--- /dev/null
+From 671796dd96b6cd85b75fba9d3007bcf7e5f7c309 Mon Sep 17 00:00:00 2001
+From: Ronald Wahl <ronald.wahl@raritan.com>
+Date: Thu, 7 Aug 2014 14:15:50 +0200
+Subject: carl9170: fix sending URBs with wrong type when using full-speed
+
+From: Ronald Wahl <ronald.wahl@raritan.com>
+
+commit 671796dd96b6cd85b75fba9d3007bcf7e5f7c309 upstream.
+
+The driver assumes that endpoint 4 is always an interrupt endpoint.
+Unfortunately the type differs between high-speed and full-speed
+configurations while in the former case it is indeed an interrupt
+endpoint this is not true for the latter case - here it is a bulk
+endpoint. When sending URBs with the wrong type the kernel will
+generate a warning message including backtrace. In this specific
+case there will be a huge amount of warnings which can bring the system
+to freeze.
+
+To fix this we are now sending URBs to endpoint 4 using the type
+found in the endpoint descriptor.
+
+A side note: The carl9170 firmware currently specifies endpoint 4 as
+interrupt endpoint even in the full-speed configuration but this has
+no relevance because before this firmware is loaded the endpoint type
+is as described above and after the firmware is running the stick is not
+reenumerated and so the old descriptor is used.
+
+Signed-off-by: Ronald Wahl <ronald.wahl@raritan.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/carl9170/carl9170.h | 1
+ drivers/net/wireless/ath/carl9170/usb.c | 31 +++++++++++++++++++++++----
+ 2 files changed, 28 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/carl9170/carl9170.h
++++ b/drivers/net/wireless/ath/carl9170/carl9170.h
+@@ -256,6 +256,7 @@ struct ar9170 {
+ atomic_t rx_work_urbs;
+ atomic_t rx_pool_urbs;
+ kernel_ulong_t features;
++ bool usb_ep_cmd_is_bulk;
+
+ /* firmware settings */
+ struct completion fw_load_wait;
+--- a/drivers/net/wireless/ath/carl9170/usb.c
++++ b/drivers/net/wireless/ath/carl9170/usb.c
+@@ -621,9 +621,16 @@ int __carl9170_exec_cmd(struct ar9170 *a
+ goto err_free;
+ }
+
+- usb_fill_int_urb(urb, ar->udev, usb_sndintpipe(ar->udev,
+- AR9170_USB_EP_CMD), cmd, cmd->hdr.len + 4,
+- carl9170_usb_cmd_complete, ar, 1);
++ if (ar->usb_ep_cmd_is_bulk)
++ usb_fill_bulk_urb(urb, ar->udev,
++ usb_sndbulkpipe(ar->udev, AR9170_USB_EP_CMD),
++ cmd, cmd->hdr.len + 4,
++ carl9170_usb_cmd_complete, ar);
++ else
++ usb_fill_int_urb(urb, ar->udev,
++ usb_sndintpipe(ar->udev, AR9170_USB_EP_CMD),
++ cmd, cmd->hdr.len + 4,
++ carl9170_usb_cmd_complete, ar, 1);
+
+ if (free_buf)
+ urb->transfer_flags |= URB_FREE_BUFFER;
+@@ -1032,9 +1039,10 @@ static void carl9170_usb_firmware_step2(
+ static int carl9170_usb_probe(struct usb_interface *intf,
+ const struct usb_device_id *id)
+ {
++ struct usb_endpoint_descriptor *ep;
+ struct ar9170 *ar;
+ struct usb_device *udev;
+- int err;
++ int i, err;
+
+ err = usb_reset_device(interface_to_usbdev(intf));
+ if (err)
+@@ -1050,6 +1058,21 @@ static int carl9170_usb_probe(struct usb
+ ar->intf = intf;
+ ar->features = id->driver_info;
+
++ /* We need to remember the type of endpoint 4 because it differs
++ * between high- and full-speed configuration. The high-speed
++ * configuration specifies it as interrupt and the full-speed
++ * configuration as bulk endpoint. This information is required
++ * later when sending urbs to that endpoint.
++ */
++ for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; ++i) {
++ ep = &intf->cur_altsetting->endpoint[i].desc;
++
++ if (usb_endpoint_num(ep) == AR9170_USB_EP_CMD &&
++ usb_endpoint_dir_out(ep) &&
++ usb_endpoint_type(ep) == USB_ENDPOINT_XFER_BULK)
++ ar->usb_ep_cmd_is_bulk = true;
++ }
++
+ usb_set_intfdata(intf, ar);
+ SET_IEEE80211_DEV(ar->hw, &intf->dev);
+
--- /dev/null
+From e9f274b2a1bd4ecc569b823b1e7942e9bf92593e Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Thu, 31 Jul 2014 17:57:42 -0400
+Subject: drm/radeon/atom: add new voltage fetch function for hawaii
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit e9f274b2a1bd4ecc569b823b1e7942e9bf92593e upstream.
+
+Some hawaii boards use a different method for fetching the
+voltage information from the vbios.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon.h | 3 ++
+ drivers/gpu/drm/radeon/radeon_atombios.c | 35 +++++++++++++++++++++++++++++++
+ 2 files changed, 38 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon.h
++++ b/drivers/gpu/drm/radeon/radeon.h
+@@ -294,6 +294,9 @@ int radeon_atom_get_leakage_vddc_based_o
+ u16 *vddc, u16 *vddci,
+ u16 virtual_voltage_id,
+ u16 vbios_voltage_id);
++int radeon_atom_get_voltage_evv(struct radeon_device *rdev,
++ u16 virtual_voltage_id,
++ u16 *voltage);
+ int radeon_atom_round_to_true_voltage(struct radeon_device *rdev,
+ u8 voltage_type,
+ u16 nominal_voltage,
+--- a/drivers/gpu/drm/radeon/radeon_atombios.c
++++ b/drivers/gpu/drm/radeon/radeon_atombios.c
+@@ -3228,6 +3228,41 @@ int radeon_atom_get_leakage_vddc_based_o
+ return 0;
+ }
+
++union get_voltage_info {
++ struct _GET_VOLTAGE_INFO_INPUT_PARAMETER_V1_2 in;
++ struct _GET_EVV_VOLTAGE_INFO_OUTPUT_PARAMETER_V1_2 evv_out;
++};
++
++int radeon_atom_get_voltage_evv(struct radeon_device *rdev,
++ u16 virtual_voltage_id,
++ u16 *voltage)
++{
++ int index = GetIndexIntoMasterTable(COMMAND, GetVoltageInfo);
++ u32 entry_id;
++ u32 count = rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.count;
++ union get_voltage_info args;
++
++ for (entry_id = 0; entry_id < count; entry_id++) {
++ if (rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries[entry_id].v ==
++ virtual_voltage_id)
++ break;
++ }
++
++ if (entry_id >= count)
++ return -EINVAL;
++
++ args.in.ucVoltageType = VOLTAGE_TYPE_VDDC;
++ args.in.ucVoltageMode = ATOM_GET_VOLTAGE_EVV_VOLTAGE;
++ args.in.ulSCLKFreq =
++ cpu_to_le32(rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries[entry_id].clk);
++
++ atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
++
++ *voltage = le16_to_cpu(args.evv_out.usVoltageLevel);
++
++ return 0;
++}
++
+ int radeon_atom_get_voltage_gpio_settings(struct radeon_device *rdev,
+ u16 voltage_level, u8 voltage_type,
+ u32 *gpio_value, u32 *gpio_mask)
--- /dev/null
+From 6b57f20cb5b708415fbab63847f8f8429b051af8 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Thu, 31 Jul 2014 18:07:17 -0400
+Subject: drm/radeon/dpm: handle voltage info fetching on hawaii
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 6b57f20cb5b708415fbab63847f8f8429b051af8 upstream.
+
+Some hawaii cards use a different method to fetch the
+voltage info from the vbios.
+
+bug:
+https://bugs.freedesktop.org/show_bug.cgi?id=74250
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/ci_dpm.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/ci_dpm.c
++++ b/drivers/gpu/drm/radeon/ci_dpm.c
+@@ -922,7 +922,18 @@ static void ci_get_leakage_voltages(stru
+ pi->vddc_leakage.count = 0;
+ pi->vddci_leakage.count = 0;
+
+- if (radeon_atom_get_leakage_id_from_vbios(rdev, &leakage_id) == 0) {
++ if (rdev->pm.dpm.platform_caps & ATOM_PP_PLATFORM_CAP_EVV) {
++ for (i = 0; i < CISLANDS_MAX_LEAKAGE_COUNT; i++) {
++ virtual_voltage_id = ATOM_VIRTUAL_VOLTAGE_ID0 + i;
++ if (radeon_atom_get_voltage_evv(rdev, virtual_voltage_id, &vddc) != 0)
++ continue;
++ if (vddc != 0 && vddc != virtual_voltage_id) {
++ pi->vddc_leakage.actual_voltage[pi->vddc_leakage.count] = vddc;
++ pi->vddc_leakage.leakage_id[pi->vddc_leakage.count] = virtual_voltage_id;
++ pi->vddc_leakage.count++;
++ }
++ }
++ } else if (radeon_atom_get_leakage_id_from_vbios(rdev, &leakage_id) == 0) {
+ for (i = 0; i < CISLANDS_MAX_LEAKAGE_COUNT; i++) {
+ virtual_voltage_id = ATOM_VIRTUAL_VOLTAGE_ID0 + i;
+ if (radeon_atom_get_leakage_vddc_based_on_leakage_params(rdev, &vddc, &vddci,
--- /dev/null
+From 5dc355325b648dc9b4cf3bea4d968de46fd59215 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Sun, 27 Jul 2014 23:21:50 -0400
+Subject: drm/radeon: load the lm63 driver for an lm64 thermal chip.
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 5dc355325b648dc9b4cf3bea4d968de46fd59215 upstream.
+
+Looks like the lm63 driver supports the lm64 as well.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_atombios.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_atombios.c
++++ b/drivers/gpu/drm/radeon/radeon_atombios.c
+@@ -1955,7 +1955,7 @@ static const char *thermal_controller_na
+ "adm1032",
+ "adm1030",
+ "max6649",
+- "lm64",
++ "lm63", /* lm64 */
+ "f75375",
+ "asc7xxx",
+ };
+@@ -1966,7 +1966,7 @@ static const char *pp_lib_thermal_contro
+ "adm1032",
+ "adm1030",
+ "max6649",
+- "lm64",
++ "lm63", /* lm64 */
+ "f75375",
+ "RV6xx",
+ "RV770",
--- /dev/null
+From c08abf11900e19b14dd3a0cc3d105bd74519cd18 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 14 Jul 2014 12:01:40 -0400
+Subject: drm/radeon: re-enable dpm by default on BTC
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit c08abf11900e19b14dd3a0cc3d105bd74519cd18 upstream.
+
+This patch depends on:
+e07929810f0a19ddd756558290c7d72827cbfcd9
+(drm/radeon/dpm: fix typo in vddci setup for eg/btc)
+
+bugs:
+https://bugs.freedesktop.org/show_bug.cgi?id=73053
+https://bugzilla.kernel.org/show_bug.cgi?id=68571
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_pm.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_pm.c
++++ b/drivers/gpu/drm/radeon/radeon_pm.c
+@@ -1276,9 +1276,6 @@ int radeon_pm_init(struct radeon_device
+ case CHIP_RS780:
+ case CHIP_RS880:
+ case CHIP_RV770:
+- case CHIP_BARTS:
+- case CHIP_TURKS:
+- case CHIP_CAICOS:
+ /* DPM requires the RLC, RV770+ dGPU requires SMC */
+ if (!rdev->rlc_fw)
+ rdev->pm.pm_method = PM_METHOD_PROFILE;
+@@ -1302,6 +1299,9 @@ int radeon_pm_init(struct radeon_device
+ case CHIP_PALM:
+ case CHIP_SUMO:
+ case CHIP_SUMO2:
++ case CHIP_BARTS:
++ case CHIP_TURKS:
++ case CHIP_CAICOS:
+ case CHIP_CAYMAN:
+ case CHIP_ARUBA:
+ case CHIP_TAHITI:
--- /dev/null
+From 8f500af4efe347d1a8ac674d115220e8caa84559 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 7 Jul 2014 17:13:37 -0400
+Subject: drm/radeon: re-enable dpm by default on cayman
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 8f500af4efe347d1a8ac674d115220e8caa84559 upstream.
+
+This patch depends on:
+b0880e87c1fd038b84498944f52e52c3e86ebe59
+(drm/radeon/dpm: fix vddci setup typo on cayman)
+
+bug:
+https://bugs.freedesktop.org/show_bug.cgi?id=69723
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_pm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_pm.c
++++ b/drivers/gpu/drm/radeon/radeon_pm.c
+@@ -1279,7 +1279,6 @@ int radeon_pm_init(struct radeon_device
+ case CHIP_BARTS:
+ case CHIP_TURKS:
+ case CHIP_CAICOS:
+- case CHIP_CAYMAN:
+ /* DPM requires the RLC, RV770+ dGPU requires SMC */
+ if (!rdev->rlc_fw)
+ rdev->pm.pm_method = PM_METHOD_PROFILE;
+@@ -1303,6 +1302,7 @@ int radeon_pm_init(struct radeon_device
+ case CHIP_PALM:
+ case CHIP_SUMO:
+ case CHIP_SUMO2:
++ case CHIP_CAYMAN:
+ case CHIP_ARUBA:
+ case CHIP_TAHITI:
+ case CHIP_PITCAIRN:
--- /dev/null
+From f1d2a26b506e9dc7bbe94fae40da0a0d8dcfacd0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+Date: Wed, 30 Jul 2014 17:18:12 +0200
+Subject: drm/radeon: set VM base addr using the PFP v2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+
+commit f1d2a26b506e9dc7bbe94fae40da0a0d8dcfacd0 upstream.
+
+Seems to make VM flushes more stable on SI and CIK.
+
+v2: only use the PFP on the GFX ring on CIK
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/cik.c | 5 +++--
+ drivers/gpu/drm/radeon/si.c | 2 +-
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -5545,12 +5545,13 @@ static void cik_vm_decode_fault(struct r
+ void cik_vm_flush(struct radeon_device *rdev, int ridx, struct radeon_vm *vm)
+ {
+ struct radeon_ring *ring = &rdev->ring[ridx];
++ int usepfp = (ridx == RADEON_RING_TYPE_GFX_INDEX);
+
+ if (vm == NULL)
+ return;
+
+ radeon_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
+- radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) |
++ radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(usepfp) |
+ WRITE_DATA_DST_SEL(0)));
+ if (vm->id < 8) {
+ radeon_ring_write(ring,
+@@ -5600,7 +5601,7 @@ void cik_vm_flush(struct radeon_device *
+ radeon_ring_write(ring, 1 << vm->id);
+
+ /* compute doesn't have PFP */
+- if (ridx == RADEON_RING_TYPE_GFX_INDEX) {
++ if (usepfp) {
+ /* sync PFP to ME, otherwise we might get invalid PFP reads */
+ radeon_ring_write(ring, PACKET3(PACKET3_PFP_SYNC_ME, 0));
+ radeon_ring_write(ring, 0x0);
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -4810,7 +4810,7 @@ void si_vm_flush(struct radeon_device *r
+
+ /* write new base address */
+ radeon_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
+- radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) |
++ radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(1) |
+ WRITE_DATA_DST_SEL(0)));
+
+ if (vm->id < 8) {
--- /dev/null
+From 3c64bd26f7e9bd589ebe0d1ebec69ef2f784c12d Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 1 Aug 2014 20:05:30 +0200
+Subject: drm/radeon: tweak ACCEL_WORKING2 query for hawaii
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 3c64bd26f7e9bd589ebe0d1ebec69ef2f784c12d upstream.
+
+Return 2 so we can be sure the kernel has the necessary
+changes for acceleration to work.
+
+Note: This patch depends on these two commits:
+ - drm/radeon: fix cut and paste issue for hawaii.
+ - drm/radeon: use packet2 for nop on hawaii with old firmware
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Andreas Boll <andreas.boll.dev@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_kms.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_kms.c
+@@ -254,7 +254,14 @@ static int radeon_info_ioctl(struct drm_
+ }
+ break;
+ case RADEON_INFO_ACCEL_WORKING2:
+- *value = rdev->accel_working;
++ if (rdev->family == CHIP_HAWAII) {
++ if (rdev->accel_working)
++ *value = 2;
++ else
++ *value = 0;
++ } else {
++ *value = rdev->accel_working;
++ }
+ break;
+ case RADEON_INFO_TILING_CONFIG:
+ if (rdev->family >= CHIP_BONAIRE)
--- /dev/null
+From c9a3ad25eddfdb898114a9d73cdb4c3472d9dfca Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= <guido@vanguardiasur.com.ar>
+Date: Tue, 17 Jun 2014 11:17:09 -0300
+Subject: drm/tilcdc: fix double kfree
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= <guido@vanguardiasur.com.ar>
+
+commit c9a3ad25eddfdb898114a9d73cdb4c3472d9dfca upstream.
+
+display_timings_release calls kfree on the display_timings object passed
+to it. Calling kfree after it is wrong. SLUB debug showed the following
+warning:
+
+ =============================================================================
+ BUG kmalloc-64 (Tainted: G W ): Object already free
+ -----------------------------------------------------------------------------
+
+ Disabling lock debugging due to kernel taint
+ INFO: Allocated in of_get_display_timings+0x2c/0x214 age=601 cpu=0
+ pid=884
+ __slab_alloc.constprop.79+0x2e0/0x33c
+ kmem_cache_alloc+0xac/0xdc
+ of_get_display_timings+0x2c/0x214
+ panel_probe+0x7c/0x314 [tilcdc]
+ platform_drv_probe+0x18/0x48
+ [..snip..]
+ INFO: Freed in panel_destroy+0x18/0x3c [tilcdc] age=0 cpu=0 pid=907
+ __slab_free+0x34/0x330
+ panel_destroy+0x18/0x3c [tilcdc]
+ tilcdc_unload+0xd0/0x118 [tilcdc]
+ drm_dev_unregister+0x24/0x98
+ [..snip..]
+
+Signed-off-by: Guido Martínez <guido@vanguardiasur.com.ar>
+Tested-by: Darren Etheridge <detheridge@ti.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/tilcdc/tilcdc_panel.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/tilcdc/tilcdc_panel.c
++++ b/drivers/gpu/drm/tilcdc/tilcdc_panel.c
+@@ -286,10 +286,8 @@ static void panel_destroy(struct tilcdc_
+ {
+ struct panel_module *panel_mod = to_panel_module(mod);
+
+- if (panel_mod->timings) {
++ if (panel_mod->timings)
+ display_timings_release(panel_mod->timings);
+- kfree(panel_mod->timings);
+- }
+
+ tilcdc_module_cleanup(mod);
+ kfree(panel_mod->info);
--- /dev/null
+From eb565a2bbadc6a5030a6dbe58db1aa52453e7edf Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= <guido@vanguardiasur.com.ar>
+Date: Tue, 17 Jun 2014 11:17:08 -0300
+Subject: drm/tilcdc: fix release order on exit
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= <guido@vanguardiasur.com.ar>
+
+commit eb565a2bbadc6a5030a6dbe58db1aa52453e7edf upstream.
+
+Unregister resources in the correct order on tilcdc_drm_fini, which is
+the reverse order they were registered during tilcdc_drm_init.
+
+This also means unregistering the driver before releasing its resources.
+
+Signed-off-by: Guido Martínez <guido@vanguardiasur.com.ar>
+Tested-by: Darren Etheridge <detheridge@ti.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/tilcdc/tilcdc_drv.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c
++++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c
+@@ -629,10 +629,10 @@ static int __init tilcdc_drm_init(void)
+ static void __exit tilcdc_drm_fini(void)
+ {
+ DBG("fini");
+- tilcdc_tfp410_fini();
+- tilcdc_slave_fini();
+- tilcdc_panel_fini();
+ platform_driver_unregister(&tilcdc_platform_driver);
++ tilcdc_panel_fini();
++ tilcdc_slave_fini();
++ tilcdc_tfp410_fini();
+ }
+
+ late_initcall(tilcdc_drm_init);
--- /dev/null
+From e396900e649b0af31161634d87fe37076f46c12b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= <guido@vanguardiasur.com.ar>
+Date: Tue, 17 Jun 2014 11:17:04 -0300
+Subject: drm/tilcdc: panel: fix dangling sysfs connector node
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= <guido@vanguardiasur.com.ar>
+
+commit e396900e649b0af31161634d87fe37076f46c12b upstream.
+
+Add a drm_sysfs_connector_remove call when we destroy the panel to make
+sure the connector node in sysfs gets deleted.
+
+This is required for proper unload and re-load of this driver as a
+module. Without this, we would get a warning at re-load time like so:
+
+ ------------[ cut here ]------------
+ WARNING: CPU: 0 PID: 824 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x54/0x74()
+ sysfs: cannot create duplicate filename '/class/drm/card0-LVDS-1'
+ Modules linked in: [...]
+ CPU: 0 PID: 824 Comm: modprobe Not tainted 3.15.0-rc4-00027-g6484f96-dirty #81
+ [<c0013bb8>] (unwind_backtrace) from [<c0011824>] (show_stack+0x10/0x14)
+ [<c0011824>] (show_stack) from [<c0034e8c>] (warn_slowpath_common+0x68/0x88)
+ [<c0034e8c>] (warn_slowpath_common) from [<c0034edc>] (warn_slowpath_fmt+0x30/0x40)
+ [<c0034edc>] (warn_slowpath_fmt) from [<c01243f4>] (sysfs_warn_dup+0x54/0x74)
+ [<c01243f4>] (sysfs_warn_dup) from [<c0124708>] (sysfs_do_create_link_sd.isra.2+0xb0/0xb8)
+ [<c0124708>] (sysfs_do_create_link_sd.isra.2) from [<c02ae37c>] (device_add+0x338/0x520)
+ [<c02ae37c>] (device_add) from [<c02ae6e8>] (device_create_groups_vargs+0xa0/0xc4)
+ [<c02ae6e8>] (device_create_groups_vargs) from [<c02ae758>] (device_create+0x24/0x2c)
+ [<c02ae758>] (device_create) from [<c029b4ec>] (drm_sysfs_connector_add+0x64/0x204)
+ [<c029b4ec>] (drm_sysfs_connector_add) from [<bf0b1fec>] (panel_modeset_init+0xb8/0x134 [tilcdc])
+ [<bf0b1fec>] (panel_modeset_init [tilcdc]) from [<bf0b2bf0>] (tilcdc_load+0x214/0x4c0 [tilcdc])
+ [<bf0b2bf0>] (tilcdc_load [tilcdc]) from [<c029955c>] (drm_dev_register+0xa4/0x104)
+ [ .. snip .. ]
+ ---[ end trace b2d09cd9578b0497 ]---
+ [drm:drm_sysfs_connector_add] *ERROR* failed to register connector device: -17
+
+Signed-off-by: Guido Martínez <guido@vanguardiasur.com.ar>
+Tested-by: Darren Etheridge <detheridge@ti.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/tilcdc/tilcdc_panel.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/tilcdc/tilcdc_panel.c
++++ b/drivers/gpu/drm/tilcdc/tilcdc_panel.c
+@@ -151,6 +151,7 @@ struct panel_connector {
+ static void panel_connector_destroy(struct drm_connector *connector)
+ {
+ struct panel_connector *panel_connector = to_panel_connector(connector);
++ drm_sysfs_connector_remove(connector);
+ drm_connector_cleanup(connector);
+ kfree(panel_connector);
+ }
--- /dev/null
+From 3a49012224ca9016658a831a327ff6a7fe5bb4f9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= <guido@vanguardiasur.com.ar>
+Date: Tue, 17 Jun 2014 11:17:07 -0300
+Subject: drm/tilcdc: panel: fix leak when unloading the module
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= <guido@vanguardiasur.com.ar>
+
+commit 3a49012224ca9016658a831a327ff6a7fe5bb4f9 upstream.
+
+The driver did not unregister the allocated framebuffer, which caused
+memory leaks (and memory manager WARNs) when unloading. Also, the
+framebuffer device under /dev still existed after unloading.
+
+Add a call to drm_fbdev_cma_fini when unloading the module to prevent
+both issues.
+
+Signed-off-by: Guido Martínez <guido@vanguardiasur.com.ar>
+Tested-by: Darren Etheridge <detheridge@ti.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/tilcdc/tilcdc_drv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c
++++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c
+@@ -122,6 +122,7 @@ static int tilcdc_unload(struct drm_devi
+ struct tilcdc_drm_private *priv = dev->dev_private;
+ struct tilcdc_module *mod, *cur;
+
++ drm_fbdev_cma_fini(priv->fbdev);
+ drm_kms_helper_poll_fini(dev);
+ drm_mode_config_cleanup(dev);
+ drm_vblank_cleanup(dev);
--- /dev/null
+From daa15b4cd1eee58eb1322062a3320b1dbe5dc96e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= <guido@vanguardiasur.com.ar>
+Date: Tue, 17 Jun 2014 11:17:05 -0300
+Subject: drm/tilcdc: slave: fix dangling sysfs connector node
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= <guido@vanguardiasur.com.ar>
+
+commit daa15b4cd1eee58eb1322062a3320b1dbe5dc96e upstream.
+
+Add a drm_sysfs_connector_remove call when we destroy the panel to make
+sure the connector node in sysfs gets deleted.
+
+This is required for proper unload and re-load of this driver as a
+module. Without this, we would get a warning at re-load time like so:
+
+ tda998x 0-0070: found TDA19988
+ ------------[ cut here ]------------
+ WARNING: CPU: 0 PID: 825 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x54/0x74()
+ sysfs: cannot create duplicate filename '/class/drm/card0-HDMI-A-1'
+ Modules linked in: [..]
+ CPU: 0 PID: 825 Comm: modprobe Not tainted 3.15.0-rc4-00027-g9dcdef4 #82
+ [<c0013bb8>] (unwind_backtrace) from [<c0011824>] (show_stack+0x10/0x14)
+ [<c0011824>] (show_stack) from [<c0034e8c>] (warn_slowpath_common+0x68/0x88)
+ [<c0034e8c>] (warn_slowpath_common) from [<c0034edc>] (warn_slowpath_fmt+0x30/0x40)
+ [<c0034edc>] (warn_slowpath_fmt) from [<c01243f4>] (sysfs_warn_dup+0x54/0x74)
+ [<c01243f4>] (sysfs_warn_dup) from [<c0124708>] (sysfs_do_create_link_sd.isra.2+0xb0/0xb8)
+ [<c0124708>] (sysfs_do_create_link_sd.isra.2) from [<c02ae37c>] (device_add+0x338/0x520)
+ [<c02ae37c>] (device_add) from [<c02ae6e8>] (device_create_groups_vargs+0xa0/0xc4)
+ [<c02ae6e8>] (device_create_groups_vargs) from [<c02ae758>] (device_create+0x24/0x2c)
+ [<c02ae758>] (device_create) from [<c029b4ec>] (drm_sysfs_connector_add+0x64/0x204)
+ [<c029b4ec>] (drm_sysfs_connector_add) from [<bf0b1b40>] (slave_modeset_init+0x120/0x1bc [tilcdc])
+ [<bf0b1b40>] (slave_modeset_init [tilcdc]) from [<bf0b2be8>] (tilcdc_load+0x214/0x4c0 [tilcdc])
+ [<bf0b2be8>] (tilcdc_load [tilcdc]) from [<c029955c>] (drm_dev_register+0xa4/0x104)
+ [..snip..]
+ ---[ end trace 4df8d614936ebdee ]---
+ [drm:drm_sysfs_connector_add] *ERROR* failed to register connector device: -17
+
+Signed-off-by: Guido Martínez <guido@vanguardiasur.com.ar>
+Tested-by: Darren Etheridge <detheridge@ti.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/tilcdc/tilcdc_slave.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/tilcdc/tilcdc_slave.c
++++ b/drivers/gpu/drm/tilcdc/tilcdc_slave.c
+@@ -166,6 +166,7 @@ struct slave_connector {
+ static void slave_connector_destroy(struct drm_connector *connector)
+ {
+ struct slave_connector *slave_connector = to_slave_connector(connector);
++ drm_sysfs_connector_remove(connector);
+ drm_connector_cleanup(connector);
+ kfree(slave_connector);
+ }
--- /dev/null
+From 16dcbdef404f4e87dab985494381939fe0a2d456 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= <guido@vanguardiasur.com.ar>
+Date: Tue, 17 Jun 2014 11:17:06 -0300
+Subject: drm/tilcdc: tfp410: fix dangling sysfs connector node
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= <guido@vanguardiasur.com.ar>
+
+commit 16dcbdef404f4e87dab985494381939fe0a2d456 upstream.
+
+Add a drm_sysfs_connector_remove call when we destroy the panel to make
+sure the connector node in sysfs gets deleted.
+
+This is required for proper unload and re-load of this driver, otherwise
+we will get a warning about a duplicate filename in sysfs.
+
+Signed-off-by: Guido Martínez <guido@vanguardiasur.com.ar>
+Tested-by: Darren Etheridge <detheridge@ti.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/tilcdc/tilcdc_tfp410.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/tilcdc/tilcdc_tfp410.c
++++ b/drivers/gpu/drm/tilcdc/tilcdc_tfp410.c
+@@ -167,6 +167,7 @@ struct tfp410_connector {
+ static void tfp410_connector_destroy(struct drm_connector *connector)
+ {
+ struct tfp410_connector *tfp410_connector = to_tfp410_connector(connector);
++ drm_sysfs_connector_remove(connector);
+ drm_connector_cleanup(connector);
+ kfree(tfp410_connector);
+ }
--- /dev/null
+From 46c2df68f03a236b30808bba361f10900c88d95e Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Date: Sun, 3 Aug 2014 20:00:40 +0900
+Subject: drm/ttm: Choose a pool to shrink correctly in ttm_dma_pool_shrink_scan().
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+commit 46c2df68f03a236b30808bba361f10900c88d95e upstream.
+
+We can use "unsigned int" instead of "atomic_t" by updating start_pool
+variable under _manager->lock. This patch will make it possible to avoid
+skipping when choosing a pool to shrink in round-robin style, after next
+patch changes mutex_lock(_manager->lock) to !mutex_trylock(_manager->lork).
+
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
++++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
+@@ -1004,9 +1004,9 @@ EXPORT_SYMBOL_GPL(ttm_dma_unpopulate);
+ static unsigned long
+ ttm_dma_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
+ {
+- static atomic_t start_pool = ATOMIC_INIT(0);
++ static unsigned start_pool;
+ unsigned idx = 0;
+- unsigned pool_offset = atomic_add_return(1, &start_pool);
++ unsigned pool_offset;
+ unsigned shrink_pages = sc->nr_to_scan;
+ struct device_pools *p;
+ unsigned long freed = 0;
+@@ -1017,7 +1017,7 @@ ttm_dma_pool_shrink_scan(struct shrinker
+ mutex_lock(&_manager->lock);
+ if (!_manager->npools)
+ goto out;
+- pool_offset = pool_offset % _manager->npools;
++ pool_offset = ++start_pool % _manager->npools;
+ list_for_each_entry(p, &_manager->pools, pools) {
+ unsigned nr_free;
+
--- /dev/null
+From 11e504cc705e8ccb06ac93a276e11b5e8fee4d40 Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Date: Sun, 3 Aug 2014 19:59:35 +0900
+Subject: drm/ttm: Fix possible division by 0 in ttm_dma_pool_shrink_scan().
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+commit 11e504cc705e8ccb06ac93a276e11b5e8fee4d40 upstream.
+
+list_empty(&_manager->pools) being false before taking _manager->lock
+does not guarantee that _manager->npools != 0 after taking _manager->lock
+because _manager->npools is updated under _manager->lock.
+
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
++++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
+@@ -1015,6 +1015,8 @@ ttm_dma_pool_shrink_scan(struct shrinker
+ return SHRINK_STOP;
+
+ mutex_lock(&_manager->lock);
++ if (!_manager->npools)
++ goto out;
+ pool_offset = pool_offset % _manager->npools;
+ list_for_each_entry(p, &_manager->pools, pools) {
+ unsigned nr_free;
+@@ -1034,6 +1036,7 @@ ttm_dma_pool_shrink_scan(struct shrinker
+ p->pool->dev_name, p->pool->name, current->pid,
+ nr_free, shrink_pages);
+ }
++out:
+ mutex_unlock(&_manager->lock);
+ return freed;
+ }
--- /dev/null
+From 71336e011d1d2312bcbcaa8fcec7365024f3a95d Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Date: Sun, 3 Aug 2014 20:02:03 +0900
+Subject: drm/ttm: Fix possible stack overflow by recursive shrinker calls.
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+commit 71336e011d1d2312bcbcaa8fcec7365024f3a95d upstream.
+
+While ttm_dma_pool_shrink_scan() tries to take mutex before doing GFP_KERNEL
+allocation, ttm_pool_shrink_scan() does not do it. This can result in stack
+overflow if kmalloc() in ttm_page_pool_free() triggered recursion due to
+memory pressure.
+
+ shrink_slab()
+ => ttm_pool_shrink_scan()
+ => ttm_page_pool_free()
+ => kmalloc(GFP_KERNEL)
+ => shrink_slab()
+ => ttm_pool_shrink_scan()
+ => ttm_page_pool_free()
+ => kmalloc(GFP_KERNEL)
+
+Change ttm_pool_shrink_scan() to do like ttm_dma_pool_shrink_scan() does.
+
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/ttm/ttm_page_alloc.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
++++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
+@@ -391,14 +391,17 @@ out:
+ static unsigned long
+ ttm_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
+ {
+- static atomic_t start_pool = ATOMIC_INIT(0);
++ static DEFINE_MUTEX(lock);
++ static unsigned start_pool;
+ unsigned i;
+- unsigned pool_offset = atomic_add_return(1, &start_pool);
++ unsigned pool_offset;
+ struct ttm_page_pool *pool;
+ int shrink_pages = sc->nr_to_scan;
+ unsigned long freed = 0;
+
+- pool_offset = pool_offset % NUM_POOLS;
++ if (!mutex_trylock(&lock))
++ return SHRINK_STOP;
++ pool_offset = ++start_pool % NUM_POOLS;
+ /* select start pool in round robin fashion */
+ for (i = 0; i < NUM_POOLS; ++i) {
+ unsigned nr_free = shrink_pages;
+@@ -408,6 +411,7 @@ ttm_pool_shrink_scan(struct shrinker *sh
+ shrink_pages = ttm_page_pool_free(pool, nr_free);
+ freed += nr_free - shrink_pages;
+ }
++ mutex_unlock(&lock);
+ return freed;
+ }
+
--- /dev/null
+From a91576d7916f6cce76d30303e60e1ac47cf4a76d Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Date: Sun, 3 Aug 2014 20:02:31 +0900
+Subject: drm/ttm: Pass GFP flags in order to avoid deadlock.
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+commit a91576d7916f6cce76d30303e60e1ac47cf4a76d upstream.
+
+Commit 7dc19d5a "drivers: convert shrinkers to new count/scan API" added
+deadlock warnings that ttm_page_pool_free() and ttm_dma_page_pool_free()
+are currently doing GFP_KERNEL allocation.
+
+But these functions did not get updated to receive gfp_t argument.
+This patch explicitly passes sc->gfp_mask or GFP_KERNEL to these functions,
+and removes the deadlock warning.
+
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/ttm/ttm_page_alloc.c | 19 ++++++++++---------
+ drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 19 +++++++++----------
+ 2 files changed, 19 insertions(+), 19 deletions(-)
+
+--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
++++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
+@@ -297,8 +297,10 @@ static void ttm_pool_update_free_locked(
+ *
+ * @pool: to free the pages from
+ * @free_all: If set to true will free all pages in pool
++ * @gfp: GFP flags.
+ **/
+-static int ttm_page_pool_free(struct ttm_page_pool *pool, unsigned nr_free)
++static int ttm_page_pool_free(struct ttm_page_pool *pool, unsigned nr_free,
++ gfp_t gfp)
+ {
+ unsigned long irq_flags;
+ struct page *p;
+@@ -309,8 +311,7 @@ static int ttm_page_pool_free(struct ttm
+ if (NUM_PAGES_TO_ALLOC < nr_free)
+ npages_to_free = NUM_PAGES_TO_ALLOC;
+
+- pages_to_free = kmalloc(npages_to_free * sizeof(struct page *),
+- GFP_KERNEL);
++ pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), gfp);
+ if (!pages_to_free) {
+ pr_err("Failed to allocate memory for pool free operation\n");
+ return 0;
+@@ -382,9 +383,7 @@ out:
+ *
+ * XXX: (dchinner) Deadlock warning!
+ *
+- * ttm_page_pool_free() does memory allocation using GFP_KERNEL. that means
+- * this can deadlock when called a sc->gfp_mask that is not equal to
+- * GFP_KERNEL.
++ * We need to pass sc->gfp_mask to ttm_page_pool_free().
+ *
+ * This code is crying out for a shrinker per pool....
+ */
+@@ -408,7 +407,8 @@ ttm_pool_shrink_scan(struct shrinker *sh
+ if (shrink_pages == 0)
+ break;
+ pool = &_manager->pools[(i + pool_offset)%NUM_POOLS];
+- shrink_pages = ttm_page_pool_free(pool, nr_free);
++ shrink_pages = ttm_page_pool_free(pool, nr_free,
++ sc->gfp_mask);
+ freed += nr_free - shrink_pages;
+ }
+ mutex_unlock(&lock);
+@@ -710,7 +710,7 @@ static void ttm_put_pages(struct page **
+ }
+ spin_unlock_irqrestore(&pool->lock, irq_flags);
+ if (npages)
+- ttm_page_pool_free(pool, npages);
++ ttm_page_pool_free(pool, npages, GFP_KERNEL);
+ }
+
+ /*
+@@ -850,7 +850,8 @@ void ttm_page_alloc_fini(void)
+ ttm_pool_mm_shrink_fini(_manager);
+
+ for (i = 0; i < NUM_POOLS; ++i)
+- ttm_page_pool_free(&_manager->pools[i], FREE_ALL_PAGES);
++ ttm_page_pool_free(&_manager->pools[i], FREE_ALL_PAGES,
++ GFP_KERNEL);
+
+ kobject_put(&_manager->kobj);
+ _manager = NULL;
+--- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
++++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
+@@ -411,8 +411,10 @@ static void ttm_dma_page_put(struct dma_
+ *
+ * @pool: to free the pages from
+ * @nr_free: If set to true will free all pages in pool
++ * @gfp: GFP flags.
+ **/
+-static unsigned ttm_dma_page_pool_free(struct dma_pool *pool, unsigned nr_free)
++static unsigned ttm_dma_page_pool_free(struct dma_pool *pool, unsigned nr_free,
++ gfp_t gfp)
+ {
+ unsigned long irq_flags;
+ struct dma_page *dma_p, *tmp;
+@@ -430,8 +432,7 @@ static unsigned ttm_dma_page_pool_free(s
+ npages_to_free, nr_free);
+ }
+ #endif
+- pages_to_free = kmalloc(npages_to_free * sizeof(struct page *),
+- GFP_KERNEL);
++ pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), gfp);
+
+ if (!pages_to_free) {
+ pr_err("%s: Failed to allocate memory for pool free operation\n",
+@@ -530,7 +531,7 @@ static void ttm_dma_free_pool(struct dev
+ if (pool->type != type)
+ continue;
+ /* Takes a spinlock.. */
+- ttm_dma_page_pool_free(pool, FREE_ALL_PAGES);
++ ttm_dma_page_pool_free(pool, FREE_ALL_PAGES, GFP_KERNEL);
+ WARN_ON(((pool->npages_in_use + pool->npages_free) != 0));
+ /* This code path is called after _all_ references to the
+ * struct device has been dropped - so nobody should be
+@@ -983,7 +984,7 @@ void ttm_dma_unpopulate(struct ttm_dma_t
+
+ /* shrink pool if necessary (only on !is_cached pools)*/
+ if (npages)
+- ttm_dma_page_pool_free(pool, npages);
++ ttm_dma_page_pool_free(pool, npages, GFP_KERNEL);
+ ttm->state = tt_unpopulated;
+ }
+ EXPORT_SYMBOL_GPL(ttm_dma_unpopulate);
+@@ -993,10 +994,7 @@ EXPORT_SYMBOL_GPL(ttm_dma_unpopulate);
+ *
+ * XXX: (dchinner) Deadlock warning!
+ *
+- * ttm_dma_page_pool_free() does GFP_KERNEL memory allocation, and so attention
+- * needs to be paid to sc->gfp_mask to determine if this can be done or not.
+- * GFP_KERNEL memory allocation in a GFP_ATOMIC reclaim context woul dbe really
+- * bad.
++ * We need to pass sc->gfp_mask to ttm_dma_page_pool_free().
+ *
+ * I'm getting sadder as I hear more pathetical whimpers about needing per-pool
+ * shrinkers
+@@ -1030,7 +1028,8 @@ ttm_dma_pool_shrink_scan(struct shrinker
+ if (++idx < pool_offset)
+ continue;
+ nr_free = shrink_pages;
+- shrink_pages = ttm_dma_page_pool_free(p->pool, nr_free);
++ shrink_pages = ttm_dma_page_pool_free(p->pool, nr_free,
++ sc->gfp_mask);
+ freed += nr_free - shrink_pages;
+
+ pr_debug("%s: (%s:%d) Asked to shrink %d, have %d more to go\n",
--- /dev/null
+From 22e71691fd54c637800d10816bbeba9cf132d218 Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Date: Sun, 3 Aug 2014 20:01:10 +0900
+Subject: drm/ttm: Use mutex_trylock() to avoid deadlock inside shrinker functions.
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+commit 22e71691fd54c637800d10816bbeba9cf132d218 upstream.
+
+I can observe that RHEL7 environment stalls with 100% CPU usage when a
+certain type of memory pressure is given. While the shrinker functions
+are called by shrink_slab() before the OOM killer is triggered, the stall
+lasts for many minutes.
+
+One of reasons of this stall is that
+ttm_dma_pool_shrink_count()/ttm_dma_pool_shrink_scan() are called and
+are blocked at mutex_lock(&_manager->lock). GFP_KERNEL allocation with
+_manager->lock held causes someone (including kswapd) to deadlock when
+these functions are called due to memory pressure. This patch changes
+"mutex_lock();" to "if (!mutex_trylock()) return ...;" in order to
+avoid deadlock.
+
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
++++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
+@@ -1014,7 +1014,8 @@ ttm_dma_pool_shrink_scan(struct shrinker
+ if (list_empty(&_manager->pools))
+ return SHRINK_STOP;
+
+- mutex_lock(&_manager->lock);
++ if (!mutex_trylock(&_manager->lock))
++ return SHRINK_STOP;
+ if (!_manager->npools)
+ goto out;
+ pool_offset = ++start_pool % _manager->npools;
+@@ -1047,7 +1048,8 @@ ttm_dma_pool_shrink_count(struct shrinke
+ struct device_pools *p;
+ unsigned long count = 0;
+
+- mutex_lock(&_manager->lock);
++ if (!mutex_trylock(&_manager->lock))
++ return 0;
+ list_for_each_entry(p, &_manager->pools, pools)
+ count += p->pool->npages_free;
+ mutex_unlock(&_manager->lock);
+carl9170-fix-sending-urbs-with-wrong-type-when-using-full-speed.patch
+drm-tilcdc-panel-fix-dangling-sysfs-connector-node.patch
+drm-tilcdc-slave-fix-dangling-sysfs-connector-node.patch
+drm-tilcdc-tfp410-fix-dangling-sysfs-connector-node.patch
+drm-tilcdc-panel-fix-leak-when-unloading-the-module.patch
+drm-tilcdc-fix-release-order-on-exit.patch
+drm-tilcdc-fix-double-kfree.patch
+drm-ttm-fix-possible-division-by-0-in-ttm_dma_pool_shrink_scan.patch
+drm-ttm-choose-a-pool-to-shrink-correctly-in-ttm_dma_pool_shrink_scan.patch
+drm-ttm-use-mutex_trylock-to-avoid-deadlock-inside-shrinker-functions.patch
+drm-ttm-fix-possible-stack-overflow-by-recursive-shrinker-calls.patch
+drm-ttm-pass-gfp-flags-in-order-to-avoid-deadlock.patch
+drm-radeon-dpm-handle-voltage-info-fetching-on-hawaii.patch
+drm-radeon-re-enable-dpm-by-default-on-cayman.patch
+drm-radeon-re-enable-dpm-by-default-on-btc.patch
+drm-radeon-load-the-lm63-driver-for-an-lm64-thermal-chip.patch
+drm-radeon-set-vm-base-addr-using-the-pfp-v2.patch
+drm-radeon-atom-add-new-voltage-fetch-function-for-hawaii.patch
+drm-radeon-tweak-accel_working2-query-for-hawaii.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
