linux-stable.git/drivers/gpu/drm, branch v3.2.89

drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl()

2017-06-05T20:13:53+00:00

commit e7e11f99564222d82f0ce84bd521e57d78a6b678 upstream.

In vmw_surface_define_ioctl(), the 'num_sizes' is the sum of the
'req->mip_levels' array. This array can be assigned any value from
the user space. As both the 'num_sizes' and the array is uint32_t,
it is easy to make 'num_sizes' overflow. The later 'mip_levels' is
used as the loop count. This can lead an oob write. Add the check of
'req->mip_levels' to avoid this.

Signed-off-by: Li Qiang 
Reviewed-by: Thomas Hellstrom 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings

drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl()

2017-06-05T20:13:53+00:00

commit 36274ab8c596f1240c606bb514da329add2a1bcd upstream.

Before memory allocations vmw_surface_define_ioctl() checks the
upper-bounds of a user-supplied size, but does not check if the
supplied size is 0.

Add check to avoid NULL pointer dereferences.

Signed-off-by: Murray McAllister 
Reviewed-by: Sinclair Yeh 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings

drm/radeon: handle vfct with multiple vbios images

2017-06-05T20:13:45+00:00

commit a882f5de402ded769af74fbf276132f9c175049c upstream.

The vfct table can contain multiple vbios images if the
platform contains multiple GPUs. Noticed by netkas on
phoronix forums.  This patch fixes those platforms.

Signed-off-by: Alex Deucher 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings

drm/ttm: Make sure BOs being swapped out are cacheable

2017-06-05T20:13:44+00:00

commit 239ac65fa5ffab71adf66e642750f940e7241d99 upstream.

The current caching state may not be tt_cached, even though the
placement contains TTM_PL_FLAG_CACHED, because placement can contain
multiple caching flags. Trying to swap out such a BO would trip up the

	BUG_ON(ttm->caching_state != tt_cached);

in ttm_tt_swapout.

Signed-off-by: Michel Dänzer 
Reviewed-by: Thomas Hellstrom 
Reviewed-by: Christian König .
Reviewed-by: Sinclair Yeh 
Signed-off-by: Christian König 
Signed-off-by: Ben Hutchings

drm: Reject page_flip for !DRIVER_MODESET

2016-11-20T01:01:34+00:00

commit 6f00975c619064a18c23fd3aced325ae165a73b9 upstream.

Somehow this one slipped through, which means drivers without modeset
support can be oopsed (since those also don't call
drm_mode_config_init, which means the crtc lookup will chase an
uninitalized idr).

Reported-by: Alexander Potapenko 
Cc: Alexander Potapenko 
Signed-off-by: Daniel Vetter 
Reviewed-by: Chris Wilson 
Signed-off-by: Dave Airlie 
Signed-off-by: Ben Hutchings

drm/radeon: fix radeon_move_blit on 32bit systems

2016-11-20T01:01:33+00:00

commit 13f479b9df4e2bbf2d16e7e1b02f3f55f70e2455 upstream.

This bug seems to be present for a very long time.

Signed-off-by: Christian König 
Reviewed-by: Alex Deucher 
Signed-off-by: Alex Deucher 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings

drm/edid: Add 6 bpc quirk for display AEO model 0.

2016-11-20T01:01:31+00:00

commit e10aec652f31ec61d6a0b4d00d8ef8d2b66fa0fd upstream.

Bugzilla https://bugzilla.kernel.org/show_bug.cgi?id=105331
reports that the "AEO model 0" display is driven with 8 bpc
without dithering by default, which looks bad because that
panel is apparently a 6 bpc DP panel with faulty EDID.

A fix for this was made by commit 013dd9e03872
("drm/i915/dp: fall back to 18 bpp when sink capability is unknown").

That commit triggers new regressions in precision for DP->DVI and
DP->VGA displays. A patch is out to revert that commit, but it will
revert video output for the AEO model 0 panel to 8 bpc without
dithering.

The EDID 1.3 of that panel, as decoded from the xrandr output
attached to that bugzilla bug report, is somewhat faulty, and beyond
other problems also sets the "DFP 1.x compliant TMDS" bit, which
according to DFP spec means to drive the panel with 8 bpc and
no dithering in absence of other colorimetry information.

Try to make the original bug reporter happy despite the
faulty EDID by adding a quirk to mark that panel as 6 bpc,
so 6 bpc output with dithering creates a nice picture.

Tested by injecting the edid from the fdo bug into a DP connector
via drm_kms_helper.edid_firmware and verifying the 6 bpc + dithering
is selected.

This patch should be backported to stable.

Signed-off-by: Mario Kleiner 
Cc: Jani Nikula 
Cc: Ville Syrjälä 
Cc: Daniel Vetter 
Signed-off-by: Dave Airlie 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings

drm/radeon: fix firmware info version checks

2016-11-20T01:01:29+00:00

commit 3edc38a0facef45ee22af8afdce3737f421f36ab upstream.

Some of the checks didn't handle frev 2 tables properly.

Signed-off-by: Alex Deucher 
Signed-off-by: Ben Hutchings

drm/radeon: Poll for both connect/disconnect on analog connectors

2016-11-20T01:01:24+00:00

commit 14ff8d48f2235295dfb3117693008e367b49cdb5 upstream.

DRM_CONNECTOR_POLL_CONNECT only enables polling for connections, not
disconnections. Because of this, we end up losing hotplug polling for
analog connectors once they get connected.

Easy way to reproduce:
 - Grab a machine with a radeon GPU and a VGA port
 - Plug a monitor into the VGA port, wait for it to update the connector
   from disconnected to connected
 - Disconnect the monitor on VGA, a hotplug event is never sent for the
   removal of the connector.

Originally, only using DRM_CONNECTOR_POLL_CONNECT might have been a good
idea since doing VGA polling can sometimes result in having to mess with
the DAC voltages to figure out whether or not there's actually something
there since VGA doesn't have HPD. Doing this would have the potential of
showing visible artifacts on the screen every time we ran a poll while a
VGA display was connected. Luckily, radeon_vga_detect() only resorts to
this sort of polling if the poll is forced, and DRM's polling helper
doesn't force it's polls.

Additionally, this removes some assignments to connector->polled that
weren't actually doing anything.

Signed-off-by: Lyude 
Signed-off-by: Alex Deucher 
Signed-off-by: Ben Hutchings

drm/radeon: fix asic initialization for virtualized environments

2016-08-22T21:37:14+00:00

commit 05082b8bbd1a0ffc74235449c4b8930a8c240f85 upstream.

When executing in a PCI passthrough based virtuzliation environment, the
hypervisor will usually attempt to send a PCIe bus reset signal to the
ASIC when the VM reboots. In this scenario, the card is not correctly
initialized, but we still consider it to be posted. Therefore, in a
passthrough based environemnt we should always post the card to guarantee
it is in a good state for driver initialization.

Ported from amdgpu commit:
amdgpu: fix asic initialization for virtualized environments

Cc: Andres Rodriguez 
Cc: Alex Williamson 
Signed-off-by: Alex Deucher 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings