We have two calling contexts for thise function:

- In the crtc helper code itself as part of the ->set_config
  implementation. In this calling context all modeset locks are
  already held, as they should.

- In drivers not implementing fastboot before the fbdev/fbcon setup
  and initialization. This has been added for all drivers in

  commit 76a39dbf
  Author: Daniel Vetter <daniel.vetter@ffwll.ch>
  Date:   Sun Jan 20 23:12:54 2013 +0100

      drm/fb-helper: don't disable everything in initial_config

  In this calling context we do not hold any modeset locks since the
  immediately following call to initialize the fbev emulation grabs
  all these locks themselves.

- There are two exceptions to the above rule: shmob doesn't have fbdev
  emulation support. I've manually checked the callchain up to the
  driver load function and no kms locks are held.

The right fix therefore is to split this helper into an internal and
external version and add the required locking to the function exported
to drivers.

This remedies locking inconsistencies exposed by me adding locking
WARNs as part of the recent kerneldoc abi polishing done in

commit 62ff94a5
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Thu Jan 23 22:18:47 2014 +0100

    drm/crtc-helper: remove LOCKING from kerneldoc

and

commit 63951385
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Thu Jan 23 15:14:15 2014 +0100

    drm/doc: Repleace LOCKING kerneldoc sections in drm_modes.c

v2: It helps when I actually git add the entire thing.

Cc: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Tested-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

Summary of what's included:

- SGX MMU support
- SGX IRQ handling (Page faults and blitter fences)
- Minor Cedarview and Poulsbo unification
- Work queue for ASLE interrupt work
- Various cleanups, style fixes and removal of dead code

* 'gma500-next' of git://github.com/patjak/drm-gma500:
  drm/gma500: remove stub .open/postclose
  drm/gma500: Code cleanup - inline documentation
  drm/gma500: Code cleanup - style fixes
  drm/gma500: Code cleanup - removal of centralized exiting of function
  drm/gma500/cdv: Cedarview display cleanups
  drm/gma500: Unify encoder mode fixup
  drm/gma500: Unify _get_core_freq for cdv and psb
  drm/gma500: Move asle interrupt work into a work task
  drm/gma500: Remove dead code
  drm/gma500: Add backing type and base align to psb_gem_create()
  drm/gma500: Remove unused ioctls
  drm/gma500: Always trap MMU page faults
  drm/gma500: Hook up the MMU
  drm/gma500: Add first piece of blitter code
  drm/gma500: Give MMU code it's own header file
  drm/gma500: Add support for SGX interrupts
  drm/gma500: Make SGX MMU driver actually do something

Not sure why git didn't flag this, but the result of automerge
from 3.14-rc7 screwed up the radeon init procedure.

Reported-by: Fireburn on #radeon
Signed-off-by: Dave Airlie <airlied@redhat.com>

Merge straggling core drm patches.

* 'topic/core-stuff' of git://git.freedesktop.org/git/drm-intel:
  drm: Fix use-after-free in the shadow-attache exit code
  drm/fb-helper: Do the 'max_conn_count' zero check
  drm: Check if the allocation has succeeded before dereferencing newmode
  drm/fb-helper: Use drm_fb_helper_restore_fbdev_mode() in drm_fb_helper_set_par()
  drm/edid: request HDMI underscan by default

The sg_table made when gem cma is created isn't used anywhere. The sgt
of struct drm_gem_cma_object will have only sg_tabel imported.
Signed-off-by: Joonyoung Shim <jy0922.shim@samsung.com>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

This is the 3rd respin of the drm-anon patches. They allow module unloading, use
the pin_fs_* helpers recommended by Al and are rebased on top of drm-next. Note
that there are minor conflicts with the "drm-minor" branch.

* 'drm-next' of git://people.freedesktop.org/~dvdhrm/linux:
  drm: init TTM dev_mapping in ttm_bo_device_init()
  drm: use anon-inode instead of relying on cdevs
  drm: add pseudo filesystem for shared inodes

Linux 3.14-rc7

Backmerge to help out Intel guys.

Here's my drm documentation update and driver api polish pull request.
Alex reviewed the entire pile, I've applied a little bit of spelling
polish in a few places since then and otherwise the Usual Suspects (David,
Rob, ...) don't seem up to have another look at it (I've poked them on
irc). So I think it's as good as it gets ;-)

Note that I've dropped the final imx breaker patch since that's blocked on
imx getting sane. Once that's landed I'll ping you to pick up that
straggler.

* 'drm-docs' of ssh://people.freedesktop.org/~danvet/drm: (34 commits)
  drm/imx: remove drm_mode_connector_detach_encoder harder
  drm: kerneldoc polish for drm_crtc.c
  drm: kerneldoc polish for drm_crtc_helper.c
  drm: drop error code for drm_helper_resume_force_mode
  drm/crtc-helper: remove LOCKING from kerneldoc
  drm: remove return value from drm_helper_mode_fill_fb_struct
  drm/doc: Fix misplaced </para>
  drm: remove drm_display_mode->private_size
  drm: polish function kerneldoc for drm_modes.[hc]
  drm/modes: drop maxPitch from drm_mode_validate_size
  drm/modes: drop return value from drm_display_mode_from_videomode
  drm/modes: remove drm_mode_height/width
  drm: extract drm_modes.h for drm_crtc.h functions
  drm: move drm_mode related functions into drm_modes.c
  drm/doc: Repleace LOCKING kerneldoc sections in drm_modes.c
  drm/doc: Integrate drm_modes.c kerneldoc
  drm/kms: rip out drm_mode_connector_detach_encoder
  drm/doc: Add function reference documentation for drm_mm.c
  drm/doc: Overview documentation for drm_mm.c
  drm/mm: Remove MM_UNUSED_TARGET
  ...

- fine-grained display power domains for byt (Imre)
- runtime pm prep patches for !hsw from Paulo
- WiZ hashing flag updates from Ville
- ppgtt setup cleanup and enabling of full 4G range on bdw (Ben)
- fixes from Jesse for the inherited intial config code
- gpu reset code improvements from Mika
- per-pipe num_planes refactoring from Damien
- stability fixes around bdw forcewake handling and other bdw w/a from Mika
  Ken
- and as usual a pile of smaller fixes all over

* 'drm-intel-next' of git://git.freedesktop.org/git/drm-intel: (107 commits)
  drm/i915: Go OCD on the Makefile
  drm/i915: Implement command buffer parsing logic
  drm/i915: Refactor shmem pread setup
  drm/i915: Avoid div by zero when pixel clock is large
  drm/i915: power domains: add vlv power wells
  drm/i915: factor out intel_set_cpu_fifo_underrun_reporting_nolock
  drm/i915: vlv: factor out valleyview_display_irq_install
  drm/i915: sanity check power well sw state against hw state
  drm/i915: factor out reset_vblank_counter
  drm/i915: sanitize PUNIT register macro definitions
  drm/i915: vlv: keep first level vblank IRQs masked
  drm/i915: check pipe power domain when reading its hw state
  drm/i915: check port power domain when reading the encoder hw state
  drm/i915: get port power domain in connector detect handlers
  drm/i915: add port power domains
  drm/i915: add noop power well handlers instead of NULL checking them
  drm/i915: split power well 'set' handler to separate enable/disable/sync_hw
  drm/i915: add init power domain to always-on power wells
  drm/i915: move power domain macros to intel_pm.c
  drm/i915: Disable full ppgtt by default
  ...

Conflicts:
	drivers/gpu/drm/i915/Makefile

Makefile cleanup in drm-intel-next conflicts with a build-fix to move
intel_opregion under CONFIG_ACPI.
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

These are unused and can safely be dropped. DRM core verifies they're
non-NULL before it calls them.

Cc: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>

Improve readability by adding/changing inline documentation
Signed-off-by: Arthur Borsboom <arthurborsboom@gmail.com>
Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>

Code cleanup by following i915 constant/variable names and ordering
Code cleanup by following directions from kernel doc: Codingstyle
Code cleanup by following directions from kernel doc: DRM
Signed-off-by: Arthur Borsboom <arthurborsboom@gmail.com>
Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>

Removed centralized exiting of function (goto statement), since it was
the only used in one single location with only a return statement.
Signed-off-by: Arthur Borsboom <arthurborsboom@gmail.com>
Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>

Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>

Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>

Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>

Previously the backlight code was called from IRQ context which isn't
allowed. This patch moves all the asle work into a work task which takes
care of the locking bug reported by users.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=64221Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>

The gma500 driver sets DRIVER_GEM unconditionally, so testing for the
absence of the feature will always fail.
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>

We'll need this for our gem create ioctl in a later patch.
Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>

All of these ioctls are unused and most of them just duplicate what drm
already provides.
Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>

Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>

Properly init the MMU and add MMU entries when adding GTT entries
Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>

Right now, all we need to know about the blitter is that it's not doing
anything that can be messed up when fiddling with MMU mappings.
Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>

Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>

Add 2D blit status and MMU fault interrupts to the IRQ handler.
Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>

Old MMU code never wrote PDs or PTEs to any registers. Now we do, and
that's a good start.
Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>

This regression has been introduced in

commit b3f2333d
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Wed Dec 11 11:34:31 2013 +0100

    drm: restrict the device list for shadow attached drivers
Reported-by: Dave Jones <davej@redhat.com>
Cc: Dave Jones <davej@redhat.com>
Cc: Dave Airlie <airlied@redhat.com>
Cc: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: David Herrmann <dh.herrmann@gmail.com>

Since we cannot make sure the 'max_conn_count' will always be none
zero from the users, and then if max_conn_count equals to zero, the
kcalloc() will return ZERO_SIZE_PTR, which equals to ((void *)16).

So this patch fix this with just doing the 'max_conn_count' zero check
in the front of drm_fb_helper_init().
Signed-off-by: Xiubo Li <Li.Xiubo@freescale.com>
CC: Jani Nikula <jani.nikula@linux.intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

We allocate memory in drm_display_mode_from_vic_index() and use it
without checking the pointer is valid. Fix that.
Signed-off-by: Damien Lespiau <damien.lespiau@intel.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

Use drm_fb_helper_restore_fbdev_mode() in drm_fb_helper_set_par() to
make sure extra planes get disabled whenever fbcon takes over.

Otherwise the code in drm_fb_helper_set_par() was already doing the
exact same thing as drm_fb_helper_restore_fbdev_mode(), so this doesn't
change the behaviour in any other way.
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

This series contains several cleanups for the DRM-minor handling. All but the
last one reviewed by Daniel and tested by Thierry. Initially, the series
included patches to convert minor-handling to a common base-ID, but have
been NACKed by Daniel so I dropped them and only included the main part in the
last patch. With this in place, drm_global_mutex is no longer needed for
minor-handling (but still for device unregistration..).
There are some pending patches that try to remove the global mutex entirely, but
they need some more reviews and thus are not included.
* 'drm-minor' of git://people.freedesktop.org/~dvdhrm/linux:
  drm: make minors independent of global lock
  drm: inline drm_minor_get_id()
  drm: coding-style fixes in minor handling
  drm: remove redundant minor->device field
  drm: remove unneeded #ifdef CONFIG_DEBUGFS
  drm: rename drm_unplug/get_minor() to drm_minor_register/unregister()
  drm: move drm_put_minor() to drm_minor_free()
  drm: allocate minors early
  drm: add minor-lookup/release helpers
  drm: provide device-refcount
  drm: turn DRM_MINOR_* into enum
  drm: remove unused DRM_MINOR_UNASSIGNED
  drm: skip redundant minor-lookup in open path
  drm: group dev-lifetime related members

This branch includes 6 minor fixes mainly for udl. Everything non-trivial was
reviewed by Daniel and the patches have been on the list for quite some time.

* 'drm-fixes' of git://people.freedesktop.org/~dvdhrm/linux:
  drm/gem: dont init "ret" in drm_gem_mmap()
  drm/crtc: add sanity checks to create_dumb()
  drm/gem: free vma-node during object-cleanup
  drm/gem: fix indentation
  drm/udl: fix Bpp calculation in dumb_create()
  drm/udl: fix error-path when damage-req fails

Pull scheduler fixes from Ingo Molnar:
 "Three small fixes"

* 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  sched/clock: Prevent tracing recursion in sched_clock_cpu()
  stop_machine: Fix^2 race between stop_two_cpus() and stop_cpus()
  sched/deadline: Deny unprivileged users to set/change SCHED_DEADLINE policy

Pull perf fixes from Ingo Molnar:
 "Misc smaller fixes"

* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf/x86: Fix leak in uncore_type_init failure paths
  perf machine: Use map as success in ip__resolve_ams
  perf symbols: Fix crash in elf_section_by_name
  perf trace: Decode architecture-specific signal numbers

While testing and documenting the msgrcv() MSG_COPY flag that Stanislav
Kinsbursky added in commit 4a674f34 ("ipc: introduce message queue
copy feature" => kernel 3.8), I discovered a couple of bugs in the
implementation.  The two bugs concern MSG_COPY interactions with other
msgrcv() flags, namely:

 (A) MSG_COPY + MSG_EXCEPT
 (B) MSG_COPY + !IPC_NOWAIT

The bugs are distinct (and the fix for the first one is obvious),
however my fix for both is a single-line patch, which is why I'm
combining them in a single mail, rather than writing two mails+patches.

 ===== (A) MSG_COPY + MSG_EXCEPT =====

With the addition of the MSG_COPY flag, there are now two msgrcv()
flags--MSG_COPY and MSG_EXCEPT--that modify the meaning of the 'msgtyp'
argument in unrelated ways.  Specifying both in the same call is a
logical error that is currently permitted, with the effect that MSG_COPY
has priority and MSG_EXCEPT is ignored.  The call should give an error
if both flags are specified.  The patch below implements that behavior.

 ===== (B) (B) MSG_COPY + !IPC_NOWAIT =====

The test code that was submitted in commit 3a665531 ("selftests: IPC
message queue copy feature test") shows MSG_COPY being used in
conjunction with IPC_NOWAIT.  In other words, if there is no message at
the position 'msgtyp'.  return immediately with the error in ENOMSG.

What was not (fully) tested is the behavior if MSG_COPY is specified
*without* IPC_NOWAIT, and there is an odd behavior.  If the queue
contains less than 'msgtyp' messages, then the call blocks until the
next message is written to the queue.  At that point, the msgrcv() call
returns a copy of the newly added message, regardless of whether that
message is at the ordinal position 'msgtyp'.  This is clearly bogus, and
problematic for applications that might want to make use of the MSG_COPY
flag.

I considered the following possible solutions to this problem:

 (1) Force the call to block until a message *does* appear at the
     position 'msgtyp'.

 (2) If the MSG_COPY flag is specified, the kernel should implicitly add
     IPC_NOWAIT, so that the call fails with ENOMSG for this case.

 (3) If the MSG_COPY flag is specified, but IPC_NOWAIT is not, generate
     an error (probably, EINVAL is the right one).

I do not know if any application would really want to have the
functionality of solution (1), especially since an application can
determine in advance the number of messages in the queue using msgctl()
IPC_STAT.  Obviously, this solution would be the most work to implement.

Solution (2) would have the effect of silently fixing any applications
that tried to employ broken behavior.  However, it would mean that if we
later decided to implement solution (1), then user-space could not
easily detect what the kernel supports (but, since I'm somewhat doubtful
that solution (1) is needed, I'm not sure that this is much of a
problem).

Solution (3) would have the effect of informing broken applications that
they are doing something broken.  The downside is that this would cause
a ABI breakage for any applications that are currently employing the
broken behavior.  However:

a) Those applications are almost certainly not getting the results they
   expect.
b) Possibly, those applications don't even exist, because MSG_COPY is
   currently hidden behind CONFIG_CHECKPOINT_RESTORE.

The upside of solution (3) is that if we later decided to implement
solution (1), user-space could determine what the kernel supports, via
the error return.

In my view, solution (3) is mildly preferable to solution (2), and
solution (1) could still be done later if anyone really cares.  The
patch below implements solution (3).

PS.  For anyone out there still listening, it's the usual story:
documenting an API (and the thinking about, and the testing of the API,
that documentation entails) is the one of the single best ways of
finding bugs in the API, as I've learned from a lot of experience.  Best
to do that documentation before releasing the API.
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
Acked-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
Cc: Stanislav Kinsbursky <skinsbursky@parallels.com>
Cc: stable@vger.kernel.org
Cc: Serge Hallyn <serge.hallyn@canonical.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Pavel Emelyanov <xemul@parallels.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fix minor conflicts with drm-anon:
 - allocation/free order
 - drm_device header cleanups

We used to protect minor-lookup and setup by the global drm lock. To
continue our attempts of dropping drm_global_mutex, this patch makes the
minor management independent of it. Furthermore, we make it all atomic and
switch to spin-locks instead of a mutex.

Now that minor-lookup is independent, we also move the
"drm_is_unplugged()" test into the minor-lookup path. There is no reason
to ever return a minor for unplugged objects, so keep that logic internal.
Signed-off-by: David Herrmann <dh.herrmann@gmail.com>