linux.git/drivers/gpu, branch v5.7.15

drm/drm_fb_helper: fix fbdev with sparc64

2020-08-11T13:35:36+00:00

[ Upstream commit 2a1658bf922ffd9b7907e270a7d9cdc9643fc45d ]

Recent kernels have been reported to panic using the bochs_drm
framebuffer under qemu-system-sparc64 which was bisected to
commit 7a0483ac4ffc ("drm/bochs: switch to generic drm fbdev emulation").

The backtrace indicates that the shadow framebuffer copy in
drm_fb_helper_dirty_blit_real() is trying to access the real
framebuffer using a virtual address rather than use an IO access
typically implemented using a physical (ASI_PHYS) access on SPARC.

The fix is to replace the memcpy with memcpy_toio() from io.h.

memcpy_toio() uses writeb() where the original fbdev code
used sbus_memcpy_toio(). The latter uses sbus_writeb().

The difference between writeb() and sbus_memcpy_toio() is
that writeb() writes bytes in little-endian, where sbus_writeb() writes
bytes in big-endian. As endian does not matter for byte writes they are
the same. So we can safely use memcpy_toio() here.

Note that this only fixes bochs, in general fbdev helpers still have
issues with mixing up system memory and __iomem space. Fixing that will
require a lot more work.

v3:
  - Improved changelog (Daniel)
  - Added FIXME to fbdev_use_iomem (Daniel)

v2:
  - Added missing __iomem cast (kernel test robot)
  - Made changelog readable and fix typos (Mark)
  - Add flag to select iomem - and set it in the bochs driver

Signed-off-by: Sam Ravnborg 
Reported-by: Mark Cave-Ayland 
Reported-by: kernel test robot 
Tested-by: Mark Cave-Ayland 
Reviewed-by: Daniel Vetter 
Cc: Mark Cave-Ayland 
Cc: Thomas Zimmermann 
Cc: Gerd Hoffmann 
Cc: "David S. Miller" 
Cc: sparclinux@vger.kernel.org
Link: https://patchwork.freedesktop.org/patch/msgid/20200709193016.291267-1-sam@ravnborg.org
Link: https://patchwork.freedesktop.org/patch/msgid/20200725191012.GA434957@ravnborg.org
Signed-off-by: Sasha Levin

drm/panel: Fix auo, kd101n80-45na horizontal noise on edges of panel

2020-08-11T13:35:36+00:00

[ Upstream commit d76acc9fcddeda53b985b029c890976a87fcc3fc ]

Fine tune the HBP and HFP to avoid the dot noise on the left and right edges.

Signed-off-by: Jitao Shi 
Signed-off-by: Sam Ravnborg 
Link: https://patchwork.freedesktop.org/patch/msgid/20200714123332.37609-1-jitao.shi@mediatek.com
Signed-off-by: Sasha Levin

drm/bridge/adv7511: set the bridge type properly

2020-08-11T13:35:36+00:00

[ Upstream commit f10761c9df96a882438faa09dcd25261281d69ca ]

After the drm_bridge_connector_init() helper function has been added,
the ADV driver has been changed accordingly. However, the 'type'
field of the bridge structure was left unset, which makes the helper
function always return -EINVAL.

Signed-off-by: Laurentiu Palcu 
Reviewed-by: Laurent Pinchart 
Reviewed-by: Vinod Koul 
Tested-by: Vinod Koul  # tested on DragonBoard 410c
Signed-off-by: Sam Ravnborg 
Link: https://patchwork.freedesktop.org/patch/msgid/20200720124228.12552-1-laurentiu.palcu@oss.nxp.com
Signed-off-by: Sasha Levin

drm/nouveau/fbcon: zero-initialise the mode_cmd2 structure

2020-08-11T13:35:35+00:00

[ Upstream commit 15fbc3b938534cc8eaac584a7b0c1183fc968b86 ]

This is tripping up the format modifier patches.

Signed-off-by: Ben Skeggs 
Signed-off-by: Sasha Levin

drm/nouveau/fbcon: fix module unload when fbcon init has failed for some reason

2020-08-11T13:35:35+00:00

[ Upstream commit 498595abf5bd51f0ae074cec565d888778ea558f ]

Stale pointer was tripping up the unload path.

Signed-off-by: Ben Skeggs 
Signed-off-by: Sasha Levin

drm/nouveau/kms/tu102: wait for core update to complete when assigning windows

2020-08-11T13:35:35+00:00

[ Upstream commit 705d9d022949e3cdae82d89db6a8fc773eb23dad ]

Fixes a race on Turing between the core cross-channel error checks and
the following window update.

Signed-off-by: Ben Skeggs 
Signed-off-by: Sasha Levin

drm: of: Fix double-free bug

2020-08-05T07:58:38+00:00

commit 4ee48cc5586bf519df19894273002aa8ef7b70ad upstream.

Fix double-free bug in the error path.

Fixes: 6529007522de ("drm: of: Add drm_of_lvds_get_dual_link_pixel_order")
Reported-by: Pavel Machek 
Signed-off-by: Biju Das 
Reviewed-by: Laurent Pinchart 
Cc: stable@vger.kernel.org
Signed-off-by: Sam Ravnborg 
Link: https://patchwork.freedesktop.org/patch/msgid/1595502654-40595-1-git-send-email-biju.das.jz@bp.renesas.com
Signed-off-by: Greg Kroah-Hartman

drm: hold gem reference until object is no longer accessed

2020-08-05T07:58:38+00:00

commit 8490d6a7e0a0a6fab5c2d82d57a3937306660864 upstream.

A use-after-free in drm_gem_open_ioctl can happen if the
GEM object handle is closed between the idr lookup and
retrieving the size from said object since a local reference
is not being held at that point. Hold the local reference
while the object can still be accessed to fix this and
plug the potential security hole.

Signed-off-by: Steve Cohen 
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/1595284250-31580-1-git-send-email-cohens@codeaurora.org
Signed-off-by: Greg Kroah-Hartman

drm/mcde: Fix stability issue

2020-08-05T07:58:38+00:00

commit aa7bf898d4bf921f61fab078040e8baec3f28126 upstream.

Whenever a display update was sent, apart from updating
the memory base address, we called mcde_display_send_one_frame()
which also sent a command to the display requesting the TE IRQ
and enabling the FIFO.

When continuous updates are running this is wrong: we need
to only send this to start the flow to the display on
the very first update. This lead to the display pipeline
locking up and crashing.

Check if the flow is already running and in that case
do not call mcde_display_send_one_frame().

This fixes crashes on the Samsung GT-S7710 (Skomer).

Signed-off-by: Linus Walleij 
Acked-by: Sam Ravnborg 
Acked-by: Stephan Gerhold 
Cc: Stephan Gerhold 
Cc: stable@vger.kernel.org
Link: https://patchwork.freedesktop.org/patch/msgid/20200718233323.3407670-1-linus.walleij@linaro.org
Signed-off-by: Greg Kroah-Hartman

drm/dbi: Fix SPI Type 1 (9-bit) transfer

2020-08-05T07:58:38+00:00

commit 900ab59e2621053b009f707f80b2c19ce0af5dee upstream.

The function mipi_dbi_spi1_transfer() will transfer its payload as 9-bit
data, the 9th (MSB) bit being the data/command bit. In order to do that,
it unpacks the 8-bit values into 16-bit values, then sets the 9th bit if
the byte corresponds to data, clears it otherwise. The 7 MSB are
padding. The array of now 16-bit values is then passed to the SPI core
for transfer.

This function was broken since its introduction, as the length of the
SPI transfer was set to the payload size before its conversion, but the
payload doubled in size due to the 8-bit -> 16-bit conversion.

Fixes: 02dd95fe3169 ("drm/tinydrm: Add MIPI DBI support")
Cc:  # 5.4+
Signed-off-by: Paul Cercueil 
Reviewed-by: Sam Ravnborg 
Reviewed-by: Noralf Trønnes 
Signed-off-by: Sam Ravnborg 
Link: https://patchwork.freedesktop.org/patch/msgid/20200703141341.1266263-1-paul@crapouillou.net
Signed-off-by: Greg Kroah-Hartman