From aa24fd77d2e9ec459de9406c904bfddda72ba1e6 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Jul 27 2016 18:37:12 +0000 Subject: Linux v4.6.5 --- diff --git a/0001-drm-mgag200-Black-screen-fix-for-G200e-rev-4.patch b/0001-drm-mgag200-Black-screen-fix-for-G200e-rev-4.patch deleted file mode 100644 index e583d09..0000000 --- a/0001-drm-mgag200-Black-screen-fix-for-G200e-rev-4.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 1e5895f2c6068fb9ae5356e3a751a29a22af5f01 Mon Sep 17 00:00:00 2001 -From: Fedora Kernel Team -Date: Mon, 20 Jun 2016 14:53:03 +0200 -Subject: [PATCH 1/6] drm/mgag200: Black screen fix for G200e rev 4 - -Upstream: since drm-fixes-for-v4.7 -commit d3922b69617b62bb2509936b68301f837229d9f0 - -Author: Mathieu Larouche -AuthorDate: Fri May 27 15:12:50 2016 -0400 -Commit: Dave Airlie -CommitDate: Wed Jun 1 15:25:04 2016 +1000 - - drm/mgag200: Black screen fix for G200e rev 4 - - - Fixed black screen for some resolutions of G200e rev4 - - Fixed testm & testn which had predetermined value. - - Reported-by: Jan Beulich - - Signed-off-by: Mathieu Larouche - Cc: stable@vger.kernel.org - Signed-off-by: Dave Airlie ---- - drivers/gpu/drm/mgag200/mgag200_mode.c | 10 +++++++++- - 1 file changed, 9 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c -index 14e64e0..d347dca 100644 ---- a/drivers/gpu/drm/mgag200/mgag200_mode.c -+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c -@@ -182,7 +182,7 @@ static int mga_g200se_set_plls(struct mga_device *mdev, long clock) - } - } - -- fvv = pllreffreq * testn / testm; -+ fvv = pllreffreq * (n + 1) / (m + 1); - fvv = (fvv - 800000) / 50000; - - if (fvv > 15) -@@ -202,6 +202,14 @@ static int mga_g200se_set_plls(struct mga_device *mdev, long clock) - WREG_DAC(MGA1064_PIX_PLLC_M, m); - WREG_DAC(MGA1064_PIX_PLLC_N, n); - WREG_DAC(MGA1064_PIX_PLLC_P, p); -+ -+ if (mdev->unique_rev_id >= 0x04) { -+ WREG_DAC(0x1a, 0x09); -+ msleep(20); -+ WREG_DAC(0x1a, 0x01); -+ -+ } -+ - return 0; - } - --- -2.7.4 - diff --git a/0002-drm-nouveau-fbcon-fix-out-of-bounds-memory-accesses.patch b/0002-drm-nouveau-fbcon-fix-out-of-bounds-memory-accesses.patch deleted file mode 100644 index d1c32b4..0000000 --- a/0002-drm-nouveau-fbcon-fix-out-of-bounds-memory-accesses.patch +++ /dev/null @@ -1,138 +0,0 @@ -From 02510a8805db2c3f8ca2926f90c4b3793934404a Mon Sep 17 00:00:00 2001 -From: Fedora Kernel Team -Date: Mon, 20 Jun 2016 14:51:45 +0200 -Subject: [PATCH 2/6] drm/nouveau/fbcon: fix out-of-bounds memory accesses - -Upstream: drm-fixes for 4.7 (and cc'd 4.6-stable) -commit f045f459d925138fe7d6193a8c86406bda7e49da - -Author: Ben Skeggs -AuthorDate: Thu Jun 2 12:23:31 2016 +1000 -Commit: Ben Skeggs -CommitDate: Thu Jun 2 13:53:44 2016 +1000 - - drm/nouveau/fbcon: fix out-of-bounds memory accesses - - Reported by KASAN. - - Signed-off-by: Ben Skeggs - Cc: stable@vger.kernel.org ---- - drivers/gpu/drm/nouveau/nouveau_fbcon.c | 1 + - drivers/gpu/drm/nouveau/nv04_fbcon.c | 7 ++----- - drivers/gpu/drm/nouveau/nv50_fbcon.c | 6 ++---- - drivers/gpu/drm/nouveau/nvc0_fbcon.c | 6 ++---- - 4 files changed, 7 insertions(+), 13 deletions(-) - -diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c -index 59f27e7..bd89c86 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c -+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c -@@ -557,6 +557,7 @@ nouveau_fbcon_init(struct drm_device *dev) - if (ret) - goto fini; - -+ fbcon->helper.fbdev->pixmap.buf_align = 4; - return 0; - - fini: -diff --git a/drivers/gpu/drm/nouveau/nv04_fbcon.c b/drivers/gpu/drm/nouveau/nv04_fbcon.c -index 789dc29..8f715fe 100644 ---- a/drivers/gpu/drm/nouveau/nv04_fbcon.c -+++ b/drivers/gpu/drm/nouveau/nv04_fbcon.c -@@ -82,7 +82,6 @@ nv04_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) - uint32_t fg; - uint32_t bg; - uint32_t dsize; -- uint32_t width; - uint32_t *data = (uint32_t *)image->data; - int ret; - -@@ -93,9 +92,6 @@ nv04_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) - if (ret) - return ret; - -- width = ALIGN(image->width, 8); -- dsize = ALIGN(width * image->height, 32) >> 5; -- - if (info->fix.visual == FB_VISUAL_TRUECOLOR || - info->fix.visual == FB_VISUAL_DIRECTCOLOR) { - fg = ((uint32_t *) info->pseudo_palette)[image->fg_color]; -@@ -111,10 +107,11 @@ nv04_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) - ((image->dx + image->width) & 0xffff)); - OUT_RING(chan, bg); - OUT_RING(chan, fg); -- OUT_RING(chan, (image->height << 16) | width); -+ OUT_RING(chan, (image->height << 16) | image->width); - OUT_RING(chan, (image->height << 16) | image->width); - OUT_RING(chan, (image->dy << 16) | (image->dx & 0xffff)); - -+ dsize = ALIGN(image->width * image->height, 32) >> 5; - while (dsize) { - int iter_len = dsize > 128 ? 128 : dsize; - -diff --git a/drivers/gpu/drm/nouveau/nv50_fbcon.c b/drivers/gpu/drm/nouveau/nv50_fbcon.c -index e05499d..a4e259a 100644 ---- a/drivers/gpu/drm/nouveau/nv50_fbcon.c -+++ b/drivers/gpu/drm/nouveau/nv50_fbcon.c -@@ -95,7 +95,7 @@ nv50_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) - struct nouveau_fbdev *nfbdev = info->par; - struct nouveau_drm *drm = nouveau_drm(nfbdev->dev); - struct nouveau_channel *chan = drm->channel; -- uint32_t width, dwords, *data = (uint32_t *)image->data; -+ uint32_t dwords, *data = (uint32_t *)image->data; - uint32_t mask = ~(~0 >> (32 - info->var.bits_per_pixel)); - uint32_t *palette = info->pseudo_palette; - int ret; -@@ -107,9 +107,6 @@ nv50_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) - if (ret) - return ret; - -- width = ALIGN(image->width, 32); -- dwords = (width * image->height) >> 5; -- - BEGIN_NV04(chan, NvSub2D, 0x0814, 2); - if (info->fix.visual == FB_VISUAL_TRUECOLOR || - info->fix.visual == FB_VISUAL_DIRECTCOLOR) { -@@ -128,6 +125,7 @@ nv50_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) - OUT_RING(chan, 0); - OUT_RING(chan, image->dy); - -+ dwords = ALIGN(image->width * image->height, 32) >> 5; - while (dwords) { - int push = dwords > 2047 ? 2047 : dwords; - -diff --git a/drivers/gpu/drm/nouveau/nvc0_fbcon.c b/drivers/gpu/drm/nouveau/nvc0_fbcon.c -index c97395b..f28315e 100644 ---- a/drivers/gpu/drm/nouveau/nvc0_fbcon.c -+++ b/drivers/gpu/drm/nouveau/nvc0_fbcon.c -@@ -95,7 +95,7 @@ nvc0_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) - struct nouveau_fbdev *nfbdev = info->par; - struct nouveau_drm *drm = nouveau_drm(nfbdev->dev); - struct nouveau_channel *chan = drm->channel; -- uint32_t width, dwords, *data = (uint32_t *)image->data; -+ uint32_t dwords, *data = (uint32_t *)image->data; - uint32_t mask = ~(~0 >> (32 - info->var.bits_per_pixel)); - uint32_t *palette = info->pseudo_palette; - int ret; -@@ -107,9 +107,6 @@ nvc0_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) - if (ret) - return ret; - -- width = ALIGN(image->width, 32); -- dwords = (width * image->height) >> 5; -- - BEGIN_NVC0(chan, NvSub2D, 0x0814, 2); - if (info->fix.visual == FB_VISUAL_TRUECOLOR || - info->fix.visual == FB_VISUAL_DIRECTCOLOR) { -@@ -128,6 +125,7 @@ nvc0_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) - OUT_RING (chan, 0); - OUT_RING (chan, image->dy); - -+ dwords = ALIGN(image->width * image->height, 32) >> 5; - while (dwords) { - int push = dwords > 2047 ? 2047 : dwords; - --- -2.7.4 - diff --git a/0003-drm-nouveau-disp-sor-gf119-both-links-use-the-same-t.patch b/0003-drm-nouveau-disp-sor-gf119-both-links-use-the-same-t.patch deleted file mode 100644 index b93bdff..0000000 --- a/0003-drm-nouveau-disp-sor-gf119-both-links-use-the-same-t.patch +++ /dev/null @@ -1,46 +0,0 @@ -From de35f524e89daf8862d49724b9045f9254bfdfea Mon Sep 17 00:00:00 2001 -From: Fedora Kernel Team -Date: Mon, 20 Jun 2016 14:52:01 +0200 -Subject: [PATCH 3/6] drm/nouveau/disp/sor/gf119: both links use the same - training register - -Upstream: drm-fixes for 4.7 (and cc'd 4.6-stable) -commit a8953c52b95167b5d21a66f0859751570271d834 - -Author: Ben Skeggs -AuthorDate: Fri Jun 3 14:37:40 2016 +1000 -Commit: Ben Skeggs -CommitDate: Tue Jun 7 08:11:14 2016 +1000 - - drm/nouveau/disp/sor/gf119: both links use the same training register - - It appears that, for whatever reason, both link A and B use the same - register to control the training pattern. It's a little odd, as the - GPUs before this (Tesla/Fermi1) have per-link registers, as do newer - GPUs (Maxwell). - - Fixes the third DP output on NVS 510 (GK107). - - Signed-off-by: Ben Skeggs - Cc: stable@vger.kernel.org ---- - drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c -index b4b41b1..5111560 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c -@@ -40,8 +40,7 @@ static int - gf119_sor_dp_pattern(struct nvkm_output_dp *outp, int pattern) - { - struct nvkm_device *device = outp->base.disp->engine.subdev.device; -- const u32 loff = gf119_sor_loff(outp); -- nvkm_mask(device, 0x61c110 + loff, 0x0f0f0f0f, 0x01010101 * pattern); -+ nvkm_mask(device, 0x61c110, 0x0f0f0f0f, 0x01010101 * pattern); - return 0; - } - --- -2.7.4 - diff --git a/0004-drm-nouveau-disp-sor-gm107-training-pattern-register.patch b/0004-drm-nouveau-disp-sor-gm107-training-pattern-register.patch deleted file mode 100644 index a0b6171..0000000 --- a/0004-drm-nouveau-disp-sor-gm107-training-pattern-register.patch +++ /dev/null @@ -1,195 +0,0 @@ -From eb4668302adce316f53896b0fd8144ffe380a3ad Mon Sep 17 00:00:00 2001 -From: Fedora Kernel Team -Date: Mon, 20 Jun 2016 14:52:06 +0200 -Subject: [PATCH 4/6] drm/nouveau/disp/sor/gm107: training pattern registers - are like gm200 - -Upstream: drm-fixes for 4.7 (and cc'd 4.6-stable) -commit 4691409b3e2250ed66aa8dcefa23fe765daf7add - -Author: Ben Skeggs -AuthorDate: Fri Jun 3 15:05:52 2016 +1000 -Commit: Ben Skeggs -CommitDate: Tue Jun 7 08:11:25 2016 +1000 - - drm/nouveau/disp/sor/gm107: training pattern registers are like gm200 - - Signed-off-by: Ben Skeggs - Cc: stable@vger.kernel.org ---- - drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild | 1 + - drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c | 2 +- - drivers/gpu/drm/nouveau/nvkm/engine/disp/outpdp.h | 9 +++- - .../gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c | 2 +- - .../nvkm/engine/disp/{gm107.c => sorgm107.c} | 50 +++++++++++----------- - .../gpu/drm/nouveau/nvkm/engine/disp/sorgm200.c | 15 +------ - 6 files changed, 36 insertions(+), 43 deletions(-) - copy drivers/gpu/drm/nouveau/nvkm/engine/disp/{gm107.c => sorgm107.c} (55%) - -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild b/drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild -index a74c5dd..e2a64ed 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild -@@ -18,6 +18,7 @@ nvkm-y += nvkm/engine/disp/piornv50.o - nvkm-y += nvkm/engine/disp/sornv50.o - nvkm-y += nvkm/engine/disp/sorg94.o - nvkm-y += nvkm/engine/disp/sorgf119.o -+nvkm-y += nvkm/engine/disp/sorgm107.o - nvkm-y += nvkm/engine/disp/sorgm200.o - nvkm-y += nvkm/engine/disp/dport.o - -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c -index b694414..f4b9cf8 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c -@@ -36,7 +36,7 @@ gm107_disp = { - .outp.internal.crt = nv50_dac_output_new, - .outp.internal.tmds = nv50_sor_output_new, - .outp.internal.lvds = nv50_sor_output_new, -- .outp.internal.dp = gf119_sor_dp_new, -+ .outp.internal.dp = gm107_sor_dp_new, - .dac.nr = 3, - .dac.power = nv50_dac_power, - .dac.sense = nv50_dac_sense, -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outpdp.h b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outpdp.h -index e9067ba..4e983f6 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outpdp.h -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outpdp.h -@@ -62,7 +62,12 @@ int g94_sor_dp_lnk_pwr(struct nvkm_output_dp *, int); - int gf119_sor_dp_new(struct nvkm_disp *, int, struct dcb_output *, - struct nvkm_output **); - int gf119_sor_dp_lnk_ctl(struct nvkm_output_dp *, int, int, bool); -+int gf119_sor_dp_drv_ctl(struct nvkm_output_dp *, int, int, int, int); - --int gm200_sor_dp_new(struct nvkm_disp *, int, struct dcb_output *, -- struct nvkm_output **); -+int gm107_sor_dp_new(struct nvkm_disp *, int, struct dcb_output *, -+ struct nvkm_output **); -+int gm107_sor_dp_pattern(struct nvkm_output_dp *, int); -+ -+int gm200_sor_dp_new(struct nvkm_disp *, int, struct dcb_output *, -+ struct nvkm_output **); - #endif -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c -index 5111560..22706c0 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c -@@ -63,7 +63,7 @@ gf119_sor_dp_lnk_ctl(struct nvkm_output_dp *outp, int nr, int bw, bool ef) - return 0; - } - --static int -+int - gf119_sor_dp_drv_ctl(struct nvkm_output_dp *outp, - int ln, int vs, int pe, int pc) - { -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm107.c -similarity index 55% -copy from drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c -copy to drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm107.c -index b694414..37790b2 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm107.c -@@ -1,5 +1,5 @@ - /* -- * Copyright 2012 Red Hat Inc. -+ * Copyright 2016 Red Hat Inc. - * - * Permission is hereby granted, free of charge, to any person obtaining a - * copy of this software and associated documentation files (the "Software"), -@@ -19,35 +19,35 @@ - * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR - * OTHER DEALINGS IN THE SOFTWARE. - * -- * Authors: Ben Skeggs -+ * Authors: Ben Skeggs - */ - #include "nv50.h" --#include "rootnv50.h" -+#include "outpdp.h" - --static const struct nv50_disp_func --gm107_disp = { -- .intr = gf119_disp_intr, -- .uevent = &gf119_disp_chan_uevent, -- .super = gf119_disp_intr_supervisor, -- .root = &gm107_disp_root_oclass, -- .head.vblank_init = gf119_disp_vblank_init, -- .head.vblank_fini = gf119_disp_vblank_fini, -- .head.scanoutpos = gf119_disp_root_scanoutpos, -- .outp.internal.crt = nv50_dac_output_new, -- .outp.internal.tmds = nv50_sor_output_new, -- .outp.internal.lvds = nv50_sor_output_new, -- .outp.internal.dp = gf119_sor_dp_new, -- .dac.nr = 3, -- .dac.power = nv50_dac_power, -- .dac.sense = nv50_dac_sense, -- .sor.nr = 4, -- .sor.power = nv50_sor_power, -- .sor.hda_eld = gf119_hda_eld, -- .sor.hdmi = gk104_hdmi_ctrl, -+int -+gm107_sor_dp_pattern(struct nvkm_output_dp *outp, int pattern) -+{ -+ struct nvkm_device *device = outp->base.disp->engine.subdev.device; -+ const u32 soff = outp->base.or * 0x800; -+ const u32 data = 0x01010101 * pattern; -+ if (outp->base.info.sorconf.link & 1) -+ nvkm_mask(device, 0x61c110 + soff, 0x0f0f0f0f, data); -+ else -+ nvkm_mask(device, 0x61c12c + soff, 0x0f0f0f0f, data); -+ return 0; -+} -+ -+static const struct nvkm_output_dp_func -+gm107_sor_dp_func = { -+ .pattern = gm107_sor_dp_pattern, -+ .lnk_pwr = g94_sor_dp_lnk_pwr, -+ .lnk_ctl = gf119_sor_dp_lnk_ctl, -+ .drv_ctl = gf119_sor_dp_drv_ctl, - }; - - int --gm107_disp_new(struct nvkm_device *device, int index, struct nvkm_disp **pdisp) -+gm107_sor_dp_new(struct nvkm_disp *disp, int index, -+ struct dcb_output *dcbE, struct nvkm_output **poutp) - { -- return gf119_disp_new_(&gm107_disp, device, index, pdisp); -+ return nvkm_output_dp_new_(&gm107_sor_dp_func, disp, index, dcbE, poutp); - } -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm200.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm200.c -index 2cfbef9..c44fa7e 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm200.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm200.c -@@ -57,19 +57,6 @@ gm200_sor_dp_lane_map(struct nvkm_device *device, u8 lane) - } - - static int --gm200_sor_dp_pattern(struct nvkm_output_dp *outp, int pattern) --{ -- struct nvkm_device *device = outp->base.disp->engine.subdev.device; -- const u32 soff = gm200_sor_soff(outp); -- const u32 data = 0x01010101 * pattern; -- if (outp->base.info.sorconf.link & 1) -- nvkm_mask(device, 0x61c110 + soff, 0x0f0f0f0f, data); -- else -- nvkm_mask(device, 0x61c12c + soff, 0x0f0f0f0f, data); -- return 0; --} -- --static int - gm200_sor_dp_lnk_pwr(struct nvkm_output_dp *outp, int nr) - { - struct nvkm_device *device = outp->base.disp->engine.subdev.device; -@@ -129,7 +116,7 @@ gm200_sor_dp_drv_ctl(struct nvkm_output_dp *outp, - - static const struct nvkm_output_dp_func - gm200_sor_dp_func = { -- .pattern = gm200_sor_dp_pattern, -+ .pattern = gm107_sor_dp_pattern, - .lnk_pwr = gm200_sor_dp_lnk_pwr, - .lnk_ctl = gf119_sor_dp_lnk_ctl, - .drv_ctl = gm200_sor_dp_drv_ctl, --- -2.7.4 - diff --git a/0005-i915-fbc-Disable-on-HSW-by-default-for-now.patch b/0005-i915-fbc-Disable-on-HSW-by-default-for-now.patch deleted file mode 100644 index d95f2f4..0000000 --- a/0005-i915-fbc-Disable-on-HSW-by-default-for-now.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 28d0147bded959b2c4d3eb1aa957452d5dbb0cc9 Mon Sep 17 00:00:00 2001 -From: Fedora Kernel Team -Date: Mon, 20 Jun 2016 14:52:10 +0200 -Subject: [PATCH 5/6] i915/fbc: Disable on HSW by default for now - -Upstream: posted on dri-devel (and r-b'd) - -Author: cpaul@redhat.com -AuthorDate: Thu Jun 9 11:58:15 2016 -0400 -Commit: Rob Clark -CommitDate: Thu Jun 9 15:43:07 2016 -0400 - - i915/fbc: Disable on HSW by default for now - - >From https://bugs.freedesktop.org/show_bug.cgi?id=96461 : - - This was kind of a difficult bug to track down. If you're using a - Haswell system running GNOME and you have fbc completely enabled and - working, playing videos can result in video artifacts. Steps to - reproduce: - - - Run GNOME - - Ensure FBC is enabled and active - - Download a movie, I used the ogg version of Big Buck Bunny for this - - Run `gst-launch-1.0 filesrc location='some_movie.ogg' ! decodebin ! - glimagesink` in a terminal - - Watch for about over a minute, you'll see small horizontal lines go - down the screen. - - For the time being, disable FBC for Haswell by default. - - Signed-off-by: Lyude - Reviewed-by: Paulo Zanoni - Cc: stable@vger.kernel.org ---- - drivers/gpu/drm/i915/intel_fbc.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/i915/intel_fbc.c b/drivers/gpu/drm/i915/intel_fbc.c -index 0f0492f..28f4407 100644 ---- a/drivers/gpu/drm/i915/intel_fbc.c -+++ b/drivers/gpu/drm/i915/intel_fbc.c -@@ -823,8 +823,7 @@ static bool intel_fbc_can_choose(struct intel_crtc *crtc) - { - struct drm_i915_private *dev_priv = crtc->base.dev->dev_private; - struct intel_fbc *fbc = &dev_priv->fbc; -- bool enable_by_default = IS_HASWELL(dev_priv) || -- IS_BROADWELL(dev_priv); -+ bool enable_by_default = IS_BROADWELL(dev_priv); - - if (intel_vgpu_active(dev_priv->dev)) { - fbc->no_fbc_reason = "VGPU is active"; --- -2.7.4 - diff --git a/HID-hiddev-validate-num_values-for-HIDIOCGUSAGES-HID.patch b/HID-hiddev-validate-num_values-for-HIDIOCGUSAGES-HID.patch deleted file mode 100644 index e84272e..0000000 --- a/HID-hiddev-validate-num_values-for-HIDIOCGUSAGES-HID.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 93a2001bdfd5376c3dc2158653034c20392d15c5 Mon Sep 17 00:00:00 2001 -From: Scott Bauer -Date: Thu, 23 Jun 2016 08:59:47 -0600 -Subject: [PATCH] HID: hiddev: validate num_values for HIDIOCGUSAGES, - HIDIOCSUSAGES commands - -This patch validates the num_values parameter from userland during the -HIDIOCGUSAGES and HIDIOCSUSAGES commands. Previously, if the report id was set -to HID_REPORT_ID_UNKNOWN, we would fail to validate the num_values parameter -leading to a heap overflow. - -Cc: stable@vger.kernel.org -Signed-off-by: Scott Bauer -Signed-off-by: Jiri Kosina ---- - drivers/hid/usbhid/hiddev.c | 10 +++++----- - 1 file changed, 5 insertions(+), 5 deletions(-) - -diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c -index 2f1ddca6f2e0..700145b15088 100644 ---- a/drivers/hid/usbhid/hiddev.c -+++ b/drivers/hid/usbhid/hiddev.c -@@ -516,13 +516,13 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd, - goto inval; - } else if (uref->usage_index >= field->report_count) - goto inval; -- -- else if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) && -- (uref_multi->num_values > HID_MAX_MULTI_USAGES || -- uref->usage_index + uref_multi->num_values > field->report_count)) -- goto inval; - } - -+ if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) && -+ (uref_multi->num_values > HID_MAX_MULTI_USAGES || -+ uref->usage_index + uref_multi->num_values > field->report_count)) -+ goto inval; -+ - switch (cmd) { - case HIDIOCGUSAGE: - uref->value = field->value[uref->usage_index]; --- -2.5.5 - diff --git a/KEYS-potential-uninitialized-variable.patch b/KEYS-potential-uninitialized-variable.patch deleted file mode 100644 index 23cabbb..0000000 --- a/KEYS-potential-uninitialized-variable.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 82a50018782f84e733e718d4b24e1653d19333be Mon Sep 17 00:00:00 2001 -From: Dan Carpenter -Date: Wed, 15 Jun 2016 09:31:45 -0400 -Subject: [PATCH] KEYS: potential uninitialized variable - -If __key_link_begin() failed then "edit" would be uninitialized. I've -added a check to fix that. - -Fixes: f70e2e06196a ('KEYS: Do preallocation for __key_link()') -Signed-off-by: Dan Carpenter ---- - security/keys/key.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/security/keys/key.c b/security/keys/key.c -index bd5a272f28a6..346fbf201c22 100644 ---- a/security/keys/key.c -+++ b/security/keys/key.c -@@ -597,7 +597,7 @@ int key_reject_and_link(struct key *key, - - mutex_unlock(&key_construction_mutex); - -- if (keyring) -+ if (keyring && link_ret == 0) - __key_link_end(keyring, &key->index_key, edit); - - /* wake up anyone waiting for a key to be constructed */ --- -2.5.5 - diff --git a/drm-nouveau-disp-sor-gf119-select-correct-sor-when.patch b/drm-nouveau-disp-sor-gf119-select-correct-sor-when.patch deleted file mode 100644 index 996b479..0000000 --- a/drm-nouveau-disp-sor-gf119-select-correct-sor-when.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 217215041b9285af2193a755b56a8f3ed408bfe2 Mon Sep 17 00:00:00 2001 -From: Ben Skeggs -Date: Wed, 6 Jul 2016 06:50:36 +1000 -Subject: [PATCH] drm/nouveau/disp/sor/gf119: select correct sor when poking - training pattern - -Fixes a regression caused by a stupid thinko from "disp/sor/gf119: both -links use the same training register". - -Signed-off-by: Ben Skeggs -Cc: stable@vger.kernel.org ---- - drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c -index 22706c0..49bd5da 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c -@@ -40,7 +40,8 @@ static int - gf119_sor_dp_pattern(struct nvkm_output_dp *outp, int pattern) - { - struct nvkm_device *device = outp->base.disp->engine.subdev.device; -- nvkm_mask(device, 0x61c110, 0x0f0f0f0f, 0x01010101 * pattern); -+ const u32 soff = gf119_sor_soff(outp); -+ nvkm_mask(device, 0x61c110 + soff, 0x0f0f0f0f, 0x01010101 * pattern); - return 0; - } - diff --git a/kernel.spec b/kernel.spec index 2efb6c3..191f685 100644 --- a/kernel.spec +++ b/kernel.spec @@ -42,7 +42,7 @@ Summary: The Linux kernel # For non-released -rc kernels, this will be appended after the rcX and # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3" # -%global baserelease 201 +%global baserelease 200 %global fedora_build %{baserelease} # base_sublevel is the kernel version we're starting with and patching @@ -54,7 +54,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 4 +%define stable_update 5 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -619,9 +619,6 @@ Patch721: tipc-fix-an-infoleak-in-tipc_nl_compat_link_dump.patch #CVE-2016-5244 rhbz 1343338 1343337 Patch722: rds-fix-an-infoleak-in-rds_inc_info_copy.txt -#CVE-2016-4470 rhbz 1341716 1346626 -Patch727: KEYS-potential-uninitialized-variable.patch - #rhbz 1338025 Patch728: hp-wmi-fix-wifi-cannot-be-hard-unblock.patch @@ -644,26 +641,9 @@ Patch815: 0015-drm-i915-gen9-Calculate-watermarks-during-atomic-che.patch Patch816: 0016-drm-i915-gen9-Reject-display-updates-that-exceed-wm-.patch Patch817: 0017-drm-i915-Remove-wm_config-from-dev_priv-intel_atomic.patch -#other drm/kms fixes (most Cc-ed stable) -Patch821: 0001-drm-mgag200-Black-screen-fix-for-G200e-rev-4.patch -Patch822: 0002-drm-nouveau-fbcon-fix-out-of-bounds-memory-accesses.patch -Patch823: 0003-drm-nouveau-disp-sor-gf119-both-links-use-the-same-t.patch -Patch824: 0004-drm-nouveau-disp-sor-gm107-training-pattern-register.patch -Patch825: 0005-i915-fbc-Disable-on-HSW-by-default-for-now.patch - -#CVE-2016-5829 rhbz 1350509 1350513 -Patch826: HID-hiddev-validate-num_values-for-HIDIOCGUSAGES-HID.patch - -#CVE-2016-1237 rhbz 1350845 1350847 -Patch830: posix_acl-Add-set_posix_acl.patch -Patch831: nfsd-check-permissions-when-setting-ACLs.patch - #CVE-2016-6156 rhbz 1353490 1353491 Patch832: platform-chrome-cros_ec_dev-double-fetch-bug-in-ioct.patch -#rbhz 1351205 -Patch833: drm-nouveau-disp-sor-gf119-select-correct-sor-when.patch - #rhbz 1346753 Patch834: qla2xxx-Fix-NULL-pointer-deref-in-QLA-interrupt.patch @@ -2202,6 +2182,9 @@ fi # # %changelog +* Wed Jul 27 2016 Josh Boyer - 4.6.5-200 +- Linux v4.6.5 + * Mon Jul 25 2016 Josh Boyer - CVE-2016-6136 race condition in auditsc.c (rhbz 1353533 1353534) diff --git a/nfsd-check-permissions-when-setting-ACLs.patch b/nfsd-check-permissions-when-setting-ACLs.patch deleted file mode 100644 index 37ed435..0000000 --- a/nfsd-check-permissions-when-setting-ACLs.patch +++ /dev/null @@ -1,154 +0,0 @@ -From 999653786df6954a31044528ac3f7a5dadca08f4 Mon Sep 17 00:00:00 2001 -From: Ben Hutchings -Date: Wed, 22 Jun 2016 19:43:35 +0100 -Subject: [PATCH] nfsd: check permissions when setting ACLs - -Use set_posix_acl, which includes proper permission checks, instead of -calling ->set_acl directly. Without this anyone may be able to grant -themselves permissions to a file by setting the ACL. - -Lock the inode to make the new checks atomic with respect to set_acl. -(Also, nfsd was the only caller of set_acl not locking the inode, so I -suspect this may fix other races.) - -This also simplifies the code, and ensures our ACLs are checked by -posix_acl_valid. - -The permission checks and the inode locking were lost with commit -4ac7249e, which changed nfsd to use the set_acl inode operation directly -instead of going through xattr handlers. - -Reported-by: David Sinquin -[agreunba@redhat.com: use set_posix_acl] -Fixes: 4ac7249e -Cc: Christoph Hellwig -Cc: Al Viro -Cc: stable@vger.kernel.org -Signed-off-by: J. Bruce Fields ---- - fs/nfsd/nfs2acl.c | 20 ++++++++++---------- - fs/nfsd/nfs3acl.c | 16 +++++++--------- - fs/nfsd/nfs4acl.c | 16 ++++++++-------- - 3 files changed, 25 insertions(+), 27 deletions(-) - -diff --git a/fs/nfsd/nfs2acl.c b/fs/nfsd/nfs2acl.c -index 1580ea6fd64d..d08cd88155c7 100644 ---- a/fs/nfsd/nfs2acl.c -+++ b/fs/nfsd/nfs2acl.c -@@ -104,22 +104,21 @@ static __be32 nfsacld_proc_setacl(struct svc_rqst * rqstp, - goto out; - - inode = d_inode(fh->fh_dentry); -- if (!IS_POSIXACL(inode) || !inode->i_op->set_acl) { -- error = -EOPNOTSUPP; -- goto out_errno; -- } - - error = fh_want_write(fh); - if (error) - goto out_errno; - -- error = inode->i_op->set_acl(inode, argp->acl_access, ACL_TYPE_ACCESS); -+ fh_lock(fh); -+ -+ error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access); - if (error) -- goto out_drop_write; -- error = inode->i_op->set_acl(inode, argp->acl_default, -- ACL_TYPE_DEFAULT); -+ goto out_drop_lock; -+ error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default); - if (error) -- goto out_drop_write; -+ goto out_drop_lock; -+ -+ fh_unlock(fh); - - fh_drop_write(fh); - -@@ -131,7 +130,8 @@ out: - posix_acl_release(argp->acl_access); - posix_acl_release(argp->acl_default); - return nfserr; --out_drop_write: -+out_drop_lock: -+ fh_unlock(fh); - fh_drop_write(fh); - out_errno: - nfserr = nfserrno(error); -diff --git a/fs/nfsd/nfs3acl.c b/fs/nfsd/nfs3acl.c -index 01df4cd7c753..0c890347cde3 100644 ---- a/fs/nfsd/nfs3acl.c -+++ b/fs/nfsd/nfs3acl.c -@@ -95,22 +95,20 @@ static __be32 nfsd3_proc_setacl(struct svc_rqst * rqstp, - goto out; - - inode = d_inode(fh->fh_dentry); -- if (!IS_POSIXACL(inode) || !inode->i_op->set_acl) { -- error = -EOPNOTSUPP; -- goto out_errno; -- } - - error = fh_want_write(fh); - if (error) - goto out_errno; - -- error = inode->i_op->set_acl(inode, argp->acl_access, ACL_TYPE_ACCESS); -+ fh_lock(fh); -+ -+ error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access); - if (error) -- goto out_drop_write; -- error = inode->i_op->set_acl(inode, argp->acl_default, -- ACL_TYPE_DEFAULT); -+ goto out_drop_lock; -+ error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default); - --out_drop_write: -+out_drop_lock: -+ fh_unlock(fh); - fh_drop_write(fh); - out_errno: - nfserr = nfserrno(error); -diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c -index 6adabd6049b7..71292a0d6f09 100644 ---- a/fs/nfsd/nfs4acl.c -+++ b/fs/nfsd/nfs4acl.c -@@ -770,9 +770,6 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqstp, struct svc_fh *fhp, - dentry = fhp->fh_dentry; - inode = d_inode(dentry); - -- if (!inode->i_op->set_acl || !IS_POSIXACL(inode)) -- return nfserr_attrnotsupp; -- - if (S_ISDIR(inode->i_mode)) - flags = NFS4_ACL_DIR; - -@@ -782,16 +779,19 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqstp, struct svc_fh *fhp, - if (host_error < 0) - goto out_nfserr; - -- host_error = inode->i_op->set_acl(inode, pacl, ACL_TYPE_ACCESS); -+ fh_lock(fhp); -+ -+ host_error = set_posix_acl(inode, ACL_TYPE_ACCESS, pacl); - if (host_error < 0) -- goto out_release; -+ goto out_drop_lock; - - if (S_ISDIR(inode->i_mode)) { -- host_error = inode->i_op->set_acl(inode, dpacl, -- ACL_TYPE_DEFAULT); -+ host_error = set_posix_acl(inode, ACL_TYPE_DEFAULT, dpacl); - } - --out_release: -+out_drop_lock: -+ fh_unlock(fhp); -+ - posix_acl_release(pacl); - posix_acl_release(dpacl); - out_nfserr: --- -2.5.5 - diff --git a/posix_acl-Add-set_posix_acl.patch b/posix_acl-Add-set_posix_acl.patch deleted file mode 100644 index c067f7b..0000000 --- a/posix_acl-Add-set_posix_acl.patch +++ /dev/null @@ -1,55 +0,0 @@ -From c463b51e8ea1ae47a7bb8cc2777eb550ad3273e2 Mon Sep 17 00:00:00 2001 -From: Andreas Gruenbacher -Date: Wed, 22 Jun 2016 23:57:25 +0200 -Subject: [PATCH] posix_acl: Add set_posix_acl - -Factor out part of posix_acl_xattr_set into a common function that takes -a posix_acl, which nfsd can also call. - -The prototype already exists in include/linux/posix_acl.h. - -Signed-off-by: Andreas Gruenbacher -Cc: stable@vger.kernel.org -Cc: Christoph Hellwig -Cc: Al Viro -Signed-off-by: J. Bruce Fields ---- - fs/posix_acl.c | 22 ++++++++++++++++++++++ - 1 file changed, 22 insertions(+) - -diff --git a/fs/posix_acl.c b/fs/posix_acl.c -index 711dd5170376..f30caace5b84 100644 ---- a/fs/posix_acl.c -+++ b/fs/posix_acl.c -@@ -786,6 +786,28 @@ posix_acl_xattr_get(const struct xattr_handler *handler, - return error; - } - -+int -+set_posix_acl(struct inode *inode, int type, struct posix_acl *acl) -+{ -+ if (!IS_POSIXACL(inode)) -+ return -EOPNOTSUPP; -+ if (!inode->i_op->set_acl) -+ return -EOPNOTSUPP; -+ -+ if (type == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode)) -+ return acl ? -EACCES : 0; -+ if (!inode_owner_or_capable(inode)) -+ return -EPERM; -+ -+ if (acl) { -+ int ret = posix_acl_valid(acl); -+ if (ret) -+ return ret; -+ } -+ return inode->i_op->set_acl(inode, acl, type); -+} -+EXPORT_SYMBOL(set_posix_acl); -+ - static int - posix_acl_xattr_set(const struct xattr_handler *handler, - struct dentry *dentry, const char *name, --- -2.5.5 - diff --git a/sources b/sources index 56a5aeb..ee52576 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ d2927020e24a76da4ab482a8bc3e9ef3 linux-4.6.tar.xz fd23b14b9d474c3dfacb6e8ee82d3a51 perf-man-4.6.tar.gz -c8ff415734155965ae7a2a85ef9c9e03 patch-4.6.4.xz +ad32c9ec1c69a99811d160d6014f9b2d patch-4.6.5.xz