--- /dev/null
+From f4b4718b61d1d5a7442a4fd6863ea80c3a10e508 Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Fri, 24 Jan 2014 09:50:18 +1000
+Subject: drm: ast,cirrus,mgag200: use drm_can_sleep
+
+From: Dave Airlie <airlied@redhat.com>
+
+commit f4b4718b61d1d5a7442a4fd6863ea80c3a10e508 upstream.
+
+these 3 were checking in_interrupt but we have situations where
+calling vunmap under this could cause a BUG to be hit in
+smp_call_function_many. Use the drm_can_sleep macro instead,
+which should stop this path from been taken in this case.
+
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/ast/ast_fb.c | 2 +-
+ drivers/gpu/drm/cirrus/cirrus_fbdev.c | 2 +-
+ drivers/gpu/drm/mgag200/mgag200_fb.c | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/ast/ast_fb.c
++++ b/drivers/gpu/drm/ast/ast_fb.c
+@@ -65,7 +65,7 @@ static void ast_dirty_update(struct ast_
+ * then the BO is being moved and we should
+ * store up the damage until later.
+ */
+- if (!in_interrupt())
++ if (!drm_can_sleep())
+ ret = ast_bo_reserve(bo, true);
+ if (ret) {
+ if (ret != -EBUSY)
+--- a/drivers/gpu/drm/cirrus/cirrus_fbdev.c
++++ b/drivers/gpu/drm/cirrus/cirrus_fbdev.c
+@@ -39,7 +39,7 @@ static void cirrus_dirty_update(struct c
+ * then the BO is being moved and we should
+ * store up the damage until later.
+ */
+- if (!in_interrupt())
++ if (!drm_can_sleep())
+ ret = cirrus_bo_reserve(bo, true);
+ if (ret) {
+ if (ret != -EBUSY)
+--- a/drivers/gpu/drm/mgag200/mgag200_fb.c
++++ b/drivers/gpu/drm/mgag200/mgag200_fb.c
+@@ -41,7 +41,7 @@ static void mga_dirty_update(struct mga_
+ * then the BO is being moved and we should
+ * store up the damage until later.
+ */
+- if (!in_interrupt())
++ if (!drm_can_sleep())
+ ret = mgag200_bo_reserve(bo, true);
+ if (ret) {
+ if (ret != -EBUSY)
--- /dev/null
+From 2510538fa000dd13a3e57b79bf073ffb1748976c Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 21 Jan 2014 14:34:51 -0800
+Subject: drm/cirrus: correct register values for 16bpp
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 2510538fa000dd13a3e57b79bf073ffb1748976c upstream.
+
+When the mode is set with 16bpp on QEMU, the output gets totally broken.
+The culprit is the bogus register values set for 16bpp, which was likely
+copied from from a wrong place.
+
+Addresses https://bugzilla.novell.com/show_bug.cgi?id=799216
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Cc: David Airlie <airlied@linux.ie>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/cirrus/cirrus_mode.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/cirrus/cirrus_mode.c
++++ b/drivers/gpu/drm/cirrus/cirrus_mode.c
+@@ -273,8 +273,8 @@ static int cirrus_crtc_mode_set(struct d
+ sr07 |= 0x11;
+ break;
+ case 16:
+- sr07 |= 0xc1;
+- hdr = 0xc0;
++ sr07 |= 0x17;
++ hdr = 0xc1;
+ break;
+ case 24:
+ sr07 |= 0x15;
--- /dev/null
+From 6ab11a2635ce988ebc2e798947beb72cf7324119 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Mon, 20 Jan 2014 08:21:54 +0100
+Subject: drm/gem: Always initialize the gem object in object_init
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+commit 6ab11a2635ce988ebc2e798947beb72cf7324119 upstream.
+
+At least drm/i915 expects that the obj->dev pointer is set even in
+failure paths. Specifically when the shmem initialization fails we
+call i915_gem_object_free which needs to deref obj->base.dev to get at
+the slab pointer in the device private structure. And the shmem
+allocation can easily fail when userspace is hitting open file limits.
+
+Doing the structure init even when the shmem file allocation fails
+prevents this Oops.
+
+This is a regression from
+
+commit 89c8233f82d9c8af5b20e72e4a185a38a7d3c50b
+Author: David Herrmann <dh.herrmann@gmail.com>
+Date: Thu Jul 11 11:56:32 2013 +0200
+
+ drm/gem: simplify object initialization
+
+v2: Add regression note which Chris supplied.
+
+Testcase: igt/gem_fd_exhaustion
+Reported-and-Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+References: http://lists.freedesktop.org/archives/intel-gfx/2014-January/038433.html
+Reviewed-by: David Herrmann <dh.herrmann@gmail.com>
+Cc: David Herrmann <dh.herrmann@gmail.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_gem.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_gem.c
++++ b/drivers/gpu/drm/drm_gem.c
+@@ -129,11 +129,12 @@ int drm_gem_object_init(struct drm_devic
+ {
+ struct file *filp;
+
++ drm_gem_private_object_init(dev, obj, size);
++
+ filp = shmem_file_setup("drm mm object", size, VM_NORESERVE);
+ if (IS_ERR(filp))
+ return PTR_ERR(filp);
+
+- drm_gem_private_object_init(dev, obj, size);
+ obj->filp = filp;
+
+ return 0;
--- /dev/null
+From 631794b44bd3dbfba37074954d5c584c9e8725f0 Mon Sep 17 00:00:00 2001
+From: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Date: Wed, 8 Jan 2014 19:30:40 +0100
+Subject: drm/gma500: Lock struct_mutex around cursor updates
+
+From: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+
+commit 631794b44bd3dbfba37074954d5c584c9e8725f0 upstream.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=64361
+Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/gma500/gma_display.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/gma500/gma_display.c
++++ b/drivers/gpu/drm/gma500/gma_display.c
+@@ -349,6 +349,7 @@ int gma_crtc_cursor_set(struct drm_crtc
+ /* If we didn't get a handle then turn the cursor off */
+ if (!handle) {
+ temp = CURSOR_MODE_DISABLE;
++ mutex_lock(&dev->struct_mutex);
+
+ if (gma_power_begin(dev, false)) {
+ REG_WRITE(control, temp);
+@@ -365,6 +366,7 @@ int gma_crtc_cursor_set(struct drm_crtc
+ gma_crtc->cursor_obj = NULL;
+ }
+
++ mutex_unlock(&dev->struct_mutex);
+ return 0;
+ }
+
+@@ -374,9 +376,12 @@ int gma_crtc_cursor_set(struct drm_crtc
+ return -EINVAL;
+ }
+
++ mutex_lock(&dev->struct_mutex);
+ obj = drm_gem_object_lookup(dev, file_priv, handle);
+- if (!obj)
+- return -ENOENT;
++ if (!obj) {
++ ret = -ENOENT;
++ goto unlock;
++ }
+
+ if (obj->size < width * height * 4) {
+ dev_dbg(dev->dev, "Buffer is too small\n");
+@@ -440,10 +445,13 @@ int gma_crtc_cursor_set(struct drm_crtc
+ }
+
+ gma_crtc->cursor_obj = obj;
++unlock:
++ mutex_unlock(&dev->struct_mutex);
+ return ret;
+
+ unref_cursor:
+ drm_gem_object_unreference(obj);
++ mutex_unlock(&dev->struct_mutex);
+ return ret;
+ }
+
--- /dev/null
+From 372fbb8e3927fc76b0f842d8eb8a798a71d8960f Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Mon, 27 Jan 2014 13:52:34 +0000
+Subject: drm/i915: Decouple GPU error reporting from ring initialisation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 372fbb8e3927fc76b0f842d8eb8a798a71d8960f upstream.
+
+Currently we report through our error state only the rings that have
+been initialised (as detected by ring->obj). This check is done after
+the GPU reset and ring re-initialisation, which means that the software
+state may not be the same as when we captured the hardware error and we
+may not print out any of the vital information for debugging the hang.
+
+This (and the implied object leak) is a regression from
+
+commit 3d57e5bd1284f44e325f3a52d966259ed42f9e05
+Author: Ben Widawsky <ben@bwidawsk.net>
+Date: Mon Oct 14 10:01:36 2013 -0700
+
+ drm/i915: Do a fuller init after reset
+
+Note that we are already starting to get bug reports with incomplete
+error states from 3.13, which also hampers debugging userspace driver
+issues.
+
+v2: Prevent a NULL dereference on 830gm/845g after a GPU reset where
+ the scratch obj may be NULL.
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Ben Widawsky <ben@bwidawsk.net>
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+References: https://bugs.freedesktop.org/show_bug.cgi?id=74094
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+[danvet: Add a bit of fluff to make it clear we need this expedited in
+stable.]
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_drv.h | 1 +
+ drivers/gpu/drm/i915/i915_gpu_error.c | 22 +++++++++++++++-------
+ 2 files changed, 16 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -317,6 +317,7 @@ struct drm_i915_error_state {
+ u64 fence[I915_MAX_NUM_FENCES];
+ struct timeval time;
+ struct drm_i915_error_ring {
++ bool valid;
+ struct drm_i915_error_object {
+ int page_count;
+ u32 gtt_offset;
+--- a/drivers/gpu/drm/i915/i915_gpu_error.c
++++ b/drivers/gpu/drm/i915/i915_gpu_error.c
+@@ -239,6 +239,9 @@ static void i915_ring_error_state(struct
+ unsigned ring)
+ {
+ BUG_ON(ring >= I915_NUM_RINGS); /* shut up confused gcc */
++ if (!error->ring[ring].valid)
++ return;
++
+ err_printf(m, "%s command stream:\n", ring_str(ring));
+ err_printf(m, " HEAD: 0x%08x\n", error->head[ring]);
+ err_printf(m, " TAIL: 0x%08x\n", error->tail[ring]);
+@@ -294,7 +297,6 @@ int i915_error_state_to_str(struct drm_i
+ struct drm_device *dev = error_priv->dev;
+ drm_i915_private_t *dev_priv = dev->dev_private;
+ struct drm_i915_error_state *error = error_priv->error;
+- struct intel_ring_buffer *ring;
+ int i, j, page, offset, elt;
+
+ if (!error) {
+@@ -329,7 +331,7 @@ int i915_error_state_to_str(struct drm_i
+ if (INTEL_INFO(dev)->gen == 7)
+ err_printf(m, "ERR_INT: 0x%08x\n", error->err_int);
+
+- for_each_ring(ring, dev_priv, i)
++ for (i = 0; i < ARRAY_SIZE(error->ring); i++)
+ i915_ring_error_state(m, dev, error, i);
+
+ if (error->active_bo)
+@@ -386,8 +388,7 @@ int i915_error_state_to_str(struct drm_i
+ }
+ }
+
+- obj = error->ring[i].ctx;
+- if (obj) {
++ if ((obj = error->ring[i].ctx)) {
+ err_printf(m, "%s --- HW Context = 0x%08x\n",
+ dev_priv->ring[i].name,
+ obj->gtt_offset);
+@@ -668,7 +669,8 @@ i915_error_first_batchbuffer(struct drm_
+ return NULL;
+
+ obj = ring->scratch.obj;
+- if (acthd >= i915_gem_obj_ggtt_offset(obj) &&
++ if (obj != NULL &&
++ acthd >= i915_gem_obj_ggtt_offset(obj) &&
+ acthd < i915_gem_obj_ggtt_offset(obj) + obj->base.size)
+ return i915_error_object_create(dev_priv, obj);
+ }
+@@ -775,11 +777,17 @@ static void i915_gem_record_rings(struct
+ struct drm_i915_error_state *error)
+ {
+ struct drm_i915_private *dev_priv = dev->dev_private;
+- struct intel_ring_buffer *ring;
+ struct drm_i915_gem_request *request;
+ int i, count;
+
+- for_each_ring(ring, dev_priv, i) {
++ for (i = 0; i < I915_NUM_RINGS; i++) {
++ struct intel_ring_buffer *ring = &dev_priv->ring[i];
++
++ if (ring->dev == NULL)
++ continue;
++
++ error->ring[i].valid = true;
++
+ i915_record_ring_state(dev, error, ring);
+
+ error->ring[i].batchbuffer =
--- /dev/null
+From ec14ba47791965d2c08e0a681ff44eacbf3c4553 Mon Sep 17 00:00:00 2001
+From: Akash Goel <akash.goel@intel.com>
+Date: Mon, 13 Jan 2014 16:24:45 +0530
+Subject: drm/i915: Fix the offset issue for the stolen GEM objects
+
+From: Akash Goel <akash.goel@intel.com>
+
+commit ec14ba47791965d2c08e0a681ff44eacbf3c4553 upstream.
+
+The 'offset' field of the 'scatterlist' structure was wrongly
+programmed with the offset value from the base of stolen area,
+whereas this field indicates the offset from where the interested
+data starts within the first PAGE pointed to by 'scattterlist'
+structure. As a result when a new GEM object allocated from stolen
+area is mapped to GTT, it could lead to an overwrite of GTT entries
+as the page count calculation will go wrong, refer the function
+'sg_page_count'.
+
+v2: Modified the commit message. (Chris)
+
+Signed-off-by: Akash Goel <akash.goel@intel.com>
+Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=71908
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=69104
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_gem_stolen.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
++++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
+@@ -250,7 +250,7 @@ i915_pages_create_for_stolen(struct drm_
+ }
+
+ sg = st->sgl;
+- sg->offset = offset;
++ sg->offset = 0;
+ sg->length = size;
+
+ sg_dma_address(sg) = (dma_addr_t)dev_priv->mm.stolen_base + offset;
--- /dev/null
+From 304d695c3dc8eb65206b9eaf16f8d1a41510d1cf Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Thu, 2 Jan 2014 14:32:35 +0000
+Subject: drm/i915: Flush outstanding requests before allocating new seqno
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 304d695c3dc8eb65206b9eaf16f8d1a41510d1cf upstream.
+
+In very rare cases (such as a memory failure stress test) it is possible
+to fill the entire ring without emitting a request. Under this
+circumstance, the outstanding request is flushed and waited upon. After
+space on the ring is cleared, we return to emitting the new command -
+except that we just cleared the seqno allocated for this operation and
+trigger the sanity check that a request is only ever emitted with a
+valid seqno. The fix is to rearrange the code to make sure the
+allocation of the seqno for this operation is after any required flushes
+of outstanding operations.
+
+The bug exists since the preallocation was introduced in
+commit 9d7730914f4cd496e356acfab95b41075aa8eae8
+Author: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Tue Nov 27 16:22:52 2012 +0000
+
+ drm/i915: Preallocate next seqno before touching the ring
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Mika Kuoppala <mika.kuoppala@intel.com>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Reviewed-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_ringbuffer.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -1611,8 +1611,8 @@ intel_ring_alloc_seqno(struct intel_ring
+ return i915_gem_get_seqno(ring->dev, &ring->outstanding_lazy_seqno);
+ }
+
+-static int __intel_ring_begin(struct intel_ring_buffer *ring,
+- int bytes)
++static int __intel_ring_prepare(struct intel_ring_buffer *ring,
++ int bytes)
+ {
+ int ret;
+
+@@ -1628,7 +1628,6 @@ static int __intel_ring_begin(struct int
+ return ret;
+ }
+
+- ring->space -= bytes;
+ return 0;
+ }
+
+@@ -1643,12 +1642,17 @@ int intel_ring_begin(struct intel_ring_b
+ if (ret)
+ return ret;
+
++ ret = __intel_ring_prepare(ring, num_dwords * sizeof(uint32_t));
++ if (ret)
++ return ret;
++
+ /* Preallocate the olr before touching the ring */
+ ret = intel_ring_alloc_seqno(ring);
+ if (ret)
+ return ret;
+
+- return __intel_ring_begin(ring, num_dwords * sizeof(uint32_t));
++ ring->space -= num_dwords * sizeof(uint32_t);
++ return 0;
+ }
+
+ void intel_ring_init_seqno(struct intel_ring_buffer *ring, u32 seqno)
--- /dev/null
+From 232a6ee9af8adb185640f67fcaaa9014a9aa0573 Mon Sep 17 00:00:00 2001
+From: Todd Previte <tprevite@gmail.com>
+Date: Thu, 23 Jan 2014 00:13:41 -0700
+Subject: drm/i915: VLV2 - Fix hotplug detect bits
+
+From: Todd Previte <tprevite@gmail.com>
+
+commit 232a6ee9af8adb185640f67fcaaa9014a9aa0573 upstream.
+
+Add new definitions for hotplug live status bits for VLV2 since they're
+in reverse order from the gen4x ones.
+
+Changelog:
+- Restored gen4 bit definitions
+- Added new definitions for VLV2
+- Added platform check for IS_VALLEYVIEW() in dp_detect to use the correct
+ bit defintions
+- Replaced a lost trailing brace for the added switch()
+
+Signed-off-by: Todd Previte <tprevite@gmail.com>
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=73951
+[danvet: Switch to _VLV postfix instead of prefix and regroupg
+comments again so that the g4x warning is right next to those defines.
+Also add a _G4X suffix for those special ones. Also cc stable.]
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_reg.h | 10 +++++++---
+ drivers/gpu/drm/i915/intel_dp.c | 40 ++++++++++++++++++++++++++++------------
+ 2 files changed, 35 insertions(+), 15 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -2117,9 +2117,13 @@
+ * Please check the detailed lore in the commit message for for experimental
+ * evidence.
+ */
+-#define PORTD_HOTPLUG_LIVE_STATUS (1 << 29)
+-#define PORTC_HOTPLUG_LIVE_STATUS (1 << 28)
+-#define PORTB_HOTPLUG_LIVE_STATUS (1 << 27)
++#define PORTD_HOTPLUG_LIVE_STATUS_G4X (1 << 29)
++#define PORTC_HOTPLUG_LIVE_STATUS_G4X (1 << 28)
++#define PORTB_HOTPLUG_LIVE_STATUS_G4X (1 << 27)
++/* VLV DP/HDMI bits again match Bspec */
++#define PORTD_HOTPLUG_LIVE_STATUS_VLV (1 << 27)
++#define PORTC_HOTPLUG_LIVE_STATUS_VLV (1 << 28)
++#define PORTB_HOTPLUG_LIVE_STATUS_VLV (1 << 29)
+ #define PORTD_HOTPLUG_INT_STATUS (3 << 21)
+ #define PORTC_HOTPLUG_INT_STATUS (3 << 19)
+ #define PORTB_HOTPLUG_INT_STATUS (3 << 17)
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -3020,18 +3020,34 @@ g4x_dp_detect(struct intel_dp *intel_dp)
+ return status;
+ }
+
+- switch (intel_dig_port->port) {
+- case PORT_B:
+- bit = PORTB_HOTPLUG_LIVE_STATUS;
+- break;
+- case PORT_C:
+- bit = PORTC_HOTPLUG_LIVE_STATUS;
+- break;
+- case PORT_D:
+- bit = PORTD_HOTPLUG_LIVE_STATUS;
+- break;
+- default:
+- return connector_status_unknown;
++ if (IS_VALLEYVIEW(dev)) {
++ switch (intel_dig_port->port) {
++ case PORT_B:
++ bit = PORTB_HOTPLUG_LIVE_STATUS_VLV;
++ break;
++ case PORT_C:
++ bit = PORTC_HOTPLUG_LIVE_STATUS_VLV;
++ break;
++ case PORT_D:
++ bit = PORTD_HOTPLUG_LIVE_STATUS_VLV;
++ break;
++ default:
++ return connector_status_unknown;
++ }
++ } else {
++ switch (intel_dig_port->port) {
++ case PORT_B:
++ bit = PORTB_HOTPLUG_LIVE_STATUS_G4X;
++ break;
++ case PORT_C:
++ bit = PORTC_HOTPLUG_LIVE_STATUS_G4X;
++ break;
++ case PORT_D:
++ bit = PORTD_HOTPLUG_LIVE_STATUS_G4X;
++ break;
++ default:
++ return connector_status_unknown;
++ }
+ }
+
+ if ((I915_READ(PORT_HOTPLUG_STAT) & bit) == 0)
--- /dev/null
+From 8b7ad1bb3d440da888f2a939dc870eba429b9192 Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Wed, 5 Feb 2014 14:47:45 +1000
+Subject: drm/mgag200,ast,cirrus: fix regression with drm_can_sleep conversion
+
+From: Dave Airlie <airlied@redhat.com>
+
+commit 8b7ad1bb3d440da888f2a939dc870eba429b9192 upstream.
+
+I totally sign inverted my way out of this one.
+
+Reported-by: "Sabrina Dubroca" <sd@queasysnail.net>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/ast/ast_fb.c | 2 +-
+ drivers/gpu/drm/cirrus/cirrus_fbdev.c | 2 +-
+ drivers/gpu/drm/mgag200/mgag200_fb.c | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/ast/ast_fb.c
++++ b/drivers/gpu/drm/ast/ast_fb.c
+@@ -65,7 +65,7 @@ static void ast_dirty_update(struct ast_
+ * then the BO is being moved and we should
+ * store up the damage until later.
+ */
+- if (!drm_can_sleep())
++ if (drm_can_sleep())
+ ret = ast_bo_reserve(bo, true);
+ if (ret) {
+ if (ret != -EBUSY)
+--- a/drivers/gpu/drm/cirrus/cirrus_fbdev.c
++++ b/drivers/gpu/drm/cirrus/cirrus_fbdev.c
+@@ -39,7 +39,7 @@ static void cirrus_dirty_update(struct c
+ * then the BO is being moved and we should
+ * store up the damage until later.
+ */
+- if (!drm_can_sleep())
++ if (drm_can_sleep())
+ ret = cirrus_bo_reserve(bo, true);
+ if (ret) {
+ if (ret != -EBUSY)
+--- a/drivers/gpu/drm/mgag200/mgag200_fb.c
++++ b/drivers/gpu/drm/mgag200/mgag200_fb.c
+@@ -41,7 +41,7 @@ static void mga_dirty_update(struct mga_
+ * then the BO is being moved and we should
+ * store up the damage until later.
+ */
+- if (!drm_can_sleep())
++ if (drm_can_sleep())
+ ret = mgag200_bo_reserve(bo, true);
+ if (ret) {
+ if (ret != -EBUSY)
--- /dev/null
+From 53dac830537b51df555ba5e7ebb236705b7eaa7c Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Thu, 16 Jan 2014 14:28:22 +1000
+Subject: drm/mgag200: fix oops in cursor code.
+
+From: Dave Airlie <airlied@redhat.com>
+
+commit 53dac830537b51df555ba5e7ebb236705b7eaa7c upstream.
+
+In some cases we enter the cursor code with file_priv = NULL causing an oops,
+we also can try to unpin something that isn't pinned, and this is a good fix for it.
+
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/mgag200/mgag200_cursor.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/mgag200/mgag200_cursor.c
++++ b/drivers/gpu/drm/mgag200/mgag200_cursor.c
+@@ -22,8 +22,10 @@ static void mga_hide_cursor(struct mga_d
+ {
+ WREG8(MGA_CURPOSXL, 0);
+ WREG8(MGA_CURPOSXH, 0);
+- mgag200_bo_unpin(mdev->cursor.pixels_1);
+- mgag200_bo_unpin(mdev->cursor.pixels_2);
++ if (mdev->cursor.pixels_1->pin_count)
++ mgag200_bo_unpin(mdev->cursor.pixels_1);
++ if (mdev->cursor.pixels_2->pin_count)
++ mgag200_bo_unpin(mdev->cursor.pixels_2);
+ }
+
+ int mga_crtc_cursor_set(struct drm_crtc *crtc,
+@@ -32,7 +34,7 @@ int mga_crtc_cursor_set(struct drm_crtc
+ uint32_t width,
+ uint32_t height)
+ {
+- struct drm_device *dev = (struct drm_device *)file_priv->minor->dev;
++ struct drm_device *dev = crtc->dev;
+ struct mga_device *mdev = (struct mga_device *)dev->dev_private;
+ struct mgag200_bo *pixels_1 = mdev->cursor.pixels_1;
+ struct mgag200_bo *pixels_2 = mdev->cursor.pixels_2;
--- /dev/null
+From ec22b4aa993abbd18f5bbbcb20a1c56be3b1d38b Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Wed, 5 Feb 2014 14:13:56 +1000
+Subject: drm/mgag200: fix typo causing bw limits to be ignored on some chips
+
+From: Dave Airlie <airlied@redhat.com>
+
+commit ec22b4aa993abbd18f5bbbcb20a1c56be3b1d38b upstream.
+
+mode->mdev otherwise the bw limits never kick in.
+
+Reported in RHEL testing.
+
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/mgag200/mgag200_mode.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/mgag200/mgag200_mode.c
++++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
+@@ -1519,11 +1519,11 @@ static int mga_vga_mode_valid(struct drm
+ (mga_vga_calculate_mode_bandwidth(mode, bpp)
+ > (32700 * 1024))) {
+ return MODE_BANDWIDTH;
+- } else if (mode->type == G200_EH &&
++ } else if (mdev->type == G200_EH &&
+ (mga_vga_calculate_mode_bandwidth(mode, bpp)
+ > (37500 * 1024))) {
+ return MODE_BANDWIDTH;
+- } else if (mode->type == G200_ER &&
++ } else if (mdev->type == G200_ER &&
+ (mga_vga_calculate_mode_bandwidth(mode,
+ bpp) > (55000 * 1024))) {
+ return MODE_BANDWIDTH;
--- /dev/null
+From 90d6db1635d5e225623af2e2e859feb607345287 Mon Sep 17 00:00:00 2001
+From: Ilia Mirkin <imirkin@alum.mit.edu>
+Date: Sat, 7 Dec 2013 11:42:19 -0500
+Subject: drm/nouveau/falcon: use vmalloc to create firwmare copies
+
+From: Ilia Mirkin <imirkin@alum.mit.edu>
+
+commit 90d6db1635d5e225623af2e2e859feb607345287 upstream.
+
+Some firmware images may be large (64K), so using kmalloc memory is
+inappropriate for them. Use vmalloc instead, to avoid high-order
+allocation failures.
+
+Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/nouveau/core/engine/falcon.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/nouveau/core/engine/falcon.c
++++ b/drivers/gpu/drm/nouveau/core/engine/falcon.c
+@@ -56,6 +56,16 @@ _nouveau_falcon_wr32(struct nouveau_obje
+ nv_wr32(falcon, falcon->addr + addr, data);
+ }
+
++static void *
++vmemdup(const void *src, size_t len)
++{
++ void *p = vmalloc(len);
++
++ if (p)
++ memcpy(p, src, len);
++ return p;
++}
++
+ int
+ _nouveau_falcon_init(struct nouveau_object *object)
+ {
+@@ -111,7 +121,7 @@ _nouveau_falcon_init(struct nouveau_obje
+
+ ret = request_firmware(&fw, name, &device->pdev->dev);
+ if (ret == 0) {
+- falcon->code.data = kmemdup(fw->data, fw->size, GFP_KERNEL);
++ falcon->code.data = vmemdup(fw->data, fw->size);
+ falcon->code.size = fw->size;
+ falcon->data.data = NULL;
+ falcon->data.size = 0;
+@@ -134,7 +144,7 @@ _nouveau_falcon_init(struct nouveau_obje
+ return ret;
+ }
+
+- falcon->data.data = kmemdup(fw->data, fw->size, GFP_KERNEL);
++ falcon->data.data = vmemdup(fw->data, fw->size);
+ falcon->data.size = fw->size;
+ release_firmware(fw);
+ if (!falcon->data.data)
+@@ -149,7 +159,7 @@ _nouveau_falcon_init(struct nouveau_obje
+ return ret;
+ }
+
+- falcon->code.data = kmemdup(fw->data, fw->size, GFP_KERNEL);
++ falcon->code.data = vmemdup(fw->data, fw->size);
+ falcon->code.size = fw->size;
+ release_firmware(fw);
+ if (!falcon->code.data)
+@@ -235,8 +245,8 @@ _nouveau_falcon_fini(struct nouveau_obje
+ if (!suspend) {
+ nouveau_gpuobj_ref(NULL, &falcon->core);
+ if (falcon->external) {
+- kfree(falcon->data.data);
+- kfree(falcon->code.data);
++ vfree(falcon->data.data);
++ vfree(falcon->code.data);
+ falcon->code.data = NULL;
+ }
+ }
--- /dev/null
+From 09c3de135063f93d7137ad112f551f293b1204cf Mon Sep 17 00:00:00 2001
+From: Maarten Lankhorst <maarten.lankhorst@canonical.com>
+Date: Wed, 29 Jan 2014 11:05:09 +0100
+Subject: drm/nouveau: fix lock unbalance in nouveau_crtc_page_flip
+
+From: Maarten Lankhorst <maarten.lankhorst@canonical.com>
+
+commit 09c3de135063f93d7137ad112f551f293b1204cf upstream.
+
+Fixes a regression introduced by d5c1e84b3a130f0
+"drm/nouveau: hold mutex while syncing to kernel channel".
+
+Reported-by: Fengguang Wu <fengguang.wu@intel.com>
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/nouveau/nouveau_display.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/nouveau/nouveau_display.c
++++ b/drivers/gpu/drm/nouveau/nouveau_display.c
+@@ -618,7 +618,7 @@ nouveau_crtc_page_flip(struct drm_crtc *
+ ret = nouveau_fence_sync(fence, chan);
+ nouveau_fence_unref(&fence);
+ if (ret)
+- goto fail_free;
++ goto fail_unpin;
+
+ ret = ttm_bo_reserve(&old_bo->bo, true, false, false, NULL);
+ if (ret)
--- /dev/null
+From ce8f7699f2b6ffe4aa8368b8d9d370875accaa5f Mon Sep 17 00:00:00 2001
+From: Maarten Lankhorst <maarten.lankhorst@canonical.com>
+Date: Tue, 12 Nov 2013 13:34:08 +0100
+Subject: drm/nouveau: fix m2mf copy to tiled gart
+
+From: Maarten Lankhorst <maarten.lankhorst@canonical.com>
+
+commit ce8f7699f2b6ffe4aa8368b8d9d370875accaa5f upstream.
+
+Commit de7b7d59d54852c introduced tiled GART, but a linear copy is
+still performed. This may result in errors on eviction, fix it by
+checking tiling from memtype.
+
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/nouveau/nouveau_bo.c | 33 ++++++++-------------------------
+ 1 file changed, 8 insertions(+), 25 deletions(-)
+
+--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
++++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
+@@ -798,25 +798,25 @@ nv50_bo_move_m2mf(struct nouveau_channel
+ struct ttm_mem_reg *old_mem, struct ttm_mem_reg *new_mem)
+ {
+ struct nouveau_mem *node = old_mem->mm_node;
+- struct nouveau_bo *nvbo = nouveau_bo(bo);
+ u64 length = (new_mem->num_pages << PAGE_SHIFT);
+ u64 src_offset = node->vma[0].offset;
+ u64 dst_offset = node->vma[1].offset;
++ int src_tiled = !!node->memtype;
++ int dst_tiled = !!((struct nouveau_mem *)new_mem->mm_node)->memtype;
+ int ret;
+
+ while (length) {
+ u32 amount, stride, height;
+
++ ret = RING_SPACE(chan, 18 + 6 * (src_tiled + dst_tiled));
++ if (ret)
++ return ret;
++
+ amount = min(length, (u64)(4 * 1024 * 1024));
+ stride = 16 * 4;
+ height = amount / stride;
+
+- if (old_mem->mem_type == TTM_PL_VRAM &&
+- nouveau_bo_tile_layout(nvbo)) {
+- ret = RING_SPACE(chan, 8);
+- if (ret)
+- return ret;
+-
++ if (src_tiled) {
+ BEGIN_NV04(chan, NvSubCopy, 0x0200, 7);
+ OUT_RING (chan, 0);
+ OUT_RING (chan, 0);
+@@ -826,19 +826,10 @@ nv50_bo_move_m2mf(struct nouveau_channel
+ OUT_RING (chan, 0);
+ OUT_RING (chan, 0);
+ } else {
+- ret = RING_SPACE(chan, 2);
+- if (ret)
+- return ret;
+-
+ BEGIN_NV04(chan, NvSubCopy, 0x0200, 1);
+ OUT_RING (chan, 1);
+ }
+- if (new_mem->mem_type == TTM_PL_VRAM &&
+- nouveau_bo_tile_layout(nvbo)) {
+- ret = RING_SPACE(chan, 8);
+- if (ret)
+- return ret;
+-
++ if (dst_tiled) {
+ BEGIN_NV04(chan, NvSubCopy, 0x021c, 7);
+ OUT_RING (chan, 0);
+ OUT_RING (chan, 0);
+@@ -848,18 +839,10 @@ nv50_bo_move_m2mf(struct nouveau_channel
+ OUT_RING (chan, 0);
+ OUT_RING (chan, 0);
+ } else {
+- ret = RING_SPACE(chan, 2);
+- if (ret)
+- return ret;
+-
+ BEGIN_NV04(chan, NvSubCopy, 0x021c, 1);
+ OUT_RING (chan, 1);
+ }
+
+- ret = RING_SPACE(chan, 14);
+- if (ret)
+- return ret;
+-
+ BEGIN_NV04(chan, NvSubCopy, 0x0238, 2);
+ OUT_RING (chan, upper_32_bits(src_offset));
+ OUT_RING (chan, upper_32_bits(dst_offset));
--- /dev/null
+From d5c1e84b3a130f0743b218b33ff7d9cb493ab5b4 Mon Sep 17 00:00:00 2001
+From: Maarten Lankhorst <maarten.lankhorst@canonical.com>
+Date: Tue, 14 Jan 2014 16:48:58 +0100
+Subject: drm/nouveau: hold mutex while syncing to kernel channel
+
+From: Maarten Lankhorst <maarten.lankhorst@canonical.com>
+
+commit d5c1e84b3a130f0743b218b33ff7d9cb493ab5b4 upstream.
+
+Not holding the mutex potentially causes corruption of the kernel
+channel when page flipping.
+
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/nouveau/nouveau_display.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/nouveau/nouveau_display.c
++++ b/drivers/gpu/drm/nouveau/nouveau_display.c
+@@ -603,6 +603,14 @@ nouveau_crtc_page_flip(struct drm_crtc *
+ if (!s)
+ return -ENOMEM;
+
++ if (new_bo != old_bo) {
++ ret = nouveau_bo_pin(new_bo, TTM_PL_FLAG_VRAM);
++ if (ret)
++ goto fail_free;
++ }
++
++ mutex_lock(&chan->cli->mutex);
++
+ /* synchronise rendering channel with the kernel's channel */
+ spin_lock(&new_bo->bo.bdev->fence_lock);
+ fence = nouveau_fence_ref(new_bo->bo.sync_obj);
+@@ -612,13 +620,6 @@ nouveau_crtc_page_flip(struct drm_crtc *
+ if (ret)
+ goto fail_free;
+
+- if (new_bo != old_bo) {
+- ret = nouveau_bo_pin(new_bo, TTM_PL_FLAG_VRAM);
+- if (ret)
+- goto fail_free;
+- }
+-
+- mutex_lock(&chan->cli->mutex);
+ ret = ttm_bo_reserve(&old_bo->bo, true, false, false, NULL);
+ if (ret)
+ goto fail_unpin;
--- /dev/null
+From eb86301f293da3c362db729a9f40ddb25755902b Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Date: Wed, 13 Nov 2013 14:26:01 +0100
+Subject: drm/rcar-du: Update plane pitch in .mode_set_base() operation
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+commit eb86301f293da3c362db729a9f40ddb25755902b upstream.
+
+When setting a new frame buffer with the mode set base operation the
+pitch value might change. Set the hardware plane pitch register at the
+same time as the plane base address in the rcar_du_plane_update_base()
+function to make sure the pitch value always matches the frame buffer.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 1 -
+ drivers/gpu/drm/rcar-du/rcar_du_plane.c | 21 +++++++++++----------
+ 2 files changed, 11 insertions(+), 11 deletions(-)
+
+--- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
+@@ -371,7 +371,6 @@ static int rcar_du_crtc_mode_set(struct
+ goto error;
+
+ rcrtc->plane->format = format;
+- rcrtc->plane->pitch = crtc->fb->pitches[0];
+
+ rcrtc->plane->src_x = x;
+ rcrtc->plane->src_y = y;
+--- a/drivers/gpu/drm/rcar-du/rcar_du_plane.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_plane.c
+@@ -104,6 +104,15 @@ void rcar_du_plane_update_base(struct rc
+ {
+ struct rcar_du_group *rgrp = plane->group;
+ unsigned int index = plane->hwindex;
++ u32 mwr;
++
++ /* Memory pitch (expressed in pixels) */
++ if (plane->format->planes == 2)
++ mwr = plane->pitch;
++ else
++ mwr = plane->pitch * 8 / plane->format->bpp;
++
++ rcar_du_plane_write(rgrp, index, PnMWR, mwr);
+
+ /* The Y position is expressed in raster line units and must be doubled
+ * for 32bpp formats, according to the R8A7790 datasheet. No mention of
+@@ -133,6 +142,8 @@ void rcar_du_plane_compute_base(struct r
+ {
+ struct drm_gem_cma_object *gem;
+
++ plane->pitch = fb->pitches[0];
++
+ gem = drm_fb_cma_get_gem_obj(fb, 0);
+ plane->dma[0] = gem->paddr + fb->offsets[0];
+
+@@ -209,7 +220,6 @@ static void __rcar_du_plane_setup(struct
+ struct rcar_du_group *rgrp = plane->group;
+ u32 ddcr2 = PnDDCR2_CODE;
+ u32 ddcr4;
+- u32 mwr;
+
+ /* Data format
+ *
+@@ -240,14 +250,6 @@ static void __rcar_du_plane_setup(struct
+ rcar_du_plane_write(rgrp, index, PnDDCR2, ddcr2);
+ rcar_du_plane_write(rgrp, index, PnDDCR4, ddcr4);
+
+- /* Memory pitch (expressed in pixels) */
+- if (plane->format->planes == 2)
+- mwr = plane->pitch;
+- else
+- mwr = plane->pitch * 8 / plane->format->bpp;
+-
+- rcar_du_plane_write(rgrp, index, PnMWR, mwr);
+-
+ /* Destination position and size */
+ rcar_du_plane_write(rgrp, index, PnDSXR, plane->width);
+ rcar_du_plane_write(rgrp, index, PnDSYR, plane->height);
+@@ -309,7 +311,6 @@ rcar_du_plane_update(struct drm_plane *p
+
+ rplane->crtc = crtc;
+ rplane->format = format;
+- rplane->pitch = fb->pitches[0];
+
+ rplane->src_x = src_x >> 16;
+ rplane->src_y = src_y >> 16;
--- /dev/null
+From cf5e3413337309050c05e13dcebe85b7194a21e5 Mon Sep 17 00:00:00 2001
+From: Thomas Hellstrom <thellstrom@vmware.com>
+Date: Thu, 30 Jan 2014 10:58:19 +0100
+Subject: drm/vmwgfx: Fix regression caused by "drm/ttm: make ttm reservation calls behave like reservation calls"
+
+From: Thomas Hellstrom <thellstrom@vmware.com>
+
+commit cf5e3413337309050c05e13dcebe85b7194a21e5 upstream.
+
+The call to ttm_eu_backoff_reservation() as part of an error path would cause
+a lock imbalance if the reservation ticket was not initialized. This error is
+easily triggered from user-space by submitting a bogus command stream.
+
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
+Cc: Maarten Lankhorst <maarten.lankhorst@canonical.com>
+Cc: Jerome Glisse <jglisse@redhat.com>
+Cc: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -1483,11 +1483,11 @@ int vmw_execbuf_process(struct drm_file
+ ret = vmw_cmd_check_all(dev_priv, sw_context, kernel_commands,
+ command_size);
+ if (unlikely(ret != 0))
+- goto out_err;
++ goto out_err_nores;
+
+ ret = vmw_resources_reserve(sw_context);
+ if (unlikely(ret != 0))
+- goto out_err;
++ goto out_err_nores;
+
+ ret = ttm_eu_reserve_buffers(&ticket, &sw_context->validate_nodes);
+ if (unlikely(ret != 0))
+@@ -1569,10 +1569,11 @@ int vmw_execbuf_process(struct drm_file
+ return 0;
+
+ out_err:
+- vmw_resource_relocations_free(&sw_context->res_relocations);
+- vmw_free_relocations(sw_context);
+ ttm_eu_backoff_reservation(&ticket, &sw_context->validate_nodes);
++out_err_nores:
+ vmw_resource_list_unreserve(&sw_context->resource_list, true);
++ vmw_resource_relocations_free(&sw_context->res_relocations);
++ vmw_free_relocations(sw_context);
+ vmw_clear_validations(sw_context);
+ if (unlikely(dev_priv->pinned_bo != NULL &&
+ !dev_priv->query_cid_valid))
--- /dev/null
+From 0d00c488f3de59d19784d5ce774528acaa194525 Mon Sep 17 00:00:00 2001
+From: Thomas Hellstrom <thellstrom@vmware.com>
+Date: Wed, 15 Jan 2014 20:19:53 +0100
+Subject: drm/vmwgfx: Fix the driver for large dma addresses
+
+From: Thomas Hellstrom <thellstrom@vmware.com>
+
+commit 0d00c488f3de59d19784d5ce774528acaa194525 upstream.
+
+With dma compliance / IOMMU support added to the driver in kernel 3.13,
+the dma addresses can exceed 44 bits, which is what we support in
+32-bit mode and with GMR1.
+So in 32-bit mode and optionally in 64-bit mode, restrict the dma
+addresses to 44 bits, and strip the old GMR1 code.
+
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 47 ++++++++--
+ drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 1
+ drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c | 160 ------------------------------------
+ 3 files changed, 39 insertions(+), 169 deletions(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+@@ -189,6 +189,7 @@ static int enable_fbdev = IS_ENABLED(CON
+ static int vmw_force_iommu;
+ static int vmw_restrict_iommu;
+ static int vmw_force_coherent;
++static int vmw_restrict_dma_mask;
+
+ static int vmw_probe(struct pci_dev *, const struct pci_device_id *);
+ static void vmw_master_init(struct vmw_master *);
+@@ -203,6 +204,8 @@ MODULE_PARM_DESC(restrict_iommu, "Try to
+ module_param_named(restrict_iommu, vmw_restrict_iommu, int, 0600);
+ MODULE_PARM_DESC(force_coherent, "Force coherent TTM pages");
+ module_param_named(force_coherent, vmw_force_coherent, int, 0600);
++MODULE_PARM_DESC(restrict_dma_mask, "Restrict DMA mask to 44 bits with IOMMU");
++module_param_named(restrict_dma_mask, vmw_restrict_dma_mask, int, 0600);
+
+
+ static void vmw_print_capabilities(uint32_t capabilities)
+@@ -510,6 +513,33 @@ out_fixup:
+ return 0;
+ }
+
++/**
++ * vmw_dma_masks - set required page- and dma masks
++ *
++ * @dev: Pointer to struct drm-device
++ *
++ * With 32-bit we can only handle 32 bit PFNs. Optionally set that
++ * restriction also for 64-bit systems.
++ */
++#ifdef CONFIG_INTEL_IOMMU
++static int vmw_dma_masks(struct vmw_private *dev_priv)
++{
++ struct drm_device *dev = dev_priv->dev;
++
++ if (intel_iommu_enabled &&
++ (sizeof(unsigned long) == 4 || vmw_restrict_dma_mask)) {
++ DRM_INFO("Restricting DMA addresses to 44 bits.\n");
++ return dma_set_mask(dev->dev, DMA_BIT_MASK(44));
++ }
++ return 0;
++}
++#else
++static int vmw_dma_masks(struct vmw_private *dev_priv)
++{
++ return 0;
++}
++#endif
++
+ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
+ {
+ struct vmw_private *dev_priv;
+@@ -578,14 +608,9 @@ static int vmw_driver_load(struct drm_de
+
+ vmw_get_initial_size(dev_priv);
+
+- if (dev_priv->capabilities & SVGA_CAP_GMR) {
+- dev_priv->max_gmr_descriptors =
+- vmw_read(dev_priv,
+- SVGA_REG_GMR_MAX_DESCRIPTOR_LENGTH);
++ if (dev_priv->capabilities & SVGA_CAP_GMR2) {
+ dev_priv->max_gmr_ids =
+ vmw_read(dev_priv, SVGA_REG_GMR_MAX_IDS);
+- }
+- if (dev_priv->capabilities & SVGA_CAP_GMR2) {
+ dev_priv->max_gmr_pages =
+ vmw_read(dev_priv, SVGA_REG_GMRS_MAX_PAGES);
+ dev_priv->memory_size =
+@@ -599,17 +624,17 @@ static int vmw_driver_load(struct drm_de
+ dev_priv->memory_size = 512*1024*1024;
+ }
+
++ ret = vmw_dma_masks(dev_priv);
++ if (unlikely(ret != 0))
++ goto out_err0;
++
+ mutex_unlock(&dev_priv->hw_mutex);
+
+ vmw_print_capabilities(dev_priv->capabilities);
+
+- if (dev_priv->capabilities & SVGA_CAP_GMR) {
++ if (dev_priv->capabilities & SVGA_CAP_GMR2) {
+ DRM_INFO("Max GMR ids is %u\n",
+ (unsigned)dev_priv->max_gmr_ids);
+- DRM_INFO("Max GMR descriptors is %u\n",
+- (unsigned)dev_priv->max_gmr_descriptors);
+- }
+- if (dev_priv->capabilities & SVGA_CAP_GMR2) {
+ DRM_INFO("Max number of GMR pages is %u\n",
+ (unsigned)dev_priv->max_gmr_pages);
+ DRM_INFO("Max dedicated hypervisor surface memory is %u kiB\n",
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+@@ -290,7 +290,6 @@ struct vmw_private {
+ __le32 __iomem *mmio_virt;
+ int mmio_mtrr;
+ uint32_t capabilities;
+- uint32_t max_gmr_descriptors;
+ uint32_t max_gmr_ids;
+ uint32_t max_gmr_pages;
+ uint32_t memory_size;
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c
+@@ -125,181 +125,27 @@ static void vmw_gmr2_unbind(struct vmw_p
+ }
+
+
+-static void vmw_gmr_free_descriptors(struct device *dev, dma_addr_t desc_dma,
+- struct list_head *desc_pages)
+-{
+- struct page *page, *next;
+- struct svga_guest_mem_descriptor *page_virtual;
+- unsigned int desc_per_page = PAGE_SIZE /
+- sizeof(struct svga_guest_mem_descriptor) - 1;
+-
+- if (list_empty(desc_pages))
+- return;
+-
+- list_for_each_entry_safe(page, next, desc_pages, lru) {
+- list_del_init(&page->lru);
+-
+- if (likely(desc_dma != DMA_ADDR_INVALID)) {
+- dma_unmap_page(dev, desc_dma, PAGE_SIZE,
+- DMA_TO_DEVICE);
+- }
+-
+- page_virtual = kmap_atomic(page);
+- desc_dma = (dma_addr_t)
+- le32_to_cpu(page_virtual[desc_per_page].ppn) <<
+- PAGE_SHIFT;
+- kunmap_atomic(page_virtual);
+-
+- __free_page(page);
+- }
+-}
+-
+-/**
+- * FIXME: Adjust to the ttm lowmem / highmem storage to minimize
+- * the number of used descriptors.
+- *
+- */
+-
+-static int vmw_gmr_build_descriptors(struct device *dev,
+- struct list_head *desc_pages,
+- struct vmw_piter *iter,
+- unsigned long num_pages,
+- dma_addr_t *first_dma)
+-{
+- struct page *page;
+- struct svga_guest_mem_descriptor *page_virtual = NULL;
+- struct svga_guest_mem_descriptor *desc_virtual = NULL;
+- unsigned int desc_per_page;
+- unsigned long prev_pfn;
+- unsigned long pfn;
+- int ret;
+- dma_addr_t desc_dma;
+-
+- desc_per_page = PAGE_SIZE /
+- sizeof(struct svga_guest_mem_descriptor) - 1;
+-
+- while (likely(num_pages != 0)) {
+- page = alloc_page(__GFP_HIGHMEM);
+- if (unlikely(page == NULL)) {
+- ret = -ENOMEM;
+- goto out_err;
+- }
+-
+- list_add_tail(&page->lru, desc_pages);
+- page_virtual = kmap_atomic(page);
+- desc_virtual = page_virtual - 1;
+- prev_pfn = ~(0UL);
+-
+- while (likely(num_pages != 0)) {
+- pfn = vmw_piter_dma_addr(iter) >> PAGE_SHIFT;
+-
+- if (pfn != prev_pfn + 1) {
+-
+- if (desc_virtual - page_virtual ==
+- desc_per_page - 1)
+- break;
+-
+- (++desc_virtual)->ppn = cpu_to_le32(pfn);
+- desc_virtual->num_pages = cpu_to_le32(1);
+- } else {
+- uint32_t tmp =
+- le32_to_cpu(desc_virtual->num_pages);
+- desc_virtual->num_pages = cpu_to_le32(tmp + 1);
+- }
+- prev_pfn = pfn;
+- --num_pages;
+- vmw_piter_next(iter);
+- }
+-
+- (++desc_virtual)->ppn = DMA_PAGE_INVALID;
+- desc_virtual->num_pages = cpu_to_le32(0);
+- kunmap_atomic(page_virtual);
+- }
+-
+- desc_dma = 0;
+- list_for_each_entry_reverse(page, desc_pages, lru) {
+- page_virtual = kmap_atomic(page);
+- page_virtual[desc_per_page].ppn = cpu_to_le32
+- (desc_dma >> PAGE_SHIFT);
+- kunmap_atomic(page_virtual);
+- desc_dma = dma_map_page(dev, page, 0, PAGE_SIZE,
+- DMA_TO_DEVICE);
+-
+- if (unlikely(dma_mapping_error(dev, desc_dma)))
+- goto out_err;
+- }
+- *first_dma = desc_dma;
+-
+- return 0;
+-out_err:
+- vmw_gmr_free_descriptors(dev, DMA_ADDR_INVALID, desc_pages);
+- return ret;
+-}
+-
+-static void vmw_gmr_fire_descriptors(struct vmw_private *dev_priv,
+- int gmr_id, dma_addr_t desc_dma)
+-{
+- mutex_lock(&dev_priv->hw_mutex);
+-
+- vmw_write(dev_priv, SVGA_REG_GMR_ID, gmr_id);
+- wmb();
+- vmw_write(dev_priv, SVGA_REG_GMR_DESCRIPTOR, desc_dma >> PAGE_SHIFT);
+- mb();
+-
+- mutex_unlock(&dev_priv->hw_mutex);
+-
+-}
+-
+ int vmw_gmr_bind(struct vmw_private *dev_priv,
+ const struct vmw_sg_table *vsgt,
+ unsigned long num_pages,
+ int gmr_id)
+ {
+- struct list_head desc_pages;
+- dma_addr_t desc_dma = 0;
+- struct device *dev = dev_priv->dev->dev;
+ struct vmw_piter data_iter;
+- int ret;
+
+ vmw_piter_start(&data_iter, vsgt, 0);
+
+ if (unlikely(!vmw_piter_next(&data_iter)))
+ return 0;
+
+- if (likely(dev_priv->capabilities & SVGA_CAP_GMR2))
+- return vmw_gmr2_bind(dev_priv, &data_iter, num_pages, gmr_id);
+-
+- if (unlikely(!(dev_priv->capabilities & SVGA_CAP_GMR)))
+- return -EINVAL;
+-
+- if (vsgt->num_regions > dev_priv->max_gmr_descriptors)
++ if (unlikely(!(dev_priv->capabilities & SVGA_CAP_GMR2)))
+ return -EINVAL;
+
+- INIT_LIST_HEAD(&desc_pages);
+-
+- ret = vmw_gmr_build_descriptors(dev, &desc_pages, &data_iter,
+- num_pages, &desc_dma);
+- if (unlikely(ret != 0))
+- return ret;
+-
+- vmw_gmr_fire_descriptors(dev_priv, gmr_id, desc_dma);
+- vmw_gmr_free_descriptors(dev, desc_dma, &desc_pages);
+-
+- return 0;
++ return vmw_gmr2_bind(dev_priv, &data_iter, num_pages, gmr_id);
+ }
+
+
+ void vmw_gmr_unbind(struct vmw_private *dev_priv, int gmr_id)
+ {
+- if (likely(dev_priv->capabilities & SVGA_CAP_GMR2)) {
++ if (likely(dev_priv->capabilities & SVGA_CAP_GMR2))
+ vmw_gmr2_unbind(dev_priv, gmr_id);
+- return;
+- }
+-
+- mutex_lock(&dev_priv->hw_mutex);
+- vmw_write(dev_priv, SVGA_REG_GMR_ID, gmr_id);
+- wmb();
+- vmw_write(dev_priv, SVGA_REG_GMR_DESCRIPTOR, 0);
+- mb();
+- mutex_unlock(&dev_priv->hw_mutex);
+ }
--- /dev/null
+From 22accca01713b13dac386ca90b787aadf88f6551 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Sat, 25 Jan 2014 10:13:37 +0100
+Subject: i915: remove pm_qos request on error
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit 22accca01713b13dac386ca90b787aadf88f6551 upstream.
+
+Not removing pm qos request and free memory for it can cause crash,
+when some other driver use pm qos. For example, this oops:
+
+BUG: unable to handle kernel paging request at fffffffffffffff8
+IP: [<ffffffff81307a6b>] plist_add+0x5b/0xd0
+Call Trace:
+ [<ffffffff810acf25>] pm_qos_update_target+0x125/0x1e0
+ [<ffffffff810ad071>] pm_qos_add_request+0x91/0x100
+ [<ffffffffa053ec14>] e1000_open+0xe4/0x5b0 [e1000e]
+
+was caused by earlier i915 probe failure:
+
+[drm:i915_report_and_clear_eir] *ERROR* EIR stuck: 0x00000010, masking
+[drm:init_ring_common] *ERROR* render ring initialization failed ctl 0001f001 head 00003004 tail 00000000 start 00003000
+[drm:i915_driver_load] *ERROR* failed to init modeset
+i915: probe of 0000:00:02.0 failed with error -5
+
+Bug report:
+http://bugzilla.redhat.com/show_bug.cgi?id=1057533
+
+Reported-by: Giandomenico De Tullio <ghisha@gmail.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+[danvet: Drop unnecessary code movement.]
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_dma.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/i915/i915_dma.c
++++ b/drivers/gpu/drm/i915/i915_dma.c
+@@ -1679,6 +1679,7 @@ out_gem_unload:
+
+ intel_teardown_gmbus(dev);
+ intel_teardown_mchbar(dev);
++ pm_qos_remove_request(&dev_priv->pm_qos);
+ destroy_workqueue(dev_priv->wq);
+ out_mtrrfree:
+ arch_phys_wc_del(dev_priv->gtt.mtrr);
drm-radeon-dce8-workaround-for-atom-blankcrtc-table.patch
dm-sysfs-fix-a-module-unload-race.patch
target-fix-percpu_ref_put-race-in-transport_lun_remove_cmd.patch
+drm-nouveau-fix-m2mf-copy-to-tiled-gart.patch
+drm-nouveau-falcon-use-vmalloc-to-create-firwmare-copies.patch
+drm-nouveau-hold-mutex-while-syncing-to-kernel-channel.patch
+drm-nouveau-fix-lock-unbalance-in-nouveau_crtc_page_flip.patch
+drm-i915-flush-outstanding-requests-before-allocating-new-seqno.patch
+drm-i915-fix-the-offset-issue-for-the-stolen-gem-objects.patch
+drm-i915-vlv2-fix-hotplug-detect-bits.patch
+i915-remove-pm_qos-request-on-error.patch
+drm-i915-decouple-gpu-error-reporting-from-ring-initialisation.patch
+drm-cirrus-correct-register-values-for-16bpp.patch
+drm-gem-always-initialize-the-gem-object-in-object_init.patch
+drm-rcar-du-update-plane-pitch-in-.mode_set_base-operation.patch
+drm-gma500-lock-struct_mutex-around-cursor-updates.patch
+drm-ast-cirrus-mgag200-use-drm_can_sleep.patch
+drm-vmwgfx-fix-the-driver-for-large-dma-addresses.patch
+drm-vmwgfx-fix-regression-caused-by-drm-ttm-make-ttm-reservation-calls-behave-like-reservation-calls.patch
+drm-mgag200-fix-oops-in-cursor-code.patch
+drm-mgag200-fix-typo-causing-bw-limits-to-be-ignored-on-some-chips.patch
+drm-mgag200-ast-cirrus-fix-regression-with-drm_can_sleep-conversion.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
