Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 80e06794 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux 

Pull drm fixes from Dave Airlie:
 "Mostly quiet now:

  i915:
    fixing userspace visiblie issues, all stable marked

  radeon:
    one more pll fix, two crashers, one suspend/resume regression"

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  drm/radeon: Resume fbcon last
  drm/radeon: only allocate necessary size for vm bo list
  drm/radeon: don't allow RADEON_GEM_DOMAIN_CPU for command submission
  drm/radeon: avoid crash if VM command submission isn't available
  drm/radeon: lower the ref * post PLL maximum once more
  drm/i915: Prevent negative relocation deltas from wrapping
  drm/i915: Only copy back the modified fields to userspace from execbuffer
  drm/i915: Fix dynamic allocation of physical handles
parents 9f12600f 18ee37a4

drivers/gpu/drm/i915/i915_dma.c

+0 −1
Original line number Diff line number Diff line
@@ -1833,7 +1833,6 @@ int i915_driver_unload(struct drm_device *dev) 
		flush_workqueue(dev_priv->wq);



		mutex_lock(&dev->struct_mutex);

		i915_gem_free_all_phys_object(dev);

		i915_gem_cleanup_ringbuffer(dev);

		i915_gem_context_fini(dev);

		WARN_ON(dev_priv->mm.aliasing_ppgtt);

drivers/gpu/drm/i915/i915_drv.h

+7 −23
Original line number Diff line number Diff line
@@ -242,18 +242,6 @@ struct intel_ddi_plls { 
#define WATCH_LISTS	0

#define WATCH_GTT	0



#define I915_GEM_PHYS_CURSOR_0 1

#define I915_GEM_PHYS_CURSOR_1 2

#define I915_GEM_PHYS_OVERLAY_REGS 3

#define I915_MAX_PHYS_OBJECT (I915_GEM_PHYS_OVERLAY_REGS)



struct drm_i915_gem_phys_object {

	int id;

	struct page **page_list;

	drm_dma_handle_t *handle;

	struct drm_i915_gem_object *cur_obj;

};



struct opregion_header;

struct opregion_acpi;

struct opregion_swsci;
@@ -1187,9 +1175,6 @@ struct i915_gem_mm { 
	/** Bit 6 swizzling required for Y tiling */

	uint32_t bit_6_swizzle_y;



	/* storage for physical objects */

	struct drm_i915_gem_phys_object *phys_objs[I915_MAX_PHYS_OBJECT];



	/* accounting, useful for userland debugging */

	spinlock_t object_stat_lock;

	size_t object_memory;
@@ -1769,7 +1754,7 @@ struct drm_i915_gem_object { 
	struct drm_file *pin_filp;



	/** for phy allocated objects */

	struct drm_i915_gem_phys_object *phys_obj;

	drm_dma_handle_t *phys_handle;

};



#define to_intel_bo(x) container_of(x, struct drm_i915_gem_object, base)
@@ -2204,10 +2189,12 @@ void i915_gem_vma_destroy(struct i915_vma *vma); 
#define PIN_MAPPABLE 0x1

#define PIN_NONBLOCK 0x2

#define PIN_GLOBAL 0x4

#define PIN_OFFSET_BIAS 0x8

#define PIN_OFFSET_MASK (~4095)

int __must_check i915_gem_object_pin(struct drm_i915_gem_object *obj,

				     struct i915_address_space *vm,

				     uint32_t alignment,

				     unsigned flags);

				     uint64_t flags);

int __must_check i915_vma_unbind(struct i915_vma *vma);

int i915_gem_object_put_pages(struct drm_i915_gem_object *obj);

void i915_gem_release_all_mmaps(struct drm_i915_private *dev_priv);
@@ -2334,13 +2321,8 @@ i915_gem_object_pin_to_display_plane(struct drm_i915_gem_object *obj, 
				     u32 alignment,

				     struct intel_ring_buffer *pipelined);

void i915_gem_object_unpin_from_display_plane(struct drm_i915_gem_object *obj);

int i915_gem_attach_phys_object(struct drm_device *dev,

				struct drm_i915_gem_object *obj,

				int id,

int i915_gem_object_attach_phys(struct drm_i915_gem_object *obj,

				int align);

void i915_gem_detach_phys_object(struct drm_device *dev,

				 struct drm_i915_gem_object *obj);

void i915_gem_free_all_phys_object(struct drm_device *dev);

int i915_gem_open(struct drm_device *dev, struct drm_file *file);

void i915_gem_release(struct drm_device *dev, struct drm_file *file);
@@ -2465,6 +2447,8 @@ int __must_check i915_gem_evict_something(struct drm_device *dev, 
					  int min_size,

					  unsigned alignment,

					  unsigned cache_level,

					  unsigned long start,

					  unsigned long end,

					  unsigned flags);

int i915_gem_evict_vm(struct i915_address_space *vm, bool do_idle);

int i915_gem_evict_everything(struct drm_device *dev);

drivers/gpu/drm/i915/i915_gem.c

+160 −205
Original line number Diff line number Diff line
@@ -43,10 +43,6 @@ static void i915_gem_object_flush_cpu_write_domain(struct drm_i915_gem_object *o 
static __must_check int

i915_gem_object_wait_rendering(struct drm_i915_gem_object *obj,

			       bool readonly);

static int i915_gem_phys_pwrite(struct drm_device *dev,

				struct drm_i915_gem_object *obj,

				struct drm_i915_gem_pwrite *args,

				struct drm_file *file);



static void i915_gem_write_fence(struct drm_device *dev, int reg,

				 struct drm_i915_gem_object *obj);
@@ -209,6 +205,128 @@ i915_gem_get_aperture_ioctl(struct drm_device *dev, void *data, 
	return 0;

}



static void i915_gem_object_detach_phys(struct drm_i915_gem_object *obj)

{

	drm_dma_handle_t *phys = obj->phys_handle;



	if (!phys)

		return;



	if (obj->madv == I915_MADV_WILLNEED) {

		struct address_space *mapping = file_inode(obj->base.filp)->i_mapping;

		char *vaddr = phys->vaddr;

		int i;



		for (i = 0; i < obj->base.size / PAGE_SIZE; i++) {

			struct page *page = shmem_read_mapping_page(mapping, i);

			if (!IS_ERR(page)) {

				char *dst = kmap_atomic(page);

				memcpy(dst, vaddr, PAGE_SIZE);

				drm_clflush_virt_range(dst, PAGE_SIZE);

				kunmap_atomic(dst);



				set_page_dirty(page);

				mark_page_accessed(page);

				page_cache_release(page);

			}

			vaddr += PAGE_SIZE;

		}

		i915_gem_chipset_flush(obj->base.dev);

	}



#ifdef CONFIG_X86

	set_memory_wb((unsigned long)phys->vaddr, phys->size / PAGE_SIZE);

#endif

	drm_pci_free(obj->base.dev, phys);

	obj->phys_handle = NULL;

}



int

i915_gem_object_attach_phys(struct drm_i915_gem_object *obj,

			    int align)

{

	drm_dma_handle_t *phys;

	struct address_space *mapping;

	char *vaddr;

	int i;



	if (obj->phys_handle) {

		if ((unsigned long)obj->phys_handle->vaddr & (align -1))

			return -EBUSY;



		return 0;

	}



	if (obj->madv != I915_MADV_WILLNEED)

		return -EFAULT;



	if (obj->base.filp == NULL)

		return -EINVAL;



	/* create a new object */

	phys = drm_pci_alloc(obj->base.dev, obj->base.size, align);

	if (!phys)

		return -ENOMEM;



	vaddr = phys->vaddr;

#ifdef CONFIG_X86

	set_memory_wc((unsigned long)vaddr, phys->size / PAGE_SIZE);

#endif

	mapping = file_inode(obj->base.filp)->i_mapping;

	for (i = 0; i < obj->base.size / PAGE_SIZE; i++) {

		struct page *page;

		char *src;



		page = shmem_read_mapping_page(mapping, i);

		if (IS_ERR(page)) {

#ifdef CONFIG_X86

			set_memory_wb((unsigned long)phys->vaddr, phys->size / PAGE_SIZE);

#endif

			drm_pci_free(obj->base.dev, phys);

			return PTR_ERR(page);

		}



		src = kmap_atomic(page);

		memcpy(vaddr, src, PAGE_SIZE);

		kunmap_atomic(src);



		mark_page_accessed(page);

		page_cache_release(page);



		vaddr += PAGE_SIZE;

	}



	obj->phys_handle = phys;

	return 0;

}



static int

i915_gem_phys_pwrite(struct drm_i915_gem_object *obj,

		     struct drm_i915_gem_pwrite *args,

		     struct drm_file *file_priv)

{

	struct drm_device *dev = obj->base.dev;

	void *vaddr = obj->phys_handle->vaddr + args->offset;

	char __user *user_data = to_user_ptr(args->data_ptr);



	if (__copy_from_user_inatomic_nocache(vaddr, user_data, args->size)) {

		unsigned long unwritten;



		/* The physical object once assigned is fixed for the lifetime

		 * of the obj, so we can safely drop the lock and continue

		 * to access vaddr.

		 */

		mutex_unlock(&dev->struct_mutex);

		unwritten = copy_from_user(vaddr, user_data, args->size);

		mutex_lock(&dev->struct_mutex);

		if (unwritten)

			return -EFAULT;

	}



	i915_gem_chipset_flush(dev);

	return 0;

}



void *i915_gem_object_alloc(struct drm_device *dev)

{

	struct drm_i915_private *dev_priv = dev->dev_private;
@@ -921,8 +1039,8 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data, 
	 * pread/pwrite currently are reading and writing from the CPU

	 * perspective, requiring manual detiling by the client.

	 */

	if (obj->phys_obj) {

		ret = i915_gem_phys_pwrite(dev, obj, args, file);

	if (obj->phys_handle) {

		ret = i915_gem_phys_pwrite(obj, args, file);

		goto out;

	}
@@ -3208,12 +3326,14 @@ static struct i915_vma * 
i915_gem_object_bind_to_vm(struct drm_i915_gem_object *obj,

			   struct i915_address_space *vm,

			   unsigned alignment,

			   unsigned flags)

			   uint64_t flags)

{

	struct drm_device *dev = obj->base.dev;

	struct drm_i915_private *dev_priv = dev->dev_private;

	u32 size, fence_size, fence_alignment, unfenced_alignment;

	size_t gtt_max =

	unsigned long start =

		flags & PIN_OFFSET_BIAS ? flags & PIN_OFFSET_MASK : 0;

	unsigned long end =

		flags & PIN_MAPPABLE ? dev_priv->gtt.mappable_end : vm->total;

	struct i915_vma *vma;

	int ret;
@@ -3242,11 +3362,11 @@ i915_gem_object_bind_to_vm(struct drm_i915_gem_object *obj, 
	/* If the object is bigger than the entire aperture, reject it early

	 * before evicting everything in a vain attempt to find space.

	 */

	if (obj->base.size > gtt_max) {

		DRM_DEBUG("Attempting to bind an object larger than the aperture: object=%zd > %s aperture=%zu\n",

	if (obj->base.size > end) {

		DRM_DEBUG("Attempting to bind an object larger than the aperture: object=%zd > %s aperture=%lu\n",

			  obj->base.size,

			  flags & PIN_MAPPABLE ? "mappable" : "total",

			  gtt_max);

			  end);

		return ERR_PTR(-E2BIG);

	}
@@ -3263,12 +3383,15 @@ i915_gem_object_bind_to_vm(struct drm_i915_gem_object *obj, 
search_free:

	ret = drm_mm_insert_node_in_range_generic(&vm->mm, &vma->node,

						  size, alignment,

						  obj->cache_level, 0, gtt_max,

						  obj->cache_level,

						  start, end,

						  DRM_MM_SEARCH_DEFAULT,

						  DRM_MM_CREATE_DEFAULT);

	if (ret) {

		ret = i915_gem_evict_something(dev, vm, size, alignment,

					       obj->cache_level, flags);

					       obj->cache_level,

					       start, end,

					       flags);

		if (ret == 0)

			goto search_free;
@@ -3828,11 +3951,30 @@ i915_gem_ring_throttle(struct drm_device *dev, struct drm_file *file) 
	return ret;

}



static bool

i915_vma_misplaced(struct i915_vma *vma, uint32_t alignment, uint64_t flags)

{

	struct drm_i915_gem_object *obj = vma->obj;



	if (alignment &&

	    vma->node.start & (alignment - 1))

		return true;



	if (flags & PIN_MAPPABLE && !obj->map_and_fenceable)

		return true;



	if (flags & PIN_OFFSET_BIAS &&

	    vma->node.start < (flags & PIN_OFFSET_MASK))

		return true;



	return false;

}



int

i915_gem_object_pin(struct drm_i915_gem_object *obj,

		    struct i915_address_space *vm,

		    uint32_t alignment,

		    unsigned flags)

		    uint64_t flags)

{

	struct i915_vma *vma;

	int ret;
@@ -3845,15 +3987,13 @@ i915_gem_object_pin(struct drm_i915_gem_object *obj, 
		if (WARN_ON(vma->pin_count == DRM_I915_GEM_OBJECT_MAX_PIN_COUNT))

			return -EBUSY;



		if ((alignment &&

		     vma->node.start & (alignment - 1)) ||

		    (flags & PIN_MAPPABLE && !obj->map_and_fenceable)) {

		if (i915_vma_misplaced(vma, alignment, flags)) {

			WARN(vma->pin_count,

			     "bo is already pinned with incorrect alignment:"

			     " offset=%lx, req.alignment=%x, req.map_and_fenceable=%d,"

			     " obj->map_and_fenceable=%d\n",

			     i915_gem_obj_offset(obj, vm), alignment,

			     flags & PIN_MAPPABLE,

			     !!(flags & PIN_MAPPABLE),

			     obj->map_and_fenceable);

			ret = i915_vma_unbind(vma);

			if (ret)
@@ -4163,9 +4303,6 @@ void i915_gem_free_object(struct drm_gem_object *gem_obj) 


	trace_i915_gem_object_destroy(obj);



	if (obj->phys_obj)

		i915_gem_detach_phys_object(dev, obj);



	list_for_each_entry_safe(vma, next, &obj->vma_list, vma_link) {

		int ret;
@@ -4183,6 +4320,8 @@ void i915_gem_free_object(struct drm_gem_object *gem_obj) 
		}

	}



	i915_gem_object_detach_phys(obj);



	/* Stolen objects don't hold a ref, but do hold pin count. Fix that up

	 * before progressing. */

	if (obj->stolen)
@@ -4646,190 +4785,6 @@ i915_gem_load(struct drm_device *dev) 
	register_shrinker(&dev_priv->mm.inactive_shrinker);

}



/*

 * Create a physically contiguous memory object for this object

 * e.g. for cursor + overlay regs

 */

static int i915_gem_init_phys_object(struct drm_device *dev,

				     int id, int size, int align)

{

	struct drm_i915_private *dev_priv = dev->dev_private;

	struct drm_i915_gem_phys_object *phys_obj;

	int ret;



	if (dev_priv->mm.phys_objs[id - 1] || !size)

		return 0;



	phys_obj = kzalloc(sizeof(*phys_obj), GFP_KERNEL);

	if (!phys_obj)

		return -ENOMEM;



	phys_obj->id = id;



	phys_obj->handle = drm_pci_alloc(dev, size, align);

	if (!phys_obj->handle) {

		ret = -ENOMEM;

		goto kfree_obj;

	}

#ifdef CONFIG_X86

	set_memory_wc((unsigned long)phys_obj->handle->vaddr, phys_obj->handle->size / PAGE_SIZE);

#endif



	dev_priv->mm.phys_objs[id - 1] = phys_obj;



	return 0;

kfree_obj:

	kfree(phys_obj);

	return ret;

}



static void i915_gem_free_phys_object(struct drm_device *dev, int id)

{

	struct drm_i915_private *dev_priv = dev->dev_private;

	struct drm_i915_gem_phys_object *phys_obj;



	if (!dev_priv->mm.phys_objs[id - 1])

		return;



	phys_obj = dev_priv->mm.phys_objs[id - 1];

	if (phys_obj->cur_obj) {

		i915_gem_detach_phys_object(dev, phys_obj->cur_obj);

	}



#ifdef CONFIG_X86

	set_memory_wb((unsigned long)phys_obj->handle->vaddr, phys_obj->handle->size / PAGE_SIZE);

#endif

	drm_pci_free(dev, phys_obj->handle);

	kfree(phys_obj);

	dev_priv->mm.phys_objs[id - 1] = NULL;

}



void i915_gem_free_all_phys_object(struct drm_device *dev)

{

	int i;



	for (i = I915_GEM_PHYS_CURSOR_0; i <= I915_MAX_PHYS_OBJECT; i++)

		i915_gem_free_phys_object(dev, i);

}



void i915_gem_detach_phys_object(struct drm_device *dev,

				 struct drm_i915_gem_object *obj)

{

	struct address_space *mapping = file_inode(obj->base.filp)->i_mapping;

	char *vaddr;

	int i;

	int page_count;



	if (!obj->phys_obj)

		return;

	vaddr = obj->phys_obj->handle->vaddr;



	page_count = obj->base.size / PAGE_SIZE;

	for (i = 0; i < page_count; i++) {

		struct page *page = shmem_read_mapping_page(mapping, i);

		if (!IS_ERR(page)) {

			char *dst = kmap_atomic(page);

			memcpy(dst, vaddr + i*PAGE_SIZE, PAGE_SIZE);

			kunmap_atomic(dst);



			drm_clflush_pages(&page, 1);



			set_page_dirty(page);

			mark_page_accessed(page);

			page_cache_release(page);

		}

	}

	i915_gem_chipset_flush(dev);



	obj->phys_obj->cur_obj = NULL;

	obj->phys_obj = NULL;

}



int

i915_gem_attach_phys_object(struct drm_device *dev,

			    struct drm_i915_gem_object *obj,

			    int id,

			    int align)

{

	struct address_space *mapping = file_inode(obj->base.filp)->i_mapping;

	struct drm_i915_private *dev_priv = dev->dev_private;

	int ret = 0;

	int page_count;

	int i;



	if (id > I915_MAX_PHYS_OBJECT)

		return -EINVAL;



	if (obj->phys_obj) {

		if (obj->phys_obj->id == id)

			return 0;

		i915_gem_detach_phys_object(dev, obj);

	}



	/* create a new object */

	if (!dev_priv->mm.phys_objs[id - 1]) {

		ret = i915_gem_init_phys_object(dev, id,

						obj->base.size, align);

		if (ret) {

			DRM_ERROR("failed to init phys object %d size: %zu\n",

				  id, obj->base.size);

			return ret;

		}

	}



	/* bind to the object */

	obj->phys_obj = dev_priv->mm.phys_objs[id - 1];

	obj->phys_obj->cur_obj = obj;



	page_count = obj->base.size / PAGE_SIZE;



	for (i = 0; i < page_count; i++) {

		struct page *page;

		char *dst, *src;



		page = shmem_read_mapping_page(mapping, i);

		if (IS_ERR(page))

			return PTR_ERR(page);



		src = kmap_atomic(page);

		dst = obj->phys_obj->handle->vaddr + (i * PAGE_SIZE);

		memcpy(dst, src, PAGE_SIZE);

		kunmap_atomic(src);



		mark_page_accessed(page);

		page_cache_release(page);

	}



	return 0;

}



static int

i915_gem_phys_pwrite(struct drm_device *dev,

		     struct drm_i915_gem_object *obj,

		     struct drm_i915_gem_pwrite *args,

		     struct drm_file *file_priv)

{

	void *vaddr = obj->phys_obj->handle->vaddr + args->offset;

	char __user *user_data = to_user_ptr(args->data_ptr);



	if (__copy_from_user_inatomic_nocache(vaddr, user_data, args->size)) {

		unsigned long unwritten;



		/* The physical object once assigned is fixed for the lifetime

		 * of the obj, so we can safely drop the lock and continue

		 * to access vaddr.

		 */

		mutex_unlock(&dev->struct_mutex);

		unwritten = copy_from_user(vaddr, user_data, args->size);

		mutex_lock(&dev->struct_mutex);

		if (unwritten)

			return -EFAULT;

	}



	i915_gem_chipset_flush(dev);

	return 0;

}



void i915_gem_release(struct drm_device *dev, struct drm_file *file)

{

	struct drm_i915_file_private *file_priv = file->driver_priv;

drivers/gpu/drm/i915/i915_gem_evict.c

+4 −5
Original line number Diff line number Diff line
@@ -68,9 +68,9 @@ mark_free(struct i915_vma *vma, struct list_head *unwind) 
int

i915_gem_evict_something(struct drm_device *dev, struct i915_address_space *vm,

			 int min_size, unsigned alignment, unsigned cache_level,

			 unsigned long start, unsigned long end,

			 unsigned flags)

{

	struct drm_i915_private *dev_priv = dev->dev_private;

	struct list_head eviction_list, unwind_list;

	struct i915_vma *vma;

	int ret = 0;
@@ -102,11 +102,10 @@ i915_gem_evict_something(struct drm_device *dev, struct i915_address_space *vm, 
	 */



	INIT_LIST_HEAD(&unwind_list);

	if (flags & PIN_MAPPABLE) {

		BUG_ON(!i915_is_ggtt(vm));

	if (start != 0 || end != vm->total) {

		drm_mm_init_scan_with_range(&vm->mm, min_size,

					    alignment, cache_level, 0,

					    dev_priv->gtt.mappable_end);

					    alignment, cache_level,

					    start, end);

	} else

		drm_mm_init_scan(&vm->mm, min_size, alignment, cache_level);

drivers/gpu/drm/i915/i915_gem_execbuffer.c

+89 −41
Original line number Diff line number Diff line
@@ -35,6 +35,9 @@ 


#define  __EXEC_OBJECT_HAS_PIN (1<<31)

#define  __EXEC_OBJECT_HAS_FENCE (1<<30)

#define  __EXEC_OBJECT_NEEDS_BIAS (1<<28)



#define BATCH_OFFSET_BIAS (256*1024)



struct eb_vmas {

	struct list_head vmas;
@@ -545,7 +548,7 @@ i915_gem_execbuffer_reserve_vma(struct i915_vma *vma, 
	struct drm_i915_gem_exec_object2 *entry = vma->exec_entry;

	bool has_fenced_gpu_access = INTEL_INFO(ring->dev)->gen < 4;

	bool need_fence;

	unsigned flags;

	uint64_t flags;

	int ret;



	flags = 0;
@@ -559,6 +562,8 @@ i915_gem_execbuffer_reserve_vma(struct i915_vma *vma, 


	if (entry->flags & EXEC_OBJECT_NEEDS_GTT)

		flags |= PIN_GLOBAL;

	if (entry->flags & __EXEC_OBJECT_NEEDS_BIAS)

		flags |= BATCH_OFFSET_BIAS | PIN_OFFSET_BIAS;



	ret = i915_gem_object_pin(obj, vma->vm, entry->alignment, flags);

	if (ret)
@@ -592,6 +597,36 @@ i915_gem_execbuffer_reserve_vma(struct i915_vma *vma, 
	return 0;

}



static bool

eb_vma_misplaced(struct i915_vma *vma, bool has_fenced_gpu_access)

{

	struct drm_i915_gem_exec_object2 *entry = vma->exec_entry;

	struct drm_i915_gem_object *obj = vma->obj;

	bool need_fence, need_mappable;



	need_fence =

		has_fenced_gpu_access &&

		entry->flags & EXEC_OBJECT_NEEDS_FENCE &&

		obj->tiling_mode != I915_TILING_NONE;

	need_mappable = need_fence || need_reloc_mappable(vma);



	WARN_ON((need_mappable || need_fence) &&

	       !i915_is_ggtt(vma->vm));



	if (entry->alignment &&

	    vma->node.start & (entry->alignment - 1))

		return true;



	if (need_mappable && !obj->map_and_fenceable)

		return true;



	if (entry->flags & __EXEC_OBJECT_NEEDS_BIAS &&

	    vma->node.start < BATCH_OFFSET_BIAS)

		return true;



	return false;

}



static int

i915_gem_execbuffer_reserve(struct intel_ring_buffer *ring,

			    struct list_head *vmas,
@@ -653,26 +688,10 @@ i915_gem_execbuffer_reserve(struct intel_ring_buffer *ring, 


		/* Unbind any ill-fitting objects or pin. */

		list_for_each_entry(vma, vmas, exec_list) {

			struct drm_i915_gem_exec_object2 *entry = vma->exec_entry;

			bool need_fence, need_mappable;



			obj = vma->obj;



			if (!drm_mm_node_allocated(&vma->node))

				continue;



			need_fence =

				has_fenced_gpu_access &&

				entry->flags & EXEC_OBJECT_NEEDS_FENCE &&

				obj->tiling_mode != I915_TILING_NONE;

			need_mappable = need_fence || need_reloc_mappable(vma);



			WARN_ON((need_mappable || need_fence) &&

			       !i915_is_ggtt(vma->vm));



			if ((entry->alignment &&

			     vma->node.start & (entry->alignment - 1)) ||

			    (need_mappable && !obj->map_and_fenceable))

			if (eb_vma_misplaced(vma, has_fenced_gpu_access))

				ret = i915_vma_unbind(vma);

			else

				ret = i915_gem_execbuffer_reserve_vma(vma, ring, need_relocs);
@@ -773,7 +792,7 @@ i915_gem_execbuffer_relocate_slow(struct drm_device *dev, 
		 * relocations were valid.

		 */

		for (j = 0; j < exec[i].relocation_count; j++) {

			if (copy_to_user(&user_relocs[j].presumed_offset,

			if (__copy_to_user(&user_relocs[j].presumed_offset,

					   &invalid_offset,

					   sizeof(invalid_offset))) {

				ret = -EFAULT;
@@ -999,6 +1018,25 @@ i915_reset_gen7_sol_offsets(struct drm_device *dev, 
	return 0;

}



static struct drm_i915_gem_object *

eb_get_batch(struct eb_vmas *eb)

{

	struct i915_vma *vma = list_entry(eb->vmas.prev, typeof(*vma), exec_list);



	/*

	 * SNA is doing fancy tricks with compressing batch buffers, which leads

	 * to negative relocation deltas. Usually that works out ok since the

	 * relocate address is still positive, except when the batch is placed

	 * very low in the GTT. Ensure this doesn't happen.

	 *

	 * Note that actual hangs have only been observed on gen7, but for

	 * paranoia do it everywhere.

	 */

	vma->exec_entry->flags |= __EXEC_OBJECT_NEEDS_BIAS;



	return vma->obj;

}



static int

i915_gem_do_execbuffer(struct drm_device *dev, void *data,

		       struct drm_file *file,
@@ -1153,7 +1191,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data, 
		goto err;



	/* take note of the batch buffer before we might reorder the lists */

	batch_obj = list_entry(eb->vmas.prev, struct i915_vma, exec_list)->obj;

	batch_obj = eb_get_batch(eb);



	/* Move the objects en-masse into the GTT, evicting if necessary. */

	need_relocs = (args->flags & I915_EXEC_NO_RELOC) == 0;
@@ -1355,18 +1393,21 @@ i915_gem_execbuffer(struct drm_device *dev, void *data, 


	ret = i915_gem_do_execbuffer(dev, data, file, &exec2, exec2_list);

	if (!ret) {

		struct drm_i915_gem_exec_object __user *user_exec_list =

			to_user_ptr(args->buffers_ptr);



		/* Copy the new buffer offsets back to the user's exec list. */

		for (i = 0; i < args->buffer_count; i++)

			exec_list[i].offset = exec2_list[i].offset;

		/* ... and back out to userspace */

		ret = copy_to_user(to_user_ptr(args->buffers_ptr),

				   exec_list,

				   sizeof(*exec_list) * args->buffer_count);

		for (i = 0; i < args->buffer_count; i++) {

			ret = __copy_to_user(&user_exec_list[i].offset,

					     &exec2_list[i].offset,

					     sizeof(user_exec_list[i].offset));

			if (ret) {

				ret = -EFAULT;

				DRM_DEBUG("failed to copy %d exec entries "

					  "back to user (%d)\n",

					  args->buffer_count, ret);

				break;

			}

		}

	}
@@ -1412,14 +1453,21 @@ i915_gem_execbuffer2(struct drm_device *dev, void *data, 
	ret = i915_gem_do_execbuffer(dev, data, file, args, exec2_list);

	if (!ret) {

		/* Copy the new buffer offsets back to the user's exec list. */

		ret = copy_to_user(to_user_ptr(args->buffers_ptr),

				   exec2_list,

				   sizeof(*exec2_list) * args->buffer_count);

		struct drm_i915_gem_exec_object2 *user_exec_list =

				   to_user_ptr(args->buffers_ptr);

		int i;



		for (i = 0; i < args->buffer_count; i++) {

			ret = __copy_to_user(&user_exec_list[i].offset,

					     &exec2_list[i].offset,

					     sizeof(user_exec_list[i].offset));

			if (ret) {

				ret = -EFAULT;

				DRM_DEBUG("failed to copy %d exec entries "

				  "back to user (%d)\n",

				  args->buffer_count, ret);

					  "back to user\n",

					  args->buffer_count);

				break;

			}

		}

	}