--- /dev/null
+From e12a2d53ae45a69aea499b64f75e7222cca0f12f Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Thu, 15 Nov 2012 11:32:18 +0000
+Subject: drm/i915: Fix detection of base of stolen memory
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit e12a2d53ae45a69aea499b64f75e7222cca0f12f upstream.
+
+The routine to query the base of stolen memory was using the wrong
+registers and the wrong encodings on virtually every platform.
+
+It was not until the G33 refresh, that a PCI config register was
+introduced that explicitly said where the stolen memory was. Prior to
+865G there was not even a register that said where the end of usable
+low memory was and where the stolen memory began (or ended depending
+upon chipset). Before then, one has to look at the BIOS memory maps to
+find the Top of Memory. Alas that is not exported by arch/x86 and so we
+have to resort to disabling stolen memory on gen2 for the time being.
+
+Then SandyBridge enlarged the PCI register to a full 32-bits and change
+the encoding of the address, so even though we happened to be querying
+the right register, we read the wrong bits and ended up using address 0
+for our stolen data, i.e. notably FBC.
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_drv.h | 1
+ drivers/gpu/drm/i915/i915_gem_stolen.c | 81 ++++++++++++++++-----------------
+ 2 files changed, 42 insertions(+), 40 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -774,6 +774,7 @@ typedef struct drm_i915_private {
+ unsigned long gtt_start;
+ unsigned long gtt_mappable_end;
+ unsigned long gtt_end;
++ unsigned long stolen_base; /* limited to low memory (32-bit) */
+
+ struct io_mapping *gtt_mapping;
+ phys_addr_t gtt_base_addr;
+--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
++++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
+@@ -42,56 +42,50 @@
+ * for is a boon.
+ */
+
+-#define PTE_ADDRESS_MASK 0xfffff000
+-#define PTE_ADDRESS_MASK_HIGH 0x000000f0 /* i915+ */
+-#define PTE_MAPPING_TYPE_UNCACHED (0 << 1)
+-#define PTE_MAPPING_TYPE_DCACHE (1 << 1) /* i830 only */
+-#define PTE_MAPPING_TYPE_CACHED (3 << 1)
+-#define PTE_MAPPING_TYPE_MASK (3 << 1)
+-#define PTE_VALID (1 << 0)
+-
+-/**
+- * i915_stolen_to_phys - take an offset into stolen memory and turn it into
+- * a physical one
+- * @dev: drm device
+- * @offset: address to translate
+- *
+- * Some chip functions require allocations from stolen space and need the
+- * physical address of the memory in question.
+- */
+-static unsigned long i915_stolen_to_phys(struct drm_device *dev, u32 offset)
++static unsigned long i915_stolen_to_physical(struct drm_device *dev)
+ {
+ struct drm_i915_private *dev_priv = dev->dev_private;
+ struct pci_dev *pdev = dev_priv->bridge_dev;
+ u32 base;
+
+-#if 0
+ /* On the machines I have tested the Graphics Base of Stolen Memory
+- * is unreliable, so compute the base by subtracting the stolen memory
+- * from the Top of Low Usable DRAM which is where the BIOS places
+- * the graphics stolen memory.
++ * is unreliable, so on those compute the base by subtracting the
++ * stolen memory from the Top of Low Usable DRAM which is where the
++ * BIOS places the graphics stolen memory.
++ *
++ * On gen2, the layout is slightly different with the Graphics Segment
++ * immediately following Top of Memory (or Top of Usable DRAM). Note
++ * it appears that TOUD is only reported by 865g, so we just use the
++ * top of memory as determined by the e820 probe.
++ *
++ * XXX gen2 requires an unavailable symbol and 945gm fails with
++ * its value of TOLUD.
+ */
+- if (INTEL_INFO(dev)->gen > 3 || IS_G33(dev)) {
+- /* top 32bits are reserved = 0 */
++ base = 0;
++ if (INTEL_INFO(dev)->gen >= 6) {
++ /* Read Base Data of Stolen Memory Register (BDSM) directly.
++ * Note that there is also a MCHBAR miror at 0x1080c0 or
++ * we could use device 2:0x5c instead.
++ */
++ pci_read_config_dword(pdev, 0xB0, &base);
++ base &= ~4095; /* lower bits used for locking register */
++ } else if (INTEL_INFO(dev)->gen > 3 || IS_G33(dev)) {
++ /* Read Graphics Base of Stolen Memory directly */
+ pci_read_config_dword(pdev, 0xA4, &base);
+- } else {
+- /* XXX presume 8xx is the same as i915 */
+- pci_bus_read_config_dword(pdev->bus, 2, 0x5C, &base);
+- }
+-#else
+- if (INTEL_INFO(dev)->gen > 3 || IS_G33(dev)) {
+- u16 val;
+- pci_read_config_word(pdev, 0xb0, &val);
+- base = val >> 4 << 20;
+- } else {
++#if 0
++ } else if (IS_GEN3(dev)) {
+ u8 val;
++ /* Stolen is immediately below Top of Low Usable DRAM */
+ pci_read_config_byte(pdev, 0x9c, &val);
+ base = val >> 3 << 27;
+- }
+- base -= dev_priv->mm.gtt->stolen_size;
++ base -= dev_priv->mm.gtt->stolen_size;
++ } else {
++ /* Stolen is immediately above Top of Memory */
++ base = max_low_pfn_mapped << PAGE_SHIFT;
+ #endif
++ }
+
+- return base + offset;
++ return base;
+ }
+
+ static void i915_warn_stolen(struct drm_device *dev)
+@@ -116,7 +110,7 @@ static void i915_setup_compression(struc
+ if (!compressed_fb)
+ goto err;
+
+- cfb_base = i915_stolen_to_phys(dev, compressed_fb->start);
++ cfb_base = dev_priv->mm.stolen_base + compressed_fb->start;
+ if (!cfb_base)
+ goto err_fb;
+
+@@ -129,7 +123,7 @@ static void i915_setup_compression(struc
+ if (!compressed_llb)
+ goto err_fb;
+
+- ll_base = i915_stolen_to_phys(dev, compressed_llb->start);
++ ll_base = dev_priv->mm.stolen_base + compressed_llb->start;
+ if (!ll_base)
+ goto err_llb;
+ }
+@@ -148,7 +142,7 @@ static void i915_setup_compression(struc
+ }
+
+ DRM_DEBUG_KMS("FBC base 0x%08lx, ll base 0x%08lx, size %dM\n",
+- cfb_base, ll_base, size >> 20);
++ (long)cfb_base, (long)ll_base, size >> 20);
+ return;
+
+ err_llb:
+@@ -180,6 +174,13 @@ int i915_gem_init_stolen(struct drm_devi
+ struct drm_i915_private *dev_priv = dev->dev_private;
+ unsigned long prealloc_size = dev_priv->mm.gtt->stolen_size;
+
++ dev_priv->mm.stolen_base = i915_stolen_to_physical(dev);
++ if (dev_priv->mm.stolen_base == 0)
++ return 0;
++
++ DRM_DEBUG_KMS("found %d bytes of stolen memory at %08lx\n",
++ dev_priv->mm.gtt->stolen_size, dev_priv->mm.stolen_base);
++
+ /* Basic memrange allocator for stolen space */
+ drm_mm_init(&dev_priv->mm.stolen, 0, prealloc_size);
+