From: Greg Kroah-Hartman Date: Tue, 11 Feb 2014 00:31:34 +0000 (-0800) Subject: 3.12-stable patches X-Git-Tag: v3.4.80~31 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3920ed0c03a6a86a34c53758d7e953716aa0f173;p=thirdparty%2Fkernel%2Fstable-queue.git 3.12-stable patches added patches: drm-ast-cirrus-mgag200-use-drm_can_sleep.patch drm-cirrus-correct-register-values-for-16bpp.patch drm-gem-always-initialize-the-gem-object-in-object_init.patch drm-gma500-lock-struct_mutex-around-cursor-updates.patch drm-i915-decouple-gpu-error-reporting-from-ring-initialisation.patch drm-i915-fix-the-offset-issue-for-the-stolen-gem-objects.patch drm-i915-flush-outstanding-requests-before-allocating-new-seqno.patch drm-i915-vlv2-fix-hotplug-detect-bits.patch drm-mgag200-ast-cirrus-fix-regression-with-drm_can_sleep-conversion.patch drm-mgag200-fix-oops-in-cursor-code.patch drm-mgag200-fix-typo-causing-bw-limits-to-be-ignored-on-some-chips.patch drm-nouveau-falcon-use-vmalloc-to-create-firwmare-copies.patch drm-nouveau-fix-m2mf-copy-to-tiled-gart.patch drm-rcar-du-update-plane-pitch-in-.mode_set_base-operation.patch drm-vmwgfx-fix-regression-caused-by-drm-ttm-make-ttm-reservation-calls-behave-like-reservation-calls.patch i915-remove-pm_qos-request-on-error.patch --- diff --git a/queue-3.12/drm-ast-cirrus-mgag200-use-drm_can_sleep.patch b/queue-3.12/drm-ast-cirrus-mgag200-use-drm_can_sleep.patch new file mode 100644 index 00000000000..10e17bd5950 --- /dev/null +++ b/queue-3.12/drm-ast-cirrus-mgag200-use-drm_can_sleep.patch @@ -0,0 +1,56 @@ +From f4b4718b61d1d5a7442a4fd6863ea80c3a10e508 Mon Sep 17 00:00:00 2001 +From: Dave Airlie +Date: Fri, 24 Jan 2014 09:50:18 +1000 +Subject: drm: ast,cirrus,mgag200: use drm_can_sleep + +From: Dave Airlie + +commit f4b4718b61d1d5a7442a4fd6863ea80c3a10e508 upstream. + +these 3 were checking in_interrupt but we have situations where +calling vunmap under this could cause a BUG to be hit in +smp_call_function_many. Use the drm_can_sleep macro instead, +which should stop this path from been taken in this case. + +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/ast/ast_fb.c | 2 +- + drivers/gpu/drm/cirrus/cirrus_fbdev.c | 2 +- + drivers/gpu/drm/mgag200/mgag200_fb.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/ast/ast_fb.c ++++ b/drivers/gpu/drm/ast/ast_fb.c +@@ -65,7 +65,7 @@ static void ast_dirty_update(struct ast_ + * then the BO is being moved and we should + * store up the damage until later. + */ +- if (!in_interrupt()) ++ if (!drm_can_sleep()) + ret = ast_bo_reserve(bo, true); + if (ret) { + if (ret != -EBUSY) +--- a/drivers/gpu/drm/cirrus/cirrus_fbdev.c ++++ b/drivers/gpu/drm/cirrus/cirrus_fbdev.c +@@ -39,7 +39,7 @@ static void cirrus_dirty_update(struct c + * then the BO is being moved and we should + * store up the damage until later. + */ +- if (!in_interrupt()) ++ if (!drm_can_sleep()) + ret = cirrus_bo_reserve(bo, true); + if (ret) { + if (ret != -EBUSY) +--- a/drivers/gpu/drm/mgag200/mgag200_fb.c ++++ b/drivers/gpu/drm/mgag200/mgag200_fb.c +@@ -41,7 +41,7 @@ static void mga_dirty_update(struct mga_ + * then the BO is being moved and we should + * store up the damage until later. + */ +- if (!in_interrupt()) ++ if (!drm_can_sleep()) + ret = mgag200_bo_reserve(bo, true); + if (ret) { + if (ret != -EBUSY) diff --git a/queue-3.12/drm-cirrus-correct-register-values-for-16bpp.patch b/queue-3.12/drm-cirrus-correct-register-values-for-16bpp.patch new file mode 100644 index 00000000000..34a45ccaa71 --- /dev/null +++ b/queue-3.12/drm-cirrus-correct-register-values-for-16bpp.patch @@ -0,0 +1,39 @@ +From 2510538fa000dd13a3e57b79bf073ffb1748976c Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 21 Jan 2014 14:34:51 -0800 +Subject: drm/cirrus: correct register values for 16bpp + +From: Takashi Iwai + +commit 2510538fa000dd13a3e57b79bf073ffb1748976c upstream. + +When the mode is set with 16bpp on QEMU, the output gets totally broken. +The culprit is the bogus register values set for 16bpp, which was likely +copied from from a wrong place. + +Addresses https://bugzilla.novell.com/show_bug.cgi?id=799216 + +Signed-off-by: Takashi Iwai +Signed-off-by: Jiri Slaby +Cc: David Airlie +Signed-off-by: Andrew Morton +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/cirrus/cirrus_mode.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/cirrus/cirrus_mode.c ++++ b/drivers/gpu/drm/cirrus/cirrus_mode.c +@@ -273,8 +273,8 @@ static int cirrus_crtc_mode_set(struct d + sr07 |= 0x11; + break; + case 16: +- sr07 |= 0xc1; +- hdr = 0xc0; ++ sr07 |= 0x17; ++ hdr = 0xc1; + break; + case 24: + sr07 |= 0x15; diff --git a/queue-3.12/drm-gem-always-initialize-the-gem-object-in-object_init.patch b/queue-3.12/drm-gem-always-initialize-the-gem-object-in-object_init.patch new file mode 100644 index 00000000000..75e5568f749 --- /dev/null +++ b/queue-3.12/drm-gem-always-initialize-the-gem-object-in-object_init.patch @@ -0,0 +1,57 @@ +From 6ab11a2635ce988ebc2e798947beb72cf7324119 Mon Sep 17 00:00:00 2001 +From: Daniel Vetter +Date: Mon, 20 Jan 2014 08:21:54 +0100 +Subject: drm/gem: Always initialize the gem object in object_init + +From: Daniel Vetter + +commit 6ab11a2635ce988ebc2e798947beb72cf7324119 upstream. + +At least drm/i915 expects that the obj->dev pointer is set even in +failure paths. Specifically when the shmem initialization fails we +call i915_gem_object_free which needs to deref obj->base.dev to get at +the slab pointer in the device private structure. And the shmem +allocation can easily fail when userspace is hitting open file limits. + +Doing the structure init even when the shmem file allocation fails +prevents this Oops. + +This is a regression from + +commit 89c8233f82d9c8af5b20e72e4a185a38a7d3c50b +Author: David Herrmann +Date: Thu Jul 11 11:56:32 2013 +0200 + + drm/gem: simplify object initialization + +v2: Add regression note which Chris supplied. + +Testcase: igt/gem_fd_exhaustion +Reported-and-Suggested-by: Linus Torvalds +Cc: Linus Torvalds +References: http://lists.freedesktop.org/archives/intel-gfx/2014-January/038433.html +Reviewed-by: David Herrmann +Cc: David Herrmann +Signed-off-by: Daniel Vetter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_gem.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_gem.c ++++ b/drivers/gpu/drm/drm_gem.c +@@ -129,11 +129,12 @@ int drm_gem_object_init(struct drm_devic + { + struct file *filp; + ++ drm_gem_private_object_init(dev, obj, size); ++ + filp = shmem_file_setup("drm mm object", size, VM_NORESERVE); + if (IS_ERR(filp)) + return PTR_ERR(filp); + +- drm_gem_private_object_init(dev, obj, size); + obj->filp = filp; + + return 0; diff --git a/queue-3.12/drm-gma500-lock-struct_mutex-around-cursor-updates.patch b/queue-3.12/drm-gma500-lock-struct_mutex-around-cursor-updates.patch new file mode 100644 index 00000000000..eb6aa3e621c --- /dev/null +++ b/queue-3.12/drm-gma500-lock-struct_mutex-around-cursor-updates.patch @@ -0,0 +1,64 @@ +From 631794b44bd3dbfba37074954d5c584c9e8725f0 Mon Sep 17 00:00:00 2001 +From: Patrik Jakobsson +Date: Wed, 8 Jan 2014 19:30:40 +0100 +Subject: drm/gma500: Lock struct_mutex around cursor updates + +From: Patrik Jakobsson + +commit 631794b44bd3dbfba37074954d5c584c9e8725f0 upstream. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=64361 +Signed-off-by: Patrik Jakobsson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/gma500/gma_display.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/gma500/gma_display.c ++++ b/drivers/gpu/drm/gma500/gma_display.c +@@ -349,6 +349,7 @@ int gma_crtc_cursor_set(struct drm_crtc + /* If we didn't get a handle then turn the cursor off */ + if (!handle) { + temp = CURSOR_MODE_DISABLE; ++ mutex_lock(&dev->struct_mutex); + + if (gma_power_begin(dev, false)) { + REG_WRITE(control, temp); +@@ -365,6 +366,7 @@ int gma_crtc_cursor_set(struct drm_crtc + gma_crtc->cursor_obj = NULL; + } + ++ mutex_unlock(&dev->struct_mutex); + return 0; + } + +@@ -374,9 +376,12 @@ int gma_crtc_cursor_set(struct drm_crtc + return -EINVAL; + } + ++ mutex_lock(&dev->struct_mutex); + obj = drm_gem_object_lookup(dev, file_priv, handle); +- if (!obj) +- return -ENOENT; ++ if (!obj) { ++ ret = -ENOENT; ++ goto unlock; ++ } + + if (obj->size < width * height * 4) { + dev_dbg(dev->dev, "Buffer is too small\n"); +@@ -440,10 +445,13 @@ int gma_crtc_cursor_set(struct drm_crtc + } + + gma_crtc->cursor_obj = obj; ++unlock: ++ mutex_unlock(&dev->struct_mutex); + return ret; + + unref_cursor: + drm_gem_object_unreference(obj); ++ mutex_unlock(&dev->struct_mutex); + return ret; + } + diff --git a/queue-3.12/drm-i915-decouple-gpu-error-reporting-from-ring-initialisation.patch b/queue-3.12/drm-i915-decouple-gpu-error-reporting-from-ring-initialisation.patch new file mode 100644 index 00000000000..4e71297af7a --- /dev/null +++ b/queue-3.12/drm-i915-decouple-gpu-error-reporting-from-ring-initialisation.patch @@ -0,0 +1,127 @@ +From 372fbb8e3927fc76b0f842d8eb8a798a71d8960f Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Mon, 27 Jan 2014 13:52:34 +0000 +Subject: drm/i915: Decouple GPU error reporting from ring initialisation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chris Wilson + +commit 372fbb8e3927fc76b0f842d8eb8a798a71d8960f upstream. + +Currently we report through our error state only the rings that have +been initialised (as detected by ring->obj). This check is done after +the GPU reset and ring re-initialisation, which means that the software +state may not be the same as when we captured the hardware error and we +may not print out any of the vital information for debugging the hang. + +This (and the implied object leak) is a regression from + +commit 3d57e5bd1284f44e325f3a52d966259ed42f9e05 +Author: Ben Widawsky +Date: Mon Oct 14 10:01:36 2013 -0700 + + drm/i915: Do a fuller init after reset + +Note that we are already starting to get bug reports with incomplete +error states from 3.13, which also hampers debugging userspace driver +issues. + +v2: Prevent a NULL dereference on 830gm/845g after a GPU reset where + the scratch obj may be NULL. + +Signed-off-by: Chris Wilson +Cc: Ben Widawsky +Cc: Ville Syrjälä +References: https://bugs.freedesktop.org/show_bug.cgi?id=74094 +Reviewed-by: Ville Syrjälä +[danvet: Add a bit of fluff to make it clear we need this expedited in +stable.] +Signed-off-by: Daniel Vetter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_drv.h | 1 + + drivers/gpu/drm/i915/i915_gpu_error.c | 22 +++++++++++++++------- + 2 files changed, 16 insertions(+), 7 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -296,6 +296,7 @@ struct drm_i915_error_state { + u64 fence[I915_MAX_NUM_FENCES]; + struct timeval time; + struct drm_i915_error_ring { ++ bool valid; + struct drm_i915_error_object { + int page_count; + u32 gtt_offset; +--- a/drivers/gpu/drm/i915/i915_gpu_error.c ++++ b/drivers/gpu/drm/i915/i915_gpu_error.c +@@ -221,6 +221,9 @@ static void i915_ring_error_state(struct + unsigned ring) + { + BUG_ON(ring >= I915_NUM_RINGS); /* shut up confused gcc */ ++ if (!error->ring[ring].valid) ++ return; ++ + err_printf(m, "%s command stream:\n", ring_str(ring)); + err_printf(m, " HEAD: 0x%08x\n", error->head[ring]); + err_printf(m, " TAIL: 0x%08x\n", error->tail[ring]); +@@ -272,7 +275,6 @@ int i915_error_state_to_str(struct drm_i + struct drm_device *dev = error_priv->dev; + drm_i915_private_t *dev_priv = dev->dev_private; + struct drm_i915_error_state *error = error_priv->error; +- struct intel_ring_buffer *ring; + int i, j, page, offset, elt; + + if (!error) { +@@ -306,7 +308,7 @@ int i915_error_state_to_str(struct drm_i + if (INTEL_INFO(dev)->gen == 7) + err_printf(m, "ERR_INT: 0x%08x\n", error->err_int); + +- for_each_ring(ring, dev_priv, i) ++ for (i = 0; i < ARRAY_SIZE(error->ring); i++) + i915_ring_error_state(m, dev, error, i); + + if (error->active_bo) +@@ -363,8 +365,7 @@ int i915_error_state_to_str(struct drm_i + } + } + +- obj = error->ring[i].ctx; +- if (obj) { ++ if ((obj = error->ring[i].ctx)) { + err_printf(m, "%s --- HW Context = 0x%08x\n", + dev_priv->ring[i].name, + obj->gtt_offset); +@@ -644,7 +645,8 @@ i915_error_first_batchbuffer(struct drm_ + return NULL; + + obj = ring->scratch.obj; +- if (acthd >= i915_gem_obj_ggtt_offset(obj) && ++ if (obj != NULL && ++ acthd >= i915_gem_obj_ggtt_offset(obj) && + acthd < i915_gem_obj_ggtt_offset(obj) + obj->base.size) + return i915_error_object_create(dev_priv, obj); + } +@@ -747,11 +749,17 @@ static void i915_gem_record_rings(struct + struct drm_i915_error_state *error) + { + struct drm_i915_private *dev_priv = dev->dev_private; +- struct intel_ring_buffer *ring; + struct drm_i915_gem_request *request; + int i, count; + +- for_each_ring(ring, dev_priv, i) { ++ for (i = 0; i < I915_NUM_RINGS; i++) { ++ struct intel_ring_buffer *ring = &dev_priv->ring[i]; ++ ++ if (ring->dev == NULL) ++ continue; ++ ++ error->ring[i].valid = true; ++ + i915_record_ring_state(dev, error, ring); + + error->ring[i].batchbuffer = diff --git a/queue-3.12/drm-i915-fix-the-offset-issue-for-the-stolen-gem-objects.patch b/queue-3.12/drm-i915-fix-the-offset-issue-for-the-stolen-gem-objects.patch new file mode 100644 index 00000000000..af5f2cdbffd --- /dev/null +++ b/queue-3.12/drm-i915-fix-the-offset-issue-for-the-stolen-gem-objects.patch @@ -0,0 +1,42 @@ +From ec14ba47791965d2c08e0a681ff44eacbf3c4553 Mon Sep 17 00:00:00 2001 +From: Akash Goel +Date: Mon, 13 Jan 2014 16:24:45 +0530 +Subject: drm/i915: Fix the offset issue for the stolen GEM objects + +From: Akash Goel + +commit ec14ba47791965d2c08e0a681ff44eacbf3c4553 upstream. + +The 'offset' field of the 'scatterlist' structure was wrongly +programmed with the offset value from the base of stolen area, +whereas this field indicates the offset from where the interested +data starts within the first PAGE pointed to by 'scattterlist' +structure. As a result when a new GEM object allocated from stolen +area is mapped to GTT, it could lead to an overwrite of GTT entries +as the page count calculation will go wrong, refer the function +'sg_page_count'. + +v2: Modified the commit message. (Chris) + +Signed-off-by: Akash Goel +Reviewed-by: Jesse Barnes +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=71908 +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=69104 +Signed-off-by: Daniel Vetter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_gem_stolen.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/i915_gem_stolen.c ++++ b/drivers/gpu/drm/i915/i915_gem_stolen.c +@@ -250,7 +250,7 @@ i915_pages_create_for_stolen(struct drm_ + } + + sg = st->sgl; +- sg->offset = offset; ++ sg->offset = 0; + sg->length = size; + + sg_dma_address(sg) = (dma_addr_t)dev_priv->mm.stolen_base + offset; diff --git a/queue-3.12/drm-i915-flush-outstanding-requests-before-allocating-new-seqno.patch b/queue-3.12/drm-i915-flush-outstanding-requests-before-allocating-new-seqno.patch new file mode 100644 index 00000000000..f0819affd90 --- /dev/null +++ b/queue-3.12/drm-i915-flush-outstanding-requests-before-allocating-new-seqno.patch @@ -0,0 +1,78 @@ +From 304d695c3dc8eb65206b9eaf16f8d1a41510d1cf Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Thu, 2 Jan 2014 14:32:35 +0000 +Subject: drm/i915: Flush outstanding requests before allocating new seqno + +From: Chris Wilson + +commit 304d695c3dc8eb65206b9eaf16f8d1a41510d1cf upstream. + +In very rare cases (such as a memory failure stress test) it is possible +to fill the entire ring without emitting a request. Under this +circumstance, the outstanding request is flushed and waited upon. After +space on the ring is cleared, we return to emitting the new command - +except that we just cleared the seqno allocated for this operation and +trigger the sanity check that a request is only ever emitted with a +valid seqno. The fix is to rearrange the code to make sure the +allocation of the seqno for this operation is after any required flushes +of outstanding operations. + +The bug exists since the preallocation was introduced in +commit 9d7730914f4cd496e356acfab95b41075aa8eae8 +Author: Chris Wilson +Date: Tue Nov 27 16:22:52 2012 +0000 + + drm/i915: Preallocate next seqno before touching the ring + +Signed-off-by: Chris Wilson +Cc: Mika Kuoppala +Cc: Daniel Vetter +Signed-off-by: Chris Wilson +Reviewed-by: Jani Nikula +Signed-off-by: Daniel Vetter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_ringbuffer.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_ringbuffer.c ++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c +@@ -1501,8 +1501,8 @@ intel_ring_alloc_seqno(struct intel_ring + return i915_gem_get_seqno(ring->dev, &ring->outstanding_lazy_request); + } + +-static int __intel_ring_begin(struct intel_ring_buffer *ring, +- int bytes) ++static int __intel_ring_prepare(struct intel_ring_buffer *ring, ++ int bytes) + { + int ret; + +@@ -1518,7 +1518,6 @@ static int __intel_ring_begin(struct int + return ret; + } + +- ring->space -= bytes; + return 0; + } + +@@ -1533,12 +1532,17 @@ int intel_ring_begin(struct intel_ring_b + if (ret) + return ret; + ++ ret = __intel_ring_prepare(ring, num_dwords * sizeof(uint32_t)); ++ if (ret) ++ return ret; ++ + /* Preallocate the olr before touching the ring */ + ret = intel_ring_alloc_seqno(ring); + if (ret) + return ret; + +- return __intel_ring_begin(ring, num_dwords * sizeof(uint32_t)); ++ ring->space -= num_dwords * sizeof(uint32_t); ++ return 0; + } + + void intel_ring_init_seqno(struct intel_ring_buffer *ring, u32 seqno) diff --git a/queue-3.12/drm-i915-vlv2-fix-hotplug-detect-bits.patch b/queue-3.12/drm-i915-vlv2-fix-hotplug-detect-bits.patch new file mode 100644 index 00000000000..80ec1191af7 --- /dev/null +++ b/queue-3.12/drm-i915-vlv2-fix-hotplug-detect-bits.patch @@ -0,0 +1,100 @@ +From 232a6ee9af8adb185640f67fcaaa9014a9aa0573 Mon Sep 17 00:00:00 2001 +From: Todd Previte +Date: Thu, 23 Jan 2014 00:13:41 -0700 +Subject: drm/i915: VLV2 - Fix hotplug detect bits + +From: Todd Previte + +commit 232a6ee9af8adb185640f67fcaaa9014a9aa0573 upstream. + +Add new definitions for hotplug live status bits for VLV2 since they're +in reverse order from the gen4x ones. + +Changelog: +- Restored gen4 bit definitions +- Added new definitions for VLV2 +- Added platform check for IS_VALLEYVIEW() in dp_detect to use the correct + bit defintions +- Replaced a lost trailing brace for the added switch() + +Signed-off-by: Todd Previte +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=73951 +[danvet: Switch to _VLV postfix instead of prefix and regroupg +comments again so that the g4x warning is right next to those defines. +Also add a _G4X suffix for those special ones. Also cc stable.] +Signed-off-by: Daniel Vetter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_reg.h | 10 +++++++--- + drivers/gpu/drm/i915/intel_dp.c | 40 ++++++++++++++++++++++++++++------------ + 2 files changed, 35 insertions(+), 15 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -1955,9 +1955,13 @@ + * Please check the detailed lore in the commit message for for experimental + * evidence. + */ +-#define PORTD_HOTPLUG_LIVE_STATUS (1 << 29) +-#define PORTC_HOTPLUG_LIVE_STATUS (1 << 28) +-#define PORTB_HOTPLUG_LIVE_STATUS (1 << 27) ++#define PORTD_HOTPLUG_LIVE_STATUS_G4X (1 << 29) ++#define PORTC_HOTPLUG_LIVE_STATUS_G4X (1 << 28) ++#define PORTB_HOTPLUG_LIVE_STATUS_G4X (1 << 27) ++/* VLV DP/HDMI bits again match Bspec */ ++#define PORTD_HOTPLUG_LIVE_STATUS_VLV (1 << 27) ++#define PORTC_HOTPLUG_LIVE_STATUS_VLV (1 << 28) ++#define PORTB_HOTPLUG_LIVE_STATUS_VLV (1 << 29) + #define PORTD_HOTPLUG_INT_STATUS (3 << 21) + #define PORTC_HOTPLUG_INT_STATUS (3 << 19) + #define PORTB_HOTPLUG_INT_STATUS (3 << 17) +--- a/drivers/gpu/drm/i915/intel_dp.c ++++ b/drivers/gpu/drm/i915/intel_dp.c +@@ -2803,18 +2803,34 @@ g4x_dp_detect(struct intel_dp *intel_dp) + return status; + } + +- switch (intel_dig_port->port) { +- case PORT_B: +- bit = PORTB_HOTPLUG_LIVE_STATUS; +- break; +- case PORT_C: +- bit = PORTC_HOTPLUG_LIVE_STATUS; +- break; +- case PORT_D: +- bit = PORTD_HOTPLUG_LIVE_STATUS; +- break; +- default: +- return connector_status_unknown; ++ if (IS_VALLEYVIEW(dev)) { ++ switch (intel_dig_port->port) { ++ case PORT_B: ++ bit = PORTB_HOTPLUG_LIVE_STATUS_VLV; ++ break; ++ case PORT_C: ++ bit = PORTC_HOTPLUG_LIVE_STATUS_VLV; ++ break; ++ case PORT_D: ++ bit = PORTD_HOTPLUG_LIVE_STATUS_VLV; ++ break; ++ default: ++ return connector_status_unknown; ++ } ++ } else { ++ switch (intel_dig_port->port) { ++ case PORT_B: ++ bit = PORTB_HOTPLUG_LIVE_STATUS_G4X; ++ break; ++ case PORT_C: ++ bit = PORTC_HOTPLUG_LIVE_STATUS_G4X; ++ break; ++ case PORT_D: ++ bit = PORTD_HOTPLUG_LIVE_STATUS_G4X; ++ break; ++ default: ++ return connector_status_unknown; ++ } + } + + if ((I915_READ(PORT_HOTPLUG_STAT) & bit) == 0) diff --git a/queue-3.12/drm-mgag200-ast-cirrus-fix-regression-with-drm_can_sleep-conversion.patch b/queue-3.12/drm-mgag200-ast-cirrus-fix-regression-with-drm_can_sleep-conversion.patch new file mode 100644 index 00000000000..62f29ff7e43 --- /dev/null +++ b/queue-3.12/drm-mgag200-ast-cirrus-fix-regression-with-drm_can_sleep-conversion.patch @@ -0,0 +1,54 @@ +From 8b7ad1bb3d440da888f2a939dc870eba429b9192 Mon Sep 17 00:00:00 2001 +From: Dave Airlie +Date: Wed, 5 Feb 2014 14:47:45 +1000 +Subject: drm/mgag200,ast,cirrus: fix regression with drm_can_sleep conversion + +From: Dave Airlie + +commit 8b7ad1bb3d440da888f2a939dc870eba429b9192 upstream. + +I totally sign inverted my way out of this one. + +Reported-by: "Sabrina Dubroca" +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/ast/ast_fb.c | 2 +- + drivers/gpu/drm/cirrus/cirrus_fbdev.c | 2 +- + drivers/gpu/drm/mgag200/mgag200_fb.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/ast/ast_fb.c ++++ b/drivers/gpu/drm/ast/ast_fb.c +@@ -65,7 +65,7 @@ static void ast_dirty_update(struct ast_ + * then the BO is being moved and we should + * store up the damage until later. + */ +- if (!drm_can_sleep()) ++ if (drm_can_sleep()) + ret = ast_bo_reserve(bo, true); + if (ret) { + if (ret != -EBUSY) +--- a/drivers/gpu/drm/cirrus/cirrus_fbdev.c ++++ b/drivers/gpu/drm/cirrus/cirrus_fbdev.c +@@ -39,7 +39,7 @@ static void cirrus_dirty_update(struct c + * then the BO is being moved and we should + * store up the damage until later. + */ +- if (!drm_can_sleep()) ++ if (drm_can_sleep()) + ret = cirrus_bo_reserve(bo, true); + if (ret) { + if (ret != -EBUSY) +--- a/drivers/gpu/drm/mgag200/mgag200_fb.c ++++ b/drivers/gpu/drm/mgag200/mgag200_fb.c +@@ -41,7 +41,7 @@ static void mga_dirty_update(struct mga_ + * then the BO is being moved and we should + * store up the damage until later. + */ +- if (!drm_can_sleep()) ++ if (drm_can_sleep()) + ret = mgag200_bo_reserve(bo, true); + if (ret) { + if (ret != -EBUSY) diff --git a/queue-3.12/drm-mgag200-fix-oops-in-cursor-code.patch b/queue-3.12/drm-mgag200-fix-oops-in-cursor-code.patch new file mode 100644 index 00000000000..eacccee2639 --- /dev/null +++ b/queue-3.12/drm-mgag200-fix-oops-in-cursor-code.patch @@ -0,0 +1,43 @@ +From 53dac830537b51df555ba5e7ebb236705b7eaa7c Mon Sep 17 00:00:00 2001 +From: Dave Airlie +Date: Thu, 16 Jan 2014 14:28:22 +1000 +Subject: drm/mgag200: fix oops in cursor code. + +From: Dave Airlie + +commit 53dac830537b51df555ba5e7ebb236705b7eaa7c upstream. + +In some cases we enter the cursor code with file_priv = NULL causing an oops, +we also can try to unpin something that isn't pinned, and this is a good fix for it. + +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/mgag200/mgag200_cursor.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/mgag200/mgag200_cursor.c ++++ b/drivers/gpu/drm/mgag200/mgag200_cursor.c +@@ -22,8 +22,10 @@ static void mga_hide_cursor(struct mga_d + { + WREG8(MGA_CURPOSXL, 0); + WREG8(MGA_CURPOSXH, 0); +- mgag200_bo_unpin(mdev->cursor.pixels_1); +- mgag200_bo_unpin(mdev->cursor.pixels_2); ++ if (mdev->cursor.pixels_1->pin_count) ++ mgag200_bo_unpin(mdev->cursor.pixels_1); ++ if (mdev->cursor.pixels_2->pin_count) ++ mgag200_bo_unpin(mdev->cursor.pixels_2); + } + + int mga_crtc_cursor_set(struct drm_crtc *crtc, +@@ -32,7 +34,7 @@ int mga_crtc_cursor_set(struct drm_crtc + uint32_t width, + uint32_t height) + { +- struct drm_device *dev = (struct drm_device *)file_priv->minor->dev; ++ struct drm_device *dev = crtc->dev; + struct mga_device *mdev = (struct mga_device *)dev->dev_private; + struct mgag200_bo *pixels_1 = mdev->cursor.pixels_1; + struct mgag200_bo *pixels_2 = mdev->cursor.pixels_2; diff --git a/queue-3.12/drm-mgag200-fix-typo-causing-bw-limits-to-be-ignored-on-some-chips.patch b/queue-3.12/drm-mgag200-fix-typo-causing-bw-limits-to-be-ignored-on-some-chips.patch new file mode 100644 index 00000000000..d19fa7523b0 --- /dev/null +++ b/queue-3.12/drm-mgag200-fix-typo-causing-bw-limits-to-be-ignored-on-some-chips.patch @@ -0,0 +1,36 @@ +From ec22b4aa993abbd18f5bbbcb20a1c56be3b1d38b Mon Sep 17 00:00:00 2001 +From: Dave Airlie +Date: Wed, 5 Feb 2014 14:13:56 +1000 +Subject: drm/mgag200: fix typo causing bw limits to be ignored on some chips + +From: Dave Airlie + +commit ec22b4aa993abbd18f5bbbcb20a1c56be3b1d38b upstream. + +mode->mdev otherwise the bw limits never kick in. + +Reported in RHEL testing. + +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/mgag200/mgag200_mode.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/mgag200/mgag200_mode.c ++++ b/drivers/gpu/drm/mgag200/mgag200_mode.c +@@ -1521,11 +1521,11 @@ static int mga_vga_mode_valid(struct drm + (mga_vga_calculate_mode_bandwidth(mode, bpp) + > (32700 * 1024))) { + return MODE_BANDWIDTH; +- } else if (mode->type == G200_EH && ++ } else if (mdev->type == G200_EH && + (mga_vga_calculate_mode_bandwidth(mode, bpp) + > (37500 * 1024))) { + return MODE_BANDWIDTH; +- } else if (mode->type == G200_ER && ++ } else if (mdev->type == G200_ER && + (mga_vga_calculate_mode_bandwidth(mode, + bpp) > (55000 * 1024))) { + return MODE_BANDWIDTH; diff --git a/queue-3.12/drm-nouveau-falcon-use-vmalloc-to-create-firwmare-copies.patch b/queue-3.12/drm-nouveau-falcon-use-vmalloc-to-create-firwmare-copies.patch new file mode 100644 index 00000000000..d65a41f1a49 --- /dev/null +++ b/queue-3.12/drm-nouveau-falcon-use-vmalloc-to-create-firwmare-copies.patch @@ -0,0 +1,77 @@ +From 90d6db1635d5e225623af2e2e859feb607345287 Mon Sep 17 00:00:00 2001 +From: Ilia Mirkin +Date: Sat, 7 Dec 2013 11:42:19 -0500 +Subject: drm/nouveau/falcon: use vmalloc to create firwmare copies + +From: Ilia Mirkin + +commit 90d6db1635d5e225623af2e2e859feb607345287 upstream. + +Some firmware images may be large (64K), so using kmalloc memory is +inappropriate for them. Use vmalloc instead, to avoid high-order +allocation failures. + +Signed-off-by: Ilia Mirkin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/nouveau/core/engine/falcon.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/nouveau/core/engine/falcon.c ++++ b/drivers/gpu/drm/nouveau/core/engine/falcon.c +@@ -56,6 +56,16 @@ _nouveau_falcon_wr32(struct nouveau_obje + nv_wr32(falcon, falcon->addr + addr, data); + } + ++static void * ++vmemdup(const void *src, size_t len) ++{ ++ void *p = vmalloc(len); ++ ++ if (p) ++ memcpy(p, src, len); ++ return p; ++} ++ + int + _nouveau_falcon_init(struct nouveau_object *object) + { +@@ -111,7 +121,7 @@ _nouveau_falcon_init(struct nouveau_obje + + ret = request_firmware(&fw, name, &device->pdev->dev); + if (ret == 0) { +- falcon->code.data = kmemdup(fw->data, fw->size, GFP_KERNEL); ++ falcon->code.data = vmemdup(fw->data, fw->size); + falcon->code.size = fw->size; + falcon->data.data = NULL; + falcon->data.size = 0; +@@ -134,7 +144,7 @@ _nouveau_falcon_init(struct nouveau_obje + return ret; + } + +- falcon->data.data = kmemdup(fw->data, fw->size, GFP_KERNEL); ++ falcon->data.data = vmemdup(fw->data, fw->size); + falcon->data.size = fw->size; + release_firmware(fw); + if (!falcon->data.data) +@@ -149,7 +159,7 @@ _nouveau_falcon_init(struct nouveau_obje + return ret; + } + +- falcon->code.data = kmemdup(fw->data, fw->size, GFP_KERNEL); ++ falcon->code.data = vmemdup(fw->data, fw->size); + falcon->code.size = fw->size; + release_firmware(fw); + if (!falcon->code.data) +@@ -235,8 +245,8 @@ _nouveau_falcon_fini(struct nouveau_obje + if (!suspend) { + nouveau_gpuobj_ref(NULL, &falcon->core); + if (falcon->external) { +- kfree(falcon->data.data); +- kfree(falcon->code.data); ++ vfree(falcon->data.data); ++ vfree(falcon->code.data); + falcon->code.data = NULL; + } + } diff --git a/queue-3.12/drm-nouveau-fix-m2mf-copy-to-tiled-gart.patch b/queue-3.12/drm-nouveau-fix-m2mf-copy-to-tiled-gart.patch new file mode 100644 index 00000000000..a1f0025c4aa --- /dev/null +++ b/queue-3.12/drm-nouveau-fix-m2mf-copy-to-tiled-gart.patch @@ -0,0 +1,96 @@ +From ce8f7699f2b6ffe4aa8368b8d9d370875accaa5f Mon Sep 17 00:00:00 2001 +From: Maarten Lankhorst +Date: Tue, 12 Nov 2013 13:34:08 +0100 +Subject: drm/nouveau: fix m2mf copy to tiled gart + +From: Maarten Lankhorst + +commit ce8f7699f2b6ffe4aa8368b8d9d370875accaa5f upstream. + +Commit de7b7d59d54852c introduced tiled GART, but a linear copy is +still performed. This may result in errors on eviction, fix it by +checking tiling from memtype. + +Signed-off-by: Maarten Lankhorst +Signed-off-by: Ben Skeggs +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/nouveau/nouveau_bo.c | 33 ++++++++------------------------- + 1 file changed, 8 insertions(+), 25 deletions(-) + +--- a/drivers/gpu/drm/nouveau/nouveau_bo.c ++++ b/drivers/gpu/drm/nouveau/nouveau_bo.c +@@ -802,25 +802,25 @@ nv50_bo_move_m2mf(struct nouveau_channel + struct ttm_mem_reg *old_mem, struct ttm_mem_reg *new_mem) + { + struct nouveau_mem *node = old_mem->mm_node; +- struct nouveau_bo *nvbo = nouveau_bo(bo); + u64 length = (new_mem->num_pages << PAGE_SHIFT); + u64 src_offset = node->vma[0].offset; + u64 dst_offset = node->vma[1].offset; ++ int src_tiled = !!node->memtype; ++ int dst_tiled = !!((struct nouveau_mem *)new_mem->mm_node)->memtype; + int ret; + + while (length) { + u32 amount, stride, height; + ++ ret = RING_SPACE(chan, 18 + 6 * (src_tiled + dst_tiled)); ++ if (ret) ++ return ret; ++ + amount = min(length, (u64)(4 * 1024 * 1024)); + stride = 16 * 4; + height = amount / stride; + +- if (old_mem->mem_type == TTM_PL_VRAM && +- nouveau_bo_tile_layout(nvbo)) { +- ret = RING_SPACE(chan, 8); +- if (ret) +- return ret; +- ++ if (src_tiled) { + BEGIN_NV04(chan, NvSubCopy, 0x0200, 7); + OUT_RING (chan, 0); + OUT_RING (chan, 0); +@@ -830,19 +830,10 @@ nv50_bo_move_m2mf(struct nouveau_channel + OUT_RING (chan, 0); + OUT_RING (chan, 0); + } else { +- ret = RING_SPACE(chan, 2); +- if (ret) +- return ret; +- + BEGIN_NV04(chan, NvSubCopy, 0x0200, 1); + OUT_RING (chan, 1); + } +- if (new_mem->mem_type == TTM_PL_VRAM && +- nouveau_bo_tile_layout(nvbo)) { +- ret = RING_SPACE(chan, 8); +- if (ret) +- return ret; +- ++ if (dst_tiled) { + BEGIN_NV04(chan, NvSubCopy, 0x021c, 7); + OUT_RING (chan, 0); + OUT_RING (chan, 0); +@@ -852,18 +843,10 @@ nv50_bo_move_m2mf(struct nouveau_channel + OUT_RING (chan, 0); + OUT_RING (chan, 0); + } else { +- ret = RING_SPACE(chan, 2); +- if (ret) +- return ret; +- + BEGIN_NV04(chan, NvSubCopy, 0x021c, 1); + OUT_RING (chan, 1); + } + +- ret = RING_SPACE(chan, 14); +- if (ret) +- return ret; +- + BEGIN_NV04(chan, NvSubCopy, 0x0238, 2); + OUT_RING (chan, upper_32_bits(src_offset)); + OUT_RING (chan, upper_32_bits(dst_offset)); diff --git a/queue-3.12/drm-rcar-du-update-plane-pitch-in-.mode_set_base-operation.patch b/queue-3.12/drm-rcar-du-update-plane-pitch-in-.mode_set_base-operation.patch new file mode 100644 index 00000000000..5ea05005127 --- /dev/null +++ b/queue-3.12/drm-rcar-du-update-plane-pitch-in-.mode_set_base-operation.patch @@ -0,0 +1,90 @@ +From eb86301f293da3c362db729a9f40ddb25755902b Mon Sep 17 00:00:00 2001 +From: Laurent Pinchart +Date: Wed, 13 Nov 2013 14:26:01 +0100 +Subject: drm/rcar-du: Update plane pitch in .mode_set_base() operation + +From: Laurent Pinchart + +commit eb86301f293da3c362db729a9f40ddb25755902b upstream. + +When setting a new frame buffer with the mode set base operation the +pitch value might change. Set the hardware plane pitch register at the +same time as the plane base address in the rcar_du_plane_update_base() +function to make sure the pitch value always matches the frame buffer. + +Signed-off-by: Laurent Pinchart +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 1 - + drivers/gpu/drm/rcar-du/rcar_du_plane.c | 21 +++++++++++---------- + 2 files changed, 11 insertions(+), 11 deletions(-) + +--- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c ++++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c +@@ -371,7 +371,6 @@ static int rcar_du_crtc_mode_set(struct + goto error; + + rcrtc->plane->format = format; +- rcrtc->plane->pitch = crtc->fb->pitches[0]; + + rcrtc->plane->src_x = x; + rcrtc->plane->src_y = y; +--- a/drivers/gpu/drm/rcar-du/rcar_du_plane.c ++++ b/drivers/gpu/drm/rcar-du/rcar_du_plane.c +@@ -104,6 +104,15 @@ void rcar_du_plane_update_base(struct rc + { + struct rcar_du_group *rgrp = plane->group; + unsigned int index = plane->hwindex; ++ u32 mwr; ++ ++ /* Memory pitch (expressed in pixels) */ ++ if (plane->format->planes == 2) ++ mwr = plane->pitch; ++ else ++ mwr = plane->pitch * 8 / plane->format->bpp; ++ ++ rcar_du_plane_write(rgrp, index, PnMWR, mwr); + + /* The Y position is expressed in raster line units and must be doubled + * for 32bpp formats, according to the R8A7790 datasheet. No mention of +@@ -133,6 +142,8 @@ void rcar_du_plane_compute_base(struct r + { + struct drm_gem_cma_object *gem; + ++ plane->pitch = fb->pitches[0]; ++ + gem = drm_fb_cma_get_gem_obj(fb, 0); + plane->dma[0] = gem->paddr + fb->offsets[0]; + +@@ -209,7 +220,6 @@ static void __rcar_du_plane_setup(struct + struct rcar_du_group *rgrp = plane->group; + u32 ddcr2 = PnDDCR2_CODE; + u32 ddcr4; +- u32 mwr; + + /* Data format + * +@@ -240,14 +250,6 @@ static void __rcar_du_plane_setup(struct + rcar_du_plane_write(rgrp, index, PnDDCR2, ddcr2); + rcar_du_plane_write(rgrp, index, PnDDCR4, ddcr4); + +- /* Memory pitch (expressed in pixels) */ +- if (plane->format->planes == 2) +- mwr = plane->pitch; +- else +- mwr = plane->pitch * 8 / plane->format->bpp; +- +- rcar_du_plane_write(rgrp, index, PnMWR, mwr); +- + /* Destination position and size */ + rcar_du_plane_write(rgrp, index, PnDSXR, plane->width); + rcar_du_plane_write(rgrp, index, PnDSYR, plane->height); +@@ -309,7 +311,6 @@ rcar_du_plane_update(struct drm_plane *p + + rplane->crtc = crtc; + rplane->format = format; +- rplane->pitch = fb->pitches[0]; + + rplane->src_x = src_x >> 16; + rplane->src_y = src_y >> 16; diff --git a/queue-3.12/drm-vmwgfx-fix-regression-caused-by-drm-ttm-make-ttm-reservation-calls-behave-like-reservation-calls.patch b/queue-3.12/drm-vmwgfx-fix-regression-caused-by-drm-ttm-make-ttm-reservation-calls-behave-like-reservation-calls.patch new file mode 100644 index 00000000000..e298c96da06 --- /dev/null +++ b/queue-3.12/drm-vmwgfx-fix-regression-caused-by-drm-ttm-make-ttm-reservation-calls-behave-like-reservation-calls.patch @@ -0,0 +1,54 @@ +From cf5e3413337309050c05e13dcebe85b7194a21e5 Mon Sep 17 00:00:00 2001 +From: Thomas Hellstrom +Date: Thu, 30 Jan 2014 10:58:19 +0100 +Subject: drm/vmwgfx: Fix regression caused by "drm/ttm: make ttm reservation calls behave like reservation calls" + +From: Thomas Hellstrom + +commit cf5e3413337309050c05e13dcebe85b7194a21e5 upstream. + +The call to ttm_eu_backoff_reservation() as part of an error path would cause +a lock imbalance if the reservation ticket was not initialized. This error is +easily triggered from user-space by submitting a bogus command stream. + +Signed-off-by: Thomas Hellstrom +Reviewed-by: Jakob Bornecrantz +Cc: Maarten Lankhorst +Cc: Jerome Glisse +Cc: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +@@ -1483,11 +1483,11 @@ int vmw_execbuf_process(struct drm_file + ret = vmw_cmd_check_all(dev_priv, sw_context, kernel_commands, + command_size); + if (unlikely(ret != 0)) +- goto out_err; ++ goto out_err_nores; + + ret = vmw_resources_reserve(sw_context); + if (unlikely(ret != 0)) +- goto out_err; ++ goto out_err_nores; + + ret = ttm_eu_reserve_buffers(&ticket, &sw_context->validate_nodes); + if (unlikely(ret != 0)) +@@ -1569,10 +1569,11 @@ int vmw_execbuf_process(struct drm_file + return 0; + + out_err: +- vmw_resource_relocations_free(&sw_context->res_relocations); +- vmw_free_relocations(sw_context); + ttm_eu_backoff_reservation(&ticket, &sw_context->validate_nodes); ++out_err_nores: + vmw_resource_list_unreserve(&sw_context->resource_list, true); ++ vmw_resource_relocations_free(&sw_context->res_relocations); ++ vmw_free_relocations(sw_context); + vmw_clear_validations(sw_context); + if (unlikely(dev_priv->pinned_bo != NULL && + !dev_priv->query_cid_valid)) diff --git a/queue-3.12/i915-remove-pm_qos-request-on-error.patch b/queue-3.12/i915-remove-pm_qos-request-on-error.patch new file mode 100644 index 00000000000..54c1cb1083c --- /dev/null +++ b/queue-3.12/i915-remove-pm_qos-request-on-error.patch @@ -0,0 +1,49 @@ +From 22accca01713b13dac386ca90b787aadf88f6551 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Sat, 25 Jan 2014 10:13:37 +0100 +Subject: i915: remove pm_qos request on error + +From: Stanislaw Gruszka + +commit 22accca01713b13dac386ca90b787aadf88f6551 upstream. + +Not removing pm qos request and free memory for it can cause crash, +when some other driver use pm qos. For example, this oops: + +BUG: unable to handle kernel paging request at fffffffffffffff8 +IP: [] plist_add+0x5b/0xd0 +Call Trace: + [] pm_qos_update_target+0x125/0x1e0 + [] pm_qos_add_request+0x91/0x100 + [] e1000_open+0xe4/0x5b0 [e1000e] + +was caused by earlier i915 probe failure: + +[drm:i915_report_and_clear_eir] *ERROR* EIR stuck: 0x00000010, masking +[drm:init_ring_common] *ERROR* render ring initialization failed ctl 0001f001 head 00003004 tail 00000000 start 00003000 +[drm:i915_driver_load] *ERROR* failed to init modeset +i915: probe of 0000:00:02.0 failed with error -5 + +Bug report: +http://bugzilla.redhat.com/show_bug.cgi?id=1057533 + +Reported-by: Giandomenico De Tullio +Signed-off-by: Stanislaw Gruszka +[danvet: Drop unnecessary code movement.] +Signed-off-by: Daniel Vetter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_dma.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/i915/i915_dma.c ++++ b/drivers/gpu/drm/i915/i915_dma.c +@@ -1683,6 +1683,7 @@ out_gem_unload: + + intel_teardown_gmbus(dev); + intel_teardown_mchbar(dev); ++ pm_qos_remove_request(&dev_priv->pm_qos); + destroy_workqueue(dev_priv->wq); + out_mtrrfree: + arch_phys_wc_del(dev_priv->gtt.mtrr); diff --git a/queue-3.12/series b/queue-3.12/series index 2bb76ac2777..6292304de68 100644 --- a/queue-3.12/series +++ b/queue-3.12/series @@ -79,3 +79,19 @@ drm-radeon-fix-dac-interrupt-handling-on-dce5.patch drm-radeon-dce4-clear-bios-scratch-dpms-bit-v2.patch drm-radeon-dce8-workaround-for-atom-blankcrtc-table.patch dm-sysfs-fix-a-module-unload-race.patch +drm-nouveau-fix-m2mf-copy-to-tiled-gart.patch +drm-nouveau-falcon-use-vmalloc-to-create-firwmare-copies.patch +drm-i915-flush-outstanding-requests-before-allocating-new-seqno.patch +drm-i915-fix-the-offset-issue-for-the-stolen-gem-objects.patch +drm-i915-vlv2-fix-hotplug-detect-bits.patch +i915-remove-pm_qos-request-on-error.patch +drm-i915-decouple-gpu-error-reporting-from-ring-initialisation.patch +drm-cirrus-correct-register-values-for-16bpp.patch +drm-gem-always-initialize-the-gem-object-in-object_init.patch +drm-rcar-du-update-plane-pitch-in-.mode_set_base-operation.patch +drm-gma500-lock-struct_mutex-around-cursor-updates.patch +drm-ast-cirrus-mgag200-use-drm_can_sleep.patch +drm-vmwgfx-fix-regression-caused-by-drm-ttm-make-ttm-reservation-calls-behave-like-reservation-calls.patch +drm-mgag200-fix-oops-in-cursor-code.patch +drm-mgag200-fix-typo-causing-bw-limits-to-be-ignored-on-some-chips.patch +drm-mgag200-ast-cirrus-fix-regression-with-drm_can_sleep-conversion.patch