--- /dev/null
+From 52b482b0f4fd6d5267faf29fe91398e203f3c230 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Thu, 15 Jun 2017 11:12:28 -0400
+Subject: drm/amdgpu: adjust default display clock
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 52b482b0f4fd6d5267faf29fe91398e203f3c230 upstream.
+
+Increase the default display clock on newer asics to
+accomodate some high res modes with really high refresh
+rates.
+
+bug: https://bugs.freedesktop.org/show_bug.cgi?id=93826
+Acked-by: Chunming Zhou <david1.zhou@amd.com>
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
+@@ -681,6 +681,10 @@ int amdgpu_atombios_get_clock_info(struc
+ DRM_INFO("Changing default dispclk from %dMhz to 600Mhz\n",
+ adev->clock.default_dispclk / 100);
+ adev->clock.default_dispclk = 60000;
++ } else if (adev->clock.default_dispclk <= 60000) {
++ DRM_INFO("Changing default dispclk from %dMhz to 625Mhz\n",
++ adev->clock.default_dispclk / 100);
++ adev->clock.default_dispclk = 62500;
+ }
+ adev->clock.dp_extclk =
+ le16_to_cpu(firmware_info->info_21.usUniphyDPModeExtClkFreq);
--- /dev/null
+From 05b4017b37f1fce4b7185f138126dd8decdb381f Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Thu, 15 Jun 2017 10:55:11 -0400
+Subject: drm/amdgpu/atom: fix ps allocation size for EnableDispPowerGating
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 05b4017b37f1fce4b7185f138126dd8decdb381f upstream.
+
+We were using the wrong structure which lead to an overflow
+on some boards.
+
+bug: https://bugs.freedesktop.org/show_bug.cgi?id=101387
+Acked-by: Chunming Zhou <david1.zhou@amd.com>
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/atombios_crtc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c
++++ b/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c
+@@ -164,7 +164,7 @@ void amdgpu_atombios_crtc_powergate(stru
+ struct drm_device *dev = crtc->dev;
+ struct amdgpu_device *adev = dev->dev_private;
+ int index = GetIndexIntoMasterTable(COMMAND, EnableDispPowerGating);
+- ENABLE_DISP_POWER_GATING_PARAMETERS_V2_1 args;
++ ENABLE_DISP_POWER_GATING_PS_ALLOCATION args;
+
+ memset(&args, 0, sizeof(args));
+
+@@ -177,7 +177,7 @@ void amdgpu_atombios_crtc_powergate(stru
+ void amdgpu_atombios_crtc_powergate_init(struct amdgpu_device *adev)
+ {
+ int index = GetIndexIntoMasterTable(COMMAND, EnableDispPowerGating);
+- ENABLE_DISP_POWER_GATING_PARAMETERS_V2_1 args;
++ ENABLE_DISP_POWER_GATING_PS_ALLOCATION args;
+
+ memset(&args, 0, sizeof(args));
+
--- /dev/null
+From 4eb59793cca00b0e629b6d55b5abb5acb82c5868 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 19 Jun 2017 12:52:47 -0400
+Subject: drm/radeon: add a PX quirk for another K53TK variant
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 4eb59793cca00b0e629b6d55b5abb5acb82c5868 upstream.
+
+Disable PX on these systems.
+
+bug: https://bugs.freedesktop.org/show_bug.cgi?id=101491
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_device.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -127,6 +127,10 @@ static struct radeon_px_quirk radeon_px_
+ * https://bugzilla.kernel.org/show_bug.cgi?id=51381
+ */
+ { PCI_VENDOR_ID_ATI, 0x6840, 0x1043, 0x2122, RADEON_PX_QUIRK_DISABLE_PX },
++ /* Asus K53TK laptop with AMD A6-3420M APU and Radeon 7670m GPU
++ * https://bugs.freedesktop.org/show_bug.cgi?id=101491
++ */
++ { PCI_VENDOR_ID_ATI, 0x6741, 0x1043, 0x2122, RADEON_PX_QUIRK_DISABLE_PX },
+ /* macbook pro 8.2 */
+ { PCI_VENDOR_ID_ATI, 0x6741, PCI_VENDOR_ID_APPLE, 0x00e2, RADEON_PX_QUIRK_LONG_WAKEUP },
+ { 0, 0, 0, 0, 0 },
--- /dev/null
+From acfd6ee4fa7ebeee75511825fe02be3f7ac1d668 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 19 Jun 2017 15:59:58 -0400
+Subject: drm/radeon: add a quirk for Toshiba Satellite L20-183
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit acfd6ee4fa7ebeee75511825fe02be3f7ac1d668 upstream.
+
+Fixes resume from suspend.
+
+bug: https://bugzilla.kernel.org/show_bug.cgi?id=196121
+Reported-by: Przemek <soprwa@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_combios.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_combios.c
++++ b/drivers/gpu/drm/radeon/radeon_combios.c
+@@ -3394,6 +3394,13 @@ void radeon_combios_asic_init(struct drm
+ rdev->pdev->subsystem_vendor == 0x103c &&
+ rdev->pdev->subsystem_device == 0x280a)
+ return;
++ /* quirk for rs4xx Toshiba Sattellite L20-183 latop to make it resume
++ * - it hangs on resume inside the dynclk 1 table.
++ */
++ if (rdev->family == CHIP_RS400 &&
++ rdev->pdev->subsystem_vendor == 0x1179 &&
++ rdev->pdev->subsystem_device == 0xff31)
++ return;
+
+ /* DYN CLK 1 */
+ table = combios_get_table_offset(dev, COMBIOS_DYN_CLK_1_TABLE);
--- /dev/null
+From abb85a9b512e8ca7ad04a5a8a6db9664fe644974 Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Wed, 7 Jun 2017 20:29:50 -0700
+Subject: iscsi-target: Reject immediate data underflow larger than SCSI transfer length
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit abb85a9b512e8ca7ad04a5a8a6db9664fe644974 upstream.
+
+When iscsi WRITE underflow occurs there are two different scenarios
+that can happen.
+
+Normally in practice, when an EDTL vs. SCSI CDB TRANSFER LENGTH
+underflow is detected, the iscsi immediate data payload is the
+smaller SCSI CDB TRANSFER LENGTH.
+
+That is, when a host fabric LLD is using a fixed size EDTL for
+a specific control CDB, the SCSI CDB TRANSFER LENGTH and actual
+SCSI payload ends up being smaller than EDTL. In iscsi, this
+means the received iscsi immediate data payload matches the
+smaller SCSI CDB TRANSFER LENGTH, because there is no more
+SCSI payload to accept beyond SCSI CDB TRANSFER LENGTH.
+
+However, it's possible for a malicous host to send a WRITE
+underflow where EDTL is larger than SCSI CDB TRANSFER LENGTH,
+but incoming iscsi immediate data actually matches EDTL.
+
+In the wild, we've never had a iscsi host environment actually
+try to do this.
+
+For this special case, it's wrong to truncate part of the
+control CDB payload and continue to process the command during
+underflow when immediate data payload received was larger than
+SCSI CDB TRANSFER LENGTH, so go ahead and reject and drop the
+bogus payload as a defensive action.
+
+Note this potential bug was originally relaxed by the following
+for allowing WRITE underflow in MSFT FCP host environments:
+
+ commit c72c5250224d475614a00c1d7e54a67f77cd3410
+ Author: Roland Dreier <roland@purestorage.com>
+ Date: Wed Jul 22 15:08:18 2015 -0700
+
+ target: allow underflow/overflow for PR OUT etc. commands
+
+Cc: Roland Dreier <roland@purestorage.com>
+Cc: Mike Christie <mchristi@redhat.com>
+Cc: Hannes Reinecke <hare@suse.de>
+Cc: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/iscsi/iscsi_target.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -1112,6 +1112,18 @@ iscsit_get_immediate_data(struct iscsi_c
+ */
+ if (dump_payload)
+ goto after_immediate_data;
++ /*
++ * Check for underflow case where both EDTL and immediate data payload
++ * exceeds what is presented by CDB's TRANSFER LENGTH, and what has
++ * already been set in target_cmd_size_check() as se_cmd->data_length.
++ *
++ * For this special case, fail the command and dump the immediate data
++ * payload.
++ */
++ if (cmd->first_burst_len > cmd->se_cmd.data_length) {
++ cmd->sense_reason = TCM_INVALID_CDB_FIELD;
++ goto after_immediate_data;
++ }
+
+ immed_ret = iscsit_handle_immediate_data(cmd, hdr,
+ cmd->first_burst_len);
powerpc-kprobes-pause-function_graph-tracing-during-jprobes-handling.patch
input-i8042-add-fujitsu-lifebook-ah544-to-notimeout-list.patch
time-fix-clock-read-clock-race-around-clocksource-changes.patch
+target-fix-kref-refcount-underflow-in-transport_cmd_finish_abort.patch
+iscsi-target-reject-immediate-data-underflow-larger-than-scsi-transfer-length.patch
+drm-radeon-add-a-px-quirk-for-another-k53tk-variant.patch
+drm-radeon-add-a-quirk-for-toshiba-satellite-l20-183.patch
+drm-amdgpu-atom-fix-ps-allocation-size-for-enabledisppowergating.patch
+drm-amdgpu-adjust-default-display-clock.patch
--- /dev/null
+From 73d4e580ccc5c3e05cea002f18111f66c9c07034 Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Fri, 2 Jun 2017 20:00:17 -0700
+Subject: target: Fix kref->refcount underflow in transport_cmd_finish_abort
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit 73d4e580ccc5c3e05cea002f18111f66c9c07034 upstream.
+
+This patch fixes a se_cmd->cmd_kref underflow during CMD_T_ABORTED
+when a fabric driver drops it's second reference from below the
+target_core_tmr.c based callers of transport_cmd_finish_abort().
+
+Recently with the conversion of kref to refcount_t, this bug was
+manifesting itself as:
+
+[705519.601034] refcount_t: underflow; use-after-free.
+[705519.604034] INFO: NMI handler (kgdb_nmi_handler) took too long to run: 20116.512 msecs
+[705539.719111] ------------[ cut here ]------------
+[705539.719117] WARNING: CPU: 3 PID: 26510 at lib/refcount.c:184 refcount_sub_and_test+0x33/0x51
+
+Since the original kref atomic_t based kref_put() didn't check for
+underflow and only invoked the final callback when zero was reached,
+this bug did not manifest in practice since all se_cmd memory is
+using preallocated tags.
+
+To address this, go ahead and propigate the existing return from
+transport_put_cmd() up via transport_cmd_finish_abort(), and
+change transport_cmd_finish_abort() + core_tmr_handle_tas_abort()
+callers to only do their local target_put_sess_cmd() if necessary.
+
+Reported-by: Bart Van Assche <bart.vanassche@sandisk.com>
+Tested-by: Bart Van Assche <bart.vanassche@sandisk.com>
+Cc: Mike Christie <mchristi@redhat.com>
+Cc: Hannes Reinecke <hare@suse.de>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Himanshu Madhani <himanshu.madhani@qlogic.com>
+Cc: Sagi Grimberg <sagig@mellanox.com>
+Tested-by: Gary Guo <ghg@datera.io>
+Tested-by: Chu Yuan Lin <cyl@datera.io>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_internal.h | 2 +-
+ drivers/target/target_core_tmr.c | 16 ++++++++--------
+ drivers/target/target_core_transport.c | 9 ++++++---
+ 3 files changed, 15 insertions(+), 12 deletions(-)
+
+--- a/drivers/target/target_core_internal.h
++++ b/drivers/target/target_core_internal.h
+@@ -132,7 +132,7 @@ int init_se_kmem_caches(void);
+ void release_se_kmem_caches(void);
+ u32 scsi_get_new_index(scsi_index_t);
+ void transport_subsystem_check_init(void);
+-void transport_cmd_finish_abort(struct se_cmd *, int);
++int transport_cmd_finish_abort(struct se_cmd *, int);
+ unsigned char *transport_dump_cmd_direction(struct se_cmd *);
+ void transport_dump_dev_state(struct se_device *, char *, int *);
+ void transport_dump_dev_info(struct se_device *, struct se_lun *,
+--- a/drivers/target/target_core_tmr.c
++++ b/drivers/target/target_core_tmr.c
+@@ -75,7 +75,7 @@ void core_tmr_release_req(struct se_tmr_
+ kfree(tmr);
+ }
+
+-static void core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas)
++static int core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas)
+ {
+ unsigned long flags;
+ bool remove = true, send_tas;
+@@ -91,7 +91,7 @@ static void core_tmr_handle_tas_abort(st
+ transport_send_task_abort(cmd);
+ }
+
+- transport_cmd_finish_abort(cmd, remove);
++ return transport_cmd_finish_abort(cmd, remove);
+ }
+
+ static int target_check_cdb_and_preempt(struct list_head *list,
+@@ -185,8 +185,8 @@ void core_tmr_abort_task(
+ cancel_work_sync(&se_cmd->work);
+ transport_wait_for_tasks(se_cmd);
+
+- transport_cmd_finish_abort(se_cmd, true);
+- target_put_sess_cmd(se_cmd);
++ if (!transport_cmd_finish_abort(se_cmd, true))
++ target_put_sess_cmd(se_cmd);
+
+ printk("ABORT_TASK: Sending TMR_FUNCTION_COMPLETE for"
+ " ref_tag: %llu\n", ref_tag);
+@@ -286,8 +286,8 @@ static void core_tmr_drain_tmr_list(
+ cancel_work_sync(&cmd->work);
+ transport_wait_for_tasks(cmd);
+
+- transport_cmd_finish_abort(cmd, 1);
+- target_put_sess_cmd(cmd);
++ if (!transport_cmd_finish_abort(cmd, 1))
++ target_put_sess_cmd(cmd);
+ }
+ }
+
+@@ -385,8 +385,8 @@ static void core_tmr_drain_state_list(
+ cancel_work_sync(&cmd->work);
+ transport_wait_for_tasks(cmd);
+
+- core_tmr_handle_tas_abort(cmd, tas);
+- target_put_sess_cmd(cmd);
++ if (!core_tmr_handle_tas_abort(cmd, tas))
++ target_put_sess_cmd(cmd);
+ }
+ }
+
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -639,9 +639,10 @@ static void transport_lun_remove_cmd(str
+ percpu_ref_put(&lun->lun_ref);
+ }
+
+-void transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
++int transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
+ {
+ bool ack_kref = (cmd->se_cmd_flags & SCF_ACK_KREF);
++ int ret = 0;
+
+ if (cmd->se_cmd_flags & SCF_SE_LUN_CMD)
+ transport_lun_remove_cmd(cmd);
+@@ -653,9 +654,11 @@ void transport_cmd_finish_abort(struct s
+ cmd->se_tfo->aborted_task(cmd);
+
+ if (transport_cmd_check_stop_to_fabric(cmd))
+- return;
++ return 1;
+ if (remove && ack_kref)
+- transport_put_cmd(cmd);
++ ret = transport_put_cmd(cmd);
++
++ return ret;
+ }
+
+ static void target_complete_failure_work(struct work_struct *work)
projects / thirdparty / kernel / stable-queue.git / commitdiff
