From 1e32335dc5be925e0c5b809a8a951db4c4c7317f Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 10 Feb 2014 16:31:42 -0800 Subject: [PATCH] 3.13-stable patches added patches: drm-ast-cirrus-mgag200-use-drm_can_sleep.patch drm-cirrus-correct-register-values-for-16bpp.patch drm-gem-always-initialize-the-gem-object-in-object_init.patch drm-gma500-lock-struct_mutex-around-cursor-updates.patch drm-i915-decouple-gpu-error-reporting-from-ring-initialisation.patch drm-i915-fix-the-offset-issue-for-the-stolen-gem-objects.patch drm-i915-flush-outstanding-requests-before-allocating-new-seqno.patch drm-i915-vlv2-fix-hotplug-detect-bits.patch drm-mgag200-ast-cirrus-fix-regression-with-drm_can_sleep-conversion.patch drm-mgag200-fix-oops-in-cursor-code.patch drm-mgag200-fix-typo-causing-bw-limits-to-be-ignored-on-some-chips.patch drm-nouveau-falcon-use-vmalloc-to-create-firwmare-copies.patch drm-nouveau-fix-lock-unbalance-in-nouveau_crtc_page_flip.patch drm-nouveau-fix-m2mf-copy-to-tiled-gart.patch drm-nouveau-hold-mutex-while-syncing-to-kernel-channel.patch drm-rcar-du-update-plane-pitch-in-.mode_set_base-operation.patch drm-vmwgfx-fix-regression-caused-by-drm-ttm-make-ttm-reservation-calls-behave-like-reservation-calls.patch drm-vmwgfx-fix-the-driver-for-large-dma-addresses.patch i915-remove-pm_qos-request-on-error.patch --- ...ast-cirrus-mgag200-use-drm_can_sleep.patch | 56 ++++ ...us-correct-register-values-for-16bpp.patch | 39 +++ ...ialize-the-gem-object-in-object_init.patch | 57 ++++ ...k-struct_mutex-around-cursor-updates.patch | 64 ++++ ...r-reporting-from-ring-initialisation.patch | 127 +++++++ ...set-issue-for-the-stolen-gem-objects.patch | 42 +++ ...requests-before-allocating-new-seqno.patch | 78 +++++ ...rm-i915-vlv2-fix-hotplug-detect-bits.patch | 100 ++++++ ...ession-with-drm_can_sleep-conversion.patch | 54 +++ .../drm-mgag200-fix-oops-in-cursor-code.patch | 43 +++ ...w-limits-to-be-ignored-on-some-chips.patch | 36 ++ ...se-vmalloc-to-create-firwmare-copies.patch | 77 +++++ ...-unbalance-in-nouveau_crtc_page_flip.patch | 32 ++ ...-nouveau-fix-m2mf-copy-to-tiled-gart.patch | 96 ++++++ ...utex-while-syncing-to-kernel-channel.patch | 51 +++ ...ne-pitch-in-.mode_set_base-operation.patch | 90 +++++ ...-calls-behave-like-reservation-calls.patch | 54 +++ ...x-the-driver-for-large-dma-addresses.patch | 314 ++++++++++++++++++ .../i915-remove-pm_qos-request-on-error.patch | 49 +++ queue-3.13/series | 19 ++ 20 files changed, 1478 insertions(+) create mode 100644 queue-3.13/drm-ast-cirrus-mgag200-use-drm_can_sleep.patch create mode 100644 queue-3.13/drm-cirrus-correct-register-values-for-16bpp.patch create mode 100644 queue-3.13/drm-gem-always-initialize-the-gem-object-in-object_init.patch create mode 100644 queue-3.13/drm-gma500-lock-struct_mutex-around-cursor-updates.patch create mode 100644 queue-3.13/drm-i915-decouple-gpu-error-reporting-from-ring-initialisation.patch create mode 100644 queue-3.13/drm-i915-fix-the-offset-issue-for-the-stolen-gem-objects.patch create mode 100644 queue-3.13/drm-i915-flush-outstanding-requests-before-allocating-new-seqno.patch create mode 100644 queue-3.13/drm-i915-vlv2-fix-hotplug-detect-bits.patch create mode 100644 queue-3.13/drm-mgag200-ast-cirrus-fix-regression-with-drm_can_sleep-conversion.patch create mode 100644 queue-3.13/drm-mgag200-fix-oops-in-cursor-code.patch create mode 100644 queue-3.13/drm-mgag200-fix-typo-causing-bw-limits-to-be-ignored-on-some-chips.patch create mode 100644 queue-3.13/drm-nouveau-falcon-use-vmalloc-to-create-firwmare-copies.patch create mode 100644 queue-3.13/drm-nouveau-fix-lock-unbalance-in-nouveau_crtc_page_flip.patch create mode 100644 queue-3.13/drm-nouveau-fix-m2mf-copy-to-tiled-gart.patch create mode 100644 queue-3.13/drm-nouveau-hold-mutex-while-syncing-to-kernel-channel.patch create mode 100644 queue-3.13/drm-rcar-du-update-plane-pitch-in-.mode_set_base-operation.patch create mode 100644 queue-3.13/drm-vmwgfx-fix-regression-caused-by-drm-ttm-make-ttm-reservation-calls-behave-like-reservation-calls.patch create mode 100644 queue-3.13/drm-vmwgfx-fix-the-driver-for-large-dma-addresses.patch create mode 100644 queue-3.13/i915-remove-pm_qos-request-on-error.patch diff --git a/queue-3.13/drm-ast-cirrus-mgag200-use-drm_can_sleep.patch b/queue-3.13/drm-ast-cirrus-mgag200-use-drm_can_sleep.patch new file mode 100644 index 00000000000..10e17bd5950 --- /dev/null +++ b/queue-3.13/drm-ast-cirrus-mgag200-use-drm_can_sleep.patch @@ -0,0 +1,56 @@ +From f4b4718b61d1d5a7442a4fd6863ea80c3a10e508 Mon Sep 17 00:00:00 2001 +From: Dave Airlie +Date: Fri, 24 Jan 2014 09:50:18 +1000 +Subject: drm: ast,cirrus,mgag200: use drm_can_sleep + +From: Dave Airlie + +commit f4b4718b61d1d5a7442a4fd6863ea80c3a10e508 upstream. + +these 3 were checking in_interrupt but we have situations where +calling vunmap under this could cause a BUG to be hit in +smp_call_function_many. Use the drm_can_sleep macro instead, +which should stop this path from been taken in this case. + +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/ast/ast_fb.c | 2 +- + drivers/gpu/drm/cirrus/cirrus_fbdev.c | 2 +- + drivers/gpu/drm/mgag200/mgag200_fb.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/ast/ast_fb.c ++++ b/drivers/gpu/drm/ast/ast_fb.c +@@ -65,7 +65,7 @@ static void ast_dirty_update(struct ast_ + * then the BO is being moved and we should + * store up the damage until later. + */ +- if (!in_interrupt()) ++ if (!drm_can_sleep()) + ret = ast_bo_reserve(bo, true); + if (ret) { + if (ret != -EBUSY) +--- a/drivers/gpu/drm/cirrus/cirrus_fbdev.c ++++ b/drivers/gpu/drm/cirrus/cirrus_fbdev.c +@@ -39,7 +39,7 @@ static void cirrus_dirty_update(struct c + * then the BO is being moved and we should + * store up the damage until later. + */ +- if (!in_interrupt()) ++ if (!drm_can_sleep()) + ret = cirrus_bo_reserve(bo, true); + if (ret) { + if (ret != -EBUSY) +--- a/drivers/gpu/drm/mgag200/mgag200_fb.c ++++ b/drivers/gpu/drm/mgag200/mgag200_fb.c +@@ -41,7 +41,7 @@ static void mga_dirty_update(struct mga_ + * then the BO is being moved and we should + * store up the damage until later. + */ +- if (!in_interrupt()) ++ if (!drm_can_sleep()) + ret = mgag200_bo_reserve(bo, true); + if (ret) { + if (ret != -EBUSY) diff --git a/queue-3.13/drm-cirrus-correct-register-values-for-16bpp.patch b/queue-3.13/drm-cirrus-correct-register-values-for-16bpp.patch new file mode 100644 index 00000000000..34a45ccaa71 --- /dev/null +++ b/queue-3.13/drm-cirrus-correct-register-values-for-16bpp.patch @@ -0,0 +1,39 @@ +From 2510538fa000dd13a3e57b79bf073ffb1748976c Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 21 Jan 2014 14:34:51 -0800 +Subject: drm/cirrus: correct register values for 16bpp + +From: Takashi Iwai + +commit 2510538fa000dd13a3e57b79bf073ffb1748976c upstream. + +When the mode is set with 16bpp on QEMU, the output gets totally broken. +The culprit is the bogus register values set for 16bpp, which was likely +copied from from a wrong place. + +Addresses https://bugzilla.novell.com/show_bug.cgi?id=799216 + +Signed-off-by: Takashi Iwai +Signed-off-by: Jiri Slaby +Cc: David Airlie +Signed-off-by: Andrew Morton +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/cirrus/cirrus_mode.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/cirrus/cirrus_mode.c ++++ b/drivers/gpu/drm/cirrus/cirrus_mode.c +@@ -273,8 +273,8 @@ static int cirrus_crtc_mode_set(struct d + sr07 |= 0x11; + break; + case 16: +- sr07 |= 0xc1; +- hdr = 0xc0; ++ sr07 |= 0x17; ++ hdr = 0xc1; + break; + case 24: + sr07 |= 0x15; diff --git a/queue-3.13/drm-gem-always-initialize-the-gem-object-in-object_init.patch b/queue-3.13/drm-gem-always-initialize-the-gem-object-in-object_init.patch new file mode 100644 index 00000000000..75e5568f749 --- /dev/null +++ b/queue-3.13/drm-gem-always-initialize-the-gem-object-in-object_init.patch @@ -0,0 +1,57 @@ +From 6ab11a2635ce988ebc2e798947beb72cf7324119 Mon Sep 17 00:00:00 2001 +From: Daniel Vetter +Date: Mon, 20 Jan 2014 08:21:54 +0100 +Subject: drm/gem: Always initialize the gem object in object_init + +From: Daniel Vetter + +commit 6ab11a2635ce988ebc2e798947beb72cf7324119 upstream. + +At least drm/i915 expects that the obj->dev pointer is set even in +failure paths. Specifically when the shmem initialization fails we +call i915_gem_object_free which needs to deref obj->base.dev to get at +the slab pointer in the device private structure. And the shmem +allocation can easily fail when userspace is hitting open file limits. + +Doing the structure init even when the shmem file allocation fails +prevents this Oops. + +This is a regression from + +commit 89c8233f82d9c8af5b20e72e4a185a38a7d3c50b +Author: David Herrmann +Date: Thu Jul 11 11:56:32 2013 +0200 + + drm/gem: simplify object initialization + +v2: Add regression note which Chris supplied. + +Testcase: igt/gem_fd_exhaustion +Reported-and-Suggested-by: Linus Torvalds +Cc: Linus Torvalds +References: http://lists.freedesktop.org/archives/intel-gfx/2014-January/038433.html +Reviewed-by: David Herrmann +Cc: David Herrmann +Signed-off-by: Daniel Vetter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_gem.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_gem.c ++++ b/drivers/gpu/drm/drm_gem.c +@@ -129,11 +129,12 @@ int drm_gem_object_init(struct drm_devic + { + struct file *filp; + ++ drm_gem_private_object_init(dev, obj, size); ++ + filp = shmem_file_setup("drm mm object", size, VM_NORESERVE); + if (IS_ERR(filp)) + return PTR_ERR(filp); + +- drm_gem_private_object_init(dev, obj, size); + obj->filp = filp; + + return 0; diff --git a/queue-3.13/drm-gma500-lock-struct_mutex-around-cursor-updates.patch b/queue-3.13/drm-gma500-lock-struct_mutex-around-cursor-updates.patch new file mode 100644 index 00000000000..eb6aa3e621c --- /dev/null +++ b/queue-3.13/drm-gma500-lock-struct_mutex-around-cursor-updates.patch @@ -0,0 +1,64 @@ +From 631794b44bd3dbfba37074954d5c584c9e8725f0 Mon Sep 17 00:00:00 2001 +From: Patrik Jakobsson +Date: Wed, 8 Jan 2014 19:30:40 +0100 +Subject: drm/gma500: Lock struct_mutex around cursor updates + +From: Patrik Jakobsson + +commit 631794b44bd3dbfba37074954d5c584c9e8725f0 upstream. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=64361 +Signed-off-by: Patrik Jakobsson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/gma500/gma_display.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/gma500/gma_display.c ++++ b/drivers/gpu/drm/gma500/gma_display.c +@@ -349,6 +349,7 @@ int gma_crtc_cursor_set(struct drm_crtc + /* If we didn't get a handle then turn the cursor off */ + if (!handle) { + temp = CURSOR_MODE_DISABLE; ++ mutex_lock(&dev->struct_mutex); + + if (gma_power_begin(dev, false)) { + REG_WRITE(control, temp); +@@ -365,6 +366,7 @@ int gma_crtc_cursor_set(struct drm_crtc + gma_crtc->cursor_obj = NULL; + } + ++ mutex_unlock(&dev->struct_mutex); + return 0; + } + +@@ -374,9 +376,12 @@ int gma_crtc_cursor_set(struct drm_crtc + return -EINVAL; + } + ++ mutex_lock(&dev->struct_mutex); + obj = drm_gem_object_lookup(dev, file_priv, handle); +- if (!obj) +- return -ENOENT; ++ if (!obj) { ++ ret = -ENOENT; ++ goto unlock; ++ } + + if (obj->size < width * height * 4) { + dev_dbg(dev->dev, "Buffer is too small\n"); +@@ -440,10 +445,13 @@ int gma_crtc_cursor_set(struct drm_crtc + } + + gma_crtc->cursor_obj = obj; ++unlock: ++ mutex_unlock(&dev->struct_mutex); + return ret; + + unref_cursor: + drm_gem_object_unreference(obj); ++ mutex_unlock(&dev->struct_mutex); + return ret; + } + diff --git a/queue-3.13/drm-i915-decouple-gpu-error-reporting-from-ring-initialisation.patch b/queue-3.13/drm-i915-decouple-gpu-error-reporting-from-ring-initialisation.patch new file mode 100644 index 00000000000..4958bae5fd4 --- /dev/null +++ b/queue-3.13/drm-i915-decouple-gpu-error-reporting-from-ring-initialisation.patch @@ -0,0 +1,127 @@ +From 372fbb8e3927fc76b0f842d8eb8a798a71d8960f Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Mon, 27 Jan 2014 13:52:34 +0000 +Subject: drm/i915: Decouple GPU error reporting from ring initialisation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chris Wilson + +commit 372fbb8e3927fc76b0f842d8eb8a798a71d8960f upstream. + +Currently we report through our error state only the rings that have +been initialised (as detected by ring->obj). This check is done after +the GPU reset and ring re-initialisation, which means that the software +state may not be the same as when we captured the hardware error and we +may not print out any of the vital information for debugging the hang. + +This (and the implied object leak) is a regression from + +commit 3d57e5bd1284f44e325f3a52d966259ed42f9e05 +Author: Ben Widawsky +Date: Mon Oct 14 10:01:36 2013 -0700 + + drm/i915: Do a fuller init after reset + +Note that we are already starting to get bug reports with incomplete +error states from 3.13, which also hampers debugging userspace driver +issues. + +v2: Prevent a NULL dereference on 830gm/845g after a GPU reset where + the scratch obj may be NULL. + +Signed-off-by: Chris Wilson +Cc: Ben Widawsky +Cc: Ville Syrjälä +References: https://bugs.freedesktop.org/show_bug.cgi?id=74094 +Reviewed-by: Ville Syrjälä +[danvet: Add a bit of fluff to make it clear we need this expedited in +stable.] +Signed-off-by: Daniel Vetter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_drv.h | 1 + + drivers/gpu/drm/i915/i915_gpu_error.c | 22 +++++++++++++++------- + 2 files changed, 16 insertions(+), 7 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -317,6 +317,7 @@ struct drm_i915_error_state { + u64 fence[I915_MAX_NUM_FENCES]; + struct timeval time; + struct drm_i915_error_ring { ++ bool valid; + struct drm_i915_error_object { + int page_count; + u32 gtt_offset; +--- a/drivers/gpu/drm/i915/i915_gpu_error.c ++++ b/drivers/gpu/drm/i915/i915_gpu_error.c +@@ -239,6 +239,9 @@ static void i915_ring_error_state(struct + unsigned ring) + { + BUG_ON(ring >= I915_NUM_RINGS); /* shut up confused gcc */ ++ if (!error->ring[ring].valid) ++ return; ++ + err_printf(m, "%s command stream:\n", ring_str(ring)); + err_printf(m, " HEAD: 0x%08x\n", error->head[ring]); + err_printf(m, " TAIL: 0x%08x\n", error->tail[ring]); +@@ -294,7 +297,6 @@ int i915_error_state_to_str(struct drm_i + struct drm_device *dev = error_priv->dev; + drm_i915_private_t *dev_priv = dev->dev_private; + struct drm_i915_error_state *error = error_priv->error; +- struct intel_ring_buffer *ring; + int i, j, page, offset, elt; + + if (!error) { +@@ -329,7 +331,7 @@ int i915_error_state_to_str(struct drm_i + if (INTEL_INFO(dev)->gen == 7) + err_printf(m, "ERR_INT: 0x%08x\n", error->err_int); + +- for_each_ring(ring, dev_priv, i) ++ for (i = 0; i < ARRAY_SIZE(error->ring); i++) + i915_ring_error_state(m, dev, error, i); + + if (error->active_bo) +@@ -386,8 +388,7 @@ int i915_error_state_to_str(struct drm_i + } + } + +- obj = error->ring[i].ctx; +- if (obj) { ++ if ((obj = error->ring[i].ctx)) { + err_printf(m, "%s --- HW Context = 0x%08x\n", + dev_priv->ring[i].name, + obj->gtt_offset); +@@ -668,7 +669,8 @@ i915_error_first_batchbuffer(struct drm_ + return NULL; + + obj = ring->scratch.obj; +- if (acthd >= i915_gem_obj_ggtt_offset(obj) && ++ if (obj != NULL && ++ acthd >= i915_gem_obj_ggtt_offset(obj) && + acthd < i915_gem_obj_ggtt_offset(obj) + obj->base.size) + return i915_error_object_create(dev_priv, obj); + } +@@ -775,11 +777,17 @@ static void i915_gem_record_rings(struct + struct drm_i915_error_state *error) + { + struct drm_i915_private *dev_priv = dev->dev_private; +- struct intel_ring_buffer *ring; + struct drm_i915_gem_request *request; + int i, count; + +- for_each_ring(ring, dev_priv, i) { ++ for (i = 0; i < I915_NUM_RINGS; i++) { ++ struct intel_ring_buffer *ring = &dev_priv->ring[i]; ++ ++ if (ring->dev == NULL) ++ continue; ++ ++ error->ring[i].valid = true; ++ + i915_record_ring_state(dev, error, ring); + + error->ring[i].batchbuffer = diff --git a/queue-3.13/drm-i915-fix-the-offset-issue-for-the-stolen-gem-objects.patch b/queue-3.13/drm-i915-fix-the-offset-issue-for-the-stolen-gem-objects.patch new file mode 100644 index 00000000000..af5f2cdbffd --- /dev/null +++ b/queue-3.13/drm-i915-fix-the-offset-issue-for-the-stolen-gem-objects.patch @@ -0,0 +1,42 @@ +From ec14ba47791965d2c08e0a681ff44eacbf3c4553 Mon Sep 17 00:00:00 2001 +From: Akash Goel +Date: Mon, 13 Jan 2014 16:24:45 +0530 +Subject: drm/i915: Fix the offset issue for the stolen GEM objects + +From: Akash Goel + +commit ec14ba47791965d2c08e0a681ff44eacbf3c4553 upstream. + +The 'offset' field of the 'scatterlist' structure was wrongly +programmed with the offset value from the base of stolen area, +whereas this field indicates the offset from where the interested +data starts within the first PAGE pointed to by 'scattterlist' +structure. As a result when a new GEM object allocated from stolen +area is mapped to GTT, it could lead to an overwrite of GTT entries +as the page count calculation will go wrong, refer the function +'sg_page_count'. + +v2: Modified the commit message. (Chris) + +Signed-off-by: Akash Goel +Reviewed-by: Jesse Barnes +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=71908 +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=69104 +Signed-off-by: Daniel Vetter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_gem_stolen.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/i915_gem_stolen.c ++++ b/drivers/gpu/drm/i915/i915_gem_stolen.c +@@ -250,7 +250,7 @@ i915_pages_create_for_stolen(struct drm_ + } + + sg = st->sgl; +- sg->offset = offset; ++ sg->offset = 0; + sg->length = size; + + sg_dma_address(sg) = (dma_addr_t)dev_priv->mm.stolen_base + offset; diff --git a/queue-3.13/drm-i915-flush-outstanding-requests-before-allocating-new-seqno.patch b/queue-3.13/drm-i915-flush-outstanding-requests-before-allocating-new-seqno.patch new file mode 100644 index 00000000000..28781aba5b6 --- /dev/null +++ b/queue-3.13/drm-i915-flush-outstanding-requests-before-allocating-new-seqno.patch @@ -0,0 +1,78 @@ +From 304d695c3dc8eb65206b9eaf16f8d1a41510d1cf Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Thu, 2 Jan 2014 14:32:35 +0000 +Subject: drm/i915: Flush outstanding requests before allocating new seqno + +From: Chris Wilson + +commit 304d695c3dc8eb65206b9eaf16f8d1a41510d1cf upstream. + +In very rare cases (such as a memory failure stress test) it is possible +to fill the entire ring without emitting a request. Under this +circumstance, the outstanding request is flushed and waited upon. After +space on the ring is cleared, we return to emitting the new command - +except that we just cleared the seqno allocated for this operation and +trigger the sanity check that a request is only ever emitted with a +valid seqno. The fix is to rearrange the code to make sure the +allocation of the seqno for this operation is after any required flushes +of outstanding operations. + +The bug exists since the preallocation was introduced in +commit 9d7730914f4cd496e356acfab95b41075aa8eae8 +Author: Chris Wilson +Date: Tue Nov 27 16:22:52 2012 +0000 + + drm/i915: Preallocate next seqno before touching the ring + +Signed-off-by: Chris Wilson +Cc: Mika Kuoppala +Cc: Daniel Vetter +Signed-off-by: Chris Wilson +Reviewed-by: Jani Nikula +Signed-off-by: Daniel Vetter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_ringbuffer.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_ringbuffer.c ++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c +@@ -1611,8 +1611,8 @@ intel_ring_alloc_seqno(struct intel_ring + return i915_gem_get_seqno(ring->dev, &ring->outstanding_lazy_seqno); + } + +-static int __intel_ring_begin(struct intel_ring_buffer *ring, +- int bytes) ++static int __intel_ring_prepare(struct intel_ring_buffer *ring, ++ int bytes) + { + int ret; + +@@ -1628,7 +1628,6 @@ static int __intel_ring_begin(struct int + return ret; + } + +- ring->space -= bytes; + return 0; + } + +@@ -1643,12 +1642,17 @@ int intel_ring_begin(struct intel_ring_b + if (ret) + return ret; + ++ ret = __intel_ring_prepare(ring, num_dwords * sizeof(uint32_t)); ++ if (ret) ++ return ret; ++ + /* Preallocate the olr before touching the ring */ + ret = intel_ring_alloc_seqno(ring); + if (ret) + return ret; + +- return __intel_ring_begin(ring, num_dwords * sizeof(uint32_t)); ++ ring->space -= num_dwords * sizeof(uint32_t); ++ return 0; + } + + void intel_ring_init_seqno(struct intel_ring_buffer *ring, u32 seqno) diff --git a/queue-3.13/drm-i915-vlv2-fix-hotplug-detect-bits.patch b/queue-3.13/drm-i915-vlv2-fix-hotplug-detect-bits.patch new file mode 100644 index 00000000000..4b99c9efdd0 --- /dev/null +++ b/queue-3.13/drm-i915-vlv2-fix-hotplug-detect-bits.patch @@ -0,0 +1,100 @@ +From 232a6ee9af8adb185640f67fcaaa9014a9aa0573 Mon Sep 17 00:00:00 2001 +From: Todd Previte +Date: Thu, 23 Jan 2014 00:13:41 -0700 +Subject: drm/i915: VLV2 - Fix hotplug detect bits + +From: Todd Previte + +commit 232a6ee9af8adb185640f67fcaaa9014a9aa0573 upstream. + +Add new definitions for hotplug live status bits for VLV2 since they're +in reverse order from the gen4x ones. + +Changelog: +- Restored gen4 bit definitions +- Added new definitions for VLV2 +- Added platform check for IS_VALLEYVIEW() in dp_detect to use the correct + bit defintions +- Replaced a lost trailing brace for the added switch() + +Signed-off-by: Todd Previte +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=73951 +[danvet: Switch to _VLV postfix instead of prefix and regroupg +comments again so that the g4x warning is right next to those defines. +Also add a _G4X suffix for those special ones. Also cc stable.] +Signed-off-by: Daniel Vetter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_reg.h | 10 +++++++--- + drivers/gpu/drm/i915/intel_dp.c | 40 ++++++++++++++++++++++++++++------------ + 2 files changed, 35 insertions(+), 15 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -2117,9 +2117,13 @@ + * Please check the detailed lore in the commit message for for experimental + * evidence. + */ +-#define PORTD_HOTPLUG_LIVE_STATUS (1 << 29) +-#define PORTC_HOTPLUG_LIVE_STATUS (1 << 28) +-#define PORTB_HOTPLUG_LIVE_STATUS (1 << 27) ++#define PORTD_HOTPLUG_LIVE_STATUS_G4X (1 << 29) ++#define PORTC_HOTPLUG_LIVE_STATUS_G4X (1 << 28) ++#define PORTB_HOTPLUG_LIVE_STATUS_G4X (1 << 27) ++/* VLV DP/HDMI bits again match Bspec */ ++#define PORTD_HOTPLUG_LIVE_STATUS_VLV (1 << 27) ++#define PORTC_HOTPLUG_LIVE_STATUS_VLV (1 << 28) ++#define PORTB_HOTPLUG_LIVE_STATUS_VLV (1 << 29) + #define PORTD_HOTPLUG_INT_STATUS (3 << 21) + #define PORTC_HOTPLUG_INT_STATUS (3 << 19) + #define PORTB_HOTPLUG_INT_STATUS (3 << 17) +--- a/drivers/gpu/drm/i915/intel_dp.c ++++ b/drivers/gpu/drm/i915/intel_dp.c +@@ -3020,18 +3020,34 @@ g4x_dp_detect(struct intel_dp *intel_dp) + return status; + } + +- switch (intel_dig_port->port) { +- case PORT_B: +- bit = PORTB_HOTPLUG_LIVE_STATUS; +- break; +- case PORT_C: +- bit = PORTC_HOTPLUG_LIVE_STATUS; +- break; +- case PORT_D: +- bit = PORTD_HOTPLUG_LIVE_STATUS; +- break; +- default: +- return connector_status_unknown; ++ if (IS_VALLEYVIEW(dev)) { ++ switch (intel_dig_port->port) { ++ case PORT_B: ++ bit = PORTB_HOTPLUG_LIVE_STATUS_VLV; ++ break; ++ case PORT_C: ++ bit = PORTC_HOTPLUG_LIVE_STATUS_VLV; ++ break; ++ case PORT_D: ++ bit = PORTD_HOTPLUG_LIVE_STATUS_VLV; ++ break; ++ default: ++ return connector_status_unknown; ++ } ++ } else { ++ switch (intel_dig_port->port) { ++ case PORT_B: ++ bit = PORTB_HOTPLUG_LIVE_STATUS_G4X; ++ break; ++ case PORT_C: ++ bit = PORTC_HOTPLUG_LIVE_STATUS_G4X; ++ break; ++ case PORT_D: ++ bit = PORTD_HOTPLUG_LIVE_STATUS_G4X; ++ break; ++ default: ++ return connector_status_unknown; ++ } + } + + if ((I915_READ(PORT_HOTPLUG_STAT) & bit) == 0) diff --git a/queue-3.13/drm-mgag200-ast-cirrus-fix-regression-with-drm_can_sleep-conversion.patch b/queue-3.13/drm-mgag200-ast-cirrus-fix-regression-with-drm_can_sleep-conversion.patch new file mode 100644 index 00000000000..62f29ff7e43 --- /dev/null +++ b/queue-3.13/drm-mgag200-ast-cirrus-fix-regression-with-drm_can_sleep-conversion.patch @@ -0,0 +1,54 @@ +From 8b7ad1bb3d440da888f2a939dc870eba429b9192 Mon Sep 17 00:00:00 2001 +From: Dave Airlie +Date: Wed, 5 Feb 2014 14:47:45 +1000 +Subject: drm/mgag200,ast,cirrus: fix regression with drm_can_sleep conversion + +From: Dave Airlie + +commit 8b7ad1bb3d440da888f2a939dc870eba429b9192 upstream. + +I totally sign inverted my way out of this one. + +Reported-by: "Sabrina Dubroca" +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/ast/ast_fb.c | 2 +- + drivers/gpu/drm/cirrus/cirrus_fbdev.c | 2 +- + drivers/gpu/drm/mgag200/mgag200_fb.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/ast/ast_fb.c ++++ b/drivers/gpu/drm/ast/ast_fb.c +@@ -65,7 +65,7 @@ static void ast_dirty_update(struct ast_ + * then the BO is being moved and we should + * store up the damage until later. + */ +- if (!drm_can_sleep()) ++ if (drm_can_sleep()) + ret = ast_bo_reserve(bo, true); + if (ret) { + if (ret != -EBUSY) +--- a/drivers/gpu/drm/cirrus/cirrus_fbdev.c ++++ b/drivers/gpu/drm/cirrus/cirrus_fbdev.c +@@ -39,7 +39,7 @@ static void cirrus_dirty_update(struct c + * then the BO is being moved and we should + * store up the damage until later. + */ +- if (!drm_can_sleep()) ++ if (drm_can_sleep()) + ret = cirrus_bo_reserve(bo, true); + if (ret) { + if (ret != -EBUSY) +--- a/drivers/gpu/drm/mgag200/mgag200_fb.c ++++ b/drivers/gpu/drm/mgag200/mgag200_fb.c +@@ -41,7 +41,7 @@ static void mga_dirty_update(struct mga_ + * then the BO is being moved and we should + * store up the damage until later. + */ +- if (!drm_can_sleep()) ++ if (drm_can_sleep()) + ret = mgag200_bo_reserve(bo, true); + if (ret) { + if (ret != -EBUSY) diff --git a/queue-3.13/drm-mgag200-fix-oops-in-cursor-code.patch b/queue-3.13/drm-mgag200-fix-oops-in-cursor-code.patch new file mode 100644 index 00000000000..eacccee2639 --- /dev/null +++ b/queue-3.13/drm-mgag200-fix-oops-in-cursor-code.patch @@ -0,0 +1,43 @@ +From 53dac830537b51df555ba5e7ebb236705b7eaa7c Mon Sep 17 00:00:00 2001 +From: Dave Airlie +Date: Thu, 16 Jan 2014 14:28:22 +1000 +Subject: drm/mgag200: fix oops in cursor code. + +From: Dave Airlie + +commit 53dac830537b51df555ba5e7ebb236705b7eaa7c upstream. + +In some cases we enter the cursor code with file_priv = NULL causing an oops, +we also can try to unpin something that isn't pinned, and this is a good fix for it. + +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/mgag200/mgag200_cursor.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/mgag200/mgag200_cursor.c ++++ b/drivers/gpu/drm/mgag200/mgag200_cursor.c +@@ -22,8 +22,10 @@ static void mga_hide_cursor(struct mga_d + { + WREG8(MGA_CURPOSXL, 0); + WREG8(MGA_CURPOSXH, 0); +- mgag200_bo_unpin(mdev->cursor.pixels_1); +- mgag200_bo_unpin(mdev->cursor.pixels_2); ++ if (mdev->cursor.pixels_1->pin_count) ++ mgag200_bo_unpin(mdev->cursor.pixels_1); ++ if (mdev->cursor.pixels_2->pin_count) ++ mgag200_bo_unpin(mdev->cursor.pixels_2); + } + + int mga_crtc_cursor_set(struct drm_crtc *crtc, +@@ -32,7 +34,7 @@ int mga_crtc_cursor_set(struct drm_crtc + uint32_t width, + uint32_t height) + { +- struct drm_device *dev = (struct drm_device *)file_priv->minor->dev; ++ struct drm_device *dev = crtc->dev; + struct mga_device *mdev = (struct mga_device *)dev->dev_private; + struct mgag200_bo *pixels_1 = mdev->cursor.pixels_1; + struct mgag200_bo *pixels_2 = mdev->cursor.pixels_2; diff --git a/queue-3.13/drm-mgag200-fix-typo-causing-bw-limits-to-be-ignored-on-some-chips.patch b/queue-3.13/drm-mgag200-fix-typo-causing-bw-limits-to-be-ignored-on-some-chips.patch new file mode 100644 index 00000000000..671094ba46f --- /dev/null +++ b/queue-3.13/drm-mgag200-fix-typo-causing-bw-limits-to-be-ignored-on-some-chips.patch @@ -0,0 +1,36 @@ +From ec22b4aa993abbd18f5bbbcb20a1c56be3b1d38b Mon Sep 17 00:00:00 2001 +From: Dave Airlie +Date: Wed, 5 Feb 2014 14:13:56 +1000 +Subject: drm/mgag200: fix typo causing bw limits to be ignored on some chips + +From: Dave Airlie + +commit ec22b4aa993abbd18f5bbbcb20a1c56be3b1d38b upstream. + +mode->mdev otherwise the bw limits never kick in. + +Reported in RHEL testing. + +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/mgag200/mgag200_mode.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/mgag200/mgag200_mode.c ++++ b/drivers/gpu/drm/mgag200/mgag200_mode.c +@@ -1519,11 +1519,11 @@ static int mga_vga_mode_valid(struct drm + (mga_vga_calculate_mode_bandwidth(mode, bpp) + > (32700 * 1024))) { + return MODE_BANDWIDTH; +- } else if (mode->type == G200_EH && ++ } else if (mdev->type == G200_EH && + (mga_vga_calculate_mode_bandwidth(mode, bpp) + > (37500 * 1024))) { + return MODE_BANDWIDTH; +- } else if (mode->type == G200_ER && ++ } else if (mdev->type == G200_ER && + (mga_vga_calculate_mode_bandwidth(mode, + bpp) > (55000 * 1024))) { + return MODE_BANDWIDTH; diff --git a/queue-3.13/drm-nouveau-falcon-use-vmalloc-to-create-firwmare-copies.patch b/queue-3.13/drm-nouveau-falcon-use-vmalloc-to-create-firwmare-copies.patch new file mode 100644 index 00000000000..d65a41f1a49 --- /dev/null +++ b/queue-3.13/drm-nouveau-falcon-use-vmalloc-to-create-firwmare-copies.patch @@ -0,0 +1,77 @@ +From 90d6db1635d5e225623af2e2e859feb607345287 Mon Sep 17 00:00:00 2001 +From: Ilia Mirkin +Date: Sat, 7 Dec 2013 11:42:19 -0500 +Subject: drm/nouveau/falcon: use vmalloc to create firwmare copies + +From: Ilia Mirkin + +commit 90d6db1635d5e225623af2e2e859feb607345287 upstream. + +Some firmware images may be large (64K), so using kmalloc memory is +inappropriate for them. Use vmalloc instead, to avoid high-order +allocation failures. + +Signed-off-by: Ilia Mirkin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/nouveau/core/engine/falcon.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/nouveau/core/engine/falcon.c ++++ b/drivers/gpu/drm/nouveau/core/engine/falcon.c +@@ -56,6 +56,16 @@ _nouveau_falcon_wr32(struct nouveau_obje + nv_wr32(falcon, falcon->addr + addr, data); + } + ++static void * ++vmemdup(const void *src, size_t len) ++{ ++ void *p = vmalloc(len); ++ ++ if (p) ++ memcpy(p, src, len); ++ return p; ++} ++ + int + _nouveau_falcon_init(struct nouveau_object *object) + { +@@ -111,7 +121,7 @@ _nouveau_falcon_init(struct nouveau_obje + + ret = request_firmware(&fw, name, &device->pdev->dev); + if (ret == 0) { +- falcon->code.data = kmemdup(fw->data, fw->size, GFP_KERNEL); ++ falcon->code.data = vmemdup(fw->data, fw->size); + falcon->code.size = fw->size; + falcon->data.data = NULL; + falcon->data.size = 0; +@@ -134,7 +144,7 @@ _nouveau_falcon_init(struct nouveau_obje + return ret; + } + +- falcon->data.data = kmemdup(fw->data, fw->size, GFP_KERNEL); ++ falcon->data.data = vmemdup(fw->data, fw->size); + falcon->data.size = fw->size; + release_firmware(fw); + if (!falcon->data.data) +@@ -149,7 +159,7 @@ _nouveau_falcon_init(struct nouveau_obje + return ret; + } + +- falcon->code.data = kmemdup(fw->data, fw->size, GFP_KERNEL); ++ falcon->code.data = vmemdup(fw->data, fw->size); + falcon->code.size = fw->size; + release_firmware(fw); + if (!falcon->code.data) +@@ -235,8 +245,8 @@ _nouveau_falcon_fini(struct nouveau_obje + if (!suspend) { + nouveau_gpuobj_ref(NULL, &falcon->core); + if (falcon->external) { +- kfree(falcon->data.data); +- kfree(falcon->code.data); ++ vfree(falcon->data.data); ++ vfree(falcon->code.data); + falcon->code.data = NULL; + } + } diff --git a/queue-3.13/drm-nouveau-fix-lock-unbalance-in-nouveau_crtc_page_flip.patch b/queue-3.13/drm-nouveau-fix-lock-unbalance-in-nouveau_crtc_page_flip.patch new file mode 100644 index 00000000000..8da55ce1219 --- /dev/null +++ b/queue-3.13/drm-nouveau-fix-lock-unbalance-in-nouveau_crtc_page_flip.patch @@ -0,0 +1,32 @@ +From 09c3de135063f93d7137ad112f551f293b1204cf Mon Sep 17 00:00:00 2001 +From: Maarten Lankhorst +Date: Wed, 29 Jan 2014 11:05:09 +0100 +Subject: drm/nouveau: fix lock unbalance in nouveau_crtc_page_flip + +From: Maarten Lankhorst + +commit 09c3de135063f93d7137ad112f551f293b1204cf upstream. + +Fixes a regression introduced by d5c1e84b3a130f0 +"drm/nouveau: hold mutex while syncing to kernel channel". + +Reported-by: Fengguang Wu +Signed-off-by: Maarten Lankhorst +Signed-off-by: Ben Skeggs +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/nouveau/nouveau_display.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/nouveau/nouveau_display.c ++++ b/drivers/gpu/drm/nouveau/nouveau_display.c +@@ -618,7 +618,7 @@ nouveau_crtc_page_flip(struct drm_crtc * + ret = nouveau_fence_sync(fence, chan); + nouveau_fence_unref(&fence); + if (ret) +- goto fail_free; ++ goto fail_unpin; + + ret = ttm_bo_reserve(&old_bo->bo, true, false, false, NULL); + if (ret) diff --git a/queue-3.13/drm-nouveau-fix-m2mf-copy-to-tiled-gart.patch b/queue-3.13/drm-nouveau-fix-m2mf-copy-to-tiled-gart.patch new file mode 100644 index 00000000000..570eadeefb7 --- /dev/null +++ b/queue-3.13/drm-nouveau-fix-m2mf-copy-to-tiled-gart.patch @@ -0,0 +1,96 @@ +From ce8f7699f2b6ffe4aa8368b8d9d370875accaa5f Mon Sep 17 00:00:00 2001 +From: Maarten Lankhorst +Date: Tue, 12 Nov 2013 13:34:08 +0100 +Subject: drm/nouveau: fix m2mf copy to tiled gart + +From: Maarten Lankhorst + +commit ce8f7699f2b6ffe4aa8368b8d9d370875accaa5f upstream. + +Commit de7b7d59d54852c introduced tiled GART, but a linear copy is +still performed. This may result in errors on eviction, fix it by +checking tiling from memtype. + +Signed-off-by: Maarten Lankhorst +Signed-off-by: Ben Skeggs +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/nouveau/nouveau_bo.c | 33 ++++++++------------------------- + 1 file changed, 8 insertions(+), 25 deletions(-) + +--- a/drivers/gpu/drm/nouveau/nouveau_bo.c ++++ b/drivers/gpu/drm/nouveau/nouveau_bo.c +@@ -798,25 +798,25 @@ nv50_bo_move_m2mf(struct nouveau_channel + struct ttm_mem_reg *old_mem, struct ttm_mem_reg *new_mem) + { + struct nouveau_mem *node = old_mem->mm_node; +- struct nouveau_bo *nvbo = nouveau_bo(bo); + u64 length = (new_mem->num_pages << PAGE_SHIFT); + u64 src_offset = node->vma[0].offset; + u64 dst_offset = node->vma[1].offset; ++ int src_tiled = !!node->memtype; ++ int dst_tiled = !!((struct nouveau_mem *)new_mem->mm_node)->memtype; + int ret; + + while (length) { + u32 amount, stride, height; + ++ ret = RING_SPACE(chan, 18 + 6 * (src_tiled + dst_tiled)); ++ if (ret) ++ return ret; ++ + amount = min(length, (u64)(4 * 1024 * 1024)); + stride = 16 * 4; + height = amount / stride; + +- if (old_mem->mem_type == TTM_PL_VRAM && +- nouveau_bo_tile_layout(nvbo)) { +- ret = RING_SPACE(chan, 8); +- if (ret) +- return ret; +- ++ if (src_tiled) { + BEGIN_NV04(chan, NvSubCopy, 0x0200, 7); + OUT_RING (chan, 0); + OUT_RING (chan, 0); +@@ -826,19 +826,10 @@ nv50_bo_move_m2mf(struct nouveau_channel + OUT_RING (chan, 0); + OUT_RING (chan, 0); + } else { +- ret = RING_SPACE(chan, 2); +- if (ret) +- return ret; +- + BEGIN_NV04(chan, NvSubCopy, 0x0200, 1); + OUT_RING (chan, 1); + } +- if (new_mem->mem_type == TTM_PL_VRAM && +- nouveau_bo_tile_layout(nvbo)) { +- ret = RING_SPACE(chan, 8); +- if (ret) +- return ret; +- ++ if (dst_tiled) { + BEGIN_NV04(chan, NvSubCopy, 0x021c, 7); + OUT_RING (chan, 0); + OUT_RING (chan, 0); +@@ -848,18 +839,10 @@ nv50_bo_move_m2mf(struct nouveau_channel + OUT_RING (chan, 0); + OUT_RING (chan, 0); + } else { +- ret = RING_SPACE(chan, 2); +- if (ret) +- return ret; +- + BEGIN_NV04(chan, NvSubCopy, 0x021c, 1); + OUT_RING (chan, 1); + } + +- ret = RING_SPACE(chan, 14); +- if (ret) +- return ret; +- + BEGIN_NV04(chan, NvSubCopy, 0x0238, 2); + OUT_RING (chan, upper_32_bits(src_offset)); + OUT_RING (chan, upper_32_bits(dst_offset)); diff --git a/queue-3.13/drm-nouveau-hold-mutex-while-syncing-to-kernel-channel.patch b/queue-3.13/drm-nouveau-hold-mutex-while-syncing-to-kernel-channel.patch new file mode 100644 index 00000000000..acca2378456 --- /dev/null +++ b/queue-3.13/drm-nouveau-hold-mutex-while-syncing-to-kernel-channel.patch @@ -0,0 +1,51 @@ +From d5c1e84b3a130f0743b218b33ff7d9cb493ab5b4 Mon Sep 17 00:00:00 2001 +From: Maarten Lankhorst +Date: Tue, 14 Jan 2014 16:48:58 +0100 +Subject: drm/nouveau: hold mutex while syncing to kernel channel + +From: Maarten Lankhorst + +commit d5c1e84b3a130f0743b218b33ff7d9cb493ab5b4 upstream. + +Not holding the mutex potentially causes corruption of the kernel +channel when page flipping. + +Signed-off-by: Maarten Lankhorst +Signed-off-by: Ben Skeggs +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/nouveau/nouveau_display.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +--- a/drivers/gpu/drm/nouveau/nouveau_display.c ++++ b/drivers/gpu/drm/nouveau/nouveau_display.c +@@ -603,6 +603,14 @@ nouveau_crtc_page_flip(struct drm_crtc * + if (!s) + return -ENOMEM; + ++ if (new_bo != old_bo) { ++ ret = nouveau_bo_pin(new_bo, TTM_PL_FLAG_VRAM); ++ if (ret) ++ goto fail_free; ++ } ++ ++ mutex_lock(&chan->cli->mutex); ++ + /* synchronise rendering channel with the kernel's channel */ + spin_lock(&new_bo->bo.bdev->fence_lock); + fence = nouveau_fence_ref(new_bo->bo.sync_obj); +@@ -612,13 +620,6 @@ nouveau_crtc_page_flip(struct drm_crtc * + if (ret) + goto fail_free; + +- if (new_bo != old_bo) { +- ret = nouveau_bo_pin(new_bo, TTM_PL_FLAG_VRAM); +- if (ret) +- goto fail_free; +- } +- +- mutex_lock(&chan->cli->mutex); + ret = ttm_bo_reserve(&old_bo->bo, true, false, false, NULL); + if (ret) + goto fail_unpin; diff --git a/queue-3.13/drm-rcar-du-update-plane-pitch-in-.mode_set_base-operation.patch b/queue-3.13/drm-rcar-du-update-plane-pitch-in-.mode_set_base-operation.patch new file mode 100644 index 00000000000..5ea05005127 --- /dev/null +++ b/queue-3.13/drm-rcar-du-update-plane-pitch-in-.mode_set_base-operation.patch @@ -0,0 +1,90 @@ +From eb86301f293da3c362db729a9f40ddb25755902b Mon Sep 17 00:00:00 2001 +From: Laurent Pinchart +Date: Wed, 13 Nov 2013 14:26:01 +0100 +Subject: drm/rcar-du: Update plane pitch in .mode_set_base() operation + +From: Laurent Pinchart + +commit eb86301f293da3c362db729a9f40ddb25755902b upstream. + +When setting a new frame buffer with the mode set base operation the +pitch value might change. Set the hardware plane pitch register at the +same time as the plane base address in the rcar_du_plane_update_base() +function to make sure the pitch value always matches the frame buffer. + +Signed-off-by: Laurent Pinchart +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 1 - + drivers/gpu/drm/rcar-du/rcar_du_plane.c | 21 +++++++++++---------- + 2 files changed, 11 insertions(+), 11 deletions(-) + +--- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c ++++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c +@@ -371,7 +371,6 @@ static int rcar_du_crtc_mode_set(struct + goto error; + + rcrtc->plane->format = format; +- rcrtc->plane->pitch = crtc->fb->pitches[0]; + + rcrtc->plane->src_x = x; + rcrtc->plane->src_y = y; +--- a/drivers/gpu/drm/rcar-du/rcar_du_plane.c ++++ b/drivers/gpu/drm/rcar-du/rcar_du_plane.c +@@ -104,6 +104,15 @@ void rcar_du_plane_update_base(struct rc + { + struct rcar_du_group *rgrp = plane->group; + unsigned int index = plane->hwindex; ++ u32 mwr; ++ ++ /* Memory pitch (expressed in pixels) */ ++ if (plane->format->planes == 2) ++ mwr = plane->pitch; ++ else ++ mwr = plane->pitch * 8 / plane->format->bpp; ++ ++ rcar_du_plane_write(rgrp, index, PnMWR, mwr); + + /* The Y position is expressed in raster line units and must be doubled + * for 32bpp formats, according to the R8A7790 datasheet. No mention of +@@ -133,6 +142,8 @@ void rcar_du_plane_compute_base(struct r + { + struct drm_gem_cma_object *gem; + ++ plane->pitch = fb->pitches[0]; ++ + gem = drm_fb_cma_get_gem_obj(fb, 0); + plane->dma[0] = gem->paddr + fb->offsets[0]; + +@@ -209,7 +220,6 @@ static void __rcar_du_plane_setup(struct + struct rcar_du_group *rgrp = plane->group; + u32 ddcr2 = PnDDCR2_CODE; + u32 ddcr4; +- u32 mwr; + + /* Data format + * +@@ -240,14 +250,6 @@ static void __rcar_du_plane_setup(struct + rcar_du_plane_write(rgrp, index, PnDDCR2, ddcr2); + rcar_du_plane_write(rgrp, index, PnDDCR4, ddcr4); + +- /* Memory pitch (expressed in pixels) */ +- if (plane->format->planes == 2) +- mwr = plane->pitch; +- else +- mwr = plane->pitch * 8 / plane->format->bpp; +- +- rcar_du_plane_write(rgrp, index, PnMWR, mwr); +- + /* Destination position and size */ + rcar_du_plane_write(rgrp, index, PnDSXR, plane->width); + rcar_du_plane_write(rgrp, index, PnDSYR, plane->height); +@@ -309,7 +311,6 @@ rcar_du_plane_update(struct drm_plane *p + + rplane->crtc = crtc; + rplane->format = format; +- rplane->pitch = fb->pitches[0]; + + rplane->src_x = src_x >> 16; + rplane->src_y = src_y >> 16; diff --git a/queue-3.13/drm-vmwgfx-fix-regression-caused-by-drm-ttm-make-ttm-reservation-calls-behave-like-reservation-calls.patch b/queue-3.13/drm-vmwgfx-fix-regression-caused-by-drm-ttm-make-ttm-reservation-calls-behave-like-reservation-calls.patch new file mode 100644 index 00000000000..e298c96da06 --- /dev/null +++ b/queue-3.13/drm-vmwgfx-fix-regression-caused-by-drm-ttm-make-ttm-reservation-calls-behave-like-reservation-calls.patch @@ -0,0 +1,54 @@ +From cf5e3413337309050c05e13dcebe85b7194a21e5 Mon Sep 17 00:00:00 2001 +From: Thomas Hellstrom +Date: Thu, 30 Jan 2014 10:58:19 +0100 +Subject: drm/vmwgfx: Fix regression caused by "drm/ttm: make ttm reservation calls behave like reservation calls" + +From: Thomas Hellstrom + +commit cf5e3413337309050c05e13dcebe85b7194a21e5 upstream. + +The call to ttm_eu_backoff_reservation() as part of an error path would cause +a lock imbalance if the reservation ticket was not initialized. This error is +easily triggered from user-space by submitting a bogus command stream. + +Signed-off-by: Thomas Hellstrom +Reviewed-by: Jakob Bornecrantz +Cc: Maarten Lankhorst +Cc: Jerome Glisse +Cc: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +@@ -1483,11 +1483,11 @@ int vmw_execbuf_process(struct drm_file + ret = vmw_cmd_check_all(dev_priv, sw_context, kernel_commands, + command_size); + if (unlikely(ret != 0)) +- goto out_err; ++ goto out_err_nores; + + ret = vmw_resources_reserve(sw_context); + if (unlikely(ret != 0)) +- goto out_err; ++ goto out_err_nores; + + ret = ttm_eu_reserve_buffers(&ticket, &sw_context->validate_nodes); + if (unlikely(ret != 0)) +@@ -1569,10 +1569,11 @@ int vmw_execbuf_process(struct drm_file + return 0; + + out_err: +- vmw_resource_relocations_free(&sw_context->res_relocations); +- vmw_free_relocations(sw_context); + ttm_eu_backoff_reservation(&ticket, &sw_context->validate_nodes); ++out_err_nores: + vmw_resource_list_unreserve(&sw_context->resource_list, true); ++ vmw_resource_relocations_free(&sw_context->res_relocations); ++ vmw_free_relocations(sw_context); + vmw_clear_validations(sw_context); + if (unlikely(dev_priv->pinned_bo != NULL && + !dev_priv->query_cid_valid)) diff --git a/queue-3.13/drm-vmwgfx-fix-the-driver-for-large-dma-addresses.patch b/queue-3.13/drm-vmwgfx-fix-the-driver-for-large-dma-addresses.patch new file mode 100644 index 00000000000..3f8f92770f2 --- /dev/null +++ b/queue-3.13/drm-vmwgfx-fix-the-driver-for-large-dma-addresses.patch @@ -0,0 +1,314 @@ +From 0d00c488f3de59d19784d5ce774528acaa194525 Mon Sep 17 00:00:00 2001 +From: Thomas Hellstrom +Date: Wed, 15 Jan 2014 20:19:53 +0100 +Subject: drm/vmwgfx: Fix the driver for large dma addresses + +From: Thomas Hellstrom + +commit 0d00c488f3de59d19784d5ce774528acaa194525 upstream. + +With dma compliance / IOMMU support added to the driver in kernel 3.13, +the dma addresses can exceed 44 bits, which is what we support in +32-bit mode and with GMR1. +So in 32-bit mode and optionally in 64-bit mode, restrict the dma +addresses to 44 bits, and strip the old GMR1 code. + +Signed-off-by: Thomas Hellstrom +Reviewed-by: Jakob Bornecrantz +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 47 ++++++++-- + drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 1 + drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c | 160 ------------------------------------ + 3 files changed, 39 insertions(+), 169 deletions(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c +@@ -189,6 +189,7 @@ static int enable_fbdev = IS_ENABLED(CON + static int vmw_force_iommu; + static int vmw_restrict_iommu; + static int vmw_force_coherent; ++static int vmw_restrict_dma_mask; + + static int vmw_probe(struct pci_dev *, const struct pci_device_id *); + static void vmw_master_init(struct vmw_master *); +@@ -203,6 +204,8 @@ MODULE_PARM_DESC(restrict_iommu, "Try to + module_param_named(restrict_iommu, vmw_restrict_iommu, int, 0600); + MODULE_PARM_DESC(force_coherent, "Force coherent TTM pages"); + module_param_named(force_coherent, vmw_force_coherent, int, 0600); ++MODULE_PARM_DESC(restrict_dma_mask, "Restrict DMA mask to 44 bits with IOMMU"); ++module_param_named(restrict_dma_mask, vmw_restrict_dma_mask, int, 0600); + + + static void vmw_print_capabilities(uint32_t capabilities) +@@ -510,6 +513,33 @@ out_fixup: + return 0; + } + ++/** ++ * vmw_dma_masks - set required page- and dma masks ++ * ++ * @dev: Pointer to struct drm-device ++ * ++ * With 32-bit we can only handle 32 bit PFNs. Optionally set that ++ * restriction also for 64-bit systems. ++ */ ++#ifdef CONFIG_INTEL_IOMMU ++static int vmw_dma_masks(struct vmw_private *dev_priv) ++{ ++ struct drm_device *dev = dev_priv->dev; ++ ++ if (intel_iommu_enabled && ++ (sizeof(unsigned long) == 4 || vmw_restrict_dma_mask)) { ++ DRM_INFO("Restricting DMA addresses to 44 bits.\n"); ++ return dma_set_mask(dev->dev, DMA_BIT_MASK(44)); ++ } ++ return 0; ++} ++#else ++static int vmw_dma_masks(struct vmw_private *dev_priv) ++{ ++ return 0; ++} ++#endif ++ + static int vmw_driver_load(struct drm_device *dev, unsigned long chipset) + { + struct vmw_private *dev_priv; +@@ -578,14 +608,9 @@ static int vmw_driver_load(struct drm_de + + vmw_get_initial_size(dev_priv); + +- if (dev_priv->capabilities & SVGA_CAP_GMR) { +- dev_priv->max_gmr_descriptors = +- vmw_read(dev_priv, +- SVGA_REG_GMR_MAX_DESCRIPTOR_LENGTH); ++ if (dev_priv->capabilities & SVGA_CAP_GMR2) { + dev_priv->max_gmr_ids = + vmw_read(dev_priv, SVGA_REG_GMR_MAX_IDS); +- } +- if (dev_priv->capabilities & SVGA_CAP_GMR2) { + dev_priv->max_gmr_pages = + vmw_read(dev_priv, SVGA_REG_GMRS_MAX_PAGES); + dev_priv->memory_size = +@@ -599,17 +624,17 @@ static int vmw_driver_load(struct drm_de + dev_priv->memory_size = 512*1024*1024; + } + ++ ret = vmw_dma_masks(dev_priv); ++ if (unlikely(ret != 0)) ++ goto out_err0; ++ + mutex_unlock(&dev_priv->hw_mutex); + + vmw_print_capabilities(dev_priv->capabilities); + +- if (dev_priv->capabilities & SVGA_CAP_GMR) { ++ if (dev_priv->capabilities & SVGA_CAP_GMR2) { + DRM_INFO("Max GMR ids is %u\n", + (unsigned)dev_priv->max_gmr_ids); +- DRM_INFO("Max GMR descriptors is %u\n", +- (unsigned)dev_priv->max_gmr_descriptors); +- } +- if (dev_priv->capabilities & SVGA_CAP_GMR2) { + DRM_INFO("Max number of GMR pages is %u\n", + (unsigned)dev_priv->max_gmr_pages); + DRM_INFO("Max dedicated hypervisor surface memory is %u kiB\n", +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h +@@ -290,7 +290,6 @@ struct vmw_private { + __le32 __iomem *mmio_virt; + int mmio_mtrr; + uint32_t capabilities; +- uint32_t max_gmr_descriptors; + uint32_t max_gmr_ids; + uint32_t max_gmr_pages; + uint32_t memory_size; +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c +@@ -125,181 +125,27 @@ static void vmw_gmr2_unbind(struct vmw_p + } + + +-static void vmw_gmr_free_descriptors(struct device *dev, dma_addr_t desc_dma, +- struct list_head *desc_pages) +-{ +- struct page *page, *next; +- struct svga_guest_mem_descriptor *page_virtual; +- unsigned int desc_per_page = PAGE_SIZE / +- sizeof(struct svga_guest_mem_descriptor) - 1; +- +- if (list_empty(desc_pages)) +- return; +- +- list_for_each_entry_safe(page, next, desc_pages, lru) { +- list_del_init(&page->lru); +- +- if (likely(desc_dma != DMA_ADDR_INVALID)) { +- dma_unmap_page(dev, desc_dma, PAGE_SIZE, +- DMA_TO_DEVICE); +- } +- +- page_virtual = kmap_atomic(page); +- desc_dma = (dma_addr_t) +- le32_to_cpu(page_virtual[desc_per_page].ppn) << +- PAGE_SHIFT; +- kunmap_atomic(page_virtual); +- +- __free_page(page); +- } +-} +- +-/** +- * FIXME: Adjust to the ttm lowmem / highmem storage to minimize +- * the number of used descriptors. +- * +- */ +- +-static int vmw_gmr_build_descriptors(struct device *dev, +- struct list_head *desc_pages, +- struct vmw_piter *iter, +- unsigned long num_pages, +- dma_addr_t *first_dma) +-{ +- struct page *page; +- struct svga_guest_mem_descriptor *page_virtual = NULL; +- struct svga_guest_mem_descriptor *desc_virtual = NULL; +- unsigned int desc_per_page; +- unsigned long prev_pfn; +- unsigned long pfn; +- int ret; +- dma_addr_t desc_dma; +- +- desc_per_page = PAGE_SIZE / +- sizeof(struct svga_guest_mem_descriptor) - 1; +- +- while (likely(num_pages != 0)) { +- page = alloc_page(__GFP_HIGHMEM); +- if (unlikely(page == NULL)) { +- ret = -ENOMEM; +- goto out_err; +- } +- +- list_add_tail(&page->lru, desc_pages); +- page_virtual = kmap_atomic(page); +- desc_virtual = page_virtual - 1; +- prev_pfn = ~(0UL); +- +- while (likely(num_pages != 0)) { +- pfn = vmw_piter_dma_addr(iter) >> PAGE_SHIFT; +- +- if (pfn != prev_pfn + 1) { +- +- if (desc_virtual - page_virtual == +- desc_per_page - 1) +- break; +- +- (++desc_virtual)->ppn = cpu_to_le32(pfn); +- desc_virtual->num_pages = cpu_to_le32(1); +- } else { +- uint32_t tmp = +- le32_to_cpu(desc_virtual->num_pages); +- desc_virtual->num_pages = cpu_to_le32(tmp + 1); +- } +- prev_pfn = pfn; +- --num_pages; +- vmw_piter_next(iter); +- } +- +- (++desc_virtual)->ppn = DMA_PAGE_INVALID; +- desc_virtual->num_pages = cpu_to_le32(0); +- kunmap_atomic(page_virtual); +- } +- +- desc_dma = 0; +- list_for_each_entry_reverse(page, desc_pages, lru) { +- page_virtual = kmap_atomic(page); +- page_virtual[desc_per_page].ppn = cpu_to_le32 +- (desc_dma >> PAGE_SHIFT); +- kunmap_atomic(page_virtual); +- desc_dma = dma_map_page(dev, page, 0, PAGE_SIZE, +- DMA_TO_DEVICE); +- +- if (unlikely(dma_mapping_error(dev, desc_dma))) +- goto out_err; +- } +- *first_dma = desc_dma; +- +- return 0; +-out_err: +- vmw_gmr_free_descriptors(dev, DMA_ADDR_INVALID, desc_pages); +- return ret; +-} +- +-static void vmw_gmr_fire_descriptors(struct vmw_private *dev_priv, +- int gmr_id, dma_addr_t desc_dma) +-{ +- mutex_lock(&dev_priv->hw_mutex); +- +- vmw_write(dev_priv, SVGA_REG_GMR_ID, gmr_id); +- wmb(); +- vmw_write(dev_priv, SVGA_REG_GMR_DESCRIPTOR, desc_dma >> PAGE_SHIFT); +- mb(); +- +- mutex_unlock(&dev_priv->hw_mutex); +- +-} +- + int vmw_gmr_bind(struct vmw_private *dev_priv, + const struct vmw_sg_table *vsgt, + unsigned long num_pages, + int gmr_id) + { +- struct list_head desc_pages; +- dma_addr_t desc_dma = 0; +- struct device *dev = dev_priv->dev->dev; + struct vmw_piter data_iter; +- int ret; + + vmw_piter_start(&data_iter, vsgt, 0); + + if (unlikely(!vmw_piter_next(&data_iter))) + return 0; + +- if (likely(dev_priv->capabilities & SVGA_CAP_GMR2)) +- return vmw_gmr2_bind(dev_priv, &data_iter, num_pages, gmr_id); +- +- if (unlikely(!(dev_priv->capabilities & SVGA_CAP_GMR))) +- return -EINVAL; +- +- if (vsgt->num_regions > dev_priv->max_gmr_descriptors) ++ if (unlikely(!(dev_priv->capabilities & SVGA_CAP_GMR2))) + return -EINVAL; + +- INIT_LIST_HEAD(&desc_pages); +- +- ret = vmw_gmr_build_descriptors(dev, &desc_pages, &data_iter, +- num_pages, &desc_dma); +- if (unlikely(ret != 0)) +- return ret; +- +- vmw_gmr_fire_descriptors(dev_priv, gmr_id, desc_dma); +- vmw_gmr_free_descriptors(dev, desc_dma, &desc_pages); +- +- return 0; ++ return vmw_gmr2_bind(dev_priv, &data_iter, num_pages, gmr_id); + } + + + void vmw_gmr_unbind(struct vmw_private *dev_priv, int gmr_id) + { +- if (likely(dev_priv->capabilities & SVGA_CAP_GMR2)) { ++ if (likely(dev_priv->capabilities & SVGA_CAP_GMR2)) + vmw_gmr2_unbind(dev_priv, gmr_id); +- return; +- } +- +- mutex_lock(&dev_priv->hw_mutex); +- vmw_write(dev_priv, SVGA_REG_GMR_ID, gmr_id); +- wmb(); +- vmw_write(dev_priv, SVGA_REG_GMR_DESCRIPTOR, 0); +- mb(); +- mutex_unlock(&dev_priv->hw_mutex); + } diff --git a/queue-3.13/i915-remove-pm_qos-request-on-error.patch b/queue-3.13/i915-remove-pm_qos-request-on-error.patch new file mode 100644 index 00000000000..749e9f1a9c9 --- /dev/null +++ b/queue-3.13/i915-remove-pm_qos-request-on-error.patch @@ -0,0 +1,49 @@ +From 22accca01713b13dac386ca90b787aadf88f6551 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Sat, 25 Jan 2014 10:13:37 +0100 +Subject: i915: remove pm_qos request on error + +From: Stanislaw Gruszka + +commit 22accca01713b13dac386ca90b787aadf88f6551 upstream. + +Not removing pm qos request and free memory for it can cause crash, +when some other driver use pm qos. For example, this oops: + +BUG: unable to handle kernel paging request at fffffffffffffff8 +IP: [] plist_add+0x5b/0xd0 +Call Trace: + [] pm_qos_update_target+0x125/0x1e0 + [] pm_qos_add_request+0x91/0x100 + [] e1000_open+0xe4/0x5b0 [e1000e] + +was caused by earlier i915 probe failure: + +[drm:i915_report_and_clear_eir] *ERROR* EIR stuck: 0x00000010, masking +[drm:init_ring_common] *ERROR* render ring initialization failed ctl 0001f001 head 00003004 tail 00000000 start 00003000 +[drm:i915_driver_load] *ERROR* failed to init modeset +i915: probe of 0000:00:02.0 failed with error -5 + +Bug report: +http://bugzilla.redhat.com/show_bug.cgi?id=1057533 + +Reported-by: Giandomenico De Tullio +Signed-off-by: Stanislaw Gruszka +[danvet: Drop unnecessary code movement.] +Signed-off-by: Daniel Vetter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_dma.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/i915/i915_dma.c ++++ b/drivers/gpu/drm/i915/i915_dma.c +@@ -1679,6 +1679,7 @@ out_gem_unload: + + intel_teardown_gmbus(dev); + intel_teardown_mchbar(dev); ++ pm_qos_remove_request(&dev_priv->pm_qos); + destroy_workqueue(dev_priv->wq); + out_mtrrfree: + arch_phys_wc_del(dev_priv->gtt.mtrr); diff --git a/queue-3.13/series b/queue-3.13/series index 0546111512a..47f49bf7f53 100644 --- a/queue-3.13/series +++ b/queue-3.13/series @@ -87,3 +87,22 @@ drm-radeon-dce4-clear-bios-scratch-dpms-bit-v2.patch drm-radeon-dce8-workaround-for-atom-blankcrtc-table.patch dm-sysfs-fix-a-module-unload-race.patch target-fix-percpu_ref_put-race-in-transport_lun_remove_cmd.patch +drm-nouveau-fix-m2mf-copy-to-tiled-gart.patch +drm-nouveau-falcon-use-vmalloc-to-create-firwmare-copies.patch +drm-nouveau-hold-mutex-while-syncing-to-kernel-channel.patch +drm-nouveau-fix-lock-unbalance-in-nouveau_crtc_page_flip.patch +drm-i915-flush-outstanding-requests-before-allocating-new-seqno.patch +drm-i915-fix-the-offset-issue-for-the-stolen-gem-objects.patch +drm-i915-vlv2-fix-hotplug-detect-bits.patch +i915-remove-pm_qos-request-on-error.patch +drm-i915-decouple-gpu-error-reporting-from-ring-initialisation.patch +drm-cirrus-correct-register-values-for-16bpp.patch +drm-gem-always-initialize-the-gem-object-in-object_init.patch +drm-rcar-du-update-plane-pitch-in-.mode_set_base-operation.patch +drm-gma500-lock-struct_mutex-around-cursor-updates.patch +drm-ast-cirrus-mgag200-use-drm_can_sleep.patch +drm-vmwgfx-fix-the-driver-for-large-dma-addresses.patch +drm-vmwgfx-fix-regression-caused-by-drm-ttm-make-ttm-reservation-calls-behave-like-reservation-calls.patch +drm-mgag200-fix-oops-in-cursor-code.patch +drm-mgag200-fix-typo-causing-bw-limits-to-be-ignored-on-some-chips.patch +drm-mgag200-ast-cirrus-fix-regression-with-drm_can_sleep-conversion.patch -- 2.47.2