--- /dev/null
+From c77d7162a7ae451c2e895d7ef7fbeb0906107472 Mon Sep 17 00:00:00 2001
+From: Willy Tarreau <w@1wt.eu>
+Date: Sat, 6 Oct 2012 10:20:16 +0200
+Subject: drm/i915: remove useless BUG_ON which caused a regression in 3.5.
+
+From: Willy Tarreau <w@1wt.eu>
+
+commit c77d7162a7ae451c2e895d7ef7fbeb0906107472 upstream.
+
+starting an old X server causes a kernel BUG since commit 1b50247a8d:
+
+------------[ cut here ]------------
+kernel BUG at drivers/gpu/drm/i915/i915_gem.c:3661!
+invalid opcode: 0000 [#1] SMP
+Modules linked in: snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss uvcvideo
++videobuf2_core videodev videobuf2_vmalloc videobuf2_memops uhci_hcd ath9k mac80211 snd_hda_codec_realtek ath9k_common microcode
++ath9k_hw psmouse serio_raw sg ath cfg80211 atl1c lpc_ich mfd_core ehci_hcd snd_hda_intel snd_hda_codec snd_hwdep snd_pcm rtc_cmos
++snd_timer snd evdev eeepc_laptop snd_page_alloc sparse_keymap
+
+Pid: 2866, comm: X Not tainted 3.5.6-rc1-eeepc #1 ASUSTeK Computer INC. 1005HA/1005HA
+EIP: 0060:[<c12dc291>] EFLAGS: 00013297 CPU: 0
+EIP is at i915_gem_entervt_ioctl+0xf1/0x110
+EAX: f5941df4 EBX: f5940000 ECX: 00000000 EDX: 00020000
+ESI: f5835400 EDI: 00000000 EBP: f51d7e38 ESP: f51d7e20
+ DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
+CR0: 8005003b CR2: b760e0a0 CR3: 351b6000 CR4: 000007d0
+DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
+DR6: ffff0ff0 DR7: 00000400
+Process X (pid: 2866, ti=f51d6000 task=f61af8d0 task.ti=f51d6000)
+Stack:
+ 00000001 00000000 f5835414 f51d7e84 f5835400 f54f85c0 f51d7f10 c12b530b
+ 00000001 c151b139 c14751b6 c152e030 00000b32 00006459 00000059 0000e200
+ 00000001 00000000 00006459 c159ddd0 c12dc1a0 ffffffea 00000000 00000000
+Call Trace:
+ [<c12b530b>] drm_ioctl+0x2eb/0x440
+ [<c12dc1a0>] ? i915_gem_init+0xe0/0xe0
+ [<c1052b2b>] ? enqueue_hrtimer+0x1b/0x50
+ [<c1053321>] ? __hrtimer_start_range_ns+0x161/0x330
+ [<c10530b3>] ? lock_hrtimer_base+0x23/0x50
+ [<c1053163>] ? hrtimer_try_to_cancel+0x33/0x70
+ [<c12b5020>] ? drm_version+0x90/0x90
+ [<c10ca171>] vfs_ioctl+0x31/0x50
+ [<c10ca2e4>] do_vfs_ioctl+0x64/0x510
+ [<c10535de>] ? hrtimer_nanosleep+0x8e/0x100
+ [<c1052c20>] ? update_rmtp+0x80/0x80
+ [<c10ca7c9>] sys_ioctl+0x39/0x60
+ [<c1433949>] syscall_call+0x7/0xb
+Code: 83 c4 0c 5b 5e 5f 5d c3 c7 44 24 04 2c 05 53 c1 c7 04 24 6f ef 47 c1 e8 6e e0 fd ff c7 83 38 1e 00 00 00 00 00 00 e9 3f ff ff
++ff <0f> 0b eb fe 0f 0b eb fe 8d b4 26 00 00 00 00 0f 0b eb fe 8d b6
+EIP: [<c12dc291>] i915_gem_entervt_ioctl+0xf1/0x110 SS:ESP 0068:f51d7e20
+---[ end trace dd332ec083cbd513 ]---
+
+The crash happens here in i915_gem_entervt_ioctl() :
+
+ 3659 BUG_ON(!list_empty(&dev_priv->mm.active_list));
+ 3660 BUG_ON(!list_empty(&dev_priv->mm.flushing_list));
+ -> 3661 BUG_ON(!list_empty(&dev_priv->mm.inactive_list));
+ 3662 mutex_unlock(&dev->struct_mutex);
+
+Quoting Chris :
+ "That BUG_ON there is silly and can simply be removed. The check is to
+ verify that no batches were submitted to the kernel whilst the UMS/GEM
+ client was suspended - to which the BUG_ONs are a crude approximation.
+ Furthermore, the checks are too late, since it means we attempted to
+ program the hardware whilst it was in an invalid state, the BUG_ONs are
+ the least of your concerns at that point."
+
+Note that this regression has been introduced in
+
+commit 1b50247a8ddde4af5aaa0e6bc125615372ce6c16
+Author: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Tue Apr 24 15:47:30 2012 +0100
+
+ drm/i915: Remove the list of pinned inactive objects
+
+Signed-off-by: Willy Tarreau <w@1wt.eu>
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+[danvet: Added note about the regressing commit and cc: stable.]
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_gem.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -3893,7 +3893,6 @@ i915_gem_entervt_ioctl(struct drm_device
+
+ BUG_ON(!list_empty(&dev_priv->mm.active_list));
+ BUG_ON(!list_empty(&dev_priv->mm.flushing_list));
+- BUG_ON(!list_empty(&dev_priv->mm.inactive_list));
+ mutex_unlock(&dev->struct_mutex);
+
+ ret = drm_irq_install(dev);
--- /dev/null
+From 26b6e44afb58432a5e998da0343757404f9de9ee Mon Sep 17 00:00:00 2001
+From: Kenneth Graunke <kenneth@whitecape.org>
+Date: Sun, 7 Oct 2012 08:51:07 -0700
+Subject: drm/i915: Set guardband clipping workaround bit in the right register.
+
+From: Kenneth Graunke <kenneth@whitecape.org>
+
+commit 26b6e44afb58432a5e998da0343757404f9de9ee upstream.
+
+A previous patch, namely:
+
+commit bf97b276ca04cee9ab65ffd378fa8e6aedd71ff6
+Author: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Wed Apr 11 20:42:41 2012 +0200
+
+ drm/i915: implement w/a for incorrect guarband clipping
+
+accidentally set bit 5 in 3D_CHICKEN, which has nothing to do with
+clipping. This patch changes it to be set in 3D_CHICKEN3, where it
+belongs.
+
+The game "Dante" demonstrates random clipping issues when guardband
+clipping is enabled and bit 5 of 3D_CHICKEN3 isn't set. So the
+workaround is actually necessary.
+
+Acked-by: Paul Menzel <paulepanter@users.sourceforge.net>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: Oliver McFadden <oliver.mcfadden@linux.intel.com>
+Signed-off-by: Kenneth Graunke <kenneth@whitecape.org>
+Reviewed-by: Mika Kuoppala <mika.kuoppala@intel.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_reg.h | 2 +-
+ drivers/gpu/drm/i915/intel_pm.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -513,7 +513,7 @@
+ */
+ # define _3D_CHICKEN2_WM_READ_PIPELINED (1 << 14)
+ #define _3D_CHICKEN3 0x02090
+-#define _3D_CHICKEN_SF_DISABLE_FASTCLIP_CULL (1 << 5)
++#define _3D_CHICKEN3_SF_DISABLE_FASTCLIP_CULL (1 << 5)
+
+ #define MI_MODE 0x0209c
+ # define VS_TIMER_DISPATCH (1 << 6)
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -3355,8 +3355,8 @@ static void gen6_init_clock_gating(struc
+ GEN6_RCCUNIT_CLOCK_GATE_DISABLE);
+
+ /* Bspec says we need to always set all mask bits. */
+- I915_WRITE(_3D_CHICKEN, (0xFFFF << 16) |
+- _3D_CHICKEN_SF_DISABLE_FASTCLIP_CULL);
++ I915_WRITE(_3D_CHICKEN3, (0xFFFF << 16) |
++ _3D_CHICKEN3_SF_DISABLE_FASTCLIP_CULL);
+
+ /*
+ * According to the spec the following bits should be
--- /dev/null
+From 0c96c65b48fba3ffe9822a554cbc0cd610765cd5 Mon Sep 17 00:00:00 2001
+From: Jani Nikula <jani.nikula@intel.com>
+Date: Wed, 26 Sep 2012 18:43:10 +0300
+Subject: drm/i915: use adjusted_mode instead of mode for checking the 6bpc force flag
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+commit 0c96c65b48fba3ffe9822a554cbc0cd610765cd5 upstream.
+
+The dithering introduced in
+
+commit 3b5c78a35cf7511c15e09a9b0ffab290a42d9bcf
+Author: Adam Jackson <ajax@redhat.com>
+Date: Tue Dec 13 15:41:00 2011 -0800
+
+ drm/i915/dp: Dither down to 6bpc if it makes the mode fit
+
+stores the INTEL_MODE_DP_FORCE_6BPC flag in the private_flags of the
+adjusted mode, while i9xx_crtc_mode_set() and ironlake_crtc_mode_set() use
+the original mode, without the flag, so it would never have any
+effect. However, the BPC was clamped by VBT settings, making things work by
+coincidence, until that part was removed in
+
+commit 4344b813f105a19f793f1fd93ad775b784648b95
+Author: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Fri Aug 10 11:10:20 2012 +0200
+
+Use adjusted_mode instead of mode when checking for
+INTEL_MODE_DP_FORCE_6BPC to make the flag have effect.
+
+v2: Don't forget to fix this in i9xx_crtc_mode_set() also, pointed out by
+Daniel both before and after sending the first patch.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=47621
+CC: Adam Jackson <ajax@redhat.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Reviewed-by: Adam Jackson <ajax@redhat.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/gpu/drm/i915/intel_display.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -4351,7 +4351,7 @@ static int i9xx_crtc_mode_set(struct drm
+ /* default to 8bpc */
+ pipeconf &= ~(PIPECONF_BPP_MASK | PIPECONF_DITHER_EN);
+ if (is_dp) {
+- if (mode->private_flags & INTEL_MODE_DP_FORCE_6BPC) {
++ if (adjusted_mode->private_flags & INTEL_MODE_DP_FORCE_6BPC) {
+ pipeconf |= PIPECONF_BPP_6 |
+ PIPECONF_DITHER_EN |
+ PIPECONF_DITHER_TYPE_SP;
+@@ -4705,7 +4705,7 @@ static int ironlake_crtc_mode_set(struct
+ /* determine panel color depth */
+ temp = I915_READ(PIPECONF(pipe));
+ temp &= ~PIPE_BPC_MASK;
+- dither = intel_choose_pipe_bpp_dither(crtc, &pipe_bpp, mode);
++ dither = intel_choose_pipe_bpp_dither(crtc, &pipe_bpp, adjusted_mode);
+ switch (pipe_bpp) {
+ case 18:
+ temp |= PIPE_6BPC;
--- /dev/null
+From 9a334cd0de2f43b29c192548000692bad52edfc6 Mon Sep 17 00:00:00 2001
+From: Ben Skeggs <bskeggs@redhat.com>
+Date: Tue, 9 Oct 2012 12:21:36 +1000
+Subject: drm/nouveau/bios: fix shadowing of ACPI ROMs larger than 64KiB
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+commit 9a334cd0de2f43b29c192548000692bad52edfc6 upstream.
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/nouveau/nouveau_bios.c | 22 ++++++++++------------
+ 1 file changed, 10 insertions(+), 12 deletions(-)
+
+--- a/drivers/gpu/drm/nouveau/nouveau_bios.c
++++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
+@@ -196,24 +196,22 @@ static void
+ bios_shadow_acpi(struct nvbios *bios)
+ {
+ struct pci_dev *pdev = bios->dev->pdev;
+- int cnt = 65536 / ROM_BIOS_PAGE;
+- int ret;
++ int ret, cnt, i;
++ u8 data[3];
+
+ if (!nouveau_acpi_rom_supported(pdev))
+ return;
+
+- bios->data = kmalloc(cnt * ROM_BIOS_PAGE, GFP_KERNEL);
+- if (!bios->data)
+- return;
+-
+ bios->length = 0;
+- while (cnt--) {
+- ret = nouveau_acpi_get_bios_chunk(bios->data, bios->length,
+- ROM_BIOS_PAGE);
+- if (ret != ROM_BIOS_PAGE)
+- return;
++ if (nouveau_acpi_get_bios_chunk(data, 0, 3) == 3)
++ bios->length = data[2] * 512;
+
+- bios->length += ROM_BIOS_PAGE;
++ bios->data = kmalloc(bios->length, GFP_KERNEL);
++ for (i = 0; bios->data && i < bios->length; i += cnt) {
++ cnt = min((bios->length - i), (u32)4096);
++ ret = nouveau_acpi_get_bios_chunk(bios->data, i, cnt);
++ if (ret != cnt)
++ break;
+ }
+ }
+
--- /dev/null
+From 082918471139b07964967cfe5f70230909c82ae1 Mon Sep 17 00:00:00 2001
+From: Egbert Eich <eich@suse.de>
+Date: Mon, 15 Oct 2012 08:21:39 +0200
+Subject: drm/radeon: Don't destroy I2C Bus Rec in radeon_ext_tmds_enc_destroy().
+
+From: Egbert Eich <eich@suse.de>
+
+commit 082918471139b07964967cfe5f70230909c82ae1 upstream.
+
+radeon_i2c_fini() walks thru the list of I2C bus recs rdev->i2c_bus[]
+to destroy each of them.
+radeon_ext_tmds_enc_destroy() however also has code to destroy it's
+associated I2C bus rec which has been obtained by radeon_i2c_lookup()
+and is therefore also in the i2c_bus[] list.
+This causes a double free resulting in a kernel panic when unloading
+the radeon driver.
+Removing destroy code from radeon_ext_tmds_enc_destroy() fixes this
+problem.
+
+agd5f: fix compiler warning
+
+Signed-off-by: Egbert Eich <eich@suse.de>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_legacy_encoders.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
++++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+@@ -974,11 +974,7 @@ static void radeon_legacy_tmds_ext_mode_
+ static void radeon_ext_tmds_enc_destroy(struct drm_encoder *encoder)
+ {
+ struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+- struct radeon_encoder_ext_tmds *tmds = radeon_encoder->enc_priv;
+- if (tmds) {
+- if (tmds->i2c_bus)
+- radeon_i2c_destroy(tmds->i2c_bus);
+- }
++ /* don't destroy the i2c bus record here, this will be done in radeon_i2c_fini */
+ kfree(radeon_encoder->enc_priv);
+ drm_encoder_cleanup(encoder);
+ kfree(radeon_encoder);
add-cdc-acm-support-for-the-cx93010-2x-ucmxx-usb-modem.patch
fs-handle-failed-audit_log_start-properly.patch
fs-prevent-use-after-free-in-auditing-when-symlink-following-was-denied.patch
+drm-radeon-don-t-destroy-i2c-bus-rec-in-radeon_ext_tmds_enc_destroy.patch
+drm-i915-remove-useless-bug_on-which-caused-a-regression-in-3.5.patch
+drm-i915-set-guardband-clipping-workaround-bit-in-the-right-register.patch
+drm-nouveau-bios-fix-shadowing-of-acpi-roms-larger-than-64kib.patch
+drm-i915-use-adjusted_mode-instead-of-mode-for-checking-the-6bpc-force-flag.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
