From 8fece35112a19f1abecde373d25e1ac0005c0709 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 4 Jun 2016 14:22:14 -0700 Subject: [PATCH] 4.5-stable patches added patches: bluetooth-6lowpan-fix-memory-corruption-of-ipv6-destination-address.patch drm-amdgpu-fix-hdmi-deep-color-support.patch drm-amdgpu-use-drm_mode_vrefresh-rather-than-mode-vrefresh.patch drm-atomic-verify-connector-funcs-null-when-clearing-states.patch drm-fb_helper-fix-references-to-dev-mode_config.num_connector.patch drm-gma500-fix-possible-out-of-bounds-read.patch drm-i915-don-t-leave-old-junk-in-ilk-active-watermarks-on-readout.patch drm-i915-fbdev-fix-num_connector-references-in-intel_fb_initial_config.patch drm-i915-fix-races-on-fbdev.patch drm-i915-fix-watermarks-for-vlv-chv.patch drm-i915-psr-try-to-program-link-training-times-correctly.patch drm-imx-match-imx-ipuv3-crtc-components-using-device-node-in-platform-data.patch drm-vmwgfx-enable-svga_3d_cmd_dx_set_predication.patch drm-vmwgfx-fix-order-of-operation.patch drm-vmwgfx-use-vmw_cmd_dx_cid_check-for-query-commands.patch --- ...rruption-of-ipv6-destination-address.patch | 74 ++++++++++ ...m-amdgpu-fix-hdmi-deep-color-support.patch | 53 ++++++++ ...e_vrefresh-rather-than-mode-vrefresh.patch | 32 +++++ ...ctor-funcs-null-when-clearing-states.patch | 45 ++++++ ...ces-to-dev-mode_config.num_connector.patch | 69 ++++++++++ ...a500-fix-possible-out-of-bounds-read.patch | 34 +++++ ...-in-ilk-active-watermarks-on-readout.patch | 45 ++++++ ...eferences-in-intel_fb_initial_config.patch | 62 +++++++++ queue-4.5/drm-i915-fix-races-on-fbdev.patch | 80 +++++++++++ .../drm-i915-fix-watermarks-for-vlv-chv.patch | 128 ++++++++++++++++++ ...rogram-link-training-times-correctly.patch | 113 ++++++++++++++++ ...s-using-device-node-in-platform-data.patch | 124 +++++++++++++++++ ...nable-svga_3d_cmd_dx_set_predication.patch | 31 +++++ .../drm-vmwgfx-fix-order-of-operation.patch | 39 ++++++ ..._cmd_dx_cid_check-for-query-commands.patch | 42 ++++++ queue-4.5/series | 15 ++ 16 files changed, 986 insertions(+) create mode 100644 queue-4.5/bluetooth-6lowpan-fix-memory-corruption-of-ipv6-destination-address.patch create mode 100644 queue-4.5/drm-amdgpu-fix-hdmi-deep-color-support.patch create mode 100644 queue-4.5/drm-amdgpu-use-drm_mode_vrefresh-rather-than-mode-vrefresh.patch create mode 100644 queue-4.5/drm-atomic-verify-connector-funcs-null-when-clearing-states.patch create mode 100644 queue-4.5/drm-fb_helper-fix-references-to-dev-mode_config.num_connector.patch create mode 100644 queue-4.5/drm-gma500-fix-possible-out-of-bounds-read.patch create mode 100644 queue-4.5/drm-i915-don-t-leave-old-junk-in-ilk-active-watermarks-on-readout.patch create mode 100644 queue-4.5/drm-i915-fbdev-fix-num_connector-references-in-intel_fb_initial_config.patch create mode 100644 queue-4.5/drm-i915-fix-races-on-fbdev.patch create mode 100644 queue-4.5/drm-i915-fix-watermarks-for-vlv-chv.patch create mode 100644 queue-4.5/drm-i915-psr-try-to-program-link-training-times-correctly.patch create mode 100644 queue-4.5/drm-imx-match-imx-ipuv3-crtc-components-using-device-node-in-platform-data.patch create mode 100644 queue-4.5/drm-vmwgfx-enable-svga_3d_cmd_dx_set_predication.patch create mode 100644 queue-4.5/drm-vmwgfx-fix-order-of-operation.patch create mode 100644 queue-4.5/drm-vmwgfx-use-vmw_cmd_dx_cid_check-for-query-commands.patch diff --git a/queue-4.5/bluetooth-6lowpan-fix-memory-corruption-of-ipv6-destination-address.patch b/queue-4.5/bluetooth-6lowpan-fix-memory-corruption-of-ipv6-destination-address.patch new file mode 100644 index 00000000000..e2b5cce2bde --- /dev/null +++ b/queue-4.5/bluetooth-6lowpan-fix-memory-corruption-of-ipv6-destination-address.patch @@ -0,0 +1,74 @@ +From 55441070ca1cbd47ce1ad2959bbf4b47aed9b83b Mon Sep 17 00:00:00 2001 +From: Glenn Ruben Bakke +Date: Fri, 22 Apr 2016 18:06:11 +0200 +Subject: Bluetooth: 6lowpan: Fix memory corruption of ipv6 destination address + +From: Glenn Ruben Bakke + +commit 55441070ca1cbd47ce1ad2959bbf4b47aed9b83b upstream. + +The memcpy of ipv6 header destination address to the skb control block +(sbk->cb) in header_create() results in currupted memory when bt_xmit() +is issued. The skb->cb is "released" in the return of header_create() +making room for lower layer to minipulate the skb->cb. + +The value retrieved in bt_xmit is not persistent across header creation +and sending, and the lower layer will overwrite portions of skb->cb, +making the copied destination address wrong. + +The memory corruption will lead to non-working multicast as the first 4 +bytes of the copied destination address is replaced by a value that +resolves into a non-multicast prefix. + +This fix removes the dependency on the skb control block between header +creation and send, by moving the destination address memcpy to the send +function path (setup_create, which is called from bt_xmit). + +Signed-off-by: Glenn Ruben Bakke +Acked-by: Jukka Rissanen +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + + +--- + net/bluetooth/6lowpan.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +--- a/net/bluetooth/6lowpan.c ++++ b/net/bluetooth/6lowpan.c +@@ -431,15 +431,18 @@ static int setup_header(struct sk_buff * + bdaddr_t *peer_addr, u8 *peer_addr_type) + { + struct in6_addr ipv6_daddr; ++ struct ipv6hdr *hdr; + struct lowpan_dev *dev; + struct lowpan_peer *peer; + bdaddr_t addr, *any = BDADDR_ANY; + u8 *daddr = any->b; + int err, status = 0; + ++ hdr = ipv6_hdr(skb); ++ + dev = lowpan_dev(netdev); + +- memcpy(&ipv6_daddr, &lowpan_cb(skb)->addr, sizeof(ipv6_daddr)); ++ memcpy(&ipv6_daddr, &hdr->daddr, sizeof(ipv6_daddr)); + + if (ipv6_addr_is_multicast(&ipv6_daddr)) { + lowpan_cb(skb)->chan = NULL; +@@ -489,15 +492,9 @@ static int header_create(struct sk_buff + unsigned short type, const void *_daddr, + const void *_saddr, unsigned int len) + { +- struct ipv6hdr *hdr; +- + if (type != ETH_P_IPV6) + return -EINVAL; + +- hdr = ipv6_hdr(skb); +- +- memcpy(&lowpan_cb(skb)->addr, &hdr->daddr, sizeof(struct in6_addr)); +- + return 0; + } + diff --git a/queue-4.5/drm-amdgpu-fix-hdmi-deep-color-support.patch b/queue-4.5/drm-amdgpu-fix-hdmi-deep-color-support.patch new file mode 100644 index 00000000000..b4342e930d4 --- /dev/null +++ b/queue-4.5/drm-amdgpu-fix-hdmi-deep-color-support.patch @@ -0,0 +1,53 @@ +From 9d746ab68163d642dae13756b2b3145b2e38cb65 Mon Sep 17 00:00:00 2001 +From: Mario Kleiner +Date: Tue, 24 May 2016 18:12:43 +0200 +Subject: drm/amdgpu: Fix hdmi deep color support. + +From: Mario Kleiner + +commit 9d746ab68163d642dae13756b2b3145b2e38cb65 upstream. + +When porting the hdmi deep color detection code from +radeon-kms to amdgpu-kms apparently some kind of +copy and paste error happened, attaching an else +branch to the wrong if statement. + +The result is that hdmi deep color mode is always +disabled, regardless of gpu and display capabilities and +user wishes, as the code mistakenly thinks that the display +doesn't provide the required max_tmds_clock limit and falls +back to 8 bpc. + +This patch fixes deep color support, as tested on a +R9 380 Tonga Pro + suitable display, and should be +backported to all kernels with amdgpu-kms support. + +Signed-off-by: Mario Kleiner +Cc: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +@@ -194,12 +194,12 @@ int amdgpu_connector_get_monitor_bpc(str + bpc = 8; + DRM_DEBUG("%s: HDMI deep color 10 bpc exceeds max tmds clock. Using %d bpc.\n", + connector->name, bpc); +- } else if (bpc > 8) { +- /* max_tmds_clock missing, but hdmi spec mandates it for deep color. */ +- DRM_DEBUG("%s: Required max tmds clock for HDMI deep color missing. Using 8 bpc.\n", +- connector->name); +- bpc = 8; + } ++ } else if (bpc > 8) { ++ /* max_tmds_clock missing, but hdmi spec mandates it for deep color. */ ++ DRM_DEBUG("%s: Required max tmds clock for HDMI deep color missing. Using 8 bpc.\n", ++ connector->name); ++ bpc = 8; + } + } + diff --git a/queue-4.5/drm-amdgpu-use-drm_mode_vrefresh-rather-than-mode-vrefresh.patch b/queue-4.5/drm-amdgpu-use-drm_mode_vrefresh-rather-than-mode-vrefresh.patch new file mode 100644 index 00000000000..efd361a76d7 --- /dev/null +++ b/queue-4.5/drm-amdgpu-use-drm_mode_vrefresh-rather-than-mode-vrefresh.patch @@ -0,0 +1,32 @@ +From 6b8812eb004ee2b24aac8b1a711a0e8e797df3ce Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 2 May 2016 10:24:41 -0400 +Subject: drm/amdgpu: use drm_mode_vrefresh() rather than mode->vrefresh + +From: Alex Deucher + +commit 6b8812eb004ee2b24aac8b1a711a0e8e797df3ce upstream. + +This is a port of radeon commit: +3d2d98ee1af0cf6eebfbd6bff4c17d3601ac1284 +drm/radeon: use drm_mode_vrefresh() rather than mode->vrefresh +to amdgpu. + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c +@@ -150,7 +150,7 @@ u32 amdgpu_dpm_get_vrefresh(struct amdgp + list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) { + amdgpu_crtc = to_amdgpu_crtc(crtc); + if (crtc->enabled && amdgpu_crtc->enabled && amdgpu_crtc->hw_mode.clock) { +- vrefresh = amdgpu_crtc->hw_mode.vrefresh; ++ vrefresh = drm_mode_vrefresh(&amdgpu_crtc->hw_mode); + break; + } + } diff --git a/queue-4.5/drm-atomic-verify-connector-funcs-null-when-clearing-states.patch b/queue-4.5/drm-atomic-verify-connector-funcs-null-when-clearing-states.patch new file mode 100644 index 00000000000..dd6329966f9 --- /dev/null +++ b/queue-4.5/drm-atomic-verify-connector-funcs-null-when-clearing-states.patch @@ -0,0 +1,45 @@ +From cpaul@redhat.com Sat Jun 4 13:44:11 2016 +From: Lyude +Date: Tue, 31 May 2016 12:49:07 -0400 +Subject: drm/atomic: Verify connector->funcs != NULL when clearing states +To: stable@vger.kernel.org, Greg Kroah-Hartman +Cc: Lyude , David Airlie , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS), linux-kernel@vger.kernel.org (open list) +Message-ID: <1464713347-28982-5-git-send-email-cpaul@redhat.com> + +From: Lyude + +Unfortunately since we don't have Dave's connector refcounting patch +here yet, it's very possible that drm_atomic_state_default_clear() could +get called by intel_display_resume() when +intel_dp_mst_destroy_connector() isn't completely finished destroying an +mst connector, but has already finished setting connector->funcs to +NULL. As such, we need to treat the connector like it's already been +destroyed and just skip it, otherwise we'll end up dereferencing a NULL +pointer. + +This fix is only required for 4.6 and below. David Airlie's patchseries +for 4.7 to add connector reference counting provides a more proper fix +for this. + +Changes since v1: + - Fix leftover whitespace + +Upstream fix: 0552f7651bc2 ("drm/i915/mst: use reference counted +connectors. (v3)") +Reviewed-by: Daniel Vetter +Signed-off-by: Lyude +--- + drivers/gpu/drm/drm_atomic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_atomic.c ++++ b/drivers/gpu/drm/drm_atomic.c +@@ -138,7 +138,7 @@ void drm_atomic_state_default_clear(stru + for (i = 0; i < state->num_connector; i++) { + struct drm_connector *connector = state->connectors[i]; + +- if (!connector) ++ if (!connector || !connector->funcs) + continue; + + /* diff --git a/queue-4.5/drm-fb_helper-fix-references-to-dev-mode_config.num_connector.patch b/queue-4.5/drm-fb_helper-fix-references-to-dev-mode_config.num_connector.patch new file mode 100644 index 00000000000..8e00e1b1f18 --- /dev/null +++ b/queue-4.5/drm-fb_helper-fix-references-to-dev-mode_config.num_connector.patch @@ -0,0 +1,69 @@ +From 255f0e7c418ad95a4baeda017ae6182ba9b3c423 Mon Sep 17 00:00:00 2001 +From: Lyude +Date: Thu, 12 May 2016 10:56:59 -0400 +Subject: drm/fb_helper: Fix references to dev->mode_config.num_connector + +From: Lyude + +commit 255f0e7c418ad95a4baeda017ae6182ba9b3c423 upstream. + +During boot, MST hotplugs are generally expected (even if no physical +hotplugging occurs) and result in DRM's connector topology changing. +This means that using num_connector from the current mode configuration +can lead to the number of connectors changing under us. This can lead to +some nasty scenarios in fbcon: + +- We allocate an array to the size of dev->mode_config.num_connectors. +- MST hotplug occurs, dev->mode_config.num_connectors gets incremented. +- We try to loop through each element in the array using the new value + of dev->mode_config.num_connectors, and end up going out of bounds + since dev->mode_config.num_connectors is now larger then the array we + allocated. + +fb_helper->connector_count however, will always remain consistent while +we do a modeset in fb_helper. + +Note: This is just polish for 4.7, Dave Airlie's drm_connector +refcounting fixed these bugs for real. But it's good enough duct-tape +for stable kernel backporting, since backporting the refcounting +changes is way too invasive. + +Signed-off-by: Lyude +[danvet: Clarify why we need this. Also remove the now unused "dev" +local variable to appease gcc.] +Signed-off-by: Daniel Vetter +Link: http://patchwork.freedesktop.org/patch/msgid/1463065021-18280-3-git-send-email-cpaul@redhat.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_fb_helper.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/drm_fb_helper.c ++++ b/drivers/gpu/drm/drm_fb_helper.c +@@ -1899,7 +1899,6 @@ static int drm_pick_crtcs(struct drm_fb_ + int n, int width, int height) + { + int c, o; +- struct drm_device *dev = fb_helper->dev; + struct drm_connector *connector; + const struct drm_connector_helper_funcs *connector_funcs; + struct drm_encoder *encoder; +@@ -1918,7 +1917,7 @@ static int drm_pick_crtcs(struct drm_fb_ + if (modes[n] == NULL) + return best_score; + +- crtcs = kzalloc(dev->mode_config.num_connector * ++ crtcs = kzalloc(fb_helper->connector_count * + sizeof(struct drm_fb_helper_crtc *), GFP_KERNEL); + if (!crtcs) + return best_score; +@@ -1964,7 +1963,7 @@ static int drm_pick_crtcs(struct drm_fb_ + if (score > best_score) { + best_score = score; + memcpy(best_crtcs, crtcs, +- dev->mode_config.num_connector * ++ fb_helper->connector_count * + sizeof(struct drm_fb_helper_crtc *)); + } + } diff --git a/queue-4.5/drm-gma500-fix-possible-out-of-bounds-read.patch b/queue-4.5/drm-gma500-fix-possible-out-of-bounds-read.patch new file mode 100644 index 00000000000..6b66f1ffde0 --- /dev/null +++ b/queue-4.5/drm-gma500-fix-possible-out-of-bounds-read.patch @@ -0,0 +1,34 @@ +From 7ccca1d5bf69fdd1d3c5fcf84faf1659a6e0ad11 Mon Sep 17 00:00:00 2001 +From: Itai Handler +Date: Tue, 3 Nov 2015 00:20:56 +0200 +Subject: drm/gma500: Fix possible out of bounds read + +From: Itai Handler + +commit 7ccca1d5bf69fdd1d3c5fcf84faf1659a6e0ad11 upstream. + +Fix possible out of bounds read, by adding missing comma. +The code may read pass the end of the dsi_errors array +when the most significant bit (bit #31) in the intr_stat register +is set. +This bug has been detected using CppCheck (static analysis tool). + +Signed-off-by: Itai Handler +Signed-off-by: Patrik Jakobsson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c ++++ b/drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c +@@ -72,7 +72,7 @@ static const char *const dsi_errors[] = + "RX Prot Violation", + "HS Generic Write FIFO Full", + "LP Generic Write FIFO Full", +- "Generic Read Data Avail" ++ "Generic Read Data Avail", + "Special Packet Sent", + "Tearing Effect", + }; diff --git a/queue-4.5/drm-i915-don-t-leave-old-junk-in-ilk-active-watermarks-on-readout.patch b/queue-4.5/drm-i915-don-t-leave-old-junk-in-ilk-active-watermarks-on-readout.patch new file mode 100644 index 00000000000..f7f2a68ad56 --- /dev/null +++ b/queue-4.5/drm-i915-don-t-leave-old-junk-in-ilk-active-watermarks-on-readout.patch @@ -0,0 +1,45 @@ +From 7045c3689f148a0c95f42bae8ef3eb2829ac7de9 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Fri, 13 May 2016 17:55:17 +0300 +Subject: drm/i915: Don't leave old junk in ilk active watermarks on readout +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit 7045c3689f148a0c95f42bae8ef3eb2829ac7de9 upstream. + +When we read out the watermark state from the hardware we're supposed to +transfer that into the active watermarks, but currently we fail to any +part of the active watermarks that isn't explicitly written. Let's clear +it all upfront. + +Looks like this has been like this since the beginning, when I added the +readout. No idea why I didn't clear it up. + +Cc: Matt Roper +Fixes: 243e6a44b9ca ("drm/i915: Init HSW watermark tracking in intel_modeset_setup_hw_state()") +Signed-off-by: Ville Syrjälä +Reviewed-by: Matt Roper +Signed-off-by: Matt Roper +Link: http://patchwork.freedesktop.org/patch/msgid/1463151318-14719-2-git-send-email-ville.syrjala@linux.intel.com +(cherry picked from commit 15606534bf0a65d8a74a90fd57b8712d147dbca6) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_pm.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/i915/intel_pm.c ++++ b/drivers/gpu/drm/i915/intel_pm.c +@@ -3812,6 +3812,8 @@ static void ilk_pipe_wm_get_hw_state(str + if (IS_HASWELL(dev) || IS_BROADWELL(dev)) + hw->wm_linetime[pipe] = I915_READ(PIPE_WM_LINETIME(pipe)); + ++ memset(active, 0, sizeof(*active)); ++ + active->pipe_enabled = intel_crtc->active; + + if (active->pipe_enabled) { diff --git a/queue-4.5/drm-i915-fbdev-fix-num_connector-references-in-intel_fb_initial_config.patch b/queue-4.5/drm-i915-fbdev-fix-num_connector-references-in-intel_fb_initial_config.patch new file mode 100644 index 00000000000..3025eb3f160 --- /dev/null +++ b/queue-4.5/drm-i915-fbdev-fix-num_connector-references-in-intel_fb_initial_config.patch @@ -0,0 +1,62 @@ +From 14a3842a1d5945067d1dd0788f314e14d5b18e5b Mon Sep 17 00:00:00 2001 +From: Lyude +Date: Thu, 12 May 2016 10:56:58 -0400 +Subject: drm/i915/fbdev: Fix num_connector references in intel_fb_initial_config() + +From: Lyude + +commit 14a3842a1d5945067d1dd0788f314e14d5b18e5b upstream. + +During boot time, MST devices usually send a ton of hotplug events +irregardless of whether or not any physical hotplugs actually occurred. +Hotplugs mean connectors being created/destroyed, and the number of DRM +connectors changing under us. This isn't a problem if we use +fb_helper->connector_count since we only set it once in the code, +however if we use num_connector from struct drm_mode_config we risk it's +value changing under us. On top of that, there's even a chance that +dev->mode_config.num_connector != fb_helper->connector_count. If the +number of connectors happens to increase under us, we'll end up using +the wrong array size for memcpy and start writing beyond the actual +length of the array, occasionally resulting in kernel panics. + +Note: This is just polish for 4.7, Dave Airlie's drm_connector +refcounting fixed these bugs for real. But it's good enough duct-tape +for stable kernel backporting, since backporting the refcounting +changes is way too invasive. + +Signed-off-by: Lyude +[danvet: Clarify why we need this.] +Signed-off-by: Daniel Vetter +Link: http://patchwork.freedesktop.org/patch/msgid/1463065021-18280-2-git-send-email-cpaul@redhat.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_fbdev.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_fbdev.c ++++ b/drivers/gpu/drm/i915/intel_fbdev.c +@@ -368,12 +368,12 @@ static bool intel_fb_initial_config(stru + uint64_t conn_configured = 0, mask; + int pass = 0; + +- save_enabled = kcalloc(dev->mode_config.num_connector, sizeof(bool), ++ save_enabled = kcalloc(fb_helper->connector_count, sizeof(bool), + GFP_KERNEL); + if (!save_enabled) + return false; + +- memcpy(save_enabled, enabled, dev->mode_config.num_connector); ++ memcpy(save_enabled, enabled, fb_helper->connector_count); + mask = (1 << fb_helper->connector_count) - 1; + retry: + for (i = 0; i < fb_helper->connector_count; i++) { +@@ -507,7 +507,7 @@ retry: + if (fallback) { + bail: + DRM_DEBUG_KMS("Not using firmware configuration\n"); +- memcpy(enabled, save_enabled, dev->mode_config.num_connector); ++ memcpy(enabled, save_enabled, fb_helper->connector_count); + kfree(save_enabled); + return false; + } diff --git a/queue-4.5/drm-i915-fix-races-on-fbdev.patch b/queue-4.5/drm-i915-fix-races-on-fbdev.patch new file mode 100644 index 00000000000..14ec13ae2ca --- /dev/null +++ b/queue-4.5/drm-i915-fix-races-on-fbdev.patch @@ -0,0 +1,80 @@ +From a7442b93cf32c1e1ddb721a26cd1f92302e2a222 Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Wed, 9 Mar 2016 12:52:53 +0100 +Subject: drm/i915: Fix races on fbdev +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lukas Wunner + +commit a7442b93cf32c1e1ddb721a26cd1f92302e2a222 upstream. + +The ->lastclose callback invokes intel_fbdev_restore_mode() and has +been witnessed to run before intel_fbdev_initial_config_async() +has finished. + +We might likewise receive hotplug events before we've had a chance to +fully set up the fbdev. + +Fix by waiting for the asynchronous thread to finish. + +v2: +An async_synchronize_full() was also added to intel_fbdev_set_suspend() +in v1 which turned out to be entirely gratuitous. It caused a deadlock +on suspend (discovered by CI, thanks to Damien Lespiau and Tomi Sarvela +for CI support) and was unnecessary since a device is never suspended +until its ->probe callback (and all asynchronous tasks it scheduled) +have finished. See dpm_prepare(), which calls wait_for_device_probe(), +which calls async_synchronize_full(). + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=93580 +Reported-by: Gustav Fägerlind +Reported-by: "Li, Weinan Z" +Cc: Chris Wilson +Signed-off-by: Lukas Wunner +Signed-off-by: Daniel Vetter +Link: http://patchwork.freedesktop.org/patch/msgid/20160309115147.67B2B6E0D3@gabe.freedesktop.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_dma.c | 8 +++----- + drivers/gpu/drm/i915/intel_fbdev.c | 3 +++ + 2 files changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_dma.c ++++ b/drivers/gpu/drm/i915/i915_dma.c +@@ -437,11 +437,9 @@ static int i915_load_modeset_init(struct + * Some ports require correctly set-up hpd registers for detection to + * work properly (leading to ghost connected connector status), e.g. VGA + * on gm45. Hence we can only set up the initial fbdev config after hpd +- * irqs are fully enabled. Now we should scan for the initial config +- * only once hotplug handling is enabled, but due to screwed-up locking +- * around kms/fbdev init we can't protect the fdbev initial config +- * scanning against hotplug events. Hence do this first and ignore the +- * tiny window where we will loose hotplug notifactions. ++ * irqs are fully enabled. We protect the fbdev initial config scanning ++ * against hotplug events by waiting in intel_fbdev_output_poll_changed ++ * until the asynchronous thread has finished. + */ + intel_fbdev_initial_config_async(dev); + +--- a/drivers/gpu/drm/i915/intel_fbdev.c ++++ b/drivers/gpu/drm/i915/intel_fbdev.c +@@ -797,6 +797,8 @@ void intel_fbdev_set_suspend(struct drm_ + void intel_fbdev_output_poll_changed(struct drm_device *dev) + { + struct drm_i915_private *dev_priv = dev->dev_private; ++ ++ async_synchronize_full(); + if (dev_priv->fbdev) + drm_fb_helper_hotplug_event(&dev_priv->fbdev->helper); + } +@@ -808,6 +810,7 @@ void intel_fbdev_restore_mode(struct drm + struct intel_fbdev *ifbdev = dev_priv->fbdev; + struct drm_fb_helper *fb_helper; + ++ async_synchronize_full(); + if (!ifbdev) + return; + diff --git a/queue-4.5/drm-i915-fix-watermarks-for-vlv-chv.patch b/queue-4.5/drm-i915-fix-watermarks-for-vlv-chv.patch new file mode 100644 index 00000000000..d30f80c997c --- /dev/null +++ b/queue-4.5/drm-i915-fix-watermarks-for-vlv-chv.patch @@ -0,0 +1,128 @@ +From caed361d83b204b7766924b80463bf7502ee7986 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Wed, 9 Mar 2016 19:07:25 +0200 +Subject: drm/i915: Fix watermarks for VLV/CHV +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit caed361d83b204b7766924b80463bf7502ee7986 upstream. + +commit 92826fcdfc14 ("drm/i915: Calculate watermark related members in the crtc_state, v4.") +broke thigns by removing the pre vs. post wm update distinction. We also +lost the pre plane wm update entirely for VLV/CHV from the crtc enable +path. + +This caused underruns on modeset and plane enable/disable on CHV, +and often those can lead to a dead pipe. + +So let's bring back the pre vs. post thing, and let's toss in an +explicit wm update to valleyview_crtc_enable() to avoid having to +put it into the common code. + +This is more or less a partial revert of the offending commit. + +Cc: Maarten Lankhorst +Cc: drm-intel-fixes@lists.freedesktop.org +Fixes: 92826fcdfc14 ("drm/i915: Calculate watermark related members in the crtc_state, v4.") +Signed-off-by: Ville Syrjälä +Link: http://patchwork.freedesktop.org/patch/msgid/1457543247-13987-4-git-send-email-ville.syrjala@linux.intel.com +Reviewed-by: Maarten Lankhorst +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_atomic.c | 3 ++- + drivers/gpu/drm/i915/intel_display.c | 21 +++++++++++++++------ + drivers/gpu/drm/i915/intel_drv.h | 2 +- + 3 files changed, 18 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_atomic.c ++++ b/drivers/gpu/drm/i915/intel_atomic.c +@@ -96,7 +96,8 @@ intel_crtc_duplicate_state(struct drm_cr + crtc_state->update_pipe = false; + crtc_state->disable_lp_wm = false; + crtc_state->disable_cxsr = false; +- crtc_state->wm_changed = false; ++ crtc_state->update_wm_pre = false; ++ crtc_state->update_wm_post = false; + + return &crtc_state->base; + } +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -4816,7 +4816,7 @@ static void intel_post_plane_update(stru + + crtc->wm.cxsr_allowed = true; + +- if (pipe_config->wm_changed && pipe_config->base.active) ++ if (pipe_config->update_wm_post && pipe_config->base.active) + intel_update_watermarks(&crtc->base); + + if (atomic->update_fbc) +@@ -4850,7 +4850,7 @@ static void intel_pre_plane_update(struc + intel_set_memory_cxsr(dev_priv, false); + } + +- if (!needs_modeset(&pipe_config->base) && pipe_config->wm_changed) ++ if (!needs_modeset(&pipe_config->base) && pipe_config->update_wm_pre) + intel_update_watermarks(&crtc->base); + } + +@@ -6229,6 +6229,7 @@ static void valleyview_crtc_enable(struc + + intel_crtc_load_lut(crtc); + ++ intel_update_watermarks(crtc); + intel_enable_pipe(intel_crtc); + + assert_vblank_disabled(crtc); +@@ -11881,8 +11882,14 @@ int intel_plane_atomic_calc_changes(stru + plane->base.id, was_visible, visible, + turn_off, turn_on, mode_changed); + +- if (turn_on || turn_off) { +- pipe_config->wm_changed = true; ++ if (turn_on) { ++ pipe_config->update_wm_pre = true; ++ ++ /* must disable cxsr around plane enable/disable */ ++ if (plane->type != DRM_PLANE_TYPE_CURSOR) ++ pipe_config->disable_cxsr = true; ++ } else if (turn_off) { ++ pipe_config->update_wm_post = true; + + /* must disable cxsr around plane enable/disable */ + if (plane->type != DRM_PLANE_TYPE_CURSOR) { +@@ -11891,7 +11898,9 @@ int intel_plane_atomic_calc_changes(stru + pipe_config->disable_cxsr = true; + } + } else if (intel_wm_need_update(plane, plane_state)) { +- pipe_config->wm_changed = true; ++ /* FIXME bollocks */ ++ pipe_config->update_wm_pre = true; ++ pipe_config->update_wm_post = true; + } + + if (visible || was_visible) +@@ -12036,7 +12045,7 @@ static int intel_crtc_atomic_check(struc + } + + if (mode_changed && !crtc_state->active) +- pipe_config->wm_changed = true; ++ pipe_config->update_wm_post = true; + + if (mode_changed && crtc_state->enable && + dev_priv->display.crtc_compute_clock && +--- a/drivers/gpu/drm/i915/intel_drv.h ++++ b/drivers/gpu/drm/i915/intel_drv.h +@@ -367,7 +367,7 @@ struct intel_crtc_state { + + bool update_pipe; /* can a fast modeset be performed? */ + bool disable_cxsr; +- bool wm_changed; /* watermarks are updated */ ++ bool update_wm_pre, update_wm_post; /* watermarks are updated */ + + /* Pipe source size (ie. panel fitter input size) + * All planes will be positioned inside this space, diff --git a/queue-4.5/drm-i915-psr-try-to-program-link-training-times-correctly.patch b/queue-4.5/drm-i915-psr-try-to-program-link-training-times-correctly.patch new file mode 100644 index 00000000000..1cb7d9ed8dc --- /dev/null +++ b/queue-4.5/drm-i915-psr-try-to-program-link-training-times-correctly.patch @@ -0,0 +1,113 @@ +From 03b7b5f983091bca17e9c163832fcde56971d7d1 Mon Sep 17 00:00:00 2001 +From: Daniel Vetter +Date: Wed, 18 May 2016 18:47:11 +0200 +Subject: drm/i915/psr: Try to program link training times correctly +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Daniel Vetter + +commit 03b7b5f983091bca17e9c163832fcde56971d7d1 upstream. + +The default of 0 is 500us of link training, but that's not enough for +some platforms. Decoding this correctly means we're using 2.5ms of +link training on these platforms, which fixes flickering issues +associated with enabling PSR. + +v2: Unbotch the math a bit. + +v3: Drop debug hunk. + +v4: Improve commit message. + +Tested-by: Lyude +Cc: Lyude +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=95176 +Cc: Rodrigo Vivi +Cc: Sonika Jindal +Cc: Durgadoss R +Cc: "Pandiyan, Dhinakaran" +Tested-by: Ville Syrjälä +Reviewed-by: Ville Syrjälä +Tested-by: fritsch@kodi.tv +Signed-off-by: Daniel Vetter +Link: http://patchwork.freedesktop.org/patch/msgid/1463590036-17824-2-git-send-email-daniel.vetter@ffwll.ch +(cherry picked from commit 50db139018f9c94376d5f4db94a3bae65fdfac14) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_psr.c | 57 ++++++++++++++++++++++++++++++++------- + 1 file changed, 48 insertions(+), 9 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_psr.c ++++ b/drivers/gpu/drm/i915/intel_psr.c +@@ -275,19 +275,58 @@ static void hsw_psr_enable_source(struct + * with the 5 or 6 idle patterns. + */ + uint32_t idle_frames = max(6, dev_priv->vbt.psr.idle_frames); +- uint32_t val = 0x0; ++ uint32_t val = EDP_PSR_ENABLE; ++ ++ val |= max_sleep_time << EDP_PSR_MAX_SLEEP_TIME_SHIFT; ++ val |= idle_frames << EDP_PSR_IDLE_FRAME_SHIFT; + + if (IS_HASWELL(dev)) + val |= EDP_PSR_MIN_LINK_ENTRY_TIME_8_LINES; + +- I915_WRITE(EDP_PSR_CTL, val | +- max_sleep_time << EDP_PSR_MAX_SLEEP_TIME_SHIFT | +- idle_frames << EDP_PSR_IDLE_FRAME_SHIFT | +- EDP_PSR_ENABLE); +- +- if (dev_priv->psr.psr2_support) +- I915_WRITE(EDP_PSR2_CTL, EDP_PSR2_ENABLE | +- EDP_SU_TRACK_ENABLE | EDP_PSR2_TP2_TIME_100); ++ if (dev_priv->vbt.psr.tp1_wakeup_time > 5) ++ val |= EDP_PSR_TP1_TIME_2500us; ++ else if (dev_priv->vbt.psr.tp1_wakeup_time > 1) ++ val |= EDP_PSR_TP1_TIME_500us; ++ else if (dev_priv->vbt.psr.tp1_wakeup_time > 0) ++ val |= EDP_PSR_TP1_TIME_100us; ++ else ++ val |= EDP_PSR_TP1_TIME_0us; ++ ++ if (dev_priv->vbt.psr.tp2_tp3_wakeup_time > 5) ++ val |= EDP_PSR_TP2_TP3_TIME_2500us; ++ else if (dev_priv->vbt.psr.tp2_tp3_wakeup_time > 1) ++ val |= EDP_PSR_TP2_TP3_TIME_500us; ++ else if (dev_priv->vbt.psr.tp2_tp3_wakeup_time > 0) ++ val |= EDP_PSR_TP2_TP3_TIME_100us; ++ else ++ val |= EDP_PSR_TP2_TP3_TIME_0us; ++ ++ if (intel_dp_source_supports_hbr2(intel_dp) && ++ drm_dp_tps3_supported(intel_dp->dpcd)) ++ val |= EDP_PSR_TP1_TP3_SEL; ++ else ++ val |= EDP_PSR_TP1_TP2_SEL; ++ ++ I915_WRITE(EDP_PSR_CTL, val); ++ ++ if (!dev_priv->psr.psr2_support) ++ return; ++ ++ /* FIXME: selective update is probably totally broken because it doesn't ++ * mesh at all with our frontbuffer tracking. And the hw alone isn't ++ * good enough. */ ++ val = EDP_PSR2_ENABLE | EDP_SU_TRACK_ENABLE; ++ ++ if (dev_priv->vbt.psr.tp2_tp3_wakeup_time > 5) ++ val |= EDP_PSR2_TP2_TIME_2500; ++ else if (dev_priv->vbt.psr.tp2_tp3_wakeup_time > 1) ++ val |= EDP_PSR2_TP2_TIME_500; ++ else if (dev_priv->vbt.psr.tp2_tp3_wakeup_time > 0) ++ val |= EDP_PSR2_TP2_TIME_100; ++ else ++ val |= EDP_PSR2_TP2_TIME_50; ++ ++ I915_WRITE(EDP_PSR2_CTL, val); + } + + static bool intel_psr_match_conditions(struct intel_dp *intel_dp) diff --git a/queue-4.5/drm-imx-match-imx-ipuv3-crtc-components-using-device-node-in-platform-data.patch b/queue-4.5/drm-imx-match-imx-ipuv3-crtc-components-using-device-node-in-platform-data.patch new file mode 100644 index 00000000000..ab90c49c89f --- /dev/null +++ b/queue-4.5/drm-imx-match-imx-ipuv3-crtc-components-using-device-node-in-platform-data.patch @@ -0,0 +1,124 @@ +From 310944d148e3600dcff8b346bee7fa01d34903b1 Mon Sep 17 00:00:00 2001 +From: Philipp Zabel +Date: Thu, 12 May 2016 15:00:44 +0200 +Subject: drm/imx: Match imx-ipuv3-crtc components using device node in platform data +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Philipp Zabel + +commit 310944d148e3600dcff8b346bee7fa01d34903b1 upstream. + +The component master driver imx-drm-core matches component devices using +their of_node. Since commit 950b410dd1ab ("gpu: ipu-v3: Fix imx-ipuv3-crtc +module autoloading"), the imx-ipuv3-crtc dev->of_node is not set during +probing. Before that, of_node was set and caused an of: modalias to be +used instead of the platform: modalias, which broke module autoloading. + +On the other hand, if dev->of_node is not set yet when the imx-ipuv3-crtc +probe function calls component_add, component matching in imx-drm-core +fails. While dev->of_node will be set once the next component tries to +bring up the component master, imx-drm-core component binding will never +succeed if one of the crtc devices is probed last. + +Add of_node to the component platform data and match against the +pdata->of_node instead of dev->of_node in imx-drm-core to work around +this problem. + +Fixes: 950b410dd1ab ("gpu: ipu-v3: Fix imx-ipuv3-crtc module autoloading") +Signed-off-by: Philipp Zabel +Tested-by: Fabio Estevam +Tested-by: Lothar Waßmann +Tested-by: Heiko Schocher +Tested-by: Chris Ruehl +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/imx/imx-drm-core.c | 8 ++++++++ + drivers/gpu/drm/imx/ipuv3-crtc.c | 2 +- + drivers/gpu/ipu-v3/ipu-common.c | 5 +++-- + include/video/imx-ipu-v3.h | 2 ++ + 4 files changed, 14 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/imx/imx-drm-core.c ++++ b/drivers/gpu/drm/imx/imx-drm-core.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include