linux.git/drivers/gpu, branch v3.18.81

drm: drm_minor_register(): Clean up debugfs on failure

2017-11-15T09:04:11+00:00

[ Upstream commit a67834f8bfa1e2f48bb27d07b9a552ba7c3af82a ]

Call drm_debugfs_cleanup() in case drm_debugfs_init() fails to
cover for failure in the drm_driver.debugfs_init callback.

Signed-off-by: Noralf Trønnes 
Signed-off-by: Daniel Vetter 
Link: http://patchwork.freedesktop.org/patch/msgid/20170126225621.12314-3-noralf@tronnes.org
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

drm/msm: fix an integer overflow test

2017-11-08T09:03:49+00:00

commit 65e93108891e571f177c202add9288eda9ac4100 upstream.

We recently added an integer overflow check but it needs an additional
tweak to work properly on 32 bit systems.

The problem is that we're doing the right hand side of the assignment as
type unsigned long so the max it will have an integer overflow instead
of being larger than SIZE_MAX.  That means the "sz > SIZE_MAX" condition
is never true even on 32 bit systems.  We need to first cast it to u64
and then do the math.

Fixes: 4a630fadbb29 ("drm/msm: Fix potential buffer overflow issue")
Signed-off-by: Dan Carpenter 
Acked-by: Jordan Crouse 
Signed-off-by: Rob Clark 
Cc: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

drm/msm: Fix potential buffer overflow issue

2017-11-08T09:03:49+00:00

commit 4a630fadbb29d9efaedb525f1a8f7449ad107641 upstream.

In function submit_create, if nr_cmds or nr_bos is assigned with
negative value, the allocated buffer may be small than intended.
Using this buffer will lead to buffer overflow issue.

Signed-off-by: Kasin Li 
Signed-off-by: Jordan Crouse 
Signed-off-by: Rob Clark 
Cc: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

drm/dp/mst: save vcpi with payloads

2017-10-21T15:07:24+00:00

commit 6cecdf7a161d2b909dc7c8979176bbc4f0669968 upstream.

This makes it possibly for drivers to find the associated
mst_port by looking at the payload allocation table.

Signed-off-by: Harry Wentland 
Reviewed-by: Alex Deucher 
Link: http://patchwork.freedesktop.org/patch/msgid/1449514552-10236-3-git-send-email-harry.wentland@amd.com
Signed-off-by: Daniel Vetter 
Cc: Kai Heng Feng 
Signed-off-by: Greg Kroah-Hartman

drm/i915/bios: ignore HDMI on port A

2017-10-12T07:18:03+00:00

commit 2ba7d7e0437127314864238f8bfcb8369d81075c upstream.

The hardware state readout oopses after several warnings when trying to
use HDMI on port A, if such a combination is configured in VBT. Filter
the combo out already at the VBT parsing phase.

v2: also ignore DVI (Ville)

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=102889
Cc: Imre Deak 
Reviewed-by: Ville Syrjälä 
Tested-by: Daniel Drake 
Signed-off-by: Jani Nikula 
Link: https://patchwork.freedesktop.org/patch/msgid/20170921141920.18172-1-jani.nikula@intel.com
(cherry picked from commit d27ffc1d00327c29b3aa97f941b42f0949f9e99f)
Signed-off-by: Rodrigo Vivi 
Signed-off-by: Greg Kroah-Hartman

drm/ttm: Fix accounting error when fail to get pages for pool

2017-09-07T06:32:20+00:00

commit 9afae2719273fa1d406829bf3498f82dbdba71c7 upstream.

When fail to get needed page for pool, need to put allocated pages
into pool. But current code has a miscalculation of allocated pages,
correct it.

Signed-off-by: Xiangliang.Yu 
Reviewed-by: Christian König 
Reviewed-by: Monk Liu 
Signed-off-by: Alex Deucher 
Signed-off-by: Greg Kroah-Hartman

drm: Release driver tracking before making the object available again

2017-08-30T08:16:55+00:00

commit fe4600a548f2763dec91b3b27a1245c370ceee2a upstream.

This is the same bug as we fixed in commit f6cd7daecff5 ("drm: Release
driver references to handle before making it available again"), but now
the exposure is via the PRIME lookup tables. If we remove the
object/handle from the PRIME lut, then a new request for the same
object/fd will generate a new handle, thus for a short window that
object is known to userspace by two different handles. Fix this by
releasing the driver tracking before PRIME.

Fixes: 0ff926c7d4f0 ("drm/prime: add exported buffers to current fprivs
imported buffer list (v2)")
Signed-off-by: Chris Wilson 
Cc: David Airlie 
Cc: Daniel Vetter 
Cc: Rob Clark 
Cc: Ville Syrjälä 
Cc: Thierry Reding 
Reviewed-by: Daniel Vetter 
Signed-off-by: Joonas Lahtinen 
Link: https://patchwork.freedesktop.org/patch/msgid/20170819120558.6465-1-chris@chris-wilson.co.uk
Signed-off-by: Greg Kroah-Hartman

drm/msm: Verify that MSM_SUBMIT_BO_FLAGS are set

2017-08-11T16:30:12+00:00

[ Upstream commit a6cb3b864b21b7345f824a4faa12b723c8aaf099 ]

For every submission buffer object one of MSM_SUBMIT_BO_WRITE
and MSM_SUBMIT_BO_READ must be set (and nothing else). If we
allowed zero then the buffer object would never get queued to
be unreferenced.

Signed-off-by: Jordan Crouse 
Signed-off-by: Rob Clark 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

drm/msm: Ensure that the hardware write pointer is valid

2017-08-11T16:30:12+00:00

[ Upstream commit 88b333b0ed790f9433ff542b163bf972953b74d3 ]

Currently the value written to CP_RB_WPTR is calculated on the fly as
(rb->next - rb->start). But as the code is designed rb->next is wrapped
before writing the commands so if a series of commands happened to
fit perfectly in the ringbuffer, rb->next would end up being equal to
rb->size / 4 and thus result in an out of bounds address to CP_RB_WPTR.

The easiest way to fix this is to mask WPTR when writing it to the
hardware; it makes the hardware happy and the rest of the ringbuffer
math appears to work and there isn't any point in upsetting anything.

Signed-off-by: Jordan Crouse 
[squash in is_power_of_2() check]
Signed-off-by: Rob Clark 

Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

drm/vmwgfx: Fix gcc-7.1.1 warning

2017-08-11T16:30:08+00:00

commit fcfffdd8f98ac305285dca568b5065ef86be6458 upstream.

The current code does not look correct, and the reason for it is
probably lost.  Since this now generates a compiler warning,
fix it to what makes sense.

Reported-by: Arnd Bergmann 
Reported-by: Linus Torvalds 
Signed-off-by: Sinclair Yeh 
Reviewed-by: Brian Paul 
Signed-off-by: Greg Kroah-Hartman