From: Greg Kroah-Hartman Date: Wed, 3 Jun 2015 06:34:39 +0000 (+0900) Subject: 4.0-stable patches X-Git-Tag: v3.10.80~3 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8704ca2a1dc61a0a0b300d62caa4ffaa699eadf5;p=thirdparty%2Fkernel%2Fstable-queue.git 4.0-stable patches added patches: acpi-init-fix-the-ordering-of-acpi_reserve_resources.patch arc-unbork-llsc-build.patch dm-fix-casting-bug-in-dm_merge_bvec.patch dm-fix-reload-failure-of-0-path-multipath-mapping-on-blk-mq-devices.patch drm-amdkfd-don-t-report-local-memory-size.patch drm-plane-helper-adapt-cursor-hack-to-transitional-helpers.patch drm-radeon-add-new-bonaire-pci-id.patch drm-radeon-audio-make-sure-connector-is-valid-in-hotplug-case.patch drm-radeon-don-t-share-plls-if-monitors-differ-in-audio-support.patch drm-radeon-fix-vm_context-_page_table_end_addr-handling.patch drm-radeon-partially-revert-fix-vm_context-_page_table_end_addr-handling.patch drm-radeon-retry-dcpd-fetch.patch fs-binfmt_elf.c-load_elf_binary-return-einval-on-zero-length-mappings.patch input-elantech-fix-semi-mt-protocol-for-v3-hw.patch iwlwifi-mvm-clean-net-detect-info-if-device-was-reset-during-suspend.patch iwlwifi-mvm-free-fw_status-after-use-to-avoid-memory-leak.patch iwlwifi-pcie-prevent-using-unmapped-memory-in-fw-monitor.patch md-fix-race-when-unfreezing-sync_action.patch mips-fix-fp-mode-selection-in-lieu-of-.mips.abiflags-data.patch power-reset-at91-fix-return-value-check-in-at91_reset_platform_probe.patch pwm-img-impose-upper-and-lower-timebase-steps-value.patch revert-drm-radeon-only-mark-audio-as-connected-if-the-monitor-supports-it-v3.patch rtlwifi-rtl8192cu-fix-kernel-deadlock.patch sd-disable-support-for-256-byte-sector-disks.patch storvsc-set-the-srb-flags-correctly-when-no-data-transfer-is-needed.patch ubi-block-add-missing-cache-flushes.patch vfs-read-file_handle-only-once-in-handle_to_path.patch --- diff --git a/queue-4.0/acpi-init-fix-the-ordering-of-acpi_reserve_resources.patch b/queue-4.0/acpi-init-fix-the-ordering-of-acpi_reserve_resources.patch new file mode 100644 index 00000000000..bc39f13501b --- /dev/null +++ b/queue-4.0/acpi-init-fix-the-ordering-of-acpi_reserve_resources.patch @@ -0,0 +1,59 @@ +From b9a5e5e18fbf223502c0b2264c15024e393da928 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Thu, 7 May 2015 21:19:39 +0200 +Subject: ACPI / init: Fix the ordering of acpi_reserve_resources() + +From: "Rafael J. Wysocki" + +commit b9a5e5e18fbf223502c0b2264c15024e393da928 upstream. + +Since acpi_reserve_resources() is defined as a device_initcall(), +there's no guarantee that it will be executed in the right order +with respect to the rest of the ACPI initialization code. On some +systems this leads to breakage if, for example, the address range +that should be reserved for the ACPI fixed registers is given to +the PCI host bridge instead if the race is won by the wrong code +path. + +Fix this by turning acpi_reserve_resources() into a void function +and calling it directly from within the ACPI initialization sequence. + +Reported-and-tested-by: George McCollister +Link: http://marc.info/?t=143092384600002&r=1&w=2 +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/osl.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/acpi/osl.c ++++ b/drivers/acpi/osl.c +@@ -182,7 +182,7 @@ static void __init acpi_request_region ( + request_mem_region(addr, length, desc); + } + +-static int __init acpi_reserve_resources(void) ++static void __init acpi_reserve_resources(void) + { + acpi_request_region(&acpi_gbl_FADT.xpm1a_event_block, acpi_gbl_FADT.pm1_event_length, + "ACPI PM1a_EVT_BLK"); +@@ -211,10 +211,7 @@ static int __init acpi_reserve_resources + if (!(acpi_gbl_FADT.gpe1_block_length & 0x1)) + acpi_request_region(&acpi_gbl_FADT.xgpe1_block, + acpi_gbl_FADT.gpe1_block_length, "ACPI GPE1_BLK"); +- +- return 0; + } +-device_initcall(acpi_reserve_resources); + + void acpi_os_printf(const char *fmt, ...) + { +@@ -1845,6 +1842,7 @@ acpi_status __init acpi_os_initialize(vo + + acpi_status __init acpi_os_initialize1(void) + { ++ acpi_reserve_resources(); + kacpid_wq = alloc_workqueue("kacpid", 0, 1); + kacpi_notify_wq = alloc_workqueue("kacpi_notify", 0, 1); + kacpi_hotplug_wq = alloc_ordered_workqueue("kacpi_hotplug", 0); diff --git a/queue-4.0/arc-unbork-llsc-build.patch b/queue-4.0/arc-unbork-llsc-build.patch new file mode 100644 index 00000000000..893c0ee2dad --- /dev/null +++ b/queue-4.0/arc-unbork-llsc-build.patch @@ -0,0 +1,28 @@ +From daaf40e53b5dbdf75255d58a45ce8ac65ca511a8 Mon Sep 17 00:00:00 2001 +From: Vineet Gupta +Date: Sun, 10 May 2015 12:04:01 +0530 +Subject: ARC: unbork !LLSC build + +From: Vineet Gupta + +commit daaf40e53b5dbdf75255d58a45ce8ac65ca511a8 upstream. + +Fixes: f7d11e93ee97a locking,arch,arc: Fold atomic_ops +Signed-off-by: Vineet Gupta +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arc/include/asm/atomic.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arc/include/asm/atomic.h ++++ b/arch/arc/include/asm/atomic.h +@@ -99,7 +99,7 @@ static inline void atomic_##op(int i, at + atomic_ops_unlock(flags); \ + } + +-#define ATOMIC_OP_RETURN(op, c_op) \ ++#define ATOMIC_OP_RETURN(op, c_op, asm_op) \ + static inline int atomic_##op##_return(int i, atomic_t *v) \ + { \ + unsigned long flags; \ diff --git a/queue-4.0/dm-fix-casting-bug-in-dm_merge_bvec.patch b/queue-4.0/dm-fix-casting-bug-in-dm_merge_bvec.patch new file mode 100644 index 00000000000..a00267bf81f --- /dev/null +++ b/queue-4.0/dm-fix-casting-bug-in-dm_merge_bvec.patch @@ -0,0 +1,73 @@ +From 1c220c69ce0dcc0f234a9f263ad9c0864f971852 Mon Sep 17 00:00:00 2001 +From: Joe Thornber +Date: Fri, 29 May 2015 14:52:51 +0100 +Subject: dm: fix casting bug in dm_merge_bvec() + +From: Joe Thornber + +commit 1c220c69ce0dcc0f234a9f263ad9c0864f971852 upstream. + +dm_merge_bvec() was originally added in f6fccb ("dm: introduce +merge_bvec_fn"). In that commit a value in sectors is converted to +bytes using << 9, and then assigned to an int. This code made +assumptions about the value of BIO_MAX_SECTORS. + +A later commit 148e51 ("dm: improve documentation and code clarity in +dm_merge_bvec") was meant to have no functional change but it removed +the use of BIO_MAX_SECTORS in favor of using queue_max_sectors(). At +this point the cast from sector_t to int resulted in a zero value. The +fallout being dm_merge_bvec() would only allow a single page to be added +to a bio. + +This interim fix is minimal for the benefit of stable@ because the more +comprehensive cleanup of passing a sector_t to all DM targets' merge +function will impact quite a few DM targets. + +Signed-off-by: Joe Thornber +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -1642,8 +1642,7 @@ static int dm_merge_bvec(struct request_ + struct mapped_device *md = q->queuedata; + struct dm_table *map = dm_get_live_table_fast(md); + struct dm_target *ti; +- sector_t max_sectors; +- int max_size = 0; ++ sector_t max_sectors, max_size = 0; + + if (unlikely(!map)) + goto out; +@@ -1658,8 +1657,16 @@ static int dm_merge_bvec(struct request_ + max_sectors = min(max_io_len(bvm->bi_sector, ti), + (sector_t) queue_max_sectors(q)); + max_size = (max_sectors << SECTOR_SHIFT) - bvm->bi_size; +- if (unlikely(max_size < 0)) /* this shouldn't _ever_ happen */ +- max_size = 0; ++ ++ /* ++ * FIXME: this stop-gap fix _must_ be cleaned up (by passing a sector_t ++ * to the targets' merge function since it holds sectors not bytes). ++ * Just doing this as an interim fix for stable@ because the more ++ * comprehensive cleanup of switching to sector_t will impact every ++ * DM target that implements a ->merge hook. ++ */ ++ if (max_size > INT_MAX) ++ max_size = INT_MAX; + + /* + * merge_bvec_fn() returns number of bytes +@@ -1667,7 +1674,7 @@ static int dm_merge_bvec(struct request_ + * max is precomputed maximal io size + */ + if (max_size && ti->type->merge) +- max_size = ti->type->merge(ti, bvm, biovec, max_size); ++ max_size = ti->type->merge(ti, bvm, biovec, (int) max_size); + /* + * If the target doesn't support merge method and some of the devices + * provided their merge_bvec method (we know this by looking for the diff --git a/queue-4.0/dm-fix-reload-failure-of-0-path-multipath-mapping-on-blk-mq-devices.patch b/queue-4.0/dm-fix-reload-failure-of-0-path-multipath-mapping-on-blk-mq-devices.patch new file mode 100644 index 00000000000..795c1d22480 --- /dev/null +++ b/queue-4.0/dm-fix-reload-failure-of-0-path-multipath-mapping-on-blk-mq-devices.patch @@ -0,0 +1,90 @@ +From 15b94a690470038aa08247eedbebbe7e2218d5ee Mon Sep 17 00:00:00 2001 +From: Junichi Nomura +Date: Fri, 29 May 2015 08:51:03 +0000 +Subject: dm: fix reload failure of 0 path multipath mapping on blk-mq devices + +From: Junichi Nomura + +commit 15b94a690470038aa08247eedbebbe7e2218d5ee upstream. + +dm-multipath accepts 0 path mapping. + + # echo '0 2097152 multipath 0 0 0 0' | dmsetup create newdev + +Such a mapping can be used to release underlying devices while still +holding requests in its queue until working paths come back. + +However, once the multipath device is created over blk-mq devices, +it rejects reloading of 0 path mapping: + + # echo '0 2097152 multipath 0 0 1 1 queue-length 0 1 1 /dev/sda 1' \ + | dmsetup create mpath1 + # echo '0 2097152 multipath 0 0 0 0' | dmsetup load mpath1 + device-mapper: reload ioctl on mpath1 failed: Invalid argument + Command failed + +With following kernel message: + device-mapper: ioctl: can't change device type after initial table load. + +DM tries to inherit the current table type using dm_table_set_type() +but it doesn't work as expected because of unnecessary check about +whether the target type is hybrid or not. + +Hybrid type is for targets that work as either request-based or bio-based +and not required for blk-mq or non blk-mq checking. + +Fixes: 65803c205983 ("dm table: train hybrid target type detection to select blk-mq if appropriate") +Signed-off-by: Jun'ichi Nomura +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-table.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +--- a/drivers/md/dm-table.c ++++ b/drivers/md/dm-table.c +@@ -823,6 +823,12 @@ void dm_consume_args(struct dm_arg_set * + } + EXPORT_SYMBOL(dm_consume_args); + ++static bool __table_type_request_based(unsigned table_type) ++{ ++ return (table_type == DM_TYPE_REQUEST_BASED || ++ table_type == DM_TYPE_MQ_REQUEST_BASED); ++} ++ + static int dm_table_set_type(struct dm_table *t) + { + unsigned i; +@@ -855,8 +861,7 @@ static int dm_table_set_type(struct dm_t + * Determine the type from the live device. + * Default to bio-based if device is new. + */ +- if (live_md_type == DM_TYPE_REQUEST_BASED || +- live_md_type == DM_TYPE_MQ_REQUEST_BASED) ++ if (__table_type_request_based(live_md_type)) + request_based = 1; + else + bio_based = 1; +@@ -906,7 +911,7 @@ static int dm_table_set_type(struct dm_t + } + t->type = DM_TYPE_MQ_REQUEST_BASED; + +- } else if (hybrid && list_empty(devices) && live_md_type != DM_TYPE_NONE) { ++ } else if (list_empty(devices) && __table_type_request_based(live_md_type)) { + /* inherit live MD type */ + t->type = live_md_type; + +@@ -928,10 +933,7 @@ struct target_type *dm_table_get_immutab + + bool dm_table_request_based(struct dm_table *t) + { +- unsigned table_type = dm_table_get_type(t); +- +- return (table_type == DM_TYPE_REQUEST_BASED || +- table_type == DM_TYPE_MQ_REQUEST_BASED); ++ return __table_type_request_based(dm_table_get_type(t)); + } + + bool dm_table_mq_request_based(struct dm_table *t) diff --git a/queue-4.0/drm-amdkfd-don-t-report-local-memory-size.patch b/queue-4.0/drm-amdkfd-don-t-report-local-memory-size.patch new file mode 100644 index 00000000000..5b4bcd67d0f --- /dev/null +++ b/queue-4.0/drm-amdkfd-don-t-report-local-memory-size.patch @@ -0,0 +1,37 @@ +From 42e08c78360e58516b6ac8af18a75a494f2967a2 Mon Sep 17 00:00:00 2001 +From: Oded Gabbay +Date: Tue, 5 May 2015 11:15:07 +0300 +Subject: drm/amdkfd: Don't report local memory size + +From: Oded Gabbay + +commit 42e08c78360e58516b6ac8af18a75a494f2967a2 upstream. + +This patch sets the local memory size that is reported to userspace to 0. +This is done to make sure that userspace won't try to allocate local memory +for HSA. + +As long as amdkfd doesn't support allocating local memory for HSA, +we need this patch. + +Signed-off-by: Oded Gabbay +Cc: stable@vger.kernel.org +Reviewed-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c +@@ -729,7 +729,7 @@ static ssize_t node_show(struct kobject + kfd2kgd->get_max_engine_clock_in_mhz( + dev->gpu->kgd)); + sysfs_show_64bit_prop(buffer, "local_mem_size", +- kfd2kgd->get_vmem_size(dev->gpu->kgd)); ++ (unsigned long long int) 0); + + sysfs_show_32bit_prop(buffer, "fw_version", + kfd2kgd->get_fw_version( diff --git a/queue-4.0/drm-plane-helper-adapt-cursor-hack-to-transitional-helpers.patch b/queue-4.0/drm-plane-helper-adapt-cursor-hack-to-transitional-helpers.patch new file mode 100644 index 00000000000..874b3199a09 --- /dev/null +++ b/queue-4.0/drm-plane-helper-adapt-cursor-hack-to-transitional-helpers.patch @@ -0,0 +1,48 @@ +From 2e7f43c41c042d6fed4d67aceeaae32d8f102e98 Mon Sep 17 00:00:00 2001 +From: Daniel Vetter +Date: Wed, 20 May 2015 10:36:32 +0200 +Subject: drm/plane-helper: Adapt cursor hack to transitional helpers + +From: Daniel Vetter + +commit 2e7f43c41c042d6fed4d67aceeaae32d8f102e98 upstream. + +In + +commit f02ad907cd9e7fe3a6405d2d005840912f1ed258 +Author: Daniel Vetter +Date: Thu Jan 22 16:36:23 2015 +0100 + + drm/atomic-helpers: Recover full cursor plane behaviour + +we've added a hack to atomic helpers to never to vblank waits for +cursor updates through the legacy apis since that's what X expects. +Unfortunately we've (again) forgotten to adjust the transitional +helpers. Do this now. + +This fixes regressions for drivers only partially converted over to +atomic (like i915). + +Reported-by: Pekka Paalanen +Cc: Pekka Paalanen +Signed-off-by: Daniel Vetter +Reviewed-and-tested-by: Mario Kleiner +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_plane_helper.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/drm_plane_helper.c ++++ b/drivers/gpu/drm/drm_plane_helper.c +@@ -476,6 +476,9 @@ int drm_plane_helper_commit(struct drm_p + if (!crtc[i]) + continue; + ++ if (crtc[i]->cursor == plane) ++ continue; ++ + /* There's no other way to figure out whether the crtc is running. */ + ret = drm_crtc_vblank_get(crtc[i]); + if (ret == 0) { diff --git a/queue-4.0/drm-radeon-add-new-bonaire-pci-id.patch b/queue-4.0/drm-radeon-add-new-bonaire-pci-id.patch new file mode 100644 index 00000000000..e4eba667488 --- /dev/null +++ b/queue-4.0/drm-radeon-add-new-bonaire-pci-id.patch @@ -0,0 +1,26 @@ +From fcf3b54282e4c5a95a1f45f67558bc105acdbc6a Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Tue, 12 May 2015 12:51:38 -0400 +Subject: drm/radeon: add new bonaire pci id + +From: Alex Deucher + +commit fcf3b54282e4c5a95a1f45f67558bc105acdbc6a upstream. + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + include/drm/drm_pciids.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/include/drm/drm_pciids.h ++++ b/include/drm/drm_pciids.h +@@ -186,6 +186,7 @@ + {0x1002, 0x6658, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x665c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x665d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \ ++ {0x1002, 0x665f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6660, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6663, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6664, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ diff --git a/queue-4.0/drm-radeon-audio-make-sure-connector-is-valid-in-hotplug-case.patch b/queue-4.0/drm-radeon-audio-make-sure-connector-is-valid-in-hotplug-case.patch new file mode 100644 index 00000000000..83d300fb220 --- /dev/null +++ b/queue-4.0/drm-radeon-audio-make-sure-connector-is-valid-in-hotplug-case.patch @@ -0,0 +1,43 @@ +From fbfd3bc7dfd7efcad2d2e52bf634f84c80a77a35 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 27 May 2015 11:33:26 -0400 +Subject: drm/radeon/audio: make sure connector is valid in hotplug case + +From: Alex Deucher + +commit fbfd3bc7dfd7efcad2d2e52bf634f84c80a77a35 upstream. + +Avoids a crash when a monitor is hotplugged and the encoder +and connector are not linked yet. + +bug: +https://bugs.freedesktop.org/show_bug.cgi?id=90681 + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/evergreen_hdmi.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/radeon/evergreen_hdmi.c ++++ b/drivers/gpu/drm/radeon/evergreen_hdmi.c +@@ -400,7 +400,7 @@ void evergreen_hdmi_enable(struct drm_en + if (enable) { + struct drm_connector *connector = radeon_get_connector_for_encoder(encoder); + +- if (drm_detect_monitor_audio(radeon_connector_edid(connector))) { ++ if (connector && drm_detect_monitor_audio(radeon_connector_edid(connector))) { + WREG32(HDMI_INFOFRAME_CONTROL0 + dig->afmt->offset, + HDMI_AVI_INFO_SEND | /* enable AVI info frames */ + HDMI_AVI_INFO_CONT | /* required for audio info values to be updated */ +@@ -438,7 +438,8 @@ void evergreen_dp_enable(struct drm_enco + if (!dig || !dig->afmt) + return; + +- if (enable && drm_detect_monitor_audio(radeon_connector_edid(connector))) { ++ if (enable && connector && ++ drm_detect_monitor_audio(radeon_connector_edid(connector))) { + struct drm_connector *connector = radeon_get_connector_for_encoder(encoder); + struct radeon_connector *radeon_connector = to_radeon_connector(connector); + struct radeon_connector_atom_dig *dig_connector; diff --git a/queue-4.0/drm-radeon-don-t-share-plls-if-monitors-differ-in-audio-support.patch b/queue-4.0/drm-radeon-don-t-share-plls-if-monitors-differ-in-audio-support.patch new file mode 100644 index 00000000000..61634a87810 --- /dev/null +++ b/queue-4.0/drm-radeon-don-t-share-plls-if-monitors-differ-in-audio-support.patch @@ -0,0 +1,35 @@ +From a10f0df0615abb194968fc08147f3cdd70fd5aa5 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Tue, 26 May 2015 18:01:05 -0400 +Subject: drm/radeon: don't share plls if monitors differ in audio support + +From: Alex Deucher + +commit a10f0df0615abb194968fc08147f3cdd70fd5aa5 upstream. + +Enabling audio may enable different pll dividers. Don't share +plls if the monitors differ in audio support. + +bug: +https://bugzilla.kernel.org/show_bug.cgi?id=98751 + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/atombios_crtc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/atombios_crtc.c ++++ b/drivers/gpu/drm/radeon/atombios_crtc.c +@@ -1789,7 +1789,9 @@ static int radeon_get_shared_nondp_ppll( + if ((crtc->mode.clock == test_crtc->mode.clock) && + (adjusted_clock == test_adjusted_clock) && + (radeon_crtc->ss_enabled == test_radeon_crtc->ss_enabled) && +- (test_radeon_crtc->pll_id != ATOM_PPLL_INVALID)) ++ (test_radeon_crtc->pll_id != ATOM_PPLL_INVALID) && ++ (drm_detect_monitor_audio(radeon_connector_edid(test_radeon_crtc->connector)) == ++ drm_detect_monitor_audio(radeon_connector_edid(radeon_crtc->connector)))) + return test_radeon_crtc->pll_id; + } + } diff --git a/queue-4.0/drm-radeon-fix-vm_context-_page_table_end_addr-handling.patch b/queue-4.0/drm-radeon-fix-vm_context-_page_table_end_addr-handling.patch new file mode 100644 index 00000000000..da0a2d1b664 --- /dev/null +++ b/queue-4.0/drm-radeon-fix-vm_context-_page_table_end_addr-handling.patch @@ -0,0 +1,121 @@ +From 607d48063512707a414e346972e2210dc71ab491 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20K=C3=B6nig?= +Date: Tue, 12 May 2015 14:56:17 +0200 +Subject: drm/radeon: fix VM_CONTEXT*_PAGE_TABLE_END_ADDR handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Christian=20K=C3=B6nig?= + +commit 607d48063512707a414e346972e2210dc71ab491 upstream. + +The mapping range is inclusive between starting and ending addresses. + +Signed-off-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/cik.c | 4 ++-- + drivers/gpu/drm/radeon/evergreen.c | 2 +- + drivers/gpu/drm/radeon/ni.c | 5 +++-- + drivers/gpu/drm/radeon/r600.c | 2 +- + drivers/gpu/drm/radeon/rv770.c | 2 +- + drivers/gpu/drm/radeon/si.c | 4 ++-- + 6 files changed, 10 insertions(+), 9 deletions(-) + +--- a/drivers/gpu/drm/radeon/cik.c ++++ b/drivers/gpu/drm/radeon/cik.c +@@ -5789,7 +5789,7 @@ static int cik_pcie_gart_enable(struct r + L2_CACHE_BIGK_FRAGMENT_SIZE(4)); + /* setup context0 */ + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR, + (u32)(rdev->dummy_page.addr >> 12)); +@@ -5804,7 +5804,7 @@ static int cik_pcie_gart_enable(struct r + /* restore context1-15 */ + /* set vm size, must be a multiple of 4 */ + WREG32(VM_CONTEXT1_PAGE_TABLE_START_ADDR, 0); +- WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn); ++ WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn - 1); + for (i = 1; i < 16; i++) { + if (i < 8) + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2), +--- a/drivers/gpu/drm/radeon/evergreen.c ++++ b/drivers/gpu/drm/radeon/evergreen.c +@@ -2457,7 +2457,7 @@ static int evergreen_pcie_gart_enable(st + WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp); + WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp); + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) | + RANGE_PROTECTION_FAULT_ENABLE_DEFAULT); +--- a/drivers/gpu/drm/radeon/ni.c ++++ b/drivers/gpu/drm/radeon/ni.c +@@ -1253,7 +1253,7 @@ static int cayman_pcie_gart_enable(struc + L2_CACHE_BIGK_FRAGMENT_SIZE(6)); + /* setup context0 */ + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR, + (u32)(rdev->dummy_page.addr >> 12)); +@@ -1272,7 +1272,8 @@ static int cayman_pcie_gart_enable(struc + */ + for (i = 1; i < 8; i++) { + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR + (i << 2), 0); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR + (i << 2), rdev->vm_manager.max_pfn); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR + (i << 2), ++ rdev->vm_manager.max_pfn - 1); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2), + rdev->vm_manager.saved_table_addr[i]); + } +--- a/drivers/gpu/drm/radeon/r600.c ++++ b/drivers/gpu/drm/radeon/r600.c +@@ -1086,7 +1086,7 @@ static int r600_pcie_gart_enable(struct + WREG32(MC_VM_L1_TLB_MCB_RD_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE); + WREG32(MC_VM_L1_TLB_MCB_WR_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE); + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) | + RANGE_PROTECTION_FAULT_ENABLE_DEFAULT); +--- a/drivers/gpu/drm/radeon/rv770.c ++++ b/drivers/gpu/drm/radeon/rv770.c +@@ -921,7 +921,7 @@ static int rv770_pcie_gart_enable(struct + WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp); + WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp); + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) | + RANGE_PROTECTION_FAULT_ENABLE_DEFAULT); +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -4273,7 +4273,7 @@ static int si_pcie_gart_enable(struct ra + L2_CACHE_BIGK_FRAGMENT_SIZE(4)); + /* setup context0 */ + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR, + (u32)(rdev->dummy_page.addr >> 12)); +@@ -4288,7 +4288,7 @@ static int si_pcie_gart_enable(struct ra + /* empty context1-15 */ + /* set vm size, must be a multiple of 4 */ + WREG32(VM_CONTEXT1_PAGE_TABLE_START_ADDR, 0); +- WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn); ++ WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn - 1); + /* Assign the pt base to something valid for now; the pts used for + * the VMs are determined by the application and setup and assigned + * on the fly in the vm part of radeon_gart.c diff --git a/queue-4.0/drm-radeon-partially-revert-fix-vm_context-_page_table_end_addr-handling.patch b/queue-4.0/drm-radeon-partially-revert-fix-vm_context-_page_table_end_addr-handling.patch new file mode 100644 index 00000000000..e723f44f7e4 --- /dev/null +++ b/queue-4.0/drm-radeon-partially-revert-fix-vm_context-_page_table_end_addr-handling.patch @@ -0,0 +1,95 @@ +From 7c0411d2fabc2e2702c9871ffb603e251158b317 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20K=C3=B6nig?= +Date: Thu, 28 May 2015 15:51:59 +0200 +Subject: drm/radeon: partially revert "fix VM_CONTEXT*_PAGE_TABLE_END_ADDR handling" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Christian=20K=C3=B6nig?= + +commit 7c0411d2fabc2e2702c9871ffb603e251158b317 upstream. + +We have that bug for years and some users report side effects when fixing it on older hardware. + +So revert it for VM_CONTEXT0_PAGE_TABLE_END_ADDR, but keep it for VM 1-15. + +Signed-off-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/cik.c | 2 +- + drivers/gpu/drm/radeon/evergreen.c | 2 +- + drivers/gpu/drm/radeon/ni.c | 2 +- + drivers/gpu/drm/radeon/r600.c | 2 +- + drivers/gpu/drm/radeon/rv770.c | 2 +- + drivers/gpu/drm/radeon/si.c | 2 +- + 6 files changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/radeon/cik.c ++++ b/drivers/gpu/drm/radeon/cik.c +@@ -5789,7 +5789,7 @@ static int cik_pcie_gart_enable(struct r + L2_CACHE_BIGK_FRAGMENT_SIZE(4)); + /* setup context0 */ + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR, + (u32)(rdev->dummy_page.addr >> 12)); +--- a/drivers/gpu/drm/radeon/evergreen.c ++++ b/drivers/gpu/drm/radeon/evergreen.c +@@ -2457,7 +2457,7 @@ static int evergreen_pcie_gart_enable(st + WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp); + WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp); + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) | + RANGE_PROTECTION_FAULT_ENABLE_DEFAULT); +--- a/drivers/gpu/drm/radeon/ni.c ++++ b/drivers/gpu/drm/radeon/ni.c +@@ -1253,7 +1253,7 @@ static int cayman_pcie_gart_enable(struc + L2_CACHE_BIGK_FRAGMENT_SIZE(6)); + /* setup context0 */ + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR, + (u32)(rdev->dummy_page.addr >> 12)); +--- a/drivers/gpu/drm/radeon/r600.c ++++ b/drivers/gpu/drm/radeon/r600.c +@@ -1086,7 +1086,7 @@ static int r600_pcie_gart_enable(struct + WREG32(MC_VM_L1_TLB_MCB_RD_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE); + WREG32(MC_VM_L1_TLB_MCB_WR_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE); + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) | + RANGE_PROTECTION_FAULT_ENABLE_DEFAULT); +--- a/drivers/gpu/drm/radeon/rv770.c ++++ b/drivers/gpu/drm/radeon/rv770.c +@@ -921,7 +921,7 @@ static int rv770_pcie_gart_enable(struct + WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp); + WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp); + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) | + RANGE_PROTECTION_FAULT_ENABLE_DEFAULT); +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -4273,7 +4273,7 @@ static int si_pcie_gart_enable(struct ra + L2_CACHE_BIGK_FRAGMENT_SIZE(4)); + /* setup context0 */ + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR, + (u32)(rdev->dummy_page.addr >> 12)); diff --git a/queue-4.0/drm-radeon-retry-dcpd-fetch.patch b/queue-4.0/drm-radeon-retry-dcpd-fetch.patch new file mode 100644 index 00000000000..36676222826 --- /dev/null +++ b/queue-4.0/drm-radeon-retry-dcpd-fetch.patch @@ -0,0 +1,55 @@ +From 0f28d1281b6c54cc98746ae61e44e7f540758ed4 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 18 May 2015 10:38:25 -0400 +Subject: drm/radeon: retry dcpd fetch + +From: Alex Deucher + +commit 0f28d1281b6c54cc98746ae61e44e7f540758ed4 upstream. + +Retry the dpcd fetch several times. Some eDP panels +fail several times before the fetch is successful. + +bug: +https://bugs.freedesktop.org/show_bug.cgi?id=73530 + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/atombios_dp.c | 20 +++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +--- a/drivers/gpu/drm/radeon/atombios_dp.c ++++ b/drivers/gpu/drm/radeon/atombios_dp.c +@@ -412,19 +412,21 @@ bool radeon_dp_getdpcd(struct radeon_con + { + struct radeon_connector_atom_dig *dig_connector = radeon_connector->con_priv; + u8 msg[DP_DPCD_SIZE]; +- int ret; ++ int ret, i; + +- ret = drm_dp_dpcd_read(&radeon_connector->ddc_bus->aux, DP_DPCD_REV, msg, +- DP_DPCD_SIZE); +- if (ret > 0) { +- memcpy(dig_connector->dpcd, msg, DP_DPCD_SIZE); ++ for (i = 0; i < 7; i++) { ++ ret = drm_dp_dpcd_read(&radeon_connector->ddc_bus->aux, DP_DPCD_REV, msg, ++ DP_DPCD_SIZE); ++ if (ret == DP_DPCD_SIZE) { ++ memcpy(dig_connector->dpcd, msg, DP_DPCD_SIZE); + +- DRM_DEBUG_KMS("DPCD: %*ph\n", (int)sizeof(dig_connector->dpcd), +- dig_connector->dpcd); ++ DRM_DEBUG_KMS("DPCD: %*ph\n", (int)sizeof(dig_connector->dpcd), ++ dig_connector->dpcd); + +- radeon_dp_probe_oui(radeon_connector); ++ radeon_dp_probe_oui(radeon_connector); + +- return true; ++ return true; ++ } + } + dig_connector->dpcd[0] = 0; + return false; diff --git a/queue-4.0/fs-binfmt_elf.c-load_elf_binary-return-einval-on-zero-length-mappings.patch b/queue-4.0/fs-binfmt_elf.c-load_elf_binary-return-einval-on-zero-length-mappings.patch new file mode 100644 index 00000000000..3340bb1ed33 --- /dev/null +++ b/queue-4.0/fs-binfmt_elf.c-load_elf_binary-return-einval-on-zero-length-mappings.patch @@ -0,0 +1,33 @@ +From 2b1d3ae940acd11be44c6eced5873d47c2e00ffa Mon Sep 17 00:00:00 2001 +From: Andrew Morton +Date: Thu, 28 May 2015 15:44:24 -0700 +Subject: fs/binfmt_elf.c:load_elf_binary(): return -EINVAL on zero-length mappings + +From: Andrew Morton + +commit 2b1d3ae940acd11be44c6eced5873d47c2e00ffa upstream. + +load_elf_binary() returns `retval', not `error'. + +Fixes: a87938b2e246b81b4fb ("fs/binfmt_elf.c: fix bug in loading of PIE binaries") +Reported-by: James Hogan +Cc: Michael Davidson +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/binfmt_elf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -928,7 +928,7 @@ static int load_elf_binary(struct linux_ + total_size = total_mapping_size(elf_phdata, + loc->elf_ex.e_phnum); + if (!total_size) { +- error = -EINVAL; ++ retval = -EINVAL; + goto out_free_dentry; + } + } diff --git a/queue-4.0/input-elantech-fix-semi-mt-protocol-for-v3-hw.patch b/queue-4.0/input-elantech-fix-semi-mt-protocol-for-v3-hw.patch new file mode 100644 index 00000000000..e5f6890c46c --- /dev/null +++ b/queue-4.0/input-elantech-fix-semi-mt-protocol-for-v3-hw.patch @@ -0,0 +1,38 @@ +From 3c0213d17a09601e0c6c0ae0e27caf70d988290f Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Thu, 23 Apr 2015 09:08:43 -0700 +Subject: Input: elantech - fix semi-mt protocol for v3 HW + +From: Benjamin Tissoires + +commit 3c0213d17a09601e0c6c0ae0e27caf70d988290f upstream. + +When the v3 hardware sees more than one finger, it uses the semi-mt +protocol to report the touches. However, it currently works when +num_fingers is 0, 1 or 2, but when it is 3 and above, it sends only 1 +finger as if num_fingers was 1. + +This confuses userspace which knows how to deal with extra fingers +when all the slots are used, but not when some are missing. + +Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=90101 + +Signed-off-by: Benjamin Tissoires +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/mouse/elantech.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -315,7 +315,7 @@ static void elantech_report_semi_mt_data + unsigned int x2, unsigned int y2) + { + elantech_set_slot(dev, 0, num_fingers != 0, x1, y1); +- elantech_set_slot(dev, 1, num_fingers == 2, x2, y2); ++ elantech_set_slot(dev, 1, num_fingers >= 2, x2, y2); + } + + /* diff --git a/queue-4.0/iwlwifi-mvm-clean-net-detect-info-if-device-was-reset-during-suspend.patch b/queue-4.0/iwlwifi-mvm-clean-net-detect-info-if-device-was-reset-during-suspend.patch new file mode 100644 index 00000000000..eb02630f1a7 --- /dev/null +++ b/queue-4.0/iwlwifi-mvm-clean-net-detect-info-if-device-was-reset-during-suspend.patch @@ -0,0 +1,94 @@ +From a500e469ead055f35c7b2d0a1104e1bd58e34e70 Mon Sep 17 00:00:00 2001 +From: Luciano Coelho +Date: Mon, 4 May 2015 17:03:17 +0300 +Subject: iwlwifi: mvm: clean net-detect info if device was reset during suspend + +From: Luciano Coelho + +commit a500e469ead055f35c7b2d0a1104e1bd58e34e70 upstream. + +If the device is reset during suspend with net-detect enabled, we +leave the net-detect information dangling and this causes the next +suspend to fail with a warning: + +[21795.351010] WARNING: at /root/iwlwifi/iwlwifi-stack-dev/drivers/net/wireless/iwlwifi/mvm/d3.c:989 __iwl_mvm_suspend.isra.6+0x2be/0x460 [iwlmvm]() +[21795.353253] Modules linked in: iwlmvm(O) iwlwifi(O) mac80211(O) cfg80211(O) compat(O) [...] +[21795.366168] CPU: 1 PID: 3645 Comm: bash Tainted: G O 3.10.29-dev #1 +[21795.368785] Hardware name: Dell Inc. Latitude E6430/0CPWYR, BIOS A09 12/13/2012 +[21795.371441] f8ec6748 f8ec6748 e51f3ce8 c168aa62 e51f3d10 c103a824 c1871238 f8ec6748 +[21795.374228] 000003dd f8eb982e f8eb982e 00000000 c3408ed4 c41edbbc e51f3d20 c103a862 +[21795.377006] 00000009 00000000 e51f3da8 f8eb982e c41ee3dc 00000004 e7970000 e51f3d74 +[21795.379792] Call Trace: +[21795.382461] [] dump_stack+0x16/0x18 +[21795.385133] [] warn_slowpath_common+0x64/0x80 +[21795.387803] [] ? __iwl_mvm_suspend.isra.6+0x2be/0x460 [iwlmvm] +[21795.390485] [] ? __iwl_mvm_suspend.isra.6+0x2be/0x460 [iwlmvm] +[21795.393124] [] warn_slowpath_null+0x22/0x30 +[21795.395787] [] __iwl_mvm_suspend.isra.6+0x2be/0x460 [iwlmvm] +[21795.398464] [] iwl_mvm_suspend+0xec/0x140 [iwlmvm] +[21795.401127] [] ? del_timer_sync+0xa1/0xc0 +[21795.403800] [] __ieee80211_suspend+0x1de/0xff0 [mac80211] +[21795.406459] [] ? mutex_lock_nested+0x25d/0x350 +[21795.409084] [] ? rtnl_lock+0x14/0x20 +[21795.411685] [] ieee80211_suspend+0x16/0x20 [mac80211] +[21795.414318] [] wiphy_suspend+0x74/0x710 [cfg80211] +[21795.416916] [] __device_suspend+0x1e2/0x220 +[21795.419521] [] ? addresses_show+0xa0/0xa0 [cfg80211] +[21795.422097] [] dpm_suspend+0x67/0x210 +[21795.424661] [] dpm_suspend_start+0x4f/0x60 +[21795.427219] [] suspend_devices_and_enter+0x60/0x480 +[21795.429768] [] ? printk+0x4d/0x4f +[21795.432295] [] pm_suspend+0x176/0x210 +[21795.434830] [] state_store+0x5d/0xb0 +[21795.437410] [] ? wakeup_count_show+0x50/0x50 +[21795.439961] [] kobj_attr_store+0x1b/0x30 +[21795.442514] [] sysfs_write_file+0xab/0x100 +[21795.445088] [] ? sysfs_poll+0xa0/0xa0 +[21795.447659] [] vfs_write+0xa5/0x1c0 +[21795.450212] [] SyS_write+0x57/0xa0 +[21795.452699] [] sysenter_do_call+0x12/0x32 +[21795.455146] ---[ end trace faf5321baba2bfdb ]--- + +To fix this, call the iwl_mvm_free_nd() function in case of any error +during resume. Additionally, rename the "out_unlock" label to err to +make it clearer that it's only called in error conditions. + +Signed-off-by: Luciano Coelho +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/mvm/d3.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/mvm/d3.c ++++ b/drivers/net/wireless/iwlwifi/mvm/d3.c +@@ -1860,15 +1860,15 @@ static int __iwl_mvm_resume(struct iwl_m + /* get the BSS vif pointer again */ + vif = iwl_mvm_get_bss_vif(mvm); + if (IS_ERR_OR_NULL(vif)) +- goto out_unlock; ++ goto err; + + ret = iwl_trans_d3_resume(mvm->trans, &d3_status, test); + if (ret) +- goto out_unlock; ++ goto err; + + if (d3_status != IWL_D3_STATUS_ALIVE) { + IWL_INFO(mvm, "Device was reset during suspend\n"); +- goto out_unlock; ++ goto err; + } + + /* query SRAM first in case we want event logging */ +@@ -1886,7 +1886,8 @@ static int __iwl_mvm_resume(struct iwl_m + /* has unlocked the mutex, so skip that */ + goto out; + +- out_unlock: ++err: ++ iwl_mvm_free_nd(mvm); + mutex_unlock(&mvm->mutex); + + out: diff --git a/queue-4.0/iwlwifi-mvm-free-fw_status-after-use-to-avoid-memory-leak.patch b/queue-4.0/iwlwifi-mvm-free-fw_status-after-use-to-avoid-memory-leak.patch new file mode 100644 index 00000000000..7d8596c48dc --- /dev/null +++ b/queue-4.0/iwlwifi-mvm-free-fw_status-after-use-to-avoid-memory-leak.patch @@ -0,0 +1,36 @@ +From 2fc863a5143d64b8f06576cc3d7fd5622c5cf3b5 Mon Sep 17 00:00:00 2001 +From: Haim Dreyfuss +Date: Wed, 20 May 2015 08:10:43 +0300 +Subject: iwlwifi: mvm: Free fw_status after use to avoid memory leak + +From: Haim Dreyfuss + +commit 2fc863a5143d64b8f06576cc3d7fd5622c5cf3b5 upstream. + +fw_status is the only pointer pointing to a block of memory +allocated above and should be freed after use. +Note: this come from Klockwork static analyzer. + +Fixes: 2021a89d7b8a ("iwlwifi: mvm: treat netdetect wake up separately") +Signed-off-by: Haim Dreyfuss +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/mvm/d3.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/iwlwifi/mvm/d3.c ++++ b/drivers/net/wireless/iwlwifi/mvm/d3.c +@@ -1742,8 +1742,10 @@ static void iwl_mvm_query_netdetect_reas + int i, j, n_matches, ret; + + fw_status = iwl_mvm_get_wakeup_status(mvm, vif); +- if (!IS_ERR_OR_NULL(fw_status)) ++ if (!IS_ERR_OR_NULL(fw_status)) { + reasons = le32_to_cpu(fw_status->wakeup_reasons); ++ kfree(fw_status); ++ } + + if (reasons & IWL_WOWLAN_WAKEUP_BY_RFKILL_DEASSERTED) + wakeup.rfkill_release = true; diff --git a/queue-4.0/iwlwifi-pcie-prevent-using-unmapped-memory-in-fw-monitor.patch b/queue-4.0/iwlwifi-pcie-prevent-using-unmapped-memory-in-fw-monitor.patch new file mode 100644 index 00000000000..f3560fc427a --- /dev/null +++ b/queue-4.0/iwlwifi-pcie-prevent-using-unmapped-memory-in-fw-monitor.patch @@ -0,0 +1,65 @@ +From 553452e5ffc0ed13214a287549627d02d9d7fbdc Mon Sep 17 00:00:00 2001 +From: Liad Kaufman +Date: Thu, 16 Apr 2015 17:21:12 +0300 +Subject: iwlwifi: pcie: prevent using unmapped memory in fw monitor + +From: Liad Kaufman + +commit 553452e5ffc0ed13214a287549627d02d9d7fbdc upstream. + +In the case of a DMA mapping error on the last iteration of +the loop of the allocation of memory of the FW monitor we +indeed free the pages, but don't NULL out the page variable +thus allowing for the possibility of setting the FW monitor +variables with invalid data to use. + +Fixes: c2d202017da1 ("iwlwifi: pcie: add firmware monitor capabilities") +Signed-off-by: Liad Kaufman +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/pcie/trans.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c +@@ -5,8 +5,8 @@ + * + * GPL LICENSE SUMMARY + * +- * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved. +- * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH ++ * Copyright(c) 2007 - 2015 Intel Corporation. All rights reserved. ++ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of version 2 of the GNU General Public License as +@@ -31,8 +31,8 @@ + * + * BSD LICENSE + * +- * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved. +- * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH ++ * Copyright(c) 2005 - 2015 Intel Corporation. All rights reserved. ++ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without +@@ -104,7 +104,7 @@ static void iwl_pcie_free_fw_monitor(str + static void iwl_pcie_alloc_fw_monitor(struct iwl_trans *trans) + { + struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans); +- struct page *page; ++ struct page *page = NULL; + dma_addr_t phys; + u32 size; + u8 power; +@@ -131,6 +131,7 @@ static void iwl_pcie_alloc_fw_monitor(st + DMA_FROM_DEVICE); + if (dma_mapping_error(trans->dev, phys)) { + __free_pages(page, order); ++ page = NULL; + continue; + } + IWL_INFO(trans, diff --git a/queue-4.0/md-fix-race-when-unfreezing-sync_action.patch b/queue-4.0/md-fix-race-when-unfreezing-sync_action.patch new file mode 100644 index 00000000000..3bf4f351477 --- /dev/null +++ b/queue-4.0/md-fix-race-when-unfreezing-sync_action.patch @@ -0,0 +1,80 @@ +From 56ccc1125bc141cf63927eda7febff4216dea2d3 Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Thu, 28 May 2015 17:53:29 +1000 +Subject: md: fix race when unfreezing sync_action + +From: NeilBrown + +commit 56ccc1125bc141cf63927eda7febff4216dea2d3 upstream. + +A recent change removed the need for locking around writing +to "sync_action" (and various other places), but introduced a +subtle race. +When e.g. setting 'reshape' on a 'frozen' array, the 'frozen' +flag is cleared before 'reshape' is set, so the md thread can +get in and start trying recovery - which isn't wanted. + +So instead of clearing MD_RECOVERY_FROZEN for any command +except 'frozen', only clear it when each specific command +is parsed. This allows the handling of 'reshape' to clear +the bit while a lock is held. + +Also remove some places where we set MD_RECOVERY_NEEDED, +as it is always set on non-error exit of the function. + + +Signed-off-by: NeilBrown +Fixes: 6791875e2e53 ("md: make reconfig_mutex optional for writes to md sysfs files.") +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/md.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -4138,12 +4138,12 @@ action_store(struct mddev *mddev, const + if (!mddev->pers || !mddev->pers->sync_request) + return -EINVAL; + +- if (cmd_match(page, "frozen")) +- set_bit(MD_RECOVERY_FROZEN, &mddev->recovery); +- else +- clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery); + + if (cmd_match(page, "idle") || cmd_match(page, "frozen")) { ++ if (cmd_match(page, "frozen")) ++ set_bit(MD_RECOVERY_FROZEN, &mddev->recovery); ++ else ++ clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery); + flush_workqueue(md_misc_wq); + if (mddev->sync_thread) { + set_bit(MD_RECOVERY_INTR, &mddev->recovery); +@@ -4156,16 +4156,17 @@ action_store(struct mddev *mddev, const + test_bit(MD_RECOVERY_NEEDED, &mddev->recovery)) + return -EBUSY; + else if (cmd_match(page, "resync")) +- set_bit(MD_RECOVERY_NEEDED, &mddev->recovery); ++ clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery); + else if (cmd_match(page, "recover")) { ++ clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery); + set_bit(MD_RECOVERY_RECOVER, &mddev->recovery); +- set_bit(MD_RECOVERY_NEEDED, &mddev->recovery); + } else if (cmd_match(page, "reshape")) { + int err; + if (mddev->pers->start_reshape == NULL) + return -EINVAL; + err = mddev_lock(mddev); + if (!err) { ++ clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery); + err = mddev->pers->start_reshape(mddev); + mddev_unlock(mddev); + } +@@ -4177,6 +4178,7 @@ action_store(struct mddev *mddev, const + set_bit(MD_RECOVERY_CHECK, &mddev->recovery); + else if (!cmd_match(page, "repair")) + return -EINVAL; ++ clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery); + set_bit(MD_RECOVERY_REQUESTED, &mddev->recovery); + set_bit(MD_RECOVERY_SYNC, &mddev->recovery); + } diff --git a/queue-4.0/mips-fix-fp-mode-selection-in-lieu-of-.mips.abiflags-data.patch b/queue-4.0/mips-fix-fp-mode-selection-in-lieu-of-.mips.abiflags-data.patch new file mode 100644 index 00000000000..5f358d044c3 --- /dev/null +++ b/queue-4.0/mips-fix-fp-mode-selection-in-lieu-of-.mips.abiflags-data.patch @@ -0,0 +1,106 @@ +From 620b155034570f577470cf5309f741bac6a6e32b Mon Sep 17 00:00:00 2001 +From: Paul Burton +Date: Wed, 6 May 2015 11:52:32 +0100 +Subject: MIPS: fix FP mode selection in lieu of .MIPS.abiflags data + +From: Paul Burton + +commit 620b155034570f577470cf5309f741bac6a6e32b upstream. + +Commit 46490b572544 ("MIPS: kernel: elf: Improve the overall ABI and FPU +mode checks") reworked the ELF FP ABI mode selection logic, but when +CONFIG_MIPS_O32_FP64_SUPPORT is enabled it breaks the use of binaries +which have no PT_MIPS_ABIFLAGS program header & associated +.MIPS.abiflags section. + +A default mode is selected based upon whether the ELF contains MIPS32 or +MIPS64 code, but that selection is made in arch_elf_pt_proc. +arch_elf_pt_proc only executes when a PT_MIPS_ABIFLAGS program header is +found. If one is not found then arch_elf_pt_proc is never called, and no +default overall_fp_mode value is selected. When arch_check_elf is +called, both abi0 & abi1 are MIPS_ABI_FP_UNKNOWN which leads to both +prog_req & interp_req being set to none_req. none_req matches none of +the conditions for mode selection at the end of arch_check_elf, so +overall_fp_mode is left untouched. Finally once mips_set_personality_fp +is called the BUG() in the default case is then hit & the kernel likely +panics. + +Fix this by moving the selection of a default overall mode to the start +of arch_check_elf, which runs once per ELF executed regardless of +whether it has a PT_MIPS_ABIFLAGS program header. + +Signed-off-by: Paul Burton +Cc: Markos Chandras +Cc: Matthew Fortune +Cc: Ralf Baechle +Cc: linux-mips@linux-mips.org +Patchwork: http://patchwork.linux-mips.org/patch/9978/ +Signed-off-by: Ralf Baechle +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/kernel/elf.c | 32 +++++++++++++++++--------------- + 1 file changed, 17 insertions(+), 15 deletions(-) + +--- a/arch/mips/kernel/elf.c ++++ b/arch/mips/kernel/elf.c +@@ -76,14 +76,6 @@ int arch_elf_pt_proc(void *_ehdr, void * + + /* Lets see if this is an O32 ELF */ + if (ehdr32->e_ident[EI_CLASS] == ELFCLASS32) { +- /* FR = 1 for N32 */ +- if (ehdr32->e_flags & EF_MIPS_ABI2) +- state->overall_fp_mode = FP_FR1; +- else +- /* Set a good default FPU mode for O32 */ +- state->overall_fp_mode = cpu_has_mips_r6 ? +- FP_FRE : FP_FR0; +- + if (ehdr32->e_flags & EF_MIPS_FP64) { + /* + * Set MIPS_ABI_FP_OLD_64 for EF_MIPS_FP64. We will override it +@@ -104,9 +96,6 @@ int arch_elf_pt_proc(void *_ehdr, void * + (char *)&abiflags, + sizeof(abiflags)); + } else { +- /* FR=1 is really the only option for 64-bit */ +- state->overall_fp_mode = FP_FR1; +- + if (phdr64->p_type != PT_MIPS_ABIFLAGS) + return 0; + if (phdr64->p_filesz < sizeof(abiflags)) +@@ -147,6 +136,7 @@ int arch_check_elf(void *_ehdr, bool has + struct elf32_hdr *ehdr = _ehdr; + struct mode_req prog_req, interp_req; + int fp_abi, interp_fp_abi, abi0, abi1, max_abi; ++ bool is_mips64; + + if (!config_enabled(CONFIG_MIPS_O32_FP64_SUPPORT)) + return 0; +@@ -162,10 +152,22 @@ int arch_check_elf(void *_ehdr, bool has + abi0 = abi1 = fp_abi; + } + +- /* ABI limits. O32 = FP_64A, N32/N64 = FP_SOFT */ +- max_abi = ((ehdr->e_ident[EI_CLASS] == ELFCLASS32) && +- (!(ehdr->e_flags & EF_MIPS_ABI2))) ? +- MIPS_ABI_FP_64A : MIPS_ABI_FP_SOFT; ++ is_mips64 = (ehdr->e_ident[EI_CLASS] == ELFCLASS64) || ++ (ehdr->e_flags & EF_MIPS_ABI2); ++ ++ if (is_mips64) { ++ /* MIPS64 code always uses FR=1, thus the default is easy */ ++ state->overall_fp_mode = FP_FR1; ++ ++ /* Disallow access to the various FPXX & FP64 ABIs */ ++ max_abi = MIPS_ABI_FP_SOFT; ++ } else { ++ /* Default to a mode capable of running code expecting FR=0 */ ++ state->overall_fp_mode = cpu_has_mips_r6 ? FP_FRE : FP_FR0; ++ ++ /* Allow all ABIs we know about */ ++ max_abi = MIPS_ABI_FP_64A; ++ } + + if ((abi0 > max_abi && abi0 != MIPS_ABI_FP_UNKNOWN) || + (abi1 > max_abi && abi1 != MIPS_ABI_FP_UNKNOWN)) diff --git a/queue-4.0/power-reset-at91-fix-return-value-check-in-at91_reset_platform_probe.patch b/queue-4.0/power-reset-at91-fix-return-value-check-in-at91_reset_platform_probe.patch new file mode 100644 index 00000000000..a462b757f0b --- /dev/null +++ b/queue-4.0/power-reset-at91-fix-return-value-check-in-at91_reset_platform_probe.patch @@ -0,0 +1,36 @@ +From 932df43005389300a3336421e4aedb25390ae144 Mon Sep 17 00:00:00 2001 +From: Wei Yongjun +Date: Thu, 16 Apr 2015 20:19:43 +0800 +Subject: power/reset: at91: fix return value check in at91_reset_platform_probe() + +From: Wei Yongjun + +commit 932df43005389300a3336421e4aedb25390ae144 upstream. + +In case of error, the function devm_ioremap() returns NULL +not ERR_PTR(). The IS_ERR() test in the return value check +should be replaced with NULL test. + +Fixes: ecfe64d8c55f ("power: reset: Add AT91 reset driver") +Signed-off-by: Wei Yongjun +Signed-off-by: Sebastian Reichel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/power/reset/at91-reset.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/power/reset/at91-reset.c ++++ b/drivers/power/reset/at91-reset.c +@@ -212,9 +212,9 @@ static int at91_reset_platform_probe(str + res = platform_get_resource(pdev, IORESOURCE_MEM, idx + 1 ); + at91_ramc_base[idx] = devm_ioremap(&pdev->dev, res->start, + resource_size(res)); +- if (IS_ERR(at91_ramc_base[idx])) { ++ if (!at91_ramc_base[idx]) { + dev_err(&pdev->dev, "Could not map ram controller address\n"); +- return PTR_ERR(at91_ramc_base[idx]); ++ return -ENOMEM; + } + } + diff --git a/queue-4.0/pwm-img-impose-upper-and-lower-timebase-steps-value.patch b/queue-4.0/pwm-img-impose-upper-and-lower-timebase-steps-value.patch new file mode 100644 index 00000000000..07ba093f247 --- /dev/null +++ b/queue-4.0/pwm-img-impose-upper-and-lower-timebase-steps-value.patch @@ -0,0 +1,179 @@ +From 1e70897d0e20f988abedcf73b33684ecd2be9511 Mon Sep 17 00:00:00 2001 +From: Naidu Tellapati +Date: Fri, 8 May 2015 18:47:31 -0300 +Subject: pwm: img: Impose upper and lower timebase steps value + +From: Naidu Tellapati + +commit 1e70897d0e20f988abedcf73b33684ecd2be9511 upstream. + +The PWM hardware on Pistachio platform has a maximum timebase steps +value to 255. To fix it, let's introduce a compatible-specific +data structure to contain the SoC-specific details and use it to +specify a maximum timebase. + +Also, let's limit the minimum timebase to 16 steps, to allow a sane +range of duty cycle steps. + +Fixes: 277bb6a29e00 ("pwm: Imagination Technologies PWM DAC driver") +Signed-off-by: Naidu Tellapati +Signed-off-by: Ezequiel Garcia +Signed-off-by: Thierry Reding +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pwm/pwm-img.c | 76 ++++++++++++++++++++++++++++++++++++++++++-------- + 1 file changed, 64 insertions(+), 12 deletions(-) + +--- a/drivers/pwm/pwm-img.c ++++ b/drivers/pwm/pwm-img.c +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -38,7 +39,22 @@ + #define PERIP_PWM_PDM_CONTROL_CH_MASK 0x1 + #define PERIP_PWM_PDM_CONTROL_CH_SHIFT(ch) ((ch) * 4) + +-#define MAX_TMBASE_STEPS 65536 ++/* ++ * PWM period is specified with a timebase register, ++ * in number of step periods. The PWM duty cycle is also ++ * specified in step periods, in the [0, $timebase] range. ++ * In other words, the timebase imposes the duty cycle ++ * resolution. Therefore, let's constraint the timebase to ++ * a minimum value to allow a sane range of duty cycle values. ++ * Imposing a minimum timebase, will impose a maximum PWM frequency. ++ * ++ * The value chosen is completely arbitrary. ++ */ ++#define MIN_TMBASE_STEPS 16 ++ ++struct img_pwm_soc_data { ++ u32 max_timebase; ++}; + + struct img_pwm_chip { + struct device *dev; +@@ -47,6 +63,9 @@ struct img_pwm_chip { + struct clk *sys_clk; + void __iomem *base; + struct regmap *periph_regs; ++ int max_period_ns; ++ int min_period_ns; ++ const struct img_pwm_soc_data *data; + }; + + static inline struct img_pwm_chip *to_img_pwm_chip(struct pwm_chip *chip) +@@ -72,24 +91,31 @@ static int img_pwm_config(struct pwm_chi + u32 val, div, duty, timebase; + unsigned long mul, output_clk_hz, input_clk_hz; + struct img_pwm_chip *pwm_chip = to_img_pwm_chip(chip); ++ unsigned int max_timebase = pwm_chip->data->max_timebase; ++ ++ if (period_ns < pwm_chip->min_period_ns || ++ period_ns > pwm_chip->max_period_ns) { ++ dev_err(chip->dev, "configured period not in range\n"); ++ return -ERANGE; ++ } + + input_clk_hz = clk_get_rate(pwm_chip->pwm_clk); + output_clk_hz = DIV_ROUND_UP(NSEC_PER_SEC, period_ns); + + mul = DIV_ROUND_UP(input_clk_hz, output_clk_hz); +- if (mul <= MAX_TMBASE_STEPS) { ++ if (mul <= max_timebase) { + div = PWM_CTRL_CFG_NO_SUB_DIV; + timebase = DIV_ROUND_UP(mul, 1); +- } else if (mul <= MAX_TMBASE_STEPS * 8) { ++ } else if (mul <= max_timebase * 8) { + div = PWM_CTRL_CFG_SUB_DIV0; + timebase = DIV_ROUND_UP(mul, 8); +- } else if (mul <= MAX_TMBASE_STEPS * 64) { ++ } else if (mul <= max_timebase * 64) { + div = PWM_CTRL_CFG_SUB_DIV1; + timebase = DIV_ROUND_UP(mul, 64); +- } else if (mul <= MAX_TMBASE_STEPS * 512) { ++ } else if (mul <= max_timebase * 512) { + div = PWM_CTRL_CFG_SUB_DIV0_DIV1; + timebase = DIV_ROUND_UP(mul, 512); +- } else if (mul > MAX_TMBASE_STEPS * 512) { ++ } else if (mul > max_timebase * 512) { + dev_err(chip->dev, + "failed to configure timebase steps/divider value\n"); + return -EINVAL; +@@ -143,11 +169,27 @@ static const struct pwm_ops img_pwm_ops + .owner = THIS_MODULE, + }; + ++static const struct img_pwm_soc_data pistachio_pwm = { ++ .max_timebase = 255, ++}; ++ ++static const struct of_device_id img_pwm_of_match[] = { ++ { ++ .compatible = "img,pistachio-pwm", ++ .data = &pistachio_pwm, ++ }, ++ { } ++}; ++MODULE_DEVICE_TABLE(of, img_pwm_of_match); ++ + static int img_pwm_probe(struct platform_device *pdev) + { + int ret; ++ u64 val; ++ unsigned long clk_rate; + struct resource *res; + struct img_pwm_chip *pwm; ++ const struct of_device_id *of_dev_id; + + pwm = devm_kzalloc(&pdev->dev, sizeof(*pwm), GFP_KERNEL); + if (!pwm) +@@ -160,6 +202,11 @@ static int img_pwm_probe(struct platform + if (IS_ERR(pwm->base)) + return PTR_ERR(pwm->base); + ++ of_dev_id = of_match_device(img_pwm_of_match, &pdev->dev); ++ if (!of_dev_id) ++ return -ENODEV; ++ pwm->data = of_dev_id->data; ++ + pwm->periph_regs = syscon_regmap_lookup_by_phandle(pdev->dev.of_node, + "img,cr-periph"); + if (IS_ERR(pwm->periph_regs)) +@@ -189,6 +236,17 @@ static int img_pwm_probe(struct platform + goto disable_sysclk; + } + ++ clk_rate = clk_get_rate(pwm->pwm_clk); ++ ++ /* The maximum input clock divider is 512 */ ++ val = (u64)NSEC_PER_SEC * 512 * pwm->data->max_timebase; ++ do_div(val, clk_rate); ++ pwm->max_period_ns = val; ++ ++ val = (u64)NSEC_PER_SEC * MIN_TMBASE_STEPS; ++ do_div(val, clk_rate); ++ pwm->min_period_ns = val; ++ + pwm->chip.dev = &pdev->dev; + pwm->chip.ops = &img_pwm_ops; + pwm->chip.base = -1; +@@ -228,12 +286,6 @@ static int img_pwm_remove(struct platfor + return pwmchip_remove(&pwm_chip->chip); + } + +-static const struct of_device_id img_pwm_of_match[] = { +- { .compatible = "img,pistachio-pwm", }, +- { } +-}; +-MODULE_DEVICE_TABLE(of, img_pwm_of_match); +- + static struct platform_driver img_pwm_driver = { + .driver = { + .name = "img-pwm", diff --git a/queue-4.0/revert-drm-radeon-only-mark-audio-as-connected-if-the-monitor-supports-it-v3.patch b/queue-4.0/revert-drm-radeon-only-mark-audio-as-connected-if-the-monitor-supports-it-v3.patch new file mode 100644 index 00000000000..1afdc6496e1 --- /dev/null +++ b/queue-4.0/revert-drm-radeon-only-mark-audio-as-connected-if-the-monitor-supports-it-v3.patch @@ -0,0 +1,101 @@ +From 2d1c18bba15daf89d75ce475ecd2068f483aa12f Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 27 May 2015 11:43:53 -0400 +Subject: Revert "drm/radeon: only mark audio as connected if the monitor supports it (v3)" + +From: Alex Deucher + +commit 2d1c18bba15daf89d75ce475ecd2068f483aa12f upstream. + +This breaks too many things. + +bugs: +https://bugzilla.kernel.org/show_bug.cgi?id=99041 +https://bugs.freedesktop.org/show_bug.cgi?id=90681 + +This reverts commit 0f55db36d49d45b80eff0c0a2a498766016f458b. + +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_audio.c | 27 ++++++++++++--------------- + drivers/gpu/drm/radeon/radeon_connectors.c | 8 ++------ + 2 files changed, 14 insertions(+), 21 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon_audio.c ++++ b/drivers/gpu/drm/radeon/radeon_audio.c +@@ -460,9 +460,6 @@ void radeon_audio_detect(struct drm_conn + if (!connector || !connector->encoder) + return; + +- if (!radeon_encoder_is_digital(connector->encoder)) +- return; +- + rdev = connector->encoder->dev->dev_private; + + if (!radeon_audio_chipset_supported(rdev)) +@@ -471,26 +468,26 @@ void radeon_audio_detect(struct drm_conn + radeon_encoder = to_radeon_encoder(connector->encoder); + dig = radeon_encoder->enc_priv; + +- if (!dig->afmt) +- return; +- + if (status == connector_status_connected) { +- struct radeon_connector *radeon_connector = to_radeon_connector(connector); ++ struct radeon_connector *radeon_connector; ++ int sink_type; ++ ++ if (!drm_detect_monitor_audio(radeon_connector_edid(connector))) { ++ radeon_encoder->audio = NULL; ++ return; ++ } ++ ++ radeon_connector = to_radeon_connector(connector); ++ sink_type = radeon_dp_getsinktype(radeon_connector); + + if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort && +- radeon_dp_getsinktype(radeon_connector) == +- CONNECTOR_OBJECT_ID_DISPLAYPORT) ++ sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) + radeon_encoder->audio = rdev->audio.dp_funcs; + else + radeon_encoder->audio = rdev->audio.hdmi_funcs; + + dig->afmt->pin = radeon_audio_get_pin(connector->encoder); +- if (drm_detect_monitor_audio(radeon_connector_edid(connector))) { +- radeon_audio_enable(rdev, dig->afmt->pin, 0xf); +- } else { +- radeon_audio_enable(rdev, dig->afmt->pin, 0); +- dig->afmt->pin = NULL; +- } ++ radeon_audio_enable(rdev, dig->afmt->pin, 0xf); + } else { + radeon_audio_enable(rdev, dig->afmt->pin, 0); + dig->afmt->pin = NULL; +--- a/drivers/gpu/drm/radeon/radeon_connectors.c ++++ b/drivers/gpu/drm/radeon/radeon_connectors.c +@@ -1333,10 +1333,8 @@ out: + /* updated in get modes as well since we need to know if it's analog or digital */ + radeon_connector_update_scratch_regs(connector, ret); + +- if (radeon_audio != 0) { +- radeon_connector_get_edid(connector); ++ if (radeon_audio != 0) + radeon_audio_detect(connector, ret); +- } + + exit: + pm_runtime_mark_last_busy(connector->dev->dev); +@@ -1661,10 +1659,8 @@ radeon_dp_detect(struct drm_connector *c + + radeon_connector_update_scratch_regs(connector, ret); + +- if (radeon_audio != 0) { +- radeon_connector_get_edid(connector); ++ if (radeon_audio != 0) + radeon_audio_detect(connector, ret); +- } + + out: + pm_runtime_mark_last_busy(connector->dev->dev); diff --git a/queue-4.0/rtlwifi-rtl8192cu-fix-kernel-deadlock.patch b/queue-4.0/rtlwifi-rtl8192cu-fix-kernel-deadlock.patch new file mode 100644 index 00000000000..aa719a6bb92 --- /dev/null +++ b/queue-4.0/rtlwifi-rtl8192cu-fix-kernel-deadlock.patch @@ -0,0 +1,39 @@ +From 414b7e3b9ce8b0577f613e656fdbc36b34b444dd Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Fri, 24 Apr 2015 11:03:37 -0500 +Subject: rtlwifi: rtl8192cu: Fix kernel deadlock + +From: Larry Finger + +commit 414b7e3b9ce8b0577f613e656fdbc36b34b444dd upstream. + +The USB mini-driver in rtlwifi, which is used by rtl8192cu, issues a call to +usb_control_msg() with a timeout value of 0. In some instances where the +interface is shutting down, this infinite wait results in a CPU deadlock. A +one second timeout fixes this problem without affecting any normal operations. + +This bug is reported at https://bugzilla.novell.com/show_bug.cgi?id=927786. + +Reported-by: Bernhard Wiedemann +Tested-by: Bernhard Wiedemann +Signed-off-by: Larry Finger +Cc: Bernhard Wiedemann +Cc: Takashi Iwai +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/rtlwifi/usb.c ++++ b/drivers/net/wireless/rtlwifi/usb.c +@@ -126,7 +126,7 @@ static int _usbctrl_vendorreq_sync_read( + + do { + status = usb_control_msg(udev, pipe, request, reqtype, value, +- index, pdata, len, 0); /*max. timeout*/ ++ index, pdata, len, 1000); + if (status < 0) { + /* firmware download is checksumed, don't retry */ + if ((value >= FW_8192C_START_ADDRESS && diff --git a/queue-4.0/sd-disable-support-for-256-byte-sector-disks.patch b/queue-4.0/sd-disable-support-for-256-byte-sector-disks.patch new file mode 100644 index 00000000000..57fed1a300f --- /dev/null +++ b/queue-4.0/sd-disable-support-for-256-byte-sector-disks.patch @@ -0,0 +1,71 @@ +From 74856fbf441929918c49ff262ace9835048e4e6a Mon Sep 17 00:00:00 2001 +From: Mark Hounschell +Date: Wed, 13 May 2015 10:49:09 +0200 +Subject: sd: Disable support for 256 byte/sector disks + +From: Mark Hounschell + +commit 74856fbf441929918c49ff262ace9835048e4e6a upstream. + +256 bytes per sector support has been broken since 2.6.X, +and no-one stepped up to fix this. +So disable support for it. + +Signed-off-by: Mark Hounschell +Signed-off-by: Hannes Reinecke +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/sd.c | 19 +++++-------------- + 1 file changed, 5 insertions(+), 14 deletions(-) + +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -1624,6 +1624,7 @@ static unsigned int sd_completed_bytes(s + { + u64 start_lba = blk_rq_pos(scmd->request); + u64 end_lba = blk_rq_pos(scmd->request) + (scsi_bufflen(scmd) / 512); ++ u64 factor = scmd->device->sector_size / 512; + u64 bad_lba; + int info_valid; + /* +@@ -1645,16 +1646,9 @@ static unsigned int sd_completed_bytes(s + if (scsi_bufflen(scmd) <= scmd->device->sector_size) + return 0; + +- if (scmd->device->sector_size < 512) { +- /* only legitimate sector_size here is 256 */ +- start_lba <<= 1; +- end_lba <<= 1; +- } else { +- /* be careful ... don't want any overflows */ +- unsigned int factor = scmd->device->sector_size / 512; +- do_div(start_lba, factor); +- do_div(end_lba, factor); +- } ++ /* be careful ... don't want any overflows */ ++ do_div(start_lba, factor); ++ do_div(end_lba, factor); + + /* The bad lba was reported incorrectly, we have no idea where + * the error is. +@@ -2212,8 +2206,7 @@ got_data: + if (sector_size != 512 && + sector_size != 1024 && + sector_size != 2048 && +- sector_size != 4096 && +- sector_size != 256) { ++ sector_size != 4096) { + sd_printk(KERN_NOTICE, sdkp, "Unsupported sector size %d.\n", + sector_size); + /* +@@ -2268,8 +2261,6 @@ got_data: + sdkp->capacity <<= 2; + else if (sector_size == 1024) + sdkp->capacity <<= 1; +- else if (sector_size == 256) +- sdkp->capacity >>= 1; + + blk_queue_physical_block_size(sdp->request_queue, + sdkp->physical_block_size); diff --git a/queue-4.0/series b/queue-4.0/series index 06f6a43bfd3..e42d7e04efb 100644 --- a/queue-4.0/series +++ b/queue-4.0/series @@ -119,3 +119,30 @@ thermal-armada-update-armada-380-thermal-sensor-coefficients.patch md-raid5-don-t-record-new-size-if-resize_stripes-fails.patch md-raid0-fix-restore-to-sector-variable-in-raid0_make_request.patch revert-hid-logitech-hidpp-support-combo-keyboard-touchpad-tk820.patch +mips-fix-fp-mode-selection-in-lieu-of-.mips.abiflags-data.patch +rtlwifi-rtl8192cu-fix-kernel-deadlock.patch +input-elantech-fix-semi-mt-protocol-for-v3-hw.patch +storvsc-set-the-srb-flags-correctly-when-no-data-transfer-is-needed.patch +sd-disable-support-for-256-byte-sector-disks.patch +acpi-init-fix-the-ordering-of-acpi_reserve_resources.patch +iwlwifi-mvm-clean-net-detect-info-if-device-was-reset-during-suspend.patch +iwlwifi-mvm-free-fw_status-after-use-to-avoid-memory-leak.patch +iwlwifi-pcie-prevent-using-unmapped-memory-in-fw-monitor.patch +drm-radeon-add-new-bonaire-pci-id.patch +drm-radeon-fix-vm_context-_page_table_end_addr-handling.patch +drm-radeon-retry-dcpd-fetch.patch +drm-plane-helper-adapt-cursor-hack-to-transitional-helpers.patch +drm-radeon-don-t-share-plls-if-monitors-differ-in-audio-support.patch +drm-radeon-audio-make-sure-connector-is-valid-in-hotplug-case.patch +revert-drm-radeon-only-mark-audio-as-connected-if-the-monitor-supports-it-v3.patch +drm-radeon-partially-revert-fix-vm_context-_page_table_end_addr-handling.patch +dm-fix-casting-bug-in-dm_merge_bvec.patch +dm-fix-reload-failure-of-0-path-multipath-mapping-on-blk-mq-devices.patch +drm-amdkfd-don-t-report-local-memory-size.patch +vfs-read-file_handle-only-once-in-handle_to_path.patch +power-reset-at91-fix-return-value-check-in-at91_reset_platform_probe.patch +arc-unbork-llsc-build.patch +ubi-block-add-missing-cache-flushes.patch +pwm-img-impose-upper-and-lower-timebase-steps-value.patch +md-fix-race-when-unfreezing-sync_action.patch +fs-binfmt_elf.c-load_elf_binary-return-einval-on-zero-length-mappings.patch diff --git a/queue-4.0/storvsc-set-the-srb-flags-correctly-when-no-data-transfer-is-needed.patch b/queue-4.0/storvsc-set-the-srb-flags-correctly-when-no-data-transfer-is-needed.patch new file mode 100644 index 00000000000..de4d5ad25a4 --- /dev/null +++ b/queue-4.0/storvsc-set-the-srb-flags-correctly-when-no-data-transfer-is-needed.patch @@ -0,0 +1,33 @@ +From dc45708ca9988656d706940df5fd102672c5de92 Mon Sep 17 00:00:00 2001 +From: "K. Y. Srinivasan" +Date: Fri, 1 May 2015 11:03:02 -0700 +Subject: storvsc: Set the SRB flags correctly when no data transfer is needed + +From: "K. Y. Srinivasan" + +commit dc45708ca9988656d706940df5fd102672c5de92 upstream. + +Set the SRB flags correctly when there is no data transfer. Without this +change some IHV drivers will fail valid commands such as TEST_UNIT_READY. + +Signed-off-by: K. Y. Srinivasan +Reviewed-by: Long Li +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/storvsc_drv.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -1565,8 +1565,7 @@ static int storvsc_queuecommand(struct S + break; + default: + vm_srb->data_in = UNKNOWN_TYPE; +- vm_srb->win8_extension.srb_flags |= (SRB_FLAGS_DATA_IN | +- SRB_FLAGS_DATA_OUT); ++ vm_srb->win8_extension.srb_flags |= SRB_FLAGS_NO_DATA_TRANSFER; + break; + } + diff --git a/queue-4.0/ubi-block-add-missing-cache-flushes.patch b/queue-4.0/ubi-block-add-missing-cache-flushes.patch new file mode 100644 index 00000000000..aac46de818c --- /dev/null +++ b/queue-4.0/ubi-block-add-missing-cache-flushes.patch @@ -0,0 +1,40 @@ +From 98fb1ffd8154890d7051750e61ff5548c3ee2ab2 Mon Sep 17 00:00:00 2001 +From: Kevin Cernekee +Date: Wed, 22 Apr 2015 09:30:53 -0300 +Subject: UBI: block: Add missing cache flushes + +From: Kevin Cernekee + +commit 98fb1ffd8154890d7051750e61ff5548c3ee2ab2 upstream. + +Block drivers are responsible for calling flush_dcache_page() on each +BIO request. This operation keeps the I$ coherent with the D$ on +architectures that don't have hardware coherency support. Without this +flush, random crashes are seen when executing user programs from an ext4 +filesystem backed by a ubiblock device. + +This patch is based on the change implemented in commit 2d4dc890b5c8 +("block: add helpers to run flush_dcache_page() against a bio and a +request's pages"). + +Fixes: 9d54c8a33eec ("UBI: R/O block driver on top of UBI volumes") +Signed-off-by: Kevin Cernekee +Signed-off-by: Ezequiel Garcia +Signed-off-by: Richard Weinberger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/ubi/block.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/mtd/ubi/block.c ++++ b/drivers/mtd/ubi/block.c +@@ -310,6 +310,8 @@ static void ubiblock_do_work(struct work + blk_rq_map_sg(req->q, req, pdu->usgl.sg); + + ret = ubiblock_read(pdu); ++ rq_flush_dcache_pages(req); ++ + blk_mq_end_request(req, ret); + } + diff --git a/queue-4.0/vfs-read-file_handle-only-once-in-handle_to_path.patch b/queue-4.0/vfs-read-file_handle-only-once-in-handle_to_path.patch new file mode 100644 index 00000000000..d2a2ade1a7b --- /dev/null +++ b/queue-4.0/vfs-read-file_handle-only-once-in-handle_to_path.patch @@ -0,0 +1,43 @@ +From 161f873b89136eb1e69477c847d5a5033239d9ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2015 15:30:43 -0500 +Subject: vfs: read file_handle only once in handle_to_path + +From: Sasha Levin + +commit 161f873b89136eb1e69477c847d5a5033239d9ba upstream. + +We used to read file_handle twice. Once to get the amount of extra +bytes, and once to fetch the entire structure. + +This may be problematic since we do size verifications only after the +first read, so if the number of extra bytes changes in userspace between +the first and second calls, we'll have an incoherent view of +file_handle. + +Instead, read the constant size once, and copy that over to the final +structure without having to re-read it again. + +Signed-off-by: Sasha Levin +Cc: Al Viro +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fhandle.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/fs/fhandle.c ++++ b/fs/fhandle.c +@@ -195,8 +195,9 @@ static int handle_to_path(int mountdirfd + goto out_err; + } + /* copy the full handle */ +- if (copy_from_user(handle, ufh, +- sizeof(struct file_handle) + ++ *handle = f_handle; ++ if (copy_from_user(&handle->f_handle, ++ &ufh->f_handle, + f_handle.handle_bytes)) { + retval = -EFAULT; + goto out_handle;