From: Greg Kroah-Hartman Date: Tue, 24 Mar 2015 10:39:18 +0000 (+0100) Subject: 3.14-stable patches X-Git-Tag: v3.19.3~20 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=784eb60b74d2d8564f634c5963c2ef7bef2cb8c0;p=thirdparty%2Fkernel%2Fstable-queue.git 3.14-stable patches added patches: change-email-address-for-8250_pci.patch console-fix-console-name-size-mismatch.patch drm-radeon-do-a-posting-read-in-cik_set_irq.patch drm-radeon-do-a-posting-read-in-evergreen_set_irq.patch drm-radeon-do-a-posting-read-in-r100_set_irq.patch drm-radeon-do-a-posting-read-in-r600_set_irq.patch drm-radeon-do-a-posting-read-in-rs600_set_irq.patch drm-radeon-do-a-posting-read-in-si_set_irq.patch drm-radeon-drop-setting-upll-to-sleep-mode.patch drm-radeon-fix-drm_ioctl_radeon_cs-oops.patch drm-radeon-fix-interlaced-modes-on-dce8.patch fuse-notify-don-t-move-pages.patch fuse-set-stolen-page-uptodate.patch lz4-fix-the-data-abort-issue.patch virtio_console-avoid-config-access-from-irq.patch virtio_console-init-work-unconditionally.patch --- diff --git a/queue-3.14/change-email-address-for-8250_pci.patch b/queue-3.14/change-email-address-for-8250_pci.patch new file mode 100644 index 00000000000..0d48d6b4b53 --- /dev/null +++ b/queue-3.14/change-email-address-for-8250_pci.patch @@ -0,0 +1,30 @@ +From f2e0ea861117bda073d1d7ffbd3120c07c0d5d34 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Fri, 6 Mar 2015 10:49:21 +0000 +Subject: Change email address for 8250_pci + +From: Russell King + +commit f2e0ea861117bda073d1d7ffbd3120c07c0d5d34 upstream. + +I'm still receiving reports to my email address, so let's point this +at the linux-serial mailing list instead. + +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/8250/8250_pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -66,7 +66,7 @@ static void moan_device(const char *str, + "Please send the output of lspci -vv, this\n" + "message (0x%04x,0x%04x,0x%04x,0x%04x), the\n" + "manufacturer and name of serial board or\n" +- "modem board to rmk+serial@arm.linux.org.uk.\n", ++ "modem board to .\n", + pci_name(dev), str, dev->vendor, dev->device, + dev->subsystem_vendor, dev->subsystem_device); + } diff --git a/queue-3.14/console-fix-console-name-size-mismatch.patch b/queue-3.14/console-fix-console-name-size-mismatch.patch new file mode 100644 index 00000000000..41e1a2dbeef --- /dev/null +++ b/queue-3.14/console-fix-console-name-size-mismatch.patch @@ -0,0 +1,44 @@ +From 30a22c215a0007603ffc08021f2e8b64018517dd Mon Sep 17 00:00:00 2001 +From: Peter Hurley +Date: Sun, 1 Mar 2015 10:11:05 -0500 +Subject: console: Fix console name size mismatch + +From: Peter Hurley + +commit 30a22c215a0007603ffc08021f2e8b64018517dd upstream. + +commit 6ae9200f2cab7 ("enlarge console.name") increased the storage +for the console name to 16 bytes, but not the corresponding +struct console_cmdline::name storage. Console names longer than +8 bytes cause read beyond end-of-string and failure to match +console; I'm not sure if there are other unexpected consequences. + +Signed-off-by: Peter Hurley +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/printk/console_cmdline.h | 2 +- + kernel/printk/printk.c | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +--- a/kernel/printk/console_cmdline.h ++++ b/kernel/printk/console_cmdline.h +@@ -3,7 +3,7 @@ + + struct console_cmdline + { +- char name[8]; /* Name of the driver */ ++ char name[16]; /* Name of the driver */ + int index; /* Minor dev. to use */ + char *options; /* Options for the driver */ + #ifdef CONFIG_A11Y_BRAILLE_CONSOLE +--- a/kernel/printk/printk.c ++++ b/kernel/printk/printk.c +@@ -2280,6 +2280,7 @@ void register_console(struct console *ne + for (i = 0, c = console_cmdline; + i < MAX_CMDLINECONSOLES && c->name[0]; + i++, c++) { ++ BUILD_BUG_ON(sizeof(c->name) != sizeof(newcon->name)); + if (strcmp(c->name, newcon->name) != 0) + continue; + if (newcon->index >= 0 && diff --git a/queue-3.14/drm-radeon-do-a-posting-read-in-cik_set_irq.patch b/queue-3.14/drm-radeon-do-a-posting-read-in-cik_set_irq.patch new file mode 100644 index 00000000000..82d9db0c8e2 --- /dev/null +++ b/queue-3.14/drm-radeon-do-a-posting-read-in-cik_set_irq.patch @@ -0,0 +1,33 @@ +From cffefd9bb31cd35ab745d3b49005d10616d25bdc Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 2 Mar 2015 20:45:24 -0500 +Subject: drm/radeon: do a posting read in cik_set_irq + +From: Alex Deucher + +commit cffefd9bb31cd35ab745d3b49005d10616d25bdc upstream. + +To make sure the writes go through the pci bridge. + +bug: +https://bugzilla.kernel.org/show_bug.cgi?id=90741 + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/cik.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/radeon/cik.c ++++ b/drivers/gpu/drm/radeon/cik.c +@@ -7069,6 +7069,9 @@ int cik_irq_set(struct radeon_device *rd + WREG32(DC_HPD5_INT_CONTROL, hpd5); + WREG32(DC_HPD6_INT_CONTROL, hpd6); + ++ /* posting read */ ++ RREG32(SRBM_STATUS); ++ + return 0; + } + diff --git a/queue-3.14/drm-radeon-do-a-posting-read-in-evergreen_set_irq.patch b/queue-3.14/drm-radeon-do-a-posting-read-in-evergreen_set_irq.patch new file mode 100644 index 00000000000..2a4f1a386a5 --- /dev/null +++ b/queue-3.14/drm-radeon-do-a-posting-read-in-evergreen_set_irq.patch @@ -0,0 +1,33 @@ +From c320bb5f6dc0cb88a811cbaf839303e0a3916a92 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 2 Mar 2015 20:42:53 -0500 +Subject: drm/radeon: do a posting read in evergreen_set_irq + +From: Alex Deucher + +commit c320bb5f6dc0cb88a811cbaf839303e0a3916a92 upstream. + +To make sure the writes go through the pci bridge. + +bug: +https://bugzilla.kernel.org/show_bug.cgi?id=90741 + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/evergreen.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/radeon/evergreen.c ++++ b/drivers/gpu/drm/radeon/evergreen.c +@@ -4596,6 +4596,9 @@ int evergreen_irq_set(struct radeon_devi + WREG32(AFMT_AUDIO_PACKET_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET, afmt5); + WREG32(AFMT_AUDIO_PACKET_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET, afmt6); + ++ /* posting read */ ++ RREG32(SRBM_STATUS); ++ + return 0; + } + diff --git a/queue-3.14/drm-radeon-do-a-posting-read-in-r100_set_irq.patch b/queue-3.14/drm-radeon-do-a-posting-read-in-r100_set_irq.patch new file mode 100644 index 00000000000..8113d10eff5 --- /dev/null +++ b/queue-3.14/drm-radeon-do-a-posting-read-in-r100_set_irq.patch @@ -0,0 +1,34 @@ +From f957063fee6392bb9365370db6db74dc0b2dce0a Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 2 Mar 2015 20:36:26 -0500 +Subject: drm/radeon: do a posting read in r100_set_irq + +From: Alex Deucher + +commit f957063fee6392bb9365370db6db74dc0b2dce0a upstream. + +To make sure the writes go through the pci bridge. + +bug: +https://bugzilla.kernel.org/show_bug.cgi?id=90741 + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/r100.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/gpu/drm/radeon/r100.c ++++ b/drivers/gpu/drm/radeon/r100.c +@@ -742,6 +742,10 @@ int r100_irq_set(struct radeon_device *r + tmp |= RADEON_FP2_DETECT_MASK; + } + WREG32(RADEON_GEN_INT_CNTL, tmp); ++ ++ /* read back to post the write */ ++ RREG32(RADEON_GEN_INT_CNTL); ++ + return 0; + } + diff --git a/queue-3.14/drm-radeon-do-a-posting-read-in-r600_set_irq.patch b/queue-3.14/drm-radeon-do-a-posting-read-in-r600_set_irq.patch new file mode 100644 index 00000000000..bf14bf50e78 --- /dev/null +++ b/queue-3.14/drm-radeon-do-a-posting-read-in-r600_set_irq.patch @@ -0,0 +1,33 @@ +From 9d1393f23d5656cdd5f368efd60694d4aeed81d3 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 2 Mar 2015 20:41:31 -0500 +Subject: drm/radeon: do a posting read in r600_set_irq + +From: Alex Deucher + +commit 9d1393f23d5656cdd5f368efd60694d4aeed81d3 upstream. + +To make sure the writes go through the pci bridge. + +bug: +https://bugzilla.kernel.org/show_bug.cgi?id=90741 + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/r600.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/radeon/r600.c ++++ b/drivers/gpu/drm/radeon/r600.c +@@ -3647,6 +3647,9 @@ int r600_irq_set(struct radeon_device *r + WREG32(RV770_CG_THERMAL_INT, thermal_int); + } + ++ /* posting read */ ++ RREG32(R_000E50_SRBM_STATUS); ++ + return 0; + } + diff --git a/queue-3.14/drm-radeon-do-a-posting-read-in-rs600_set_irq.patch b/queue-3.14/drm-radeon-do-a-posting-read-in-rs600_set_irq.patch new file mode 100644 index 00000000000..1a4ab8141af --- /dev/null +++ b/queue-3.14/drm-radeon-do-a-posting-read-in-rs600_set_irq.patch @@ -0,0 +1,34 @@ +From 54acf107e4e66d1f4a697e08a7f60dba9fcf07c3 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 2 Mar 2015 20:39:56 -0500 +Subject: drm/radeon: do a posting read in rs600_set_irq + +From: Alex Deucher + +commit 54acf107e4e66d1f4a697e08a7f60dba9fcf07c3 upstream. + +To make sure the writes go through the pci bridge. + +bug: +https://bugzilla.kernel.org/show_bug.cgi?id=90741 + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/rs600.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/gpu/drm/radeon/rs600.c ++++ b/drivers/gpu/drm/radeon/rs600.c +@@ -700,6 +700,10 @@ int rs600_irq_set(struct radeon_device * + WREG32(R_007D18_DC_HOT_PLUG_DETECT2_INT_CONTROL, hpd2); + if (ASIC_IS_DCE2(rdev)) + WREG32(R_007408_HDMI0_AUDIO_PACKET_CONTROL, hdmi0); ++ ++ /* posting read */ ++ RREG32(R_000040_GEN_INT_CNTL); ++ + return 0; + } + diff --git a/queue-3.14/drm-radeon-do-a-posting-read-in-si_set_irq.patch b/queue-3.14/drm-radeon-do-a-posting-read-in-si_set_irq.patch new file mode 100644 index 00000000000..3d6b4518e8c --- /dev/null +++ b/queue-3.14/drm-radeon-do-a-posting-read-in-si_set_irq.patch @@ -0,0 +1,33 @@ +From 0586915ec10d0ae60de5cd3381ad25a704760402 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 2 Mar 2015 20:43:53 -0500 +Subject: drm/radeon: do a posting read in si_set_irq + +From: Alex Deucher + +commit 0586915ec10d0ae60de5cd3381ad25a704760402 upstream. + +To make sure the writes go through the pci bridge. + +bug: +https://bugzilla.kernel.org/show_bug.cgi?id=90741 + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/si.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -5958,6 +5958,9 @@ int si_irq_set(struct radeon_device *rde + + WREG32(CG_THERMAL_INT, thermal_int); + ++ /* posting read */ ++ RREG32(SRBM_STATUS); ++ + return 0; + } + diff --git a/queue-3.14/drm-radeon-drop-setting-upll-to-sleep-mode.patch b/queue-3.14/drm-radeon-drop-setting-upll-to-sleep-mode.patch new file mode 100644 index 00000000000..86e85333cf1 --- /dev/null +++ b/queue-3.14/drm-radeon-drop-setting-upll-to-sleep-mode.patch @@ -0,0 +1,46 @@ +From a17d4996e051e78d164989b894608cf37cd5110b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20K=C3=B6nig?= +Date: Thu, 19 Feb 2015 09:40:28 +0100 +Subject: drm/radeon: drop setting UPLL to sleep mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Christian=20K=C3=B6nig?= + +commit a17d4996e051e78d164989b894608cf37cd5110b upstream. + +Just keep it working, seems to fix some PLL problems. + +Bug: https://bugs.freedesktop.org/show_bug.cgi?id=73378 + +Signed-off-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/si.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -6878,8 +6878,7 @@ int si_set_uvd_clocks(struct radeon_devi + WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_BYPASS_EN_MASK, ~UPLL_BYPASS_EN_MASK); + + if (!vclk || !dclk) { +- /* keep the Bypass mode, put PLL to sleep */ +- WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK); ++ /* keep the Bypass mode */ + return 0; + } + +@@ -6895,8 +6894,7 @@ int si_set_uvd_clocks(struct radeon_devi + /* set VCO_MODE to 1 */ + WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_VCO_MODE_MASK, ~UPLL_VCO_MODE_MASK); + +- /* toggle UPLL_SLEEP to 1 then back to 0 */ +- WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK); ++ /* disable sleep mode */ + WREG32_P(CG_UPLL_FUNC_CNTL, 0, ~UPLL_SLEEP_MASK); + + /* deassert UPLL_RESET */ diff --git a/queue-3.14/drm-radeon-fix-drm_ioctl_radeon_cs-oops.patch b/queue-3.14/drm-radeon-fix-drm_ioctl_radeon_cs-oops.patch new file mode 100644 index 00000000000..7f7b8aff6ba --- /dev/null +++ b/queue-3.14/drm-radeon-fix-drm_ioctl_radeon_cs-oops.patch @@ -0,0 +1,103 @@ +From a28b2a47edcd0cb7c051b445f71a426000394606 Mon Sep 17 00:00:00 2001 +From: Tommi Rantala +Date: Mon, 2 Mar 2015 21:36:07 +0200 +Subject: drm/radeon: fix DRM_IOCTL_RADEON_CS oops +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tommi Rantala + +commit a28b2a47edcd0cb7c051b445f71a426000394606 upstream. + +Passing zeroed drm_radeon_cs struct to DRM_IOCTL_RADEON_CS produces the +following oops. + +Fix by always calling INIT_LIST_HEAD() to avoid the crash in list_sort(). + +---------------------------------- + + #include + #include + #include + #include + #include + + static const struct drm_radeon_cs cs; + + int main(int argc, char **argv) + { + return ioctl(open(argv[1], O_RDWR), DRM_IOCTL_RADEON_CS, &cs); + } + +---------------------------------- + +[ttrantal@test2 ~]$ ./main /dev/dri/card0 +[ 46.904650] BUG: unable to handle kernel NULL pointer dereference at (null) +[ 46.905022] IP: [] list_sort+0x42/0x240 +[ 46.905022] PGD 68f29067 PUD 688b5067 PMD 0 +[ 46.905022] Oops: 0002 [#1] SMP +[ 46.905022] CPU: 0 PID: 2413 Comm: main Not tainted 4.0.0-rc1+ #58 +[ 46.905022] Hardware name: Hewlett-Packard HP Compaq dc5750 Small Form Factor/0A64h, BIOS 786E3 v02.10 01/25/2007 +[ 46.905022] task: ffff880058e2bcc0 ti: ffff880058e64000 task.ti: ffff880058e64000 +[ 46.905022] RIP: 0010:[] [] list_sort+0x42/0x240 +[ 46.905022] RSP: 0018:ffff880058e67998 EFLAGS: 00010246 +[ 46.905022] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 +[ 46.905022] RDX: ffffffff81644410 RSI: ffff880058e67b40 RDI: ffff880058e67a58 +[ 46.905022] RBP: ffff880058e67a88 R08: 0000000000000000 R09: 0000000000000000 +[ 46.905022] R10: ffff880058e2bcc0 R11: ffffffff828e6ca0 R12: ffffffff81644410 +[ 46.905022] R13: ffff8800694b8018 R14: 0000000000000000 R15: ffff880058e679b0 +[ 46.905022] FS: 00007fdc65a65700(0000) GS:ffff88006d600000(0000) knlGS:0000000000000000 +[ 46.905022] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 46.905022] CR2: 0000000000000000 CR3: 0000000058dd9000 CR4: 00000000000006f0 +[ 46.905022] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 46.905022] DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400 +[ 46.905022] Stack: +[ 46.905022] ffff880058e67b40 ffff880058e2bcc0 ffff880058e67a78 0000000000000000 +[ 46.905022] 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +[ 46.905022] 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +[ 46.905022] Call Trace: +[ 46.905022] [] radeon_cs_parser_fini+0x195/0x220 +[ 46.905022] [] radeon_cs_ioctl+0xa9/0x960 +[ 46.905022] [] drm_ioctl+0x19c/0x640 +[ 46.905022] [] ? trace_hardirqs_on_caller+0xfd/0x1c0 +[ 46.905022] [] ? trace_hardirqs_on+0xd/0x10 +[ 46.905022] [] radeon_drm_ioctl+0x46/0x80 +[ 46.905022] [] do_vfs_ioctl+0x318/0x570 +[ 46.905022] [] ? selinux_file_ioctl+0x56/0x110 +[ 46.905022] [] SyS_ioctl+0x81/0xa0 +[ 46.905022] [] system_call_fastpath+0x12/0x17 +[ 46.905022] Code: 48 89 b5 10 ff ff ff 0f 84 03 01 00 00 4c 8d bd 28 ff ff +ff 31 c0 48 89 fb b9 15 00 00 00 49 89 d4 4c 89 ff f3 48 ab 48 8b 46 08 <48> c7 +00 00 00 00 00 48 8b 0e 48 85 c9 0f 84 7d 00 00 00 c7 85 +[ 46.905022] RIP [] list_sort+0x42/0x240 +[ 46.905022] RSP +[ 46.905022] CR2: 0000000000000000 +[ 47.149253] ---[ end trace 09576b4e8b2c20b8 ]--- + +Reviewed-by: Christian König +Signed-off-by: Tommi Rantala +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_cs.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/radeon_cs.c ++++ b/drivers/gpu/drm/radeon/radeon_cs.c +@@ -179,11 +179,13 @@ int radeon_cs_parser_init(struct radeon_ + u32 ring = RADEON_CS_RING_GFX; + s32 priority = 0; + ++ INIT_LIST_HEAD(&p->validated); ++ + if (!cs->num_chunks) { + return 0; + } ++ + /* get chunks */ +- INIT_LIST_HEAD(&p->validated); + p->idx = 0; + p->ib.sa_bo = NULL; + p->ib.semaphore = NULL; diff --git a/queue-3.14/drm-radeon-fix-interlaced-modes-on-dce8.patch b/queue-3.14/drm-radeon-fix-interlaced-modes-on-dce8.patch new file mode 100644 index 00000000000..303a741a875 --- /dev/null +++ b/queue-3.14/drm-radeon-fix-interlaced-modes-on-dce8.patch @@ -0,0 +1,30 @@ +From 77ae5f4b48a0445426c9c1ef7c0f28b717e35d55 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Tue, 3 Mar 2015 17:00:43 -0500 +Subject: drm/radeon: fix interlaced modes on DCE8 + +From: Alex Deucher + +commit 77ae5f4b48a0445426c9c1ef7c0f28b717e35d55 upstream. + +Need to double the viewport height. + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/atombios_crtc.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/radeon/atombios_crtc.c ++++ b/drivers/gpu/drm/radeon/atombios_crtc.c +@@ -1306,6 +1306,9 @@ static int dce4_crtc_do_set_base(struct + (x << 16) | y); + viewport_w = crtc->mode.hdisplay; + viewport_h = (crtc->mode.vdisplay + 1) & ~1; ++ if ((rdev->family >= CHIP_BONAIRE) && ++ (crtc->mode.flags & DRM_MODE_FLAG_INTERLACE)) ++ viewport_h *= 2; + WREG32(EVERGREEN_VIEWPORT_SIZE + radeon_crtc->crtc_offset, + (viewport_w << 16) | viewport_h); + diff --git a/queue-3.14/fuse-notify-don-t-move-pages.patch b/queue-3.14/fuse-notify-don-t-move-pages.patch new file mode 100644 index 00000000000..6312c0ba349 --- /dev/null +++ b/queue-3.14/fuse-notify-don-t-move-pages.patch @@ -0,0 +1,32 @@ +From 0d2783626a53d4c922f82d51fa675cb5d13f0d36 Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Thu, 26 Feb 2015 11:45:47 +0100 +Subject: fuse: notify: don't move pages + +From: Miklos Szeredi + +commit 0d2783626a53d4c922f82d51fa675cb5d13f0d36 upstream. + +fuse_try_move_page() is not prepared for replacing pages that have already +been read. + +Reported-by: Al Viro +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fuse/dev.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/fuse/dev.c ++++ b/fs/fuse/dev.c +@@ -1726,6 +1726,9 @@ copy_finish: + static int fuse_notify(struct fuse_conn *fc, enum fuse_notify_code code, + unsigned int size, struct fuse_copy_state *cs) + { ++ /* Don't try to move pages (yet) */ ++ cs->move_pages = 0; ++ + switch (code) { + case FUSE_NOTIFY_POLL: + return fuse_notify_poll(fc, size, cs); diff --git a/queue-3.14/fuse-set-stolen-page-uptodate.patch b/queue-3.14/fuse-set-stolen-page-uptodate.patch new file mode 100644 index 00000000000..20b6c5f57e9 --- /dev/null +++ b/queue-3.14/fuse-set-stolen-page-uptodate.patch @@ -0,0 +1,34 @@ +From aa991b3b267e24f578bac7b09cc57579b660304b Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Thu, 26 Feb 2015 11:45:47 +0100 +Subject: fuse: set stolen page uptodate + +From: Miklos Szeredi + +commit aa991b3b267e24f578bac7b09cc57579b660304b upstream. + +Regular pipe buffers' ->steal method (generic_pipe_buf_steal()) doesn't set +PG_uptodate. + +Don't warn on this condition, just set the uptodate flag. + +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fuse/dev.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/fuse/dev.c ++++ b/fs/fuse/dev.c +@@ -819,8 +819,8 @@ static int fuse_try_move_page(struct fus + + newpage = buf->page; + +- if (WARN_ON(!PageUptodate(newpage))) +- return -EIO; ++ if (!PageUptodate(newpage)) ++ SetPageUptodate(newpage); + + ClearPageMappedToDisk(newpage); + diff --git a/queue-3.14/lz4-fix-the-data-abort-issue.patch b/queue-3.14/lz4-fix-the-data-abort-issue.patch new file mode 100644 index 00000000000..822e5d49b6a --- /dev/null +++ b/queue-3.14/lz4-fix-the-data-abort-issue.patch @@ -0,0 +1,46 @@ +From d5e7cafd69da24e6d6cc988fab6ea313a2577efc Mon Sep 17 00:00:00 2001 +From: JeHyeon Yeon +Date: Mon, 16 Mar 2015 01:03:19 +0000 +Subject: LZ4 : fix the data abort issue + +From: JeHyeon Yeon + +commit d5e7cafd69da24e6d6cc988fab6ea313a2577efc upstream. + +If the part of the compression data are corrupted, or the compression +data is totally fake, the memory access over the limit is possible. + +This is the log from my system usning lz4 decompression. + [6502]data abort, halting + [6503]r0 0x00000000 r1 0x00000000 r2 0xdcea0ffc r3 0xdcea0ffc + [6509]r4 0xb9ab0bfd r5 0xdcea0ffc r6 0xdcea0ff8 r7 0xdce80000 + [6515]r8 0x00000000 r9 0x00000000 r10 0x00000000 r11 0xb9a98000 + [6522]r12 0xdcea1000 usp 0x00000000 ulr 0x00000000 pc 0x820149bc + [6528]spsr 0x400001f3 +and the memory addresses of some variables at the moment are + ref:0xdcea0ffc, op:0xdcea0ffc, oend:0xdcea1000 + +As you can see, COPYLENGH is 8bytes, so @ref and @op can access the momory +over @oend. + +Signed-off-by: JeHyeon Yeon +Reviewed-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + lib/lz4/lz4_decompress.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/lib/lz4/lz4_decompress.c ++++ b/lib/lz4/lz4_decompress.c +@@ -139,6 +139,9 @@ static int lz4_uncompress(const char *so + /* Error: request to write beyond destination buffer */ + if (cpy > oend) + goto _output_error; ++ if ((ref + COPYLENGTH) > oend || ++ (op + COPYLENGTH) > oend) ++ goto _output_error; + LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH)); + while (op < cpy) + *op++ = *ref++; diff --git a/queue-3.14/series b/queue-3.14/series index b23b0d08154..16c22c5d803 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -15,3 +15,19 @@ ipv6-fix-backtracking-for-throw-routes.patch tcp-fix-tcp-fin-memory-accounting.patch net-compat-update-get_compat_msghdr-to-match-copy_msghdr_from_user-behaviour.patch tcp-make-connect-mem-charging-friendly.patch +drm-radeon-fix-drm_ioctl_radeon_cs-oops.patch +drm-radeon-do-a-posting-read-in-evergreen_set_irq.patch +drm-radeon-do-a-posting-read-in-r100_set_irq.patch +drm-radeon-do-a-posting-read-in-r600_set_irq.patch +drm-radeon-do-a-posting-read-in-cik_set_irq.patch +drm-radeon-do-a-posting-read-in-si_set_irq.patch +drm-radeon-do-a-posting-read-in-rs600_set_irq.patch +drm-radeon-fix-interlaced-modes-on-dce8.patch +drm-radeon-drop-setting-upll-to-sleep-mode.patch +lz4-fix-the-data-abort-issue.patch +fuse-set-stolen-page-uptodate.patch +fuse-notify-don-t-move-pages.patch +console-fix-console-name-size-mismatch.patch +virtio_console-init-work-unconditionally.patch +virtio_console-avoid-config-access-from-irq.patch +change-email-address-for-8250_pci.patch diff --git a/queue-3.14/virtio_console-avoid-config-access-from-irq.patch b/queue-3.14/virtio_console-avoid-config-access-from-irq.patch new file mode 100644 index 00000000000..aa3ed5ca94c --- /dev/null +++ b/queue-3.14/virtio_console-avoid-config-access-from-irq.patch @@ -0,0 +1,80 @@ +From eeb8a7e8bb123e84daeef84f5a2eab99ad2839a2 Mon Sep 17 00:00:00 2001 +From: "Michael S. Tsirkin" +Date: Thu, 5 Mar 2015 10:45:49 +1030 +Subject: virtio_console: avoid config access from irq + +From: "Michael S. Tsirkin" + +commit eeb8a7e8bb123e84daeef84f5a2eab99ad2839a2 upstream. + +when multiport is off, virtio console invokes config access from irq +context, config access is blocking on s390. +Fix this up by scheduling work from config irq - similar to what we do +for multiport configs. + +Signed-off-by: Michael S. Tsirkin +Reviewed-by: Amit Shah +Signed-off-by: Rusty Russell +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/virtio_console.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- a/drivers/char/virtio_console.c ++++ b/drivers/char/virtio_console.c +@@ -142,6 +142,7 @@ struct ports_device { + * notification + */ + struct work_struct control_work; ++ struct work_struct config_work; + + struct list_head ports; + +@@ -1832,10 +1833,21 @@ static void config_intr(struct virtio_de + + portdev = vdev->priv; + ++ if (!use_multiport(portdev)) ++ schedule_work(&portdev->config_work); ++} ++ ++static void config_work_handler(struct work_struct *work) ++{ ++ struct ports_device *portdev; ++ ++ portdev = container_of(work, struct ports_device, control_work); + if (!use_multiport(portdev)) { ++ struct virtio_device *vdev; + struct port *port; + u16 rows, cols; + ++ vdev = portdev->vdev; + virtio_cread(vdev, struct virtio_console_config, cols, &cols); + virtio_cread(vdev, struct virtio_console_config, rows, &rows); + +@@ -2024,6 +2036,7 @@ static int virtcons_probe(struct virtio_ + spin_lock_init(&portdev->ports_lock); + INIT_LIST_HEAD(&portdev->ports); + ++ INIT_WORK(&portdev->config_work, &config_work_handler); + INIT_WORK(&portdev->control_work, &control_work_handler); + + if (multiport) { +@@ -2098,6 +2111,8 @@ static void virtcons_remove(struct virti + /* Finish up work that's lined up */ + if (use_multiport(portdev)) + cancel_work_sync(&portdev->control_work); ++ else ++ cancel_work_sync(&portdev->config_work); + + list_for_each_entry_safe(port, port2, &portdev->ports, list) + unplug_port(port); +@@ -2149,6 +2164,7 @@ static int virtcons_freeze(struct virtio + + virtqueue_disable_cb(portdev->c_ivq); + cancel_work_sync(&portdev->control_work); ++ cancel_work_sync(&portdev->config_work); + /* + * Once more: if control_work_handler() was running, it would + * enable the cb as the last step. diff --git a/queue-3.14/virtio_console-init-work-unconditionally.patch b/queue-3.14/virtio_console-init-work-unconditionally.patch new file mode 100644 index 00000000000..a09e3865c7a --- /dev/null +++ b/queue-3.14/virtio_console-init-work-unconditionally.patch @@ -0,0 +1,38 @@ +From 4f6e24ed9de8634d6471ef86b382cba6d4e57ca8 Mon Sep 17 00:00:00 2001 +From: "Michael S. Tsirkin" +Date: Thu, 5 Mar 2015 10:45:30 +1030 +Subject: virtio_console: init work unconditionally + +From: "Michael S. Tsirkin" + +commit 4f6e24ed9de8634d6471ef86b382cba6d4e57ca8 upstream. + +when multiport is off, we don't initialize config work, +but we then cancel uninitialized control_work on freeze. + +Signed-off-by: Michael S. Tsirkin +Reviewed-by: Amit Shah +Signed-off-by: Rusty Russell +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/virtio_console.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/char/virtio_console.c ++++ b/drivers/char/virtio_console.c +@@ -2024,12 +2024,13 @@ static int virtcons_probe(struct virtio_ + spin_lock_init(&portdev->ports_lock); + INIT_LIST_HEAD(&portdev->ports); + ++ INIT_WORK(&portdev->control_work, &control_work_handler); ++ + if (multiport) { + unsigned int nr_added_bufs; + + spin_lock_init(&portdev->c_ivq_lock); + spin_lock_init(&portdev->c_ovq_lock); +- INIT_WORK(&portdev->control_work, &control_work_handler); + + nr_added_bufs = fill_queue(portdev->c_ivq, + &portdev->c_ivq_lock);