diff --git a/0001-watchdog-omap_wdt-fix-null-pointer-dereference.patch b/0001-watchdog-omap_wdt-fix-null-pointer-dereference.patch deleted file mode 100644 index 7dab1ff..0000000 --- a/0001-watchdog-omap_wdt-fix-null-pointer-dereference.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 721ebb3cf4788107424f92ac2da6cfce20c67297 Mon Sep 17 00:00:00 2001 -From: Peter Robinson -Date: Sun, 1 Nov 2015 23:54:08 +0000 -Subject: [PATCH] watchdog: omap_wdt: fix null pointer dereference - -Fix issue from two patches overlapping causing a kernel oops - -[ 3569.297449] Unable to handle kernel NULL pointer dereference at virtual address 00000088 -[ 3569.306272] pgd = dc894000 -[ 3569.309287] [00000088] *pgd=00000000 -[ 3569.313104] Internal error: Oops: 5 [#1] SMP ARM -[ 3569.317986] Modules linked in: ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ebtable_filter ebtable_nat ebtable_broute bridge stp llc ebtables ip6table_security ip6table_raw ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_filter ip6_tables iptable_security iptable_raw iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle musb_dsps cppi41 musb_hdrc phy_am335x udc_core phy_generic phy_am335x_control omap_sham omap_aes omap_rng omap_hwspinlock omap_mailbox hwspinlock_core musb_am335x omap_wdt at24 8250_omap leds_gpio cpufreq_dt smsc davinci_mdio mmc_block ti_cpsw cpsw_common ptp pps_core cpsw_ale davinci_cpdma omap_hsmmc omap_dma mmc_core i2c_dev -[ 3569.386293] CPU: 0 PID: 1429 Comm: wdctl Not tainted 4.3.0-0.rc7.git0.1.fc24.armv7hl #1 -[ 3569.394740] Hardware name: Generic AM33XX (Flattened Device Tree) -[ 3569.401179] task: dbd11a00 ti: dbaac000 task.ti: dbaac000 -[ 3569.406917] PC is at omap_wdt_get_timeleft+0xc/0x20 [omap_wdt] -[ 3569.413106] LR is at watchdog_ioctl+0x3cc/0x42c -[ 3569.417902] pc : [] lr : [] psr: 600f0013 -[ 3569.417902] sp : dbaadf18 ip : 00000003 fp : 7f5d3bbe -[ 3569.430014] r10: 00000000 r9 : 00000003 r8 : bef21ab8 -[ 3569.435535] r7 : dbbc0f7c r6 : dbbc0f18 r5 : bef21ab8 r4 : 00000000 -[ 3569.442427] r3 : 00000000 r2 : 00000000 r1 : 8004570a r0 : dbbc0f18 -[ 3569.449323] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none -[ 3569.456858] Control: 10c5387d Table: 9c894019 DAC: 00000051 -[ 3569.462927] Process wdctl (pid: 1429, stack limit = 0xdbaac220) -[ 3569.469179] Stack: (0xdbaadf18 to 0xdbaae000) -[ 3569.473790] df00: bef21ab8 dbf60e38 -[ 3569.482441] df20: dc91b840 8004570a bef21ab8 c03988a4 dbaadf48 dc854000 00000000 dd313850 -[ 3569.491092] df40: ddf033b8 0000570a dc91b80b dbaadf3c dbf60e38 00000020 c0df9250 c0df6c48 -[ 3569.499741] df60: dc91b840 8004570a 00000000 dc91b840 dc91b840 8004570a bef21ab8 00000003 -[ 3569.508389] df80: 00000000 c03989d4 bef21b74 7f5d3bad 00000003 00000036 c020fcc4 dbaac000 -[ 3569.517037] dfa0: 00000000 c020fb00 bef21b74 7f5d3bad 00000003 8004570a bef21ab8 00000001 -[ 3569.525685] dfc0: bef21b74 7f5d3bad 00000003 00000036 00000001 00000000 7f5e4eb0 7f5d3bbe -[ 3569.534334] dfe0: 7f5e4f10 bef21a3c 7f5d0a54 b6e97e0c a00f0010 00000003 00000000 00000000 -[ 3569.543038] [] (omap_wdt_get_timeleft [omap_wdt]) from [] (watchdog_ioctl+0x3cc/0x42c) -[ 3569.553266] [] (watchdog_ioctl) from [] (do_vfs_ioctl+0x5bc/0x698) -[ 3569.561648] [] (do_vfs_ioctl) from [] (SyS_ioctl+0x54/0x7c) -[ 3569.569400] [] (SyS_ioctl) from [] (ret_fast_syscall+0x0/0x3c) -[ 3569.577413] Code: e12fff1e e52de004 e8bd4000 e5903060 (e5933088) -[ 3569.584089] ---[ end trace cec3039bd3ae610a ]--- - -Cc: # v4.2+ -Signed-off-by: Peter Robinson ---- - drivers/watchdog/omap_wdt.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c -index d96bee0..6f17c93 100644 ---- a/drivers/watchdog/omap_wdt.c -+++ b/drivers/watchdog/omap_wdt.c -@@ -205,7 +205,7 @@ static int omap_wdt_set_timeout(struct watchdog_device *wdog, - - static unsigned int omap_wdt_get_timeleft(struct watchdog_device *wdog) - { -- struct omap_wdt_dev *wdev = watchdog_get_drvdata(wdog); -+ struct omap_wdt_dev *wdev = to_omap_wdt_dev(wdog); - void __iomem *base = wdev->base; - u32 value; - --- -2.5.0 - diff --git a/ALSA-usb-audio-avoid-freeing-umidi-object-twice.patch b/ALSA-usb-audio-avoid-freeing-umidi-object-twice.patch deleted file mode 100644 index c59d683..0000000 --- a/ALSA-usb-audio-avoid-freeing-umidi-object-twice.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 07d86ca93db7e5cdf4743564d98292042ec21af7 Mon Sep 17 00:00:00 2001 -From: Andrey Konovalov -Date: Sat, 13 Feb 2016 11:08:06 +0300 -Subject: [PATCH] ALSA: usb-audio: avoid freeing umidi object twice - -The 'umidi' object will be free'd on the error path by snd_usbmidi_free() -when tearing down the rawmidi interface. So we shouldn't try to free it -in snd_usbmidi_create() after having registered the rawmidi interface. - -Found by KASAN. - -Signed-off-by: Andrey Konovalov -Acked-by: Clemens Ladisch -Cc: -Signed-off-by: Takashi Iwai ---- - sound/usb/midi.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/sound/usb/midi.c b/sound/usb/midi.c -index cc39f63299ef..007cf5831121 100644 ---- a/sound/usb/midi.c -+++ b/sound/usb/midi.c -@@ -2455,7 +2455,6 @@ int snd_usbmidi_create(struct snd_card *card, - else - err = snd_usbmidi_create_endpoints(umidi, endpoints); - if (err < 0) { -- snd_usbmidi_free(umidi); - return err; - } - --- -2.5.0 - diff --git a/ARM-dts-Add-am335x-bonegreen.patch b/ARM-dts-Add-am335x-bonegreen.patch deleted file mode 100644 index 35fb3e4..0000000 --- a/ARM-dts-Add-am335x-bonegreen.patch +++ /dev/null @@ -1,103 +0,0 @@ -From patchwork Fri Sep 25 15:10:31 2015 -Content-Type: text/plain; charset="utf-8" -MIME-Version: 1.0 -Content-Transfer-Encoding: 7bit -Subject: ARM: dts: Add am335x-bonegreen -From: Robert Nelson -X-Patchwork-Id: 7265851 -Message-Id: <1443193831-5693-1-git-send-email-robertcnelson@gmail.com> -To: tony@atomide.com, devicetree@vger.kernel.org -Cc: linux-omap@vger.kernel.org, linux-arm-kernel@lists.infradead.org, - Robert Nelson , Jason Kridner -Date: Fri, 25 Sep 2015 10:10:31 -0500 - -SeeedStudio BeagleBone Green (BBG) is clone of the BeagleBone Black (BBB) minus -the HDMI port and addition of two Grove connectors (i2c2 and usart2). - -This board can be identified by the 1A value after A335BNLT (BBB) in the at24 eeprom: -1A: [aa 55 33 ee 41 33 33 35 42 4e 4c 54 1a 00 00 00 |.U3.A335BNLT....|] - -http://beagleboard.org/green -http://www.seeedstudio.com/wiki/Beaglebone_green - -Signed-off-by: Robert Nelson -CC: Tony Lindgren -CC: Jason Kridner - ---- -arch/arm/boot/dts/Makefile | 1 + - arch/arm/boot/dts/am335x-bonegreen.dts | 53 ++++++++++++++++++++++++++++++++++ - 2 files changed, 54 insertions(+) - create mode 100644 arch/arm/boot/dts/am335x-bonegreen.dts - -diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile -index 233159d..e45d771 100644 ---- a/arch/arm/boot/dts/Makefile -+++ b/arch/arm/boot/dts/Makefile -@@ -446,6 +446,7 @@ dtb-$(CONFIG_SOC_AM33XX) += \ - am335x-base0033.dtb \ - am335x-bone.dtb \ - am335x-boneblack.dtb \ -+ am335x-bonegreen.dtb \ - am335x-sl50.dtb \ - am335x-evm.dtb \ - am335x-evmsk.dtb \ -diff --git a/arch/arm/boot/dts/am335x-bonegreen.dts b/arch/arm/boot/dts/am335x-bonegreen.dts -new file mode 100644 -index 0000000..0f65bda ---- /dev/null -+++ b/arch/arm/boot/dts/am335x-bonegreen.dts -@@ -0,0 +1,53 @@ -+/* -+ * Copyright (C) 2012 Texas Instruments Incorporated - http://www.ti.com/ -+ * -+ * This program is free software; you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License version 2 as -+ * published by the Free Software Foundation. -+ */ -+/dts-v1/; -+ -+#include "am33xx.dtsi" -+#include "am335x-bone-common.dtsi" -+ -+/ { -+ model = "TI AM335x BeagleBone Green"; -+ compatible = "ti,am335x-bone-green", "ti,am335x-bone-black", "ti,am335x-bone", "ti,am33xx"; -+}; -+ -+&ldo3_reg { -+ regulator-min-microvolt = <1800000>; -+ regulator-max-microvolt = <1800000>; -+ regulator-always-on; -+}; -+ -+&mmc1 { -+ vmmc-supply = <&vmmcsd_fixed>; -+}; -+ -+&mmc2 { -+ vmmc-supply = <&vmmcsd_fixed>; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&emmc_pins>; -+ bus-width = <8>; -+ status = "okay"; -+}; -+ -+&am33xx_pinmux { -+ uart2_pins: uart2_pins { -+ pinctrl-single,pins = < -+ 0x150 (PIN_INPUT | MUX_MODE1) /* spi0_sclk.uart2_rxd */ -+ 0x154 (PIN_OUTPUT | MUX_MODE1) /* spi0_d0.uart2_txd */ -+ >; -+ }; -+}; -+ -+&uart2 { -+ pinctrl-names = "default"; -+ pinctrl-0 = <&uart2_pins>; -+ status = "okay"; -+}; -+ -+&rtc { -+ system-power-controller; -+}; diff --git a/Add-EFI-signature-data-types.patch b/Add-EFI-signature-data-types.patch index 57847dc..35f170a 100644 --- a/Add-EFI-signature-data-types.patch +++ b/Add-EFI-signature-data-types.patch @@ -1,4 +1,4 @@ -From 34e3e23e08fdccbf4637deab0cf03070d4f2226d Mon Sep 17 00:00:00 2001 +From 47f6b5c281137394d627e275cb80980492d00d84 Mon Sep 17 00:00:00 2001 From: Dave Howells Date: Tue, 23 Oct 2012 09:30:54 -0400 Subject: [PATCH 15/20] Add EFI signature data types @@ -15,12 +15,12 @@ Signed-off-by: David Howells 1 file changed, 20 insertions(+) diff --git a/include/linux/efi.h b/include/linux/efi.h -index de3e45088d4a..fac43c611614 100644 +index 4dc970e..82d6218 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h -@@ -595,6 +595,12 @@ void efi_native_runtime_setup(void); - #define DEVICE_TREE_GUID \ - EFI_GUID( 0xb1b621d5, 0xf19c, 0x41a5, 0x83, 0x0b, 0xd9, 0x15, 0x2c, 0x69, 0xaa, 0xe0 ) +@@ -599,6 +599,12 @@ void efi_native_runtime_setup(void); + #define EFI_PROPERTIES_TABLE_GUID \ + EFI_GUID( 0x880aaca3, 0x4adc, 0x4a04, 0x90, 0x79, 0xb7, 0x47, 0x34, 0x08, 0x25, 0xe5 ) +#define EFI_CERT_SHA256_GUID \ + EFI_GUID( 0xc1c41626, 0x504c, 0x4092, 0xac, 0xa9, 0x41, 0xf9, 0x36, 0x93, 0x43, 0x28 ) @@ -31,7 +31,7 @@ index de3e45088d4a..fac43c611614 100644 typedef struct { efi_guid_t guid; u64 table; -@@ -810,6 +816,20 @@ typedef struct _efi_file_io_interface { +@@ -823,6 +829,20 @@ typedef struct { #define EFI_INVALID_TABLE_ADDR (~0UL) @@ -53,5 +53,5 @@ index de3e45088d4a..fac43c611614 100644 * All runtime access to EFI goes through this structure: */ -- -2.4.3 +2.5.0 diff --git a/Btrfs-fix-fitrim-discarding-device-area-reserved-for.patch b/Btrfs-fix-fitrim-discarding-device-area-reserved-for.patch deleted file mode 100644 index 63f66fb..0000000 --- a/Btrfs-fix-fitrim-discarding-device-area-reserved-for.patch +++ /dev/null @@ -1,119 +0,0 @@ -From 259072b7a1c20f8612dcaa8e0e027004aa98f864 Mon Sep 17 00:00:00 2001 -From: Filipe Manana -Date: Wed, 6 Jan 2016 22:42:35 +0000 -Subject: [PATCH 2/2] Btrfs: fix fitrim discarding device area reserved for - boot loader's use - -As of the 4.3 kernel release, the fitrim ioctl can now discard any region -of a disk that is not allocated to any chunk/block group, including the -first megabyte which is used for our primary superblock and by the boot -loader (grub for example). - -Fix this by not allowing to trim/discard any region in the device starting -with an offset not greater than min(alloc_start_mount_option, 1Mb), just -as it was not possible before 4.3. - -A reproducer test case for xfstests follows. - - seq=`basename $0` - seqres=$RESULT_DIR/$seq - echo "QA output created by $seq" - tmp=/tmp/$$ - status=1 # failure is the default! - trap "_cleanup; exit \$status" 0 1 2 3 15 - - _cleanup() - { - cd / - rm -f $tmp.* - } - - # get standard environment, filters and checks - . ./common/rc - . ./common/filter - - # real QA test starts here - _need_to_be_root - _supported_fs btrfs - _supported_os Linux - _require_scratch - - rm -f $seqres.full - - _scratch_mkfs >>$seqres.full 2>&1 - - # Write to the [0, 64Kb[ and [68Kb, 1Mb[ ranges of the device. These ranges are - # reserved for a boot loader to use (GRUB for example) and btrfs should never - # use them - neither for allocating metadata/data nor should trim/discard them. - # The range [64Kb, 68Kb[ is used for the primary superblock of the filesystem. - $XFS_IO_PROG -c "pwrite -S 0xfd 0 64K" $SCRATCH_DEV | _filter_xfs_io - $XFS_IO_PROG -c "pwrite -S 0xfd 68K 956K" $SCRATCH_DEV | _filter_xfs_io - - # Now mount the filesystem and perform a fitrim against it. - _scratch_mount - _require_batched_discard $SCRATCH_MNT - $FSTRIM_PROG $SCRATCH_MNT - - # Now unmount the filesystem and verify the content of the ranges was not - # modified (no trim/discard happened on them). - _scratch_unmount - echo "Content of the ranges [0, 64Kb] and [68Kb, 1Mb[ after fitrim:" - od -t x1 -N $((64 * 1024)) $SCRATCH_DEV - od -t x1 -j $((68 * 1024)) -N $((956 * 1024)) $SCRATCH_DEV - - status=0 - exit - -Reported-by: Vincent Petry -Reported-by: Andrei Borzenkov -Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=109341 -Fixes: 499f377f49f0 (btrfs: iterate over unused chunk space in FITRIM) -Cc: stable@vger.kernel.org # 4.3+ -Signed-off-by: Filipe Manana ---- - fs/btrfs/volumes.c | 20 ++++++++++---------- - 1 file changed, 10 insertions(+), 10 deletions(-) - -diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c -index b816b3a2e118..96f8c827d563 100644 ---- a/fs/btrfs/volumes.c -+++ b/fs/btrfs/volumes.c -@@ -1208,6 +1208,15 @@ int find_free_dev_extent_start(struct btrfs_transaction *transaction, - int ret; - int slot; - struct extent_buffer *l; -+ u64 min_search_start; -+ -+ /* -+ * We don't want to overwrite the superblock on the drive nor any area -+ * used by the boot loader (grub for example), so we make sure to start -+ * at an offset of at least 1MB. -+ */ -+ min_search_start = max(root->fs_info->alloc_start, 1024ull * 1024); -+ search_start = max(search_start, min_search_start); - - path = btrfs_alloc_path(); - if (!path) -@@ -1348,18 +1357,9 @@ int find_free_dev_extent(struct btrfs_trans_handle *trans, - struct btrfs_device *device, u64 num_bytes, - u64 *start, u64 *len) - { -- struct btrfs_root *root = device->dev_root; -- u64 search_start; -- - /* FIXME use last free of some kind */ -- -- /* -- * we don't want to overwrite the superblock on the drive, -- * so we make sure to start at an offset of at least 1MB -- */ -- search_start = max(root->fs_info->alloc_start, 1024ull * 1024); - return find_free_dev_extent_start(trans->transaction, device, -- num_bytes, search_start, start, len); -+ num_bytes, 0, start, len); - } - - static int btrfs_free_dev_extent(struct btrfs_trans_handle *trans, --- -2.5.0 - diff --git a/HID-multitouch-Fetch-feature-reports-on-demand-for-W.patch b/HID-multitouch-Fetch-feature-reports-on-demand-for-W.patch deleted file mode 100644 index f6bb579..0000000 --- a/HID-multitouch-Fetch-feature-reports-on-demand-for-W.patch +++ /dev/null @@ -1,133 +0,0 @@ -From 84ac7d370783d4819c5986da1c5d5c62d360dc8f Mon Sep 17 00:00:00 2001 -From: Mika Westerberg -Date: Wed, 7 Oct 2015 15:33:43 +0300 -Subject: [PATCH] HID: multitouch: Fetch feature reports on demand for Win8 - devices - -Some newer Intel Skylake based Dell laptops with Win8 precision touchpad -fail when initial feature reports are fetched from it. Below is an example -output with some additional debug included: - - i2c_hid i2c-DLL0704:01: Fetching the HID descriptor - i2c_hid i2c-DLL0704:01: __i2c_hid_command: cmd=20 00 - i2c_hid i2c-DLL0704:01: HID Descriptor: 1e 00 00 01 99 02 21 00 24 ... - ... - i2c_hid i2c-DLL0704:01: i2c_hid_get_report - i2c_hid i2c-DLL0704:01: __i2c_hid_command: cmd=22 00 38 02 23 00 - i2c_hid i2c-DLL0704:01: report (len=4): 04 00 08 05 - i2c_hid i2c-DLL0704:01: report id 13 - i2c_hid i2c-DLL0704:01: i2c_hid_get_report - i2c_hid i2c-DLL0704:01: __i2c_hid_command: cmd=22 00 3d 02 23 00 - i2c_hid i2c-DLL0704:01: failed to retrieve report from device. - i2c_hid i2c-DLL0704:01: report id 7 - i2c_hid i2c-DLL0704:01: i2c_hid_get_report - i2c_hid i2c-DLL0704:01: __i2c_hid_command: cmd=22 00 37 02 23 00 - i2c_hid i2c-DLL0704:01: report (len=259): 03 01 07 fc 28 fe 84 40 ... - i2c_hid i2c-DLL0704:01: report id 4 - i2c_hid i2c-DLL0704:01: i2c_hid_get_report - i2c_hid i2c-DLL0704:01: __i2c_hid_command: cmd=22 00 34 02 23 00 - -We manage to fetch few reports but then the touchpad dies: - - i2c_designware i2c_designware.1: i2c_dw_handle_tx_abort: lost arbitration - i2c_hid i2c-DLL0704:01: failed to retrieve report from device. - -it eventually pulls the whole I2C bus low: - - i2c_designware i2c_designware.1: controller timed out - i2c_hid i2c-DLL0704:01: failed to set a report to device. - -Fix this by preventing initial feature report retrieval for Win8 devices. -Instead we fetch reports as needed in mt_feature_mapping(). This prevents -fetching reports which might cause problems with the device in question. - -Suggested-by: Benjamin Tissoires -Signed-off-by: Mika Westerberg -Reviewed-by: Benjamin Tissoires -Tested-by: Seth Forshee -Signed-off-by: Jiri Kosina ---- - drivers/hid/hid-multitouch.c | 45 +++++++++++++++++++++++++++++++++++++++++++- - 1 file changed, 44 insertions(+), 1 deletion(-) - -diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c -index 426b2f1a3450..4afe8d78b366 100644 ---- a/drivers/hid/hid-multitouch.c -+++ b/drivers/hid/hid-multitouch.c -@@ -309,6 +309,41 @@ static struct attribute_group mt_attribute_group = { - .attrs = sysfs_attrs - }; - -+static void mt_get_feature(struct hid_device *hdev, struct hid_report *report) -+{ -+ struct mt_device *td = hid_get_drvdata(hdev); -+ int ret, size = hid_report_len(report); -+ u8 *buf; -+ -+ /* -+ * Only fetch the feature report if initial reports are not already -+ * been retrieved. Currently this is only done for Windows 8 touch -+ * devices. -+ */ -+ if (!(hdev->quirks & HID_QUIRK_NO_INIT_REPORTS)) -+ return; -+ if (td->mtclass.name != MT_CLS_WIN_8) -+ return; -+ -+ buf = hid_alloc_report_buf(report, GFP_KERNEL); -+ if (!buf) -+ return; -+ -+ ret = hid_hw_raw_request(hdev, report->id, buf, size, -+ HID_FEATURE_REPORT, HID_REQ_GET_REPORT); -+ if (ret < 0) { -+ dev_warn(&hdev->dev, "failed to fetch feature %d\n", -+ report->id); -+ } else { -+ ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT, buf, -+ size, 0); -+ if (ret) -+ dev_warn(&hdev->dev, "failed to report feature\n"); -+ } -+ -+ kfree(buf); -+} -+ - static void mt_feature_mapping(struct hid_device *hdev, - struct hid_field *field, struct hid_usage *usage) - { -@@ -327,6 +362,8 @@ static void mt_feature_mapping(struct hid_device *hdev, - - break; - case HID_DG_CONTACTMAX: -+ mt_get_feature(hdev, field->report); -+ - td->maxcontact_report_id = field->report->id; - td->maxcontacts = field->value[0]; - if (!td->maxcontacts && -@@ -343,6 +380,7 @@ static void mt_feature_mapping(struct hid_device *hdev, - break; - } - -+ mt_get_feature(hdev, field->report); - if (field->value[usage->usage_index] == MT_BUTTONTYPE_CLICKPAD) - td->is_buttonpad = true; - -@@ -1026,8 +1064,13 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id) - * reports. Fortunately, the Win8 spec says that all touches - * should be sent during each report, making the initialization - * of input reports unnecessary. -+ * -+ * In addition some touchpads do not behave well if we read -+ * all feature reports from them. Instead we prevent -+ * initial report fetching and then selectively fetch each -+ * report we are interested in. - */ -- hdev->quirks |= HID_QUIRK_NO_INIT_INPUT_REPORTS; -+ hdev->quirks |= HID_QUIRK_NO_INIT_REPORTS; - - td = devm_kzalloc(&hdev->dev, sizeof(struct mt_device), GFP_KERNEL); - if (!td) { --- -2.5.0 - diff --git a/HID-multitouch-fix-input-mode-switching-on-some-Elan.patch b/HID-multitouch-fix-input-mode-switching-on-some-Elan.patch deleted file mode 100644 index c469460..0000000 --- a/HID-multitouch-fix-input-mode-switching-on-some-Elan.patch +++ /dev/null @@ -1,94 +0,0 @@ -From cd1e1e286bb3c4fa8714c1e571ae082e510efd5d Mon Sep 17 00:00:00 2001 -From: Benjamin Tissoires -Date: Tue, 1 Dec 2015 12:41:38 +0100 -Subject: [PATCH] HID: multitouch: fix input mode switching on some Elan panels - -as reported by https://bugzilla.kernel.org/show_bug.cgi?id=108481 - -This bug reports mentions 6d4f5440 ("HID: multitouch: Fetch feature -reports on demand for Win8 devices") as the origin of the problem but this -commit actually masked 2 firmware bugs that are annihilating each other: - -The report descriptor declares two features in reports 3 and 5: - -0x05, 0x0d, // Usage Page (Digitizers) 318 -0x09, 0x0e, // Usage (Device Configuration) 320 -0xa1, 0x01, // Collection (Application) 322 -0x85, 0x03, // Report ID (3) 324 -0x09, 0x22, // Usage (Finger) 326 -0xa1, 0x00, // Collection (Physical) 328 -0x09, 0x52, // Usage (Inputmode) 330 -0x15, 0x00, // Logical Minimum (0) 332 -0x25, 0x0a, // Logical Maximum (10) 334 -0x75, 0x08, // Report Size (8) 336 -0x95, 0x02, // Report Count (2) 338 -0xb1, 0x02, // Feature (Data,Var,Abs) 340 -0xc0, // End Collection 342 -0x09, 0x22, // Usage (Finger) 343 -0xa1, 0x00, // Collection (Physical) 345 -0x85, 0x05, // Report ID (5) 347 -0x09, 0x57, // Usage (Surface Switch) 349 -0x09, 0x58, // Usage (Button Switch) 351 -0x15, 0x00, // Logical Minimum (0) 353 -0x75, 0x01, // Report Size (1) 355 -0x95, 0x02, // Report Count (2) 357 -0x25, 0x03, // Logical Maximum (3) 359 -0xb1, 0x02, // Feature (Data,Var,Abs) 361 -0x95, 0x0e, // Report Count (14) 363 -0xb1, 0x03, // Feature (Cnst,Var,Abs) 365 -0xc0, // End Collection 367 - -The report ID 3 presents 2 input mode features, while only the first one -is handled by the device. Given that we did not checked if one was -previously assigned, we were dealing with the ignored featured and we -should never have been able to switch this panel into the multitouch mode. - -However, the firmware presents an other bugs which allowed 6d4f5440 -to counteract the faulty report descriptor. When we request the values -of the feature 5, the firmware answers "03 03 00". The fields are correct -but the report id is wrong. Before 6d4f5440, we retrieved all the features -and injected them in the system. So when we called report 5, we injected -in the system the report 3 with the values "03 00". -Setting the second input mode to 03 in this report changed it to "03 03" -and the touchpad switched to the mt mode. We could have set anything -in the second field because the actual value (the first 03 in this report) -was given by the query of report ID 5. - -To sum up: 2 bugs in the firmware were hiding that we were accessing the -wrong feature. - -Signed-off-by: Benjamin Tissoires -Signed-off-by: Jiri Kosina ---- - drivers/hid/hid-multitouch.c | 15 +++++++++++++-- - 1 file changed, 13 insertions(+), 2 deletions(-) - -diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c -index ba94044cb859..d866720412cd 100644 ---- a/drivers/hid/hid-multitouch.c -+++ b/drivers/hid/hid-multitouch.c -@@ -357,8 +357,19 @@ static void mt_feature_mapping(struct hid_device *hdev, - break; - } - -- td->inputmode = field->report->id; -- td->inputmode_index = usage->usage_index; -+ if (td->inputmode < 0) { -+ td->inputmode = field->report->id; -+ td->inputmode_index = usage->usage_index; -+ } else { -+ /* -+ * Some elan panels wrongly declare 2 input mode -+ * features, and silently ignore when we set the -+ * value in the second field. Skip the second feature -+ * and hope for the best. -+ */ -+ dev_info(&hdev->dev, -+ "Ignoring the extra HID_DG_INPUTMODE\n"); -+ } - - break; - case HID_DG_CONTACTMAX: --- -2.5.0 - diff --git a/Input-aiptek-fix-crash-on-detecting-device-without-e.patch b/Input-aiptek-fix-crash-on-detecting-device-without-e.patch deleted file mode 100644 index 19dbaa3..0000000 --- a/Input-aiptek-fix-crash-on-detecting-device-without-e.patch +++ /dev/null @@ -1,48 +0,0 @@ -From a0edc539fda3f0a4a271f47a0fcf79d1305c1444 Mon Sep 17 00:00:00 2001 -From: Vladis Dronov -Date: Wed, 25 Nov 2015 16:31:35 +0100 -Subject: [PATCH] Input: aiptek: fix crash on detecting device without - endpoints - -The aiptek driver crashes in aiptek_probe() when a specially crafted usb device -without endpoints is detected. This fix adds a check that the device has proper -configuration expected by the driver. Also an error return value is changed to -more matching one in one of the error paths. - -Reported-by: Ralf Spenneberg -Signed-off-by: Vladis Dronov ---- - drivers/input/tablet/aiptek.c | 10 ++++++++++ - 1 file changed, 10 insertions(+) - -diff --git a/drivers/input/tablet/aiptek.c b/drivers/input/tablet/aiptek.c -index e7f966da6efa..78c0732fbb57 100644 ---- a/drivers/input/tablet/aiptek.c -+++ b/drivers/input/tablet/aiptek.c -@@ -1819,6 +1819,15 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id) - input_set_abs_params(inputdev, ABS_TILT_Y, AIPTEK_TILT_MIN, AIPTEK_TILT_MAX, 0, 0); - input_set_abs_params(inputdev, ABS_WHEEL, AIPTEK_WHEEL_MIN, AIPTEK_WHEEL_MAX - 1, 0, 0); - -+ /* Verify that a device really has an endpoint -+ */ -+ if (intf->altsetting[0].desc.bNumEndpoints < 1) { -+ dev_warn(&intf->dev, -+ "interface has %d endpoints, but must have minimum 1\n", -+ intf->altsetting[0].desc.bNumEndpoints); -+ err = -ENODEV; -+ goto fail3; -+ } - endpoint = &intf->altsetting[0].endpoint[0].desc; - - /* Go set up our URB, which is called when the tablet receives -@@ -1861,6 +1870,7 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id) - if (i == ARRAY_SIZE(speeds)) { - dev_info(&intf->dev, - "Aiptek tried all speeds, no sane response\n"); -+ err = -ENODEV; - goto fail3; - } - --- -2.5.0 - diff --git a/KEYS-Fix-handling-of-stored-error-in-a-negatively-in.patch b/KEYS-Fix-handling-of-stored-error-in-a-negatively-in.patch deleted file mode 100644 index 3837037..0000000 --- a/KEYS-Fix-handling-of-stored-error-in-a-negatively-in.patch +++ /dev/null @@ -1,125 +0,0 @@ -From 3b34bea74e636583d34c8e472237a0bea1e3ba93 Mon Sep 17 00:00:00 2001 -From: David Howells -Date: Tue, 24 Nov 2015 21:36:31 +0000 -Subject: [PATCH] KEYS: Fix handling of stored error in a negatively - instantiated user key - -If a user key gets negatively instantiated, an error code is cached in the -payload area. A negatively instantiated key may be then be positively -instantiated by updating it with valid data. However, the ->update key -type method must be aware that the error code may be there. - -The following may be used to trigger the bug in the user key type: - - keyctl request2 user user "" @u - keyctl add user user "a" @u - -which manifests itself as: - - BUG: unable to handle kernel paging request at 00000000ffffff8a - IP: [] __call_rcu.constprop.76+0x1f/0x280 kernel/rcu/tree.c:3046 - PGD 7cc30067 PUD 0 - Oops: 0002 [#1] SMP - Modules linked in: - CPU: 3 PID: 2644 Comm: a.out Not tainted 4.3.0+ #49 - Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 - task: ffff88003ddea700 ti: ffff88003dd88000 task.ti: ffff88003dd88000 - RIP: 0010:[] [] __call_rcu.constprop.76+0x1f/0x280 - [] __call_rcu.constprop.76+0x1f/0x280 kernel/rcu/tree.c:3046 - RSP: 0018:ffff88003dd8bdb0 EFLAGS: 00010246 - RAX: 00000000ffffff82 RBX: 0000000000000000 RCX: 0000000000000001 - RDX: ffffffff81e3fe40 RSI: 0000000000000000 RDI: 00000000ffffff82 - RBP: ffff88003dd8bde0 R08: ffff88007d2d2da0 R09: 0000000000000000 - R10: 0000000000000000 R11: ffff88003e8073c0 R12: 00000000ffffff82 - R13: ffff88003dd8be68 R14: ffff88007d027600 R15: ffff88003ddea700 - FS: 0000000000b92880(0063) GS:ffff88007fd00000(0000) knlGS:0000000000000000 - CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b - CR2: 00000000ffffff8a CR3: 000000007cc5f000 CR4: 00000000000006e0 - Stack: - ffff88003dd8bdf0 ffffffff81160a8a 0000000000000000 00000000ffffff82 - ffff88003dd8be68 ffff88007d027600 ffff88003dd8bdf0 ffffffff810a39e5 - ffff88003dd8be20 ffffffff812a31ab ffff88007d027600 ffff88007d027620 - Call Trace: - [] kfree_call_rcu+0x15/0x20 kernel/rcu/tree.c:3136 - [] user_update+0x8b/0xb0 security/keys/user_defined.c:129 - [< inline >] __key_update security/keys/key.c:730 - [] key_create_or_update+0x291/0x440 security/keys/key.c:908 - [< inline >] SYSC_add_key security/keys/keyctl.c:125 - [] SyS_add_key+0x101/0x1e0 security/keys/keyctl.c:60 - [] entry_SYSCALL_64_fastpath+0x12/0x6a arch/x86/entry/entry_64.S:185 - -Note the error code (-ENOKEY) in EDX. - -A similar bug can be tripped by: - - keyctl request2 trusted user "" @u - keyctl add trusted user "a" @u - -This should also affect encrypted keys - but that has to be correctly -parameterised or it will fail with EINVAL before getting to the bit that -will crashes. - -Reported-by: Dmitry Vyukov -Signed-off-by: David Howells -Acked-by: Mimi Zohar -Signed-off-by: James Morris ---- - security/keys/encrypted-keys/encrypted.c | 2 ++ - security/keys/trusted.c | 5 ++++- - security/keys/user_defined.c | 5 ++++- - 3 files changed, 10 insertions(+), 2 deletions(-) - -diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c -index 7bed4ad7cd76..0a374a2ce030 100644 ---- a/security/keys/encrypted-keys/encrypted.c -+++ b/security/keys/encrypted-keys/encrypted.c -@@ -845,6 +845,8 @@ static int encrypted_update(struct key *key, struct key_preparsed_payload *prep) - size_t datalen = prep->datalen; - int ret = 0; - -+ if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) -+ return -ENOKEY; - if (datalen <= 0 || datalen > 32767 || !prep->data) - return -EINVAL; - -diff --git a/security/keys/trusted.c b/security/keys/trusted.c -index c0594cb07ada..aeb38f1a12e7 100644 ---- a/security/keys/trusted.c -+++ b/security/keys/trusted.c -@@ -984,13 +984,16 @@ static void trusted_rcu_free(struct rcu_head *rcu) - */ - static int trusted_update(struct key *key, struct key_preparsed_payload *prep) - { -- struct trusted_key_payload *p = key->payload.data; -+ struct trusted_key_payload *p; - struct trusted_key_payload *new_p; - struct trusted_key_options *new_o; - size_t datalen = prep->datalen; - char *datablob; - int ret = 0; - -+ if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) -+ return -ENOKEY; -+ p = key->payload.data; - if (!p->migratable) - return -EPERM; - if (datalen <= 0 || datalen > 32767 || !prep->data) -diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c -index 36b47bbd3d8c..7cf22260bdff 100644 ---- a/security/keys/user_defined.c -+++ b/security/keys/user_defined.c -@@ -120,7 +120,10 @@ int user_update(struct key *key, struct key_preparsed_payload *prep) - - if (ret == 0) { - /* attach the new data, displacing the old */ -- zap = key->payload.data; -+ if (!test_bit(KEY_FLAG_NEGATIVE, &key->flags)) -+ zap = key->payload.data; -+ else -+ zap = NULL; - rcu_assign_keypointer(key, upayload); - key->expiry = 0; - } --- -2.5.0 - diff --git a/KVM-x86-Reload-pit-counters-for-all-channels-when-re.patch b/KVM-x86-Reload-pit-counters-for-all-channels-when-re.patch deleted file mode 100644 index a9d88a0..0000000 --- a/KVM-x86-Reload-pit-counters-for-all-channels-when-re.patch +++ /dev/null @@ -1,59 +0,0 @@ -From f3b9db45027a40369fe13c4661c4249d1df8c8d0 Mon Sep 17 00:00:00 2001 -From: Andrew Honig -Date: Wed, 18 Nov 2015 14:50:23 -0800 -Subject: [PATCH] KVM: x86: Reload pit counters for all channels when restoring - state - -Currently if userspace restores the pit counters with a count of 0 -on channels 1 or 2 and the guest attempts to read the count on those -channels, then KVM will perform a mod of 0 and crash. This will ensure -that 0 values are converted to 65536 as per the spec. - -This is CVE-2015-7513. - -Signed-off-by: Andy Honig -Signed-off-by: Paolo Bonzini -[Backported to 4.3.y by Josh Boyer ] ---- - arch/x86/kvm/x86.c | 9 ++++++--- - 1 file changed, 6 insertions(+), 3 deletions(-) - -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 43609af03283..e124f9c8391e 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -3437,10 +3437,11 @@ static int kvm_vm_ioctl_get_pit(struct kvm *kvm, struct kvm_pit_state *ps) - static int kvm_vm_ioctl_set_pit(struct kvm *kvm, struct kvm_pit_state *ps) - { - int r = 0; -- -+ int i; - mutex_lock(&kvm->arch.vpit->pit_state.lock); - memcpy(&kvm->arch.vpit->pit_state, ps, sizeof(struct kvm_pit_state)); -- kvm_pit_load_count(kvm, 0, ps->channels[0].count, 0); -+ for (i = 0; i < 3; i++) -+ kvm_pit_load_count(kvm, i, ps->channels[i].count, 0); - mutex_unlock(&kvm->arch.vpit->pit_state.lock); - return r; - } -@@ -3461,6 +3462,7 @@ static int kvm_vm_ioctl_get_pit2(struct kvm *kvm, struct kvm_pit_state2 *ps) - static int kvm_vm_ioctl_set_pit2(struct kvm *kvm, struct kvm_pit_state2 *ps) - { - int r = 0, start = 0; -+ int i; - u32 prev_legacy, cur_legacy; - mutex_lock(&kvm->arch.vpit->pit_state.lock); - prev_legacy = kvm->arch.vpit->pit_state.flags & KVM_PIT_FLAGS_HPET_LEGACY; -@@ -3470,7 +3472,8 @@ static int kvm_vm_ioctl_set_pit2(struct kvm *kvm, struct kvm_pit_state2 *ps) - memcpy(&kvm->arch.vpit->pit_state.channels, &ps->channels, - sizeof(kvm->arch.vpit->pit_state.channels)); - kvm->arch.vpit->pit_state.flags = ps->flags; -- kvm_pit_load_count(kvm, 0, kvm->arch.vpit->pit_state.channels[0].count, start); -+ for (i = 0; i < 3; i++) -+ kvm_pit_load_count(kvm, i, kvm->arch.vpit->pit_state.channels[i].count, start); - mutex_unlock(&kvm->arch.vpit->pit_state.lock); - return r; - } --- -2.5.0 - diff --git a/SCSI-fix-bug-in-scsi_dev_info_list-matching.patch b/SCSI-fix-bug-in-scsi_dev_info_list-matching.patch deleted file mode 100644 index d79ccf9..0000000 --- a/SCSI-fix-bug-in-scsi_dev_info_list-matching.patch +++ /dev/null @@ -1,140 +0,0 @@ -From 4abc12dd59bed74aa1730c2b3129d1750604d530 Mon Sep 17 00:00:00 2001 -From: Alan Stern -Date: Mon, 3 Aug 2015 11:57:29 -0400 -Subject: [PATCH 2/2] SCSI: fix bug in scsi_dev_info_list matching - -The "compatible" matching algorithm used for looking up old-style -blacklist entries in a scsi_dev_info_list is buggy. The core of the -algorithm looks like this: - - if (memcmp(devinfo->vendor, vendor, - min(max, strlen(devinfo->vendor)))) - /* not a match */ - -where max is the length of the device's vendor string after leading -spaces have been removed but trailing spaces have not. Because of the -min() computation, either entry could be a proper substring of the -other and the code would still think that they match. - -In the case originally reported, the device's vendor and product -strings were "Inateck " and " ". These matched against -the following entry in the global device list: - - {"", "Scanner", "1.80", BLIST_NOLUN} - -because "" is a substring of "Inateck " and "" (the result of removing -leading spaces from the device's product string) is a substring of -"Scanner". The mistaken match prevented the system from scanning and -finding the device's second Logical Unit. - -This patch fixes the problem by making two changes. First, the code -for leading-space removal is hoisted out of the loop. (This means it -will sometimes run unnecessarily, but since a large percentage of all -lookups involve the "compatible" entries in global device list, this -should be an overall improvement.) Second and more importantly, the -patch removes trailing spaces and adds a check to verify that the two -resulting strings are exactly the same length. This prevents matches -where one entry is a proper substring of the other. - -Signed-off-by: Alan Stern -Reported-by: Giulio Bernardi -Tested-by: Giulio Bernardi -Signed-off-by: James Bottomley ---- - drivers/scsi/scsi_devinfo.c | 69 +++++++++++++++++++++++---------------------- - 1 file changed, 35 insertions(+), 34 deletions(-) - -diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c -index 2f49a224462d..2c1160c7ec92 100644 ---- a/drivers/scsi/scsi_devinfo.c -+++ b/drivers/scsi/scsi_devinfo.c -@@ -407,51 +407,52 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor, - struct scsi_dev_info_list *devinfo; - struct scsi_dev_info_list_table *devinfo_table = - scsi_devinfo_lookup_by_key(key); -+ size_t vmax, mmax; -+ const char *vskip, *mskip; - - if (IS_ERR(devinfo_table)) - return (struct scsi_dev_info_list *) devinfo_table; - -+ /* Prepare for "compatible" matches */ -+ -+ /* -+ * XXX why skip leading spaces? If an odd INQUIRY -+ * value, that should have been part of the -+ * scsi_static_device_list[] entry, such as " FOO" -+ * rather than "FOO". Since this code is already -+ * here, and we don't know what device it is -+ * trying to work with, leave it as-is. -+ */ -+ vmax = 8; /* max length of vendor */ -+ vskip = vendor; -+ while (vmax > 0 && *vskip == ' ') { -+ vmax--; -+ vskip++; -+ } -+ /* Also skip trailing spaces */ -+ while (vmax > 0 && vskip[vmax - 1] == ' ') -+ --vmax; -+ -+ mmax = 16; /* max length of model */ -+ mskip = model; -+ while (mmax > 0 && *mskip == ' ') { -+ mmax--; -+ mskip++; -+ } -+ while (mmax > 0 && mskip[mmax - 1] == ' ') -+ --mmax; -+ - list_for_each_entry(devinfo, &devinfo_table->scsi_dev_info_list, - dev_info_list) { - if (devinfo->compatible) { - /* - * Behave like the older version of get_device_flags. - */ -- size_t max; -- /* -- * XXX why skip leading spaces? If an odd INQUIRY -- * value, that should have been part of the -- * scsi_static_device_list[] entry, such as " FOO" -- * rather than "FOO". Since this code is already -- * here, and we don't know what device it is -- * trying to work with, leave it as-is. -- */ -- max = 8; /* max length of vendor */ -- while ((max > 0) && *vendor == ' ') { -- max--; -- vendor++; -- } -- /* -- * XXX removing the following strlen() would be -- * good, using it means that for a an entry not in -- * the list, we scan every byte of every vendor -- * listed in scsi_static_device_list[], and never match -- * a single one (and still have to compare at -- * least the first byte of each vendor). -- */ -- if (memcmp(devinfo->vendor, vendor, -- min(max, strlen(devinfo->vendor)))) -+ if (memcmp(devinfo->vendor, vskip, vmax) || -+ devinfo->vendor[vmax]) - continue; -- /* -- * Skip spaces again. -- */ -- max = 16; /* max length of model */ -- while ((max > 0) && *model == ' ') { -- max--; -- model++; -- } -- if (memcmp(devinfo->model, model, -- min(max, strlen(devinfo->model)))) -+ if (memcmp(devinfo->model, mskip, mmax) || -+ devinfo->model[mmax]) - continue; - return devinfo; - } else { --- -2.5.0 - diff --git a/SCSI-refactor-device-matching-code-in-scsi_devinfo.c.patch b/SCSI-refactor-device-matching-code-in-scsi_devinfo.c.patch deleted file mode 100644 index e87baad..0000000 --- a/SCSI-refactor-device-matching-code-in-scsi_devinfo.c.patch +++ /dev/null @@ -1,183 +0,0 @@ -From 26d61e8347b27a981d647d3ea4ec8c7f462c1fcf Mon Sep 17 00:00:00 2001 -From: Alan Stern -Date: Mon, 3 Aug 2015 11:57:21 -0400 -Subject: [PATCH 1/2] SCSI: refactor device-matching code in scsi_devinfo.c - -In drivers/scsi/scsi_devinfo.c, the scsi_dev_info_list_del_keyed() and -scsi_get_device_flags_keyed() routines contain a large amount of -duplicate code for finding vendor/product matches in a -scsi_dev_info_list. This patch factors out the duplicate code and -puts it in a separate function, scsi_dev_info_list_find(). - -Signed-off-by: Alan Stern -Suggested-by: Giulio Bernardi -Signed-off-by: James Bottomley ---- - drivers/scsi/scsi_devinfo.c | 112 ++++++++++++++++---------------------------- - 1 file changed, 41 insertions(+), 71 deletions(-) - -diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c -index 9f77d23239a2..2f49a224462d 100644 ---- a/drivers/scsi/scsi_devinfo.c -+++ b/drivers/scsi/scsi_devinfo.c -@@ -390,25 +390,26 @@ int scsi_dev_info_list_add_keyed(int compatible, char *vendor, char *model, - EXPORT_SYMBOL(scsi_dev_info_list_add_keyed); - - /** -- * scsi_dev_info_list_del_keyed - remove one dev_info list entry. -+ * scsi_dev_info_list_find - find a matching dev_info list entry. - * @vendor: vendor string - * @model: model (product) string - * @key: specify list to use - * - * Description: -- * Remove and destroy one dev_info entry for @vendor, @model -+ * Finds the first dev_info entry matching @vendor, @model - * in list specified by @key. - * -- * Returns: 0 OK, -error on failure. -+ * Returns: pointer to matching entry, or ERR_PTR on failure. - **/ --int scsi_dev_info_list_del_keyed(char *vendor, char *model, int key) -+static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor, -+ const char *model, int key) - { -- struct scsi_dev_info_list *devinfo, *found = NULL; -+ struct scsi_dev_info_list *devinfo; - struct scsi_dev_info_list_table *devinfo_table = - scsi_devinfo_lookup_by_key(key); - - if (IS_ERR(devinfo_table)) -- return PTR_ERR(devinfo_table); -+ return (struct scsi_dev_info_list *) devinfo_table; - - list_for_each_entry(devinfo, &devinfo_table->scsi_dev_info_list, - dev_info_list) { -@@ -452,25 +453,42 @@ int scsi_dev_info_list_del_keyed(char *vendor, char *model, int key) - if (memcmp(devinfo->model, model, - min(max, strlen(devinfo->model)))) - continue; -- found = devinfo; -+ return devinfo; - } else { - if (!memcmp(devinfo->vendor, vendor, - sizeof(devinfo->vendor)) && - !memcmp(devinfo->model, model, - sizeof(devinfo->model))) -- found = devinfo; -+ return devinfo; - } -- if (found) -- break; - } - -- if (found) { -- list_del(&found->dev_info_list); -- kfree(found); -- return 0; -- } -+ return ERR_PTR(-ENOENT); -+} -+ -+/** -+ * scsi_dev_info_list_del_keyed - remove one dev_info list entry. -+ * @vendor: vendor string -+ * @model: model (product) string -+ * @key: specify list to use -+ * -+ * Description: -+ * Remove and destroy one dev_info entry for @vendor, @model -+ * in list specified by @key. -+ * -+ * Returns: 0 OK, -error on failure. -+ **/ -+int scsi_dev_info_list_del_keyed(char *vendor, char *model, int key) -+{ -+ struct scsi_dev_info_list *found; - -- return -ENOENT; -+ found = scsi_dev_info_list_find(vendor, model, key); -+ if (IS_ERR(found)) -+ return PTR_ERR(found); -+ -+ list_del(&found->dev_info_list); -+ kfree(found); -+ return 0; - } - EXPORT_SYMBOL(scsi_dev_info_list_del_keyed); - -@@ -565,64 +583,16 @@ int scsi_get_device_flags_keyed(struct scsi_device *sdev, - int key) - { - struct scsi_dev_info_list *devinfo; -- struct scsi_dev_info_list_table *devinfo_table; -+ int err; - -- devinfo_table = scsi_devinfo_lookup_by_key(key); -+ devinfo = scsi_dev_info_list_find(vendor, model, key); -+ if (!IS_ERR(devinfo)) -+ return devinfo->flags; - -- if (IS_ERR(devinfo_table)) -- return PTR_ERR(devinfo_table); -+ err = PTR_ERR(devinfo); -+ if (err != -ENOENT) -+ return err; - -- list_for_each_entry(devinfo, &devinfo_table->scsi_dev_info_list, -- dev_info_list) { -- if (devinfo->compatible) { -- /* -- * Behave like the older version of get_device_flags. -- */ -- size_t max; -- /* -- * XXX why skip leading spaces? If an odd INQUIRY -- * value, that should have been part of the -- * scsi_static_device_list[] entry, such as " FOO" -- * rather than "FOO". Since this code is already -- * here, and we don't know what device it is -- * trying to work with, leave it as-is. -- */ -- max = 8; /* max length of vendor */ -- while ((max > 0) && *vendor == ' ') { -- max--; -- vendor++; -- } -- /* -- * XXX removing the following strlen() would be -- * good, using it means that for a an entry not in -- * the list, we scan every byte of every vendor -- * listed in scsi_static_device_list[], and never match -- * a single one (and still have to compare at -- * least the first byte of each vendor). -- */ -- if (memcmp(devinfo->vendor, vendor, -- min(max, strlen(devinfo->vendor)))) -- continue; -- /* -- * Skip spaces again. -- */ -- max = 16; /* max length of model */ -- while ((max > 0) && *model == ' ') { -- max--; -- model++; -- } -- if (memcmp(devinfo->model, model, -- min(max, strlen(devinfo->model)))) -- continue; -- return devinfo->flags; -- } else { -- if (!memcmp(devinfo->vendor, vendor, -- sizeof(devinfo->vendor)) && -- !memcmp(devinfo->model, model, -- sizeof(devinfo->model))) -- return devinfo->flags; -- } -- } - /* nothing found, return nothing */ - if (key != SCSI_DEVINFO_GLOBAL) - return 0; --- -2.5.0 - diff --git a/arm64-avoid-needing-console-to-enable-serial-console.patch b/arm64-avoid-needing-console-to-enable-serial-console.patch index 47d09c2..e8cc7bb 100644 --- a/arm64-avoid-needing-console-to-enable-serial-console.patch +++ b/arm64-avoid-needing-console-to-enable-serial-console.patch @@ -1,3 +1,4 @@ +From ede02df9a481ba07348e6fd4393ba2e273ef16d8 Mon Sep 17 00:00:00 2001 From: Mark Salter Date: Wed, 25 Mar 2015 14:17:50 -0400 Subject: [PATCH] arm64: avoid needing console= to enable serial console @@ -14,13 +15,13 @@ Signed-off-by: Mark Salter 1 file changed, 19 insertions(+) diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c -index f3067d4d4e35..6f8d814c4e5c 100644 +index 8119479..ea9ff80 100644 --- a/arch/arm64/kernel/setup.c +++ b/arch/arm64/kernel/setup.c -@@ -568,3 +568,22 @@ const struct seq_operations cpuinfo_op = { - .stop = c_stop, - .show = c_show - }; +@@ -381,3 +381,22 @@ static int __init topology_init(void) + return 0; + } + subsys_initcall(topology_init); + +/* + * Temporary hack to avoid need for console= on command line @@ -40,3 +41,6 @@ index f3067d4d4e35..6f8d814c4e5c 100644 + return 0; +} +early_initcall(arm64_console_setup); +-- +2.5.0 + diff --git a/block-ensure-to-split-after-potentially-bouncing-a-b.patch b/block-ensure-to-split-after-potentially-bouncing-a-b.patch deleted file mode 100644 index 6dda59a..0000000 --- a/block-ensure-to-split-after-potentially-bouncing-a-b.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 23688bf4f830a89866fd0ed3501e342a7360fe4f Mon Sep 17 00:00:00 2001 -From: Junichi Nomura -Date: Tue, 22 Dec 2015 10:23:44 -0700 -Subject: [PATCH] block: ensure to split after potentially bouncing a bio - -blk_queue_bio() does split then bounce, which makes the segment -counting based on pages before bouncing and could go wrong. Move -the split to after bouncing, like we do for blk-mq, and the we -fix the issue of having the bio count for segments be wrong. - -Fixes: 54efd50bfd87 ("block: make generic_make_request handle arbitrarily sized bios") -Cc: stable@vger.kernel.org -Tested-by: Artem S. Tashkinov -Signed-off-by: Jens Axboe ---- - block/blk-core.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/block/blk-core.c b/block/blk-core.c -index 3636be469fa2..c487b94c59e3 100644 ---- a/block/blk-core.c -+++ b/block/blk-core.c -@@ -1689,8 +1689,6 @@ static blk_qc_t blk_queue_bio(struct request_queue *q, struct bio *bio) - struct request *req; - unsigned int request_count = 0; - -- blk_queue_split(q, &bio, q->bio_split); -- - /* - * low level driver can indicate that it wants pages above a - * certain limit bounced to low memory (ie for highmem, or even -@@ -1698,6 +1696,8 @@ static blk_qc_t blk_queue_bio(struct request_queue *q, struct bio *bio) - */ - blk_queue_bounce(q, &bio); - -+ blk_queue_split(q, &bio, q->bio_split); -+ - if (bio_integrity_enabled(bio) && bio_integrity_prep(bio)) { - bio->bi_error = -EIO; - bio_endio(bio); --- -2.5.0 - diff --git a/btrfs-handle-invalid-num_stripes-in-sys_array.patch b/btrfs-handle-invalid-num_stripes-in-sys_array.patch deleted file mode 100644 index 20bf403..0000000 --- a/btrfs-handle-invalid-num_stripes-in-sys_array.patch +++ /dev/null @@ -1,66 +0,0 @@ -From 43d10880aa4ac713cf73dbac428be9671ef1bf9d Mon Sep 17 00:00:00 2001 -From: David Sterba -Date: Mon, 30 Nov 2015 17:27:06 +0100 -Subject: [PATCH 1/2] btrfs: handle invalid num_stripes in sys_array - -We can handle the special case of num_stripes == 0 directly inside -btrfs_read_sys_array. The BUG_ON in btrfs_chunk_item_size is there to -catch other unhandled cases where we fail to validate external data. - -A crafted or corrupted image crashes at mount time: - -BTRFS: device fsid 9006933e-2a9a-44f0-917f-514252aeec2c devid 1 transid 7 /dev/loop0 -BTRFS info (device loop0): disk space caching is enabled -BUG: failure at fs/btrfs/ctree.h:337/btrfs_chunk_item_size()! -Kernel panic - not syncing: BUG! -CPU: 0 PID: 313 Comm: mount Not tainted 4.2.5-00657-ge047887-dirty #25 -Stack: - 637af890 60062489 602aeb2e 604192ba - 60387961 00000011 637af8a0 6038a835 - 637af9c0 6038776b 634ef32b 00000000 -Call Trace: - [<6001c86d>] show_stack+0xfe/0x15b - [<6038a835>] dump_stack+0x2a/0x2c - [<6038776b>] panic+0x13e/0x2b3 - [<6020f099>] btrfs_read_sys_array+0x25d/0x2ff - [<601cfbbe>] open_ctree+0x192d/0x27af - [<6019c2c1>] btrfs_mount+0x8f5/0xb9a - [<600bc9a7>] mount_fs+0x11/0xf3 - [<600d5167>] vfs_kern_mount+0x75/0x11a - [<6019bcb0>] btrfs_mount+0x2e4/0xb9a - [<600bc9a7>] mount_fs+0x11/0xf3 - [<600d5167>] vfs_kern_mount+0x75/0x11a - [<600d710b>] do_mount+0xa35/0xbc9 - [<600d7557>] SyS_mount+0x95/0xc8 - [<6001e884>] handle_syscall+0x6b/0x8e - -Reported-by: Jiri Slaby -Reported-by: Vegard Nossum -CC: stable@vger.kernel.org # 3.19+ -Signed-off-by: David Sterba ---- - fs/btrfs/volumes.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c -index 6fc735869c18..b816b3a2e118 100644 ---- a/fs/btrfs/volumes.c -+++ b/fs/btrfs/volumes.c -@@ -6399,6 +6399,14 @@ int btrfs_read_sys_array(struct btrfs_root *root) - goto out_short_read; - - num_stripes = btrfs_chunk_num_stripes(sb, chunk); -+ if (!num_stripes) { -+ printk(KERN_ERR -+ "BTRFS: invalid number of stripes %u in sys_array at offset %u\n", -+ num_stripes, cur_offset); -+ ret = -EIO; -+ break; -+ } -+ - len = btrfs_chunk_item_size(num_stripes); - if (cur_offset + len > array_size) - goto out_short_read; --- -2.5.0 - diff --git a/config-arm-generic b/config-arm-generic index c898459..399bfaf 100644 --- a/config-arm-generic +++ b/config-arm-generic @@ -7,8 +7,8 @@ CONFIG_SERIAL_EARLYCON_ARM_SEMIHOST=y CONFIG_FB_SSD1307=m CONFIG_HW_PERF_EVENTS=y CONFIG_NFS_FS=y +CONFIG_FORCE_MAX_ZONEORDER=11 -CONFIG_CRASH=m CONFIG_CC_STACKPROTECTOR=y # CONFIG_PID_IN_CONTEXTIDR is not set @@ -94,6 +94,35 @@ CONFIG_CLKSRC_VERSATILE=y CONFIG_POWER_RESET_VERSATILE=y # CONFIG_ARM_CHARLCD is not set +# Rockchips +CONFIG_ARCH_ROCKCHIP=y +CONFIG_I2C_RK3X=m +CONFIG_SPI_ROCKCHIP=m +CONFIG_PWM_ROCKCHIP=m +CONFIG_ROCKCHIP_SARADC=m +CONFIG_ROCKCHIP_IODOMAIN=m +CONFIG_MMC_DW_ROCKCHIP=m +CONFIG_EMAC_ROCKCHIP=m +CONFIG_MFD_RK808=m +CONFIG_COMMON_CLK_RK808=m +CONFIG_REGULATOR_RK808=m +CONFIG_RTC_DRV_RK808=m +CONFIG_RTC_DRV_HYM8563=m +CONFIG_ROCKCHIP_SARADC=m +CONFIG_ROCKCHIP_IOMMU=y +CONFIG_ROCKCHIP_THERMAL=m +CONFIG_DRM_ROCKCHIP=m +CONFIG_ROCKCHIP_DW_HDMI=m +CONFIG_PHY_ROCKCHIP_USB=m +CONFIG_DWMAC_ROCKCHIP=m +CONFIG_SND_SOC_ROCKCHIP=m +CONFIG_SND_SOC_ROCKCHIP_I2S=m +CONFIG_SND_SOC_ROCKCHIP_MAX98090=m +CONFIG_SND_SOC_ROCKCHIP_RT5645=m +CONFIG_SND_SOC_ROCKCHIP_SPDIF=m +CONFIG_REGULATOR_ACT8865=m +CONFIG_ROCKCHIP_PM_DOMAINS=y + # Tegra # CONFIG_TEGRA_AHB is not set @@ -136,6 +165,7 @@ CONFIG_THERMAL_OF=y CONFIG_MAILBOX=y CONFIG_ARM_MHU=m # CONFIG_PL320_MBOX is not set +CONFIG_ARM_SCPI_PROTOCOL=m # USB CONFIG_USB_OHCI_HCD_PLATFORM=m @@ -144,6 +174,7 @@ CONFIG_USB_XHCI_PLATFORM=m # MMC/SD CONFIG_MMC_SPI=m +CONFIG_MMC_SDHCI_OF_ARASAN=m # Designware (used by numerous devices) CONFIG_MMC_DW=m @@ -170,6 +201,9 @@ CONFIG_USB_DWC3_ULPI=y CONFIG_DW_WATCHDOG=m CONFIG_PCIE_DW=y # CONFIG_MMC_DW_EXYNOS is not set +CONFIG_I2C_DESIGNWARE_CORE=m +CONFIG_I2C_DESIGNWARE_PLATFORM=m +CONFIG_GPIO_DWAPB=m # External Connectors CONFIG_EXTCON=m @@ -210,6 +244,13 @@ CONFIG_POWER_RESET_GPIO_RESTART=y CONFIG_POWER_RESET_RESTART=y # CONFIG_GPIO_74XX_MMIO is not set +# Pin stuff +CONFIG_PINMUX=y +CONFIG_PINCONF=y +CONFIG_PINCTRL=y +CONFIG_GENERIC_PINCONF=y +CONFIG_PINCTRL_SINGLE=m + #i2c CONFIG_I2C_ARB_GPIO_CHALLENGE=m CONFIG_I2C_BOARDINFO=y @@ -227,6 +268,7 @@ CONFIG_SPI_PL022=m # Sensors CONFIG_SENSORS_IIO_HWMON=m CONFIG_IIO_SYSFS_TRIGGER=m +CONFIG_SENSORS_ARM_SCPI=m # PHY framework CONFIG_GENERIC_PHY=y @@ -279,6 +321,7 @@ CONFIG_VFIO_AMBA=m # CONFIG_COMMON_CLK_SI570 is not set # CONFIG_COMMON_CLK_QCOM is not set +CONFIG_COMMON_CLK_SCPI=m # CONFIG_ARM_PTDUMP is not set @@ -305,6 +348,7 @@ CONFIG_VFIO_AMBA=m # netdrv +CONFIG_NET_VENDOR_MELLANOX=y # CONFIG_NET_VENDOR_3COM is not set # CONFIG_NET_VENDOR_ADAPTEC is not set # CONFIG_NET_VENDOR_BROADCOM is not set @@ -314,7 +358,6 @@ CONFIG_VFIO_AMBA=m # CONFIG_NET_VENDOR_DEC is not set # CONFIG_NET_VENDOR_EMULEX is not set # CONFIG_NET_VENDOR_EXAR is not set -# CONFIG_NET_VENDOR_MELLANOX is not set # CONFIG_NET_VENDOR_QLOGIC is not set # CONFIG_NET_VENDOR_SUN is not set # CONFIG_NET_VENDOR_WIZNET is not set @@ -352,11 +395,15 @@ CONFIG_VFIO_AMBA=m # CONFIG_DEBUG_SET_MODULE_RONX is not set # CONFIG_CORESIGHT is not set - # CONFIG_LATTICE_ECP3_CONFIG is not set # CONFIG_BMP085_SPI is not set # CONFIG_TI_DAC7512 is not set -# CONFIG_SPI_ROCKCHIP is not set # https://fedoraproject.org/wiki/Features/Checkpoint_Restore CONFIG_CHECKPOINT_RESTORE=y + +# Bad Intel shit we don't care about +# CONFIG_PINCTRL_BAYTRAIL is not set +# CONFIG_PINCTRL_CHERRYVIEW is not set +# CONFIG_PINCTRL_BROXTON is not set +# CONFIG_PINCTRL_SUNRISEPOINT is not set diff --git a/config-arm64 b/config-arm64 index 31f4d51..d2a7232 100644 --- a/config-arm64 +++ b/config-arm64 @@ -10,18 +10,18 @@ CONFIG_SCHED_SMT=y CONFIG_ARCH_HISI=y CONFIG_ARCH_SEATTLE=y CONFIG_ARCH_XGENE=y -# CONFIG_ARCH_THUNDER is not set +# CONFIG_ARCH_BCM_IPROC is not set +# CONFIG_ARCH_BERLIN is not set # CONFIG_ARCH_EXYNOS7 is not set # CONFIG_ARCH_FSL_LS2085A is not set +# CONFIG_ARCH_LAYERSCAPE is not set # CONFIG_ARCH_MEDIATEK is not set -# CONFIG_ARCH_TEGRA is not set # CONFIG_ARCH_QCOM is not set # CONFIG_ARCH_SPRD is not set +# CONFIG_ARCH_STRATIX10 is not set +# CONFIG_ARCH_TEGRA is not set +# CONFIG_ARCH_THUNDER is not set # CONFIG_ARCH_ZYNQMP is not set -# CONFIG_ARCH_BCM_IPROC is not set -# CONFIG_ARCH_BERLIN is not set -# CONFIG_ARCH_ROCKCHIP is not set - # Erratum CONFIG_ARM64_ERRATUM_826319=y @@ -29,8 +29,10 @@ CONFIG_ARM64_ERRATUM_827319=y CONFIG_ARM64_ERRATUM_824069=y CONFIG_ARM64_ERRATUM_819472=y CONFIG_ARM64_ERRATUM_832075=y -CONFIG_ARM64_ERRATUM_834220=y CONFIG_ARM64_ERRATUM_843419=y +CONFIG_ARM64_ERRATUM_834220=y +CONFIG_CAVIUM_ERRATUM_22375=y +CONFIG_CAVIUM_ERRATUM_23154=y # AMBA / VExpress # CONFIG_RTC_DRV_PL030 is not set @@ -57,17 +59,17 @@ CONFIG_CONSOLE_TRANSLATIONS=y CONFIG_HAVE_64BIT_ALIGNED_ACCESS=y CONFIG_HVC_DRIVER=y +# CONFIG_HVC_DCC is not set CONFIG_HZ=100 CONFIG_KVM=y -CONFIG_KVM_ARM_MAX_VCPUS=8 +CONFIG_KVM_ARM_MAX_VCPUS=16 CONFIG_RCU_FANOUT=64 CONFIG_SPARSE_IRQ=y CONFIG_SPARSEMEM_VMEMMAP=y # CONFIG_SYS_HYPERVISOR is not set -# CONFIG_THERMAL is not set CONFIG_EFI=y CONFIG_EFI_VARS=y @@ -89,6 +91,11 @@ CONFIG_ACPI_CUSTOM_METHOD=m CONFIG_ACPI_NFIT=m # CONFIG_ACPI_NFIT_DEBUG is not set CONFIG_PCC=y +CONFIG_ACPI_CPPC_CPUFREQ=y +CONFIG_ACPI_PROCESSOR=y +CONFIG_ACPI_THERMAL=y +CONFIG_I2C_SCMI=m +CONFIG_SENSORS_ACPI_POWER=m CONFIG_ARM64_CRYPTO=y CONFIG_CRYPTO_SHA1_ARM64_CE=y @@ -106,7 +113,6 @@ CONFIG_CRYPTO_DEV_CCP_CRYPTO=m # APM Xgene CONFIG_POWER_RESET_XGENE=y CONFIG_COMMON_CLK_XGENE=y - CONFIG_AHCI_XGENE=y CONFIG_PHY_XGENE=y CONFIG_NET_XGENE=y @@ -116,6 +122,9 @@ CONFIG_GPIO_XGENE=y CONFIG_GPIO_XGENE_SB=m CONFIG_XGENE_DMA=m CONFIG_EDAC_XGENE=m +CONFIG_PCI_XGENE=y +CONFIG_PCI_XGENE_MSI=y +CONFIG_I2C_XGENE_SLIMPRO=m # busted build for various reasons # uses pci_* for some reason to allocate DMA buffers @@ -126,36 +135,29 @@ CONFIG_EDAC_XGENE=m # CONFIG_PARPORT_PC is not set # CONFIG_VGA_CONSOLE is not set -CONFIG_PCI_XGENE=y -CONFIG_PCI_XGENE_MSI=y # CONFIG_HOTPLUG_PCI_SHPC is not set # CONFIG_ARM64_RANDOMIZE_TEXT_OFFSET is not set # CONFIG_PNP_DEBUG_MESSAGES is not set -CONFIG_I2C_SCMI=m -CONFIG_I2C_XGENE_SLIMPRO=m -CONFIG_SENSORS_ACPI_POWER=m # AMD Seattle CONFIG_NET_SB1000=y CONFIG_AMD_XGBE=m CONFIG_AMD_XGBE_PHY=m # CONFIG_AMD_XGBE_DCB is not set +# CONFIG_VFIO_PLATFORM_AMDXGBE_RESET is not set +CONFIG_PINCTRL_AMD=y # HiSilicon CONFIG_POWER_RESET_HISI=y CONFIG_HISI_THERMAL=m CONFIG_STUB_CLK_HI6220=y +CONFIG_PCI_HISI=y # ThunderX # CONFIG_MDIO_OCTEON is not set -CONFIG_NET_VENDOR_MELLANOX=y -CONFIG_MLX4_EN=m -CONFIG_MLX4_EN_DCB=y -CONFIG_MLX4_EN_VXLAN=y - # CONFIG_IMX_THERMAL is not set CONFIG_DMI=y diff --git a/config-armv7 b/config-armv7 index 7c81e1d..eaa6d4e 100644 --- a/config-armv7 +++ b/config-armv7 @@ -5,7 +5,6 @@ CONFIG_ARCH_MXC=y CONFIG_ARCH_OMAP3=y CONFIG_ARCH_OMAP4=y -CONFIG_ARCH_PICOXCELL=y CONFIG_ARCH_QCOM=y CONFIG_ARCH_TEGRA=y CONFIG_ARCH_U8500=y @@ -22,7 +21,7 @@ CONFIG_ARCH_OMAP2PLUS_TYPICAL=y CONFIG_SOC_OMAP5=y # CONFIG_SOC_DRA7XX is not set CONFIG_SOC_OMAP3430=y -CONFIG_SOC_TI81XX=y +# CONFIG_SOC_TI81XX is not set # CONFIG_MACH_NOKIA_RX51 is not set # CONFIG_MACH_OMAP_LDP is not set # CONFIG_MACH_OMAP3517EVM is not set @@ -63,9 +62,9 @@ CONFIG_TWL4030_MADC=m CONFIG_TWL4030_POWER=y CONFIG_TWL4030_WATCHDOG=m CONFIG_BATTERY_TWL4030_MADC=m -CONFIG_BATTERY_BQ27x00=m -CONFIG_BATTERY_BQ27X00_I2C=y -CONFIG_BATTERY_BQ27X00_PLATFORM=y +CONFIG_BATTERY_BQ27XXX=m +CONFIG_BATTERY_BQ27XXX_I2C=y +CONFIG_BATTERY_BQ27XXX_PLATFORM=y CONFIG_OMAP_USB2=m CONFIG_OMAP_CONTROL_PHY=m CONFIG_TI_PIPE3=m @@ -84,9 +83,9 @@ CONFIG_USB_EHCI_HCD_OMAP=m CONFIG_USB_OHCI_HCD_OMAP3=m CONFIG_USB_MUSB_AM35X=m CONFIG_USB_MUSB_OMAP2PLUS=m +CONFIG_USB_INVENTRA_DMA=y CONFIG_USB_DWC3_OMAP=m CONFIG_MMC_OMAP=m -CONFIG_MMC_OMAP_HS=m CONFIG_RTC_DRV_MAX8907=m # CONFIG_RTC_DRV_TWL92330 is not set CONFIG_RTC_DRV_TWL4030=y @@ -240,8 +239,6 @@ CONFIG_TI_CPSW=m CONFIG_TI_CPSW_PHY_SEL=y CONFIG_TI_CPSW_ALE=m CONFIG_TI_CPTS=y -# Builtin needed for BBone White -CONFIG_REGULATOR_TPS65217=y CONFIG_TI_EMIF=m CONFIG_DRM_TILCDC=m # We only need this until the BBB dts is actually updated @@ -265,6 +262,13 @@ CONFIG_VIDEO_AM437X_VPFE=m CONFIG_UIO_PRUSS=m CONFIG_WKUP_M3_RPROC=m +# Builtin needed for BBone White +CONFIG_MFD_TPS65217=y +CONFIG_REGULATOR_TPS65217=y +CONFOG_CHARGER_TPS65217=m +CONFIG_BACKLIGHT_TPS65217=m +CONFIG_REGULATOR_TPS65217=m + CONFIG_CAN_C_CAN=m CONFIG_CAN_C_CAN_PLATFORM=m @@ -351,6 +355,7 @@ CONFIG_REGULATOR_QCOM_SMD_RPM=m CONFIG_SOC_IMX50=y CONFIG_SOC_IMX51=y CONFIG_SOC_IMX53=y +CONFIG_SOC_IMX6=y CONFIG_SOC_IMX6Q=y CONFIG_SOC_IMX6SL=y CONFIG_SOC_IMX6SX=y @@ -408,6 +413,7 @@ CONFIG_CRYPTO_DEV_FSL_CAAM_CRYPTO_API=m CONFIG_CRYPTO_DEV_FSL_CAAM_AHASH_API=m CONFIG_CRYPTO_DEV_FSL_CAAM_RNG_API=m # CONFIG_CRYPTO_DEV_FSL_CAAM_DEBUG is not set +# CONFIG_CRYPTO_DEV_MXS_DCP is not set CONFIG_RTC_DRV_SNVS=m CONFIG_FB_MXS=m # CONFIG_FB_MX3 is not set @@ -546,17 +552,6 @@ CONFIG_SENSORS_AB8500=m CONFIG_STE_MODEM_RPROC=m CONFIG_STIH415_RESET=y -CONFIG_IIO_ST_GYRO_I2C_3AXIS=m -CONFIG_IIO_ST_GYRO_SPI_3AXIS=m -CONFIG_IIO_ST_MAGN_I2C_3AXIS=m -CONFIG_IIO_ST_MAGN_SPI_3AXIS=m -CONFIG_IIO_ST_PRESS=m -CONFIG_IIO_ST_PRESS_I2C=m -CONFIG_IIO_ST_PRESS_SPI=m -CONFIG_IIO_ST_SENSORS_I2C=m -CONFIG_IIO_ST_SENSORS_SPI=m -CONFIG_IIO_ST_SENSORS_CORE=m - # Allwinner CONFIG_MACH_SUN4I=y CONFIG_MACH_SUN5I=y @@ -609,7 +604,6 @@ CONFIG_GPIO_ZYNQ=m CONFIG_I2C_XILINX=m CONFIG_SPI_XILINX=m CONFIG_SPI_CADENCE=m -CONFIG_MMC_SDHCI_OF_ARASAN=m CONFIG_I2C_CADENCE=m CONFIG_XILINX_WATCHDOG=m CONFIG_XILINX_XADC=m diff --git a/config-armv7-generic b/config-armv7-generic index 1fcaa96..285b4dc 100644 --- a/config-armv7-generic +++ b/config-armv7-generic @@ -50,7 +50,6 @@ CONFIG_CPU_SW_DOMAIN_PAN=y # Platforms enabled/disabled globally on ARMv7 CONFIG_ARCH_EXYNOS=y CONFIG_ARCH_HIGHBANK=y -CONFIG_ARCH_ROCKCHIP=y CONFIG_ARCH_SUNXI=y CONFIG_ARCH_TEGRA=y CONFIG_ARCH_VEXPRESS_CORTEX_A5_A9_ERRATA=y @@ -76,6 +75,7 @@ CONFIG_ARCH_VIRT=y # CONFIG_ARCH_AT91 is not set # CONFIG_ARCH_UNIPHIER is not set # CONFIG_ARCH_ZX is not set +# CONFIG_SOC_BRCMSTB is not set # errata # v5/v6 @@ -126,6 +126,7 @@ CONFIG_ARM_CPU_SUSPEND=y CONFIG_ARM_PSCI=y CONFIG_THERMAL=y CONFIG_CLOCK_THERMAL=y +# CONFIG_DEVFREQ_THERMAL is not set CONFIG_CPUFREQ_DT=m # CONFIG_ARM_BIG_LITTLE_CPUFREQ is not set CONFIG_PM_DEVFREQ=y @@ -200,11 +201,12 @@ CONFIG_GPIO_PCA953X=m CONFIG_GPIO_PCF857X=m CONFIG_TOUCHSCREEN_SUN4I=m CONFIG_MFD_AXP20X=y +CONFIG_AXP20X_POWER=m +CONFIG_INPUT_AXP20X_PEK=m +CONFIG_REGULATOR_AXP20X=m CONFIG_AXP288_FUEL_GAUGE=m CONFIG_AXP288_ADC=m CONFIG_EXTCON_AXP288=m -CONFIG_INPUT_AXP20X_PEK=m -CONFIG_REGULATOR_AXP20X=m CONFIG_AXP288_CHARGER=m CONFIG_TOUCHSCREEN_CHIPONE_ICN8318=m CONFIG_IR_SUNXI=m @@ -218,6 +220,8 @@ CONFIG_KEYBOARD_SUN4I_LRADC=m CONFIG_PWM_SUN4I=m CONFIG_USB_MUSB_SUNXI=m CONFIG_CRYPTO_DEV_SUN4I_SS=m +CONFIG_SND_SUN4I_CODEC=m +CONFIG_SUNXI_RSB=m # Exynos CONFIG_ARCH_EXYNOS3=y @@ -287,6 +291,7 @@ CONFIG_DRM_EXYNOS_HDMI=y CONFIG_DRM_EXYNOS_IPP=y CONFIG_DRM_EXYNOS_ROTATOR=y CONFIG_DRM_EXYNOS_VIDI=y +CONFIG_DRM_EXYNOS_MIXER=y CONFIG_PHY_EXYNOS_DP_VIDEO=m # CONFIG_FB_S3C is not set CONFIG_PHY_EXYNOS_MIPI_VIDEO=m @@ -329,34 +334,8 @@ CONFIG_LEDS_MAX8997=m CONFIG_RTC_DRV_MAX8997=m CONFIG_RTC_DRV_MAX77686=m CONFIG_RTC_DRV_MAX77802=m -CONFIG_RTC_DRV_RK808=m CONFIG_EXTCON_MAX8997=m -# Rockchips -CONFIG_I2C_RK3X=m -CONFIG_SPI_ROCKCHIP=m -CONFIG_PWM_ROCKCHIP=m -CONFIG_ROCKCHIP_SARADC=m -CONFIG_ROCKCHIP_IODOMAIN=m -CONFIG_MMC_DW_ROCKCHIP=m -CONFIG_EMAC_ROCKCHIP=m -CONFIG_MFD_RK808=m -CONFIG_COMMON_CLK_RK808=m -CONFIG_REGULATOR_RK808=m -CONFIG_RTC_DRV_HYM8563=m -CONFIG_ROCKCHIP_SARADC=m -CONFIG_ROCKCHIP_IOMMU=y -CONFIG_SND_SOC_ROCKCHIP=m -CONFIG_SND_SOC_ROCKCHIP_I2S=m -CONFIG_ROCKCHIP_THERMAL=m -CONFIG_DRM_ROCKCHIP=m -CONFIG_ROCKCHIP_DW_HDMI=m -CONFIG_PHY_ROCKCHIP_USB=m -CONFIG_DWMAC_ROCKCHIP=m -CONFIG_SND_SOC_ROCKCHIP_MAX98090=m -CONFIG_SND_SOC_ROCKCHIP_RT5645=m -CONFIG_REGULATOR_ACT8865=m - # Tegra CONFIG_ARCH_TEGRA_114_SOC=y CONFIG_ARCH_TEGRA_124_SOC=y @@ -410,6 +389,8 @@ CONFIG_RTC_DRV_AS3722=y # TI Generic CONFIG_TI_SOC_THERMAL=m CONFIG_TI_THERMAL=y +# CONFIG_OMAP3_THERMAL is not set +CONFIG_MMC_OMAP_HS=m # mvebu CONFIG_ARCH_MVEBU=y @@ -475,6 +456,7 @@ CONFIG_DRM_PANEL_LG_LG4573=m CONFIG_DRM_PANEL_SAMSUNG_LD9040=m CONFIG_DRM_PANEL_SAMSUNG_S6E8AA0=m CONFIG_DRM_DW_HDMI=m +# CONFIG_DRM_DW_HDMI_AHB_AUDIO is not set # regmap CONFIG_REGMAP_SPI=m @@ -496,8 +478,7 @@ CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS=2 CONFIG_USB_MUSB_HDRC=m CONFIG_USB_MUSB_DUAL_ROLE=y CONFIG_USB_MUSB_DSPS=m -# Use PIO on musb as upstream doesn't support multiple DMA engines yet :-/ -CONFIG_MUSB_PIO_ONLY=y +# CONFIG_MUSB_PIO_ONLY is not set # CONFIG_USB_MUSB_TUSB6010 is not set # CONFIG_USB_MUSB_UX500 is not set CONFIG_USB_GPIO_VBUS=m @@ -541,7 +522,6 @@ CONFIG_USB_CONFIGFS_SERIAL=y # Multifunction Devices CONFIG_MFD_TPS65090=y -CONFIG_MFD_TPS65217=y CONFIG_MFD_TPS65910=y CONFIG_MFD_TPS65912=y CONFIG_MFD_TPS65912_I2C=y @@ -562,11 +542,6 @@ CONFIG_MFD_TPS65912_SPI=y # # Pin stuff -CONFIG_PINMUX=y -CONFIG_PINCONF=y -CONFIG_PINCTRL=y -CONFIG_PINCTRL_SINGLE=y -CONFIG_GENERIC_PINCONF=y # CONFIG_PINCTRL_AMD is not set # CONFIG_PINCTRL_SAMSUNG is not set # CONFIG_PINCTRL_MSM8X74 is not set @@ -619,8 +594,6 @@ CONFIG_SPI_XCOMM=m CONFIG_NFC_NCI_SPI=y # i2c -CONFIG_I2C_DESIGNWARE_CORE=m -CONFIG_I2C_DESIGNWARE_PLATFORM=m CONFIG_I2C_MV64XXX=m # HW crypto and rng @@ -668,9 +641,6 @@ CONFIG_SND_ARM=y CONFIG_SND_SOC_AC97_BUS=y CONFIG_SND_SOC_AC97_CODEC=y -# Displays -CONFIG_BACKLIGHT_TPS65217=m - # RTC CONFIG_RTC_DRV_DS1305=m CONFIG_RTC_DRV_DS1390=m @@ -747,11 +717,11 @@ CONFIG_TMP006=m CONFIG_BMP085=y CONFIG_BMP085_I2C=m CONFIG_BMP085_SPI=m -CONFIG_DHT11=m -CONFIG_MPL3115=m +CONFIG_BMP280=m CONFIG_SENSORS_AD7314=m CONFIG_SENSORS_ADCXX=m CONFIG_SENSORS_ADS7871=m +CONFIG_SENSORS_BH1780=m CONFIG_SENSORS_GPIO_FAN=m CONFIG_SENSORS_HTU21=m CONFIG_SENSORS_ISL29018=m @@ -759,11 +729,12 @@ CONFIG_SENSORS_ISL29028=m CONFIG_SENSORS_LIS3_SPI=m CONFIG_SENSORS_LM70=m CONFIG_SENSORS_MAX1111=m +CONFIG_MPL115=m CONFIG_MPL3115=m +CONFIG_DHT11=m CONFIG_SI7005=m CONFIG_SI7020=m -# LCD panels CONFIG_LCD_L4F00242T03=m CONFIG_LCD_LMS283GF05=m CONFIG_LCD_LTV350QV=m @@ -902,7 +873,6 @@ CONFIG_R8188EU=m # CONFIG_SCSI_ACARD is not set # CONFIG_SFC is not set # CONFIG_SND_ALI5451 is not set -# CONFIG_MLX4_EN is not set # CONFIG_POWER_RESET_QNAP is not set # CONFIG_MMC_TMIO is not set # CONFIG_PINCTRL_IMX35 is not set @@ -936,3 +906,8 @@ CONFIG_R8188EU=m # CONFIG_CRYPTO_DEV_UX500_DEBUG is not set # CONFIG_AB8500_DEBUG is not set # CONFIG_ARM_KERNMEM_PERMS is not set + +# CONFIG_VFIO_PLATFORM_AMDXGBE_RESET is not set + +# Altera? +# CONFIG_PCIE_ALTERA is not set diff --git a/config-debug b/config-debug index d57a218..d733183 100644 --- a/config-debug +++ b/config-debug @@ -31,7 +31,7 @@ CONFIG_LOCK_STAT=y CONFIG_DEBUG_STACK_USAGE=y CONFIG_ACPI_DEBUG=y - +# CONFIG_ACPI_DEBUGGER is not set CONFIG_DEBUG_SG=y CONFIG_DEBUG_PI_LIST=y diff --git a/config-generic b/config-generic index bc0e297..508543b 100644 --- a/config-generic +++ b/config-generic @@ -160,7 +160,7 @@ CONFIG_MMC_MTK=m # CONFIG_MMC_SDHCI_OF_ARASAN is not set # CONFIG_MMC_SDHCI_F_SDH30 is not set # CONFIG_MMC_USDHI6ROL0 is not set - +# CONFIG_MMC_SDHCI_OF_ESDHC is not set CONFIG_CB710_CORE=m # CONFIG_CB710_DEBUG is not set @@ -189,14 +189,12 @@ CONFIG_INFINIBAND_CXGB4=m CONFIG_SCSI_CXGB3_ISCSI=m CONFIG_SCSI_CXGB4_ISCSI=m # CONFIG_INFINIBAND_CXGB3_DEBUG is not set -CONFIG_MLX4_INFINIBAND=m -CONFIG_MLX5_INFINIBAND=m CONFIG_INFINIBAND_NES=m # CONFIG_INFINIBAND_NES_DEBUG is not set CONFIG_INFINIBAND_QIB=m CONFIG_INFINIBAND_QIB_DCA=y -# CONFIG_INFINIBAND_OCRDMA is not set -# CONFIG_INFINIBAND_USNIC is not set +CONFIG_INFINIBAND_OCRDMA=m +CONFIG_INFINIBAND_USNIC=m # # Executable file formats @@ -360,6 +358,8 @@ CONFIG_HOTPLUG_PCI_ACPI_IBM=m # CONFIG_NVMEM is not set +# CONFIG_FPGA is not set + # # Block devices # @@ -585,6 +585,8 @@ CONFIG_FCOE_FNIC=m CONFIG_SCSI_SNIC=m # CONFIG_SCSI_SNIC_DEBUG_FS is not set +# CONFIG_NVM is not set + CONFIG_ATA=y CONFIG_ATA_BMDMA=y CONFIG_ATA_VERBOSE_ERROR=y @@ -897,6 +899,7 @@ CONFIG_NETFILTER_NETLINK_ACCT=m CONFIG_NETFILTER_NETLINK_QUEUE=m CONFIG_NETFILTER_NETLINK_QUEUE_CT=y CONFIG_NETFILTER_NETLINK_LOG=m +# CONFIG_NETFILTER_NETLINK_GLUE_CT is not set CONFIG_NETFILTER_XTABLES=y CONFIG_NETFILTER_XT_SET=m CONFIG_NETFILTER_XT_MARK=m @@ -1428,7 +1431,8 @@ CONFIG_CHELSIO_T1_1G=y CONFIG_CHELSIO_T3=m CONFIG_CHELSIO_T4=m CONFIG_CHELSIO_T4VF=m -# CONFIG_CHELSIO_T4_DCB is not set +CONFIG_CHELSIO_T4_DCB=y +# CONFIG_CHELSIO_T4_FCOE is not set CONFIG_NET_VENDOR_CISCO=y CONFIG_ENIC=m @@ -1544,6 +1548,8 @@ CONFIG_QLCNIC_VXLAN=y CONFIG_QLCNIC_HWMON=y CONFIG_QLGE=m CONFIG_NETXEN_NIC=m +CONFIG_QED=m +CONFIG_QEDE=m # CONFIG_NET_VENDOR_QUALCOMM is not set @@ -1673,12 +1679,20 @@ CONFIG_JME=m # # Ethernet (10000 Mbit) +# CONFIG_NET_VENDOR_AURORA is not set + # # CONFIG_IP1000 is not set -# CONFIG_MLX4_EN is not set -# CONFIG_MLX4_EN_VXLAN is not set -# CONFIG_MLX5_CORE is not set +CONFIG_MLX4_CORE=m +CONFIG_MLX4_EN=m +CONFIG_MLX4_EN_DCB=y +CONFIG_MLX4_EN_VXLAN=y +CONFIG_MLX4_INFINIBAND=m +CONFIG_MLX5_CORE=m +CONFIG_MLX5_CORE_EN=y +CONFIG_MLX5_INFINIBAND=m # CONFIG_MLXSW_CORE is not set +# CONFIG_MLX4_DEBUG is not set # CONFIG_SFC is not set # CONFIG_FDDI is not set @@ -1832,6 +1846,8 @@ CONFIG_LIBERTAS_SDIO=m # CONFIG_LIBERTAS_THINFIRM is not set # CONFIG_LIBERTAS_SPI is not set CONFIG_LIBERTAS_MESH=y +CONFIG_BNXT=m +CONFIG_BNXT_SRIOV=y CONFIG_IWLWIFI=m CONFIG_IWLDVM=m @@ -1913,6 +1929,9 @@ CONFIG_RTL8723AE=m CONFIG_RTL8723BE=m CONFIG_RTL8188EE=m CONFIG_RTL8821AE=m +CONFIG_RTL8XXXU=m +# Untested is intentionally disabled in stable branches +# CONFIG_RTL8XXXU_UNTESTED is not set CONFIG_MWIFIEX=m CONFIG_MWIFIEX_SDIO=m @@ -1928,6 +1947,8 @@ CONFIG_IEEE802154_ATUSB=m CONFIG_IEEE802154_CC2520=m # CONFIG_IEEE802154_AT86RF230 is not set # CONFIG_IEEE802154_MRF24J40 is not set +# CONFIG_IEEE802154_NL802154_EXPERIMENTAL is not set +# CONFIG_IEEE802154_AT86RF230_DEBUGFS is not set CONFIG_MAC802154=m CONFIG_NET_MPLS_GSO=m @@ -2010,6 +2031,7 @@ CONFIG_CAN_GS_USB=m CONFIG_CAN_8DEV_USB=m CONFIG_CAN_SOFTING=m # CONFIG_CAN_SOFTING_CS is not set +CONFIG_CAN_SUN4I=m CONFIG_NETROM=m CONFIG_ROSE=m @@ -2050,7 +2072,9 @@ CONFIG_NFC_ST21NFCA_I2C=m # CONFIG_NFC_NCI_UART is not set # CONFIG_NFC_ST_NCI is not set # CONFIG_NFC_S3FWRN5_I2C is not set - +# CONFIG_NFC_FDP is not set +# CONFIG_NFC_MRVL_I2C is not set +# CONFIG_NFC_MRVL_SPI is not set # # IrDA (infrared) support @@ -2264,6 +2288,8 @@ CONFIG_GIGASET_M105=m # # CONFIG_PHONE is not set +# CONFIG_NET_L3_MASTER_DEV is not set + # # Input device support # @@ -2328,6 +2354,7 @@ CONFIG_SERIO_ARC_PS2=m # CONFIG_SERIO_PARKBD is not set # CONFIG_SERIO_PCIPS2 is not set # CONFIG_SERIO_LIBPS2 is not set +# CONFIG_USERIO is not set # # Input Device Drivers @@ -2457,6 +2484,9 @@ CONFIG_TOUCHSCREEN_ZFORCE=m # CONFIG_TOUCHSCREEN_SX8654 is not set # CONFIG_TOUCHSCREEN_WDT87XX_I2C is not set # CONFIG_TOUCHSCREEN_IMX6UL_TSC is not set +# CONFIG_TOUCHSCREEN_FT6236 is not set +# CONFIG_TOUCHSCREEN_ROHM_BU21023 is not set +# CONFIG_TOUCHSCREEN_TSC2004 is not set CONFIG_INPUT_MISC=y CONFIG_INPUT_E3X0_BUTTON=m @@ -2528,6 +2558,8 @@ CONFIG_SERIAL_8250_SHARE_IRQ=y CONFIG_SERIAL_8250_RSA=y CONFIG_SERIAL_8250_DW=y # CONFIG_SERIAL_8250_INGENIC is not set +CONFIG_SERIAL_8250_RT288X=y +CONFIG_SERIAL_8250_MID=y CONFIG_CYCLADES=m # CONFIG_CYZ_INTR is not set # CONFIG_MOXA_INTELLIO is not set @@ -2581,7 +2613,7 @@ CONFIG_I2C_CHARDEV=m # CONFIG_I2C_MUX_PCA9541 is not set # CONFIG_I2C_MUX_PINCTRL is not set # CONFIG_I2C_MUX_REG is not set -# +# CONFIG_I2C_CADENCE is not set # # I2C Algorithms @@ -2808,6 +2840,7 @@ CONFIG_SENSORS_MAX34440=m CONFIG_SENSORS_MAX8688=m CONFIG_SENSORS_MAX1668=m CONFIG_SENSORS_MAX197=m +CONFIG_SENSORS_MAX31790=m CONFIG_SENSORS_TPS40422=m # CONFIG_NTB is not set @@ -2931,6 +2964,18 @@ CONFIG_PA12203001=m # CONFIG_T5403 is not set # CONFIG_MCP4922 is not set # CONFIG_MAX1027 is not set +# CONFIG_MXC4005 is not set +# CONFIG_VZ89X is not set +# CONFIG_HDC100X is not set +# CONFIG_HTU21 is not set +# CONFIG_APDS9960 is not set +# CONFIG_US5182D is not set +# CONFIG_MCP4531 is not set +# CONFIG_MS5637 is not set +# CONFIG_LIDAR_LITE_V2 is not set +# CONFIG_TSYS01 is not set +# CONFIG_TSYS02D is not set +# CONFIG_HI8435 is not set # staging IIO drivers # CONFIG_AD7291 is not set @@ -3065,6 +3110,7 @@ CONFIG_WM831X_WATCHDOG=m # CONFIG_GPIO_WATCHDOG is not set # CONFIG_XILINX_WATCHDOG is not set # CONFIG_CADENCE_WATCHDOG is not set +# CONFIG_BCM7038_WDT is not set CONFIG_HW_RANDOM=y CONFIG_HW_RANDOM_TIMERIOMEM=m @@ -3151,6 +3197,7 @@ CONFIG_RTC_DRV_PCF85063=m # CONFIG_RTC_DRV_XGENE is not set # CONFIG_RTC_DRV_ABB5ZES3 is not set # CONFIG_RTC_DRV_ZYNQMP is not set +# CONFIG_RTC_DRV_RV8803 is not set CONFIG_R3964=m # CONFIG_APPLICOM is not set @@ -3577,6 +3624,7 @@ CONFIG_FB_EFI=y # CONFIG_FB_GOLDFISH is not set # CONFIG_FB_OPENCORES is not set # CONFIG_FB_SM712 is not set +# CONFIG_FB_IBM_GXT4500 is not set # CONFIG_FIRMWARE_EDID is not set @@ -3767,6 +3815,8 @@ CONFIG_SND_DICE=m CONFIG_SND_OXFW=m CONFIG_SND_FIREWORKS=m CONFIG_SND_BEBOB=m +CONFIG_SND_FIREWIRE_DIGI00X=m +CONFIG_SND_FIREWIRE_TASCAM=m # # Open Sound System @@ -3803,7 +3853,6 @@ CONFIG_USB_EHCI_TT_NEWSCHED=y # CONFIG_USB_ISP116X_HCD is not set # CONFIG_USB_ISP1760 is not set CONFIG_USB_ISP1362_HCD=m -CONFIG_USB_FUSBH200_HCD=m # CONFIG_USB_FOTG210_HCD is not set # CONFIG_USB_GR_UDC is not set CONFIG_USB_OHCI_HCD=y @@ -3949,7 +3998,8 @@ CONFIG_HID_BELKIN=m CONFIG_HID_APPLEIR=m # CONFIG_HID_CP2112 is not set CONFIG_HID_LENOVO=m - +CONFIG_HID_CORSAIR=m +CONFIG_HID_GFRM=m # # USB Imaging devices @@ -4239,6 +4289,7 @@ CONFIG_SSB_PCMCIAHOST=y # CONFIG_SSB_DEBUG is not set CONFIG_SSB_DRIVER_PCICORE=y CONFIG_SSB_DRIVER_GPIO=y +CONFIG_SSB_HOST_SOC=y # Multifunction USB devices # CONFIG_MFD_PCF50633 is not set @@ -4318,7 +4369,7 @@ CONFIG_MFD_VIPERBOARD=m # CONFIG_MFD_DA9062 is not set # CONFIG_EZX_PCAP is not set # CONFIG_INTEL_SOC_PMIC is not set - +# CONFIG_MFD_ATMEL_FLEXCOM is not set # # File systems @@ -4552,6 +4603,7 @@ CONFIG_GFS2_FS_LOCKING_DLM=y CONFIG_UBIFS_FS=m # CONFIG_UBIFS_FS_ADVANCED_COMPR is not set +CONFIG_UBIFS_ATIME_SUPPORT=y # # Partition Types @@ -4704,6 +4756,7 @@ CONFIG_MEMORY_FAILURE=y CONFIG_HWPOISON_INJECT=m CONFIG_CROSS_MEMORY_ATTACH=y # CONFIG_DEBUG_SECTION_MISMATCH is not set +CONFIG_SECTION_MISMATCH_WARN_ONLY=y # CONFIG_BACKTRACE_SELF_TEST is not set CONFIG_LATENCYTOP=y # CONFIG_COMPAT_BRK is not set @@ -4711,8 +4764,8 @@ CONFIG_LATENCYTOP=y # CONFIG_DEBUG_BLOCK_EXT_DEVT is not set CONFIG_EARLY_PRINTK_DBGP=y # CONFIG_PAGE_POISONING is not set -# CONFIG_CRASH_DUMP is not set -# CONFIG_CRASH is not set +CONFIG_CRASH=m +CONFIG_CRASH_DUMP=y # CONFIG_GCOV_KERNEL is not set CONFIG_KGDB=y @@ -4838,7 +4891,7 @@ CONFIG_CRYPTO_CHACHA20=m CONFIG_CRYPTO_842=m CONFIG_CRYPTO_DRBG_HASH=y CONFIG_CRYPTO_DRBG_CTR=y - +CONFIG_CRYPTO_KEYWRAP=m @@ -5059,6 +5112,7 @@ CONFIG_SND_SOC_GENERIC_DMAENGINE_PCM=y # CONFIG_SND_SOC_AK4554 is not set # CONFIG_SND_SOC_AK4642 is not set # CONFIG_SND_SOC_AK5386 is not set +# CONFIG_SND_SOC_AK4613 is not set # CONFIG_SND_SOC_CS42L52 is not set # CONFIG_SND_SOC_CS42L73 is not set # CONFIG_SND_SOC_CS4270 is not set @@ -5201,6 +5255,7 @@ CONFIG_ASYNC_TX_DMA=y # CONFIG_HSU_DMA is not set # CONFIG_HSU_DMA_PCI is not set # CONFIG_XGENE_DMA is not set +# CONFIG_INTEL_IDMA64 is not set CONFIG_UNUSED_SYMBOLS=y @@ -5222,6 +5277,7 @@ CONFIG_FUNCTION_PROFILER=y CONFIG_RING_BUFFER_BENCHMARK=m # CONFIG_RING_BUFFER_STARTUP_TEST is not set # CONFIG_TRACE_ENUM_MAP_FILE is not set +# CONFIG_TRACING_EVENTS_GPIO is not set # CONFIG_RBTREE_TEST is not set # CONFIG_INTERVAL_TREE_TEST is not set CONFIG_FUNCTION_TRACER=y @@ -5265,7 +5321,7 @@ CONFIG_APM_POWER=m # CONFIG_BATTERY_DS2782 is not set # CONFIG_BATTERY_SBS is not set # CONFIG_BATTERY_DS2780 is not set -# CONFIG_BATTERY_BQ27x00 is not set +# CONFIG_BATTERY_BQ27XXX is not set # CONFIG_BATTERY_MAX17040 is not set # CONFIG_BATTERY_MAX17042 is not set # CONFIG_BATTERY_GOLDFISH is not set @@ -5281,6 +5337,9 @@ CONFIG_APM_POWER=m # CONFIG_CHARGER_BQ24257 is not set # CONFIG_CHARGER_BQ25890 is not set # CONFIG_CHARGER_RT9455 is not set +# CONFIG_CHARGER_QCOM_SMBB is not set +# CONFIG_CHARGER_TPS65217 is not set +# CONFIG_AXP20X_POWER is not set CONFIG_POWER_RESET=y # CONFIG_POWER_RESET_LTC2952 is not set @@ -5308,7 +5367,7 @@ CONFIG_UIO_PCI_GENERIC=m CONFIG_VFIO=m CONFIG_VFIO_IOMMU_TYPE1=m CONFIG_VFIO_PCI=m - +# CONFIG_VFIO_NOIOMMU is not set # LIRC CONFIG_LIRC_STAGING=y @@ -5470,6 +5529,7 @@ CONFIG_USBIP_HOST=m # CONFIG_FB_TFT is not set # CONFIG_FB_SM750 is not set # CONFIG_STAGING_RDMA is not set +# CONFIG_WILC1000_DRIVER is not set # END OF STAGING # @@ -5597,6 +5657,9 @@ CONFIG_GPIO_VIPERBOARD=m # CONFIG_GPIO_XILINX is not set # CONFIG_GPIO_ALTERA is not set # CONFIG_GPIO_ZX is not set +# CONFIG_GPIO_AMDPT is not set +# CONFIG_GPIO_104_IDIO_16 is not set +# CONFIG_GPIO_IT87 is not set # FIXME: Why? @@ -5638,6 +5701,7 @@ CONFIG_PSTORE_RAM=m # CONFIG_TEST_HEXDUMP is not set # CONFIG_TEST_RHASHTABLE is not set # CONFIG_TEST_STATIC_KEYS is not set +# CONFIG_TEST_PRINTF is not set # CONFIG_AVERAGE is not set # CONFIG_VMXNET3 is not set @@ -5663,6 +5727,7 @@ CONFIG_IOMMU_SUPPORT=y # CONFIG_MAILBOX is not set # CONFIG_ALTERA_MBOX is not set +# CONFIG_MAILBOX_TEST is not set # CONFIG_RESET_CONTROLLER is not set @@ -5711,3 +5776,12 @@ CONFIG_POWERCAP=y # set in x86-generic presently # CONFIG_TOUCHSCREEN_GOODIX is not set + +# CONFIG_INTEL_TH is not set +# CONFIG_STM is not set +# CONFIG_STM_DUMMY is not set +# CONFIG_STM_SOURCE_CONSOLE is not set + +# CONFIG_AHCI_QORIQ is not set +# CONFIG_COMMON_CLK_SI514 is not set +# CONFIG_CLK_QORIQ is not set diff --git a/config-nodebug b/config-nodebug index 15af3c7..65e8acc 100644 --- a/config-nodebug +++ b/config-nodebug @@ -31,6 +31,7 @@ CONFIG_CPUMASK_OFFSTACK=y # CONFIG_DEBUG_STACK_USAGE is not set # CONFIG_ACPI_DEBUG is not set +# CONFIG_ACPI_DEBUGGER is not set # CONFIG_DEBUG_SG is not set # CONFIG_DEBUG_PI_LIST is not set diff --git a/config-powerpc64-generic b/config-powerpc64-generic index 7f0b105..b543cfb 100644 --- a/config-powerpc64-generic +++ b/config-powerpc64-generic @@ -64,8 +64,6 @@ CONFIG_CGROUP_HUGETLB=y CONFIG_RCU_FANOUT=64 CONFIG_RCU_FANOUT_LEAF=16 -CONFIG_CRASH=m -CONFIG_CRASH_DUMP=y CONFIG_FA_DUMP=y CONFIG_RELOCATABLE=y @@ -166,6 +164,7 @@ CONFIG_SCSI_IPR_TRACE=y CONFIG_SCSI_IPR_DUMP=y CONFIG_SERIAL_ICOM=m +# CONFIG_SERIAL_8250 is not set # Things we might want to review for newer architectures # CONFIG_PCIEPORTBUS is not set @@ -260,10 +259,6 @@ CONFIG_SND_PPC=y CONFIG_NET_VENDOR_IBM=y -CONFIG_MLX4_EN=m -CONFIG_MLX4_EN_DCB=y -CONFIG_MLX4_EN_VXLAN=y - # CONFIG_SERIO_XILINX_XPS_PS2 is not set # CONFIG_PPC_SMLPAR is not set @@ -316,8 +311,6 @@ CONFIG_PPC_EMULATED_STATS=y CONFIG_SWIOTLB=y -# CONFIG_RDS is not set - CONFIG_PPC_DISABLE_WERROR=y # CONFIG_STRICT_MM_TYPECHECKS is not set @@ -337,7 +330,6 @@ CONFIG_GPIO_WM831X=m # CONFIG_MFD_TPS65912_I2C is not set # CONFIG_MFD_WL1273_CORE is not set # CONFIG_XPS_USB_HCD_XILINX is not set -# CONFIG_MMC_SDHCI_OF_ESDHC is not set # CONFIG_MMC_SDHCI_OF_HLWD is not set # CONFIG_MFD_AAT2870_CORE is not set diff --git a/config-s390x b/config-s390x index ae94aa8..a41d95a 100644 --- a/config-s390x +++ b/config-s390x @@ -14,6 +14,8 @@ CONFIG_HZ_100=y CONFIG_LOG_BUF_SHIFT=16 +CONFIG_IRQ_DOMAIN_DEBUG=y + # # I/O subsystem configuration # @@ -127,10 +129,12 @@ CONFIG_MSDOS_PARTITION=y # # S390 crypto hw # +CONFIG_CRYPTO_AES_S390=m +CONFIG_CRYPTO_DES_S390=m +CONFIG_CRYPTO_GHASH_S390=m CONFIG_CRYPTO_SHA1_S390=m CONFIG_CRYPTO_SHA256_S390=m -CONFIG_CRYPTO_DES_S390=m -CONFIG_CRYPTO_AES_S390=m +CONFIG_CRYPTO_SHA512_S390=m # # Kernel hacking @@ -170,7 +174,7 @@ CONFIG_S390_VMUR=m CONFIG_CTCM=m CONFIG_QETH_L2=m CONFIG_QETH_L3=m -CONFIG_CRYPTO_SHA512_S390=m + CONFIG_KVM=m # CONFIG_KVM_S390_UCONTROL is not set CONFIG_S390_GUEST=y @@ -205,8 +209,6 @@ CONFIG_SCHED_TOPOLOGY=y # CONFIG_WARN_DYNAMIC_STACK is not set -CONFIG_CRYPTO_GHASH_S390=m - # CONFIG_TRANSPARENT_HUGEPAGE is not set CONFIG_SCM_BUS=y CONFIG_EADM_SCH=m @@ -292,20 +294,5 @@ CONFIG_HOTPLUG_PCI_S390=y # CONFIG_NET_VENDOR_VIA is not set # CONFIG_IEEE802154_DRIVERS is not set # CONFIG_MDIO_OCTEON is not set - # CONFIG_FMC is not set - # CONFIG_OF is not set - -CONFIG_MLX4_EN=m -CONFIG_MLX4_EN_DCB=y -CONFIG_MLX4_EN_VXLAN=y -CONFIG_INFINIBAND=m -CONFIG_INFINIBAND_USER_ACCESS=m -CONFIG_MLX4_INFINIBAND=m -CONFIG_RDS=m -CONFIG_RDS_RDMA=m -CONFIG_RDS_TCP=m -CONFIG_IRQ_DOMAIN_DEBUG=y - -CONFIG_CRASH=m diff --git a/config-x86-generic b/config-x86-generic index 807f602..646378b 100644 --- a/config-x86-generic +++ b/config-x86-generic @@ -48,6 +48,7 @@ CONFIG_EFI_PCDP=y CONFIG_FB_EFI=y CONFIG_EARLY_PRINTK_EFI=y CONFIG_EFI_RUNTIME_MAP=y +# CONFIG_EFI_FAKE_MEMMAP is not set # needs FB_SIMPLE to work correctly # CONFIG_X86_SYSFB is not set @@ -57,6 +58,7 @@ CONFIG_EFI_RUNTIME_MAP=y CONFIG_INTEL_IOMMU=y CONFIG_INTEL_IOMMU_FLOPPY_WA=y # CONFIG_INTEL_IOMMU_DEFAULT_ON is not set +CONFIG_INTEL_IOMMU_SVM=y CONFIG_SCSI_ADVANSYS=m CONFIG_CAPI_EICON=y @@ -70,6 +72,8 @@ CONFIG_MMIOTRACE=y # CONFIG_MMIOTRACE_TEST is not set # CONFIG_DEBUG_PER_CPU_MAPS is not set CONFIG_DEBUG_RODATA=y +# Generating too many warnings while waiting for fixes +# CONFIG_DEBUG_WX is not set CONFIG_DEBUG_STACKOVERFLOW=y CONFIG_ACPI=y @@ -102,7 +106,7 @@ CONFIG_ACPI_IPMI=m CONFIG_ACPI_CUSTOM_METHOD=m CONFIG_ACPI_BGRT=y # CONFIG_ACPI_EXTLOG is not set -CONFIG_ACPI_REV_OVERRIDE_POSSIBLE=y +# CONFIG_ACPI_REV_OVERRIDE_POSSIBLE is not set CONFIG_INTEL_SOC_PMIC=y CONFIG_PMIC_OPREGION=y @@ -263,9 +267,7 @@ CONFIG_TOUCHSCREEN_GOODIX=m CONFIG_VIA_WDT=m CONFIG_IE6XX_WDT=m -CONFIG_CRASH_DUMP=y CONFIG_PROC_VMCORE=y -CONFIG_CRASH=m CONFIG_KVM=m CONFIG_KVM_INTEL=m @@ -314,7 +316,14 @@ CONFIG_XEN_ACPI_PROCESSOR=m # CONFIG_XEN_SCSI_BACKEND is not set CONFIG_XEN_SYMS=y +CONFIG_SPI=y +CONFIG_SPI_MASTER=y CONFIG_SPI_PXA2XX=m +# CONFIG_CAN_MCP251X is not set +# CONFIG_SPI_CADENCE is not set +# CONFIG_SPI_ZYNQMP_GQSPI is not set +# CONFIG_DRM_PANEL_SAMSUNG_LD9040 is not set +# CONFIG_DRM_PANEL_LG_LG4573 is not set CONFIG_MTD_ESB2ROM=m CONFIG_MTD_CK804XROM=m @@ -342,6 +351,7 @@ CONFIG_ISCSI_IBFT=m CONFIG_DMADEVICES=y CONFIG_INTEL_IOATDMA=m +CONFIG_INTEL_IDMA64=m CONFIG_SENSORS_I5K_AMB=m CONFIG_SENSORS_FAM15H_POWER=m @@ -394,6 +404,7 @@ CONFIG_ACPI_CMPC=m CONFIG_MSI_WMI=m CONFIG_TOSHIBA_BT_RFKILL=m CONFIG_TOSHIBA_HAPS=m +CONFIG_TOSHIBA_WMI=m CONFIG_VGA_SWITCHEROO=y CONFIG_LPC_SCH=m @@ -520,9 +531,10 @@ CONFIG_PWM_LPSS_PCI=m CONFIG_PWM_LPSS_PLATFORM=m CONFIG_PINCTRL=y CONFIG_PINCTRL_BAYTRAIL=y -CONFIG_PINCTRL_CHERRYVIEW=m +CONFIG_PINCTRL_CHERRYVIEW=y # CONFIG_PINCTRL_AMD is not set CONFIG_PINCTRL_SUNRISEPOINT=m +CONFIG_PINCTRL_BROXTON=m #baytrail/cherrytrail stuff CONFIG_KEYBOARD_GPIO=m @@ -538,9 +550,10 @@ CONFIG_SND_SOC_INTEL_BYTCR_RT5640_MACH=m CONFIG_SND_SOC_INTEL_CHT_BSW_RT5672_MACH=m CONFIG_SND_SOC_INTEL_CHT_BSW_RT5645_MACH=m CONFIG_SND_SOC_INTEL_CHT_BSW_MAX98090_TI_MACH=m +CONFIG_SND_SOC_INTEL_SKL_RT286_MACH=m CONFIG_SND_SOC_AC97_CODEC=m # CONFIG_SND_SOC_TAS571X is not set - +# CONFIG_SND_SUN4I_CODEC is not set # CONFIG_INTEL_POWERCLAMP is not set CONFIG_X86_PKG_TEMP_THERMAL=m diff --git a/config-x86_64-generic b/config-x86_64-generic index 2729998..9d13391 100644 --- a/config-x86_64-generic +++ b/config-x86_64-generic @@ -61,6 +61,7 @@ CONFIG_INTEL_MIC_HOST=m CONFIG_INTEL_MIC_CARD=m CONFIG_INTEL_MIC_BUS=m CONFIG_INTEL_MIC_X100_DMA=m +CONFIG_MIC_COSM=m # SHPC has half-arsed PCI probing, which makes it load on too many systems CONFIG_HOTPLUG_PCI_SHPC=m @@ -135,7 +136,7 @@ CONFIG_XEN_DEV_EVTCHN=m CONFIG_XEN_SYS_HYPERVISOR=y # CONFIG_XEN_MCE_LOG is not set # CONFIG_XEN_STUB is not set -# CONFIG_XEN_PVH is not set +CONFIG_XEN_PVH=y CONFIG_XEN_512GB=y CONFIG_PROVIDE_OHCI1394_DMA_INIT=y @@ -183,10 +184,6 @@ CONFIG_NTB_TRANSPORT=m # 10GigE # CONFIG_IP1000=m -CONFIG_MLX4_EN=m -CONFIG_MLX4_EN_DCB=y -CONFIG_MLX4_EN_VXLAN=y -# CONFIG_MLX4_DEBUG is not set CONFIG_SFC=m CONFIG_SFC_MCDI_MON=y CONFIG_SFC_SRIOV=y @@ -209,3 +206,9 @@ CONFIG_NO_HZ_FULL=y # CONFIG_NO_HZ_FULL_ALL is not set # CONFIG_NO_HZ_FULL_SYSIDLE is not set # CONFIG_CONTEXT_TRACKING_FORCE is not set + +# Turn on CONFIG_CMA for THP +CONFIG_CMA=y +# CONFIG_CMA_DEBUG is not set +# CONFIG_CMA_DEBUGFS is not set +CONFIG_CMA_AREAS=7 diff --git a/drm-i915-Do-a-better-job-at-disabling-primary-plane-.patch b/drm-i915-Do-a-better-job-at-disabling-primary-plane-.patch deleted file mode 100644 index 3ab9132..0000000 --- a/drm-i915-Do-a-better-job-at-disabling-primary-plane-.patch +++ /dev/null @@ -1,59 +0,0 @@ -From d271283fd90da8cc5a4c659b1854c0d3a34b1929 Mon Sep 17 00:00:00 2001 -From: Maarten Lankhorst -Date: Mon, 23 Nov 2015 10:25:28 +0100 -Subject: [PATCH] drm/i915: Do a better job at disabling primary plane in the - noatomic case. - -When disable_noatomic is called plane_mask is not correct yet, and -plane_state->visible = true is left as true after disabling the primary -plane. - -Other planes are already disabled as part of crtc sanitization, only the -primary is left active. But the plane_mask is not updated here. It gets -updated during fb takeover in modeset_gem_init, or set to the new value -on resume. - -This means that to disable the primary plane 1 << drm_plane_index(primary) -needs to be used. - -Afterwards because the crtc is no longer active it's forbidden to keep -plane_state->visible set, or a WARN_ON in -intel_plane_atomic_calc_changes triggers. There are other code points -that rely on accurate plane_state->visible too, so make sure the bool is -cleared. - -The other planes are already disabled in intel_sanitize_crtc, so they -don't have to be handled here. - -Cc: stable@vger.kernel.org #v4.3, v4.2? -Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92655 -Tested-by: Tomas Mezzadra -Signed-off-by: Maarten Lankhorst -Reviewed-by: Daniel Vetter -Link: http://patchwork.freedesktop.org/patch/msgid/5652DB88.9070208@linux.intel.com -(cherry picked from commit 54a4196188eab82e6f0a5f05716626e9f18b8fb6) -Signed-off-by: Jani Nikula ---- - drivers/gpu/drm/i915/intel_display.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c -index b2270d576979..84eda179e3ff 100644 ---- a/drivers/gpu/drm/i915/intel_display.c -+++ b/drivers/gpu/drm/i915/intel_display.c -@@ -6225,9 +6225,11 @@ static void intel_crtc_disable_noatomic(struct drm_crtc *crtc) - if (to_intel_plane_state(crtc->primary->state)->visible) { - intel_crtc_wait_for_pending_flips(crtc); - intel_pre_disable_primary(crtc); -+ -+ intel_crtc_disable_planes(crtc, 1 << drm_plane_index(crtc->primary)); -+ to_intel_plane_state(crtc->primary->state)->visible = false; - } - -- intel_crtc_disable_planes(crtc, crtc->state->plane_mask); - dev_priv->display.crtc_disable(crtc); - intel_disable_shared_dpll(intel_crtc); - --- -2.5.0 - diff --git a/drm-i915-shut-up-gen8-SDE-irq-dmesg-noise-again.patch b/drm-i915-shut-up-gen8-SDE-irq-dmesg-noise-again.patch index 4765601..cd53bf7 100644 --- a/drm-i915-shut-up-gen8-SDE-irq-dmesg-noise-again.patch +++ b/drm-i915-shut-up-gen8-SDE-irq-dmesg-noise-again.patch @@ -1,4 +1,4 @@ -From 951660dcf5d09f7040ab1d56817ae952a1076978 Mon Sep 17 00:00:00 2001 +From 41ed5ee704b784a4fca02787311d59c243563013 Mon Sep 17 00:00:00 2001 From: Jani Nikula Date: Thu, 7 Jan 2016 10:29:10 +0200 Subject: [PATCH] drm/i915: shut up gen8+ SDE irq dmesg noise, again @@ -38,22 +38,21 @@ Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92084 Cc: drm-intel-fixes@lists.freedesktop.org Fixes: 820da7ae4633 ("Revert "drm/i915: shut up gen8+ SDE irq dmesg noise"") Signed-off-by: Jani Nikula - -[Backported to 4.3.y by Josh Boyer ] --- - drivers/gpu/drm/i915/i915_irq.c | 9 +++++++-- - 1 file changed, 7 insertions(+), 2 deletions(-) + drivers/gpu/drm/i915/i915_irq.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c -index 39d73dbc1c47..fa7f82d54762 100644 +index 0d228f909dcb..0f42a2782afc 100644 --- a/drivers/gpu/drm/i915/i915_irq.c +++ b/drivers/gpu/drm/i915/i915_irq.c -@@ -2168,8 +2168,13 @@ static irqreturn_t gen8_irq_handler(int irq, void *arg) - I915_WRITE(SDEIIR, pch_iir); - ret = IRQ_HANDLED; - cpt_irq_handler(dev, pch_iir); +@@ -2354,9 +2354,13 @@ static irqreturn_t gen8_irq_handler(int irq, void *arg) + spt_irq_handler(dev, pch_iir); + else + cpt_irq_handler(dev, pch_iir); - } else - DRM_ERROR("The master control interrupt lied (SDE)!\n"); +- + } else { + /* + * Like on previous PCH there seems to be something @@ -61,9 +60,9 @@ index 39d73dbc1c47..fa7f82d54762 100644 + */ + DRM_DEBUG_DRIVER("The master control interrupt lied (SDE)!\n"); + } - } + I915_WRITE_FW(GEN8_MASTER_IRQ, GEN8_MASTER_IRQ_CONTROL); -- 2.5.0 diff --git a/drm-mgag200-fix-kernel-hang-in-cursor-code.patch b/drm-mgag200-fix-kernel-hang-in-cursor-code.patch deleted file mode 100644 index 075c062..0000000 --- a/drm-mgag200-fix-kernel-hang-in-cursor-code.patch +++ /dev/null @@ -1,107 +0,0 @@ -From f6619ef7508261be2ba3ded313ccc46ce670d0d3 Mon Sep 17 00:00:00 2001 -From: "Wang, Rui Y" -Date: Wed, 18 Nov 2015 23:00:53 +0800 -Subject: [PATCH] drm/mgag200: fix kernel hang in cursor code. - -The machine hang completely with the following message on the console: - -[ 487.777538] BUG: unable to handle kernel NULL pointer dereference at 0000000000000060 -[ 487.777554] IP: [] _raw_spin_lock+0xe/0x30 -[ 487.777557] PGD 42e9f7067 PUD 42f2fa067 PMD 0 -[ 487.777560] Oops: 0002 [#1] SMP -... -[ 487.777618] CPU: 21 PID: 3190 Comm: Xorg Tainted: G E 4.4.0-rc1-3-default+ #6 -[ 487.777620] Hardware name: Intel Corporation BRICKLAND/BRICKLAND, BIOS BRHSXSD1.86B.0059.R00.1501081238 01/08/2015 -[ 487.777621] task: ffff880853ae4680 ti: ffff8808696d4000 task.ti: ffff8808696d4000 -[ 487.777625] RIP: 0010:[] [] _raw_spin_lock+0xe/0x30 -[ 487.777627] RSP: 0018:ffff8808696d79c0 EFLAGS: 00010246 -[ 487.777628] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 -[ 487.777629] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000060 -[ 487.777630] RBP: ffff8808696d79e0 R08: 0000000000000000 R09: ffff88086924a780 -[ 487.777631] R10: 000000000001bb40 R11: 0000000000003246 R12: 0000000000000000 -[ 487.777632] R13: ffff880463a27360 R14: ffff88046ca50218 R15: 0000000000000080 -[ 487.777634] FS: 00007f3f81c5a8c0(0000) GS:ffff88086f060000(0000) knlGS:0000000000000000 -[ 487.777635] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 -[ 487.777636] CR2: 0000000000000060 CR3: 000000042e678000 CR4: 00000000001406e0 -[ 487.777638] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 -[ 487.777639] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 -[ 487.777639] Stack: -[ 487.777642] ffffffffa00eb5fa ffff8808696d7b60 ffff88086b87d800 0000000000000000 -[ 487.777644] ffff8808696d7ac8 ffffffffa01694b6 ffff8808696d7ae8 ffffffff8109c8d5 -[ 487.777647] ffff880469158740 ffff880463a27000 ffff88086b87d800 ffff88086b87d800 -[ 487.777647] Call Trace: -[ 487.777674] [] ? drm_gem_object_lookup+0x1a/0xa0 [drm] -[ 487.777681] [] mga_crtc_cursor_set+0xc6/0xb60 [mgag200] -[ 487.777691] [] ? find_busiest_group+0x35/0x4a0 -[ 487.777696] [] ? __might_sleep+0x44/0x80 -[ 487.777699] [] ? __ww_mutex_lock+0x22/0x9c -[ 487.777722] [] ? drm_modeset_lock+0x34/0xf0 [drm] -[ 487.777733] [] restore_fbdev_mode+0xee/0x2a0 [drm_kms_helper] -[ 487.777742] [] drm_fb_helper_restore_fbdev_mode_unlocked+0x2e/0x70 [drm_kms_helper] -[ 487.777748] [] drm_fb_helper_set_par+0x27/0x50 [drm_kms_helper] -[ 487.777752] [] fb_set_var+0x18c/0x3f0 -[ 487.777777] [] ? __ext4_handle_dirty_metadata+0x8a/0x210 [ext4] -[ 487.777783] [] fbcon_blank+0x1b7/0x2b0 -[ 487.777790] [] do_unblank_screen+0xb3/0x1c0 -[ 487.777795] [] vt_ioctl+0x118a/0x1210 -[ 487.777801] [] tty_ioctl+0x3f0/0xc90 -[ 487.777808] [] ? kzfree+0x28/0x30 -[ 487.777813] [] ? mntput+0x1f/0x30 -[ 487.777817] [] do_vfs_ioctl+0x30d/0x570 -[ 487.777822] [] ? task_work_run+0x8a/0xa0 -[ 487.777825] [] SyS_ioctl+0x74/0x80 -[ 487.777829] [] entry_SYSCALL_64_fastpath+0x12/0x71 -[ 487.777851] Code: 65 ff 0d ce 02 a8 7e 5d c3 ba 01 00 00 00 f0 0f b1 17 85 c0 75 e8 b0 01 5d c3 0f 1f 00 65 ff 05 b1 02 a8 7e 31 c0 ba 01 00 00 00 0f b1 17 85 c0 75 01 c3 55 89 c6 48 89 e5 e8 4e f5 b1 ff 5d -[ 487.777854] RIP [] _raw_spin_lock+0xe/0x30 -[ 487.777855] RSP -[ 487.777856] CR2: 0000000000000060 -[ 487.777860] ---[ end trace 672a2cd555e0ebd3 ]--- - -The cursor code may be entered with file_priv == NULL && handle == NULL. -The problem was introduced by: - -"bf89209 drm/mga200g: Hold a proper reference for cursor_set" - -which calls drm_gem_object_lookup(dev, file_priv...). Previously this wasn't -a problem because we checked the handle. Move the check early in the function -can fix the problem. - -Signed-off-by: Rui Wang -Reviewed-by: Daniel Vetter -Signed-off-by: Dave Airlie ---- - drivers/gpu/drm/mgag200/mgag200_cursor.c | 11 +++++------ - 1 file changed, 5 insertions(+), 6 deletions(-) - -diff --git a/drivers/gpu/drm/mgag200/mgag200_cursor.c b/drivers/gpu/drm/mgag200/mgag200_cursor.c -index 4f2068fe5d88..a7bf6a90eae5 100644 ---- a/drivers/gpu/drm/mgag200/mgag200_cursor.c -+++ b/drivers/gpu/drm/mgag200/mgag200_cursor.c -@@ -70,6 +70,11 @@ int mga_crtc_cursor_set(struct drm_crtc *crtc, - BUG_ON(pixels_2 != pixels_current && pixels_2 != pixels_prev); - BUG_ON(pixels_current == pixels_prev); - -+ if (!handle || !file_priv) { -+ mga_hide_cursor(mdev); -+ return 0; -+ } -+ - obj = drm_gem_object_lookup(dev, file_priv, handle); - if (!obj) - return -ENOENT; -@@ -88,12 +93,6 @@ int mga_crtc_cursor_set(struct drm_crtc *crtc, - goto out_unreserve1; - } - -- if (!handle) { -- mga_hide_cursor(mdev); -- ret = 0; -- goto out1; -- } -- - /* Move cursor buffers into VRAM if they aren't already */ - if (!pixels_1->pin_count) { - ret = mgag200_bo_pin(pixels_1, TTM_PL_FLAG_VRAM, --- -2.5.0 - diff --git a/drm-nouveau-Fix-pre-nv50-pageflip-events-v4.patch b/drm-nouveau-Fix-pre-nv50-pageflip-events-v4.patch deleted file mode 100644 index 49bcefb..0000000 --- a/drm-nouveau-Fix-pre-nv50-pageflip-events-v4.patch +++ /dev/null @@ -1,204 +0,0 @@ -From 424f582d0ec7f206dcc59d34c9a2fa1c8087a8aa Mon Sep 17 00:00:00 2001 -From: Daniel Vetter -Date: Tue, 10 Nov 2015 17:37:31 +0100 -Subject: [PATCH] drm/nouveau: Fix pre-nv50 pageflip events (v4) -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Apparently pre-nv50 pageflip events happen before the actual vblank -period. Therefore that functionality got semi-disabled in - -commit af4870e406126b7ac0ae7c7ce5751f25ebe60f28 -Author: Mario Kleiner -Date: Tue May 13 00:42:08 2014 +0200 - - drm/nouveau/kms/nv04-nv40: fix pageflip events via special case. - -Unfortunately that hack got uprooted in - -commit cc1ef118fc099295ae6aabbacc8af94d8d8885eb -Author: Thierry Reding -Date: Wed Aug 12 17:00:31 2015 +0200 - - drm/irq: Make pipe unsigned and name consistent - -Triggering a warning when trying to sample the vblank timestamp for a -non-existing pipe. There's a few ways to fix this: - -- Open-code the old behaviour, which just enshrines this slight - breakage of the userspace ABI. - -- Revert Mario's commit and again inflict broken timestamps, again not - pretty. - -- Fix this for real by delaying the pageflip TS until the next vblank - interrupt, thereby making it accurate. - -This patch implements the third option. Since having a page flip -interrupt that happens when the pageflip gets armed and not when it -completes in the next vblank seems to be fairly common (older i915 hw -works very similarly) create a new helper to arm vblank events for -such drivers. - -v2 (Mario Kleiner): -- Fix function prototypes in drmP.h -- Add missing vblank_put() for pageflip completion without - pageflip event. -- Initialize sequence number for queued pageflip event to avoid - trouble in drm_handle_vblank_events(). -- Remove dead code and spelling fix. - -v3 (Mario Kleiner): -- Add a signed-off-by and cc stable tag per Ilja's advice. - -v4 (Thierry Reding): -- Fix kerneldoc typo, discovered by Michel Dänzer -- Rearrange tags and changelog - -Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=106431 -Cc: Thierry Reding -Cc: Mario Kleiner -Acked-by: Ben Skeggs -Cc: Ilia Mirkin -Signed-off-by: Daniel Vetter -Reviewed-by: Mario Kleiner -Cc: stable@vger.kernel.org # v4.3 -Signed-off-by: Mario Kleiner -Signed-off-by: Thierry Reding -Signed-off-by: Dave Airlie ---- - drivers/gpu/drm/drm_irq.c | 54 ++++++++++++++++++++++++++++++- - drivers/gpu/drm/nouveau/nouveau_display.c | 19 ++++++----- - include/drm/drmP.h | 4 +++ - 3 files changed, 68 insertions(+), 9 deletions(-) - -diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c -index 22d207e211e7..c5f20e41dcc6 100644 ---- a/drivers/gpu/drm/drm_irq.c -+++ b/drivers/gpu/drm/drm_irq.c -@@ -944,7 +944,8 @@ static void send_vblank_event(struct drm_device *dev, - struct drm_pending_vblank_event *e, - unsigned long seq, struct timeval *now) - { -- WARN_ON_SMP(!spin_is_locked(&dev->event_lock)); -+ assert_spin_locked(&dev->event_lock); -+ - e->event.sequence = seq; - e->event.tv_sec = now->tv_sec; - e->event.tv_usec = now->tv_usec; -@@ -957,6 +958,57 @@ static void send_vblank_event(struct drm_device *dev, - } - - /** -+ * drm_arm_vblank_event - arm vblank event after pageflip -+ * @dev: DRM device -+ * @pipe: CRTC index -+ * @e: the event to prepare to send -+ * -+ * A lot of drivers need to generate vblank events for the very next vblank -+ * interrupt. For example when the page flip interrupt happens when the page -+ * flip gets armed, but not when it actually executes within the next vblank -+ * period. This helper function implements exactly the required vblank arming -+ * behaviour. -+ * -+ * Caller must hold event lock. Caller must also hold a vblank reference for -+ * the event @e, which will be dropped when the next vblank arrives. -+ * -+ * This is the legacy version of drm_crtc_arm_vblank_event(). -+ */ -+void drm_arm_vblank_event(struct drm_device *dev, unsigned int pipe, -+ struct drm_pending_vblank_event *e) -+{ -+ assert_spin_locked(&dev->event_lock); -+ -+ e->pipe = pipe; -+ e->event.sequence = drm_vblank_count(dev, pipe); -+ list_add_tail(&e->base.link, &dev->vblank_event_list); -+} -+EXPORT_SYMBOL(drm_arm_vblank_event); -+ -+/** -+ * drm_crtc_arm_vblank_event - arm vblank event after pageflip -+ * @crtc: the source CRTC of the vblank event -+ * @e: the event to send -+ * -+ * A lot of drivers need to generate vblank events for the very next vblank -+ * interrupt. For example when the page flip interrupt happens when the page -+ * flip gets armed, but not when it actually executes within the next vblank -+ * period. This helper function implements exactly the required vblank arming -+ * behaviour. -+ * -+ * Caller must hold event lock. Caller must also hold a vblank reference for -+ * the event @e, which will be dropped when the next vblank arrives. -+ * -+ * This is the native KMS version of drm_arm_vblank_event(). -+ */ -+void drm_crtc_arm_vblank_event(struct drm_crtc *crtc, -+ struct drm_pending_vblank_event *e) -+{ -+ drm_arm_vblank_event(crtc->dev, drm_crtc_index(crtc), e); -+} -+EXPORT_SYMBOL(drm_crtc_arm_vblank_event); -+ -+/** - * drm_send_vblank_event - helper to send vblank event after pageflip - * @dev: DRM device - * @pipe: CRTC index -diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c -index e905c00acf1a..54183bcca48f 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_display.c -+++ b/drivers/gpu/drm/nouveau/nouveau_display.c -@@ -827,7 +827,6 @@ nouveau_finish_page_flip(struct nouveau_channel *chan, - struct drm_device *dev = drm->dev; - struct nouveau_page_flip_state *s; - unsigned long flags; -- int crtcid = -1; - - spin_lock_irqsave(&dev->event_lock, flags); - -@@ -839,15 +838,19 @@ nouveau_finish_page_flip(struct nouveau_channel *chan, - - s = list_first_entry(&fctx->flip, struct nouveau_page_flip_state, head); - if (s->event) { -- /* Vblank timestamps/counts are only correct on >= NV-50 */ -- if (drm->device.info.family >= NV_DEVICE_INFO_V0_TESLA) -- crtcid = s->crtc; -+ if (drm->device.info.family < NV_DEVICE_INFO_V0_TESLA) { -+ drm_arm_vblank_event(dev, s->crtc, s->event); -+ } else { -+ drm_send_vblank_event(dev, s->crtc, s->event); - -- drm_send_vblank_event(dev, crtcid, s->event); -+ /* Give up ownership of vblank for page-flipped crtc */ -+ drm_vblank_put(dev, s->crtc); -+ } -+ } -+ else { -+ /* Give up ownership of vblank for page-flipped crtc */ -+ drm_vblank_put(dev, s->crtc); - } -- -- /* Give up ownership of vblank for page-flipped crtc */ -- drm_vblank_put(dev, s->crtc); - - list_del(&s->head); - if (ps) -diff --git a/include/drm/drmP.h b/include/drm/drmP.h -index 8b5ce7c5d9bb..c98f01046bd0 100644 ---- a/include/drm/drmP.h -+++ b/include/drm/drmP.h -@@ -932,6 +932,10 @@ extern void drm_send_vblank_event(struct drm_device *dev, unsigned int pipe, - struct drm_pending_vblank_event *e); - extern void drm_crtc_send_vblank_event(struct drm_crtc *crtc, - struct drm_pending_vblank_event *e); -+extern void drm_arm_vblank_event(struct drm_device *dev, unsigned int pipe, -+ struct drm_pending_vblank_event *e); -+extern void drm_crtc_arm_vblank_event(struct drm_crtc *crtc, -+ struct drm_pending_vblank_event *e); - extern bool drm_handle_vblank(struct drm_device *dev, unsigned int pipe); - extern bool drm_crtc_handle_vblank(struct drm_crtc *crtc); - extern int drm_vblank_get(struct drm_device *dev, unsigned int pipe); --- -2.5.0 - diff --git a/drm-nouveau-pmu-do-not-assume-a-PMU-is-present.patch b/drm-nouveau-pmu-do-not-assume-a-PMU-is-present.patch deleted file mode 100644 index 6ad5796..0000000 --- a/drm-nouveau-pmu-do-not-assume-a-PMU-is-present.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 65fbb05cbbf9ef7f531712634c3e914b54171707 Mon Sep 17 00:00:00 2001 -From: Alexandre Courbot -Date: Thu, 3 Sep 2015 17:39:52 +0900 -Subject: [PATCH] drm/nouveau/pmu: do not assume a PMU is present - -Some devices may not have a PMU. Avoid a NULL pointer dereference in -such cases by checking whether the pointer given to nvkm_pmu_pgob() is -valid. - -Signed-off-by: Alexandre Courbot -Signed-off-by: Ben Skeggs ---- - drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c -index 27a79c0c3888..d95eb8659d1b 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c -@@ -28,7 +28,7 @@ - void - nvkm_pmu_pgob(struct nvkm_pmu *pmu, bool enable) - { -- if (pmu->func->pgob) -+ if (pmu && pmu->func->pgob) - pmu->func->pgob(pmu, enable); - } - --- -2.5.0 - diff --git a/efi-Add-EFI_SECURE_BOOT-bit.patch b/efi-Add-EFI_SECURE_BOOT-bit.patch index 94f7fe7..89b9664 100644 --- a/efi-Add-EFI_SECURE_BOOT-bit.patch +++ b/efi-Add-EFI_SECURE_BOOT-bit.patch @@ -1,4 +1,4 @@ -From b4467813ec088c13bd8c9f1eafb7c29d889d7c8f Mon Sep 17 00:00:00 2001 +From c01ff700ea4192ae04b306fef725d62189550236 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Tue, 27 Aug 2013 13:33:03 -0400 Subject: [PATCH 13/20] efi: Add EFI_SECURE_BOOT bit @@ -13,10 +13,10 @@ Signed-off-by: Josh Boyer 2 files changed, 3 insertions(+) diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index 1ac118146e90..f93826b8522c 100644 +index f3b804f..a401ff8 100644 --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c -@@ -1137,7 +1137,9 @@ void __init setup_arch(char **cmdline_p) +@@ -1145,7 +1145,9 @@ void __init setup_arch(char **cmdline_p) #ifdef CONFIG_EFI_SECURE_BOOT_SIG_ENFORCE if (boot_params.secure_boot) { @@ -27,17 +27,17 @@ index 1ac118146e90..f93826b8522c 100644 #endif diff --git a/include/linux/efi.h b/include/linux/efi.h -index 85ef051ac6fb..de3e45088d4a 100644 +index 569b5a8..4dc970e 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h -@@ -959,6 +959,7 @@ extern int __init efi_setup_pcdp_console(char *); - #define EFI_PARAVIRT 6 /* Access is via a paravirt interface */ +@@ -980,6 +980,7 @@ extern int __init efi_setup_pcdp_console(char *); #define EFI_ARCH_1 7 /* First arch-specific bit */ #define EFI_DBG 8 /* Print additional debug info at runtime */ -+#define EFI_SECURE_BOOT 9 /* Are we in Secure Boot mode? */ + #define EFI_NX_PE_DATA 9 /* Can runtime data regions be mapped non-executable? */ ++#define EFI_SECURE_BOOT 10 /* Are we in Secure Boot mode? */ #ifdef CONFIG_EFI /* -- -2.4.3 +2.5.0 diff --git a/i915-stable-backports.patch b/i915-stable-backports.patch deleted file mode 100644 index f366fda..0000000 --- a/i915-stable-backports.patch +++ /dev/null @@ -1,1962 +0,0 @@ -From 5c19e5ee394c36652c59c247855a3c7e5a83a015 Mon Sep 17 00:00:00 2001 -From: Jani Nikula -Date: Thu, 7 Jan 2016 10:29:10 +0200 -Subject: [PATCH 01/26] drm/i915: shut up gen8+ SDE irq dmesg noise, again - -We still keep getting - -[ 4.249930] [drm:gen8_irq_handler [i915]] *ERROR* The master control interrupt lied (SDE)! - -This reverts - -commit 820da7ae46332fa709b171eb7ba57cbd023fa6df -Author: Jani Nikula -Date: Wed Nov 25 16:47:23 2015 +0200 - - Revert "drm/i915: shut up gen8+ SDE irq dmesg noise" - -which in itself is a revert, so this is just doing - -commit 97e5ed1111dcc5300a0f59a55248cd243937a8ab -Author: Daniel Vetter -Date: Fri Oct 23 10:56:12 2015 +0200 - - drm/i915: shut up gen8+ SDE irq dmesg noise - -all over again. I'll stop pretending I understand what's going on like I -did when I thought I'd fixed this for good in - -commit 6a39d7c986be4fd18eb019e9cdbf774ec36c9f77 -Author: Jani Nikula -Date: Wed Nov 25 16:47:22 2015 +0200 - - drm/i915: fix the SDE irq dmesg warnings properly - -Reported-by: Chris Wilson -Reference: http://mid.gmane.org/20151213124945.GA5715@nuc-i3427.alporthouse.com -Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92084 -Cc: drm-intel-fixes@lists.freedesktop.org -Fixes: 820da7ae4633 ("Revert "drm/i915: shut up gen8+ SDE irq dmesg noise"") -Signed-off-by: Jani Nikula - -[Backported to 4.3.y by Josh Boyer ] ---- - drivers/gpu/drm/i915/i915_irq.c | 9 +++++++-- - 1 file changed, 7 insertions(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c -index 39d73dbc1c47..fa7f82d54762 100644 ---- a/drivers/gpu/drm/i915/i915_irq.c -+++ b/drivers/gpu/drm/i915/i915_irq.c -@@ -2168,8 +2168,13 @@ static irqreturn_t gen8_irq_handler(int irq, void *arg) - I915_WRITE(SDEIIR, pch_iir); - ret = IRQ_HANDLED; - cpt_irq_handler(dev, pch_iir); -- } else -- DRM_ERROR("The master control interrupt lied (SDE)!\n"); -+ } else { -+ /* -+ * Like on previous PCH there seems to be something -+ * fishy going on with forwarding PCH interrupts. -+ */ -+ DRM_DEBUG_DRIVER("The master control interrupt lied (SDE)!\n"); -+ } - - } - --- -2.5.0 - - -From 65dcf0f52e9705d0094e76a9225bbe770329c96d Mon Sep 17 00:00:00 2001 -From: Chris Wilson -Date: Thu, 1 Oct 2015 12:34:46 +0100 -Subject: [PATCH 02/26] drm/i915: Fix userptr deadlock with aliased GTT - mmappings -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Upstream commit e4b946bfe1e36680e27a5f39163980979fa61a5d - -Michał Winiarski found a really evil way to trigger a struct_mutex -deadlock with userptr. He found that if he allocated a userptr bo and -then GTT mmaped another bo, or even itself, at the same address as the -userptr using MAP_FIXED, he could then cause a deadlock any time we then -had to invalidate the GTT mmappings (so at will). Tvrtko then found by -repeatedly allocating GTT mmappings he could alias with an old userptr -mmap and also trigger the deadlock. - -To counter act the deadlock, we make the observation that we only need -to take the struct_mutex if the object has any pages to revoke, and that -before userspace can alias with the userptr address space, it must have -invalidated the userptr->pages. Thus if we can check for those pages -outside of the struct_mutex, we can avoid the deadlock. To do so we -introduce a separate flag for userptr objects that we can inspect from -the mmu-notifier underneath its spinlock. - -The patch makes one eye-catching change. That is the removal serial=0 -after detecting a to-be-freed object inside the invalidate walker. I -felt setting serial=0 was a questionable pessimisation: it denies us the -chance to reuse the current iterator for the next loop (before it is -freed) and being explicit makes the reader question the validity of the -locking (since the object-free race could occur elsewhere). The -serialisation of the iterator is through the spinlock, if the object is -freed before the next loop then the notifier.serial will be incremented -and we start the walk from the beginning as we detect the invalid cache. - -To try and tame the error paths and interactions with the userptr->active -flag, we have to do a fair amount of rearranging of get_pages_userptr(). - -v2: Grammar fixes -v3: Reorder set-active so that it is only set when obj->pages is set -(and so needs cancellation). Only the order of setting obj->pages and -the active-flag is crucial. Calling gup after invalidate-range begin -means the userptr sees the new set of backing storage (and so will not -need to invalidate its new pages), but we have to be careful not to set -the active-flag prior to successfully establishing obj->pages. -v4: Take the active->flag early so we know in the mmu-notifier when we -have to cancel a pending gup-worker. -v5: Rearrange the error path so that is not so convoluted -v6: Set pinned to 0 when negative before calling release_pages() - -Reported-by: Michał Winiarski -Testcase: igt/gem_userptr_blits/map-fixed* -Signed-off-by: Chris Wilson -Cc: Michał Winiarski -Cc: Tvrtko Ursulin -Cc: stable@vger.kernel.org -Reviewed-by: Tvrtko Ursulin -Signed-off-by: Daniel Vetter ---- - drivers/gpu/drm/i915/i915_gem_userptr.c | 176 ++++++++++++++++++++------------ - 1 file changed, 110 insertions(+), 66 deletions(-) - -diff --git a/drivers/gpu/drm/i915/i915_gem_userptr.c b/drivers/gpu/drm/i915/i915_gem_userptr.c -index a96b9006a51e..ba321f0c41c5 100644 ---- a/drivers/gpu/drm/i915/i915_gem_userptr.c -+++ b/drivers/gpu/drm/i915/i915_gem_userptr.c -@@ -59,6 +59,7 @@ struct i915_mmu_object { - struct interval_tree_node it; - struct list_head link; - struct drm_i915_gem_object *obj; -+ bool active; - bool is_linear; - }; - -@@ -114,7 +115,8 @@ restart: - - obj = mo->obj; - -- if (!kref_get_unless_zero(&obj->base.refcount)) -+ if (!mo->active || -+ !kref_get_unless_zero(&obj->base.refcount)) - continue; - - spin_unlock(&mn->lock); -@@ -151,7 +153,8 @@ static void i915_gem_userptr_mn_invalidate_range_start(struct mmu_notifier *_mn, - else - it = interval_tree_iter_first(&mn->objects, start, end); - if (it != NULL) { -- obj = container_of(it, struct i915_mmu_object, it)->obj; -+ struct i915_mmu_object *mo = -+ container_of(it, struct i915_mmu_object, it); - - /* The mmu_object is released late when destroying the - * GEM object so it is entirely possible to gain a -@@ -160,11 +163,9 @@ static void i915_gem_userptr_mn_invalidate_range_start(struct mmu_notifier *_mn, - * the struct_mutex - and consequently use it after it - * is freed and then double free it. - */ -- if (!kref_get_unless_zero(&obj->base.refcount)) { -- spin_unlock(&mn->lock); -- serial = 0; -- continue; -- } -+ if (mo->active && -+ kref_get_unless_zero(&mo->obj->base.refcount)) -+ obj = mo->obj; - - serial = mn->serial; - } -@@ -566,6 +567,30 @@ __i915_gem_userptr_set_pages(struct drm_i915_gem_object *obj, - } - - static void -+__i915_gem_userptr_set_active(struct drm_i915_gem_object *obj, -+ bool value) -+{ -+ /* During mm_invalidate_range we need to cancel any userptr that -+ * overlaps the range being invalidated. Doing so requires the -+ * struct_mutex, and that risks recursion. In order to cause -+ * recursion, the user must alias the userptr address space with -+ * a GTT mmapping (possible with a MAP_FIXED) - then when we have -+ * to invalidate that mmaping, mm_invalidate_range is called with -+ * the userptr address *and* the struct_mutex held. To prevent that -+ * we set a flag under the i915_mmu_notifier spinlock to indicate -+ * whether this object is valid. -+ */ -+#if defined(CONFIG_MMU_NOTIFIER) -+ if (obj->userptr.mmu_object == NULL) -+ return; -+ -+ spin_lock(&obj->userptr.mmu_object->mn->lock); -+ obj->userptr.mmu_object->active = value; -+ spin_unlock(&obj->userptr.mmu_object->mn->lock); -+#endif -+} -+ -+static void - __i915_gem_userptr_get_pages_worker(struct work_struct *_work) - { - struct get_pages_work *work = container_of(_work, typeof(*work), work); -@@ -612,6 +637,9 @@ __i915_gem_userptr_get_pages_worker(struct work_struct *_work) - - pinned = 0; - } -+ obj->userptr.work = ERR_PTR(ret); -+ if (ret) -+ __i915_gem_userptr_set_active(obj, false); - } - - obj->userptr.work = ERR_PTR(ret); -@@ -627,11 +655,60 @@ __i915_gem_userptr_get_pages_worker(struct work_struct *_work) - } - - static int -+__i915_gem_userptr_get_pages_schedule(struct drm_i915_gem_object *obj, -+ bool *active) -+{ -+ struct get_pages_work *work; -+ -+ /* Spawn a worker so that we can acquire the -+ * user pages without holding our mutex. Access -+ * to the user pages requires mmap_sem, and we have -+ * a strict lock ordering of mmap_sem, struct_mutex - -+ * we already hold struct_mutex here and so cannot -+ * call gup without encountering a lock inversion. -+ * -+ * Userspace will keep on repeating the operation -+ * (thanks to EAGAIN) until either we hit the fast -+ * path or the worker completes. If the worker is -+ * cancelled or superseded, the task is still run -+ * but the results ignored. (This leads to -+ * complications that we may have a stray object -+ * refcount that we need to be wary of when -+ * checking for existing objects during creation.) -+ * If the worker encounters an error, it reports -+ * that error back to this function through -+ * obj->userptr.work = ERR_PTR. -+ */ -+ if (obj->userptr.workers >= I915_GEM_USERPTR_MAX_WORKERS) -+ return -EAGAIN; -+ -+ work = kmalloc(sizeof(*work), GFP_KERNEL); -+ if (work == NULL) -+ return -ENOMEM; -+ -+ obj->userptr.work = &work->work; -+ obj->userptr.workers++; -+ -+ work->obj = obj; -+ drm_gem_object_reference(&obj->base); -+ -+ work->task = current; -+ get_task_struct(work->task); -+ -+ INIT_WORK(&work->work, __i915_gem_userptr_get_pages_worker); -+ schedule_work(&work->work); -+ -+ *active = true; -+ return -EAGAIN; -+} -+ -+static int - i915_gem_userptr_get_pages(struct drm_i915_gem_object *obj) - { - const int num_pages = obj->base.size >> PAGE_SHIFT; - struct page **pvec; - int pinned, ret; -+ bool active; - - /* If userspace should engineer that these pages are replaced in - * the vma between us binding this page into the GTT and completion -@@ -649,6 +726,18 @@ i915_gem_userptr_get_pages(struct drm_i915_gem_object *obj) - * to the vma (discard or cloning) which should prevent the more - * egregious cases from causing harm. - */ -+ if (IS_ERR(obj->userptr.work)) { -+ /* active flag will have been dropped already by the worker */ -+ ret = PTR_ERR(obj->userptr.work); -+ obj->userptr.work = NULL; -+ return ret; -+ } -+ if (obj->userptr.work) -+ /* active flag should still be held for the pending work */ -+ return -EAGAIN; -+ -+ /* Let the mmu-notifier know that we have begun and need cancellation */ -+ __i915_gem_userptr_set_active(obj, true); - - pvec = NULL; - pinned = 0; -@@ -657,73 +746,27 @@ i915_gem_userptr_get_pages(struct drm_i915_gem_object *obj) - GFP_TEMPORARY | __GFP_NOWARN | __GFP_NORETRY); - if (pvec == NULL) { - pvec = drm_malloc_ab(num_pages, sizeof(struct page *)); -- if (pvec == NULL) -+ if (pvec == NULL) { -+ __i915_gem_userptr_set_active(obj, false); - return -ENOMEM; -+ } - } - - pinned = __get_user_pages_fast(obj->userptr.ptr, num_pages, - !obj->userptr.read_only, pvec); - } -- if (pinned < num_pages) { -- if (pinned < 0) { -- ret = pinned; -- pinned = 0; -- } else { -- /* Spawn a worker so that we can acquire the -- * user pages without holding our mutex. Access -- * to the user pages requires mmap_sem, and we have -- * a strict lock ordering of mmap_sem, struct_mutex - -- * we already hold struct_mutex here and so cannot -- * call gup without encountering a lock inversion. -- * -- * Userspace will keep on repeating the operation -- * (thanks to EAGAIN) until either we hit the fast -- * path or the worker completes. If the worker is -- * cancelled or superseded, the task is still run -- * but the results ignored. (This leads to -- * complications that we may have a stray object -- * refcount that we need to be wary of when -- * checking for existing objects during creation.) -- * If the worker encounters an error, it reports -- * that error back to this function through -- * obj->userptr.work = ERR_PTR. -- */ -- ret = -EAGAIN; -- if (obj->userptr.work == NULL && -- obj->userptr.workers < I915_GEM_USERPTR_MAX_WORKERS) { -- struct get_pages_work *work; -- -- work = kmalloc(sizeof(*work), GFP_KERNEL); -- if (work != NULL) { -- obj->userptr.work = &work->work; -- obj->userptr.workers++; -- -- work->obj = obj; -- drm_gem_object_reference(&obj->base); -- -- work->task = current; -- get_task_struct(work->task); -- -- INIT_WORK(&work->work, __i915_gem_userptr_get_pages_worker); -- schedule_work(&work->work); -- } else -- ret = -ENOMEM; -- } else { -- if (IS_ERR(obj->userptr.work)) { -- ret = PTR_ERR(obj->userptr.work); -- obj->userptr.work = NULL; -- } -- } -- } -- } else { -+ -+ active = false; -+ if (pinned < 0) -+ ret = pinned, pinned = 0; -+ else if (pinned < num_pages) -+ ret = __i915_gem_userptr_get_pages_schedule(obj, &active); -+ else - ret = __i915_gem_userptr_set_pages(obj, pvec, num_pages); -- if (ret == 0) { -- obj->userptr.work = NULL; -- pinned = 0; -- } -+ if (ret) { -+ __i915_gem_userptr_set_active(obj, active); -+ release_pages(pvec, pinned, 0); - } -- -- release_pages(pvec, pinned, 0); - drm_free_large(pvec); - return ret; - } -@@ -734,6 +777,7 @@ i915_gem_userptr_put_pages(struct drm_i915_gem_object *obj) - struct sg_page_iter sg_iter; - - BUG_ON(obj->userptr.work != NULL); -+ __i915_gem_userptr_set_active(obj, false); - - if (obj->madv != I915_MADV_WILLNEED) - obj->dirty = 0; --- -2.5.0 - - -From d9cc6dc69e3a5f7f68e22227baf0e0f7743e448c Mon Sep 17 00:00:00 2001 -From: Maarten Lankhorst -Date: Thu, 22 Oct 2015 13:56:34 +0200 -Subject: [PATCH 03/26] drm/i915/skl: Prevent unclaimed register writes on - skylake. - -Upstream commit b10f1b20171945b49988b2b1fe68cb312cc36d32 - -I'm getting unclaimed register writes when checking the WM registers -after the crtc is disabled. So I would imagine those are guarded by -the crtc power well. Fix this by not reading out wm state when the -power well is off. - -Cc: stable@vger.kernel.org # v4.3 -Signed-off-by: Maarten Lankhorst -Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92181 -Reviewed-by: Daniel Vetter -Signed-off-by: Jani Nikula ---- - drivers/gpu/drm/i915/intel_pm.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c -index ddbb7ed0a193..5e91e795fd99 100644 ---- a/drivers/gpu/drm/i915/intel_pm.c -+++ b/drivers/gpu/drm/i915/intel_pm.c -@@ -2899,7 +2899,12 @@ void skl_ddb_get_hw_state(struct drm_i915_private *dev_priv, - int plane; - u32 val; - -+ memset(ddb, 0, sizeof(*ddb)); -+ - for_each_pipe(dev_priv, pipe) { -+ if (!intel_display_power_is_enabled(dev_priv, POWER_DOMAIN_PIPE(pipe))) -+ continue; -+ - for_each_plane(dev_priv, pipe, plane) { - val = I915_READ(PLANE_BUF_CFG(pipe, plane)); - skl_ddb_entry_init_from_hw(&ddb->plane[pipe][plane], --- -2.5.0 - - -From 0ee1dd6b04a4e8eb34f948842fe4385c09695270 Mon Sep 17 00:00:00 2001 -From: Jani Nikula -Date: Fri, 30 Oct 2015 14:50:24 +0200 -Subject: [PATCH 04/26] drm/i915: add quirk to enable backlight on Dell - Chromebook 11 (2015) - -Upstream commit 9be64eee3a87dc03218ca9a12834d1150a57b8a8 - -Reported-by: Keith Webb -Suggested-by: Keith Webb -Cc: stable@vger.kernel.org -Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=106671 -Reviewed-by: Clint Taylor -Signed-off-by: Jani Nikula -Link: http://patchwork.freedesktop.org/patch/msgid/1446209424-28801-1-git-send-email-jani.nikula@intel.com ---- - drivers/gpu/drm/i915/intel_display.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c -index 1d2ff8e6fb4a..8f258092cada 100644 ---- a/drivers/gpu/drm/i915/intel_display.c -+++ b/drivers/gpu/drm/i915/intel_display.c -@@ -14678,6 +14678,9 @@ static struct intel_quirk intel_quirks[] = { - - /* Dell Chromebook 11 */ - { 0x0a06, 0x1028, 0x0a35, quirk_backlight_present }, -+ -+ /* Dell Chromebook 11 (2015 version) */ -+ { 0x0a16, 0x1028, 0x0a35, quirk_backlight_present }, - }; - - static void intel_init_quirks(struct drm_device *dev) --- -2.5.0 - - -From 06d7e7fe18b63244ec4e6e633fc40dd5bea39099 Mon Sep 17 00:00:00 2001 -From: Maarten Lankhorst -Date: Tue, 3 Nov 2015 08:31:41 +0100 -Subject: [PATCH 05/26] drm/i915: Extend DSL readout fix to BDW and SKL. -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Upstream commit b291681926a142958112eedde62823230d6afb84 - -Those platforms have the same bug as haswell, and the same fix applies -to them. - -The original HSW fix that this extends is - -commit 41b578fb0e8b930f2470d3f673b0fa279e77a7b8 -Author: Jesse Barnes -Date: Tue Sep 22 12:15:54 2015 -0700 - - drm/i915: workaround bad DSL readout v3 - -Signed-off-by: Maarten Lankhorst -Acked-by: Ville Syrjälä -Cc: stable@vger.kernel.org # v4.3 -Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91579 -Link: http://patchwork.freedesktop.org/patch/msgid/1446535913-31970-3-git-send-email-maarten.lankhorst@linux.intel.com -Signed-off-by: Jani Nikula ---- - drivers/gpu/drm/i915/i915_irq.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c -index fa7f82d54762..d83d12eeb3fe 100644 ---- a/drivers/gpu/drm/i915/i915_irq.c -+++ b/drivers/gpu/drm/i915/i915_irq.c -@@ -651,7 +651,7 @@ static int __intel_get_crtc_scanline(struct intel_crtc *crtc) - * problem. We may need to extend this to include other platforms, - * but so far testing only shows the problem on HSW. - */ -- if (IS_HASWELL(dev) && !position) { -+ if (HAS_DDI(dev) && !position) { - int i, temp; - - for (i = 0; i < 100; i++) { --- -2.5.0 - - -From f5268273f194155f0a5f3cbfa7bf271774a7a9d6 Mon Sep 17 00:00:00 2001 -From: Jani Nikula -Date: Thu, 5 Nov 2015 11:49:59 +0200 -Subject: [PATCH 06/26] drm/i915: quirk backlight present on Macbook 4, 1 - -Upstream commit 1b9448b071caa7d10bb2569fabe3020a2c25ae59 - -Unsurprisingly macbooks have backlights, just the VBT doesn't seem to -know it in this case. - -Reported-and-tested-by: Daniel Nicoletti -Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=88325 -Fixes: c675949ec58c ("drm/i915: do not setup backlight if not available according to VBT") -Cc: stable@vger.kernel.org # v3.15+ -Reviewed-by: Ander Conselvan de Oliveira -Signed-off-by: Jani Nikula -Link: http://patchwork.freedesktop.org/patch/msgid/1446716999-1796-1-git-send-email-jani.nikula@intel.com ---- - drivers/gpu/drm/i915/intel_display.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c -index 8f258092cada..2e348788ecaa 100644 ---- a/drivers/gpu/drm/i915/intel_display.c -+++ b/drivers/gpu/drm/i915/intel_display.c -@@ -14670,6 +14670,9 @@ static struct intel_quirk intel_quirks[] = { - /* Apple Macbook 2,1 (Core 2 T7400) */ - { 0x27a2, 0x8086, 0x7270, quirk_backlight_present }, - -+ /* Apple Macbook 4,1 */ -+ { 0x2a02, 0x106b, 0x00a1, quirk_backlight_present }, -+ - /* Toshiba CB35 Chromebook (Celeron 2955U) */ - { 0x0a06, 0x1179, 0x0a88, quirk_backlight_present }, - --- -2.5.0 - - -From dddd84b8b5f7f8c0b0037a1bb53f81f5bc70115b Mon Sep 17 00:00:00 2001 -From: Imre Deak -Date: Wed, 4 Nov 2015 21:25:32 +0200 -Subject: [PATCH 07/26] drm/i915: get runtime PM reference around GEM - set_caching IOCTL - -Upstream commit fd0fe6acf1dd88aabfbf383f7e4c16315387a7b7 - -After Damien's D3 fix I started to get runtime suspend residency for the -first time and that revealed a breakage on the set_caching IOCTL path -that accesses the HW but doesn't take an RPM ref. Fix this up. - -Signed-off-by: Imre Deak -Reviewed-by: Paulo Zanoni -Cc: stable@vger.kernel.org -Link: http://patchwork.freedesktop.org/patch/msgid/1446665132-22491-1-git-send-email-imre.deak@intel.com -Signed-off-by: Jani Nikula ---- - drivers/gpu/drm/i915/i915_gem.c | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c -index 4d631a946481..dee065c2b6d8 100644 ---- a/drivers/gpu/drm/i915/i915_gem.c -+++ b/drivers/gpu/drm/i915/i915_gem.c -@@ -3728,6 +3728,7 @@ int i915_gem_get_caching_ioctl(struct drm_device *dev, void *data, - int i915_gem_set_caching_ioctl(struct drm_device *dev, void *data, - struct drm_file *file) - { -+ struct drm_i915_private *dev_priv = dev->dev_private; - struct drm_i915_gem_caching *args = data; - struct drm_i915_gem_object *obj; - enum i915_cache_level level; -@@ -3747,9 +3748,11 @@ int i915_gem_set_caching_ioctl(struct drm_device *dev, void *data, - return -EINVAL; - } - -+ intel_runtime_pm_get(dev_priv); -+ - ret = i915_mutex_lock_interruptible(dev); - if (ret) -- return ret; -+ goto rpm_put; - - obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle)); - if (&obj->base == NULL) { -@@ -3762,6 +3765,9 @@ int i915_gem_set_caching_ioctl(struct drm_device *dev, void *data, - drm_gem_object_unreference(&obj->base); - unlock: - mutex_unlock(&dev->struct_mutex); -+rpm_put: -+ intel_runtime_pm_put(dev_priv); -+ - return ret; - } - --- -2.5.0 - - -From df79b28d6a73835c70222506405bdb54774395c9 Mon Sep 17 00:00:00 2001 -From: Maarten Lankhorst -Date: Mon, 16 Nov 2015 12:49:14 +0100 -Subject: [PATCH 08/26] drm/i915: Clear intel_crtc->atomic before updating it. -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Upstream commit ba8af3e592f7175b5f9a92d2cfcc00b82097d1be - -If an atomic update fails intel_crtc->atomic may have have some values left -from the last atomic check. One example is atomic->wait_for_vblank, -which results in spurious errors in kms_flip. - -[ 1551.892708] ------------[ cut here ]------------ -[ 1551.892721] WARNING: CPU: 3 PID: 4179 at ../drivers/gpu/drm/drm_irq.c:1199 drm_wait_one_vblank+0x197/0x1a0 [drm]() -[ 1551.892722] vblank not available on crtc 2, ret=-22 -[ 1551.892751] Modules linked in: snd_hda_intel i915 drm_kms_helper drm -intel_gtt i2c_algo_bit cfbfillrect syscopyarea cfbimgblt sysfillrect -sysimgblt fb_sys_fops cfbcopyarea agpgart cfg80211 binfmt_misc -snd_hda_codec_hdmi intel_rapl iosf_mbi x86_pkg_temp_thermal coretemp -kvm_intel snd_hda_codec_realtek kvm snd_hda_codec_generic iTCO_wdt -aesni_intel aes_x86_64 glue_helper lrw snd_hda_codec gf128mul -ablk_helper cryptd snd_hwdep psmouse snd_hda_core pcspkr snd_pcm -snd_timer snd lpc_ich i2c_i801 mfd_core soundcore wmi evdev [last -unloaded: drm] -[ 1551.892753] CPU: 3 PID: 4179 Comm: kms_pipe_crc_ba Tainted: G U W 4.3.0-reg+ #6 -[ 1551.892754] Hardware name: /DZ77BH-55K, BIOS BHZ7710H.86A.0100.2013.0517.0942 05/17/2013 -[ 1551.892758] ffffffffa03128d8 ffff8800cec73890 ffffffff812c0f3c ffff8800cec738d8 -[ 1551.892760] ffff8800cec738c8 ffffffff8104ff36 ffff880116ae2290 0000000000000002 -[ 1551.892762] ffff8800d39fcda0 ffff8800d038b4d0 ffff8800d42b5550 ffff8800cec73928 -[ 1551.892763] Call Trace: -[ 1551.892768] [] dump_stack+0x4e/0x82 -[ 1551.892771] [] warn_slowpath_common+0x86/0xc0 -[ 1551.892773] [] warn_slowpath_fmt+0x4c/0x50 -[ 1551.892781] [] ? drm_vblank_get+0x78/0xd0 [drm] -[ 1551.892787] [] drm_wait_one_vblank+0x197/0x1a0 [drm] -[ 1551.892813] [] intel_post_plane_update+0xef/0x120 [i915] -[ 1551.892832] [] intel_atomic_commit+0x4c2/0x1600 [i915] -[ 1551.892862] [] ? drm_atomic_check_only+0x147/0x5e0 [drm] -[ 1551.892872] [] ? drm_atomic_add_affected_connectors+0x27/0xf0 [drm] -[ 1551.892881] [] drm_atomic_commit+0x37/0x60 [drm] -[ 1551.892887] [] restore_fbdev_mode+0x28a/0x2c0 [drm_kms_helper] -[ 1551.892895] [] drm_fb_helper_restore_fbdev_mode_unlocked+0x33/0x80 [drm_kms_helper] -[ 1551.892900] [] drm_fb_helper_set_par+0x2d/0x50 [drm_kms_helper] -[ 1551.892920] [] intel_fbdev_set_par+0x1a/0x60 [i915] -[ 1551.892923] [] fb_set_var+0x1a7/0x3f0 -[ 1551.892927] [] ? trace_hardirqs_on_caller+0x12f/0x1c0 -[ 1551.892931] [] fbcon_blank+0x212/0x2f0 -[ 1551.892935] [] do_unblank_screen+0xba/0x1d0 -[ 1551.892937] [] vt_ioctl+0x13d5/0x1450 -[ 1551.892940] [] ? preempt_count_sub+0x41/0x50 -[ 1551.892943] [] tty_ioctl+0x423/0xe30 -[ 1551.892947] [] do_vfs_ioctl+0x301/0x560 -[ 1551.892949] [] ? putname+0x53/0x60 -[ 1551.892952] [] ? __fget_light+0x66/0x90 -[ 1551.892955] [] SyS_ioctl+0x79/0x90 -[ 1551.892958] [] entry_SYSCALL_64_fastpath+0x12/0x6f -[ 1551.892961] ---[ end trace 3e764d4b6628c91c ]--- - -Testcase: kms_flip -Reported-and-tested-by: Ville Syrjälä -Cc: stable@vger.kernel.org #v4.3 -Signed-off-by: Maarten Lankhorst -Reviewed-by: Daniel Stone -Signed-off-by: Jani Nikula -Link: http://patchwork.freedesktop.org/patch/msgid/5649C2BA.6080300@mblankhorst.nl ---- - drivers/gpu/drm/i915/intel_display.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c -index 2e348788ecaa..7e13bea3b4d5 100644 ---- a/drivers/gpu/drm/i915/intel_display.c -+++ b/drivers/gpu/drm/i915/intel_display.c -@@ -13005,6 +13005,9 @@ static int intel_atomic_check(struct drm_device *dev, - struct intel_crtc_state *pipe_config = - to_intel_crtc_state(crtc_state); - -+ memset(&to_intel_crtc(crtc)->atomic, 0, -+ sizeof(struct intel_crtc_atomic_commit)); -+ - /* Catch I915_MODE_FLAG_INHERITED */ - if (crtc_state->mode.private_flags != crtc->state->mode.private_flags) - crtc_state->mode_changed = true; --- -2.5.0 - - -From eb02e7a4b15ec47b50fd7447471ac3bb75cce53f Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= -Date: Wed, 11 Nov 2015 19:11:28 +0200 -Subject: [PATCH 09/26] drm/i915: Don't clobber the addfb2 ioctl params -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Upstream commit 76dc3769d7c3cdcfa7c4c7768a7cb87cd91af12f - -We try to convert the old way of of specifying fb tiling (obj->tiling) -into the new fb modifiers. We store the result in the passed in mode_cmd -structure. But that structure comes directly from the addfb2 ioctl, and -gets copied back out to userspace, which means we're clobbering the -modifiers that the user provided (all 0 since the DRM_MODE_FB_MODIFIERS -flag wasn't even set by the user). Hence if the user reuses the struct -for another addfb2, the ioctl will be rejected since it's now asking for -some modifiers w/o the flag set. - -Fix the problem by making a copy of the user provided structure. We can -play any games we want with the copy. - -IGT-Version: 1.12-git (x86_64) (Linux: 4.4.0-rc1-stereo+ x86_64) -... -Subtest basic-X-tiled: SUCCESS (0.001s) -Test assertion failure function pitch_tests, file kms_addfb_basic.c:167: -Failed assertion: drmIoctl(fd, DRM_IOCTL_MODE_ADDFB2, &f) == 0 -Last errno: 22, Invalid argument -Stack trace: - #0 [__igt_fail_assert+0x101] - #1 [pitch_tests+0x619] - #2 [__real_main426+0x2f] - #3 [main+0x23] - #4 [__libc_start_main+0xf0] - #5 [_start+0x29] - #6 [+0x29] - Subtest framebuffer-vs-set-tiling failed. - **** DEBUG **** - Test assertion failure function pitch_tests, file kms_addfb_basic.c:167: - Failed assertion: drmIoctl(fd, DRM_IOCTL_MODE_ADDFB2, &f) == 0 - Last errno: 22, Invalid argument - **** END **** - Subtest framebuffer-vs-set-tiling: FAIL (0.003s) - ... - -IGT-Version: 1.12-git (x86_64) (Linux: 4.4.0-rc1-stereo+ x86_64) -Subtest framebuffer-vs-set-tiling: SUCCESS (0.000s) - -Cc: stable@vger.kernel.org # v4.1+ -Cc: Daniel Vetter -Cc: Tvrtko Ursulin -Fixes: 2a80eada326f ("drm/i915: Add fb format modifier support") -Testcase: igt/kms_addfb_basic/clobbered-modifier -Signed-off-by: Ville Syrjälä -Reviewed-by: Daniel Vetter -Signed-off-by: Jani Nikula -Link: http://patchwork.freedesktop.org/patch/msgid/1447261890-3960-1-git-send-email-ville.syrjala@linux.intel.com ---- - drivers/gpu/drm/i915/intel_display.c | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - -diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c -index 7e13bea3b4d5..d07d98aeb72c 100644 ---- a/drivers/gpu/drm/i915/intel_display.c -+++ b/drivers/gpu/drm/i915/intel_display.c -@@ -14330,16 +14330,17 @@ static int intel_framebuffer_init(struct drm_device *dev, - static struct drm_framebuffer * - intel_user_framebuffer_create(struct drm_device *dev, - struct drm_file *filp, -- struct drm_mode_fb_cmd2 *mode_cmd) -+ struct drm_mode_fb_cmd2 *user_mode_cmd) - { - struct drm_i915_gem_object *obj; -+ struct drm_mode_fb_cmd2 mode_cmd = *user_mode_cmd; - - obj = to_intel_bo(drm_gem_object_lookup(dev, filp, -- mode_cmd->handles[0])); -+ mode_cmd.handles[0])); - if (&obj->base == NULL) - return ERR_PTR(-ENOENT); - -- return intel_framebuffer_create(dev, mode_cmd, obj); -+ return intel_framebuffer_create(dev, &mode_cmd, obj); - } - - #ifndef CONFIG_DRM_FBDEV_EMULATION --- -2.5.0 - - -From 687b4f4810c6a23420994e9cf4bb2d420a80217d Mon Sep 17 00:00:00 2001 -From: Mika Kuoppala -Date: Tue, 17 Nov 2015 18:14:26 +0200 -Subject: [PATCH 10/26] drm/i915: Fix gpu frequency change tracing -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Upstream commit 0f94592efd36213c961145fe1ab0c3bc323ec053 - -With gen < 9 we have had always 50Mhz units as our hw -ratio. With gen >= 9 the hw ratio changed to 16.667Mhz (50/3). -The result was that our gpu frequency tracing started to output -values 3 times larger than expected due to hardcoded scaling -value. Fix this by using Use intel_gpu_freq() when generating Mhz -value from ratio for 'intel_gpu_freq_change' trace event. - -Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92591 -Cc: stable@vger.kernel.org # v4.3+ -Reported-by: Eero Tamminen -Signed-off-by: Mika Kuoppala -Reviewed-by: Ville Syrjälä -Signed-off-by: Jani Nikula -Link: http://patchwork.freedesktop.org/patch/msgid/1447776866-29384-1-git-send-email-mika.kuoppala@intel.com ---- - drivers/gpu/drm/i915/intel_pm.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c -index 5e91e795fd99..2a689522cd89 100644 ---- a/drivers/gpu/drm/i915/intel_pm.c -+++ b/drivers/gpu/drm/i915/intel_pm.c -@@ -4503,7 +4503,7 @@ static void gen6_set_rps(struct drm_device *dev, u8 val) - POSTING_READ(GEN6_RPNSWREQ); - - dev_priv->rps.cur_freq = val; -- trace_intel_gpu_freq_change(val * 50); -+ trace_intel_gpu_freq_change(intel_gpu_freq(dev_priv, val)); - } - - static void valleyview_set_rps(struct drm_device *dev, u8 val) --- -2.5.0 - - -From efee83c75bf454e745ebaddd96b9fe741c706317 Mon Sep 17 00:00:00 2001 -From: Chris Wilson -Date: Thu, 19 Nov 2015 09:58:05 +0000 -Subject: [PATCH 11/26] drm/i915: Mark uneven memory banks on gen4 desktop as - unknown swizzling -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Upstream commit 0b466dc238cb660bbdb9ef6e121e1757057484c3 - -We have varied reports of swizzling corruption on gen4 desktop, and -confirmation that one at least is triggered by uneven memory banks -(L-shaped memory). The implication is that the swizzling varies between -the paired channels and the remainder of memory on the single channel. As -the object then has unpredictable swizzling (it will vary depending on -exact page allocation and may even change during the object's lifetime as -the pages are replaced), we have to report to userspace that the swizzling -is unknown. - -However, some existing userspace is buggy when it meets an unknown -swizzling configuration and so we need to tell another white lie and -mark the swizzling as NONE but report it as UNKNOWN through the extended -get-tiling-ioctl. See - -commit 5eb3e5a5e11d14f9deb2a4b83555443b69ab9940 -Author: Chris Wilson -Date: Sun Jun 28 09:19:26 2015 +0100 - - drm/i915: Declare the swizzling unknown for L-shaped configurations - -for the previous example where we found that telling the truth to -userspace just ends up in a world of hurt. - -Also since we don't truly know what the swizzling is on the pages, we -need to keep them pinned to prevent swapping as the reports also -suggest that some gen4 devices have previously undetected bit17 -swizzling. - -v2: Combine unknown + quirk patches to prevent userspace ever seeing -unknown swizzling through the normal get-tiling-ioctl. Also use the same -path for the existing uneven bank detection for mobile gen4. - -Reported-by: Matti Hämäläinen -Tested-by: Matti Hämäläinen -References: https://bugs.freedesktop.org/show_bug.cgi?id=90725 -Signed-off-by: Chris Wilson -Cc: Matti Hämäläinen -Cc: Daniel Vetter -Cc: Jani Nikula -Cc: stable@vger.kernel.org -Reviewed-by: Daniel Vetter -Link: http://patchwork.freedesktop.org/patch/msgid/1447927085-31726-1-git-send-email-chris@chris-wilson.co.uk -Signed-off-by: Jani Nikula ---- - drivers/gpu/drm/i915/i915_gem_fence.c | 36 ++++++++++++++++++++++++++--------- - 1 file changed, 27 insertions(+), 9 deletions(-) - -diff --git a/drivers/gpu/drm/i915/i915_gem_fence.c b/drivers/gpu/drm/i915/i915_gem_fence.c -index af1f8c461060..716c3d8f027c 100644 ---- a/drivers/gpu/drm/i915/i915_gem_fence.c -+++ b/drivers/gpu/drm/i915/i915_gem_fence.c -@@ -647,11 +647,10 @@ i915_gem_detect_bit_6_swizzle(struct drm_device *dev) - } - - /* check for L-shaped memory aka modified enhanced addressing */ -- if (IS_GEN4(dev)) { -- uint32_t ddc2 = I915_READ(DCC2); -- -- if (!(ddc2 & DCC2_MODIFIED_ENHANCED_DISABLE)) -- dev_priv->quirks |= QUIRK_PIN_SWIZZLED_PAGES; -+ if (IS_GEN4(dev) && -+ !(I915_READ(DCC2) & DCC2_MODIFIED_ENHANCED_DISABLE)) { -+ swizzle_x = I915_BIT_6_SWIZZLE_UNKNOWN; -+ swizzle_y = I915_BIT_6_SWIZZLE_UNKNOWN; - } - - if (dcc == 0xffffffff) { -@@ -680,16 +679,35 @@ i915_gem_detect_bit_6_swizzle(struct drm_device *dev) - * matching, which was the case for the swizzling required in - * the table above, or from the 1-ch value being less than - * the minimum size of a rank. -+ * -+ * Reports indicate that the swizzling actually -+ * varies depending upon page placement inside the -+ * channels, i.e. we see swizzled pages where the -+ * banks of memory are paired and unswizzled on the -+ * uneven portion, so leave that as unknown. - */ -- if (I915_READ16(C0DRB3) != I915_READ16(C1DRB3)) { -- swizzle_x = I915_BIT_6_SWIZZLE_NONE; -- swizzle_y = I915_BIT_6_SWIZZLE_NONE; -- } else { -+ if (I915_READ16(C0DRB3) == I915_READ16(C1DRB3)) { - swizzle_x = I915_BIT_6_SWIZZLE_9_10; - swizzle_y = I915_BIT_6_SWIZZLE_9; - } - } - -+ if (swizzle_x == I915_BIT_6_SWIZZLE_UNKNOWN || -+ swizzle_y == I915_BIT_6_SWIZZLE_UNKNOWN) { -+ /* Userspace likes to explode if it sees unknown swizzling, -+ * so lie. We will finish the lie when reporting through -+ * the get-tiling-ioctl by reporting the physical swizzle -+ * mode as unknown instead. -+ * -+ * As we don't strictly know what the swizzling is, it may be -+ * bit17 dependent, and so we need to also prevent the pages -+ * from being moved. -+ */ -+ dev_priv->quirks |= QUIRK_PIN_SWIZZLED_PAGES; -+ swizzle_x = I915_BIT_6_SWIZZLE_NONE; -+ swizzle_y = I915_BIT_6_SWIZZLE_NONE; -+ } -+ - dev_priv->mm.bit_6_swizzle_x = swizzle_x; - dev_priv->mm.bit_6_swizzle_y = swizzle_y; - } --- -2.5.0 - - -From b9aa6e409916793c7b2c6302df80f9a8c36ddcf2 Mon Sep 17 00:00:00 2001 -From: Takashi Iwai -Date: Wed, 25 Nov 2015 15:26:47 +0100 -Subject: [PATCH 12/26] drm/i915: Don't compare has_drrs strictly in pipe - config - -Upstream commit 13b13dfaaa39ab52b0f433c6744f4638793cbf7b - -The commit [cfb23ed622d0: drm/i915: Allow fuzzy matching in -pipe_config_compare, v2] relaxed the way to compare the pipe -configurations, but one new comparison sneaked in there: it added the -strict has_drrs value check. This causes a regression on many -machines, typically HP laptops with a docking port, where the kernel -spews warnings and eventually fails to set the mode properly like: - [drm:intel_pipe_config_compare [i915]] *ERROR* mismatch in has_drrs (expected 1, found 0) - ------------[ cut here ]------------ - WARNING: CPU: 0 PID: 79 at drivers/gpu/drm/i915/intel_display.c:12700 intel_modeset_check_state+0x5aa/0x870 [i915]() - pipe state doesn't match! - .... - -This patch just removes the check again for fixing the regression. - -Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=104041 -Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92456 -Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=956397 -Fixes: cfb23ed622d0 ('drm/i915: Allow fuzzy matching in pipe_config_compare, v2') -Cc: # v4.3+ -Reported-and-tested-by: Max Lin -Signed-off-by: Takashi Iwai -Reviewed-by: Daniel Vetter -Link: http://patchwork.freedesktop.org/patch/msgid/1448461607-16868-1-git-send-email-tiwai@suse.de -Signed-off-by: Jani Nikula ---- - drivers/gpu/drm/i915/intel_display.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c -index d07d98aeb72c..58e08fb47d1f 100644 ---- a/drivers/gpu/drm/i915/intel_display.c -+++ b/drivers/gpu/drm/i915/intel_display.c -@@ -12427,7 +12427,6 @@ intel_pipe_config_compare(struct drm_device *dev, - if (INTEL_INFO(dev)->gen < 8) { - PIPE_CONF_CHECK_M_N(dp_m_n); - -- PIPE_CONF_CHECK_I(has_drrs); - if (current_config->has_drrs) - PIPE_CONF_CHECK_M_N(dp_m2_n2); - } else --- -2.5.0 - - -From 17e09098ed89ccc44a9420b0eee361b2e4f1f58c Mon Sep 17 00:00:00 2001 -From: Takashi Iwai -Date: Thu, 19 Nov 2015 12:09:56 +0100 -Subject: [PATCH 13/26] drm/i915: Don't override output type for DDI HDMI - -Upstream commit 2540058f7a9d9a843b4d9a28d4f8168dd034d030 - -Currently a DDI port may register the DP hotplug handler even though -it's used with HDMI, and the DP HPD handler overrides the encoder -type forcibly to DP. This caused the inconsistency on a machine -connected with a HDMI monitor; upon a hotplug event, the DDI port is -suddenly switched to be handled as a DP although the same monitor is -kept connected, and this leads to the erroneous blank output. - -This patch papers over the bug by excluding the previous HDMI encoder -type from this override. This should be fixed more fundamentally, -e.g. by moving the encoder type reset from the HPD or by having -individual encoder objects for HDMI and DP. But since the bug has -been present for a long time (3.17), it's better to have a -quick-n-dirty fix for now, and keep working on a cleaner fix. - -Bugzilla: http://bugzilla.opensuse.org/show_bug.cgi?id=955190 -Fixes: 0e32b39ceed6 ('drm/i915: add DP 1.2 MST support (v0.7)') -Cc: # v3.17+ -Signed-off-by: Takashi Iwai -Reviewed-by: Daniel Vetter -Link: http://patchwork.freedesktop.org/patch/msgid/1447931396-19147-1-git-send-email-tiwai@suse.de -Signed-off-by: Jani Nikula ---- - drivers/gpu/drm/i915/intel_dp.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c -index 0a2e33fbf20d..a7b7a64d8d27 100644 ---- a/drivers/gpu/drm/i915/intel_dp.c -+++ b/drivers/gpu/drm/i915/intel_dp.c -@@ -4921,7 +4921,8 @@ intel_dp_hpd_pulse(struct intel_digital_port *intel_dig_port, bool long_hpd) - enum intel_display_power_domain power_domain; - enum irqreturn ret = IRQ_NONE; - -- if (intel_dig_port->base.type != INTEL_OUTPUT_EDP) -+ if (intel_dig_port->base.type != INTEL_OUTPUT_EDP && -+ intel_dig_port->base.type != INTEL_OUTPUT_HDMI) - intel_dig_port->base.type = INTEL_OUTPUT_DISPLAYPORT; - - if (long_hpd && intel_dig_port->base.type == INTEL_OUTPUT_EDP) { --- -2.5.0 - - -From 5cbff55f4355dc1cec8124c8741fdfd98f644c73 Mon Sep 17 00:00:00 2001 -From: Sagar Arun Kamble -Date: Sat, 12 Sep 2015 10:17:50 +0530 -Subject: [PATCH 14/26] drm/i915: Add IS_SKL_GT3 and IS_SKL_GT4 macro. - -Upstream commit 7a58bad0e63295dfa803973efcebc80cb730c7bd - -It will be usefull to specify w/a that affects only SKL GT3 and GT4. - -Signed-off-by: Sagar Arun Kamble -Reviewed-by: Alex Dai -Signed-off-by: Daniel Vetter ---- - drivers/gpu/drm/i915/i915_drv.h | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h -index e1db8de52851..3c16f6237251 100644 ---- a/drivers/gpu/drm/i915/i915_drv.h -+++ b/drivers/gpu/drm/i915/i915_drv.h -@@ -2475,6 +2475,11 @@ struct drm_i915_cmd_table { - #define IS_SKL_ULX(dev) (INTEL_DEVID(dev) == 0x190E || \ - INTEL_DEVID(dev) == 0x1915 || \ - INTEL_DEVID(dev) == 0x191E) -+#define IS_SKL_GT3(dev) (IS_SKYLAKE(dev) && \ -+ (INTEL_DEVID(dev) & 0x00F0) == 0x0020) -+#define IS_SKL_GT4(dev) (IS_SKYLAKE(dev) && \ -+ (INTEL_DEVID(dev) & 0x00F0) == 0x0030) -+ - #define IS_PRELIMINARY_HW(intel_info) ((intel_info)->is_preliminary) - - #define SKL_REVID_A0 (0x0) --- -2.5.0 - - -From baed978880f2c32e82587cc514227aad82daecd5 Mon Sep 17 00:00:00 2001 -From: Arun Siluvery -Date: Fri, 18 Sep 2015 17:52:47 +0100 -Subject: [PATCH 15/26] drm/i915/bxt: Update revision id for BXT C0 - -Upstream commit 5ca4163a612068d8f942c454218d3d631f22af1b - -Cc: Nick Hoath -Cc: Imre Deak -Signed-off-by: Arun Siluvery -Reviewed-by: Imre Deak -Signed-off-by: Daniel Vetter ---- - drivers/gpu/drm/i915/i915_drv.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h -index 3c16f6237251..475b03e9d584 100644 ---- a/drivers/gpu/drm/i915/i915_drv.h -+++ b/drivers/gpu/drm/i915/i915_drv.h -@@ -2491,7 +2491,7 @@ struct drm_i915_cmd_table { - - #define BXT_REVID_A0 (0x0) - #define BXT_REVID_B0 (0x3) --#define BXT_REVID_C0 (0x6) -+#define BXT_REVID_C0 (0x9) - - /* - * The genX designation typically refers to the render engine, so render --- -2.5.0 - - -From c80bd95bfeb85ce970c5f7711718a274e4b38b55 Mon Sep 17 00:00:00 2001 -From: Sagar Arun Kamble -Date: Sat, 12 Sep 2015 10:17:51 +0530 -Subject: [PATCH 16/26] drm/i915: WaRsDisableCoarsePowerGating - -Upstream commit f2d2fe95072acd5404f8051b8bf1195c61a47fb5 - -WaRsDisableCoarsePowerGating: Coarse Power Gating (CPG) needs to be -disabled for platforms prior to BXT B0 and SKL GT3/GT4 till E0. - -v2: Added GT3/GT4 Check. - -Change-Id: Ia3c4c16e050c88d3e259f601054875c812d69c3a -Signed-off-by: Sagar Arun Kamble -Reviewed-by: Alex Dai -[danvet: Align continuation properly.] -Signed-off-by: Daniel Vetter ---- - drivers/gpu/drm/i915/intel_pm.c | 11 +++++++---- - 1 file changed, 7 insertions(+), 4 deletions(-) - -diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c -index 2a689522cd89..56a5568ffeb7 100644 ---- a/drivers/gpu/drm/i915/intel_pm.c -+++ b/drivers/gpu/drm/i915/intel_pm.c -@@ -4851,11 +4851,14 @@ static void gen9_enable_rc6(struct drm_device *dev) - - /* - * 3b: Enable Coarse Power Gating only when RC6 is enabled. -- * WaDisableRenderPowerGating:skl,bxt - Render PG need to be disabled with RC6. -+ * WaRsDisableCoarsePowerGating:skl,bxt - Render/Media PG need to be disabled with RC6. - */ -- I915_WRITE(GEN9_PG_ENABLE, (rc6_mask & GEN6_RC_CTL_RC6_ENABLE) ? -- GEN9_MEDIA_PG_ENABLE : 0); -- -+ if ((IS_BROXTON(dev) && (INTEL_REVID(dev) < BXT_REVID_B0)) || -+ ((IS_SKL_GT3(dev) || IS_SKL_GT4(dev)) && (INTEL_REVID(dev) <= SKL_REVID_E0))) -+ I915_WRITE(GEN9_PG_ENABLE, 0); -+ else -+ I915_WRITE(GEN9_PG_ENABLE, (rc6_mask & GEN6_RC_CTL_RC6_ENABLE) ? -+ (GEN9_RENDER_PG_ENABLE | GEN9_MEDIA_PG_ENABLE) : 0); - - intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL); - --- -2.5.0 - - -From c6b1dd5d44c09a9c0032066415ccf8539efb5856 Mon Sep 17 00:00:00 2001 -From: Sagar Arun Kamble -Date: Sat, 12 Sep 2015 10:17:52 +0530 -Subject: [PATCH 17/26] drm/i915: WaRsUseTimeoutMode - -Upstream commit e3429cd240b06c79df3ea90f28065a7e011744cd - -Enable TO mode for RC6 for SKL till D0 and BXT till A0. - -Cc: Tom O'Rourke -Cc: Akash Goel -Signed-off-by: Sagar Arun Kamble -Reviewed-by: Alex Dai -[danvet: Fixup line continuation alignment.] -Signed-off-by: Daniel Vetter ---- - drivers/gpu/drm/i915/intel_pm.c | 13 ++++++++++--- - 1 file changed, 10 insertions(+), 3 deletions(-) - -diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c -index 56a5568ffeb7..ab54c645c2ee 100644 ---- a/drivers/gpu/drm/i915/intel_pm.c -+++ b/drivers/gpu/drm/i915/intel_pm.c -@@ -4845,9 +4845,16 @@ static void gen9_enable_rc6(struct drm_device *dev) - rc6_mask = GEN6_RC_CTL_RC6_ENABLE; - DRM_INFO("RC6 %s\n", (rc6_mask & GEN6_RC_CTL_RC6_ENABLE) ? - "on" : "off"); -- I915_WRITE(GEN6_RC_CONTROL, GEN6_RC_CTL_HW_ENABLE | -- GEN6_RC_CTL_EI_MODE(1) | -- rc6_mask); -+ -+ if ((IS_SKYLAKE(dev) && INTEL_REVID(dev) <= SKL_REVID_D0) || -+ (IS_BROXTON(dev) && INTEL_REVID(dev) <= BXT_REVID_A0)) -+ I915_WRITE(GEN6_RC_CONTROL, GEN6_RC_CTL_HW_ENABLE | -+ GEN7_RC_CTL_TO_MODE | -+ rc6_mask); -+ else -+ I915_WRITE(GEN6_RC_CONTROL, GEN6_RC_CTL_HW_ENABLE | -+ GEN6_RC_CTL_EI_MODE(1) | -+ rc6_mask); - - /* - * 3b: Enable Coarse Power Gating only when RC6 is enabled. --- -2.5.0 - - -From a7af36dfaaa2136be0454787130f73d207c2f34d Mon Sep 17 00:00:00 2001 -From: Sagar Arun Kamble -Date: Sat, 12 Sep 2015 10:17:53 +0530 -Subject: [PATCH 18/26] drm/i915: WaRsDoubleRc6WrlWithCoarsePowerGating - -Upstream commit 63a4dec2c168b74a39df1eac494501f0f6bf3708 - -Cc: Tom O'Rourke -Cc: Akash Goel -Signed-off-by: Sagar Arun Kamble -Reviewed-by: Alex Dai -[danvet: Fix continuation alignment.] -Signed-off-by: Daniel Vetter ---- - drivers/gpu/drm/i915/intel_pm.c | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c -index ab54c645c2ee..7c7b6386121f 100644 ---- a/drivers/gpu/drm/i915/intel_pm.c -+++ b/drivers/gpu/drm/i915/intel_pm.c -@@ -4828,7 +4828,13 @@ static void gen9_enable_rc6(struct drm_device *dev) - I915_WRITE(GEN6_RC_CONTROL, 0); - - /* 2b: Program RC6 thresholds.*/ -- I915_WRITE(GEN6_RC6_WAKE_RATE_LIMIT, 54 << 16); -+ -+ /* WaRsDoubleRc6WrlWithCoarsePowerGating: Doubling WRL only when CPG is enabled */ -+ if (IS_SKYLAKE(dev) && !((IS_SKL_GT3(dev) || IS_SKL_GT4(dev)) && -+ (INTEL_REVID(dev) <= SKL_REVID_E0))) -+ I915_WRITE(GEN6_RC6_WAKE_RATE_LIMIT, 108 << 16); -+ else -+ I915_WRITE(GEN6_RC6_WAKE_RATE_LIMIT, 54 << 16); - I915_WRITE(GEN6_RC_EVALUATION_INTERVAL, 125000); /* 12500 * 1280ns */ - I915_WRITE(GEN6_RC_IDLE_HYSTERSIS, 25); /* 25 * 1280ns */ - for_each_ring(ring, dev_priv, unused) --- -2.5.0 - - -From b925cfd49203fc37c491fa28310221be23a2634d Mon Sep 17 00:00:00 2001 -From: Mika Kuoppala -Date: Mon, 7 Dec 2015 18:29:44 +0200 -Subject: [PATCH 19/26] drm/i915/skl: Disable coarse power gating up until F0 - -Upstream commit 344df9809f4521c8c11d67c5ef18764b54358950 - -There is conflicting info between E0 and F0 steppings -for this workarounds. Trust more authoritative source and -be conservative and extend also for F0. - -This prevents numerous (>50) gpu hangs with SKL GT4e -during piglit run. - -References: HSD: gen9lp/2134184 -Cc: Sagar Arun Kamble -Signed-off-by: Mika Kuoppala -Reviewed-by: Sagar Arun Kamble -Link: http://patchwork.freedesktop.org/patch/msgid/1449505785-20812-1-git-send-email-mika.kuoppala@intel.com -(cherry picked from commit 6686ece19f7446f0e29c77d9e0402e1d0ce10c48) -Cc: stable@vger.kernel.org # v4.3+ -Signed-off-by: Jani Nikula ---- - drivers/gpu/drm/i915/intel_pm.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c -index 7c7b6386121f..d04f123f4ccf 100644 ---- a/drivers/gpu/drm/i915/intel_pm.c -+++ b/drivers/gpu/drm/i915/intel_pm.c -@@ -4867,7 +4867,7 @@ static void gen9_enable_rc6(struct drm_device *dev) - * WaRsDisableCoarsePowerGating:skl,bxt - Render/Media PG need to be disabled with RC6. - */ - if ((IS_BROXTON(dev) && (INTEL_REVID(dev) < BXT_REVID_B0)) || -- ((IS_SKL_GT3(dev) || IS_SKL_GT4(dev)) && (INTEL_REVID(dev) <= SKL_REVID_E0))) -+ ((IS_SKL_GT3(dev) || IS_SKL_GT4(dev)) && (INTEL_REVID(dev) <= SKL_REVID_F0))) - I915_WRITE(GEN9_PG_ENABLE, 0); - else - I915_WRITE(GEN9_PG_ENABLE, (rc6_mask & GEN6_RC_CTL_RC6_ENABLE) ? --- -2.5.0 - - -From 302e759f64e1c4bed49f31459329acbb2cddce8a Mon Sep 17 00:00:00 2001 -From: Mika Kuoppala -Date: Mon, 7 Dec 2015 18:29:45 +0200 -Subject: [PATCH 20/26] drm/i915/skl: Double RC6 WRL always on - -Upstream commit 6704d45528537ea6088aeea0667d87b605b82d51 - -WaRsDoubleRc6WrlWithCoarsePowerGating should -be enabled for all Skylakes. Make it so. - -Cc: Sagar Arun Kamble -Signed-off-by: Mika Kuoppala -Reviewed-by: Sagar Arun Kamble -Link: http://patchwork.freedesktop.org/patch/msgid/1449505785-20812-2-git-send-email-mika.kuoppala@intel.com -(cherry picked from commit e7674b8c31717dd0c58b3a9493d43249722071eb) -Cc: stable@vger.kernel.org # v4.3+ -Signed-off-by: Jani Nikula ---- - drivers/gpu/drm/i915/intel_pm.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c -index d04f123f4ccf..33db474fae02 100644 ---- a/drivers/gpu/drm/i915/intel_pm.c -+++ b/drivers/gpu/drm/i915/intel_pm.c -@@ -4830,8 +4830,7 @@ static void gen9_enable_rc6(struct drm_device *dev) - /* 2b: Program RC6 thresholds.*/ - - /* WaRsDoubleRc6WrlWithCoarsePowerGating: Doubling WRL only when CPG is enabled */ -- if (IS_SKYLAKE(dev) && !((IS_SKL_GT3(dev) || IS_SKL_GT4(dev)) && -- (INTEL_REVID(dev) <= SKL_REVID_E0))) -+ if (IS_SKYLAKE(dev)) - I915_WRITE(GEN6_RC6_WAKE_RATE_LIMIT, 108 << 16); - else - I915_WRITE(GEN6_RC6_WAKE_RATE_LIMIT, 54 << 16); --- -2.5.0 - - -From c4c390176eaf6b4321c1f90065107711845e9aff Mon Sep 17 00:00:00 2001 -From: Maarten Lankhorst -Date: Mon, 23 Nov 2015 10:25:28 +0100 -Subject: [PATCH 21/26] drm/i915: Do a better job at disabling primary plane in - the noatomic case. - -Upstream commit 634b3a4a476e96816d5d6cd5bb9f8900a53f56ba - -When disable_noatomic is called plane_mask is not correct yet, and -plane_state->visible = true is left as true after disabling the primary -plane. - -Other planes are already disabled as part of crtc sanitization, only the -primary is left active. But the plane_mask is not updated here. It gets -updated during fb takeover in modeset_gem_init, or set to the new value -on resume. - -This means that to disable the primary plane 1 << drm_plane_index(primary) -needs to be used. - -Afterwards because the crtc is no longer active it's forbidden to keep -plane_state->visible set, or a WARN_ON in -intel_plane_atomic_calc_changes triggers. There are other code points -that rely on accurate plane_state->visible too, so make sure the bool is -cleared. - -The other planes are already disabled in intel_sanitize_crtc, so they -don't have to be handled here. - -Cc: stable@vger.kernel.org #v4.3, v4.2? -Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92655 -Tested-by: Tomas Mezzadra -Signed-off-by: Maarten Lankhorst -Reviewed-by: Daniel Vetter -Link: http://patchwork.freedesktop.org/patch/msgid/5652DB88.9070208@linux.intel.com -(cherry picked from commit 54a4196188eab82e6f0a5f05716626e9f18b8fb6) -Signed-off-by: Jani Nikula ---- - drivers/gpu/drm/i915/intel_display.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c -index 58e08fb47d1f..35fad110cc26 100644 ---- a/drivers/gpu/drm/i915/intel_display.c -+++ b/drivers/gpu/drm/i915/intel_display.c -@@ -6225,9 +6225,11 @@ static void intel_crtc_disable_noatomic(struct drm_crtc *crtc) - if (to_intel_plane_state(crtc->primary->state)->visible) { - intel_crtc_wait_for_pending_flips(crtc); - intel_pre_disable_primary(crtc); -+ -+ intel_crtc_disable_planes(crtc, 1 << drm_plane_index(crtc->primary)); -+ to_intel_plane_state(crtc->primary->state)->visible = false; - } - -- intel_crtc_disable_planes(crtc, crtc->state->plane_mask); - dev_priv->display.crtc_disable(crtc); - intel_disable_shared_dpll(intel_crtc); - --- -2.5.0 - - -From 42ab5c413c7cf61fab4b2fbce9cb4ab7f7be6356 Mon Sep 17 00:00:00 2001 -From: Chris Wilson -Date: Fri, 11 Dec 2015 11:32:57 +0000 -Subject: [PATCH 22/26] drm/i915: Break busywaiting for requests on pending - signals - -Upstream commit e7571f7fd66c77a760338340adbe41d994fe93ac - -The busywait in __i915_spin_request() does not respect pending signals -and so may consume the entire timeslice for the task instead of -returning to userspace to handle the signal. - -In the worst case this could cause a delay in signal processing of 20ms, -which would be a noticeable jitter in cursor tracking. If a higher -resolution signal was being used, for example to provide fairness of a -server timeslices between clients, we could expect to detect some -unfairness between clients (i.e. some windows not updating as fast as -others). This issue was noticed when inspecting a report of poor -interactivity resulting from excessively high __i915_spin_request usage. - -Fixes regression from -commit 2def4ad99befa25775dd2f714fdd4d92faec6e34 [v4.2] -Author: Chris Wilson -Date: Tue Apr 7 16:20:41 2015 +0100 - - drm/i915: Optimistically spin for the request completion - -v2: Try to assess the impact of the bug - -Signed-off-by: Chris Wilson -Reviewed-by: Tvrtko Ursulin -Cc: Jens Axboe -Cc; "Rogozhkin, Dmitry V" -Cc: Daniel Vetter -Cc: Tvrtko Ursulin -Cc: Eero Tamminen -Cc: "Rantala, Valtteri" -Cc: stable@vger.kernel.org -Signed-off-by: Daniel Vetter -Link: http://patchwork.freedesktop.org/patch/msgid/1449833608-22125-2-git-send-email-chris@chris-wilson.co.uk -(cherry picked from commit 91b0c352ace9afec1fb51590c7b8bd60e0eb9fbd) -Signed-off-by: Jani Nikula ---- - drivers/gpu/drm/i915/i915_gem.c | 13 ++++++++----- - 1 file changed, 8 insertions(+), 5 deletions(-) - -diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c -index dee065c2b6d8..c6e3ab72882f 100644 ---- a/drivers/gpu/drm/i915/i915_gem.c -+++ b/drivers/gpu/drm/i915/i915_gem.c -@@ -1144,7 +1144,7 @@ static bool missed_irq(struct drm_i915_private *dev_priv, - return test_bit(ring->id, &dev_priv->gpu_error.missed_irq_rings); - } - --static int __i915_spin_request(struct drm_i915_gem_request *req) -+static int __i915_spin_request(struct drm_i915_gem_request *req, int state) - { - unsigned long timeout; - -@@ -1156,6 +1156,9 @@ static int __i915_spin_request(struct drm_i915_gem_request *req) - if (i915_gem_request_completed(req, true)) - return 0; - -+ if (signal_pending_state(state, current)) -+ break; -+ - if (time_after_eq(jiffies, timeout)) - break; - -@@ -1195,6 +1198,7 @@ int __i915_wait_request(struct drm_i915_gem_request *req, - struct drm_i915_private *dev_priv = dev->dev_private; - const bool irq_test_in_progress = - ACCESS_ONCE(dev_priv->gpu_error.test_irq_rings) & intel_ring_flag(ring); -+ int state = interruptible ? TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE; - DEFINE_WAIT(wait); - unsigned long timeout_expire; - s64 before, now; -@@ -1219,7 +1223,7 @@ int __i915_wait_request(struct drm_i915_gem_request *req, - before = ktime_get_raw_ns(); - - /* Optimistic spin for the next jiffie before touching IRQs */ -- ret = __i915_spin_request(req); -+ ret = __i915_spin_request(req, state); - if (ret == 0) - goto out; - -@@ -1231,8 +1235,7 @@ int __i915_wait_request(struct drm_i915_gem_request *req, - for (;;) { - struct timer_list timer; - -- prepare_to_wait(&ring->irq_queue, &wait, -- interruptible ? TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE); -+ prepare_to_wait(&ring->irq_queue, &wait, state); - - /* We need to check whether any gpu reset happened in between - * the caller grabbing the seqno and now ... */ -@@ -1250,7 +1253,7 @@ int __i915_wait_request(struct drm_i915_gem_request *req, - break; - } - -- if (interruptible && signal_pending(current)) { -+ if (signal_pending_state(state, current)) { - ret = -ERESTARTSYS; - break; - } --- -2.5.0 - - -From 8cbf415a2aadd85cf9dfab28296a821ffea96d87 Mon Sep 17 00:00:00 2001 -From: Chris Wilson -Date: Fri, 11 Dec 2015 11:32:58 +0000 -Subject: [PATCH 23/26] drm/i915: Limit the busy wait on requests to 5us not - 10ms! - -Upstream commit f87a780f07b22b6dc4642dbaf44af65112076cb8 - -When waiting for high frequency requests, the finite amount of time -required to set up the irq and wait upon it limits the response rate. By -busywaiting on the request completion for a short while we can service -the high frequency waits as quick as possible. However, if it is a slow -request, we want to sleep as quickly as possible. The tradeoff between -waiting and sleeping is roughly the time it takes to sleep on a request, -on the order of a microsecond. Based on measurements of synchronous -workloads from across big core and little atom, I have set the limit for -busywaiting as 10 microseconds. In most of the synchronous cases, we can -reduce the limit down to as little as 2 miscroseconds, but that leaves -quite a few test cases regressing by factors of 3 and more. - -The code currently uses the jiffie clock, but that is far too coarse (on -the order of 10 milliseconds) and results in poor interactivity as the -CPU ends up being hogged by slow requests. To get microsecond resolution -we need to use a high resolution timer. The cheapest of which is polling -local_clock(), but that is only valid on the same CPU. If we switch CPUs -because the task was preempted, we can also use that as an indicator that - the system is too busy to waste cycles on spinning and we should sleep -instead. - -__i915_spin_request was introduced in -commit 2def4ad99befa25775dd2f714fdd4d92faec6e34 [v4.2] -Author: Chris Wilson -Date: Tue Apr 7 16:20:41 2015 +0100 - - drm/i915: Optimistically spin for the request completion - -v2: Drop full u64 for unsigned long - the timer is 32bit wraparound safe, -so we can use native register sizes on smaller architectures. Mention -the approximate microseconds units for elapsed time and add some extra -comments describing the reason for busywaiting. - -v3: Raise the limit to 10us -v4: Now 5us. - -Reported-by: Jens Axboe -Link: https://lkml.org/lkml/2015/11/12/621 -Reviewed-by: Tvrtko Ursulin -Cc: "Rogozhkin, Dmitry V" -Cc: Daniel Vetter -Cc: Tvrtko Ursulin -Cc: Eero Tamminen -Cc: "Rantala, Valtteri" -Cc: stable@vger.kernel.org -Signed-off-by: Daniel Vetter -Link: http://patchwork.freedesktop.org/patch/msgid/1449833608-22125-3-git-send-email-chris@chris-wilson.co.uk -(cherry picked from commit ca5b721e238226af1d767103ac852aeb8e4c0764) -Signed-off-by: Jani Nikula ---- - drivers/gpu/drm/i915/i915_gem.c | 47 +++++++++++++++++++++++++++++++++++++++-- - 1 file changed, 45 insertions(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c -index c6e3ab72882f..205316d056f1 100644 ---- a/drivers/gpu/drm/i915/i915_gem.c -+++ b/drivers/gpu/drm/i915/i915_gem.c -@@ -1144,14 +1144,57 @@ static bool missed_irq(struct drm_i915_private *dev_priv, - return test_bit(ring->id, &dev_priv->gpu_error.missed_irq_rings); - } - -+static unsigned long local_clock_us(unsigned *cpu) -+{ -+ unsigned long t; -+ -+ /* Cheaply and approximately convert from nanoseconds to microseconds. -+ * The result and subsequent calculations are also defined in the same -+ * approximate microseconds units. The principal source of timing -+ * error here is from the simple truncation. -+ * -+ * Note that local_clock() is only defined wrt to the current CPU; -+ * the comparisons are no longer valid if we switch CPUs. Instead of -+ * blocking preemption for the entire busywait, we can detect the CPU -+ * switch and use that as indicator of system load and a reason to -+ * stop busywaiting, see busywait_stop(). -+ */ -+ *cpu = get_cpu(); -+ t = local_clock() >> 10; -+ put_cpu(); -+ -+ return t; -+} -+ -+static bool busywait_stop(unsigned long timeout, unsigned cpu) -+{ -+ unsigned this_cpu; -+ -+ if (time_after(local_clock_us(&this_cpu), timeout)) -+ return true; -+ -+ return this_cpu != cpu; -+} -+ - static int __i915_spin_request(struct drm_i915_gem_request *req, int state) - { - unsigned long timeout; -+ unsigned cpu; -+ -+ /* When waiting for high frequency requests, e.g. during synchronous -+ * rendering split between the CPU and GPU, the finite amount of time -+ * required to set up the irq and wait upon it limits the response -+ * rate. By busywaiting on the request completion for a short while we -+ * can service the high frequency waits as quick as possible. However, -+ * if it is a slow request, we want to sleep as quickly as possible. -+ * The tradeoff between waiting and sleeping is roughly the time it -+ * takes to sleep on a request, on the order of a microsecond. -+ */ - - if (i915_gem_request_get_ring(req)->irq_refcount) - return -EBUSY; - -- timeout = jiffies + 1; -+ timeout = local_clock_us(&cpu) + 5; - while (!need_resched()) { - if (i915_gem_request_completed(req, true)) - return 0; -@@ -1159,7 +1202,7 @@ static int __i915_spin_request(struct drm_i915_gem_request *req, int state) - if (signal_pending_state(state, current)) - break; - -- if (time_after_eq(jiffies, timeout)) -+ if (busywait_stop(timeout, cpu)) - break; - - cpu_relax_lowlatency(); --- -2.5.0 - - -From 7b94b8683d8d2ac4b29099e24e351e03f163e462 Mon Sep 17 00:00:00 2001 -From: Chris Wilson -Date: Fri, 11 Dec 2015 11:32:59 +0000 -Subject: [PATCH 24/26] drm/i915: Only spin whilst waiting on the current - request - -Upstream commit 0f0cd472062eca6f9fac8be0cd5585f9a2df1ab2 - -Limit busywaiting only to the request currently being processed by the -GPU. If the request is not currently being processed by the GPU, there -is a very low likelihood of it being completed within the 2 microsecond -spin timeout and so we will just be wasting CPU cycles. - -v2: Check for logical inversion when rebasing - we were incorrectly -checking for this request being active, and instead busywaiting for -when the GPU was not yet processing the request of interest. - -v3: Try another colour for the seqno names. -v4: Another colour for the function names. - -v5: Remove the forced coherency when checking for the active request. On -reflection and plenty of recent experimentation, the issue is not a -cache coherency problem - but an irq/seqno ordering problem (timing issue). -Here, we do not need the w/a to force ordering of the read with an -interrupt. - -Signed-off-by: Chris Wilson -Reviewed-by: Tvrtko Ursulin -Cc: "Rogozhkin, Dmitry V" -Cc: Daniel Vetter -Cc: Tvrtko Ursulin -Cc: Eero Tamminen -Cc: "Rantala, Valtteri" -Cc: stable@vger.kernel.org -Signed-off-by: Daniel Vetter -Link: http://patchwork.freedesktop.org/patch/msgid/1449833608-22125-4-git-send-email-chris@chris-wilson.co.uk -(cherry picked from commit 821485dc2ad665f136c57ee589bf7a8210160fe2) -Signed-off-by: Jani Nikula ---- - drivers/gpu/drm/i915/i915_drv.h | 27 +++++++++++++++++++-------- - drivers/gpu/drm/i915/i915_gem.c | 8 +++++++- - 2 files changed, 26 insertions(+), 9 deletions(-) - -diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h -index 475b03e9d584..bd6df685ae61 100644 ---- a/drivers/gpu/drm/i915/i915_drv.h -+++ b/drivers/gpu/drm/i915/i915_drv.h -@@ -2178,8 +2178,17 @@ struct drm_i915_gem_request { - struct drm_i915_private *i915; - struct intel_engine_cs *ring; - -- /** GEM sequence number associated with this request. */ -- uint32_t seqno; -+ /** GEM sequence number associated with the previous request, -+ * when the HWS breadcrumb is equal to this the GPU is processing -+ * this request. -+ */ -+ u32 previous_seqno; -+ -+ /** GEM sequence number associated with this request, -+ * when the HWS breadcrumb is equal or greater than this the GPU -+ * has finished processing this request. -+ */ -+ u32 seqno; - - /** Position in the ringbuffer of the start of the request */ - u32 head; -@@ -2880,15 +2889,17 @@ i915_seqno_passed(uint32_t seq1, uint32_t seq2) - return (int32_t)(seq1 - seq2) >= 0; - } - -+static inline bool i915_gem_request_started(struct drm_i915_gem_request *req, -+ bool lazy_coherency) -+{ -+ u32 seqno = req->ring->get_seqno(req->ring, lazy_coherency); -+ return i915_seqno_passed(seqno, req->previous_seqno); -+} -+ - static inline bool i915_gem_request_completed(struct drm_i915_gem_request *req, - bool lazy_coherency) - { -- u32 seqno; -- -- BUG_ON(req == NULL); -- -- seqno = req->ring->get_seqno(req->ring, lazy_coherency); -- -+ u32 seqno = req->ring->get_seqno(req->ring, lazy_coherency); - return i915_seqno_passed(seqno, req->seqno); - } - -diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c -index 205316d056f1..1bf658dc6553 100644 ---- a/drivers/gpu/drm/i915/i915_gem.c -+++ b/drivers/gpu/drm/i915/i915_gem.c -@@ -1191,9 +1191,13 @@ static int __i915_spin_request(struct drm_i915_gem_request *req, int state) - * takes to sleep on a request, on the order of a microsecond. - */ - -- if (i915_gem_request_get_ring(req)->irq_refcount) -+ if (req->ring->irq_refcount) - return -EBUSY; - -+ /* Only spin if we know the GPU is processing this request */ -+ if (!i915_gem_request_started(req, true)) -+ return -EAGAIN; -+ - timeout = local_clock_us(&cpu) + 5; - while (!need_resched()) { - if (i915_gem_request_completed(req, true)) -@@ -1207,6 +1211,7 @@ static int __i915_spin_request(struct drm_i915_gem_request *req, int state) - - cpu_relax_lowlatency(); - } -+ - if (i915_gem_request_completed(req, false)) - return 0; - -@@ -2591,6 +2596,7 @@ void __i915_add_request(struct drm_i915_gem_request *request, - request->batch_obj = obj; - - request->emitted_jiffies = jiffies; -+ request->previous_seqno = ring->last_submitted_seqno; - ring->last_submitted_seqno = request->seqno; - list_add_tail(&request->list, &ring->request_list); - --- -2.5.0 - - -From bf0176f1bb4bb6316102f4ca4d9314a20c228098 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= -Date: Fri, 18 Dec 2015 19:24:39 +0200 -Subject: [PATCH 25/26] drm/i915: Workaround CHV pipe C cursor fail -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Upstream commit ef8dd37af85a8f37ca3a29074647511e52c56181 - -Turns out CHV pipe C was glued on somewhat poorly, and there's something -wrong with the cursor. If the cursor straddles the left screen edge, -and is then moved away from the edge or disabled, the pipe will often -underrun. If enough underruns are triggered quickly enough the pipe -will fall over and die (it just scans out a solid color and reports -a constant underrun). We need to turn the disp2d power well off and -on again to recover the pipe. - -None of that is very nice for the user, so let's just refuse to place -the cursor in the compromised position. The ddx appears to fall back -to swcursor when the ioctl returns an error, so theoretically there's -no loss of functionality for the user (discounting swcursor bugs). -I suppose most cursors images actually have the hotspot not exactly -at 0,0 so under typical conditions the fallback will in fact kick in -as soon as the cursor touches the left edge of the screen. - -Any atomic compositor should anyway be prepared to fall back to -GPU composition when things don't work out, so there should be no -problem with those. - -Other things that I tried to solve this include flipping all -display related clock gating knobs I could find, increasing the -minimum gtt alignment all the way up to 512k. I also tried to see -if there are more specific screen coordinates that hit the bug, but -the findings were somewhat inconclusive. Sometimes the failures -happen almost across the whole left edge, sometimes more at the very -top and around the bottom half. I wasn't able to find any real pattern -to these variations, so it seems our only choice is to just refuse -to straddle the left screen edge at all. - -Cc: stable@vger.kernel.org -Cc: Jason Plum -Testcase: igt/kms_chv_cursor_fail -Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92826 -Signed-off-by: Ville Syrjälä -Link: http://patchwork.freedesktop.org/patch/msgid/1450459479-16286-1-git-send-email-ville.syrjala@linux.intel.com -Signed-off-by: Daniel Vetter -(cherry picked from commit b29ec92c4f5e6d45d8bae8194e664427a01c6687) -Signed-off-by: Jani Nikula ---- - drivers/gpu/drm/i915/intel_display.c | 17 +++++++++++++++++ - 1 file changed, 17 insertions(+) - -diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c -index 35fad110cc26..c70a6cb8914f 100644 ---- a/drivers/gpu/drm/i915/intel_display.c -+++ b/drivers/gpu/drm/i915/intel_display.c -@@ -13614,6 +13614,7 @@ intel_check_cursor_plane(struct drm_plane *plane, - struct drm_crtc *crtc = crtc_state->base.crtc; - struct drm_framebuffer *fb = state->base.fb; - struct drm_i915_gem_object *obj = intel_fb_obj(fb); -+ enum pipe pipe = to_intel_plane(plane)->pipe; - unsigned stride; - int ret; - -@@ -13647,6 +13648,22 @@ intel_check_cursor_plane(struct drm_plane *plane, - return -EINVAL; - } - -+ /* -+ * There's something wrong with the cursor on CHV pipe C. -+ * If it straddles the left edge of the screen then -+ * moving it away from the edge or disabling it often -+ * results in a pipe underrun, and often that can lead to -+ * dead pipe (constant underrun reported, and it scans -+ * out just a solid color). To recover from that, the -+ * display power well must be turned off and on again. -+ * Refuse the put the cursor into that compromised position. -+ */ -+ if (IS_CHERRYVIEW(plane->dev) && pipe == PIPE_C && -+ state->visible && state->base.crtc_x < 0) { -+ DRM_DEBUG_KMS("CHV cursor C not allowed to straddle the left screen edge\n"); -+ return -EINVAL; -+ } -+ - return 0; - } - --- -2.5.0 - - -From 036933da945df1526e0b5ee17fe8a8a77c1380e7 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= -Date: Thu, 10 Dec 2015 18:22:31 +0200 -Subject: [PATCH 26/26] drm/i915: Unbreak check_digital_port_conflicts() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Upstream commit ae35b56e367b9fef7f5de701cf8c1c3dd954dded - -Atomic changes broke check_digital_port_conflicts(). It needs to look -at the global situation instead of just trying to find a conflict -within the current atomic state. - -This bug made my HSW explode spectacularly after I had split the DDI -encoders into separate DP and HDMI encoders. With the fix, things -seem much more solid. - -I hope holding the connection_mutex is enough protection that we can -actually walk the connectors even if they're not part of the current -atomic state... - -v2: Regenerate the patch so that it actually applies (Jani) - -Cc: stable@vger.kernel.org -Cc: Ander Conselvan de Oliveira -Fixes: 5448a00d3f06 ("drm/i915: Don't use staged config in check_digital_port_conflicts()") -Signed-off-by: Ville Syrjälä -Reviewed-by: Daniel Vetter -Link: http://patchwork.freedesktop.org/patch/msgid/1449764551-12466-1-git-send-email-ville.syrjala@linux.intel.com -(cherry picked from commit 0bff4858653312a10c83709e0009c3adb87e6f1e) -Signed-off-by: Jani Nikula ---- - drivers/gpu/drm/i915/intel_display.c | 12 ++++++++---- - 1 file changed, 8 insertions(+), 4 deletions(-) - -diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c -index c70a6cb8914f..aafe3e3de3ae 100644 ---- a/drivers/gpu/drm/i915/intel_display.c -+++ b/drivers/gpu/drm/i915/intel_display.c -@@ -12026,18 +12026,22 @@ static void intel_dump_pipe_config(struct intel_crtc *crtc, - static bool check_digital_port_conflicts(struct drm_atomic_state *state) - { - struct drm_device *dev = state->dev; -- struct intel_encoder *encoder; - struct drm_connector *connector; -- struct drm_connector_state *connector_state; - unsigned int used_ports = 0; -- int i; - - /* - * Walk the connector list instead of the encoder - * list to detect the problem on ddi platforms - * where there's just one encoder per digital port. - */ -- for_each_connector_in_state(state, connector, connector_state, i) { -+ drm_for_each_connector(connector, dev) { -+ struct drm_connector_state *connector_state; -+ struct intel_encoder *encoder; -+ -+ connector_state = drm_atomic_get_existing_connector_state(state, connector); -+ if (!connector_state) -+ connector_state = connector->state; -+ - if (!connector_state->best_encoder) - continue; - --- -2.5.0 - diff --git a/ideapad-laptop-Add-Lenovo-Yoga-700-to-no_hw_rfkill-d.patch b/ideapad-laptop-Add-Lenovo-Yoga-700-to-no_hw_rfkill-d.patch deleted file mode 100644 index da0c827..0000000 --- a/ideapad-laptop-Add-Lenovo-Yoga-700-to-no_hw_rfkill-d.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 90da345613c5c0910b54b72019664e0b2ada19f9 Mon Sep 17 00:00:00 2001 -From: Josh Boyer -Date: Tue, 12 Jan 2016 07:54:39 -0500 -Subject: [PATCH] ideapad-laptop: Add Lenovo Yoga 700 to no_hw_rfkill dmi list - -Like the Yoga 900 models the Lenovo Yoga 700 does not have a -hw rfkill switch, and trying to read the hw rfkill switch through the -ideapad module causes it to always reported blocking breaking wifi. - -This commit adds the Lenovo Yoga 700 to the no_hw_rfkill dmi list, fixing -the wifi breakage. - -BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1295272 -Cc: stable@vger.kernel.org -Signed-off-by: Josh Boyer ---- - drivers/platform/x86/ideapad-laptop.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c -index d28db0e793df..51178626305d 100644 ---- a/drivers/platform/x86/ideapad-laptop.c -+++ b/drivers/platform/x86/ideapad-laptop.c -@@ -900,6 +900,13 @@ static const struct dmi_system_id no_hw_rfkill_list[] = { - }, - }, - { -+ .ident = "Lenogo Yoga 700", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 700"), -+ }, -+ }, -+ { - .ident = "Lenovo Yoga 900", - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), --- -2.5.0 - diff --git a/ideapad-laptop-Add-Lenovo-Yoga-900-to-no_hw_rfkill-d.patch b/ideapad-laptop-Add-Lenovo-Yoga-900-to-no_hw_rfkill-d.patch deleted file mode 100644 index 9f6e5db..0000000 --- a/ideapad-laptop-Add-Lenovo-Yoga-900-to-no_hw_rfkill-d.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 332faabbaab64876396be48f1a1cf72b31d53a9d Mon Sep 17 00:00:00 2001 -From: Hans de Goede -Date: Mon, 9 Nov 2015 17:09:05 +0100 -Subject: [PATCH] ideapad-laptop: Add Lenovo Yoga 900 to no_hw_rfkill dmi list - -Like some of the other Yoga models the Lenovo Yoga 900 does not have a -hw rfkill switch, and trying to read the hw rfkill switch through the -ideapad module causes it to always reported blocking breaking wifi. - -This commit adds the Lenovo Yoga 900 to the no_hw_rfkill dmi list, fixing -the wifi breakage. - -BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1275490 -Cc: stable@vger.kernel.org -Reported-and-tested-by: Kevin Fenzi -Signed-off-by: Hans de Goede ---- - drivers/platform/x86/ideapad-laptop.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c -index fce49f3c6ed6..d4a48b4d161a 100644 ---- a/drivers/platform/x86/ideapad-laptop.c -+++ b/drivers/platform/x86/ideapad-laptop.c -@@ -873,6 +873,13 @@ static const struct dmi_system_id no_hw_rfkill_list[] = { - DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 3 Pro-1370"), - }, - }, -+ { -+ .ident = "Lenovo Yoga 900", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 900"), -+ }, -+ }, - {} - }; - --- -2.4.3 - diff --git a/kbuild-AFTER_LINK.patch b/kbuild-AFTER_LINK.patch index 7a18fd2..805b6ee 100644 --- a/kbuild-AFTER_LINK.patch +++ b/kbuild-AFTER_LINK.patch @@ -1,4 +1,4 @@ -From 7877d76b409181af38d307b98d8fed1024f3c9c2 Mon Sep 17 00:00:00 2001 +From a9488dbeccf188f0bd83b9d5704892f2c0f97fdc Mon Sep 17 00:00:00 2001 From: Roland McGrath Date: Mon, 6 Oct 2008 23:03:03 -0700 Subject: [PATCH] kbuild: AFTER_LINK @@ -21,10 +21,10 @@ Signed-off-by: Roland McGrath 7 files changed, 17 insertions(+), 7 deletions(-) diff --git a/arch/arm64/kernel/vdso/Makefile b/arch/arm64/kernel/vdso/Makefile -index f6fe17d88da5..eb6ddbf37f30 100644 +index b467fd0..feeff5e 100644 --- a/arch/arm64/kernel/vdso/Makefile +++ b/arch/arm64/kernel/vdso/Makefile -@@ -52,7 +52,8 @@ $(obj-vdso): %.o: %.S FORCE +@@ -55,7 +55,8 @@ $(obj-vdso): %.o: %.S FORCE # Actual build commands quiet_cmd_vdsold = VDSOL $@ @@ -35,7 +35,7 @@ index f6fe17d88da5..eb6ddbf37f30 100644 cmd_vdsoas = $(CC) $(a_flags) -c -o $@ $< diff --git a/arch/powerpc/kernel/vdso32/Makefile b/arch/powerpc/kernel/vdso32/Makefile -index 53e6c9b979ec..e427844e9bb0 100644 +index 6abffb7..7b103bb 100644 --- a/arch/powerpc/kernel/vdso32/Makefile +++ b/arch/powerpc/kernel/vdso32/Makefile @@ -43,7 +43,8 @@ $(obj-vdso32): %.o: %.S @@ -49,7 +49,7 @@ index 53e6c9b979ec..e427844e9bb0 100644 cmd_vdso32as = $(CROSS32CC) $(a_flags) -c -o $@ $< diff --git a/arch/powerpc/kernel/vdso64/Makefile b/arch/powerpc/kernel/vdso64/Makefile -index effca9404b17..713891a92d23 100644 +index 8c8f2ae..a743ebe 100644 --- a/arch/powerpc/kernel/vdso64/Makefile +++ b/arch/powerpc/kernel/vdso64/Makefile @@ -36,7 +36,8 @@ $(obj-vdso64): %.o: %.S @@ -63,7 +63,7 @@ index effca9404b17..713891a92d23 100644 cmd_vdso64as = $(CC) $(a_flags) -c -o $@ $< diff --git a/arch/s390/kernel/vdso32/Makefile b/arch/s390/kernel/vdso32/Makefile -index ee8a18e50a25..63e33fa049f8 100644 +index ee8a18e..63e33fa 100644 --- a/arch/s390/kernel/vdso32/Makefile +++ b/arch/s390/kernel/vdso32/Makefile @@ -43,7 +43,8 @@ $(obj-vdso32): %.o: %.S @@ -77,7 +77,7 @@ index ee8a18e50a25..63e33fa049f8 100644 cmd_vdso32as = $(CC) $(a_flags) -c -o $@ $< diff --git a/arch/s390/kernel/vdso64/Makefile b/arch/s390/kernel/vdso64/Makefile -index c4b03f9ed228..550450fc2f95 100644 +index c4b03f9..550450f 100644 --- a/arch/s390/kernel/vdso64/Makefile +++ b/arch/s390/kernel/vdso64/Makefile @@ -43,7 +43,8 @@ $(obj-vdso64): %.o: %.S @@ -91,10 +91,10 @@ index c4b03f9ed228..550450fc2f95 100644 cmd_vdso64as = $(CC) $(a_flags) -c -o $@ $< diff --git a/arch/x86/entry/vdso/Makefile b/arch/x86/entry/vdso/Makefile -index a3d0767a6b29..078c9be1db8f 100644 +index 265c0ed..fd90c7d 100644 --- a/arch/x86/entry/vdso/Makefile +++ b/arch/x86/entry/vdso/Makefile -@@ -172,8 +172,9 @@ $(vdso32-images:%=$(obj)/%.dbg): $(obj)/vdso32-%.so.dbg: FORCE \ +@@ -159,8 +159,9 @@ $(obj)/vdso32.so.dbg: FORCE \ quiet_cmd_vdso = VDSO $@ cmd_vdso = $(CC) -nostdlib -o $@ \ $(VDSO_LDFLAGS) $(VDSO_LDFLAGS_$(filter %.lds,$(^F))) \ @@ -107,11 +107,11 @@ index a3d0767a6b29..078c9be1db8f 100644 VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=both) \ $(call cc-ldoption, -Wl$(comma)--build-id) -Wl,-Bsymbolic $(LTO_CFLAGS) diff --git a/scripts/link-vmlinux.sh b/scripts/link-vmlinux.sh -index 1a10d8ac8162..092d0c0cf72c 100755 +index dacf71a..72cbefd 100755 --- a/scripts/link-vmlinux.sh +++ b/scripts/link-vmlinux.sh @@ -65,6 +65,10 @@ vmlinux_link() - -lutil ${1} + -lutil -lrt ${1} rm -f linux fi + if [ -n "${AFTER_LINK}" ]; then @@ -122,5 +122,5 @@ index 1a10d8ac8162..092d0c0cf72c 100755 -- -2.4.3 +2.5.0 diff --git a/kernel.spec b/kernel.spec index 9442d63..786eb2b 100644 --- a/kernel.spec +++ b/kernel.spec @@ -40,19 +40,19 @@ Summary: The Linux kernel # For non-released -rc kernels, this will be appended after the rcX and # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3" # -%global baserelease 301 +%global baserelease 300 %global fedora_build %{baserelease} # base_sublevel is the kernel version we're starting with and patching # on top of -- for example, 3.1-rc7-git1 starts with a 3.0 base, # which yields a base_sublevel of 0. -%define base_sublevel 3 +%define base_sublevel 4 ## If this is a released kernel ## %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 5 +%define stable_update 2 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -502,16 +502,10 @@ Patch453: amd-xgbe-phy-a0-Add-support-for-XGBE-PHY-on-A0.patch Patch454: arm64-avoid-needing-console-to-enable-serial-console.patch -Patch455: usb-make-xhci-platform-driver-use-64-bit-or-32-bit-D.patch - Patch456: arm64-acpi-drop-expert-patch.patch Patch457: ARM-tegra-usb-no-reset.patch -Patch458: ARM-dts-Add-am335x-bonegreen.patch - -Patch459: 0001-watchdog-omap_wdt-fix-null-pointer-dereference.patch - Patch460: mfd-wm8994-Ensure-that-the-whole-MFD-is-built-into-a.patch Patch463: arm-i.MX6-Utilite-device-dtb.patch @@ -592,26 +586,9 @@ Patch503: drm-i915-turn-off-wc-mmaps.patch Patch508: kexec-uefi-copy-secure_boot-flag-in-boot-params.patch -#rhbz 1269300 -Patch552: megaraid_sas-Do-not-use-PAGE_SIZE-for-max_sectors.patch - -#rhbz 1275490 -Patch553: ideapad-laptop-Add-Lenovo-Yoga-900-to-no_hw_rfkill-d.patch - -#rhbz 1279189 -Patch556: netfilter-ipset-Fix-extension-alignment.patch -Patch557: netfilter-ipset-Fix-hash-type-expiration.patch -Patch558: netfilter-ipset-Fix-hash-type-expire-release-empty-h.patch - -#rhbz 1284059 -Patch566: KEYS-Fix-handling-of-stored-error-in-a-negatively-in.patch - #CVE-2015-7833 rhbz 1270158 1270160 Patch567: usbvision-fix-crash-on-detecting-device-with-invalid.patch -#CVE-2015-7515 rhbz 1285326 1285331 -Patch568: Input-aiptek-fix-crash-on-detecting-device-without-e.patch - #rhbz 1287819 Patch570: HID-multitouch-enable-palm-rejection-if-device-imple.patch @@ -621,69 +598,18 @@ Patch571: ideapad-laptop-Add-Lenovo-ideapad-Y700-17ISK-to-no_h.patch #rhbz 1288687 Patch572: alua_fix.patch -#CVE-XXXX-XXXX rhbz 1291329 1291332 -Patch574: ovl-fix-permission-checking-for-setattr.patch - #CVE-2015-8709 rhbz 1295287 1295288 Patch603: ptrace-being-capable-wrt-a-process-requires-mapped-u.patch -#atch604: drm-i915-shut-up-gen8-SDE-irq-dmesg-noise-again.patch - -#CVE-2015-7513 rhbz 1284847 1296142 -Patch605: KVM-x86-Reload-pit-counters-for-all-channels-when-re.patch - -#rhbz 1296677 -Patch606: HID-multitouch-Fetch-feature-reports-on-demand-for-W.patch -Patch641: HID-multitouch-fix-input-mode-switching-on-some-Elan.patch - -#rhbz 1281368 -Patch607: drm-nouveau-Fix-pre-nv50-pageflip-events-v4.patch - -#rhbz 1296820 -Patch608: drm-nouveau-pmu-do-not-assume-a-PMU-is-present.patch +Patch604: drm-i915-shut-up-gen8-SDE-irq-dmesg-noise-again.patch #rhbz 1083853 Patch610: PNP-Add-Broadwell-to-Intel-MCH-size-workaround.patch -#CVE-2015-7566 rhbz 1296466 1297517 -Patch623: usb-serial-visor-fix-crash-on-detecting-device-witho.patch - -#rhbz 1298309 -#atch624: drm-i915-Do-a-better-job-at-disabling-primary-plane-.patch - -#rhbz 1298996 -Patch625: block-ensure-to-split-after-potentially-bouncing-a-b.patch - -#rhbz 1298192 -Patch626: selinux-fix-bug-in-conditional-rules-handling.patch - -#rhbz 1295272 -Patch627: ideapad-laptop-Add-Lenovo-Yoga-700-to-no_hw_rfkill-d.patch - -Patch628: i915-stable-backports.patch -Patch635: nouveau-stable-backports.patch - -#rhbz 1299810 -Patch629: SCSI-refactor-device-matching-code-in-scsi_devinfo.c.patch -Patch630: SCSI-fix-bug-in-scsi_dev_info_list-matching.patch - -Patch631: btrfs-handle-invalid-num_stripes-in-sys_array.patch -Patch632: Btrfs-fix-fitrim-discarding-device-area-reserved-for.patch - -#CVE-2016-0723 rhbz 1296253 1300224 -Patch637: tty-Fix-unsafe-ldisc-reference-via-ioctl-TIOCGETD.patch - -#rhbz 1279653 -Patch638: rtlwifi-rtl8821ae-Fix-5G-failure-when-EEPROM-is-inco.patch - -#CVE-XXXX-XXXX rhbz 1300731 1300732 -Patch639: netfilter-nf_nat_redirect-add-missing-NULL-pointer-c.patch - #rhbz 1300955 Patch640: PNP-Add-Haswell-ULT-to-Intel-MCH-size-workaround.patch #rhbz 1278942 -Patch642: media-Revert-media-ivtv-avoid-going-past-input-audio.patch Patch643: media-ivtv-avoid-going-past-input-audio-array.patch #rhbz 1302037 @@ -693,24 +619,15 @@ Patch645: cfg80211-wext-fix-message-ordering.patch #rhbz 1255325 Patch646: HID-sony-do-not-bail-out-when-the-sixaxis-refuses-th.patch -#rhbz 1303270 -Patch647: rtlwifi-fix-memory-leak-for-USB-device.patch - #CVE-2016-0617 rhbz 1305803 1305804 Patch648: fs-hugetlbfs-inode.c-fix-bugs-in-hugetlb_vmtruncate_.patch -#CVE-2016-2384 rhbz 1308444 1308445 -Patch649: ALSA-usb-audio-avoid-freeing-umidi-object-twice.patch - #CVE-2016-2383 rhbz 1308452 1308453 Patch650: bpf-fix-branch-offset-adjustment-on-backjumps-after-.patch #rhbz 1306987 Patch651: Input-elantech-mark-protocols-v2-and-v3-as-semi-mt.patch -#rhbz 1305181 1299901 -Patch652: drm-mgag200-fix-kernel-hang-in-cursor-code.patch - #CVE-2015-8812 rhbz 1303532 1309548 Patch653: iw_cxgb3-Fix-incorrectly-returning-error-on-success.patch @@ -2157,6 +2074,9 @@ fi # # %changelog +* Thu Feb 18 2016 Laura Abbott - 4.4.2-300 +- Linux v4.4.2 + * Thu Feb 18 2016 Josh Boyer - CVE-2015-8812 cxgb3 use after free (rhbz 1303532 1309548) diff --git a/media-Revert-media-ivtv-avoid-going-past-input-audio.patch b/media-Revert-media-ivtv-avoid-going-past-input-audio.patch deleted file mode 100644 index 7c00071..0000000 --- a/media-Revert-media-ivtv-avoid-going-past-input-audio.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 823873481b2a17ce5900899f8ef85118f8407b67 Mon Sep 17 00:00:00 2001 -From: Mauro Carvalho Chehab -Date: Wed, 11 Nov 2015 09:22:36 -0200 -Subject: [PATCH] [media] Revert "[media] ivtv: avoid going past input/audio - array" - -This patch broke ivtv logic, as reported at - https://bugzilla.redhat.com/show_bug.cgi?id=1278942 - -This reverts commit 09290cc885937cab3b2d60a6d48fe3d2d3e04061. - -Cc: stable@vger.kernel.org # for v4.1 and upper -Signed-off-by: Mauro Carvalho Chehab ---- - drivers/media/pci/ivtv/ivtv-driver.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/media/pci/ivtv/ivtv-driver.c b/drivers/media/pci/ivtv/ivtv-driver.c -index 8616fa8193bc..c2e60b4f292d 100644 ---- a/drivers/media/pci/ivtv/ivtv-driver.c -+++ b/drivers/media/pci/ivtv/ivtv-driver.c -@@ -805,11 +805,11 @@ static void ivtv_init_struct2(struct ivtv *itv) - { - int i; - -- for (i = 0; i < IVTV_CARD_MAX_VIDEO_INPUTS - 1; i++) -+ for (i = 0; i < IVTV_CARD_MAX_VIDEO_INPUTS; i++) - if (itv->card->video_inputs[i].video_type == 0) - break; - itv->nof_inputs = i; -- for (i = 0; i < IVTV_CARD_MAX_AUDIO_INPUTS - 1; i++) -+ for (i = 0; i < IVTV_CARD_MAX_AUDIO_INPUTS; i++) - if (itv->card->audio_inputs[i].audio_type == 0) - break; - itv->nof_audio_inputs = i; --- -2.5.0 - diff --git a/megaraid_sas-Do-not-use-PAGE_SIZE-for-max_sectors.patch b/megaraid_sas-Do-not-use-PAGE_SIZE-for-max_sectors.patch deleted file mode 100644 index 769337d..0000000 --- a/megaraid_sas-Do-not-use-PAGE_SIZE-for-max_sectors.patch +++ /dev/null @@ -1,50 +0,0 @@ -From c6f081c88ab76d5a40365b94c1f5839e099b2b2b Mon Sep 17 00:00:00 2001 -From: "sumit.saxena@avagotech.com" -Date: Thu, 15 Oct 2015 13:40:04 +0530 -Subject: [PATCH] megaraid_sas: Do not use PAGE_SIZE for max_sectors - -Do not use PAGE_SIZE marco to calculate max_sectors per I/O -request. Driver code assumes PAGE_SIZE will be always 4096 which can -lead to wrongly calculated value if PAGE_SIZE is not 4096. This issue -was reported in Ubuntu Bugzilla Bug #1475166. - -Cc: -Signed-off-by: Sumit Saxena -Signed-off-by: Kashyap Desai -Reviewed-by: Tomas Henzl -Reviewed-by: Martin K. Petersen -Signed-off-by: Martin K. Petersen ---- - drivers/scsi/megaraid/megaraid_sas.h | 2 ++ - drivers/scsi/megaraid/megaraid_sas_base.c | 2 +- - 2 files changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h -index 20c37541963f..ebf821b94cb6 100644 ---- a/drivers/scsi/megaraid/megaraid_sas.h -+++ b/drivers/scsi/megaraid/megaraid_sas.h -@@ -364,6 +364,8 @@ enum MR_EVT_ARGS { - MR_EVT_ARGS_GENERIC, - }; - -+ -+#define SGE_BUFFER_SIZE 4096 - /* - * define constants for device list query options - */ -diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c -index eaa81e552fd2..a9eb10ebc6ed 100644 ---- a/drivers/scsi/megaraid/megaraid_sas_base.c -+++ b/drivers/scsi/megaraid/megaraid_sas_base.c -@@ -4752,7 +4752,7 @@ static int megasas_init_fw(struct megasas_instance *instance) - - - instance->max_sectors_per_req = instance->max_num_sge * -- PAGE_SIZE / 512; -+ SGE_BUFFER_SIZE / 512; - if (tmp_sectors && (instance->max_sectors_per_req > tmp_sectors)) - instance->max_sectors_per_req = tmp_sectors; - --- -2.4.3 - diff --git a/netfilter-ipset-Fix-extension-alignment.patch b/netfilter-ipset-Fix-extension-alignment.patch deleted file mode 100644 index 0a955e2..0000000 --- a/netfilter-ipset-Fix-extension-alignment.patch +++ /dev/null @@ -1,481 +0,0 @@ -From 55301931f78c0fdbb8f76dfdb3f914e9eef1f273 Mon Sep 17 00:00:00 2001 -From: Jozsef Kadlecsik -Date: Sat, 7 Nov 2015 11:21:47 +0100 -Subject: [PATCH 1/3] netfilter: ipset: Fix extension alignment - -The data extensions in ipset lacked the proper memory alignment and -thus could lead to kernel crash on several architectures. Therefore -the structures have been reorganized and alignment attributes added -where needed. The patch was tested on armv7h by Gerhard Wiesinger and -on x86_64, sparc64 by Jozsef Kadlecsik. - -Reported-by: Gerhard Wiesinger -Tested-by: Gerhard Wiesinger -Tested-by: Jozsef Kadlecsik -Signed-off-by: Jozsef Kadlecsik ---- - include/linux/netfilter/ipset/ip_set.h | 2 +- - net/netfilter/ipset/ip_set_bitmap_gen.h | 17 +++----- - net/netfilter/ipset/ip_set_bitmap_ip.c | 14 ++----- - net/netfilter/ipset/ip_set_bitmap_ipmac.c | 64 ++++++++++++++----------------- - net/netfilter/ipset/ip_set_bitmap_port.c | 18 ++++----- - net/netfilter/ipset/ip_set_core.c | 14 ++++--- - net/netfilter/ipset/ip_set_hash_gen.h | 11 ++++-- - net/netfilter/ipset/ip_set_list_set.c | 5 ++- - 8 files changed, 65 insertions(+), 80 deletions(-) - -diff --git a/include/linux/netfilter/ipset/ip_set.h b/include/linux/netfilter/ipset/ip_set.h -index 48bb01edcf30..0e1f433cc4b7 100644 ---- a/include/linux/netfilter/ipset/ip_set.h -+++ b/include/linux/netfilter/ipset/ip_set.h -@@ -421,7 +421,7 @@ extern void ip_set_free(void *members); - extern int ip_set_get_ipaddr4(struct nlattr *nla, __be32 *ipaddr); - extern int ip_set_get_ipaddr6(struct nlattr *nla, union nf_inet_addr *ipaddr); - extern size_t ip_set_elem_len(struct ip_set *set, struct nlattr *tb[], -- size_t len); -+ size_t len, size_t align); - extern int ip_set_get_extensions(struct ip_set *set, struct nlattr *tb[], - struct ip_set_ext *ext); - -diff --git a/net/netfilter/ipset/ip_set_bitmap_gen.h b/net/netfilter/ipset/ip_set_bitmap_gen.h -index d05e759ed0fa..b0bc475f641e 100644 ---- a/net/netfilter/ipset/ip_set_bitmap_gen.h -+++ b/net/netfilter/ipset/ip_set_bitmap_gen.h -@@ -33,7 +33,7 @@ - #define mtype_gc IPSET_TOKEN(MTYPE, _gc) - #define mtype MTYPE - --#define get_ext(set, map, id) ((map)->extensions + (set)->dsize * (id)) -+#define get_ext(set, map, id) ((map)->extensions + ((set)->dsize * (id))) - - static void - mtype_gc_init(struct ip_set *set, void (*gc)(unsigned long ul_set)) -@@ -67,12 +67,9 @@ mtype_destroy(struct ip_set *set) - del_timer_sync(&map->gc); - - ip_set_free(map->members); -- if (set->dsize) { -- if (set->extensions & IPSET_EXT_DESTROY) -- mtype_ext_cleanup(set); -- ip_set_free(map->extensions); -- } -- kfree(map); -+ if (set->dsize && set->extensions & IPSET_EXT_DESTROY) -+ mtype_ext_cleanup(set); -+ ip_set_free(map); - - set->data = NULL; - } -@@ -92,16 +89,14 @@ mtype_head(struct ip_set *set, struct sk_buff *skb) - { - const struct mtype *map = set->data; - struct nlattr *nested; -+ size_t memsize = sizeof(*map) + map->memsize; - - nested = ipset_nest_start(skb, IPSET_ATTR_DATA); - if (!nested) - goto nla_put_failure; - if (mtype_do_head(skb, map) || - nla_put_net32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1)) || -- nla_put_net32(skb, IPSET_ATTR_MEMSIZE, -- htonl(sizeof(*map) + -- map->memsize + -- set->dsize * map->elements))) -+ nla_put_net32(skb, IPSET_ATTR_MEMSIZE, htonl(memsize))) - goto nla_put_failure; - if (unlikely(ip_set_put_flags(skb, set))) - goto nla_put_failure; -diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c b/net/netfilter/ipset/ip_set_bitmap_ip.c -index 64a564334418..4783efff0bde 100644 ---- a/net/netfilter/ipset/ip_set_bitmap_ip.c -+++ b/net/netfilter/ipset/ip_set_bitmap_ip.c -@@ -41,7 +41,6 @@ MODULE_ALIAS("ip_set_bitmap:ip"); - /* Type structure */ - struct bitmap_ip { - void *members; /* the set members */ -- void *extensions; /* data extensions */ - u32 first_ip; /* host byte order, included in range */ - u32 last_ip; /* host byte order, included in range */ - u32 elements; /* number of max elements in the set */ -@@ -49,6 +48,8 @@ struct bitmap_ip { - size_t memsize; /* members size */ - u8 netmask; /* subnet netmask */ - struct timer_list gc; /* garbage collection */ -+ unsigned char extensions[0] /* data extensions */ -+ __aligned(__alignof__(u64)); - }; - - /* ADT structure for generic function args */ -@@ -224,13 +225,6 @@ init_map_ip(struct ip_set *set, struct bitmap_ip *map, - map->members = ip_set_alloc(map->memsize); - if (!map->members) - return false; -- if (set->dsize) { -- map->extensions = ip_set_alloc(set->dsize * elements); -- if (!map->extensions) { -- kfree(map->members); -- return false; -- } -- } - map->first_ip = first_ip; - map->last_ip = last_ip; - map->elements = elements; -@@ -316,13 +310,13 @@ bitmap_ip_create(struct net *net, struct ip_set *set, struct nlattr *tb[], - pr_debug("hosts %u, elements %llu\n", - hosts, (unsigned long long)elements); - -- map = kzalloc(sizeof(*map), GFP_KERNEL); -+ set->dsize = ip_set_elem_len(set, tb, 0, 0); -+ map = ip_set_alloc(sizeof(*map) + elements * set->dsize); - if (!map) - return -ENOMEM; - - map->memsize = bitmap_bytes(0, elements - 1); - set->variant = &bitmap_ip; -- set->dsize = ip_set_elem_len(set, tb, 0); - if (!init_map_ip(set, map, first_ip, last_ip, - elements, hosts, netmask)) { - kfree(map); -diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c -index 1430535118fb..29dde208381d 100644 ---- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c -+++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c -@@ -47,24 +47,26 @@ enum { - /* Type structure */ - struct bitmap_ipmac { - void *members; /* the set members */ -- void *extensions; /* MAC + data extensions */ - u32 first_ip; /* host byte order, included in range */ - u32 last_ip; /* host byte order, included in range */ - u32 elements; /* number of max elements in the set */ - size_t memsize; /* members size */ - struct timer_list gc; /* garbage collector */ -+ unsigned char extensions[0] /* MAC + data extensions */ -+ __aligned(__alignof__(u64)); - }; - - /* ADT structure for generic function args */ - struct bitmap_ipmac_adt_elem { -+ unsigned char ether[ETH_ALEN] __aligned(2); - u16 id; -- unsigned char *ether; -+ u16 add_mac; - }; - - struct bitmap_ipmac_elem { - unsigned char ether[ETH_ALEN]; - unsigned char filled; --} __attribute__ ((aligned)); -+} __aligned(__alignof__(u64)); - - static inline u32 - ip_to_id(const struct bitmap_ipmac *m, u32 ip) -@@ -72,11 +74,11 @@ ip_to_id(const struct bitmap_ipmac *m, u32 ip) - return ip - m->first_ip; - } - --static inline struct bitmap_ipmac_elem * --get_elem(void *extensions, u16 id, size_t dsize) --{ -- return (struct bitmap_ipmac_elem *)(extensions + id * dsize); --} -+#define get_elem(extensions, id, dsize) \ -+ (struct bitmap_ipmac_elem *)(extensions + (id) * (dsize)) -+ -+#define get_const_elem(extensions, id, dsize) \ -+ (const struct bitmap_ipmac_elem *)(extensions + (id) * (dsize)) - - /* Common functions */ - -@@ -88,10 +90,9 @@ bitmap_ipmac_do_test(const struct bitmap_ipmac_adt_elem *e, - - if (!test_bit(e->id, map->members)) - return 0; -- elem = get_elem(map->extensions, e->id, dsize); -- if (elem->filled == MAC_FILLED) -- return !e->ether || -- ether_addr_equal(e->ether, elem->ether); -+ elem = get_const_elem(map->extensions, e->id, dsize); -+ if (e->add_mac && elem->filled == MAC_FILLED) -+ return ether_addr_equal(e->ether, elem->ether); - /* Trigger kernel to fill out the ethernet address */ - return -EAGAIN; - } -@@ -103,7 +104,7 @@ bitmap_ipmac_gc_test(u16 id, const struct bitmap_ipmac *map, size_t dsize) - - if (!test_bit(id, map->members)) - return 0; -- elem = get_elem(map->extensions, id, dsize); -+ elem = get_const_elem(map->extensions, id, dsize); - /* Timer not started for the incomplete elements */ - return elem->filled == MAC_FILLED; - } -@@ -133,7 +134,7 @@ bitmap_ipmac_add_timeout(unsigned long *timeout, - * and we can reuse it later when MAC is filled out, - * possibly by the kernel - */ -- if (e->ether) -+ if (e->add_mac) - ip_set_timeout_set(timeout, t); - else - *timeout = t; -@@ -150,7 +151,7 @@ bitmap_ipmac_do_add(const struct bitmap_ipmac_adt_elem *e, - elem = get_elem(map->extensions, e->id, dsize); - if (test_bit(e->id, map->members)) { - if (elem->filled == MAC_FILLED) { -- if (e->ether && -+ if (e->add_mac && - (flags & IPSET_FLAG_EXIST) && - !ether_addr_equal(e->ether, elem->ether)) { - /* memcpy isn't atomic */ -@@ -159,7 +160,7 @@ bitmap_ipmac_do_add(const struct bitmap_ipmac_adt_elem *e, - ether_addr_copy(elem->ether, e->ether); - } - return IPSET_ADD_FAILED; -- } else if (!e->ether) -+ } else if (!e->add_mac) - /* Already added without ethernet address */ - return IPSET_ADD_FAILED; - /* Fill the MAC address and trigger the timer activation */ -@@ -168,7 +169,7 @@ bitmap_ipmac_do_add(const struct bitmap_ipmac_adt_elem *e, - ether_addr_copy(elem->ether, e->ether); - elem->filled = MAC_FILLED; - return IPSET_ADD_START_STORED_TIMEOUT; -- } else if (e->ether) { -+ } else if (e->add_mac) { - /* We can store MAC too */ - ether_addr_copy(elem->ether, e->ether); - elem->filled = MAC_FILLED; -@@ -191,7 +192,7 @@ bitmap_ipmac_do_list(struct sk_buff *skb, const struct bitmap_ipmac *map, - u32 id, size_t dsize) - { - const struct bitmap_ipmac_elem *elem = -- get_elem(map->extensions, id, dsize); -+ get_const_elem(map->extensions, id, dsize); - - return nla_put_ipaddr4(skb, IPSET_ATTR_IP, - htonl(map->first_ip + id)) || -@@ -213,7 +214,7 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb, - { - struct bitmap_ipmac *map = set->data; - ipset_adtfn adtfn = set->variant->adt[adt]; -- struct bitmap_ipmac_adt_elem e = { .id = 0 }; -+ struct bitmap_ipmac_adt_elem e = { .id = 0, .add_mac = 1 }; - struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set); - u32 ip; - -@@ -231,7 +232,7 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb, - return -EINVAL; - - e.id = ip_to_id(map, ip); -- e.ether = eth_hdr(skb)->h_source; -+ memcpy(e.ether, eth_hdr(skb)->h_source, ETH_ALEN); - - return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags); - } -@@ -265,11 +266,10 @@ bitmap_ipmac_uadt(struct ip_set *set, struct nlattr *tb[], - return -IPSET_ERR_BITMAP_RANGE; - - e.id = ip_to_id(map, ip); -- if (tb[IPSET_ATTR_ETHER]) -- e.ether = nla_data(tb[IPSET_ATTR_ETHER]); -- else -- e.ether = NULL; -- -+ if (tb[IPSET_ATTR_ETHER]) { -+ memcpy(e.ether, nla_data(tb[IPSET_ATTR_ETHER]), ETH_ALEN); -+ e.add_mac = 1; -+ } - ret = adtfn(set, &e, &ext, &ext, flags); - - return ip_set_eexist(ret, flags) ? 0 : ret; -@@ -300,13 +300,6 @@ init_map_ipmac(struct ip_set *set, struct bitmap_ipmac *map, - map->members = ip_set_alloc(map->memsize); - if (!map->members) - return false; -- if (set->dsize) { -- map->extensions = ip_set_alloc(set->dsize * elements); -- if (!map->extensions) { -- kfree(map->members); -- return false; -- } -- } - map->first_ip = first_ip; - map->last_ip = last_ip; - map->elements = elements; -@@ -361,14 +354,15 @@ bitmap_ipmac_create(struct net *net, struct ip_set *set, struct nlattr *tb[], - if (elements > IPSET_BITMAP_MAX_RANGE + 1) - return -IPSET_ERR_BITMAP_RANGE_SIZE; - -- map = kzalloc(sizeof(*map), GFP_KERNEL); -+ set->dsize = ip_set_elem_len(set, tb, -+ sizeof(struct bitmap_ipmac_elem), -+ __alignof__(struct bitmap_ipmac_elem)); -+ map = ip_set_alloc(sizeof(*map) + elements * set->dsize); - if (!map) - return -ENOMEM; - - map->memsize = bitmap_bytes(0, elements - 1); - set->variant = &bitmap_ipmac; -- set->dsize = ip_set_elem_len(set, tb, -- sizeof(struct bitmap_ipmac_elem)); - if (!init_map_ipmac(set, map, first_ip, last_ip, elements)) { - kfree(map); - return -ENOMEM; -diff --git a/net/netfilter/ipset/ip_set_bitmap_port.c b/net/netfilter/ipset/ip_set_bitmap_port.c -index 5338ccd5da46..7f0c733358a4 100644 ---- a/net/netfilter/ipset/ip_set_bitmap_port.c -+++ b/net/netfilter/ipset/ip_set_bitmap_port.c -@@ -35,12 +35,13 @@ MODULE_ALIAS("ip_set_bitmap:port"); - /* Type structure */ - struct bitmap_port { - void *members; /* the set members */ -- void *extensions; /* data extensions */ - u16 first_port; /* host byte order, included in range */ - u16 last_port; /* host byte order, included in range */ - u32 elements; /* number of max elements in the set */ - size_t memsize; /* members size */ - struct timer_list gc; /* garbage collection */ -+ unsigned char extensions[0] /* data extensions */ -+ __aligned(__alignof__(u64)); - }; - - /* ADT structure for generic function args */ -@@ -209,13 +210,6 @@ init_map_port(struct ip_set *set, struct bitmap_port *map, - map->members = ip_set_alloc(map->memsize); - if (!map->members) - return false; -- if (set->dsize) { -- map->extensions = ip_set_alloc(set->dsize * map->elements); -- if (!map->extensions) { -- kfree(map->members); -- return false; -- } -- } - map->first_port = first_port; - map->last_port = last_port; - set->timeout = IPSET_NO_TIMEOUT; -@@ -232,6 +226,7 @@ bitmap_port_create(struct net *net, struct ip_set *set, struct nlattr *tb[], - { - struct bitmap_port *map; - u16 first_port, last_port; -+ u32 elements; - - if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_PORT) || - !ip_set_attr_netorder(tb, IPSET_ATTR_PORT_TO) || -@@ -248,14 +243,15 @@ bitmap_port_create(struct net *net, struct ip_set *set, struct nlattr *tb[], - last_port = tmp; - } - -- map = kzalloc(sizeof(*map), GFP_KERNEL); -+ elements = last_port - first_port + 1; -+ set->dsize = ip_set_elem_len(set, tb, 0, 0); -+ map = ip_set_alloc(sizeof(*map) + elements * set->dsize); - if (!map) - return -ENOMEM; - -- map->elements = last_port - first_port + 1; -+ map->elements = elements; - map->memsize = bitmap_bytes(0, map->elements); - set->variant = &bitmap_port; -- set->dsize = ip_set_elem_len(set, tb, 0); - if (!init_map_port(set, map, first_port, last_port)) { - kfree(map); - return -ENOMEM; -diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c -index 338b4047776f..cab4bc06cddd 100644 ---- a/net/netfilter/ipset/ip_set_core.c -+++ b/net/netfilter/ipset/ip_set_core.c -@@ -364,25 +364,27 @@ add_extension(enum ip_set_ext_id id, u32 flags, struct nlattr *tb[]) - } - - size_t --ip_set_elem_len(struct ip_set *set, struct nlattr *tb[], size_t len) -+ip_set_elem_len(struct ip_set *set, struct nlattr *tb[], size_t len, -+ size_t align) - { - enum ip_set_ext_id id; -- size_t offset = len; - u32 cadt_flags = 0; - - if (tb[IPSET_ATTR_CADT_FLAGS]) - cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]); - if (cadt_flags & IPSET_FLAG_WITH_FORCEADD) - set->flags |= IPSET_CREATE_FLAG_FORCEADD; -+ if (!align) -+ align = 1; - for (id = 0; id < IPSET_EXT_ID_MAX; id++) { - if (!add_extension(id, cadt_flags, tb)) - continue; -- offset = ALIGN(offset, ip_set_extensions[id].align); -- set->offset[id] = offset; -+ len = ALIGN(len, ip_set_extensions[id].align); -+ set->offset[id] = len; - set->extensions |= ip_set_extensions[id].type; -- offset += ip_set_extensions[id].len; -+ len += ip_set_extensions[id].len; - } -- return offset; -+ return ALIGN(len, align); - } - EXPORT_SYMBOL_GPL(ip_set_elem_len); - -diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h -index 691b54fcaf2a..4ff22194ce55 100644 ---- a/net/netfilter/ipset/ip_set_hash_gen.h -+++ b/net/netfilter/ipset/ip_set_hash_gen.h -@@ -72,8 +72,9 @@ struct hbucket { - DECLARE_BITMAP(used, AHASH_MAX_TUNED); - u8 size; /* size of the array */ - u8 pos; /* position of the first free entry */ -- unsigned char value[0]; /* the array of the values */ --} __attribute__ ((aligned)); -+ unsigned char value[0] /* the array of the values */ -+ __aligned(__alignof__(u64)); -+}; - - /* The hash table: the table size stored here in order to make resizing easy */ - struct htable { -@@ -1323,12 +1324,14 @@ IPSET_TOKEN(HTYPE, _create)(struct net *net, struct ip_set *set, - #endif - set->variant = &IPSET_TOKEN(HTYPE, 4_variant); - set->dsize = ip_set_elem_len(set, tb, -- sizeof(struct IPSET_TOKEN(HTYPE, 4_elem))); -+ sizeof(struct IPSET_TOKEN(HTYPE, 4_elem)), -+ __alignof__(struct IPSET_TOKEN(HTYPE, 4_elem))); - #ifndef IP_SET_PROTO_UNDEF - } else { - set->variant = &IPSET_TOKEN(HTYPE, 6_variant); - set->dsize = ip_set_elem_len(set, tb, -- sizeof(struct IPSET_TOKEN(HTYPE, 6_elem))); -+ sizeof(struct IPSET_TOKEN(HTYPE, 6_elem)), -+ __alignof__(struct IPSET_TOKEN(HTYPE, 6_elem))); - } - #endif - if (tb[IPSET_ATTR_TIMEOUT]) { -diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c -index 5a30ce6e8c90..bbede95c9f68 100644 ---- a/net/netfilter/ipset/ip_set_list_set.c -+++ b/net/netfilter/ipset/ip_set_list_set.c -@@ -31,7 +31,7 @@ struct set_elem { - struct rcu_head rcu; - struct list_head list; - ip_set_id_t id; --}; -+} __aligned(__alignof__(u64)); - - struct set_adt_elem { - ip_set_id_t id; -@@ -618,7 +618,8 @@ list_set_create(struct net *net, struct ip_set *set, struct nlattr *tb[], - size = IP_SET_LIST_MIN_SIZE; - - set->variant = &set_variant; -- set->dsize = ip_set_elem_len(set, tb, sizeof(struct set_elem)); -+ set->dsize = ip_set_elem_len(set, tb, sizeof(struct set_elem), -+ __alignof__(struct set_elem)); - if (!init_list_set(net, set, size)) - return -ENOMEM; - if (tb[IPSET_ATTR_TIMEOUT]) { --- -2.4.3 - diff --git a/netfilter-ipset-Fix-hash-type-expiration.patch b/netfilter-ipset-Fix-hash-type-expiration.patch deleted file mode 100644 index 16ba438..0000000 --- a/netfilter-ipset-Fix-hash-type-expiration.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 7210b25e452780f0792e04dd9f84f3a02c582ab7 Mon Sep 17 00:00:00 2001 -From: Jozsef Kadlecsik -Date: Sat, 7 Nov 2015 11:23:34 +0100 -Subject: [PATCH 2/3] netfilter: ipset: Fix hash:* type expiration - -Incorrect index was used when the data blob was shrinked at expiration, -which could lead to falsely expired entries and memory leak when -the comment extension was used too. - -Signed-off-by: Jozsef Kadlecsik ---- - net/netfilter/ipset/ip_set_hash_gen.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h -index 4ff22194ce55..fa4f6374bb73 100644 ---- a/net/netfilter/ipset/ip_set_hash_gen.h -+++ b/net/netfilter/ipset/ip_set_hash_gen.h -@@ -523,7 +523,7 @@ mtype_expire(struct ip_set *set, struct htype *h, u8 nets_length, size_t dsize) - continue; - data = ahash_data(n, j, dsize); - memcpy(tmp->value + d * dsize, data, dsize); -- set_bit(j, tmp->used); -+ set_bit(d, tmp->used); - d++; - } - tmp->pos = d; --- -2.4.3 - diff --git a/netfilter-ipset-Fix-hash-type-expire-release-empty-h.patch b/netfilter-ipset-Fix-hash-type-expire-release-empty-h.patch deleted file mode 100644 index 1f0d863..0000000 --- a/netfilter-ipset-Fix-hash-type-expire-release-empty-h.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 03fdcf282c8fe212efae0d1229fb8594ffe60b17 Mon Sep 17 00:00:00 2001 -From: Jozsef Kadlecsik -Date: Sat, 7 Nov 2015 11:24:51 +0100 -Subject: [PATCH 3/3] netfilter: ipset: Fix hash type expire: release empty - hash bucket block - -When all entries are expired/all slots are empty, release the bucket. - -Signed-off-by: Jozsef Kadlecsik ---- - net/netfilter/ipset/ip_set_hash_gen.h | 13 +++++++++---- - 1 file changed, 9 insertions(+), 4 deletions(-) - -diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h -index fa4f6374bb73..e5336ab36d67 100644 ---- a/net/netfilter/ipset/ip_set_hash_gen.h -+++ b/net/netfilter/ipset/ip_set_hash_gen.h -@@ -476,7 +476,7 @@ static void - mtype_expire(struct ip_set *set, struct htype *h, u8 nets_length, size_t dsize) - { - struct htable *t; -- struct hbucket *n; -+ struct hbucket *n, *tmp; - struct mtype_elem *data; - u32 i, j, d; - #ifdef IP_SET_HASH_WITH_NETS -@@ -511,9 +511,14 @@ mtype_expire(struct ip_set *set, struct htype *h, u8 nets_length, size_t dsize) - } - } - if (d >= AHASH_INIT_SIZE) { -- struct hbucket *tmp = kzalloc(sizeof(*tmp) + -- (n->size - AHASH_INIT_SIZE) * dsize, -- GFP_ATOMIC); -+ if (d >= n->size) { -+ rcu_assign_pointer(hbucket(t, i), NULL); -+ kfree_rcu(n, rcu); -+ continue; -+ } -+ tmp = kzalloc(sizeof(*tmp) + -+ (n->size - AHASH_INIT_SIZE) * dsize, -+ GFP_ATOMIC); - if (!tmp) - /* Still try to delete expired elements */ - continue; --- -2.4.3 - diff --git a/netfilter-nf_nat_redirect-add-missing-NULL-pointer-c.patch b/netfilter-nf_nat_redirect-add-missing-NULL-pointer-c.patch deleted file mode 100644 index 3b20319..0000000 --- a/netfilter-nf_nat_redirect-add-missing-NULL-pointer-c.patch +++ /dev/null @@ -1,83 +0,0 @@ -From f9688b8f6755c3c2eb5c7e2e22ab168d0cb97644 Mon Sep 17 00:00:00 2001 -From: Munehisa Kamata -Date: Mon, 26 Oct 2015 19:10:52 -0700 -Subject: [PATCH] netfilter: nf_nat_redirect: add missing NULL pointer check - -Upstream commit 94f9cd81436c85d8c3a318ba92e236ede73752fc - -Commit 8b13eddfdf04cbfa561725cfc42d6868fe896f56 ("netfilter: refactor NAT -redirect IPv4 to use it from nf_tables") has introduced a trivial logic -change which can result in the following crash. - -BUG: unable to handle kernel NULL pointer dereference at 0000000000000030 -IP: [] nf_nat_redirect_ipv4+0x2d/0xa0 [nf_nat_redirect] -PGD 3ba662067 PUD 3ba661067 PMD 0 -Oops: 0000 [#1] SMP -Modules linked in: ipv6(E) xt_REDIRECT(E) nf_nat_redirect(E) xt_tcpudp(E) iptable_nat(E) nf_conntrack_ipv4(E) nf_defrag_ipv4(E) nf_nat_ipv4(E) nf_nat(E) nf_conntrack(E) ip_tables(E) x_tables(E) binfmt_misc(E) xfs(E) libcrc32c(E) evbug(E) evdev(E) psmouse(E) i2c_piix4(E) i2c_core(E) acpi_cpufreq(E) button(E) ext4(E) crc16(E) jbd2(E) mbcache(E) dm_mirror(E) dm_region_hash(E) dm_log(E) dm_mod(E) -CPU: 0 PID: 2536 Comm: ip Tainted: G E 4.1.7-15.23.amzn1.x86_64 #1 -Hardware name: Xen HVM domU, BIOS 4.2.amazon 05/06/2015 -task: ffff8800eb438000 ti: ffff8803ba664000 task.ti: ffff8803ba664000 -[...] -Call Trace: - - [] redirect_tg4+0x15/0x20 [xt_REDIRECT] - [] ipt_do_table+0x2b9/0x5e1 [ip_tables] - [] iptable_nat_do_chain+0x25/0x30 [iptable_nat] - [] nf_nat_ipv4_fn+0x13d/0x1f0 [nf_nat_ipv4] - [] ? iptable_nat_ipv4_fn+0x20/0x20 [iptable_nat] - [] nf_nat_ipv4_in+0x2e/0x90 [nf_nat_ipv4] - [] iptable_nat_ipv4_in+0x15/0x20 [iptable_nat] - [] nf_iterate+0x57/0x80 - [] nf_hook_slow+0x97/0x100 - [] ip_rcv+0x314/0x400 - -unsigned int -nf_nat_redirect_ipv4(struct sk_buff *skb, -... -{ -... - rcu_read_lock(); - indev = __in_dev_get_rcu(skb->dev); - if (indev != NULL) { - ifa = indev->ifa_list; - newdst = ifa->ifa_local; <--- - } - rcu_read_unlock(); -... -} - -Before the commit, 'ifa' had been always checked before access. After the -commit, however, it could be accessed even if it's NULL. Interestingly, -this was once fixed in 2003. - -http://marc.info/?l=netfilter-devel&m=106668497403047&w=2 - -In addition to the original one, we have seen the crash when packets that -need to be redirected somehow arrive on an interface which hasn't been -yet fully configured. - -This change just reverts the logic to the old behavior to avoid the crash. - -Fixes: 8b13eddfdf04 ("netfilter: refactor NAT redirect IPv4 to use it from nf_tables") -Signed-off-by: Munehisa Kamata -Signed-off-by: Pablo Neira Ayuso ---- - net/netfilter/nf_nat_redirect.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/net/netfilter/nf_nat_redirect.c b/net/netfilter/nf_nat_redirect.c -index 97b75f9bfbcd..d43869879fcf 100644 ---- a/net/netfilter/nf_nat_redirect.c -+++ b/net/netfilter/nf_nat_redirect.c -@@ -55,7 +55,7 @@ nf_nat_redirect_ipv4(struct sk_buff *skb, - - rcu_read_lock(); - indev = __in_dev_get_rcu(skb->dev); -- if (indev != NULL) { -+ if (indev && indev->ifa_list) { - ifa = indev->ifa_list; - newdst = ifa->ifa_local; - } --- -2.5.0 - diff --git a/nouveau-stable-backports.patch b/nouveau-stable-backports.patch deleted file mode 100644 index bd6d210..0000000 --- a/nouveau-stable-backports.patch +++ /dev/null @@ -1,105 +0,0 @@ -From fe9c94340928d8ec3ea1ae74f99c3c9b18684129 Mon Sep 17 00:00:00 2001 -From: Martin Peres -Date: Sun, 29 Nov 2015 16:10:18 +0200 -Subject: [PATCH 1/3] drm/nouveau/bios/fan: hardcode the fan mode to linear -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -This is an oversight that made use of the trip-point-based fan managenent on -cards that never expose those. This led the fan to stay at fan_min. - -Fortunately, the emergency code would kick when the temperature would reach -90°C. - -Reported-by: Tom Englund -Tested-by: Tom Englund -Signed-off-by: Martin Peres -Tested-by: Daemon32 -Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92126 -Signed-off-by: Ben Skeggs -Cc: stable@vger.kernel.org ---- - drivers/gpu/drm/nouveau/nvkm/subdev/bios/fan.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/fan.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/fan.c -index 43006db6fd58..80fed7e78dcb 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/fan.c -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/fan.c -@@ -83,6 +83,7 @@ nvbios_fan_parse(struct nvkm_bios *bios, struct nvbios_therm_fan *fan) - fan->type = NVBIOS_THERM_FAN_UNK; - } - -+ fan->fan_mode = NVBIOS_THERM_FAN_LINEAR; - fan->min_duty = nvbios_rd08(bios, data + 0x02); - fan->max_duty = nvbios_rd08(bios, data + 0x03); - --- -2.5.0 - - -From acdc10375119fc5dd76d7051a5ae4a41f61c45aa Mon Sep 17 00:00:00 2001 -From: Ben Skeggs -Date: Mon, 4 Jan 2016 09:01:13 +1000 -Subject: [PATCH 2/3] drm/nouveau/gr/nv40: fix oops in interrupt handler - -fdo#93557 - -Signed-off-by: Ben Skeggs -Cc: stable@vger.kernel.org ---- - drivers/gpu/drm/nouveau/nvkm/engine/gr/nv40.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv40.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv40.c -index ffa902ece872..05a895496fc6 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv40.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv40.c -@@ -156,6 +156,7 @@ nv40_gr_chan_new(struct nvkm_gr *base, struct nvkm_fifo_chan *fifoch, - return -ENOMEM; - nvkm_object_ctor(&nv40_gr_chan, oclass, &chan->object); - chan->gr = gr; -+ chan->fifo = fifoch; - *pobject = &chan->object; - - spin_lock_irqsave(&chan->gr->base.engine.lock, flags); --- -2.5.0 - - -From c5d07dcb6d6260a51a2309d5f62c3391637afa86 Mon Sep 17 00:00:00 2001 -From: Ben Skeggs -Date: Fri, 8 Jan 2016 08:56:51 +1000 -Subject: [PATCH 3/3] drm/nouveau/kms: take mode_config mutex in connector - hotplug path - -fdo#93634 - -Signed-off-by: Ben Skeggs -Cc: stable@vger.kernel.org ---- - drivers/gpu/drm/nouveau/nouveau_connector.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c -index 2e7cbe933533..2a5ed7460354 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_connector.c -+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c -@@ -969,10 +969,13 @@ nouveau_connector_hotplug(struct nvif_notify *notify) - - NV_DEBUG(drm, "%splugged %s\n", plugged ? "" : "un", name); - -+ mutex_lock(&drm->dev->mode_config.mutex); - if (plugged) - drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON); - else - drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF); -+ mutex_unlock(&drm->dev->mode_config.mutex); -+ - drm_helper_hpd_irq_event(connector->dev); - } - --- -2.5.0 - diff --git a/rtlwifi-fix-memory-leak-for-USB-device.patch b/rtlwifi-fix-memory-leak-for-USB-device.patch deleted file mode 100644 index 8c06c86..0000000 --- a/rtlwifi-fix-memory-leak-for-USB-device.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 17bc55864f81dd730d05f09b1641312a7990d636 Mon Sep 17 00:00:00 2001 -From: Peter Wu -Date: Mon, 7 Dec 2015 01:07:31 +0100 -Subject: [PATCH] rtlwifi: fix memory leak for USB device - -Free skb for received frames with a wrong checksum. This can happen -pretty rapidly, exhausting all memory. - -This fixes a memleak (detected with kmemleak). Originally found while -using monitor mode, but it also appears during managed mode (once the -link is up). - -Cc: stable@vger.kernel.org -Signed-off-by: Peter Wu -ACKed-by: Larry Finger -Signed-off-by: Kalle Valo ---- - drivers/net/wireless/rtlwifi/usb.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c -index 2721cf8..aac1ed3 100644 ---- a/drivers/net/wireless/rtlwifi/usb.c -+++ b/drivers/net/wireless/rtlwifi/usb.c -@@ -531,6 +531,8 @@ static void _rtl_usb_rx_process_noagg(struct ieee80211_hw *hw, - ieee80211_rx(hw, skb); - else - dev_kfree_skb_any(skb); -+ } else { -+ dev_kfree_skb_any(skb); - } - } - --- -2.5.0 - diff --git a/rtlwifi-rtl8821ae-Fix-5G-failure-when-EEPROM-is-inco.patch b/rtlwifi-rtl8821ae-Fix-5G-failure-when-EEPROM-is-inco.patch deleted file mode 100644 index b3ab35e..0000000 --- a/rtlwifi-rtl8821ae-Fix-5G-failure-when-EEPROM-is-inco.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 1bd0c273bcf537adadedd7cc69408b99afd1534c Mon Sep 17 00:00:00 2001 -From: Larry Finger -Date: Wed, 20 Jan 2016 21:26:18 -0600 -Subject: [PATCH] rtlwifi: rtl8821ae: Fix 5G failure when EEPROM is incorrectly - encoded - -Recently, it has been reported that D-Link DWA-582 cards, which use an -RTL8812AE chip are not able to scan for 5G networks. The problems started -with kernel 4.2, which is the first version that had commit d10101a60372 -("rtlwifi: rtl8821ae: Fix problem with regulatory information"). With this -patch, the driver went from setting a default channel plan to using -the value derived from EEPROM. - -Bug reports at https://bugzilla.kernel.org/show_bug.cgi?id=111031 and -https://bugzilla.redhat.com/show_bug.cgi?id=1279653 are examples of this -problem. - -The problem was solved once I learned that the internal country code was -resulting in a regulatory set with only 2.4 GHz channels. With the RTL8821AE -chips available to me, the country code was such that both 2.4 and 5 GHz -channels are allowed. The fix is to allow both bands even when the EEPROM -is incorrectly encoded. - -Fixes: d10101a60372 ("rtlwifi: rtl8821ae: Fix problem with regulatory information") -Signed-off-by: Larry Finger -Cc: littlesmartguy@gmail.com -Cc: gabe@codehaus.org -Cc: Stable [v4.2+] ---- - drivers/net/wireless/rtlwifi/regd.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/rtlwifi/regd.c b/drivers/net/wireless/rtlwifi/regd.c -index a62bf0a65c32..5be34118e0af 100644 ---- a/drivers/net/wireless/rtlwifi/regd.c -+++ b/drivers/net/wireless/rtlwifi/regd.c -@@ -351,7 +351,6 @@ static const struct ieee80211_regdomain *_rtl_regdomain_select( - case COUNTRY_CODE_SPAIN: - case COUNTRY_CODE_FRANCE: - case COUNTRY_CODE_ISRAEL: -- case COUNTRY_CODE_WORLD_WIDE_13: - return &rtl_regdom_12_13; - case COUNTRY_CODE_MKK: - case COUNTRY_CODE_MKK1: -@@ -360,6 +359,7 @@ static const struct ieee80211_regdomain *_rtl_regdomain_select( - return &rtl_regdom_14_60_64; - case COUNTRY_CODE_GLOBAL_DOMAIN: - return &rtl_regdom_14; -+ case COUNTRY_CODE_WORLD_WIDE_13: - case COUNTRY_CODE_WORLD_WIDE_13_5G_ALL: - return &rtl_regdom_12_13_5g_all; - default: --- -2.5.0 - diff --git a/scsi-sd_revalidate_disk-prevent-NULL-ptr-deref.patch b/scsi-sd_revalidate_disk-prevent-NULL-ptr-deref.patch index a51cb9b..7b99765 100644 --- a/scsi-sd_revalidate_disk-prevent-NULL-ptr-deref.patch +++ b/scsi-sd_revalidate_disk-prevent-NULL-ptr-deref.patch @@ -1,3 +1,4 @@ +From 7afe9a8d7dca86a8f35250f21f5f0a62ea2fedf7 Mon Sep 17 00:00:00 2001 From: "kernel-team@fedoraproject.org" Date: Fri, 10 Feb 2012 14:56:13 -0500 Subject: [PATCH] scsi: sd_revalidate_disk prevent NULL ptr deref @@ -9,18 +10,19 @@ Upstream-status: Fedora mustard (might be worth dropping...) 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c -index 3b2fcb4fada0..f0f9e8574303 100644 +index 3d22fc3..07aec76 100644 --- a/drivers/scsi/sd.c +++ b/drivers/scsi/sd.c -@@ -2717,13 +2717,18 @@ static int sd_try_extended_inquiry(struct scsi_device *sdp) +@@ -2825,7 +2825,7 @@ static inline u32 logical_to_sectors(struct scsi_device *sdev, u32 blocks) static int sd_revalidate_disk(struct gendisk *disk) { struct scsi_disk *sdkp = scsi_disk(disk); - struct scsi_device *sdp = sdkp->device; + struct scsi_device *sdp; + struct request_queue *q = sdkp->disk->queue; unsigned char *buffer; - unsigned int max_xfer; - + unsigned int dev_max, rw_max; +@@ -2833,6 +2833,11 @@ static int sd_revalidate_disk(struct gendisk *disk) SCSI_LOG_HLQUEUE(3, sd_printk(KERN_INFO, sdkp, "sd_revalidate_disk\n")); @@ -32,3 +34,6 @@ index 3b2fcb4fada0..f0f9e8574303 100644 /* * If the device is offline, don't try and read capacity or any * of the other niceties. +-- +2.5.0 + diff --git a/selinux-fix-bug-in-conditional-rules-handling.patch b/selinux-fix-bug-in-conditional-rules-handling.patch deleted file mode 100644 index 6a78f5b..0000000 --- a/selinux-fix-bug-in-conditional-rules-handling.patch +++ /dev/null @@ -1,51 +0,0 @@ -From f3bef67992e8698897b584616535803887c4a73e Mon Sep 17 00:00:00 2001 -From: Stephen Smalley -Date: Mon, 23 Nov 2015 16:07:41 -0500 -Subject: [PATCH] selinux: fix bug in conditional rules handling - -commit fa1aa143ac4a ("selinux: extended permissions for ioctls") -introduced a bug into the handling of conditional rules, skipping the -processing entirely when the caller does not provide an extended -permissions (xperms) structure. Access checks from userspace using -/sys/fs/selinux/access do not include such a structure since that -interface does not presently expose extended permission information. -As a result, conditional rules were being ignored entirely on userspace -access requests, producing denials when access was allowed by -conditional rules in the policy. Fix the bug by only skipping -computation of extended permissions in this situation, not the entire -conditional rules processing. - -Reported-by: Laurent Bigonville -Signed-off-by: Stephen Smalley -[PM: fixed long lines in patch description] -Cc: stable@vger.kernel.org # 4.3 -Signed-off-by: Paul Moore ---- - security/selinux/ss/conditional.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c -index 18643bf9894d..456e1a9bcfde 100644 ---- a/security/selinux/ss/conditional.c -+++ b/security/selinux/ss/conditional.c -@@ -638,7 +638,7 @@ void cond_compute_av(struct avtab *ctab, struct avtab_key *key, - { - struct avtab_node *node; - -- if (!ctab || !key || !avd || !xperms) -+ if (!ctab || !key || !avd) - return; - - for (node = avtab_search_node(ctab, key); node; -@@ -657,7 +657,7 @@ void cond_compute_av(struct avtab *ctab, struct avtab_key *key, - if ((u16)(AVTAB_AUDITALLOW|AVTAB_ENABLED) == - (node->key.specified & (AVTAB_AUDITALLOW|AVTAB_ENABLED))) - avd->auditallow |= node->datum.u.data; -- if ((node->key.specified & AVTAB_ENABLED) && -+ if (xperms && (node->key.specified & AVTAB_ENABLED) && - (node->key.specified & AVTAB_XPERMS)) - services_compute_xperms_drivers(xperms, node); - } --- -2.5.0 - diff --git a/tty-Fix-unsafe-ldisc-reference-via-ioctl-TIOCGETD.patch b/tty-Fix-unsafe-ldisc-reference-via-ioctl-TIOCGETD.patch deleted file mode 100644 index d169105..0000000 --- a/tty-Fix-unsafe-ldisc-reference-via-ioctl-TIOCGETD.patch +++ /dev/null @@ -1,68 +0,0 @@ -From 938f50fc744cb49892bd42c8f56bdfa63e82a27d Mon Sep 17 00:00:00 2001 -From: Peter Hurley -Date: Sun, 10 Jan 2016 22:40:55 -0800 -Subject: [PATCH] tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) - -ioctl(TIOCGETD) retrieves the line discipline id directly from the -ldisc because the line discipline id (c_line) in termios is untrustworthy; -userspace may have set termios via ioctl(TCSETS*) without actually -changing the line discipline via ioctl(TIOCSETD). - -However, directly accessing the current ldisc via tty->ldisc is -unsafe; the ldisc ptr dereferenced may be stale if the line discipline -is changing via ioctl(TIOCSETD) or hangup. - -Wait for the line discipline reference (just like read() or write()) -to retrieve the "current" line discipline id. - -Cc: -Signed-off-by: Peter Hurley ---- - drivers/tty/tty_io.c | 24 +++++++++++++++++++++++- - 1 file changed, 23 insertions(+), 1 deletion(-) - -diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c -index f435977de740..bd4027e36910 100644 ---- a/drivers/tty/tty_io.c -+++ b/drivers/tty/tty_io.c -@@ -2654,6 +2654,28 @@ static int tiocsetd(struct tty_struct *tty, int __user *p) - } - - /** -+ * tiocgetd - get line discipline -+ * @tty: tty device -+ * @p: pointer to user data -+ * -+ * Retrieves the line discipline id directly from the ldisc. -+ * -+ * Locking: waits for ldisc reference (in case the line discipline -+ * is changing or the tty is being hungup) -+ */ -+ -+static int tiocgetd(struct tty_struct *tty, int __user *p) -+{ -+ struct tty_ldisc *ld; -+ int ret; -+ -+ ld = tty_ldisc_ref_wait(tty); -+ ret = put_user(ld->ops->num, p); -+ tty_ldisc_deref(ld); -+ return ret; -+} -+ -+/** - * send_break - performed time break - * @tty: device to break on - * @duration: timeout in mS -@@ -2879,7 +2901,7 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - case TIOCGSID: - return tiocgsid(tty, real_tty, p); - case TIOCGETD: -- return put_user(tty->ldisc->ops->num, (int __user *)p); -+ return tiocgetd(tty, p); - case TIOCSETD: - return tiocsetd(tty, p); - case TIOCVHANGUP: --- -2.5.0 - diff --git a/usb-make-xhci-platform-driver-use-64-bit-or-32-bit-D.patch b/usb-make-xhci-platform-driver-use-64-bit-or-32-bit-D.patch deleted file mode 100644 index 79f58f7..0000000 --- a/usb-make-xhci-platform-driver-use-64-bit-or-32-bit-D.patch +++ /dev/null @@ -1,40 +0,0 @@ -From: Mark Langsdorf -Date: Wed, 25 Mar 2015 14:12:51 -0400 -Subject: [PATCH] usb: make xhci platform driver use 64 bit or 32 bit DMA - -The xhci platform driver needs to work on systems that either only -support 64-bit DMA or only support 32-bit DMA. Attempt to set a -coherent dma mask for 64-bit DMA, and attempt again with 32-bit -DMA if that fails. - -Signed-off-by: Mark Langsdorf ---- - drivers/usb/host/xhci-plat.c | 15 +++++++-------- - 1 file changed, 7 insertions(+), 8 deletions(-) - -diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c -index 890ad9d9d329..122b1fb12b7e 100644 ---- a/drivers/usb/host/xhci-plat.c -+++ b/drivers/usb/host/xhci-plat.c -@@ -93,14 +93,13 @@ static int xhci_plat_probe(struct platform_device *pdev) - if (irq < 0) - return -ENODEV; - -- /* Initialize dma_mask and coherent_dma_mask to 32-bits */ -- ret = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32)); -- if (ret) -- return ret; -- if (!pdev->dev.dma_mask) -- pdev->dev.dma_mask = &pdev->dev.coherent_dma_mask; -- else -- dma_set_mask(&pdev->dev, DMA_BIT_MASK(32)); -+ /* Try setting the coherent_dma_mask to 64 bits, then try 32 bits */ -+ ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)); -+ if (ret) { -+ ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)); -+ if (ret) -+ return ret; -+ } - - hcd = usb_create_hcd(driver, &pdev->dev, dev_name(&pdev->dev)); - if (!hcd) diff --git a/usb-serial-visor-fix-crash-on-detecting-device-witho.patch b/usb-serial-visor-fix-crash-on-detecting-device-witho.patch deleted file mode 100644 index ddd4fc5..0000000 --- a/usb-serial-visor-fix-crash-on-detecting-device-witho.patch +++ /dev/null @@ -1,36 +0,0 @@ -From b2476fe4c16be5c2b7ee950e50677cfaa9ab9bae Mon Sep 17 00:00:00 2001 -From: Vladis Dronov -Date: Tue, 12 Jan 2016 14:10:50 -0500 -Subject: [PATCH] usb: serial: visor: fix crash on detecting device without - write_urbs - -The visor driver crashes in clie_5_attach() when a specially crafted USB -device without bulk-out endpoint is detected. This fix adds a check that -the device has proper configuration expected by the driver. - -Reported-by: Ralf Spenneberg -Signed-off-by: Vladis Dronov ---- - drivers/usb/serial/visor.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c -index 60afb39eb73c..bbc90c059002 100644 ---- a/drivers/usb/serial/visor.c -+++ b/drivers/usb/serial/visor.c -@@ -597,8 +597,10 @@ static int clie_5_attach(struct usb_serial *serial) - */ - - /* some sanity check */ -- if (serial->num_ports < 2) -- return -1; -+ if (serial->num_bulk_out < 2) { -+ dev_err(&serial->interface->dev, "missing bulk out endpoints\n"); -+ return -ENODEV; -+ } - - /* port 0 now uses the modified endpoint Address */ - port = serial->port[0]; --- -2.5.0 - diff --git a/watchdog-Disable-watchdog-on-virtual-machines.patch b/watchdog-Disable-watchdog-on-virtual-machines.patch index 01cbba9..11bce5b 100644 --- a/watchdog-Disable-watchdog-on-virtual-machines.patch +++ b/watchdog-Disable-watchdog-on-virtual-machines.patch @@ -1,3 +1,4 @@ +From f1293c68aff98cd913a59b151aac938ec4ce4857 Mon Sep 17 00:00:00 2001 From: Dave Jones Date: Tue, 24 Jun 2014 08:43:34 -0400 Subject: [PATCH] watchdog: Disable watchdog on virtual machines. @@ -20,7 +21,7 @@ Signed-off-by: Dave Jones 1 file changed, 29 insertions(+) diff --git a/kernel/watchdog.c b/kernel/watchdog.c -index a6ffa43f2993..b378b762844a 100644 +index 18f34cf..6aadffe 100644 --- a/kernel/watchdog.c +++ b/kernel/watchdog.c @@ -20,6 +20,7 @@ @@ -31,8 +32,8 @@ index a6ffa43f2993..b378b762844a 100644 #include #include -@@ -155,6 +156,32 @@ static int __init softlockup_all_cpu_backtrace_setup(char *str) - __setup("softlockup_all_cpu_backtrace=", softlockup_all_cpu_backtrace_setup); +@@ -185,6 +186,32 @@ static int __init hardlockup_all_cpu_backtrace_setup(char *str) + __setup("hardlockup_all_cpu_backtrace=", hardlockup_all_cpu_backtrace_setup); #endif +static int disable_watchdog(const struct dmi_system_id *d) @@ -64,7 +65,7 @@ index a6ffa43f2993..b378b762844a 100644 /* * Hard-lockup warnings should be triggered after just a few seconds. Soft- * lockups can have false positives under extreme conditions. So we generally -@@ -928,6 +955,8 @@ int proc_watchdog_cpumask(struct ctl_table *table, int write, +@@ -1030,6 +1057,8 @@ out: void __init lockup_detector_init(void) { @@ -73,3 +74,6 @@ index a6ffa43f2993..b378b762844a 100644 set_sample_period(); #ifdef CONFIG_NO_HZ_FULL +-- +2.5.0 +