08 Jun, 2017

1 commit

  • 1. unique need to be set to get proper busid.
    Vivante driver is very simple and does not use drm_dev_alloc
    which in turn calls drm_dev_set_unique.
    Use set_busid to set the unique.

    https://patchwork.kernel.org/patch/9182749/

    2. driver_features = DRIVER_LEGACY added to do mmap of SHM.
    https://patchwork.kernel.org/patch/8694561/

    fix the problem that X11 cannot work with 4.9 kernel upgrade

    Signed-off-by: Prabhu Sundararaj

    Prabhu Sundararaj
     

23 Feb, 2017

2 commits


15 Feb, 2017

4 commits

  • commit 6e7eb1783be7f19eb071c96ddda0bbf22279ff46 upstream.

    We're using non-canonical addresses in drm_mm, and we're making sure that
    userspace is using canonical addressing - both in case of softpin
    (verifying incoming offset) and when relocating (converting to canonical
    when updating offset returned to userspace).
    Unfortunately when considering the need for relocations, we're comparing
    offset from userspace (in canonical form) with drm_mm node (in
    non-canonical form), and as a result, we end up always relocating if our
    offsets are in the "problematic" range.
    Let's always convert the offsets to avoid the performance impact of
    relocations.

    Fixes: a5f0edf63bdf ("drm/i915: Avoid writing relocs with addresses in non-canonical form")
    Cc: Chris Wilson
    Cc: Michel Thierry
    Reported-by: Michał Pyrzowski
    Signed-off-by: Michał Winiarski
    Link: http://patchwork.freedesktop.org/patch/msgid/20170207195559.18798-1-michal.winiarski@intel.com
    Reviewed-by: Chris Wilson
    Signed-off-by: Chris Wilson
    (cherry picked from commit 038c95a313e4ca954ee5ab8a0c7559a646b0f462)
    Signed-off-by: Jani Nikula
    Signed-off-by: Greg Kroah-Hartman

    Michał Winiarski
     
  • commit 92c715fca907686f5298220ece53423e38ba3aed upstream.

    drm_atomic_helper_page_flip and drm_atomic_ioctl set their own events
    in crtc_state->event. But when it's set the event is freed in 2 places.

    Solve this by only freeing the event in the atomic ioctl when it
    allocated its own event.

    This has been broken twice. The first time when the code was introduced,
    but only in the corner case when an event is allocated, but more crtc's
    were included by atomic check and then failing. This can mostly
    happen when you do an atomic modeset in i915 and the display clock is
    changed, which forces all crtc's to be included to the state.

    This has been broken worse by adding in-fences support, which caused
    the double free to be done unconditionally.

    [IGT] kms_rotation_crc: starting subtest primary-rotation-180
    =============================================================================
    BUG kmalloc-128 (Tainted: G U ): Object already free
    -----------------------------------------------------------------------------

    Disabling lock debugging due to kernel taint
    INFO: Allocated in drm_atomic_helper_setup_commit+0x285/0x2f0 [drm_kms_helper] age=0 cpu=3 pid=1529
    ___slab_alloc+0x308/0x3b0
    __slab_alloc+0xd/0x20
    kmem_cache_alloc_trace+0x92/0x1c0
    drm_atomic_helper_setup_commit+0x285/0x2f0 [drm_kms_helper]
    intel_atomic_commit+0x35/0x4f0 [i915]
    drm_atomic_commit+0x46/0x50 [drm]
    drm_mode_atomic_ioctl+0x7d4/0xab0 [drm]
    drm_ioctl+0x2b3/0x490 [drm]
    do_vfs_ioctl+0x69c/0x700
    SyS_ioctl+0x4e/0x80
    entry_SYSCALL_64_fastpath+0x13/0x94
    INFO: Freed in drm_event_cancel_free+0xa3/0xb0 [drm] age=0 cpu=3 pid=1529
    __slab_free+0x48/0x2e0
    kfree+0x159/0x1a0
    drm_event_cancel_free+0xa3/0xb0 [drm]
    drm_mode_atomic_ioctl+0x86d/0xab0 [drm]
    drm_ioctl+0x2b3/0x490 [drm]
    do_vfs_ioctl+0x69c/0x700
    SyS_ioctl+0x4e/0x80
    entry_SYSCALL_64_fastpath+0x13/0x94
    INFO: Slab 0xffffde1f0997b080 objects=17 used=2 fp=0xffff92fb65ec2578 flags=0x200000000008101
    INFO: Object 0xffff92fb65ec2578 @offset=1400 fp=0xffff92fb65ec2ae8

    Redzone ffff92fb65ec2570: bb bb bb bb bb bb bb bb ........
    Object ffff92fb65ec2578: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
    Object ffff92fb65ec2588: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
    Object ffff92fb65ec2598: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
    Object ffff92fb65ec25a8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
    Object ffff92fb65ec25b8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
    Object ffff92fb65ec25c8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
    Object ffff92fb65ec25d8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
    Object ffff92fb65ec25e8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 kkkkkkkkkkkkkkk.
    Redzone ffff92fb65ec25f8: bb bb bb bb bb bb bb bb ........
    Padding ffff92fb65ec2738: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ
    CPU: 3 PID: 180 Comm: kworker/3:2 Tainted: G BU 4.10.0-rc6-patser+ #5039
    Hardware name: /NUC5PPYB, BIOS PYBSWCEL.86A.0031.2015.0601.1712 06/01/2015
    Workqueue: events intel_atomic_helper_free_state [i915]
    Call Trace:
    dump_stack+0x4d/0x6d
    print_trailer+0x20c/0x220
    free_debug_processing+0x1c6/0x330
    ? drm_atomic_state_default_clear+0xf7/0x1c0 [drm]
    __slab_free+0x48/0x2e0
    ? drm_atomic_state_default_clear+0xf7/0x1c0 [drm]
    kfree+0x159/0x1a0
    drm_atomic_state_default_clear+0xf7/0x1c0 [drm]
    ? drm_atomic_state_clear+0x30/0x30 [drm]
    intel_atomic_state_clear+0xd/0x20 [i915]
    drm_atomic_state_clear+0x1a/0x30 [drm]
    __drm_atomic_state_free+0x13/0x60 [drm]
    intel_atomic_helper_free_state+0x5d/0x70 [i915]
    process_one_work+0x260/0x4a0
    worker_thread+0x2d1/0x4f0
    kthread+0x127/0x130
    ? process_one_work+0x4a0/0x4a0
    ? kthread_stop+0x120/0x120
    ret_from_fork+0x29/0x40
    FIX kmalloc-128: Object at 0xffff92fb65ec2578 not freed

    Fixes: 3b24f7d67581 ("drm/atomic: Add struct drm_crtc_commit to track async updates")
    Fixes: 9626014258a5 ("drm/fence: add in-fences support")
    Cc: Daniel Vetter
    Signed-off-by: Maarten Lankhorst
    Reviewed-by: Daniel Vetter
    Reviewed-by: Gustavo Padovan
    Signed-off-by: Daniel Vetter
    Link: http://patchwork.freedesktop.org/patch/msgid/1485854725-27640-1-git-send-email-maarten.lankhorst@linux.intel.com
    CC: koos vriezen
    Signed-off-by: Greg Kroah-Hartman

    Maarten Lankhorst
     
  • commit 789ea12500e5ce3911d0a6a822277c3133451927 upstream.

    Add the missing INTEL_OUTPUT_DP_MST case in bxt_get_dpll()
    to correctly initialize the crtc_state and port plls when
    link training a DP MST monitor on BXT/APL devices.

    Fixes: a277ca7dc01d ("drm/i915: Split bxt_ddi_pll_select()")
    Bugs: https://bugs.freedesktop.org/show_bug.cgi?id=99572
    Reviewed-by: Cooper Chiou
    Reviewed-by: Gary C Wang
    Reviewed-by: Ciobanu, Nathan D
    Reviewed-by: Herbert, Marc
    Reviewed-by: Bride, Jim
    Reviewed-by: Navare, Manasi D
    Cc: Jani Nikula
    Signed-off-by: Lee, Shawn C
    Signed-off-by: Jani Nikula
    Link: http://patchwork.freedesktop.org/patch/msgid/1486096329-6255-1-git-send-email-shawn.c.lee@intel.com
    (cherry picked from commit 0aab2c721d81590012a5021a516f00666646741f)
    Signed-off-by: Jani Nikula
    Signed-off-by: Greg Kroah-Hartman

    Lee, Shawn C
     
  • commit 5351fbb1bf1413f6024892093528280769ca852f upstream.

    page_flip_completed() dereferences 'work' variable after executing
    queue_work(). This is not safe as the 'work' item might be already freed
    by queued work:

    BUG: KASAN: use-after-free in page_flip_completed+0x3ff/0x490 at addr ffff8803dc010f90
    Call Trace:
    __asan_report_load8_noabort+0x59/0x80
    page_flip_completed+0x3ff/0x490
    intel_finish_page_flip_mmio+0xe3/0x130
    intel_pipe_handle_vblank+0x2d/0x40
    gen8_irq_handler+0x4a7/0xed0
    __handle_irq_event_percpu+0xf6/0x860
    handle_irq_event_percpu+0x6b/0x160
    handle_irq_event+0xc7/0x1b0
    handle_edge_irq+0x1f4/0xa50
    handle_irq+0x41/0x70
    do_IRQ+0x9a/0x200
    common_interrupt+0x89/0x89

    Freed:
    kfree+0x113/0x4d0
    intel_unpin_work_fn+0x29a/0x3b0
    process_one_work+0x79e/0x1b70
    worker_thread+0x611/0x1460
    kthread+0x241/0x3a0
    ret_from_fork+0x27/0x40

    Move queue_work() after trace_i915_flip_complete() to fix this.

    Fixes: e5510fac98a7 ("drm/i915: add tracepoints for flip requests & completions")
    Signed-off-by: Andrey Ryabinin
    Reviewed-by: Chris Wilson
    Signed-off-by: Daniel Vetter
    Link: http://patchwork.freedesktop.org/patch/msgid/20170126143211.24013-1-aryabinin@virtuozzo.com
    (cherry picked from commit 05c41f926fcc7ef838c80a6a99d84f67b4e0b824)
    Signed-off-by: Jani Nikula
    Signed-off-by: Greg Kroah-Hartman

    Andrey Ryabinin
     

09 Feb, 2017

4 commits

  • commit bafb2f7d4755bf1571bd5e9a03b97f3fc4fe69ae upstream.

    There is a disparity in the context image saved to disk and our own
    bookkeeping - that is we presume the RING_HEAD and RING_TAIL match our
    stored ce->ring->tail value. However, as we emit WA_TAIL_DWORDS into the
    ring but may not tell the GPU about them, the GPU may be lagging behind
    our bookkeeping. Upon hibernation we do not save stolen pages, presuming
    that their contents are volatile. This means that although we start
    writing into the ring at tail, the GPU starts executing from its HEAD
    and there may be some garbage in between and so the GPU promptly hangs
    upon resume.

    Testcase: igt/gem_exec_suspend/basic-S4
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=96526
    Signed-off-by: Chris Wilson
    Reviewed-by: Joonas Lahtinen
    Link: http://patchwork.freedesktop.org/patch/msgid/20160921135108.29574-3-chris@chris-wilson.co.uk
    Cc: Eric Blau
    Signed-off-by: Greg Kroah-Hartman

    Chris Wilson
     
  • commit 24bf7ae359b8cca165bb30742d2b1c03a1eb23af upstream.

    Based on the xf86-video-nv code, NFORCE (NV1A) and NFORCE2 (NV1F) have a
    different way of retrieving clocks. See the
    nv_hw.c:nForceUpdateArbitrationSettings function in the original code
    for how these clocks were accessed.

    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=54587
    Signed-off-by: Ilia Mirkin
    Signed-off-by: Ben Skeggs
    Signed-off-by: Greg Kroah-Hartman

    Ilia Mirkin
     
  • commit d347583a39e2df609a9e40c835f72d3614665b53 upstream.

    Store the ELD correctly, not just enough copies of the first byte
    to pad out the given ELD size.

    Signed-off-by: Alastair Bridgewater
    Fixes: 120b0c39c756 ("drm/nv50-/disp: audit and version SOR_HDA_ELD method")
    Reviewed-by: Ilia Mirkin
    Signed-off-by: Ben Skeggs
    Signed-off-by: Greg Kroah-Hartman

    Alastair Bridgewater
     
  • commit 57bcd0a6364cd4eaa362d7ff1777e88ddf501602 upstream.

    Missing check for crtcs present.

    Fixes:
    https://bugzilla.kernel.org/show_bug.cgi?id=193341
    https://bugs.freedesktop.org/show_bug.cgi?id=99387

    Reviewed-by: Christian König
    Signed-off-by: Alex Deucher
    Signed-off-by: Alex Deucher
    Signed-off-by: Greg Kroah-Hartman

    Alex Deucher
     

01 Feb, 2017

16 commits

  • commit 4fc020d864647ea3ae8cb8f17d63e48e87ebd0bf upstream.

    The WaDisableLSQCROPERFforOCL workaround has the side effect of
    disabling an L3SQ optimization that has huge performance implications
    and is unlikely to be necessary for the correct functioning of usual
    graphic workloads. Userspace is free to re-enable the workaround on
    demand, and is generally in a better position to determine whether the
    workaround is necessary than the DRM is (e.g. only during the
    execution of compute kernels that rely on both L3 fences and HDC R/W
    requests).

    The same workaround seems to apply to BDW (at least to production
    stepping G1) and SKL as well (the internal workaround database claims
    that it does for all steppings, while the BSpec workaround table only
    mentions pre-production steppings), but the DRM doesn't do anything
    beyond whitelisting the L3SQCREG4 register so userspace can enable it
    when it sees fit. Do the same on KBL platforms.

    Improves performance of the GFXBench4 gl_manhattan31 benchmark by 60%,
    and gl_4 (AKA car chase) by 14% on a KBL GT2 running Mesa master --
    This is followed by a regression of 35% and 10% respectively for the
    same benchmarks and platform caused by my recent patch series
    switching userspace to use the dataport constant cache instead of the
    sampler to implement uniform pull constant loads, which caused us to
    hit more heavily the L3 cache (and on platforms other than KBL had the
    opposite effect of improving performance of the same two benchmarks).
    The overall effect on KBL of this change combined with the recent
    userspace change is respectively 4.6% and 2.6%. SynMark2 OglShMapPcf
    was affected by the constant cache changes (though it improved as it
    did on other platforms rather than regressing), but is not
    significantly affected by this patch (with statistical significance of
    5% and sample size 20).

    v2: Drop some more code to avoid unused variable warning.

    Fixes: 738fa1b3123f ("drm/i915/kbl: Add WaDisableLSQCROPERFforOCL")
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=99256
    Signed-off-by: Francisco Jerez
    Cc: Matthew Auld
    Cc: Eero Tamminen
    Cc: Jani Nikula
    Cc: Mika Kuoppala
    Cc: beignet@lists.freedesktop.org
    Reviewed-by: Mika Kuoppala
    [Removed double Fixes tag]
    Signed-off-by: Mika Kuoppala
    Link: http://patchwork.freedesktop.org/patch/msgid/1484217894-20505-1-git-send-email-mika.kuoppala@intel.com
    (cherry picked from commit 8726f2faa371514fba2f594d799db95203dfeee0)
    Signed-off-by: Jani Nikula
    [ Francisco Jerez: Rebase on v4.9 branch. ]
    Signed-off-by: Francisco Jerez
    Signed-off-by: Greg Kroah-Hartman

    Francisco Jerez
     
  • commit 6d1d427a4e24c403b4adf928d61994bdaa0ca03a upstream.

    In intel_crtc_disable_noatomic(), bail on a failure to allocate an
    atomic state to avoid a NULL pointer dereference.

    Fixes: 4a80655827af ("drm/i915: Pass atomic state to crtc enable/disable functions")
    Cc: Maarten Lankhorst
    Cc: Daniel Vetter
    Cc: Daniel Vetter
    Cc: Jani Nikula
    Cc: intel-gfx@lists.freedesktop.org
    Signed-off-by: Ander Conselvan de Oliveira
    Reviewed-by: Ville Syrjälä
    Link: http://patchwork.freedesktop.org/patch/msgid/1484922525-6131-4-git-send-email-ander.conselvan.de.oliveira@intel.com
    (cherry picked from commit 31bb2ef97ea9db343348f9b5ccaa9bb6f48fc655)
    Signed-off-by: Jani Nikula
    Signed-off-by: Greg Kroah-Hartman

    Ander Conselvan de Oliveira
     
  • commit 3781bd6e7d64d5f5bea9fdee11ab9460a700c0e4 upstream.

    Parameters tile_size, tile_width and tile_height were passed in the
    wrong order to _intel_adjust_tile_offset() when calculating the rotated
    offsets.

    This doesn't fix any user visible bug, since for packed formats new
    and old offset are the same and the rotated offsets are within a tile
    before they are fed to _intel_adjust_tile_offset(). In that case, the
    offsets are unchanged. That is not true for planar formats, but those
    are currently not supported.

    Fixes: 66a2d927cb0e ("drm/i915: Make intel_adjust_tile_offset() work for linear buffers")
    Cc: Ville Syrjälä
    Cc: Sivakumar Thulasimani
    Cc: Daniel Vetter
    Cc: Jani Nikula
    Cc: intel-gfx@lists.freedesktop.org
    Signed-off-by: Ander Conselvan de Oliveira
    Reviewed-by: Ville Syrjälä
    Link: http://patchwork.freedesktop.org/patch/msgid/1484922525-6131-3-git-send-email-ander.conselvan.de.oliveira@intel.com
    (cherry picked from commit 46a1bd289507dfcc428fb9daf65421ed6be6af8b)
    Signed-off-by: Jani Nikula
    Signed-off-by: Greg Kroah-Hartman

    Ander Conselvan de Oliveira
     
  • commit 21d6e0bde50713922a6520ef84e5fd245b05d468 upstream.

    An error in the condition for avoiding the call to intel_hpd_poll_init()
    for valleyview and cherryview from intel_runtime_suspend() caused it to
    be called unconditionally. Fix it.

    Fixes: 19625e85c6ec ("drm/i915: Enable polling when we don't have hpd")
    Cc: Ville Syrjälä
    Cc: Daniel Vetter
    Cc: Lyude
    Cc: Daniel Vetter
    Cc: Jani Nikula
    Cc: intel-gfx@lists.freedesktop.org
    Signed-off-by: Ander Conselvan de Oliveira
    Reviewed-by: Ville Syrjälä
    Link: http://patchwork.freedesktop.org/patch/msgid/1484922525-6131-2-git-send-email-ander.conselvan.de.oliveira@intel.com
    (cherry picked from commit 04313b00b79405f86d815100f85c47a2ee5b8ca0)
    Signed-off-by: Jani Nikula
    Signed-off-by: Greg Kroah-Hartman

    Ander Conselvan de Oliveira
     
  • commit c34f078675f505c4437919bb1897b1351f16a050 upstream.

    In the path where intel_crt_detect_ddc() detects a CRT, if would return
    true without freeing the edid.

    Fixes: a2bd1f541f19 ("drm/i915: check whether we actually received an edid in detect_ddc")
    Cc: Chris Wilson
    Cc: Daniel Vetter
    Cc: Daniel Vetter
    Cc: Jani Nikula
    Cc: intel-gfx@lists.freedesktop.org
    Signed-off-by: Ander Conselvan de Oliveira
    Reviewed-by: Ville Syrjälä
    Reviewed-by: Jani Nikula
    Link: http://patchwork.freedesktop.org/patch/msgid/1484922525-6131-1-git-send-email-ander.conselvan.de.oliveira@intel.com
    (cherry picked from commit c96b63a6a7ac4bd670ec2e663793a9a31418b790)
    Signed-off-by: Jani Nikula
    Signed-off-by: Greg Kroah-Hartman

    Ander Conselvan de Oliveira
     
  • commit 27892bbdc9233f33bf0f44e08aab8f12e0dec142 upstream.

    The .disable_display parameter was causing a fatal crash when fbdev
    was dereferenced during driver init.

    V1: protection in i915_drv.c
    V2: Moved protection to intel_fbdev.c

    Fixes: 43cee314345a ("drm/i915/fbdev: Limit the global async-domain synchronization")
    Testcase: igt/drv_module_reload/basic-no-display
    Cc: Chris Wilson
    Signed-off-by: Clint Taylor
    Link: http://patchwork.freedesktop.org/patch/msgid/1484775523-29428-1-git-send-email-clinton.a.taylor@intel.com
    Reviewed-by: Chris Wilson
    Cc: Lukas Wunner
    Cc: Daniel Vetter
    Cc: Jani Nikula
    Signed-off-by: Chris Wilson
    (cherry picked from commit 5b8cd0755f8a06a851c436a013e7be0823fb155a)
    Signed-off-by: Jani Nikula
    Signed-off-by: Greg Kroah-Hartman

    Clint Taylor
     
  • commit e88893fea17996018b2d68a22e677ea04f3baadf upstream.

    Missed when rebasing patches, I failed to set ret to zero before
    starting the unbind loop (which depends upon ret being zero).

    Reported-by: Matthew Auld
    Fixes: 9332f3b1b99a ("drm/i915: Combine loops within i915_gem_evict_something")
    Signed-off-by: Chris Wilson
    Cc: Matthew Auld
    Link: http://patchwork.freedesktop.org/patch/msgid/20170105155940.10033-1-chris@chris-wilson.co.uk
    Reviewed-by: Matthew Auld
    (cherry picked from commit 121dfbb2a2ef1c5f49e15c38ccc47ff0beb59446)
    Signed-off-by: Jani Nikula
    Signed-off-by: Greg Kroah-Hartman

    Chris Wilson
     
  • [Fixed differently in 4.10]

    The fence needs to be cleared out, otherwise the following commit
    might wait on a stale fence from the previous commit. This was fixed
    as a side effect of 9626014258a5 (drm/fence: add in-fences support)
    in kernel 4.10.

    As this commit introduces new functionality and as such can not be
    applied to stable, this patch is the minimal fix for the kernel 4.9
    stable series.

    Signed-off-by: Lucas Stach
    Reviewed-by: Daniel Vetter
    Tested-by: Fabio Estevam
    Signed-off-by: Greg Kroah-Hartman

    Lucas Stach
     
  • commit b9b487e494712c8e5905b724e12f5ef17e9ae6f9 upstream.

    This seems to break reboot on some evergreen systems.

    bugs:
    https://bugs.freedesktop.org/show_bug.cgi?id=99524
    https://bugzilla.kernel.org/show_bug.cgi?id=192271

    This reverts commit a481daa88fd4d6b54f25348972bba10b5f6a84d0.

    Signed-off-by: Alex Deucher
    Signed-off-by: Greg Kroah-Hartman

    Alex Deucher
     
  • commit 21ccc32496b2f63228f5232b3ac0e426e8fb3c31 upstream.

    We accidentally return success even if vc4_full_res_bounds_check() fails.

    Fixes: d5b1a78a772f ("drm/vc4: Add support for drawing 3D frames.")
    Signed-off-by: Dan Carpenter
    Reviewed-by: Eric Engestrom
    Reviewed-by: Eric Anholt
    Signed-off-by: Greg Kroah-Hartman

    Dan Carpenter
     
  • commit 6b8ac63847bc2f958dd93c09edc941a0118992d9 upstream.

    By failing to set the errno, we'd continue on to trying to set up the
    RCL, and then oops on trying to dereference the tile_bo that binning
    validation should have set up.

    Reported-by: Ingo Molnar
    Signed-off-by: Eric Anholt
    Fixes: d5b1a78a772f ("drm/vc4: Add support for drawing 3D frames.")
    Signed-off-by: Greg Kroah-Hartman

    Eric Anholt
     
  • commit 0f2ff82e11c86c05d051cae32b58226392d33bbf upstream.

    We copy the unvalidated ioctl arguments from the user into kernel
    temporary memory to run the validation from, to avoid a race where the
    user updates the unvalidate contents in between validating them and
    copying them into the validated BO.

    However, in setting up the layout of the kernel side, we failed to
    check one of the additions (the roundup() for shader_rec_offset)
    against integer overflow, allowing a nearly MAX_UINT value of
    bin_cl_size to cause us to under-allocate the temporary space that we
    then copy_from_user into.

    Reported-by: Murray McAllister
    Signed-off-by: Eric Anholt
    Fixes: d5b1a78a772f ("drm/vc4: Add support for drawing 3D frames.")
    Signed-off-by: Greg Kroah-Hartman

    Eric Anholt
     
  • commit 7622b25543665567d8830a63210385b7d705924b upstream.

    The underscores variant frees the pointers inside, while the
    no-underscores variant calls underscores and then frees the struct.

    Signed-off-by: Eric Anholt
    Fixes: d8dbf44f13b9 ("drm/vc4: Make the CRTCs cooperate on allocating display lists.")
    Signed-off-by: Greg Kroah-Hartman

    Eric Anholt
     
  • commit 3bfdfdcbce2796ce75bf2d85fd8471858d702e5d upstream.

    When the plane is invisible we may have all sorts of bogus stuff
    in the coordinates, which we must ignore or else we might fail the
    plane update. This started to happen on SKL when I moved the plane
    offset computation to happen in the check phase. Previously we
    happily ignored it all since we never called the update_plane hook
    with an invisible plane.

    Cc: Sivakumar Thulasimani
    Cc: drm-intel-fixes@lists.freedesktop.org
    Fixes: b63a16f6cd89 ("drm/i915: Compute display surface offset in the plane check hook for SKL+")
    Signed-off-by: Ville Syrjälä
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=98258
    Testcase: igt/pm_rpm/legacy-planes
    Testcase: igt/pm_rpm/universal-planes
    Reviewed-by: Matt Roper
    Signed-off-by: Matt Roper
    Link: http://patchwork.freedesktop.org/patch/msgid/1478550057-24864-3-git-send-email-ville.syrjala@linux.intel.com
    (cherry picked from commit a5e4c7d0aa6784d8abe95c3ceef0da9656d17468)
    Signed-off-by: Jani Nikula
    Signed-off-by: Greg Kroah-Hartman

    Ville Syrjälä
     
  • commit fdf35a6b22247746a7053fc764d04218a9306f82 upstream.

    I noticed that the VT switch doesn't work any longer with a Dell
    laptop with 1366x768 eDP when the machine is connected with a DP
    monitor. It behaves as if VT were switched, but the graphics remain
    frozen. Actually the keyboard works, so I could switch back to VT7
    again.

    I tried to track down the problem, and encountered a long story until
    we reach to this error:

    - The machine is booted with video=1366x768 option (the distro
    installer seems to add it as default).
    - Recently, drm_helper_probe_single_connector_modes() deals with
    cmdline modes, and it tries to create a new mode when no
    matching mode is found.
    - The drm_mode_create_from_cmdline_mode() creates a mode based on
    either CVT of GFT according to the given cmdline mode; in our case,
    it's 1366x768.
    - Since both CVT and GFT can't express the width 1366 due to
    alignment, the resultant mode becomes 1368x768, slightly larger than
    the given size.
    - Later on, the atomic commit is performed, and in
    drm_atomic_check_only(), the size of each plane is checked.
    - The size check of 1366x768 fails due to the above, and eventually
    the whole VT switch fails.

    Back in the history, we've had a manual fix-up of 1368x768 in various
    places via c09dedb7a50e ("drm/edid: Add a workaround for 1366x768 HD
    panel"), but they have been all in drm_edid.c at probing the modes
    from EDID. For addressing the problem above, we need a similar hack
    to the mode newly created from cmdline, manually adjusting the width
    when the expected size is 1366 while we get 1368 instead.

    Fixes: eaf99c749d43 ("drm: Perform cmdline mode parsing during...")
    Signed-off-by: Takashi Iwai
    Link: http://patchwork.freedesktop.org/patch/msgid/20170109145614.29454-1-tiwai@suse.de
    Reviewed-by: Ville Syrjälä
    Signed-off-by: Ville Syrjälä
    Signed-off-by: Greg Kroah-Hartman

    Takashi Iwai
     
  • commit 68f458eec7069d618a6c884ca007426e0cea411b upstream.

    Instead of scheduling the work to handle the initial delayed event, use 1s
    delay.

    This delay should not be needed, but Optimus/nouveau will fail in a
    mysterious way if the delayed event is handled as soon as possible like it
    is done in drm_helper_probe_single_connector_modes() in case the poll
    was enabled before.

    Reverting 339fd36238dd would give back the 10 sec (!) delay to handle the
    delayed event. Adding 1sec delay to the poll_work is enough to work around
    the issue in Optimus setups and gives shorter response on handling the
    initial delayed event.

    Fixes: 339fd36238dd ("drm: drm_probe_helper: Fix output_poll_work scheduling")
    Signed-off-by: Peter Ujfalusi
    [danvet: Add FIXME to the comment to make it stick out more.]
    Signed-off-by: Daniel Vetter
    Link: http://patchwork.freedesktop.org/patch/msgid/20170109143158.21917-1-peter.ujfalusi@ti.com
    Signed-off-by: Greg Kroah-Hartman

    Peter Ujfalusi
     

20 Jan, 2017

13 commits

  • commit cc98e6ce6abe1c0103cbd7aff1ee586622a9361e upstream.

    commit 202b52b7fbf7 ("drm: Track drm_mm nodes with an interval tree")
    introduced a requirement that the special drm_mm.head_node was
    initialised and marked as not being allocated. It is a very special node
    that has no side but has a hole that represents the drm_mm address
    space, and holds the list of nodes. Since it is not a real node, it is
    not part of the node rbtree and we detect this as it being unallocated.
    This presumed that drm_mm_init() was initialising it to zero. It happens
    that i915 kzallocs its objects and so it was accidentally setting it,
    but for generic use we cannot make that assumption.

    [ 22.981519] general protection fault: 0000 [#1] SMP
    [ 22.981521] Modules linked in: test_drm_mm(+) ctr ccm arc4 rt2800usb rt2x00usb rt2800lib rt2x00lib crc_ccitt mac80211 cmac rfcomm bnep snd_hda_codec_realtek snd_hda_codec_hdmi snd_hda_codec_generic snd_hda_intel dcdbas snd_hda_codec x86_pkg_temp_thermal intel_powerclamp btusb snd_hda_core coretemp crct10dif_pclmul cfg80211 btrtl btbcm btintel bluetooth crc32_pclmul ghash_clmulni_intel aesni_intel snd_pcm i2c_hid aes_x86_64 lrw gf128mul glue_helper ablk_helper cryptd snd_timer hid_multitouch snd joydev serio_raw lpc_ich mfd_core i2c_designware_platform i2c_designware_core 8250_dw binfmt_misc soundcore acpi_pad nls_iso8859_1 usbhid hid psmouse ahci libahci [last unloaded: test_drm_mm]
    [ 22.981544] CPU: 1 PID: 2088 Comm: drm_mm Tainted: G W 4.9.0-rc7+ #234
    [ 22.981545] Hardware name: Dell Inc. XPS 13 9343/0310JH, BIOS A07 11/11/2015
    [ 22.981546] task: ffff88020c971cc0 task.stack: ffffc90001728000
    [ 22.981547] RIP: 0010:[] [] drm_mm_interval_tree_add_node+0xa0/0xd0
    [ 22.981551] RSP: 0018:ffffc9000172ba98 EFLAGS: 00010202
    [ 22.981552] RAX: 0f0000c69cf63d80 RBX: ffff88020be00000 RCX: ffff88020be00000
    [ 22.981553] RDX: 0000000000000fff RSI: ffffc9000172bc48 RDI: ffffffff810ac4df
    [ 22.981553] RBP: ffffc9000172bb08 R08: ffffc9000172bc70 R09: 0000000000000fff
    [ 22.981554] R10: ffffffff810ac4d7 R11: 4dc04d8b4cffffe5 R12: 0000000000001000
    [ 22.981555] R13: ffffc9000172bbd0 R14: ffffc9000172bbe0 R15: 0000000002000000
    [ 22.981556] FS: 00007f80c9fab740(0000) GS:ffff88021f480000(0000) knlGS:0000000000000000
    [ 22.981557] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [ 22.981558] CR2: 00007f80c9fd5000 CR3: 000000020c191000 CR4: 00000000003406e0
    [ 22.981559] Stack:
    [ 22.981560] ffffffff81405d09 ffff88020be00000 ffffc9000172bbe0 000000000172bb08
    [ 22.981562] ffffffffffffffff 0000000000000000 0000000000000000 0000000000000000
    [ 22.981563] 0000000002000000 0000000002000000 ffffffffa02f3000 ffff88020be00000
    [ 22.981565] Call Trace:
    [ 22.981568] [] ? drm_mm_insert_node_generic+0x229/0x310
    [ 22.981570] [] ? 0xffffffffa02f3000
    [ 22.981572] [] __subtest_insert_range.constprop.7+0xd1/0x5b0 [test_drm_mm]
    [ 22.981575] [] ? default_wake_function+0x12/0x20
    [ 22.981576] [] ? __wake_up_common+0x55/0x90
    [ 22.981578] [] ? sched_clock_cpu+0x72/0xa0
    [ 22.981581] [] ? irq_work_queue+0xd/0x80
    [ 22.981582] [] ? wake_up_klogd+0x34/0x40
    [ 22.981584] [] ? console_unlock+0x4cd/0x530
    [ 22.981585] [] ? vprintk_emit+0x2d7/0x490
    [ 22.981587] [] ? vprintk_default+0x1f/0x30
    [ 22.981589] [] ? printk+0x4d/0x4f
    [ 22.981590] [] ? 0xffffffffa02f3000
    [ 22.981592] [] subtest_insert_range+0x15/0x80 [test_drm_mm]
    [ 22.981594] [] test_drm_mm_init+0x88/0x1000 [test_drm_mm]
    [ 22.981597] [] do_one_initcall+0x3d/0x150
    [ 22.981600] [] ? kfree+0x13f/0x180
    [ 22.981602] [] do_init_module+0x60/0x1f1
    [ 22.981606] [] load_module+0x2228/0x2790
    [ 22.981608] [] ? __symbol_put+0x40/0x40
    [ 22.981612] [] ? kernel_read+0x41/0x60
    [ 22.981614] [] SYSC_finit_module+0x96/0xd0
    [ 22.981617] [] SyS_finit_module+0xe/0x10
    [ 22.981620] [] entry_SYSCALL_64_fastpath+0x17/0x98
    [ 22.981622] Code: c7 41 30 00 00 00 00 48 89 e5 48 89 3a 48 c7 c2 20 4e 40 81 e8 b2 a1 f0 ff 5d c3 48 8d 56 78 45 31 d2 48 89 d6 eb 25 48 8b 51 58 39 50 38 73 04 48 89 50 38 4c 8b 58 28 4c 39 59 48 48 8d 50
    [ 22.981651] RIP [] drm_mm_interval_tree_add_node+0xa0/0xd0
    [ 22.981655] RSP

    Testcase: igt/drm_mm
    Fixes: 202b52b7fbf7 ("drm: Track drm_mm nodes with an interval tree")
    Signed-off-by: Chris Wilson
    Cc: David Herrmann
    Cc: dri-devel@lists.freedesktop.org
    Cc: Daniel Vetter
    Cc: # v4.9-rc1+
    Signed-off-by: Daniel Vetter
    Link: http://patchwork.freedesktop.org/patch/msgid/20161130205126.31106-1-chris@chris-wilson.co.uk
    Signed-off-by: Greg Kroah-Hartman

    Chris Wilson
     
  • commit 00b2b7288299a8c73c0c37b531a075ba5c849e67 upstream.

    Trying to determine the pixel rate of the pipe can't be done until we
    know the clock, which means it can't be done until the encoder
    .get_config() hooks have been called. So let's move the min_pixclk[]
    stuff to the end of intel_modeset_readout_hw_state() when we actually
    have gathered all the required infromation.

    Cc: Maarten Lankhorst
    Cc: Mika Kahola
    Cc: Ander Conselvan de Oliveira
    Fixes: 565602d7501a ("drm/i915: Do not acquire crtc state to check clock during modeset, v4.")
    Signed-off-by: Ville Syrjälä
    Link: http://patchwork.freedesktop.org/patch/msgid/20161220153902.15621-1-ville.syrjala@linux.intel.com
    Reviewed-by: Ander Conselvan de Oliveira
    Reviewed-by: Maarten Lankhorst
    (cherry picked from commit aca1ebf491518910df156f3dab6a66306bb52e28)
    Signed-off-by: Jani Nikula
    Signed-off-by: Greg Kroah-Hartman

    Ville Syrjälä
     
  • commit 230c5b44233ff0543c0b5ccf4ff9400057010fbe upstream.

    In the loop on .timings, we should check .num_timings to see if it's the
    only mode specified, not .num_modes, which should be used with .modes.

    Fixes: cda553725c92 ("drm/panel: simple: Set appropriate mode type")
    Signed-off-by: Chen-Yu Tsai
    Signed-off-by: Thierry Reding
    Signed-off-by: Greg Kroah-Hartman

    Chen-Yu Tsai
     
  • commit cff52e5fc4cfc978b7df898dc14a0492c7ef0ae8 upstream.

    gcc warns about the timestamp in drm_wait_vblank being possibly
    used without an initialization:

    drivers/gpu/drm/drm_irq.c: In function 'drm_crtc_send_vblank_event':
    drivers/gpu/drm/drm_irq.c:992:24: error: 'now.tv_usec' may be used uninitialized in this function [-Werror=maybe-uninitialized]
    drivers/gpu/drm/drm_irq.c:1069:17: note: 'now.tv_usec' was declared here
    drivers/gpu/drm/drm_irq.c:991:23: error: 'now.tv_sec' may be used uninitialized in this function [-Werror=maybe-uninitialized]

    This can happen if drm_vblank_count_and_time() returns 0 in its
    error path. To sanitize the error case, I'm changing that function
    to return a zero timestamp when it fails.

    Fixes: e6ae8687a87b ("drm: idiot-proof vblank")
    Reviewed-by: David Herrmann
    Cc: Rob Clark
    Cc: Daniel Vetter
    Signed-off-by: Arnd Bergmann
    Reviewed-by: Mario Kleiner
    Signed-off-by: Daniel Vetter
    Link: http://patchwork.freedesktop.org/patch/msgid/20161017221355.1861551-6-arnd@arndb.de
    Signed-off-by: Greg Kroah-Hartman

    Arnd Bergmann
     
  • commit dccf82ad1775f2b9c36ec85e25e39d88c7e86818 upstream.

    According to the previous patch, it's possible atm that we call
    intel_do_sagv_disable() only once during the 1ms period and time out if
    that call fails. As opposed to this the spec says that we need to keep
    retrying this request for a 1ms duration, so let's do this similarly to
    the CDCLK change notification request.

    v4-5:
    - Rebased on the reply_mask, reply change.
    v6:
    - Remove w/s change. (Lyude)
    - Rebased on the timeout_base argument change.

    Cc: Lyude
    Cc: Ville Syrjälä
    Cc: Chris Wilson
    Fixes: 656d1b89e5ff ("drm/i915/skl: Add support for the SAGV, fix underrun hangs")
    Signed-off-by: Imre Deak
    Reviewed-by: Lyude (v4)
    Link: http://patchwork.freedesktop.org/patch/msgid/1480955258-26311-2-git-send-email-imre.deak@intel.com
    (cherry picked from commit b3b8e99984a4eace91bc097e8f8cec71441cae16)
    Signed-off-by: Jani Nikula
    Signed-off-by: Greg Kroah-Hartman

    Imre Deak
     
  • commit 7192c54a68013f6058b1bb505645fcd07015191c upstream.

    Port of radeon change to amdgpu.

    Acked-by: Edward O'Callaghan
    Signed-off-by: Alex Deucher
    Signed-off-by: Greg Kroah-Hartman

    Alex Deucher
     
  • commit 5165484b02f2cbedb5bf3a41ff5e8ae16069016c upstream.

    Use the appropriate smc firmware for each chip revision.
    Using the wrong one can cause stability issues.

    Acked-by: Edward O'Callaghan
    Signed-off-by: Flora Cui
    Reviewed-by: Junwei Zhang
    Signed-off-by: Alex Deucher
    Signed-off-by: Greg Kroah-Hartman

    Flora Cui
     
  • commit 8a08403bcb39f5d0e733bcf59a8a74f16b538f6e upstream.

    fixes:
    https://bugs.freedesktop.org/show_bug.cgi?id=98897
    https://bugs.launchpad.net/bugs/1651981

    Acked-by: Edward O'Callaghan
    Signed-off-by: Alex Deucher
    Cc: Adrian Fiergolski
    Signed-off-by: Greg Kroah-Hartman

    Alex Deucher
     
  • commit 6458bd4dfd9414cba5804eb9907fe2a824278c34 upstream.

    Use the appropriate smc firmware for each chip revision.
    Using the wrong one can cause stability issues.

    Acked-by: Edward O'Callaghan
    Signed-off-by: Alex Deucher
    Signed-off-by: Greg Kroah-Hartman

    Alex Deucher
     
  • commit aebe55c2d4b998741c0847ace1b4af47d73c763b upstream.

    If waiting for fences fails for blocking commits, planes must be cleaned
    up before returning.

    Fixes: f6ce410a59a4 ("drm/fence: allow fence waiting to be interrupted by userspace")
    Signed-off-by: Laurent Pinchart
    Signed-off-by: Daniel Vetter
    Link: http://patchwork.freedesktop.org/patch/msgid/20170102231427.7192-1-laurent.pinchart@ideasonboard.com
    Signed-off-by: Greg Kroah-Hartman

    Laurent Pinchart
     
  • The backport of
    2c7d0602c - "Fix PCODE polling during CDCLK change notification"
    to the 4.9 stable tree used an incorrect timeout value. Fix this up
    so the backport matches the upstream commit.

    Reported-by: Thomas Backlund
    Signed-off-by: Imre Deak
    Signed-off-by: Greg Kroah-Hartman

    Imre Deak
     
  • commit f7741aa75e76440f4e9ecfe512feebe9bce33ca8 upstream.

    A recent cleanup changed the kmalloc() + copy_from_user() to
    memdup_user() but the error handling wasn't updated so we might call
    kfree(-EFAULT) and crash.

    Fixes: a6e3918bcdb1 ('GPU-DRM-Savage: Use memdup_user() rather than duplicating')
    Signed-off-by: Dan Carpenter
    Signed-off-by: Daniel Vetter
    Link: http://patchwork.freedesktop.org/patch/msgid/20161012062227.GU12841@mwanda
    Signed-off-by: Greg Kroah-Hartman

    Dan Carpenter
     
  • commit b2cdeb19f16ad984eb5bb9193f793d05a8101511 upstream.

    If the allocation fails the current code returns success. If
    copy_from_user() fails it returns the number of bytes remaining instead
    of -EFAULT.

    Fixes: d5b1a78a772f ("drm/vc4: Add support for drawing 3D frames.")
    Signed-off-by: Dan Carpenter
    Reviewed-by: Eric Anholt
    Signed-off-by: Greg Kroah-Hartman

    Dan Carpenter