From: Greg Kroah-Hartman Date: Sat, 4 Jun 2016 20:54:48 +0000 (-0700) Subject: 4.4-stable patches X-Git-Tag: v3.14.72~10 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0a41819ac9d9b58b0ad6f276fcfb750cd16e40f1;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: drm-amdgpu-fix-hdmi-deep-color-support.patch drm-amdgpu-use-drm_mode_vrefresh-rather-than-mode-vrefresh.patch drm-atomic-verify-connector-funcs-null-when-clearing-states.patch drm-fb_helper-fix-references-to-dev-mode_config.num_connector.patch drm-gma500-fix-possible-out-of-bounds-read.patch drm-i915-fbdev-fix-num_connector-references-in-intel_fb_initial_config.patch drm-vmwgfx-enable-svga_3d_cmd_dx_set_predication.patch drm-vmwgfx-fix-order-of-operation.patch drm-vmwgfx-use-vmw_cmd_dx_cid_check-for-query-commands.patch --- diff --git a/queue-4.4/drm-amdgpu-fix-hdmi-deep-color-support.patch b/queue-4.4/drm-amdgpu-fix-hdmi-deep-color-support.patch new file mode 100644 index 00000000000..b4342e930d4 --- /dev/null +++ b/queue-4.4/drm-amdgpu-fix-hdmi-deep-color-support.patch @@ -0,0 +1,53 @@ +From 9d746ab68163d642dae13756b2b3145b2e38cb65 Mon Sep 17 00:00:00 2001 +From: Mario Kleiner +Date: Tue, 24 May 2016 18:12:43 +0200 +Subject: drm/amdgpu: Fix hdmi deep color support. + +From: Mario Kleiner + +commit 9d746ab68163d642dae13756b2b3145b2e38cb65 upstream. + +When porting the hdmi deep color detection code from +radeon-kms to amdgpu-kms apparently some kind of +copy and paste error happened, attaching an else +branch to the wrong if statement. + +The result is that hdmi deep color mode is always +disabled, regardless of gpu and display capabilities and +user wishes, as the code mistakenly thinks that the display +doesn't provide the required max_tmds_clock limit and falls +back to 8 bpc. + +This patch fixes deep color support, as tested on a +R9 380 Tonga Pro + suitable display, and should be +backported to all kernels with amdgpu-kms support. + +Signed-off-by: Mario Kleiner +Cc: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +@@ -194,12 +194,12 @@ int amdgpu_connector_get_monitor_bpc(str + bpc = 8; + DRM_DEBUG("%s: HDMI deep color 10 bpc exceeds max tmds clock. Using %d bpc.\n", + connector->name, bpc); +- } else if (bpc > 8) { +- /* max_tmds_clock missing, but hdmi spec mandates it for deep color. */ +- DRM_DEBUG("%s: Required max tmds clock for HDMI deep color missing. Using 8 bpc.\n", +- connector->name); +- bpc = 8; + } ++ } else if (bpc > 8) { ++ /* max_tmds_clock missing, but hdmi spec mandates it for deep color. */ ++ DRM_DEBUG("%s: Required max tmds clock for HDMI deep color missing. Using 8 bpc.\n", ++ connector->name); ++ bpc = 8; + } + } + diff --git a/queue-4.4/drm-amdgpu-use-drm_mode_vrefresh-rather-than-mode-vrefresh.patch b/queue-4.4/drm-amdgpu-use-drm_mode_vrefresh-rather-than-mode-vrefresh.patch new file mode 100644 index 00000000000..efd361a76d7 --- /dev/null +++ b/queue-4.4/drm-amdgpu-use-drm_mode_vrefresh-rather-than-mode-vrefresh.patch @@ -0,0 +1,32 @@ +From 6b8812eb004ee2b24aac8b1a711a0e8e797df3ce Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 2 May 2016 10:24:41 -0400 +Subject: drm/amdgpu: use drm_mode_vrefresh() rather than mode->vrefresh + +From: Alex Deucher + +commit 6b8812eb004ee2b24aac8b1a711a0e8e797df3ce upstream. + +This is a port of radeon commit: +3d2d98ee1af0cf6eebfbd6bff4c17d3601ac1284 +drm/radeon: use drm_mode_vrefresh() rather than mode->vrefresh +to amdgpu. + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c +@@ -150,7 +150,7 @@ u32 amdgpu_dpm_get_vrefresh(struct amdgp + list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) { + amdgpu_crtc = to_amdgpu_crtc(crtc); + if (crtc->enabled && amdgpu_crtc->enabled && amdgpu_crtc->hw_mode.clock) { +- vrefresh = amdgpu_crtc->hw_mode.vrefresh; ++ vrefresh = drm_mode_vrefresh(&amdgpu_crtc->hw_mode); + break; + } + } diff --git a/queue-4.4/drm-atomic-verify-connector-funcs-null-when-clearing-states.patch b/queue-4.4/drm-atomic-verify-connector-funcs-null-when-clearing-states.patch new file mode 100644 index 00000000000..f64f45960cb --- /dev/null +++ b/queue-4.4/drm-atomic-verify-connector-funcs-null-when-clearing-states.patch @@ -0,0 +1,45 @@ +From cpaul@redhat.com Sat Jun 4 13:44:11 2016 +From: Lyude +Date: Tue, 31 May 2016 12:49:07 -0400 +Subject: drm/atomic: Verify connector->funcs != NULL when clearing states +To: stable@vger.kernel.org, Greg Kroah-Hartman +Cc: Lyude , David Airlie , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS), linux-kernel@vger.kernel.org (open list) +Message-ID: <1464713347-28982-5-git-send-email-cpaul@redhat.com> + +From: Lyude + +Unfortunately since we don't have Dave's connector refcounting patch +here yet, it's very possible that drm_atomic_state_default_clear() could +get called by intel_display_resume() when +intel_dp_mst_destroy_connector() isn't completely finished destroying an +mst connector, but has already finished setting connector->funcs to +NULL. As such, we need to treat the connector like it's already been +destroyed and just skip it, otherwise we'll end up dereferencing a NULL +pointer. + +This fix is only required for 4.6 and below. David Airlie's patchseries +for 4.7 to add connector reference counting provides a more proper fix +for this. + +Changes since v1: + - Fix leftover whitespace + +Upstream fix: 0552f7651bc2 ("drm/i915/mst: use reference counted +connectors. (v3)") +Reviewed-by: Daniel Vetter +Signed-off-by: Lyude +--- + drivers/gpu/drm/drm_atomic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_atomic.c ++++ b/drivers/gpu/drm/drm_atomic.c +@@ -150,7 +150,7 @@ void drm_atomic_state_default_clear(stru + for (i = 0; i < state->num_connector; i++) { + struct drm_connector *connector = state->connectors[i]; + +- if (!connector) ++ if (!connector || !connector->funcs) + continue; + + /* diff --git a/queue-4.4/drm-fb_helper-fix-references-to-dev-mode_config.num_connector.patch b/queue-4.4/drm-fb_helper-fix-references-to-dev-mode_config.num_connector.patch new file mode 100644 index 00000000000..8e00e1b1f18 --- /dev/null +++ b/queue-4.4/drm-fb_helper-fix-references-to-dev-mode_config.num_connector.patch @@ -0,0 +1,69 @@ +From 255f0e7c418ad95a4baeda017ae6182ba9b3c423 Mon Sep 17 00:00:00 2001 +From: Lyude +Date: Thu, 12 May 2016 10:56:59 -0400 +Subject: drm/fb_helper: Fix references to dev->mode_config.num_connector + +From: Lyude + +commit 255f0e7c418ad95a4baeda017ae6182ba9b3c423 upstream. + +During boot, MST hotplugs are generally expected (even if no physical +hotplugging occurs) and result in DRM's connector topology changing. +This means that using num_connector from the current mode configuration +can lead to the number of connectors changing under us. This can lead to +some nasty scenarios in fbcon: + +- We allocate an array to the size of dev->mode_config.num_connectors. +- MST hotplug occurs, dev->mode_config.num_connectors gets incremented. +- We try to loop through each element in the array using the new value + of dev->mode_config.num_connectors, and end up going out of bounds + since dev->mode_config.num_connectors is now larger then the array we + allocated. + +fb_helper->connector_count however, will always remain consistent while +we do a modeset in fb_helper. + +Note: This is just polish for 4.7, Dave Airlie's drm_connector +refcounting fixed these bugs for real. But it's good enough duct-tape +for stable kernel backporting, since backporting the refcounting +changes is way too invasive. + +Signed-off-by: Lyude +[danvet: Clarify why we need this. Also remove the now unused "dev" +local variable to appease gcc.] +Signed-off-by: Daniel Vetter +Link: http://patchwork.freedesktop.org/patch/msgid/1463065021-18280-3-git-send-email-cpaul@redhat.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_fb_helper.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/drm_fb_helper.c ++++ b/drivers/gpu/drm/drm_fb_helper.c +@@ -1899,7 +1899,6 @@ static int drm_pick_crtcs(struct drm_fb_ + int n, int width, int height) + { + int c, o; +- struct drm_device *dev = fb_helper->dev; + struct drm_connector *connector; + const struct drm_connector_helper_funcs *connector_funcs; + struct drm_encoder *encoder; +@@ -1918,7 +1917,7 @@ static int drm_pick_crtcs(struct drm_fb_ + if (modes[n] == NULL) + return best_score; + +- crtcs = kzalloc(dev->mode_config.num_connector * ++ crtcs = kzalloc(fb_helper->connector_count * + sizeof(struct drm_fb_helper_crtc *), GFP_KERNEL); + if (!crtcs) + return best_score; +@@ -1964,7 +1963,7 @@ static int drm_pick_crtcs(struct drm_fb_ + if (score > best_score) { + best_score = score; + memcpy(best_crtcs, crtcs, +- dev->mode_config.num_connector * ++ fb_helper->connector_count * + sizeof(struct drm_fb_helper_crtc *)); + } + } diff --git a/queue-4.4/drm-gma500-fix-possible-out-of-bounds-read.patch b/queue-4.4/drm-gma500-fix-possible-out-of-bounds-read.patch new file mode 100644 index 00000000000..6b66f1ffde0 --- /dev/null +++ b/queue-4.4/drm-gma500-fix-possible-out-of-bounds-read.patch @@ -0,0 +1,34 @@ +From 7ccca1d5bf69fdd1d3c5fcf84faf1659a6e0ad11 Mon Sep 17 00:00:00 2001 +From: Itai Handler +Date: Tue, 3 Nov 2015 00:20:56 +0200 +Subject: drm/gma500: Fix possible out of bounds read + +From: Itai Handler + +commit 7ccca1d5bf69fdd1d3c5fcf84faf1659a6e0ad11 upstream. + +Fix possible out of bounds read, by adding missing comma. +The code may read pass the end of the dsi_errors array +when the most significant bit (bit #31) in the intr_stat register +is set. +This bug has been detected using CppCheck (static analysis tool). + +Signed-off-by: Itai Handler +Signed-off-by: Patrik Jakobsson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c ++++ b/drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c +@@ -72,7 +72,7 @@ static const char *const dsi_errors[] = + "RX Prot Violation", + "HS Generic Write FIFO Full", + "LP Generic Write FIFO Full", +- "Generic Read Data Avail" ++ "Generic Read Data Avail", + "Special Packet Sent", + "Tearing Effect", + }; diff --git a/queue-4.4/drm-i915-fbdev-fix-num_connector-references-in-intel_fb_initial_config.patch b/queue-4.4/drm-i915-fbdev-fix-num_connector-references-in-intel_fb_initial_config.patch new file mode 100644 index 00000000000..4c7ecbcbdfd --- /dev/null +++ b/queue-4.4/drm-i915-fbdev-fix-num_connector-references-in-intel_fb_initial_config.patch @@ -0,0 +1,62 @@ +From 14a3842a1d5945067d1dd0788f314e14d5b18e5b Mon Sep 17 00:00:00 2001 +From: Lyude +Date: Thu, 12 May 2016 10:56:58 -0400 +Subject: drm/i915/fbdev: Fix num_connector references in intel_fb_initial_config() + +From: Lyude + +commit 14a3842a1d5945067d1dd0788f314e14d5b18e5b upstream. + +During boot time, MST devices usually send a ton of hotplug events +irregardless of whether or not any physical hotplugs actually occurred. +Hotplugs mean connectors being created/destroyed, and the number of DRM +connectors changing under us. This isn't a problem if we use +fb_helper->connector_count since we only set it once in the code, +however if we use num_connector from struct drm_mode_config we risk it's +value changing under us. On top of that, there's even a chance that +dev->mode_config.num_connector != fb_helper->connector_count. If the +number of connectors happens to increase under us, we'll end up using +the wrong array size for memcpy and start writing beyond the actual +length of the array, occasionally resulting in kernel panics. + +Note: This is just polish for 4.7, Dave Airlie's drm_connector +refcounting fixed these bugs for real. But it's good enough duct-tape +for stable kernel backporting, since backporting the refcounting +changes is way too invasive. + +Signed-off-by: Lyude +[danvet: Clarify why we need this.] +Signed-off-by: Daniel Vetter +Link: http://patchwork.freedesktop.org/patch/msgid/1463065021-18280-2-git-send-email-cpaul@redhat.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_fbdev.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_fbdev.c ++++ b/drivers/gpu/drm/i915/intel_fbdev.c +@@ -362,12 +362,12 @@ static bool intel_fb_initial_config(stru + uint64_t conn_configured = 0, mask; + int pass = 0; + +- save_enabled = kcalloc(dev->mode_config.num_connector, sizeof(bool), ++ save_enabled = kcalloc(fb_helper->connector_count, sizeof(bool), + GFP_KERNEL); + if (!save_enabled) + return false; + +- memcpy(save_enabled, enabled, dev->mode_config.num_connector); ++ memcpy(save_enabled, enabled, fb_helper->connector_count); + mask = (1 << fb_helper->connector_count) - 1; + retry: + for (i = 0; i < fb_helper->connector_count; i++) { +@@ -501,7 +501,7 @@ retry: + if (fallback) { + bail: + DRM_DEBUG_KMS("Not using firmware configuration\n"); +- memcpy(enabled, save_enabled, dev->mode_config.num_connector); ++ memcpy(enabled, save_enabled, fb_helper->connector_count); + kfree(save_enabled); + return false; + } diff --git a/queue-4.4/drm-vmwgfx-enable-svga_3d_cmd_dx_set_predication.patch b/queue-4.4/drm-vmwgfx-enable-svga_3d_cmd_dx_set_predication.patch new file mode 100644 index 00000000000..17bfe6c7beb --- /dev/null +++ b/queue-4.4/drm-vmwgfx-enable-svga_3d_cmd_dx_set_predication.patch @@ -0,0 +1,31 @@ +From 1883598d4201361a6d2ce785095695f58071ee11 Mon Sep 17 00:00:00 2001 +From: Charmaine Lee +Date: Tue, 12 Apr 2016 08:14:23 -0700 +Subject: drm/vmwgfx: Enable SVGA_3D_CMD_DX_SET_PREDICATION + +From: Charmaine Lee + +commit 1883598d4201361a6d2ce785095695f58071ee11 upstream. + +Fixes piglit tests nv_conditional_render-* crashes. + +Signed-off-by: Charmaine Lee +Reviewed-by: Brian Paul +Reviewed-by: Sinclair Yeh +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +@@ -3285,7 +3285,7 @@ static const struct vmw_cmd_entry vmw_cm + true, false, true), + VMW_CMD_DEF(SVGA_3D_CMD_DX_READBACK_QUERY, &vmw_cmd_invalid, + true, false, true), +- VMW_CMD_DEF(SVGA_3D_CMD_DX_SET_PREDICATION, &vmw_cmd_invalid, ++ VMW_CMD_DEF(SVGA_3D_CMD_DX_SET_PREDICATION, &vmw_cmd_dx_cid_check, + true, false, true), + VMW_CMD_DEF(SVGA_3D_CMD_DX_SET_VIEWPORTS, &vmw_cmd_dx_cid_check, + true, false, true), diff --git a/queue-4.4/drm-vmwgfx-fix-order-of-operation.patch b/queue-4.4/drm-vmwgfx-fix-order-of-operation.patch new file mode 100644 index 00000000000..288b22dd800 --- /dev/null +++ b/queue-4.4/drm-vmwgfx-fix-order-of-operation.patch @@ -0,0 +1,39 @@ +From 7851496a32319237456919575e5f4ba62f74cc7d Mon Sep 17 00:00:00 2001 +From: Sinclair Yeh +Date: Thu, 21 Apr 2016 11:29:31 -0700 +Subject: drm/vmwgfx: Fix order of operation + +From: Sinclair Yeh + +commit 7851496a32319237456919575e5f4ba62f74cc7d upstream. + +mode->hdisplay * (var->bits_per_pixel + 7) gets evaluated before +the division, potentially making the pitch larger than it should +be. + +Since the original intention is to do a div-round-up, just use +the macro instead. + +Signed-off-by: Sinclair Yeh +Reviewed-by: Thomas Hellstrom +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +@@ -573,9 +573,9 @@ static int vmw_fb_set_par(struct fb_info + mode = old_mode; + old_mode = NULL; + } else if (!vmw_kms_validate_mode_vram(vmw_priv, +- mode->hdisplay * +- (var->bits_per_pixel + 7) / 8, +- mode->vdisplay)) { ++ mode->hdisplay * ++ DIV_ROUND_UP(var->bits_per_pixel, 8), ++ mode->vdisplay)) { + drm_mode_destroy(vmw_priv->dev, mode); + return -EINVAL; + } diff --git a/queue-4.4/drm-vmwgfx-use-vmw_cmd_dx_cid_check-for-query-commands.patch b/queue-4.4/drm-vmwgfx-use-vmw_cmd_dx_cid_check-for-query-commands.patch new file mode 100644 index 00000000000..c33481a3a2c --- /dev/null +++ b/queue-4.4/drm-vmwgfx-use-vmw_cmd_dx_cid_check-for-query-commands.patch @@ -0,0 +1,42 @@ +From e02e58843153ce80a9fe7588def89b2638d40e64 Mon Sep 17 00:00:00 2001 +From: Charmaine Lee +Date: Tue, 12 Apr 2016 08:19:08 -0700 +Subject: drm/vmwgfx: use vmw_cmd_dx_cid_check for query commands. + +From: Charmaine Lee + +commit e02e58843153ce80a9fe7588def89b2638d40e64 upstream. + +Instead of calling vmw_cmd_ok, call vmw_cmd_dx_cid_check to +validate the context id for query commands. + +Signed-off-by: Charmaine Lee +Reviewed-by: Sinclair Yeh +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +@@ -3273,15 +3273,15 @@ static const struct vmw_cmd_entry vmw_cm + &vmw_cmd_dx_cid_check, true, false, true), + VMW_CMD_DEF(SVGA_3D_CMD_DX_DEFINE_QUERY, &vmw_cmd_dx_define_query, + true, false, true), +- VMW_CMD_DEF(SVGA_3D_CMD_DX_DESTROY_QUERY, &vmw_cmd_ok, ++ VMW_CMD_DEF(SVGA_3D_CMD_DX_DESTROY_QUERY, &vmw_cmd_dx_cid_check, + true, false, true), + VMW_CMD_DEF(SVGA_3D_CMD_DX_BIND_QUERY, &vmw_cmd_dx_bind_query, + true, false, true), + VMW_CMD_DEF(SVGA_3D_CMD_DX_SET_QUERY_OFFSET, +- &vmw_cmd_ok, true, false, true), +- VMW_CMD_DEF(SVGA_3D_CMD_DX_BEGIN_QUERY, &vmw_cmd_ok, ++ &vmw_cmd_dx_cid_check, true, false, true), ++ VMW_CMD_DEF(SVGA_3D_CMD_DX_BEGIN_QUERY, &vmw_cmd_dx_cid_check, + true, false, true), +- VMW_CMD_DEF(SVGA_3D_CMD_DX_END_QUERY, &vmw_cmd_ok, ++ VMW_CMD_DEF(SVGA_3D_CMD_DX_END_QUERY, &vmw_cmd_dx_cid_check, + true, false, true), + VMW_CMD_DEF(SVGA_3D_CMD_DX_READBACK_QUERY, &vmw_cmd_invalid, + true, false, true), diff --git a/queue-4.4/series b/queue-4.4/series index b2a4058a079..e8b2a80db70 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -69,3 +69,12 @@ powerpc-eeh-restore-initial-state-in-eeh_pe_reset_and_recover.patch xen-events-don-t-move-disabled-irqs.patch xen-use-same-main-loop-for-counting-and-remapping-pages.patch sunrpc-fix-stripping-of-padded-mic-tokens.patch +drm-gma500-fix-possible-out-of-bounds-read.patch +drm-vmwgfx-enable-svga_3d_cmd_dx_set_predication.patch +drm-vmwgfx-use-vmw_cmd_dx_cid_check-for-query-commands.patch +drm-vmwgfx-fix-order-of-operation.patch +drm-amdgpu-use-drm_mode_vrefresh-rather-than-mode-vrefresh.patch +drm-amdgpu-fix-hdmi-deep-color-support.patch +drm-i915-fbdev-fix-num_connector-references-in-intel_fb_initial_config.patch +drm-fb_helper-fix-references-to-dev-mode_config.num_connector.patch +drm-atomic-verify-connector-funcs-null-when-clearing-states.patch