linux-stable.git/drivers/gpu, branch v4.1.44

drm/msm: Verify that MSM_SUBMIT_BO_FLAGS are set

2017-09-10T20:35:54+00:00

[ Upstream commit a6cb3b864b21b7345f824a4faa12b723c8aaf099 ]

For every submission buffer object one of MSM_SUBMIT_BO_WRITE
and MSM_SUBMIT_BO_READ must be set (and nothing else). If we
allowed zero then the buffer object would never get queued to
be unreferenced.

Signed-off-by: Jordan Crouse 
Signed-off-by: Rob Clark 
Signed-off-by: Sasha Levin

drm/msm: Ensure that the hardware write pointer is valid

2017-09-10T20:35:53+00:00

[ Upstream commit 88b333b0ed790f9433ff542b163bf972953b74d3 ]

Currently the value written to CP_RB_WPTR is calculated on the fly as
(rb->next - rb->start). But as the code is designed rb->next is wrapped
before writing the commands so if a series of commands happened to
fit perfectly in the ringbuffer, rb->next would end up being equal to
rb->size / 4 and thus result in an out of bounds address to CP_RB_WPTR.

The easiest way to fix this is to mask WPTR when writing it to the
hardware; it makes the hardware happy and the rest of the ringbuffer
math appears to work and there isn't any point in upsetting anything.

Signed-off-by: Jordan Crouse 
[squash in is_power_of_2() check]
Signed-off-by: Rob Clark 

Signed-off-by: Sasha Levin

drm/rcar: Nuke preclose hook

2017-09-10T20:35:47+00:00

[ Upstream commit 0a346629f5304a8390004a91e8d4f1206b87792b ]

Again since the drm core takes care of event unlinking/disarming this
is now just needless code.

Cc: Laurent Pinchart 
Acked-by: Daniel Stone 
Reviewed-by: Alex Deucher 
Reviewed-by: Laurent Pinchart 
Signed-off-by: Daniel Vetter 
Link: http://patchwork.freedesktop.org/patch/msgid/1453756616-28942-10-git-send-email-daniel.vetter@ffwll.ch
Signed-off-by: Sasha Levin

drm/vmwgfx: Fix gcc-7.1.1 warning

2017-09-10T20:35:46+00:00

[ Upstream commit fcfffdd8f98ac305285dca568b5065ef86be6458 ]

The current code does not look correct, and the reason for it is
probably lost.  Since this now generates a compiler warning,
fix it to what makes sense.

Cc: 
Reported-by: Arnd Bergmann 
Reported-by: Linus Torvalds 
Signed-off-by: Sinclair Yeh 
Reviewed-by: Brian Paul 
Signed-off-by: Sasha Levin

drm/mst: Avoid processing partially received up/down message transactions

2017-09-10T20:35:44+00:00

[ Upstream commit 636c4c3e762b62aa93632c645ca65879285b16e3 ]

Currently we may process up/down message transactions containing
uninitialized data. This can happen if there was an error during the
reception of any message in the transaction, but we happened to receive
the last message correctly with the end-of-message flag set.

To avoid this abort the reception of the transaction when the first
error is detected, rejecting any messages until a message with the
start-of-message flag is received (which will start a new transaction).
This is also what the DP 1.4 spec 2.11.8.2 calls for in this case.

In addtion this also prevents receiving bogus transactions without the
first message with the the start-of-message flag set.

v2:
- unchanged
v3:
- git add the part that actually skips messages after an error in
  drm_dp_sideband_msg_build()

Cc: Dave Airlie 
Cc: Lyude 
Cc: Daniel Vetter 
Signed-off-by: Imre Deak 
Reviewed-by: Lyude 
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20170719134632.13366-1-imre.deak@intel.com
Signed-off-by: Sasha Levin

drm/mst: Avoid dereferencing a NULL mstb in drm_dp_mst_handle_up_req()

2017-09-10T20:35:44+00:00

[ Upstream commit 7f8b3987da54cb4d41ad2545cd4d7958b9a36bdf ]

In case of an unknown broadcast message is sent mstb will remain unset,
so check for this.

Cc: Dave Airlie 
Cc: Lyude 
Cc: Daniel Vetter 
Signed-off-by: Imre Deak 
Reviewed-by: Lyude 
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20170719114330.26540-3-imre.deak@intel.com
Signed-off-by: Sasha Levin

drm/mst: Fix error handling during MST sideband message reception

2017-09-10T20:35:44+00:00

[ Upstream commit 448421b5e93b9177c5698f0cf6f5e72d2995eeca ]

Handle any error due to partial reads, timeouts etc. to avoid parsing
uninitialized data subsequently. Also bail out if the parsing itself
fails.

Cc: Dave Airlie 
Cc: Lyude 
Cc: Daniel Vetter 
Signed-off-by: Imre Deak 
Reviewed-by: Lyude 
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20170719114330.26540-2-imre.deak@intel.com
Signed-off-by: Sasha Levin

drm/radeon: Fix eDP for single-display iMac10,1 (v2)

2017-09-10T14:59:17+00:00

[ Upstream commit 564d8a2cf3abf16575af48bdc3e86e92ee8a617d ]

The late 2009, 27 inch Apple iMac10,1 has an
internal eDP display and an external Mini-
Displayport output, driven by a DCE-3.2, RV730
Radeon Mobility HD-4670.

The machine worked fine in a dual-display setup
with eDP panel + externally connected HDMI
or DVI-D digital display sink, connected via
MiniDP to DVI or HDMI adapter.

However, booting the machine single-display with
only eDP panel results in a completely black
display - even backlight powering off, as soon as
the radeon modesetting driver loads.

This patch fixes the single dispay eDP case by
assigning encoders based on dig->linkb, similar
to DCE-4+. While this should not be generally
necessary (Alex: "...atom on normal boards
should be able to handle any mapping."), Apple
seems to use some special routing here.

One remaining problem not solved by this patch
is that an external Minidisplayport->DP sink
does still not work on iMac10,1, whereas external
DVI and HDMI sinks continue to work.

The problem affects at least all tested kernels
since Linux 3.13 - didn't test earlier kernels, so
backporting to stable probably makes sense.

v2: With the original patch from 2016, Alex was worried it
    will break other DCE3.2 systems. Use dmi_match() to
    apply this special encoder assignment only for the
    Apple iMac 10,1 from late 2009.

Signed-off-by: Mario Kleiner 
Cc: Alex Deucher 
Cc: Michel Dänzer 
Cc: 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin

drm/vmwgfx: Free hash table allocated by cmdbuf managed res mgr

2017-07-31T17:37:49+00:00

[ Upstream commit 82fcee526ba8ca2c5d378bdf51b21b7eb058fe3a ]

The hash table created during vmw_cmdbuf_res_man_create was
never freed. This causes memory leak in context creation.
Added the corresponding drm_ht_remove in vmw_cmdbuf_res_man_destroy.

Tested for memory leak by running piglit overnight and kernel
memory is not inflated which earlier was.

Cc: 
Signed-off-by: Deepak Rawat 
Reviewed-by: Sinclair Yeh 
Signed-off-by: Thomas Hellstrom 
Signed-off-by: Sasha Levin

drm/ast: Handle configuration without P2A bridge

2017-07-31T17:37:49+00:00

[ Upstream commit 71f677a91046599ece96ebab21df956ce909c456 ]

The ast driver configures a window to enable access into BMC
memory space in order to read some configuration registers.

If this window is disabled, which it can be from the BMC side,
the ast driver can't function.

Closing this window is a necessity for security if a machine's
host side and BMC side are controlled by different parties;
i.e. a cloud provider offering machines "bare metal".

A recent patch went in to try to check if that window is open
but it does so by trying to access the registers in question
and testing if the result is 0xffffffff.

This method will trigger a PCIe error when the window is closed
which on some systems will be fatal (it will trigger an EEH
for example on POWER which will take out the device).

This patch improves this in two ways:

 - First, if the firmware has put properties in the device-tree
containing the relevant configuration information, we use these.

 - Otherwise, a bit in one of the SCU scratch registers (which
are readable via the VGA register space and writeable by the BMC)
will indicate if the BMC has closed the window. This bit has been
defined by Y.C Chen from Aspeed.

If the window is closed and the configuration isn't available from
the device-tree, some sane defaults are used. Those defaults are
hopefully sufficient for standard video modes used on a server.

Signed-off-by: Russell Currey 
Acked-by: Joel Stanley 
Cc: 
Signed-off-by: Benjamin Herrenschmidt 
Signed-off-by: Dave Airlie 
Signed-off-by: Sasha Levin