linux-toradex.git, branch v4.4.5

Linux 4.4.5

2016-03-09T23:35:58+00:00

drm/amdgpu: fix topaz/tonga gmc assignment in 4.4 stable

2016-03-09T23:34:57+00:00

When upstream commit 429c45deae6e57f1bb91bfb05b671063fb0cef60
was applied to 4.4 as d60703ca942e8d044d61360bc9792fcab54b95d0
it applied incorrectly to the tonga_ip_blocks array rather than
the topaz_ip_blocks array.  Fix that up here.

Bug:
https://bugzilla.kernel.org/show_bug.cgi?id=113951

Signed-off-by: Alex Deucher 
Signed-off-by: Greg Kroah-Hartman

modules: fix longstanding /proc/kallsyms vs module insertion race.

2016-03-09T23:34:56+00:00

commit 8244062ef1e54502ef55f54cced659913f244c3e upstream.

For CONFIG_KALLSYMS, we keep two symbol tables and two string tables.
There's one full copy, marked SHF_ALLOC and laid out at the end of the
module's init section.  There's also a cut-down version that only
contains core symbols and strings, and lives in the module's core
section.

After module init (and before we free the module memory), we switch
the mod->symtab, mod->num_symtab and mod->strtab to point to the core
versions.  We do this under the module_mutex.

However, kallsyms doesn't take the module_mutex: it uses
preempt_disable() and rcu tricks to walk through the modules, because
it's used in the oops path.  It's also used in /proc/kallsyms.
There's nothing atomic about the change of these variables, so we can
get the old (larger!) num_symtab and the new symtab pointer; in fact
this is what I saw when trying to reproduce.

By grouping these variables together, we can use a
carefully-dereferenced pointer to ensure we always get one or the
other (the free of the module init section is already done in an RCU
callback, so that's safe).  We allocate the init one at the end of the
module init section, and keep the core one inside the struct module
itself (it could also have been allocated at the end of the module
core, but that's probably overkill).

[ Rebased for 4.4-stable and older, because the following changes aren't
  in the older trees:
  - e0224418516b4d8a6c2160574bac18447c354ef0: adds arg to is_core_symbol
  - 7523e4dc5057e157212b4741abd6256e03404cf1: module_init/module_core/init_size/core_size
    become init_layout.base/core_layout.base/init_layout.size/core_layout.size.
]

Reported-by: Weilong Chen 
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=111541
Cc: stable@kernel.org
Signed-off-by: Rusty Russell 
Signed-off-by: Greg Kroah-Hartman

drm/i915: refine qemu south bridge detection

2016-03-09T23:34:56+00:00

commit f2e305108faba0c85eb4ba4066599decb675117e upstream.

The test for the qemu q35 south bridge added by commit
"39bfcd52 drm/i915: more virtual south bridge detection"
also matches on real hardware.  Having the check for
virtual systems last in the list is not enough to avoid
that ...

Refine the check by additionally verifying the pci
subsystem id to see whenever it *really* is qemu.

[ v2: fix subvendor tyops ]

Reported-and-tested-by: Bjørn Mork 
Signed-off-by: Gerd Hoffmann 
Tested-by: Bruno Wolff III 
Cc: drm-intel-fixes@lists.freedesktop.org
Signed-off-by: Jani Nikula 
Link: http://patchwork.freedesktop.org/patch/msgid/1453719748-10944-1-git-send-email-kraxel@redhat.com
(cherry picked from commit 1e859111c128265f8d62b39ff322e42b1ddb5a20)
Signed-off-by: Greg Kroah-Hartman

drm/i915: more virtual south bridge detection

2016-03-09T23:34:56+00:00

commit 39bfcd5235e07e95ad3e70eab8e0b85db181de9e upstream.

Commit "30c964a drm/i915: Detect virtual south bridge" detects and
handles the southbridge emulated by vmware esx.  Add the ich9 south
bridge emulated by 'qemu -M q35'.

Signed-off-by: Gerd Hoffmann 
Signed-off-by: Daniel Vetter 
Signed-off-by: Greg Kroah-Hartman

block: get the 1st and last bvec via helpers

2016-03-09T23:34:56+00:00

commit 25e71a99f10e444cd00bb2ebccb11e1c9fb672b1 upstream.

This patch applies the two introduced helpers to
figure out the 1st and last bvec, and fixes the
original way after bio splitting.

Reported-by: Sagi Grimberg 
Reviewed-by: Sagi Grimberg 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Ming Lei 
Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

block: check virt boundary in bio_will_gap()

2016-03-09T23:34:56+00:00

commit e0af29171aa8912e1ca95023b75ef336cd70d661 upstream.

In the following patch, the way for figuring out
the last bvec will be changed with a bit cost introduced,
so return immediately if the queue doesn't have virt
boundary limit. Actually most of devices have not
this limit.

Reviewed-by: Sagi Grimberg 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Ming Lei 
Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

drm/amdgpu: Use drm_calloc_large for VM page_tables array

2016-03-09T23:34:56+00:00

commit 9571e1d84042f5670df9fabdcbe7dd5da3abe43e upstream.

It can be big, depending on the VM address space size, which is tunable
via the vm_size module parameter.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=93721
Reviewed-by: Christian König 
Signed-off-by: Michel Dänzer 
Signed-off-by: Alex Deucher 
Signed-off-by: Greg Kroah-Hartman

thermal: cpu_cooling: fix out of bounds access in time_in_idle

2016-03-09T23:34:56+00:00

commit a53b8394ec3c67255928df6ee9cc99dd1cd452e3 upstream.

In __cpufreq_cooling_register() we allocate the arrays for time_in_idle
and time_in_idle_timestamp to be as big as the number of cpus in this
cpufreq device.  However, in get_load() we access this array using the
cpu number as index, which can result in an out of bound access.

Index time_in_idle{,_timestamp} using the index in the cpufreq_device's
allowed_cpus mask, as we do for the load_cpu array in
cpufreq_get_requested_power()

Reported-by: Nicolas Boichat 
Cc: Amit Daniel Kachhap 
Cc: Zhang Rui 
Cc: Eduardo Valentin 
Tested-by: Nicolas Boichat 
Acked-by: Viresh Kumar 
Signed-off-by: Javi Merino 
Signed-off-by: Eduardo Valentin 
Signed-off-by: Greg Kroah-Hartman

i2c: brcmstb: allocate correct amount of memory for regmap

2016-03-09T23:34:56+00:00

commit 7314d22a2f5bd40468d57768be368c3d9b4bd726 upstream.

We want the size of the struct, not of a pointer to it. To be future
proof, just dereference the pointer to get the desired type.

Fixes: dd1aa2524bc5 ("i2c: brcmstb: Add Broadcom settop SoC i2c controller driver")
Acked-by: Gregory Fong 
Acked-by: Florian Fainelli 
Reviewed-by: Kamal Dasu 
Signed-off-by: Wolfram Sang 
Signed-off-by: Greg Kroah-Hartman