From: Greg Kroah-Hartman Date: Wed, 21 May 2014 07:01:19 +0000 (+0900) Subject: 3.10-stable patches X-Git-Tag: v3.10.41~6 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=97d3ce26857d094df0c7467fb226ff534f519372;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: drm-qxl-unset-a-pointer-in-sync_obj_unref.patch drm-radeon-call-drm_edid_to_eld-when-we-update-the-edid.patch drm-vmwgfx-correct-fb_fix_screeninfo.line_length.patch drm-vmwgfx-make-sure-user-space-can-t-dma-across-buffer-object-boundaries-v2.patch --- diff --git a/queue-3.10/drm-qxl-unset-a-pointer-in-sync_obj_unref.patch b/queue-3.10/drm-qxl-unset-a-pointer-in-sync_obj_unref.patch new file mode 100644 index 00000000000..d7a396056ed --- /dev/null +++ b/queue-3.10/drm-qxl-unset-a-pointer-in-sync_obj_unref.patch @@ -0,0 +1,29 @@ +From 41ccec352f3c823931a7d9d2a9c7880c14d7415a Mon Sep 17 00:00:00 2001 +From: Maarten Lankhorst +Date: Tue, 1 Apr 2014 15:15:47 +0200 +Subject: drm/qxl: unset a pointer in sync_obj_unref + +From: Maarten Lankhorst + +commit 41ccec352f3c823931a7d9d2a9c7880c14d7415a upstream. + +This fixes a BUG_ON(bo->sync_obj != NULL); in ttm_bo_release_list. + +Signed-off-by: Maarten Lankhorst +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/qxl/qxl_ttm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/qxl/qxl_ttm.c ++++ b/drivers/gpu/drm/qxl/qxl_ttm.c +@@ -431,6 +431,7 @@ static int qxl_sync_obj_flush(void *sync + + static void qxl_sync_obj_unref(void **sync_obj) + { ++ *sync_obj = NULL; + } + + static void *qxl_sync_obj_ref(void *sync_obj) diff --git a/queue-3.10/drm-radeon-call-drm_edid_to_eld-when-we-update-the-edid.patch b/queue-3.10/drm-radeon-call-drm_edid_to_eld-when-we-update-the-edid.patch new file mode 100644 index 00000000000..b17b97a0f58 --- /dev/null +++ b/queue-3.10/drm-radeon-call-drm_edid_to_eld-when-we-update-the-edid.patch @@ -0,0 +1,35 @@ +From 16086279353cbfecbb3ead474072dced17b97ddc Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 31 Mar 2014 11:19:46 -0400 +Subject: drm/radeon: call drm_edid_to_eld when we update the edid +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +commit 16086279353cbfecbb3ead474072dced17b97ddc upstream. + +This needs to be done to update some of the fields in +the connector structure used by the audio code. + +Noticed by several users on irc. + +Signed-off-by: Alex Deucher +Signed-off-by: Christian König +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_display.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/radeon/radeon_display.c ++++ b/drivers/gpu/drm/radeon/radeon_display.c +@@ -729,6 +729,7 @@ int radeon_ddc_get_modes(struct radeon_c + if (radeon_connector->edid) { + drm_mode_connector_update_edid_property(&radeon_connector->base, radeon_connector->edid); + ret = drm_add_edid_modes(&radeon_connector->base, radeon_connector->edid); ++ drm_edid_to_eld(&radeon_connector->base, radeon_connector->edid); + return ret; + } + drm_mode_connector_update_edid_property(&radeon_connector->base, NULL); diff --git a/queue-3.10/drm-vmwgfx-correct-fb_fix_screeninfo.line_length.patch b/queue-3.10/drm-vmwgfx-correct-fb_fix_screeninfo.line_length.patch new file mode 100644 index 00000000000..ad0f39cd43b --- /dev/null +++ b/queue-3.10/drm-vmwgfx-correct-fb_fix_screeninfo.line_length.patch @@ -0,0 +1,50 @@ +From aa6de142c901cd2d90ef08db30ae87da214bedcc Mon Sep 17 00:00:00 2001 +From: Christopher Friedt +Date: Sat, 1 Feb 2014 10:01:15 -0500 +Subject: drm/vmwgfx: correct fb_fix_screeninfo.line_length + +From: Christopher Friedt + +commit aa6de142c901cd2d90ef08db30ae87da214bedcc upstream. + +Previously, the vmwgfx_fb driver would allow users to call FBIOSET_VINFO, but it would not adjust +the FINFO properly, resulting in distorted screen rendering. The patch corrects that behaviour. + +See https://bugs.gentoo.org/show_bug.cgi?id=494794 for examples. + +Signed-off-by: Christopher Friedt +Reviewed-by: Thomas Hellstrom +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +@@ -147,7 +147,7 @@ static int vmw_fb_check_var(struct fb_va + } + + if (!vmw_kms_validate_mode_vram(vmw_priv, +- info->fix.line_length, ++ var->xres * var->bits_per_pixel/8, + var->yoffset + var->yres)) { + DRM_ERROR("Requested geom can not fit in framebuffer\n"); + return -EINVAL; +@@ -162,6 +162,8 @@ static int vmw_fb_set_par(struct fb_info + struct vmw_private *vmw_priv = par->vmw_priv; + int ret; + ++ info->fix.line_length = info->var.xres * info->var.bits_per_pixel/8; ++ + ret = vmw_kms_write_svga(vmw_priv, info->var.xres, info->var.yres, + info->fix.line_length, + par->bpp, par->depth); +@@ -177,6 +179,7 @@ static int vmw_fb_set_par(struct fb_info + vmw_write(vmw_priv, SVGA_REG_DISPLAY_POSITION_Y, info->var.yoffset); + vmw_write(vmw_priv, SVGA_REG_DISPLAY_WIDTH, info->var.xres); + vmw_write(vmw_priv, SVGA_REG_DISPLAY_HEIGHT, info->var.yres); ++ vmw_write(vmw_priv, SVGA_REG_BYTES_PER_LINE, info->fix.line_length); + vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID); + } + diff --git a/queue-3.10/drm-vmwgfx-make-sure-user-space-can-t-dma-across-buffer-object-boundaries-v2.patch b/queue-3.10/drm-vmwgfx-make-sure-user-space-can-t-dma-across-buffer-object-boundaries-v2.patch new file mode 100644 index 00000000000..3b17d9b1f50 --- /dev/null +++ b/queue-3.10/drm-vmwgfx-make-sure-user-space-can-t-dma-across-buffer-object-boundaries-v2.patch @@ -0,0 +1,61 @@ +From cbd75e97a525e3819c02dc18bc2d67aa544c9e45 Mon Sep 17 00:00:00 2001 +From: Thomas Hellstrom +Date: Tue, 15 Apr 2014 18:25:48 +0200 +Subject: drm/vmwgfx: Make sure user-space can't DMA across buffer object boundaries v2 + +From: Thomas Hellstrom + +commit cbd75e97a525e3819c02dc18bc2d67aa544c9e45 upstream. + +We already check that the buffer object we're accessing is registered with +the file. Now also make sure that we can't DMA across buffer object boundaries. + +v2: Code commenting update. + +Signed-off-by: Thomas Hellstrom +Reviewed-by: Jakob Bornecrantz +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +@@ -834,14 +834,36 @@ static int vmw_cmd_dma(struct vmw_privat + SVGA3dCmdSurfaceDMA dma; + } *cmd; + int ret; ++ SVGA3dCmdSurfaceDMASuffix *suffix; ++ uint32_t bo_size; + + cmd = container_of(header, struct vmw_dma_cmd, header); ++ suffix = (SVGA3dCmdSurfaceDMASuffix *)((unsigned long) &cmd->dma + ++ header->size - sizeof(*suffix)); ++ ++ /* Make sure device and verifier stays in sync. */ ++ if (unlikely(suffix->suffixSize != sizeof(*suffix))) { ++ DRM_ERROR("Invalid DMA suffix size.\n"); ++ return -EINVAL; ++ } ++ + ret = vmw_translate_guest_ptr(dev_priv, sw_context, + &cmd->dma.guest.ptr, + &vmw_bo); + if (unlikely(ret != 0)) + return ret; + ++ /* Make sure DMA doesn't cross BO boundaries. */ ++ bo_size = vmw_bo->base.num_pages * PAGE_SIZE; ++ if (unlikely(cmd->dma.guest.ptr.offset > bo_size)) { ++ DRM_ERROR("Invalid DMA offset.\n"); ++ return -EINVAL; ++ } ++ ++ bo_size -= cmd->dma.guest.ptr.offset; ++ if (unlikely(suffix->maximumOffset > bo_size)) ++ suffix->maximumOffset = bo_size; ++ + ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, + user_surface_converter, &cmd->dma.host.sid, + NULL); diff --git a/queue-3.10/series b/queue-3.10/series index 825b56f0a69..cbcc2335240 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -31,3 +31,7 @@ usb-qcserial-add-sierra-wireless-mc7305-mc7355.patch usb-option-add-olivetti-olicard-500.patch usb-option-add-alcatel-l800ma.patch usb-option-add-and-update-a-number-of-cmotech-devices.patch +drm-vmwgfx-correct-fb_fix_screeninfo.line_length.patch +drm-vmwgfx-make-sure-user-space-can-t-dma-across-buffer-object-boundaries-v2.patch +drm-qxl-unset-a-pointer-in-sync_obj_unref.patch +drm-radeon-call-drm_edid_to_eld-when-we-update-the-edid.patch