--- /dev/null
+From 4283908ef7f11a72c3b80dd4cf026f1a86429f82 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Fri, 14 Dec 2012 23:38:28 +0100
+Subject: drm/i915: Implement WaDisableHiZPlanesWhenMSAAEnabled
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+commit 4283908ef7f11a72c3b80dd4cf026f1a86429f82 upstream.
+
+Quoting from Bspec, 3D_CHICKEN1, bit 10
+
+This bit needs to be set always to "1", Project: DevSNB "
+
+Reviewed-by: Rodrigo Vivi <rodrigo.vivi@gmail.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_reg.h | 1 +
+ drivers/gpu/drm/i915/intel_pm.c | 4 ++++
+ 2 files changed, 5 insertions(+)
+
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -514,6 +514,7 @@
+ * the enables for writing to the corresponding low bit.
+ */
+ #define _3D_CHICKEN 0x02084
++#define _3D_CHICKEN_HIZ_PLANE_DISABLE_MSAA_4X_SNB (1 << 10)
+ #define _3D_CHICKEN2 0x0208c
+ /* Disables pipelining of read flushes past the SF-WIZ interface.
+ * Required on all Ironlake steppings according to the B-Spec, but the
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -3412,6 +3412,10 @@ static void gen6_init_clock_gating(struc
+ I915_READ(ILK_DISPLAY_CHICKEN2) |
+ ILK_ELPIN_409_SELECT);
+
++ /* WaDisableHiZPlanesWhenMSAAEnabled */
++ I915_WRITE(_3D_CHICKEN,
++ _MASKED_BIT_ENABLE(_3D_CHICKEN_HIZ_PLANE_DISABLE_MSAA_4X_SNB));
++
+ I915_WRITE(WM3_LP_ILK, 0);
+ I915_WRITE(WM2_LP_ILK, 0);
+ I915_WRITE(WM1_LP_ILK, 0);
--- /dev/null
+From 0d21b0e3477395e7ff2acc269f15df6e6a8d356d Mon Sep 17 00:00:00 2001
+From: Rusty Russell <rusty@rustcorp.com.au>
+Date: Sat, 12 Jan 2013 11:38:44 +1030
+Subject: module: add new state MODULE_STATE_UNFORMED.
+
+From: Rusty Russell <rusty@rustcorp.com.au>
+
+commit 0d21b0e3477395e7ff2acc269f15df6e6a8d356d upstream.
+
+You should never look at such a module, so it's excised from all paths
+which traverse the modules list.
+
+We add the state at the end, to avoid gratuitous ABI break (ksplice).
+
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/module.h | 10 +++----
+ kernel/debug/kdb/kdb_main.c | 2 +
+ kernel/module.c | 57 ++++++++++++++++++++++++++++++++++++++++----
+ 3 files changed, 59 insertions(+), 10 deletions(-)
+
+--- a/include/linux/module.h
++++ b/include/linux/module.h
+@@ -199,11 +199,11 @@ struct module_use {
+ struct module *source, *target;
+ };
+
+-enum module_state
+-{
+- MODULE_STATE_LIVE,
+- MODULE_STATE_COMING,
+- MODULE_STATE_GOING,
++enum module_state {
++ MODULE_STATE_LIVE, /* Normal state. */
++ MODULE_STATE_COMING, /* Full formed, running module_init. */
++ MODULE_STATE_GOING, /* Going away. */
++ MODULE_STATE_UNFORMED, /* Still setting it up. */
+ };
+
+ /**
+--- a/kernel/debug/kdb/kdb_main.c
++++ b/kernel/debug/kdb/kdb_main.c
+@@ -1970,6 +1970,8 @@ static int kdb_lsmod(int argc, const cha
+
+ kdb_printf("Module Size modstruct Used by\n");
+ list_for_each_entry(mod, kdb_modules, list) {
++ if (mod->state == MODULE_STATE_UNFORMED)
++ continue;
+
+ kdb_printf("%-20s%8u 0x%p ", mod->name,
+ mod->core_size, (void *)mod);
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -185,6 +185,7 @@ struct load_info {
+ ongoing or failed initialization etc. */
+ static inline int strong_try_module_get(struct module *mod)
+ {
++ BUG_ON(mod && mod->state == MODULE_STATE_UNFORMED);
+ if (mod && mod->state == MODULE_STATE_COMING)
+ return -EBUSY;
+ if (try_module_get(mod))
+@@ -340,6 +341,9 @@ bool each_symbol_section(bool (*fn)(cons
+ #endif
+ };
+
++ if (mod->state == MODULE_STATE_UNFORMED)
++ continue;
++
+ if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
+ return true;
+ }
+@@ -450,16 +454,24 @@ const struct kernel_symbol *find_symbol(
+ EXPORT_SYMBOL_GPL(find_symbol);
+
+ /* Search for module by name: must hold module_mutex. */
+-struct module *find_module(const char *name)
++static struct module *find_module_all(const char *name,
++ bool even_unformed)
+ {
+ struct module *mod;
+
+ list_for_each_entry(mod, &modules, list) {
++ if (!even_unformed && mod->state == MODULE_STATE_UNFORMED)
++ continue;
+ if (strcmp(mod->name, name) == 0)
+ return mod;
+ }
+ return NULL;
+ }
++
++struct module *find_module(const char *name)
++{
++ return find_module_all(name, false);
++}
+ EXPORT_SYMBOL_GPL(find_module);
+
+ #ifdef CONFIG_SMP
+@@ -525,6 +537,8 @@ bool is_module_percpu_address(unsigned l
+ preempt_disable();
+
+ list_for_each_entry_rcu(mod, &modules, list) {
++ if (mod->state == MODULE_STATE_UNFORMED)
++ continue;
+ if (!mod->percpu_size)
+ continue;
+ for_each_possible_cpu(cpu) {
+@@ -1048,6 +1062,8 @@ static ssize_t show_initstate(struct mod
+ case MODULE_STATE_GOING:
+ state = "going";
+ break;
++ default:
++ BUG();
+ }
+ return sprintf(buffer, "%s\n", state);
+ }
+@@ -1786,6 +1802,8 @@ void set_all_modules_text_rw(void)
+
+ mutex_lock(&module_mutex);
+ list_for_each_entry_rcu(mod, &modules, list) {
++ if (mod->state == MODULE_STATE_UNFORMED)
++ continue;
+ if ((mod->module_core) && (mod->core_text_size)) {
+ set_page_attributes(mod->module_core,
+ mod->module_core + mod->core_text_size,
+@@ -1807,6 +1825,8 @@ void set_all_modules_text_ro(void)
+
+ mutex_lock(&module_mutex);
+ list_for_each_entry_rcu(mod, &modules, list) {
++ if (mod->state == MODULE_STATE_UNFORMED)
++ continue;
+ if ((mod->module_core) && (mod->core_text_size)) {
+ set_page_attributes(mod->module_core,
+ mod->module_core + mod->core_text_size,
+@@ -2939,7 +2959,8 @@ static bool finished_loading(const char
+
+ mutex_lock(&module_mutex);
+ mod = find_module(name);
+- ret = !mod || mod->state != MODULE_STATE_COMING;
++ ret = !mod || mod->state == MODULE_STATE_LIVE
++ || mod->state == MODULE_STATE_GOING;
+ mutex_unlock(&module_mutex);
+
+ return ret;
+@@ -3264,6 +3285,8 @@ const char *module_address_lookup(unsign
+
+ preempt_disable();
+ list_for_each_entry_rcu(mod, &modules, list) {
++ if (mod->state == MODULE_STATE_UNFORMED)
++ continue;
+ if (within_module_init(addr, mod) ||
+ within_module_core(addr, mod)) {
+ if (modname)
+@@ -3287,6 +3310,8 @@ int lookup_module_symbol_name(unsigned l
+
+ preempt_disable();
+ list_for_each_entry_rcu(mod, &modules, list) {
++ if (mod->state == MODULE_STATE_UNFORMED)
++ continue;
+ if (within_module_init(addr, mod) ||
+ within_module_core(addr, mod)) {
+ const char *sym;
+@@ -3311,6 +3336,8 @@ int lookup_module_symbol_attrs(unsigned
+
+ preempt_disable();
+ list_for_each_entry_rcu(mod, &modules, list) {
++ if (mod->state == MODULE_STATE_UNFORMED)
++ continue;
+ if (within_module_init(addr, mod) ||
+ within_module_core(addr, mod)) {
+ const char *sym;
+@@ -3338,6 +3365,8 @@ int module_get_kallsym(unsigned int symn
+
+ preempt_disable();
+ list_for_each_entry_rcu(mod, &modules, list) {
++ if (mod->state == MODULE_STATE_UNFORMED)
++ continue;
+ if (symnum < mod->num_symtab) {
+ *value = mod->symtab[symnum].st_value;
+ *type = mod->symtab[symnum].st_info;
+@@ -3380,9 +3409,12 @@ unsigned long module_kallsyms_lookup_nam
+ ret = mod_find_symname(mod, colon+1);
+ *colon = ':';
+ } else {
+- list_for_each_entry_rcu(mod, &modules, list)
++ list_for_each_entry_rcu(mod, &modules, list) {
++ if (mod->state == MODULE_STATE_UNFORMED)
++ continue;
+ if ((ret = mod_find_symname(mod, name)) != 0)
+ break;
++ }
+ }
+ preempt_enable();
+ return ret;
+@@ -3397,6 +3429,8 @@ int module_kallsyms_on_each_symbol(int (
+ int ret;
+
+ list_for_each_entry(mod, &modules, list) {
++ if (mod->state == MODULE_STATE_UNFORMED)
++ continue;
+ for (i = 0; i < mod->num_symtab; i++) {
+ ret = fn(data, mod->strtab + mod->symtab[i].st_name,
+ mod, mod->symtab[i].st_value);
+@@ -3412,6 +3446,7 @@ static char *module_flags(struct module
+ {
+ int bx = 0;
+
++ BUG_ON(mod->state == MODULE_STATE_UNFORMED);
+ if (mod->taints ||
+ mod->state == MODULE_STATE_GOING ||
+ mod->state == MODULE_STATE_COMING) {
+@@ -3453,6 +3488,10 @@ static int m_show(struct seq_file *m, vo
+ struct module *mod = list_entry(p, struct module, list);
+ char buf[8];
+
++ /* We always ignore unformed modules. */
++ if (mod->state == MODULE_STATE_UNFORMED)
++ return 0;
++
+ seq_printf(m, "%s %u",
+ mod->name, mod->init_size + mod->core_size);
+ print_unload_info(m, mod);
+@@ -3513,6 +3552,8 @@ const struct exception_table_entry *sear
+
+ preempt_disable();
+ list_for_each_entry_rcu(mod, &modules, list) {
++ if (mod->state == MODULE_STATE_UNFORMED)
++ continue;
+ if (mod->num_exentries == 0)
+ continue;
+
+@@ -3561,10 +3602,13 @@ struct module *__module_address(unsigned
+ if (addr < module_addr_min || addr > module_addr_max)
+ return NULL;
+
+- list_for_each_entry_rcu(mod, &modules, list)
++ list_for_each_entry_rcu(mod, &modules, list) {
++ if (mod->state == MODULE_STATE_UNFORMED)
++ continue;
+ if (within_module_core(addr, mod)
+ || within_module_init(addr, mod))
+ return mod;
++ }
+ return NULL;
+ }
+ EXPORT_SYMBOL_GPL(__module_address);
+@@ -3617,8 +3661,11 @@ void print_modules(void)
+ printk(KERN_DEFAULT "Modules linked in:");
+ /* Most callers should already have preempt disabled, but make sure */
+ preempt_disable();
+- list_for_each_entry_rcu(mod, &modules, list)
++ list_for_each_entry_rcu(mod, &modules, list) {
++ if (mod->state == MODULE_STATE_UNFORMED)
++ continue;
+ printk(" %s%s", mod->name, module_flags(mod, buf));
++ }
+ preempt_enable();
+ if (last_unloaded_module[0])
+ printk(" [last unloaded: %s]", last_unloaded_module);
--- /dev/null
+From ee61abb3223e28a1a14a8429c0319755d20d3e40 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Sun, 20 Jan 2013 20:22:58 -0800
+Subject: module: fix missing module_mutex unlock
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit ee61abb3223e28a1a14a8429c0319755d20d3e40 upstream.
+
+Commit 1fb9341ac348 ("module: put modules in list much earlier") moved
+some of the module initialization code around, and in the process
+changed the exit paths too. But for the duplicate export symbol error
+case the change made the ddebug_cleanup path jump to after the module
+mutex unlock, even though it happens with the mutex held.
+
+Rusty has some patches to split this function up into some helper
+functions, hopefully the mess of complex goto targets will go away
+eventually.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/module.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -3100,8 +3100,8 @@ again:
+ /* module_bug_cleanup needs module_mutex protection */
+ mutex_lock(&module_mutex);
+ module_bug_cleanup(mod);
+- mutex_unlock(&module_mutex);
+ ddebug_cleanup:
++ mutex_unlock(&module_mutex);
+ dynamic_debug_remove(info.debug);
+ synchronize_sched();
+ kfree(mod->args);
--- /dev/null
+From 1fb9341ac34825aa40354e74d9a2c69df7d2c304 Mon Sep 17 00:00:00 2001
+From: Rusty Russell <rusty@rustcorp.com.au>
+Date: Sat, 12 Jan 2013 13:27:34 +1030
+Subject: module: put modules in list much earlier.
+
+From: Rusty Russell <rusty@rustcorp.com.au>
+
+commit 1fb9341ac34825aa40354e74d9a2c69df7d2c304 upstream.
+
+Prarit's excellent bug report:
+> In recent Fedora releases (F17 & F18) some users have reported seeing
+> messages similar to
+>
+> [ 15.478160] kvm: Could not allocate 304 bytes percpu data
+> [ 15.478174] PERCPU: allocation failed, size=304 align=32, alloc from
+> reserved chunk failed
+>
+> during system boot. In some cases, users have also reported seeing this
+> message along with a failed load of other modules.
+>
+> What is happening is systemd is loading an instance of the kvm module for
+> each cpu found (see commit e9bda3b). When the module load occurs the kernel
+> currently allocates the modules percpu data area prior to checking to see
+> if the module is already loaded or is in the process of being loaded. If
+> the module is already loaded, or finishes load, the module loading code
+> releases the current instance's module's percpu data.
+
+Now we have a new state MODULE_STATE_UNFORMED, we can insert the
+module into the list (and thus guarantee its uniqueness) before we
+allocate the per-cpu region.
+
+Reported-by: Prarit Bhargava <prarit@redhat.com>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Tested-by: Prarit Bhargava <prarit@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/module.c | 90 ++++++++++++++++++++++++++++++--------------------------
+ lib/bug.c | 1
+ 2 files changed, 50 insertions(+), 41 deletions(-)
+
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -2958,7 +2958,7 @@ static bool finished_loading(const char
+ bool ret;
+
+ mutex_lock(&module_mutex);
+- mod = find_module(name);
++ mod = find_module_all(name, true);
+ ret = !mod || mod->state == MODULE_STATE_LIVE
+ || mod->state == MODULE_STATE_GOING;
+ mutex_unlock(&module_mutex);
+@@ -2991,6 +2991,32 @@ static struct module *load_module(void _
+ goto free_copy;
+ }
+
++ /*
++ * We try to place it in the list now to make sure it's unique
++ * before we dedicate too many resources. In particular,
++ * temporary percpu memory exhaustion.
++ */
++ mod->state = MODULE_STATE_UNFORMED;
++again:
++ mutex_lock(&module_mutex);
++ if ((old = find_module_all(mod->name, true)) != NULL) {
++ if (old->state == MODULE_STATE_COMING
++ || old->state == MODULE_STATE_UNFORMED) {
++ /* Wait in case it fails to load. */
++ mutex_unlock(&module_mutex);
++ err = wait_event_interruptible(module_wq,
++ finished_loading(mod->name));
++ if (err)
++ goto free_module;
++ goto again;
++ }
++ err = -EEXIST;
++ mutex_unlock(&module_mutex);
++ goto free_module;
++ }
++ list_add_rcu(&mod->list, &modules);
++ mutex_unlock(&module_mutex);
++
+ #ifdef CONFIG_MODULE_SIG
+ mod->sig_ok = info.sig_ok;
+ if (!mod->sig_ok)
+@@ -3000,7 +3026,7 @@ static struct module *load_module(void _
+ /* Now module is in final location, initialize linked lists, etc. */
+ err = module_unload_init(mod);
+ if (err)
+- goto free_module;
++ goto unlink_mod;
+
+ /* Now we've got everything in the final locations, we can
+ * find optional sections. */
+@@ -3035,54 +3061,33 @@ static struct module *load_module(void _
+ goto free_arch_cleanup;
+ }
+
+- /* Mark state as coming so strong_try_module_get() ignores us. */
+- mod->state = MODULE_STATE_COMING;
+-
+- /* Now sew it into the lists so we can get lockdep and oops
+- * info during argument parsing. No one should access us, since
+- * strong_try_module_get() will fail.
+- * lockdep/oops can run asynchronous, so use the RCU list insertion
+- * function to insert in a way safe to concurrent readers.
+- * The mutex protects against concurrent writers.
+- */
+-again:
+- mutex_lock(&module_mutex);
+- if ((old = find_module(mod->name)) != NULL) {
+- if (old->state == MODULE_STATE_COMING) {
+- /* Wait in case it fails to load. */
+- mutex_unlock(&module_mutex);
+- err = wait_event_interruptible(module_wq,
+- finished_loading(mod->name));
+- if (err)
+- goto free_arch_cleanup;
+- goto again;
+- }
+- err = -EEXIST;
+- goto unlock;
+- }
+-
+- /* This has to be done once we're sure module name is unique. */
+ dynamic_debug_setup(info.debug, info.num_debug);
+
+- /* Find duplicate symbols */
++ mutex_lock(&module_mutex);
++ /* Find duplicate symbols (must be called under lock). */
+ err = verify_export_symbols(mod);
+ if (err < 0)
+- goto ddebug;
++ goto ddebug_cleanup;
+
++ /* This relies on module_mutex for list integrity. */
+ module_bug_finalize(info.hdr, info.sechdrs, mod);
+- list_add_rcu(&mod->list, &modules);
++
++ /* Mark state as coming so strong_try_module_get() ignores us,
++ * but kallsyms etc. can see us. */
++ mod->state = MODULE_STATE_COMING;
++
+ mutex_unlock(&module_mutex);
+
+ /* Module is ready to execute: parsing args may do that. */
+ err = parse_args(mod->name, mod->args, mod->kp, mod->num_kp,
+ -32768, 32767, &ddebug_dyndbg_module_param_cb);
+ if (err < 0)
+- goto unlink;
++ goto bug_cleanup;
+
+ /* Link in to syfs. */
+ err = mod_sysfs_setup(mod, &info, mod->kp, mod->num_kp);
+ if (err < 0)
+- goto unlink;
++ goto bug_cleanup;
+
+ /* Get rid of temporary copy. */
+ free_copy(&info);
+@@ -3091,16 +3096,13 @@ again:
+ trace_module_load(mod);
+ return mod;
+
+- unlink:
++ bug_cleanup:
++ /* module_bug_cleanup needs module_mutex protection */
+ mutex_lock(&module_mutex);
+- /* Unlink carefully: kallsyms could be walking list. */
+- list_del_rcu(&mod->list);
+ module_bug_cleanup(mod);
+- wake_up_all(&module_wq);
+- ddebug:
+- dynamic_debug_remove(info.debug);
+- unlock:
+ mutex_unlock(&module_mutex);
++ ddebug_cleanup:
++ dynamic_debug_remove(info.debug);
+ synchronize_sched();
+ kfree(mod->args);
+ free_arch_cleanup:
+@@ -3109,6 +3111,12 @@ again:
+ free_modinfo(mod);
+ free_unload:
+ module_unload_free(mod);
++ unlink_mod:
++ mutex_lock(&module_mutex);
++ /* Unlink carefully: kallsyms could be walking list. */
++ list_del_rcu(&mod->list);
++ wake_up_all(&module_wq);
++ mutex_unlock(&module_mutex);
+ free_module:
+ module_deallocate(mod, &info);
+ free_copy:
+--- a/lib/bug.c
++++ b/lib/bug.c
+@@ -55,6 +55,7 @@ static inline unsigned long bug_addr(con
+ }
+
+ #ifdef CONFIG_MODULES
++/* Updates are protected by module mutex */
+ static LIST_HEAD(module_bug_list);
+
+ static const struct bug_entry *module_find_bug(unsigned long bugaddr)
scsi-sd-reshuffle-init_sd-to-avoid-crash.patch
drivers-firmware-dmi_scan.c-check-dmi-version-when-get.patch
drivers-firmware-dmi_scan.c-fetch-dmi-version-from-smbios-if-it-exists.patch
+drm-i915-implement-wadisablehizplaneswhenmsaaenabled.patch
+module-add-new-state-module_state_unformed.patch
+module-put-modules-in-list-much-earlier.patch
+module-fix-missing-module_mutex-unlock.patch