From: Greg Kroah-Hartman Date: Wed, 9 Nov 2016 08:18:34 +0000 (+0100) Subject: 4.8-stable patches X-Git-Tag: v4.4.31~10 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=dda83139cc8079216110be272fb9f3ef3061179f;p=thirdparty%2Fkernel%2Fstable-queue.git 4.8-stable patches added patches: ath10k-cache-calibration-data-when-the-core-is-stopped.patch drm-fb-helper-don-t-call-dirty-callback-for-untouched-clips.patch drm-fb-helper-fix-connector-ref-leak-on-error.patch drm-fb-helper-keep-references-for-the-current-set-of-used-connectors.patch drm-imx-ipuv3-plane-access-old-u-vbo-properly-in-atomic_check-for-yu12-yv12.patch drm-imx-ipuv3-plane-switch-eba-buffer-only-when-we-don-t-need-modeset.patch drm-nouveau-acpi-fix-check-for-power-resources-support.patch drm-radeon-drop-register-readback-in-cayman_cp_int_cntl_setup.patch drm-radeon-si_dpm-limit-clocks-on-hd86xx-part.patch drm-radeon-si_dpm-workaround-for-si-kickers.patch mac80211-discard-multicast-and-4-addr-a-msdus.patch md-be-careful-not-lot-leak-internal-curr_resync-value-into-metadata.-all.patch mmc-dw_mmc-pltfm-fix-the-potential-null-pointer-dereference.patch raid1-ignore-discard-error.patch raid10-ignore-discard-error.patch revert-ath9k_hw-implement-temperature-compensation-support-for-ar9003.patch revert-drm-radeon-fix-dp-link-training-issue-with-second-4k-monitor.patch scsi-arcmsr-send-synchronize_cache-command-to-firmware.patch scsi-megaraid_sas-fix-data-integrity-failure-for-jbod-passthrough-devices.patch scsi-scsi_debug-fix-memory-leak-if-lbp-enabled-and-module-is-unloaded.patch --- diff --git a/queue-4.8/ath10k-cache-calibration-data-when-the-core-is-stopped.patch b/queue-4.8/ath10k-cache-calibration-data-when-the-core-is-stopped.patch new file mode 100644 index 00000000000..3ffd0f0c80f --- /dev/null +++ b/queue-4.8/ath10k-cache-calibration-data-when-the-core-is-stopped.patch @@ -0,0 +1,206 @@ +From f67b107d4ceddcf7aa65b706aaaf50d68edb52a6 Mon Sep 17 00:00:00 2001 +From: Marty Faltesek +Date: Mon, 10 Oct 2016 19:00:04 +0300 +Subject: ath10k: cache calibration data when the core is stopped + +From: Marty Faltesek + +commit f67b107d4ceddcf7aa65b706aaaf50d68edb52a6 upstream. + +Commit 0b8e3c4ca29f ("ath10k: move cal data len to hw_params") broke retrieving +the calibration data from cal_data debugfs file. The length of file was always +zero. The reason is: + + static ssize_t ath10k_debug_cal_data_read(struct file *file, + char __user *user_buf, + size_t count, loff_t *ppos) + { + struct ath10k *ar = file->private_data; + void *buf = file->private_data; + +This is obviously bogus, private_data cannot contain both struct ath10k and the +buffer. Fix it by caching calibration data to ar->debug.cal_data. This also +allows it to be accessed when the device is not active (interface is down). + +The cal_data buffer is fixed size because during the first firmware probe we +don't yet know what will be the lenght of the calibration data. It was simplest +just to use a fixed length. There's a WARN_ON() in +ath10k_debug_cal_data_fetch() if the buffer is too small. + +Tested with qca988x and firmware 10.2.4.70.56. + +Reported-by: Nikolay Martynov +Fixes: 0b8e3c4ca29f ("ath10k: move cal data len to hw_params") +Signed-off-by: Marty Faltesek +[kvalo@qca.qualcomm.com: improve commit log and minor other changes] +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath10k/core.h | 1 + drivers/net/wireless/ath/ath10k/debug.c | 75 ++++++++++++++++---------------- + 2 files changed, 40 insertions(+), 36 deletions(-) + +--- a/drivers/net/wireless/ath/ath10k/core.h ++++ b/drivers/net/wireless/ath/ath10k/core.h +@@ -445,6 +445,7 @@ struct ath10k_debug { + u32 pktlog_filter; + u32 reg_addr; + u32 nf_cal_period; ++ void *cal_data; + + struct ath10k_fw_crash_data *fw_crash_data; + }; +--- a/drivers/net/wireless/ath/ath10k/debug.c ++++ b/drivers/net/wireless/ath/ath10k/debug.c +@@ -30,6 +30,8 @@ + /* ms */ + #define ATH10K_DEBUG_HTT_STATS_INTERVAL 1000 + ++#define ATH10K_DEBUG_CAL_DATA_LEN 12064 ++ + #define ATH10K_FW_CRASH_DUMP_VERSION 1 + + /** +@@ -1450,56 +1452,51 @@ static const struct file_operations fops + .llseek = default_llseek, + }; + +-static int ath10k_debug_cal_data_open(struct inode *inode, struct file *file) ++static int ath10k_debug_cal_data_fetch(struct ath10k *ar) + { +- struct ath10k *ar = inode->i_private; +- void *buf; + u32 hi_addr; + __le32 addr; + int ret; + +- mutex_lock(&ar->conf_mutex); +- +- if (ar->state != ATH10K_STATE_ON && +- ar->state != ATH10K_STATE_UTF) { +- ret = -ENETDOWN; +- goto err; +- } ++ lockdep_assert_held(&ar->conf_mutex); + +- buf = vmalloc(ar->hw_params.cal_data_len); +- if (!buf) { +- ret = -ENOMEM; +- goto err; +- } ++ if (WARN_ON(ar->hw_params.cal_data_len > ATH10K_DEBUG_CAL_DATA_LEN)) ++ return -EINVAL; + + hi_addr = host_interest_item_address(HI_ITEM(hi_board_data)); + + ret = ath10k_hif_diag_read(ar, hi_addr, &addr, sizeof(addr)); + if (ret) { +- ath10k_warn(ar, "failed to read hi_board_data address: %d\n", ret); +- goto err_vfree; ++ ath10k_warn(ar, "failed to read hi_board_data address: %d\n", ++ ret); ++ return ret; + } + +- ret = ath10k_hif_diag_read(ar, le32_to_cpu(addr), buf, ++ ret = ath10k_hif_diag_read(ar, le32_to_cpu(addr), ar->debug.cal_data, + ar->hw_params.cal_data_len); + if (ret) { + ath10k_warn(ar, "failed to read calibration data: %d\n", ret); +- goto err_vfree; ++ return ret; + } + +- file->private_data = buf; ++ return 0; ++} + +- mutex_unlock(&ar->conf_mutex); ++static int ath10k_debug_cal_data_open(struct inode *inode, struct file *file) ++{ ++ struct ath10k *ar = inode->i_private; + +- return 0; ++ mutex_lock(&ar->conf_mutex); + +-err_vfree: +- vfree(buf); ++ if (ar->state == ATH10K_STATE_ON || ++ ar->state == ATH10K_STATE_UTF) { ++ ath10k_debug_cal_data_fetch(ar); ++ } + +-err: ++ file->private_data = ar; + mutex_unlock(&ar->conf_mutex); + +- return ret; ++ return 0; + } + + static ssize_t ath10k_debug_cal_data_read(struct file *file, +@@ -1507,18 +1504,16 @@ static ssize_t ath10k_debug_cal_data_rea + size_t count, loff_t *ppos) + { + struct ath10k *ar = file->private_data; +- void *buf = file->private_data; + +- return simple_read_from_buffer(user_buf, count, ppos, +- buf, ar->hw_params.cal_data_len); +-} ++ mutex_lock(&ar->conf_mutex); + +-static int ath10k_debug_cal_data_release(struct inode *inode, +- struct file *file) +-{ +- vfree(file->private_data); ++ count = simple_read_from_buffer(user_buf, count, ppos, ++ ar->debug.cal_data, ++ ar->hw_params.cal_data_len); + +- return 0; ++ mutex_unlock(&ar->conf_mutex); ++ ++ return count; + } + + static ssize_t ath10k_write_ani_enable(struct file *file, +@@ -1579,7 +1574,6 @@ static const struct file_operations fops + static const struct file_operations fops_cal_data = { + .open = ath10k_debug_cal_data_open, + .read = ath10k_debug_cal_data_read, +- .release = ath10k_debug_cal_data_release, + .owner = THIS_MODULE, + .llseek = default_llseek, + }; +@@ -1931,6 +1925,8 @@ void ath10k_debug_stop(struct ath10k *ar + { + lockdep_assert_held(&ar->conf_mutex); + ++ ath10k_debug_cal_data_fetch(ar); ++ + /* Must not use _sync to avoid deadlock, we do that in + * ath10k_debug_destroy(). The check for htt_stats_mask is to avoid + * warning from del_timer(). */ +@@ -2343,6 +2339,10 @@ int ath10k_debug_create(struct ath10k *a + if (!ar->debug.fw_crash_data) + return -ENOMEM; + ++ ar->debug.cal_data = vzalloc(ATH10K_DEBUG_CAL_DATA_LEN); ++ if (!ar->debug.cal_data) ++ return -ENOMEM; ++ + INIT_LIST_HEAD(&ar->debug.fw_stats.pdevs); + INIT_LIST_HEAD(&ar->debug.fw_stats.vdevs); + INIT_LIST_HEAD(&ar->debug.fw_stats.peers); +@@ -2356,6 +2356,9 @@ void ath10k_debug_destroy(struct ath10k + vfree(ar->debug.fw_crash_data); + ar->debug.fw_crash_data = NULL; + ++ vfree(ar->debug.cal_data); ++ ar->debug.cal_data = NULL; ++ + ath10k_debug_fw_stats_reset(ar); + + kfree(ar->debug.tpc_stats); diff --git a/queue-4.8/drm-fb-helper-don-t-call-dirty-callback-for-untouched-clips.patch b/queue-4.8/drm-fb-helper-don-t-call-dirty-callback-for-untouched-clips.patch new file mode 100644 index 00000000000..244d9ec2bcf --- /dev/null +++ b/queue-4.8/drm-fb-helper-don-t-call-dirty-callback-for-untouched-clips.patch @@ -0,0 +1,58 @@ +From 87d3b6588f9bf205902868d3e5baf68e37ad4ae1 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 20 Oct 2016 17:05:30 +0200 +Subject: drm/fb-helper: Don't call dirty callback for untouched clips +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Takashi Iwai + +commit 87d3b6588f9bf205902868d3e5baf68e37ad4ae1 upstream. + +Since 4.7 kernel, we've seen the error messages like + + kernel: [TTM] Buffer eviction failed + kernel: qxl 0000:00:02.0: object_init failed for (4026540032, 0x00000001) + kernel: [drm:qxl_alloc_bo_reserved [qxl]] *ERROR* failed to allocate VRAM BO + +on QXL when switching and accessing on VT. The culprit was the +generic deferred_io code (qxl driver switched to it since 4.7). +There is a race between the dirty clip update and the call of +callback. + +In drm_fb_helper_dirty(), the dirty clip is updated in the spinlock, +while it kicks off the update worker outside the spinlock. Meanwhile +the update worker clears the dirty clip in the spinlock, too. Thus, +when drm_fb_helper_dirty() is called concurrently, schedule_work() is +called after the clip is cleared in the first worker call. + +This patch addresses it by validating the clip before calling the +dirty fb callback. + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=98322 +Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1003298 +Fixes: eaa434defaca ('drm/fb-helper: Add fb_deferred_io support') +Signed-off-by: Takashi Iwai +Reviewed-by: Ville Syrjälä +Signed-off-by: Daniel Vetter +Link: http://patchwork.freedesktop.org/patch/msgid/20161020150530.5787-1-tiwai@suse.de +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_fb_helper.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_fb_helper.c ++++ b/drivers/gpu/drm/drm_fb_helper.c +@@ -632,7 +632,9 @@ static void drm_fb_helper_dirty_work(str + clip->x2 = clip->y2 = 0; + spin_unlock_irqrestore(&helper->dirty_lock, flags); + +- helper->fb->funcs->dirty(helper->fb, NULL, 0, 0, &clip_copy, 1); ++ /* call dirty callback only when it has been really touched */ ++ if (clip_copy.x1 < clip_copy.x2 && clip_copy.y1 < clip_copy.y2) ++ helper->fb->funcs->dirty(helper->fb, NULL, 0, 0, &clip_copy, 1); + } + + /** diff --git a/queue-4.8/drm-fb-helper-fix-connector-ref-leak-on-error.patch b/queue-4.8/drm-fb-helper-fix-connector-ref-leak-on-error.patch new file mode 100644 index 00000000000..bee3cebab00 --- /dev/null +++ b/queue-4.8/drm-fb-helper-fix-connector-ref-leak-on-error.patch @@ -0,0 +1,45 @@ +From 7dfcb36a1f17e4c7c7c12b9d8a6902037c7d98dc Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Wed, 26 Oct 2016 12:05:52 +0300 +Subject: drm/fb-helper: Fix connector ref leak on error +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit 7dfcb36a1f17e4c7c7c12b9d8a6902037c7d98dc upstream. + +We need to drop the connector references already taken when we +abort in the middle of drm_fb_helper_single_add_all_connectors() + +Cc: Carlos Santa +Cc: Kirill A. Shutemov +Tested-by: Carlos Santa +Tested-by: Kirill A. Shutemov +Signed-off-by: Ville Syrjälä +Reviewed-by: Chris Wilson +Signed-off-by: Daniel Vetter +Link: http://patchwork.freedesktop.org/patch/msgid/1477472755-15288-2-git-send-email-ville.syrjala@linux.intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_fb_helper.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_fb_helper.c ++++ b/drivers/gpu/drm/drm_fb_helper.c +@@ -129,7 +129,12 @@ int drm_fb_helper_single_add_all_connect + return 0; + fail: + for (i = 0; i < fb_helper->connector_count; i++) { +- kfree(fb_helper->connector_info[i]); ++ struct drm_fb_helper_connector *fb_helper_connector = ++ fb_helper->connector_info[i]; ++ ++ drm_connector_unreference(fb_helper_connector->connector); ++ ++ kfree(fb_helper_connector); + fb_helper->connector_info[i] = NULL; + } + fb_helper->connector_count = 0; diff --git a/queue-4.8/drm-fb-helper-keep-references-for-the-current-set-of-used-connectors.patch b/queue-4.8/drm-fb-helper-keep-references-for-the-current-set-of-used-connectors.patch new file mode 100644 index 00000000000..18bfdbc0f8c --- /dev/null +++ b/queue-4.8/drm-fb-helper-keep-references-for-the-current-set-of-used-connectors.patch @@ -0,0 +1,155 @@ +From a2889606636d135148de101fe3311dfea67baf1c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Wed, 26 Oct 2016 17:41:18 +0300 +Subject: drm/fb-helper: Keep references for the current set of used connectors +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit a2889606636d135148de101fe3311dfea67baf1c upstream. + +The fbdev helper code keeps around two lists of connectors. One is the +list of all connectors it could use, and that list already holds +references for all the connectors. However the other list, or rather +lists, is the one actively being used. That list is tracked per-crtc +and currently doesn't hold any extra references. Let's grab those +extra references to avoid oopsing when the connector vanishes. The +list of all possible connectors should get updated when the hpd happens, +but the list of actively used connectors would not get updated until +the next time the fb-helper picks through the set of possible connectors. +And so we need to hang on to the connectors until that time. + +Since we need to clean up in drm_fb_helper_crtc_free() as well, +let's pull the code to a common place. And while at it let's +pull in up the modeset->mode cleanup in there as well. The case +of modeset->fb is a bit less clear. I'm thinking we should probably +hold a reference to it, but for now I just slapped on a FIXME. + +v2: Cleanup things drm_fb_helper_crtc_free() too (Chris) +v3: Don't leak modeset->connectors (Chris) + +Cc: Chris Wilson +Cc: Carlos Santa +Cc: Kirill A. Shutemov +Tested-by: Carlos Santa (v1) +Tested-by: Kirill A. Shutemov (v1) +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=97666 +Signed-off-by: Ville Syrjälä +Reviewed-by: Chris Wilson +Signed-off-by: Daniel Vetter +Link: http://patchwork.freedesktop.org/patch/msgid/1477492878-4990-1-git-send-email-ville.syrjala@linux.intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_fb_helper.c | 57 +++++++++++++++++++++++----------------- + 1 file changed, 33 insertions(+), 24 deletions(-) + +--- a/drivers/gpu/drm/drm_fb_helper.c ++++ b/drivers/gpu/drm/drm_fb_helper.c +@@ -606,6 +606,24 @@ int drm_fb_helper_blank(int blank, struc + } + EXPORT_SYMBOL(drm_fb_helper_blank); + ++static void drm_fb_helper_modeset_release(struct drm_fb_helper *helper, ++ struct drm_mode_set *modeset) ++{ ++ int i; ++ ++ for (i = 0; i < modeset->num_connectors; i++) { ++ drm_connector_unreference(modeset->connectors[i]); ++ modeset->connectors[i] = NULL; ++ } ++ modeset->num_connectors = 0; ++ ++ drm_mode_destroy(helper->dev, modeset->mode); ++ modeset->mode = NULL; ++ ++ /* FIXME should hold a ref? */ ++ modeset->fb = NULL; ++} ++ + static void drm_fb_helper_crtc_free(struct drm_fb_helper *helper) + { + int i; +@@ -615,10 +633,12 @@ static void drm_fb_helper_crtc_free(stru + kfree(helper->connector_info[i]); + } + kfree(helper->connector_info); ++ + for (i = 0; i < helper->crtc_count; i++) { +- kfree(helper->crtc_info[i].mode_set.connectors); +- if (helper->crtc_info[i].mode_set.mode) +- drm_mode_destroy(helper->dev, helper->crtc_info[i].mode_set.mode); ++ struct drm_mode_set *modeset = &helper->crtc_info[i].mode_set; ++ ++ drm_fb_helper_modeset_release(helper, modeset); ++ kfree(modeset->connectors); + } + kfree(helper->crtc_info); + } +@@ -2034,7 +2054,6 @@ static void drm_setup_crtcs(struct drm_f + struct drm_fb_helper_crtc **crtcs; + struct drm_display_mode **modes; + struct drm_fb_offset *offsets; +- struct drm_mode_set *modeset; + bool *enabled; + int width, height; + int i; +@@ -2082,45 +2101,35 @@ static void drm_setup_crtcs(struct drm_f + + /* need to set the modesets up here for use later */ + /* fill out the connector<->crtc mappings into the modesets */ +- for (i = 0; i < fb_helper->crtc_count; i++) { +- modeset = &fb_helper->crtc_info[i].mode_set; +- modeset->num_connectors = 0; +- modeset->fb = NULL; +- } ++ for (i = 0; i < fb_helper->crtc_count; i++) ++ drm_fb_helper_modeset_release(fb_helper, ++ &fb_helper->crtc_info[i].mode_set); + + for (i = 0; i < fb_helper->connector_count; i++) { + struct drm_display_mode *mode = modes[i]; + struct drm_fb_helper_crtc *fb_crtc = crtcs[i]; + struct drm_fb_offset *offset = &offsets[i]; +- modeset = &fb_crtc->mode_set; ++ struct drm_mode_set *modeset = &fb_crtc->mode_set; + + if (mode && fb_crtc) { ++ struct drm_connector *connector = ++ fb_helper->connector_info[i]->connector; ++ + DRM_DEBUG_KMS("desired mode %s set on crtc %d (%d,%d)\n", + mode->name, fb_crtc->mode_set.crtc->base.id, offset->x, offset->y); ++ + fb_crtc->desired_mode = mode; + fb_crtc->x = offset->x; + fb_crtc->y = offset->y; +- if (modeset->mode) +- drm_mode_destroy(dev, modeset->mode); + modeset->mode = drm_mode_duplicate(dev, + fb_crtc->desired_mode); +- modeset->connectors[modeset->num_connectors++] = fb_helper->connector_info[i]->connector; ++ drm_connector_reference(connector); ++ modeset->connectors[modeset->num_connectors++] = connector; + modeset->fb = fb_helper->fb; + modeset->x = offset->x; + modeset->y = offset->y; + } + } +- +- /* Clear out any old modes if there are no more connected outputs. */ +- for (i = 0; i < fb_helper->crtc_count; i++) { +- modeset = &fb_helper->crtc_info[i].mode_set; +- if (modeset->num_connectors == 0) { +- BUG_ON(modeset->fb); +- if (modeset->mode) +- drm_mode_destroy(dev, modeset->mode); +- modeset->mode = NULL; +- } +- } + out: + kfree(crtcs); + kfree(modes); diff --git a/queue-4.8/drm-imx-ipuv3-plane-access-old-u-vbo-properly-in-atomic_check-for-yu12-yv12.patch b/queue-4.8/drm-imx-ipuv3-plane-access-old-u-vbo-properly-in-atomic_check-for-yu12-yv12.patch new file mode 100644 index 00000000000..edd1042b799 --- /dev/null +++ b/queue-4.8/drm-imx-ipuv3-plane-access-old-u-vbo-properly-in-atomic_check-for-yu12-yv12.patch @@ -0,0 +1,38 @@ +From e73aca5184ad9fc948ba22b4d35dce11db35bb25 Mon Sep 17 00:00:00 2001 +From: Liu Ying +Date: Tue, 18 Oct 2016 16:44:03 +0800 +Subject: drm/imx: ipuv3-plane: Access old u/vbo properly in ->atomic_check for YU12/YV12 + +From: Liu Ying + +commit e73aca5184ad9fc948ba22b4d35dce11db35bb25 upstream. + +Before accessing the u/v offset(aka, u/vbo for IPUv3) of the old plane state's +relevant fb, we should make sure the fb is in YU12 or YV12 pixel format(which +are the two YUV pixel formats we support only), otherwise, we are likely to +trigger BUG_ON() in drm_plane_state_to_u/vbo() since the fb's pixel format is +probably not YU12 or YV12. + +Link: https://bugs.freedesktop.org/show_bug.cgi?id=98150 +Fixes: c6c1f9bc798b ("drm/imx: Add active plane reconfiguration support") +Signed-off-by: Liu Ying +Signed-off-by: Philipp Zabel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/imx/ipuv3-plane.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/imx/ipuv3-plane.c ++++ b/drivers/gpu/drm/imx/ipuv3-plane.c +@@ -360,7 +360,9 @@ static int ipu_plane_atomic_check(struct + if ((ubo > 0xfffff8) || (vbo > 0xfffff8)) + return -EINVAL; + +- if (old_fb) { ++ if (old_fb && ++ (old_fb->pixel_format == DRM_FORMAT_YUV420 || ++ old_fb->pixel_format == DRM_FORMAT_YVU420)) { + old_ubo = drm_plane_state_to_ubo(old_state); + old_vbo = drm_plane_state_to_vbo(old_state); + if (ubo != old_ubo || vbo != old_vbo) diff --git a/queue-4.8/drm-imx-ipuv3-plane-switch-eba-buffer-only-when-we-don-t-need-modeset.patch b/queue-4.8/drm-imx-ipuv3-plane-switch-eba-buffer-only-when-we-don-t-need-modeset.patch new file mode 100644 index 00000000000..0af96173ff4 --- /dev/null +++ b/queue-4.8/drm-imx-ipuv3-plane-switch-eba-buffer-only-when-we-don-t-need-modeset.patch @@ -0,0 +1,43 @@ +From 43daa01323da37a3692cabe1579ef5c2c4372e06 Mon Sep 17 00:00:00 2001 +From: Liu Ying +Date: Mon, 10 Oct 2016 14:50:06 +0800 +Subject: drm/imx: ipuv3-plane: Switch EBA buffer only when we don't need modeset + +From: Liu Ying + +commit 43daa01323da37a3692cabe1579ef5c2c4372e06 upstream. + +We added active plane reconfiguration support by forcing a full modeset +operation. So, looking at old_plane_state->fb to determine whether we need to +switch EBA buffer(for hardware double buffering) in ipu_plane_atomic_set_base() +or not is no more correct. Instead, we should do that only when we don't need +modeset, otherwise, we initialize the two EBA buffers with the buffer address. + +Fixes: c6c1f9bc798b ("drm/imx: Add active plane reconfiguration support") +Signed-off-by: Liu Ying +Signed-off-by: Philipp Zabel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/imx/ipuv3-plane.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/imx/ipuv3-plane.c ++++ b/drivers/gpu/drm/imx/ipuv3-plane.c +@@ -108,6 +108,7 @@ static void ipu_plane_atomic_set_base(st + { + struct drm_plane *plane = &ipu_plane->base; + struct drm_plane_state *state = plane->state; ++ struct drm_crtc_state *crtc_state = state->crtc->state; + struct drm_framebuffer *fb = state->fb; + unsigned long eba, ubo, vbo; + int active; +@@ -149,7 +150,7 @@ static void ipu_plane_atomic_set_base(st + break; + } + +- if (old_state->fb) { ++ if (!drm_atomic_crtc_needs_modeset(crtc_state)) { + active = ipu_idmac_get_current_buffer(ipu_plane->ipu_ch); + ipu_cpmem_set_buffer(ipu_plane->ipu_ch, !active, eba); + ipu_idmac_select_buffer(ipu_plane->ipu_ch, !active); diff --git a/queue-4.8/drm-nouveau-acpi-fix-check-for-power-resources-support.patch b/queue-4.8/drm-nouveau-acpi-fix-check-for-power-resources-support.patch new file mode 100644 index 00000000000..ee30196ebe7 --- /dev/null +++ b/queue-4.8/drm-nouveau-acpi-fix-check-for-power-resources-support.patch @@ -0,0 +1,42 @@ +From b0a6af8b34c9ad20894aa46f85f4bf59d444f286 Mon Sep 17 00:00:00 2001 +From: Peter Wu +Date: Mon, 31 Oct 2016 23:48:22 +0100 +Subject: drm/nouveau/acpi: fix check for power resources support + +From: Peter Wu + +commit b0a6af8b34c9ad20894aa46f85f4bf59d444f286 upstream. + +Check whether the kernel really supports power resources for a device, +otherwise the power might not be removed when the device is runtime +suspended (DSM should still work in these cases where PR does not). + +This is a workaround for a problem where ACPICA and Windows 10 differ in +behavior. ACPICA does not correctly enumerate power resources within a +conditional block (due to delayed execution of such blocks) and as a +result power_resources is set to false even if _PR3 exists. + +Fixes: 692a17dcc292 ("drm/nouveau/acpi: fix lockup with PCIe runtime PM") +Link: https://bugs.freedesktop.org/show_bug.cgi?id=98398 +Reported-and-tested-by: Rick Kerkhof +Reviewed-by: Mika Westerberg +Signed-off-by: Peter Wu +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/nouveau/nouveau_acpi.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c ++++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c +@@ -240,7 +240,8 @@ static bool nouveau_pr3_present(struct p + if (!parent_adev) + return false; + +- return acpi_has_method(parent_adev->handle, "_PR3"); ++ return parent_adev->power.flags.power_resources && ++ acpi_has_method(parent_adev->handle, "_PR3"); + } + + static void nouveau_dsm_pci_probe(struct pci_dev *pdev, acpi_handle *dhandle_out, diff --git a/queue-4.8/drm-radeon-drop-register-readback-in-cayman_cp_int_cntl_setup.patch b/queue-4.8/drm-radeon-drop-register-readback-in-cayman_cp_int_cntl_setup.patch new file mode 100644 index 00000000000..f1eb4679077 --- /dev/null +++ b/queue-4.8/drm-radeon-drop-register-readback-in-cayman_cp_int_cntl_setup.patch @@ -0,0 +1,45 @@ +From 537b4b462caa8bfb9726d9695b8e56e2d5e6b41e Mon Sep 17 00:00:00 2001 +From: Lucas Stach +Date: Mon, 24 Oct 2016 23:32:04 +0200 +Subject: drm/radeon: drop register readback in cayman_cp_int_cntl_setup +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lucas Stach + +commit 537b4b462caa8bfb9726d9695b8e56e2d5e6b41e upstream. + +The read is taking a considerable amount of time (about 50us on this +machine). The register does not ever hold anything other than the ring +ID that is updated in this exact function, so there is no need for +the read modify write cycle. + +This chops off a big chunk of the time spent in hardirq disabled +context, as this function is called multiple times in the interrupt +handler. With this change applied radeon won't show up in the list +of the worst IRQ latency offenders anymore, where it was a regular +before. + +Reviewed-by: Christian König +Signed-off-by: Lucas Stach +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/ni.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/gpu/drm/radeon/ni.c ++++ b/drivers/gpu/drm/radeon/ni.c +@@ -1396,9 +1396,7 @@ static void cayman_pcie_gart_fini(struct + void cayman_cp_int_cntl_setup(struct radeon_device *rdev, + int ring, u32 cp_int_cntl) + { +- u32 srbm_gfx_cntl = RREG32(SRBM_GFX_CNTL) & ~3; +- +- WREG32(SRBM_GFX_CNTL, srbm_gfx_cntl | (ring & 3)); ++ WREG32(SRBM_GFX_CNTL, RINGID(ring)); + WREG32(CP_INT_CNTL, cp_int_cntl); + } + diff --git a/queue-4.8/drm-radeon-si_dpm-limit-clocks-on-hd86xx-part.patch b/queue-4.8/drm-radeon-si_dpm-limit-clocks-on-hd86xx-part.patch new file mode 100644 index 00000000000..4552ff451f0 --- /dev/null +++ b/queue-4.8/drm-radeon-si_dpm-limit-clocks-on-hd86xx-part.patch @@ -0,0 +1,35 @@ +From fb9a5b0c1c9893db2e0d18544fd49e19d784a87d Mon Sep 17 00:00:00 2001 +From: Tom St Denis +Date: Thu, 13 Oct 2016 12:38:07 -0400 +Subject: drm/radeon/si_dpm: Limit clocks on HD86xx part + +From: Tom St Denis + +commit fb9a5b0c1c9893db2e0d18544fd49e19d784a87d upstream. + +Limit clocks on a specific HD86xx part to avoid +crashes (while awaiting an appropriate PP fix). + +Signed-off-by: Tom St Denis +Reviewed-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/si_dpm.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/gpu/drm/radeon/si_dpm.c ++++ b/drivers/gpu/drm/radeon/si_dpm.c +@@ -3021,6 +3021,12 @@ static void si_apply_state_adjust_rules( + max_sclk = 75000; + max_mclk = 80000; + } ++ /* limit clocks on HD8600 series */ ++ if (rdev->pdev->device == 0x6660 && ++ rdev->pdev->revision == 0x83) { ++ max_sclk = 75000; ++ max_mclk = 80000; ++ } + + if (rps->vce_active) { + rps->evclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].evclk; diff --git a/queue-4.8/drm-radeon-si_dpm-workaround-for-si-kickers.patch b/queue-4.8/drm-radeon-si_dpm-workaround-for-si-kickers.patch new file mode 100644 index 00000000000..f8a2483ff11 --- /dev/null +++ b/queue-4.8/drm-radeon-si_dpm-workaround-for-si-kickers.patch @@ -0,0 +1,95 @@ +From 7dc86ef5ac91642dfc3eb93ee0f0458e702a343e Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Fri, 14 Oct 2016 16:38:02 -0400 +Subject: drm/radeon/si_dpm: workaround for SI kickers + +From: Alex Deucher + +commit 7dc86ef5ac91642dfc3eb93ee0f0458e702a343e upstream. + +Consolidate existing quirks. Fixes stability issues +on some kickers. + +Signed-off-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/si_dpm.c | 59 +++++++++++++++++++++++++++++----------- + 1 file changed, 43 insertions(+), 16 deletions(-) + +--- a/drivers/gpu/drm/radeon/si_dpm.c ++++ b/drivers/gpu/drm/radeon/si_dpm.c +@@ -2999,6 +2999,49 @@ static void si_apply_state_adjust_rules( + int i; + struct si_dpm_quirk *p = si_dpm_quirk_list; + ++ /* limit all SI kickers */ ++ if (rdev->family == CHIP_PITCAIRN) { ++ if ((rdev->pdev->revision == 0x81) || ++ (rdev->pdev->device == 0x6810) || ++ (rdev->pdev->device == 0x6811) || ++ (rdev->pdev->device == 0x6816) || ++ (rdev->pdev->device == 0x6817) || ++ (rdev->pdev->device == 0x6806)) ++ max_mclk = 120000; ++ } else if (rdev->family == CHIP_VERDE) { ++ if ((rdev->pdev->revision == 0x81) || ++ (rdev->pdev->revision == 0x83) || ++ (rdev->pdev->revision == 0x87) || ++ (rdev->pdev->device == 0x6820) || ++ (rdev->pdev->device == 0x6821) || ++ (rdev->pdev->device == 0x6822) || ++ (rdev->pdev->device == 0x6823) || ++ (rdev->pdev->device == 0x682A) || ++ (rdev->pdev->device == 0x682B)) { ++ max_sclk = 75000; ++ max_mclk = 80000; ++ } ++ } else if (rdev->family == CHIP_OLAND) { ++ if ((rdev->pdev->revision == 0xC7) || ++ (rdev->pdev->revision == 0x80) || ++ (rdev->pdev->revision == 0x81) || ++ (rdev->pdev->revision == 0x83) || ++ (rdev->pdev->device == 0x6604) || ++ (rdev->pdev->device == 0x6605)) { ++ max_sclk = 75000; ++ max_mclk = 80000; ++ } ++ } else if (rdev->family == CHIP_HAINAN) { ++ if ((rdev->pdev->revision == 0x81) || ++ (rdev->pdev->revision == 0x83) || ++ (rdev->pdev->revision == 0xC3) || ++ (rdev->pdev->device == 0x6664) || ++ (rdev->pdev->device == 0x6665) || ++ (rdev->pdev->device == 0x6667)) { ++ max_sclk = 75000; ++ max_mclk = 80000; ++ } ++ } + /* Apply dpm quirks */ + while (p && p->chip_device != 0) { + if (rdev->pdev->vendor == p->chip_vendor && +@@ -3011,22 +3054,6 @@ static void si_apply_state_adjust_rules( + } + ++p; + } +- /* limit mclk on all R7 370 parts for stability */ +- if (rdev->pdev->device == 0x6811 && +- rdev->pdev->revision == 0x81) +- max_mclk = 120000; +- /* limit sclk/mclk on Jet parts for stability */ +- if (rdev->pdev->device == 0x6665 && +- rdev->pdev->revision == 0xc3) { +- max_sclk = 75000; +- max_mclk = 80000; +- } +- /* limit clocks on HD8600 series */ +- if (rdev->pdev->device == 0x6660 && +- rdev->pdev->revision == 0x83) { +- max_sclk = 75000; +- max_mclk = 80000; +- } + + if (rps->vce_active) { + rps->evclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].evclk; diff --git a/queue-4.8/mac80211-discard-multicast-and-4-addr-a-msdus.patch b/queue-4.8/mac80211-discard-multicast-and-4-addr-a-msdus.patch new file mode 100644 index 00000000000..6411919f164 --- /dev/null +++ b/queue-4.8/mac80211-discard-multicast-and-4-addr-a-msdus.patch @@ -0,0 +1,64 @@ +From ea720935cf6686f72def9d322298bf7e9bd53377 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Wed, 5 Oct 2016 10:14:42 +0200 +Subject: mac80211: discard multicast and 4-addr A-MSDUs + +From: Johannes Berg + +commit ea720935cf6686f72def9d322298bf7e9bd53377 upstream. + +In mac80211, multicast A-MSDUs are accepted in many cases that +they shouldn't be accepted in: + * drop A-MSDUs with a multicast A1 (RA), as required by the + spec in 9.11 (802.11-2012 version) + * drop A-MSDUs with a 4-addr header, since the fourth address + can't actually be useful for them; unless 4-address frame + format is actually requested, even though the fourth address + is still not useful in this case, but ignored + +Accepting the first case, in particular, is very problematic +since it allows anyone else with possession of a GTK to send +unicast frames encapsulated in a multicast A-MSDU, even when +the AP has client isolation enabled. + +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/rx.c | 24 +++++++++++++++--------- + 1 file changed, 15 insertions(+), 9 deletions(-) + +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -2253,16 +2253,22 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx + if (!(status->rx_flags & IEEE80211_RX_AMSDU)) + return RX_CONTINUE; + +- if (ieee80211_has_a4(hdr->frame_control) && +- rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && +- !rx->sdata->u.vlan.sta) +- return RX_DROP_UNUSABLE; ++ if (unlikely(ieee80211_has_a4(hdr->frame_control))) { ++ switch (rx->sdata->vif.type) { ++ case NL80211_IFTYPE_AP_VLAN: ++ if (!rx->sdata->u.vlan.sta) ++ return RX_DROP_UNUSABLE; ++ break; ++ case NL80211_IFTYPE_STATION: ++ if (!rx->sdata->u.mgd.use_4addr) ++ return RX_DROP_UNUSABLE; ++ break; ++ default: ++ return RX_DROP_UNUSABLE; ++ } ++ } + +- if (is_multicast_ether_addr(hdr->addr1) && +- ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && +- rx->sdata->u.vlan.sta) || +- (rx->sdata->vif.type == NL80211_IFTYPE_STATION && +- rx->sdata->u.mgd.use_4addr))) ++ if (is_multicast_ether_addr(hdr->addr1)) + return RX_DROP_UNUSABLE; + + skb->dev = dev; diff --git a/queue-4.8/md-be-careful-not-lot-leak-internal-curr_resync-value-into-metadata.-all.patch b/queue-4.8/md-be-careful-not-lot-leak-internal-curr_resync-value-into-metadata.-all.patch new file mode 100644 index 00000000000..1f41a35633c --- /dev/null +++ b/queue-4.8/md-be-careful-not-lot-leak-internal-curr_resync-value-into-metadata.-all.patch @@ -0,0 +1,65 @@ +From 1217e1d1999ed6c9c1e1b1acae0a74ab70464ae2 Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Fri, 28 Oct 2016 15:59:41 +1100 +Subject: md: be careful not lot leak internal curr_resync value into metadata. -- (all) + +From: NeilBrown + +commit 1217e1d1999ed6c9c1e1b1acae0a74ab70464ae2 upstream. + +mddev->curr_resync usually records where the current resync is up to, +but during the starting phase it has some "magic" values. + + 1 - means that the array is trying to start a resync, but has yielded + to another array which shares physical devices, and also needs to + start a resync + 2 - means the array is trying to start resync, but has found another + array which shares physical devices and has already started resync. + + 3 - means that resync has commensed, but it is possible that nothing + has actually been resynced yet. + +It is important that this value not be visible to user-space and +particularly that it doesn't get written to the metadata, as the +resync or recovery checkpoint. In part, this is because it may be +slightly higher than the correct value, though this is very rare. +In part, because it is not a multiple of 4K, and some devices only +support 4K aligned accesses. + +There are two places where this value is propagates into either +->curr_resync_completed or ->recovery_cp or ->recovery_offset. +These currently avoid the propagation of values 1 and 3, but will +allow 3 to leak through. + +Change them to only propagate the value if it is > 3. + +As this can cause an array to fail, the patch is suitable for -stable. + +Reported-by: Viswesh +Signed-off-by: NeilBrown +Signed-off-by: Shaohua Li +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/md.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -8120,14 +8120,14 @@ void md_do_sync(struct md_thread *thread + + if (!test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) && + !test_bit(MD_RECOVERY_INTR, &mddev->recovery) && +- mddev->curr_resync > 2) { ++ mddev->curr_resync > 3) { + mddev->curr_resync_completed = mddev->curr_resync; + sysfs_notify(&mddev->kobj, NULL, "sync_completed"); + } + mddev->pers->sync_request(mddev, max_sectors, &skipped); + + if (!test_bit(MD_RECOVERY_CHECK, &mddev->recovery) && +- mddev->curr_resync > 2) { ++ mddev->curr_resync > 3) { + if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery)) { + if (test_bit(MD_RECOVERY_INTR, &mddev->recovery)) { + if (mddev->curr_resync >= mddev->recovery_cp) { diff --git a/queue-4.8/mmc-dw_mmc-pltfm-fix-the-potential-null-pointer-dereference.patch b/queue-4.8/mmc-dw_mmc-pltfm-fix-the-potential-null-pointer-dereference.patch new file mode 100644 index 00000000000..0d1c0355d4d --- /dev/null +++ b/queue-4.8/mmc-dw_mmc-pltfm-fix-the-potential-null-pointer-dereference.patch @@ -0,0 +1,40 @@ +From 45c7a4908a307a023e237a64a3eadcafc4836493 Mon Sep 17 00:00:00 2001 +From: Jaehoon Chung +Date: Fri, 21 Oct 2016 19:57:57 +0900 +Subject: mmc: dw_mmc-pltfm: fix the potential NULL pointer dereference + +From: Jaehoon Chung + +commit 45c7a4908a307a023e237a64a3eadcafc4836493 upstream. + +platform_get_resource can be returned the NULL pointer. +Then regs->start should be referred to NULL Pointer. +devm_ioremap_resource() checks whether res is NULL or not. + +Signed-off-by: Jaehoon Chung +Reviewed-by: Shawn Lin +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/dw_mmc-pltfm.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/mmc/host/dw_mmc-pltfm.c ++++ b/drivers/mmc/host/dw_mmc-pltfm.c +@@ -46,12 +46,13 @@ int dw_mci_pltfm_register(struct platfor + host->pdata = pdev->dev.platform_data; + + regs = platform_get_resource(pdev, IORESOURCE_MEM, 0); +- /* Get registers' physical base address */ +- host->phy_regs = regs->start; + host->regs = devm_ioremap_resource(&pdev->dev, regs); + if (IS_ERR(host->regs)) + return PTR_ERR(host->regs); + ++ /* Get registers' physical base address */ ++ host->phy_regs = regs->start; ++ + platform_set_drvdata(pdev, host); + return dw_mci_probe(host); + } diff --git a/queue-4.8/raid1-ignore-discard-error.patch b/queue-4.8/raid1-ignore-discard-error.patch new file mode 100644 index 00000000000..62ce16c57b3 --- /dev/null +++ b/queue-4.8/raid1-ignore-discard-error.patch @@ -0,0 +1,54 @@ +From e3f948cd3283e4fbe5907f1f3967c839912f480e Mon Sep 17 00:00:00 2001 +From: Shaohua Li +Date: Thu, 6 Oct 2016 14:09:16 -0700 +Subject: RAID1: ignore discard error + +From: Shaohua Li + +commit e3f948cd3283e4fbe5907f1f3967c839912f480e upstream. + +If a write error occurs, raid1 will try to rewrite the bio in small +chunk size. If the rewrite fails, raid1 will record the error in bad +block. narrow_write_error will always use WRITE for the bio, but +actually it could be a discard. Since discard bio hasn't payload, write +the bio will cause different issues. But discard error isn't fatal, we +can safely ignore it. This is what this patch does. + +This issue should exist since discard is added, but only exposed with +recent arbitrary bio size feature. + +Reported-and-tested-by: Sitsofe Wheeler +Signed-off-by: Shaohua Li +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/raid1.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -407,11 +407,14 @@ static void raid1_end_write_request(stru + struct bio *to_put = NULL; + int mirror = find_bio_disk(r1_bio, bio); + struct md_rdev *rdev = conf->mirrors[mirror].rdev; ++ bool discard_error; ++ ++ discard_error = bio->bi_error && bio_op(bio) == REQ_OP_DISCARD; + + /* + * 'one mirror IO has finished' event handler: + */ +- if (bio->bi_error) { ++ if (bio->bi_error && !discard_error) { + set_bit(WriteErrorSeen, &rdev->flags); + if (!test_and_set_bit(WantReplacement, &rdev->flags)) + set_bit(MD_RECOVERY_NEEDED, & +@@ -448,7 +451,7 @@ static void raid1_end_write_request(stru + + /* Maybe we can clear some bad blocks. */ + if (is_badblock(rdev, r1_bio->sector, r1_bio->sectors, +- &first_bad, &bad_sectors)) { ++ &first_bad, &bad_sectors) && !discard_error) { + r1_bio->bios[mirror] = IO_MADE_GOOD; + set_bit(R1BIO_MadeGood, &r1_bio->state); + } diff --git a/queue-4.8/raid10-ignore-discard-error.patch b/queue-4.8/raid10-ignore-discard-error.patch new file mode 100644 index 00000000000..26ba1d612cd --- /dev/null +++ b/queue-4.8/raid10-ignore-discard-error.patch @@ -0,0 +1,58 @@ +From 579ed34f7b751b8add233cba4cf755258dbdd60a Mon Sep 17 00:00:00 2001 +From: Shaohua Li +Date: Thu, 6 Oct 2016 14:13:52 -0700 +Subject: RAID10: ignore discard error + +From: Shaohua Li + +commit 579ed34f7b751b8add233cba4cf755258dbdd60a upstream. + +This is the counterpart of raid10 fix. If a write error occurs, raid10 +will try to rewrite the bio in small chunk size. If the rewrite fails, +raid10 will record the error in bad block. narrow_write_error will +always use WRITE for the bio, but actually it could be a discard. Since +discard bio hasn't payload, write the bio will cause different issues. +But discard error isn't fatal, we can safely ignore it. This is what +this patch does. + +This issue should exist since discard is added, but only exposed with +recent arbitrary bio size feature. + +Cc: Sitsofe Wheeler +Signed-off-by: Shaohua Li +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/raid10.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -447,6 +447,9 @@ static void raid10_end_write_request(str + struct r10conf *conf = r10_bio->mddev->private; + int slot, repl; + struct md_rdev *rdev = NULL; ++ bool discard_error; ++ ++ discard_error = bio->bi_error && bio_op(bio) == REQ_OP_DISCARD; + + dev = find_bio_disk(conf, r10_bio, bio, &slot, &repl); + +@@ -460,7 +463,7 @@ static void raid10_end_write_request(str + /* + * this branch is our 'one mirror IO has finished' event handler: + */ +- if (bio->bi_error) { ++ if (bio->bi_error && !discard_error) { + if (repl) + /* Never record new bad blocks to replacement, + * just fail it. +@@ -503,7 +506,7 @@ static void raid10_end_write_request(str + if (is_badblock(rdev, + r10_bio->devs[slot].addr, + r10_bio->sectors, +- &first_bad, &bad_sectors)) { ++ &first_bad, &bad_sectors) && !discard_error) { + bio_put(bio); + if (repl) + r10_bio->devs[slot].repl_bio = IO_MADE_GOOD; diff --git a/queue-4.8/revert-ath9k_hw-implement-temperature-compensation-support-for-ar9003.patch b/queue-4.8/revert-ath9k_hw-implement-temperature-compensation-support-for-ar9003.patch new file mode 100644 index 00000000000..28e71d06bc7 --- /dev/null +++ b/queue-4.8/revert-ath9k_hw-implement-temperature-compensation-support-for-ar9003.patch @@ -0,0 +1,113 @@ +From 304e5ac118cc351eb047b6c433a89e13ea7259cf Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Tue, 11 Oct 2016 19:46:49 +0200 +Subject: Revert "ath9k_hw: implement temperature compensation support for AR9003+" + +From: Felix Fietkau + +commit 304e5ac118cc351eb047b6c433a89e13ea7259cf upstream. + +This reverts commit 171f6402e4aa ("ath9k_hw: implement temperature compensation +support for AR9003+"). Some users report that this commit causes a regression +in performance under some conditions. + +Fixes: 171f6402e4aa ("ath9k_hw: implement temperature compensation support for AR9003+") +Signed-off-by: Felix Fietkau +[kvalo@qca.qualcomm.com: improve commit log] +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/ar9003_calib.c | 25 +++---------------------- + drivers/net/wireless/ath/ath9k/hw.h | 1 - + 2 files changed, 3 insertions(+), 23 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c ++++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c +@@ -33,7 +33,6 @@ struct coeff { + + enum ar9003_cal_types { + IQ_MISMATCH_CAL = BIT(0), +- TEMP_COMP_CAL = BIT(1), + }; + + static void ar9003_hw_setup_calibration(struct ath_hw *ah, +@@ -59,12 +58,6 @@ static void ar9003_hw_setup_calibration( + /* Kick-off cal */ + REG_SET_BIT(ah, AR_PHY_TIMING4, AR_PHY_TIMING4_DO_CAL); + break; +- case TEMP_COMP_CAL: +- ath_dbg(common, CALIBRATE, +- "starting Temperature Compensation Calibration\n"); +- REG_SET_BIT(ah, AR_CH0_THERM, AR_CH0_THERM_LOCAL); +- REG_SET_BIT(ah, AR_CH0_THERM, AR_CH0_THERM_START); +- break; + default: + ath_err(common, "Invalid calibration type\n"); + break; +@@ -93,8 +86,7 @@ static bool ar9003_hw_per_calibration(st + /* + * Accumulate cal measures for active chains + */ +- if (cur_caldata->calCollect) +- cur_caldata->calCollect(ah); ++ cur_caldata->calCollect(ah); + ah->cal_samples++; + + if (ah->cal_samples >= cur_caldata->calNumSamples) { +@@ -107,8 +99,7 @@ static bool ar9003_hw_per_calibration(st + /* + * Process accumulated data + */ +- if (cur_caldata->calPostProc) +- cur_caldata->calPostProc(ah, numChains); ++ cur_caldata->calPostProc(ah, numChains); + + /* Calibration has finished. */ + caldata->CalValid |= cur_caldata->calType; +@@ -323,16 +314,9 @@ static const struct ath9k_percal_data iq + ar9003_hw_iqcalibrate + }; + +-static const struct ath9k_percal_data temp_cal_single_sample = { +- TEMP_COMP_CAL, +- MIN_CAL_SAMPLES, +- PER_MAX_LOG_COUNT, +-}; +- + static void ar9003_hw_init_cal_settings(struct ath_hw *ah) + { + ah->iq_caldata.calData = &iq_cal_single_sample; +- ah->temp_caldata.calData = &temp_cal_single_sample; + + if (AR_SREV_9300_20_OR_LATER(ah)) { + ah->enabled_cals |= TX_IQ_CAL; +@@ -340,7 +324,7 @@ static void ar9003_hw_init_cal_settings( + ah->enabled_cals |= TX_IQ_ON_AGC_CAL; + } + +- ah->supp_cals = IQ_MISMATCH_CAL | TEMP_COMP_CAL; ++ ah->supp_cals = IQ_MISMATCH_CAL; + } + + #define OFF_UPPER_LT 24 +@@ -1399,9 +1383,6 @@ static void ar9003_hw_init_cal_common(st + INIT_CAL(&ah->iq_caldata); + INSERT_CAL(ah, &ah->iq_caldata); + +- INIT_CAL(&ah->temp_caldata); +- INSERT_CAL(ah, &ah->temp_caldata); +- + /* Initialize current pointer to first element in list */ + ah->cal_list_curr = ah->cal_list; + +--- a/drivers/net/wireless/ath/ath9k/hw.h ++++ b/drivers/net/wireless/ath/ath9k/hw.h +@@ -830,7 +830,6 @@ struct ath_hw { + /* Calibration */ + u32 supp_cals; + struct ath9k_cal_list iq_caldata; +- struct ath9k_cal_list temp_caldata; + struct ath9k_cal_list adcgain_caldata; + struct ath9k_cal_list adcdc_caldata; + struct ath9k_cal_list *cal_list; diff --git a/queue-4.8/revert-drm-radeon-fix-dp-link-training-issue-with-second-4k-monitor.patch b/queue-4.8/revert-drm-radeon-fix-dp-link-training-issue-with-second-4k-monitor.patch new file mode 100644 index 00000000000..91e6ae1a65e --- /dev/null +++ b/queue-4.8/revert-drm-radeon-fix-dp-link-training-issue-with-second-4k-monitor.patch @@ -0,0 +1,38 @@ +From 9dc79965b21967caebde575f5f5d8bf1aa2c23ab Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michel=20D=C3=A4nzer?= +Date: Mon, 24 Oct 2016 16:52:20 +0900 +Subject: Revert "drm/radeon: fix DP link training issue with second 4K monitor" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michel Dänzer + +commit 9dc79965b21967caebde575f5f5d8bf1aa2c23ab upstream. + +This reverts commit 1a738347df2ee4977459a8776fe2c62196bdcb1b. + +It caused at least some Kaveri laptops to incorrectly report DisplayPort +connectors as connected. + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=97857 +Reviewed-by: Alex Deucher +Signed-off-by: Michel Dänzer +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_dp_auxch.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/radeon_dp_auxch.c ++++ b/drivers/gpu/drm/radeon/radeon_dp_auxch.c +@@ -105,7 +105,7 @@ radeon_dp_aux_transfer_native(struct drm + + tmp &= AUX_HPD_SEL(0x7); + tmp |= AUX_HPD_SEL(chan->rec.hpd); +- tmp |= AUX_EN | AUX_LS_READ_EN | AUX_HPD_DISCON(0x1); ++ tmp |= AUX_EN | AUX_LS_READ_EN; + + WREG32(AUX_CONTROL + aux_offset[instance], tmp); + diff --git a/queue-4.8/scsi-arcmsr-send-synchronize_cache-command-to-firmware.patch b/queue-4.8/scsi-arcmsr-send-synchronize_cache-command-to-firmware.patch new file mode 100644 index 00000000000..f38b9f64a96 --- /dev/null +++ b/queue-4.8/scsi-arcmsr-send-synchronize_cache-command-to-firmware.patch @@ -0,0 +1,48 @@ +From 2bf7dc8443e113844d078fd6541b7f4aa544f92f Mon Sep 17 00:00:00 2001 +From: Ching Huang +Date: Wed, 19 Oct 2016 17:50:26 +0800 +Subject: scsi: arcmsr: Send SYNCHRONIZE_CACHE command to firmware + +From: Ching Huang + +commit 2bf7dc8443e113844d078fd6541b7f4aa544f92f upstream. + +The arcmsr driver failed to pass SYNCHRONIZE CACHE to controller +firmware. Depending on how drive caches are handled internally by +controller firmware this could potentially lead to data integrity +problems. + +Ensure that cache flushes are passed to the controller. + +[mkp: applied by hand and removed unused vars] + +Signed-off-by: Ching Huang +Reported-by: Tomas Henzl +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/arcmsr/arcmsr_hba.c | 9 --------- + 1 file changed, 9 deletions(-) + +--- a/drivers/scsi/arcmsr/arcmsr_hba.c ++++ b/drivers/scsi/arcmsr/arcmsr_hba.c +@@ -2636,18 +2636,9 @@ static int arcmsr_queue_command_lck(stru + struct AdapterControlBlock *acb = (struct AdapterControlBlock *) host->hostdata; + struct CommandControlBlock *ccb; + int target = cmd->device->id; +- int lun = cmd->device->lun; +- uint8_t scsicmd = cmd->cmnd[0]; + cmd->scsi_done = done; + cmd->host_scribble = NULL; + cmd->result = 0; +- if ((scsicmd == SYNCHRONIZE_CACHE) ||(scsicmd == SEND_DIAGNOSTIC)){ +- if(acb->devstate[target][lun] == ARECA_RAID_GONE) { +- cmd->result = (DID_NO_CONNECT << 16); +- } +- cmd->scsi_done(cmd); +- return 0; +- } + if (target == 16) { + /* virtual device for iop message transfer */ + arcmsr_handle_virtual_command(acb, cmd); diff --git a/queue-4.8/scsi-megaraid_sas-fix-data-integrity-failure-for-jbod-passthrough-devices.patch b/queue-4.8/scsi-megaraid_sas-fix-data-integrity-failure-for-jbod-passthrough-devices.patch new file mode 100644 index 00000000000..238fbcefffa --- /dev/null +++ b/queue-4.8/scsi-megaraid_sas-fix-data-integrity-failure-for-jbod-passthrough-devices.patch @@ -0,0 +1,55 @@ +From 1e793f6fc0db920400574211c48f9157a37e3945 Mon Sep 17 00:00:00 2001 +From: Kashyap Desai +Date: Fri, 21 Oct 2016 06:33:32 -0700 +Subject: scsi: megaraid_sas: Fix data integrity failure for JBOD (passthrough) devices + +From: Kashyap Desai + +commit 1e793f6fc0db920400574211c48f9157a37e3945 upstream. + +Commit 02b01e010afe ("megaraid_sas: return sync cache call with +success") modified the driver to successfully complete SYNCHRONIZE_CACHE +commands without passing them to the controller. Disk drive caches are +only explicitly managed by controller firmware when operating in RAID +mode. So this commit effectively disabled writeback cache flushing for +any drives used in JBOD mode, leading to data integrity failures. + +[mkp: clarified patch description] + +Fixes: 02b01e010afeeb49328d35650d70721d2ca3fd59 +Signed-off-by: Kashyap Desai +Signed-off-by: Sumit Saxena +Reviewed-by: Tomas Henzl +Reviewed-by: Hannes Reinecke +Reviewed-by: Ewan D. Milne +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/megaraid/megaraid_sas_base.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -1713,16 +1713,13 @@ megasas_queue_command(struct Scsi_Host * + goto out_done; + } + +- switch (scmd->cmnd[0]) { +- case SYNCHRONIZE_CACHE: +- /* +- * FW takes care of flush cache on its own +- * No need to send it down +- */ ++ /* ++ * FW takes care of flush cache on its own for Virtual Disk. ++ * No need to send it down for VD. For JBOD send SYNCHRONIZE_CACHE to FW. ++ */ ++ if ((scmd->cmnd[0] == SYNCHRONIZE_CACHE) && MEGASAS_IS_LOGICAL(scmd)) { + scmd->result = DID_OK << 16; + goto out_done; +- default: +- break; + } + + return instance->instancet->build_and_issue_cmd(instance, scmd); diff --git a/queue-4.8/scsi-scsi_debug-fix-memory-leak-if-lbp-enabled-and-module-is-unloaded.patch b/queue-4.8/scsi-scsi_debug-fix-memory-leak-if-lbp-enabled-and-module-is-unloaded.patch new file mode 100644 index 00000000000..76bfec2a0eb --- /dev/null +++ b/queue-4.8/scsi-scsi_debug-fix-memory-leak-if-lbp-enabled-and-module-is-unloaded.patch @@ -0,0 +1,30 @@ +From 4d2b496f19f3c2cfaca1e8fa0710688b5ff3811d Mon Sep 17 00:00:00 2001 +From: "Ewan D. Milne" +Date: Wed, 26 Oct 2016 11:22:53 -0400 +Subject: scsi: scsi_debug: Fix memory leak if LBP enabled and module is unloaded + +From: Ewan D. Milne + +commit 4d2b496f19f3c2cfaca1e8fa0710688b5ff3811d upstream. + +map_storep was not being vfree()'d in the module_exit call. + +Signed-off-by: Ewan D. Milne +Reviewed-by: Laurence Oberman +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/scsi_debug.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/scsi/scsi_debug.c ++++ b/drivers/scsi/scsi_debug.c +@@ -5134,6 +5134,7 @@ static void __exit scsi_debug_exit(void) + bus_unregister(&pseudo_lld_bus); + root_device_unregister(pseudo_primary); + ++ vfree(map_storep); + vfree(dif_storep); + vfree(fake_storep); + kfree(sdebug_q_arr); diff --git a/queue-4.8/series b/queue-4.8/series index f36bd528edd..5e164bc4ae0 100644 --- a/queue-4.8/series +++ b/queue-4.8/series @@ -91,3 +91,23 @@ rtl8xxxu-fix-rtl8723bu-driver-reload-issue.patch input-i8042-add-xmg-c504-to-keyboard-reset-table.patch firewire-net-guard-against-rx-buffer-overflows.patch firewire-net-fix-fragmented-datagram_size-off-by-one.patch +mac80211-discard-multicast-and-4-addr-a-msdus.patch +revert-ath9k_hw-implement-temperature-compensation-support-for-ar9003.patch +ath10k-cache-calibration-data-when-the-core-is-stopped.patch +scsi-megaraid_sas-fix-data-integrity-failure-for-jbod-passthrough-devices.patch +scsi-scsi_debug-fix-memory-leak-if-lbp-enabled-and-module-is-unloaded.patch +scsi-arcmsr-send-synchronize_cache-command-to-firmware.patch +mmc-dw_mmc-pltfm-fix-the-potential-null-pointer-dereference.patch +raid1-ignore-discard-error.patch +raid10-ignore-discard-error.patch +md-be-careful-not-lot-leak-internal-curr_resync-value-into-metadata.-all.patch +revert-drm-radeon-fix-dp-link-training-issue-with-second-4k-monitor.patch +drm-imx-ipuv3-plane-switch-eba-buffer-only-when-we-don-t-need-modeset.patch +drm-imx-ipuv3-plane-access-old-u-vbo-properly-in-atomic_check-for-yu12-yv12.patch +drm-radeon-si_dpm-limit-clocks-on-hd86xx-part.patch +drm-radeon-si_dpm-workaround-for-si-kickers.patch +drm-radeon-drop-register-readback-in-cayman_cp_int_cntl_setup.patch +drm-nouveau-acpi-fix-check-for-power-resources-support.patch +drm-fb-helper-don-t-call-dirty-callback-for-untouched-clips.patch +drm-fb-helper-fix-connector-ref-leak-on-error.patch +drm-fb-helper-keep-references-for-the-current-set-of-used-connectors.patch