diff options
24 files changed, 3453 insertions, 373 deletions
diff --git a/Btrfs-fix-fitrim-discarding-device-area-reserved-for.patch b/Btrfs-fix-fitrim-discarding-device-area-reserved-for.patch new file mode 100644 index 000000000..63f66fb1b --- /dev/null +++ b/Btrfs-fix-fitrim-discarding-device-area-reserved-for.patch @@ -0,0 +1,119 @@ +From 259072b7a1c20f8612dcaa8e0e027004aa98f864 Mon Sep 17 00:00:00 2001 +From: Filipe Manana <fdmanana@suse.com> +Date: Wed, 6 Jan 2016 22:42:35 +0000 +Subject: [PATCH 2/2] Btrfs: fix fitrim discarding device area reserved for + boot loader's use + +As of the 4.3 kernel release, the fitrim ioctl can now discard any region +of a disk that is not allocated to any chunk/block group, including the +first megabyte which is used for our primary superblock and by the boot +loader (grub for example). + +Fix this by not allowing to trim/discard any region in the device starting +with an offset not greater than min(alloc_start_mount_option, 1Mb), just +as it was not possible before 4.3. + +A reproducer test case for xfstests follows. + + seq=`basename $0` + seqres=$RESULT_DIR/$seq + echo "QA output created by $seq" + tmp=/tmp/$$ + status=1 # failure is the default! + trap "_cleanup; exit \$status" 0 1 2 3 15 + + _cleanup() + { + cd / + rm -f $tmp.* + } + + # get standard environment, filters and checks + . ./common/rc + . ./common/filter + + # real QA test starts here + _need_to_be_root + _supported_fs btrfs + _supported_os Linux + _require_scratch + + rm -f $seqres.full + + _scratch_mkfs >>$seqres.full 2>&1 + + # Write to the [0, 64Kb[ and [68Kb, 1Mb[ ranges of the device. These ranges are + # reserved for a boot loader to use (GRUB for example) and btrfs should never + # use them - neither for allocating metadata/data nor should trim/discard them. + # The range [64Kb, 68Kb[ is used for the primary superblock of the filesystem. + $XFS_IO_PROG -c "pwrite -S 0xfd 0 64K" $SCRATCH_DEV | _filter_xfs_io + $XFS_IO_PROG -c "pwrite -S 0xfd 68K 956K" $SCRATCH_DEV | _filter_xfs_io + + # Now mount the filesystem and perform a fitrim against it. + _scratch_mount + _require_batched_discard $SCRATCH_MNT + $FSTRIM_PROG $SCRATCH_MNT + + # Now unmount the filesystem and verify the content of the ranges was not + # modified (no trim/discard happened on them). + _scratch_unmount + echo "Content of the ranges [0, 64Kb] and [68Kb, 1Mb[ after fitrim:" + od -t x1 -N $((64 * 1024)) $SCRATCH_DEV + od -t x1 -j $((68 * 1024)) -N $((956 * 1024)) $SCRATCH_DEV + + status=0 + exit + +Reported-by: Vincent Petry <PVince81@yahoo.fr> +Reported-by: Andrei Borzenkov <arvidjaar@gmail.com> +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=109341 +Fixes: 499f377f49f0 (btrfs: iterate over unused chunk space in FITRIM) +Cc: stable@vger.kernel.org # 4.3+ +Signed-off-by: Filipe Manana <fdmanana@suse.com> +--- + fs/btrfs/volumes.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index b816b3a2e118..96f8c827d563 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -1208,6 +1208,15 @@ int find_free_dev_extent_start(struct btrfs_transaction *transaction, + int ret; + int slot; + struct extent_buffer *l; ++ u64 min_search_start; ++ ++ /* ++ * We don't want to overwrite the superblock on the drive nor any area ++ * used by the boot loader (grub for example), so we make sure to start ++ * at an offset of at least 1MB. ++ */ ++ min_search_start = max(root->fs_info->alloc_start, 1024ull * 1024); ++ search_start = max(search_start, min_search_start); + + path = btrfs_alloc_path(); + if (!path) +@@ -1348,18 +1357,9 @@ int find_free_dev_extent(struct btrfs_trans_handle *trans, + struct btrfs_device *device, u64 num_bytes, + u64 *start, u64 *len) + { +- struct btrfs_root *root = device->dev_root; +- u64 search_start; +- + /* FIXME use last free of some kind */ +- +- /* +- * we don't want to overwrite the superblock on the drive, +- * so we make sure to start at an offset of at least 1MB +- */ +- search_start = max(root->fs_info->alloc_start, 1024ull * 1024); + return find_free_dev_extent_start(trans->transaction, device, +- num_bytes, search_start, start, len); ++ num_bytes, 0, start, len); + } + + static int btrfs_free_dev_extent(struct btrfs_trans_handle *trans, +-- +2.5.0 + diff --git a/KEYS-Fix-race-between-read-and-revoke.patch b/KEYS-Fix-race-between-read-and-revoke.patch deleted file mode 100644 index df0d9376b..000000000 --- a/KEYS-Fix-race-between-read-and-revoke.patch +++ /dev/null @@ -1,108 +0,0 @@ -From f144220f72062ed5359e0211f130670c915a12dd Mon Sep 17 00:00:00 2001 -From: David Howells <dhowells@redhat.com> -Date: Mon, 14 Dec 2015 10:36:31 -0500 -Subject: [PATCH] KEYS: Fix race between read and revoke - -There's a race between keyctl_read() and keyctl_revoke(). If the revoke -happens between keyctl_read() checking the validity of a key and the key's -semaphore being taken, then the key type read method will see a revoked key. - -This causes a problem for the user-defined key type because it assumes in -its read method that there will always be a payload in a non-revoked key -and doesn't check for a NULL pointer. - -Fix this by making keyctl_read() check the validity of a key after taking -semaphore instead of before. - -This was discovered by a multithreaded test program generated by syzkaller -(http://github.com/google/syzkaller). Here's a cleaned up version: - - #include <sys/types.h> - #include <keyutils.h> - #include <pthread.h> - void *thr0(void *arg) - { - key_serial_t key = (unsigned long)arg; - keyctl_revoke(key); - return 0; - } - void *thr1(void *arg) - { - key_serial_t key = (unsigned long)arg; - char buffer[16]; - keyctl_read(key, buffer, 16); - return 0; - } - int main() - { - key_serial_t key = add_key("user", "%", "foo", 3, KEY_SPEC_USER_KEYRING); - pthread_t th[5]; - pthread_create(&th[0], 0, thr0, (void *)(unsigned long)key); - pthread_create(&th[1], 0, thr1, (void *)(unsigned long)key); - pthread_create(&th[2], 0, thr0, (void *)(unsigned long)key); - pthread_create(&th[3], 0, thr1, (void *)(unsigned long)key); - pthread_join(th[0], 0); - pthread_join(th[1], 0); - pthread_join(th[2], 0); - pthread_join(th[3], 0); - return 0; - } - -Build as: - - cc -o keyctl-race keyctl-race.c -lkeyutils -lpthread - -Run as: - - while keyctl-race; do :; done - -as it may need several iterations to crash the kernel. The crash can be -summarised as: - - BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 - IP: [<ffffffff81279b08>] user_read+0x56/0xa3 - ... - Call Trace: - [<ffffffff81276aa9>] keyctl_read_key+0xb6/0xd7 - [<ffffffff81277815>] SyS_keyctl+0x83/0xe0 - [<ffffffff815dbb97>] entry_SYSCALL_64_fastpath+0x12/0x6f - -Reported-by: Dmitry Vyukov <dvyukov@google.com> -Signed-off-by: David Howells <dhowells@redhat.com> ---- - security/keys/keyctl.c | 18 +++++++++--------- - 1 file changed, 9 insertions(+), 9 deletions(-) - -diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c -index fb111eafcb89..1c3872aeed14 100644 ---- a/security/keys/keyctl.c -+++ b/security/keys/keyctl.c -@@ -751,16 +751,16 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen) - - /* the key is probably readable - now try to read it */ - can_read_key: -- ret = key_validate(key); -- if (ret == 0) { -- ret = -EOPNOTSUPP; -- if (key->type->read) { -- /* read the data with the semaphore held (since we -- * might sleep) */ -- down_read(&key->sem); -+ ret = -EOPNOTSUPP; -+ if (key->type->read) { -+ /* Read the data with the semaphore held (since we might sleep) -+ * to protect against the key being updated or revoked. -+ */ -+ down_read(&key->sem); -+ ret = key_validate(key); -+ if (ret == 0) - ret = key->type->read(key, buffer, buflen); -- up_read(&key->sem); -- } -+ up_read(&key->sem); - } - - error2: --- -2.5.0 - diff --git a/PNP-Add-Broadwell-to-Intel-MCH-size-workaround.patch b/PNP-Add-Broadwell-to-Intel-MCH-size-workaround.patch new file mode 100644 index 000000000..3a877105d --- /dev/null +++ b/PNP-Add-Broadwell-to-Intel-MCH-size-workaround.patch @@ -0,0 +1,101 @@ +From 61feb31b0dfecfd7949e672a54ac7256f4dd2c3d Mon Sep 17 00:00:00 2001 +From: Christophe Le Roy <christophe.fish@gmail.com> +Date: Fri, 11 Dec 2015 09:13:42 +0100 +Subject: [PATCH] PNP: Add Broadwell to Intel MCH size workaround + +Add device ID 0x1604 for Broadwell to commit cb171f7abb9a ("PNP: +Work around BIOS defects in Intel MCH area reporting"). + +>From a Lenovo ThinkPad T550: + + system 00:01: [io 0x1800-0x189f] could not be reserved + system 00:01: [io 0x0800-0x087f] has been reserved + system 00:01: [io 0x0880-0x08ff] has been reserved + system 00:01: [io 0x0900-0x097f] has been reserved + system 00:01: [io 0x0980-0x09ff] has been reserved + system 00:01: [io 0x0a00-0x0a7f] has been reserved + system 00:01: [io 0x0a80-0x0aff] has been reserved + system 00:01: [io 0x0b00-0x0b7f] has been reserved + system 00:01: [io 0x0b80-0x0bff] has been reserved + system 00:01: [io 0x15e0-0x15ef] has been reserved + system 00:01: [io 0x1600-0x167f] has been reserved + system 00:01: [io 0x1640-0x165f] has been reserved + system 00:01: [mem 0xf8000000-0xfbffffff] could not be reserved + system 00:01: [mem 0xfed1c000-0xfed1ffff] has been reserved + system 00:01: [mem 0xfed10000-0xfed13fff] has been reserved + system 00:01: [mem 0xfed18000-0xfed18fff] has been reserved + system 00:01: [mem 0xfed19000-0xfed19fff] has been reserved + system 00:01: [mem 0xfed45000-0xfed4bfff] has been reserved + system 00:01: Plug and Play ACPI device, IDs PNP0c02 (active) + [...] + resource sanity check: requesting [mem 0xfed10000-0xfed15fff], which spans more than pnp 00:01 [mem 0xfed10000-0xfed13fff] + ------------[ cut here ]------------ + WARNING: CPU: 2 PID: 1 at /build/linux-CrHvZ_/linux-4.2.6/arch/x86/mm/ioremap.c:198 __ioremap_caller+0x2ee/0x360() + Info: mapping multiple BARs. Your kernel is fine. + Modules linked in: + CPU: 2 PID: 1 Comm: swapper/0 Not tainted 4.2.0-1-amd64 #1 Debian 4.2.6-1 + Hardware name: LENOVO 20CKCTO1WW/20CKCTO1WW, BIOS N11ET34W (1.10 ) 08/20/2015 + 0000000000000000 ffffffff817e6868 ffffffff8154e2f6 ffff8802241efbf8 + ffffffff8106e5b1 ffffc90000e98000 0000000000006000 ffffc90000e98000 + 0000000000006000 0000000000000000 ffffffff8106e62a ffffffff817e68c8 + Call Trace: + [<ffffffff8154e2f6>] ? dump_stack+0x40/0x50 + [<ffffffff8106e5b1>] ? warn_slowpath_common+0x81/0xb0 + [<ffffffff8106e62a>] ? warn_slowpath_fmt+0x4a/0x50 + [<ffffffff810742a3>] ? iomem_map_sanity_check+0xb3/0xc0 + [<ffffffff8105dade>] ? __ioremap_caller+0x2ee/0x360 + [<ffffffff81036ae6>] ? snb_uncore_imc_init_box+0x66/0x90 + [<ffffffff810351a8>] ? uncore_pci_probe+0xc8/0x1a0 + [<ffffffff81302d7f>] ? local_pci_probe+0x3f/0xa0 + [<ffffffff81303ea4>] ? pci_device_probe+0xc4/0x110 + [<ffffffff813d9b1e>] ? driver_probe_device+0x1ee/0x450 + [<ffffffff813d9dfb>] ? __driver_attach+0x7b/0x80 + [<ffffffff813d9d80>] ? driver_probe_device+0x450/0x450 + [<ffffffff813d796a>] ? bus_for_each_dev+0x5a/0x90 + [<ffffffff813d9091>] ? bus_add_driver+0x1f1/0x290 + [<ffffffff81b37fa8>] ? uncore_cpu_setup+0xc/0xc + [<ffffffff813da73f>] ? driver_register+0x5f/0xe0 + [<ffffffff81b38074>] ? intel_uncore_init+0xcc/0x2b0 + [<ffffffff81b37fa8>] ? uncore_cpu_setup+0xc/0xc + [<ffffffff8100213e>] ? do_one_initcall+0xce/0x200 + [<ffffffff8108a100>] ? parse_args+0x140/0x4e0 + [<ffffffff81b2b0cb>] ? kernel_init_freeable+0x162/0x1e8 + [<ffffffff815443f0>] ? rest_init+0x80/0x80 + [<ffffffff815443fe>] ? kernel_init+0xe/0xf0 + [<ffffffff81553e5f>] ? ret_from_fork+0x3f/0x70 + [<ffffffff815443f0>] ? rest_init+0x80/0x80 + ---[ end trace 472e7959536abf12 ]--- + + 00:00.0 Host bridge: Intel Corporation Broadwell-U Host Bridge -OPI (rev 09) + Subsystem: Lenovo Device 2223 + Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- + Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort+ >SERR- <PERR- INTx- + Latency: 0 + Capabilities: [e0] Vendor Specific Information: Len=0c <?> + Kernel driver in use: bdw_uncore + 00: 86 80 04 16 06 00 90 20 09 00 00 06 00 00 00 00 + 10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 20: 00 00 00 00 00 00 00 00 00 00 00 00 aa 17 23 22 + 30: 00 00 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 + +Signed-off-by: Christophe Le Roy <christophe.fish@gmail.com> +Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> +--- + drivers/pnp/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pnp/quirks.c b/drivers/pnp/quirks.c +index 943c1cb9566c..f700723ca5d6 100644 +--- a/drivers/pnp/quirks.c ++++ b/drivers/pnp/quirks.c +@@ -343,6 +343,7 @@ static void quirk_amd_mmconfig_area(struct pnp_dev *dev) + static const unsigned int mch_quirk_devices[] = { + 0x0154, /* Ivy Bridge */ + 0x0c00, /* Haswell */ ++ 0x1604, /* Broadwell */ + }; + + static struct pci_dev *get_intel_host(void) +-- +2.5.0 + diff --git a/PNP-Add-Haswell-ULT-to-Intel-MCH-size-workaround.patch b/PNP-Add-Haswell-ULT-to-Intel-MCH-size-workaround.patch new file mode 100644 index 000000000..c2082a3b4 --- /dev/null +++ b/PNP-Add-Haswell-ULT-to-Intel-MCH-size-workaround.patch @@ -0,0 +1,119 @@ +From afa5b65015ff2a7f0b4ec8cab6f58fa47025259a Mon Sep 17 00:00:00 2001 +From: Josh Boyer <jwboyer@fedoraproject.org> +Date: Fri, 22 Jan 2016 08:11:46 -0500 +Subject: [PATCH] PNP: Add Haswell-ULT to Intel MCH size workaround + +Add device ID 0x0a04 for Haswell-ULT to the list of devices with MCH +problems. + +From a Lenovo ThinkPad T440S: +[ 0.188604] pnp: PnP ACPI init +[ 0.189044] system 00:00: [mem 0x00000000-0x0009ffff] could not be reserved +[ 0.189048] system 00:00: [mem 0x000c0000-0x000c3fff] could not be reserved +[ 0.189050] system 00:00: [mem 0x000c4000-0x000c7fff] could not be reserved +[ 0.189052] system 00:00: [mem 0x000c8000-0x000cbfff] could not be reserved +[ 0.189054] system 00:00: [mem 0x000cc000-0x000cffff] could not be reserved +[ 0.189056] system 00:00: [mem 0x000d0000-0x000d3fff] has been reserved +[ 0.189058] system 00:00: [mem 0x000d4000-0x000d7fff] has been reserved +[ 0.189060] system 00:00: [mem 0x000d8000-0x000dbfff] has been reserved +[ 0.189061] system 00:00: [mem 0x000dc000-0x000dffff] has been reserved +[ 0.189063] system 00:00: [mem 0x000e0000-0x000e3fff] could not be reserved +[ 0.189065] system 00:00: [mem 0x000e4000-0x000e7fff] could not be reserved +[ 0.189067] system 00:00: [mem 0x000e8000-0x000ebfff] could not be reserved +[ 0.189069] system 00:00: [mem 0x000ec000-0x000effff] could not be reserved +[ 0.189071] system 00:00: [mem 0x000f0000-0x000fffff] could not be reserved +[ 0.189073] system 00:00: [mem 0x00100000-0xdf9fffff] could not be reserved +[ 0.189075] system 00:00: [mem 0xfec00000-0xfed3ffff] could not be reserved +[ 0.189078] system 00:00: [mem 0xfed4c000-0xffffffff] could not be reserved +[ 0.189082] system 00:00: Plug and Play ACPI device, IDs PNP0c01 (active) +[ 0.189216] system 00:01: [io 0x1800-0x189f] could not be reserved +[ 0.189220] system 00:01: [io 0x0800-0x087f] has been reserved +[ 0.189222] system 00:01: [io 0x0880-0x08ff] has been reserved +[ 0.189224] system 00:01: [io 0x0900-0x097f] has been reserved +[ 0.189226] system 00:01: [io 0x0980-0x09ff] has been reserved +[ 0.189229] system 00:01: [io 0x0a00-0x0a7f] has been reserved +[ 0.189231] system 00:01: [io 0x0a80-0x0aff] has been reserved +[ 0.189233] system 00:01: [io 0x0b00-0x0b7f] has been reserved +[ 0.189235] system 00:01: [io 0x0b80-0x0bff] has been reserved +[ 0.189238] system 00:01: [io 0x15e0-0x15ef] has been reserved +[ 0.189240] system 00:01: [io 0x1600-0x167f] has been reserved +[ 0.189242] system 00:01: [io 0x1640-0x165f] has been reserved +[ 0.189246] system 00:01: [mem 0xf8000000-0xfbffffff] could not be reserved +[ 0.189249] system 00:01: [mem 0x00000000-0x00000fff] could not be reserved +[ 0.189251] system 00:01: [mem 0xfed1c000-0xfed1ffff] has been reserved +[ 0.189254] system 00:01: [mem 0xfed10000-0xfed13fff] has been reserved +[ 0.189256] system 00:01: [mem 0xfed18000-0xfed18fff] has been reserved +[ 0.189258] system 00:01: [mem 0xfed19000-0xfed19fff] has been reserved +[ 0.189261] system 00:01: [mem 0xfed45000-0xfed4bfff] has been reserved +[ 0.189264] system 00:01: Plug and Play ACPI device, IDs PNP0c02 (active) +[....] +[ 0.583653] resource sanity check: requesting [mem 0xfed10000-0xfed15fff], which spans more than pnp 00:01 [mem 0xfed10000-0xfed13fff] +[ 0.583654] ------------[ cut here ]------------ +[ 0.583660] WARNING: CPU: 0 PID: 1 at arch/x86/mm/ioremap.c:198 __ioremap_caller+0x2c5/0x380() +[ 0.583661] Info: mapping multiple BARs. Your kernel is fine. +[ 0.583662] Modules linked in: + +[ 0.583666] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.3.3-303.fc23.x86_64 #1 +[ 0.583668] Hardware name: LENOVO 20AR001GXS/20AR001GXS, BIOS GJET86WW (2.36 ) 12/04/2015 +[ 0.583670] 0000000000000000 0000000014cf7e59 ffff880214a1baf8 ffffffff813a625f +[ 0.583673] ffff880214a1bb40 ffff880214a1bb30 ffffffff810a07c2 00000000fed10000 +[ 0.583675] ffffc90000cb8000 0000000000006000 0000000000000000 ffff8800d6381040 +[ 0.583678] Call Trace: +[ 0.583683] [<ffffffff813a625f>] dump_stack+0x44/0x55 +[ 0.583686] [<ffffffff810a07c2>] warn_slowpath_common+0x82/0xc0 +[ 0.583688] [<ffffffff810a085c>] warn_slowpath_fmt+0x5c/0x80 +[ 0.583692] [<ffffffff810a6fba>] ? iomem_map_sanity_check+0xba/0xd0 +[ 0.583695] [<ffffffff81065835>] __ioremap_caller+0x2c5/0x380 +[ 0.583698] [<ffffffff81065907>] ioremap_nocache+0x17/0x20 +[ 0.583701] [<ffffffff8103a119>] snb_uncore_imc_init_box+0x79/0xb0 +[ 0.583705] [<ffffffff81038900>] uncore_pci_probe+0xd0/0x1b0 +[ 0.583707] [<ffffffff813efda5>] local_pci_probe+0x45/0xa0 +[ 0.583710] [<ffffffff813f118d>] pci_device_probe+0xfd/0x140 +[ 0.583713] [<ffffffff814d9b52>] driver_probe_device+0x222/0x480 +[ 0.583715] [<ffffffff814d9e34>] __driver_attach+0x84/0x90 +[ 0.583717] [<ffffffff814d9db0>] ? driver_probe_device+0x480/0x480 +[ 0.583720] [<ffffffff814d762c>] bus_for_each_dev+0x6c/0xc0 +[ 0.583722] [<ffffffff814d930e>] driver_attach+0x1e/0x20 +[ 0.583724] [<ffffffff814d8e4b>] bus_add_driver+0x1eb/0x280 +[ 0.583727] [<ffffffff81d6af1a>] ? uncore_cpu_setup+0x12/0x12 +[ 0.583729] [<ffffffff814da680>] driver_register+0x60/0xe0 +[ 0.583733] [<ffffffff813ef78c>] __pci_register_driver+0x4c/0x50 +[ 0.583736] [<ffffffff81d6affc>] intel_uncore_init+0xe2/0x2e6 +[ 0.583738] [<ffffffff81d6af1a>] ? uncore_cpu_setup+0x12/0x12 +[ 0.583741] [<ffffffff81002123>] do_one_initcall+0xb3/0x200 +[ 0.583745] [<ffffffff810be500>] ? parse_args+0x1a0/0x4a0 +[ 0.583749] [<ffffffff81d5c1c8>] kernel_init_freeable+0x189/0x223 +[ 0.583752] [<ffffffff81775c40>] ? rest_init+0x80/0x80 +[ 0.583754] [<ffffffff81775c4e>] kernel_init+0xe/0xe0 +[ 0.583758] [<ffffffff81781adf>] ret_from_fork+0x3f/0x70 +[ 0.583760] [<ffffffff81775c40>] ? rest_init+0x80/0x80 +[ 0.583765] ---[ end trace 077c426a39e018aa ]--- + +00:00.0 Host bridge [0600]: Intel Corporation Haswell-ULT DRAM Controller [8086:0a04] (rev 0b) + Subsystem: Lenovo Device [17aa:220c] + Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- + Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort+ >SERR- <PERR- INTx- + Latency: 0 + Capabilities: <access denied> + Kernel driver in use: hsw_uncore + +Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org> +--- + drivers/pnp/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pnp/quirks.c b/drivers/pnp/quirks.c +index f700723ca5d6..d28e3ab9479c 100644 +--- a/drivers/pnp/quirks.c ++++ b/drivers/pnp/quirks.c +@@ -342,6 +342,7 @@ static void quirk_amd_mmconfig_area(struct pnp_dev *dev) + /* Device IDs of parts that have 32KB MCH space */ + static const unsigned int mch_quirk_devices[] = { + 0x0154, /* Ivy Bridge */ ++ 0x0a04, /* Haswell-ULT */ + 0x0c00, /* Haswell */ + 0x1604, /* Broadwell */ + }; +-- +2.5.0 + diff --git a/SCSI-fix-bug-in-scsi_dev_info_list-matching.patch b/SCSI-fix-bug-in-scsi_dev_info_list-matching.patch new file mode 100644 index 000000000..d79ccf923 --- /dev/null +++ b/SCSI-fix-bug-in-scsi_dev_info_list-matching.patch @@ -0,0 +1,140 @@ +From 4abc12dd59bed74aa1730c2b3129d1750604d530 Mon Sep 17 00:00:00 2001 +From: Alan Stern <stern@rowland.harvard.edu> +Date: Mon, 3 Aug 2015 11:57:29 -0400 +Subject: [PATCH 2/2] SCSI: fix bug in scsi_dev_info_list matching + +The "compatible" matching algorithm used for looking up old-style +blacklist entries in a scsi_dev_info_list is buggy. The core of the +algorithm looks like this: + + if (memcmp(devinfo->vendor, vendor, + min(max, strlen(devinfo->vendor)))) + /* not a match */ + +where max is the length of the device's vendor string after leading +spaces have been removed but trailing spaces have not. Because of the +min() computation, either entry could be a proper substring of the +other and the code would still think that they match. + +In the case originally reported, the device's vendor and product +strings were "Inateck " and " ". These matched against +the following entry in the global device list: + + {"", "Scanner", "1.80", BLIST_NOLUN} + +because "" is a substring of "Inateck " and "" (the result of removing +leading spaces from the device's product string) is a substring of +"Scanner". The mistaken match prevented the system from scanning and +finding the device's second Logical Unit. + +This patch fixes the problem by making two changes. First, the code +for leading-space removal is hoisted out of the loop. (This means it +will sometimes run unnecessarily, but since a large percentage of all +lookups involve the "compatible" entries in global device list, this +should be an overall improvement.) Second and more importantly, the +patch removes trailing spaces and adds a check to verify that the two +resulting strings are exactly the same length. This prevents matches +where one entry is a proper substring of the other. + +Signed-off-by: Alan Stern <stern@rowland.harvard.edu> +Reported-by: Giulio Bernardi <ugilio@gmail.com> +Tested-by: Giulio Bernardi <ugilio@gmail.com> +Signed-off-by: James Bottomley <JBottomley@Odin.com> +--- + drivers/scsi/scsi_devinfo.c | 69 +++++++++++++++++++++++---------------------- + 1 file changed, 35 insertions(+), 34 deletions(-) + +diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c +index 2f49a224462d..2c1160c7ec92 100644 +--- a/drivers/scsi/scsi_devinfo.c ++++ b/drivers/scsi/scsi_devinfo.c +@@ -407,51 +407,52 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor, + struct scsi_dev_info_list *devinfo; + struct scsi_dev_info_list_table *devinfo_table = + scsi_devinfo_lookup_by_key(key); ++ size_t vmax, mmax; ++ const char *vskip, *mskip; + + if (IS_ERR(devinfo_table)) + return (struct scsi_dev_info_list *) devinfo_table; + ++ /* Prepare for "compatible" matches */ ++ ++ /* ++ * XXX why skip leading spaces? If an odd INQUIRY ++ * value, that should have been part of the ++ * scsi_static_device_list[] entry, such as " FOO" ++ * rather than "FOO". Since this code is already ++ * here, and we don't know what device it is ++ * trying to work with, leave it as-is. ++ */ ++ vmax = 8; /* max length of vendor */ ++ vskip = vendor; ++ while (vmax > 0 && *vskip == ' ') { ++ vmax--; ++ vskip++; ++ } ++ /* Also skip trailing spaces */ ++ while (vmax > 0 && vskip[vmax - 1] == ' ') ++ --vmax; ++ ++ mmax = 16; /* max length of model */ ++ mskip = model; ++ while (mmax > 0 && *mskip == ' ') { ++ mmax--; ++ mskip++; ++ } ++ while (mmax > 0 && mskip[mmax - 1] == ' ') ++ --mmax; ++ + list_for_each_entry(devinfo, &devinfo_table->scsi_dev_info_list, + dev_info_list) { + if (devinfo->compatible) { + /* + * Behave like the older version of get_device_flags. + */ +- size_t max; +- /* +- * XXX why skip leading spaces? If an odd INQUIRY +- * value, that should have been part of the +- * scsi_static_device_list[] entry, such as " FOO" +- * rather than "FOO". Since this code is already +- * here, and we don't know what device it is +- * trying to work with, leave it as-is. +- */ +- max = 8; /* max length of vendor */ +- while ((max > 0) && *vendor == ' ') { +- max--; +- vendor++; +- } +- /* +- * XXX removing the following strlen() would be +- * good, using it means that for a an entry not in +- * the list, we scan every byte of every vendor +- * listed in scsi_static_device_list[], and never match +- * a single one (and still have to compare at +- * least the first byte of each vendor). +- */ +- if (memcmp(devinfo->vendor, vendor, +- min(max, strlen(devinfo->vendor)))) ++ if (memcmp(devinfo->vendor, vskip, vmax) || ++ devinfo->vendor[vmax]) + continue; +- /* +- * Skip spaces again. +- */ +- max = 16; /* max length of model */ +- while ((max > 0) && *model == ' ') { +- max--; +- model++; +- } +- if (memcmp(devinfo->model, model, +- min(max, strlen(devinfo->model)))) ++ if (memcmp(devinfo->model, mskip, mmax) || ++ devinfo->model[mmax]) + continue; + return devinfo; + } else { +-- +2.5.0 + diff --git a/SCSI-refactor-device-matching-code-in-scsi_devinfo.c.patch b/SCSI-refactor-device-matching-code-in-scsi_devinfo.c.patch new file mode 100644 index 000000000..e87baad50 --- /dev/null +++ b/SCSI-refactor-device-matching-code-in-scsi_devinfo.c.patch @@ -0,0 +1,183 @@ +From 26d61e8347b27a981d647d3ea4ec8c7f462c1fcf Mon Sep 17 00:00:00 2001 +From: Alan Stern <stern@rowland.harvard.edu> +Date: Mon, 3 Aug 2015 11:57:21 -0400 +Subject: [PATCH 1/2] SCSI: refactor device-matching code in scsi_devinfo.c + +In drivers/scsi/scsi_devinfo.c, the scsi_dev_info_list_del_keyed() and +scsi_get_device_flags_keyed() routines contain a large amount of +duplicate code for finding vendor/product matches in a +scsi_dev_info_list. This patch factors out the duplicate code and +puts it in a separate function, scsi_dev_info_list_find(). + +Signed-off-by: Alan Stern <stern@rowland.harvard.edu> +Suggested-by: Giulio Bernardi <ugilio@gmail.com> +Signed-off-by: James Bottomley <JBottomley@Odin.com> +--- + drivers/scsi/scsi_devinfo.c | 112 ++++++++++++++++---------------------------- + 1 file changed, 41 insertions(+), 71 deletions(-) + +diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c +index 9f77d23239a2..2f49a224462d 100644 +--- a/drivers/scsi/scsi_devinfo.c ++++ b/drivers/scsi/scsi_devinfo.c +@@ -390,25 +390,26 @@ int scsi_dev_info_list_add_keyed(int compatible, char *vendor, char *model, + EXPORT_SYMBOL(scsi_dev_info_list_add_keyed); + + /** +- * scsi_dev_info_list_del_keyed - remove one dev_info list entry. ++ * scsi_dev_info_list_find - find a matching dev_info list entry. + * @vendor: vendor string + * @model: model (product) string + * @key: specify list to use + * + * Description: +- * Remove and destroy one dev_info entry for @vendor, @model ++ * Finds the first dev_info entry matching @vendor, @model + * in list specified by @key. + * +- * Returns: 0 OK, -error on failure. ++ * Returns: pointer to matching entry, or ERR_PTR on failure. + **/ +-int scsi_dev_info_list_del_keyed(char *vendor, char *model, int key) ++static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor, ++ const char *model, int key) + { +- struct scsi_dev_info_list *devinfo, *found = NULL; ++ struct scsi_dev_info_list *devinfo; + struct scsi_dev_info_list_table *devinfo_table = + scsi_devinfo_lookup_by_key(key); + + if (IS_ERR(devinfo_table)) +- return PTR_ERR(devinfo_table); ++ return (struct scsi_dev_info_list *) devinfo_table; + + list_for_each_entry(devinfo, &devinfo_table->scsi_dev_info_list, + dev_info_list) { +@@ -452,25 +453,42 @@ int scsi_dev_info_list_del_keyed(char *vendor, char *model, int key) + if (memcmp(devinfo->model, model, + min(max, strlen(devinfo->model)))) + continue; +- found = devinfo; ++ return devinfo; + } else { + if (!memcmp(devinfo->vendor, vendor, + sizeof(devinfo->vendor)) && + !memcmp(devinfo->model, model, + sizeof(devinfo->model))) +- found = devinfo; ++ return devinfo; + } +- if (found) +- break; + } + +- if (found) { +- list_del(&found->dev_info_list); +- kfree(found); +- return 0; +- } ++ return ERR_PTR(-ENOENT); ++} ++ ++/** ++ * scsi_dev_info_list_del_keyed - remove one dev_info list entry. ++ * @vendor: vendor string ++ * @model: model (product) string ++ * @key: specify list to use ++ * ++ * Description: ++ * Remove and destroy one dev_info entry for @vendor, @model ++ * in list specified by @key. ++ * ++ * Returns: 0 OK, -error on failure. ++ **/ ++int scsi_dev_info_list_del_keyed(char *vendor, char *model, int key) ++{ ++ struct scsi_dev_info_list *found; + +- return -ENOENT; ++ found = scsi_dev_info_list_find(vendor, model, key); ++ if (IS_ERR(found)) ++ return PTR_ERR(found); ++ ++ list_del(&found->dev_info_list); ++ kfree(found); ++ return 0; + } + EXPORT_SYMBOL(scsi_dev_info_list_del_keyed); + +@@ -565,64 +583,16 @@ int scsi_get_device_flags_keyed(struct scsi_device *sdev, + int key) + { + struct scsi_dev_info_list *devinfo; +- struct scsi_dev_info_list_table *devinfo_table; ++ int err; + +- devinfo_table = scsi_devinfo_lookup_by_key(key); ++ devinfo = scsi_dev_info_list_find(vendor, model, key); ++ if (!IS_ERR(devinfo)) ++ return devinfo->flags; + +- if (IS_ERR(devinfo_table)) +- return PTR_ERR(devinfo_table); ++ err = PTR_ERR(devinfo); ++ if (err != -ENOENT) ++ return err; + +- list_for_each_entry(devinfo, &devinfo_table->scsi_dev_info_list, +- dev_info_list) { +- if (devinfo->compatible) { +- /* +- * Behave like the older version of get_device_flags. +- */ +- size_t max; +- /* +- * XXX why skip leading spaces? If an odd INQUIRY +- * value, that should have been part of the +- * scsi_static_device_list[] entry, such as " FOO" +- * rather than "FOO". Since this code is already +- * here, and we don't know what device it is +- * trying to work with, leave it as-is. +- */ +- max = 8; /* max length of vendor */ +- while ((max > 0) && *vendor == ' ') { +- max--; +- vendor++; +- } +- /* +- * XXX removing the following strlen() would be +- * good, using it means that for a an entry not in +- * the list, we scan every byte of every vendor +- * listed in scsi_static_device_list[], and never match +- * a single one (and still have to compare at +- * least the first byte of each vendor). +- */ +- if (memcmp(devinfo->vendor, vendor, +- min(max, strlen(devinfo->vendor)))) +- continue; +- /* +- * Skip spaces again. +- */ +- max = 16; /* max length of model */ +- while ((max > 0) && *model == ' ') { +- max--; +- model++; +- } +- if (memcmp(devinfo->model, model, +- min(max, strlen(devinfo->model)))) +- continue; +- return devinfo->flags; +- } else { +- if (!memcmp(devinfo->vendor, vendor, +- sizeof(devinfo->vendor)) && +- !memcmp(devinfo->model, model, +- sizeof(devinfo->model))) +- return devinfo->flags; +- } +- } + /* nothing found, return nothing */ + if (key != SCSI_DEVINFO_GLOBAL) + return 0; +-- +2.5.0 + diff --git a/block-ensure-to-split-after-potentially-bouncing-a-b.patch b/block-ensure-to-split-after-potentially-bouncing-a-b.patch new file mode 100644 index 000000000..6dda59a4c --- /dev/null +++ b/block-ensure-to-split-after-potentially-bouncing-a-b.patch @@ -0,0 +1,43 @@ +From 23688bf4f830a89866fd0ed3501e342a7360fe4f Mon Sep 17 00:00:00 2001 +From: Junichi Nomura <j-nomura@ce.jp.nec.com> +Date: Tue, 22 Dec 2015 10:23:44 -0700 +Subject: [PATCH] block: ensure to split after potentially bouncing a bio + +blk_queue_bio() does split then bounce, which makes the segment +counting based on pages before bouncing and could go wrong. Move +the split to after bouncing, like we do for blk-mq, and the we +fix the issue of having the bio count for segments be wrong. + +Fixes: 54efd50bfd87 ("block: make generic_make_request handle arbitrarily sized bios") +Cc: stable@vger.kernel.org +Tested-by: Artem S. Tashkinov <t.artem@lycos.com> +Signed-off-by: Jens Axboe <axboe@fb.com> +--- + block/blk-core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/block/blk-core.c b/block/blk-core.c +index 3636be469fa2..c487b94c59e3 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -1689,8 +1689,6 @@ static blk_qc_t blk_queue_bio(struct request_queue *q, struct bio *bio) + struct request *req; + unsigned int request_count = 0; + +- blk_queue_split(q, &bio, q->bio_split); +- + /* + * low level driver can indicate that it wants pages above a + * certain limit bounced to low memory (ie for highmem, or even +@@ -1698,6 +1696,8 @@ static blk_qc_t blk_queue_bio(struct request_queue *q, struct bio *bio) + */ + blk_queue_bounce(q, &bio); + ++ blk_queue_split(q, &bio, q->bio_split); ++ + if (bio_integrity_enabled(bio) && bio_integrity_prep(bio)) { + bio->bi_error = -EIO; + bio_endio(bio); +-- +2.5.0 + diff --git a/bluetooth-Validate-socket-address-length-in-sco_sock.patch b/bluetooth-Validate-socket-address-length-in-sco_sock.patch deleted file mode 100644 index 1ee23fcf4..000000000 --- a/bluetooth-Validate-socket-address-length-in-sco_sock.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 5233252fce714053f0151680933571a2da9cbfb4 Mon Sep 17 00:00:00 2001 -From: "David S. Miller" <davem@davemloft.net> -Date: Tue, 15 Dec 2015 15:39:08 -0500 -Subject: [PATCH] bluetooth: Validate socket address length in sco_sock_bind(). - -Signed-off-by: David S. Miller <davem@davemloft.net> ---- - net/bluetooth/sco.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c -index fe129663bd3f..f52bcbf2e58c 100644 ---- a/net/bluetooth/sco.c -+++ b/net/bluetooth/sco.c -@@ -526,6 +526,9 @@ static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, - if (!addr || addr->sa_family != AF_BLUETOOTH) - return -EINVAL; - -+ if (addr_len < sizeof(struct sockaddr_sco)) -+ return -EINVAL; -+ - lock_sock(sk); - - if (sk->sk_state != BT_OPEN) { --- -2.5.0 - diff --git a/btrfs-handle-invalid-num_stripes-in-sys_array.patch b/btrfs-handle-invalid-num_stripes-in-sys_array.patch new file mode 100644 index 000000000..20bf403bc --- /dev/null +++ b/btrfs-handle-invalid-num_stripes-in-sys_array.patch @@ -0,0 +1,66 @@ +From 43d10880aa4ac713cf73dbac428be9671ef1bf9d Mon Sep 17 00:00:00 2001 +From: David Sterba <dsterba@suse.com> +Date: Mon, 30 Nov 2015 17:27:06 +0100 +Subject: [PATCH 1/2] btrfs: handle invalid num_stripes in sys_array + +We can handle the special case of num_stripes == 0 directly inside +btrfs_read_sys_array. The BUG_ON in btrfs_chunk_item_size is there to +catch other unhandled cases where we fail to validate external data. + +A crafted or corrupted image crashes at mount time: + +BTRFS: device fsid 9006933e-2a9a-44f0-917f-514252aeec2c devid 1 transid 7 /dev/loop0 +BTRFS info (device loop0): disk space caching is enabled +BUG: failure at fs/btrfs/ctree.h:337/btrfs_chunk_item_size()! +Kernel panic - not syncing: BUG! +CPU: 0 PID: 313 Comm: mount Not tainted 4.2.5-00657-ge047887-dirty #25 +Stack: + 637af890 60062489 602aeb2e 604192ba + 60387961 00000011 637af8a0 6038a835 + 637af9c0 6038776b 634ef32b 00000000 +Call Trace: + [<6001c86d>] show_stack+0xfe/0x15b + [<6038a835>] dump_stack+0x2a/0x2c + [<6038776b>] panic+0x13e/0x2b3 + [<6020f099>] btrfs_read_sys_array+0x25d/0x2ff + [<601cfbbe>] open_ctree+0x192d/0x27af + [<6019c2c1>] btrfs_mount+0x8f5/0xb9a + [<600bc9a7>] mount_fs+0x11/0xf3 + [<600d5167>] vfs_kern_mount+0x75/0x11a + [<6019bcb0>] btrfs_mount+0x2e4/0xb9a + [<600bc9a7>] mount_fs+0x11/0xf3 + [<600d5167>] vfs_kern_mount+0x75/0x11a + [<600d710b>] do_mount+0xa35/0xbc9 + [<600d7557>] SyS_mount+0x95/0xc8 + [<6001e884>] handle_syscall+0x6b/0x8e + +Reported-by: Jiri Slaby <jslaby@suse.com> +Reported-by: Vegard Nossum <vegard.nossum@oracle.com> +CC: stable@vger.kernel.org # 3.19+ +Signed-off-by: David Sterba <dsterba@suse.com> +--- + fs/btrfs/volumes.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 6fc735869c18..b816b3a2e118 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -6399,6 +6399,14 @@ int btrfs_read_sys_array(struct btrfs_root *root) + goto out_short_read; + + num_stripes = btrfs_chunk_num_stripes(sb, chunk); ++ if (!num_stripes) { ++ printk(KERN_ERR ++ "BTRFS: invalid number of stripes %u in sys_array at offset %u\n", ++ num_stripes, cur_offset); ++ ret = -EIO; ++ break; ++ } ++ + len = btrfs_chunk_item_size(num_stripes); + if (cur_offset + len > array_size) + goto out_short_read; +-- +2.5.0 + diff --git a/drm-i915-Do-a-better-job-at-disabling-primary-plane-.patch b/drm-i915-Do-a-better-job-at-disabling-primary-plane-.patch new file mode 100644 index 000000000..3ab9132f4 --- /dev/null +++ b/drm-i915-Do-a-better-job-at-disabling-primary-plane-.patch @@ -0,0 +1,59 @@ +From d271283fd90da8cc5a4c659b1854c0d3a34b1929 Mon Sep 17 00:00:00 2001 +From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> +Date: Mon, 23 Nov 2015 10:25:28 +0100 +Subject: [PATCH] drm/i915: Do a better job at disabling primary plane in the + noatomic case. + +When disable_noatomic is called plane_mask is not correct yet, and +plane_state->visible = true is left as true after disabling the primary +plane. + +Other planes are already disabled as part of crtc sanitization, only the +primary is left active. But the plane_mask is not updated here. It gets +updated during fb takeover in modeset_gem_init, or set to the new value +on resume. + +This means that to disable the primary plane 1 << drm_plane_index(primary) +needs to be used. + +Afterwards because the crtc is no longer active it's forbidden to keep +plane_state->visible set, or a WARN_ON in +intel_plane_atomic_calc_changes triggers. There are other code points +that rely on accurate plane_state->visible too, so make sure the bool is +cleared. + +The other planes are already disabled in intel_sanitize_crtc, so they +don't have to be handled here. + +Cc: stable@vger.kernel.org #v4.3, v4.2? +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92655 +Tested-by: Tomas Mezzadra <tmezzadra@gmail.com> +Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> +Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> +Link: http://patchwork.freedesktop.org/patch/msgid/5652DB88.9070208@linux.intel.com +(cherry picked from commit 54a4196188eab82e6f0a5f05716626e9f18b8fb6) +Signed-off-by: Jani Nikula <jani.nikula@intel.com> +--- + drivers/gpu/drm/i915/intel_display.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index b2270d576979..84eda179e3ff 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -6225,9 +6225,11 @@ static void intel_crtc_disable_noatomic(struct drm_crtc *crtc) + if (to_intel_plane_state(crtc->primary->state)->visible) { + intel_crtc_wait_for_pending_flips(crtc); + intel_pre_disable_primary(crtc); ++ ++ intel_crtc_disable_planes(crtc, 1 << drm_plane_index(crtc->primary)); ++ to_intel_plane_state(crtc->primary->state)->visible = false; + } + +- intel_crtc_disable_planes(crtc, crtc->state->plane_mask); + dev_priv->display.crtc_disable(crtc); + intel_disable_shared_dpll(intel_crtc); + +-- +2.5.0 + diff --git a/i915-stable-backports.patch b/i915-stable-backports.patch new file mode 100644 index 000000000..f366fda66 --- /dev/null +++ b/i915-stable-backports.patch @@ -0,0 +1,1962 @@ +From 5c19e5ee394c36652c59c247855a3c7e5a83a015 Mon Sep 17 00:00:00 2001 +From: Jani Nikula <jani.nikula@intel.com> +Date: Thu, 7 Jan 2016 10:29:10 +0200 +Subject: [PATCH 01/26] drm/i915: shut up gen8+ SDE irq dmesg noise, again + +We still keep getting + +[ 4.249930] [drm:gen8_irq_handler [i915]] *ERROR* The master control interrupt lied (SDE)! + +This reverts + +commit 820da7ae46332fa709b171eb7ba57cbd023fa6df +Author: Jani Nikula <jani.nikula@intel.com> +Date: Wed Nov 25 16:47:23 2015 +0200 + + Revert "drm/i915: shut up gen8+ SDE irq dmesg noise" + +which in itself is a revert, so this is just doing + +commit 97e5ed1111dcc5300a0f59a55248cd243937a8ab +Author: Daniel Vetter <daniel.vetter@ffwll.ch> +Date: Fri Oct 23 10:56:12 2015 +0200 + + drm/i915: shut up gen8+ SDE irq dmesg noise + +all over again. I'll stop pretending I understand what's going on like I +did when I thought I'd fixed this for good in + +commit 6a39d7c986be4fd18eb019e9cdbf774ec36c9f77 +Author: Jani Nikula <jani.nikula@intel.com> +Date: Wed Nov 25 16:47:22 2015 +0200 + + drm/i915: fix the SDE irq dmesg warnings properly + +Reported-by: Chris Wilson <chris@chris-wilson.co.uk> +Reference: http://mid.gmane.org/20151213124945.GA5715@nuc-i3427.alporthouse.com +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92084 +Cc: drm-intel-fixes@lists.freedesktop.org +Fixes: 820da7ae4633 ("Revert "drm/i915: shut up gen8+ SDE irq dmesg noise"") +Signed-off-by: Jani Nikula <jani.nikula@intel.com> + +[Backported to 4.3.y by Josh Boyer <jwboyer@fedoraproject.org>] +--- + drivers/gpu/drm/i915/i915_irq.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c +index 39d73dbc1c47..fa7f82d54762 100644 +--- a/drivers/gpu/drm/i915/i915_irq.c ++++ b/drivers/gpu/drm/i915/i915_irq.c +@@ -2168,8 +2168,13 @@ static irqreturn_t gen8_irq_handler(int irq, void *arg) + I915_WRITE(SDEIIR, pch_iir); + ret = IRQ_HANDLED; + cpt_irq_handler(dev, pch_iir); +- } else +- DRM_ERROR("The master control interrupt lied (SDE)!\n"); ++ } else { ++ /* ++ * Like on previous PCH there seems to be something ++ * fishy going on with forwarding PCH interrupts. ++ */ ++ DRM_DEBUG_DRIVER("The master control interrupt lied (SDE)!\n"); ++ } + + } + +-- +2.5.0 + + +From 65dcf0f52e9705d0094e76a9225bbe770329c96d Mon Sep 17 00:00:00 2001 +From: Chris Wilson <chris@chris-wilson.co.uk> +Date: Thu, 1 Oct 2015 12:34:46 +0100 +Subject: [PATCH 02/26] drm/i915: Fix userptr deadlock with aliased GTT + mmappings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Upstream commit e4b946bfe1e36680e27a5f39163980979fa61a5d + +Michał Winiarski found a really evil way to trigger a struct_mutex +deadlock with userptr. He found that if he allocated a userptr bo and +then GTT mmaped another bo, or even itself, at the same address as the +userptr using MAP_FIXED, he could then cause a deadlock any time we then +had to invalidate the GTT mmappings (so at will). Tvrtko then found by +repeatedly allocating GTT mmappings he could alias with an old userptr +mmap and also trigger the deadlock. + +To counter act the deadlock, we make the observation that we only need +to take the struct_mutex if the object has any pages to revoke, and that +before userspace can alias with the userptr address space, it must have +invalidated the userptr->pages. Thus if we can check for those pages +outside of the struct_mutex, we can avoid the deadlock. To do so we +introduce a separate flag for userptr objects that we can inspect from +the mmu-notifier underneath its spinlock. + +The patch makes one eye-catching change. That is the removal serial=0 +after detecting a to-be-freed object inside the invalidate walker. I +felt setting serial=0 was a questionable pessimisation: it denies us the +chance to reuse the current iterator for the next loop (before it is +freed) and being explicit makes the reader question the validity of the +locking (since the object-free race could occur elsewhere). The +serialisation of the iterator is through the spinlock, if the object is +freed before the next loop then the notifier.serial will be incremented +and we start the walk from the beginning as we detect the invalid cache. + +To try and tame the error paths and interactions with the userptr->active +flag, we have to do a fair amount of rearranging of get_pages_userptr(). + +v2: Grammar fixes +v3: Reorder set-active so that it is only set when obj->pages is set +(and so needs cancellation). Only the order of setting obj->pages and +the active-flag is crucial. Calling gup after invalidate-range begin +means the userptr sees the new set of backing storage (and so will not +need to invalidate its new pages), but we have to be careful not to set +the active-flag prior to successfully establishing obj->pages. +v4: Take the active->flag early so we know in the mmu-notifier when we +have to cancel a pending gup-worker. +v5: Rearrange the error path so that is not so convoluted +v6: Set pinned to 0 when negative before calling release_pages() + +Reported-by: Michał Winiarski <michal.winiarski@intel.com> +Testcase: igt/gem_userptr_blits/map-fixed* +Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> +Cc: Michał Winiarski <michal.winiarski@intel.com> +Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com> +Cc: stable@vger.kernel.org +Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com> +Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> +--- + drivers/gpu/drm/i915/i915_gem_userptr.c | 176 ++++++++++++++++++++------------ + 1 file changed, 110 insertions(+), 66 deletions(-) + +diff --git a/drivers/gpu/drm/i915/i915_gem_userptr.c b/drivers/gpu/drm/i915/i915_gem_userptr.c +index a96b9006a51e..ba321f0c41c5 100644 +--- a/drivers/gpu/drm/i915/i915_gem_userptr.c ++++ b/drivers/gpu/drm/i915/i915_gem_userptr.c +@@ -59,6 +59,7 @@ struct i915_mmu_object { + struct interval_tree_node it; + struct list_head link; + struct drm_i915_gem_object *obj; ++ bool active; + bool is_linear; + }; + +@@ -114,7 +115,8 @@ restart: + + obj = mo->obj; + +- if (!kref_get_unless_zero(&obj->base.refcount)) ++ if (!mo->active || ++ !kref_get_unless_zero(&obj->base.refcount)) + continue; + + spin_unlock(&mn->lock); +@@ -151,7 +153,8 @@ static void i915_gem_userptr_mn_invalidate_range_start(struct mmu_notifier *_mn, + else + it = interval_tree_iter_first(&mn->objects, start, end); + if (it != NULL) { +- obj = container_of(it, struct i915_mmu_object, it)->obj; ++ struct i915_mmu_object *mo = ++ container_of(it, struct i915_mmu_object, it); + + /* The mmu_object is released late when destroying the + * GEM object so it is entirely possible to gain a +@@ -160,11 +163,9 @@ static void i915_gem_userptr_mn_invalidate_range_start(struct mmu_notifier *_mn, + * the struct_mutex - and consequently use it after it + * is freed and then double free it. + */ +- if (!kref_get_unless_zero(&obj->base.refcount)) { +- spin_unlock(&mn->lock); +- serial = 0; +- continue; +- } ++ if (mo->active && ++ kref_get_unless_zero(&mo->obj->base.refcount)) ++ obj = mo->obj; + + serial = mn->serial; + } +@@ -566,6 +567,30 @@ __i915_gem_userptr_set_pages(struct drm_i915_gem_object *obj, + } + + static void ++__i915_gem_userptr_set_active(struct drm_i915_gem_object *obj, ++ bool value) ++{ ++ /* During mm_invalidate_range we need to cancel any userptr that ++ * overlaps the range being invalidated. Doing so requires the ++ * struct_mutex, and that risks recursion. In order to cause ++ * recursion, the user must alias the userptr address space with ++ * a GTT mmapping (possible with a MAP_FIXED) - then when we have ++ * to invalidate that mmaping, mm_invalidate_range is called with ++ * the userptr address *and* the struct_mutex held. To prevent that ++ * we set a flag under the i915_mmu_notifier spinlock to indicate ++ * whether this object is valid. ++ */ ++#if defined(CONFIG_MMU_NOTIFIER) ++ if (obj->userptr.mmu_object == NULL) ++ return; ++ ++ spin_lock(&obj->userptr.mmu_object->mn->lock); ++ obj->userptr.mmu_object->active = value; ++ spin_unlock(&obj->userptr.mmu_object->mn->lock); ++#endif ++} ++ ++static void + __i915_gem_userptr_get_pages_worker(struct work_struct *_work) + { + struct get_pages_work *work = container_of(_work, typeof(*work), work); +@@ -612,6 +637,9 @@ __i915_gem_userptr_get_pages_worker(struct work_struct *_work) + + pinned = 0; + } ++ obj->userptr.work = ERR_PTR(ret); ++ if (ret) ++ __i915_gem_userptr_set_active(obj, false); + } + + obj->userptr.work = ERR_PTR(ret); +@@ -627,11 +655,60 @@ __i915_gem_userptr_get_pages_worker(struct work_struct *_work) + } + + static int ++__i915_gem_userptr_get_pages_schedule(struct drm_i915_gem_object *obj, ++ bool *active) ++{ ++ struct get_pages_work *work; ++ ++ /* Spawn a worker so that we can acquire the ++ * user pages without holding our mutex. Access ++ * to the user pages requires mmap_sem, and we have ++ * a strict lock ordering of mmap_sem, struct_mutex - ++ * we already hold struct_mutex here and so cannot ++ * call gup without encountering a lock inversion. ++ * ++ * Userspace will keep on repeating the operation ++ * (thanks to EAGAIN) until either we hit the fast ++ * path or the worker completes. If the worker is ++ * cancelled or superseded, the task is still run ++ * but the results ignored. (This leads to ++ * complications that we may have a stray object ++ * refcount that we need to be wary of when ++ * checking for existing objects during creation.) ++ * If the worker encounters an error, it reports ++ * that error back to this function through ++ * obj->userptr.work = ERR_PTR. ++ */ ++ if (obj->userptr.workers >= I915_GEM_USERPTR_MAX_WORKERS) ++ return -EAGAIN; ++ ++ work = kmalloc(sizeof(*work), GFP_KERNEL); ++ if (work == NULL) ++ return -ENOMEM; ++ ++ obj->userptr.work = &work->work; ++ obj->userptr.workers++; ++ ++ work->obj = obj; ++ drm_gem_object_reference(&obj->base); ++ ++ work->task = current; ++ get_task_struct(work->task); ++ ++ INIT_WORK(&work->work, __i915_gem_userptr_get_pages_worker); ++ schedule_work(&work->work); ++ ++ *active = true; ++ return -EAGAIN; ++} ++ ++static int + i915_gem_userptr_get_pages(struct drm_i915_gem_object *obj) + { + const int num_pages = obj->base.size >> PAGE_SHIFT; + struct page **pvec; + int pinned, ret; ++ bool active; + + /* If userspace should engineer that these pages are replaced in + * the vma between us binding this page into the GTT and completion +@@ -649,6 +726,18 @@ i915_gem_userptr_get_pages(struct drm_i915_gem_object *obj) + * to the vma (discard or cloning) which should prevent the more + * egregious cases from causing harm. + */ ++ if (IS_ERR(obj->userptr.work)) { ++ /* active flag will have been dropped already by the worker */ ++ ret = PTR_ERR(obj->userptr.work); ++ obj->userptr.work = NULL; ++ return ret; ++ } ++ if (obj->userptr.work) ++ /* active flag should still be held for the pending work */ ++ return -EAGAIN; ++ ++ /* Let the mmu-notifier know that we have begun and need cancellation */ ++ __i915_gem_userptr_set_active(obj, true); + + pvec = NULL; + pinned = 0; +@@ -657,73 +746,27 @@ i915_gem_userptr_get_pages(struct drm_i915_gem_object *obj) + GFP_TEMPORARY | __GFP_NOWARN | __GFP_NORETRY); + if (pvec == NULL) { + pvec = drm_malloc_ab(num_pages, sizeof(struct page *)); +- if (pvec == NULL) ++ if (pvec == NULL) { ++ __i915_gem_userptr_set_active(obj, false); + return -ENOMEM; ++ } + } + + pinned = __get_user_pages_fast(obj->userptr.ptr, num_pages, + !obj->userptr.read_only, pvec); + } +- if (pinned < num_pages) { +- if (pinned < 0) { +- ret = pinned; +- pinned = 0; +- } else { +- /* Spawn a worker so that we can acquire the +- * user pages without holding our mutex. Access +- * to the user pages requires mmap_sem, and we have +- * a strict lock ordering of mmap_sem, struct_mutex - +- * we already hold struct_mutex here and so cannot +- * call gup without encountering a lock inversion. +- * +- * Userspace will keep on repeating the operation +- * (thanks to EAGAIN) until either we hit the fast +- * path or the worker completes. If the worker is +- * cancelled or superseded, the task is still run +- * but the results ignored. (This leads to +- * complications that we may have a stray object +- * refcount that we need to be wary of when +- * checking for existing objects during creation.) +- * If the worker encounters an error, it reports +- * that error back to this function through +- * obj->userptr.work = ERR_PTR. +- */ +- ret = -EAGAIN; +- if (obj->userptr.work == NULL && +- obj->userptr.workers < I915_GEM_USERPTR_MAX_WORKERS) { +- struct get_pages_work *work; +- +- work = kmalloc(sizeof(*work), GFP_KERNEL); +- if (work != NULL) { +- obj->userptr.work = &work->work; +- obj->userptr.workers++; +- +- work->obj = obj; +- drm_gem_object_reference(&obj->base); +- +- work->task = current; +- get_task_struct(work->task); +- +- INIT_WORK(&work->work, __i915_gem_userptr_get_pages_worker); +- schedule_work(&work->work); +- } else +- ret = -ENOMEM; +- } else { +- if (IS_ERR(obj->userptr.work)) { +- ret = PTR_ERR(obj->userptr.work); +- obj->userptr.work = NULL; +- } +- } +- } +- } else { ++ ++ active = false; ++ if (pinned < 0) ++ ret = pinned, pinned = 0; ++ else if (pinned < num_pages) ++ ret = __i915_gem_userptr_get_pages_schedule(obj, &active); ++ else + ret = __i915_gem_userptr_set_pages(obj, pvec, num_pages); +- if (ret == 0) { +- obj->userptr.work = NULL; +- pinned = 0; +- } ++ if (ret) { ++ __i915_gem_userptr_set_active(obj, active); ++ release_pages(pvec, pinned, 0); + } +- +- release_pages(pvec, pinned, 0); + drm_free_large(pvec); + return ret; + } +@@ -734,6 +777,7 @@ i915_gem_userptr_put_pages(struct drm_i915_gem_object *obj) + struct sg_page_iter sg_iter; + + BUG_ON(obj->userptr.work != NULL); ++ __i915_gem_userptr_set_active(obj, false); + + if (obj->madv != I915_MADV_WILLNEED) + obj->dirty = 0; +-- +2.5.0 + + +From d9cc6dc69e3a5f7f68e22227baf0e0f7743e448c Mon Sep 17 00:00:00 2001 +From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> +Date: Thu, 22 Oct 2015 13:56:34 +0200 +Subject: [PATCH 03/26] drm/i915/skl: Prevent unclaimed register writes on + skylake. + +Upstream commit b10f1b20171945b49988b2b1fe68cb312cc36d32 + +I'm getting unclaimed register writes when checking the WM registers +after the crtc is disabled. So I would imagine those are guarded by +the crtc power well. Fix this by not reading out wm state when the +power well is off. + +Cc: stable@vger.kernel.org # v4.3 +Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92181 +Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> +Signed-off-by: Jani Nikula <jani.nikula@intel.com> +--- + drivers/gpu/drm/i915/intel_pm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c +index ddbb7ed0a193..5e91e795fd99 100644 +--- a/drivers/gpu/drm/i915/intel_pm.c ++++ b/drivers/gpu/drm/i915/intel_pm.c +@@ -2899,7 +2899,12 @@ void skl_ddb_get_hw_state(struct drm_i915_private *dev_priv, + int plane; + u32 val; + ++ memset(ddb, 0, sizeof(*ddb)); ++ + for_each_pipe(dev_priv, pipe) { ++ if (!intel_display_power_is_enabled(dev_priv, POWER_DOMAIN_PIPE(pipe))) ++ continue; ++ + for_each_plane(dev_priv, pipe, plane) { + val = I915_READ(PLANE_BUF_CFG(pipe, plane)); + skl_ddb_entry_init_from_hw(&ddb->plane[pipe][plane], +-- +2.5.0 + + +From 0ee1dd6b04a4e8eb34f948842fe4385c09695270 Mon Sep 17 00:00:00 2001 +From: Jani Nikula <jani.nikula@intel.com> +Date: Fri, 30 Oct 2015 14:50:24 +0200 +Subject: [PATCH 04/26] drm/i915: add quirk to enable backlight on Dell + Chromebook 11 (2015) + +Upstream commit 9be64eee3a87dc03218ca9a12834d1150a57b8a8 + +Reported-by: Keith Webb <khwebb@gmail.com> +Suggested-by: Keith Webb <khwebb@gmail.com> +Cc: stable@vger.kernel.org +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=106671 +Reviewed-by: Clint Taylor <Clinton.A.Taylor@intel.com> +Signed-off-by: Jani Nikula <jani.nikula@intel.com> +Link: http://patchwork.freedesktop.org/patch/msgid/1446209424-28801-1-git-send-email-jani.nikula@intel.com +--- + drivers/gpu/drm/i915/intel_display.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index 1d2ff8e6fb4a..8f258092cada 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -14678,6 +14678,9 @@ static struct intel_quirk intel_quirks[] = { + + /* Dell Chromebook 11 */ + { 0x0a06, 0x1028, 0x0a35, quirk_backlight_present }, ++ ++ /* Dell Chromebook 11 (2015 version) */ ++ { 0x0a16, 0x1028, 0x0a35, quirk_backlight_present }, + }; + + static void intel_init_quirks(struct drm_device *dev) +-- +2.5.0 + + +From 06d7e7fe18b63244ec4e6e633fc40dd5bea39099 Mon Sep 17 00:00:00 2001 +From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> +Date: Tue, 3 Nov 2015 08:31:41 +0100 +Subject: [PATCH 05/26] drm/i915: Extend DSL readout fix to BDW and SKL. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Upstream commit b291681926a142958112eedde62823230d6afb84 + +Those platforms have the same bug as haswell, and the same fix applies +to them. + +The original HSW fix that this extends is + +commit 41b578fb0e8b930f2470d3f673b0fa279e77a7b8 +Author: Jesse Barnes <jbarnes@virtuousgeek.org> +Date: Tue Sep 22 12:15:54 2015 -0700 + + drm/i915: workaround bad DSL readout v3 + +Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> +Acked-by: Ville Syrjälä <ville.syrjala@linux.intel.com> +Cc: stable@vger.kernel.org # v4.3 +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91579 +Link: http://patchwork.freedesktop.org/patch/msgid/1446535913-31970-3-git-send-email-maarten.lankhorst@linux.intel.com +Signed-off-by: Jani Nikula <jani.nikula@intel.com> +--- + drivers/gpu/drm/i915/i915_irq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c +index fa7f82d54762..d83d12eeb3fe 100644 +--- a/drivers/gpu/drm/i915/i915_irq.c ++++ b/drivers/gpu/drm/i915/i915_irq.c +@@ -651,7 +651,7 @@ static int __intel_get_crtc_scanline(struct intel_crtc *crtc) + * problem. We may need to extend this to include other platforms, + * but so far testing only shows the problem on HSW. + */ +- if (IS_HASWELL(dev) && !position) { ++ if (HAS_DDI(dev) && !position) { + int i, temp; + + for (i = 0; i < 100; i++) { +-- +2.5.0 + + +From f5268273f194155f0a5f3cbfa7bf271774a7a9d6 Mon Sep 17 00:00:00 2001 +From: Jani Nikula <jani.nikula@intel.com> +Date: Thu, 5 Nov 2015 11:49:59 +0200 +Subject: [PATCH 06/26] drm/i915: quirk backlight present on Macbook 4, 1 + +Upstream commit 1b9448b071caa7d10bb2569fabe3020a2c25ae59 + +Unsurprisingly macbooks have backlights, just the VBT doesn't seem to +know it in this case. + +Reported-and-tested-by: Daniel Nicoletti <dantti12@gmail.com> +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=88325 +Fixes: c675949ec58c ("drm/i915: do not setup backlight if not available according to VBT") +Cc: stable@vger.kernel.org # v3.15+ +Reviewed-by: Ander Conselvan de Oliveira <conselvan2@gmail.com> +Signed-off-by: Jani Nikula <jani.nikula@intel.com> +Link: http://patchwork.freedesktop.org/patch/msgid/1446716999-1796-1-git-send-email-jani.nikula@intel.com +--- + drivers/gpu/drm/i915/intel_display.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index 8f258092cada..2e348788ecaa 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -14670,6 +14670,9 @@ static struct intel_quirk intel_quirks[] = { + /* Apple Macbook 2,1 (Core 2 T7400) */ + { 0x27a2, 0x8086, 0x7270, quirk_backlight_present }, + ++ /* Apple Macbook 4,1 */ ++ { 0x2a02, 0x106b, 0x00a1, quirk_backlight_present }, ++ + /* Toshiba CB35 Chromebook (Celeron 2955U) */ + { 0x0a06, 0x1179, 0x0a88, quirk_backlight_present }, + +-- +2.5.0 + + +From dddd84b8b5f7f8c0b0037a1bb53f81f5bc70115b Mon Sep 17 00:00:00 2001 +From: Imre Deak <imre.deak@intel.com> +Date: Wed, 4 Nov 2015 21:25:32 +0200 +Subject: [PATCH 07/26] drm/i915: get runtime PM reference around GEM + set_caching IOCTL + +Upstream commit fd0fe6acf1dd88aabfbf383f7e4c16315387a7b7 + +After Damien's D3 fix I started to get runtime suspend residency for the +first time and that revealed a breakage on the set_caching IOCTL path +that accesses the HW but doesn't take an RPM ref. Fix this up. + +Signed-off-by: Imre Deak <imre.deak@intel.com> +Reviewed-by: Paulo Zanoni <paulo.r.zanoni@intel.com> +Cc: stable@vger.kernel.org +Link: http://patchwork.freedesktop.org/patch/msgid/1446665132-22491-1-git-send-email-imre.deak@intel.com +Signed-off-by: Jani Nikula <jani.nikula@intel.com> +--- + drivers/gpu/drm/i915/i915_gem.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c +index 4d631a946481..dee065c2b6d8 100644 +--- a/drivers/gpu/drm/i915/i915_gem.c ++++ b/drivers/gpu/drm/i915/i915_gem.c +@@ -3728,6 +3728,7 @@ int i915_gem_get_caching_ioctl(struct drm_device *dev, void *data, + int i915_gem_set_caching_ioctl(struct drm_device *dev, void *data, + struct drm_file *file) + { ++ struct drm_i915_private *dev_priv = dev->dev_private; + struct drm_i915_gem_caching *args = data; + struct drm_i915_gem_object *obj; + enum i915_cache_level level; +@@ -3747,9 +3748,11 @@ int i915_gem_set_caching_ioctl(struct drm_device *dev, void *data, + return -EINVAL; + } + ++ intel_runtime_pm_get(dev_priv); ++ + ret = i915_mutex_lock_interruptible(dev); + if (ret) +- return ret; ++ goto rpm_put; + + obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle)); + if (&obj->base == NULL) { +@@ -3762,6 +3765,9 @@ int i915_gem_set_caching_ioctl(struct drm_device *dev, void *data, + drm_gem_object_unreference(&obj->base); + unlock: + mutex_unlock(&dev->struct_mutex); ++rpm_put: ++ intel_runtime_pm_put(dev_priv); ++ + return ret; + } + +-- +2.5.0 + + +From df79b28d6a73835c70222506405bdb54774395c9 Mon Sep 17 00:00:00 2001 +From: Maarten Lankhorst <maarten@mblankhorst.nl> +Date: Mon, 16 Nov 2015 12:49:14 +0100 +Subject: [PATCH 08/26] drm/i915: Clear intel_crtc->atomic before updating it. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Upstream commit ba8af3e592f7175b5f9a92d2cfcc00b82097d1be + +If an atomic update fails intel_crtc->atomic may have have some values left +from the last atomic check. One example is atomic->wait_for_vblank, +which results in spurious errors in kms_flip. + +[ 1551.892708] ------------[ cut here ]------------ +[ 1551.892721] WARNING: CPU: 3 PID: 4179 at ../drivers/gpu/drm/drm_irq.c:1199 drm_wait_one_vblank+0x197/0x1a0 [drm]() +[ 1551.892722] vblank not available on crtc 2, ret=-22 +[ 1551.892751] Modules linked in: snd_hda_intel i915 drm_kms_helper drm +intel_gtt i2c_algo_bit cfbfillrect syscopyarea cfbimgblt sysfillrect +sysimgblt fb_sys_fops cfbcopyarea agpgart cfg80211 binfmt_misc +snd_hda_codec_hdmi intel_rapl iosf_mbi x86_pkg_temp_thermal coretemp +kvm_intel snd_hda_codec_realtek kvm snd_hda_codec_generic iTCO_wdt +aesni_intel aes_x86_64 glue_helper lrw snd_hda_codec gf128mul +ablk_helper cryptd snd_hwdep psmouse snd_hda_core pcspkr snd_pcm +snd_timer snd lpc_ich i2c_i801 mfd_core soundcore wmi evdev [last +unloaded: drm] +[ 1551.892753] CPU: 3 PID: 4179 Comm: kms_pipe_crc_ba Tainted: G U W 4.3.0-reg+ #6 +[ 1551.892754] Hardware name: /DZ77BH-55K, BIOS BHZ7710H.86A.0100.2013.0517.0942 05/17/2013 +[ 1551.892758] ffffffffa03128d8 ffff8800cec73890 ffffffff812c0f3c ffff8800cec738d8 +[ 1551.892760] ffff8800cec738c8 ffffffff8104ff36 ffff880116ae2290 0000000000000002 +[ 1551.892762] ffff8800d39fcda0 ffff8800d038b4d0 ffff8800d42b5550 ffff8800cec73928 +[ 1551.892763] Call Trace: +[ 1551.892768] [<ffffffff812c0f3c>] dump_stack+0x4e/0x82 +[ 1551.892771] [<ffffffff8104ff36>] warn_slowpath_common+0x86/0xc0 +[ 1551.892773] [<ffffffff8104ffbc>] warn_slowpath_fmt+0x4c/0x50 +[ 1551.892781] [<ffffffffa02e6708>] ? drm_vblank_get+0x78/0xd0 [drm] +[ 1551.892787] [<ffffffffa02e6d47>] drm_wait_one_vblank+0x197/0x1a0 [drm] +[ 1551.892813] [<ffffffffa03d052f>] intel_post_plane_update+0xef/0x120 [i915] +[ 1551.892832] [<ffffffffa03d11d2>] intel_atomic_commit+0x4c2/0x1600 [i915] +[ 1551.892862] [<ffffffffa02ff0c7>] ? drm_atomic_check_only+0x147/0x5e0 [drm] +[ 1551.892872] [<ffffffffa02feeb7>] ? drm_atomic_add_affected_connectors+0x27/0xf0 [drm] +[ 1551.892881] [<ffffffffa02ff597>] drm_atomic_commit+0x37/0x60 [drm] +[ 1551.892887] [<ffffffffa034301a>] restore_fbdev_mode+0x28a/0x2c0 [drm_kms_helper] +[ 1551.892895] [<ffffffffa0345253>] drm_fb_helper_restore_fbdev_mode_unlocked+0x33/0x80 [drm_kms_helper] +[ 1551.892900] [<ffffffffa03452cd>] drm_fb_helper_set_par+0x2d/0x50 [drm_kms_helper] +[ 1551.892920] [<ffffffffa03e7a9a>] intel_fbdev_set_par+0x1a/0x60 [i915] +[ 1551.892923] [<ffffffff8131a5a7>] fb_set_var+0x1a7/0x3f0 +[ 1551.892927] [<ffffffff8109732f>] ? trace_hardirqs_on_caller+0x12f/0x1c0 +[ 1551.892931] [<ffffffff81314f32>] fbcon_blank+0x212/0x2f0 +[ 1551.892935] [<ffffffff81373f4a>] do_unblank_screen+0xba/0x1d0 +[ 1551.892937] [<ffffffff8136b725>] vt_ioctl+0x13d5/0x1450 +[ 1551.892940] [<ffffffff8107cdd1>] ? preempt_count_sub+0x41/0x50 +[ 1551.892943] [<ffffffff8135d8a3>] tty_ioctl+0x423/0xe30 +[ 1551.892947] [<ffffffff8119f721>] do_vfs_ioctl+0x301/0x560 +[ 1551.892949] [<ffffffff8119b1e3>] ? putname+0x53/0x60 +[ 1551.892952] [<ffffffff811ab376>] ? __fget_light+0x66/0x90 +[ 1551.892955] [<ffffffff8119f9f9>] SyS_ioctl+0x79/0x90 +[ 1551.892958] [<ffffffff81552e97>] entry_SYSCALL_64_fastpath+0x12/0x6f +[ 1551.892961] ---[ end trace 3e764d4b6628c91c ]--- + +Testcase: kms_flip +Reported-and-tested-by: Ville Syrjälä <ville.syrjala@linux.intel.com> +Cc: stable@vger.kernel.org #v4.3 +Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> +Reviewed-by: Daniel Stone <daniels@collabora.com> +Signed-off-by: Jani Nikula <jani.nikula@intel.com> +Link: http://patchwork.freedesktop.org/patch/msgid/5649C2BA.6080300@mblankhorst.nl +--- + drivers/gpu/drm/i915/intel_display.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index 2e348788ecaa..7e13bea3b4d5 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -13005,6 +13005,9 @@ static int intel_atomic_check(struct drm_device *dev, + struct intel_crtc_state *pipe_config = + to_intel_crtc_state(crtc_state); + ++ memset(&to_intel_crtc(crtc)->atomic, 0, ++ sizeof(struct intel_crtc_atomic_commit)); ++ + /* Catch I915_MODE_FLAG_INHERITED */ + if (crtc_state->mode.private_flags != crtc->state->mode.private_flags) + crtc_state->mode_changed = true; +-- +2.5.0 + + +From eb02e7a4b15ec47b50fd7447471ac3bb75cce53f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com> +Date: Wed, 11 Nov 2015 19:11:28 +0200 +Subject: [PATCH 09/26] drm/i915: Don't clobber the addfb2 ioctl params +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Upstream commit 76dc3769d7c3cdcfa7c4c7768a7cb87cd91af12f + +We try to convert the old way of of specifying fb tiling (obj->tiling) +into the new fb modifiers. We store the result in the passed in mode_cmd +structure. But that structure comes directly from the addfb2 ioctl, and +gets copied back out to userspace, which means we're clobbering the +modifiers that the user provided (all 0 since the DRM_MODE_FB_MODIFIERS +flag wasn't even set by the user). Hence if the user reuses the struct +for another addfb2, the ioctl will be rejected since it's now asking for +some modifiers w/o the flag set. + +Fix the problem by making a copy of the user provided structure. We can +play any games we want with the copy. + +IGT-Version: 1.12-git (x86_64) (Linux: 4.4.0-rc1-stereo+ x86_64) +... +Subtest basic-X-tiled: SUCCESS (0.001s) +Test assertion failure function pitch_tests, file kms_addfb_basic.c:167: +Failed assertion: drmIoctl(fd, DRM_IOCTL_MODE_ADDFB2, &f) == 0 +Last errno: 22, Invalid argument +Stack trace: + #0 [__igt_fail_assert+0x101] + #1 [pitch_tests+0x619] + #2 [__real_main426+0x2f] + #3 [main+0x23] + #4 [__libc_start_main+0xf0] + #5 [_start+0x29] + #6 [<unknown>+0x29] + Subtest framebuffer-vs-set-tiling failed. + **** DEBUG **** + Test assertion failure function pitch_tests, file kms_addfb_basic.c:167: + Failed assertion: drmIoctl(fd, DRM_IOCTL_MODE_ADDFB2, &f) == 0 + Last errno: 22, Invalid argument + **** END **** + Subtest framebuffer-vs-set-tiling: FAIL (0.003s) + ... + +IGT-Version: 1.12-git (x86_64) (Linux: 4.4.0-rc1-stereo+ x86_64) +Subtest framebuffer-vs-set-tiling: SUCCESS (0.000s) + +Cc: stable@vger.kernel.org # v4.1+ +Cc: Daniel Vetter <daniel.vetter@ffwll.ch> +Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com> +Fixes: 2a80eada326f ("drm/i915: Add fb format modifier support") +Testcase: igt/kms_addfb_basic/clobbered-modifier +Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> +Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> +Signed-off-by: Jani Nikula <jani.nikula@intel.com> +Link: http://patchwork.freedesktop.org/patch/msgid/1447261890-3960-1-git-send-email-ville.syrjala@linux.intel.com +--- + drivers/gpu/drm/i915/intel_display.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index 7e13bea3b4d5..d07d98aeb72c 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -14330,16 +14330,17 @@ static int intel_framebuffer_init(struct drm_device *dev, + static struct drm_framebuffer * + intel_user_framebuffer_create(struct drm_device *dev, + struct drm_file *filp, +- struct drm_mode_fb_cmd2 *mode_cmd) ++ struct drm_mode_fb_cmd2 *user_mode_cmd) + { + struct drm_i915_gem_object *obj; ++ struct drm_mode_fb_cmd2 mode_cmd = *user_mode_cmd; + + obj = to_intel_bo(drm_gem_object_lookup(dev, filp, +- mode_cmd->handles[0])); ++ mode_cmd.handles[0])); + if (&obj->base == NULL) + return ERR_PTR(-ENOENT); + +- return intel_framebuffer_create(dev, mode_cmd, obj); ++ return intel_framebuffer_create(dev, &mode_cmd, obj); + } + + #ifndef CONFIG_DRM_FBDEV_EMULATION +-- +2.5.0 + + +From 687b4f4810c6a23420994e9cf4bb2d420a80217d Mon Sep 17 00:00:00 2001 +From: Mika Kuoppala <mika.kuoppala@linux.intel.com> +Date: Tue, 17 Nov 2015 18:14:26 +0200 +Subject: [PATCH 10/26] drm/i915: Fix gpu frequency change tracing +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Upstream commit 0f94592efd36213c961145fe1ab0c3bc323ec053 + +With gen < 9 we have had always 50Mhz units as our hw +ratio. With gen >= 9 the hw ratio changed to 16.667Mhz (50/3). +The result was that our gpu frequency tracing started to output +values 3 times larger than expected due to hardcoded scaling +value. Fix this by using Use intel_gpu_freq() when generating Mhz +value from ratio for 'intel_gpu_freq_change' trace event. + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92591 +Cc: stable@vger.kernel.org # v4.3+ +Reported-by: Eero Tamminen <eero.t.tamminen@intel.com> +Signed-off-by: Mika Kuoppala <mika.kuoppala@intel.com> +Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> +Signed-off-by: Jani Nikula <jani.nikula@intel.com> +Link: http://patchwork.freedesktop.org/patch/msgid/1447776866-29384-1-git-send-email-mika.kuoppala@intel.com +--- + drivers/gpu/drm/i915/intel_pm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c +index 5e91e795fd99..2a689522cd89 100644 +--- a/drivers/gpu/drm/i915/intel_pm.c ++++ b/drivers/gpu/drm/i915/intel_pm.c +@@ -4503,7 +4503,7 @@ static void gen6_set_rps(struct drm_device *dev, u8 val) + POSTING_READ(GEN6_RPNSWREQ); + + dev_priv->rps.cur_freq = val; +- trace_intel_gpu_freq_change(val * 50); ++ trace_intel_gpu_freq_change(intel_gpu_freq(dev_priv, val)); + } + + static void valleyview_set_rps(struct drm_device *dev, u8 val) +-- +2.5.0 + + +From efee83c75bf454e745ebaddd96b9fe741c706317 Mon Sep 17 00:00:00 2001 +From: Chris Wilson <chris@chris-wilson.co.uk> +Date: Thu, 19 Nov 2015 09:58:05 +0000 +Subject: [PATCH 11/26] drm/i915: Mark uneven memory banks on gen4 desktop as + unknown swizzling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Upstream commit 0b466dc238cb660bbdb9ef6e121e1757057484c3 + +We have varied reports of swizzling corruption on gen4 desktop, and +confirmation that one at least is triggered by uneven memory banks +(L-shaped memory). The implication is that the swizzling varies between +the paired channels and the remainder of memory on the single channel. As +the object then has unpredictable swizzling (it will vary depending on +exact page allocation and may even change during the object's lifetime as +the pages are replaced), we have to report to userspace that the swizzling +is unknown. + +However, some existing userspace is buggy when it meets an unknown +swizzling configuration and so we need to tell another white lie and +mark the swizzling as NONE but report it as UNKNOWN through the extended +get-tiling-ioctl. See + +commit 5eb3e5a5e11d14f9deb2a4b83555443b69ab9940 +Author: Chris Wilson <chris@chris-wilson.co.uk> +Date: Sun Jun 28 09:19:26 2015 +0100 + + drm/i915: Declare the swizzling unknown for L-shaped configurations + +for the previous example where we found that telling the truth to +userspace just ends up in a world of hurt. + +Also since we don't truly know what the swizzling is on the pages, we +need to keep them pinned to prevent swapping as the reports also +suggest that some gen4 devices have previously undetected bit17 +swizzling. + +v2: Combine unknown + quirk patches to prevent userspace ever seeing +unknown swizzling through the normal get-tiling-ioctl. Also use the same +path for the existing uneven bank detection for mobile gen4. + +Reported-by: Matti Hämäläinen <ccr@tnsp.org> +Tested-by: Matti Hämäläinen <ccr@tnsp.org> +References: https://bugs.freedesktop.org/show_bug.cgi?id=90725 +Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> +Cc: Matti Hämäläinen <ccr@tnsp.org> +Cc: Daniel Vetter <daniel.vetter@ffwll.ch> +Cc: Jani Nikula <jani.nikula@intel.com> +Cc: stable@vger.kernel.org +Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> +Link: http://patchwork.freedesktop.org/patch/msgid/1447927085-31726-1-git-send-email-chris@chris-wilson.co.uk +Signed-off-by: Jani Nikula <jani.nikula@intel.com> +--- + drivers/gpu/drm/i915/i915_gem_fence.c | 36 ++++++++++++++++++++++++++--------- + 1 file changed, 27 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/i915/i915_gem_fence.c b/drivers/gpu/drm/i915/i915_gem_fence.c +index af1f8c461060..716c3d8f027c 100644 +--- a/drivers/gpu/drm/i915/i915_gem_fence.c ++++ b/drivers/gpu/drm/i915/i915_gem_fence.c +@@ -647,11 +647,10 @@ i915_gem_detect_bit_6_swizzle(struct drm_device *dev) + } + + /* check for L-shaped memory aka modified enhanced addressing */ +- if (IS_GEN4(dev)) { +- uint32_t ddc2 = I915_READ(DCC2); +- +- if (!(ddc2 & DCC2_MODIFIED_ENHANCED_DISABLE)) +- dev_priv->quirks |= QUIRK_PIN_SWIZZLED_PAGES; ++ if (IS_GEN4(dev) && ++ !(I915_READ(DCC2) & DCC2_MODIFIED_ENHANCED_DISABLE)) { ++ swizzle_x = I915_BIT_6_SWIZZLE_UNKNOWN; ++ swizzle_y = I915_BIT_6_SWIZZLE_UNKNOWN; + } + + if (dcc == 0xffffffff) { +@@ -680,16 +679,35 @@ i915_gem_detect_bit_6_swizzle(struct drm_device *dev) + * matching, which was the case for the swizzling required in + * the table above, or from the 1-ch value being less than + * the minimum size of a rank. ++ * ++ * Reports indicate that the swizzling actually ++ * varies depending upon page placement inside the ++ * channels, i.e. we see swizzled pages where the ++ * banks of memory are paired and unswizzled on the ++ * uneven portion, so leave that as unknown. + */ +- if (I915_READ16(C0DRB3) != I915_READ16(C1DRB3)) { +- swizzle_x = I915_BIT_6_SWIZZLE_NONE; +- swizzle_y = I915_BIT_6_SWIZZLE_NONE; +- } else { ++ if (I915_READ16(C0DRB3) == I915_READ16(C1DRB3)) { + swizzle_x = I915_BIT_6_SWIZZLE_9_10; + swizzle_y = I915_BIT_6_SWIZZLE_9; + } + } + ++ if (swizzle_x == I915_BIT_6_SWIZZLE_UNKNOWN || ++ swizzle_y == I915_BIT_6_SWIZZLE_UNKNOWN) { ++ /* Userspace likes to explode if it sees unknown swizzling, ++ * so lie. We will finish the lie when reporting through ++ * the get-tiling-ioctl by reporting the physical swizzle ++ * mode as unknown instead. ++ * ++ * As we don't strictly know what the swizzling is, it may be ++ * bit17 dependent, and so we need to also prevent the pages ++ * from being moved. ++ */ ++ dev_priv->quirks |= QUIRK_PIN_SWIZZLED_PAGES; ++ swizzle_x = I915_BIT_6_SWIZZLE_NONE; ++ swizzle_y = I915_BIT_6_SWIZZLE_NONE; ++ } ++ + dev_priv->mm.bit_6_swizzle_x = swizzle_x; + dev_priv->mm.bit_6_swizzle_y = swizzle_y; + } +-- +2.5.0 + + +From b9aa6e409916793c7b2c6302df80f9a8c36ddcf2 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai <tiwai@suse.de> +Date: Wed, 25 Nov 2015 15:26:47 +0100 +Subject: [PATCH 12/26] drm/i915: Don't compare has_drrs strictly in pipe + config + +Upstream commit 13b13dfaaa39ab52b0f433c6744f4638793cbf7b + +The commit [cfb23ed622d0: drm/i915: Allow fuzzy matching in +pipe_config_compare, v2] relaxed the way to compare the pipe +configurations, but one new comparison sneaked in there: it added the +strict has_drrs value check. This causes a regression on many +machines, typically HP laptops with a docking port, where the kernel +spews warnings and eventually fails to set the mode properly like: + [drm:intel_pipe_config_compare [i915]] *ERROR* mismatch in has_drrs (expected 1, found 0) + ------------[ cut here ]------------ + WARNING: CPU: 0 PID: 79 at drivers/gpu/drm/i915/intel_display.c:12700 intel_modeset_check_state+0x5aa/0x870 [i915]() + pipe state doesn't match! + .... + +This patch just removes the check again for fixing the regression. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=104041 +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92456 +Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=956397 +Fixes: cfb23ed622d0 ('drm/i915: Allow fuzzy matching in pipe_config_compare, v2') +Cc: <stable@vger.kernel.org> # v4.3+ +Reported-and-tested-by: Max Lin <mlin@suse.com> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> +Link: http://patchwork.freedesktop.org/patch/msgid/1448461607-16868-1-git-send-email-tiwai@suse.de +Signed-off-by: Jani Nikula <jani.nikula@intel.com> +--- + drivers/gpu/drm/i915/intel_display.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index d07d98aeb72c..58e08fb47d1f 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -12427,7 +12427,6 @@ intel_pipe_config_compare(struct drm_device *dev, + if (INTEL_INFO(dev)->gen < 8) { + PIPE_CONF_CHECK_M_N(dp_m_n); + +- PIPE_CONF_CHECK_I(has_drrs); + if (current_config->has_drrs) + PIPE_CONF_CHECK_M_N(dp_m2_n2); + } else +-- +2.5.0 + + +From 17e09098ed89ccc44a9420b0eee361b2e4f1f58c Mon Sep 17 00:00:00 2001 +From: Takashi Iwai <tiwai@suse.de> +Date: Thu, 19 Nov 2015 12:09:56 +0100 +Subject: [PATCH 13/26] drm/i915: Don't override output type for DDI HDMI + +Upstream commit 2540058f7a9d9a843b4d9a28d4f8168dd034d030 + +Currently a DDI port may register the DP hotplug handler even though +it's used with HDMI, and the DP HPD handler overrides the encoder +type forcibly to DP. This caused the inconsistency on a machine +connected with a HDMI monitor; upon a hotplug event, the DDI port is +suddenly switched to be handled as a DP although the same monitor is +kept connected, and this leads to the erroneous blank output. + +This patch papers over the bug by excluding the previous HDMI encoder +type from this override. This should be fixed more fundamentally, +e.g. by moving the encoder type reset from the HPD or by having +individual encoder objects for HDMI and DP. But since the bug has +been present for a long time (3.17), it's better to have a +quick-n-dirty fix for now, and keep working on a cleaner fix. + +Bugzilla: http://bugzilla.opensuse.org/show_bug.cgi?id=955190 +Fixes: 0e32b39ceed6 ('drm/i915: add DP 1.2 MST support (v0.7)') +Cc: <stable@vger.kernel.org> # v3.17+ +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> +Link: http://patchwork.freedesktop.org/patch/msgid/1447931396-19147-1-git-send-email-tiwai@suse.de +Signed-off-by: Jani Nikula <jani.nikula@intel.com> +--- + drivers/gpu/drm/i915/intel_dp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c +index 0a2e33fbf20d..a7b7a64d8d27 100644 +--- a/drivers/gpu/drm/i915/intel_dp.c ++++ b/drivers/gpu/drm/i915/intel_dp.c +@@ -4921,7 +4921,8 @@ intel_dp_hpd_pulse(struct intel_digital_port *intel_dig_port, bool long_hpd) + enum intel_display_power_domain power_domain; + enum irqreturn ret = IRQ_NONE; + +- if (intel_dig_port->base.type != INTEL_OUTPUT_EDP) ++ if (intel_dig_port->base.type != INTEL_OUTPUT_EDP && ++ intel_dig_port->base.type != INTEL_OUTPUT_HDMI) + intel_dig_port->base.type = INTEL_OUTPUT_DISPLAYPORT; + + if (long_hpd && intel_dig_port->base.type == INTEL_OUTPUT_EDP) { +-- +2.5.0 + + +From 5cbff55f4355dc1cec8124c8741fdfd98f644c73 Mon Sep 17 00:00:00 2001 +From: Sagar Arun Kamble <sagar.a.kamble@intel.com> +Date: Sat, 12 Sep 2015 10:17:50 +0530 +Subject: [PATCH 14/26] drm/i915: Add IS_SKL_GT3 and IS_SKL_GT4 macro. + +Upstream commit 7a58bad0e63295dfa803973efcebc80cb730c7bd + +It will be usefull to specify w/a that affects only SKL GT3 and GT4. + +Signed-off-by: Sagar Arun Kamble <sagar.a.kamble@intel.com> +Reviewed-by: Alex Dai <yu.dai@intel.com> +Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> +--- + drivers/gpu/drm/i915/i915_drv.h | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h +index e1db8de52851..3c16f6237251 100644 +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -2475,6 +2475,11 @@ struct drm_i915_cmd_table { + #define IS_SKL_ULX(dev) (INTEL_DEVID(dev) == 0x190E || \ + INTEL_DEVID(dev) == 0x1915 || \ + INTEL_DEVID(dev) == 0x191E) ++#define IS_SKL_GT3(dev) (IS_SKYLAKE(dev) && \ ++ (INTEL_DEVID(dev) & 0x00F0) == 0x0020) ++#define IS_SKL_GT4(dev) (IS_SKYLAKE(dev) && \ ++ (INTEL_DEVID(dev) & 0x00F0) == 0x0030) ++ + #define IS_PRELIMINARY_HW(intel_info) ((intel_info)->is_preliminary) + + #define SKL_REVID_A0 (0x0) +-- +2.5.0 + + +From baed978880f2c32e82587cc514227aad82daecd5 Mon Sep 17 00:00:00 2001 +From: Arun Siluvery <arun.siluvery@linux.intel.com> +Date: Fri, 18 Sep 2015 17:52:47 +0100 +Subject: [PATCH 15/26] drm/i915/bxt: Update revision id for BXT C0 + +Upstream commit 5ca4163a612068d8f942c454218d3d631f22af1b + +Cc: Nick Hoath <nicholas.hoath@intel.com> +Cc: Imre Deak <imre.deak@intel.com> +Signed-off-by: Arun Siluvery <arun.siluvery@linux.intel.com> +Reviewed-by: Imre Deak <imre.deak@intel.com> +Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> +--- + drivers/gpu/drm/i915/i915_drv.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h +index 3c16f6237251..475b03e9d584 100644 +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -2491,7 +2491,7 @@ struct drm_i915_cmd_table { + + #define BXT_REVID_A0 (0x0) + #define BXT_REVID_B0 (0x3) +-#define BXT_REVID_C0 (0x6) ++#define BXT_REVID_C0 (0x9) + + /* + * The genX designation typically refers to the render engine, so render +-- +2.5.0 + + +From c80bd95bfeb85ce970c5f7711718a274e4b38b55 Mon Sep 17 00:00:00 2001 +From: Sagar Arun Kamble <sagar.a.kamble@intel.com> +Date: Sat, 12 Sep 2015 10:17:51 +0530 +Subject: [PATCH 16/26] drm/i915: WaRsDisableCoarsePowerGating + +Upstream commit f2d2fe95072acd5404f8051b8bf1195c61a47fb5 + +WaRsDisableCoarsePowerGating: Coarse Power Gating (CPG) needs to be +disabled for platforms prior to BXT B0 and SKL GT3/GT4 till E0. + +v2: Added GT3/GT4 Check. + +Change-Id: Ia3c4c16e050c88d3e259f601054875c812d69c3a +Signed-off-by: Sagar Arun Kamble <sagar.a.kamble@intel.com> +Reviewed-by: Alex Dai <yu.dai@intel.com> +[danvet: Align continuation properly.] +Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> +--- + drivers/gpu/drm/i915/intel_pm.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c +index 2a689522cd89..56a5568ffeb7 100644 +--- a/drivers/gpu/drm/i915/intel_pm.c ++++ b/drivers/gpu/drm/i915/intel_pm.c +@@ -4851,11 +4851,14 @@ static void gen9_enable_rc6(struct drm_device *dev) + + /* + * 3b: Enable Coarse Power Gating only when RC6 is enabled. +- * WaDisableRenderPowerGating:skl,bxt - Render PG need to be disabled with RC6. ++ * WaRsDisableCoarsePowerGating:skl,bxt - Render/Media PG need to be disabled with RC6. + */ +- I915_WRITE(GEN9_PG_ENABLE, (rc6_mask & GEN6_RC_CTL_RC6_ENABLE) ? +- GEN9_MEDIA_PG_ENABLE : 0); +- ++ if ((IS_BROXTON(dev) && (INTEL_REVID(dev) < BXT_REVID_B0)) || ++ ((IS_SKL_GT3(dev) || IS_SKL_GT4(dev)) && (INTEL_REVID(dev) <= SKL_REVID_E0))) ++ I915_WRITE(GEN9_PG_ENABLE, 0); ++ else ++ I915_WRITE(GEN9_PG_ENABLE, (rc6_mask & GEN6_RC_CTL_RC6_ENABLE) ? ++ (GEN9_RENDER_PG_ENABLE | GEN9_MEDIA_PG_ENABLE) : 0); + + intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL); + +-- +2.5.0 + + +From c6b1dd5d44c09a9c0032066415ccf8539efb5856 Mon Sep 17 00:00:00 2001 +From: Sagar Arun Kamble <sagar.a.kamble@intel.com> +Date: Sat, 12 Sep 2015 10:17:52 +0530 +Subject: [PATCH 17/26] drm/i915: WaRsUseTimeoutMode + +Upstream commit e3429cd240b06c79df3ea90f28065a7e011744cd + +Enable TO mode for RC6 for SKL till D0 and BXT till A0. + +Cc: Tom O'Rourke <Tom.O'Rourke@intel.com> +Cc: Akash Goel <akash.goel@intel.com> +Signed-off-by: Sagar Arun Kamble <sagar.a.kamble@intel.com> +Reviewed-by: Alex Dai <yu.dai@intel.com> +[danvet: Fixup line continuation alignment.] +Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> +--- + drivers/gpu/drm/i915/intel_pm.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c +index 56a5568ffeb7..ab54c645c2ee 100644 +--- a/drivers/gpu/drm/i915/intel_pm.c ++++ b/drivers/gpu/drm/i915/intel_pm.c +@@ -4845,9 +4845,16 @@ static void gen9_enable_rc6(struct drm_device *dev) + rc6_mask = GEN6_RC_CTL_RC6_ENABLE; + DRM_INFO("RC6 %s\n", (rc6_mask & GEN6_RC_CTL_RC6_ENABLE) ? + "on" : "off"); +- I915_WRITE(GEN6_RC_CONTROL, GEN6_RC_CTL_HW_ENABLE | +- GEN6_RC_CTL_EI_MODE(1) | +- rc6_mask); ++ ++ if ((IS_SKYLAKE(dev) && INTEL_REVID(dev) <= SKL_REVID_D0) || ++ (IS_BROXTON(dev) && INTEL_REVID(dev) <= BXT_REVID_A0)) ++ I915_WRITE(GEN6_RC_CONTROL, GEN6_RC_CTL_HW_ENABLE | ++ GEN7_RC_CTL_TO_MODE | ++ rc6_mask); ++ else ++ I915_WRITE(GEN6_RC_CONTROL, GEN6_RC_CTL_HW_ENABLE | ++ GEN6_RC_CTL_EI_MODE(1) | ++ rc6_mask); + + /* + * 3b: Enable Coarse Power Gating only when RC6 is enabled. +-- +2.5.0 + + +From a7af36dfaaa2136be0454787130f73d207c2f34d Mon Sep 17 00:00:00 2001 +From: Sagar Arun Kamble <sagar.a.kamble@intel.com> +Date: Sat, 12 Sep 2015 10:17:53 +0530 +Subject: [PATCH 18/26] drm/i915: WaRsDoubleRc6WrlWithCoarsePowerGating + +Upstream commit 63a4dec2c168b74a39df1eac494501f0f6bf3708 + +Cc: Tom O'Rourke <Tom.O'Rourke@intel.com> +Cc: Akash Goel <akash.goel@intel.com> +Signed-off-by: Sagar Arun Kamble <sagar.a.kamble@intel.com> +Reviewed-by: Alex Dai <yu.dai@intel.com> +[danvet: Fix continuation alignment.] +Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> +--- + drivers/gpu/drm/i915/intel_pm.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c +index ab54c645c2ee..7c7b6386121f 100644 +--- a/drivers/gpu/drm/i915/intel_pm.c ++++ b/drivers/gpu/drm/i915/intel_pm.c +@@ -4828,7 +4828,13 @@ static void gen9_enable_rc6(struct drm_device *dev) + I915_WRITE(GEN6_RC_CONTROL, 0); + + /* 2b: Program RC6 thresholds.*/ +- I915_WRITE(GEN6_RC6_WAKE_RATE_LIMIT, 54 << 16); ++ ++ /* WaRsDoubleRc6WrlWithCoarsePowerGating: Doubling WRL only when CPG is enabled */ ++ if (IS_SKYLAKE(dev) && !((IS_SKL_GT3(dev) || IS_SKL_GT4(dev)) && ++ (INTEL_REVID(dev) <= SKL_REVID_E0))) ++ I915_WRITE(GEN6_RC6_WAKE_RATE_LIMIT, 108 << 16); ++ else ++ I915_WRITE(GEN6_RC6_WAKE_RATE_LIMIT, 54 << 16); + I915_WRITE(GEN6_RC_EVALUATION_INTERVAL, 125000); /* 12500 * 1280ns */ + I915_WRITE(GEN6_RC_IDLE_HYSTERSIS, 25); /* 25 * 1280ns */ + for_each_ring(ring, dev_priv, unused) +-- +2.5.0 + + +From b925cfd49203fc37c491fa28310221be23a2634d Mon Sep 17 00:00:00 2001 +From: Mika Kuoppala <mika.kuoppala@linux.intel.com> +Date: Mon, 7 Dec 2015 18:29:44 +0200 +Subject: [PATCH 19/26] drm/i915/skl: Disable coarse power gating up until F0 + +Upstream commit 344df9809f4521c8c11d67c5ef18764b54358950 + +There is conflicting info between E0 and F0 steppings +for this workarounds. Trust more authoritative source and +be conservative and extend also for F0. + +This prevents numerous (>50) gpu hangs with SKL GT4e +during piglit run. + +References: HSD: gen9lp/2134184 +Cc: Sagar Arun Kamble <sagar.a.kamble@intel.com> +Signed-off-by: Mika Kuoppala <mika.kuoppala@intel.com> +Reviewed-by: Sagar Arun Kamble <sagar.a.kamble@intel.com> +Link: http://patchwork.freedesktop.org/patch/msgid/1449505785-20812-1-git-send-email-mika.kuoppala@intel.com +(cherry picked from commit 6686ece19f7446f0e29c77d9e0402e1d0ce10c48) +Cc: stable@vger.kernel.org # v4.3+ +Signed-off-by: Jani Nikula <jani.nikula@intel.com> +--- + drivers/gpu/drm/i915/intel_pm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c +index 7c7b6386121f..d04f123f4ccf 100644 +--- a/drivers/gpu/drm/i915/intel_pm.c ++++ b/drivers/gpu/drm/i915/intel_pm.c +@@ -4867,7 +4867,7 @@ static void gen9_enable_rc6(struct drm_device *dev) + * WaRsDisableCoarsePowerGating:skl,bxt - Render/Media PG need to be disabled with RC6. + */ + if ((IS_BROXTON(dev) && (INTEL_REVID(dev) < BXT_REVID_B0)) || +- ((IS_SKL_GT3(dev) || IS_SKL_GT4(dev)) && (INTEL_REVID(dev) <= SKL_REVID_E0))) ++ ((IS_SKL_GT3(dev) || IS_SKL_GT4(dev)) && (INTEL_REVID(dev) <= SKL_REVID_F0))) + I915_WRITE(GEN9_PG_ENABLE, 0); + else + I915_WRITE(GEN9_PG_ENABLE, (rc6_mask & GEN6_RC_CTL_RC6_ENABLE) ? +-- +2.5.0 + + +From 302e759f64e1c4bed49f31459329acbb2cddce8a Mon Sep 17 00:00:00 2001 +From: Mika Kuoppala <mika.kuoppala@linux.intel.com> +Date: Mon, 7 Dec 2015 18:29:45 +0200 +Subject: [PATCH 20/26] drm/i915/skl: Double RC6 WRL always on + +Upstream commit 6704d45528537ea6088aeea0667d87b605b82d51 + +WaRsDoubleRc6WrlWithCoarsePowerGating should +be enabled for all Skylakes. Make it so. + +Cc: Sagar Arun Kamble <sagar.a.kamble@intel.com> +Signed-off-by: Mika Kuoppala <mika.kuoppala@intel.com> +Reviewed-by: Sagar Arun Kamble <sagar.a.kamble@intel.com> +Link: http://patchwork.freedesktop.org/patch/msgid/1449505785-20812-2-git-send-email-mika.kuoppala@intel.com +(cherry picked from commit e7674b8c31717dd0c58b3a9493d43249722071eb) +Cc: stable@vger.kernel.org # v4.3+ +Signed-off-by: Jani Nikula <jani.nikula@intel.com> +--- + drivers/gpu/drm/i915/intel_pm.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c +index d04f123f4ccf..33db474fae02 100644 +--- a/drivers/gpu/drm/i915/intel_pm.c ++++ b/drivers/gpu/drm/i915/intel_pm.c +@@ -4830,8 +4830,7 @@ static void gen9_enable_rc6(struct drm_device *dev) + /* 2b: Program RC6 thresholds.*/ + + /* WaRsDoubleRc6WrlWithCoarsePowerGating: Doubling WRL only when CPG is enabled */ +- if (IS_SKYLAKE(dev) && !((IS_SKL_GT3(dev) || IS_SKL_GT4(dev)) && +- (INTEL_REVID(dev) <= SKL_REVID_E0))) ++ if (IS_SKYLAKE(dev)) + I915_WRITE(GEN6_RC6_WAKE_RATE_LIMIT, 108 << 16); + else + I915_WRITE(GEN6_RC6_WAKE_RATE_LIMIT, 54 << 16); +-- +2.5.0 + + +From c4c390176eaf6b4321c1f90065107711845e9aff Mon Sep 17 00:00:00 2001 +From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> +Date: Mon, 23 Nov 2015 10:25:28 +0100 +Subject: [PATCH 21/26] drm/i915: Do a better job at disabling primary plane in + the noatomic case. + +Upstream commit 634b3a4a476e96816d5d6cd5bb9f8900a53f56ba + +When disable_noatomic is called plane_mask is not correct yet, and +plane_state->visible = true is left as true after disabling the primary +plane. + +Other planes are already disabled as part of crtc sanitization, only the +primary is left active. But the plane_mask is not updated here. It gets +updated during fb takeover in modeset_gem_init, or set to the new value +on resume. + +This means that to disable the primary plane 1 << drm_plane_index(primary) +needs to be used. + +Afterwards because the crtc is no longer active it's forbidden to keep +plane_state->visible set, or a WARN_ON in +intel_plane_atomic_calc_changes triggers. There are other code points +that rely on accurate plane_state->visible too, so make sure the bool is +cleared. + +The other planes are already disabled in intel_sanitize_crtc, so they +don't have to be handled here. + +Cc: stable@vger.kernel.org #v4.3, v4.2? +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92655 +Tested-by: Tomas Mezzadra <tmezzadra@gmail.com> +Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> +Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> +Link: http://patchwork.freedesktop.org/patch/msgid/5652DB88.9070208@linux.intel.com +(cherry picked from commit 54a4196188eab82e6f0a5f05716626e9f18b8fb6) +Signed-off-by: Jani Nikula <jani.nikula@intel.com> +--- + drivers/gpu/drm/i915/intel_display.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index 58e08fb47d1f..35fad110cc26 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -6225,9 +6225,11 @@ static void intel_crtc_disable_noatomic(struct drm_crtc *crtc) + if (to_intel_plane_state(crtc->primary->state)->visible) { + intel_crtc_wait_for_pending_flips(crtc); + intel_pre_disable_primary(crtc); ++ ++ intel_crtc_disable_planes(crtc, 1 << drm_plane_index(crtc->primary)); ++ to_intel_plane_state(crtc->primary->state)->visible = false; + } + +- intel_crtc_disable_planes(crtc, crtc->state->plane_mask); + dev_priv->display.crtc_disable(crtc); + intel_disable_shared_dpll(intel_crtc); + +-- +2.5.0 + + +From 42ab5c413c7cf61fab4b2fbce9cb4ab7f7be6356 Mon Sep 17 00:00:00 2001 +From: Chris Wilson <chris@chris-wilson.co.uk> +Date: Fri, 11 Dec 2015 11:32:57 +0000 +Subject: [PATCH 22/26] drm/i915: Break busywaiting for requests on pending + signals + +Upstream commit e7571f7fd66c77a760338340adbe41d994fe93ac + +The busywait in __i915_spin_request() does not respect pending signals +and so may consume the entire timeslice for the task instead of +returning to userspace to handle the signal. + +In the worst case this could cause a delay in signal processing of 20ms, +which would be a noticeable jitter in cursor tracking. If a higher +resolution signal was being used, for example to provide fairness of a +server timeslices between clients, we could expect to detect some +unfairness between clients (i.e. some windows not updating as fast as +others). This issue was noticed when inspecting a report of poor +interactivity resulting from excessively high __i915_spin_request usage. + +Fixes regression from +commit 2def4ad99befa25775dd2f714fdd4d92faec6e34 [v4.2] +Author: Chris Wilson <chris@chris-wilson.co.uk> +Date: Tue Apr 7 16:20:41 2015 +0100 + + drm/i915: Optimistically spin for the request completion + +v2: Try to assess the impact of the bug + +Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> +Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com> +Cc: Jens Axboe <axboe@kernel.dk> +Cc; "Rogozhkin, Dmitry V" <dmitry.v.rogozhkin@intel.com> +Cc: Daniel Vetter <daniel.vetter@ffwll.ch> +Cc: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com> +Cc: Eero Tamminen <eero.t.tamminen@intel.com> +Cc: "Rantala, Valtteri" <valtteri.rantala@intel.com> +Cc: stable@vger.kernel.org +Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> +Link: http://patchwork.freedesktop.org/patch/msgid/1449833608-22125-2-git-send-email-chris@chris-wilson.co.uk +(cherry picked from commit 91b0c352ace9afec1fb51590c7b8bd60e0eb9fbd) +Signed-off-by: Jani Nikula <jani.nikula@intel.com> +--- + drivers/gpu/drm/i915/i915_gem.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c +index dee065c2b6d8..c6e3ab72882f 100644 +--- a/drivers/gpu/drm/i915/i915_gem.c ++++ b/drivers/gpu/drm/i915/i915_gem.c +@@ -1144,7 +1144,7 @@ static bool missed_irq(struct drm_i915_private *dev_priv, + return test_bit(ring->id, &dev_priv->gpu_error.missed_irq_rings); + } + +-static int __i915_spin_request(struct drm_i915_gem_request *req) ++static int __i915_spin_request(struct drm_i915_gem_request *req, int state) + { + unsigned long timeout; + +@@ -1156,6 +1156,9 @@ static int __i915_spin_request(struct drm_i915_gem_request *req) + if (i915_gem_request_completed(req, true)) + return 0; + ++ if (signal_pending_state(state, current)) ++ break; ++ + if (time_after_eq(jiffies, timeout)) + break; + +@@ -1195,6 +1198,7 @@ int __i915_wait_request(struct drm_i915_gem_request *req, + struct drm_i915_private *dev_priv = dev->dev_private; + const bool irq_test_in_progress = + ACCESS_ONCE(dev_priv->gpu_error.test_irq_rings) & intel_ring_flag(ring); ++ int state = interruptible ? TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE; + DEFINE_WAIT(wait); + unsigned long timeout_expire; + s64 before, now; +@@ -1219,7 +1223,7 @@ int __i915_wait_request(struct drm_i915_gem_request *req, + before = ktime_get_raw_ns(); + + /* Optimistic spin for the next jiffie before touching IRQs */ +- ret = __i915_spin_request(req); ++ ret = __i915_spin_request(req, state); + if (ret == 0) + goto out; + +@@ -1231,8 +1235,7 @@ int __i915_wait_request(struct drm_i915_gem_request *req, + for (;;) { + struct timer_list timer; + +- prepare_to_wait(&ring->irq_queue, &wait, +- interruptible ? TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE); ++ prepare_to_wait(&ring->irq_queue, &wait, state); + + /* We need to check whether any gpu reset happened in between + * the caller grabbing the seqno and now ... */ +@@ -1250,7 +1253,7 @@ int __i915_wait_request(struct drm_i915_gem_request *req, + break; + } + +- if (interruptible && signal_pending(current)) { ++ if (signal_pending_state(state, current)) { + ret = -ERESTARTSYS; + break; + } +-- +2.5.0 + + +From 8cbf415a2aadd85cf9dfab28296a821ffea96d87 Mon Sep 17 00:00:00 2001 +From: Chris Wilson <chris@chris-wilson.co.uk> +Date: Fri, 11 Dec 2015 11:32:58 +0000 +Subject: [PATCH 23/26] drm/i915: Limit the busy wait on requests to 5us not + 10ms! + +Upstream commit f87a780f07b22b6dc4642dbaf44af65112076cb8 + +When waiting for high frequency requests, the finite amount of time +required to set up the irq and wait upon it limits the response rate. By +busywaiting on the request completion for a short while we can service +the high frequency waits as quick as possible. However, if it is a slow +request, we want to sleep as quickly as possible. The tradeoff between +waiting and sleeping is roughly the time it takes to sleep on a request, +on the order of a microsecond. Based on measurements of synchronous +workloads from across big core and little atom, I have set the limit for +busywaiting as 10 microseconds. In most of the synchronous cases, we can +reduce the limit down to as little as 2 miscroseconds, but that leaves +quite a few test cases regressing by factors of 3 and more. + +The code currently uses the jiffie clock, but that is far too coarse (on +the order of 10 milliseconds) and results in poor interactivity as the +CPU ends up being hogged by slow requests. To get microsecond resolution +we need to use a high resolution timer. The cheapest of which is polling +local_clock(), but that is only valid on the same CPU. If we switch CPUs +because the task was preempted, we can also use that as an indicator that + the system is too busy to waste cycles on spinning and we should sleep +instead. + +__i915_spin_request was introduced in +commit 2def4ad99befa25775dd2f714fdd4d92faec6e34 [v4.2] +Author: Chris Wilson <chris@chris-wilson.co.uk> +Date: Tue Apr 7 16:20:41 2015 +0100 + + drm/i915: Optimistically spin for the request completion + +v2: Drop full u64 for unsigned long - the timer is 32bit wraparound safe, +so we can use native register sizes on smaller architectures. Mention +the approximate microseconds units for elapsed time and add some extra +comments describing the reason for busywaiting. + +v3: Raise the limit to 10us +v4: Now 5us. + +Reported-by: Jens Axboe <axboe@kernel.dk> +Link: https://lkml.org/lkml/2015/11/12/621 +Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com> +Cc: "Rogozhkin, Dmitry V" <dmitry.v.rogozhkin@intel.com> +Cc: Daniel Vetter <daniel.vetter@ffwll.ch> +Cc: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com> +Cc: Eero Tamminen <eero.t.tamminen@intel.com> +Cc: "Rantala, Valtteri" <valtteri.rantala@intel.com> +Cc: stable@vger.kernel.org +Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> +Link: http://patchwork.freedesktop.org/patch/msgid/1449833608-22125-3-git-send-email-chris@chris-wilson.co.uk +(cherry picked from commit ca5b721e238226af1d767103ac852aeb8e4c0764) +Signed-off-by: Jani Nikula <jani.nikula@intel.com> +--- + drivers/gpu/drm/i915/i915_gem.c | 47 +++++++++++++++++++++++++++++++++++++++-- + 1 file changed, 45 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c +index c6e3ab72882f..205316d056f1 100644 +--- a/drivers/gpu/drm/i915/i915_gem.c ++++ b/drivers/gpu/drm/i915/i915_gem.c +@@ -1144,14 +1144,57 @@ static bool missed_irq(struct drm_i915_private *dev_priv, + return test_bit(ring->id, &dev_priv->gpu_error.missed_irq_rings); + } + ++static unsigned long local_clock_us(unsigned *cpu) ++{ ++ unsigned long t; ++ ++ /* Cheaply and approximately convert from nanoseconds to microseconds. ++ * The result and subsequent calculations are also defined in the same ++ * approximate microseconds units. The principal source of timing ++ * error here is from the simple truncation. ++ * ++ * Note that local_clock() is only defined wrt to the current CPU; ++ * the comparisons are no longer valid if we switch CPUs. Instead of ++ * blocking preemption for the entire busywait, we can detect the CPU ++ * switch and use that as indicator of system load and a reason to ++ * stop busywaiting, see busywait_stop(). ++ */ ++ *cpu = get_cpu(); ++ t = local_clock() >> 10; ++ put_cpu(); ++ ++ return t; ++} ++ ++static bool busywait_stop(unsigned long timeout, unsigned cpu) ++{ ++ unsigned this_cpu; ++ ++ if (time_after(local_clock_us(&this_cpu), timeout)) ++ return true; ++ ++ return this_cpu != cpu; ++} ++ + static int __i915_spin_request(struct drm_i915_gem_request *req, int state) + { + unsigned long timeout; ++ unsigned cpu; ++ ++ /* When waiting for high frequency requests, e.g. during synchronous ++ * rendering split between the CPU and GPU, the finite amount of time ++ * required to set up the irq and wait upon it limits the response ++ * rate. By busywaiting on the request completion for a short while we ++ * can service the high frequency waits as quick as possible. However, ++ * if it is a slow request, we want to sleep as quickly as possible. ++ * The tradeoff between waiting and sleeping is roughly the time it ++ * takes to sleep on a request, on the order of a microsecond. ++ */ + + if (i915_gem_request_get_ring(req)->irq_refcount) + return -EBUSY; + +- timeout = jiffies + 1; ++ timeout = local_clock_us(&cpu) + 5; + while (!need_resched()) { + if (i915_gem_request_completed(req, true)) + return 0; +@@ -1159,7 +1202,7 @@ static int __i915_spin_request(struct drm_i915_gem_request *req, int state) + if (signal_pending_state(state, current)) + break; + +- if (time_after_eq(jiffies, timeout)) ++ if (busywait_stop(timeout, cpu)) + break; + + cpu_relax_lowlatency(); +-- +2.5.0 + + +From 7b94b8683d8d2ac4b29099e24e351e03f163e462 Mon Sep 17 00:00:00 2001 +From: Chris Wilson <chris@chris-wilson.co.uk> +Date: Fri, 11 Dec 2015 11:32:59 +0000 +Subject: [PATCH 24/26] drm/i915: Only spin whilst waiting on the current + request + +Upstream commit 0f0cd472062eca6f9fac8be0cd5585f9a2df1ab2 + +Limit busywaiting only to the request currently being processed by the +GPU. If the request is not currently being processed by the GPU, there +is a very low likelihood of it being completed within the 2 microsecond +spin timeout and so we will just be wasting CPU cycles. + +v2: Check for logical inversion when rebasing - we were incorrectly +checking for this request being active, and instead busywaiting for +when the GPU was not yet processing the request of interest. + +v3: Try another colour for the seqno names. +v4: Another colour for the function names. + +v5: Remove the forced coherency when checking for the active request. On +reflection and plenty of recent experimentation, the issue is not a +cache coherency problem - but an irq/seqno ordering problem (timing issue). +Here, we do not need the w/a to force ordering of the read with an +interrupt. + +Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> +Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com> +Cc: "Rogozhkin, Dmitry V" <dmitry.v.rogozhkin@intel.com> +Cc: Daniel Vetter <daniel.vetter@ffwll.ch> +Cc: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com> +Cc: Eero Tamminen <eero.t.tamminen@intel.com> +Cc: "Rantala, Valtteri" <valtteri.rantala@intel.com> +Cc: stable@vger.kernel.org +Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> +Link: http://patchwork.freedesktop.org/patch/msgid/1449833608-22125-4-git-send-email-chris@chris-wilson.co.uk +(cherry picked from commit 821485dc2ad665f136c57ee589bf7a8210160fe2) +Signed-off-by: Jani Nikula <jani.nikula@intel.com> +--- + drivers/gpu/drm/i915/i915_drv.h | 27 +++++++++++++++++++-------- + drivers/gpu/drm/i915/i915_gem.c | 8 +++++++- + 2 files changed, 26 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h +index 475b03e9d584..bd6df685ae61 100644 +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -2178,8 +2178,17 @@ struct drm_i915_gem_request { + struct drm_i915_private *i915; + struct intel_engine_cs *ring; + +- /** GEM sequence number associated with this request. */ +- uint32_t seqno; ++ /** GEM sequence number associated with the previous request, ++ * when the HWS breadcrumb is equal to this the GPU is processing ++ * this request. ++ */ ++ u32 previous_seqno; ++ ++ /** GEM sequence number associated with this request, ++ * when the HWS breadcrumb is equal or greater than this the GPU ++ * has finished processing this request. ++ */ ++ u32 seqno; + + /** Position in the ringbuffer of the start of the request */ + u32 head; +@@ -2880,15 +2889,17 @@ i915_seqno_passed(uint32_t seq1, uint32_t seq2) + return (int32_t)(seq1 - seq2) >= 0; + } + ++static inline bool i915_gem_request_started(struct drm_i915_gem_request *req, ++ bool lazy_coherency) ++{ ++ u32 seqno = req->ring->get_seqno(req->ring, lazy_coherency); ++ return i915_seqno_passed(seqno, req->previous_seqno); ++} ++ + static inline bool i915_gem_request_completed(struct drm_i915_gem_request *req, + bool lazy_coherency) + { +- u32 seqno; +- +- BUG_ON(req == NULL); +- +- seqno = req->ring->get_seqno(req->ring, lazy_coherency); +- ++ u32 seqno = req->ring->get_seqno(req->ring, lazy_coherency); + return i915_seqno_passed(seqno, req->seqno); + } + +diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c +index 205316d056f1..1bf658dc6553 100644 +--- a/drivers/gpu/drm/i915/i915_gem.c ++++ b/drivers/gpu/drm/i915/i915_gem.c +@@ -1191,9 +1191,13 @@ static int __i915_spin_request(struct drm_i915_gem_request *req, int state) + * takes to sleep on a request, on the order of a microsecond. + */ + +- if (i915_gem_request_get_ring(req)->irq_refcount) ++ if (req->ring->irq_refcount) + return -EBUSY; + ++ /* Only spin if we know the GPU is processing this request */ ++ if (!i915_gem_request_started(req, true)) ++ return -EAGAIN; ++ + timeout = local_clock_us(&cpu) + 5; + while (!need_resched()) { + if (i915_gem_request_completed(req, true)) +@@ -1207,6 +1211,7 @@ static int __i915_spin_request(struct drm_i915_gem_request *req, int state) + + cpu_relax_lowlatency(); + } ++ + if (i915_gem_request_completed(req, false)) + return 0; + +@@ -2591,6 +2596,7 @@ void __i915_add_request(struct drm_i915_gem_request *request, + request->batch_obj = obj; + + request->emitted_jiffies = jiffies; ++ request->previous_seqno = ring->last_submitted_seqno; + ring->last_submitted_seqno = request->seqno; + list_add_tail(&request->list, &ring->request_list); + +-- +2.5.0 + + +From bf0176f1bb4bb6316102f4ca4d9314a20c228098 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com> +Date: Fri, 18 Dec 2015 19:24:39 +0200 +Subject: [PATCH 25/26] drm/i915: Workaround CHV pipe C cursor fail +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Upstream commit ef8dd37af85a8f37ca3a29074647511e52c56181 + +Turns out CHV pipe C was glued on somewhat poorly, and there's something +wrong with the cursor. If the cursor straddles the left screen edge, +and is then moved away from the edge or disabled, the pipe will often +underrun. If enough underruns are triggered quickly enough the pipe +will fall over and die (it just scans out a solid color and reports +a constant underrun). We need to turn the disp2d power well off and +on again to recover the pipe. + +None of that is very nice for the user, so let's just refuse to place +the cursor in the compromised position. The ddx appears to fall back +to swcursor when the ioctl returns an error, so theoretically there's +no loss of functionality for the user (discounting swcursor bugs). +I suppose most cursors images actually have the hotspot not exactly +at 0,0 so under typical conditions the fallback will in fact kick in +as soon as the cursor touches the left edge of the screen. + +Any atomic compositor should anyway be prepared to fall back to +GPU composition when things don't work out, so there should be no +problem with those. + +Other things that I tried to solve this include flipping all +display related clock gating knobs I could find, increasing the +minimum gtt alignment all the way up to 512k. I also tried to see +if there are more specific screen coordinates that hit the bug, but +the findings were somewhat inconclusive. Sometimes the failures +happen almost across the whole left edge, sometimes more at the very +top and around the bottom half. I wasn't able to find any real pattern +to these variations, so it seems our only choice is to just refuse +to straddle the left screen edge at all. + +Cc: stable@vger.kernel.org +Cc: Jason Plum <max@warheads.net> +Testcase: igt/kms_chv_cursor_fail +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92826 +Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> +Link: http://patchwork.freedesktop.org/patch/msgid/1450459479-16286-1-git-send-email-ville.syrjala@linux.intel.com +Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> +(cherry picked from commit b29ec92c4f5e6d45d8bae8194e664427a01c6687) +Signed-off-by: Jani Nikula <jani.nikula@intel.com> +--- + drivers/gpu/drm/i915/intel_display.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index 35fad110cc26..c70a6cb8914f 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -13614,6 +13614,7 @@ intel_check_cursor_plane(struct drm_plane *plane, + struct drm_crtc *crtc = crtc_state->base.crtc; + struct drm_framebuffer *fb = state->base.fb; + struct drm_i915_gem_object *obj = intel_fb_obj(fb); ++ enum pipe pipe = to_intel_plane(plane)->pipe; + unsigned stride; + int ret; + +@@ -13647,6 +13648,22 @@ intel_check_cursor_plane(struct drm_plane *plane, + return -EINVAL; + } + ++ /* ++ * There's something wrong with the cursor on CHV pipe C. ++ * If it straddles the left edge of the screen then ++ * moving it away from the edge or disabling it often ++ * results in a pipe underrun, and often that can lead to ++ * dead pipe (constant underrun reported, and it scans ++ * out just a solid color). To recover from that, the ++ * display power well must be turned off and on again. ++ * Refuse the put the cursor into that compromised position. ++ */ ++ if (IS_CHERRYVIEW(plane->dev) && pipe == PIPE_C && ++ state->visible && state->base.crtc_x < 0) { ++ DRM_DEBUG_KMS("CHV cursor C not allowed to straddle the left screen edge\n"); ++ return -EINVAL; ++ } ++ + return 0; + } + +-- +2.5.0 + + +From 036933da945df1526e0b5ee17fe8a8a77c1380e7 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com> +Date: Thu, 10 Dec 2015 18:22:31 +0200 +Subject: [PATCH 26/26] drm/i915: Unbreak check_digital_port_conflicts() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Upstream commit ae35b56e367b9fef7f5de701cf8c1c3dd954dded + +Atomic changes broke check_digital_port_conflicts(). It needs to look +at the global situation instead of just trying to find a conflict +within the current atomic state. + +This bug made my HSW explode spectacularly after I had split the DDI +encoders into separate DP and HDMI encoders. With the fix, things +seem much more solid. + +I hope holding the connection_mutex is enough protection that we can +actually walk the connectors even if they're not part of the current +atomic state... + +v2: Regenerate the patch so that it actually applies (Jani) + +Cc: stable@vger.kernel.org +Cc: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com> +Fixes: 5448a00d3f06 ("drm/i915: Don't use staged config in check_digital_port_conflicts()") +Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> +Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> +Link: http://patchwork.freedesktop.org/patch/msgid/1449764551-12466-1-git-send-email-ville.syrjala@linux.intel.com +(cherry picked from commit 0bff4858653312a10c83709e0009c3adb87e6f1e) +Signed-off-by: Jani Nikula <jani.nikula@intel.com> +--- + drivers/gpu/drm/i915/intel_display.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index c70a6cb8914f..aafe3e3de3ae 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -12026,18 +12026,22 @@ static void intel_dump_pipe_config(struct intel_crtc *crtc, + static bool check_digital_port_conflicts(struct drm_atomic_state *state) + { + struct drm_device *dev = state->dev; +- struct intel_encoder *encoder; + struct drm_connector *connector; +- struct drm_connector_state *connector_state; + unsigned int used_ports = 0; +- int i; + + /* + * Walk the connector list instead of the encoder + * list to detect the problem on ddi platforms + * where there's just one encoder per digital port. + */ +- for_each_connector_in_state(state, connector, connector_state, i) { ++ drm_for_each_connector(connector, dev) { ++ struct drm_connector_state *connector_state; ++ struct intel_encoder *encoder; ++ ++ connector_state = drm_atomic_get_existing_connector_state(state, connector); ++ if (!connector_state) ++ connector_state = connector->state; ++ + if (!connector_state->best_encoder) + continue; + +-- +2.5.0 + diff --git a/ideapad-laptop-Add-Lenovo-Yoga-700-to-no_hw_rfkill-d.patch b/ideapad-laptop-Add-Lenovo-Yoga-700-to-no_hw_rfkill-d.patch new file mode 100644 index 000000000..da0c82750 --- /dev/null +++ b/ideapad-laptop-Add-Lenovo-Yoga-700-to-no_hw_rfkill-d.patch @@ -0,0 +1,40 @@ +From 90da345613c5c0910b54b72019664e0b2ada19f9 Mon Sep 17 00:00:00 2001 +From: Josh Boyer <jwboyer@fedoraproject.org> +Date: Tue, 12 Jan 2016 07:54:39 -0500 +Subject: [PATCH] ideapad-laptop: Add Lenovo Yoga 700 to no_hw_rfkill dmi list + +Like the Yoga 900 models the Lenovo Yoga 700 does not have a +hw rfkill switch, and trying to read the hw rfkill switch through the +ideapad module causes it to always reported blocking breaking wifi. + +This commit adds the Lenovo Yoga 700 to the no_hw_rfkill dmi list, fixing +the wifi breakage. + +BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1295272 +Cc: stable@vger.kernel.org +Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org> +--- + drivers/platform/x86/ideapad-laptop.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c +index d28db0e793df..51178626305d 100644 +--- a/drivers/platform/x86/ideapad-laptop.c ++++ b/drivers/platform/x86/ideapad-laptop.c +@@ -900,6 +900,13 @@ static const struct dmi_system_id no_hw_rfkill_list[] = { + }, + }, + { ++ .ident = "Lenogo Yoga 700", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 700"), ++ }, ++ }, ++ { + .ident = "Lenovo Yoga 900", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), +-- +2.5.0 + diff --git a/kernel.spec b/kernel.spec index b1f9ab737..8b668ac8f 100644 --- a/kernel.spec +++ b/kernel.spec @@ -58,7 +58,7 @@ Summary: The Linux kernel # Do we have a -stable update to apply? -%define stable_update 3 +%define stable_update 4 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -650,24 +650,10 @@ Patch572: alua_fix.patch #CVE-XXXX-XXXX rhbz 1291329 1291332 Patch574: ovl-fix-permission-checking-for-setattr.patch -#CVE-2015-7550 rhbz 1291197 1291198 -Patch575: KEYS-Fix-race-between-read-and-revoke.patch - -#CVE-2015-8543 rhbz 1290475 1290477 -Patch576: net-add-validation-for-the-socket-syscall-protocol-a.patch - -#CVE-2015-8569 rhbz 1292045 1292047 -Patch600: pptp-verify-sockaddr_len-in-pptp_bind-and-pptp_conne.patch - -Patch601: vrf-fix-memory-leak-on-registration.patch - -#CVE-2015-8575 rhbz 1292840 1292841 -Patch602: bluetooth-Validate-socket-address-length-in-sco_sock.patch - #CVE-2015-8709 rhbz 1295287 1295288 Patch603: ptrace-being-capable-wrt-a-process-requires-mapped-u.patch -Patch604: drm-i915-shut-up-gen8-SDE-irq-dmesg-noise-again.patch +#atch604: drm-i915-shut-up-gen8-SDE-irq-dmesg-noise-again.patch #CVE-2015-7513 rhbz 1284847 1296142 Patch605: KVM-x86-Reload-pit-counters-for-all-channels-when-re.patch @@ -681,6 +667,49 @@ Patch607: drm-nouveau-Fix-pre-nv50-pageflip-events-v4.patch #rhbz 1296820 Patch608: drm-nouveau-pmu-do-not-assume-a-PMU-is-present.patch +#rhbz 1083853 +Patch610: PNP-Add-Broadwell-to-Intel-MCH-size-workaround.patch + +#CVE-2015-7566 rhbz 1296466 1297517 +Patch623: usb-serial-visor-fix-crash-on-detecting-device-witho.patch + +#rhbz 1298309 +#atch624: drm-i915-Do-a-better-job-at-disabling-primary-plane-.patch + +#rhbz 1298996 +Patch625: block-ensure-to-split-after-potentially-bouncing-a-b.patch + +#rhbz 1298192 +Patch626: selinux-fix-bug-in-conditional-rules-handling.patch + +#rhbz 1295272 +Patch627: ideapad-laptop-Add-Lenovo-Yoga-700-to-no_hw_rfkill-d.patch + +Patch628: i915-stable-backports.patch +Patch635: nouveau-stable-backports.patch + +#rhbz 1299810 +Patch629: SCSI-refactor-device-matching-code-in-scsi_devinfo.c.patch +Patch630: SCSI-fix-bug-in-scsi_dev_info_list-matching.patch + +Patch631: btrfs-handle-invalid-num_stripes-in-sys_array.patch +Patch632: Btrfs-fix-fitrim-discarding-device-area-reserved-for.patch + +#CVE-2013-4312 rhbz 1297813 1300216 +Patch636: unix-properly-account-for-FDs-passed-over-unix-socke.patch + +#CVE-2016-0723 rhbz 1296253 1300224 +Patch637: tty-Fix-unsafe-ldisc-reference-via-ioctl-TIOCGETD.patch + +#rhbz 1279653 +Patch638: rtlwifi-rtl8821ae-Fix-5G-failure-when-EEPROM-is-inco.patch + +#CVE-XXXX-XXXX rhbz 1300731 1300732 +Patch639: netfilter-nf_nat_redirect-add-missing-NULL-pointer-c.patch + +#rhbz 1300955 +Patch640: PNP-Add-Haswell-ULT-to-Intel-MCH-size-workaround.patch + # END OF PATCH DEFINITIONS %endif @@ -2127,6 +2156,42 @@ fi # # %changelog +* Sat Jan 23 2016 Josh Boyer <jwboyer@fedoraproject.org> - 4.3.4-300 +- Linux v4.3.4 + +* Fri Jan 22 2016 Josh Boyer <jwboyer@fedoraproject.org> +- Fix backtrace from PNP conflict on Haswell-ULT (rhbz 1300955) + +* Thu Jan 21 2016 Josh Boyer <jwboyer@fedoraproject.org> +- CVE-XXXX-XXXX missing null ptr check in nf_nat_redirect_ipv4 (rhbz 1300731 1300732) +- Fix incorrect country code issue on RTL8812AE devices (rhbz 1279653) + +* Wed Jan 20 2016 Josh Boyer <jwboyer@fedoraproject.org> +- CVE-2016-0723 memory disclosure and crash in tty layer (rhbz 1296253 1300224) +- CVE-2013-4312 file descr passed over unix sockects not properly accounted (rhbz 1297813 1300216) + +* Tue Jan 19 2016 Josh Boyer <jwboyer@fedoraproject.org> - 4.3.3-303 +- Backport nouveau stable fixes (rhbz 1299349) +- CVE-2016-0728 Keys: reference leak in join_session_keyring (rhbz 1296623 1297475) +- Add currently queued networking stable patches +- Add a couple btrfs patches cc'd to stable upstream +- Add SCSI patches to avoid blacklist false positives (rhbz 1299810) + +* Mon Jan 18 2016 Josh Boyer <jwboyer@fedoraproject.org> - 4.3.3-302 +- Backport stable fixed marked in upstream 4.4 +- Fix rfkill issues on Yoga 700 (rhbz 1295272) +- Fix SELinux issue with conditional rules (rhbz 1298192) + +* Fri Jan 15 2016 Josh Boyer <jwboyer@fedoraproject.org> +- Fix block errors on PAE machines (rhbz 1298996) + +* Wed Jan 13 2016 Josh Boyer <jwboyer@fedoraproject.org> - 4.3.3-301 +- Fix garbled video on some i915 machines (rhbz 1298309) + +* Tue Jan 12 2016 Josh Boyer <jwboyer@fedoraproject.org> +- CVE-2015-7566 usb: visor: Crash on invalid USB dev descriptors (rhbz 1296466 1297517) +- Fix backtrace from PNP conflict on Broadwell (rhbz 1083853) + * Fri Jan 08 2016 Josh Boyer <jwboyer@fedoraproject.org> - Fix oops in nouveau driver for devices that don't have a PMU (rhbz 1296820) - Fix warnings from pre-nv50 cards (rhbz 1281368) @@ -2134,7 +2199,7 @@ fi * Thu Jan 07 2016 Josh Boyer <jwboyer@fedorparoject.org> - CVE-2015-7513 kvm: divide by zero DoS (rhbz 1284847 1296142) -- Quiet i915 gen8 irq messages +- Quiet i915 gen8 irq messages (rhbz 1297143) * Tue Jan 05 2016 Josh Boyer <jwboyer@fedoraproject.org> - CVE-2015-8709 ptrace: potential priv escalation with userns (rhbz 1295287 1295288) diff --git a/net-add-validation-for-the-socket-syscall-protocol-a.patch b/net-add-validation-for-the-socket-syscall-protocol-a.patch deleted file mode 100644 index ce387ea42..000000000 --- a/net-add-validation-for-the-socket-syscall-protocol-a.patch +++ /dev/null @@ -1,139 +0,0 @@ -From 4da7dc22c91ad2c3144cb1d0d96e9611bc86da47 Mon Sep 17 00:00:00 2001 -From: Hannes Frederic Sowa <hannes@stressinduktion.org> -Date: Mon, 14 Dec 2015 22:03:39 +0100 -Subject: [PATCH] net: add validation for the socket syscall protocol argument -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -郭永刚 reported that one could simply crash the kernel as root by -using a simple program: - - int socket_fd; - struct sockaddr_in addr; - addr.sin_port = 0; - addr.sin_addr.s_addr = INADDR_ANY; - addr.sin_family = 10; - - socket_fd = socket(10,3,0x40000000); - connect(socket_fd , &addr,16); - -AF_INET, AF_INET6 sockets actually only support 8-bit protocol -identifiers. inet_sock's skc_protocol field thus is sized accordingly, -thus larger protocol identifiers simply cut off the higher bits and -store a zero in the protocol fields. - -This could lead to e.g. NULL function pointer because as a result of -the cut off inet_num is zero and we call down to inet_autobind, which -is NULL for raw sockets. - -kernel: Call Trace: -kernel: [<ffffffff816db90e>] ? inet_autobind+0x2e/0x70 -kernel: [<ffffffff816db9a4>] inet_dgram_connect+0x54/0x80 -kernel: [<ffffffff81645069>] SYSC_connect+0xd9/0x110 -kernel: [<ffffffff810ac51b>] ? ptrace_notify+0x5b/0x80 -kernel: [<ffffffff810236d8>] ? syscall_trace_enter_phase2+0x108/0x200 -kernel: [<ffffffff81645e0e>] SyS_connect+0xe/0x10 -kernel: [<ffffffff81779515>] tracesys_phase2+0x84/0x89 - -I found no particular commit which introduced this problem. - -CVE: CVE-2015-8543 -Cc: Cong Wang <cwang@twopensource.com> -Reported-by: 郭永刚 <guoyonggang@360.cn> -Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> -Signed-off-by: David S. Miller <davem@davemloft.net> ---- - include/net/sock.h | 1 + - net/ax25/af_ax25.c | 3 +++ - net/decnet/af_decnet.c | 3 +++ - net/ipv4/af_inet.c | 3 +++ - net/ipv6/af_inet6.c | 3 +++ - net/irda/af_irda.c | 3 +++ - 6 files changed, 16 insertions(+) - -diff --git a/include/net/sock.h b/include/net/sock.h -index 52d27ee924f4..2fa1fc00e8cb 100644 ---- a/include/net/sock.h -+++ b/include/net/sock.h -@@ -403,6 +403,7 @@ struct sock { - sk_no_check_rx : 1, - sk_userlocks : 4, - sk_protocol : 8, -+#define SK_PROTOCOL_MAX U8_MAX - sk_type : 16; - kmemcheck_bitfield_end(flags); - int sk_wmem_queued; -diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c -index ae3a47f9d1d5..fbd0acf80b13 100644 ---- a/net/ax25/af_ax25.c -+++ b/net/ax25/af_ax25.c -@@ -805,6 +805,9 @@ static int ax25_create(struct net *net, struct socket *sock, int protocol, - struct sock *sk; - ax25_cb *ax25; - -+ if (protocol < 0 || protocol > SK_PROTOCOL_MAX) -+ return -EINVAL; -+ - if (!net_eq(net, &init_net)) - return -EAFNOSUPPORT; - -diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c -index eebf5ac8ce18..13d6b1a6e0fc 100644 ---- a/net/decnet/af_decnet.c -+++ b/net/decnet/af_decnet.c -@@ -678,6 +678,9 @@ static int dn_create(struct net *net, struct socket *sock, int protocol, - { - struct sock *sk; - -+ if (protocol < 0 || protocol > SK_PROTOCOL_MAX) -+ return -EINVAL; -+ - if (!net_eq(net, &init_net)) - return -EAFNOSUPPORT; - -diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c -index 11c4ca13ec3b..5c5db6636704 100644 ---- a/net/ipv4/af_inet.c -+++ b/net/ipv4/af_inet.c -@@ -257,6 +257,9 @@ static int inet_create(struct net *net, struct socket *sock, int protocol, - int try_loading_module = 0; - int err; - -+ if (protocol < 0 || protocol >= IPPROTO_MAX) -+ return -EINVAL; -+ - sock->state = SS_UNCONNECTED; - - /* Look for the requested type/protocol pair. */ -diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c -index 8ec0df75f1c4..9f5137cd604e 100644 ---- a/net/ipv6/af_inet6.c -+++ b/net/ipv6/af_inet6.c -@@ -109,6 +109,9 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol, - int try_loading_module = 0; - int err; - -+ if (protocol < 0 || protocol >= IPPROTO_MAX) -+ return -EINVAL; -+ - /* Look for the requested type/protocol pair. */ - lookup_protocol: - err = -ESOCKTNOSUPPORT; -diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c -index e6aa48b5395c..923abd6b3064 100644 ---- a/net/irda/af_irda.c -+++ b/net/irda/af_irda.c -@@ -1086,6 +1086,9 @@ static int irda_create(struct net *net, struct socket *sock, int protocol, - struct sock *sk; - struct irda_sock *self; - -+ if (protocol < 0 || protocol > SK_PROTOCOL_MAX) -+ return -EINVAL; -+ - if (net != &init_net) - return -EAFNOSUPPORT; - --- -2.5.0 - diff --git a/netfilter-nf_nat_redirect-add-missing-NULL-pointer-c.patch b/netfilter-nf_nat_redirect-add-missing-NULL-pointer-c.patch new file mode 100644 index 000000000..3b2031981 --- /dev/null +++ b/netfilter-nf_nat_redirect-add-missing-NULL-pointer-c.patch @@ -0,0 +1,83 @@ +From f9688b8f6755c3c2eb5c7e2e22ab168d0cb97644 Mon Sep 17 00:00:00 2001 +From: Munehisa Kamata <kamatam@amazon.com> +Date: Mon, 26 Oct 2015 19:10:52 -0700 +Subject: [PATCH] netfilter: nf_nat_redirect: add missing NULL pointer check + +Upstream commit 94f9cd81436c85d8c3a318ba92e236ede73752fc + +Commit 8b13eddfdf04cbfa561725cfc42d6868fe896f56 ("netfilter: refactor NAT +redirect IPv4 to use it from nf_tables") has introduced a trivial logic +change which can result in the following crash. + +BUG: unable to handle kernel NULL pointer dereference at 0000000000000030 +IP: [<ffffffffa033002d>] nf_nat_redirect_ipv4+0x2d/0xa0 [nf_nat_redirect] +PGD 3ba662067 PUD 3ba661067 PMD 0 +Oops: 0000 [#1] SMP +Modules linked in: ipv6(E) xt_REDIRECT(E) nf_nat_redirect(E) xt_tcpudp(E) iptable_nat(E) nf_conntrack_ipv4(E) nf_defrag_ipv4(E) nf_nat_ipv4(E) nf_nat(E) nf_conntrack(E) ip_tables(E) x_tables(E) binfmt_misc(E) xfs(E) libcrc32c(E) evbug(E) evdev(E) psmouse(E) i2c_piix4(E) i2c_core(E) acpi_cpufreq(E) button(E) ext4(E) crc16(E) jbd2(E) mbcache(E) dm_mirror(E) dm_region_hash(E) dm_log(E) dm_mod(E) +CPU: 0 PID: 2536 Comm: ip Tainted: G E 4.1.7-15.23.amzn1.x86_64 #1 +Hardware name: Xen HVM domU, BIOS 4.2.amazon 05/06/2015 +task: ffff8800eb438000 ti: ffff8803ba664000 task.ti: ffff8803ba664000 +[...] +Call Trace: + <IRQ> + [<ffffffffa0334065>] redirect_tg4+0x15/0x20 [xt_REDIRECT] + [<ffffffffa02e2e99>] ipt_do_table+0x2b9/0x5e1 [ip_tables] + [<ffffffffa0328045>] iptable_nat_do_chain+0x25/0x30 [iptable_nat] + [<ffffffffa031777d>] nf_nat_ipv4_fn+0x13d/0x1f0 [nf_nat_ipv4] + [<ffffffffa0328020>] ? iptable_nat_ipv4_fn+0x20/0x20 [iptable_nat] + [<ffffffffa031785e>] nf_nat_ipv4_in+0x2e/0x90 [nf_nat_ipv4] + [<ffffffffa03280a5>] iptable_nat_ipv4_in+0x15/0x20 [iptable_nat] + [<ffffffff81449137>] nf_iterate+0x57/0x80 + [<ffffffff814491f7>] nf_hook_slow+0x97/0x100 + [<ffffffff814504d4>] ip_rcv+0x314/0x400 + +unsigned int +nf_nat_redirect_ipv4(struct sk_buff *skb, +... +{ +... + rcu_read_lock(); + indev = __in_dev_get_rcu(skb->dev); + if (indev != NULL) { + ifa = indev->ifa_list; + newdst = ifa->ifa_local; <--- + } + rcu_read_unlock(); +... +} + +Before the commit, 'ifa' had been always checked before access. After the +commit, however, it could be accessed even if it's NULL. Interestingly, +this was once fixed in 2003. + +http://marc.info/?l=netfilter-devel&m=106668497403047&w=2 + +In addition to the original one, we have seen the crash when packets that +need to be redirected somehow arrive on an interface which hasn't been +yet fully configured. + +This change just reverts the logic to the old behavior to avoid the crash. + +Fixes: 8b13eddfdf04 ("netfilter: refactor NAT redirect IPv4 to use it from nf_tables") +Signed-off-by: Munehisa Kamata <kamatam@amazon.com> +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + net/netfilter/nf_nat_redirect.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_nat_redirect.c b/net/netfilter/nf_nat_redirect.c +index 97b75f9bfbcd..d43869879fcf 100644 +--- a/net/netfilter/nf_nat_redirect.c ++++ b/net/netfilter/nf_nat_redirect.c +@@ -55,7 +55,7 @@ nf_nat_redirect_ipv4(struct sk_buff *skb, + + rcu_read_lock(); + indev = __in_dev_get_rcu(skb->dev); +- if (indev != NULL) { ++ if (indev && indev->ifa_list) { + ifa = indev->ifa_list; + newdst = ifa->ifa_local; + } +-- +2.5.0 + diff --git a/nouveau-stable-backports.patch b/nouveau-stable-backports.patch new file mode 100644 index 000000000..bd6d210e0 --- /dev/null +++ b/nouveau-stable-backports.patch @@ -0,0 +1,105 @@ +From fe9c94340928d8ec3ea1ae74f99c3c9b18684129 Mon Sep 17 00:00:00 2001 +From: Martin Peres <martin.peres@free.fr> +Date: Sun, 29 Nov 2015 16:10:18 +0200 +Subject: [PATCH 1/3] drm/nouveau/bios/fan: hardcode the fan mode to linear +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This is an oversight that made use of the trip-point-based fan managenent on +cards that never expose those. This led the fan to stay at fan_min. + +Fortunately, the emergency code would kick when the temperature would reach +90°C. + +Reported-by: Tom Englund <tomenglund26@gmail.com> +Tested-by: Tom Englund <tomenglund26@gmail.com> +Signed-off-by: Martin Peres <martin.peres@free.fr> +Tested-by: Daemon32 <lnf.purple@gmail.com> +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92126 +Signed-off-by: Ben Skeggs <bskeggs@redhat.com> +Cc: stable@vger.kernel.org +--- + drivers/gpu/drm/nouveau/nvkm/subdev/bios/fan.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/fan.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/fan.c +index 43006db6fd58..80fed7e78dcb 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/fan.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/fan.c +@@ -83,6 +83,7 @@ nvbios_fan_parse(struct nvkm_bios *bios, struct nvbios_therm_fan *fan) + fan->type = NVBIOS_THERM_FAN_UNK; + } + ++ fan->fan_mode = NVBIOS_THERM_FAN_LINEAR; + fan->min_duty = nvbios_rd08(bios, data + 0x02); + fan->max_duty = nvbios_rd08(bios, data + 0x03); + +-- +2.5.0 + + +From acdc10375119fc5dd76d7051a5ae4a41f61c45aa Mon Sep 17 00:00:00 2001 +From: Ben Skeggs <bskeggs@redhat.com> +Date: Mon, 4 Jan 2016 09:01:13 +1000 +Subject: [PATCH 2/3] drm/nouveau/gr/nv40: fix oops in interrupt handler + +fdo#93557 + +Signed-off-by: Ben Skeggs <bskeggs@redhat.com> +Cc: stable@vger.kernel.org +--- + drivers/gpu/drm/nouveau/nvkm/engine/gr/nv40.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv40.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv40.c +index ffa902ece872..05a895496fc6 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv40.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv40.c +@@ -156,6 +156,7 @@ nv40_gr_chan_new(struct nvkm_gr *base, struct nvkm_fifo_chan *fifoch, + return -ENOMEM; + nvkm_object_ctor(&nv40_gr_chan, oclass, &chan->object); + chan->gr = gr; ++ chan->fifo = fifoch; + *pobject = &chan->object; + + spin_lock_irqsave(&chan->gr->base.engine.lock, flags); +-- +2.5.0 + + +From c5d07dcb6d6260a51a2309d5f62c3391637afa86 Mon Sep 17 00:00:00 2001 +From: Ben Skeggs <bskeggs@redhat.com> +Date: Fri, 8 Jan 2016 08:56:51 +1000 +Subject: [PATCH 3/3] drm/nouveau/kms: take mode_config mutex in connector + hotplug path + +fdo#93634 + +Signed-off-by: Ben Skeggs <bskeggs@redhat.com> +Cc: stable@vger.kernel.org +--- + drivers/gpu/drm/nouveau/nouveau_connector.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c +index 2e7cbe933533..2a5ed7460354 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_connector.c ++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c +@@ -969,10 +969,13 @@ nouveau_connector_hotplug(struct nvif_notify *notify) + + NV_DEBUG(drm, "%splugged %s\n", plugged ? "" : "un", name); + ++ mutex_lock(&drm->dev->mode_config.mutex); + if (plugged) + drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON); + else + drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF); ++ mutex_unlock(&drm->dev->mode_config.mutex); ++ + drm_helper_hpd_irq_event(connector->dev); + } + +-- +2.5.0 + diff --git a/pptp-verify-sockaddr_len-in-pptp_bind-and-pptp_conne.patch b/pptp-verify-sockaddr_len-in-pptp_bind-and-pptp_conne.patch deleted file mode 100644 index b891c5211..000000000 --- a/pptp-verify-sockaddr_len-in-pptp_bind-and-pptp_conne.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 16c5a158e97d5b1f6c8bf86b006c1349f025d4e0 Mon Sep 17 00:00:00 2001 -From: WANG Cong <xiyou.wangcong@gmail.com> -Date: Mon, 14 Dec 2015 13:48:36 -0800 -Subject: [PATCH] pptp: verify sockaddr_len in pptp_bind() and pptp_connect() - -Reported-by: Dmitry Vyukov <dvyukov@gmail.com> -Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> -Signed-off-by: David S. Miller <davem@davemloft.net> ---- - drivers/net/ppp/pptp.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c -index fc69e41d0950..597c53e0a2ec 100644 ---- a/drivers/net/ppp/pptp.c -+++ b/drivers/net/ppp/pptp.c -@@ -419,6 +419,9 @@ static int pptp_bind(struct socket *sock, struct sockaddr *uservaddr, - struct pptp_opt *opt = &po->proto.pptp; - int error = 0; - -+ if (sockaddr_len < sizeof(struct sockaddr_pppox)) -+ return -EINVAL; -+ - lock_sock(sk); - - opt->src_addr = sp->sa_addr.pptp; -@@ -440,6 +443,9 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr, - struct flowi4 fl4; - int error = 0; - -+ if (sockaddr_len < sizeof(struct sockaddr_pppox)) -+ return -EINVAL; -+ - if (sp->sa_protocol != PX_PROTO_PPTP) - return -EINVAL; - --- -2.5.0 - diff --git a/rtlwifi-rtl8821ae-Fix-5G-failure-when-EEPROM-is-inco.patch b/rtlwifi-rtl8821ae-Fix-5G-failure-when-EEPROM-is-inco.patch new file mode 100644 index 000000000..b3ab35e2c --- /dev/null +++ b/rtlwifi-rtl8821ae-Fix-5G-failure-when-EEPROM-is-inco.patch @@ -0,0 +1,55 @@ +From 1bd0c273bcf537adadedd7cc69408b99afd1534c Mon Sep 17 00:00:00 2001 +From: Larry Finger <Larry.Finger@lwfinger.net> +Date: Wed, 20 Jan 2016 21:26:18 -0600 +Subject: [PATCH] rtlwifi: rtl8821ae: Fix 5G failure when EEPROM is incorrectly + encoded + +Recently, it has been reported that D-Link DWA-582 cards, which use an +RTL8812AE chip are not able to scan for 5G networks. The problems started +with kernel 4.2, which is the first version that had commit d10101a60372 +("rtlwifi: rtl8821ae: Fix problem with regulatory information"). With this +patch, the driver went from setting a default channel plan to using +the value derived from EEPROM. + +Bug reports at https://bugzilla.kernel.org/show_bug.cgi?id=111031 and +https://bugzilla.redhat.com/show_bug.cgi?id=1279653 are examples of this +problem. + +The problem was solved once I learned that the internal country code was +resulting in a regulatory set with only 2.4 GHz channels. With the RTL8821AE +chips available to me, the country code was such that both 2.4 and 5 GHz +channels are allowed. The fix is to allow both bands even when the EEPROM +is incorrectly encoded. + +Fixes: d10101a60372 ("rtlwifi: rtl8821ae: Fix problem with regulatory information") +Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> +Cc: littlesmartguy@gmail.com +Cc: gabe@codehaus.org +Cc: Stable <stable@vger.kernel.org> [v4.2+] +--- + drivers/net/wireless/rtlwifi/regd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/rtlwifi/regd.c b/drivers/net/wireless/rtlwifi/regd.c +index a62bf0a65c32..5be34118e0af 100644 +--- a/drivers/net/wireless/rtlwifi/regd.c ++++ b/drivers/net/wireless/rtlwifi/regd.c +@@ -351,7 +351,6 @@ static const struct ieee80211_regdomain *_rtl_regdomain_select( + case COUNTRY_CODE_SPAIN: + case COUNTRY_CODE_FRANCE: + case COUNTRY_CODE_ISRAEL: +- case COUNTRY_CODE_WORLD_WIDE_13: + return &rtl_regdom_12_13; + case COUNTRY_CODE_MKK: + case COUNTRY_CODE_MKK1: +@@ -360,6 +359,7 @@ static const struct ieee80211_regdomain *_rtl_regdomain_select( + return &rtl_regdom_14_60_64; + case COUNTRY_CODE_GLOBAL_DOMAIN: + return &rtl_regdom_14; ++ case COUNTRY_CODE_WORLD_WIDE_13: + case COUNTRY_CODE_WORLD_WIDE_13_5G_ALL: + return &rtl_regdom_12_13_5g_all; + default: +-- +2.5.0 + diff --git a/selinux-fix-bug-in-conditional-rules-handling.patch b/selinux-fix-bug-in-conditional-rules-handling.patch new file mode 100644 index 000000000..6a78f5b2e --- /dev/null +++ b/selinux-fix-bug-in-conditional-rules-handling.patch @@ -0,0 +1,51 @@ +From f3bef67992e8698897b584616535803887c4a73e Mon Sep 17 00:00:00 2001 +From: Stephen Smalley <sds@tycho.nsa.gov> +Date: Mon, 23 Nov 2015 16:07:41 -0500 +Subject: [PATCH] selinux: fix bug in conditional rules handling + +commit fa1aa143ac4a ("selinux: extended permissions for ioctls") +introduced a bug into the handling of conditional rules, skipping the +processing entirely when the caller does not provide an extended +permissions (xperms) structure. Access checks from userspace using +/sys/fs/selinux/access do not include such a structure since that +interface does not presently expose extended permission information. +As a result, conditional rules were being ignored entirely on userspace +access requests, producing denials when access was allowed by +conditional rules in the policy. Fix the bug by only skipping +computation of extended permissions in this situation, not the entire +conditional rules processing. + +Reported-by: Laurent Bigonville <bigon@debian.org> +Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> +[PM: fixed long lines in patch description] +Cc: stable@vger.kernel.org # 4.3 +Signed-off-by: Paul Moore <pmoore@redhat.com> +--- + security/selinux/ss/conditional.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c +index 18643bf9894d..456e1a9bcfde 100644 +--- a/security/selinux/ss/conditional.c ++++ b/security/selinux/ss/conditional.c +@@ -638,7 +638,7 @@ void cond_compute_av(struct avtab *ctab, struct avtab_key *key, + { + struct avtab_node *node; + +- if (!ctab || !key || !avd || !xperms) ++ if (!ctab || !key || !avd) + return; + + for (node = avtab_search_node(ctab, key); node; +@@ -657,7 +657,7 @@ void cond_compute_av(struct avtab *ctab, struct avtab_key *key, + if ((u16)(AVTAB_AUDITALLOW|AVTAB_ENABLED) == + (node->key.specified & (AVTAB_AUDITALLOW|AVTAB_ENABLED))) + avd->auditallow |= node->datum.u.data; +- if ((node->key.specified & AVTAB_ENABLED) && ++ if (xperms && (node->key.specified & AVTAB_ENABLED) && + (node->key.specified & AVTAB_XPERMS)) + services_compute_xperms_drivers(xperms, node); + } +-- +2.5.0 + @@ -1,3 +1,3 @@ 58b35794eee3b6d52ce7be39357801e7 linux-4.3.tar.xz 7c516c9528b9f9aac0136944b0200b7e perf-man-4.3.tar.gz -d3235b3640ae6ac1ab579171943fda4b patch-4.3.3.xz +5bbeeb57b8cff23e5c27430e60810d1b patch-4.3.4.xz diff --git a/tty-Fix-unsafe-ldisc-reference-via-ioctl-TIOCGETD.patch b/tty-Fix-unsafe-ldisc-reference-via-ioctl-TIOCGETD.patch new file mode 100644 index 000000000..d169105db --- /dev/null +++ b/tty-Fix-unsafe-ldisc-reference-via-ioctl-TIOCGETD.patch @@ -0,0 +1,68 @@ +From 938f50fc744cb49892bd42c8f56bdfa63e82a27d Mon Sep 17 00:00:00 2001 +From: Peter Hurley <peter@hurleysoftware.com> +Date: Sun, 10 Jan 2016 22:40:55 -0800 +Subject: [PATCH] tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) + +ioctl(TIOCGETD) retrieves the line discipline id directly from the +ldisc because the line discipline id (c_line) in termios is untrustworthy; +userspace may have set termios via ioctl(TCSETS*) without actually +changing the line discipline via ioctl(TIOCSETD). + +However, directly accessing the current ldisc via tty->ldisc is +unsafe; the ldisc ptr dereferenced may be stale if the line discipline +is changing via ioctl(TIOCSETD) or hangup. + +Wait for the line discipline reference (just like read() or write()) +to retrieve the "current" line discipline id. + +Cc: <stable@vger.kernel.org> +Signed-off-by: Peter Hurley <peter@hurleysoftware.com> +--- + drivers/tty/tty_io.c | 24 +++++++++++++++++++++++- + 1 file changed, 23 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c +index f435977de740..bd4027e36910 100644 +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -2654,6 +2654,28 @@ static int tiocsetd(struct tty_struct *tty, int __user *p) + } + + /** ++ * tiocgetd - get line discipline ++ * @tty: tty device ++ * @p: pointer to user data ++ * ++ * Retrieves the line discipline id directly from the ldisc. ++ * ++ * Locking: waits for ldisc reference (in case the line discipline ++ * is changing or the tty is being hungup) ++ */ ++ ++static int tiocgetd(struct tty_struct *tty, int __user *p) ++{ ++ struct tty_ldisc *ld; ++ int ret; ++ ++ ld = tty_ldisc_ref_wait(tty); ++ ret = put_user(ld->ops->num, p); ++ tty_ldisc_deref(ld); ++ return ret; ++} ++ ++/** + * send_break - performed time break + * @tty: device to break on + * @duration: timeout in mS +@@ -2879,7 +2901,7 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + case TIOCGSID: + return tiocgsid(tty, real_tty, p); + case TIOCGETD: +- return put_user(tty->ldisc->ops->num, (int __user *)p); ++ return tiocgetd(tty, p); + case TIOCSETD: + return tiocsetd(tty, p); + case TIOCVHANGUP: +-- +2.5.0 + diff --git a/unix-properly-account-for-FDs-passed-over-unix-socke.patch b/unix-properly-account-for-FDs-passed-over-unix-socke.patch new file mode 100644 index 000000000..c263abf2b --- /dev/null +++ b/unix-properly-account-for-FDs-passed-over-unix-socke.patch @@ -0,0 +1,140 @@ +From 0cd038d23b86853d68993c94f3c713e4375fd61f Mon Sep 17 00:00:00 2001 +From: willy tarreau <w@1wt.eu> +Date: Sun, 10 Jan 2016 07:54:56 +0100 +Subject: [PATCH] unix: properly account for FDs passed over unix sockets + +It is possible for a process to allocate and accumulate far more FDs than +the process' limit by sending them over a unix socket then closing them +to keep the process' fd count low. + +This change addresses this problem by keeping track of the number of FDs +in flight per user and preventing non-privileged processes from having +more FDs in flight than their configured FD limit. + +Reported-by: socketpair@gmail.com +Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> +Mitigates: CVE-2013-4312 (Linux 2.0+) +Suggested-by: Linus Torvalds <torvalds@linux-foundation.org> +Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> +Signed-off-by: Willy Tarreau <w@1wt.eu> +Signed-off-by: David S. Miller <davem@davemloft.net> +--- + include/linux/sched.h | 1 + + net/unix/af_unix.c | 24 ++++++++++++++++++++---- + net/unix/garbage.c | 13 ++++++++----- + 3 files changed, 29 insertions(+), 9 deletions(-) + +diff --git a/include/linux/sched.h b/include/linux/sched.h +index b7b9501b41af..f477e87ca46f 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -830,6 +830,7 @@ struct user_struct { + unsigned long mq_bytes; /* How many bytes can be allocated to mqueue? */ + #endif + unsigned long locked_shm; /* How many pages of mlocked shm ? */ ++ unsigned long unix_inflight; /* How many files in flight in unix sockets */ + + #ifdef CONFIG_KEYS + struct key *uid_keyring; /* UID specific keyring */ +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index 128b0982c96b..9085de63bb81 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -1498,6 +1498,21 @@ static void unix_destruct_scm(struct sk_buff *skb) + sock_wfree(skb); + } + ++/* ++ * The "user->unix_inflight" variable is protected by the garbage ++ * collection lock, and we just read it locklessly here. If you go ++ * over the limit, there might be a tiny race in actually noticing ++ * it across threads. Tough. ++ */ ++static inline bool too_many_unix_fds(struct task_struct *p) ++{ ++ struct user_struct *user = current_user(); ++ ++ if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE))) ++ return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN); ++ return false; ++} ++ + #define MAX_RECURSION_LEVEL 4 + + static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb) +@@ -1506,6 +1521,9 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb) + unsigned char max_level = 0; + int unix_sock_count = 0; + ++ if (too_many_unix_fds(current)) ++ return -ETOOMANYREFS; ++ + for (i = scm->fp->count - 1; i >= 0; i--) { + struct sock *sk = unix_get_socket(scm->fp->fp[i]); + +@@ -1527,10 +1545,8 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb) + if (!UNIXCB(skb).fp) + return -ENOMEM; + +- if (unix_sock_count) { +- for (i = scm->fp->count - 1; i >= 0; i--) +- unix_inflight(scm->fp->fp[i]); +- } ++ for (i = scm->fp->count - 1; i >= 0; i--) ++ unix_inflight(scm->fp->fp[i]); + return max_level; + } + +diff --git a/net/unix/garbage.c b/net/unix/garbage.c +index a73a226f2d33..8fcdc2283af5 100644 +--- a/net/unix/garbage.c ++++ b/net/unix/garbage.c +@@ -120,11 +120,11 @@ void unix_inflight(struct file *fp) + { + struct sock *s = unix_get_socket(fp); + ++ spin_lock(&unix_gc_lock); ++ + if (s) { + struct unix_sock *u = unix_sk(s); + +- spin_lock(&unix_gc_lock); +- + if (atomic_long_inc_return(&u->inflight) == 1) { + BUG_ON(!list_empty(&u->link)); + list_add_tail(&u->link, &gc_inflight_list); +@@ -132,25 +132,28 @@ void unix_inflight(struct file *fp) + BUG_ON(list_empty(&u->link)); + } + unix_tot_inflight++; +- spin_unlock(&unix_gc_lock); + } ++ fp->f_cred->user->unix_inflight++; ++ spin_unlock(&unix_gc_lock); + } + + void unix_notinflight(struct file *fp) + { + struct sock *s = unix_get_socket(fp); + ++ spin_lock(&unix_gc_lock); ++ + if (s) { + struct unix_sock *u = unix_sk(s); + +- spin_lock(&unix_gc_lock); + BUG_ON(list_empty(&u->link)); + + if (atomic_long_dec_and_test(&u->inflight)) + list_del_init(&u->link); + unix_tot_inflight--; +- spin_unlock(&unix_gc_lock); + } ++ fp->f_cred->user->unix_inflight--; ++ spin_unlock(&unix_gc_lock); + } + + static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *), +-- +2.5.0 + diff --git a/usb-serial-visor-fix-crash-on-detecting-device-witho.patch b/usb-serial-visor-fix-crash-on-detecting-device-witho.patch new file mode 100644 index 000000000..ddd4fc5b9 --- /dev/null +++ b/usb-serial-visor-fix-crash-on-detecting-device-witho.patch @@ -0,0 +1,36 @@ +From b2476fe4c16be5c2b7ee950e50677cfaa9ab9bae Mon Sep 17 00:00:00 2001 +From: Vladis Dronov <vdronov@redhat.com> +Date: Tue, 12 Jan 2016 14:10:50 -0500 +Subject: [PATCH] usb: serial: visor: fix crash on detecting device without + write_urbs + +The visor driver crashes in clie_5_attach() when a specially crafted USB +device without bulk-out endpoint is detected. This fix adds a check that +the device has proper configuration expected by the driver. + +Reported-by: Ralf Spenneberg <ralf@spenneberg.net> +Signed-off-by: Vladis Dronov <vdronov@redhat.com> +--- + drivers/usb/serial/visor.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c +index 60afb39eb73c..bbc90c059002 100644 +--- a/drivers/usb/serial/visor.c ++++ b/drivers/usb/serial/visor.c +@@ -597,8 +597,10 @@ static int clie_5_attach(struct usb_serial *serial) + */ + + /* some sanity check */ +- if (serial->num_ports < 2) +- return -1; ++ if (serial->num_bulk_out < 2) { ++ dev_err(&serial->interface->dev, "missing bulk out endpoints\n"); ++ return -ENODEV; ++ } + + /* port 0 now uses the modified endpoint Address */ + port = serial->port[0]; +-- +2.5.0 + diff --git a/vrf-fix-memory-leak-on-registration.patch b/vrf-fix-memory-leak-on-registration.patch deleted file mode 100644 index 86c3dff69..000000000 --- a/vrf-fix-memory-leak-on-registration.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 5780068e17af44a98d432d31448bb18a99ce64dc Mon Sep 17 00:00:00 2001 -From: Ben Hutchings <ben@decadent.org.uk> -Date: Tue, 15 Dec 2015 15:12:43 +0000 -Subject: [PATCH] vrf: Fix memory leak on registration failure in vrf_newlink() - -The backported version of commit 7f109f7cc371 ("vrf: fix double free -and memory corruption on register_netdevice failure") incorrectly -removed a kfree() from the failure path as well as the free_netdev(). -Add that back. - -Signed-off-by: Ben Hutchings <ben@decadent.org.uk> ---- - drivers/net/vrf.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c -index c9e309c..6c25fd0 100644 ---- a/drivers/net/vrf.c -+++ b/drivers/net/vrf.c -@@ -581,6 +581,7 @@ static int vrf_newlink(struct net *src_net, struct net_device *dev, - { - struct net_vrf *vrf = netdev_priv(dev); - struct net_vrf_dev *vrf_ptr; -+ int err; - - if (!data || !data[IFLA_VRF_TABLE]) - return -EINVAL; -@@ -598,7 +599,10 @@ static int vrf_newlink(struct net *src_net, struct net_device *dev, - - rcu_assign_pointer(dev->vrf_ptr, vrf_ptr); - -- return register_netdev(dev); -+ err = register_netdev(dev); -+ if (err) -+ kfree(vrf_ptr); -+ return err; - } - - static size_t vrf_nl_getsize(const struct net_device *dev) --- -2.5.0 - |