diff --git a/Revert-drm-i915-Ensure-plane-state-fb-stays-in-sync-.patch b/Revert-drm-i915-Ensure-plane-state-fb-stays-in-sync-.patch deleted file mode 100644 index 9f5c967..0000000 --- a/Revert-drm-i915-Ensure-plane-state-fb-stays-in-sync-.patch +++ /dev/null @@ -1,97 +0,0 @@ -From: Josh Boyer -Date: Mon, 23 Mar 2015 13:50:33 -0400 -Subject: [PATCH] Revert "drm/i915: Ensure plane->state->fb stays in sync with - plane->fb" - -This reverts commit 319c1d420a0b62d9dbb88104afebaabc968cdbfa. ---- - drivers/gpu/drm/i915/intel_display.c | 17 ----------------- - 1 file changed, 17 deletions(-) - -diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c -index e116dee10cf9..ac8112d86237 100644 ---- a/drivers/gpu/drm/i915/intel_display.c -+++ b/drivers/gpu/drm/i915/intel_display.c -@@ -37,7 +37,6 @@ - #include - #include "i915_drv.h" - #include "i915_trace.h" --#include - #include - #include - #include -@@ -2417,14 +2416,6 @@ out_unref_obj: - return false; - } - --/* Update plane->state->fb to match plane->fb after driver-internal updates */ --static void --update_state_fb(struct drm_plane *plane) --{ -- if (plane->fb != plane->state->fb) -- drm_atomic_set_fb_for_plane(plane->state, plane->fb); --} -- - static void - intel_find_plane_obj(struct intel_crtc *intel_crtc, - struct intel_initial_plane_config *plane_config) -@@ -2471,8 +2462,6 @@ intel_find_plane_obj(struct intel_crtc *intel_crtc, - break; - } - } -- -- update_state_fb(intel_crtc->base.primary); - } - - static void i9xx_update_primary_plane(struct drm_crtc *crtc, -@@ -6663,7 +6652,6 @@ i9xx_get_initial_plane_config(struct intel_crtc *crtc, - plane_config->size); - - crtc->base.primary->fb = fb; -- update_state_fb(crtc->base.primary); - } - - static void chv_crtc_clock_get(struct intel_crtc *crtc, -@@ -7704,7 +7692,6 @@ skylake_get_initial_plane_config(struct intel_crtc *crtc, - plane_config->size); - - crtc->base.primary->fb = fb; -- update_state_fb(crtc->base.primary); - return; - - error: -@@ -7798,7 +7785,6 @@ ironlake_get_initial_plane_config(struct intel_crtc *crtc, - plane_config->size); - - crtc->base.primary->fb = fb; -- update_state_fb(crtc->base.primary); - } - - static bool ironlake_get_pipe_config(struct intel_crtc *crtc, -@@ -9837,7 +9823,6 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc, - drm_gem_object_reference(&obj->base); - - crtc->primary->fb = fb; -- update_state_fb(crtc->primary); - - work->pending_flip_obj = obj; - -@@ -9906,7 +9891,6 @@ cleanup_unpin: - cleanup_pending: - atomic_dec(&intel_crtc->unpin_work_count); - crtc->primary->fb = old_fb; -- update_state_fb(crtc->primary); - drm_gem_object_unreference(&work->old_fb_obj->base); - drm_gem_object_unreference(&obj->base); - mutex_unlock(&dev->struct_mutex); -@@ -13741,7 +13725,6 @@ void intel_modeset_gem_init(struct drm_device *dev) - to_intel_crtc(c)->pipe); - drm_framebuffer_unreference(c->primary->fb); - c->primary->fb = NULL; -- update_state_fb(c->primary); - } - } - mutex_unlock(&dev->struct_mutex); --- -2.1.0 - diff --git a/drm-Fixup-racy-refcounting-in-plane_force_disable.patch b/drm-Fixup-racy-refcounting-in-plane_force_disable.patch new file mode 100644 index 0000000..6c46cb0 --- /dev/null +++ b/drm-Fixup-racy-refcounting-in-plane_force_disable.patch @@ -0,0 +1,72 @@ +From: Daniel Vetter +Date: Fri, 27 Feb 2015 12:58:13 +0100 +Subject: [PATCH] drm: Fixup racy refcounting in plane_force_disable + +Originally it was impossible to be dropping the last refcount in this +function since there was always one around still from the idr. But in + +commit 83f45fc360c8e16a330474860ebda872d1384c8c +Author: Daniel Vetter +Date: Wed Aug 6 09:10:18 2014 +0200 + + drm: Don't grab an fb reference for the idr + +we've switched to weak references, broke that assumption but forgot to +fix it up. + +Since we still force-disable planes it's only possible to hit this +when racing multiple rmfb with fbdev restoring or similar evil things. +As long as userspace is nice it's impossible to hit the BUG_ON. + +But the BUG_ON would most likely be hit from fbdev code, which usually +invovles the console_lock besides all modeset locks. So very likely +we'd never get the bug reports if this was hit in the wild, hence +better be safe than sorry and backport. + +Spotted by Matt Roper while reviewing other patches. + +[airlied: pull this back into 4.0 - the oops happens there] + +Cc: stable@vger.kernel.org +Cc: Matt Roper +Reviewed-by: Matt Roper +Signed-off-by: Daniel Vetter +Signed-off-by: Dave Airlie +--- + drivers/gpu/drm/drm_crtc.c | 13 +------------ + 1 file changed, 1 insertion(+), 12 deletions(-) + +diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c +index f6d04c7b5115..679b10e34fb5 100644 +--- a/drivers/gpu/drm/drm_crtc.c ++++ b/drivers/gpu/drm/drm_crtc.c +@@ -525,17 +525,6 @@ void drm_framebuffer_reference(struct drm_framebuffer *fb) + } + EXPORT_SYMBOL(drm_framebuffer_reference); + +-static void drm_framebuffer_free_bug(struct kref *kref) +-{ +- BUG(); +-} +- +-static void __drm_framebuffer_unreference(struct drm_framebuffer *fb) +-{ +- DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount)); +- kref_put(&fb->refcount, drm_framebuffer_free_bug); +-} +- + /** + * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr + * @fb: fb to unregister +@@ -1320,7 +1309,7 @@ void drm_plane_force_disable(struct drm_plane *plane) + return; + } + /* disconnect the plane from the fb and crtc: */ +- __drm_framebuffer_unreference(plane->old_fb); ++ drm_framebuffer_unreference(plane->old_fb); + plane->old_fb = NULL; + plane->fb = NULL; + plane->crtc = NULL; +-- +2.1.0 + diff --git a/drm-i915-Don-t-try-to-reference-the-fb-in-get_initia.patch b/drm-i915-Don-t-try-to-reference-the-fb-in-get_initia.patch new file mode 100644 index 0000000..ba40a84 --- /dev/null +++ b/drm-i915-Don-t-try-to-reference-the-fb-in-get_initia.patch @@ -0,0 +1,94 @@ +From: Damien Lespiau +Date: Thu, 5 Feb 2015 18:30:20 +0000 +Subject: [PATCH] drm/i915: Don't try to reference the fb in + get_initial_plane_config() + +Tvrtko noticed a new warning on boot: + + WARNING: CPU: 1 PID: 353 at include/linux/kref.h:47 drm_framebuffer_reference+0x6c/0x80 [drm]() + Call Trace: + [] dump_stack+0x4f/0x7b + [] warn_slowpath_common+0xaa/0xd0 + [] warn_slowpath_null+0x1a/0x20 + [] drm_framebuffer_reference+0x6c/0x80 [drm] + [] update_state_fb.isra.54+0x47/0x50 [i915] + [] skylake_get_initial_plane_config+0x93c/0x950 [i915] + [] intel_modeset_init+0x1551/0x17c0 [i915] + [] i915_driver_load+0xed0/0x11e0 [i915] + [] ? _raw_spin_unlock_irqrestore+0x51/0x70 + [] drm_dev_register+0x77/0x110 [drm] + [] drm_get_pci_dev+0x11b/0x1f0 [drm] + [] ? trace_hardirqs_on+0xd/0x10 + [] ? _raw_spin_unlock_irqrestore+0x51/0x70 + [] i915_pci_probe+0x56/0x60 [i915] + [] pci_device_probe+0x7c/0x100 + [] driver_probe_device+0x16d/0x380 + +We cannot take a reference at this point, not before +intel_framebuffer_init() and the underlying drm_framebuffer_init(). + +Introduced in: + + commit 706dc7b549175e47f23e913b7f1e52874a7d0f56 + Author: Matt Roper + Date: Tue Feb 3 13:10:04 2015 -0800 + + drm/i915: Ensure plane->state->fb stays in sync with plane->fb + +v2: Don't move update_state_fb(). It was moved around because I + originally put update_state_fb() in intel_alloc_plane_obj() before + finding a better place. (Matt) + +Reviewed-by: Matt Roper +Reported-by: Tvrtko Ursulin +Cc: Matt Roper +Cc: Tvrtko Ursulin +Signed-off-by: Damien Lespiau +Signed-off-by: Daniel Vetter +--- + drivers/gpu/drm/i915/intel_display.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index e116dee10cf9..177714a9d778 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -2438,8 +2438,10 @@ intel_find_plane_obj(struct intel_crtc *intel_crtc, + if (!intel_crtc->base.primary->fb) + return; + +- if (intel_alloc_plane_obj(intel_crtc, plane_config)) ++ if (intel_alloc_plane_obj(intel_crtc, plane_config)) { ++ update_state_fb(intel_crtc->base.primary); + return; ++ } + + kfree(intel_crtc->base.primary->fb); + intel_crtc->base.primary->fb = NULL; +@@ -6663,7 +6665,6 @@ i9xx_get_initial_plane_config(struct intel_crtc *crtc, + plane_config->size); + + crtc->base.primary->fb = fb; +- update_state_fb(crtc->base.primary); + } + + static void chv_crtc_clock_get(struct intel_crtc *crtc, +@@ -7704,7 +7705,6 @@ skylake_get_initial_plane_config(struct intel_crtc *crtc, + plane_config->size); + + crtc->base.primary->fb = fb; +- update_state_fb(crtc->base.primary); + return; + + error: +@@ -7798,7 +7798,6 @@ ironlake_get_initial_plane_config(struct intel_crtc *crtc, + plane_config->size); + + crtc->base.primary->fb = fb; +- update_state_fb(crtc->base.primary); + } + + static bool ironlake_get_pipe_config(struct intel_crtc *crtc, +-- +2.1.0 + diff --git a/kernel.spec b/kernel.spec index 3efb7c6..3af55f2 100644 --- a/kernel.spec +++ b/kernel.spec @@ -68,7 +68,7 @@ Summary: The Linux kernel # The rc snapshot level %define rcrev 5 # The git snapshot level -%define gitrev 0 +%define gitrev 1 # Set rpm version accordingly %define rpmversion 4.%{upstream_sublevel}.0 %endif @@ -627,9 +627,8 @@ Patch26168: HID-multitouch-add-support-of-clickpads.patch Patch26170: acpi-video-Allow-forcing-native-backlight-on-non-win.patch Patch26171: acpi-video-Add-force-native-backlight-quirk-for-Leno.patch -Patch26172: Revert-drm-i915-Ensure-plane-state-fb-stays-in-sync-.patch - -Patch26173: net-validate-the-range-we-feed-to-iov_iter_init-in-s.patch +Patch26172: drm-Fixup-racy-refcounting-in-plane_force_disable.patch +Patch26173: drm-i915-Don-t-try-to-reference-the-fb-in-get_initia.patch # END OF PATCH DEFINITIONS @@ -1369,9 +1368,8 @@ ApplyPatch HID-multitouch-add-support-of-clickpads.patch ApplyPatch acpi-video-Allow-forcing-native-backlight-on-non-win.patch ApplyPatch acpi-video-Add-force-native-backlight-quirk-for-Leno.patch -ApplyPatch Revert-drm-i915-Ensure-plane-state-fb-stays-in-sync-.patch - -ApplyPatch net-validate-the-range-we-feed-to-iov_iter_init-in-s.patch +ApplyPatch drm-Fixup-racy-refcounting-in-plane_force_disable.patch +ApplyPatch drm-i915-Don-t-try-to-reference-the-fb-in-get_initia.patch # END OF PATCH APPLICATIONS @@ -2223,6 +2221,10 @@ fi # # %changelog +* Tue Mar 24 2015 Josh Boyer - 4.0.0-0.rc5.git1.3 +- Linux v4.0-rc5-25-g90a5a895cc8b +- Add some i915 fixes + * Mon Mar 23 2015 Josh Boyer - 4.0.0-0.rc5.git0.3 - Enable CONFIG_SND_BEBOB (rhbz 1204342) - Validate iovec range in sys_sendto/sys_recvfrom diff --git a/net-validate-the-range-we-feed-to-iov_iter_init-in-s.patch b/net-validate-the-range-we-feed-to-iov_iter_init-in-s.patch deleted file mode 100644 index d82fb0f..0000000 --- a/net-validate-the-range-we-feed-to-iov_iter_init-in-s.patch +++ /dev/null @@ -1,37 +0,0 @@ -From: Al Viro -Date: Fri, 20 Mar 2015 17:41:43 +0000 -Subject: [PATCH] net: validate the range we feed to iov_iter_init() in - sys_sendto/sys_recvfrom - -Cc: stable@vger.kernel.org # v3.19 -Signed-off-by: Al Viro -Signed-off-by: David S. Miller ---- - net/socket.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/net/socket.c b/net/socket.c -index bbedbfcb42c2..245330ca0015 100644 ---- a/net/socket.c -+++ b/net/socket.c -@@ -1702,6 +1702,8 @@ SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len, - - if (len > INT_MAX) - len = INT_MAX; -+ if (unlikely(!access_ok(VERIFY_READ, buff, len))) -+ return -EFAULT; - sock = sockfd_lookup_light(fd, &err, &fput_needed); - if (!sock) - goto out; -@@ -1760,6 +1762,8 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size, - - if (size > INT_MAX) - size = INT_MAX; -+ if (unlikely(!access_ok(VERIFY_WRITE, ubuf, size))) -+ return -EFAULT; - sock = sockfd_lookup_light(fd, &err, &fput_needed); - if (!sock) - goto out; --- -2.1.0 - diff --git a/sources b/sources index e336c29..8525519 100644 --- a/sources +++ b/sources @@ -1,2 +1,3 @@ b26150c980099ef554b26d07f470e647 linux-4.0-rc5.tar.xz 7614f559a09f0242827fc7783c7adf3f perf-man-4.0-rc5.tar.gz +658fcb5b3fbc9bd1ccbf4f8ce5a9e79c patch-4.0-rc5-git1.xz