qxl_bo structure has two reference counters, one in the GEM object and
another in the TTM object. The GEM object keep a counter to the TTM object
so when GEM counter reached zero the TTM counter (using qxl_bo_unref) was
decremented. The qxl object is fully freed (both GEM and TTM part are cleaned)
when the TTM counter reach zero.
One issue was that surface idr structure has no owning on qxl_bo objects however
it contains a pointer to qxl_bo object. This caused some nasty race condition
for instance qxl_bo object was reaped even after counter was already zero.
This patch fix these races moving main counter (the one used by qxl_bo_(un)ref)
to GEM object which cleanup routine (qxl_gem_object_free) remove the idr pointer
(using qxl_surface_evict) when the counters are still valid.
Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

Enable format string checks for qxl_io_log and remove resulting warnings
which could lead to memory errors on different platform or just printing
wrong information.
Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

Free resources correctly if function fails
Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

This function return handle to allocated release object which is an int.
Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

Only EBUSY error was handled. This could cause code to believe
reserve was successful while it failed.
Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

Is we are not able to get source bo object from handle we free
destination bo object and call cleanup code however destination
object was already inserted in reloc_info array (num_relocs was
already incremented) so on cleanup we free destination again.
Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

reloc_info[i] is not still initialized in the print statement.
Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

If the function fails reference counter to the object is not decremented
causing leaks.
This is hard to spot as it happens only on very low memory situations.
Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
Cc: stable@vger.kernel.org
Reviewed-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

If objects are moved back from system memory to VRAM (and spice id
created again) memory is already initialized so we need to set flag
to not clear memory.
If you don't do it after a while using desktop many images turns to
black or transparents.
Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
Cc: stable@vger.kernel.org
Reviewed-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

Yay, thanks to Gerd for pull this together.

* 'virtio-gpu-drm-next' of git://git.kraxel.org/linux:
  Add MAINTAINERS entry for virtio-gpu.
  Add virtio gpu driver.
  drm_vblank_get: don't WARN_ON in case vblanks are not initialized
  break kconfig dependency loop

Please pull the contents of "Use DRM component API in tilcdc to
connect to tda998x" patch series.

* 'linux-4.1.0-rc5-tilcdc-refactor' of https://github.com/jsarha/linux:
  drm/tilcdc: Force building of DRM_TILCDC_SLAVE_COMPAT
  drm/tilcdc: Add DRM_TILCDC_SLAVE_COMPAT for ti,tilcdc,slave binding support
  drm/tilcdc: use pm_runtime_irq_safe()
  drm/tilcdc: Add support for external tda998x encoder
  drm/tilcdc: Remove tilcdc slave support for tda998x driver
  drm/tilcdc: Fix module unloading

Linux 4.1-rc6

backmerge 4.1-rc6 as some of the later pull reqs are based on newer bases
and I'd prefer to do the fixup myself.

This fixes some regressions in i915 when converting to atomic.
set_config failed with -EINVAL, and I received the following warning
in dmesg:

[drm:drm_atomic_crtc_check] [CRTC:20] active without enabled

Solve this by clearing active when a crtc is disabled.

Because crtc_state->enable implies that connectors are active the
change from disabled->enabled can only happen for the crtc that's
being set_config'd, and checking for !crtc_state->enable is sufficient
here.

Cc: dri-devel@lists.freedesktop.org
Reviewed-by: Rob Clark <robdclark@gmail.com>
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

One more round of drm-misc, again mostly atomic. Big thing is the
userspace blob code from Daniel Stone, with support for the mode_id blob
now added to the atomic ioctl. Finally we can do atomic modesets!

Note that the atomic ioctl is still behind the module knob since the
weston patches aren't quite ready yet imo - they lack TEST_ONLY support,
which is a fairly crucial bit of the atomic api. But besides that I think
it's all good to go. That's also why we didn't bother to hide the new blob
ioctls behind the knob, that part won't need to change. And if weston
patches get in shape in time we could throw the "atomic by default patch"
on top for 4.2.

* tag 'topic/drm-misc-2015-05-27' of git://anongit.freedesktop.org/drm-intel:
  drm: Fix off-by-one in vblank hardware counter wraparound handling
  drm/atomic: fix out of bounds read in for_each_*_in_state helpers
  drm/atomic: Add MODE_ID property
  drm/atomic: Add current-mode blob to CRTC state
  drm: Add drm_atomic_set_mode_for_crtc
  drm: check for garbage in unused addfb2 fields
  drm: Retain reference to blob properties in lookup
  drm/mode: Add user blob-creation ioctl
  drm: Return error value from blob creation
  drm: Allow creating blob properties without copy
  drm/mode: Unstatic kernel-userspace mode conversion
  drm/mode: Validate modes inside drm_crtc_convert_umode
  drm/crtc_helper: Replace open-coded CRTC state helpers
  drm: kerneldoc fixes for blob properties
  drm/DocBook: Add more drm_bridge documentation
  drm: bridge: Allow daisy chaining of bridges
  drm/atomic: add all affected planes in drm_atomic_helper_check_modeset
  drm/atomic: add drm_atomic_add_affected_planes
  drm/atomic: add commit_planes_on_crtc helper

drm-amdkfd-next-2015-06-03:

- Add the H/W debugger support module, including new IOCTLs to:
  - register/unregister a process as a debugged process
  - Set address watch-point in the debugged process's GPU kernel
  - Do a wave control operation in the debugged process's waves
  See the commit messages for more details on the available operations.

  The debugged process can only perform debug operation on itself. It is
  blocked by the amdkfd+H/W from performing operations on other processes's
  waves or GPU kernels. The blocking is done by setting the VMID and PASID of
  the debugged process in the packets that are sent to the CP with the debug
  instructions.

- Add support for static user-mode queues. These queues are regular queues,
  but because they belong to the debugged process, we need to make sure the CP
  doesn't preempt them during a debug operation. Therefore, we mark them as
  static for the CP ignore them during preemption.

- Support killing all the waves when a process is terminated. This is needed
  in case a process is terminated but we can't UNMAP its queues (can occur due
  to several reasons). In that case, the CP could be stuck unless we kill all
  its waves. This function is *very* important as it provides the kernel a high
  level of control over the GPU. The reason we didn't upstream this function
  so far, is because it is implemented using the H/W debugger module functions,
  so we had to wait until we can upstream the H/W debugger module.

- Replace declaration of bitmap from unsigned long to standard DECLARE_BITMAP

* tag 'drm-amdkfd-next-2015-06-03' of git://people.freedesktop.org/~gabbayo/linux:
  drm/amdkfd: Enforce kill all waves on process termination
  drm/radeon: Add ATC VMID<-->PASID functions to kfd->kgd
  drm/amdkfd: Implement address watch debugger IOCTL
  drm/amdkfd: Implement wave control debugger IOCTL
  drm/amdkfd: Implement (un)register debugger IOCTLs
  drm/amdkfd: Add address watch operation to debugger
  drm/amdkfd: Add wave control operation to debugger
  drm/amdkfd: Add skeleton H/W debugger module support
  drm/amdkfd: Add static user-mode queues support
  drm/amdkfd: add H/W debugger IOCTL set definitions
  drm/radeon: Add H/W debugger kfd->kgd functions
  drm/amdkfd: Use DECLARE_BITMAP

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

This patch adds a kms driver for the virtio gpu.  The xorg modesetting
driver can handle the device just fine, the framebuffer for fbcon is
there too.

Qemu patches for the host side are under review currently.

The pci version of the device comes in two variants: with and without
vga compatibility.  The former has a extra memory bar for the vga
framebuffer, the later is a pure virtio device.  The only concern for
this driver is that in the virtio-vga case we have to kick out the
firmware framebuffer.

Initial revision has only 2d support, 3d (virgl) support requires
some more work on the qemu side and will be added later.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>

This commit makes sure that on process termination, after
we're destroying all the active queues, we're killing all the
existing wave front of the current process.

By doing this we're making sure that if any of the CUs were blocked
by infinite loop we're enforcing it to end the shader explicitly.
Signed-off-by: Ben Goz <ben.goz@amd.com>
Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>

This patch adds three new interfaces to kfd2kgd interface file of radeon.

The interfaces are:

- Check if a specific VMID has a valid PASID mapping
- Retrieve the PASID which is mapped to a specific VMID
- Issue a VMID invalidation request to the ATC
Signed-off-by: Alexey Skidanov <Alexey.Skidanov@amd.com>
Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>

v2:

- rename get_dbgmgr_mutex to kfd_get_dbgmgr_mutex to namespace it
- change void* to uint64_t inside ioctl arguments
- use kmalloc instead of kzalloc because we use copy_from_user
  immediately after it
Signed-off-by: Yair Shachar <yair.shachar@amd.com>
Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>

v2:

- rename get_dbgmgr_mutex to kfd_get_dbgmgr_mutex to namespace it
- change void* to uint64_t inside ioctl arguments
- use kmalloc instead of kzalloc because we use copy_from_user
  immediately after it
Signed-off-by: Yair Shachar <yair.shachar@amd.com>
Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>

v2: rename get_dbgmgr_mutex to kfd_get_dbgmgr_mutex to namespace it
Signed-off-by: Yair Shachar <yair.shachar@amd.com>
Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>

The address watch operation gives the ability to specify watch points
which will generate a shader breakpoint, based on a specified single
address or range of addresses.

There is support for read/write/any access modes.
Signed-off-by: Yair Shachar <yair.shachar@amd.com>
Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>

The wave control operation supports several command types executed upon
existing wave fronts that belong to the currently debugged process.

The available commands are:

HALT   - Freeze wave front(s) execution
RESUME - Resume freezed wave front(s) execution
KILL   - Kill existing wave front(s)
Signed-off-by: Yair Shachar <yair.shachar@amd.com>
Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>

This patch adds the skeleton H/W debugger module support. This code
enables registration and unregistration of a single HSA process at a
time.

The module saves the process's pasid and use it to verify that only the
registered process is allowed to execute debugger operations through the
kernel driver.

v2: rename get_dbgmgr_mutex to kfd_get_dbgmgr_mutex to namespace it
Signed-off-by: Yair Shachar <yair.shachar@amd.com>
Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>

This patch adds support for static user-mode queues in QCM.
Queues which are designated as static can NOT be preempted by
the CP microcode when it is executing its scheduling algorithm.

This is needed for supporting the debugger feature, because we
can't allow the CP to preempt queues which are currently being debugged.

The number of queues that can be designated as static is limited by the
number of HQDs (Hardware Queue Descriptors).
Signed-off-by: Yair Shachar <yair.shachar@amd.com>
Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>

This patch adds four new IOCTLs to amdkfd. These IOCTLs expose a H/W
debugger functionality to the userspace.

The IOCTLs are:

- AMDKFD_IOC_DBG_REGISTER:

The purpose of this IOCTL is to notify amdkfd that a process wants to use
GPU debugging facilities on itself only.
It is expected that this IOCTL would be called before any other H/W
debugger requests are sent to amdkfd and for each GPU where the H/W
debugging needs to be enabled. The use of this IOCTL ensures that only
one instance of a debugger is active in the system.

- AMDKFD_IOC_DBG_UNREGISTER:

This IOCTL detaches the debugger/debugged process from the H/W
Debug which was established by the AMDKFD_IOC_DBG_REGISTER IOCTL.

- AMDKFD_IOC_DBG_ADDRESS_WATCH:

This IOCTL allows to set different watchpoints with various conditions as
indicated by the IOCTL's arguments. The available number of watchpoints
is retrieved from topology. This operation is confined to the current
debugged process, which was registered through AMDKFD_IOC_DBG_REGISTER.

- AMDKFD_IOC_DBG_WAVE_CONTROL:

This IOCTL allows to control a wavefront as indicated by the IOCTL's
arguments. For example, you can halt/resume or kill either a
single wavefront or a set of wavefronts. This operation is confined to
the current debugged process, which was registered through
AMDKFD_IOC_DBG_REGISTER.

Because the arguments for the address watch IOCTL and wave control IOCTL
are dynamic, meaning that they could vary in size, the userspace passes a
pointer to a structure (in userspace) that contains the value of the
arguments. The kernel driver is responsible to parse this structure and
validate its contents.

v2: change void* to uint64_t inside ioctl arguments
Signed-off-by: Yair Shachar <yair.shachar@amd.com>
Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>

This patch adds new interface functions to the kfd2kgd interface file. The
new functions allow to perform H/W debugger operations by writing to GPU
registers.
Signed-off-by: Yair Shachar <yair.shachar@amd.com>
Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>

Use the generic mechanism to declare a bitmap instead of unsigned long.

It seems that "struct kfd_process.allocated_queue_bitmap" is unused.
Maybe it could be deleted instead.
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>

After adding virtio-gpu I get this funky kconfig dependency loop.

scripts/kconfig/conf --oldconfig Kconfig
drivers/video/fbdev/Kconfig:5:error: recursive dependency detected!
drivers/video/fbdev/Kconfig:5:  symbol FB is selected by DRM_KMS_FB_HELPER
drivers/gpu/drm/Kconfig:34:     symbol DRM_KMS_FB_HELPER is selected by DRM_VIRTIO_GPU
drivers/gpu/drm/virtio/Kconfig:1:       symbol DRM_VIRTIO_GPU depends on VIRTIO
drivers/virtio/Kconfig:1:       symbol VIRTIO is selected by REMOTEPROC
drivers/remoteproc/Kconfig:4:   symbol REMOTEPROC is selected by OMAP_REMOTEPROC
drivers/remoteproc/Kconfig:12:  symbol OMAP_REMOTEPROC depends on OMAP_IOMMU
drivers/iommu/Kconfig:141:      symbol OMAP_IOMMU is selected by VIDEO_OMAP3
drivers/media/platform/Kconfig:96:      symbol VIDEO_OMAP3 depends on VIDEO_V4L2
drivers/media/v4l2-core/Kconfig:6:      symbol VIDEO_V4L2 depends on I2C
drivers/i2c/Kconfig:7:  symbol I2C is selected by FB_DDC
drivers/video/fbdev/Kconfig:59: symbol FB_DDC is selected by FB_CYBER2000_DDC
drivers/video/fbdev/Kconfig:374:        symbol FB_CYBER2000_DDC depends on FB_CYBER2000
drivers/video/fbdev/Kconfig:362:        symbol FB_CYBER2000 depends on FB

Making VIDEO_OMAP3 depend on OMAP_IOMMU instead of selecting it breaks the
loop, which looks like the best way to handle it to me.  Updated OMAP_IOMMU
help text accordingly.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

Merge tag 'drm-intel-next-fixes-2015-05-29' of git://anongit.freedesktop.org/drm-intel into drm-next

Fixes for 4.2. Nothing too serious (given that it's still pre merge
window). With that it's off for 2 weeks of vacation for me and taking care
of 4.2 fixes for Jani.

* tag 'drm-intel-next-fixes-2015-05-29' of git://anongit.freedesktop.org/drm-intel:
  drm/i915: limit PPGTT size to 2GB in 32-bit platforms
  drm/i915: Another fbdev hack to avoid PSR on fbcon.
  drm/i915: Return the frontbuffer flip to enable intel_crtc_enable_planes.
  drm/i915: disable IPS while getting the sink CRCs
  drm/i915: Disable 12bpc hdmi for now
  drm/i915: Adjust sideband locking a bit for CHV/VLV
  drm/i915: s/dpio_lock/sb_lock/
  drm/i915: Kill intel_flush_primary_plane()
  drm/i915: Throw out WIP CHV power well definitions
  drm/i915: Use the default 600ns LDO programming sequence delay
  drm/i915: Remove unnecessary null check in execlists_context_unqueue
  drm/i915: Use spinlocks for checking when to waitboost
  drm/i915: Fix the confusing comment about the ioctl limits
  Revert "drm/i915: Force clean compilation with -Werror"

dma_alloc_coherent() can return memory in the vmalloc range.
virt_to_page() cannot handle such addresses and crashes. This
patch detects such cases and obtains the struct page * using
vmalloc_to_page() instead.
Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

Pull vfs fix from Al Viro:
 "Off-by-one in d_walk()/__dentry_kill() race fix.

  It's very hard to hit; possible in the same conditions as the original
  bug, except that you need the skipped branch to contain all the
  remaining evictables, so that the d_walk()-calling loop in
  d_invalidate() decides there's nothing more to do and doesn't go for
  another pass - otherwise that next pass will sweep the sucker.

  So it's not too urgent, but seeing that the fix is obvious and the
  original commit has spread into all -stable branches..."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  d_walk() might skip too much

Pull ARM fixes from Russell King:
 "Three fixes this time around:

   - fix a memory leak which occurs when probing performance monitoring
     unit interrupts

   - fix handling of non-PMD aligned end of RAM causing boot failures

   - fix missing syscall trace exit path with syscall tracing enabled
     causing a kernel oops in the audit code"

* 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm:
  ARM: 8357/1: perf: fix memory leak when probing PMU PPIs
  ARM: fix missing syscall trace exit
  ARM: 8356/1: mm: handle non-pmd-aligned end of RAM

Pull MIPS fixes from Ralf Baechle:
 "MIPS fixes for 4.1 all across the tree"

* 'upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/ralf/linux:
  MIPS: strnlen_user.S: Fix a CPU_DADDI_WORKAROUNDS regression
  MIPS: BMIPS: Fix bmips_wr_vec()
  MIPS: ath79: fix build problem if CONFIG_BLK_DEV_INITRD is not set
  MIPS: Fuloong 2E: Replace CONFIG_USB_ISP1760_HCD by CONFIG_USB_ISP1760
  MIPS: irq: Use DECLARE_BITMAP
  ttyFDC: Fix to use native endian MMIO reads
  MIPS: Fix CDMM to use native endian MMIO reads

Pull turbostat tool fixes from Len Brown:
 "Just one minor kernel dependency in this batch -- added a #define to
  msr-index.h"

* 'turbostat' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux:
  tools/power turbostat: update version number to 4.7
  tools/power turbostat: allow running without cpu0
  tools/power turbostat: correctly decode of ENERGY_PERFORMANCE_BIAS
  tools/power turbostat: enable turbostat to support Knights Landing (KNL)
  tools/power turbostat: correctly display more than 2 threads/core

Pull SCSI target fixes from Nicholas Bellinger:
 "These are mostly minor fixes, with the exception of the following that
  address fall-out from recent v4.1-rc1 changes:

   - regression fix related to the big fabric API registration changes
     and configfs_depend_item() usage, that required cherry-picking one
     of HCH's patches from for-next to address the issue for v4.1 code.

   - remaining TCM-USER -v2 related changes to enforce full CDB
     passthrough from Andy + Ilias.

  Also included is a target_core_pscsi driver fix from Andy that
  addresses a long standing issue with a Scsi_Host reference being
  leaked on PSCSI device shutdown"

* git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
  iser-target: Fix error path in isert_create_pi_ctx()
  target: Use a PASSTHROUGH flag instead of transport_types
  target: Move passthrough CDB parsing into a common function
  target/user: Only support full command pass-through
  target/user: Update example code for new ABI requirements
  target/pscsi: Don't leak scsi_host if hba is VIRTUAL_HOST
  target: Fix se_tpg_tfo->tf_subsys regression + remove tf_subsystem
  target: Drop signal_pending checks after interruptible lock acquire
  target: Add missing parentheses
  target: Fix bidi command handling
  target/user: Disallow full passthrough (pass_level=0)
  ISCSI: fix minor memory leak

Merge tag 'hwmon-for-linus-v4.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull hwmon fixes from Guenter Roeck:
 "Some late hwmon patches, all headed for -stable

   - fix sysfs attribute initialization in nct6775 and nct6683 drivers

   - do not attempt to auto-detect tmp435 on I2C address 0x37

   - ensure iio channel is of type IIO_VOLTAGE in ntc_thermistor driver"

* tag 'hwmon-for-linus-v4.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: (nct6683) Add missing sysfs attribute initialization
  hwmon: (nct6775) Add missing sysfs attribute initialization
  hwmon: (tmp401) Do not auto-detect chip on I2C address 0x37
  hwmon: (ntc_thermistor) Ensure iio channel is of type IIO_VOLTAGE