Merge remote branch 'intel/drm-intel-fixes' of ../drm-next into drm-core-next

* 'intel/drm-intel-fixes' of ../drm-next:
  Revert "drm/i915: Don't save/restore hardware status page address register"
  drm/i915: Avoid unmapping pages from a NULL address space
  drm/i915: Fix use after free within tracepoint
  drm/i915: Restore missing command flush before interrupt on BLT ring
  drm/i915: Disable pagefaults along execbuffer relocation fast path
  drm/i915: Fix computation of pitch for dumb bo creator
  drm/i915: report correct render clock frequencies on SNB
  drm/i915/dp: Correct the order of deletion for ghost eDP devices
  drm/i915: Fix tiling corruption from pipelined fencing
  drm/i915: Re-enable self-refresh
  drm/i915: Prevent racy removal of request from client list
  drm/i915: skip redundant operations whilst enabling pipes and planes
  drm/i915: Remove surplus POSTING_READs before wait_for_vblank

1 files changed, 17 insertions, 4 deletions

diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 7ff7f933ddf1..20a4cc5b818f 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -367,6 +367,10 @@ i915_gem_execbuffer_relocate_entry(struct drm_i915_gem_object *obj,
                 uint32_t __iomem *reloc_entry;
                 void __iomem *reloc_page;
 
+                /* We can't wait for rendering with pagefaults disabled */
+                if (obj->active && in_atomic())
+                        return -EFAULT;
+
                 ret = i915_gem_object_set_to_gtt_domain(obj, 1);
                 if (ret)
                         return ret;
@@ -440,15 +444,24 @@ i915_gem_execbuffer_relocate(struct drm_device *dev,
                              struct list_head *objects)
 {
         struct drm_i915_gem_object *obj;
-        int ret;
-
+        int ret = 0;
+
+        /* This is the fast path and we cannot handle a pagefault whilst
+         * holding the struct mutex lest the user pass in the relocations
+         * contained within a mmaped bo. For in such a case we, the page
+         * fault handler would call i915_gem_fault() and we would try to
+         * acquire the struct mutex again. Obviously this is bad and so
+         * lockdep complains vehemently.
+         */
+        pagefault_disable();
         list_for_each_entry(obj, objects, exec_list) {
                 ret = i915_gem_execbuffer_relocate_object(obj, eb);
                 if (ret)
-                        return ret;
+                        break;
         }
+        pagefault_enable();
 
-        return 0;
+        return ret;
 }
 
 static int