466e69b8 dropped busmaster enable from the
global drm code and moved it to the individual drivers, but missed the savage
driver. So, this re-adds busmaster enable to the savage driver, fixing the
regression.
Signed-off-by: NFlorian Zumbiehl <florz@florz.de>
Reviewed-by: NAlex Deucher <alexdeucher@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: NDave Airlie <airlied@redhat.com>

We set ".disable" to "ast_crtc_disable" twice.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

Use the new WRITE_DATA packet rather than the legacy
ME_WRITE packet.
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>

Pass the vm and ring index rather than an IB.  This allows
us to use the vm_flush interface for non-IB cases in the
future.
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>
Reviewed-by: NChristian König <christian.koenig@amd.com>

This is the preferred packet for writing data to memory
or registers on SI.
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>

Starting on BTC, there are no longer separate states for
single head and multi-head, we just use the high mclk/voltage
for all states for multi-head.

Fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=49981

v2: fix typo
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>

Previously read-only KMS ioctls had some somewhat inconsistent settings
regarding whether mastership was required.  For example, GETRESOURCES
did not require master, but GETPLANERESOURCES, GETPROPERTY, etc. did.

At least for debugging, it is nice to be able to use modetest to dump
property values while another process is master, and there seems to
be no harm in allowing read-only access to the KMS state to other
processes.
Signed-off-by: NRob Clark <rob@ti.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

For drivers that can support rotated scanout, the extra parameter
checking in drm-core, while nice, tends to get confused.  To solve
this drivers can set the crtc or plane invert_dimensions field so
that the dimension checking takes into account the rotation that
the driver is performing.

v1: original
v2: remove invert_dimensions from plane, at Ville's suggestion.
    Userspace can give rotated src coordinates, so invert_dimensions
    is not required for planes.
Signed-off-by: NRob Clark <rob@ti.com>
Reviewed-by: NVille Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

This simplifies drm fb lifetime, and if the crtc/plane needs to hold
a ref to the fb when disabling a pipe until the next vblank, this
avoids the need to make disabling an overlay synchronous.  This is a
problem that shows up when userspace is using a drm plane to
implement a hw cursor.. making overlay disable synchronous causes
a performance problem when x11 is rapidly enabling/disabling the
hw cursor.  But not making it synchronous opens up a race condition
for crashing if userspace turns around and immediately deletes the
fb.  Refcnt'ing the fb makes it possible to solve this problem.

v1: original
v2: add drm_framebuffer_remove() which is called in all paths where
    fb->funcs->destroy() was directly called before.  This cleans
    up the CRTCs/planes that the fb was attached to.  You should
    only directly use drm_framebuffer_unreference() if you are also
    using drm_framebuffer_reference() to keep a ref to the fb.
v3: add comment explaining the fb refcount
v4: remove duplicate 'list_del(&fb->filp_head)'

[airlied: v4.1: fix local rejection]
Signed-off-by: NRob Clark <rob@ti.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

Remove useless kfree() and clean up code related to the removal.

The semantic patch that finds this problem is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@r exists@
position p1,p2;
expression x;
@@

if (x@p1 == NULL) { ... kfree@p2(x); ... return ...; }

@unchanged exists@
position r.p1,r.p2;
expression e <= r.x,x,e1;
iterator I;
statement S;
@@

if (x@p1 == NULL) { ... when != I(x,...) S
                        when != e = e1
                        when != e += e1
                        when != e -= e1
                        when != ++e
                        when != --e
                        when != e++
                        when != e--
                        when != &e
   kfree@p2(x); ... return ...; }

@ok depends on unchanged exists@
position any r.p1;
position r.p2;
expression x;
@@

... when != true x@p1 == NULL
kfree@p2(x);

@depends on !ok && unchanged@
position r.p2;
expression x;
@@

*kfree@p2(x);
// </smpl>
Signed-off-by: NPeter Senna Tschudin <peter.senna@gmail.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

As during the plane cleanup, we wish to disable the hardware and
so may modify state on the associated CRTC, that CRTC must continue to
exist until we are finished.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=54101Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>
Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
Cc: stable@vger.kernel.org
Reviewed-by: NJesse Barnes <jbarnes@virtuousgeek.org>
Tested-by: Nlu hua <huax.lu@intel.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

Use copy_highpage() to copy from one page to another.
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Cc: dri-devel@lists.freedesktop.org
Signed-off-by: NDave Airlie <airlied@redhat.com>

Fixes the following sparse warnings:
drivers/gpu/drm/udl/udl_fb.c:360:6: warning:
symbol 'udl_crtc_fb_gamma_set' was not declared. Should it be static?
drivers/gpu/drm/udl/udl_fb.c:365:6: warning:
symbol 'udl_crtc_fb_gamma_get' was not declared. Should it be static?
Signed-off-by: NSachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: NDave Airlie <airlied@redhat.com>

Fixes the following sparse warning:
drivers/gpu/drm/udl/udl_modeset.c:394:5: warning:
symbol 'udl_crtc_init' was not declared. Should it be static?
Signed-off-by: NSachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: NDave Airlie <airlied@redhat.com>

Fixes the following sparse warning:
drivers/gpu/drm/udl/udl_encoder.c:19:6: warning:
symbol 'udl_enc_destroy' was not declared. Should it be static?
Signed-off-by: NSachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: NDave Airlie <airlied@redhat.com>

Fixes the following sparse warnings:
drivers/gpu/drm/udl/udl_transfer.c:129:50:
drivers/gpu/drm/udl/udl_transfer.c:130:50:
drivers/gpu/drm/udl/udl_transfer.c:131:45:
drivers/gpu/drm/udl/udl_transfer.c:132:61:
warning: Using plain integer as NULL pointer
Signed-off-by: NSachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: NDave Airlie <airlied@redhat.com>

Driver used to print "default" as the state type regardless
of whether it is the default state.
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>

There are so many quirks, lets just try and force
this for all RS690s.  See:
https://bugs.freedesktop.org/show_bug.cgi?id=37679Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org

Fixes another system on:
https://bugs.freedesktop.org/show_bug.cgi?id=37679Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org

MIP_ADDRESS should point to the resolved FMASK for an MSAA texture.
Setting MIP_ADDRESS to 0 means the FMASK pointer is invalid (the GPU
won't read the memory then).

The userspace has to set MIP_ADDRESS to 0 and *not* emit any relocation
for it.
Signed-off-by: NMarek Olšák <maraeo@gmail.com>
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org

This is required to make streamout work there.
Signed-off-by: NMarek Olšák <maraeo@gmail.com>
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org

PDE/PTE update code uses CP ring for memory writes.
All page table entries are preallocated for now in alloc_pt().

It is made as whole because it's hard to divide it to several patches
that compile and doesn't break anything being applied separately.

Tested on cayman card.

v2: rebased on top of "refactor set_page chipset interface v3",
    code cleanups

v3: switched offsets calc macros to inline funcs where possible,
    remove pd_addr from radeon_vm, switched RADEON_BLOCK_SIZE define,
    to 9 (and PTE_COUNT to 1 << BLOCK_SIZE)

v4 (ck): move "incr" documentation to previous patch, cleanup and
         document RADEON_VM_* constants, change commit message to
         our usual format, simplify patch allot by removing
         everything current not necessary, disable SI workaround.

v5: (agd5f): Fix typo in tables_size calculation in
             radeon_vm_alloc_pt().  Second line should have been
             '+=' rather than '='.

v6: fix npdes calculation. In scenario when pfns to be mapped overlap
two PDE spans:

   +-----------+-------------+
   | PDE span  | PDE span    |
   +-----------+----+--------+
          |         |
          +---------+
          | pfns    |
          +---------+

the following npdes calculation gives incorrect result:

npdes = (nptes >> RADEON_VM_BLOCK_SIZE) + 1;

For the case above picture it should give npdes = 2, but gives one.

This patch corrects it by rounding last pfn up to 512 border,
first - down to 512 border and then subtracting and dividing by 512.

v7: Make npde calculation clearer, fix ndw calculation.

v8: (agd5f): reserve enough for 2 full VM PTs, add some
             additional comments.

v9: fix typo in npde calculation
Signed-off-by: NDmitry Cherkasov <Dmitrii.Cherkasov@amd.com>
Signed-off-by: NChristian König <deathsimple@vodafone.de>
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>

Cleanup the interface in preparation for hierarchical page tables.

v2: add incr parameter to set_page for simple scattered PTs uptates
    added PDE-specific flags to r600_flags and radeon_drm.h
    removed superfluous value masking with 0xffffffff

v3: removed superfluous bo_va->valid checking
    changed R600_PTE_VALID to R600_ENTRY_VALID to handle PDE too

v4 (ck): fix indention style, rework and fix typos in commit message,
         add documentation for incr parameter, also use incr
         parameter for system pages

v5 (agd5f): use upper_32_bits() and minor white space fixes
Signed-off-by: NChristian König <deathsimple@vodafone.de>
Signed-off-by: NDmitry Cherkassov <Dmitrii.Cherkasov@amd.com>
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>

Restructure the code to jump out via labels instead of directly returning
early. Also make error reporting consistent across all hardware generations.
Signed-off-by: NMichel Dänzer <michel.daenzer@amd.com>
Reviewed-by: NSimon Kitching <skitching@vonos.net>
Reviewed-by: NChristian König <christian.koenig@amd.com>
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>

Restore the backlight level on resume.  Some systems
need to explicitly restore the backlight level on
resume.

Fixes panel resume on my Trinity laptop and may fix the
following bugs:
https://bugs.freedesktop.org/show_bug.cgi?id=43829
https://bugzilla.kernel.org/show_bug.cgi?id=46241Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>

Read back the backlight level from the hw.
Needed for proper backlight restoration on resume.
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>

SI asics store voltage information differently so we
don't have a way to deal with it properly yet.
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org

This allows us to bail if we can't support the requested
setup from a PPLL perspective.  Prevents broken setups
from being attempted.
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>

Since the current KMS API sets the mode independantly on
each crtc, we may end up with resource conflicts.  The PLL
allocation is one of those cases.  In the following example
we have 3 crtcs in use driving 2 DVI connectors and 1 DP
connector.  On the initial kernel modeset for fbdev, the
display topology ends up as follows:

crtc0 -> DP-0
crtc1 -> DVI-0
crtc2 -> DVI-1

Because this is the first modeset, all of the PLLs are
available as none have been assigned.  So we end up with
the following:

crtc0 uses DCPLL
crtc1 uses PPLL2
crtc2 uses PPLL1

When X starts, it assigns a different topology:

crtc0 -> DVI-0
crtc1 -> DP-0
crtc2 -> DVI-1

However, since the KMS API is per crtc, we set the mode on each
crtc independantly.  When it comes time to set the mode on crtc0,
the topology for crtc1 and crtc2 are still intact.  crtc1 and
crtc2 are already assigned PPLL2 and PPLL1 so when it comes time
to set the mode on crtc0, crtc1 and crtc2 have not been torn down
yet, so there appears to be no PLLs available.  In reality, we
are reconfiguring the entire display topology, however, since
each crtc is handled independantly, we don't know that in the
driver at each crtc mode set time.

This patch checks to see if the same connector is being driven by
another crtc, and if so, uses the PLL already associated with it.

v2: store connector in the radeon crtc struct, simplify checking.
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>

Finishes commit 02d71956
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Thu Aug 9 16:44:54 2012 +0200

    drm/i915: properly guard ilk ips state

The core functions were annotated with their locking requirements, but
we overlooked that they were exported, without any control over the
locking, to debugfs. So in order to enable debugfs to read the registers
without triggering sanity checks, we change the exported entry points to
properly take the required locks before calling the core routines.
Reported-by: Nyangguang <guang.a.yang@intel.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=55304Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>

Signed-off-by: NBen Widawsky <ben@bwidawsk.net>
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>

... even if the actual infoframe is smaller than the maximum possible
size.

If we don't write all the 32 DIP data bytes the InfoFrame ECC may not
be correctly calculated in some cases (e.g., when changing the port),
and this will lead to black screens on HDMI monitors. The ECC value is
generated by the hardware.

I don't see how this should break anything since we're writing 0 and
that should be the correct value, so this patch should be safe.

Notice that on IVB and older we actually have 64 bytes available for
VIDEO_DIP_DATA, but only bytes 0-31 actually store infoframe data: the
others are either read-only ECC values or marked as "reserved". On HSW
we only have 32 bytes, and the ECC value is stored on its own separate
read-only register. See BSpec.

This patch fixes bug #46761, which is marked as a regression
introduced by commit 4e89ee17:
    drm/i915: set the DIP port on ibx_write_infoframe

Before commit 4e89 we were just failing to send AVI infoframes when we
needed to change the port, which can lead to black screens in some
cases. After commit 4e89 we started sending infoframes, but with a
possibly wrong ECC value. After this patch I hope we start sending
correct infoframes.

Version 2:
  - Improve commit message
  - Try to make the code more clear

Cc: stable@vger.kernel.org
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=46761Signed-off-by: NPaulo Zanoni <paulo.r.zanoni@intel.com>
Reviewed-by: NRodrigo Vivi <rodrigo.vivi@gmail.com>
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>

This should never happen, but the silent "return" makes me wonder
every time I try to debug InfoFrame bugs, so promote this to BUG() to
make sure people will complain if we ever break this.
Signed-off-by: NPaulo Zanoni <paulo.r.zanoni@intel.com>
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>

Fix potential NULL pointer dereference in edac_unregister_sysfs() on
system boot introduced in 3.6-rc1.

Since commit 7a623c03 ("edac: rewrite the sysfs code to use struct
device") edac_mc_alloc() no longer initializes embedded kobjects in
struct mem_ctl_info.  Therefore edac_mc_free() can no longer simply
decrement a kobject reference count to free the allocated memory unless
the memory controller driver module had also called edac_mc_add_mc().

Now edac_mc_free() will check if the newly embedded struct device has
been registered with sysfs before using either the standard device
release functions or freeing the data structures itself with logic
pulled out of the error path of edac_mc_alloc().

The BUG this patch resolves for me:

  BUG: unable to handle kernel NULL pointer dereference at   (null)
  EIP is at __wake_up_common+0x1a/0x6a
  Process modprobe (pid: 933, ti=f3dc6000 task=f3db9520 task.ti=f3dc6000)
  Call Trace:
    complete_all+0x3f/0x50
    device_pm_remove+0x23/0xa2
    device_del+0x34/0x142
    edac_unregister_sysfs+0x3b/0x5c [edac_core]
    edac_mc_free+0x29/0x2f [edac_core]
    e7xxx_probe1+0x268/0x311 [e7xxx_edac]
    e7xxx_init_one+0x56/0x61 [e7xxx_edac]
    local_pci_probe+0x13/0x15
  ...

Cc: Mauro Carvalho Chehab <mchehab@redhat.com>
Cc: Shaohui Xie <Shaohui.Xie@freescale.com>
Signed-off-by: NShaun Ruffell <sruffell@digium.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

coccinelle warns about:

+ drivers/edac/edac_mc.c:429:9-23: ERROR: reference preceded by free on line 429

   421         if (mci->csrows) {
 > 422                 for (chn = 0; chn < tot_channels; chn++) {
   423                         csr = mci->csrows[chn];
   424                         if (csr) {
 > 425                                 for (chn = 0; chn < tot_channels; chn++)
   426                                          kfree(csr->channels[chn]);
   427                                  kfree(csr);
   428                          }
 > 429                          kfree(mci->csrows[i]);
   430                  }
   431                  kfree(mci->csrows);
   432          }

and that code block seem to mess things up in several ways (double free, memory
leak, out-of-bound reads etc.):

L422: The iterator "chn" and bound "tot_channels" are totally wrong. Should be
      "row" and "tot_csrows" respectively. Which means either memory leak, or
      out-of-bound reads (which if does not trigger an immediate page fault
      error, will further lead to kfree() on random addresses).

L425: The inner loop is reusing the same iterator "chn" as the outer loop,
      which could lead to premature end of the outer loop, and hence memory leak.

L429: The array index 'i' in mci->csrows[i] is a temporary value used in
      previous loops, and won't change at all in the current loop. Which
      means either out-of-bound read and possibly kfree(random number), or the
      same mci->csrows[i] get freed once and again, and possibly double free
      for the kfree(csr) in L427.

L426/L427: a kfree(csr->channels) is needed in between to avoid leaking the memory.

The buggy code was introduced by commit de3910eb ("edac: change the mem
allocation scheme to make Documentation/kobject.txt happy") in the 3.6-rc1
merge window. Fix it by freeing up resources in this order:

  free csrows[i]->channels[j]
  free csrows[i]->channels
  free csrows[i]
  free csrows

CC: Mauro Carvalho Chehab <mchehab@redhat.com>
CC: Shaun Ruffell <sruffell@digium.com>
Signed-off-by: NFengguang Wu <fengguang.wu@intel.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The quirk introduced with commit
00250ec9 (hwmon: fam15h_power: fix
bogus values with current BIOSes) is not only required during driver
load but also when system resumes from suspend. The BIOS might set the
previously recommended (but unsuitable) initilization value for the
running average range register during resume.
Signed-off-by: NAndreas Herrmann <andreas.herrmann3@amd.com>
Tested-by: NAndreas Hartmann <andihartmann@01019freenet.de>
Signed-off-by: NJean Delvare <khali@linux-fr.org>
Cc: stable@vger.kernel.org # 3.0+

coretemp_init loops with for_each_online_cpu, adding platform_devices
and sysfs interfaces, then calls register_hotcpu_notifier.  There is a
race if a CPU is offlined or onlined after the loop, but before
register_hotcpu_notifier.  The race might result in the absence of a
platform_device+sysfs interface for an online CPU, or the presence of
a platform_device+sysfs interface for an offline CPU.  A similar race
occurs during coretemp_exit, after the module calls
unregister_hotcpu_notifier, but before it unregisters all devices, a
CPU might offline and a device for an offline CPU will exist for a
short while.

This fix surrounds for_each_online_cpu and register_hotcpu_notifier
with get_online_cpus+put_online_cpus; and surrounds
unregister_hotcpu_notifier and device unregistering with
get_online_cpus+put_online_cpus.

Build tested.
Signed-off-by: NSilas Boyd-Wickizer <sbw@mit.edu>
Signed-off-by: NJean Delvare <khali@linux-fr.org>

via_cputemp_init loops with for_each_online_cpu, adding
platform_devices, then calls register_hotcpu_notifier.  If a CPU is
offlined between the loop and register_hotcpu_notifier, then later
onlined, via_cputemp_device_add will attempt to add platform devices
with the same ID.  A similar race occurs during via_cputemp_exit,
after the module calls unregister_hotcpu_notifier, a CPU might offline
and a device will exist for a CPU that is offline.

This fix surrounds for_each_online_cpu and register_hotcpu_notifier
with get_online_cpus+put_online_cpus; and surrounds
unregister_hotcpu_notifier and device unregistering with
get_online_cpus+put_online_cpus.

Build tested.
Signed-off-by: NSilas Boyd-Wickizer <sbw@mit.edu>
Acked-by: NHarald Welte <laforge@gnumonks.org>
Signed-off-by: NJean Delvare <khali@linux-fr.org>

This patch fixes an issue introduced after commit 4ea54542
("HID: Fix race condition between driver core and ll-driver").

After that commit, hid-core discards any incoming packet that arrives while
hid driver's probe function is being executed.

This broke the enumeration process of hid-logitech-dj, that must receive
control packets in-band with the mouse and keyboard packets. Discarding mouse
or keyboard data at the very begining is usually fine, but it is not the case
for control packets.

This patch forces a re-enumeration of the paired devices when a packet arrives
that comes from an unknown device.

Based on a patch originally written by Benjamin Tissoires.

Cc: stable@vger.kernel.org   # v3.2+
Signed-off-by: NNestor Lopez Casado <nlopezcasad@logitech.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

We need to kfree names for led_mute and led_micmute in tpkbd_remove_tp().
Signed-off-by: NAxel Lin <axel.lin@gmail.com>
Acked-by: NBernhard Seibold <mail@bernhard-seibold.de>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>