--- /dev/null
+From 41ccec352f3c823931a7d9d2a9c7880c14d7415a Mon Sep 17 00:00:00 2001
+From: Maarten Lankhorst <maarten.lankhorst@canonical.com>
+Date: Tue, 1 Apr 2014 15:15:47 +0200
+Subject: drm/qxl: unset a pointer in sync_obj_unref
+
+From: Maarten Lankhorst <maarten.lankhorst@canonical.com>
+
+commit 41ccec352f3c823931a7d9d2a9c7880c14d7415a upstream.
+
+This fixes a BUG_ON(bo->sync_obj != NULL); in ttm_bo_release_list.
+
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/qxl/qxl_ttm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/qxl/qxl_ttm.c
++++ b/drivers/gpu/drm/qxl/qxl_ttm.c
+@@ -431,6 +431,7 @@ static int qxl_sync_obj_flush(void *sync
+
+ static void qxl_sync_obj_unref(void **sync_obj)
+ {
++ *sync_obj = NULL;
+ }
+
+ static void *qxl_sync_obj_ref(void *sync_obj)
--- /dev/null
+From 16086279353cbfecbb3ead474072dced17b97ddc Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Mon, 31 Mar 2014 11:19:46 -0400
+Subject: drm/radeon: call drm_edid_to_eld when we update the edid
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit 16086279353cbfecbb3ead474072dced17b97ddc upstream.
+
+This needs to be done to update some of the fields in
+the connector structure used by the audio code.
+
+Noticed by several users on irc.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_display.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -729,6 +729,7 @@ int radeon_ddc_get_modes(struct radeon_c
+ if (radeon_connector->edid) {
+ drm_mode_connector_update_edid_property(&radeon_connector->base, radeon_connector->edid);
+ ret = drm_add_edid_modes(&radeon_connector->base, radeon_connector->edid);
++ drm_edid_to_eld(&radeon_connector->base, radeon_connector->edid);
+ return ret;
+ }
+ drm_mode_connector_update_edid_property(&radeon_connector->base, NULL);
--- /dev/null
+From aa6de142c901cd2d90ef08db30ae87da214bedcc Mon Sep 17 00:00:00 2001
+From: Christopher Friedt <chrisfriedt@gmail.com>
+Date: Sat, 1 Feb 2014 10:01:15 -0500
+Subject: drm/vmwgfx: correct fb_fix_screeninfo.line_length
+
+From: Christopher Friedt <chrisfriedt@gmail.com>
+
+commit aa6de142c901cd2d90ef08db30ae87da214bedcc upstream.
+
+Previously, the vmwgfx_fb driver would allow users to call FBIOSET_VINFO, but it would not adjust
+the FINFO properly, resulting in distorted screen rendering. The patch corrects that behaviour.
+
+See https://bugs.gentoo.org/show_bug.cgi?id=494794 for examples.
+
+Signed-off-by: Christopher Friedt <chrisfriedt@gmail.com>
+Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+@@ -147,7 +147,7 @@ static int vmw_fb_check_var(struct fb_va
+ }
+
+ if (!vmw_kms_validate_mode_vram(vmw_priv,
+- info->fix.line_length,
++ var->xres * var->bits_per_pixel/8,
+ var->yoffset + var->yres)) {
+ DRM_ERROR("Requested geom can not fit in framebuffer\n");
+ return -EINVAL;
+@@ -162,6 +162,8 @@ static int vmw_fb_set_par(struct fb_info
+ struct vmw_private *vmw_priv = par->vmw_priv;
+ int ret;
+
++ info->fix.line_length = info->var.xres * info->var.bits_per_pixel/8;
++
+ ret = vmw_kms_write_svga(vmw_priv, info->var.xres, info->var.yres,
+ info->fix.line_length,
+ par->bpp, par->depth);
+@@ -177,6 +179,7 @@ static int vmw_fb_set_par(struct fb_info
+ vmw_write(vmw_priv, SVGA_REG_DISPLAY_POSITION_Y, info->var.yoffset);
+ vmw_write(vmw_priv, SVGA_REG_DISPLAY_WIDTH, info->var.xres);
+ vmw_write(vmw_priv, SVGA_REG_DISPLAY_HEIGHT, info->var.yres);
++ vmw_write(vmw_priv, SVGA_REG_BYTES_PER_LINE, info->fix.line_length);
+ vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID);
+ }
+
--- /dev/null
+From cbd75e97a525e3819c02dc18bc2d67aa544c9e45 Mon Sep 17 00:00:00 2001
+From: Thomas Hellstrom <thellstrom@vmware.com>
+Date: Tue, 15 Apr 2014 18:25:48 +0200
+Subject: drm/vmwgfx: Make sure user-space can't DMA across buffer object boundaries v2
+
+From: Thomas Hellstrom <thellstrom@vmware.com>
+
+commit cbd75e97a525e3819c02dc18bc2d67aa544c9e45 upstream.
+
+We already check that the buffer object we're accessing is registered with
+the file. Now also make sure that we can't DMA across buffer object boundaries.
+
+v2: Code commenting update.
+
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -834,14 +834,36 @@ static int vmw_cmd_dma(struct vmw_privat
+ SVGA3dCmdSurfaceDMA dma;
+ } *cmd;
+ int ret;
++ SVGA3dCmdSurfaceDMASuffix *suffix;
++ uint32_t bo_size;
+
+ cmd = container_of(header, struct vmw_dma_cmd, header);
++ suffix = (SVGA3dCmdSurfaceDMASuffix *)((unsigned long) &cmd->dma +
++ header->size - sizeof(*suffix));
++
++ /* Make sure device and verifier stays in sync. */
++ if (unlikely(suffix->suffixSize != sizeof(*suffix))) {
++ DRM_ERROR("Invalid DMA suffix size.\n");
++ return -EINVAL;
++ }
++
+ ret = vmw_translate_guest_ptr(dev_priv, sw_context,
+ &cmd->dma.guest.ptr,
+ &vmw_bo);
+ if (unlikely(ret != 0))
+ return ret;
+
++ /* Make sure DMA doesn't cross BO boundaries. */
++ bo_size = vmw_bo->base.num_pages * PAGE_SIZE;
++ if (unlikely(cmd->dma.guest.ptr.offset > bo_size)) {
++ DRM_ERROR("Invalid DMA offset.\n");
++ return -EINVAL;
++ }
++
++ bo_size -= cmd->dma.guest.ptr.offset;
++ if (unlikely(suffix->maximumOffset > bo_size))
++ suffix->maximumOffset = bo_size;
++
+ ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
+ user_surface_converter, &cmd->dma.host.sid,
+ NULL);
usb-option-add-olivetti-olicard-500.patch
usb-option-add-alcatel-l800ma.patch
usb-option-add-and-update-a-number-of-cmotech-devices.patch
+drm-vmwgfx-correct-fb_fix_screeninfo.line_length.patch
+drm-vmwgfx-make-sure-user-space-can-t-dma-across-buffer-object-boundaries-v2.patch
+drm-qxl-unset-a-pointer-in-sync_obj_unref.patch
+drm-radeon-call-drm_edid_to_eld-when-we-update-the-edid.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
