void intel_hpd_init(struct drm_i915_priv + continue; + + if (!connector->polled && I915_HAS_HOTPLUG(dev) && +- intel_connector->encoder->hpd_pin > HPD_NONE) +- connector->polled = DRM_CONNECTOR_POLL_HPD; ++ intel_connector->encoder->hpd_pin > HPD_NONE) { ++ connector->polled = enabled ? ++ DRM_CONNECTOR_POLL_CONNECT | ++ DRM_CONNECTOR_POLL_DISCONNECT : ++ DRM_CONNECTOR_POLL_HPD; ++ } + } + ++ if (enabled) ++ drm_kms_helper_poll_enable_locked(dev); ++ ++ mutex_unlock(&dev->mode_config.mutex); ++ + /* +- * Interrupt setup is already guaranteed to be single-threaded, this is +- * just to make the assert_spin_locked checks happy. ++ * We might have missed any hotplugs that happened while we were ++ * in the middle of disabling polling + */ +- spin_lock_irq(&dev_priv->irq_lock); +- if (dev_priv->display.hpd_irq_setup) +- dev_priv->display.hpd_irq_setup(dev); +- spin_unlock_irq(&dev_priv->irq_lock); ++ if (!enabled) ++ drm_helper_hpd_irq_event(dev); ++} ++ ++/** ++ * intel_hpd_poll_init - enables/disables polling for connectors with hpd ++ * @dev_priv: i915 device instance ++ * @enabled: Whether to enable or disable polling ++ * ++ * This function enables polling for all connectors, regardless of whether or ++ * not they support hotplug detection. Under certain conditions HPD may not be ++ * functional. On most Intel GPUs, this happens when we enter runtime suspend. ++ * On Valleyview and Cherryview systems, this also happens when we shut off all ++ * of the powerwells. ++ * ++ * Since this function can get called in contexts where we're already holding ++ * dev->mode_config.mutex, we do the actual hotplug enabling in a seperate ++ * worker. ++ * ++ * Also see: intel_hpd_init(), which restores hpd handling. ++ */ ++void intel_hpd_poll_init(struct drm_i915_private *dev_priv) ++{ ++ WRITE_ONCE(dev_priv->hotplug.poll_enabled, true); ++ ++ /* ++ * We might already be holding dev->mode_config.mutex, so do this in a ++ * seperate worker ++ * As well, there's no issue if we race here since we always reschedule ++ * this worker anyway ++ */ ++ schedule_work(&dev_priv->hotplug.poll_init_work); + } + + void intel_hpd_init_work(struct drm_i915_private *dev_priv) + { + INIT_WORK(&dev_priv->hotplug.hotplug_work, i915_hotplug_work_func); + INIT_WORK(&dev_priv->hotplug.dig_port_work, i915_digport_work_func); ++ INIT_WORK(&dev_priv->hotplug.poll_init_work, i915_hpd_poll_init_work); + INIT_DELAYED_WORK(&dev_priv->hotplug.reenable_work, + intel_hpd_irq_storm_reenable_work); + } +@@ -509,6 +574,7 @@ void intel_hpd_cancel_work(struct drm_i9 + + cancel_work_sync(&dev_priv->hotplug.dig_port_work); + cancel_work_sync(&dev_priv->hotplug.hotplug_work); ++ cancel_work_sync(&dev_priv->hotplug.poll_init_work); + cancel_delayed_work_sync(&dev_priv->hotplug.reenable_work); + } + +--- a/drivers/gpu/drm/i915/intel_runtime_pm.c ++++ b/drivers/gpu/drm/i915/intel_runtime_pm.c +@@ -1007,6 +1007,8 @@ static void vlv_display_power_well_deini + synchronize_irq(dev_priv->dev->irq); + + vlv_power_sequencer_reset(dev_priv); ++ ++ intel_hpd_poll_init(dev_priv); + } + + static void vlv_display_power_well_enable(struct drm_i915_private *dev_priv, diff --git a/queue-4.7/drm-i915-fix-aliasing_ppgtt-leak.patch b/queue-4.7/drm-i915-fix-aliasing_ppgtt-leak.patch new file mode 100644 index 00000000000..b26977108f7 --- /dev/null +++ b/queue-4.7/drm-i915-fix-aliasing_ppgtt-leak.patch @@ -0,0 +1,58 @@ +From 3871f42a57efcdc6a9da751a8cb6fa196c212289 Mon Sep 17 00:00:00 2001 +From: Matthew Auld +Date: Fri, 5 Aug 2016 19:04:40 +0100 +Subject: drm/i915: fix aliasing_ppgtt leak + +From: Matthew Auld + +commit 3871f42a57efcdc6a9da751a8cb6fa196c212289 upstream. + +In i915_ggtt_cleanup_hw we need to remember to free aliasing_ppgtt. This +fixes the following kmemleak message: + +unreferenced object 0xffff880213cca000 (size 8192): + comm "modprobe", pid 1298, jiffies 4294745402 (age 703.930s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [] kmemleak_alloc+0x4e/0xb0 + [] kmem_cache_alloc_trace+0x142/0x1d0 + [] i915_gem_init_ggtt+0x10f/0x210 [i915] + [] i915_gem_init+0x5b/0xd0 [i915] + [] i915_driver_load+0x97a/0x1460 [i915] + [] i915_pci_probe+0x4f/0x70 [i915] + [] local_pci_probe+0x45/0xa0 + [] pci_device_probe+0x103/0x150 + [] driver_probe_device+0x22c/0x440 + [] __driver_attach+0xd1/0xf0 + [] bus_for_each_dev+0x6c/0xc0 + [] driver_attach+0x1e/0x20 + [] bus_add_driver+0x1c3/0x280 + [] driver_register+0x60/0xe0 + [] __pci_register_driver+0x4c/0x50 + [] 0xffffffffa013605b + +Signed-off-by: Matthew Auld +Reviewed-by: Chris Wilson +Fixes: b18b6bde300e ("drm/i915/bdw: Free PPGTT struct") +Signed-off-by: Daniel Vetter +Link: http://patchwork.freedesktop.org/patch/msgid/1470420280-21417-1-git-send-email-matthew.auld@intel.com +(cherry picked from commit cb7f27601c81a1e0454e9461e96f65b31fafbea0) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_gem_gtt.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/i915/i915_gem_gtt.c ++++ b/drivers/gpu/drm/i915/i915_gem_gtt.c +@@ -2826,6 +2826,7 @@ void i915_ggtt_cleanup_hw(struct drm_dev + struct i915_hw_ppgtt *ppgtt = dev_priv->mm.aliasing_ppgtt; + + ppgtt->base.cleanup(&ppgtt->base); ++ kfree(ppgtt); + } + + i915_gem_cleanup_stolen(dev); diff --git a/queue-4.7/drm-i915-fix-iboost-setting-for-ddi-with-4-lanes-on-skl.patch b/queue-4.7/drm-i915-fix-iboost-setting-for-ddi-with-4-lanes-on-skl.patch new file mode 100644 index 00000000000..c0dddfd1a8d --- /dev/null +++ b/queue-4.7/drm-i915-fix-iboost-setting-for-ddi-with-4-lanes-on-skl.patch @@ -0,0 +1,109 @@ +From 5728e0de741a3581e9900c5cbee3a51425daf211 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Tue, 12 Jul 2016 15:59:28 +0300 +Subject: drm/i915: Fix iboost setting for DDI with 4 lanes on SKL +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit 5728e0de741a3581e9900c5cbee3a51425daf211 upstream. + +Bspec says: +"For DDIA with x4 capability (DDI_BUF_CTL DDIA Lane Capability Control = + DDIA x4), the I_boost value has to be programmed in both + tx_blnclegsctl_0 and tx_blnclegsctl_4." + +Currently we only program tx_blnclegsctl_0. Let's do the other one as +well. + +Fixes: f8896f5d58e6 ("drm/i915/skl: Buffer translation improvements") +Cc: David Weinehall +Signed-off-by: Ville Syrjälä +Link: http://patchwork.freedesktop.org/patch/msgid/1468328376-6380-2-git-send-email-ville.syrjala@linux.intel.com +Reviewed-by: David Weinehall +(cherry picked from commit a7d8dbc07c8f0faaace983b1e4c6e9495dd0aa75) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_reg.h | 1 + + drivers/gpu/drm/i915/intel_ddi.c | 36 +++++++++++++++++++++++------------- + 2 files changed, 24 insertions(+), 13 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -1522,6 +1522,7 @@ enum skl_disp_power_wells { + #define BALANCE_LEG_MASK(port) (7<<(8+3*(port))) + /* Balance leg disable bits */ + #define BALANCE_LEG_DISABLE_SHIFT 23 ++#define BALANCE_LEG_DISABLE(port) (1 << (23 + (port))) + + /* + * Fence registers +--- a/drivers/gpu/drm/i915/intel_ddi.c ++++ b/drivers/gpu/drm/i915/intel_ddi.c +@@ -1371,14 +1371,30 @@ void intel_ddi_disable_pipe_clock(struct + TRANS_CLK_SEL_DISABLED); + } + +-static void skl_ddi_set_iboost(struct drm_i915_private *dev_priv, +- u32 level, enum port port, int type) ++static void _skl_ddi_set_iboost(struct drm_i915_private *dev_priv, ++ enum port port, uint8_t iboost) + { ++ u32 tmp; ++ ++ tmp = I915_READ(DISPIO_CR_TX_BMU_CR0); ++ tmp &= ~(BALANCE_LEG_MASK(port) | BALANCE_LEG_DISABLE(port)); ++ if (iboost) ++ tmp |= iboost << BALANCE_LEG_SHIFT(port); ++ else ++ tmp |= BALANCE_LEG_DISABLE(port); ++ I915_WRITE(DISPIO_CR_TX_BMU_CR0, tmp); ++} ++ ++static void skl_ddi_set_iboost(struct intel_encoder *encoder, u32 level) ++{ ++ struct intel_digital_port *intel_dig_port = enc_to_dig_port(&encoder->base); ++ struct drm_i915_private *dev_priv = to_i915(intel_dig_port->base.base.dev); ++ enum port port = intel_dig_port->port; ++ int type = encoder->type; + const struct ddi_buf_trans *ddi_translations; + uint8_t iboost; + uint8_t dp_iboost, hdmi_iboost; + int n_entries; +- u32 reg; + + /* VBT may override standard boost values */ + dp_iboost = dev_priv->vbt.ddi_port_info[port].dp_boost_level; +@@ -1420,16 +1436,10 @@ static void skl_ddi_set_iboost(struct dr + return; + } + +- reg = I915_READ(DISPIO_CR_TX_BMU_CR0); +- reg &= ~BALANCE_LEG_MASK(port); +- reg &= ~(1 << (BALANCE_LEG_DISABLE_SHIFT + port)); +- +- if (iboost) +- reg |= iboost << BALANCE_LEG_SHIFT(port); +- else +- reg |= 1 << (BALANCE_LEG_DISABLE_SHIFT + port); ++ _skl_ddi_set_iboost(dev_priv, port, iboost); + +- I915_WRITE(DISPIO_CR_TX_BMU_CR0, reg); ++ if (port == PORT_A && intel_dig_port->max_lanes == 4) ++ _skl_ddi_set_iboost(dev_priv, PORT_E, iboost); + } + + static void bxt_ddi_vswing_sequence(struct drm_i915_private *dev_priv, +@@ -1560,7 +1570,7 @@ uint32_t ddi_signal_levels(struct intel_ + level = translate_signal_level(signal_levels); + + if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv)) +- skl_ddi_set_iboost(dev_priv, level, port, encoder->type); ++ skl_ddi_set_iboost(encoder, level); + else if (IS_BROXTON(dev_priv)) + bxt_ddi_vswing_sequence(dev_priv, level, port, encoder->type); + diff --git a/queue-4.7/drm-i915-fix-iboost-setting-for-skl-y-u-dp-ddi-buffer-translation-entry-2.patch b/queue-4.7/drm-i915-fix-iboost-setting-for-skl-y-u-dp-ddi-buffer-translation-entry-2.patch new file mode 100644 index 00000000000..3a36fb3cfb4 --- /dev/null +++ b/queue-4.7/drm-i915-fix-iboost-setting-for-skl-y-u-dp-ddi-buffer-translation-entry-2.patch @@ -0,0 +1,48 @@ +From 85bf59d188721dca37bc8276457e68351213f38f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Tue, 2 Aug 2016 15:21:57 +0300 +Subject: drm/i915: Fix iboost setting for SKL Y/U DP DDI buffer translation entry 2 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit 85bf59d188721dca37bc8276457e68351213f38f upstream. + +The spec was recently fixed to have the correct iboost setting for the +SKL Y/U DP DDI buffer translation table entry 2. Update our tables +to match. + +Cc: David Weinehall +Signed-off-by: Ville Syrjälä +Link: http://patchwork.freedesktop.org/patch/msgid/1470140517-13011-1-git-send-email-ville.syrjala@linux.intel.com +Reviewed-by: David Weinehall +(cherry picked from commit 5ac9056753e79ac5ad1ccc3c99b311688e46e8c9) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_ddi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_ddi.c ++++ b/drivers/gpu/drm/i915/intel_ddi.c +@@ -145,7 +145,7 @@ static const struct ddi_buf_trans skl_dd + static const struct ddi_buf_trans skl_u_ddi_translations_dp[] = { + { 0x0000201B, 0x000000A2, 0x0 }, + { 0x00005012, 0x00000088, 0x0 }, +- { 0x80007011, 0x000000CD, 0x0 }, ++ { 0x80007011, 0x000000CD, 0x1 }, + { 0x80009010, 0x000000C0, 0x1 }, + { 0x0000201B, 0x0000009D, 0x0 }, + { 0x80005012, 0x000000C0, 0x1 }, +@@ -158,7 +158,7 @@ static const struct ddi_buf_trans skl_u_ + static const struct ddi_buf_trans skl_y_ddi_translations_dp[] = { + { 0x00000018, 0x000000A2, 0x0 }, + { 0x00005012, 0x00000088, 0x0 }, +- { 0x80007011, 0x000000CD, 0x0 }, ++ { 0x80007011, 0x000000CD, 0x3 }, + { 0x80009010, 0x000000C0, 0x3 }, + { 0x00000018, 0x0000009D, 0x0 }, + { 0x80005012, 0x000000C0, 0x3 }, diff --git a/queue-4.7/drm-i915-program-iboost-settings-for-hdmi-dvi-on-skl.patch b/queue-4.7/drm-i915-program-iboost-settings-for-hdmi-dvi-on-skl.patch new file mode 100644 index 00000000000..d99538a46a1 --- /dev/null +++ b/queue-4.7/drm-i915-program-iboost-settings-for-hdmi-dvi-on-skl.patch @@ -0,0 +1,144 @@ +From 7ff9a55614712adf13ce7990565be0263e620f5e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Tue, 12 Jul 2016 15:59:30 +0300 +Subject: drm/i915: Program iboost settings for HDMI/DVI on SKL +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit 7ff9a55614712adf13ce7990565be0263e620f5e upstream. + +Currently we fail to program the iboost stuff for HDMI/DVI. Let's remedy +that. + +Fixes: f8896f5d58e6 ("drm/i915/skl: Buffer translation improvements") +Cc: David Weinehall +Signed-off-by: Ville Syrjälä +Link: http://patchwork.freedesktop.org/patch/msgid/1468328376-6380-4-git-send-email-ville.syrjala@linux.intel.com +Reviewed-by: David Weinehall +(cherry picked from commit 8d8bb85eb7d859aa9bbe36e588690a1d22af7608) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_ddi.c | 51 ++++++++++++++++++++++++++++++--------- + 1 file changed, 40 insertions(+), 11 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_ddi.c ++++ b/drivers/gpu/drm/i915/intel_ddi.c +@@ -388,6 +388,40 @@ skl_get_buf_trans_hdmi(struct drm_i915_p + } + } + ++static int intel_ddi_hdmi_level(struct drm_i915_private *dev_priv, enum port port) ++{ ++ int n_hdmi_entries; ++ int hdmi_level; ++ int hdmi_default_entry; ++ ++ hdmi_level = dev_priv->vbt.ddi_port_info[port].hdmi_level_shift; ++ ++ if (IS_BROXTON(dev_priv)) ++ return hdmi_level; ++ ++ if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv)) { ++ skl_get_buf_trans_hdmi(dev_priv, &n_hdmi_entries); ++ hdmi_default_entry = 8; ++ } else if (IS_BROADWELL(dev_priv)) { ++ n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi); ++ hdmi_default_entry = 7; ++ } else if (IS_HASWELL(dev_priv)) { ++ n_hdmi_entries = ARRAY_SIZE(hsw_ddi_translations_hdmi); ++ hdmi_default_entry = 6; ++ } else { ++ WARN(1, "ddi translation table missing\n"); ++ n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi); ++ hdmi_default_entry = 7; ++ } ++ ++ /* Choose a good default if VBT is badly populated */ ++ if (hdmi_level == HDMI_LEVEL_SHIFT_UNKNOWN || ++ hdmi_level >= n_hdmi_entries) ++ hdmi_level = hdmi_default_entry; ++ ++ return hdmi_level; ++} ++ + /* + * Starting with Haswell, DDI port buffers must be programmed with correct + * values in advance. The buffer values are different for FDI and DP modes, +@@ -399,7 +433,7 @@ void intel_prepare_ddi_buffer(struct int + { + struct drm_i915_private *dev_priv = to_i915(encoder->base.dev); + u32 iboost_bit = 0; +- int i, n_hdmi_entries, n_dp_entries, n_edp_entries, hdmi_default_entry, ++ int i, n_hdmi_entries, n_dp_entries, n_edp_entries, + size; + int hdmi_level; + enum port port; +@@ -410,7 +444,7 @@ void intel_prepare_ddi_buffer(struct int + const struct ddi_buf_trans *ddi_translations; + + port = intel_ddi_get_encoder_port(encoder); +- hdmi_level = dev_priv->vbt.ddi_port_info[port].hdmi_level_shift; ++ hdmi_level = intel_ddi_hdmi_level(dev_priv, port); + + if (IS_BROXTON(dev_priv)) { + if (encoder->type != INTEL_OUTPUT_HDMI) +@@ -430,7 +464,6 @@ void intel_prepare_ddi_buffer(struct int + skl_get_buf_trans_edp(dev_priv, &n_edp_entries); + ddi_translations_hdmi = + skl_get_buf_trans_hdmi(dev_priv, &n_hdmi_entries); +- hdmi_default_entry = 8; + /* If we're boosting the current, set bit 31 of trans1 */ + if (dev_priv->vbt.ddi_port_info[port].hdmi_boost_level || + dev_priv->vbt.ddi_port_info[port].dp_boost_level) +@@ -456,7 +489,6 @@ void intel_prepare_ddi_buffer(struct int + + n_dp_entries = ARRAY_SIZE(bdw_ddi_translations_dp); + n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi); +- hdmi_default_entry = 7; + } else if (IS_HASWELL(dev_priv)) { + ddi_translations_fdi = hsw_ddi_translations_fdi; + ddi_translations_dp = hsw_ddi_translations_dp; +@@ -464,7 +496,6 @@ void intel_prepare_ddi_buffer(struct int + ddi_translations_hdmi = hsw_ddi_translations_hdmi; + n_dp_entries = n_edp_entries = ARRAY_SIZE(hsw_ddi_translations_dp); + n_hdmi_entries = ARRAY_SIZE(hsw_ddi_translations_hdmi); +- hdmi_default_entry = 6; + } else { + WARN(1, "ddi translation table missing\n"); + ddi_translations_edp = bdw_ddi_translations_dp; +@@ -474,7 +505,6 @@ void intel_prepare_ddi_buffer(struct int + n_edp_entries = ARRAY_SIZE(bdw_ddi_translations_edp); + n_dp_entries = ARRAY_SIZE(bdw_ddi_translations_dp); + n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi); +- hdmi_default_entry = 7; + } + + switch (encoder->type) { +@@ -505,11 +535,6 @@ void intel_prepare_ddi_buffer(struct int + if (encoder->type != INTEL_OUTPUT_HDMI) + return; + +- /* Choose a good default if VBT is badly populated */ +- if (hdmi_level == HDMI_LEVEL_SHIFT_UNKNOWN || +- hdmi_level >= n_hdmi_entries) +- hdmi_level = hdmi_default_entry; +- + /* Entry 9 is for HDMI: */ + I915_WRITE(DDI_BUF_TRANS_LO(port, i), + ddi_translations_hdmi[hdmi_level].trans1 | iboost_bit); +@@ -1639,6 +1664,10 @@ static void intel_ddi_pre_enable(struct + intel_dp_stop_link_train(intel_dp); + } else if (type == INTEL_OUTPUT_HDMI) { + struct intel_hdmi *intel_hdmi = enc_to_intel_hdmi(encoder); ++ int level = intel_ddi_hdmi_level(dev_priv, port); ++ ++ if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv)) ++ skl_ddi_set_iboost(intel_encoder, level); + + intel_hdmi->set_infoframes(encoder, + crtc->config->has_hdmi_sink, diff --git a/queue-4.7/drm-i915-vlv-disable-hpd-in-valleyview_crt_detect_hotplug.patch b/queue-4.7/drm-i915-vlv-disable-hpd-in-valleyview_crt_detect_hotplug.patch new file mode 100644 index 00000000000..fb826a0986d --- /dev/null +++ b/queue-4.7/drm-i915-vlv-disable-hpd-in-valleyview_crt_detect_hotplug.patch @@ -0,0 +1,123 @@ +From 21842ea84f161ae37ba25f0250c377fd19c5b307 Mon Sep 17 00:00:00 2001 +From: Lyude +Date: Tue, 21 Jun 2016 17:03:43 -0400 +Subject: drm/i915/vlv: Disable HPD in valleyview_crt_detect_hotplug() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lyude + +commit 21842ea84f161ae37ba25f0250c377fd19c5b307 upstream. + +One of the things preventing us from using polling is the fact that +calling valleyview_crt_detect_hotplug() when there's a VGA cable +connected results in sending another hotplug. With polling enabled when +HPD is disabled, this results in a scenario like this: + +- We enable power wells and reset the ADPA +- output_poll_exec does force probe on VGA, triggering a hpd +- HPD handler waits for poll to unlock dev->mode_config.mutex +- output_poll_exec shuts off the ADPA, unlocks dev->mode_config.mutex +- HPD handler runs, resets ADPA and brings us back to the start + +This results in an endless irq storm getting sent from the ADPA +whenever a VGA connector gets detected in the middle of polling. + +Somewhat based off of the "drm/i915: Disable CRT HPD around force +trigger" patch Ville Syrjälä sent a while back + +Cc: stable@vger.kernel.org +Cc: Ville Syrjälä +Signed-off-by: Lyude +Signed-off-by: Daniel Vetter +(cherry picked from commit b236d7c8421969ac0693fc571e47ee5c2a62fb90) +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/i915_drv.h | 2 ++ + drivers/gpu/drm/i915/intel_crt.c | 18 ++++++++++++++++++ + drivers/gpu/drm/i915/intel_hotplug.c | 27 +++++++++++++++++++++++++++ + 3 files changed, 47 insertions(+) + +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -2791,6 +2791,8 @@ void intel_hpd_init(struct drm_i915_priv + void intel_hpd_init_work(struct drm_i915_private *dev_priv); + void intel_hpd_cancel_work(struct drm_i915_private *dev_priv); + bool intel_hpd_pin_to_port(enum hpd_pin pin, enum port *port); ++bool intel_hpd_disable(struct drm_i915_private *dev_priv, enum hpd_pin pin); ++void intel_hpd_enable(struct drm_i915_private *dev_priv, enum hpd_pin pin); + + /* i915_irq.c */ + void i915_queue_hangcheck(struct drm_device *dev); +--- a/drivers/gpu/drm/i915/intel_crt.c ++++ b/drivers/gpu/drm/i915/intel_crt.c +@@ -327,10 +327,25 @@ static bool valleyview_crt_detect_hotplu + struct drm_device *dev = connector->dev; + struct intel_crt *crt = intel_attached_crt(connector); + struct drm_i915_private *dev_priv = dev->dev_private; ++ bool reenable_hpd; + u32 adpa; + bool ret; + u32 save_adpa; + ++ /* ++ * Doing a force trigger causes a hpd interrupt to get sent, which can ++ * get us stuck in a loop if we're polling: ++ * - We enable power wells and reset the ADPA ++ * - output_poll_exec does force probe on VGA, triggering a hpd ++ * - HPD handler waits for poll to unlock dev->mode_config.mutex ++ * - output_poll_exec shuts off the ADPA, unlocks ++ * dev->mode_config.mutex ++ * - HPD handler runs, resets ADPA and brings us back to the start ++ * ++ * Just disable HPD interrupts here to prevent this ++ */ ++ reenable_hpd = intel_hpd_disable(dev_priv, crt->base.hpd_pin); ++ + save_adpa = adpa = I915_READ(crt->adpa_reg); + DRM_DEBUG_KMS("trigger hotplug detect cycle: adpa=0x%x\n", adpa); + +@@ -353,6 +368,9 @@ static bool valleyview_crt_detect_hotplu + + DRM_DEBUG_KMS("valleyview hotplug adpa=0x%x, result %d\n", adpa, ret); + ++ if (reenable_hpd) ++ intel_hpd_enable(dev_priv, crt->base.hpd_pin); ++ + return ret; + } + +--- a/drivers/gpu/drm/i915/intel_hotplug.c ++++ b/drivers/gpu/drm/i915/intel_hotplug.c +@@ -511,3 +511,30 @@ void intel_hpd_cancel_work(struct drm_i9 + cancel_work_sync(&dev_priv->hotplug.hotplug_work); + cancel_delayed_work_sync(&dev_priv->hotplug.reenable_work); + } ++ ++bool intel_hpd_disable(struct drm_i915_private *dev_priv, enum hpd_pin pin) ++{ ++ bool ret = false; ++ ++ if (pin == HPD_NONE) ++ return false; ++ ++ spin_lock_irq(&dev_priv->irq_lock); ++ if (dev_priv->hotplug.stats[pin].state == HPD_ENABLED) { ++ dev_priv->hotplug.stats[pin].state = HPD_DISABLED; ++ ret = true; ++ } ++ spin_unlock_irq(&dev_priv->irq_lock); ++ ++ return ret; ++} ++ ++void intel_hpd_enable(struct drm_i915_private *dev_priv, enum hpd_pin pin) ++{ ++ if (pin == HPD_NONE) ++ return; ++ ++ spin_lock_irq(&dev_priv->irq_lock); ++ dev_priv->hotplug.stats[pin].state = HPD_ENABLED; ++ spin_unlock_irq(&dev_priv->irq_lock); ++} diff --git a/queue-4.7/drm-i915-vlv-make-intel_crt_reset-per-encoder.patch b/queue-4.7/drm-i915-vlv-make-intel_crt_reset-per-encoder.patch new file mode 100644 index 00000000000..59bc5f9664d --- /dev/null +++ b/queue-4.7/drm-i915-vlv-make-intel_crt_reset-per-encoder.patch @@ -0,0 +1,67 @@ +From 4570d833390b10043d082fe535375d4a0e071d9c Mon Sep 17 00:00:00 2001 +From: Lyude +Date: Tue, 21 Jun 2016 17:03:41 -0400 +Subject: drm/i915/vlv: Make intel_crt_reset() per-encoder +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lyude + +commit 4570d833390b10043d082fe535375d4a0e071d9c upstream. + +This lets call intel_crt_reset() in contexts where IRQs are disabled and +as such, can't hold the locks required to work with the connectors. + +Cc: Ville Syrjälä +Acked-by: Daniel Vetter +Signed-off-by: Lyude +Signed-off-by: Daniel Vetter +(cherry picked from commit 28cf71ce3e206db1c3f30b3da31e7b48b2269e4c) +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/gpu/drm/i915/intel_crt.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_crt.c ++++ b/drivers/gpu/drm/i915/intel_crt.c +@@ -713,11 +713,11 @@ static int intel_crt_set_property(struct + return 0; + } + +-static void intel_crt_reset(struct drm_connector *connector) ++static void intel_crt_reset(struct drm_encoder *encoder) + { +- struct drm_device *dev = connector->dev; ++ struct drm_device *dev = encoder->dev; + struct drm_i915_private *dev_priv = dev->dev_private; +- struct intel_crt *crt = intel_attached_crt(connector); ++ struct intel_crt *crt = intel_encoder_to_crt(to_intel_encoder(encoder)); + + if (INTEL_INFO(dev)->gen >= 5) { + u32 adpa; +@@ -739,7 +739,6 @@ static void intel_crt_reset(struct drm_c + */ + + static const struct drm_connector_funcs intel_crt_connector_funcs = { +- .reset = intel_crt_reset, + .dpms = drm_atomic_helper_connector_dpms, + .detect = intel_crt_detect, + .fill_modes = drm_helper_probe_single_connector_modes, +@@ -757,6 +756,7 @@ static const struct drm_connector_helper + }; + + static const struct drm_encoder_funcs intel_crt_enc_funcs = { ++ .reset = intel_crt_reset, + .destroy = intel_encoder_destroy, + }; + +@@ -902,5 +902,5 @@ void intel_crt_init(struct drm_device *d + dev_priv->fdi_rx_config = I915_READ(FDI_RX_CTL(PIPE_A)) & fdi_config; + } + +- intel_crt_reset(connector); ++ intel_crt_reset(&crt->base.base); + } diff --git a/queue-4.7/drm-i915-vlv-reset-the-adpa-in-vlv_display_power_well_init.patch b/queue-4.7/drm-i915-vlv-reset-the-adpa-in-vlv_display_power_well_init.patch new file mode 100644 index 00000000000..8735b89140b --- /dev/null +++ b/queue-4.7/drm-i915-vlv-reset-the-adpa-in-vlv_display_power_well_init.patch @@ -0,0 +1,101 @@ +From 4c732e6ee9e71903934d75b12a021eb3520b6197 Mon Sep 17 00:00:00 2001 +From: Lyude +Date: Tue, 21 Jun 2016 17:03:42 -0400 +Subject: drm/i915/vlv: Reset the ADPA in vlv_display_power_well_init() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lyude + +commit 4c732e6ee9e71903934d75b12a021eb3520b6197 upstream. + +While VGA hotplugging worked(ish) before, it looks like that was mainly +because we'd unintentionally enable it in +valleyview_crt_detect_hotplug() when we did a force trigger. This +doesn't work reliably enough because whenever the display powerwell on +vlv gets disabled, the values set in VLV_ADPA get cleared and +consequently VGA hotplugging gets disabled. This causes bugs such as one +we found on an Intel NUC, where doing the following sequence of +hotplugs: + + - Disconnect all monitors + - Connect VGA + - Disconnect VGA + - Connect HDMI + +Would result in VGA hotplugging becoming disabled, due to the powerwells +getting toggled in the process of connecting HDMI. + +Changes since v3: + - Expose intel_crt_reset() through intel_drv.h and call that in + vlv_display_power_well_init() instead of + encoder->base.funcs->reset(&encoder->base); + +Changes since v2: + - Use intel_encoder structs instead of drm_encoder structs + +Changes since v1: + - Instead of handling the register writes ourself, we just reuse + intel_crt_detect() + - Instead of resetting the ADPA during display IRQ installation, we now + reset them in vlv_display_power_well_init() + +Acked-by: Daniel Vetter +Signed-off-by: Lyude +Reviewed-by: Ville Syrjälä +[danvet: Rebase over dev_priv/drm_device embedding.] +Signed-off-by: Daniel Vetter +(cherry picked from commit 9504a89247595b6c066c68aea0c34af1fc78d021) +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/intel_crt.c | 2 +- + drivers/gpu/drm/i915/intel_drv.h | 2 +- + drivers/gpu/drm/i915/intel_runtime_pm.c | 7 +++++++ + 3 files changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_crt.c ++++ b/drivers/gpu/drm/i915/intel_crt.c +@@ -713,7 +713,7 @@ static int intel_crt_set_property(struct + return 0; + } + +-static void intel_crt_reset(struct drm_encoder *encoder) ++void intel_crt_reset(struct drm_encoder *encoder) + { + struct drm_device *dev = encoder->dev; + struct drm_i915_private *dev_priv = dev->dev_private; +--- a/drivers/gpu/drm/i915/intel_drv.h ++++ b/drivers/gpu/drm/i915/intel_drv.h +@@ -1052,7 +1052,7 @@ void gen8_irq_power_well_pre_disable(str + + /* intel_crt.c */ + void intel_crt_init(struct drm_device *dev); +- ++void intel_crt_reset(struct drm_encoder *encoder); + + /* intel_ddi.c */ + void intel_ddi_clk_select(struct intel_encoder *encoder, +--- a/drivers/gpu/drm/i915/intel_runtime_pm.c ++++ b/drivers/gpu/drm/i915/intel_runtime_pm.c +@@ -952,6 +952,7 @@ static void vlv_init_display_clock_gatin + + static void vlv_display_power_well_init(struct drm_i915_private *dev_priv) + { ++ struct intel_encoder *encoder; + enum pipe pipe; + + /* +@@ -987,6 +988,12 @@ static void vlv_display_power_well_init( + + intel_hpd_init(dev_priv); + ++ /* Re-enable the ADPA, if we have one */ ++ for_each_intel_encoder(dev_priv->dev, encoder) { ++ if (encoder->type == INTEL_OUTPUT_ANALOG) ++ intel_crt_reset(&encoder->base); ++ } ++ + i915_redisable_vga_power_on(dev_priv->dev); + } + diff --git a/queue-4.7/edac-sb_edac-fix-channel-reporting-on-knights-landing.patch b/queue-4.7/edac-sb_edac-fix-channel-reporting-on-knights-landing.patch new file mode 100644 index 00000000000..c2fb2c84475 --- /dev/null +++ b/queue-4.7/edac-sb_edac-fix-channel-reporting-on-knights-landing.patch @@ -0,0 +1,86 @@ +From c5b48fa7e298b9a8968a1c1fc0ef013069ca2dd2 Mon Sep 17 00:00:00 2001 +From: Lukasz Odzioba +Date: Sat, 23 Jul 2016 01:44:49 +0200 +Subject: EDAC, sb_edac: Fix channel reporting on Knights Landing + +From: Lukasz Odzioba + +commit c5b48fa7e298b9a8968a1c1fc0ef013069ca2dd2 upstream. + +On Intel Xeon Phi Knights Landing processor family the channels of the +memory controller have untypical arrangement - MC0 is mapped to CH3,4,5 +and MC1 is mapped to CH0,1,2. This causes the EDAC driver to report the +channel name incorrectly. + +We missed this change earlier, so the code already contains similar +comment, but the translation function is incorrect. + +Without this patch: + errors in DIMM_A and DIMM_D were reported in DIMM_D + errors in DIMM_B and DIMM_E were reported in DIMM_E + errors in DIMM_C and DIMM_F were reported in DIMM_F + +Correct this. + +Hubert Chrzaniuk: + - rebased to 4.8 + - comments and code cleanup + +Fixes: d0cdf9003140 ("sb_edac: Add Knights Landing (Xeon Phi gen 2) support") +Reviewed-by: Tony Luck +Cc: Mauro Carvalho Chehab +Cc: Hubert Chrzaniuk +Cc: linux-edac +Cc: lukasz.anaczkowski@intel.com +Cc: lukasz.odzioba@intel.com +Cc: mchehab@kernel.org +Link: http://lkml.kernel.org/r/1469231089-22837-1-git-send-email-lukasz.odzioba@intel.com +Signed-off-by: Lukasz Odzioba +[ Boris: Simplify a bit by removing char mc. ] +Signed-off-by: Borislav Petkov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/edac/sb_edac.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +--- a/drivers/edac/sb_edac.c ++++ b/drivers/edac/sb_edac.c +@@ -552,9 +552,9 @@ static const struct pci_id_table pci_dev + /* Knight's Landing Support */ + /* + * KNL's memory channels are swizzled between memory controllers. +- * MC0 is mapped to CH3,5,6 and MC1 is mapped to CH0,1,2 ++ * MC0 is mapped to CH3,4,5 and MC1 is mapped to CH0,1,2 + */ +-#define knl_channel_remap(channel) ((channel + 3) % 6) ++#define knl_channel_remap(mc, chan) ((mc) ? (chan) : (chan) + 3) + + /* Memory controller, TAD tables, error injection - 2-8-0, 2-9-0 (2 of these) */ + #define PCI_DEVICE_ID_INTEL_KNL_IMC_MC 0x7840 +@@ -1286,7 +1286,7 @@ static u32 knl_get_mc_route(int entry, u + mc = GET_BITFIELD(reg, entry*3, (entry*3)+2); + chan = GET_BITFIELD(reg, (entry*2) + 18, (entry*2) + 18 + 1); + +- return knl_channel_remap(mc*3 + chan); ++ return knl_channel_remap(mc, chan); + } + + /* +@@ -2997,8 +2997,15 @@ static void sbridge_mce_output_error(str + } else { + char A = *("A"); + +- channel = knl_channel_remap(channel); ++ /* ++ * Reported channel is in range 0-2, so we can't map it ++ * back to mc. To figure out mc we check machine check ++ * bank register that reported this error. ++ * bank15 means mc0 and bank16 means mc1. ++ */ ++ channel = knl_channel_remap(m->bank == 16, channel); + channel_mask = 1 << channel; ++ + snprintf(msg, sizeof(msg), + "%s%s err_code:%04x:%04x channel:%d (DIMM_%c)", + overflow ? " OVERFLOW" : "", diff --git a/queue-4.7/fs-seq_file-fix-out-of-bounds-read.patch b/queue-4.7/fs-seq_file-fix-out-of-bounds-read.patch new file mode 100644 index 00000000000..4e7c21b38d4 --- /dev/null +++ b/queue-4.7/fs-seq_file-fix-out-of-bounds-read.patch @@ -0,0 +1,110 @@ +From 088bf2ff5d12e2e32ee52a4024fec26e582f44d3 Mon Sep 17 00:00:00 2001 +From: Vegard Nossum +Date: Thu, 25 Aug 2016 15:17:11 -0700 +Subject: fs/seq_file: fix out-of-bounds read + +From: Vegard Nossum + +commit 088bf2ff5d12e2e32ee52a4024fec26e582f44d3 upstream. + +seq_read() is a nasty piece of work, not to mention buggy. + +It has (I think) an old bug which allows unprivileged userspace to read +beyond the end of m->buf. + +I was getting these: + + BUG: KASAN: slab-out-of-bounds in seq_read+0xcd2/0x1480 at addr ffff880116889880 + Read of size 2713 by task trinity-c2/1329 + CPU: 2 PID: 1329 Comm: trinity-c2 Not tainted 4.8.0-rc1+ #96 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014 + Call Trace: + kasan_object_err+0x1c/0x80 + kasan_report_error+0x2cb/0x7e0 + kasan_report+0x4e/0x80 + check_memory_region+0x13e/0x1a0 + kasan_check_read+0x11/0x20 + seq_read+0xcd2/0x1480 + proc_reg_read+0x10b/0x260 + do_loop_readv_writev.part.5+0x140/0x2c0 + do_readv_writev+0x589/0x860 + vfs_readv+0x7b/0xd0 + do_readv+0xd8/0x2c0 + SyS_readv+0xb/0x10 + do_syscall_64+0x1b3/0x4b0 + entry_SYSCALL64_slow_path+0x25/0x25 + Object at ffff880116889100, in cache kmalloc-4096 size: 4096 + Allocated: + PID = 1329 + save_stack_trace+0x26/0x80 + save_stack+0x46/0xd0 + kasan_kmalloc+0xad/0xe0 + __kmalloc+0x1aa/0x4a0 + seq_buf_alloc+0x35/0x40 + seq_read+0x7d8/0x1480 + proc_reg_read+0x10b/0x260 + do_loop_readv_writev.part.5+0x140/0x2c0 + do_readv_writev+0x589/0x860 + vfs_readv+0x7b/0xd0 + do_readv+0xd8/0x2c0 + SyS_readv+0xb/0x10 + do_syscall_64+0x1b3/0x4b0 + return_from_SYSCALL_64+0x0/0x6a + Freed: + PID = 0 + (stack is not available) + Memory state around the buggy address: + ffff88011688a000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + ffff88011688a080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + >ffff88011688a100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + ^ + ffff88011688a180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + ffff88011688a200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ================================================================== + Disabling lock debugging due to kernel taint + +This seems to be the same thing that Dave Jones was seeing here: + + https://lkml.org/lkml/2016/8/12/334 + +There are multiple issues here: + + 1) If we enter the function with a non-empty buffer, there is an attempt + to flush it. But it was not clearing m->from after doing so, which + means that if we try to do this flush twice in a row without any call + to traverse() in between, we are going to be reading from the wrong + place -- the splat above, fixed by this patch. + + 2) If there's a short write to userspace because of page faults, the + buffer may already contain multiple lines (i.e. pos has advanced by + more than 1), but we don't save the progress that was made so the + next call will output what we've already returned previously. Since + that is a much less serious issue (and I have a headache after + staring at seq_read() for the past 8 hours), I'll leave that for now. + +Link: http://lkml.kernel.org/r/1471447270-32093-1-git-send-email-vegard.nossum@oracle.com +Signed-off-by: Vegard Nossum +Reported-by: Dave Jones +Cc: Al Viro +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/seq_file.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/fs/seq_file.c ++++ b/fs/seq_file.c +@@ -223,8 +223,10 @@ ssize_t seq_read(struct file *file, char + size -= n; + buf += n; + copied += n; +- if (!m->count) ++ if (!m->count) { ++ m->from = 0; + m->index++; ++ } + if (!size) + goto Done; + } diff --git a/queue-4.7/gpio-fix-of-build-problem-on-um.patch b/queue-4.7/gpio-fix-of-build-problem-on-um.patch new file mode 100644 index 00000000000..156cce42652 --- /dev/null +++ b/queue-4.7/gpio-fix-of-build-problem-on-um.patch @@ -0,0 +1,33 @@ +From 2527ecc9195e9c66252af24c4689e8a67cd4ccb9 Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Tue, 16 Aug 2016 09:58:25 +0200 +Subject: gpio: Fix OF build problem on UM + +From: Linus Walleij + +commit 2527ecc9195e9c66252af24c4689e8a67cd4ccb9 upstream. + +The UserMode (UM) Linux build was failing in gpiolib-of as it requires +ioremap()/iounmap() to exist, which is absent from UM. The non-existence +of IO memory is negatively defined as CONFIG_NO_IOMEM which means we +need to depend on HAS_IOMEM. + +Cc: Geert Uytterhoeven +Reported-by: kbuild test robot +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpio/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpio/Kconfig ++++ b/drivers/gpio/Kconfig +@@ -50,6 +50,7 @@ config GPIO_DEVRES + config OF_GPIO + def_bool y + depends on OF ++ depends on HAS_IOMEM + + config GPIO_ACPI + def_bool y diff --git a/queue-4.7/gpio-max730x-set-gpiochip-data-pointer-before-using-it.patch b/queue-4.7/gpio-max730x-set-gpiochip-data-pointer-before-using-it.patch new file mode 100644 index 00000000000..61b7c3465ea --- /dev/null +++ b/queue-4.7/gpio-max730x-set-gpiochip-data-pointer-before-using-it.patch @@ -0,0 +1,88 @@ +From 6f4deb18a505523eb7925d646574a95f9e982ff7 Mon Sep 17 00:00:00 2001 +From: Christophe Leroy +Date: Mon, 8 Aug 2016 15:58:56 +0200 +Subject: gpio: max730x: set gpiochip data pointer before using it + +From: Christophe Leroy + +commit 6f4deb18a505523eb7925d646574a95f9e982ff7 upstream. + +gpiochip_add_data() has to be called before calling +max7301_direction_input() + +[ 4.389883] Unable to handle kernel paging request for data at address 0x00000018 +[ 4.397282] Faulting instruction address: 0xc01a8cbc +[ 4.402023] Oops: Kernel access of bad area, sig: 11 [#1] +[ 4.407331] PREEMPT CMPC885 +[ 4.410131] CPU: 0 PID: 6 Comm: kworker/u2:0 Not tainted 4.5.0-gacdfdee #39 +[ 4.418592] Workqueue: deferwq deferred_probe_work_func +[ 4.423711] task: c60798b0 ti: c608a000 task.ti: c608a000 +[ 4.429038] NIP: c01a8cbc LR: c01a8e24 CTR: c01ff028 +[ 4.433953] REGS: c608bad0 TRAP: 0300 Not tainted (4.5.0-s3k-dev-gacdfdee-svn-dirty) +[ 4.441847] MSR: 00009032 CR: 33039553 XER: a000f940 +[ 4.448395] DAR: 00000018 DSISR: c0000000 +GPR00: c01a8e24 c608bb80 c60798b0 c60d6f6c 00000004 00000002 07de2900 00700000 +GPR08: 00000000 00000000 c608a000 00001032 35039553 00000000 c002f37c c6010b64 +GPR16: c6010a48 c6010a14 c6010a00 00000000 c0450000 c0453568 c0453438 c050db14 +GPR24: c62662bc 00000009 ffffffaa c60d6f5d 00000001 00000000 00000000 00000000 +[ 4.480371] NIP [c01a8cbc] max7301_direction_input+0x20/0x9c +[ 4.485951] LR [c01a8e24] __max730x_probe+0xec/0x138 +[ 4.490812] Call Trace: +[ 4.493268] [c608bba0] [c01a8e24] __max730x_probe+0xec/0x138 +[ 4.498878] [c608bbc0] [c01cc368] driver_probe_device+0x190/0x38c +[ 4.504895] [c608bbf0] [c01ca918] bus_for_each_drv+0x58/0xb4 +[ 4.510489] [c608bc20] [c01cc04c] __device_attach+0x8c/0x110 +[ 4.516082] [c608bc50] [c01cab80] bus_probe_device+0x34/0xb8 +[ 4.521673] [c608bc70] [c01c96c8] device_add+0x3c0/0x598 +[ 4.526925] [c608bcb0] [c0200f90] spi_add_device+0x114/0x160 +[ 4.532512] [c608bcd0] [c02018d0] spi_register_master+0x6e0/0x7c8 +[ 4.538537] [c608bd20] [c02019fc] devm_spi_register_master+0x44/0x8c +[ 4.544824] [c608bd40] [c0203854] of_fsl_spi_probe+0x458/0x57c +[ 4.550587] [c608bda0] [c01cd828] platform_drv_probe+0x30/0x74 +[ 4.556366] [c608bdb0] [c01cc368] driver_probe_device+0x190/0x38c +[ 4.562383] [c608bde0] [c01ca918] bus_for_each_drv+0x58/0xb4 +[ 4.567977] [c608be10] [c01cc04c] __device_attach+0x8c/0x110 +[ 4.573572] [c608be40] [c01cab80] bus_probe_device+0x34/0xb8 +[ 4.579170] [c608be60] [c01cb9b4] deferred_probe_work_func+0xa4/0xc4 +[ 4.585438] [c608be80] [c0029c04] process_one_work+0x22c/0x414 +[ 4.591201] [c608bea0] [c002a100] worker_thread+0x314/0x5c0 +[ 4.596722] [c608bef0] [c002f444] kthread+0xc8/0xcc +[ 4.601538] [c608bf40] [c000af84] ret_from_kernel_thread+0x5c/0x64 +[ 4.607596] Instruction dump: +[ 4.610530] 7c0803a6 bba10014 38210020 4e800020 7c0802a6 9421ffe0 38840004 bf810010 +[ 4.618188] 90010024 549cf0be 83c30010 549d0f7c <813e0018> 7fc3f378 7d3f2430 57ff07fe +[ 4.626041] ---[ end trace 303adb021dd4caf2 ]--- + +fixes: 5e45e01916197 ("gpio: max730x: use gpiochip data pointer") +Signed-off-by: Christophe Leroy +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpio/gpio-max730x.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/gpio/gpio-max730x.c ++++ b/drivers/gpio/gpio-max730x.c +@@ -192,6 +192,10 @@ int __max730x_probe(struct max7301 *ts) + ts->chip.parent = dev; + ts->chip.owner = THIS_MODULE; + ++ ret = gpiochip_add_data(&ts->chip, ts); ++ if (ret) ++ goto exit_destroy; ++ + /* + * initialize pullups according to platform data and cache the + * register values for later use. +@@ -213,10 +217,6 @@ int __max730x_probe(struct max7301 *ts) + } + } + +- ret = gpiochip_add_data(&ts->chip, ts); +- if (ret) +- goto exit_destroy; +- + return ret; + + exit_destroy: diff --git a/queue-4.7/i2c-cros-ec-tunnel-fix-usage-of-cros_ec_cmd_xfer.patch b/queue-4.7/i2c-cros-ec-tunnel-fix-usage-of-cros_ec_cmd_xfer.patch new file mode 100644 index 00000000000..1b2fe78e651 --- /dev/null +++ b/queue-4.7/i2c-cros-ec-tunnel-fix-usage-of-cros_ec_cmd_xfer.patch @@ -0,0 +1,42 @@ +From 4d01d88019261d05ec3bff5f1a6013393faa3b9e Mon Sep 17 00:00:00 2001 +From: Brian Norris +Date: Wed, 10 Aug 2016 13:37:18 -0700 +Subject: i2c: cros-ec-tunnel: Fix usage of cros_ec_cmd_xfer() + +From: Brian Norris + +commit 4d01d88019261d05ec3bff5f1a6013393faa3b9e upstream. + +cros_ec_cmd_xfer returns success status if the command transport +completes successfully, but the execution result is incorrectly ignored. +In many cases, the execution result is assumed to be successful, leading +to ignored errors and operating on uninitialized data. + +We've recently introduced the cros_ec_cmd_xfer_status() helper to avoid these +problems. Let's use it. + +[Regarding the 'Fixes' tag; there is significant refactoring since the driver's +introduction, but the underlying logical error exists throughout I believe] + +Fixes: 9d230c9e4f4e ("i2c: ChromeOS EC tunnel driver") +Signed-off-by: Brian Norris +Reviewed-by: Javier Martinez Canillas +Reviewed-by: Guenter Roeck +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-cros-ec-tunnel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/i2c/busses/i2c-cros-ec-tunnel.c ++++ b/drivers/i2c/busses/i2c-cros-ec-tunnel.c +@@ -215,7 +215,7 @@ static int ec_i2c_xfer(struct i2c_adapte + msg->outsize = request_len; + msg->insize = response_len; + +- result = cros_ec_cmd_xfer(bus->ec, msg); ++ result = cros_ec_cmd_xfer_status(bus->ec, msg); + if (result < 0) { + dev_err(dev, "Error transferring EC i2c message %d\n", result); + goto exit; diff --git a/queue-4.7/i2c-mux-demux-pinctrl-properly-roll-back-when-adding-adapter-fails.patch b/queue-4.7/i2c-mux-demux-pinctrl-properly-roll-back-when-adding-adapter-fails.patch new file mode 100644 index 00000000000..b431a7aaca9 --- /dev/null +++ b/queue-4.7/i2c-mux-demux-pinctrl-properly-roll-back-when-adding-adapter-fails.patch @@ -0,0 +1,41 @@ +From ce8cb803d8b90458495f23606c706f0c0c857cdc Mon Sep 17 00:00:00 2001 +From: Wolfram Sang +Date: Fri, 12 Aug 2016 18:40:23 +0200 +Subject: i2c: mux: demux-pinctrl: properly roll back when adding adapter fails + +From: Wolfram Sang + +commit ce8cb803d8b90458495f23606c706f0c0c857cdc upstream. + +We also need to revert the dynamic OF change, so we get a consistent +state again. Otherwise, we might have two devices enabled e.g. after +pinctrl setup fails. + +Signed-off-by: Wolfram Sang +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/muxes/i2c-demux-pinctrl.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c ++++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c +@@ -68,7 +68,7 @@ static int i2c_demux_activate_master(str + adap = of_find_i2c_adapter_by_node(priv->chan[new_chan].parent_np); + if (!adap) { + ret = -ENODEV; +- goto err; ++ goto err_with_revert; + } + + p = devm_pinctrl_get_select(adap->dev.parent, priv->bus_name); +@@ -103,6 +103,8 @@ static int i2c_demux_activate_master(str + + err_with_put: + i2c_put_adapter(adap); ++ err_with_revert: ++ of_changeset_revert(&priv->chan[new_chan].chgset); + err: + dev_err(priv->dev, "failed to setup demux-adapter %d (%d)\n", new_chan, ret); + return ret; diff --git a/queue-4.7/iio-fix-sched-warning-do-not-call-blocking-ops-when-task_running.patch b/queue-4.7/iio-fix-sched-warning-do-not-call-blocking-ops-when-task_running.patch new file mode 100644 index 00000000000..43d4f63baa9 --- /dev/null +++ b/queue-4.7/iio-fix-sched-warning-do-not-call-blocking-ops-when-task_running.patch @@ -0,0 +1,89 @@ +From fcf68f3c0bb2a541aa47a2a38b8939edf84fd529 Mon Sep 17 00:00:00 2001 +From: Brian Norris +Date: Mon, 8 Aug 2016 17:19:38 -0700 +Subject: iio: fix sched WARNING "do not call blocking ops when !TASK_RUNNING" + +From: Brian Norris + +commit fcf68f3c0bb2a541aa47a2a38b8939edf84fd529 upstream. + +When using CONFIG_DEBUG_ATOMIC_SLEEP, the scheduler nicely points out +that we're calling sleeping primitives within the wait_event loop, which +means we might clobber the task state: + +[ 10.831289] do not call blocking ops when !TASK_RUNNING; state=1 set at [] +[ 10.845531] ------------[ cut here ]------------ +[ 10.850161] WARNING: at kernel/sched/core.c:7630 +... +[ 12.164333] ---[ end trace 45409966a9a76438 ]--- +[ 12.168942] Call trace: +[ 12.171391] [] __might_sleep+0x64/0x90 +[ 12.176699] [] mutex_lock_nested+0x50/0x3fc +[ 12.182440] [] iio_kfifo_buf_data_available+0x28/0x4c +[ 12.189043] [] iio_buffer_ready+0x60/0xe0 +[ 12.194608] [] iio_buffer_read_first_n_outer+0x108/0x1a8 +[ 12.201474] [] __vfs_read+0x58/0x114 +[ 12.206606] [] vfs_read+0x94/0x118 +[ 12.211564] [] SyS_read+0x64/0xb4 +[ 12.216436] [] el0_svc_naked+0x24/0x28 + +To avoid this, we should (a la https://lwn.net/Articles/628628/) use the +wait_woken() function, which avoids the nested sleeping while still +handling races between waiting / wake-events. + +Signed-off-by: Brian Norris +Reviewed-by: Lars-Peter Clausen +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/industrialio-buffer.c | 25 ++++++++++++++++++------- + 1 file changed, 18 insertions(+), 7 deletions(-) + +--- a/drivers/iio/industrialio-buffer.c ++++ b/drivers/iio/industrialio-buffer.c +@@ -107,6 +107,7 @@ ssize_t iio_buffer_read_first_n_outer(st + { + struct iio_dev *indio_dev = filp->private_data; + struct iio_buffer *rb = indio_dev->buffer; ++ DEFINE_WAIT_FUNC(wait, woken_wake_function); + size_t datum_size; + size_t to_wait; + int ret; +@@ -131,19 +132,29 @@ ssize_t iio_buffer_read_first_n_outer(st + else + to_wait = min_t(size_t, n / datum_size, rb->watermark); + ++ add_wait_queue(&rb->pollq, &wait); + do { +- ret = wait_event_interruptible(rb->pollq, +- iio_buffer_ready(indio_dev, rb, to_wait, n / datum_size)); +- if (ret) +- return ret; +- +- if (!indio_dev->info) +- return -ENODEV; ++ if (!indio_dev->info) { ++ ret = -ENODEV; ++ break; ++ } ++ ++ if (!iio_buffer_ready(indio_dev, rb, to_wait, n / datum_size)) { ++ if (signal_pending(current)) { ++ ret = -ERESTARTSYS; ++ break; ++ } ++ ++ wait_woken(&wait, TASK_INTERRUPTIBLE, ++ MAX_SCHEDULE_TIMEOUT); ++ continue; ++ } + + ret = rb->access->read_first_n(rb, n, buf); + if (ret == 0 && (filp->f_flags & O_NONBLOCK)) + ret = -EAGAIN; + } while (ret == 0); ++ remove_wait_queue(&rb->pollq, &wait); + + return ret; + } diff --git a/queue-4.7/iommu-arm-smmu-disable-stalling-faults-for-all-endpoints.patch b/queue-4.7/iommu-arm-smmu-disable-stalling-faults-for-all-endpoints.patch new file mode 100644 index 00000000000..b868b475da3 --- /dev/null +++ b/queue-4.7/iommu-arm-smmu-disable-stalling-faults-for-all-endpoints.patch @@ -0,0 +1,93 @@ +From 3714ce1d6655098ee69ede632883e5874d67e4ab Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Fri, 5 Aug 2016 19:49:45 +0100 +Subject: iommu/arm-smmu: Disable stalling faults for all endpoints + +From: Will Deacon + +commit 3714ce1d6655098ee69ede632883e5874d67e4ab upstream. + +Enabling stalling faults can result in hardware deadlock on poorly +designed systems, particularly those with a PCI root complex upstream of +the SMMU. + +Although it's not really Linux's job to save hardware integrators from +their own misfortune, it *is* our job to stop userspace (e.g. VFIO +clients) from hosing the system for everybody else, even if they might +already be required to have elevated privileges. + +Given that the fault handling code currently executes entirely in IRQ +context, there is nothing that can sensibly be done to recover from +things like page faults anyway, so let's rip this code out for now and +avoid the potential for deadlock. + +Fixes: 48ec83bcbcf5 ("iommu/arm-smmu: Add initial driver support for ARM SMMUv3 devices") +Reported-by: Matt Evans +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iommu/arm-smmu.c | 34 +++++++--------------------------- + 1 file changed, 7 insertions(+), 27 deletions(-) + +--- a/drivers/iommu/arm-smmu.c ++++ b/drivers/iommu/arm-smmu.c +@@ -686,8 +686,7 @@ static struct iommu_gather_ops arm_smmu_ + + static irqreturn_t arm_smmu_context_fault(int irq, void *dev) + { +- int flags, ret; +- u32 fsr, fsynr, resume; ++ u32 fsr, fsynr; + unsigned long iova; + struct iommu_domain *domain = dev; + struct arm_smmu_domain *smmu_domain = to_smmu_domain(domain); +@@ -701,34 +700,15 @@ static irqreturn_t arm_smmu_context_faul + if (!(fsr & FSR_FAULT)) + return IRQ_NONE; + +- if (fsr & FSR_IGN) +- dev_err_ratelimited(smmu->dev, +- "Unexpected context fault (fsr 0x%x)\n", +- fsr); +- + fsynr = readl_relaxed(cb_base + ARM_SMMU_CB_FSYNR0); +- flags = fsynr & FSYNR0_WNR ? IOMMU_FAULT_WRITE : IOMMU_FAULT_READ; +- + iova = readq_relaxed(cb_base + ARM_SMMU_CB_FAR); +- if (!report_iommu_fault(domain, smmu->dev, iova, flags)) { +- ret = IRQ_HANDLED; +- resume = RESUME_RETRY; +- } else { +- dev_err_ratelimited(smmu->dev, +- "Unhandled context fault: iova=0x%08lx, fsynr=0x%x, cb=%d\n", +- iova, fsynr, cfg->cbndx); +- ret = IRQ_NONE; +- resume = RESUME_TERMINATE; +- } + +- /* Clear the faulting FSR */ +- writel(fsr, cb_base + ARM_SMMU_CB_FSR); +- +- /* Retry or terminate any stalled transactions */ +- if (fsr & FSR_SS) +- writel_relaxed(resume, cb_base + ARM_SMMU_CB_RESUME); ++ dev_err_ratelimited(smmu->dev, ++ "Unhandled context fault: fsr=0x%x, iova=0x%08lx, fsynr=0x%x, cb=%d\n", ++ fsr, iova, fsynr, cfg->cbndx); + +- return ret; ++ writel(fsr, cb_base + ARM_SMMU_CB_FSR); ++ return IRQ_HANDLED; + } + + static irqreturn_t arm_smmu_global_fault(int irq, void *dev) +@@ -837,7 +817,7 @@ static void arm_smmu_init_context_bank(s + } + + /* SCTLR */ +- reg = SCTLR_CFCFG | SCTLR_CFIE | SCTLR_CFRE | SCTLR_M | SCTLR_EAE_SBOP; ++ reg = SCTLR_CFIE | SCTLR_CFRE | SCTLR_M | SCTLR_EAE_SBOP; + if (stage1) + reg |= SCTLR_S1_ASIDPNE; + #ifdef __BIG_ENDIAN diff --git a/queue-4.7/iommu-arm-smmu-don-t-bug-if-we-find-aborting-stes-with-disable_bypass.patch b/queue-4.7/iommu-arm-smmu-don-t-bug-if-we-find-aborting-stes-with-disable_bypass.patch new file mode 100644 index 00000000000..9adf70d25e2 --- /dev/null +++ b/queue-4.7/iommu-arm-smmu-don-t-bug-if-we-find-aborting-stes-with-disable_bypass.patch @@ -0,0 +1,41 @@ +From 5bc0a11664e17e9f9551983f5b660bd48b57483c Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Tue, 16 Aug 2016 14:29:16 +0100 +Subject: iommu/arm-smmu: Don't BUG() if we find aborting STEs with disable_bypass + +From: Will Deacon + +commit 5bc0a11664e17e9f9551983f5b660bd48b57483c upstream. + +The disable_bypass cmdline option changes the SMMUv3 driver to put down +faulting stream table entries by default, as opposed to bypassing +transactions from unconfigured devices. + +In this mode of operation, it is entirely expected to see aborting +entries in the stream table if and when we come to installing a valid +translation, so don't trigger a BUG() as a result of misdiagnosing these +entries as stream table corruption. + +Fixes: 48ec83bcbcf5 ("iommu/arm-smmu: Add initial driver support for ARM SMMUv3 devices") +Tested-by: Robin Murphy +Reported-by: Robin Murphy +Reviewed-by: Robin Murphy +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iommu/arm-smmu-v3.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/iommu/arm-smmu-v3.c ++++ b/drivers/iommu/arm-smmu-v3.c +@@ -1034,6 +1034,9 @@ static void arm_smmu_write_strtab_ent(st + case STRTAB_STE_0_CFG_S2_TRANS: + ste_live = true; + break; ++ case STRTAB_STE_0_CFG_ABORT: ++ if (disable_bypass) ++ break; + default: + BUG(); /* STE corruption */ + } diff --git a/queue-4.7/iommu-arm-smmu-fix-cmdq-error-handling.patch b/queue-4.7/iommu-arm-smmu-fix-cmdq-error-handling.patch new file mode 100644 index 00000000000..a886ea3d717 --- /dev/null +++ b/queue-4.7/iommu-arm-smmu-fix-cmdq-error-handling.patch @@ -0,0 +1,55 @@ +From aea2037e0d3e23c3be1498feae29f71ca997d9e6 Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Fri, 29 Jul 2016 11:15:37 +0100 +Subject: iommu/arm-smmu: Fix CMDQ error handling + +From: Will Deacon + +commit aea2037e0d3e23c3be1498feae29f71ca997d9e6 upstream. + +In the unlikely event of a global command queue error, the ARM SMMUv3 +driver attempts to convert the problematic command into a CMD_SYNC and +resume the command queue. Unfortunately, this code is pretty badly +broken: + + 1. It uses the index into the error string table as the CMDQ index, + so we probably read the wrong entry out of the queue + + 2. The arguments to queue_write are the wrong way round, so we end up + writing from the queue onto the stack. + +These happily cancel out, so the kernel is likely to stay alive, but +the command queue will probably fault again when we resume. + +This patch fixes the error handling code to use the correct queue index +and write back the CMD_SYNC to the faulting entry. + +Fixes: 48ec83bcbcf5 ("iommu/arm-smmu: Add initial driver support for ARM SMMUv3 devices") +Reported-by: Diwakar Subraveti +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iommu/arm-smmu-v3.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/iommu/arm-smmu-v3.c ++++ b/drivers/iommu/arm-smmu-v3.c +@@ -879,7 +879,7 @@ static void arm_smmu_cmdq_skip_err(struc + * We may have concurrent producers, so we need to be careful + * not to touch any of the shadow cmdq state. + */ +- queue_read(cmd, Q_ENT(q, idx), q->ent_dwords); ++ queue_read(cmd, Q_ENT(q, cons), q->ent_dwords); + dev_err(smmu->dev, "skipping command in error state:\n"); + for (i = 0; i < ARRAY_SIZE(cmd); ++i) + dev_err(smmu->dev, "\t0x%016llx\n", (unsigned long long)cmd[i]); +@@ -890,7 +890,7 @@ static void arm_smmu_cmdq_skip_err(struc + return; + } + +- queue_write(cmd, Q_ENT(q, idx), q->ent_dwords); ++ queue_write(Q_ENT(q, cons), cmd, q->ent_dwords); + } + + static void arm_smmu_cmdq_issue_cmd(struct arm_smmu_device *smmu, diff --git a/queue-4.7/iommu-dma-don-t-put-uninitialised-iova-domains.patch b/queue-4.7/iommu-dma-don-t-put-uninitialised-iova-domains.patch new file mode 100644 index 00000000000..11e0c41b785 --- /dev/null +++ b/queue-4.7/iommu-dma-don-t-put-uninitialised-iova-domains.patch @@ -0,0 +1,45 @@ +From 3ec60043f7c02e1f79e4a90045ff2d2e80042941 Mon Sep 17 00:00:00 2001 +From: Robin Murphy +Date: Tue, 9 Aug 2016 16:23:17 +0100 +Subject: iommu/dma: Don't put uninitialised IOVA domains + +From: Robin Murphy + +commit 3ec60043f7c02e1f79e4a90045ff2d2e80042941 upstream. + +Due to the limitations of having to wait until we see a device's DMA +restrictions before we know how we want an IOVA domain initialised, +there is a window for error if a DMA ops domain is allocated but later +freed without ever being used. In that case, init_iova_domain() was +never called, so calling put_iova_domain() from iommu_put_dma_cookie() +ends up trying to take an uninitialised lock and crashing. + +Make things robust by skipping the call unless the IOVA domain actually +has been initialised, as we probably should have done from the start. + +Fixes: 0db2e5d18f76 ("iommu: Implement common IOMMU ops for DMA mapping") +Reported-by: Nate Watterson +Reviewed-by: Nate Watterson +Tested-by: Nate Watterson +Reviewed-by: Eric Auger +Tested-by: Eric Auger +Signed-off-by: Robin Murphy +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iommu/dma-iommu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/iommu/dma-iommu.c ++++ b/drivers/iommu/dma-iommu.c +@@ -68,7 +68,8 @@ void iommu_put_dma_cookie(struct iommu_d + if (!iovad) + return; + +- put_iova_domain(iovad); ++ if (iovad->granule) ++ put_iova_domain(iovad); + kfree(iovad); + domain->iova_cookie = NULL; + } diff --git a/queue-4.7/iommu-io-pgtable-arm-v7s-fix-attributes-when-splitting-blocks.patch b/queue-4.7/iommu-io-pgtable-arm-v7s-fix-attributes-when-splitting-blocks.patch new file mode 100644 index 00000000000..0e54bca7a88 --- /dev/null +++ b/queue-4.7/iommu-io-pgtable-arm-v7s-fix-attributes-when-splitting-blocks.patch @@ -0,0 +1,49 @@ +From e633fc7a1347528c3b4a6bbdeb41f5d63988242c Mon Sep 17 00:00:00 2001 +From: Robin Murphy +Date: Thu, 11 Aug 2016 17:44:05 +0100 +Subject: iommu/io-pgtable-arm-v7s: Fix attributes when splitting blocks + +From: Robin Murphy + +commit e633fc7a1347528c3b4a6bbdeb41f5d63988242c upstream. + +Due to the attribute bits being all over the place in the different +types of short-descriptor PTEs, when remapping an existing entry, e.g. +splitting a section into pages, we take the approach of decomposing +the PTE attributes back to the IOMMU API flags to start from scratch. + +On inspection, though, the existing code seems to have got the read-only +bit backwards and ignored the XN bit. How embarrassing... + +Fortunately the primary user so far, the Mediatek IOMMU, both never +splits blocks (because it only serves non-overlapping DMA API calls) and +also ignores permissions anyway, but let's put things right before any +future users trip up. + +Fixes: e5fc9753b1a8 ("iommu/io-pgtable: Add ARMv7 short descriptor support") +Signed-off-by: Robin Murphy +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iommu/io-pgtable-arm-v7s.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/iommu/io-pgtable-arm-v7s.c ++++ b/drivers/iommu/io-pgtable-arm-v7s.c +@@ -286,12 +286,14 @@ static int arm_v7s_pte_to_prot(arm_v7s_i + int prot = IOMMU_READ; + arm_v7s_iopte attr = pte >> ARM_V7S_ATTR_SHIFT(lvl); + +- if (attr & ARM_V7S_PTE_AP_RDONLY) ++ if (!(attr & ARM_V7S_PTE_AP_RDONLY)) + prot |= IOMMU_WRITE; + if ((attr & (ARM_V7S_TEX_MASK << ARM_V7S_TEX_SHIFT)) == 0) + prot |= IOMMU_MMIO; + else if (pte & ARM_V7S_ATTR_C) + prot |= IOMMU_CACHE; ++ if (pte & ARM_V7S_ATTR_XN(lvl)) ++ prot |= IOMMU_NOEXEC; + + return prot; + } diff --git a/queue-4.7/mac80211-fix-purging-multicast-ps-buffer-queue.patch b/queue-4.7/mac80211-fix-purging-multicast-ps-buffer-queue.patch new file mode 100644 index 00000000000..720c4dc7912 --- /dev/null +++ b/queue-4.7/mac80211-fix-purging-multicast-ps-buffer-queue.patch @@ -0,0 +1,65 @@ +From 6b07d9ca9b5363dda959b9582a3fc9c0b89ef3b5 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Tue, 2 Aug 2016 11:13:41 +0200 +Subject: mac80211: fix purging multicast PS buffer queue + +From: Felix Fietkau + +commit 6b07d9ca9b5363dda959b9582a3fc9c0b89ef3b5 upstream. + +The code currently assumes that buffered multicast PS frames don't have +a pending ACK frame for tx status reporting. +However, hostapd sends a broadcast deauth frame on teardown for which tx +status is requested. This can lead to the "Have pending ack frames" +warning on module reload. +Fix this by using ieee80211_free_txskb/ieee80211_purge_tx_queue. + +Signed-off-by: Felix Fietkau +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/cfg.c | 2 +- + net/mac80211/tx.c | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -869,7 +869,7 @@ static int ieee80211_stop_ap(struct wiph + + /* free all potentially still buffered bcast frames */ + local->total_ps_buffered -= skb_queue_len(&sdata->u.ap.ps.bc_buf); +- skb_queue_purge(&sdata->u.ap.ps.bc_buf); ++ ieee80211_purge_tx_queue(&local->hw, &sdata->u.ap.ps.bc_buf); + + mutex_lock(&local->mtx); + ieee80211_vif_copy_chanctx_to_vlans(sdata, true); +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -365,7 +365,7 @@ static void purge_old_ps_buffers(struct + skb = skb_dequeue(&ps->bc_buf); + if (skb) { + purged++; +- dev_kfree_skb(skb); ++ ieee80211_free_txskb(&local->hw, skb); + } + total += skb_queue_len(&ps->bc_buf); + } +@@ -448,7 +448,7 @@ ieee80211_tx_h_multicast_ps_buf(struct i + if (skb_queue_len(&ps->bc_buf) >= AP_MAX_BC_BUFFER) { + ps_dbg(tx->sdata, + "BC TX buffer full - dropping the oldest frame\n"); +- dev_kfree_skb(skb_dequeue(&ps->bc_buf)); ++ ieee80211_free_txskb(&tx->local->hw, skb_dequeue(&ps->bc_buf)); + } else + tx->local->total_ps_buffered++; + +@@ -4055,7 +4055,7 @@ ieee80211_get_buffered_bc(struct ieee802 + sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev); + if (!ieee80211_tx_prepare(sdata, &tx, NULL, skb)) + break; +- dev_kfree_skb_any(skb); ++ ieee80211_free_txskb(hw, skb); + } + + info = IEEE80211_SKB_CB(skb); diff --git a/queue-4.7/megaraid_sas-fix-probing-cards-without-io-port.patch b/queue-4.7/megaraid_sas-fix-probing-cards-without-io-port.patch new file mode 100644 index 00000000000..56638a7d4ce --- /dev/null +++ b/queue-4.7/megaraid_sas-fix-probing-cards-without-io-port.patch @@ -0,0 +1,84 @@ +From e7f851684efb3377e9c93aca7fae6e76212e5680 Mon Sep 17 00:00:00 2001 +From: Yinghai Lu +Date: Fri, 5 Aug 2016 23:37:34 -0700 +Subject: megaraid_sas: Fix probing cards without io port + +From: Yinghai Lu + +commit e7f851684efb3377e9c93aca7fae6e76212e5680 upstream. + +Found one megaraid_sas HBA probe fails, + +[ 187.235190] scsi host2: Avago SAS based MegaRAID driver +[ 191.112365] megaraid_sas 0000:89:00.0: BAR 0: can't reserve [io 0x0000-0x00ff] +[ 191.120548] megaraid_sas 0000:89:00.0: IO memory region busy! + +and the card has resource like, +[ 125.097714] pci 0000:89:00.0: [1000:005d] type 00 class 0x010400 +[ 125.104446] pci 0000:89:00.0: reg 0x10: [io 0x0000-0x00ff] +[ 125.110686] pci 0000:89:00.0: reg 0x14: [mem 0xce400000-0xce40ffff 64bit] +[ 125.118286] pci 0000:89:00.0: reg 0x1c: [mem 0xce300000-0xce3fffff 64bit] +[ 125.125891] pci 0000:89:00.0: reg 0x30: [mem 0xce200000-0xce2fffff pref] + +that does not io port resource allocated from BIOS, and kernel can not +assign one as io port shortage. + +The driver is only looking for MEM, and should not fail. + +It turns out megasas_init_fw() etc are using bar index as mask. index 1 +is used as mask 1, so that pci_request_selected_regions() is trying to +request BAR0 instead of BAR1. + +Fix all related reference. + +Fixes: b6d5d8808b4c ("megaraid_sas: Use lowest memory bar for SR-IOV VF support") +Signed-off-by: Yinghai Lu +Acked-by: Kashyap Desai +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/megaraid/megaraid_sas_base.c | 6 +++--- + drivers/scsi/megaraid/megaraid_sas_fusion.c | 2 +- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -5037,7 +5037,7 @@ static int megasas_init_fw(struct megasa + /* Find first memory bar */ + bar_list = pci_select_bars(instance->pdev, IORESOURCE_MEM); + instance->bar = find_first_bit(&bar_list, sizeof(unsigned long)); +- if (pci_request_selected_regions(instance->pdev, instance->bar, ++ if (pci_request_selected_regions(instance->pdev, 1<bar, + "megasas: LSI")) { + dev_printk(KERN_DEBUG, &instance->pdev->dev, "IO memory region busy!\n"); + return -EBUSY; +@@ -5339,7 +5339,7 @@ fail_ready_state: + iounmap(instance->reg_set); + + fail_ioremap: +- pci_release_selected_regions(instance->pdev, instance->bar); ++ pci_release_selected_regions(instance->pdev, 1<bar); + + return -EINVAL; + } +@@ -5360,7 +5360,7 @@ static void megasas_release_mfi(struct m + + iounmap(instance->reg_set); + +- pci_release_selected_regions(instance->pdev, instance->bar); ++ pci_release_selected_regions(instance->pdev, 1<bar); + } + + /** +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c +@@ -2603,7 +2603,7 @@ megasas_release_fusion(struct megasas_in + + iounmap(instance->reg_set); + +- pci_release_selected_regions(instance->pdev, instance->bar); ++ pci_release_selected_regions(instance->pdev, 1<bar); + } + + /** diff --git a/queue-4.7/mfd-cros_ec-add-cros_ec_cmd_xfer_status-helper.patch b/queue-4.7/mfd-cros_ec-add-cros_ec_cmd_xfer_status-helper.patch new file mode 100644 index 00000000000..92ec490212e --- /dev/null +++ b/queue-4.7/mfd-cros_ec-add-cros_ec_cmd_xfer_status-helper.patch @@ -0,0 +1,72 @@ +From 9798ac6d32c1a32d6d92d853ff507d2d39c4300c Mon Sep 17 00:00:00 2001 +From: Tomeu Vizoso +Date: Fri, 15 Jul 2016 16:28:41 -0700 +Subject: mfd: cros_ec: Add cros_ec_cmd_xfer_status() helper + +From: Tomeu Vizoso + +commit 9798ac6d32c1a32d6d92d853ff507d2d39c4300c upstream. + +So that callers of cros_ec_cmd_xfer() don't have to repeat boilerplate +code when checking for errors from the EC side. + +Signed-off-by: Tomeu Vizoso +Reviewed-by: Benson Leung +Signed-off-by: Brian Norris +Acked-by: Lee Jones +Tested-by: Enric Balletbo i Serra +Signed-off-by: Thierry Reding +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/chrome/cros_ec_proto.c | 17 +++++++++++++++++ + include/linux/mfd/cros_ec.h | 15 +++++++++++++++ + 2 files changed, 32 insertions(+) + +--- a/drivers/platform/chrome/cros_ec_proto.c ++++ b/drivers/platform/chrome/cros_ec_proto.c +@@ -380,3 +380,20 @@ int cros_ec_cmd_xfer(struct cros_ec_devi + return ret; + } + EXPORT_SYMBOL(cros_ec_cmd_xfer); ++ ++int cros_ec_cmd_xfer_status(struct cros_ec_device *ec_dev, ++ struct cros_ec_command *msg) ++{ ++ int ret; ++ ++ ret = cros_ec_cmd_xfer(ec_dev, msg); ++ if (ret < 0) { ++ dev_err(ec_dev->dev, "Command xfer error (err:%d)\n", ret); ++ } else if (msg->result != EC_RES_SUCCESS) { ++ dev_dbg(ec_dev->dev, "Command result (err: %d)\n", msg->result); ++ return -EPROTO; ++ } ++ ++ return ret; ++} ++EXPORT_SYMBOL(cros_ec_cmd_xfer_status); +--- a/include/linux/mfd/cros_ec.h ++++ b/include/linux/mfd/cros_ec.h +@@ -226,6 +226,21 @@ int cros_ec_cmd_xfer(struct cros_ec_devi + struct cros_ec_command *msg); + + /** ++ * cros_ec_cmd_xfer_status - Send a command to the ChromeOS EC ++ * ++ * This function is identical to cros_ec_cmd_xfer, except it returns success ++ * status only if both the command was transmitted successfully and the EC ++ * replied with success status. It's not necessary to check msg->result when ++ * using this function. ++ * ++ * @ec_dev: EC device ++ * @msg: Message to write ++ * @return: Num. of bytes transferred on success, <0 on failure ++ */ ++int cros_ec_cmd_xfer_status(struct cros_ec_device *ec_dev, ++ struct cros_ec_command *msg); ++ ++/** + * cros_ec_remove - Remove a ChromeOS EC + * + * Call this to deregister a ChromeOS EC, then clean up any private data. diff --git a/queue-4.7/mm-silently-skip-readahead-for-dax-inodes.patch b/queue-4.7/mm-silently-skip-readahead-for-dax-inodes.patch new file mode 100644 index 00000000000..731e232de16 --- /dev/null +++ b/queue-4.7/mm-silently-skip-readahead-for-dax-inodes.patch @@ -0,0 +1,62 @@ +From 11bd969fdefea3ac0cb9791224f1e09784e21e58 Mon Sep 17 00:00:00 2001 +From: Ross Zwisler +Date: Thu, 25 Aug 2016 15:17:17 -0700 +Subject: mm: silently skip readahead for DAX inodes + +From: Ross Zwisler + +commit 11bd969fdefea3ac0cb9791224f1e09784e21e58 upstream. + +For DAX inodes we need to be careful to never have page cache pages in +the mapping->page_tree. This radix tree should be composed only of DAX +exceptional entries and zero pages. + +ltp's readahead02 test was triggering a warning because we were trying +to insert a DAX exceptional entry but found that a page cache page had +already been inserted into the tree. This page was being inserted into +the radix tree in response to a readahead(2) call. + +Readahead doesn't make sense for DAX inodes, but we don't want it to +report a failure either. Instead, we just return success and don't do +any work. + +Link: http://lkml.kernel.org/r/20160824221429.21158-1-ross.zwisler@linux.intel.com +Signed-off-by: Ross Zwisler +Reported-by: Jeff Moyer +Cc: Dan Williams +Cc: Dave Chinner +Cc: Dave Hansen +Cc: Jan Kara +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/readahead.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/mm/readahead.c ++++ b/mm/readahead.c +@@ -8,6 +8,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -545,6 +546,14 @@ do_readahead(struct address_space *mappi + if (!mapping || !mapping->a_ops) + return -EINVAL; + ++ /* ++ * Readahead doesn't make sense for DAX inodes, but we don't want it ++ * to report a failure either. Instead, we just return success and ++ * don't do any work. ++ */ ++ if (dax_mapping(mapping)) ++ return 0; ++ + return force_page_cache_readahead(mapping, filp, index, nr); + } + diff --git a/queue-4.7/mpt3sas-fix-resume-on-warpdrive-flash-cards.patch b/queue-4.7/mpt3sas-fix-resume-on-warpdrive-flash-cards.patch new file mode 100644 index 00000000000..8857d606e1d --- /dev/null +++ b/queue-4.7/mpt3sas-fix-resume-on-warpdrive-flash-cards.patch @@ -0,0 +1,97 @@ +From ce7c6c9e1d997a2670aead3a7b87f4df32c11118 Mon Sep 17 00:00:00 2001 +From: Greg Edwards +Date: Sat, 30 Jul 2016 10:06:26 -0600 +Subject: mpt3sas: Fix resume on WarpDrive flash cards + +From: Greg Edwards + +commit ce7c6c9e1d997a2670aead3a7b87f4df32c11118 upstream. + +mpt3sas crashes on resume after suspend with WarpDrive flash cards. The +reply_post_host_index array is not set back up after the resume, and we +deference a stale pointer in _base_interrupt(). + +[ 47.309711] BUG: unable to handle kernel paging request at ffffc90001f8006c +[ 47.318289] IP: [] _base_interrupt+0x49f/0xa30 [mpt3sas] +[ 47.326749] PGD 41ccaa067 PUD 41ccab067 PMD 3466c067 PTE 0 +[ 47.333848] Oops: 0002 [#1] SMP +... +[ 47.452708] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.7.0 #6 +[ 47.460506] Hardware name: Dell Inc. OptiPlex 990/06D7TR, BIOS A18 09/24/2013 +[ 47.469629] task: ffffffff81c0d500 ti: ffffffff81c00000 task.ti: ffffffff81c00000 +[ 47.479112] RIP: 0010:[] [] _base_interrupt+0x49f/0xa30 [mpt3sas] +[ 47.490466] RSP: 0018:ffff88041d203e30 EFLAGS: 00010002 +[ 47.497801] RAX: 0000000000000001 RBX: ffff880033f4c000 RCX: 0000000000000001 +[ 47.506973] RDX: ffffc90001f8006c RSI: 0000000000000082 RDI: 0000000000000082 +[ 47.516141] RBP: ffff88041d203eb0 R08: ffff8804118e2820 R09: 0000000000000001 +[ 47.525300] R10: 0000000000000001 R11: 00000000100c0000 R12: 0000000000000000 +[ 47.534457] R13: ffff880412c487e0 R14: ffff88041a8987d8 R15: 0000000000000001 +[ 47.543632] FS: 0000000000000000(0000) GS:ffff88041d200000(0000) knlGS:0000000000000000 +[ 47.553796] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 47.561632] CR2: ffffc90001f8006c CR3: 0000000001c06000 CR4: 00000000000406f0 +[ 47.570883] Stack: +[ 47.575015] 000000001d211228 ffff88041d2100c0 ffff8800c47d8130 0000000000000100 +[ 47.584625] ffff8804100c0000 100c000000000000 ffff88041a8992a0 ffff88041a8987f8 +[ 47.594230] ffff88041d203e00 ffffffff81111e55 000000000000038c ffff880414ad4280 +[ 47.603862] Call Trace: +[ 47.608474] +[ 47.610413] [] ? call_timer_fn+0x35/0x120 +[ 47.620539] [] handle_irq_event_percpu+0x7f/0x1c0 +[ 47.629061] [] handle_irq_event+0x2c/0x50 +[ 47.636859] [] handle_edge_irq+0x6f/0x130 +[ 47.644654] [] handle_irq+0x73/0x120 +[ 47.652011] [] ? atomic_notifier_call_chain+0x1a/0x20 +[ 47.660854] [] do_IRQ+0x4b/0xd0 +[ 47.667777] [] common_interrupt+0x8c/0x8c +[ 47.675635] + +Move the reply_post_host_index array setup into +mpt3sas_base_map_resources(), which is also in the resume path. + +Signed-off-by: Greg Edwards +Acked-by: Chaitra P B +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/mpt3sas/mpt3sas_base.c | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -2188,6 +2188,17 @@ mpt3sas_base_map_resources(struct MPT3SA + } else + ioc->msix96_vector = 0; + ++ if (ioc->is_warpdrive) { ++ ioc->reply_post_host_index[0] = (resource_size_t __iomem *) ++ &ioc->chip->ReplyPostHostIndex; ++ ++ for (i = 1; i < ioc->cpu_msix_table_sz; i++) ++ ioc->reply_post_host_index[i] = ++ (resource_size_t __iomem *) ++ ((u8 __iomem *)&ioc->chip->Doorbell + (0x4000 + ((i - 1) ++ * 4))); ++ } ++ + list_for_each_entry(reply_q, &ioc->reply_queue_list, list) + pr_info(MPT3SAS_FMT "%s: IRQ %d\n", + reply_q->name, ((ioc->msix_enable) ? "PCI-MSI-X enabled" : +@@ -5280,17 +5291,6 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPT + if (r) + goto out_free_resources; + +- if (ioc->is_warpdrive) { +- ioc->reply_post_host_index[0] = (resource_size_t __iomem *) +- &ioc->chip->ReplyPostHostIndex; +- +- for (i = 1; i < ioc->cpu_msix_table_sz; i++) +- ioc->reply_post_host_index[i] = +- (resource_size_t __iomem *) +- ((u8 __iomem *)&ioc->chip->Doorbell + (0x4000 + ((i - 1) +- * 4))); +- } +- + pci_set_drvdata(ioc->pdev, ioc->shost); + r = _base_get_ioc_facts(ioc, CAN_SLEEP); + if (r) diff --git a/queue-4.7/of-fix-reference-counting-in-of_graph_get_endpoint_by_regs.patch b/queue-4.7/of-fix-reference-counting-in-of_graph_get_endpoint_by_regs.patch new file mode 100644 index 00000000000..42e8c32b080 --- /dev/null +++ b/queue-4.7/of-fix-reference-counting-in-of_graph_get_endpoint_by_regs.patch @@ -0,0 +1,53 @@ +From 34276bb062b8449b3b0a208c9b848a1a27920075 Mon Sep 17 00:00:00 2001 +From: Lucas Stach +Date: Mon, 15 Aug 2016 14:58:43 +0200 +Subject: of: fix reference counting in of_graph_get_endpoint_by_regs + +From: Lucas Stach + +commit 34276bb062b8449b3b0a208c9b848a1a27920075 upstream. + +The called of_graph_get_next_endpoint() already decrements the refcount +of the prev node, so it is wrong to do it again in the calling function. + +Use the for_each_endpoint_of_node() helper to interate through the +endpoint OF nodes, which already does the right thing and simplifies +the code a bit. + +Fixes: 8ccd0d0ca041 +(of: add helper for getting endpoint node of specific identifiers) +Reported-by: David Jander +Signed-off-by: Lucas Stach +Acked-by: Philipp Zabel +Signed-off-by: Rob Herring +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/of/base.c | 11 ++--------- + 1 file changed, 2 insertions(+), 9 deletions(-) + +--- a/drivers/of/base.c ++++ b/drivers/of/base.c +@@ -2318,20 +2318,13 @@ struct device_node *of_graph_get_endpoin + const struct device_node *parent, int port_reg, int reg) + { + struct of_endpoint endpoint; +- struct device_node *node, *prev_node = NULL; +- +- while (1) { +- node = of_graph_get_next_endpoint(parent, prev_node); +- of_node_put(prev_node); +- if (!node) +- break; ++ struct device_node *node = NULL; + ++ for_each_endpoint_of_node(parent, node) { + of_graph_parse_endpoint(node, &endpoint); + if (((port_reg == -1) || (endpoint.port == port_reg)) && + ((reg == -1) || (endpoint.id == reg))) + return node; +- +- prev_node = node; + } + + return NULL; diff --git a/queue-4.7/perf-core-fix-event_function_local.patch b/queue-4.7/perf-core-fix-event_function_local.patch new file mode 100644 index 00000000000..3af4079717b --- /dev/null +++ b/queue-4.7/perf-core-fix-event_function_local.patch @@ -0,0 +1,112 @@ +From cca2094605efe6ccf43ff2876dd5bccc799202d8 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Tue, 16 Aug 2016 13:33:26 +0200 +Subject: perf/core: Fix event_function_local() + +From: Peter Zijlstra + +commit cca2094605efe6ccf43ff2876dd5bccc799202d8 upstream. + +Vincent reported triggering the WARN_ON_ONCE() in event_function_local(). + +While thinking through cases I noticed that by using event_function() +directly, we miss the inactive case usually handled by +event_function_call(). + +Therefore construct a blend of event_function_call() and +event_function() that handles the cases relevant to +event_function_local(). + +Reported-by: Vince Weaver +Signed-off-by: Peter Zijlstra (Intel) +Cc: Alexander Shishkin +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Stephane Eranian +Cc: Thomas Gleixner +Fixes: fae3fde65138 ("perf: Collapse and fix event_function_call() users") +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/events/core.c | 60 ++++++++++++++++++++++++++++++++++++++++----------- + 1 file changed, 48 insertions(+), 12 deletions(-) + +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -242,18 +242,6 @@ unlock: + return ret; + } + +-static void event_function_local(struct perf_event *event, event_f func, void *data) +-{ +- struct event_function_struct efs = { +- .event = event, +- .func = func, +- .data = data, +- }; +- +- int ret = event_function(&efs); +- WARN_ON_ONCE(ret); +-} +- + static void event_function_call(struct perf_event *event, event_f func, void *data) + { + struct perf_event_context *ctx = event->ctx; +@@ -303,6 +291,54 @@ again: + raw_spin_unlock_irq(&ctx->lock); + } + ++/* ++ * Similar to event_function_call() + event_function(), but hard assumes IRQs ++ * are already disabled and we're on the right CPU. ++ */ ++static void event_function_local(struct perf_event *event, event_f func, void *data) ++{ ++ struct perf_event_context *ctx = event->ctx; ++ struct perf_cpu_context *cpuctx = __get_cpu_context(ctx); ++ struct task_struct *task = READ_ONCE(ctx->task); ++ struct perf_event_context *task_ctx = NULL; ++ ++ WARN_ON_ONCE(!irqs_disabled()); ++ ++ if (task) { ++ if (task == TASK_TOMBSTONE) ++ return; ++ ++ task_ctx = ctx; ++ } ++ ++ perf_ctx_lock(cpuctx, task_ctx); ++ ++ task = ctx->task; ++ if (task == TASK_TOMBSTONE) ++ goto unlock; ++ ++ if (task) { ++ /* ++ * We must be either inactive or active and the right task, ++ * otherwise we're screwed, since we cannot IPI to somewhere ++ * else. ++ */ ++ if (ctx->is_active) { ++ if (WARN_ON_ONCE(task != current)) ++ goto unlock; ++ ++ if (WARN_ON_ONCE(cpuctx->task_ctx != ctx)) ++ goto unlock; ++ } ++ } else { ++ WARN_ON_ONCE(&cpuctx->ctx != ctx); ++ } ++ ++ func(event, cpuctx, ctx, data); ++unlock: ++ perf_ctx_unlock(cpuctx, task_ctx); ++} ++ + #define PERF_FLAG_ALL (PERF_FLAG_FD_NO_GROUP |\ + PERF_FLAG_FD_OUTPUT |\ + PERF_FLAG_PID_CGROUP |\ diff --git a/queue-4.7/perf-symbols-fix-annotation-of-objects-with-debuginfo-files.patch b/queue-4.7/perf-symbols-fix-annotation-of-objects-with-debuginfo-files.patch new file mode 100644 index 00000000000..79555977788 --- /dev/null +++ b/queue-4.7/perf-symbols-fix-annotation-of-objects-with-debuginfo-files.patch @@ -0,0 +1,49 @@ +From 50de1a0c54cdbc69a6dbcbc323f53daf95a4050e Mon Sep 17 00:00:00 2001 +From: Anton Blanchard +Date: Sat, 13 Aug 2016 11:55:33 +1000 +Subject: perf symbols: Fix annotation of objects with debuginfo files + +From: Anton Blanchard + +commit 50de1a0c54cdbc69a6dbcbc323f53daf95a4050e upstream. + +Commit 73cdf0c6ea9c ("perf symbols: Record text offset in dso +to calculate objdump address") started storing the offset of +the text section for all DSOs: + + if (elf_section_by_name(elf, &ehdr, &tshdr, ".text", NULL)) + dso->text_offset = tshdr.sh_addr - tshdr.sh_offset; + +Unfortunately this breaks debuginfo files, because we need to calculate +the offset of the text section in the associated executable file. As a +result perf annotate returns junk for all debuginfo files. + +Fix this by using runtime_ss->elf which should point at the executable +when parsing a debuginfo file. + +Signed-off-by: Anton Blanchard +Reviewed-by: Naveen N. Rao +Tested-by: Wang Nan +Cc: Peter Zijlstra +Cc: Ravi Bangoria +Fixes: 73cdf0c6ea9c ("perf symbols: Record text offset in dso to calculate objdump address") +Link: http://lkml.kernel.org/r/20160813115533.6de17912@kryten +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman + +--- + tools/perf/util/symbol-elf.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/tools/perf/util/symbol-elf.c ++++ b/tools/perf/util/symbol-elf.c +@@ -827,7 +827,8 @@ int dso__load_sym(struct dso *dso, struc + sec = syms_ss->symtab; + shdr = syms_ss->symshdr; + +- if (elf_section_by_name(elf, &ehdr, &tshdr, ".text", NULL)) ++ if (elf_section_by_name(runtime_ss->elf, &runtime_ss->ehdr, &tshdr, ++ ".text", NULL)) + dso->text_offset = tshdr.sh_addr - tshdr.sh_offset; + + if (runtime_ss->opdsec) diff --git a/queue-4.7/perf-tools-mem-fix-t-store-option-for-record-command.patch b/queue-4.7/perf-tools-mem-fix-t-store-option-for-record-command.patch new file mode 100644 index 00000000000..8f7e7927697 --- /dev/null +++ b/queue-4.7/perf-tools-mem-fix-t-store-option-for-record-command.patch @@ -0,0 +1,64 @@ +From 33da54fa86e29b87fe1e83bd0f15b4ef2be53ecb Mon Sep 17 00:00:00 2001 +From: Jiri Olsa +Date: Thu, 11 Aug 2016 10:50:57 +0200 +Subject: perf tools mem: Fix -t store option for record command + +From: Jiri Olsa + +commit 33da54fa86e29b87fe1e83bd0f15b4ef2be53ecb upstream. + +Michael reported 'perf mem -t store record' being broken. The reason is +latest rework of this area: + + commit acbe613e0c03 ("perf tools: Add monitored events array") + +We don't mark perf_mem_events store record when -t store option is +specified. + +Committer notes: + +Before: + + # perf mem -t store record usleep 1 + [ perf record: Woken up 1 times to write data ] + [ perf record: Captured and wrote 0.020 MB perf.data (7 samples) ] + # perf evlist + cycles:ppp + # + +After: + + # perf mem -t store record usleep 1 + [ perf record: Woken up 1 times to write data ] + [ perf record: Captured and wrote 0.020 MB perf.data (7 samples) ] + # perf evlist + cpu/mem-stores/P + # + +Reported-by: Michael Petlan +Signed-off-by: Jiri Olsa +Tested-by: Arnaldo Carvalho de Melo +Cc: David Ahern +Cc: Namhyung Kim +Cc: Peter Zijlstra +Fixes: acbe613e0c03 ("perf tools: Add monitored events array") +Link: http://lkml.kernel.org/r/1470905457-18311-1-git-send-email-jolsa@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman + +--- + tools/perf/builtin-mem.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/tools/perf/builtin-mem.c ++++ b/tools/perf/builtin-mem.c +@@ -87,6 +87,9 @@ static int __cmd_record(int argc, const + if (mem->operation & MEM_OPERATION_LOAD) + perf_mem_events[PERF_MEM_EVENTS__LOAD].record = true; + ++ if (mem->operation & MEM_OPERATION_STORE) ++ perf_mem_events[PERF_MEM_EVENTS__STORE].record = true; ++ + if (perf_mem_events[PERF_MEM_EVENTS__LOAD].record) + rec_argv[i++] = "-W"; + diff --git a/queue-4.7/pinctrl-amd-remove-the-default-de-bounce-time.patch b/queue-4.7/pinctrl-amd-remove-the-default-de-bounce-time.patch new file mode 100644 index 00000000000..769d51b887e --- /dev/null +++ b/queue-4.7/pinctrl-amd-remove-the-default-de-bounce-time.patch @@ -0,0 +1,65 @@ +From 8cf4345575a416e6856a6856ac6eaa31ad883126 Mon Sep 17 00:00:00 2001 +From: "Agrawal, Nitesh-kumar" +Date: Tue, 26 Jul 2016 08:28:19 +0000 +Subject: pinctrl/amd: Remove the default de-bounce time +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Agrawal, Nitesh-kumar + +commit 8cf4345575a416e6856a6856ac6eaa31ad883126 upstream. + +In the function amd_gpio_irq_enable() and +amd_gpio_direction_input(), remove the code which is setting +the default de-bounce time to 2.75ms. + +The driver code shall use the same settings as specified in +BIOS. Any default assignment impacts TouchPad behaviour when +the LevelTrig is set to EDGE FALLING. + +Reviewed-by:  Ken Xue +Signed-off-by: Nitesh Kumar Agrawal +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pinctrl/pinctrl-amd.c | 20 -------------------- + 1 file changed, 20 deletions(-) + +--- a/drivers/pinctrl/pinctrl-amd.c ++++ b/drivers/pinctrl/pinctrl-amd.c +@@ -43,17 +43,6 @@ static int amd_gpio_direction_input(stru + + spin_lock_irqsave(&gpio_dev->lock, flags); + pin_reg = readl(gpio_dev->base + offset * 4); +- /* +- * Suppose BIOS or Bootloader sets specific debounce for the +- * GPIO. if not, set debounce to be 2.75ms and remove glitch. +- */ +- if ((pin_reg & DB_TMR_OUT_MASK) == 0) { +- pin_reg |= 0xf; +- pin_reg |= BIT(DB_TMR_OUT_UNIT_OFF); +- pin_reg |= DB_TYPE_REMOVE_GLITCH << DB_CNTRL_OFF; +- pin_reg &= ~BIT(DB_TMR_LARGE_OFF); +- } +- + pin_reg &= ~BIT(OUTPUT_ENABLE_OFF); + writel(pin_reg, gpio_dev->base + offset * 4); + spin_unlock_irqrestore(&gpio_dev->lock, flags); +@@ -326,15 +315,6 @@ static void amd_gpio_irq_enable(struct i + + spin_lock_irqsave(&gpio_dev->lock, flags); + pin_reg = readl(gpio_dev->base + (d->hwirq)*4); +- /* +- Suppose BIOS or Bootloader sets specific debounce for the +- GPIO. if not, set debounce to be 2.75ms. +- */ +- if ((pin_reg & DB_TMR_OUT_MASK) == 0) { +- pin_reg |= 0xf; +- pin_reg |= BIT(DB_TMR_OUT_UNIT_OFF); +- pin_reg &= ~BIT(DB_TMR_LARGE_OFF); +- } + pin_reg |= BIT(INTERRUPT_ENABLE_OFF); + pin_reg |= BIT(INTERRUPT_MASK_OFF); + writel(pin_reg, gpio_dev->base + (d->hwirq)*4); diff --git a/queue-4.7/pinctrl-meson-drop-pinctrl_unregister-for-devm_-registered-device.patch b/queue-4.7/pinctrl-meson-drop-pinctrl_unregister-for-devm_-registered-device.patch new file mode 100644 index 00000000000..9e7b6800e49 --- /dev/null +++ b/queue-4.7/pinctrl-meson-drop-pinctrl_unregister-for-devm_-registered-device.patch @@ -0,0 +1,43 @@ +From 5b236d0fde21d88351420ef0b9a6cb7aeeea0c54 Mon Sep 17 00:00:00 2001 +From: Wei Yongjun +Date: Tue, 26 Jul 2016 14:51:58 +0000 +Subject: pinctrl: meson: Drop pinctrl_unregister for devm_ registered device + +From: Wei Yongjun + +commit 5b236d0fde21d88351420ef0b9a6cb7aeeea0c54 upstream. + +It's not necessary to unregister pin controller device registered +with devm_pinctrl_register() and using pinctrl_unregister() leads +to a double free. + +This is detected by Coccinelle semantic patch. + +Fixes: e649f7ec8c5f ("pinctrl: meson: Use devm_pinctrl_register() for pinctrl registration") +Signed-off-by: Wei Yongjun +Reviewed-by: Dmitry Torokhov +Acked-by: Kevin Hilman +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pinctrl/meson/pinctrl-meson.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +--- a/drivers/pinctrl/meson/pinctrl-meson.c ++++ b/drivers/pinctrl/meson/pinctrl-meson.c +@@ -727,13 +727,7 @@ static int meson_pinctrl_probe(struct pl + return PTR_ERR(pc->pcdev); + } + +- ret = meson_gpiolib_register(pc); +- if (ret) { +- pinctrl_unregister(pc->pcdev); +- return ret; +- } +- +- return 0; ++ return meson_gpiolib_register(pc); + } + + static struct platform_driver meson_pinctrl_driver = { diff --git a/queue-4.7/s390-dasd-fix-hanging-device-after-clear-subchannel.patch b/queue-4.7/s390-dasd-fix-hanging-device-after-clear-subchannel.patch new file mode 100644 index 00000000000..2f64cdcadb5 --- /dev/null +++ b/queue-4.7/s390-dasd-fix-hanging-device-after-clear-subchannel.patch @@ -0,0 +1,56 @@ +From 9ba333dc55cbb9523553df973adb3024d223e905 Mon Sep 17 00:00:00 2001 +From: Stefan Haberland +Date: Mon, 8 Aug 2016 14:08:17 +0200 +Subject: s390/dasd: fix hanging device after clear subchannel + +From: Stefan Haberland + +commit 9ba333dc55cbb9523553df973adb3024d223e905 upstream. + +When a device is in a status where CIO has killed all I/O by itself the +interrupt for a clear request may not contain an irb to determine the +clear function. Instead it contains an error pointer -EIO. +This was ignored by the DASD int_handler leading to a hanging device +waiting for a clear interrupt. + +Handle -EIO error pointer correctly for requests that are clear pending and +treat the clear as successful. + +Signed-off-by: Stefan Haberland +Reviewed-by: Sebastian Ott +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/s390/block/dasd.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/s390/block/dasd.c ++++ b/drivers/s390/block/dasd.c +@@ -1643,9 +1643,18 @@ void dasd_int_handler(struct ccw_device + u8 *sense = NULL; + int expires; + ++ cqr = (struct dasd_ccw_req *) intparm; + if (IS_ERR(irb)) { + switch (PTR_ERR(irb)) { + case -EIO: ++ if (cqr && cqr->status == DASD_CQR_CLEAR_PENDING) { ++ device = (struct dasd_device *) cqr->startdev; ++ cqr->status = DASD_CQR_CLEARED; ++ dasd_device_clear_timer(device); ++ wake_up(&dasd_flush_wq); ++ dasd_schedule_device_bh(device); ++ return; ++ } + break; + case -ETIMEDOUT: + DBF_EVENT_DEVID(DBF_WARNING, cdev, "%s: " +@@ -1661,7 +1670,6 @@ void dasd_int_handler(struct ccw_device + } + + now = get_tod_clock(); +- cqr = (struct dasd_ccw_req *) intparm; + /* check for conditions that should be handled immediately */ + if (!cqr || + !(scsw_dstat(&irb->scsw) == (DEV_STAT_CHN_END | DEV_STAT_DEV_END) && diff --git a/queue-4.7/sched-cputime-fix-no_hz_full-getrusage-monotonicity-regression.patch b/queue-4.7/sched-cputime-fix-no_hz_full-getrusage-monotonicity-regression.patch new file mode 100644 index 00000000000..8af429d200a --- /dev/null +++ b/queue-4.7/sched-cputime-fix-no_hz_full-getrusage-monotonicity-regression.patch @@ -0,0 +1,86 @@ +From 173be9a14f7b2e901cf77c18b1aafd4d672e9d9e Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Mon, 15 Aug 2016 18:38:42 +0200 +Subject: sched/cputime: Fix NO_HZ_FULL getrusage() monotonicity regression + +From: Peter Zijlstra + +commit 173be9a14f7b2e901cf77c18b1aafd4d672e9d9e upstream. + +Mike reports: + + Roughly 10% of the time, ltp testcase getrusage04 fails: + getrusage04 0 TINFO : Expected timers granularity is 4000 us + getrusage04 0 TINFO : Using 1 as multiply factor for max [us]time increment (1000+4000us)! + getrusage04 0 TINFO : utime: 0us; stime: 179us + getrusage04 0 TINFO : utime: 3751us; stime: 0us + getrusage04 1 TFAIL : getrusage04.c:133: stime increased > 5000us: + +And tracked it down to the case where the task simply doesn't get +_any_ [us]time ticks. + +Update the code to assume all rtime is utime when we lack information, +thus ensuring a task that elides the tick gets time accounted. + +Reported-by: Mike Galbraith +Tested-by: Mike Galbraith +Signed-off-by: Peter Zijlstra (Intel) +Cc: Frederic Weisbecker +Cc: Fredrik Markstrom +Cc: Linus Torvalds +Cc: Paolo Bonzini +Cc: Peter Zijlstra +Cc: Radim +Cc: Rik van Riel +Cc: Stephane Eranian +Cc: Thomas Gleixner +Cc: Vince Weaver +Cc: Wanpeng Li +Fixes: 9d7fb0427648 ("sched/cputime: Guarantee stime + utime == rtime") +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/sched/cputime.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +--- a/kernel/sched/cputime.c ++++ b/kernel/sched/cputime.c +@@ -603,19 +603,25 @@ static void cputime_adjust(struct task_c + stime = curr->stime; + utime = curr->utime; + +- if (utime == 0) { +- stime = rtime; ++ /* ++ * If either stime or both stime and utime are 0, assume all runtime is ++ * userspace. Once a task gets some ticks, the monotonicy code at ++ * 'update' will ensure things converge to the observed ratio. ++ */ ++ if (stime == 0) { ++ utime = rtime; + goto update; + } + +- if (stime == 0) { +- utime = rtime; ++ if (utime == 0) { ++ stime = rtime; + goto update; + } + + stime = scale_stime((__force u64)stime, (__force u64)rtime, + (__force u64)(stime + utime)); + ++update: + /* + * Make sure stime doesn't go backwards; this preserves monotonicity + * for utime because rtime is monotonic. +@@ -638,7 +644,6 @@ static void cputime_adjust(struct task_c + stime = rtime - utime; + } + +-update: + prev->stime = stime; + prev->utime = utime; + out: diff --git a/queue-4.7/series b/queue-4.7/series index baa54c7028b..58f51c4308b 100644 --- a/queue-4.7/series +++ b/queue-4.7/series @@ -52,3 +52,62 @@ usb-serial-option-add-support-for-telit-le920a4.patch usb-serial-ftdi_sio-add-device-id-for-wiced-usb-uart-dev-board.patch usb-serial-ftdi_sio-add-pids-for-ivium-technologies-devices.patch uprobes-fix-the-memcg-accounting.patch +perf-symbols-fix-annotation-of-objects-with-debuginfo-files.patch +perf-core-fix-event_function_local.patch +perf-tools-mem-fix-t-store-option-for-record-command.patch +iommu-dma-don-t-put-uninitialised-iova-domains.patch +iommu-io-pgtable-arm-v7s-fix-attributes-when-splitting-blocks.patch +iommu-arm-smmu-fix-cmdq-error-handling.patch +iommu-arm-smmu-disable-stalling-faults-for-all-endpoints.patch +iommu-arm-smmu-don-t-bug-if-we-find-aborting-stes-with-disable_bypass.patch +pinctrl-meson-drop-pinctrl_unregister-for-devm_-registered-device.patch +pinctrl-amd-remove-the-default-de-bounce-time.patch +i2c-mux-demux-pinctrl-properly-roll-back-when-adding-adapter-fails.patch +edac-sb_edac-fix-channel-reporting-on-knights-landing.patch +s390-dasd-fix-hanging-device-after-clear-subchannel.patch +mac80211-fix-purging-multicast-ps-buffer-queue.patch +arm64-kernel-avoid-literal-load-of-virtual-address-with-mmu-off.patch +arm64-avoid-tlb-conflict-with-config_randomize_base.patch +arm64-dts-rockchip-add-reset-saradc-node-for-rk3368-socs.patch +arm64-kernel-fix-unmasked-debug-exceptions-when-restoring-mdscr_el1.patch +of-fix-reference-counting-in-of_graph_get_endpoint_by_regs.patch +sched-cputime-fix-no_hz_full-getrusage-monotonicity-regression.patch +iio-fix-sched-warning-do-not-call-blocking-ops-when-task_running.patch +drm-amdgpu-change-gart-offset-to-64-bit.patch +drm-amdgpu-fix-amdgpu_move_blit-on-32bit-systems.patch +drm-amdgpu-fix-lru-size-grouping-v2.patch +drm-amdgpu-avoid-a-possible-array-overflow.patch +drm-amdgpu-skip-tv-cv-in-display-parsing.patch +drm-amd-amdgpu-sdma-resume-fail-during-s4-on-ci.patch +drm-amd-amdgpu-compute-ring-test-fail-during-s4-on-ci.patch +drm-amdgpu-record-error-code-when-ring-test-failed.patch +drm-i915-fix-iboost-setting-for-ddi-with-4-lanes-on-skl.patch +drm-i915-program-iboost-settings-for-hdmi-dvi-on-skl.patch +drm-i915-fix-iboost-setting-for-skl-y-u-dp-ddi-buffer-translation-entry-2.patch +drm-i915-acquire-audio-powerwell-for-hd-audio-registers.patch +drm-i915-fix-aliasing_ppgtt-leak.patch +drm-i915-vlv-make-intel_crt_reset-per-encoder.patch +drm-i915-vlv-reset-the-adpa-in-vlv_display_power_well_init.patch +drm-i915-vlv-disable-hpd-in-valleyview_crt_detect_hotplug.patch +drm-i915-enable-polling-when-we-don-t-have-hpd.patch +arc-use-correct-offset-in-pt_regs-for-saving-restoring-user-mode-r25.patch +arc-mm-fix-build-breakage-with-strict_mm_typechecks.patch +arc-call-trace_hardirqs_on-before-enabling-irqs.patch +arc-elide-redundant-setup-of-dma-callbacks.patch +aacraid-check-size-values-after-double-fetch-from-user.patch +mfd-cros_ec-add-cros_ec_cmd_xfer_status-helper.patch +i2c-cros-ec-tunnel-fix-usage-of-cros_ec_cmd_xfer.patch +cdc-acm-fix-wrong-pipe-type-on-rx-interrupt-xfers.patch +mpt3sas-fix-resume-on-warpdrive-flash-cards.patch +megaraid_sas-fix-probing-cards-without-io-port.patch +usb-renesas_usbhs-gadget-fix-return-value-check-in-usbhs_mod_gadget_probe.patch +dm-round-robin-do-not-use-this_cpu_ptr-without-having-preemption-disabled.patch +gpio-fix-of-build-problem-on-um.patch +gpio-max730x-set-gpiochip-data-pointer-before-using-it.patch +fs-seq_file-fix-out-of-bounds-read.patch +soft_dirty-fix-soft_dirty-during-thp-split.patch +dax-fix-device-dax-region-base.patch +mm-silently-skip-readahead-for-dax-inodes.patch +btrfs-waiting-on-qgroup-rescan-should-not-always-be-interruptible.patch +btrfs-properly-track-when-rescan-worker-is-running.patch +btrfs-don-t-create-or-leak-aliased-root-while-cleaning-up-orphans.patch diff --git a/queue-4.7/soft_dirty-fix-soft_dirty-during-thp-split.patch b/queue-4.7/soft_dirty-fix-soft_dirty-during-thp-split.patch new file mode 100644 index 00000000000..d4fa0ff2c54 --- /dev/null +++ b/queue-4.7/soft_dirty-fix-soft_dirty-during-thp-split.patch @@ -0,0 +1,94 @@ +From 804dd150468cfd920d92d4b3cf00536fedef3902 Mon Sep 17 00:00:00 2001 +From: Andrea Arcangeli +Date: Thu, 25 Aug 2016 15:16:57 -0700 +Subject: soft_dirty: fix soft_dirty during THP split + +From: Andrea Arcangeli + +commit 804dd150468cfd920d92d4b3cf00536fedef3902 upstream. + +While adding proper userfaultfd_wp support with bits in pagetable and +swap entry to avoid false positives WP userfaults through swap/fork/ +KSM/etc, I've been adding a framework that mostly mirrors soft dirty. + +So I noticed in one place I had to add uffd_wp support to the pagetables +that wasn't covered by soft_dirty and I think it should have. + +Example: in the THP migration code migrate_misplaced_transhuge_page() +pmd_mkdirty is called unconditionally after mk_huge_pmd. + + entry = mk_huge_pmd(new_page, vma->vm_page_prot); + entry = maybe_pmd_mkwrite(pmd_mkdirty(entry), vma); + +That sets soft dirty too (it's a false positive for soft dirty, the soft +dirty bit could be more finegrained and transfer the bit like uffd_wp +will do.. pmd/pte_uffd_wp() enforces the invariant that when it's set +pmd/pte_write is not set). + +However in the THP split there's no unconditional pmd_mkdirty after +mk_huge_pmd and pte_swp_mksoft_dirty isn't called after the migration +entry is created. The code sets the dirty bit in the struct page +instead of setting it in the pagetable (which is fully equivalent as far +as the real dirty bit is concerned, as the whole point of pagetable bits +is to be eventually flushed out of to the page, but that is not +equivalent for the soft-dirty bit that gets lost in translation). + +This was found by code review only and totally untested as I'm working +to actually replace soft dirty and I don't have time to test potential +soft dirty bugfixes as well :). + +Transfer the soft_dirty from pmd to pte during THP splits. + +This fix avoids losing the soft_dirty bit and avoids userland memory +corruption in the checkpoint. + +Fixes: eef1b3ba053aa6 ("thp: implement split_huge_pmd()") +Link: http://lkml.kernel.org/r/1471610515-30229-2-git-send-email-aarcange@redhat.com +Signed-off-by: Andrea Arcangeli +Acked-by: Pavel Emelyanov +Cc: "Kirill A. Shutemov" +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/huge_memory.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -2872,7 +2872,7 @@ static void __split_huge_pmd_locked(stru + struct page *page; + pgtable_t pgtable; + pmd_t _pmd; +- bool young, write, dirty; ++ bool young, write, dirty, soft_dirty; + unsigned long addr; + int i; + +@@ -2898,6 +2898,7 @@ static void __split_huge_pmd_locked(stru + write = pmd_write(*pmd); + young = pmd_young(*pmd); + dirty = pmd_dirty(*pmd); ++ soft_dirty = pmd_soft_dirty(*pmd); + + pmdp_huge_split_prepare(vma, haddr, pmd); + pgtable = pgtable_trans_huge_withdraw(mm, pmd); +@@ -2914,6 +2915,8 @@ static void __split_huge_pmd_locked(stru + swp_entry_t swp_entry; + swp_entry = make_migration_entry(page + i, write); + entry = swp_entry_to_pte(swp_entry); ++ if (soft_dirty) ++ entry = pte_swp_mksoft_dirty(entry); + } else { + entry = mk_pte(page + i, vma->vm_page_prot); + entry = maybe_mkwrite(entry, vma); +@@ -2921,6 +2924,8 @@ static void __split_huge_pmd_locked(stru + entry = pte_wrprotect(entry); + if (!young) + entry = pte_mkold(entry); ++ if (soft_dirty) ++ entry = pte_mksoft_dirty(entry); + } + if (dirty) + SetPageDirty(page + i); diff --git a/queue-4.7/usb-renesas_usbhs-gadget-fix-return-value-check-in-usbhs_mod_gadget_probe.patch b/queue-4.7/usb-renesas_usbhs-gadget-fix-return-value-check-in-usbhs_mod_gadget_probe.patch new file mode 100644 index 00000000000..e382bdb4e8b --- /dev/null +++ b/queue-4.7/usb-renesas_usbhs-gadget-fix-return-value-check-in-usbhs_mod_gadget_probe.patch @@ -0,0 +1,35 @@ +From 3295235fd70ed6d594aadee8c892a14f6a4b2d2e Mon Sep 17 00:00:00 2001 +From: Wei Yongjun +Date: Sat, 13 Aug 2016 01:28:24 +0000 +Subject: usb: renesas_usbhs: gadget: fix return value check in usbhs_mod_gadget_probe() + +From: Wei Yongjun + +commit 3295235fd70ed6d594aadee8c892a14f6a4b2d2e upstream. + +In case of error, the function usb_get_phy() returns ERR_PTR() and never +returns NULL. The NULL test in the return value check should be replaced +with IS_ERR(). + +Fixes: b5a2875605ca ("usb: renesas_usbhs: Allow an OTG PHY driver to + provide VBUS") +Acked-by: Yoshihiro Shimoda +Signed-off-by: Wei Yongjun +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/renesas_usbhs/mod_gadget.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/renesas_usbhs/mod_gadget.c ++++ b/drivers/usb/renesas_usbhs/mod_gadget.c +@@ -1076,7 +1076,7 @@ int usbhs_mod_gadget_probe(struct usbhs_ + + gpriv->transceiver = usb_get_phy(USB_PHY_TYPE_UNDEFINED); + dev_info(dev, "%stransceiver found\n", +- gpriv->transceiver ? "" : "no "); ++ !IS_ERR(gpriv->transceiver) ? "" : "no "); + + /* + * CAUTION