Linux v4.0-rc5-25-g90a5a895cc8b

- Add some i915 fixes

6 files changed, 176 insertions, 141 deletions

diff --git a/Revert-drm-i915-Ensure-plane-state-fb-stays-in-sync-.patch b/Revert-drm-i915-Ensure-plane-state-fb-stays-in-sync-.patch
deleted file mode 100644
index 9f5c96767..000000000
--- a/Revert-drm-i915-Ensure-plane-state-fb-stays-in-sync-.patch
+++ /dev/null
@@ -1,97 +0,0 @@
-From: Josh Boyer <jwboyer@fedoraproject.org>
-Date: Mon, 23 Mar 2015 13:50:33 -0400
-Subject: [PATCH] Revert "drm/i915: Ensure plane->state->fb stays in sync with
- plane->fb"
-
-This reverts commit 319c1d420a0b62d9dbb88104afebaabc968cdbfa.
----
- drivers/gpu/drm/i915/intel_display.c | 17 -----------------
- 1 file changed, 17 deletions(-)
-
-diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index e116dee10cf9..ac8112d86237 100644
---- a/drivers/gpu/drm/i915/intel_display.c
-+++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -37,7 +37,6 @@
- #include <drm/i915_drm.h>
- #include "i915_drv.h"
- #include "i915_trace.h"
--#include <drm/drm_atomic.h>
- #include <drm/drm_atomic_helper.h>
- #include <drm/drm_dp_helper.h>
- #include <drm/drm_crtc_helper.h>
-@@ -2417,14 +2416,6 @@ out_unref_obj:
- 	return false;
- }
- 
--/* Update plane->state->fb to match plane->fb after driver-internal updates */
--static void
--update_state_fb(struct drm_plane *plane)
--{
--	if (plane->fb != plane->state->fb)
--		drm_atomic_set_fb_for_plane(plane->state, plane->fb);
--}
--
- static void
- intel_find_plane_obj(struct intel_crtc *intel_crtc,
- 		     struct intel_initial_plane_config *plane_config)
-@@ -2471,8 +2462,6 @@ intel_find_plane_obj(struct intel_crtc *intel_crtc,
- 			break;
- 		}
- 	}
--
--	update_state_fb(intel_crtc->base.primary);
- }
- 
- static void i9xx_update_primary_plane(struct drm_crtc *crtc,
-@@ -6663,7 +6652,6 @@ i9xx_get_initial_plane_config(struct intel_crtc *crtc,
- 		      plane_config->size);
- 
- 	crtc->base.primary->fb = fb;
--	update_state_fb(crtc->base.primary);
- }
- 
- static void chv_crtc_clock_get(struct intel_crtc *crtc,
-@@ -7704,7 +7692,6 @@ skylake_get_initial_plane_config(struct intel_crtc *crtc,
- 		      plane_config->size);
- 
- 	crtc->base.primary->fb = fb;
--	update_state_fb(crtc->base.primary);
- 	return;
- 
- error:
-@@ -7798,7 +7785,6 @@ ironlake_get_initial_plane_config(struct intel_crtc *crtc,
- 		      plane_config->size);
- 
- 	crtc->base.primary->fb = fb;
--	update_state_fb(crtc->base.primary);
- }
- 
- static bool ironlake_get_pipe_config(struct intel_crtc *crtc,
-@@ -9837,7 +9823,6 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
- 	drm_gem_object_reference(&obj->base);
- 
- 	crtc->primary->fb = fb;
--	update_state_fb(crtc->primary);
- 
- 	work->pending_flip_obj = obj;
- 
-@@ -9906,7 +9891,6 @@ cleanup_unpin:
- cleanup_pending:
- 	atomic_dec(&intel_crtc->unpin_work_count);
- 	crtc->primary->fb = old_fb;
--	update_state_fb(crtc->primary);
- 	drm_gem_object_unreference(&work->old_fb_obj->base);
- 	drm_gem_object_unreference(&obj->base);
- 	mutex_unlock(&dev->struct_mutex);
-@@ -13741,7 +13725,6 @@ void intel_modeset_gem_init(struct drm_device *dev)
- 				  to_intel_crtc(c)->pipe);
- 			drm_framebuffer_unreference(c->primary->fb);
- 			c->primary->fb = NULL;
--			update_state_fb(c->primary);
- 		}
- 	}
- 	mutex_unlock(&dev->struct_mutex);
--- 
-2.1.0
-
diff --git a/drm-Fixup-racy-refcounting-in-plane_force_disable.patch b/drm-Fixup-racy-refcounting-in-plane_force_disable.patch
new file mode 100644
index 000000000..6c46cb007
--- /dev/null
+++ b/drm-Fixup-racy-refcounting-in-plane_force_disable.patch
@@ -0,0 +1,72 @@
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Fri, 27 Feb 2015 12:58:13 +0100
+Subject: [PATCH] drm: Fixup racy refcounting in plane_force_disable
+
+Originally it was impossible to be dropping the last refcount in this
+function since there was always one around still from the idr. But in
+
+commit 83f45fc360c8e16a330474860ebda872d1384c8c
+Author: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date:   Wed Aug 6 09:10:18 2014 +0200
+
+    drm: Don't grab an fb reference for the idr
+
+we've switched to weak references, broke that assumption but forgot to
+fix it up.
+
+Since we still force-disable planes it's only possible to hit this
+when racing multiple rmfb with fbdev restoring or similar evil things.
+As long as userspace is nice it's impossible to hit the BUG_ON.
+
+But the BUG_ON would most likely be hit from fbdev code, which usually
+invovles the console_lock besides all modeset locks. So very likely
+we'd never get the bug reports if this was hit in the wild, hence
+better be safe than sorry and backport.
+
+Spotted by Matt Roper while reviewing other patches.
+
+[airlied: pull this back into 4.0 - the oops happens there]
+
+Cc: stable@vger.kernel.org
+Cc: Matt Roper <matthew.d.roper@intel.com>
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+---
+ drivers/gpu/drm/drm_crtc.c | 13 +------------
+ 1 file changed, 1 insertion(+), 12 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
+index f6d04c7b5115..679b10e34fb5 100644
+--- a/drivers/gpu/drm/drm_crtc.c
++++ b/drivers/gpu/drm/drm_crtc.c
+@@ -525,17 +525,6 @@ void drm_framebuffer_reference(struct drm_framebuffer *fb)
+ }
+ EXPORT_SYMBOL(drm_framebuffer_reference);
+ 
+-static void drm_framebuffer_free_bug(struct kref *kref)
+-{
+-	BUG();
+-}
+-
+-static void __drm_framebuffer_unreference(struct drm_framebuffer *fb)
+-{
+-	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
+-	kref_put(&fb->refcount, drm_framebuffer_free_bug);
+-}
+-
+ /**
+  * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
+  * @fb: fb to unregister
+@@ -1320,7 +1309,7 @@ void drm_plane_force_disable(struct drm_plane *plane)
+ 		return;
+ 	}
+ 	/* disconnect the plane from the fb and crtc: */
+-	__drm_framebuffer_unreference(plane->old_fb);
++	drm_framebuffer_unreference(plane->old_fb);
+ 	plane->old_fb = NULL;
+ 	plane->fb = NULL;
+ 	plane->crtc = NULL;
+-- 
+2.1.0
+
diff --git a/drm-i915-Don-t-try-to-reference-the-fb-in-get_initia.patch b/drm-i915-Don-t-try-to-reference-the-fb-in-get_initia.patch
new file mode 100644
index 000000000..ba40a8431
--- /dev/null
+++ b/drm-i915-Don-t-try-to-reference-the-fb-in-get_initia.patch
@@ -0,0 +1,94 @@
+From: Damien Lespiau <damien.lespiau@intel.com>
+Date: Thu, 5 Feb 2015 18:30:20 +0000
+Subject: [PATCH] drm/i915: Don't try to reference the fb in
+ get_initial_plane_config()
+
+Tvrtko noticed a new warning on boot:
+
+  WARNING: CPU: 1 PID: 353 at include/linux/kref.h:47 drm_framebuffer_reference+0x6c/0x80 [drm]()
+  Call Trace:
+  [<ffffffff8161f10c>] dump_stack+0x4f/0x7b
+  [<ffffffff81052caa>] warn_slowpath_common+0xaa/0xd0
+  [<ffffffff81052d8a>] warn_slowpath_null+0x1a/0x20
+  [<ffffffffa00d035c>] drm_framebuffer_reference+0x6c/0x80 [drm]
+  [<ffffffffa01c0df7>] update_state_fb.isra.54+0x47/0x50 [i915]
+  [<ffffffffa01ccd5c>] skylake_get_initial_plane_config+0x93c/0x950 [i915]
+  [<ffffffffa01e8721>] intel_modeset_init+0x1551/0x17c0 [i915]
+  [<ffffffffa02476e0>] i915_driver_load+0xed0/0x11e0 [i915]
+  [<ffffffff81627aa1>] ? _raw_spin_unlock_irqrestore+0x51/0x70
+  [<ffffffffa00ca8b7>] drm_dev_register+0x77/0x110 [drm]
+  [<ffffffffa00cda3b>] drm_get_pci_dev+0x11b/0x1f0 [drm]
+  [<ffffffff81098e3d>] ? trace_hardirqs_on+0xd/0x10
+  [<ffffffff81627aa1>] ? _raw_spin_unlock_irqrestore+0x51/0x70
+  [<ffffffffa0145276>] i915_pci_probe+0x56/0x60 [i915]
+  [<ffffffff813ad59c>] pci_device_probe+0x7c/0x100
+  [<ffffffff81466aad>] driver_probe_device+0x16d/0x380
+
+We cannot take a reference at this point, not before
+intel_framebuffer_init() and the underlying drm_framebuffer_init().
+
+Introduced in:
+
+  commit 706dc7b549175e47f23e913b7f1e52874a7d0f56
+  Author: Matt Roper <matthew.d.roper@intel.com>
+  Date:   Tue Feb 3 13:10:04 2015 -0800
+
+      drm/i915: Ensure plane->state->fb stays in sync with plane->fb
+
+v2: Don't move update_state_fb(). It was moved around because I
+    originally put update_state_fb() in intel_alloc_plane_obj() before
+    finding a better place. (Matt)
+
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Reported-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Cc: Matt Roper <matthew.d.roper@intel.com>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Signed-off-by: Damien Lespiau <damien.lespiau@intel.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+---
+ drivers/gpu/drm/i915/intel_display.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index e116dee10cf9..177714a9d778 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -2438,8 +2438,10 @@ intel_find_plane_obj(struct intel_crtc *intel_crtc,
+ 	if (!intel_crtc->base.primary->fb)
+ 		return;
+ 
+-	if (intel_alloc_plane_obj(intel_crtc, plane_config))
++	if (intel_alloc_plane_obj(intel_crtc, plane_config)) {
++		update_state_fb(intel_crtc->base.primary);
+ 		return;
++	}
+ 
+ 	kfree(intel_crtc->base.primary->fb);
+ 	intel_crtc->base.primary->fb = NULL;
+@@ -6663,7 +6665,6 @@ i9xx_get_initial_plane_config(struct intel_crtc *crtc,
+ 		      plane_config->size);
+ 
+ 	crtc->base.primary->fb = fb;
+-	update_state_fb(crtc->base.primary);
+ }
+ 
+ static void chv_crtc_clock_get(struct intel_crtc *crtc,
+@@ -7704,7 +7705,6 @@ skylake_get_initial_plane_config(struct intel_crtc *crtc,
+ 		      plane_config->size);
+ 
+ 	crtc->base.primary->fb = fb;
+-	update_state_fb(crtc->base.primary);
+ 	return;
+ 
+ error:
+@@ -7798,7 +7798,6 @@ ironlake_get_initial_plane_config(struct intel_crtc *crtc,
+ 		      plane_config->size);
+ 
+ 	crtc->base.primary->fb = fb;
+-	update_state_fb(crtc->base.primary);
+ }
+ 
+ static bool ironlake_get_pipe_config(struct intel_crtc *crtc,
+-- 
+2.1.0
+
diff --git a/kernel.spec b/kernel.spec
index 3efb7c669..3af55f2ae 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -68,7 +68,7 @@ Summary: The Linux kernel
 # The rc snapshot level
 %define rcrev 5
 # The git snapshot level
-%define gitrev 0
+%define gitrev 1
 # Set rpm version accordingly
 %define rpmversion 4.%{upstream_sublevel}.0
 %endif
@@ -627,9 +627,8 @@ Patch26168: HID-multitouch-add-support-of-clickpads.patch
 Patch26170: acpi-video-Allow-forcing-native-backlight-on-non-win.patch
 Patch26171: acpi-video-Add-force-native-backlight-quirk-for-Leno.patch
 
-Patch26172: Revert-drm-i915-Ensure-plane-state-fb-stays-in-sync-.patch
-
-Patch26173: net-validate-the-range-we-feed-to-iov_iter_init-in-s.patch
+Patch26172: drm-Fixup-racy-refcounting-in-plane_force_disable.patch
+Patch26173: drm-i915-Don-t-try-to-reference-the-fb-in-get_initia.patch
 
 # END OF PATCH DEFINITIONS
 
@@ -1369,9 +1368,8 @@ ApplyPatch HID-multitouch-add-support-of-clickpads.patch
 ApplyPatch acpi-video-Allow-forcing-native-backlight-on-non-win.patch
 ApplyPatch acpi-video-Add-force-native-backlight-quirk-for-Leno.patch
 
-ApplyPatch Revert-drm-i915-Ensure-plane-state-fb-stays-in-sync-.patch
-
-ApplyPatch net-validate-the-range-we-feed-to-iov_iter_init-in-s.patch
+ApplyPatch drm-Fixup-racy-refcounting-in-plane_force_disable.patch
+ApplyPatch drm-i915-Don-t-try-to-reference-the-fb-in-get_initia.patch
 
 # END OF PATCH APPLICATIONS
 
@@ -2223,6 +2221,10 @@ fi
 #
 # 
 %changelog
+* Tue Mar 24 2015 Josh Boyer <jwboyer@fedoraproject.org> - 4.0.0-0.rc5.git1.3
+- Linux v4.0-rc5-25-g90a5a895cc8b
+- Add some i915 fixes
+
 * Mon Mar 23 2015 Josh Boyer <jwboyer@fedoraproject.org> - 4.0.0-0.rc5.git0.3
 - Enable CONFIG_SND_BEBOB (rhbz 1204342)
 - Validate iovec range in sys_sendto/sys_recvfrom
diff --git a/net-validate-the-range-we-feed-to-iov_iter_init-in-s.patch b/net-validate-the-range-we-feed-to-iov_iter_init-in-s.patch
deleted file mode 100644
index d82fb0f51..000000000
--- a/net-validate-the-range-we-feed-to-iov_iter_init-in-s.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From: Al Viro <viro@ZenIV.linux.org.uk>
-Date: Fri, 20 Mar 2015 17:41:43 +0000
-Subject: [PATCH] net: validate the range we feed to iov_iter_init() in
- sys_sendto/sys_recvfrom
-
-Cc: stable@vger.kernel.org # v3.19
-Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
-Signed-off-by: David S. Miller <davem@davemloft.net>
----
- net/socket.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/net/socket.c b/net/socket.c
-index bbedbfcb42c2..245330ca0015 100644
---- a/net/socket.c
-+++ b/net/socket.c
-@@ -1702,6 +1702,8 @@ SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
- 
- 	if (len > INT_MAX)
- 		len = INT_MAX;
-+	if (unlikely(!access_ok(VERIFY_READ, buff, len)))
-+		return -EFAULT;
- 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
- 	if (!sock)
- 		goto out;
-@@ -1760,6 +1762,8 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
- 
- 	if (size > INT_MAX)
- 		size = INT_MAX;
-+	if (unlikely(!access_ok(VERIFY_WRITE, ubuf, size)))
-+		return -EFAULT;
- 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
- 	if (!sock)
- 		goto out;
--- 
-2.1.0
-
diff --git a/sources b/sources
index e336c2931..85255192c 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,3 @@
 b26150c980099ef554b26d07f470e647  linux-4.0-rc5.tar.xz
 7614f559a09f0242827fc7783c7adf3f  perf-man-4.0-rc5.tar.gz
+658fcb5b3fbc9bd1ccbf4f8ce5a9e79c  patch-4.0-rc5-git1.xz