--- /dev/null
+From 9d746ab68163d642dae13756b2b3145b2e38cb65 Mon Sep 17 00:00:00 2001
+From: Mario Kleiner <mario.kleiner.de@gmail.com>
+Date: Tue, 24 May 2016 18:12:43 +0200
+Subject: drm/amdgpu: Fix hdmi deep color support.
+
+From: Mario Kleiner <mario.kleiner.de@gmail.com>
+
+commit 9d746ab68163d642dae13756b2b3145b2e38cb65 upstream.
+
+When porting the hdmi deep color detection code from
+radeon-kms to amdgpu-kms apparently some kind of
+copy and paste error happened, attaching an else
+branch to the wrong if statement.
+
+The result is that hdmi deep color mode is always
+disabled, regardless of gpu and display capabilities and
+user wishes, as the code mistakenly thinks that the display
+doesn't provide the required max_tmds_clock limit and falls
+back to 8 bpc.
+
+This patch fixes deep color support, as tested on a
+R9 380 Tonga Pro + suitable display, and should be
+backported to all kernels with amdgpu-kms support.
+
+Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+@@ -194,12 +194,12 @@ int amdgpu_connector_get_monitor_bpc(str
+ bpc = 8;
+ DRM_DEBUG("%s: HDMI deep color 10 bpc exceeds max tmds clock. Using %d bpc.\n",
+ connector->name, bpc);
+- } else if (bpc > 8) {
+- /* max_tmds_clock missing, but hdmi spec mandates it for deep color. */
+- DRM_DEBUG("%s: Required max tmds clock for HDMI deep color missing. Using 8 bpc.\n",
+- connector->name);
+- bpc = 8;
+ }
++ } else if (bpc > 8) {
++ /* max_tmds_clock missing, but hdmi spec mandates it for deep color. */
++ DRM_DEBUG("%s: Required max tmds clock for HDMI deep color missing. Using 8 bpc.\n",
++ connector->name);
++ bpc = 8;
+ }
+ }
+
--- /dev/null
+From 6b8812eb004ee2b24aac8b1a711a0e8e797df3ce Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 2 May 2016 10:24:41 -0400
+Subject: drm/amdgpu: use drm_mode_vrefresh() rather than mode->vrefresh
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 6b8812eb004ee2b24aac8b1a711a0e8e797df3ce upstream.
+
+This is a port of radeon commit:
+3d2d98ee1af0cf6eebfbd6bff4c17d3601ac1284
+drm/radeon: use drm_mode_vrefresh() rather than mode->vrefresh
+to amdgpu.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c
+@@ -150,7 +150,7 @@ u32 amdgpu_dpm_get_vrefresh(struct amdgp
+ list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+ amdgpu_crtc = to_amdgpu_crtc(crtc);
+ if (crtc->enabled && amdgpu_crtc->enabled && amdgpu_crtc->hw_mode.clock) {
+- vrefresh = amdgpu_crtc->hw_mode.vrefresh;
++ vrefresh = drm_mode_vrefresh(&amdgpu_crtc->hw_mode);
+ break;
+ }
+ }
--- /dev/null
+From cpaul@redhat.com Sat Jun 4 13:44:11 2016
+From: Lyude <cpaul@redhat.com>
+Date: Tue, 31 May 2016 12:49:07 -0400
+Subject: drm/atomic: Verify connector->funcs != NULL when clearing states
+To: stable@vger.kernel.org, Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Lyude <cpaul@redhat.com>, David Airlie <airlied@linux.ie>, dri-devel@lists.freedesktop.org (open list:DRM DRIVERS), linux-kernel@vger.kernel.org (open list)
+Message-ID: <1464713347-28982-5-git-send-email-cpaul@redhat.com>
+
+From: Lyude <cpaul@redhat.com>
+
+Unfortunately since we don't have Dave's connector refcounting patch
+here yet, it's very possible that drm_atomic_state_default_clear() could
+get called by intel_display_resume() when
+intel_dp_mst_destroy_connector() isn't completely finished destroying an
+mst connector, but has already finished setting connector->funcs to
+NULL. As such, we need to treat the connector like it's already been
+destroyed and just skip it, otherwise we'll end up dereferencing a NULL
+pointer.
+
+This fix is only required for 4.6 and below. David Airlie's patchseries
+for 4.7 to add connector reference counting provides a more proper fix
+for this.
+
+Changes since v1:
+ - Fix leftover whitespace
+
+Upstream fix: 0552f7651bc2 ("drm/i915/mst: use reference counted
+connectors. (v3)")
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Lyude <cpaul@redhat.com>
+---
+ drivers/gpu/drm/drm_atomic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_atomic.c
++++ b/drivers/gpu/drm/drm_atomic.c
+@@ -150,7 +150,7 @@ void drm_atomic_state_default_clear(stru
+ for (i = 0; i < state->num_connector; i++) {
+ struct drm_connector *connector = state->connectors[i];
+
+- if (!connector)
++ if (!connector || !connector->funcs)
+ continue;
+
+ /*
--- /dev/null
+From 255f0e7c418ad95a4baeda017ae6182ba9b3c423 Mon Sep 17 00:00:00 2001
+From: Lyude <cpaul@redhat.com>
+Date: Thu, 12 May 2016 10:56:59 -0400
+Subject: drm/fb_helper: Fix references to dev->mode_config.num_connector
+
+From: Lyude <cpaul@redhat.com>
+
+commit 255f0e7c418ad95a4baeda017ae6182ba9b3c423 upstream.
+
+During boot, MST hotplugs are generally expected (even if no physical
+hotplugging occurs) and result in DRM's connector topology changing.
+This means that using num_connector from the current mode configuration
+can lead to the number of connectors changing under us. This can lead to
+some nasty scenarios in fbcon:
+
+- We allocate an array to the size of dev->mode_config.num_connectors.
+- MST hotplug occurs, dev->mode_config.num_connectors gets incremented.
+- We try to loop through each element in the array using the new value
+ of dev->mode_config.num_connectors, and end up going out of bounds
+ since dev->mode_config.num_connectors is now larger then the array we
+ allocated.
+
+fb_helper->connector_count however, will always remain consistent while
+we do a modeset in fb_helper.
+
+Note: This is just polish for 4.7, Dave Airlie's drm_connector
+refcounting fixed these bugs for real. But it's good enough duct-tape
+for stable kernel backporting, since backporting the refcounting
+changes is way too invasive.
+
+Signed-off-by: Lyude <cpaul@redhat.com>
+[danvet: Clarify why we need this. Also remove the now unused "dev"
+local variable to appease gcc.]
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/1463065021-18280-3-git-send-email-cpaul@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_fb_helper.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -1899,7 +1899,6 @@ static int drm_pick_crtcs(struct drm_fb_
+ int n, int width, int height)
+ {
+ int c, o;
+- struct drm_device *dev = fb_helper->dev;
+ struct drm_connector *connector;
+ const struct drm_connector_helper_funcs *connector_funcs;
+ struct drm_encoder *encoder;
+@@ -1918,7 +1917,7 @@ static int drm_pick_crtcs(struct drm_fb_
+ if (modes[n] == NULL)
+ return best_score;
+
+- crtcs = kzalloc(dev->mode_config.num_connector *
++ crtcs = kzalloc(fb_helper->connector_count *
+ sizeof(struct drm_fb_helper_crtc *), GFP_KERNEL);
+ if (!crtcs)
+ return best_score;
+@@ -1964,7 +1963,7 @@ static int drm_pick_crtcs(struct drm_fb_
+ if (score > best_score) {
+ best_score = score;
+ memcpy(best_crtcs, crtcs,
+- dev->mode_config.num_connector *
++ fb_helper->connector_count *
+ sizeof(struct drm_fb_helper_crtc *));
+ }
+ }
--- /dev/null
+From 7ccca1d5bf69fdd1d3c5fcf84faf1659a6e0ad11 Mon Sep 17 00:00:00 2001
+From: Itai Handler <itai_handler@hotmail.com>
+Date: Tue, 3 Nov 2015 00:20:56 +0200
+Subject: drm/gma500: Fix possible out of bounds read
+
+From: Itai Handler <itai_handler@hotmail.com>
+
+commit 7ccca1d5bf69fdd1d3c5fcf84faf1659a6e0ad11 upstream.
+
+Fix possible out of bounds read, by adding missing comma.
+The code may read pass the end of the dsi_errors array
+when the most significant bit (bit #31) in the intr_stat register
+is set.
+This bug has been detected using CppCheck (static analysis tool).
+
+Signed-off-by: Itai Handler <itai_handler@hotmail.com>
+Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c
++++ b/drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c
+@@ -72,7 +72,7 @@ static const char *const dsi_errors[] =
+ "RX Prot Violation",
+ "HS Generic Write FIFO Full",
+ "LP Generic Write FIFO Full",
+- "Generic Read Data Avail"
++ "Generic Read Data Avail",
+ "Special Packet Sent",
+ "Tearing Effect",
+ };
--- /dev/null
+From 14a3842a1d5945067d1dd0788f314e14d5b18e5b Mon Sep 17 00:00:00 2001
+From: Lyude <cpaul@redhat.com>
+Date: Thu, 12 May 2016 10:56:58 -0400
+Subject: drm/i915/fbdev: Fix num_connector references in intel_fb_initial_config()
+
+From: Lyude <cpaul@redhat.com>
+
+commit 14a3842a1d5945067d1dd0788f314e14d5b18e5b upstream.
+
+During boot time, MST devices usually send a ton of hotplug events
+irregardless of whether or not any physical hotplugs actually occurred.
+Hotplugs mean connectors being created/destroyed, and the number of DRM
+connectors changing under us. This isn't a problem if we use
+fb_helper->connector_count since we only set it once in the code,
+however if we use num_connector from struct drm_mode_config we risk it's
+value changing under us. On top of that, there's even a chance that
+dev->mode_config.num_connector != fb_helper->connector_count. If the
+number of connectors happens to increase under us, we'll end up using
+the wrong array size for memcpy and start writing beyond the actual
+length of the array, occasionally resulting in kernel panics.
+
+Note: This is just polish for 4.7, Dave Airlie's drm_connector
+refcounting fixed these bugs for real. But it's good enough duct-tape
+for stable kernel backporting, since backporting the refcounting
+changes is way too invasive.
+
+Signed-off-by: Lyude <cpaul@redhat.com>
+[danvet: Clarify why we need this.]
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/1463065021-18280-2-git-send-email-cpaul@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_fbdev.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_fbdev.c
++++ b/drivers/gpu/drm/i915/intel_fbdev.c
+@@ -362,12 +362,12 @@ static bool intel_fb_initial_config(stru
+ uint64_t conn_configured = 0, mask;
+ int pass = 0;
+
+- save_enabled = kcalloc(dev->mode_config.num_connector, sizeof(bool),
++ save_enabled = kcalloc(fb_helper->connector_count, sizeof(bool),
+ GFP_KERNEL);
+ if (!save_enabled)
+ return false;
+
+- memcpy(save_enabled, enabled, dev->mode_config.num_connector);
++ memcpy(save_enabled, enabled, fb_helper->connector_count);
+ mask = (1 << fb_helper->connector_count) - 1;
+ retry:
+ for (i = 0; i < fb_helper->connector_count; i++) {
+@@ -501,7 +501,7 @@ retry:
+ if (fallback) {
+ bail:
+ DRM_DEBUG_KMS("Not using firmware configuration\n");
+- memcpy(enabled, save_enabled, dev->mode_config.num_connector);
++ memcpy(enabled, save_enabled, fb_helper->connector_count);
+ kfree(save_enabled);
+ return false;
+ }
--- /dev/null
+From 1883598d4201361a6d2ce785095695f58071ee11 Mon Sep 17 00:00:00 2001
+From: Charmaine Lee <charmainel@vmware.com>
+Date: Tue, 12 Apr 2016 08:14:23 -0700
+Subject: drm/vmwgfx: Enable SVGA_3D_CMD_DX_SET_PREDICATION
+
+From: Charmaine Lee <charmainel@vmware.com>
+
+commit 1883598d4201361a6d2ce785095695f58071ee11 upstream.
+
+Fixes piglit tests nv_conditional_render-* crashes.
+
+Signed-off-by: Charmaine Lee <charmainel@vmware.com>
+Reviewed-by: Brian Paul <brianp@vmware.com>
+Reviewed-by: Sinclair Yeh <syeh@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -3285,7 +3285,7 @@ static const struct vmw_cmd_entry vmw_cm
+ true, false, true),
+ VMW_CMD_DEF(SVGA_3D_CMD_DX_READBACK_QUERY, &vmw_cmd_invalid,
+ true, false, true),
+- VMW_CMD_DEF(SVGA_3D_CMD_DX_SET_PREDICATION, &vmw_cmd_invalid,
++ VMW_CMD_DEF(SVGA_3D_CMD_DX_SET_PREDICATION, &vmw_cmd_dx_cid_check,
+ true, false, true),
+ VMW_CMD_DEF(SVGA_3D_CMD_DX_SET_VIEWPORTS, &vmw_cmd_dx_cid_check,
+ true, false, true),
--- /dev/null
+From 7851496a32319237456919575e5f4ba62f74cc7d Mon Sep 17 00:00:00 2001
+From: Sinclair Yeh <syeh@vmware.com>
+Date: Thu, 21 Apr 2016 11:29:31 -0700
+Subject: drm/vmwgfx: Fix order of operation
+
+From: Sinclair Yeh <syeh@vmware.com>
+
+commit 7851496a32319237456919575e5f4ba62f74cc7d upstream.
+
+mode->hdisplay * (var->bits_per_pixel + 7) gets evaluated before
+the division, potentially making the pitch larger than it should
+be.
+
+Since the original intention is to do a div-round-up, just use
+the macro instead.
+
+Signed-off-by: Sinclair Yeh <syeh@vmware.com>
+Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+@@ -573,9 +573,9 @@ static int vmw_fb_set_par(struct fb_info
+ mode = old_mode;
+ old_mode = NULL;
+ } else if (!vmw_kms_validate_mode_vram(vmw_priv,
+- mode->hdisplay *
+- (var->bits_per_pixel + 7) / 8,
+- mode->vdisplay)) {
++ mode->hdisplay *
++ DIV_ROUND_UP(var->bits_per_pixel, 8),
++ mode->vdisplay)) {
+ drm_mode_destroy(vmw_priv->dev, mode);
+ return -EINVAL;
+ }
--- /dev/null
+From e02e58843153ce80a9fe7588def89b2638d40e64 Mon Sep 17 00:00:00 2001
+From: Charmaine Lee <charmainel@vmware.com>
+Date: Tue, 12 Apr 2016 08:19:08 -0700
+Subject: drm/vmwgfx: use vmw_cmd_dx_cid_check for query commands.
+
+From: Charmaine Lee <charmainel@vmware.com>
+
+commit e02e58843153ce80a9fe7588def89b2638d40e64 upstream.
+
+Instead of calling vmw_cmd_ok, call vmw_cmd_dx_cid_check to
+validate the context id for query commands.
+
+Signed-off-by: Charmaine Lee <charmainel@vmware.com>
+Reviewed-by: Sinclair Yeh <syeh@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -3273,15 +3273,15 @@ static const struct vmw_cmd_entry vmw_cm
+ &vmw_cmd_dx_cid_check, true, false, true),
+ VMW_CMD_DEF(SVGA_3D_CMD_DX_DEFINE_QUERY, &vmw_cmd_dx_define_query,
+ true, false, true),
+- VMW_CMD_DEF(SVGA_3D_CMD_DX_DESTROY_QUERY, &vmw_cmd_ok,
++ VMW_CMD_DEF(SVGA_3D_CMD_DX_DESTROY_QUERY, &vmw_cmd_dx_cid_check,
+ true, false, true),
+ VMW_CMD_DEF(SVGA_3D_CMD_DX_BIND_QUERY, &vmw_cmd_dx_bind_query,
+ true, false, true),
+ VMW_CMD_DEF(SVGA_3D_CMD_DX_SET_QUERY_OFFSET,
+- &vmw_cmd_ok, true, false, true),
+- VMW_CMD_DEF(SVGA_3D_CMD_DX_BEGIN_QUERY, &vmw_cmd_ok,
++ &vmw_cmd_dx_cid_check, true, false, true),
++ VMW_CMD_DEF(SVGA_3D_CMD_DX_BEGIN_QUERY, &vmw_cmd_dx_cid_check,
+ true, false, true),
+- VMW_CMD_DEF(SVGA_3D_CMD_DX_END_QUERY, &vmw_cmd_ok,
++ VMW_CMD_DEF(SVGA_3D_CMD_DX_END_QUERY, &vmw_cmd_dx_cid_check,
+ true, false, true),
+ VMW_CMD_DEF(SVGA_3D_CMD_DX_READBACK_QUERY, &vmw_cmd_invalid,
+ true, false, true),
xen-events-don-t-move-disabled-irqs.patch
xen-use-same-main-loop-for-counting-and-remapping-pages.patch
sunrpc-fix-stripping-of-padded-mic-tokens.patch
+drm-gma500-fix-possible-out-of-bounds-read.patch
+drm-vmwgfx-enable-svga_3d_cmd_dx_set_predication.patch
+drm-vmwgfx-use-vmw_cmd_dx_cid_check-for-query-commands.patch
+drm-vmwgfx-fix-order-of-operation.patch
+drm-amdgpu-use-drm_mode_vrefresh-rather-than-mode-vrefresh.patch
+drm-amdgpu-fix-hdmi-deep-color-support.patch
+drm-i915-fbdev-fix-num_connector-references-in-intel_fb_initial_config.patch
+drm-fb_helper-fix-references-to-dev-mode_config.num_connector.patch
+drm-atomic-verify-connector-funcs-null-when-clearing-states.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
