[linux] 01/03: Update to 3.2.84
debian-kernel at lists.debian.org
debian-kernel at lists.debian.org
Wed Nov 30 03:16:22 UTC 2016
This is an automated email from the git hooks/post-receive script.
benh pushed a commit to branch wheezy-security
in repository linux.
commit fa34b6a506333dfb575723ef9c8b39222cba65c2
Author: Ben Hutchings <ben at decadent.org.uk>
Date: Tue Nov 29 01:38:20 2016 +0000
Update to 3.2.84
drm, agp: Update to 3.4.113
Drop/refresh patches as appropriate.
This has some ABI breakers which will need to be fixed.
---
debian/changelog | 99 +++++++
...ck-size-values-after-double-fetch-from-us.patch | 62 -----
...ix-potential-null-dereference-in-rfcomm-b.patch | 60 ----
.../drm-radeon-fix-hotplug-race-at-startup.patch | 61 -----
...ort-sprintf-buffer-in-proc-keys-show-func.patch | 65 -----
.../all/mm-gup-close-foll_map_private-race.patch | 137 ----------
...-buffer-overflow-in-arcmsr_iop_message_xf.patch | 41 ---
...e-after-free-in-tcp_xmit_retransmit_queue.patch | 50 ----
...arm-oabi-compat-add-missing-access-checks.patch | 44 ---
debian/patches/features/all/drm/drm-3.4.patch | 301 ++++++++++++++-------
debian/patches/series | 8 -
11 files changed, 306 insertions(+), 622 deletions(-)
diff --git a/debian/changelog b/debian/changelog
index b7342da..10981b7 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,102 @@
+linux (3.2.84-1) UNRELEASED; urgency=medium
+
+ * New upstream stable update:
+ https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.83
+ https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.84
+ - netlabel: add address family checks to netlbl_{sock,req}_delattr()
+ - sched/cputime: Fix prev steal time accouting during CPU hotplug
+ - crypto: gcm - Filter out async ghash if necessary
+ - Input: xpad - validate USB endpoint count during probe
+ - ext4: check for extents that wrap around
+ - ext4: don't call ext4_should_journal_data() on the journal inode
+ - ext4: validate s_reserved_gdt_blocks on mount
+ - ALSA: ctl: Stop notification after disconnection
+ - ppp: defer netns reference release for ppp channel
+ - [x86] quirks: Add early quirk to reset Apple AirPort card
+ - svc: Avoid garbage replies when pc_func() returns rpc_drop_reply
+ - NFS: Don't drop CB requests with invalid principals
+ - net: ethoc: Fix early error paths
+ - [x86] KVM: nVMX: fix lifetime issues for vmcs02
+ - [x86] KVM: nVMX: Fix memory corruption when using VMCS shadowing
+ - ext4: fix reference counting bug on block allocation error
+ - ext4: short-cut orphan cleanup on error
+ - Bluetooth: Fix l2cap_sock_setsockopt() with optname BT_RCVMTU
+ - crypto: scatterwalk - Fix test in scatterwalk_done
+ - tpm: read burstcount from TPM_STS in one 32-bit transaction
+ - brcmsmac: Initialize power in brcms_c_stf_ss_algo_channel_get()
+ - mtd: nand: fix bug writing 1 byte less than page size
+ - hwmon: (adt7411) set bit 3 in CFG1 register
+ - tty/vt/keyboard: fix OOB access in do_compute_shiftstate()
+ - nfs: don't create zero-length requests
+ - pps: do not crash when failed to register
+ - [armhf/omap] hwmod data: Add sysc information for DSI
+ - net/irda: fix NULL pointer dereference on memory allocation failure
+ - l2tp: Correctly return -EBADF from pppol2tp_getname.
+ - ceph: Correctly return NXIO errors from ceph_llseek
+ - ubi: Fix race condition between ubi device creation and udev
+ - tcp: consider recv buf for the initial window scale
+ - ext4: validate that metadata blocks do not overlap superblock
+ - [amd64] syscalls/64: Add compat_sys_keyctl for 32-bit userspace
+ - balloon: check the number of available pages in leak balloon
+ - dm flakey: error READ bios during the down_interval
+ - mm/hugetlb: avoid soft lockup in set_max_huge_pages()
+ - hostfs: Freeing an ERR_PTR in hostfs_fill_sb_common()
+ - block: fix use-after-free in seq file (CVE-2016-7910)
+ - netfilter: nfnetlink_queue: reject verdict request from different portid
+ - USB: validate wMaxPacketValue entries in endpoint descriptors
+ - [x86] mm: Disable preemption during CR3 read+write
+ - megaraid_sas: Fix probing cards without io port
+ - USB: serial: mos7720: fix non-atomic allocation in write path
+ - USB: serial: mos7840: fix non-atomic allocation in write path
+ - cdc-acm: fix wrong pipe type on rx interrupt xfers
+ - usb: xhci: Fix panic if disconnect
+ - xhci: don't dereference a xhci member after removing xhci
+ - iio: accel: kxsd9: Fix raw read return
+ - USB: fix typo in wMaxPacketSize validation
+ - ubifs: Fix assertion in layout_in_gaps()
+ - [x86] apic: Do not init irq remapping if ioapic is disabled
+ - fs/seq_file: fix out-of-bounds read
+ - ALSA: timer: fix division by zero after SNDRV_TIMER_IOCTL_CONTINUE
+ - ALSA: timer: fix NULL pointer dereference on memory allocation failure
+ - ALSA: timer: fix NULL pointer dereference in read()/ioctl() race
+ - [x86] paravirt: Do not trace _paravirt_ident_*() functions
+ - IB/core: Fix use after free in send_leave function
+ - IB/ipoib: Fix memory corruption in ipoib cm mode connect flow
+ - iio: accel: kxsd9: Fix scaling bug
+ - sched/core: Fix a race between try_to_wake_up() and a woken up task
+ - crypto: cryptd - initialize child shash_desc on import
+ - ALSA: timer: Fix zero-division by continue of uninitialized instance
+ - ALSA: rawmidi: Fix possible deadlock with virmidi registration
+ - xfrm_user: propagate sec ctx allocation errors
+ - NFSv4.1: Fix the CREATE_SESSION slot number accounting
+ - crypto: skcipher - Fix blkcipher walk OOM crash
+ - USB: change bInterval default to 10 ms
+ - IB/ipoib: Don't allow MC joins during light MC flush
+ - irda: Free skb on irda_accept error path.
+ - xfrm: Fix memory leak of aead algorithm name
+ - ocfs2/dlm: fix race between convert and migration
+ - ocfs2: fix start offset to ocfs2_zero_range_for_truncate()
+ - [x86] i2c-eg20t: fix race between i2c init and interrupt enable
+ - btrfs: ensure that file descriptor used with subvol ioctls is a dir
+ - can: dev: fix deadlock reported after bus-off
+ - tracing: Move mutex to protect against resetting of seq data
+ - ipmr, ip6mr: fix scheduling while atomic and a deadlock with
+ ipmr_get_route
+ - mm,ksm: fix endless looping in allocating memory when ksm enable
+ - firewire: net: guard against rx buffer overflows (CVE-2016-8633)
+ - fs: Avoid premature clearing of capabilities (CVE-2015-1350)
+ - Btrfs: skip adding an acl attribute if we don't have to
+ - posix_acl: Clear SGID bit when setting file permissions (CVE-2016-7097)
+ - usbvision: revert commit 588afcc1
+ - xenbus: don't BUG() on user mode induced condition
+ - xenbus: don't look up transaction IDs for ordinary writes
+ - ext3: NULL dereference in ext3_evict_inode()
+
+ [ Ben Hutchings ]
+ * drm, agp: Update to 3.4.113 (no functional change)
+
+ -- Ben Hutchings <ben at decadent.org.uk> Mon, 28 Nov 2016 18:43:52 +0000
+
linux (3.2.82-1) wheezy-security; urgency=high
* New upstream stable update:
diff --git a/debian/patches/bugfix/all/aacraid-check-size-values-after-double-fetch-from-us.patch b/debian/patches/bugfix/all/aacraid-check-size-values-after-double-fetch-from-us.patch
deleted file mode 100644
index d07f5fa..0000000
--- a/debian/patches/bugfix/all/aacraid-check-size-values-after-double-fetch-from-us.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From: Dave Carroll <david.carroll at microsemi.com>
-Date: Fri, 5 Aug 2016 13:44:10 -0600
-Subject: aacraid: Check size values after double-fetch from user
-Origin: https://git.kernel.org/linus/fa00c437eef8dc2e7b25f8cd868cfa405fcc2bb3
-
-In aacraid's ioctl_send_fib() we do two fetches from userspace, one the
-get the fib header's size and one for the fib itself. Later we use the
-size field from the second fetch to further process the fib. If for some
-reason the size from the second fetch is different than from the first
-fix, we may encounter an out-of- bounds access in aac_fib_send(). We
-also check the sender size to insure it is not out of bounds. This was
-reported in https://bugzilla.kernel.org/show_bug.cgi?id=116751 and was
-assigned CVE-2016-6480.
-
-Reported-by: Pengfei Wang <wpengfeinudt at gmail.com>
-Fixes: 7c00ffa31 '[SCSI] 2.6 aacraid: Variable FIB size (updated patch)'
-Cc: stable at vger.kernel.org
-Signed-off-by: Dave Carroll <david.carroll at microsemi.com>
-Reviewed-by: Johannes Thumshirn <jthumshirn at suse.de>
-Signed-off-by: Martin K. Petersen <martin.petersen at oracle.com>
----
- drivers/scsi/aacraid/commctrl.c | 13 +++++++++++--
- 1 file changed, 11 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
-index b381b3718a98..5648b715fed9 100644
---- a/drivers/scsi/aacraid/commctrl.c
-+++ b/drivers/scsi/aacraid/commctrl.c
-@@ -63,7 +63,7 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
- struct fib *fibptr;
- struct hw_fib * hw_fib = (struct hw_fib *)0;
- dma_addr_t hw_fib_pa = (dma_addr_t)0LL;
-- unsigned size;
-+ unsigned int size, osize;
- int retval;
-
- if (dev->in_reset) {
-@@ -87,7 +87,8 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
- * will not overrun the buffer when we copy the memory. Return
- * an error if we would.
- */
-- size = le16_to_cpu(kfib->header.Size) + sizeof(struct aac_fibhdr);
-+ osize = size = le16_to_cpu(kfib->header.Size) +
-+ sizeof(struct aac_fibhdr);
- if (size < le16_to_cpu(kfib->header.SenderSize))
- size = le16_to_cpu(kfib->header.SenderSize);
- if (size > dev->max_fib_size) {
-@@ -118,6 +119,14 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
- goto cleanup;
- }
-
-+ /* Sanity check the second copy */
-+ if ((osize != le16_to_cpu(kfib->header.Size) +
-+ sizeof(struct aac_fibhdr))
-+ || (size < le16_to_cpu(kfib->header.SenderSize))) {
-+ retval = -EINVAL;
-+ goto cleanup;
-+ }
-+
- if (kfib->header.Command == cpu_to_le16(TakeABreakPt)) {
- aac_adapter_interrupt(dev);
- /*
diff --git a/debian/patches/bugfix/all/bluetooth-fix-potential-null-dereference-in-rfcomm-b.patch b/debian/patches/bugfix/all/bluetooth-fix-potential-null-dereference-in-rfcomm-b.patch
deleted file mode 100644
index 29be422..0000000
--- a/debian/patches/bugfix/all/bluetooth-fix-potential-null-dereference-in-rfcomm-b.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From: Jaganath Kanakkassery <jaganath.k at samsung.com>
-Date: Thu, 14 May 2015 12:58:08 +0530
-Subject: Bluetooth: Fix potential NULL dereference in RFCOMM bind callback
-Origin: https://git.kernel.org/linus/951b6a0717db97ce420547222647bcc40bf1eacd
-
-addr can be NULL and it should not be dereferenced before NULL checking.
-
-Signed-off-by: Jaganath Kanakkassery <jaganath.k at samsung.com>
-Signed-off-by: Marcel Holtmann <marcel at holtmann.org>
-[bwh: Backported to 3.2:
- - There's no 'chan' variable
- - Keep using batostr() to log addresses
- - Adjust context]
----
- net/bluetooth/rfcomm/sock.c | 20 ++++++++++++--------
- 1 file changed, 12 insertions(+), 8 deletions(-)
-
---- a/net/bluetooth/rfcomm/sock.c
-+++ b/net/bluetooth/rfcomm/sock.c
-@@ -349,15 +349,19 @@ static int rfcomm_sock_create(struct net
-
- static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
- {
-- struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
-+ struct sockaddr_rc sa;
- struct sock *sk = sock->sk;
-- int err = 0;
--
-- BT_DBG("sk %p %s", sk, batostr(&sa->rc_bdaddr));
-+ int len, err = 0;
-
- if (!addr || addr->sa_family != AF_BLUETOOTH)
- return -EINVAL;
-
-+ memset(&sa, 0, sizeof(sa));
-+ len = min_t(unsigned int, sizeof(sa), addr_len);
-+ memcpy(&sa, addr, len);
-+
-+ BT_DBG("sk %p %s", sk, batostr(&sa.rc_bdaddr));
-+
- lock_sock(sk);
-
- if (sk->sk_state != BT_OPEN) {
-@@ -372,12 +376,13 @@ static int rfcomm_sock_bind(struct socke
-
- write_lock_bh(&rfcomm_sk_list.lock);
-
-- if (sa->rc_channel && __rfcomm_get_sock_by_addr(sa->rc_channel, &sa->rc_bdaddr)) {
-+ if (sa.rc_channel &&
-+ __rfcomm_get_sock_by_addr(sa.rc_channel, &sa.rc_bdaddr)) {
- err = -EADDRINUSE;
- } else {
- /* Save source address */
-- bacpy(&bt_sk(sk)->src, &sa->rc_bdaddr);
-- rfcomm_pi(sk)->channel = sa->rc_channel;
-+ bacpy(&bt_sk(sk)->src, &sa.rc_bdaddr);
-+ rfcomm_pi(sk)->channel = sa.rc_channel;
- sk->sk_state = BT_BOUND;
- }
-
diff --git a/debian/patches/bugfix/all/drm-radeon-fix-hotplug-race-at-startup.patch b/debian/patches/bugfix/all/drm-radeon-fix-hotplug-race-at-startup.patch
deleted file mode 100644
index 8bf8aff..0000000
--- a/debian/patches/bugfix/all/drm-radeon-fix-hotplug-race-at-startup.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From: Dave Airlie <airlied at redhat.com>
-Date: Thu, 20 Aug 2015 10:13:55 +1000
-Subject: drm/radeon: fix hotplug race at startup
-Origin: https://git.kernel.org/linus/7f98ca454ad373fc1b76be804fa7138ff68c1d27
-Bug-Debian: https://bugs.debian.org/808973
-
-We apparantly get a hotplug irq before we've initialised
-modesetting,
-
-[drm] Loading R100 Microcode
-BUG: unable to handle kernel NULL pointer dereference at (null)
-IP: [<c125f56f>] __mutex_lock_slowpath+0x23/0x91
-*pde = 00000000
-Oops: 0002 [#1]
-Modules linked in: radeon(+) drm_kms_helper ttm drm i2c_algo_bit backlight pcspkr psmouse evdev sr_mod input_leds led_class cdrom sg parport_pc parport floppy intel_agp intel_gtt lpc_ich acpi_cpufreq processor button mfd_core agpgart uhci_hcd ehci_hcd rng_core snd_intel8x0 snd_ac97_codec ac97_bus snd_pcm usbcore usb_common i2c_i801 i2c_core snd_timer snd soundcore thermal_sys
-CPU: 0 PID: 15 Comm: kworker/0:1 Not tainted 4.2.0-rc7-00015-gbf67402 #111
-Hardware name: MicroLink /D850MV , BIOS MV85010A.86A.0067.P24.0304081124 04/08/2003
-Workqueue: events radeon_hotplug_work_func [radeon]
-task: f6ca5900 ti: f6d3e000 task.ti: f6d3e000
-EIP: 0060:[<c125f56f>] EFLAGS: 00010282 CPU: 0
-EIP is at __mutex_lock_slowpath+0x23/0x91
-EAX: 00000000 EBX: f5e900fc ECX: 00000000 EDX: fffffffe
-ESI: f6ca5900 EDI: f5e90100 EBP: f5e90000 ESP: f6d3ff0c
- DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068
-CR0: 8005003b CR2: 00000000 CR3: 36f61000 CR4: 000006d0
-Stack:
- f5e90100 00000000 c103c4c1 f6d2a5a0 f5e900fc f6df394c c125f162 f8b0faca
- f6d2a5a0 c138ca00 f6df394c f7395600 c1034741 00d40000 00000000 f6d2a5a0
- c138ca00 f6d2a5b8 c138ca10 c1034b58 00000001 f6d40000 f6ca5900 f6d0c940
-Call Trace:
- [<c103c4c1>] ? dequeue_task_fair+0xa4/0xb7
- [<c125f162>] ? mutex_lock+0x9/0xa
- [<f8b0faca>] ? radeon_hotplug_work_func+0x17/0x57 [radeon]
- [<c1034741>] ? process_one_work+0xfc/0x194
- [<c1034b58>] ? worker_thread+0x18d/0x218
- [<c10349cb>] ? rescuer_thread+0x1d5/0x1d5
- [<c103742a>] ? kthread+0x7b/0x80
- [<c12601c0>] ? ret_from_kernel_thread+0x20/0x30
- [<c10373af>] ? init_completion+0x18/0x18
-Code: 42 08 e8 8e a6 dd ff c3 57 56 53 83 ec 0c 8b 35 48 f7 37 c1 8b 10 4a 74 1a 89 c3 8d 78 04 8b 40 08 89 63
-
-Reported-and-Tested-by: Meelis Roos <mroos at linux.ee>
-Signed-off-by: Dave Airlie <airlied at redhat.com>
----
- drivers/gpu/drm/radeon/radeon_irq_kms.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
---- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
-+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
-@@ -51,6 +51,11 @@ static void radeon_hotplug_work_func(str
- struct drm_mode_config *mode_config = &dev->mode_config;
- struct drm_connector *connector;
-
-+ /* we can race here at startup, some boards seem to trigger
-+ * hotplug irqs when they shouldn't. */
-+ if (!rdev->mode_info.mode_config_initialized)
-+ return;
-+
- mutex_lock(&mode_config->mutex);
- if (mode_config->num_connector) {
- list_for_each_entry(connector, &mode_config->connector_list, head)
diff --git a/debian/patches/bugfix/all/keys-fix-short-sprintf-buffer-in-proc-keys-show-func.patch b/debian/patches/bugfix/all/keys-fix-short-sprintf-buffer-in-proc-keys-show-func.patch
deleted file mode 100644
index b798430..0000000
--- a/debian/patches/bugfix/all/keys-fix-short-sprintf-buffer-in-proc-keys-show-func.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From: David Howells <dhowells at redhat.com>
-Date: Thu, 13 Oct 2016 22:38:46 +0200
-Subject: KEYS: Fix short sprintf buffer in /proc/keys show function
-Origin: https://bugzilla.redhat.com/attachment.cgi?id=1200212
-
-Fix a short sprintf buffer in proc_keys_show(). If the gcc stack protector
-is turned on, this can cause a panic due to stack corruption.
-
-The problem is that xbuf[] is not big enough to hold a 64-bit timeout
-rendered as weeks:
-
- (gdb) p 0xffffffffffffffffULL/(60*60*24*7)
- $2 = 30500568904943
-
-That's 14 chars plus NUL, not 11 chars plus NUL.
-
-Expand the buffer to 16 chars.
-
-I think the unpatched code apparently works if the stack-protector is not
-enabled because on a 32-bit machine the buffer won't be overflowed and on a
-64-bit machine there's a 64-bit aligned pointer at one side and an int that
-isn't checked again on the other side.
-
-The panic incurred looks something like:
-
-Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffff81352ebe
-CPU: 0 PID: 1692 Comm: reproducer Not tainted 4.7.2-201.fc24.x86_64 #1
-Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
- 0000000000000086 00000000fbbd2679 ffff8800a044bc00 ffffffff813d941f
- ffffffff81a28d58 ffff8800a044bc98 ffff8800a044bc88 ffffffff811b2cb6
- ffff880000000010 ffff8800a044bc98 ffff8800a044bc30 00000000fbbd2679
-Call Trace:
- [<ffffffff813d941f>] dump_stack+0x63/0x84
- [<ffffffff811b2cb6>] panic+0xde/0x22a
- [<ffffffff81352ebe>] ? proc_keys_show+0x3ce/0x3d0
- [<ffffffff8109f7f9>] __stack_chk_fail+0x19/0x30
- [<ffffffff81352ebe>] proc_keys_show+0x3ce/0x3d0
- [<ffffffff81350410>] ? key_validate+0x50/0x50
- [<ffffffff8134db30>] ? key_default_cmp+0x20/0x20
- [<ffffffff8126b31c>] seq_read+0x2cc/0x390
- [<ffffffff812b6b12>] proc_reg_read+0x42/0x70
- [<ffffffff81244fc7>] __vfs_read+0x37/0x150
- [<ffffffff81357020>] ? security_file_permission+0xa0/0xc0
- [<ffffffff81246156>] vfs_read+0x96/0x130
- [<ffffffff81247635>] SyS_read+0x55/0xc0
- [<ffffffff817eb872>] entry_SYSCALL_64_fastpath+0x1a/0xa4
-
-Reported-by: Ondrej Kozina <okozina at redhat.com>
-Signed-off-by: David Howells <dhowells at redhat.com>
-Tested-by: Ondrej Kozina <okozina at redhat.com>
----
- security/keys/proc.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/security/keys/proc.c
-+++ b/security/keys/proc.c
-@@ -188,7 +188,7 @@ static int proc_keys_show(struct seq_fil
- struct timespec now;
- unsigned long timo;
- key_ref_t key_ref, skey_ref;
-- char xbuf[12];
-+ char xbuf[16];
- int rc;
-
- key_ref = make_key_ref(key, 0);
diff --git a/debian/patches/bugfix/all/mm-gup-close-foll_map_private-race.patch b/debian/patches/bugfix/all/mm-gup-close-foll_map_private-race.patch
deleted file mode 100644
index a37c914..0000000
--- a/debian/patches/bugfix/all/mm-gup-close-foll_map_private-race.patch
+++ /dev/null
@@ -1,137 +0,0 @@
-From: Michal Hocko <mhocko at suse.com>
-Date: Sun, 16 Oct 2016 11:55:00 +0200
-Subject: mm, gup: close FOLL MAP_PRIVATE race
-
-faultin_page drops FOLL_WRITE after the page fault handler did the CoW
-and then we retry follow_page_mask to get our CoWed page. This is racy,
-however because the page might have been unmapped by that time and so
-we would have to do a page fault again, this time without CoW. This
-would cause the page cache corruption for FOLL_FORCE on MAP_PRIVATE
-read only mappings with obvious consequences.
-
-This is an ancient bug that was actually already fixed once by Linus
-eleven years ago in commit 4ceb5db9757a ("Fix get_user_pages() race
-for write access") but that was then undone due to problems on s390
-by commit f33ea7f404e5 ("fix get_user_pages bug") because s390 didn't
-have proper dirty pte tracking until abf09bed3cce ("s390/mm: implement
-software dirty bits"). This wasn't a problem at the time as pointed out
-by Hugh Dickins because madvise relied on mmap_sem for write up until
-0a27a14a6292 ("mm: madvise avoid exclusive mmap_sem") but since then we
-can race with madvise which can unmap the fresh COWed page or with KSM
-and corrupt the content of the shared page.
-
-This patch is based on the Linus' approach to not clear FOLL_WRITE after
-the CoW page fault (aka VM_FAULT_WRITE) but instead introduces FOLL_COW
-to note this fact. The flag is then rechecked during follow_pfn_pte to
-enforce the page fault again if we do not see the CoWed page. Linus was
-suggesting to check pte_dirty again as s390 is OK now. But that would
-make backporting to some old kernels harder. So instead let's just make
-sure that vm_normal_page sees a pure anonymous page.
-
-This would guarantee we are seeing a real CoW page. Introduce
-can_follow_write_pte which checks both pte_write and falls back to
-PageAnon on forced write faults which passed CoW already. Thanks to Hugh
-to point out that a special care has to be taken for KSM pages because
-our COWed page might have been merged with a KSM one and keep its
-PageAnon flag.
-
-Fixes: 0a27a14a6292 ("mm: madvise avoid exclusive mmap_sem")
-Reported-by: Phil "not Paul" Oester <kernel at linuxace.com>
-Disclosed-by: Andy Lutomirski <luto at kernel.org>
-Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
-Signed-off-by: Michal Hocko <mhocko at suse.com>
-[bwh: Backported to 3.2:
- - Adjust filename, context, indentation
- - The 'no_page' exit path in follow_page() is different, so open-code the
- cleanup
- - Delete a now-unused label]
-Signed-off-by: Ben Hutchings <ben at decadent.org.uk>
----
- include/linux/mm.h | 1 +
- mm/memory.c | 39 ++++++++++++++++++++++++++++-----------
- 2 files changed, 29 insertions(+), 11 deletions(-)
-
---- a/include/linux/mm.h
-+++ b/include/linux/mm.h
-@@ -1527,6 +1527,7 @@ struct page *follow_page(struct vm_area_
- #define FOLL_MLOCK 0x40 /* mark page as mlocked */
- #define FOLL_SPLIT 0x80 /* don't return transhuge pages, split them */
- #define FOLL_HWPOISON 0x100 /* check page is hwpoisoned */
-+#define FOLL_COW 0x4000 /* internal GUP flag */
-
- typedef int (*pte_fn_t)(pte_t *pte, pgtable_t token, unsigned long addr,
- void *data);
---- a/mm/memory.c
-+++ b/mm/memory.c
-@@ -1427,6 +1427,24 @@ int zap_vma_ptes(struct vm_area_struct *
- }
- EXPORT_SYMBOL_GPL(zap_vma_ptes);
-
-+static inline bool can_follow_write_pte(pte_t pte, struct page *page,
-+ unsigned int flags)
-+{
-+ if (pte_write(pte))
-+ return true;
-+
-+ /*
-+ * Make sure that we are really following CoWed page. We do not really
-+ * have to care about exclusiveness of the page because we only want
-+ * to ensure that once COWed page hasn't disappeared in the meantime
-+ * or it hasn't been merged to a KSM page.
-+ */
-+ if ((flags & FOLL_FORCE) && (flags & FOLL_COW))
-+ return page && PageAnon(page) && !PageKsm(page);
-+
-+ return false;
-+}
-+
- /**
- * follow_page - look up a page descriptor from a user-virtual address
- * @vma: vm_area_struct mapping @address
-@@ -1509,10 +1527,13 @@ split_fallthrough:
- pte = *ptep;
- if (!pte_present(pte))
- goto no_page;
-- if ((flags & FOLL_WRITE) && !pte_write(pte))
-- goto unlock;
-
- page = vm_normal_page(vma, address, pte);
-+ if ((flags & FOLL_WRITE) && !can_follow_write_pte(pte, page, flags)) {
-+ pte_unmap_unlock(ptep, ptl);
-+ return NULL;
-+ }
-+
- if (unlikely(!page)) {
- if ((flags & FOLL_DUMP) ||
- !is_zero_pfn(pte_pfn(pte)))
-@@ -1555,7 +1576,7 @@ split_fallthrough:
- unlock_page(page);
- }
- }
--unlock:
-+
- pte_unmap_unlock(ptep, ptl);
- out:
- return page;
-@@ -1789,17 +1810,13 @@ int __get_user_pages(struct task_struct
- * The VM_FAULT_WRITE bit tells us that
- * do_wp_page has broken COW when necessary,
- * even if maybe_mkwrite decided not to set
-- * pte_write. We can thus safely do subsequent
-- * page lookups as if they were reads. But only
-- * do so when looping for pte_write is futile:
-- * in some cases userspace may also be wanting
-- * to write to the gotten user page, which a
-- * read fault here might prevent (a readonly
-- * page might get reCOWed by userspace write).
-+ * pte_write. We cannot simply drop FOLL_WRITE
-+ * here because the COWed page might be gone by
-+ * the time we do the subsequent page lookups.
- */
- if ((ret & VM_FAULT_WRITE) &&
- !(vma->vm_flags & VM_WRITE))
-- foll_flags &= ~FOLL_WRITE;
-+ foll_flags |= FOLL_COW;
-
- cond_resched();
- }
diff --git a/debian/patches/bugfix/all/scsi-arcmsr-buffer-overflow-in-arcmsr_iop_message_xf.patch b/debian/patches/bugfix/all/scsi-arcmsr-buffer-overflow-in-arcmsr_iop_message_xf.patch
deleted file mode 100644
index 572d9ed..0000000
--- a/debian/patches/bugfix/all/scsi-arcmsr-buffer-overflow-in-arcmsr_iop_message_xf.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From: Dan Carpenter <dan.carpenter at oracle.com>
-Date: Thu, 15 Sep 2016 16:44:56 +0300
-Subject: scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer()
-Origin: https://git.kernel.org/linus/7bc2b55a5c030685b399bb65b6baa9ccc3d1f167
-
-We need to put an upper bound on "user_len" so the memcpy() doesn't
-overflow.
-
-Cc: <stable at vger.kernel.org>
-Reported-by: Marco Grassi <marco.gra at gmail.com>
-Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
-Reviewed-by: Tomas Henzl <thenzl at redhat.com>
-Signed-off-by: Martin K. Petersen <martin.petersen at oracle.com>
-[bwh: Backported to 3.2:
- - Adjust context
- - Use literal 1032 insetad of ARCMSR_API_DATA_BUFLEN]
----
---- a/drivers/scsi/arcmsr/arcmsr_hba.c
-+++ b/drivers/scsi/arcmsr/arcmsr_hba.c
-@@ -1803,7 +1803,8 @@ static int arcmsr_iop_message_xfer(struc
-
- case ARCMSR_MESSAGE_WRITE_WQBUFFER: {
- unsigned char *ver_addr;
-- int32_t my_empty_len, user_len, wqbuf_firstindex, wqbuf_lastindex;
-+ uint32_t user_len;
-+ int32_t my_empty_len, wqbuf_firstindex, wqbuf_lastindex;
- uint8_t *pQbuffer, *ptmpuserbuffer;
-
- ver_addr = kmalloc(1032, GFP_ATOMIC);
-@@ -1820,6 +1821,11 @@ static int arcmsr_iop_message_xfer(struc
- }
- ptmpuserbuffer = ver_addr;
- user_len = pcmdmessagefld->cmdmessage.Length;
-+ if (user_len > 1032) {
-+ retvalue = ARCMSR_MESSAGE_FAIL;
-+ kfree(ver_addr);
-+ goto message_out;
-+ }
- memcpy(ptmpuserbuffer, pcmdmessagefld->messagedatabuffer, user_len);
- wqbuf_lastindex = acb->wqbuf_lastindex;
- wqbuf_firstindex = acb->wqbuf_firstindex;
diff --git a/debian/patches/bugfix/all/tcp-fix-use-after-free-in-tcp_xmit_retransmit_queue.patch b/debian/patches/bugfix/all/tcp-fix-use-after-free-in-tcp_xmit_retransmit_queue.patch
deleted file mode 100644
index 19b6906..0000000
--- a/debian/patches/bugfix/all/tcp-fix-use-after-free-in-tcp_xmit_retransmit_queue.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From: Eric Dumazet <edumazet at google.com>
-Date: Wed, 17 Aug 2016 05:56:26 -0700
-Subject: tcp: fix use after free in tcp_xmit_retransmit_queue()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-Origin: https://git.kernel.org/linus/bb1fceca22492109be12640d49f5ea5a544c6bb4
-
-When tcp_sendmsg() allocates a fresh and empty skb, it puts it at the
-tail of the write queue using tcp_add_write_queue_tail()
-
-Then it attempts to copy user data into this fresh skb.
-
-If the copy fails, we undo the work and remove the fresh skb.
-
-Unfortunately, this undo lacks the change done to tp->highest_sack and
-we can leave a dangling pointer (to a freed skb)
-
-Later, tcp_xmit_retransmit_queue() can dereference this pointer and
-access freed memory. For regular kernels where memory is not unmapped,
-this might cause SACK bugs because tcp_highest_sack_seq() is buggy,
-returning garbage instead of tp->snd_nxt, but with various debug
-features like CONFIG_DEBUG_PAGEALLOC, this can crash the kernel.
-
-This bug was found by Marco Grassi thanks to syzkaller.
-
-Fixes: 6859d49475d4 ("[TCP]: Abstract tp->highest_sack accessing & point to next skb")
-Reported-by: Marco Grassi <marco.gra at gmail.com>
-Signed-off-by: Eric Dumazet <edumazet at google.com>
-Cc: Ilpo Järvinen <ilpo.jarvinen at helsinki.fi>
-Cc: Yuchung Cheng <ycheng at google.com>
-Cc: Neal Cardwell <ncardwell at google.com>
-Acked-by: Neal Cardwell <ncardwell at google.com>
-Reviewed-by: Cong Wang <xiyou.wangcong at gmail.com>
-Signed-off-by: David S. Miller <davem at davemloft.net>
----
- include/net/tcp.h | 2 ++
- 1 file changed, 2 insertions(+)
-
---- a/include/net/tcp.h
-+++ b/include/net/tcp.h
-@@ -1293,6 +1293,8 @@ static inline void tcp_check_send_head(s
- {
- if (sk->sk_send_head == skb_unlinked)
- sk->sk_send_head = NULL;
-+ if (tcp_sk(sk)->highest_sack == skb_unlinked)
-+ tcp_sk(sk)->highest_sack = NULL;
- }
-
- static inline void tcp_init_send_head(struct sock *sk)
diff --git a/debian/patches/bugfix/arm/arm-oabi-compat-add-missing-access-checks.patch b/debian/patches/bugfix/arm/arm-oabi-compat-add-missing-access-checks.patch
deleted file mode 100644
index 4aef6ef..0000000
--- a/debian/patches/bugfix/arm/arm-oabi-compat-add-missing-access-checks.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From: Dave Weinstein <olorin at google.com>
-Date: Thu, 28 Jul 2016 11:55:41 -0700
-Subject: arm: oabi compat: add missing access checks
-Origin: https://git.kernel.org/linus/7de249964f5578e67b99699c5f0b405738d820a2
-
-Add access checks to sys_oabi_epoll_wait() and sys_oabi_semtimedop().
-This fixes CVE-2016-3857, a local privilege escalation under
-CONFIG_OABI_COMPAT.
-
-Cc: stable at vger.kernel.org
-Reported-by: Chiachih Wu <wuchiachih at gmail.com>
-Reviewed-by: Kees Cook <keescook at chromium.org>
-Reviewed-by: Nicolas Pitre <nico at linaro.org>
-Signed-off-by: Dave Weinstein <olorin at google.com>
-Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
----
- arch/arm/kernel/sys_oabi-compat.c | 8 +++++++-
- 1 file changed, 7 insertions(+), 1 deletion(-)
-
---- a/arch/arm/kernel/sys_oabi-compat.c
-+++ b/arch/arm/kernel/sys_oabi-compat.c
-@@ -275,8 +275,12 @@ asmlinkage long sys_oabi_epoll_wait(int
- mm_segment_t fs;
- long ret, err, i;
-
-- if (maxevents <= 0 || maxevents > (INT_MAX/sizeof(struct epoll_event)))
-+ if (maxevents <= 0 ||
-+ maxevents > (INT_MAX/sizeof(*kbuf)) ||
-+ maxevents > (INT_MAX/sizeof(*events)))
- return -EINVAL;
-+ if (!access_ok(VERIFY_WRITE, events, sizeof(*events) * maxevents))
-+ return -EFAULT;
- kbuf = kmalloc(sizeof(*kbuf) * maxevents, GFP_KERNEL);
- if (!kbuf)
- return -ENOMEM;
-@@ -313,6 +317,8 @@ asmlinkage long sys_oabi_semtimedop(int
-
- if (nsops < 1 || nsops > SEMOPM)
- return -EINVAL;
-+ if (!access_ok(VERIFY_READ, tsops, sizeof(*tsops) * nsops))
-+ return -EFAULT;
- sops = kmalloc(sizeof(*sops) * nsops, GFP_KERNEL);
- if (!sops)
- return -ENOMEM;
diff --git a/debian/patches/features/all/drm/drm-3.4.patch b/debian/patches/features/all/drm/drm-3.4.patch
index 4d5e723..5eb4040 100644
--- a/debian/patches/features/all/drm/drm-3.4.patch
+++ b/debian/patches/features/all/drm/drm-3.4.patch
@@ -351,7 +351,7 @@ index 6d440fb894cf..325365f6d355 100644
return -EINVAL;
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
-index 20110b4ad791..93c5b2fdf9b4 100644
+index 4ca454bf69a3..93c5b2fdf9b4 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -36,11 +36,7 @@
@@ -962,7 +962,7 @@ index 20110b4ad791..93c5b2fdf9b4 100644
}
/**
-@@ -1234,7 +1317,7 @@ out:
+@@ -1234,7 +1317,7 @@ int drm_mode_getresources(struct drm_device *dev, void *data,
* @arg: arg from ioctl
*
* LOCKING:
@@ -971,7 +971,7 @@ index 20110b4ad791..93c5b2fdf9b4 100644
*
* Construct a CRTC configuration structure to return to the user.
*
-@@ -1294,7 +1377,7 @@ out:
+@@ -1294,7 +1377,7 @@ int drm_mode_getcrtc(struct drm_device *dev,
* @arg: arg from ioctl
*
* LOCKING:
@@ -1009,7 +1009,7 @@ index 20110b4ad791..93c5b2fdf9b4 100644
for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
if (connector->encoder_ids[i] != 0) {
if (put_user(connector->encoder_ids[i],
-@@ -1471,6 +1554,254 @@ out:
+@@ -1471,6 +1554,254 @@ int drm_mode_getencoder(struct drm_device *dev, void *data,
}
/**
@@ -1264,7 +1264,7 @@ index 20110b4ad791..93c5b2fdf9b4 100644
* drm_mode_setcrtc - set CRTC configuration
* @inode: inode from the ioctl
* @filp: file * from the ioctl
-@@ -1478,7 +1809,7 @@ out:
+@@ -1478,7 +1809,7 @@ int drm_mode_getencoder(struct drm_device *dev, void *data,
* @arg: arg from ioctl
*
* LOCKING:
@@ -1351,7 +1351,7 @@ index 20110b4ad791..93c5b2fdf9b4 100644
mutex_unlock(&dev->mode_config.mutex);
return ret;
}
-@@ -1667,6 +2019,42 @@ out:
+@@ -1667,6 +2019,42 @@ int drm_mode_cursor_ioctl(struct drm_device *dev,
return ret;
}
@@ -1394,7 +1394,7 @@ index 20110b4ad791..93c5b2fdf9b4 100644
/**
* drm_mode_addfb - add an FB to the graphics configuration
* @inode: inode from the ioctl
-@@ -1687,18 +2075,27 @@ out:
+@@ -1687,18 +2075,27 @@ int drm_mode_cursor_ioctl(struct drm_device *dev,
int drm_mode_addfb(struct drm_device *dev,
void *data, struct drm_file *file_priv)
{
@@ -1564,7 +1564,7 @@ index 20110b4ad791..93c5b2fdf9b4 100644
fb = dev->mode_config.funcs->fb_create(dev, file_priv, r);
if (IS_ERR(fb)) {
DRM_ERROR("could not create framebuffer\n");
-@@ -1789,7 +2318,7 @@ out:
+@@ -1789,7 +2318,7 @@ int drm_mode_rmfb(struct drm_device *dev,
* @arg: arg from ioctl
*
* LOCKING:
@@ -1890,7 +1890,17 @@ index 20110b4ad791..93c5b2fdf9b4 100644
}
EXPORT_SYMBOL(drm_mode_crtc_set_gamma_size);
-@@ -2702,6 +3297,18 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
+@@ -2675,9 +3270,6 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
+ unsigned long flags;
+ int ret = -EINVAL;
+
+- if (!drm_core_check_feature(dev, DRIVER_MODESET))
+- return -EINVAL;
+-
+ if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS ||
+ page_flip->reserved != 0)
+ return -EINVAL;
+@@ -2705,6 +3297,18 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
goto out;
fb = obj_to_fb(obj);
@@ -1909,7 +1919,7 @@ index 20110b4ad791..93c5b2fdf9b4 100644
if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
ret = -ENOMEM;
spin_lock_irqsave(&dev->event_lock, flags);
-@@ -2731,10 +3338,12 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
+@@ -2734,10 +3338,12 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
ret = crtc->funcs->page_flip(crtc, fb, e);
if (ret) {
@@ -1926,7 +1936,7 @@ index 20110b4ad791..93c5b2fdf9b4 100644
}
out:
-@@ -2794,3 +3403,72 @@ int drm_mode_destroy_dumb_ioctl(struct drm_device *dev,
+@@ -2797,3 +3403,72 @@ int drm_mode_destroy_dumb_ioctl(struct drm_device *dev,
return dev->driver->dumb_destroy(file_priv, dev, args->handle);
}
@@ -2070,7 +2080,7 @@ index 11788f72e2b0..b3abf7044718 100644
if (mode->status == MODE_OK)
mode->status = connector_funcs->mode_valid(connector,
mode);
-@@ -151,7 +158,7 @@ prune:
+@@ -151,7 +158,7 @@ int drm_helper_probe_single_connector_modes(struct drm_connector *connector,
DRM_DEBUG_KMS("[CONNECTOR:%d:%s] probed modes :\n", connector->base.id,
drm_get_connector_name(connector));
@@ -2241,19 +2251,31 @@ index 0731d437e7fb..e9f1ef5d9340 100644
if (ioctl->flags & DRM_UNLOCKED)
retcode = func(dev, kdata, file_priv);
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
-index 72f460e22b76..d75dccb562f3 100644
+index bcfcfbb32877..d75dccb562f3 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
-@@ -68,6 +68,8 @@
+@@ -68,8 +68,8 @@
#define EDID_QUIRK_DETAILED_SYNC_PP (1 << 6)
/* Force reduced-blanking timings for detailed modes */
#define EDID_QUIRK_FORCE_REDUCED_BLANKING (1 << 7)
+-/* Force 6bpc */
+-#define EDID_QUIRK_FORCE_6BPC (1 << 10)
+/* Force 8bpc */
+#define EDID_QUIRK_FORCE_8BPC (1 << 8)
struct detailed_mode_closure {
struct drm_connector *connector;
-@@ -128,6 +130,9 @@ static struct edid_quirk {
+@@ -96,9 +96,6 @@ static struct edid_quirk {
+ /* Unknown Acer */
+ { "ACR", 2423, EDID_QUIRK_FIRST_DETAILED_PREFERRED },
+
+- /* AEO model 0 reports 8 bpc, but is a 6 bpc panel */
+- { "AEO", 0, EDID_QUIRK_FORCE_6BPC },
+-
+ /* Belinea 10 15 55 */
+ { "MAX", 1516, EDID_QUIRK_PREFER_LARGE_60 },
+ { "MAX", 0x77e, EDID_QUIRK_PREFER_LARGE_60 },
+@@ -133,6 +130,9 @@ static struct edid_quirk {
/* Medion MD 30217 PG */
{ "MED", 0x7b8, EDID_QUIRK_PREFER_LARGE_75 },
@@ -2263,7 +2285,7 @@ index 72f460e22b76..d75dccb562f3 100644
};
/*** DDC fetch and block validation ***/
-@@ -157,8 +162,7 @@ EXPORT_SYMBOL(drm_edid_header_is_valid);
+@@ -162,8 +162,7 @@ EXPORT_SYMBOL(drm_edid_header_is_valid);
* Sanity check the EDID block (base or extension). Return 0 if the block
* doesn't check out, or 1 if it's valid.
*/
@@ -2273,7 +2295,7 @@ index 72f460e22b76..d75dccb562f3 100644
{
int i;
u8 csum = 0;
-@@ -211,6 +215,7 @@ bad:
+@@ -216,6 +215,7 @@ drm_edid_block_valid(u8 *raw_edid)
}
return 0;
}
@@ -2281,7 +2303,7 @@ index 72f460e22b76..d75dccb562f3 100644
/**
* drm_edid_is_valid - sanity check EDID data
-@@ -234,7 +239,6 @@ bool drm_edid_is_valid(struct edid *edid)
+@@ -239,7 +239,6 @@ bool drm_edid_is_valid(struct edid *edid)
}
EXPORT_SYMBOL(drm_edid_is_valid);
@@ -2289,7 +2311,7 @@ index 72f460e22b76..d75dccb562f3 100644
#define DDC_SEGMENT_ADDR 0x30
/**
* Get EDID information via I2C.
-@@ -521,25 +525,10 @@ static void
+@@ -526,25 +525,10 @@ static void
cea_for_each_detailed_block(u8 *ext, detailed_cb *cb, void *closure)
{
int i, n = 0;
@@ -2317,7 +2339,7 @@ index 72f460e22b76..d75dccb562f3 100644
for (i = 0; i < n; i++)
cb((struct detailed_timing *)(det_base + 18 * i), closure);
}
-@@ -773,7 +762,7 @@ drm_mode_std(struct drm_connector *connector, struct edid *edid,
+@@ -778,7 +762,7 @@ drm_mode_std(struct drm_connector *connector, struct edid *edid,
*/
mode = drm_gtf_mode(dev, hsize, vsize, vrefresh_rate, 0, 0);
if (drm_mode_hsync(mode) > drm_gtf2_hbreak(edid)) {
@@ -2326,7 +2348,7 @@ index 72f460e22b76..d75dccb562f3 100644
mode = drm_gtf_mode_complex(dev, hsize, vsize,
vrefresh_rate, 0, 0,
drm_gtf2_m(edid),
-@@ -1342,6 +1331,7 @@ add_detailed_modes(struct drm_connector *connector, struct edid *edid,
+@@ -1347,6 +1331,7 @@ add_detailed_modes(struct drm_connector *connector, struct edid *edid,
#define HDMI_IDENTIFIER 0x000C03
#define AUDIO_BLOCK 0x01
@@ -2334,7 +2356,7 @@ index 72f460e22b76..d75dccb562f3 100644
#define VENDOR_BLOCK 0x03
#define SPEAKER_BLOCK 0x04
#define EDID_BASIC_AUDIO (1 << 6)
-@@ -1372,6 +1362,47 @@ u8 *drm_find_cea_extension(struct edid *edid)
+@@ -1377,6 +1362,47 @@ u8 *drm_find_cea_extension(struct edid *edid)
}
EXPORT_SYMBOL(drm_find_cea_extension);
@@ -2382,7 +2404,7 @@ index 72f460e22b76..d75dccb562f3 100644
static void
parse_hdmi_vsdb(struct drm_connector *connector, uint8_t *db)
{
-@@ -1455,26 +1486,29 @@ void drm_edid_to_eld(struct drm_connector *connector, struct edid *edid)
+@@ -1460,26 +1486,29 @@ void drm_edid_to_eld(struct drm_connector *connector, struct edid *edid)
eld[18] = edid->prod_code[0];
eld[19] = edid->prod_code[1];
@@ -2431,7 +2453,7 @@ index 72f460e22b76..d75dccb562f3 100644
eld[5] |= sad_count << 4;
eld[2] = (20 + mnl + sad_count * 3 + 3) / 4;
-@@ -1746,12 +1780,16 @@ int drm_add_edid_modes(struct drm_connector *connector, struct edid *edid)
+@@ -1751,14 +1780,15 @@ int drm_add_edid_modes(struct drm_connector *connector, struct edid *edid)
num_modes += add_established_modes(connector, edid);
if (edid->features & DRM_EDID_FEATURE_DEFAULT_GTF)
num_modes += add_inferred_modes(connector, edid);
@@ -2442,12 +2464,13 @@ index 72f460e22b76..d75dccb562f3 100644
drm_add_display_info(edid, &connector->display_info);
+- if (quirks & EDID_QUIRK_FORCE_6BPC)
+- connector->display_info.bpc = 6;
+ if (quirks & EDID_QUIRK_FORCE_8BPC)
+ connector->display_info.bpc = 8;
-+
+
return num_modes;
}
- EXPORT_SYMBOL(drm_add_edid_modes);
diff --git a/drivers/gpu/drm/drm_edid_load.c b/drivers/gpu/drm/drm_edid_load.c
new file mode 100644
index 000000000000..da9acba2dd6c
@@ -4444,7 +4467,7 @@ index 6c1f6cea40a5..aa454f80e109 100644
/**
-@@ -402,6 +398,7 @@ err_idr:
+@@ -402,6 +398,7 @@ int drm_get_minor(struct drm_device *dev, struct drm_minor **minor, int type)
*minor = NULL;
return ret;
}
@@ -4517,7 +4540,7 @@ index 0f9ef9bf6730..5a7bd51fc3d8 100644
}
EXPORT_SYMBOL(drm_sysfs_connector_remove);
-@@ -533,7 +536,9 @@ err_out:
+@@ -533,7 +536,9 @@ int drm_sysfs_device_add(struct drm_minor *minor)
*/
void drm_sysfs_device_remove(struct drm_minor *minor)
{
@@ -5099,7 +5122,7 @@ index d620b0784257..bf791fa0e50d 100644
default:
type = DRM_MODE_CONNECTOR_Unknown;
break;
-@@ -319,9 +352,3 @@ err_connector:
+@@ -319,9 +352,3 @@ struct drm_connector *exynos_drm_connector_create(struct drm_device *dev,
kfree(exynos_connector);
return NULL;
}
@@ -6763,7 +6786,7 @@ index 836f41008187..d5586cc75163 100644
/*
* if failed, all resources allocated above would be released by
-@@ -184,58 +171,6 @@ out:
+@@ -184,58 +171,6 @@ static int exynos_drm_fbdev_create(struct drm_fb_helper *helper,
return ret;
}
@@ -7493,7 +7516,7 @@ index db3b3d9e731d..29fdbfeb43cb 100644
exynos_drm_subdrv_register(subdrv);
return 0;
-@@ -797,14 +922,25 @@ err_clk_get:
+@@ -797,14 +922,25 @@ static int __devinit fimd_probe(struct platform_device *pdev)
static int __devexit fimd_remove(struct platform_device *pdev)
{
@@ -43854,7 +43877,7 @@ index ca67338e5533..38c0a4720cc8 100644
/* Try to set up FBC with a reasonable compressed buffer size */
if (I915_HAS_FBC(dev) && i915_powersave) {
-@@ -1292,6 +1332,7 @@ cleanup_gem:
+@@ -1292,6 +1332,7 @@ static int i915_load_modeset_init(struct drm_device *dev)
mutex_lock(&dev->struct_mutex);
i915_gem_cleanup_ringbuffer(dev);
mutex_unlock(&dev->struct_mutex);
@@ -45566,7 +45589,7 @@ index 315a49e4323f..b1f1d105e8c7 100644
if (ret != 0) {
mutex_unlock(&dev->struct_mutex);
return ret;
-@@ -4270,7 +4306,7 @@ rescan:
+@@ -4270,7 +4306,7 @@ i915_gem_inactive_shrink(struct shrinker *shrinker, struct shrink_control *sc)
* This has a dramatic impact to reduce the number of
* OOM-killer events whilst running the GPU aggressively.
*/
@@ -45617,7 +45640,7 @@ index ead5d00f91b0..21a82710f4b2 100644
}
/* We expect the caller to unpin, evict all and try again, or give up.
-@@ -158,10 +141,10 @@ found:
+@@ -158,10 +141,10 @@ i915_gem_evict_something(struct drm_device *dev, int min_size,
exec_list);
if (drm_mm_scan_remove_block(obj->gtt_space)) {
list_move(&obj->exec_list, &eviction_list);
@@ -48032,7 +48055,7 @@ index 27999d990da8..c975c996ff5f 100644
}
dev_priv->mm.interruptible = true;
-@@ -2035,6 +2087,12 @@ err_interruptible:
+@@ -2035,6 +2087,12 @@ intel_pin_and_fence_fb_obj(struct drm_device *dev,
return ret;
}
@@ -50115,7 +50138,7 @@ index e035eaf88454..8fdc95700218 100644
(msgs[i].len << GMBUS_BYTE_COUNT_SHIFT) |
(msgs[i].addr << GMBUS_SLAVE_ADDR_SHIFT) |
GMBUS_SLAVE_WRITE | GMBUS_SW_RDY);
-@@ -317,11 +299,15 @@ clear_err:
+@@ -317,11 +299,15 @@ gmbus_xfer(struct i2c_adapter *adapter,
I915_WRITE(GMBUS1 + reg_offset, 0);
done:
@@ -50134,7 +50157,7 @@ index e035eaf88454..8fdc95700218 100644
timeout:
DRM_INFO("GMBUS timed out, falling back to bit banging on pin %d [%s]\n",
-@@ -329,23 +315,21 @@ timeout:
+@@ -329,23 +315,21 @@ gmbus_xfer(struct i2c_adapter *adapter,
I915_WRITE(GMBUS0 + reg_offset, 0);
/* Hardware may not support GMBUS over these pins? Try GPIO bitbanging instead. */
@@ -53994,7 +54017,7 @@ index 2bb29c922394..2c3d5c8b7a3f 100644
return ret;
}
-@@ -801,19 +804,22 @@ out:
+@@ -801,19 +804,22 @@ nouveau_bo_move_flips(struct ttm_buffer_object *bo, bool evict, bool intr,
static void
nouveau_bo_move_ntfy(struct ttm_buffer_object *bo, struct ttm_mem_reg *new_mem)
{
@@ -55315,7 +55338,7 @@ index de5efe71fefd..d996134b1b28 100644
/******************************************************************************
* aux channel util functions
-@@ -160,121 +161,9 @@ out:
+@@ -160,121 +161,9 @@ auxch_tx(struct drm_device *dev, int ch, u8 type, u32 addr, u8 *data, u8 size)
return ret;
}
@@ -62412,7 +62435,7 @@ index 01adcfb8101b..b096cf28213a 100644
out_irq:
nouveau_irq_fini(dev);
out_fifo:
-@@ -785,15 +892,6 @@ out_engine:
+@@ -785,15 +892,6 @@ nouveau_card_init(struct drm_device *dev)
dev_priv->eng[e]->destroy(dev,e );
}
}
@@ -62428,7 +62451,7 @@ index 01adcfb8101b..b096cf28213a 100644
nouveau_mem_gart_fini(dev);
out_ttmvram:
nouveau_mem_vram_fini(dev);
-@@ -801,10 +899,17 @@ out_instmem:
+@@ -801,10 +899,17 @@ nouveau_card_init(struct drm_device *dev)
engine->instmem.takedown(dev);
out_gpuobj:
nouveau_gpuobj_takedown(dev);
@@ -63895,7 +63918,7 @@ index e676b0d53478..c7615381c5d9 100644
/* set engine clocks */
nv_mask(dev, 0x00c040, 0x00000333, 0x00000000);
nv_wr32(dev, 0x004004, info->npll_coef);
-@@ -345,4 +347,48 @@ resume:
+@@ -345,4 +347,48 @@ nv40_pm_clocks_set(struct drm_device *dev, void *pre_state)
spin_unlock_irqrestore(&dev_priv->context_switch_lock, flags);
kfree(info);
@@ -67634,7 +67657,7 @@ index 618c144b7a30..9e636e6ef6d7 100644
cleanup:
/* unfreeze PFIFO */
nv_mask(dev, 0x002504, 0x00000001, 0x00000000);
-@@ -339,4 +342,5 @@ cleanup:
+@@ -339,4 +342,5 @@ nva3_pm_clocks_set(struct drm_device *dev, void *pre_state)
nv_mask(dev, 0x400824, 0x10000000, 0x10000000);
spin_unlock_irqrestore(&dev_priv->context_switch_lock, flags);
kfree(info);
@@ -73715,7 +73738,7 @@ index 5d78973a9d67..c5fe79e67ed9 100644
}
return (wptr & rdev->ih.ptr_mask);
}
-@@ -3018,11 +3167,24 @@ restart_ih:
+@@ -3018,11 +3167,24 @@ int evergreen_irq_process(struct radeon_device *rdev)
case 177: /* CP_INT in IB1 */
case 178: /* CP_INT in IB2 */
DRM_DEBUG("IH: CP int: 0x%08x\n", src_data);
@@ -73742,7 +73765,7 @@ index 5d78973a9d67..c5fe79e67ed9 100644
break;
case 233: /* GUI IDLE */
DRM_DEBUG("IH: GUI idle\n");
-@@ -3052,6 +3214,7 @@ restart_ih:
+@@ -3052,6 +3214,7 @@ int evergreen_irq_process(struct radeon_device *rdev)
static int evergreen_startup(struct radeon_device *rdev)
{
@@ -80050,7 +80073,7 @@ index e5299a04da9c..9c7062d970ee 100644
}
return (wptr & rdev->ih.ptr_mask);
}
-@@ -3469,11 +3496,11 @@ restart_ih:
+@@ -3469,11 +3496,11 @@ int r600_irq_process(struct radeon_device *rdev)
case 177: /* CP_INT in IB1 */
case 178: /* CP_INT in IB2 */
DRM_DEBUG("IH: CP int: 0x%08x\n", src_data);
@@ -80064,7 +80087,7 @@ index e5299a04da9c..9c7062d970ee 100644
break;
case 233: /* GUI IDLE */
DRM_DEBUG("IH: GUI idle\n");
-@@ -3506,30 +3533,6 @@ restart_ih:
+@@ -3506,30 +3533,6 @@ int r600_irq_process(struct radeon_device *rdev)
*/
#if defined(CONFIG_DEBUG_FS)
@@ -85575,7 +85598,7 @@ index 5aa6670d60d0..917e49cb490b 100644
#endif
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
-index 473bd330032e..1ce67435918b 100644
+index fde52a05d919..1ce67435918b 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -56,6 +56,10 @@ extern void
@@ -85626,6 +85649,24 @@ index 473bd330032e..1ce67435918b 100644
return true;
}
+@@ -1138,7 +1150,7 @@ bool radeon_atom_get_clock_info(struct drm_device *dev)
+ le16_to_cpu(firmware_info->info.usReferenceClock);
+ p1pll->reference_div = 0;
+
+- if ((frev < 2) && (crev < 2))
++ if (crev < 2)
+ p1pll->pll_out_min =
+ le16_to_cpu(firmware_info->info.usMinPixelClockPLL_Output);
+ else
+@@ -1147,7 +1159,7 @@ bool radeon_atom_get_clock_info(struct drm_device *dev)
+ p1pll->pll_out_max =
+ le32_to_cpu(firmware_info->info.ulMaxPixelClockPLL_Output);
+
+- if (((frev < 2) && (crev >= 4)) || (frev >= 2)) {
++ if (crev >= 4) {
+ p1pll->lcd_pll_out_min =
+ le16_to_cpu(firmware_info->info_14.usLcdMinPixelClockPLL_Output) * 100;
+ if (p1pll->lcd_pll_out_min == 0)
@@ -1874,7 +1886,7 @@ static const char *thermal_controller_names[] = {
"adm1032",
"adm1030",
@@ -86198,7 +86239,7 @@ index 87a677e91927..69c2dd085722 100644
break;
default:
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
-index 6303fc8fcb8e..9c5d96cb6e14 100644
+index 40633f3ad044..9c5d96cb6e14 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -851,6 +851,27 @@ static int radeon_dvi_get_modes(struct drm_connector *connector)
@@ -86297,6 +86338,51 @@ index 6303fc8fcb8e..9c5d96cb6e14 100644
if (radeon_connector->edid) {
kfree(radeon_connector->edid);
radeon_connector->edid = NULL;
+@@ -1589,6 +1625,7 @@ radeon_add_atom_connector(struct drm_device *dev,
+ 1);
+ /* no HPD on analog connectors */
+ radeon_connector->hpd.hpd = RADEON_HPD_NONE;
++ connector->polled = DRM_CONNECTOR_POLL_CONNECT;
+ connector->interlace_allowed = true;
+ connector->doublescan_allowed = true;
+ break;
+@@ -1786,10 +1823,8 @@ radeon_add_atom_connector(struct drm_device *dev,
+ }
+
+ if (radeon_connector->hpd.hpd == RADEON_HPD_NONE) {
+- if (i2c_bus->valid) {
+- connector->polled = DRM_CONNECTOR_POLL_CONNECT |
+- DRM_CONNECTOR_POLL_DISCONNECT;
+- }
++ if (i2c_bus->valid)
++ connector->polled = DRM_CONNECTOR_POLL_CONNECT;
+ } else
+ connector->polled = DRM_CONNECTOR_POLL_HPD;
+
+@@ -1861,6 +1896,7 @@ radeon_add_legacy_connector(struct drm_device *dev,
+ 1);
+ /* no HPD on analog connectors */
+ radeon_connector->hpd.hpd = RADEON_HPD_NONE;
++ connector->polled = DRM_CONNECTOR_POLL_CONNECT;
+ connector->interlace_allowed = true;
+ connector->doublescan_allowed = true;
+ break;
+@@ -1945,13 +1981,10 @@ radeon_add_legacy_connector(struct drm_device *dev,
+ }
+
+ if (radeon_connector->hpd.hpd == RADEON_HPD_NONE) {
+- if (i2c_bus->valid) {
+- connector->polled = DRM_CONNECTOR_POLL_CONNECT |
+- DRM_CONNECTOR_POLL_DISCONNECT;
+- }
++ if (i2c_bus->valid)
++ connector->polled = DRM_CONNECTOR_POLL_CONNECT;
+ } else
+ connector->polled = DRM_CONNECTOR_POLL_HPD;
+-
+ connector->display_info.subpixel_order = subpixel_order;
+ drm_sysfs_connector_add(connector);
+ if (connector_type == DRM_MODE_CONNECTOR_LVDS) {
diff --git a/drivers/gpu/drm/radeon/radeon_cp.c b/drivers/gpu/drm/radeon/radeon_cp.c
index 72ae8266b8e9..0ebb7d4796fa 100644
--- a/drivers/gpu/drm/radeon/radeon_cp.c
@@ -86803,7 +86889,7 @@ index 213210984764..8fb6f41bd1f2 100644
struct drm_crtc *crtc_p;
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
-index 8cde84b666d5..2f555d782248 100644
+index f122e6132d35..2f555d782248 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -89,6 +89,10 @@ static const char radeon_family_name[][16] = {
@@ -86828,7 +86914,39 @@ index 8cde84b666d5..2f555d782248 100644
rdev->wb.enabled = true;
rdev->wb.use_event = true;
}
-@@ -720,18 +724,25 @@ int radeon_device_init(struct radeon_device *rdev,
+@@ -350,31 +354,10 @@ void radeon_gtt_location(struct radeon_device *rdev, struct radeon_mc *mc)
+ /*
+ * GPU helpers function.
+ */
+-
+-/**
+- * radeon_device_is_virtual - check if we are running is a virtual environment
+- *
+- * Check if the asic has been passed through to a VM (all asics).
+- * Used at driver startup.
+- * Returns true if virtual or false if not.
+- */
+-static bool radeon_device_is_virtual(void)
+-{
+-#ifdef CONFIG_X86
+- return boot_cpu_has(X86_FEATURE_HYPERVISOR);
+-#else
+- return false;
+-#endif
+-}
+-
+ bool radeon_card_posted(struct radeon_device *rdev)
+ {
+ uint32_t reg;
+
+- /* for pass through, always force asic_init */
+- if (radeon_device_is_virtual())
+- return false;
+-
+ if (efi_enabled(EFI_BOOT) &&
+ rdev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE)
+ return false;
+@@ -741,18 +724,25 @@ int radeon_device_init(struct radeon_device *rdev,
/* mutex initialization are all done here so we
* can recall function without having locking issues */
radeon_mutex_init(&rdev->cs_mutex);
@@ -86857,7 +86975,7 @@ index 8cde84b666d5..2f555d782248 100644
/* Set asic functions */
r = radeon_asic_init(rdev);
-@@ -768,8 +779,14 @@ int radeon_device_init(struct radeon_device *rdev,
+@@ -789,8 +779,14 @@ int radeon_device_init(struct radeon_device *rdev,
r = pci_set_dma_mask(rdev->pdev, DMA_BIT_MASK(dma_bits));
if (r) {
rdev->need_dma32 = true;
@@ -86872,7 +86990,7 @@ index 8cde84b666d5..2f555d782248 100644
/* Registers mapping */
/* TODO: block userspace mapping of io register */
-@@ -817,12 +834,18 @@ int radeon_device_init(struct radeon_device *rdev,
+@@ -838,12 +834,18 @@ int radeon_device_init(struct radeon_device *rdev,
if (r)
return r;
}
@@ -86892,7 +87010,7 @@ index 8cde84b666d5..2f555d782248 100644
if (radeon_benchmarking) {
if (rdev->accel_working)
radeon_benchmark(rdev, radeon_benchmarking);
-@@ -832,6 +855,8 @@ int radeon_device_init(struct radeon_device *rdev,
+@@ -853,6 +855,8 @@ int radeon_device_init(struct radeon_device *rdev,
return 0;
}
@@ -86901,7 +87019,7 @@ index 8cde84b666d5..2f555d782248 100644
void radeon_device_fini(struct radeon_device *rdev)
{
DRM_INFO("radeon: finishing device.\n");
-@@ -846,6 +871,7 @@ void radeon_device_fini(struct radeon_device *rdev)
+@@ -867,6 +871,7 @@ void radeon_device_fini(struct radeon_device *rdev)
rdev->rio_mem = NULL;
iounmap(rdev->rmmio);
rdev->rmmio = NULL;
@@ -86909,7 +87027,7 @@ index 8cde84b666d5..2f555d782248 100644
}
-@@ -857,7 +883,7 @@ int radeon_suspend_kms(struct drm_device *dev, pm_message_t state)
+@@ -878,7 +883,7 @@ int radeon_suspend_kms(struct drm_device *dev, pm_message_t state)
struct radeon_device *rdev;
struct drm_crtc *crtc;
struct drm_connector *connector;
@@ -86918,7 +87036,7 @@ index 8cde84b666d5..2f555d782248 100644
if (dev == NULL || dev->dev_private == NULL) {
return -ENODEV;
-@@ -898,7 +924,8 @@ int radeon_suspend_kms(struct drm_device *dev, pm_message_t state)
+@@ -919,7 +924,8 @@ int radeon_suspend_kms(struct drm_device *dev, pm_message_t state)
/* evict vram memory */
radeon_bo_evict_vram(rdev);
/* wait for gpu to finish processing current batch */
@@ -86928,7 +87046,7 @@ index 8cde84b666d5..2f555d782248 100644
radeon_save_bios_scratch_regs(rdev);
-@@ -947,9 +974,11 @@ int radeon_resume_kms(struct drm_device *dev)
+@@ -968,9 +974,11 @@ int radeon_resume_kms(struct drm_device *dev)
radeon_fbdev_set_suspend(rdev, 0);
console_unlock();
@@ -86942,7 +87060,7 @@ index 8cde84b666d5..2f555d782248 100644
/* reset hpd state */
radeon_hpd_init(rdev);
/* blat the mode back in */
-@@ -999,36 +1028,29 @@ int radeon_gpu_reset(struct radeon_device *rdev)
+@@ -1020,36 +1028,29 @@ int radeon_gpu_reset(struct radeon_device *rdev)
/*
* Debugfs
*/
@@ -86985,7 +87103,7 @@ index 8cde84b666d5..2f555d782248 100644
#if defined(CONFIG_DEBUG_FS)
drm_debugfs_create_files(files, nfiles,
rdev->ddev->control->debugfs_root,
-@@ -1040,6 +1062,22 @@ int radeon_debugfs_add_files(struct radeon_device *rdev,
+@@ -1061,6 +1062,22 @@ int radeon_debugfs_add_files(struct radeon_device *rdev,
return 0;
}
@@ -87008,7 +87126,7 @@ index 8cde84b666d5..2f555d782248 100644
#if defined(CONFIG_DEBUG_FS)
int radeon_debugfs_init(struct drm_minor *minor)
{
-@@ -1048,11 +1086,5 @@ int radeon_debugfs_init(struct drm_minor *minor)
+@@ -1069,11 +1086,5 @@ int radeon_debugfs_init(struct drm_minor *minor)
void radeon_debugfs_cleanup(struct drm_minor *minor)
{
@@ -87908,7 +88026,7 @@ index 76ec0e9ed8ae..4bd36a354fbe 100644
}
trace_radeon_fence_wait_end(rdev->ddev, seq);
if (unlikely(!radeon_fence_signaled(fence))) {
-@@ -258,10 +255,11 @@ retry:
+@@ -258,10 +255,11 @@ int radeon_fence_wait(struct radeon_fence *fence, bool intr)
timeout = r;
goto retry;
}
@@ -87922,7 +88040,7 @@ index 76ec0e9ed8ae..4bd36a354fbe 100644
/* good news we believe it's a lockup */
printk(KERN_WARNING "GPU lockup (waiting for 0x%08X last fence id 0x%08X)\n",
fence->seq, seq);
-@@ -272,20 +270,20 @@ retry:
+@@ -272,20 +270,20 @@ int radeon_fence_wait(struct radeon_fence *fence, bool intr)
r = radeon_gpu_reset(rdev);
if (r)
return r;
@@ -88774,7 +88892,7 @@ index aa1ca2dea42f..c7008b5210f7 100644
return 0;
}
-@@ -352,6 +366,109 @@ out:
+@@ -352,6 +366,109 @@ int radeon_gem_get_tiling_ioctl(struct drm_device *dev, void *data,
return r;
}
@@ -88981,22 +89099,10 @@ index 894b5f0fb08c..19d68c55c7e6 100644
snprintf(i2c->adapter.name, sizeof(i2c->adapter.name),
"Radeon aux bus %s", name);
diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
-index 931a8a9efb63..77c456d624bf 100644
+index 931a8a9efb63..afd1cc14b26c 100644
--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
-@@ -51,11 +51,6 @@ static void radeon_hotplug_work_func(struct work_struct *work)
- struct drm_mode_config *mode_config = &dev->mode_config;
- struct drm_connector *connector;
-
-- /* we can race here at startup, some boards seem to trigger
-- * hotplug irqs when they shouldn't. */
-- if (!rdev->mode_info.mode_config_initialized)
-- return;
--
- mutex_lock(&mode_config->mutex);
- if (mode_config->num_connector) {
- list_for_each_entry(connector, &mode_config->connector_list, head)
-@@ -72,7 +67,8 @@ void radeon_driver_irq_preinstall_kms(struct drm_device *dev)
+@@ -72,7 +72,8 @@ void radeon_driver_irq_preinstall_kms(struct drm_device *dev)
unsigned i;
/* Disable *all* interrupts */
@@ -89006,7 +89112,7 @@ index 931a8a9efb63..77c456d624bf 100644
rdev->irq.gui_idle = false;
for (i = 0; i < RADEON_MAX_HPD_PINS; i++)
rdev->irq.hpd[i] = false;
-@@ -88,9 +84,11 @@ void radeon_driver_irq_preinstall_kms(struct drm_device *dev)
+@@ -88,9 +89,11 @@ void radeon_driver_irq_preinstall_kms(struct drm_device *dev)
int radeon_driver_irq_postinstall_kms(struct drm_device *dev)
{
struct radeon_device *rdev = dev->dev_private;
@@ -89019,7 +89125,7 @@ index 931a8a9efb63..77c456d624bf 100644
radeon_irq_set(rdev);
return 0;
}
-@@ -104,7 +102,8 @@ void radeon_driver_irq_uninstall_kms(struct drm_device *dev)
+@@ -104,7 +107,8 @@ void radeon_driver_irq_uninstall_kms(struct drm_device *dev)
return;
}
/* Disable *all* interrupts */
@@ -89029,7 +89135,7 @@ index 931a8a9efb63..77c456d624bf 100644
rdev->irq.gui_idle = false;
for (i = 0; i < RADEON_MAX_HPD_PINS; i++)
rdev->irq.hpd[i] = false;
-@@ -223,26 +222,26 @@ void radeon_irq_kms_fini(struct radeon_device *rdev)
+@@ -223,26 +227,26 @@ void radeon_irq_kms_fini(struct radeon_device *rdev)
flush_work_sync(&rdev->hotplug_work);
}
@@ -89229,7 +89335,7 @@ diff --git a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c b/drivers/gpu/drm/radeo
index a9238b009d1a..b44bbf50760f 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
-@@ -420,7 +420,9 @@ retry:
+@@ -420,7 +420,9 @@ int radeon_crtc_do_set_base(struct drm_crtc *crtc,
r = radeon_bo_reserve(rbo, false);
if (unlikely(r != 0))
return r;
@@ -89240,7 +89346,7 @@ index a9238b009d1a..b44bbf50760f 100644
if (unlikely(r != 0)) {
radeon_bo_unreserve(rbo);
-@@ -465,7 +467,7 @@ retry:
+@@ -465,7 +467,7 @@ int radeon_crtc_do_set_base(struct drm_crtc *crtc,
crtc_offset_cntl = 0;
@@ -89424,7 +89530,7 @@ index 3e35bbe96e3a..df6a4dbd93f8 100644
retry:
bo = kzalloc(sizeof(struct radeon_bo), GFP_KERNEL);
if (bo == NULL)
-@@ -130,12 +149,13 @@ retry:
+@@ -130,12 +149,13 @@ int radeon_bo_create(struct radeon_device *rdev,
bo->gem_base.driver_private = NULL;
bo->surface_reg = -1;
INIT_LIST_HEAD(&bo->list);
@@ -90894,7 +91000,7 @@ index 602fa3541c45..dc5dcf483aa3 100644
if (r) {
DRM_ERROR("Failed to create VRAM->GTT fence %d\n", i);
goto out_cleanup;
-@@ -232,3 +234,264 @@ out_cleanup:
+@@ -232,3 +234,264 @@ void radeon_test_moves(struct radeon_device *rdev)
printk(KERN_WARNING "Error while testing BO move.\n");
}
}
@@ -91160,7 +91266,7 @@ index 602fa3541c45..dc5dcf483aa3 100644
+ }
+}
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
-index 0b5468bfaf54..15042d0ca035 100644
+index a4327436221b..15042d0ca035 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -114,24 +114,6 @@ static void radeon_ttm_global_fini(struct radeon_device *rdev)
@@ -91197,7 +91303,7 @@ index 0b5468bfaf54..15042d0ca035 100644
radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_CPU);
else
radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_GTT);
-@@ -241,10 +223,10 @@ static int radeon_move_blit(struct ttm_buffer_object *bo,
+@@ -241,15 +223,15 @@ static int radeon_move_blit(struct ttm_buffer_object *bo,
struct radeon_device *rdev;
uint64_t old_start, new_start;
struct radeon_fence *fence;
@@ -91210,6 +91316,13 @@ index 0b5468bfaf54..15042d0ca035 100644
if (unlikely(r)) {
return r;
}
+- old_start = (u64)old_mem->start << PAGE_SHIFT;
+- new_start = (u64)new_mem->start << PAGE_SHIFT;
++ old_start = old_mem->start << PAGE_SHIFT;
++ new_start = new_mem->start << PAGE_SHIFT;
+
+ switch (old_mem->mem_type) {
+ case TTM_PL_VRAM:
@@ -273,13 +255,43 @@ static int radeon_move_blit(struct ttm_buffer_object *bo,
DRM_ERROR("Unknown placement %d\n", old_mem->mem_type);
return -EINVAL;
@@ -98848,7 +98961,7 @@ index 22a89cd5aa5d..a67e61be38f2 100644
bo->evicted = false;
}
-@@ -472,6 +468,9 @@ out_err:
+@@ -472,6 +468,9 @@ static int ttm_bo_handle_move_mem(struct ttm_buffer_object *bo,
static void ttm_bo_cleanup_memtype_use(struct ttm_buffer_object *bo)
{
@@ -98952,7 +99065,7 @@ index 22a89cd5aa5d..a67e61be38f2 100644
return -EINVAL;
}
bo->destroy = destroy;
-@@ -1263,14 +1265,34 @@ out_err:
+@@ -1263,14 +1265,34 @@ int ttm_bo_init(struct ttm_bo_device *bdev,
}
EXPORT_SYMBOL(ttm_bo_init);
@@ -99475,7 +99588,7 @@ index 508c64ce5d9e..578207ecc43f 100644
{
unsigned long irq_flags;
struct list_head *p;
-@@ -667,17 +652,63 @@ out:
+@@ -667,17 +652,63 @@ static unsigned ttm_page_pool_get_pages(struct ttm_page_pool *pool,
return count;
}
@@ -104462,7 +104575,7 @@ index 148fa9120c5f..e43341a53fac 100644
vmw_kms_save_vga(dev_priv);
/* Start kms and overlay systems, needs fifo. */
-@@ -621,11 +664,11 @@ out_no_kms:
+@@ -621,11 +664,11 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
vmw_kms_restore_vga(dev_priv);
vmw_3d_resource_dec(dev_priv, false);
}
@@ -104476,7 +104589,7 @@ index 148fa9120c5f..e43341a53fac 100644
vmw_fence_manager_takedown(dev_priv->fman);
out_no_fman:
if (dev_priv->stealth)
-@@ -639,6 +682,7 @@ out_err4:
+@@ -639,6 +682,7 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
out_err3:
drm_mtrr_del(dev_priv->mmio_mtrr, dev_priv->mmio_start,
dev_priv->mmio_size, DRM_MTRR_WC);
@@ -105263,7 +105376,7 @@ index eb9735e95d3a..7ca1d472d7cb 100644
vfbd->base.base.depth = mode_cmd->depth;
vfbd->base.base.width = mode_cmd->width;
vfbd->base.base.height = mode_cmd->height;
-@@ -1085,7 +1094,7 @@ out_err1:
+@@ -1085,7 +1094,7 @@ static int vmw_kms_new_framebuffer_dmabuf(struct vmw_private *dev_priv,
static struct drm_framebuffer *vmw_kms_fb_create(struct drm_device *dev,
struct drm_file *file_priv,
@@ -105507,7 +105620,7 @@ diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/v
index 0795d1733c1b..059b32c6f22b 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
-@@ -1540,29 +1540,10 @@ out_bad_surface:
+@@ -1540,29 +1540,10 @@ int vmw_surface_check(struct vmw_private *dev_priv,
/**
* Buffer management.
*/
diff --git a/debian/patches/series b/debian/patches/series
index 0b2f21b..06f36f5 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -516,7 +516,6 @@ bugfix/x86/drm-i915-i8xx-interrupt-handler.patch
bugfix/x86/drm-i915-Disable-AsyncFlip-performance-optimisations.patch
bugfix/x86/drm-i915-Unconditionally-initialise-the-interrupt-wo.patch
bugfix/all/drm-fix-drm_ioctl_mode_getfb-handle-leak.patch
-bugfix/all/drm-radeon-fix-hotplug-race-at-startup.patch
# virtio-scsi from 3.7
features/all/virtio_scsi/0001-SCSI-virtio-scsi-SCSI-driver-for-QEMU-based-virtual-.patch
@@ -1106,13 +1105,6 @@ features/all/hpsa/0011-hpsa-add-in-P840ar-controller-model-name.patch
bugfix/all/netfilter-ipset-Check-and-reject-crazy-0-input-param.patch
bugfix/all/KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch
bugfix/all/ecryptfs-fix-handling-of-directory-opening.patch
-bugfix/arm/arm-oabi-compat-add-missing-access-checks.patch
-bugfix/all/aacraid-check-size-values-after-double-fetch-from-us.patch
-bugfix/all/tcp-fix-use-after-free-in-tcp_xmit_retransmit_queue.patch
-bugfix/all/bluetooth-fix-potential-null-dereference-in-rfcomm-b.patch
-bugfix/all/keys-fix-short-sprintf-buffer-in-proc-keys-show-func.patch
-bugfix/all/scsi-arcmsr-buffer-overflow-in-arcmsr_iop_message_xf.patch
-bugfix/all/mm-gup-close-foll_map_private-race.patch
# ABI maintenance
debian/perf-hide-abi-change-in-3.2.30.patch
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git
More information about the Kernel-svn-changes
mailing list