From: Greg Kroah-Hartman Date: Tue, 2 Apr 2013 19:12:27 +0000 (-0700) Subject: 3.0-stable patches X-Git-Tag: v3.8.6~21 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=97e033be6fddf6745239b1ed3620789eea106105;p=thirdparty%2Fkernel%2Fstable-queue.git 3.0-stable patches added patches: drm-i915-don-t-clobber-crtc-fb-when-queue_flip-fails.patch drm-i915-don-t-set-unpin_work-if-vblank_get-fails.patch --- diff --git a/queue-3.0/drm-i915-don-t-clobber-crtc-fb-when-queue_flip-fails.patch b/queue-3.0/drm-i915-don-t-clobber-crtc-fb-when-queue_flip-fails.patch new file mode 100644 index 00000000000..76bab709e47 --- /dev/null +++ b/queue-3.0/drm-i915-don-t-clobber-crtc-fb-when-queue_flip-fails.patch @@ -0,0 +1,74 @@ +From 4a35f83b2b7c6aae3fc0d1c4554fdc99dc33ad07 Mon Sep 17 00:00:00 2001 +From: Ville Syrjälä +Date: Fri, 22 Feb 2013 16:53:38 +0200 +Subject: drm/i915: Don't clobber crtc->fb when queue_flip fails + +From: Ville Syrjälä + +commit 4a35f83b2b7c6aae3fc0d1c4554fdc99dc33ad07 upstream. + +Restore crtc->fb to the old framebuffer if queue_flip fails. + +While at it, kill the pointless intel_fb temp variable. + +v2: Update crtc->fb before queue_flip and restore it back + after a failure. + +[Backported for 3.0-stable. Adjusted context. Please +cherry-pick commit 7317c75e66fce0c9f82fbe6f72f7e5256b315422 +upstream before this patch as it provides necessary context +and fixes a panic.] + +Signed-off-by: Ville Syrjälä +Reviewed-by: Chris Wilson +Reported-and-Tested-by: Mika Kuoppala +Signed-off-by: Daniel Vetter +Signed-off-by: Lingzhu Xiang +Reviewed-by: CAI Qian +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_display.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -6507,8 +6507,8 @@ static int intel_crtc_page_flip(struct d + { + struct drm_device *dev = crtc->dev; + struct drm_i915_private *dev_priv = dev->dev_private; +- struct intel_framebuffer *intel_fb; +- struct drm_i915_gem_object *obj; ++ struct drm_framebuffer *old_fb = crtc->fb; ++ struct drm_i915_gem_object *obj = to_intel_framebuffer(fb)->obj; + struct intel_crtc *intel_crtc = to_intel_crtc(crtc); + struct intel_unpin_work *work; + unsigned long flags; +@@ -6520,8 +6520,7 @@ static int intel_crtc_page_flip(struct d + + work->event = event; + work->dev = crtc->dev; +- intel_fb = to_intel_framebuffer(crtc->fb); +- work->old_fb_obj = intel_fb->obj; ++ work->old_fb_obj = to_intel_framebuffer(old_fb)->obj; + INIT_WORK(&work->work, intel_unpin_work_fn); + + ret = drm_vblank_get(dev, intel_crtc->pipe); +@@ -6541,9 +6540,6 @@ static int intel_crtc_page_flip(struct d + intel_crtc->unpin_work = work; + spin_unlock_irqrestore(&dev->event_lock, flags); + +- intel_fb = to_intel_framebuffer(fb); +- obj = intel_fb->obj; +- + mutex_lock(&dev->struct_mutex); + + /* Reference the objects for the scheduled work. */ +@@ -6573,6 +6569,7 @@ static int intel_crtc_page_flip(struct d + + cleanup_pending: + atomic_sub(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip); ++ crtc->fb = old_fb; + drm_gem_object_unreference(&work->old_fb_obj->base); + drm_gem_object_unreference(&obj->base); + mutex_unlock(&dev->struct_mutex); diff --git a/queue-3.0/drm-i915-don-t-set-unpin_work-if-vblank_get-fails.patch b/queue-3.0/drm-i915-don-t-set-unpin_work-if-vblank_get-fails.patch new file mode 100644 index 00000000000..ee17f59d9a5 --- /dev/null +++ b/queue-3.0/drm-i915-don-t-set-unpin_work-if-vblank_get-fails.patch @@ -0,0 +1,70 @@ +From 7317c75e66fce0c9f82fbe6f72f7e5256b315422 Mon Sep 17 00:00:00 2001 +From: Jesse Barnes +Date: Mon, 29 Aug 2011 09:45:28 -0700 +Subject: drm/i915: don't set unpin_work if vblank_get fails + +From: Jesse Barnes + +commit 7317c75e66fce0c9f82fbe6f72f7e5256b315422 upstream. + +This fixes a race where we may try to finish a page flip and decrement +the refcount even if our vblank_get failed and we ended up with a +spurious flip pending interrupt. + +Fixes https://bugs.freedesktop.org/show_bug.cgi?id=34211. + +Signed-off-by: Jesse Barnes +Signed-off-by: Keith Packard +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_display.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -6524,11 +6524,16 @@ static int intel_crtc_page_flip(struct d + work->old_fb_obj = intel_fb->obj; + INIT_WORK(&work->work, intel_unpin_work_fn); + ++ ret = drm_vblank_get(dev, intel_crtc->pipe); ++ if (ret) ++ goto free_work; ++ + /* We borrow the event spin lock for protecting unpin_work */ + spin_lock_irqsave(&dev->event_lock, flags); + if (intel_crtc->unpin_work) { + spin_unlock_irqrestore(&dev->event_lock, flags); + kfree(work); ++ drm_vblank_put(dev, intel_crtc->pipe); + + DRM_DEBUG_DRIVER("flip queue: crtc already busy\n"); + return -EBUSY; +@@ -6547,10 +6552,6 @@ static int intel_crtc_page_flip(struct d + + crtc->fb = fb; + +- ret = drm_vblank_get(dev, intel_crtc->pipe); +- if (ret) +- goto cleanup_objs; +- + work->pending_flip_obj = obj; + + work->enable_stall_check = true; +@@ -6572,7 +6573,6 @@ static int intel_crtc_page_flip(struct d + + cleanup_pending: + atomic_sub(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip); +-cleanup_objs: + drm_gem_object_unreference(&work->old_fb_obj->base); + drm_gem_object_unreference(&obj->base); + mutex_unlock(&dev->struct_mutex); +@@ -6581,6 +6581,8 @@ cleanup_objs: + intel_crtc->unpin_work = NULL; + spin_unlock_irqrestore(&dev->event_lock, flags); + ++ drm_vblank_put(dev, intel_crtc->pipe); ++free_work: + kfree(work); + + return ret; diff --git a/queue-3.0/series b/queue-3.0/series index 3003ca9ca16..deebd5e82bf 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -31,3 +31,5 @@ mm-hotplug-correctly-add-new-zone-to-all-other-nodes-zone-lists.patch kvm-x86-invalid-opcode-oops-on-set_sregs-with-osxsave-bit-set-cve-2012-4461.patch loop-prevent-bdev-freeing-while-device-in-use.patch nfsd4-reject-negative-acl-lengths.patch +drm-i915-don-t-set-unpin_work-if-vblank_get-fails.patch +drm-i915-don-t-clobber-crtc-fb-when-queue_flip-fails.patch