From: Greg Kroah-Hartman Date: Sun, 1 May 2016 23:21:13 +0000 (-0700) Subject: 4.4-stable patches X-Git-Tag: v3.14.68~34 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=91fd798e0e664d7b1e26770a3d58619029520ed9;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: drm-amdkfd-uninitialized-variable-in-dbgdev_wave_control_set_registers.patch drm-dp-mst-get-validated-port-ref-in-drm_dp_update_payload_part1.patch drm-dp-mst-restore-primary-hub-guid-on-resume.patch drm-dp-mst-validate-port-in-drm_dp_payload_send_msg.patch drm-i915-cleanup-phys-status-page-too.patch drm-i915-fixup-the-free-space-logic-in-ring_prepare.patch drm-i915-skl_update_scaler-wants-a-rotation-bitmask-instead-of-bit-number.patch drm-i915-use-fw_domains_put_with_fifo-on-hsw.patch drm-loongson-3-doesn-t-fully-support-wc-memory.patch drm-nouveau-gr-gf100-select-a-stream-master-to-fixup-tfb-offset-queries.patch drm-radeon-add-a-quirk-for-a-xfx-r9-270x.patch drm-radeon-fix-initial-connector-audio-value.patch drm-radeon-fix-vertical-bars-appear-on-monitor-v2.patch drm-radeon-forbid-mapping-of-userptr-bo-through-radeon-device-file.patch edac-i7core-sb_edac-don-t-return-notify_bad-from-mce_decoder-callback.patch i2c-cpm-fix-build-break-due-to-incompatible-pointer-types.patch i2c-exynos5-fix-possible-abba-deadlock-by-keeping-i2c-clock-prepared.patch perf-intel-pt-fix-segfault-tracing-transactions.patch pwm-brcmstb-fix-check-of-devm_ioremap_resource-return-code.patch toshiba_acpi-fix-regression-caused-by-hotkey-enabling-value.patch --- diff --git a/queue-4.4/drm-amdkfd-uninitialized-variable-in-dbgdev_wave_control_set_registers.patch b/queue-4.4/drm-amdkfd-uninitialized-variable-in-dbgdev_wave_control_set_registers.patch new file mode 100644 index 00000000000..8375891f274 --- /dev/null +++ b/queue-4.4/drm-amdkfd-uninitialized-variable-in-dbgdev_wave_control_set_registers.patch @@ -0,0 +1,32 @@ +From 93fce954427effee89e44a976299b15dd75b4bbc Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 11 Mar 2016 10:51:51 +0300 +Subject: drm/amdkfd: uninitialized variable in dbgdev_wave_control_set_registers() + +From: Dan Carpenter + +commit 93fce954427effee89e44a976299b15dd75b4bbc upstream. + +At the end of the function we expect "status" to be zero, but it's +either -EINVAL or uninitialized. + +Fixes: 788bf83db301 ('drm/amdkfd: Add wave control operation to debugger') +Signed-off-by: Dan Carpenter +Signed-off-by: Oded Gabbay +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdkfd/kfd_dbgdev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_dbgdev.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_dbgdev.c +@@ -513,7 +513,7 @@ static int dbgdev_wave_control_set_regis + union SQ_CMD_BITS *in_reg_sq_cmd, + union GRBM_GFX_INDEX_BITS *in_reg_gfx_index) + { +- int status; ++ int status = 0; + union SQ_CMD_BITS reg_sq_cmd; + union GRBM_GFX_INDEX_BITS reg_gfx_index; + struct HsaDbgWaveMsgAMDGen2 *pMsg; diff --git a/queue-4.4/drm-dp-mst-get-validated-port-ref-in-drm_dp_update_payload_part1.patch b/queue-4.4/drm-dp-mst-get-validated-port-ref-in-drm_dp_update_payload_part1.patch new file mode 100644 index 00000000000..afbf5d401af --- /dev/null +++ b/queue-4.4/drm-dp-mst-get-validated-port-ref-in-drm_dp_update_payload_part1.patch @@ -0,0 +1,78 @@ +From 263efde31f97c498e1ebad30e4d2906609d7ad6b Mon Sep 17 00:00:00 2001 +From: "cpaul@redhat.com" +Date: Fri, 22 Apr 2016 16:08:46 -0400 +Subject: drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1() + +From: cpaul@redhat.com + +commit 263efde31f97c498e1ebad30e4d2906609d7ad6b upstream. + +We can thank KASAN for finding this, otherwise I probably would have spent +hours on it. This fixes a somewhat harder to trigger kernel panic, occuring +while enabling MST where the port we were currently updating the payload on +would have all of it's refs dropped before we finished what we were doing: + +================================================================== +BUG: KASAN: use-after-free in drm_dp_update_payload_part1+0xb3f/0xdb0 [drm_kms_helper] at addr ffff8800d29de018 +Read of size 4 by task Xorg/973 +============================================================================= +BUG kmalloc-2048 (Tainted: G B W ): kasan: bad access detected +----------------------------------------------------------------------------- + +INFO: Allocated in drm_dp_add_port+0x1aa/0x1ed0 [drm_kms_helper] age=16477 cpu=0 pid=2175 + ___slab_alloc+0x472/0x490 + __slab_alloc+0x20/0x40 + kmem_cache_alloc_trace+0x151/0x190 + drm_dp_add_port+0x1aa/0x1ed0 [drm_kms_helper] + drm_dp_send_link_address+0x526/0x960 [drm_kms_helper] + drm_dp_check_and_send_link_address+0x1ac/0x210 [drm_kms_helper] + drm_dp_mst_link_probe_work+0x77/0xd0 [drm_kms_helper] + process_one_work+0x562/0x1350 + worker_thread+0xd9/0x1390 + kthread+0x1c5/0x260 + ret_from_fork+0x22/0x40 +INFO: Freed in drm_dp_free_mst_port+0x50/0x60 [drm_kms_helper] age=7521 cpu=0 pid=2175 + __slab_free+0x17f/0x2d0 + kfree+0x169/0x180 + drm_dp_free_mst_port+0x50/0x60 [drm_kms_helper] + drm_dp_destroy_connector_work+0x2b8/0x490 [drm_kms_helper] + process_one_work+0x562/0x1350 + worker_thread+0xd9/0x1390 + kthread+0x1c5/0x260 + ret_from_fork+0x22/0x40 + +which on this T460s, would eventually lead to kernel panics in somewhat +random places later in intel_mst_enable_dp() if we got lucky enough. + +Signed-off-by: Lyude +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_dp_mst_topology.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -1786,6 +1786,11 @@ int drm_dp_update_payload_part1(struct d + req_payload.start_slot = cur_slots; + if (mgr->proposed_vcpis[i]) { + port = container_of(mgr->proposed_vcpis[i], struct drm_dp_mst_port, vcpi); ++ port = drm_dp_get_validated_port_ref(mgr, port); ++ if (!port) { ++ mutex_unlock(&mgr->payload_lock); ++ return -EINVAL; ++ } + req_payload.num_slots = mgr->proposed_vcpis[i]->num_slots; + } else { + port = NULL; +@@ -1811,6 +1816,9 @@ int drm_dp_update_payload_part1(struct d + mgr->payloads[i].payload_state = req_payload.payload_state; + } + cur_slots += req_payload.num_slots; ++ ++ if (port) ++ drm_dp_put_port(port); + } + + for (i = 0; i < mgr->max_payloads; i++) { diff --git a/queue-4.4/drm-dp-mst-restore-primary-hub-guid-on-resume.patch b/queue-4.4/drm-dp-mst-restore-primary-hub-guid-on-resume.patch new file mode 100644 index 00000000000..dd1149db6ca --- /dev/null +++ b/queue-4.4/drm-dp-mst-restore-primary-hub-guid-on-resume.patch @@ -0,0 +1,55 @@ +From 9dc0487d96a0396367a1451b31873482080b527f Mon Sep 17 00:00:00 2001 +From: Lyude +Date: Wed, 13 Apr 2016 16:50:18 -0400 +Subject: drm/dp/mst: Restore primary hub guid on resume + +From: Lyude + +commit 9dc0487d96a0396367a1451b31873482080b527f upstream. + +Some hubs are forgetful, and end up forgetting whatever GUID we set +previously after we do a suspend/resume cycle. This can lead to +hotplugging breaking (along with probably other things) since the hub +will start sending connection notifications with the wrong GUID. As +such, we need to check on resume whether or not the GUID the hub is +giving us is valid. + +Signed-off-by: Lyude +Reviewed-by: Harry Wentland +Signed-off-by: Daniel Vetter +Link: http://patchwork.freedesktop.org/patch/msgid/1460580618-7421-1-git-send-email-cpaul@redhat.com +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_dp_mst_topology.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -2116,6 +2116,8 @@ int drm_dp_mst_topology_mgr_resume(struc + + if (mgr->mst_primary) { + int sret; ++ u8 guid[16]; ++ + sret = drm_dp_dpcd_read(mgr->aux, DP_DPCD_REV, mgr->dpcd, DP_RECEIVER_CAP_SIZE); + if (sret != DP_RECEIVER_CAP_SIZE) { + DRM_DEBUG_KMS("dpcd read failed - undocked during suspend?\n"); +@@ -2130,6 +2132,16 @@ int drm_dp_mst_topology_mgr_resume(struc + ret = -1; + goto out_unlock; + } ++ ++ /* Some hubs forget their guids after they resume */ ++ sret = drm_dp_dpcd_read(mgr->aux, DP_GUID, guid, 16); ++ if (sret != 16) { ++ DRM_DEBUG_KMS("dpcd read failed - undocked during suspend?\n"); ++ ret = -1; ++ goto out_unlock; ++ } ++ drm_dp_check_mstb_guid(mgr->mst_primary, guid); ++ + ret = 0; + } else + ret = -1; diff --git a/queue-4.4/drm-dp-mst-validate-port-in-drm_dp_payload_send_msg.patch b/queue-4.4/drm-dp-mst-validate-port-in-drm_dp_payload_send_msg.patch new file mode 100644 index 00000000000..7a7d78a488a --- /dev/null +++ b/queue-4.4/drm-dp-mst-validate-port-in-drm_dp_payload_send_msg.patch @@ -0,0 +1,91 @@ +From deba0a2af9592b2022a0bce7b085a318b53ce1db Mon Sep 17 00:00:00 2001 +From: "cpaul@redhat.com" +Date: Mon, 4 Apr 2016 19:58:47 -0400 +Subject: drm/dp/mst: Validate port in drm_dp_payload_send_msg() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: cpaul@redhat.com + +commit deba0a2af9592b2022a0bce7b085a318b53ce1db upstream. + +With the joys of things running concurrently, there's always a chance +that the port we get passed in drm_dp_payload_send_msg() isn't actually +valid anymore. Because of this, we need to make sure we validate the +reference to the port before we use it otherwise we risk running into +various race conditions. For instance, on the Dell MST monitor I have +here for testing, hotplugging it enough times causes us to kernel panic: + +[drm:intel_mst_enable_dp] 1 +[drm:drm_dp_update_payload_part2] payload 0 1 +[drm:intel_get_hpd_pins] hotplug event received, stat 0x00200000, dig 0x10101011, pins 0x00000020 +[drm:intel_hpd_irq_handler] digital hpd port B - short +[drm:intel_dp_hpd_pulse] got hpd irq on port B - short +[drm:intel_dp_check_mst_status] got esi 00 10 00 +[drm:drm_dp_update_payload_part2] payload 1 1 +general protection fault: 0000 [#1] SMP +… +Call Trace: + [] drm_dp_update_payload_part2+0xc2/0x130 [drm_kms_helper] + [] intel_mst_enable_dp+0xf8/0x180 [i915] + [] haswell_crtc_enable+0x3ed/0x8c0 [i915] + [] intel_atomic_commit+0x5ad/0x1590 [i915] + [] ? drm_atomic_set_crtc_for_connector+0x57/0xe0 [drm] + [] drm_atomic_commit+0x37/0x60 [drm] + [] drm_atomic_helper_set_config+0x7a/0xb0 [drm_kms_helper] + [] drm_mode_set_config_internal+0x62/0x100 [drm] + [] drm_mode_setcrtc+0x3cd/0x4e0 [drm] + [] drm_ioctl+0x143/0x510 [drm] + [] ? drm_mode_setplane+0x1b0/0x1b0 [drm] + [] ? hrtimer_start_range_ns+0x1b7/0x3a0 + [] do_vfs_ioctl+0x92/0x570 + [] ? __sys_recvmsg+0x42/0x80 + [] SyS_ioctl+0x79/0x90 + [] entry_SYSCALL_64_fastpath+0x1a/0xa4 +RIP [] drm_dp_payload_send_msg+0x146/0x1f0 [drm_kms_helper] + +Which occurs because of the hotplug event shown in the log, which ends +up causing DRM's dp helpers to drop the port we're updating the payload +on and panic. + +Signed-off-by: Lyude +Reviewed-by: David Airlie +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_dp_mst_topology.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -1665,13 +1665,19 @@ static int drm_dp_payload_send_msg(struc + struct drm_dp_mst_branch *mstb; + int len, ret, port_num; + ++ port = drm_dp_get_validated_port_ref(mgr, port); ++ if (!port) ++ return -EINVAL; ++ + port_num = port->port_num; + mstb = drm_dp_get_validated_mstb_ref(mgr, port->parent); + if (!mstb) { + mstb = drm_dp_get_last_connected_port_and_mstb(mgr, port->parent, &port_num); + +- if (!mstb) ++ if (!mstb) { ++ drm_dp_put_port(port); + return -EINVAL; ++ } + } + + txmsg = kzalloc(sizeof(*txmsg), GFP_KERNEL); +@@ -1697,6 +1703,7 @@ static int drm_dp_payload_send_msg(struc + kfree(txmsg); + fail_put: + drm_dp_put_mst_branch_device(mstb); ++ drm_dp_put_port(port); + return ret; + } + diff --git a/queue-4.4/drm-i915-cleanup-phys-status-page-too.patch b/queue-4.4/drm-i915-cleanup-phys-status-page-too.patch new file mode 100644 index 00000000000..5fc1c13e8fc --- /dev/null +++ b/queue-4.4/drm-i915-cleanup-phys-status-page-too.patch @@ -0,0 +1,125 @@ +From 7d3fdfff23852fe458a0d0979a3555fe60f1e563 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Mon, 11 Jan 2016 20:48:32 +0200 +Subject: drm/i915: Cleanup phys status page too +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit 7d3fdfff23852fe458a0d0979a3555fe60f1e563 upstream. + +Restore the lost phys status page cleanup. + +Fixes the following splat with DMA_API_DEBUG=y: + +WARNING: CPU: 0 PID: 21615 at ../lib/dma-debug.c:974 dma_debug_device_change+0x190/0x1f0() +pci 0000:00:02.0: DMA-API: device driver has pending DMA allocations while released from device [count=1] + One of leaked entries details: [device address=0x0000000023163000] [size=4096 bytes] [mapped with DMA_BIDIRECTIONAL] [mapped as coherent] +Modules linked in: i915(-) i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm sha256_generic hmac drbg ctr ccm sch_fq_codel binfmt_misc joydev mousedev arc4 ath5k iTCO_wdt mac80211 smsc_ircc2 ath snd_intel8x0m snd_intel8x0 snd_ac97_codec ac97_bus psmouse snd_pcm input_leds i2c_i801 pcspkr snd_timer cfg80211 snd soundcore i2c_core ehci_pci firewire_ohci ehci_hcd firewire_core lpc_ich 8139too rfkill crc_itu_t mfd_core mii usbcore rng_core intel_agp intel_gtt usb_common agpgart irda crc_ccitt fujitsu_laptop led_class parport_pc video parport evdev backlight +CPU: 0 PID: 21615 Comm: rmmod Tainted: G U 4.4.0-rc4-mgm-ovl+ #4 +Hardware name: FUJITSU SIEMENS LIFEBOOK S6120/FJNB16C, BIOS Version 1.26 05/10/2004 + e31a3de0 e31a3de0 e31a3d9c c128d4bd e31a3dd0 c1045a0c c15e00c4 e31a3dfc + 0000546f c15dfad2 000003ce c12b3740 000003ce c12b3740 00000000 00000001 + f61fb8a0 e31a3de8 c1045a83 00000009 e31a3de0 c15e00c4 e31a3dfc e31a3e4c +Call Trace: + [] dump_stack+0x16/0x19 + [] warn_slowpath_common+0x8c/0xd0 + [] ? dma_debug_device_change+0x190/0x1f0 + [] ? dma_debug_device_change+0x190/0x1f0 + [] warn_slowpath_fmt+0x33/0x40 + [] dma_debug_device_change+0x190/0x1f0 + [] notifier_call_chain+0x59/0x70 + [] __blocking_notifier_call_chain+0x3f/0x80 + [] blocking_notifier_call_chain+0x1f/0x30 + [] __device_release_driver+0xc3/0xf0 + [] driver_detach+0x97/0xa0 + [] bus_remove_driver+0x40/0x90 + [] driver_unregister+0x28/0x60 + [] ? trace_hardirqs_on_caller+0x12c/0x1d0 + [] pci_unregister_driver+0x18/0x80 + [] drm_pci_exit+0x87/0xb0 [drm] + [] i915_exit+0x1b/0x1ee [i915] + [] SyS_delete_module+0x14c/0x210 + [] ? trace_hardirqs_on_caller+0x12c/0x1d0 + [] ? ____fput+0xd/0x10 + [] do_fast_syscall_32+0xa4/0x450 + [] sysenter_past_esp+0x3b/0x5d +---[ end trace c2ecbc77760f10a0 ]--- +Mapped at: + [] debug_dma_alloc_coherent+0x33/0x90 + [] drm_pci_alloc+0x18c/0x1e0 [drm] + [] intel_init_ring_buffer+0x2af/0x490 [i915] + [] intel_init_render_ring_buffer+0x130/0x750 [i915] + [] i915_gem_init_rings+0x1e/0x110 [i915] + +v2: s/BUG_ON/WARN_ON/ since dim doens't like the former anymore + +Cc: Chris Wilson +Fixes: 5c6c600 ("drm/i915: Remove DRI1 ring accessors and API") +Signed-off-by: Ville Syrjälä +Reviewed-by: Chris Wilson (v1) +Link: http://patchwork.freedesktop.org/patch/msgid/1452538112-5331-1-git-send-email-ville.syrjala@linux.intel.com +Reviewed-by: Daniel Vetter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_ringbuffer.c | 24 ++++++++++++++++++++---- + 1 file changed, 20 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_ringbuffer.c ++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c +@@ -1922,6 +1922,17 @@ i915_dispatch_execbuffer(struct drm_i915 + return 0; + } + ++static void cleanup_phys_status_page(struct intel_engine_cs *ring) ++{ ++ struct drm_i915_private *dev_priv = to_i915(ring->dev); ++ ++ if (!dev_priv->status_page_dmah) ++ return; ++ ++ drm_pci_free(ring->dev, dev_priv->status_page_dmah); ++ ring->status_page.page_addr = NULL; ++} ++ + static void cleanup_status_page(struct intel_engine_cs *ring) + { + struct drm_i915_gem_object *obj; +@@ -1938,9 +1949,9 @@ static void cleanup_status_page(struct i + + static int init_status_page(struct intel_engine_cs *ring) + { +- struct drm_i915_gem_object *obj; ++ struct drm_i915_gem_object *obj = ring->status_page.obj; + +- if ((obj = ring->status_page.obj) == NULL) { ++ if (obj == NULL) { + unsigned flags; + int ret; + +@@ -2134,7 +2145,7 @@ static int intel_init_ring_buffer(struct + if (ret) + goto error; + } else { +- BUG_ON(ring->id != RCS); ++ WARN_ON(ring->id != RCS); + ret = init_phys_status_page(ring); + if (ret) + goto error; +@@ -2179,7 +2190,12 @@ void intel_cleanup_ring_buffer(struct in + if (ring->cleanup) + ring->cleanup(ring); + +- cleanup_status_page(ring); ++ if (I915_NEED_GFX_HWS(ring->dev)) { ++ cleanup_status_page(ring); ++ } else { ++ WARN_ON(ring->id != RCS); ++ cleanup_phys_status_page(ring); ++ } + + i915_cmd_parser_fini_ring(ring); + i915_gem_batch_pool_fini(&ring->batch_pool); diff --git a/queue-4.4/drm-i915-fixup-the-free-space-logic-in-ring_prepare.patch b/queue-4.4/drm-i915-fixup-the-free-space-logic-in-ring_prepare.patch new file mode 100644 index 00000000000..f7d457d45ce --- /dev/null +++ b/queue-4.4/drm-i915-fixup-the-free-space-logic-in-ring_prepare.patch @@ -0,0 +1,70 @@ +From d43f3ebf12f59c57782ec652da65ef61c2662b40 Mon Sep 17 00:00:00 2001 +From: Akash Goel +Date: Fri, 11 Mar 2016 14:56:42 +0530 +Subject: drm/i915: Fixup the free space logic in ring_prepare + +From: Akash Goel + +commit d43f3ebf12f59c57782ec652da65ef61c2662b40 upstream. + +Currently for the case where there is enough space at the end of Ring +buffer for accommodating only the base request, the wrapround is done +immediately and as a result the base request gets added at the start +of Ring buffer. But there may not be enough free space at the beginning +to accommodate the base request, as before the wraparound, the wait was +effectively done for the reserved_size free space from the start of +Ring buffer. In such a case there is a potential of Ring buffer overflow, +the instructions at the head of Ring (ACTHD) can get overwritten. + +Since the base request can fit in the remaining space, there is no need +to wraparound immediately. The wraparound will anyway happen later when +the reserved part starts getting used. + +Cc: Chris Wilson +Signed-off-by: Akash Goel +Signed-off-by: Chris Wilson +Link: http://patchwork.freedesktop.org/patch/msgid/1457688402-10411-1-git-send-email-akash.goel@intel.com +Reviewed-by: Chris Wilson +(cherry picked from commit 782f6bc0aba037436d6a04d19b23f8b61020a576) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_lrc.c | 6 +++--- + drivers/gpu/drm/i915/intel_ringbuffer.c | 6 +++--- + 2 files changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_lrc.c ++++ b/drivers/gpu/drm/i915/intel_lrc.c +@@ -776,11 +776,11 @@ static int logical_ring_prepare(struct d + if (unlikely(total_bytes > remain_usable)) { + /* + * The base request will fit but the reserved space +- * falls off the end. So only need to to wait for the +- * reserved size after flushing out the remainder. ++ * falls off the end. So don't need an immediate wrap ++ * and only need to effectively wait for the reserved ++ * size space from the start of ringbuffer. + */ + wait_bytes = remain_actual + ringbuf->reserved_size; +- need_wrap = true; + } else if (total_bytes > ringbuf->space) { + /* No wrapping required, just waiting. */ + wait_bytes = total_bytes; +--- a/drivers/gpu/drm/i915/intel_ringbuffer.c ++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c +@@ -2357,11 +2357,11 @@ static int __intel_ring_prepare(struct i + if (unlikely(total_bytes > remain_usable)) { + /* + * The base request will fit but the reserved space +- * falls off the end. So only need to to wait for the +- * reserved size after flushing out the remainder. ++ * falls off the end. So don't need an immediate wrap ++ * and only need to effectively wait for the reserved ++ * size space from the start of ringbuffer. + */ + wait_bytes = remain_actual + ringbuf->reserved_size; +- need_wrap = true; + } else if (total_bytes > ringbuf->space) { + /* No wrapping required, just waiting. */ + wait_bytes = total_bytes; diff --git a/queue-4.4/drm-i915-skl_update_scaler-wants-a-rotation-bitmask-instead-of-bit-number.patch b/queue-4.4/drm-i915-skl_update_scaler-wants-a-rotation-bitmask-instead-of-bit-number.patch new file mode 100644 index 00000000000..2642e9f7830 --- /dev/null +++ b/queue-4.4/drm-i915-skl_update_scaler-wants-a-rotation-bitmask-instead-of-bit-number.patch @@ -0,0 +1,41 @@ +From fa5a7970d372c9c9beb3a0ce79ee1d0c23387d0a Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Thu, 15 Oct 2015 17:01:58 +0300 +Subject: drm/i915: skl_update_scaler() wants a rotation bitmask instead of bit number +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit fa5a7970d372c9c9beb3a0ce79ee1d0c23387d0a upstream. + +Pass BIT(DRM_ROTATE_0) instead of DRM_ROTATE_0 to skl_update_scaler(). +The former is a mask, the latter just the bit number. + +Fortunately the only thing skl_update_scaler() does with the rotation +is check if it's 90/270 degrees or not, and so in this case it would +still do the right thing. + +Cc: Chandra Konduru +Signed-off-by: Ville Syrjälä +Link: http://patchwork.freedesktop.org/patch/msgid/1444917718-28495-1-git-send-email-ville.syrjala@linux.intel.com +Fixes: 6156a45602f9 ("drm/i915: skylake primary plane scaling using shared scalers") +Reviewed-by: Matt Roper +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_display.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -4447,7 +4447,7 @@ int skl_update_scaler_crtc(struct intel_ + intel_crtc->base.base.id, intel_crtc->pipe, SKL_CRTC_INDEX); + + return skl_update_scaler(state, !state->base.active, SKL_CRTC_INDEX, +- &state->scaler_state.scaler_id, DRM_ROTATE_0, ++ &state->scaler_state.scaler_id, BIT(DRM_ROTATE_0), + state->pipe_src_w, state->pipe_src_h, + adjusted_mode->crtc_hdisplay, adjusted_mode->crtc_vdisplay); + } diff --git a/queue-4.4/drm-i915-use-fw_domains_put_with_fifo-on-hsw.patch b/queue-4.4/drm-i915-use-fw_domains_put_with_fifo-on-hsw.patch new file mode 100644 index 00000000000..a59d803234c --- /dev/null +++ b/queue-4.4/drm-i915-use-fw_domains_put_with_fifo-on-hsw.patch @@ -0,0 +1,43 @@ +From 31318a922395ec9e78d6e2ddf70779355afc7594 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Thu, 14 Apr 2016 14:39:02 +0300 +Subject: drm/i915: Use fw_domains_put_with_fifo() on HSW +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit 31318a922395ec9e78d6e2ddf70779355afc7594 upstream. + +HSW still has the wake FIFO, so let's check it. + +Cc: Mika Kuoppala +Cc: Deepak S +Fixes: 05a2fb157e44 ("drm/i915: Consolidate forcewake code") +Signed-off-by: Ville Syrjälä +Link: http://patchwork.freedesktop.org/patch/msgid/1460633942-24013-1-git-send-email-ville.syrjala@linux.intel.com +Reviewed-by: Mika Kuoppala +(cherry picked from commit 3d7d0c85e41afb5a05e98b3a8a72c38357f02594) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_uncore.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/intel_uncore.c ++++ b/drivers/gpu/drm/i915/intel_uncore.c +@@ -1132,7 +1132,11 @@ static void intel_uncore_fw_domains_init + } else if (IS_HASWELL(dev) || IS_BROADWELL(dev)) { + dev_priv->uncore.funcs.force_wake_get = + fw_domains_get_with_thread_status; +- dev_priv->uncore.funcs.force_wake_put = fw_domains_put; ++ if (IS_HASWELL(dev)) ++ dev_priv->uncore.funcs.force_wake_put = ++ fw_domains_put_with_fifo; ++ else ++ dev_priv->uncore.funcs.force_wake_put = fw_domains_put; + fw_domain_init(dev_priv, FW_DOMAIN_ID_RENDER, + FORCEWAKE_MT, FORCEWAKE_ACK_HSW); + } else if (IS_IVYBRIDGE(dev)) { diff --git a/queue-4.4/drm-loongson-3-doesn-t-fully-support-wc-memory.patch b/queue-4.4/drm-loongson-3-doesn-t-fully-support-wc-memory.patch new file mode 100644 index 00000000000..a5f77c459d1 --- /dev/null +++ b/queue-4.4/drm-loongson-3-doesn-t-fully-support-wc-memory.patch @@ -0,0 +1,29 @@ +From 221004c66a58949a0f25c937a6789c0839feb530 Mon Sep 17 00:00:00 2001 +From: Huacai Chen +Date: Tue, 19 Apr 2016 19:19:11 +0800 +Subject: drm: Loongson-3 doesn't fully support wc memory + +From: Huacai Chen + +commit 221004c66a58949a0f25c937a6789c0839feb530 upstream. + +Signed-off-by: Huacai Chen +Reviewed-by: Alex Deucher +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + include/drm/drm_cache.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/include/drm/drm_cache.h ++++ b/include/drm/drm_cache.h +@@ -39,6 +39,8 @@ static inline bool drm_arch_can_wc_memor + { + #if defined(CONFIG_PPC) && !defined(CONFIG_NOT_COHERENT_CACHE) + return false; ++#elif defined(CONFIG_MIPS) && defined(CONFIG_CPU_LOONGSON3) ++ return false; + #else + return true; + #endif diff --git a/queue-4.4/drm-nouveau-gr-gf100-select-a-stream-master-to-fixup-tfb-offset-queries.patch b/queue-4.4/drm-nouveau-gr-gf100-select-a-stream-master-to-fixup-tfb-offset-queries.patch new file mode 100644 index 00000000000..a03f114be76 --- /dev/null +++ b/queue-4.4/drm-nouveau-gr-gf100-select-a-stream-master-to-fixup-tfb-offset-queries.patch @@ -0,0 +1,27 @@ +From 28dca90533750c7e31e8641c3df426bad9c12941 Mon Sep 17 00:00:00 2001 +From: Ben Skeggs +Date: Fri, 22 Apr 2016 10:05:21 +1000 +Subject: drm/nouveau/gr/gf100: select a stream master to fixup tfb offset queries + +From: Ben Skeggs + +commit 28dca90533750c7e31e8641c3df426bad9c12941 upstream. + +Signed-off-by: Ben Skeggs +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c +@@ -1717,6 +1717,8 @@ gf100_gr_init(struct gf100_gr *gr) + + gf100_gr_mmio(gr, gr->func->mmio); + ++ nvkm_mask(device, TPC_UNIT(0, 0, 0x05c), 0x00000001, 0x00000001); ++ + memcpy(tpcnr, gr->tpc_nr, sizeof(gr->tpc_nr)); + for (i = 0, gpc = -1; i < gr->tpc_total; i++) { + do { diff --git a/queue-4.4/drm-radeon-add-a-quirk-for-a-xfx-r9-270x.patch b/queue-4.4/drm-radeon-add-a-quirk-for-a-xfx-r9-270x.patch new file mode 100644 index 00000000000..f36390d6916 --- /dev/null +++ b/queue-4.4/drm-radeon-add-a-quirk-for-a-xfx-r9-270x.patch @@ -0,0 +1,29 @@ +From bcb31eba4a4ea356fd61cbd5dec5511c3883f57e Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Thu, 14 Apr 2016 14:15:16 -0400 +Subject: drm/radeon: add a quirk for a XFX R9 270X + +From: Alex Deucher + +commit bcb31eba4a4ea356fd61cbd5dec5511c3883f57e upstream. + +bug: +https://bugs.freedesktop.org/show_bug.cgi?id=76490 + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/si_dpm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/radeon/si_dpm.c ++++ b/drivers/gpu/drm/radeon/si_dpm.c +@@ -2931,6 +2931,7 @@ static struct si_dpm_quirk si_dpm_quirk_ + { PCI_VENDOR_ID_ATI, 0x6811, 0x1462, 0x2015, 0, 120000 }, + { PCI_VENDOR_ID_ATI, 0x6811, 0x1043, 0x2015, 0, 120000 }, + { PCI_VENDOR_ID_ATI, 0x6811, 0x148c, 0x2015, 0, 120000 }, ++ { PCI_VENDOR_ID_ATI, 0x6810, 0x1682, 0x9275, 0, 120000 }, + { 0, 0, 0, 0 }, + }; + diff --git a/queue-4.4/drm-radeon-fix-initial-connector-audio-value.patch b/queue-4.4/drm-radeon-fix-initial-connector-audio-value.patch new file mode 100644 index 00000000000..1e80a9941f7 --- /dev/null +++ b/queue-4.4/drm-radeon-fix-initial-connector-audio-value.patch @@ -0,0 +1,60 @@ +From 7403c515c49c033fec33df0814fffdc977e6acdc Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 13 Apr 2016 12:08:27 -0400 +Subject: drm/radeon: fix initial connector audio value + +From: Alex Deucher + +commit 7403c515c49c033fec33df0814fffdc977e6acdc upstream. + +This got lost somewhere along the way. This fixes +audio not working until set_property was called. + +Noticed-by: Hyungwon Hwang +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_connectors.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/radeon_connectors.c ++++ b/drivers/gpu/drm/radeon/radeon_connectors.c +@@ -1996,10 +1996,12 @@ radeon_add_atom_connector(struct drm_dev + rdev->mode_info.dither_property, + RADEON_FMT_DITHER_DISABLE); + +- if (radeon_audio != 0) ++ if (radeon_audio != 0) { + drm_object_attach_property(&radeon_connector->base.base, + rdev->mode_info.audio_property, + RADEON_AUDIO_AUTO); ++ radeon_connector->audio = RADEON_AUDIO_AUTO; ++ } + if (ASIC_IS_DCE5(rdev)) + drm_object_attach_property(&radeon_connector->base.base, + rdev->mode_info.output_csc_property, +@@ -2124,6 +2126,7 @@ radeon_add_atom_connector(struct drm_dev + drm_object_attach_property(&radeon_connector->base.base, + rdev->mode_info.audio_property, + RADEON_AUDIO_AUTO); ++ radeon_connector->audio = RADEON_AUDIO_AUTO; + } + if (connector_type == DRM_MODE_CONNECTOR_DVII) { + radeon_connector->dac_load_detect = true; +@@ -2179,6 +2182,7 @@ radeon_add_atom_connector(struct drm_dev + drm_object_attach_property(&radeon_connector->base.base, + rdev->mode_info.audio_property, + RADEON_AUDIO_AUTO); ++ radeon_connector->audio = RADEON_AUDIO_AUTO; + } + if (ASIC_IS_DCE5(rdev)) + drm_object_attach_property(&radeon_connector->base.base, +@@ -2231,6 +2235,7 @@ radeon_add_atom_connector(struct drm_dev + drm_object_attach_property(&radeon_connector->base.base, + rdev->mode_info.audio_property, + RADEON_AUDIO_AUTO); ++ radeon_connector->audio = RADEON_AUDIO_AUTO; + } + if (ASIC_IS_DCE5(rdev)) + drm_object_attach_property(&radeon_connector->base.base, diff --git a/queue-4.4/drm-radeon-fix-vertical-bars-appear-on-monitor-v2.patch b/queue-4.4/drm-radeon-fix-vertical-bars-appear-on-monitor-v2.patch new file mode 100644 index 00000000000..dd89244ade8 --- /dev/null +++ b/queue-4.4/drm-radeon-fix-vertical-bars-appear-on-monitor-v2.patch @@ -0,0 +1,262 @@ +From 5d5b7803c49bbb01bdf4c6e95e8314d0515b9484 Mon Sep 17 00:00:00 2001 +From: Vitaly Prosyak +Date: Thu, 14 Apr 2016 13:34:03 -0400 +Subject: drm/radeon: fix vertical bars appear on monitor (v2) + +From: Vitaly Prosyak + +commit 5d5b7803c49bbb01bdf4c6e95e8314d0515b9484 upstream. + +When crtc/timing is disabled on boot the dig block +should be stopped in order ignore timing from crtc, +reset the steering fifo otherwise we get display +corruption or hung in dp sst mode. + +v2: agd: fix coding style + +Signed-off-by: Vitaly Prosyak +Signed-off-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/evergreen.c | 154 ++++++++++++++++++++++++++++++++- + drivers/gpu/drm/radeon/evergreen_reg.h | 46 +++++++++ + 2 files changed, 199 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/evergreen.c ++++ b/drivers/gpu/drm/radeon/evergreen.c +@@ -2608,10 +2608,152 @@ static void evergreen_agp_enable(struct + WREG32(VM_CONTEXT1_CNTL, 0); + } + ++static const unsigned ni_dig_offsets[] = ++{ ++ NI_DIG0_REGISTER_OFFSET, ++ NI_DIG1_REGISTER_OFFSET, ++ NI_DIG2_REGISTER_OFFSET, ++ NI_DIG3_REGISTER_OFFSET, ++ NI_DIG4_REGISTER_OFFSET, ++ NI_DIG5_REGISTER_OFFSET ++}; ++ ++static const unsigned ni_tx_offsets[] = ++{ ++ NI_DCIO_UNIPHY0_UNIPHY_TX_CONTROL1, ++ NI_DCIO_UNIPHY1_UNIPHY_TX_CONTROL1, ++ NI_DCIO_UNIPHY2_UNIPHY_TX_CONTROL1, ++ NI_DCIO_UNIPHY3_UNIPHY_TX_CONTROL1, ++ NI_DCIO_UNIPHY4_UNIPHY_TX_CONTROL1, ++ NI_DCIO_UNIPHY5_UNIPHY_TX_CONTROL1 ++}; ++ ++static const unsigned evergreen_dp_offsets[] = ++{ ++ EVERGREEN_DP0_REGISTER_OFFSET, ++ EVERGREEN_DP1_REGISTER_OFFSET, ++ EVERGREEN_DP2_REGISTER_OFFSET, ++ EVERGREEN_DP3_REGISTER_OFFSET, ++ EVERGREEN_DP4_REGISTER_OFFSET, ++ EVERGREEN_DP5_REGISTER_OFFSET ++}; ++ ++ ++/* ++ * Assumption is that EVERGREEN_CRTC_MASTER_EN enable for requested crtc ++ * We go from crtc to connector and it is not relible since it ++ * should be an opposite direction .If crtc is enable then ++ * find the dig_fe which selects this crtc and insure that it enable. ++ * if such dig_fe is found then find dig_be which selects found dig_be and ++ * insure that it enable and in DP_SST mode. ++ * if UNIPHY_PLL_CONTROL1.enable then we should disconnect timing ++ * from dp symbols clocks . ++ */ ++static bool evergreen_is_dp_sst_stream_enabled(struct radeon_device *rdev, ++ unsigned crtc_id, unsigned *ret_dig_fe) ++{ ++ unsigned i; ++ unsigned dig_fe; ++ unsigned dig_be; ++ unsigned dig_en_be; ++ unsigned uniphy_pll; ++ unsigned digs_fe_selected; ++ unsigned dig_be_mode; ++ unsigned dig_fe_mask; ++ bool is_enabled = false; ++ bool found_crtc = false; ++ ++ /* loop through all running dig_fe to find selected crtc */ ++ for (i = 0; i < ARRAY_SIZE(ni_dig_offsets); i++) { ++ dig_fe = RREG32(NI_DIG_FE_CNTL + ni_dig_offsets[i]); ++ if (dig_fe & NI_DIG_FE_CNTL_SYMCLK_FE_ON && ++ crtc_id == NI_DIG_FE_CNTL_SOURCE_SELECT(dig_fe)) { ++ /* found running pipe */ ++ found_crtc = true; ++ dig_fe_mask = 1 << i; ++ dig_fe = i; ++ break; ++ } ++ } ++ ++ if (found_crtc) { ++ /* loop through all running dig_be to find selected dig_fe */ ++ for (i = 0; i < ARRAY_SIZE(ni_dig_offsets); i++) { ++ dig_be = RREG32(NI_DIG_BE_CNTL + ni_dig_offsets[i]); ++ /* if dig_fe_selected by dig_be? */ ++ digs_fe_selected = NI_DIG_BE_CNTL_FE_SOURCE_SELECT(dig_be); ++ dig_be_mode = NI_DIG_FE_CNTL_MODE(dig_be); ++ if (dig_fe_mask & digs_fe_selected && ++ /* if dig_be in sst mode? */ ++ dig_be_mode == NI_DIG_BE_DPSST) { ++ dig_en_be = RREG32(NI_DIG_BE_EN_CNTL + ++ ni_dig_offsets[i]); ++ uniphy_pll = RREG32(NI_DCIO_UNIPHY0_PLL_CONTROL1 + ++ ni_tx_offsets[i]); ++ /* dig_be enable and tx is running */ ++ if (dig_en_be & NI_DIG_BE_EN_CNTL_ENABLE && ++ dig_en_be & NI_DIG_BE_EN_CNTL_SYMBCLK_ON && ++ uniphy_pll & NI_DCIO_UNIPHY0_PLL_CONTROL1_ENABLE) { ++ is_enabled = true; ++ *ret_dig_fe = dig_fe; ++ break; ++ } ++ } ++ } ++ } ++ ++ return is_enabled; ++} ++ ++/* ++ * Blank dig when in dp sst mode ++ * Dig ignores crtc timing ++ */ ++static void evergreen_blank_dp_output(struct radeon_device *rdev, ++ unsigned dig_fe) ++{ ++ unsigned stream_ctrl; ++ unsigned fifo_ctrl; ++ unsigned counter = 0; ++ ++ if (dig_fe >= ARRAY_SIZE(evergreen_dp_offsets)) { ++ DRM_ERROR("invalid dig_fe %d\n", dig_fe); ++ return; ++ } ++ ++ stream_ctrl = RREG32(EVERGREEN_DP_VID_STREAM_CNTL + ++ evergreen_dp_offsets[dig_fe]); ++ if (!(stream_ctrl & EVERGREEN_DP_VID_STREAM_CNTL_ENABLE)) { ++ DRM_ERROR("dig %d , should be enable\n", dig_fe); ++ return; ++ } ++ ++ stream_ctrl &=~EVERGREEN_DP_VID_STREAM_CNTL_ENABLE; ++ WREG32(EVERGREEN_DP_VID_STREAM_CNTL + ++ evergreen_dp_offsets[dig_fe], stream_ctrl); ++ ++ stream_ctrl = RREG32(EVERGREEN_DP_VID_STREAM_CNTL + ++ evergreen_dp_offsets[dig_fe]); ++ while (counter < 32 && stream_ctrl & EVERGREEN_DP_VID_STREAM_STATUS) { ++ msleep(1); ++ counter++; ++ stream_ctrl = RREG32(EVERGREEN_DP_VID_STREAM_CNTL + ++ evergreen_dp_offsets[dig_fe]); ++ } ++ if (counter >= 32 ) ++ DRM_ERROR("counter exceeds %d\n", counter); ++ ++ fifo_ctrl = RREG32(EVERGREEN_DP_STEER_FIFO + evergreen_dp_offsets[dig_fe]); ++ fifo_ctrl |= EVERGREEN_DP_STEER_FIFO_RESET; ++ WREG32(EVERGREEN_DP_STEER_FIFO + evergreen_dp_offsets[dig_fe], fifo_ctrl); ++ ++} ++ + void evergreen_mc_stop(struct radeon_device *rdev, struct evergreen_mc_save *save) + { + u32 crtc_enabled, tmp, frame_count, blackout; + int i, j; ++ unsigned dig_fe; + + if (!ASIC_IS_NODCE(rdev)) { + save->vga_render_control = RREG32(VGA_RENDER_CONTROL); +@@ -2651,7 +2793,17 @@ void evergreen_mc_stop(struct radeon_dev + break; + udelay(1); + } +- ++ /*we should disable dig if it drives dp sst*/ ++ /*but we are in radeon_device_init and the topology is unknown*/ ++ /*and it is available after radeon_modeset_init*/ ++ /*the following method radeon_atom_encoder_dpms_dig*/ ++ /*does the job if we initialize it properly*/ ++ /*for now we do it this manually*/ ++ /**/ ++ if (ASIC_IS_DCE5(rdev) && ++ evergreen_is_dp_sst_stream_enabled(rdev, i ,&dig_fe)) ++ evergreen_blank_dp_output(rdev, dig_fe); ++ /*we could remove 6 lines below*/ + /* XXX this is a hack to avoid strange behavior with EFI on certain systems */ + WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 1); + tmp = RREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[i]); +--- a/drivers/gpu/drm/radeon/evergreen_reg.h ++++ b/drivers/gpu/drm/radeon/evergreen_reg.h +@@ -250,8 +250,43 @@ + + /* HDMI blocks at 0x7030, 0x7c30, 0x10830, 0x11430, 0x12030, 0x12c30 */ + #define EVERGREEN_HDMI_BASE 0x7030 ++/*DIG block*/ ++#define NI_DIG0_REGISTER_OFFSET (0x7000 - 0x7000) ++#define NI_DIG1_REGISTER_OFFSET (0x7C00 - 0x7000) ++#define NI_DIG2_REGISTER_OFFSET (0x10800 - 0x7000) ++#define NI_DIG3_REGISTER_OFFSET (0x11400 - 0x7000) ++#define NI_DIG4_REGISTER_OFFSET (0x12000 - 0x7000) ++#define NI_DIG5_REGISTER_OFFSET (0x12C00 - 0x7000) ++ ++ ++#define NI_DIG_FE_CNTL 0x7000 ++# define NI_DIG_FE_CNTL_SOURCE_SELECT(x) ((x) & 0x3) ++# define NI_DIG_FE_CNTL_SYMCLK_FE_ON (1<<24) ++ ++ ++#define NI_DIG_BE_CNTL 0x7140 ++# define NI_DIG_BE_CNTL_FE_SOURCE_SELECT(x) (((x) >> 8 ) & 0x3F) ++# define NI_DIG_FE_CNTL_MODE(x) (((x) >> 16) & 0x7 ) ++ ++#define NI_DIG_BE_EN_CNTL 0x7144 ++# define NI_DIG_BE_EN_CNTL_ENABLE (1 << 0) ++# define NI_DIG_BE_EN_CNTL_SYMBCLK_ON (1 << 8) ++# define NI_DIG_BE_DPSST 0 + + /* Display Port block */ ++#define EVERGREEN_DP0_REGISTER_OFFSET (0x730C - 0x730C) ++#define EVERGREEN_DP1_REGISTER_OFFSET (0x7F0C - 0x730C) ++#define EVERGREEN_DP2_REGISTER_OFFSET (0x10B0C - 0x730C) ++#define EVERGREEN_DP3_REGISTER_OFFSET (0x1170C - 0x730C) ++#define EVERGREEN_DP4_REGISTER_OFFSET (0x1230C - 0x730C) ++#define EVERGREEN_DP5_REGISTER_OFFSET (0x12F0C - 0x730C) ++ ++ ++#define EVERGREEN_DP_VID_STREAM_CNTL 0x730C ++# define EVERGREEN_DP_VID_STREAM_CNTL_ENABLE (1 << 0) ++# define EVERGREEN_DP_VID_STREAM_STATUS (1 <<16) ++#define EVERGREEN_DP_STEER_FIFO 0x7310 ++# define EVERGREEN_DP_STEER_FIFO_RESET (1 << 0) + #define EVERGREEN_DP_SEC_CNTL 0x7280 + # define EVERGREEN_DP_SEC_STREAM_ENABLE (1 << 0) + # define EVERGREEN_DP_SEC_ASP_ENABLE (1 << 4) +@@ -266,4 +301,15 @@ + # define EVERGREEN_DP_SEC_N_BASE_MULTIPLE(x) (((x) & 0xf) << 24) + # define EVERGREEN_DP_SEC_SS_EN (1 << 28) + ++/*DCIO_UNIPHY block*/ ++#define NI_DCIO_UNIPHY0_UNIPHY_TX_CONTROL1 (0x6600 -0x6600) ++#define NI_DCIO_UNIPHY1_UNIPHY_TX_CONTROL1 (0x6640 -0x6600) ++#define NI_DCIO_UNIPHY2_UNIPHY_TX_CONTROL1 (0x6680 - 0x6600) ++#define NI_DCIO_UNIPHY3_UNIPHY_TX_CONTROL1 (0x66C0 - 0x6600) ++#define NI_DCIO_UNIPHY4_UNIPHY_TX_CONTROL1 (0x6700 - 0x6600) ++#define NI_DCIO_UNIPHY5_UNIPHY_TX_CONTROL1 (0x6740 - 0x6600) ++ ++#define NI_DCIO_UNIPHY0_PLL_CONTROL1 0x6618 ++# define NI_DCIO_UNIPHY0_PLL_CONTROL1_ENABLE (1 << 0) ++ + #endif diff --git a/queue-4.4/drm-radeon-forbid-mapping-of-userptr-bo-through-radeon-device-file.patch b/queue-4.4/drm-radeon-forbid-mapping-of-userptr-bo-through-radeon-device-file.patch new file mode 100644 index 00000000000..a6c2350fa8e --- /dev/null +++ b/queue-4.4/drm-radeon-forbid-mapping-of-userptr-bo-through-radeon-device-file.patch @@ -0,0 +1,44 @@ +From b5dcec693f87cb8475f2291c0075b2422addd3d6 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Glisse?= +Date: Tue, 19 Apr 2016 09:07:50 -0400 +Subject: drm/radeon: forbid mapping of userptr bo through radeon device file +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jérôme Glisse + +commit b5dcec693f87cb8475f2291c0075b2422addd3d6 upstream. + +Allowing userptr bo which are basicly a list of page from some vma +(so either anonymous page or file backed page) would lead to serious +corruption of kernel structures and counters (because we overwrite +the page->mapping field when mapping buffer). + +This will already block if the buffer was populated before anyone does +try to mmap it because then TTM_PAGE_FLAG_SG would be set in in the +ttm_tt flags. But that flag is check before ttm_tt_populate in the ttm +vm fault handler. + +So to be safe just add a check to verify_access() callback. + +Reviewed-by: Christian König +Signed-off-by: Jérôme Glisse +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_ttm.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/radeon/radeon_ttm.c ++++ b/drivers/gpu/drm/radeon/radeon_ttm.c +@@ -235,6 +235,8 @@ static int radeon_verify_access(struct t + { + struct radeon_bo *rbo = container_of(bo, struct radeon_bo, tbo); + ++ if (radeon_ttm_tt_has_userptr(bo->ttm)) ++ return -EPERM; + return drm_vma_node_verify_access(&rbo->gem_base.vma_node, filp); + } + diff --git a/queue-4.4/edac-i7core-sb_edac-don-t-return-notify_bad-from-mce_decoder-callback.patch b/queue-4.4/edac-i7core-sb_edac-don-t-return-notify_bad-from-mce_decoder-callback.patch new file mode 100644 index 00000000000..a1cdd3cfc3e --- /dev/null +++ b/queue-4.4/edac-i7core-sb_edac-don-t-return-notify_bad-from-mce_decoder-callback.patch @@ -0,0 +1,51 @@ +From c4fc1956fa31003bfbe4f597e359d751568e2954 Mon Sep 17 00:00:00 2001 +From: Tony Luck +Date: Fri, 29 Apr 2016 15:42:25 +0200 +Subject: EDAC: i7core, sb_edac: Don't return NOTIFY_BAD from mce_decoder callback + +From: Tony Luck + +commit c4fc1956fa31003bfbe4f597e359d751568e2954 upstream. + +Both of these drivers can return NOTIFY_BAD, but this terminates +processing other callbacks that were registered later on the chain. +Since the driver did nothing to log the error it seems wrong to prevent +other interested parties from seeing it. E.g. neither of them had even +bothered to check the type of the error to see if it was a memory error +before the return NOTIFY_BAD. + +Signed-off-by: Tony Luck +Acked-by: Aristeu Rozanski +Acked-by: Mauro Carvalho Chehab +Cc: linux-edac +Link: http://lkml.kernel.org/r/72937355dd92318d2630979666063f8a2853495b.1461864507.git.tony.luck@intel.com +Signed-off-by: Borislav Petkov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/edac/i7core_edac.c | 2 +- + drivers/edac/sb_edac.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/edac/i7core_edac.c ++++ b/drivers/edac/i7core_edac.c +@@ -1866,7 +1866,7 @@ static int i7core_mce_check_error(struct + + i7_dev = get_i7core_dev(mce->socketid); + if (!i7_dev) +- return NOTIFY_BAD; ++ return NOTIFY_DONE; + + mci = i7_dev->mci; + pvt = mci->pvt_info; +--- a/drivers/edac/sb_edac.c ++++ b/drivers/edac/sb_edac.c +@@ -2254,7 +2254,7 @@ static int sbridge_mce_check_error(struc + + mci = get_mci_for_node_id(mce->socketid); + if (!mci) +- return NOTIFY_BAD; ++ return NOTIFY_DONE; + pvt = mci->pvt_info; + + /* diff --git a/queue-4.4/i2c-cpm-fix-build-break-due-to-incompatible-pointer-types.patch b/queue-4.4/i2c-cpm-fix-build-break-due-to-incompatible-pointer-types.patch new file mode 100644 index 00000000000..96d31ac2e80 --- /dev/null +++ b/queue-4.4/i2c-cpm-fix-build-break-due-to-incompatible-pointer-types.patch @@ -0,0 +1,40 @@ +From 609d5a1b2b35bb62b4b3750396e55453160c2a17 Mon Sep 17 00:00:00 2001 +From: Michael Ellerman +Date: Wed, 13 Apr 2016 13:59:14 +1000 +Subject: i2c: cpm: Fix build break due to incompatible pointer types + +From: Michael Ellerman + +commit 609d5a1b2b35bb62b4b3750396e55453160c2a17 upstream. + +Since commit ea8daa7b9784 ("kbuild: Add option to turn incompatible +pointer check into error"), assignments from an incompatible pointer +types have become a hard error, eg: + + drivers/i2c/busses/i2c-cpm.c:545:91: error: passing argument 3 of + 'dma_alloc_coherent' from incompatible pointer type + +Fix the build break by converting txdma & rxdma to dma_addr_t. + +Signed-off-by: Michael Ellerman +Signed-off-by: Wolfram Sang +Fixes: ea8daa7b9784 +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-cpm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/i2c/busses/i2c-cpm.c ++++ b/drivers/i2c/busses/i2c-cpm.c +@@ -116,8 +116,8 @@ struct cpm_i2c { + cbd_t __iomem *rbase; + u_char *txbuf[CPM_MAXBD]; + u_char *rxbuf[CPM_MAXBD]; +- u32 txdma[CPM_MAXBD]; +- u32 rxdma[CPM_MAXBD]; ++ dma_addr_t txdma[CPM_MAXBD]; ++ dma_addr_t rxdma[CPM_MAXBD]; + }; + + static irqreturn_t cpm_i2c_interrupt(int irq, void *dev_id) diff --git a/queue-4.4/i2c-exynos5-fix-possible-abba-deadlock-by-keeping-i2c-clock-prepared.patch b/queue-4.4/i2c-exynos5-fix-possible-abba-deadlock-by-keeping-i2c-clock-prepared.patch new file mode 100644 index 00000000000..21af28765d9 --- /dev/null +++ b/queue-4.4/i2c-exynos5-fix-possible-abba-deadlock-by-keeping-i2c-clock-prepared.patch @@ -0,0 +1,137 @@ +From 10ff4c5239a137abfc896ec73ef3d15a0f86a16a Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Sat, 16 Apr 2016 21:14:52 -0400 +Subject: i2c: exynos5: Fix possible ABBA deadlock by keeping I2C clock prepared + +From: Javier Martinez Canillas + +commit 10ff4c5239a137abfc896ec73ef3d15a0f86a16a upstream. + +The exynos5 I2C controller driver always prepares and enables a clock +before using it and then disables unprepares it when the clock is not +used anymore. + +But this can cause a possible ABBA deadlock in some scenarios since a +driver that uses regmap to access its I2C registers, will first grab +the regmap lock and then the I2C xfer function will grab the prepare +lock when preparing the I2C clock. But since the clock driver also +uses regmap for I2C accesses, preparing a clock will first grab the +prepare lock and then the regmap lock when using the regmap API. + +An example of this happens on the Exynos5422 Odroid XU4 board where a +s2mps11 PMIC is used and both the s2mps11 regulators and clk drivers +share the same I2C regmap. + +The possible deadlock is reported by the kernel lockdep: + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(sec_core:428:(regmap)->lock); + lock(prepare_lock); + lock(sec_core:428:(regmap)->lock); + lock(prepare_lock); + + *** DEADLOCK *** + +Fix it by leaving the code prepared on probe and use {en,dis}able in +the I2C transfer function. + +This patch is similar to commit 34e81ad5f0b6 ("i2c: s3c2410: fix ABBA +deadlock by keeping clock prepared") that fixes the same bug in other +driver for an I2C controller found in Samsung SoCs. + +Reported-by: Anand Moon +Signed-off-by: Javier Martinez Canillas +Reviewed-by: Anand Moon +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-exynos5.c | 24 +++++++++++++++++++----- + 1 file changed, 19 insertions(+), 5 deletions(-) + +--- a/drivers/i2c/busses/i2c-exynos5.c ++++ b/drivers/i2c/busses/i2c-exynos5.c +@@ -671,7 +671,9 @@ static int exynos5_i2c_xfer(struct i2c_a + return -EIO; + } + +- clk_prepare_enable(i2c->clk); ++ ret = clk_enable(i2c->clk); ++ if (ret) ++ return ret; + + for (i = 0; i < num; i++, msgs++) { + stop = (i == num - 1); +@@ -695,7 +697,7 @@ static int exynos5_i2c_xfer(struct i2c_a + } + + out: +- clk_disable_unprepare(i2c->clk); ++ clk_disable(i2c->clk); + return ret; + } + +@@ -747,7 +749,9 @@ static int exynos5_i2c_probe(struct plat + return -ENOENT; + } + +- clk_prepare_enable(i2c->clk); ++ ret = clk_prepare_enable(i2c->clk); ++ if (ret) ++ return ret; + + mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); + i2c->regs = devm_ioremap_resource(&pdev->dev, mem); +@@ -799,6 +803,10 @@ static int exynos5_i2c_probe(struct plat + + platform_set_drvdata(pdev, i2c); + ++ clk_disable(i2c->clk); ++ ++ return 0; ++ + err_clk: + clk_disable_unprepare(i2c->clk); + return ret; +@@ -810,6 +818,8 @@ static int exynos5_i2c_remove(struct pla + + i2c_del_adapter(&i2c->adap); + ++ clk_unprepare(i2c->clk); ++ + return 0; + } + +@@ -821,6 +831,8 @@ static int exynos5_i2c_suspend_noirq(str + + i2c->suspended = 1; + ++ clk_unprepare(i2c->clk); ++ + return 0; + } + +@@ -830,7 +842,9 @@ static int exynos5_i2c_resume_noirq(stru + struct exynos5_i2c *i2c = platform_get_drvdata(pdev); + int ret = 0; + +- clk_prepare_enable(i2c->clk); ++ ret = clk_prepare_enable(i2c->clk); ++ if (ret) ++ return ret; + + ret = exynos5_hsi2c_clock_setup(i2c); + if (ret) { +@@ -839,7 +853,7 @@ static int exynos5_i2c_resume_noirq(stru + } + + exynos5_i2c_init(i2c); +- clk_disable_unprepare(i2c->clk); ++ clk_disable(i2c->clk); + i2c->suspended = 0; + + return 0; diff --git a/queue-4.4/perf-intel-pt-fix-segfault-tracing-transactions.patch b/queue-4.4/perf-intel-pt-fix-segfault-tracing-transactions.patch new file mode 100644 index 00000000000..c18a3556d5a --- /dev/null +++ b/queue-4.4/perf-intel-pt-fix-segfault-tracing-transactions.patch @@ -0,0 +1,66 @@ +From 1342e0b7a6c1a060c593037fbac9f4b717f1cb3b Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Mon, 18 Apr 2016 13:57:48 +0300 +Subject: perf intel-pt: Fix segfault tracing transactions + +From: Adrian Hunter + +commit 1342e0b7a6c1a060c593037fbac9f4b717f1cb3b upstream. + +Tracing a workload that uses transactions gave a seg fault as follows: + + perf record -e intel_pt// workload + perf report + Program received signal SIGSEGV, Segmentation fault. + 0x000000000054b58c in intel_pt_reset_last_branch_rb (ptq=0x1a36110) + at util/intel-pt.c:929 + 929 ptq->last_branch_rb->nr = 0; + (gdb) p ptq->last_branch_rb + $1 = (struct branch_stack *) 0x0 + (gdb) up + 1148 intel_pt_reset_last_branch_rb(ptq); + (gdb) l + 1143 if (ret) + 1144 pr_err("Intel Processor Trace: failed to deliver transaction event + 1145 ret); + 1146 + 1147 if (pt->synth_opts.callchain) + 1148 intel_pt_reset_last_branch_rb(ptq); + 1149 + 1150 return ret; + 1151 } + 1152 + (gdb) p pt->synth_opts.callchain + $2 = true + (gdb) + (gdb) bt + #0 0x000000000054b58c in intel_pt_reset_last_branch_rb (ptq=0x1a36110) + #1 0x000000000054c1e0 in intel_pt_synth_transaction_sample (ptq=0x1a36110) + #2 0x000000000054c5b2 in intel_pt_sample (ptq=0x1a36110) + +Caused by checking the 'callchain' flag when it should have been the +'last_branch' flag. Fix that. + +Reported-by: Andi Kleen +Signed-off-by: Adrian Hunter +Cc: Jiri Olsa +Fixes: f14445ee72c5 ("perf intel-pt: Support generating branch stack") +Link: http://lkml.kernel.org/r/1460977068-11566-1-git-send-email-adrian.hunter@intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman + +--- + tools/perf/util/intel-pt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/perf/util/intel-pt.c ++++ b/tools/perf/util/intel-pt.c +@@ -1127,7 +1127,7 @@ static int intel_pt_synth_transaction_sa + pr_err("Intel Processor Trace: failed to deliver transaction event, error %d\n", + ret); + +- if (pt->synth_opts.callchain) ++ if (pt->synth_opts.last_branch) + intel_pt_reset_last_branch_rb(ptq); + + return ret; diff --git a/queue-4.4/pwm-brcmstb-fix-check-of-devm_ioremap_resource-return-code.patch b/queue-4.4/pwm-brcmstb-fix-check-of-devm_ioremap_resource-return-code.patch new file mode 100644 index 00000000000..5f3539023e1 --- /dev/null +++ b/queue-4.4/pwm-brcmstb-fix-check-of-devm_ioremap_resource-return-code.patch @@ -0,0 +1,38 @@ +From c5857e3f94ab2719dfac649a146cb5dd6f21fcf3 Mon Sep 17 00:00:00 2001 +From: Vladimir Zapolskiy +Date: Sun, 6 Mar 2016 03:21:46 +0200 +Subject: pwm: brcmstb: Fix check of devm_ioremap_resource() return code + +From: Vladimir Zapolskiy + +commit c5857e3f94ab2719dfac649a146cb5dd6f21fcf3 upstream. + +The change fixes potential oops while accessing iomem on invalid address +if devm_ioremap_resource() fails due to some reason. + +The devm_ioremap_resource() function returns ERR_PTR() and never returns +NULL, which makes useless a following check for NULL. + +Signed-off-by: Vladimir Zapolskiy +Fixes: 3a9f5957020f ("pwm: Add Broadcom BCM7038 PWM controller support") +Acked-by: Florian Fainelli +Signed-off-by: Thierry Reding +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pwm/pwm-brcmstb.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/pwm/pwm-brcmstb.c ++++ b/drivers/pwm/pwm-brcmstb.c +@@ -274,8 +274,8 @@ static int brcmstb_pwm_probe(struct plat + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + p->base = devm_ioremap_resource(&pdev->dev, res); +- if (!p->base) { +- ret = -ENOMEM; ++ if (IS_ERR(p->base)) { ++ ret = PTR_ERR(p->base); + goto out_clk; + } + diff --git a/queue-4.4/series b/queue-4.4/series index 9e224c3c36f..70d8f9b365f 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -67,3 +67,23 @@ drm-amdgpu-use-defines-for-crtcs-and-amft-blocks.patch drm-amdgpu-bump-the-afmt-limit-for-cz-st-polaris.patch amdgpu-uvd-add-uvd-fw-version-for-amdgpu.patch drm-amdgpu-fix-regression-on-cik-v2.patch +drm-radeon-add-a-quirk-for-a-xfx-r9-270x.patch +drm-radeon-fix-initial-connector-audio-value.patch +drm-radeon-forbid-mapping-of-userptr-bo-through-radeon-device-file.patch +drm-radeon-fix-vertical-bars-appear-on-monitor-v2.patch +drm-loongson-3-doesn-t-fully-support-wc-memory.patch +drm-nouveau-gr-gf100-select-a-stream-master-to-fixup-tfb-offset-queries.patch +drm-dp-mst-validate-port-in-drm_dp_payload_send_msg.patch +drm-dp-mst-restore-primary-hub-guid-on-resume.patch +drm-dp-mst-get-validated-port-ref-in-drm_dp_update_payload_part1.patch +pwm-brcmstb-fix-check-of-devm_ioremap_resource-return-code.patch +drm-i915-cleanup-phys-status-page-too.patch +drm-i915-skl_update_scaler-wants-a-rotation-bitmask-instead-of-bit-number.patch +drm-amdkfd-uninitialized-variable-in-dbgdev_wave_control_set_registers.patch +drm-i915-fixup-the-free-space-logic-in-ring_prepare.patch +drm-i915-use-fw_domains_put_with_fifo-on-hsw.patch +perf-intel-pt-fix-segfault-tracing-transactions.patch +i2c-cpm-fix-build-break-due-to-incompatible-pointer-types.patch +i2c-exynos5-fix-possible-abba-deadlock-by-keeping-i2c-clock-prepared.patch +toshiba_acpi-fix-regression-caused-by-hotkey-enabling-value.patch +edac-i7core-sb_edac-don-t-return-notify_bad-from-mce_decoder-callback.patch diff --git a/queue-4.4/toshiba_acpi-fix-regression-caused-by-hotkey-enabling-value.patch b/queue-4.4/toshiba_acpi-fix-regression-caused-by-hotkey-enabling-value.patch new file mode 100644 index 00000000000..a97388d1dae --- /dev/null +++ b/queue-4.4/toshiba_acpi-fix-regression-caused-by-hotkey-enabling-value.patch @@ -0,0 +1,40 @@ +From a30b8f81d9d6fe24eab8a023794548b048f08e3c Mon Sep 17 00:00:00 2001 +From: Azael Avalos +Date: Fri, 22 Apr 2016 09:29:36 -0600 +Subject: toshiba_acpi: Fix regression caused by hotkey enabling value + +From: Azael Avalos + +commit a30b8f81d9d6fe24eab8a023794548b048f08e3c upstream. + +Commit 52cbae0127ad ("toshiba_acpi: Change default Hotkey enabling value") +changed the hotkeys enabling value, as it was the same value Windows uses, +however, it turns out that the value tells the EC that the driver will now +take care of the hardware events like the physical RFKill switch or the +pointing device toggle button. + +This patch reverts such commit by changing the default hotkey enabling +value to 0x09, which enables hotkey events only, making the hardware +buttons working again. + +Fixes bugs 113331 and 114941. + +Signed-off-by: Azael Avalos +Signed-off-by: Darren Hart +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/toshiba_acpi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/platform/x86/toshiba_acpi.c ++++ b/drivers/platform/x86/toshiba_acpi.c +@@ -131,7 +131,7 @@ MODULE_LICENSE("GPL"); + /* Field definitions */ + #define HCI_ACCEL_MASK 0x7fff + #define HCI_HOTKEY_DISABLE 0x0b +-#define HCI_HOTKEY_ENABLE 0x01 ++#define HCI_HOTKEY_ENABLE 0x09 + #define HCI_HOTKEY_SPECIAL_FUNCTIONS 0x10 + #define HCI_LCD_BRIGHTNESS_BITS 3 + #define HCI_LCD_BRIGHTNESS_SHIFT (16-HCI_LCD_BRIGHTNESS_BITS)