3.0-stable patches

added patches:
	drm-i915-don-t-clobber-crtc-fb-when-queue_flip-fails.patch
	drm-i915-don-t-set-unpin_work-if-vblank_get-fails.patch

diff --git a/queue-3.0/drm-i915-don-t-clobber-crtc-fb-when-queue_flip-fails.patch b/queue-3.0/drm-i915-don-t-clobber-crtc-fb-when-queue_flip-fails.patch
new file mode 100644 (file)
index 0000000..76bab70
--- /dev/null
+++ b/queue-3.0/drm-i915-don-t-clobber-crtc-fb-when-queue_flip-fails.patch
@@ -0,0 +1,74 @@
+From 4a35f83b2b7c6aae3fc0d1c4554fdc99dc33ad07 Mon Sep 17 00:00:00 2001
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Date: Fri, 22 Feb 2013 16:53:38 +0200
+Subject: drm/i915: Don't clobber crtc->fb when queue_flip fails
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 4a35f83b2b7c6aae3fc0d1c4554fdc99dc33ad07 upstream.
+
+Restore crtc->fb to the old framebuffer if queue_flip fails.
+
+While at it, kill the pointless intel_fb temp variable.
+
+v2: Update crtc->fb before queue_flip and restore it back
+    after a failure.
+
+[Backported for 3.0-stable. Adjusted context. Please
+cherry-pick commit 7317c75e66fce0c9f82fbe6f72f7e5256b315422
+upstream before this patch as it provides necessary context
+and fixes a panic.]
+
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Reported-and-Tested-by: Mika Kuoppala <mika.kuoppala@intel.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Lingzhu Xiang <lxiang@redhat.com>
+Reviewed-by: CAI Qian <caiqian@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_display.c |   11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -6507,8 +6507,8 @@ static int intel_crtc_page_flip(struct d
+ {
+       struct drm_device *dev = crtc->dev;
+       struct drm_i915_private *dev_priv = dev->dev_private;
+-      struct intel_framebuffer *intel_fb;
+-      struct drm_i915_gem_object *obj;
++      struct drm_framebuffer *old_fb = crtc->fb;
++      struct drm_i915_gem_object *obj = to_intel_framebuffer(fb)->obj;
+       struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+       struct intel_unpin_work *work;
+       unsigned long flags;
+@@ -6520,8 +6520,7 @@ static int intel_crtc_page_flip(struct d
+ 
+       work->event = event;
+       work->dev = crtc->dev;
+-      intel_fb = to_intel_framebuffer(crtc->fb);
+-      work->old_fb_obj = intel_fb->obj;
++      work->old_fb_obj = to_intel_framebuffer(old_fb)->obj;
+       INIT_WORK(&work->work, intel_unpin_work_fn);
+ 
+       ret = drm_vblank_get(dev, intel_crtc->pipe);
+@@ -6541,9 +6540,6 @@ static int intel_crtc_page_flip(struct d
+       intel_crtc->unpin_work = work;
+       spin_unlock_irqrestore(&dev->event_lock, flags);
+ 
+-      intel_fb = to_intel_framebuffer(fb);
+-      obj = intel_fb->obj;
+-
+       mutex_lock(&dev->struct_mutex);
+ 
+       /* Reference the objects for the scheduled work. */
+@@ -6573,6 +6569,7 @@ static int intel_crtc_page_flip(struct d
+ 
+ cleanup_pending:
+       atomic_sub(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
++      crtc->fb = old_fb;
+       drm_gem_object_unreference(&work->old_fb_obj->base);
+       drm_gem_object_unreference(&obj->base);
+       mutex_unlock(&dev->struct_mutex);

diff --git a/queue-3.0/drm-i915-don-t-set-unpin_work-if-vblank_get-fails.patch b/queue-3.0/drm-i915-don-t-set-unpin_work-if-vblank_get-fails.patch
new file mode 100644 (file)
index 0000000..ee17f59
--- /dev/null
+++ b/queue-3.0/drm-i915-don-t-set-unpin_work-if-vblank_get-fails.patch
@@ -0,0 +1,70 @@
+From 7317c75e66fce0c9f82fbe6f72f7e5256b315422 Mon Sep 17 00:00:00 2001
+From: Jesse Barnes <jbarnes@virtuousgeek.org>
+Date: Mon, 29 Aug 2011 09:45:28 -0700
+Subject: drm/i915: don't set unpin_work if vblank_get fails
+
+From: Jesse Barnes <jbarnes@virtuousgeek.org>
+
+commit 7317c75e66fce0c9f82fbe6f72f7e5256b315422 upstream.
+
+This fixes a race where we may try to finish a page flip and decrement
+the refcount even if our vblank_get failed and we ended up with a
+spurious flip pending interrupt.
+
+Fixes https://bugs.freedesktop.org/show_bug.cgi?id=34211.
+
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_display.c |   12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -6524,11 +6524,16 @@ static int intel_crtc_page_flip(struct d
+       work->old_fb_obj = intel_fb->obj;
+       INIT_WORK(&work->work, intel_unpin_work_fn);
+ 
++      ret = drm_vblank_get(dev, intel_crtc->pipe);
++      if (ret)
++              goto free_work;
++
+       /* We borrow the event spin lock for protecting unpin_work */
+       spin_lock_irqsave(&dev->event_lock, flags);
+       if (intel_crtc->unpin_work) {
+               spin_unlock_irqrestore(&dev->event_lock, flags);
+               kfree(work);
++              drm_vblank_put(dev, intel_crtc->pipe);
+ 
+               DRM_DEBUG_DRIVER("flip queue: crtc already busy\n");
+               return -EBUSY;
+@@ -6547,10 +6552,6 @@ static int intel_crtc_page_flip(struct d
+ 
+       crtc->fb = fb;
+ 
+-      ret = drm_vblank_get(dev, intel_crtc->pipe);
+-      if (ret)
+-              goto cleanup_objs;
+-
+       work->pending_flip_obj = obj;
+ 
+       work->enable_stall_check = true;
+@@ -6572,7 +6573,6 @@ static int intel_crtc_page_flip(struct d
+ 
+ cleanup_pending:
+       atomic_sub(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
+-cleanup_objs:
+       drm_gem_object_unreference(&work->old_fb_obj->base);
+       drm_gem_object_unreference(&obj->base);
+       mutex_unlock(&dev->struct_mutex);
+@@ -6581,6 +6581,8 @@ cleanup_objs:
+       intel_crtc->unpin_work = NULL;
+       spin_unlock_irqrestore(&dev->event_lock, flags);
+ 
++      drm_vblank_put(dev, intel_crtc->pipe);
++free_work:
+       kfree(work);
+ 
+       return ret;

diff --git a/queue-3.0/series b/queue-3.0/series
index 3003ca9ca1659016437c711ea7a8d7a9628b54ae..deebd5e82bffc86fc6251067412ad25ca9439095 100644 (file)
--- a/queue-3.0/series
+++ b/queue-3.0/series
@@ -31,3 +31,5 @@ mm-hotplug-correctly-add-new-zone-to-all-other-nodes-zone-lists.patch
 kvm-x86-invalid-opcode-oops-on-set_sregs-with-osxsave-bit-set-cve-2012-4461.patch
 loop-prevent-bdev-freeing-while-device-in-use.patch
 nfsd4-reject-negative-acl-lengths.patch
+drm-i915-don-t-set-unpin_work-if-vblank_get-fails.patch
+drm-i915-don-t-clobber-crtc-fb-when-queue_flip-fails.patch