[linux] 01/03: Update to 3.2.91
debian-kernel at lists.debian.org
debian-kernel at lists.debian.org
Thu Aug 17 20:34:00 UTC 2017
This is an automated email from the git hooks/post-receive script.
benh pushed a commit to branch wheezy-security
in repository linux.
commit 908c459d88e9363e5015fb78eea598def6102009
Author: Ben Hutchings <ben at decadent.org.uk>
Date: Thu Aug 17 21:15:47 2017 +0100
Update to 3.2.91
Refresh drm-3.4.patch.
---
debian/changelog | 85 +++-
debian/patches/features/all/drm/drm-3.4.patch | 649 ++++++++++++++++++--------
2 files changed, 544 insertions(+), 190 deletions(-)
diff --git a/debian/changelog b/debian/changelog
index 749bd11..eeccfb5 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,4 +1,4 @@
-linux (3.2.90-1) UNRELEASED; urgency=medium
+linux (3.2.91-1) UNRELEASED; urgency=medium
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.90
@@ -7,6 +7,89 @@ linux (3.2.90-1) UNRELEASED; urgency=medium
(CVE-2017-7482)
- mm: simplify find_vma_prev()
- mm: fix find_vma_prev
+ https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.91
+ - xen: do not re-use pirq number cached in pci device msi msg data
+ - usb: dwc3: gadget: make Set Endpoint Configuration macros safe
+ - scsi: aacraid: Fix typo in blink status
+ - scsi: lpfc: Add shutdown method for kexec
+ - USB: serial: io_ti: fix NULL-deref in interrupt callback
+ - USB: serial: safe_serial: fix information leak in completion handler
+ - dvb-usb: don't use stack for firmware load
+ - dvb-usb-firmware: don't do DMA on stack
+ - USB: iowarrior: fix NULL-deref in write
+ - udp: avoid ufo handling on IP payload compression packets
+ - isdn/gigaset: fix NULL-deref at probe
+ - net: wimax/i2400m: fix NULL-deref at probe
+ - USB: idmouse: fix NULL-deref at probe
+ - USB: uss720: fix NULL-deref at probe
+ - USB: wusbcore: fix NULL-deref at probe
+ - uwb: hwa-rc: fix NULL-deref at probe
+ - uwb: i1480-dfu: fix NULL-deref at probe
+ - usb-core: Add LINEAR_FRAME_INTR_BINTERVAL USB quirk
+ - futex: Fix potential use-after-free in FUTEX_REQUEUE_PI
+ - futex: Add missing error handling to FUTEX_REQUEUE_PI
+ - sched/loadavg: Avoid loadavg spikes caused by delayed NO_HZ accounting
+ - perf/core: Fix event inheritance on fork()
+ - mmc: ushc: fix NULL-deref at probe
+ - Input: iforce - validate number of endpoints before using them
+ - Input: cm109 - validate number of endpoints before using them
+ - Input: yealink - validate number of endpoints before using them
+ - Input: hanwang - validate number of endpoints before using them
+ - Input: kbtab - validate number of endpoints before using them
+ - net: ipv6: set route type for anycast routes
+ - USB: usbtmc: add missing endpoint sanity check
+ - ACM gadget: fix endianness in notifications
+ - ALSA: ctxfi: Fix the incorrect check of dma_set_mask() call
+ - scsi: libsas: fix ata xfer length
+ - ALSA: seq: Fix racy cell insertions during snd_seq_pool_done()
+ - net: unix: properly re-increment inflight counter of GC discarded
+ candidates
+ - bpf: try harder on clones when writing into skb
+ - sch_dsmark: fix invalid skb_cow() usage
+ - mmc: sdhci: Do not disable interrupts while waiting for clock
+ - hwmon: (asus_atk0110) fix uninitialized data access
+ - ALSA: seq: Fix race during FIFO resize
+ - net: phy: handle state correctly in phy_stop_machine
+ - IB/qib: fix false-postive maybe-uninitialized warning
+ - netfilter: nf_nat_snmp: Fix panic when snmp_trap_helper fails to register
+ - virtio_balloon: init 1st buffer in stats vq
+ - virtio_balloon: prevent uninitialized variable use
+ - ACPI / APEI: Add missing synchronize_rcu() on NOTIFY_SCI removal
+ - ACPI: Fix incompatibility with mcount-based function graph tracing
+ - xhci: Manually give back cancelled URB if we can't queue it for cancel
+ - ubi/upd: Always flush after prepared for an update
+ - mmc: sdhci: Disable runtime pm when the sdio_irq is enabled
+ - l2tp: fix race in l2tp_recv_common()
+ - l2tp: ensure session can't get removed during pppol2tp_session_ioctl()
+ - l2tp: fix duplicate session creation
+ - l2tp: take a reference on sessions used in genetlink handlers
+ - iscsi-target: Drop work-around for legacy GlobalSAN initiator
+ - af_key: Add lock to key dump
+ - l2tp: take reference on sessions being dumped
+ - xen, fbfront: fix connecting to backend
+ - scsi: sr: Sanity check returned mode data
+ - scsi: sd: Fix capacity calculation with 32-bit sector_t
+ - ptrace: fix PTRACE_LISTEN race corrupting task->state
+ - l2tp: don't mask errors in pppol2tp_setsockopt()
+ - l2tp: don't mask errors in pppol2tp_getsockopt()
+ - [x86] vdso: Plug race between mapping and ELF header setup
+ - ALSA: seq: Don't break snd_use_lock_sync() loop by timeout
+ - [x86] ftrace: Fix triple fault with graph tracing and suspend-to-ram
+ - p9_client_readdir() fix
+ - KEYS: Change the name of the dead type to ".dead" to prevent user access
+ - ACPI / power: Avoid maybe-uninitialized warning
+ - ring-buffer: Have ring_buffer_iter_empty() return true when empty
+ - mac80211: reject ToDS broadcast data frames
+ - smsc75xx: use skb_cow_head() to deal with cloned skbs
+ - cx82310_eth: use skb_cow_head() to deal with cloned skbs
+ - [x86] mm/init.c: Fix devmem_is_allowed() off by one
+ - [x86] mm: Tighten x86 /dev/mem with zeroing reads (CVE-2017-7889)
+ - xen-blkback: don't leak stack data via response ring (CVE-2017-10911)
+ - char: lp: fix possible integer overflow in lp_setup() (CVE-2017-1000363)
+ - fs/exec.c: account for argv/envp pointers (CVE-2017-1000365)
+ - ALSA: timer: Fix race between read and ioctl (CVE-2017-1000380)
+ - ALSA: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT
+ (CVE-2017-1000380)
-- Ben Hutchings <ben at decadent.org.uk> Mon, 03 Jul 2017 17:17:55 +0100
diff --git a/debian/patches/features/all/drm/drm-3.4.patch b/debian/patches/features/all/drm/drm-3.4.patch
index 5eb4040..5f5548d 100644
--- a/debian/patches/features/all/drm/drm-3.4.patch
+++ b/debian/patches/features/all/drm/drm-3.4.patch
@@ -1009,10 +1009,11 @@ index 4ca454bf69a3..93c5b2fdf9b4 100644
for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
if (connector->encoder_ids[i] != 0) {
if (put_user(connector->encoder_ids[i],
-@@ -1471,6 +1554,254 @@ int drm_mode_getencoder(struct drm_device *dev, void *data,
+@@ -1470,6 +1553,254 @@ int drm_mode_getencoder(struct drm_device *dev, void *data,
+ return ret;
}
- /**
++/**
+ * drm_mode_getplane_res - get plane info
+ * @dev: DRM device
+ * @data: ioctl data
@@ -1260,10 +1261,9 @@ index 4ca454bf69a3..93c5b2fdf9b4 100644
+ return ret;
+}
+
-+/**
+ /**
* drm_mode_setcrtc - set CRTC configuration
* @inode: inode from the ioctl
- * @filp: file * from the ioctl
@@ -1478,7 +1809,7 @@ int drm_mode_getencoder(struct drm_device *dev, void *data,
* @arg: arg from ioctl
*
@@ -3216,10 +3216,11 @@ index 5f1a65378ee4..b90abff19341 100644
if (filp->f_op == NULL) {
filp->f_op = old_fops;
goto out;
-@@ -219,62 +225,6 @@ static int drm_cpu_valid(void)
+@@ -218,62 +224,6 @@ static int drm_cpu_valid(void)
+ return 1;
}
- /**
+-/**
- * drm_new_set_master - Allocate a new master object and become master for the
- * associated master realm.
- *
@@ -3275,10 +3276,9 @@ index 5f1a65378ee4..b90abff19341 100644
- return ret;
-}
-
--/**
+ /**
* Called whenever a process opens /dev/drm.
*
- * \param inode device inode.
@@ -324,6 +274,9 @@ static int drm_open_helper(struct inode *inode, struct file *filp,
if (dev->driver->driver_features & DRIVER_GEM)
drm_gem_open(dev, priv);
@@ -3673,10 +3673,11 @@ index fb8e46b4e8bc..b7adb4a967fd 100644
}
if (p->flags & DRM_MODE_FLAG_DBLSCAN) {
-@@ -716,6 +714,27 @@ EXPORT_SYMBOL(drm_mode_set_crtcinfo);
+@@ -715,6 +713,27 @@ void drm_mode_set_crtcinfo(struct drm_display_mode *p, int adjust_flags)
+ EXPORT_SYMBOL(drm_mode_set_crtcinfo);
- /**
++/**
+ * drm_mode_copy - copy the mode
+ * @dst: mode to overwrite
+ * @src: mode to copy
@@ -3697,10 +3698,9 @@ index fb8e46b4e8bc..b7adb4a967fd 100644
+}
+EXPORT_SYMBOL(drm_mode_copy);
+
-+/**
+ /**
* drm_mode_duplicate - allocate and duplicate an existing mode
* @m: mode to duplicate
- *
@@ -729,16 +748,13 @@ struct drm_display_mode *drm_mode_duplicate(struct drm_device *dev,
const struct drm_display_mode *mode)
{
@@ -45911,10 +45911,11 @@ index 9b9f447b571a..e97ed611d8c0 100644
obj->pending_gpu_write = true;
list_move_tail(&obj->gpu_write_list,
&ring->gpu_write_list);
-@@ -998,6 +1048,31 @@ i915_gem_execbuffer_retire_commands(struct drm_device *dev,
+@@ -997,6 +1047,31 @@ i915_gem_execbuffer_retire_commands(struct drm_device *dev,
+ }
}
- static int
++static int
+i915_reset_gen7_sol_offsets(struct drm_device *dev,
+ struct intel_ring_buffer *ring)
+{
@@ -45939,10 +45940,9 @@ index 9b9f447b571a..e97ed611d8c0 100644
+ return 0;
+}
+
-+static int
+ static int
i915_gem_do_execbuffer(struct drm_device *dev, void *data,
struct drm_file *file,
- struct drm_i915_gem_execbuffer2 *args,
@@ -1193,7 +1268,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
* so every billion or so execbuffers, we need to stall
* the GPU in order to reset the counters.
@@ -50358,10 +50358,11 @@ index be2c6fe07d12..9a2b27031a4d 100644
.flags = I2C_M_RD,
.len = 1,
.buf = buf,
-@@ -59,6 +60,25 @@ bool intel_ddc_probe(struct intel_encoder *intel_encoder, int ddc_bus)
+@@ -58,6 +59,25 @@ bool intel_ddc_probe(struct intel_encoder *intel_encoder, int ddc_bus)
+ return i2c_transfer(&dev_priv->gmbus[ddc_bus].adapter, msgs, 2) == 2;
}
- /**
++/**
+ * intel_connector_update_modes - update connector from edid
+ * @connector: DRM connector device to use
+ * @edid: previously read EDID information
@@ -50380,10 +50381,9 @@ index be2c6fe07d12..9a2b27031a4d 100644
+ return ret;
+}
+
-+/**
+ /**
* intel_ddc_get_modes - get modelist from monitor
* @connector: DRM connector device to use
- * @adapter: i2c adapter
@@ -69,24 +89,19 @@ int intel_ddc_get_modes(struct drm_connector *connector,
struct i2c_adapter *adapter)
{
@@ -51858,10 +51858,11 @@ index b221f2b6305f..c82b1d4fd24b 100644
.clock = 107520,
.refresh = 59940,
.oversample = TV_OVERSAMPLE_4X,
-@@ -698,30 +698,6 @@ static const struct tv_mode tv_modes[] = {
+@@ -697,30 +697,6 @@ static const struct tv_mode tv_modes[] = {
+
.filter_table = filter_table,
},
- {
+- {
- .name = "480p at 60Hz",
- .clock = 107520,
- .refresh = 60000,
@@ -51885,10 +51886,9 @@ index b221f2b6305f..c82b1d4fd24b 100644
-
- .filter_table = filter_table,
- },
-- {
+ {
.name = "576p",
.clock = 107520,
- .refresh = 50000,
@@ -731,7 +707,7 @@ static const struct tv_mode tv_modes[] = {
.hsync_end = 64, .hblank_end = 139,
.hblank_start = 859, .htotal = 863,
@@ -51898,10 +51898,11 @@ index b221f2b6305f..c82b1d4fd24b 100644
.vsync_start_f1 = 10, .vsync_start_f2 = 10,
.vsync_len = 10,
-@@ -770,30 +746,6 @@ static const struct tv_mode tv_modes[] = {
+@@ -769,30 +745,6 @@ static const struct tv_mode tv_modes[] = {
+
.filter_table = filter_table,
},
- {
+- {
- .name = "720p at 59.94Hz",
- .clock = 148800,
- .refresh = 59940,
@@ -51925,14 +51926,15 @@ index b221f2b6305f..c82b1d4fd24b 100644
-
- .filter_table = filter_table,
- },
-- {
+ {
.name = "720p at 50Hz",
.clock = 148800,
- .refresh = 50000,
-@@ -870,32 +822,6 @@ static const struct tv_mode tv_modes[] = {
+@@ -868,32 +820,6 @@ static const struct tv_mode tv_modes[] = {
- .filter_table = filter_table,
- },
+ .burst_ena = false,
+
+- .filter_table = filter_table,
+- },
- {
- .name = "1080i at 59.94Hz",
- .clock = 148800,
@@ -51957,11 +51959,9 @@ index b221f2b6305f..c82b1d4fd24b 100644
-
- .burst_ena = false,
-
-- .filter_table = filter_table,
-- },
+ .filter_table = filter_table,
+ },
};
-
- static struct intel_tv *enc_to_intel_tv(struct drm_encoder *encoder)
@@ -1367,7 +1293,7 @@ intel_tv_detect(struct drm_connector *connector, bool force)
int type;
@@ -63074,10 +63074,11 @@ diff --git a/drivers/gpu/drm/nouveau/nv04_fb.c b/drivers/gpu/drm/nouveau/nv04_fb
index 638cf601c427..d5eedd67afe5 100644
--- a/drivers/gpu/drm/nouveau/nv04_fb.c
+++ b/drivers/gpu/drm/nouveau/nv04_fb.c
-@@ -4,6 +4,40 @@
+@@ -3,6 +3,40 @@
+ #include "nouveau_drv.h"
#include "nouveau_drm.h"
- int
++int
+nv04_fb_vram_init(struct drm_device *dev)
+{
+ struct drm_nouveau_private *dev_priv = dev->dev_private;
@@ -63111,10 +63112,9 @@ index 638cf601c427..d5eedd67afe5 100644
+ return 0;
+}
+
-+int
+ int
nv04_fb_init(struct drm_device *dev)
{
- /* This is what the DDX did for NV_ARCH_04, but a mmio-trace shows
diff --git a/drivers/gpu/drm/nouveau/nv04_pm.c b/drivers/gpu/drm/nouveau/nv04_pm.c
index 9ae92a87b8cc..6e7589918fa9 100644
--- a/drivers/gpu/drm/nouveau/nv04_pm.c
@@ -63835,10 +63835,11 @@ diff --git a/drivers/gpu/drm/nouveau/nv40_fb.c b/drivers/gpu/drm/nouveau/nv40_fb
index f0ac2a768c67..7fbcb334c096 100644
--- a/drivers/gpu/drm/nouveau/nv40_fb.c
+++ b/drivers/gpu/drm/nouveau/nv40_fb.c
-@@ -72,6 +72,51 @@ nv44_fb_init_gart(struct drm_device *dev)
+@@ -71,6 +71,51 @@ nv44_fb_init_gart(struct drm_device *dev)
+ nv_wr32(dev, 0x100800, vinst | 0x00000010);
}
- int
++int
+nv40_fb_vram_init(struct drm_device *dev)
+{
+ struct drm_nouveau_private *dev_priv = dev->dev_private;
@@ -63883,10 +63884,9 @@ index f0ac2a768c67..7fbcb334c096 100644
+ return 0;
+}
+
-+int
+ int
nv40_fb_init(struct drm_device *dev)
{
- struct drm_nouveau_private *dev_priv = dev->dev_private;
diff --git a/drivers/gpu/drm/nouveau/nv40_pm.c b/drivers/gpu/drm/nouveau/nv40_pm.c
index e676b0d53478..c7615381c5d9 100644
--- a/drivers/gpu/drm/nouveau/nv40_pm.c
@@ -64477,7 +64477,7 @@ diff --git a/drivers/gpu/drm/nouveau/nv50_dac.c b/drivers/gpu/drm/nouveau/nv50_d
index 808f3ec8f827..55c56330be6d 100644
--- a/drivers/gpu/drm/nouveau/nv50_dac.c
+++ b/drivers/gpu/drm/nouveau/nv50_dac.c
-@@ -190,21 +190,13 @@ nv50_dac_mode_fixup(struct drm_encoder *encoder, struct drm_display_mode *mode,
+@@ -190,20 +190,12 @@ nv50_dac_mode_fixup(struct drm_encoder *encoder, struct drm_display_mode *mode,
}
if (connector->scaling_mode != DRM_MODE_SCALE_NONE &&
@@ -64492,15 +64492,14 @@ index 808f3ec8f827..55c56330be6d 100644
return true;
}
- static void
+-static void
-nv50_dac_prepare(struct drm_encoder *encoder)
-{
-}
-
--static void
+ static void
nv50_dac_commit(struct drm_encoder *encoder)
{
- }
@@ -266,7 +258,7 @@ static const struct drm_encoder_helper_funcs nv50_dac_helper_funcs = {
.save = nv50_dac_save,
.restore = nv50_dac_restore,
@@ -67119,7 +67118,7 @@ index d8947319b303..219850d53286 100644
)
main:
-@@ -143,12 +145,12 @@ main:
+@@ -143,12 +145,12 @@ ifdef(`NVA3',
mov $sp $r0
// setup i0 handler and route fifo and ctxswitch to it
@@ -67134,7 +67133,7 @@ index d8947319b303..219850d53286 100644
// enable interrupts
or $r2 0xc
-@@ -164,19 +166,19 @@ main:
+@@ -164,19 +166,19 @@ ifdef(`NVA3',
bset $flags $p0
spin:
sleep $p0
@@ -67171,7 +67170,7 @@ index d8947319b303..219850d53286 100644
swctx_load:
xdld $r0 $r4
swctx_done:
-@@ -251,9 +253,9 @@ chsw:
+@@ -251,9 +253,9 @@ ifdef(`NVA3', `
// if it's active, unload it and return
xbit $r15 $r3 0x1e
@@ -67183,7 +67182,7 @@ index d8947319b303..219850d53286 100644
bclr $r3 0x1e
iowr I[$r2] $r3
mov $r4 1
-@@ -266,20 +268,20 @@ chsw:
+@@ -266,20 +268,20 @@ ifdef(`NVA3', `
// is there a channel waiting to be loaded?
xbit $r13 $r3 0x1e
@@ -67209,7 +67208,7 @@ index d8947319b303..219850d53286 100644
,)
chsw_finish_load:
-@@ -297,7 +299,7 @@ dispatch:
+@@ -297,7 +299,7 @@ ifdef(`NVA3',
shl b32 $r2 0x10
// lookup method in the dispatch table, ILLEGAL_MTHD if not found
@@ -67218,7 +67217,7 @@ index d8947319b303..219850d53286 100644
clear b32 $r6
clear b32 $r7
dispatch_loop:
-@@ -305,14 +307,14 @@ dispatch:
+@@ -305,14 +307,14 @@ ifdef(`NVA3',
ld b16 $r7 D[$r5 + 2]
add b32 $r5 4
cmpu b32 $r4 $r6
@@ -67236,7 +67235,7 @@ index d8947319b303..219850d53286 100644
// ensure no bits set in reserved fields, INVALID_BITFIELD
dispatch_valid_mthd:
-@@ -322,20 +324,20 @@ dispatch:
+@@ -322,20 +324,20 @@ ifdef(`NVA3',
ld b32 $r5 D[$r4 + 4]
and $r5 $r3
cmpu b32 $r5 0
@@ -67262,7 +67261,7 @@ index d8947319b303..219850d53286 100644
dispatch_invalid_bitfield:
or $r2 2
-@@ -353,7 +355,7 @@ dispatch:
+@@ -353,7 +355,7 @@ ifdef(`NVA3',
iord $r2 I[$r0 + 0x200]
and $r2 0x40
cmpu b32 $r2 0
@@ -67284,7 +67283,7 @@ index d8947319b303..219850d53286 100644
add b32 $r4 0x600
shl b32 $r4 6
iowr I[$r4] $r3
-@@ -430,7 +432,7 @@ cmd_exec_set_format:
+@@ -430,7 +432,7 @@ ifdef(`NVA3',
st b32 D[$sp + 0x0c] $r0
// extract cpp, src_ncomp and dst_ncomp from FORMAT
@@ -67293,7 +67292,7 @@ index d8947319b303..219850d53286 100644
extr $r5 $r4 16:17
add b32 $r5 1
extr $r6 $r4 20:21
-@@ -448,22 +450,22 @@ cmd_exec_set_format:
+@@ -448,22 +450,22 @@ ifdef(`NVA3',
clear b32 $r11
bpc_loop:
cmpu b8 $r10 4
@@ -67322,7 +67321,7 @@ index d8947319b303..219850d53286 100644
cmp_zero:
mov $r12 0x80
bpc_next:
-@@ -471,22 +473,22 @@ cmd_exec_set_format:
+@@ -471,22 +473,22 @@ ifdef(`NVA3',
add b32 $r8 1
add b32 $r11 1
cmpu b32 $r11 $r5
@@ -67351,7 +67350,7 @@ index d8947319b303..219850d53286 100644
mulu $r7 $r8
mov $r5 0x810
-@@ -494,10 +496,10 @@ cmd_exec_set_format:
+@@ -494,10 +496,10 @@ ifdef(`NVA3',
iowr I[$r5 + 0x000] $r6
iowr I[$r5 + 0x100] $r7
add b32 $r5 0x800
@@ -67364,7 +67363,7 @@ index d8947319b303..219850d53286 100644
sub b32 $r7 1
or $r6 $r7
iowr I[$r5 + 0x000] $r6
-@@ -511,9 +513,9 @@ cmd_exec_set_format:
+@@ -511,9 +513,9 @@ ifdef(`NVA3',
ld b32 $r6 D[$sp + 0x0c]
iowr I[$r5 + 0x300] $r6
add b32 $r5 0x400
@@ -67376,7 +67375,7 @@ index d8947319b303..219850d53286 100644
iowr I[$r5 + 0x100] $r6
add $sp 0x10
ret
-@@ -543,7 +545,7 @@ cmd_exec_set_format:
+@@ -543,7 +545,7 @@ ifdef(`NVA3',
//
cmd_exec_set_surface_tiled:
// translate TILE_MODE into Tp, Th, Td shift values
@@ -67457,7 +67456,7 @@ index d8947319b303..219850d53286 100644
add b32 $r10 $r12
add b32 $r7 $r10
adc b32 $r8 0
-@@ -677,14 +679,14 @@ cmd_exec_set_surface_linear:
+@@ -677,14 +679,14 @@ ifdef(`NVA3',
xbit $r6 $flags $p2
add b32 $r6 0x202
shl b32 $r6 8
@@ -67475,7 +67474,7 @@ index d8947319b303..219850d53286 100644
iowr I[$r6 + 0x000] $r7
ret
-@@ -697,7 +699,7 @@ cmd_exec_wait:
+@@ -697,7 +699,7 @@ ifdef(`NVA3',
loop:
iord $r1 I[$r0]
and $r1 1
@@ -67484,7 +67483,7 @@ index d8947319b303..219850d53286 100644
pop $r1
pop $r0
ret
-@@ -705,18 +707,18 @@ cmd_exec_wait:
+@@ -705,18 +707,18 @@ ifdef(`NVA3',
cmd_exec_query:
// if QUERY_SHORT not set, write out { -, 0, TIME_LO, TIME_HI }
xbit $r4 $r3 13
@@ -67507,7 +67506,7 @@ index d8947319b303..219850d53286 100644
shl b32 $r5 16
iowr I[$r4 + 0x000] $r5
add b32 $r4 0x500
-@@ -741,16 +743,16 @@ cmd_exec_query:
+@@ -741,16 +743,16 @@ ifdef(`NVA3',
// write COUNTER
query_counter:
@@ -67527,7 +67526,7 @@ index d8947319b303..219850d53286 100644
shl b32 $r5 16
iowr I[$r4 + 0x000] $r5
add b32 $r4 0x500
-@@ -759,7 +761,7 @@ cmd_exec_query:
+@@ -759,7 +761,7 @@ ifdef(`NVA3',
mov $r5 0x00001110
sethi $r5 0x13120000
iowr I[$r4 + 0x100] $r5
@@ -67536,7 +67535,7 @@ index d8947319b303..219850d53286 100644
add b32 $r4 0x500
iowr I[$r4 + 0x000] $r5
mov $r5 0x00002601
-@@ -787,22 +789,22 @@ cmd_exec_query:
+@@ -787,22 +789,22 @@ ifdef(`NVA3',
// $r2: hostirq state
// $r3: data
cmd_exec:
@@ -67566,7 +67565,7 @@ index d8947319b303..219850d53286 100644
iowr I[$r6 + 0x000] $r7
iowr I[$r6 + 0x100] $r7
clear b32 $r4
-@@ -811,28 +813,28 @@ cmd_exec:
+@@ -811,28 +813,28 @@ ifdef(`NVA3',
bclr $flags $p2
clear b32 $r5
xbit $r15 $r3 4
@@ -67605,7 +67604,7 @@ index d8947319b303..219850d53286 100644
iowr I[$r5 + 0x100] $r6
mov $r6 0x0041
// SRC_TARGET = 1, DST_TARGET = 2
-@@ -842,8 +844,8 @@ cmd_exec:
+@@ -842,8 +844,8 @@ ifdef(`NVA3',
// if requested, queue up a QUERY write after the copy has completed
xbit $r15 $r3 12
@@ -67794,7 +67793,7 @@ diff --git a/drivers/gpu/drm/nouveau/nvc0_graph.fuc b/drivers/gpu/drm/nouveau/nv
index 2a4b6dc8f9de..e6b228844a32 100644
--- a/drivers/gpu/drm/nouveau/nvc0_graph.fuc
+++ b/drivers/gpu/drm/nouveau/nvc0_graph.fuc
-@@ -71,9 +71,9 @@ queue_put:
+@@ -71,9 +71,9 @@ define(`trace_clr', `
ld b32 $r9 D[$r13 + 0x4] // PUT
xor $r8 8
cmpu b32 $r8 $r9
@@ -67806,7 +67805,7 @@ index 2a4b6dc8f9de..e6b228844a32 100644
ret
// store cmd/data on queue
-@@ -104,7 +104,7 @@ queue_get:
+@@ -104,7 +104,7 @@ define(`trace_clr', `
ld b32 $r8 D[$r13 + 0x0] // GET
ld b32 $r9 D[$r13 + 0x4] // PUT
cmpu b32 $r8 $r9
@@ -67815,7 +67814,7 @@ index 2a4b6dc8f9de..e6b228844a32 100644
// fetch first cmd/data pair
and $r9 $r8 7
shl b32 $r9 3
-@@ -135,9 +135,9 @@ nv_rd32:
+@@ -135,9 +135,9 @@ define(`trace_clr', `
nv_rd32_wait:
iord $r12 I[$r11 + 0x000]
xbit $r12 $r12 31
@@ -67827,7 +67826,7 @@ index 2a4b6dc8f9de..e6b228844a32 100644
iord $r15 I[$r11 + 0x100] // MMIO_RDVAL
ret
-@@ -157,7 +157,7 @@ nv_wr32:
+@@ -157,7 +157,7 @@ define(`trace_clr', `
nv_wr32_wait:
iord $r12 I[$r11 + 0x000]
xbit $r12 $r12 31
@@ -67836,7 +67835,7 @@ index 2a4b6dc8f9de..e6b228844a32 100644
ret
// (re)set watchdog timer
-@@ -193,7 +193,7 @@ $1:
+@@ -193,7 +193,7 @@ define(`wait_done', `
shl b32 $r8 6
iord $r8 I[$r8 + 0x000] // DONE
xbit $r8 $r8 $r10
@@ -67845,7 +67844,7 @@ index 2a4b6dc8f9de..e6b228844a32 100644
trace_clr(T_WAIT)
ret
')
-@@ -216,7 +216,7 @@ mmctx_size:
+@@ -216,7 +216,7 @@ wait_done(wait_doneo, e)
add b32 $r9 $r8
add b32 $r14 4
cmpu b32 $r14 $r15
@@ -67854,7 +67853,7 @@ index 2a4b6dc8f9de..e6b228844a32 100644
mov b32 $r15 $r9
ret
-@@ -238,12 +238,12 @@ mmctx_xfer:
+@@ -238,12 +238,12 @@ wait_done(wait_doneo, e)
shl b32 $r8 6
clear b32 $r9
or $r11 $r11
@@ -67869,7 +67868,7 @@ index 2a4b6dc8f9de..e6b228844a32 100644
iowr I[$r8 + 0x200] $r14 // MMCTX_MULTI_STRIDE
iowr I[$r8 + 0x300] $r15 // MMCTX_MULTI_MASK
bset $r9 1 // MULTI_EN
-@@ -264,7 +264,7 @@ mmctx_xfer:
+@@ -264,7 +264,7 @@ wait_done(wait_doneo, e)
mmctx_wait_free:
iord $r14 I[$r8 + 0x000] // MMCTX_CTRL
and $r14 0x1f
@@ -67878,7 +67877,7 @@ index 2a4b6dc8f9de..e6b228844a32 100644
// queue up an entry
ld b32 $r14 D[$r12]
-@@ -272,19 +272,19 @@ mmctx_xfer:
+@@ -272,19 +272,19 @@ wait_done(wait_doneo, e)
iowr I[$r8 + 0x300] $r14
add b32 $r12 4
cmpu b32 $r12 $r13
@@ -67903,7 +67902,7 @@ index 2a4b6dc8f9de..e6b228844a32 100644
mmctx_stop:
xbit $r11 $r10 0
shl b32 $r11 16 // DIR
-@@ -295,7 +295,7 @@ mmctx_xfer:
+@@ -295,7 +295,7 @@ wait_done(wait_doneo, e)
// wait for STOP_TRIGGER to clear
iord $r11 I[$r8 + 0x000] // MMCTX_CTRL
xbit $r11 $r11 18
@@ -67912,7 +67911,7 @@ index 2a4b6dc8f9de..e6b228844a32 100644
mmctx_done:
trace_clr(T_MMCTX)
ret
-@@ -305,7 +305,7 @@ mmctx_xfer:
+@@ -305,7 +305,7 @@ wait_done(wait_doneo, e)
strand_wait:
push $r10
mov $r10 2
@@ -67921,7 +67920,7 @@ index 2a4b6dc8f9de..e6b228844a32 100644
pop $r10
ret
-@@ -316,7 +316,7 @@ strand_pre:
+@@ -316,7 +316,7 @@ wait_done(wait_doneo, e)
sethi $r8 0x20000
mov $r9 0xc
iowr I[$r8] $r9
@@ -67930,7 +67929,7 @@ index 2a4b6dc8f9de..e6b228844a32 100644
ret
// unknown - call after issuing strand commands
-@@ -326,7 +326,7 @@ strand_post:
+@@ -326,7 +326,7 @@ wait_done(wait_doneo, e)
sethi $r8 0x20000
mov $r9 0xd
iowr I[$r8] $r9
@@ -67939,7 +67938,7 @@ index 2a4b6dc8f9de..e6b228844a32 100644
ret
// Selects strand set?!
-@@ -341,11 +341,11 @@ strand_set:
+@@ -341,11 +341,11 @@ wait_done(wait_doneo, e)
iowr I[$r10 + 0x000] $r12 // 0x93c = 0xf
mov $r12 0xb
iowr I[$r11 + 0x000] $r12 // 0x928 = 0xb
@@ -67953,7 +67952,7 @@ index 2a4b6dc8f9de..e6b228844a32 100644
ret
// Initialise strand context data
-@@ -357,22 +357,22 @@ strand_set:
+@@ -357,22 +357,22 @@ wait_done(wait_doneo, e)
//
strand_ctx_init:
trace_set(T_STRINIT)
@@ -67981,7 +67980,7 @@ index 2a4b6dc8f9de..e6b228844a32 100644
// read the size of each strand, poke the context offset of
// each into STRAND_{SAVE,LOAD}_SWBASE now, no need to worry
-@@ -391,7 +391,7 @@ strand_ctx_init:
+@@ -391,7 +391,7 @@ wait_done(wait_doneo, e)
add b32 $r14 $r10
add b32 $r8 4
sub b32 $r9 1
@@ -68356,7 +68355,7 @@ index 06f5e26d1e0f..15272be33b66 100644
.b8 0 0 0 0
// GPC mmio lists
-@@ -114,6 +119,35 @@ nvc0_gpc_mmio_tail:
+@@ -114,6 +119,35 @@ mmctx_data(0x001014, 1)
mmctx_data(0x000c6c, 1);
nvc1_gpc_mmio_tail:
@@ -68392,7 +68391,7 @@ index 06f5e26d1e0f..15272be33b66 100644
// TPC mmio lists
nvc0_tpc_mmio_head:
mmctx_data(0x000018, 1)
-@@ -146,9 +180,34 @@ nvc3_tpc_mmio_tail:
+@@ -146,9 +180,34 @@ mmctx_data(0x0004bc, 1)
mmctx_data(0x000544, 1)
nvc1_tpc_mmio_tail:
@@ -68429,7 +68428,7 @@ index 06f5e26d1e0f..15272be33b66 100644
define(`include_code')
include(`nvc0_graph.fuc')
-@@ -160,10 +219,10 @@ error:
+@@ -160,10 +219,10 @@ include(`nvc0_graph.fuc')
push $r14
mov $r14 -0x67ec // 0x9814
sethi $r14 0x400000
@@ -68442,7 +68441,7 @@ index 06f5e26d1e0f..15272be33b66 100644
pop $r14
ret
-@@ -190,7 +249,7 @@ init:
+@@ -190,7 +249,7 @@ include(`nvc0_graph.fuc')
iowr I[$r1 + 0x000] $r2 // FIFO_ENABLE
// setup i0 handler, and route all interrupts to it
@@ -68451,7 +68450,7 @@ index 06f5e26d1e0f..15272be33b66 100644
mov $iv0 $r1
mov $r1 0x400
iowr I[$r1 + 0x300] $r0 // INTR_DISPATCH
-@@ -210,24 +269,24 @@ init:
+@@ -210,24 +269,24 @@ include(`nvc0_graph.fuc')
and $r2 0x1f
shl b32 $r3 $r2
sub b32 $r3 1
@@ -68482,7 +68481,7 @@ index 06f5e26d1e0f..15272be33b66 100644
// unknown chipset
ret
-@@ -253,19 +312,19 @@ init:
+@@ -253,19 +312,19 @@ include(`nvc0_graph.fuc')
clear b32 $r15
ld b16 $r14 D[$r1 + 4]
ld b16 $r15 D[$r1 + 6]
@@ -68509,7 +68508,7 @@ index 06f5e26d1e0f..15272be33b66 100644
mulu $r14 $r15
add b32 $r2 $r14
add b32 $r3 $r14
-@@ -283,7 +342,7 @@ init:
+@@ -283,7 +342,7 @@ include(`nvc0_graph.fuc')
// calculate size of strand context data
mov b32 $r15 $r2
@@ -68518,7 +68517,7 @@ index 06f5e26d1e0f..15272be33b66 100644
add b32 $r3 $r15
// save context size, and tell HUB we're done
-@@ -301,13 +360,13 @@ init:
+@@ -301,13 +360,13 @@ include(`nvc0_graph.fuc')
main:
bset $flags $p0
sleep $p0
@@ -68536,7 +68535,7 @@ index 06f5e26d1e0f..15272be33b66 100644
// fetch $flags and mask off $p1/$p2
mov $r1 $flags
mov $r2 0x0006
-@@ -318,14 +377,14 @@ main:
+@@ -318,14 +377,14 @@ include(`nvc0_graph.fuc')
or $r1 $r14
mov $flags $r1
// transfer context data
@@ -68555,7 +68554,7 @@ index 06f5e26d1e0f..15272be33b66 100644
// interrupt handler
ih:
-@@ -342,13 +401,13 @@ ih:
+@@ -342,13 +401,13 @@ include(`nvc0_graph.fuc')
// incoming fifo command?
iord $r10 I[$r0 + 0x200] // INTR
and $r11 $r10 0x00000004
@@ -68572,7 +68571,7 @@ index 06f5e26d1e0f..15272be33b66 100644
add b32 $r11 0x400
mov $r14 1
iowr I[$r11 + 0x000] $r14 // FIFO_ACK
-@@ -374,11 +433,11 @@ ih:
+@@ -374,11 +433,11 @@ include(`nvc0_graph.fuc')
//
hub_barrier_done:
mov $r15 1
@@ -68586,7 +68585,7 @@ index 06f5e26d1e0f..15272be33b66 100644
ret
// Disables various things, waits a bit, and re-enables them..
-@@ -395,7 +454,7 @@ ctx_redswitch:
+@@ -395,7 +454,7 @@ include(`nvc0_graph.fuc')
mov $r15 8
ctx_redswitch_delay:
sub b32 $r15 1
@@ -68595,7 +68594,7 @@ index 06f5e26d1e0f..15272be33b66 100644
mov $r15 0xa20
iowr I[$r14] $r15 // GPC_RED_SWITCH = UNK11, ENABLE, POWER
ret
-@@ -413,8 +472,8 @@ ctx_xfer:
+@@ -413,8 +472,8 @@ include(`nvc0_graph.fuc')
mov $r1 0xa04
shl b32 $r1 6
iowr I[$r1 + 0x000] $r15// MEM_BASE
@@ -68606,7 +68605,7 @@ index 06f5e26d1e0f..15272be33b66 100644
ctx_xfer_not_load:
// strands
-@@ -422,7 +481,7 @@ ctx_xfer:
+@@ -422,7 +481,7 @@ include(`nvc0_graph.fuc')
sethi $r1 0x20000
mov $r2 0xc
iowr I[$r1] $r2 // STRAND_CMD(0x3f) = 0x0c
@@ -68615,7 +68614,7 @@ index 06f5e26d1e0f..15272be33b66 100644
mov $r2 0x47fc
sethi $r2 0x20000
iowr I[$r2] $r0 // STRAND_FIRST_GENE(0x3f) = 0x00
-@@ -435,46 +494,46 @@ ctx_xfer:
+@@ -435,46 +494,46 @@ include(`nvc0_graph.fuc')
or $r10 2 // first
mov $r11 0x0000
sethi $r11 0x500000
@@ -68844,7 +68843,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
.b8 0 0 0 0
nvc0_hub_mmio_head:
-@@ -105,6 +108,48 @@ nvc0_hub_mmio_tail:
+@@ -105,6 +108,48 @@ mmctx_data(0x408980, 1)
mmctx_data(0x4064c0, 2)
nvc1_hub_mmio_tail:
@@ -68904,7 +68903,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
define(`include_code')
include(`nvc0_graph.fuc')
-@@ -157,7 +202,7 @@ init:
+@@ -157,7 +202,7 @@ include(`nvc0_graph.fuc')
iowr I[$r1 + 0x000] $r2 // FIFO_ENABLE
// setup i0 handler, and route all interrupts to it
@@ -68913,7 +68912,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
mov $iv0 $r1
mov $r1 0x400
iowr I[$r1 + 0x300] $r0 // INTR_DISPATCH
-@@ -201,11 +246,11 @@ init:
+@@ -201,11 +246,11 @@ include(`nvc0_graph.fuc')
// fetch enabled GPC/ROP counts
mov $r14 -0x69fc // 0x409604
sethi $r14 0x400000
@@ -68928,7 +68927,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
// set BAR_REQMASK to GPC mask
mov $r1 1
-@@ -220,14 +265,14 @@ init:
+@@ -220,14 +265,14 @@ include(`nvc0_graph.fuc')
mov $r2 0x800
shl b32 $r2 6
iord $r2 I[$r2 + 0x000] // CC_SCRATCH[0]
@@ -68946,7 +68945,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
// unknown chipset
ret
-@@ -239,9 +284,9 @@ init:
+@@ -239,9 +284,9 @@ include(`nvc0_graph.fuc')
ld b16 $r14 D[$r15 + 4]
ld b16 $r15 D[$r15 + 6]
sethi $r14 0
@@ -68959,7 +68958,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
// set mmctx base addresses now so we don't have to do it later,
// they don't (currently) ever change
-@@ -260,7 +305,7 @@ init:
+@@ -260,7 +305,7 @@ include(`nvc0_graph.fuc')
add b32 $r1 1
shl b32 $r1 8
mov b32 $r15 $r1
@@ -68968,7 +68967,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
add b32 $r1 $r15
// initialise each GPC in sequence by passing in the offset of its
-@@ -271,40 +316,40 @@ init:
+@@ -271,40 +316,40 @@ include(`nvc0_graph.fuc')
// when it has completed, and return the size of its context data
// in GPCn_CC_SCRATCH[1]
//
@@ -69019,7 +69018,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
// save context size, and tell host we're ready
mov $r2 0x800
-@@ -322,13 +367,13 @@ main:
+@@ -322,13 +367,13 @@ include(`nvc0_graph.fuc')
// sleep until we have something to do
bset $flags $p0
sleep $p0
@@ -69037,7 +69036,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
trace_set(T_AUTO)
mov $r1 0xb00
shl b32 $r1 6
-@@ -336,39 +381,39 @@ main:
+@@ -336,39 +381,39 @@ include(`nvc0_graph.fuc')
iord $r1 I[$r1 + 0x000] // CHAN_CUR
xbit $r3 $r1 31
@@ -69086,7 +69085,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
// ack the context switch request
chsw_done:
-@@ -377,32 +422,32 @@ main:
+@@ -377,32 +422,32 @@ include(`nvc0_graph.fuc')
mov $r2 1
iowr I[$r1 + 0x000] $r2 // 0x409b0c
trace_clr(T_AUTO)
@@ -69128,7 +69127,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
main_done:
mov $r1 0x820
-@@ -410,7 +455,7 @@ main:
+@@ -410,7 +455,7 @@ include(`nvc0_graph.fuc')
clear b32 $r2
bset $r2 31
iowr I[$r1 + 0x000] $r2 // CC_SCRATCH[0] |= 0x80000000
@@ -69137,7 +69136,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
// interrupt handler
ih:
-@@ -427,13 +472,13 @@ ih:
+@@ -427,13 +472,13 @@ include(`nvc0_graph.fuc')
// incoming fifo command?
iord $r10 I[$r0 + 0x200] // INTR
and $r11 $r10 0x00000004
@@ -69154,7 +69153,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
add b32 $r11 0x400
mov $r14 1
iowr I[$r11 + 0x000] $r14 // FIFO_ACK
-@@ -441,18 +486,18 @@ ih:
+@@ -441,18 +486,18 @@ include(`nvc0_graph.fuc')
// context switch request?
ih_no_fifo:
and $r11 $r10 0x00000100
@@ -69177,7 +69176,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
mov $r10 0xc1c
shl b32 $r10 6
iowr I[$r10] $r11 // INTR_UP_SET
-@@ -478,11 +523,11 @@ ctx_4160s:
+@@ -478,11 +523,11 @@ include(`nvc0_graph.fuc')
mov $r14 0x4160
sethi $r14 0x400000
mov $r15 1
@@ -69192,7 +69191,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
ret
// Without clearing again at end of xfer, some things cause PGRAPH
-@@ -492,7 +537,7 @@ ctx_4160c:
+@@ -492,7 +537,7 @@ include(`nvc0_graph.fuc')
mov $r14 0x4160
sethi $r14 0x400000
clear b32 $r15
@@ -69201,7 +69200,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
ret
// Again, not real sure
-@@ -503,7 +548,7 @@ ctx_4170s:
+@@ -503,7 +548,7 @@ include(`nvc0_graph.fuc')
mov $r14 0x4170
sethi $r14 0x400000
or $r15 0x10
@@ -69210,7 +69209,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
ret
// Waits for a ctx_4170s() call to complete
-@@ -511,9 +556,9 @@ ctx_4170s:
+@@ -511,9 +556,9 @@ include(`nvc0_graph.fuc')
ctx_4170w:
mov $r14 0x4170
sethi $r14 0x400000
@@ -69222,7 +69221,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
ret
// Disables various things, waits a bit, and re-enables them..
-@@ -530,7 +575,7 @@ ctx_redswitch:
+@@ -530,7 +575,7 @@ include(`nvc0_graph.fuc')
mov $r15 8
ctx_redswitch_delay:
sub b32 $r15 1
@@ -69231,7 +69230,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
mov $r15 0x770
iowr I[$r14] $r15 // HUB_RED_SWITCH = ENABLE_ALL, POWER_ALL
ret
-@@ -546,10 +591,10 @@ ctx_86c:
+@@ -546,10 +591,10 @@ include(`nvc0_graph.fuc')
iowr I[$r14] $r15 // HUB(0x86c) = val
mov $r14 -0x75ec
sethi $r14 0x400000
@@ -69244,7 +69243,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
ret
// ctx_load - load's a channel's ctxctl data, and selects its vm
-@@ -561,7 +606,7 @@ ctx_load:
+@@ -561,7 +606,7 @@ include(`nvc0_graph.fuc')
// switch to channel, somewhat magic in parts..
mov $r10 12 // DONE_UNK12
@@ -69253,7 +69252,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
mov $r1 0xa24
shl b32 $r1 6
iowr I[$r1 + 0x000] $r0 // 0x409a24
-@@ -576,7 +621,7 @@ ctx_load:
+@@ -576,7 +621,7 @@ include(`nvc0_graph.fuc')
ctx_chan_wait_0:
iord $r4 I[$r1 + 0x100]
and $r4 0x1f
@@ -69262,7 +69261,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
iowr I[$r3 + 0x000] $r2 // CHAN_CUR
// load channel header, fetch PGRAPH context pointer
-@@ -595,19 +640,19 @@ ctx_load:
+@@ -595,19 +640,19 @@ include(`nvc0_graph.fuc')
sethi $r2 0x80000000
iowr I[$r1 + 0x000] $r2 // MEM_TARGET = vram
mov $r1 0x10 // chan + 0x0210
@@ -69286,7 +69285,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
// set transfer base to start of context, and fetch context header
trace_set(T_LCTXH)
-@@ -618,7 +663,7 @@ ctx_load:
+@@ -618,7 +663,7 @@ include(`nvc0_graph.fuc')
mov $r1 0xa20
shl b32 $r1 6
iowr I[$r1 + 0x000] $r2 // MEM_TARGET = vm
@@ -69295,7 +69294,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
sethi $r1 0x00060000 // 256 bytes
xdld $r0 $r1
xdwait
-@@ -635,10 +680,10 @@ ctx_load:
+@@ -635,10 +680,10 @@ include(`nvc0_graph.fuc')
// In: $r2 channel address
//
ctx_chan:
@@ -69309,7 +69308,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
mov $r1 0xa10
shl b32 $r1 6
mov $r2 5
-@@ -646,8 +691,8 @@ ctx_chan:
+@@ -646,8 +691,8 @@ include(`nvc0_graph.fuc')
ctx_chan_wait:
iord $r2 I[$r1 + 0x000]
or $r2 $r2
@@ -69320,7 +69319,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
ret
// Execute per-context state overrides list
-@@ -661,7 +706,7 @@ ctx_chan:
+@@ -661,7 +706,7 @@ include(`nvc0_graph.fuc')
//
ctx_mmio_exec:
// set transfer base to be the mmio list
@@ -69329,7 +69328,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
mov $r2 0xa04
shl b32 $r2 6
iowr I[$r2 + 0x000] $r3 // MEM_BASE
-@@ -670,31 +715,31 @@ ctx_mmio_exec:
+@@ -670,31 +715,31 @@ include(`nvc0_graph.fuc')
ctx_mmio_loop:
// fetch next 256 bytes of mmio list if necessary
and $r4 $r3 0xff
@@ -69370,7 +69369,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
sethi $r1 0x00060000 // 256 bytes
xdst $r0 $r1
xdwait
-@@ -709,46 +754,46 @@ ctx_mmio_exec:
+@@ -709,46 +754,46 @@ include(`nvc0_graph.fuc')
// on load it means: "a save preceeded this load"
//
ctx_xfer:
@@ -69431,7 +69430,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
mov $r2 0x47fc
sethi $r2 0x20000
iowr I[$r2] $r0 // STRAND_FIRST_GENE(0x3f) = 0x00
-@@ -760,22 +805,22 @@ ctx_xfer:
+@@ -760,22 +805,22 @@ include(`nvc0_graph.fuc')
xbit $r10 $flags $p1 // direction
or $r10 6 // first, last
mov $r11 0 // base = 0
@@ -69461,7 +69460,7 @@ index e4f8c7e89ddd..98acddb2c5bb 100644
mov $r1 0xa10
shl b32 $r1 6
mov $r2 5
-@@ -783,27 +828,27 @@ ctx_xfer:
+@@ -783,27 +828,27 @@ include(`nvc0_graph.fuc')
ctx_xfer_post_save_wait:
iord $r2 I[$r1]
or $r2 $r2
@@ -70640,18 +70639,18 @@ index 3002d8283a1a..8a555fb67024 100644
};
static void
-@@ -640,11 +957,6 @@ nvd0_dac_mode_fixup(struct drm_encoder *encoder, struct drm_display_mode *mode,
+@@ -639,11 +956,6 @@ nvd0_dac_mode_fixup(struct drm_encoder *encoder, struct drm_display_mode *mode,
+ return true;
}
- static void
+-static void
-nvd0_dac_prepare(struct drm_encoder *encoder)
-{
-}
-
--static void
+ static void
nvd0_dac_commit(struct drm_encoder *encoder)
{
- }
@@ -655,16 +967,29 @@ nvd0_dac_mode_set(struct drm_encoder *encoder, struct drm_display_mode *mode,
{
struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
@@ -70711,10 +70710,11 @@ index 3002d8283a1a..8a555fb67024 100644
.commit = nvd0_dac_commit,
.mode_set = nvd0_dac_mode_set,
.disable = nvd0_dac_disconnect,
-@@ -760,8 +1085,253 @@ nvd0_dac_create(struct drm_connector *connector, struct dcb_entry *dcbe)
+@@ -759,9 +1084,254 @@ nvd0_dac_create(struct drm_connector *connector, struct dcb_entry *dcbe)
+ return 0;
}
- /******************************************************************************
++/******************************************************************************
+ * Audio
+ *****************************************************************************/
+static void
@@ -70816,7 +70816,7 @@ index 3002d8283a1a..8a555fb67024 100644
+ nv_mask(dev, 0x616714 + head, 0x00000001, 0x00000000);
+}
+
-+/******************************************************************************
+ /******************************************************************************
* SOR
*****************************************************************************/
+static inline u32
@@ -70982,10 +70982,11 @@ index 3002d8283a1a..8a555fb67024 100644
}
static bool
-@@ -816,8 +1396,37 @@ nvd0_sor_mode_fixup(struct drm_encoder *encoder, struct drm_display_mode *mode,
+@@ -815,9 +1395,38 @@ nvd0_sor_mode_fixup(struct drm_encoder *encoder, struct drm_display_mode *mode,
+ return true;
}
- static void
++static void
+nvd0_sor_disconnect(struct drm_encoder *encoder)
+{
+ struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
@@ -71011,7 +71012,7 @@ index 3002d8283a1a..8a555fb67024 100644
+ }
+}
+
-+static void
+ static void
nvd0_sor_prepare(struct drm_encoder *encoder)
{
+ nvd0_sor_disconnect(encoder);
@@ -71089,7 +71090,7 @@ index 3002d8283a1a..8a555fb67024 100644
default:
BUG_ON(1);
break;
-@@ -889,42 +1528,26 @@ nvd0_sor_mode_set(struct drm_encoder *encoder, struct drm_display_mode *umode,
+@@ -889,41 +1528,25 @@ nvd0_sor_mode_set(struct drm_encoder *encoder, struct drm_display_mode *umode,
nvd0_sor_dpms(encoder, DRM_MODE_DPMS_ON);
@@ -71115,7 +71116,7 @@ index 3002d8283a1a..8a555fb67024 100644
nv_encoder->crtc = encoder->crtc;
}
- static void
+-static void
-nvd0_sor_disconnect(struct drm_encoder *encoder)
-{
- struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
@@ -71139,10 +71140,9 @@ index 3002d8283a1a..8a555fb67024 100644
- }
-}
-
--static void
+ static void
nvd0_sor_destroy(struct drm_encoder *encoder)
{
- drm_encoder_cleanup(encoder);
@@ -976,17 +1599,19 @@ static struct dcb_entry *
lookup_dcb(struct drm_device *dev, int id, u32 mc)
{
@@ -82210,10 +82210,11 @@ index 28e69e9121f2..66150f0ffc73 100644
/*
* Errata workarounds.
*/
-@@ -127,6 +142,47 @@ bool radeon_get_bios(struct radeon_device *rdev);
+@@ -126,6 +141,47 @@ struct radeon_device;
+ bool radeon_get_bios(struct radeon_device *rdev);
- /*
++/*
+ * Mutex which allows recursive locking from the same process.
+ */
+struct radeon_mutex {
@@ -82254,10 +82255,9 @@ index 28e69e9121f2..66150f0ffc73 100644
+}
+
+
-+/*
+ /*
* Dummy page
*/
- struct radeon_dummy_page {
@@ -165,26 +221,30 @@ void radeon_pm_resume(struct radeon_device *rdev);
void radeon_combios_get_power_modes(struct radeon_device *rdev);
void radeon_atombios_get_power_modes(struct radeon_device *rdev);
@@ -82416,10 +82416,11 @@ index 28e69e9121f2..66150f0ffc73 100644
int radeon_mode_dumb_create(struct drm_file *file_priv,
struct drm_device *dev,
-@@ -288,6 +411,46 @@ int radeon_mode_dumb_destroy(struct drm_file *file_priv,
+@@ -287,6 +410,46 @@ int radeon_mode_dumb_destroy(struct drm_file *file_priv,
+ struct drm_device *dev,
uint32_t handle);
- /*
++/*
+ * Semaphores.
+ */
+struct radeon_ring;
@@ -82459,10 +82460,9 @@ index 28e69e9121f2..66150f0ffc73 100644
+void radeon_semaphore_free(struct radeon_device *rdev,
+ struct radeon_semaphore *semaphore);
+
-+/*
+ /*
* GART structures, functions & helpers
*/
- struct radeon_mc;
@@ -295,6 +458,7 @@ struct radeon_mc;
#define RADEON_GPU_PAGE_SIZE 4096
#define RADEON_GPU_PAGE_MASK (RADEON_GPU_PAGE_SIZE - 1)
@@ -82965,10 +82965,11 @@ index 28e69e9121f2..66150f0ffc73 100644
int radeon_cs_ioctl(struct drm_device *dev, void *data, struct drm_file *filp);
int radeon_gem_set_tiling_ioctl(struct drm_device *dev, void *data,
struct drm_file *filp);
-@@ -1132,47 +1458,6 @@ struct r600_vram_scratch {
+@@ -1131,47 +1457,6 @@ struct r600_vram_scratch {
+ };
- /*
+-/*
- * Mutex which allows recursive locking from the same process.
- */
-struct radeon_mutex {
@@ -83009,10 +83010,9 @@ index 28e69e9121f2..66150f0ffc73 100644
-}
-
-
--/*
+ /*
* Core structure, functions and helpers.
*/
- typedef uint32_t (*radeon_rreg_t)(struct radeon_device*, uint32_t);
@@ -1216,11 +1501,10 @@ struct radeon_device {
struct radeon_mode_info mode_info;
struct radeon_scratch scratch;
@@ -83180,10 +83180,11 @@ index 28e69e9121f2..66150f0ffc73 100644
/* Common functions */
/* AGP */
-@@ -1488,12 +1788,49 @@ extern int radeon_suspend_kms(struct drm_device *dev, pm_message_t state);
+@@ -1487,12 +1787,49 @@ extern int radeon_resume_kms(struct drm_device *dev);
+ extern int radeon_suspend_kms(struct drm_device *dev, pm_message_t state);
extern void radeon_ttm_set_active_vram_size(struct radeon_device *rdev, u64 size);
- /*
++/*
+ * vm
+ */
+int radeon_vm_manager_init(struct radeon_device *rdev);
@@ -83210,13 +83211,13 @@ index 28e69e9121f2..66150f0ffc73 100644
+ struct radeon_bo *bo);
+
+
-+/*
+ /*
* R600 vram scratch functions
*/
int r600_vram_scratch_init(struct radeon_device *rdev);
void r600_vram_scratch_fini(struct radeon_device *rdev);
- /*
++/*
+ * r600 cs checking helper
+ */
+unsigned r600_mip_minify(unsigned size, unsigned level);
@@ -83226,10 +83227,9 @@ index 28e69e9121f2..66150f0ffc73 100644
+int r600_fmt_get_nblocksx(u32 format, u32 w);
+int r600_fmt_get_nblocksy(u32 format, u32 h);
+
-+/*
+ /*
* r600 functions used by radeon_encoder.c
*/
- extern void r600_hdmi_enable(struct drm_encoder *encoder);
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index a2e1eae114ef..be4dc2ff0e40 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
@@ -86009,7 +86009,7 @@ index 441de38b0203..89a0eeca0e23 100644
RADEON_GEM_DOMAIN_VRAM,
RADEON_GEM_DOMAIN_VRAM);
diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
-index 6e9870341467..ef56e4ed89d2 100644
+index e6a5162d81b3..ef56e4ed89d2 100644
--- a/drivers/gpu/drm/radeon/radeon_bios.c
+++ b/drivers/gpu/drm/radeon/radeon_bios.c
@@ -177,20 +177,6 @@ static bool radeon_atrm_get_bios(struct radeon_device *rdev)
@@ -86033,6 +86033,95 @@ index 6e9870341467..ef56e4ed89d2 100644
if (!found)
return false;
+@@ -570,57 +556,51 @@ static bool radeon_read_disabled_bios(struct radeon_device *rdev)
+ #ifdef CONFIG_ACPI
+ static bool radeon_acpi_vfct_bios(struct radeon_device *rdev)
+ {
++ bool ret = false;
+ struct acpi_table_header *hdr;
+ acpi_size tbl_size;
+ UEFI_ACPI_VFCT *vfct;
+- unsigned offset;
++ GOP_VBIOS_CONTENT *vbios;
++ VFCT_IMAGE_HEADER *vhdr;
+
+ if (!ACPI_SUCCESS(acpi_get_table_with_size("VFCT", 1, &hdr, &tbl_size)))
+ return false;
+ if (tbl_size < sizeof(UEFI_ACPI_VFCT)) {
+ DRM_ERROR("ACPI VFCT table present but broken (too short #1)\n");
+- return false;
++ goto out_unmap;
+ }
+
+ vfct = (UEFI_ACPI_VFCT *)hdr;
+- offset = vfct->VBIOSImageOffset;
+-
+- while (offset < tbl_size) {
+- GOP_VBIOS_CONTENT *vbios = (GOP_VBIOS_CONTENT *)((char *)hdr + offset);
+- VFCT_IMAGE_HEADER *vhdr = &vbios->VbiosHeader;
+-
+- offset += sizeof(VFCT_IMAGE_HEADER);
+- if (offset > tbl_size) {
+- DRM_ERROR("ACPI VFCT image header truncated\n");
+- return false;
+- }
+-
+- offset += vhdr->ImageLength;
+- if (offset > tbl_size) {
+- DRM_ERROR("ACPI VFCT image truncated\n");
+- return false;
+- }
++ if (vfct->VBIOSImageOffset + sizeof(VFCT_IMAGE_HEADER) > tbl_size) {
++ DRM_ERROR("ACPI VFCT table present but broken (too short #2)\n");
++ goto out_unmap;
++ }
+
+- if (vhdr->ImageLength &&
+- vhdr->PCIBus == rdev->pdev->bus->number &&
+- vhdr->PCIDevice == PCI_SLOT(rdev->pdev->devfn) &&
+- vhdr->PCIFunction == PCI_FUNC(rdev->pdev->devfn) &&
+- vhdr->VendorID == rdev->pdev->vendor &&
+- vhdr->DeviceID == rdev->pdev->device) {
+- rdev->bios = kmemdup(&vbios->VbiosContent,
+- vhdr->ImageLength,
+- GFP_KERNEL);
+-
+- if (!rdev->bios) {
+- kfree(rdev->bios);
+- return false;
+- }
+- return true;
+- }
++ vbios = (GOP_VBIOS_CONTENT *)((char *)hdr + vfct->VBIOSImageOffset);
++ vhdr = &vbios->VbiosHeader;
++ DRM_INFO("ACPI VFCT contains a BIOS for %02x:%02x.%d %04x:%04x, size %d\n",
++ vhdr->PCIBus, vhdr->PCIDevice, vhdr->PCIFunction,
++ vhdr->VendorID, vhdr->DeviceID, vhdr->ImageLength);
++
++ if (vhdr->PCIBus != rdev->pdev->bus->number ||
++ vhdr->PCIDevice != PCI_SLOT(rdev->pdev->devfn) ||
++ vhdr->PCIFunction != PCI_FUNC(rdev->pdev->devfn) ||
++ vhdr->VendorID != rdev->pdev->vendor ||
++ vhdr->DeviceID != rdev->pdev->device) {
++ DRM_INFO("ACPI VFCT table is not for this card\n");
++ goto out_unmap;
++ };
++
++ if (vfct->VBIOSImageOffset + sizeof(VFCT_IMAGE_HEADER) + vhdr->ImageLength > tbl_size) {
++ DRM_ERROR("ACPI VFCT image truncated\n");
++ goto out_unmap;
+ }
+
+- DRM_ERROR("ACPI VFCT table present but broken (too short #2)\n");
+- return false;
++ rdev->bios = kmemdup(&vbios->VbiosContent, vhdr->ImageLength, GFP_KERNEL);
++ ret = !!rdev->bios;
++
++out_unmap:
++ return ret;
+ }
+ #else
+ static inline bool radeon_acpi_vfct_bios(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/radeon_blit_common.h b/drivers/gpu/drm/radeon/radeon_blit_common.h
new file mode 100644
index 000000000000..4ecbe72c9d2d
@@ -98822,7 +98911,7 @@ index 1c4a72f681c1..4a8728291361 100644
#endif
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
-index 22a89cd5aa5d..a67e61be38f2 100644
+index f5e5037e0daa..a67e61be38f2 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -28,6 +28,8 @@
@@ -99210,6 +99299,24 @@ index 22a89cd5aa5d..a67e61be38f2 100644
}
man->has_type = false;
}
+@@ -1807,6 +1807,7 @@ static int ttm_bo_swapout(struct ttm_mem_shrink *shrink)
+ struct ttm_buffer_object *bo;
+ int ret = -EBUSY;
+ int put_count;
++ uint32_t swap_placement = (TTM_PL_FLAG_CACHED | TTM_PL_FLAG_SYSTEM);
+
+ spin_lock(&glob->lru_lock);
+ while (ret == -EBUSY) {
+@@ -1859,8 +1860,7 @@ static int ttm_bo_swapout(struct ttm_mem_shrink *shrink)
+ if (unlikely(ret != 0))
+ goto out;
+
+- if (bo->mem.mem_type != TTM_PL_SYSTEM ||
+- bo->ttm->caching_state != tt_cached) {
++ if ((bo->mem.placement & swap_placement) != swap_placement) {
+ struct ttm_mem_reg evict_mem;
+
+ evict_mem = bo->mem;
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 082fcaea583f..2d6926269036 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -104856,7 +104963,7 @@ index 7f16ff28070c..7fc3dc7f9985 100644
info->apertures = alloc_apertures(1);
if (!info->apertures) {
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
-index 1ed5a1c4d59a..992b46bbadfb 100644
+index 46f627710c47..992b46bbadfb 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
@@ -69,12 +69,13 @@ struct vmw_user_fence {
@@ -104876,7 +104983,92 @@ index 1ed5a1c4d59a..992b46bbadfb 100644
uint32_t *tv_sec;
uint32_t *tv_usec;
};
-@@ -767,46 +768,40 @@ int vmw_fence_obj_unref_ioctl(struct drm_device *dev, void *data,
+@@ -493,7 +494,7 @@ int vmw_fence_create(struct vmw_fence_manager *fman,
+ struct vmw_fence_obj **p_fence)
+ {
+ struct vmw_fence_obj *fence;
+- int ret;
++ int ret;
+
+ fence = kzalloc(sizeof(*fence), GFP_KERNEL);
+ if (unlikely(fence == NULL))
+@@ -661,41 +662,6 @@ void vmw_fence_fifo_up(struct vmw_fence_manager *fman)
+ }
+
+
+-/**
+- * vmw_fence_obj_lookup - Look up a user-space fence object
+- *
+- * @tfile: A struct ttm_object_file identifying the caller.
+- * @handle: A handle identifying the fence object.
+- * @return: A struct vmw_user_fence base ttm object on success or
+- * an error pointer on failure.
+- *
+- * The fence object is looked up and type-checked. The caller needs
+- * to have opened the fence object first, but since that happens on
+- * creation and fence objects aren't shareable, that's not an
+- * issue currently.
+- */
+-static struct ttm_base_object *
+-vmw_fence_obj_lookup(struct ttm_object_file *tfile, u32 handle)
+-{
+- struct ttm_base_object *base = ttm_base_object_lookup(tfile, handle);
+-
+- if (!base) {
+- pr_err("Invalid fence object handle 0x%08lx.\n",
+- (unsigned long)handle);
+- return ERR_PTR(-EINVAL);
+- }
+-
+- if (base->refcount_release != vmw_user_fence_base_release) {
+- pr_err("Invalid fence object handle 0x%08lx.\n",
+- (unsigned long)handle);
+- ttm_base_object_unref(&base);
+- return ERR_PTR(-EINVAL);
+- }
+-
+- return base;
+-}
+-
+-
+ int vmw_fence_obj_wait_ioctl(struct drm_device *dev, void *data,
+ struct drm_file *file_priv)
+ {
+@@ -721,9 +687,13 @@ int vmw_fence_obj_wait_ioctl(struct drm_device *dev, void *data,
+ arg->kernel_cookie = jiffies + wait_timeout;
+ }
+
+- base = vmw_fence_obj_lookup(tfile, arg->handle);
+- if (IS_ERR(base))
+- return PTR_ERR(base);
++ base = ttm_base_object_lookup(tfile, arg->handle);
++ if (unlikely(base == NULL)) {
++ printk(KERN_ERR "Wait invalid fence object handle "
++ "0x%08lx.\n",
++ (unsigned long)arg->handle);
++ return -EINVAL;
++ }
+
+ fence = &(container_of(base, struct vmw_user_fence, base)->fence);
+
+@@ -762,9 +732,13 @@ int vmw_fence_obj_signaled_ioctl(struct drm_device *dev, void *data,
+ struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
+ struct vmw_private *dev_priv = vmw_priv(dev);
+
+- base = vmw_fence_obj_lookup(tfile, arg->handle);
+- if (IS_ERR(base))
+- return PTR_ERR(base);
++ base = ttm_base_object_lookup(tfile, arg->handle);
++ if (unlikely(base == NULL)) {
++ printk(KERN_ERR "Fence signaled invalid fence object handle "
++ "0x%08lx.\n",
++ (unsigned long)arg->handle);
++ return -EINVAL;
++ }
+
+ fence = &(container_of(base, struct vmw_user_fence, base)->fence);
+ fman = fence->fman;
+@@ -794,46 +768,40 @@ int vmw_fence_obj_unref_ioctl(struct drm_device *dev, void *data,
}
/**
@@ -104952,7 +105144,7 @@ index 1ed5a1c4d59a..992b46bbadfb 100644
}
-@@ -819,18 +814,21 @@ static void vmw_event_fence_action_delivered(struct drm_pending_event *e)
+@@ -846,18 +814,21 @@ static void vmw_event_fence_action_delivered(struct drm_pending_event *e)
* This function is called when the seqno of the fence where @action is
* attached has passed. It queues the event on the submitter's event list.
* This function is always called from atomic context, and may be called
@@ -104978,7 +105170,7 @@ index 1ed5a1c4d59a..992b46bbadfb 100644
spin_lock_irqsave(&dev->event_lock, irq_flags);
if (likely(eaction->tv_sec != NULL)) {
-@@ -841,7 +839,9 @@ static void vmw_event_fence_action_seq_passed(struct vmw_fence_action *action)
+@@ -868,7 +839,9 @@ static void vmw_event_fence_action_seq_passed(struct vmw_fence_action *action)
*eaction->tv_usec = tv.tv_usec;
}
@@ -104989,7 +105181,7 @@ index 1ed5a1c4d59a..992b46bbadfb 100644
wake_up_all(&file_priv->event_wait);
spin_unlock_irqrestore(&dev->event_lock, irq_flags);
}
-@@ -859,9 +859,15 @@ static void vmw_event_fence_action_cleanup(struct vmw_fence_action *action)
+@@ -886,9 +859,15 @@ static void vmw_event_fence_action_cleanup(struct vmw_fence_action *action)
{
struct vmw_event_fence_action *eaction =
container_of(action, struct vmw_event_fence_action, action);
@@ -105006,7 +105198,7 @@ index 1ed5a1c4d59a..992b46bbadfb 100644
}
-@@ -929,39 +935,23 @@ void vmw_fence_obj_add_action(struct vmw_fence_obj *fence,
+@@ -956,39 +935,23 @@ void vmw_fence_obj_add_action(struct vmw_fence_obj *fence,
* an error code, the caller needs to free that object.
*/
@@ -105056,7 +105248,7 @@ index 1ed5a1c4d59a..992b46bbadfb 100644
eaction->action.seq_passed = vmw_event_fence_action_seq_passed;
eaction->action.cleanup = vmw_event_fence_action_cleanup;
-@@ -969,16 +959,91 @@ int vmw_event_fence_action_create(struct drm_file *file_priv,
+@@ -996,16 +959,91 @@ int vmw_event_fence_action_create(struct drm_file *file_priv,
eaction->fence = vmw_fence_obj_reference(fence);
eaction->dev = fman->dev_priv->dev;
@@ -105150,7 +105342,12 @@ index 1ed5a1c4d59a..992b46bbadfb 100644
int vmw_fence_event_ioctl(struct drm_device *dev, void *data,
struct drm_file *file_priv)
{
-@@ -991,8 +1056,6 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data,
+@@ -1014,13 +1052,10 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data,
+ (struct drm_vmw_fence_event_arg *) data;
+ struct vmw_fence_obj *fence = NULL;
+ struct vmw_fpriv *vmw_fp = vmw_fpriv(file_priv);
+- struct ttm_object_file *tfile = vmw_fp->tfile;
+ struct drm_vmw_fence_rep __user *user_fence_rep =
(struct drm_vmw_fence_rep __user *)(unsigned long)
arg->fence_rep;
uint32_t handle;
@@ -105159,7 +105356,35 @@ index 1ed5a1c4d59a..992b46bbadfb 100644
int ret;
/*
-@@ -1045,59 +1108,21 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data,
+@@ -1030,11 +1065,14 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data,
+ */
+ if (arg->handle) {
+ struct ttm_base_object *base =
+- vmw_fence_obj_lookup(tfile, arg->handle);
+-
+- if (IS_ERR(base))
+- return PTR_ERR(base);
++ ttm_base_object_lookup(vmw_fp->tfile, arg->handle);
+
++ if (unlikely(base == NULL)) {
++ DRM_ERROR("Fence event invalid fence object handle "
++ "0x%08lx.\n",
++ (unsigned long)arg->handle);
++ return -EINVAL;
++ }
+ fence = &(container_of(base, struct vmw_user_fence,
+ base)->fence);
+ (void) vmw_fence_obj_reference(fence);
+@@ -1042,7 +1080,7 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data,
+ if (user_fence_rep != NULL) {
+ bool existed;
+
+- ret = ttm_ref_object_add(tfile, base,
++ ret = ttm_ref_object_add(vmw_fp->tfile, base,
+ TTM_REF_USAGE, &existed);
+ if (unlikely(ret != 0)) {
+ DRM_ERROR("Failed to reference a fence "
+@@ -1070,61 +1108,24 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data,
BUG_ON(fence == NULL);
@@ -105223,8 +105448,12 @@ index 1ed5a1c4d59a..992b46bbadfb 100644
-out_no_event_space:
+out_no_create:
if (user_fence_rep != NULL)
- ttm_ref_object_base_unref(vmw_fpriv(file_priv)->tfile,
- handle, TTM_REF_USAGE);
+- ttm_ref_object_base_unref(tfile, handle, TTM_REF_USAGE);
++ ttm_ref_object_base_unref(vmw_fpriv(file_priv)->tfile,
++ handle, TTM_REF_USAGE);
+ out_no_ref_obj:
+ vmw_fence_obj_unreference(&fence);
+ return ret;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.h b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.h
index 0854a2096b55..faf2e7873860 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.h
@@ -105269,6 +105498,28 @@ index 295224947c6b..e1978a2a4982 100644
return 0;
out_err:
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
+index 52e3ddaadbb3..66917c6c3813 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
+@@ -69,6 +69,8 @@ int vmw_getparam_ioctl(struct drm_device *dev, void *data,
+ break;
+ }
+ default:
++ DRM_ERROR("Illegal vmwgfx get param request: %d\n",
++ param->param);
+ return -EINVAL;
+ }
+
+@@ -88,7 +90,7 @@ int vmw_get_cap_3d_ioctl(struct drm_device *dev, void *data,
+ void *bounce;
+ int ret;
+
+- if (unlikely(arg->pad64 != 0 || arg->max_size == 0)) {
++ if (unlikely(arg->pad64 != 0)) {
+ DRM_ERROR("Illegal GET_3D_CAP argument.\n");
+ return -EINVAL;
+ }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index eb9735e95d3a..7ca1d472d7cb 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -105617,10 +105868,28 @@ index 8f8dbd43c33d..070fb239c5af 100644
ldu->base.is_implicit = true;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
-index 0795d1733c1b..059b32c6f22b 100644
+index e7af6c8617ce..059b32c6f22b 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
-@@ -1540,29 +1540,10 @@ int vmw_surface_check(struct vmw_private *dev_priv,
+@@ -1304,14 +1304,11 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
+ 128;
+
+ num_sizes = 0;
+- for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i) {
+- if (req->mip_levels[i] > DRM_VMW_MAX_MIP_LEVELS)
+- return -EINVAL;
++ for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i)
+ num_sizes += req->mip_levels[i];
+- }
+
+- if (num_sizes > DRM_VMW_MAX_SURFACE_FACES * DRM_VMW_MAX_MIP_LEVELS ||
+- num_sizes == 0)
++ if (num_sizes > DRM_VMW_MAX_SURFACE_FACES *
++ DRM_VMW_MAX_MIP_LEVELS)
+ return -EINVAL;
+
+ size = vmw_user_surface_size + 128 +
+@@ -1543,29 +1540,10 @@ int vmw_surface_check(struct vmw_private *dev_priv,
/**
* Buffer management.
*/
@@ -105650,7 +105919,7 @@ index 0795d1733c1b..059b32c6f22b 100644
kfree(vmw_bo);
}
-@@ -1573,24 +1554,12 @@ int vmw_dmabuf_init(struct vmw_private *dev_priv,
+@@ -1576,24 +1554,12 @@ int vmw_dmabuf_init(struct vmw_private *dev_priv,
void (*bo_free) (struct ttm_buffer_object *bo))
{
struct ttm_bo_device *bdev = &dev_priv->bdev;
@@ -105676,7 +105945,7 @@ index 0795d1733c1b..059b32c6f22b 100644
memset(vmw_bo, 0, sizeof(*vmw_bo));
INIT_LIST_HEAD(&vmw_bo->validate_list);
-@@ -1605,9 +1574,7 @@ int vmw_dmabuf_init(struct vmw_private *dev_priv,
+@@ -1608,9 +1574,7 @@ int vmw_dmabuf_init(struct vmw_private *dev_priv,
static void vmw_user_dmabuf_destroy(struct ttm_buffer_object *bo)
{
struct vmw_user_dma_buffer *vmw_user_bo = vmw_user_dma_buffer(bo);
@@ -107599,10 +107868,11 @@ index 42e346985186..974c8f801c39 100644
/**
* ttm_bo_synccpu_write_release:
*
-@@ -447,6 +442,22 @@ ttm_bo_synccpu_write_grab(struct ttm_buffer_object *bo, bool no_wait);
+@@ -446,6 +441,22 @@ ttm_bo_synccpu_write_grab(struct ttm_buffer_object *bo, bool no_wait);
+ */
extern void ttm_bo_synccpu_write_release(struct ttm_buffer_object *bo);
- /**
++/**
+ * ttm_bo_acc_size
+ *
+ * @bdev: Pointer to a ttm_bo_device struct.
@@ -107618,10 +107888,9 @@ index 42e346985186..974c8f801c39 100644
+ unsigned long bo_size,
+ unsigned struct_size);
+
-+/**
+ /**
* ttm_bo_init
*
- * @bdev: Pointer to a ttm_bo_device struct.
@@ -493,6 +504,7 @@ extern int ttm_bo_init(struct ttm_bo_device *bdev,
struct file *persistent_swap_storage,
size_t acc_size,
@@ -107634,10 +107903,11 @@ diff --git a/include/drm/ttm/ttm_bo_driver.h b/include/drm/ttm/ttm_bo_driver.h
index 94eb1434316e..d43e892307ff 100644
--- a/include/drm/ttm/ttm_bo_driver.h
+++ b/include/drm/ttm/ttm_bo_driver.h
-@@ -43,36 +43,9 @@ struct ttm_backend;
+@@ -42,37 +42,10 @@
+ struct ttm_backend;
struct ttm_backend_func {
- /**
+- /**
- * struct ttm_backend_func member populate
- *
- * @backend: Pointer to a struct ttm_backend.
@@ -107664,7 +107934,7 @@ index 94eb1434316e..d43e892307ff 100644
- */
- void (*clear) (struct ttm_backend *backend);
-
-- /**
+ /**
* struct ttm_backend_func member bind
*
- * @backend: Pointer to a struct ttm_backend.
@@ -107914,10 +108184,11 @@ index 94eb1434316e..d43e892307ff 100644
/**
* ttm_ttm_bind:
-@@ -646,20 +628,11 @@ extern int ttm_tt_set_user(struct ttm_tt *ttm,
+@@ -645,21 +627,12 @@ extern int ttm_tt_set_user(struct ttm_tt *ttm,
+ */
extern int ttm_tt_bind(struct ttm_tt *ttm, struct ttm_mem_reg *bo_mem);
- /**
+-/**
- * ttm_tt_populate:
- *
- * @ttm: The struct ttm_tt to contain the backing pages.
@@ -107926,7 +108197,7 @@ index 94eb1434316e..d43e892307ff 100644
- */
-extern int ttm_tt_populate(struct ttm_tt *ttm);
-
--/**
+ /**
* ttm_ttm_destroy:
*
* @ttm: The struct ttm_tt.
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git
More information about the Kernel-svn-changes
mailing list