Merge branch 'drm-next' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6

* 'drm-next' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
  drm: Avoid oops in DRM_IOCTL_RM_DRAW if a bad handle is supplied.
  drm: Add 32-bit compatibility for DRM_IOCTL_UPDATE_DRAW.
  drm/i915: use pipes, not planes to label vblank data
  drm/i915: hold dev->struct_mutex and DRM lock during vblank ring operations
  i915: Fix format string warnings on x86-64.
  i915: Don't dereference HWS in /proc debug files when it isn't initialized.
  i915: Enable IMR passthrough of vblank events before enabling it in pipestat.
  drm: Remove two leaks of vblank reference count in error paths.
  drm: fix leak of cliprects in drm_rmdraw()
  i915: Disable MSI on GM965 (errata says it doesn't work)
  drm: Set cliprects to NULL when changing drawable to having 0 cliprects.
  i915: Protect vblank IRQ reg access with spinlock

drivers/gpu/drm/drm_drawable.c

@@ -76,11 +76,18 @@ int drm_rmdraw(struct drm_device *dev, void *data, struct drm_file *file_priv)
 {
 	struct drm_draw *draw = data;
 	unsigned long irqflags;
+	struct drm_drawable_info *info;
 
 	spin_lock_irqsave(&dev->drw_lock, irqflags);
 
-	drm_free(drm_get_drawable_info(dev, draw->handle),
-		 sizeof(struct drm_drawable_info), DRM_MEM_BUFS);
+	info = drm_get_drawable_info(dev, draw->handle);
+	if (info == NULL) {
+		spin_unlock_irqrestore(&dev->drw_lock, irqflags);
+		return -EINVAL;
+	}
+	drm_free(info->rects, info->num_rects * sizeof(struct drm_clip_rect),
+			DRM_MEM_BUFS);
+	drm_free(info, sizeof(struct drm_drawable_info), DRM_MEM_BUFS);
 
 	idr_remove(&dev->drw_idr, draw->handle);
 
@@ -111,7 +118,9 @@ int drm_update_drawable_info(struct drm_device *dev, void *data, struct drm_file
 
 	switch (update->type) {
 	case DRM_DRAWABLE_CLIPRECTS:
-		if (update->num != info->num_rects) {
+		if (update->num == 0)
+			rects = NULL;
+		else if (update->num != info->num_rects) {
 			rects = drm_alloc(update->num * sizeof(struct drm_clip_rect),
 					 DRM_MEM_BUFS);
 		} else

drivers/gpu/drm/drm_ioc32.c

@@ -64,6 +64,8 @@
 #define DRM_IOCTL_SG_ALLOC32		DRM_IOW( 0x38, drm_scatter_gather32_t)
 #define DRM_IOCTL_SG_FREE32		DRM_IOW( 0x39, drm_scatter_gather32_t)
 
+#define DRM_IOCTL_UPDATE_DRAW32		DRM_IOW( 0x3f, drm_update_draw32_t)
+
 #define DRM_IOCTL_WAIT_VBLANK32		DRM_IOWR(0x3a, drm_wait_vblank32_t)
 
 typedef struct drm_version_32 {
@@ -952,6 +954,37 @@ static int compat_drm_sg_free(struct file *file, unsigned int cmd,
 			 DRM_IOCTL_SG_FREE, (unsigned long)request);
 }
 
+typedef struct drm_update_draw32 {
+	drm_drawable_t handle;
+	unsigned int type;
+	unsigned int num;
+	/* 64-bit version has a 32-bit pad here */
+	u64 data;	/**< Pointer */
+} __attribute__((packed)) drm_update_draw32_t;
+
+static int compat_drm_update_draw(struct file *file, unsigned int cmd,
+				  unsigned long arg)
+{
+	drm_update_draw32_t update32;
+	struct drm_update_draw __user *request;
+	int err;
+
+	if (copy_from_user(&update32, (void __user *)arg, sizeof(update32)))
+		return -EFAULT;
+
+	request = compat_alloc_user_space(sizeof(*request));
+	if (!access_ok(VERIFY_WRITE, request, sizeof(*request)) ||
+	    __put_user(update32.handle, &request->handle) ||
+	    __put_user(update32.type, &request->type) ||
+	    __put_user(update32.num, &request->num) ||
+	    __put_user(update32.data, &request->data))
+		return -EFAULT;
+
+	err = drm_ioctl(file->f_path.dentry->d_inode, file,
+			DRM_IOCTL_UPDATE_DRAW, (unsigned long)request);
+	return err;
+}
+
 struct drm_wait_vblank_request32 {
 	enum drm_vblank_seq_type type;
 	unsigned int sequence;
@@ -1033,6 +1066,7 @@ drm_ioctl_compat_t *drm_compat_ioctls[] = {
 #endif
 	[DRM_IOCTL_NR(DRM_IOCTL_SG_ALLOC32)] = compat_drm_sg_alloc,
 	[DRM_IOCTL_NR(DRM_IOCTL_SG_FREE32)] = compat_drm_sg_free,
+	[DRM_IOCTL_NR(DRM_IOCTL_UPDATE_DRAW32)] = compat_drm_update_draw,
 	[DRM_IOCTL_NR(DRM_IOCTL_WAIT_VBLANK32)] = compat_drm_wait_vblank,
 };
 

drivers/gpu/drm/drm_irq.c

@@ -594,11 +594,14 @@ int drm_wait_vblank(struct drm_device *dev, void *data,
 			goto done;
 		}
 
+		/* Get a refcount on the vblank, which will be released by
+		 * drm_vbl_send_signals().
+		 */
 		ret = drm_vblank_get(dev, crtc);
 		if (ret) {
 			drm_free(vbl_sig, sizeof(struct drm_vbl_sig),
 				 DRM_MEM_DRIVER);
-			return ret;
+			goto done;
 		}
 
 		atomic_inc(&dev->vbl_signal_pending);

drivers/gpu/drm/drm_lock.c

@@ -232,6 +232,7 @@ int drm_lock_take(struct drm_lock_data *lock_data,
 	}
 	return 0;
 }
+EXPORT_SYMBOL(drm_lock_take);
 
 /**
  * This takes a lock forcibly and hands it to context.	Should ONLY be used
@@ -299,6 +300,7 @@ int drm_lock_free(struct drm_lock_data *lock_data, unsigned int context)
 	wake_up_interruptible(&lock_data->lock_queue);
 	return 0;
 }
+EXPORT_SYMBOL(drm_lock_free);
 
 /**
  * If we get here, it means that the process has called DRM_IOCTL_LOCK

drivers/gpu/drm/i915/i915_dma.c

@@ -844,8 +844,11 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
 	 * correctly in testing on 945G.
 	 * This may be a side effect of MSI having been made available for PEG
 	 * and the registers being closely associated.
+	 *
+	 * According to chipset errata, on the 965GM, MSI interrupts may
+	 * be lost or delayed
 	 */
-	if (!IS_I945G(dev) && !IS_I945GM(dev))
+	if (!IS_I945G(dev) && !IS_I945GM(dev) && !IS_I965GM(dev))
 		if (pci_enable_msi(dev->pdev))
 			DRM_ERROR("failed to enable MSI\n");
 

drivers/gpu/drm/i915/i915_drv.h

@@ -90,7 +90,7 @@ struct mem_block {
 typedef struct _drm_i915_vbl_swap {
 	struct list_head head;
 	drm_drawable_t drw_id;
-	unsigned int plane;
+	unsigned int pipe;
 	unsigned int sequence;
 } drm_i915_vbl_swap_t;
 
@@ -240,6 +240,9 @@ typedef struct drm_i915_private {
 	u8 saveDACDATA[256*3]; /* 256 3-byte colors */
 	u8 saveCR[37];
 
+	/** Work task for vblank-related ring access */
+	struct work_struct vblank_work;
+
 	struct {
 		struct drm_mm gtt_space;
 
@@ -285,9 +288,6 @@ typedef struct drm_i915_private {
 		 */
 		struct delayed_work retire_work;
 
-		/** Work task for vblank-related ring access */
-		struct work_struct vblank_work;
-
 		uint32_t next_gem_seqno;
 
 		/**
@@ -441,7 +441,7 @@ extern int i915_irq_wait(struct drm_device *dev, void *data,
 void i915_user_irq_get(struct drm_device *dev);
 void i915_user_irq_put(struct drm_device *dev);
 
-extern void i915_gem_vblank_work_handler(struct work_struct *work);
+extern void i915_vblank_work_handler(struct work_struct *work);
 extern irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS);
 extern void i915_driver_irq_preinstall(struct drm_device * dev);
 extern int i915_driver_irq_postinstall(struct drm_device *dev);

drivers/gpu/drm/i915/i915_gem.c

@@ -2564,8 +2564,6 @@ i915_gem_load(struct drm_device *dev)
 	INIT_LIST_HEAD(&dev_priv->mm.request_list);
 	INIT_DELAYED_WORK(&dev_priv->mm.retire_work,
 			  i915_gem_retire_work_handler);
-	INIT_WORK(&dev_priv->mm.vblank_work,
-		  i915_gem_vblank_work_handler);
 	dev_priv->mm.next_gem_seqno = 1;
 
 	i915_gem_detect_bit_6_swizzle(dev);

drivers/gpu/drm/i915/i915_gem_proc.c

@@ -192,7 +192,12 @@ static int i915_gem_seqno_info(char *buf, char **start, off_t offset,
 
 	*start = &buf[offset];
 	*eof = 0;
-	DRM_PROC_PRINT("Current sequence: %d\n", i915_get_gem_seqno(dev));
+	if (dev_priv->hw_status_page != NULL) {
+		DRM_PROC_PRINT("Current sequence: %d\n",
+			       i915_get_gem_seqno(dev));
+	} else {
+		DRM_PROC_PRINT("Current sequence: hws uninitialized\n");
+	}
 	DRM_PROC_PRINT("Waiter sequence:  %d\n",
 		       dev_priv->mm.waiting_gem_seqno);
 	DRM_PROC_PRINT("IRQ sequence:     %d\n", dev_priv->mm.irq_gem_seqno);
@@ -230,8 +235,12 @@ static int i915_interrupt_info(char *buf, char **start, off_t offset,
 		       I915_READ(PIPEBSTAT));
 	DRM_PROC_PRINT("Interrupts received: %d\n",
 		       atomic_read(&dev_priv->irq_received));
+	if (dev_priv->hw_status_page != NULL) {
 		DRM_PROC_PRINT("Current sequence:    %d\n",
 			       i915_get_gem_seqno(dev));
+	} else {
+		DRM_PROC_PRINT("Current sequence:    hws uninitialized\n");
+	}
 	DRM_PROC_PRINT("Waiter sequence:     %d\n",
 		       dev_priv->mm.waiting_gem_seqno);
 	DRM_PROC_PRINT("IRQ sequence:        %d\n",