Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux

Pull drm fixes from Dave Airlie: "Smattering of fixes, i915, exynos, tegra, msm, vmwgfx. A bit of framebuffer reference counting fallout fixes, i915 GM45 regression fix, DVI regression fix, vmware info leak between processes fix" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/exynos: use %pad for dma_addr_t drm/exynos: dsi: use IS_ERR() to check devm_ioremap_resource() results MAINTAINERS: update maintainer entry for Exynos DP driver drm/exynos: balance framebuffer refcount drm/i915: Move all ring resets before setting the HWS page drm/i915: Don't WARN nor handle unexpected hpd interrupts on gmch platforms drm/msm/mdp4: cure for the cursor blues (v2) drm/msm: default to XR24 rather than AR24 drm/msm: fix memory leak drm/tegra: restrict plane loops to legacy planes drm/i915: Allow full PPGTT with param override drm/i915: Discard BIOS framebuffers too small to accommodate chosen mode drm/vmwgfx: Make sure user-space can't DMA across buffer object boundaries v2 drm/i915: get power domain in case the BIOS enabled eDP VDD drm/i915: Don't check gmch state on inherited configs drm/i915: Allow user modes to exceed DVI 165MHz limit

Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
Pull drm fixes from Dave Airlie: "Smattering of fixes, i915, exynos, tegra, msm, vmwgfx. A bit of framebuffer reference counting fallout fixes, i915 GM45 regression fix, DVI regression fix, vmware info leak between processes fix" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/exynos: use %pad for dma_addr_t drm/exynos: dsi: use IS_ERR() to check devm_ioremap_resource() results MAINTAINERS: update maintainer entry for Exynos DP driver drm/exynos: balance framebuffer refcount drm/i915: Move all ring resets before setting the HWS page drm/i915: Don't WARN nor handle unexpected hpd interrupts on gmch platforms drm/msm/mdp4: cure for the cursor blues (v2) drm/msm: default to XR24 rather than AR24 drm/msm: fix memory leak drm/tegra: restrict plane loops to legacy planes drm/i915: Allow full PPGTT with param override drm/i915: Discard BIOS framebuffers too small to accommodate chosen mode drm/vmwgfx: Make sure user-space can't DMA across buffer object boundaries v2 drm/i915: get power domain in case the BIOS enabled eDP VDD drm/i915: Don't check gmch state on inherited configs drm/i915: Allow user modes to exceed DVI 165MHz limit
Linus Torvalds
2 parents 2aafe1a4d4 b8eade24c9
Showing 24 changed files Side-by-side Diff
MAINTAINERS
drivers/gpu/drm/exynos/exynos_drm_crtc.c
drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
drivers/gpu/drm/exynos/exynos_drm_dsi.c
drivers/gpu/drm/exynos/exynos_drm_vidi.c
drivers/gpu/drm/i915/i915_gem_gtt.c
drivers/gpu/drm/i915/i915_irq.c
drivers/gpu/drm/i915/i915_reg.h
drivers/gpu/drm/i915/intel_display.c
drivers/gpu/drm/i915/intel_dp.c
drivers/gpu/drm/i915/intel_drv.h
drivers/gpu/drm/i915/intel_fbdev.c
drivers/gpu/drm/i915/intel_hdmi.c
drivers/gpu/drm/i915/intel_ringbuffer.c
drivers/gpu/drm/i915/intel_ringbuffer.h
drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c
drivers/gpu/drm/msm/mdp/mdp4/mdp4_irq.c
drivers/gpu/drm/msm/mdp/mdp4/mdp4_kms.c
drivers/gpu/drm/msm/mdp/mdp4/mdp4_kms.h
drivers/gpu/drm/msm/mdp/mdp5/mdp5_irq.c
@@ -3485,6 +3485,12 @@
 F:	drivers/extcon/
 F:	Documentation/extcon/
  
+EXYNOS DP DRIVER
+M:	Jingoo Han <jg1.han@samsung.com>
+L:	dri-devel@lists.freedesktop.org
+S:	Maintained
+F:	drivers/gpu/drm/exynos/exynos_dp*
+
 EXYNOS MIPI DISPLAY DRIVERS
 M:	Inki Dae <inki.dae@samsung.com>
 M:	Donghwa Lee <dh09.lee@samsung.com>
@@ -145,6 +145,7 @@
  
 	plane->crtc = crtc;
 	plane->fb = crtc->primary->fb;
+	drm_framebuffer_reference(plane->fb);
  
 	return 0;
 }
@@ -263,7 +263,7 @@
 	buffer->sgt = sgt;
 	exynos_gem_obj->base.import_attach = attach;
  
-	DRM_DEBUG_PRIME("dma_addr = 0x%x, size = 0x%lx\n", buffer->dma_addr,
+	DRM_DEBUG_PRIME("dma_addr = %pad, size = 0x%lx\n", &buffer->dma_addr,
 								buffer->size);
  
 	return &exynos_gem_obj->base;
@@ -1426,9 +1426,9 @@
  
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	dsi->reg_base = devm_ioremap_resource(&pdev->dev, res);
-	if (!dsi->reg_base) {
+	if (IS_ERR(dsi->reg_base)) {
 		dev_err(&pdev->dev, "failed to remap io region\n");
-		return -EADDRNOTAVAIL;
+		return PTR_ERR(dsi->reg_base);
 	}
  
 	dsi->phy = devm_phy_get(&pdev->dev, "dsim");
@@ -220,7 +220,7 @@
  
 	win_data->enabled = true;
  
-	DRM_DEBUG_KMS("dma_addr = 0x%x\n", win_data->dma_addr);
+	DRM_DEBUG_KMS("dma_addr = %pad\n", &win_data->dma_addr);
  
 	if (ctx->vblank_on)
 		schedule_work(&ctx->work);
@@ -50,7 +50,7 @@
  
 	/* Full ppgtt disabled by default for now due to issues. */
 	if (full)
-		return false; /* HAS_PPGTT(dev) */
+		return HAS_PPGTT(dev) && (i915.enable_ppgtt == 2);
 	else
 		return HAS_ALIASING_PPGTT(dev);
 }
@@ -1362,10 +1362,20 @@
 	spin_lock(&dev_priv->irq_lock);
 	for (i = 1; i < HPD_NUM_PINS; i++) {
  
-		WARN_ONCE(hpd[i] & hotplug_trigger &&
-			  dev_priv->hpd_stats[i].hpd_mark == HPD_DISABLED,
-			  "Received HPD interrupt (0x%08x) on pin %d (0x%08x) although disabled\n",
-			  hotplug_trigger, i, hpd[i]);
+		if (hpd[i] & hotplug_trigger &&
+		    dev_priv->hpd_stats[i].hpd_mark == HPD_DISABLED) {
+			/*
+			 * On GMCH platforms the interrupt mask bits only
+			 * prevent irq generation, not the setting of the
+			 * hotplug bits itself. So only WARN about unexpected
+			 * interrupts on saner platforms.
+			 */
+			WARN_ONCE(INTEL_INFO(dev)->gen >= 5 && !IS_VALLEYVIEW(dev),
+				  "Received HPD interrupt (0x%08x) on pin %d (0x%08x) although disabled\n",
+				  hotplug_trigger, i, hpd[i]);
+
+			continue;
+		}
  
 		if (!(hpd[i] & hotplug_trigger) ||
 		    dev_priv->hpd_stats[i].hpd_mark != HPD_ENABLED)
@@ -827,6 +827,7 @@
 # define MI_FLUSH_ENABLE				(1 << 12)
 # define ASYNC_FLIP_PERF_DISABLE			(1 << 14)
 # define MODE_IDLE					(1 << 9)
+# define STOP_RING					(1 << 8)
  
 #define GEN6_GT_MODE	0x20d0
 #define GEN7_GT_MODE	0x7008
@@ -9654,11 +9654,22 @@
 	PIPE_CONF_CHECK_I(pipe_src_w);
 	PIPE_CONF_CHECK_I(pipe_src_h);
  
-	PIPE_CONF_CHECK_I(gmch_pfit.control);
-	/* pfit ratios are autocomputed by the hw on gen4+ */
-	if (INTEL_INFO(dev)->gen < 4)
-		PIPE_CONF_CHECK_I(gmch_pfit.pgm_ratios);
-	PIPE_CONF_CHECK_I(gmch_pfit.lvds_border_bits);
+	/*
+	 * FIXME: BIOS likes to set up a cloned config with lvds+external
+	 * screen. Since we don't yet re-compute the pipe config when moving
+	 * just the lvds port away to another pipe the sw tracking won't match.
+	 *
+	 * Proper atomic modesets with recomputed global state will fix this.
+	 * Until then just don't check gmch state for inherited modes.
+	 */
+	if (!PIPE_CONF_QUIRK(PIPE_CONFIG_QUIRK_INHERITED_MODE)) {
+		PIPE_CONF_CHECK_I(gmch_pfit.control);
+		/* pfit ratios are autocomputed by the hw on gen4+ */
+		if (INTEL_INFO(dev)->gen < 4)
+			PIPE_CONF_CHECK_I(gmch_pfit.pgm_ratios);
+		PIPE_CONF_CHECK_I(gmch_pfit.lvds_border_bits);
+	}
+
 	PIPE_CONF_CHECK_I(pch_pfit.enabled);
 	if (current_config->pch_pfit.enabled) {
 		PIPE_CONF_CHECK_I(pch_pfit.pos);
@@ -11615,6 +11626,8 @@
 	list_for_each_entry(crtc, &dev->mode_config.crtc_list,
 			    base.head) {
 		memset(&crtc->config, 0, sizeof(crtc->config));
+
+		crtc->config.quirks |= PIPE_CONFIG_QUIRK_INHERITED_MODE;
  
 		crtc->active = dev_priv->display.get_pipe_config(crtc,
 								 &crtc->config);
@@ -3619,7 +3619,8 @@
 {
 	struct drm_connector *connector = &intel_connector->base;
 	struct intel_digital_port *intel_dig_port = dp_to_dig_port(intel_dp);
-	struct drm_device *dev = intel_dig_port->base.base.dev;
+	struct intel_encoder *intel_encoder = &intel_dig_port->base;
+	struct drm_device *dev = intel_encoder->base.dev;
 	struct drm_i915_private *dev_priv = dev->dev_private;
 	struct drm_display_mode *fixed_mode = NULL;
 	bool has_dpcd;
@@ -3628,6 +3629,14 @@
  
 	if (!is_edp(intel_dp))
 		return true;
+
+	/* The VDD bit needs a power domain reference, so if the bit is already
+	 * enabled when we boot, grab this reference. */
+	if (edp_have_panel_vdd(intel_dp)) {
+		enum intel_display_power_domain power_domain;
+		power_domain = intel_display_port_power_domain(intel_encoder);
+		intel_display_power_get(dev_priv, power_domain);
+	}
  
 	/* Cache DPCD and EDID for edp. */
 	intel_edp_panel_vdd_on(intel_dp);
@@ -236,7 +236,8 @@
 	 * tracked with quirk flags so that fastboot and state checker can act
 	 * accordingly.
 	 */
-#define PIPE_CONFIG_QUIRK_MODE_SYNC_FLAGS (1<<0) /* unreliable sync mode.flags */
+#define PIPE_CONFIG_QUIRK_MODE_SYNC_FLAGS	(1<<0) /* unreliable sync mode.flags */
+#define PIPE_CONFIG_QUIRK_INHERITED_MODE	(1<<1) /* mode inherited from firmware */
 	unsigned long quirks;
  
 	/* User requested mode, only valid as a starting point to
@@ -132,6 +132,16 @@
  
 	mutex_lock(&dev->struct_mutex);
  
+	if (intel_fb &&
+	    (sizes->fb_width > intel_fb->base.width ||
+	     sizes->fb_height > intel_fb->base.height)) {
+		DRM_DEBUG_KMS("BIOS fb too small (%dx%d), we require (%dx%d),"
+			      " releasing it\n",
+			      intel_fb->base.width, intel_fb->base.height,
+			      sizes->fb_width, sizes->fb_height);
+		drm_framebuffer_unreference(&intel_fb->base);
+		intel_fb = ifbdev->fb = NULL;
+	}
 	if (!intel_fb || WARN_ON(!intel_fb->obj)) {
 		DRM_DEBUG_KMS("no BIOS fb, allocating a new one\n");
 		ret = intelfb_alloc(helper, sizes);
@@ -821,11 +821,11 @@
 	}
 }
  
-static int hdmi_portclock_limit(struct intel_hdmi *hdmi)
+static int hdmi_portclock_limit(struct intel_hdmi *hdmi, bool respect_dvi_limit)
 {
 	struct drm_device *dev = intel_hdmi_to_dev(hdmi);
  
-	if (!hdmi->has_hdmi_sink || IS_G4X(dev))
+	if ((respect_dvi_limit && !hdmi->has_hdmi_sink) || IS_G4X(dev))
 		return 165000;
 	else if (IS_HASWELL(dev) || INTEL_INFO(dev)->gen >= 8)
 		return 300000;
@@ -837,7 +837,8 @@
 intel_hdmi_mode_valid(struct drm_connector *connector,
 		      struct drm_display_mode *mode)
 {
-	if (mode->clock > hdmi_portclock_limit(intel_attached_hdmi(connector)))
+	if (mode->clock > hdmi_portclock_limit(intel_attached_hdmi(connector),
+					       true))
 		return MODE_CLOCK_HIGH;
 	if (mode->clock < 20000)
 		return MODE_CLOCK_LOW;
@@ -879,7 +880,7 @@
 	struct drm_device *dev = encoder->base.dev;
 	struct drm_display_mode *adjusted_mode = &pipe_config->adjusted_mode;
 	int clock_12bpc = pipe_config->adjusted_mode.crtc_clock * 3 / 2;
-	int portclock_limit = hdmi_portclock_limit(intel_hdmi);
+	int portclock_limit = hdmi_portclock_limit(intel_hdmi, false);
 	int desired_bpp;
  
 	if (intel_hdmi->color_range_auto) {
@@ -437,32 +437,41 @@
 	I915_WRITE(HWS_PGA, addr);
 }
  
-static int init_ring_common(struct intel_ring_buffer *ring)
+static bool stop_ring(struct intel_ring_buffer *ring)
 {
-	struct drm_device *dev = ring->dev;
-	struct drm_i915_private *dev_priv = dev->dev_private;
-	struct drm_i915_gem_object *obj = ring->obj;
-	int ret = 0;
-	u32 head;
+	struct drm_i915_private *dev_priv = to_i915(ring->dev);
  
-	gen6_gt_force_wake_get(dev_priv, FORCEWAKE_ALL);
+	if (!IS_GEN2(ring->dev)) {
+		I915_WRITE_MODE(ring, _MASKED_BIT_ENABLE(STOP_RING));
+		if (wait_for_atomic((I915_READ_MODE(ring) & MODE_IDLE) != 0, 1000)) {
+			DRM_ERROR("%s :timed out trying to stop ring\n", ring->name);
+			return false;
+		}
+	}
  
-	/* Stop the ring if it's running. */
 	I915_WRITE_CTL(ring, 0);
 	I915_WRITE_HEAD(ring, 0);
 	ring->write_tail(ring, 0);
-	if (wait_for_atomic((I915_READ_MODE(ring) & MODE_IDLE) != 0, 1000))
-		DRM_ERROR("%s :timed out trying to stop ring\n", ring->name);
  
-	if (I915_NEED_GFX_HWS(dev))
-		intel_ring_setup_status_page(ring);
-	else
-		ring_setup_phys_status_page(ring);
+	if (!IS_GEN2(ring->dev)) {
+		(void)I915_READ_CTL(ring);
+		I915_WRITE_MODE(ring, _MASKED_BIT_DISABLE(STOP_RING));
+	}
  
-	head = I915_READ_HEAD(ring) & HEAD_ADDR;
+	return (I915_READ_HEAD(ring) & HEAD_ADDR) == 0;
+}
  
-	/* G45 ring initialization fails to reset head to zero */
-	if (head != 0) {
+static int init_ring_common(struct intel_ring_buffer *ring)
+{
+	struct drm_device *dev = ring->dev;
+	struct drm_i915_private *dev_priv = dev->dev_private;
+	struct drm_i915_gem_object *obj = ring->obj;
+	int ret = 0;
+
+	gen6_gt_force_wake_get(dev_priv, FORCEWAKE_ALL);
+
+	if (!stop_ring(ring)) {
+		/* G45 ring initialization often fails to reset head to zero */
 		DRM_DEBUG_KMS("%s head not reset to zero "
 			      "ctl %08x head %08x tail %08x start %08x\n",
 			      ring->name,
@@ -471,9 +480,7 @@
 			      I915_READ_TAIL(ring),
 			      I915_READ_START(ring));
  
-		I915_WRITE_HEAD(ring, 0);
-
-		if (I915_READ_HEAD(ring) & HEAD_ADDR) {
+		if (!stop_ring(ring)) {
 			DRM_ERROR("failed to set %s head to zero "
 				  "ctl %08x head %08x tail %08x start %08x\n",
 				  ring->name,
  
@@ -481,8 +488,15 @@
 				  I915_READ_HEAD(ring),
 				  I915_READ_TAIL(ring),
 				  I915_READ_START(ring));
+			ret = -EIO;
+			goto out;
 		}
 	}
+
+	if (I915_NEED_GFX_HWS(dev))
+		intel_ring_setup_status_page(ring);
+	else
+		ring_setup_phys_status_page(ring);
  
 	/* Initialize the ring. This must happen _after_ we've cleared the ring
 	 * registers with the above sequence (the readback of the HEAD registers
@@ -34,6 +34,7 @@
 #define I915_WRITE_IMR(ring, val) I915_WRITE(RING_IMR((ring)->mmio_base), val)
  
 #define I915_READ_MODE(ring) I915_READ(RING_MI_MODE((ring)->mmio_base))
+#define I915_WRITE_MODE(ring, val) I915_WRITE(RING_MI_MODE((ring)->mmio_base), val)
  
 enum intel_ring_hangcheck_action {
 	HANGCHECK_IDLE = 0,
@@ -510,9 +510,8 @@
 					MDP4_DMA_CURSOR_BLEND_CONFIG_CURSOR_EN);
 		} else {
 			/* disable cursor: */
-			mdp4_write(mdp4_kms, REG_MDP4_DMA_CURSOR_BASE(dma), 0);
-			mdp4_write(mdp4_kms, REG_MDP4_DMA_CURSOR_BLEND_CONFIG(dma),
-					MDP4_DMA_CURSOR_BLEND_CONFIG_FORMAT(CURSOR_ARGB));
+			mdp4_write(mdp4_kms, REG_MDP4_DMA_CURSOR_BASE(dma),
+					mdp4_kms->blank_cursor_iova);
 		}
  
 		/* and drop the iova ref + obj rev when done scanning out: */
  
@@ -574,11 +573,9 @@
  
 	if (old_bo) {
 		/* drop our previous reference: */
-		msm_gem_put_iova(old_bo, mdp4_kms->id);
-		drm_gem_object_unreference_unlocked(old_bo);
+		drm_flip_work_queue(&mdp4_crtc->unref_cursor_work, old_bo);
 	}
  
-	crtc_flush(crtc);
 	request_pending(crtc, PENDING_CURSOR);
  
 	return 0;
@@ -70,11 +70,11 @@
  
 	VERB("status=%08x", status);
  
+	mdp_dispatch_irqs(mdp_kms, status);
+
 	for (id = 0; id < priv->num_crtcs; id++)
 		if (status & mdp4_crtc_vblank(priv->crtcs[id]))
 			drm_handle_vblank(dev, id);
-
-	mdp_dispatch_irqs(mdp_kms, status);
  
 	return IRQ_HANDLED;
 }
@@ -144,6 +144,10 @@
 static void mdp4_destroy(struct msm_kms *kms)
 {
 	struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(kms));
+	if (mdp4_kms->blank_cursor_iova)
+		msm_gem_put_iova(mdp4_kms->blank_cursor_bo, mdp4_kms->id);
+	if (mdp4_kms->blank_cursor_bo)
+		drm_gem_object_unreference(mdp4_kms->blank_cursor_bo);
 	kfree(mdp4_kms);
 }
  
@@ -369,6 +373,23 @@
 	ret = modeset_init(mdp4_kms);
 	if (ret) {
 		dev_err(dev->dev, "modeset_init failed: %d\n", ret);
+		goto fail;
+	}
+
+	mutex_lock(&dev->struct_mutex);
+	mdp4_kms->blank_cursor_bo = msm_gem_new(dev, SZ_16K, MSM_BO_WC);
+	mutex_unlock(&dev->struct_mutex);
+	if (IS_ERR(mdp4_kms->blank_cursor_bo)) {
+		ret = PTR_ERR(mdp4_kms->blank_cursor_bo);
+		dev_err(dev->dev, "could not allocate blank-cursor bo: %d\n", ret);
+		mdp4_kms->blank_cursor_bo = NULL;
+		goto fail;
+	}
+
+	ret = msm_gem_get_iova(mdp4_kms->blank_cursor_bo, mdp4_kms->id,
+			&mdp4_kms->blank_cursor_iova);
+	if (ret) {
+		dev_err(dev->dev, "could not pin blank-cursor bo: %d\n", ret);
 		goto fail;
 	}
  
@@ -44,6 +44,10 @@
 	struct clk *lut_clk;
  
 	struct mdp_irq error_handler;
+
+	/* empty/blank cursor bo to use when cursor is "disabled" */
+	struct drm_gem_object *blank_cursor_bo;
+	uint32_t blank_cursor_iova;
 };
 #define to_mdp4_kms(x) container_of(x, struct mdp4_kms, base)
  
@@ -71,11 +71,11 @@
  
 	VERB("status=%08x", status);
  
+	mdp_dispatch_irqs(mdp_kms, status);
+
 	for (id = 0; id < priv->num_crtcs; id++)
 		if (status & mdp5_crtc_vblank(priv->crtcs[id]))
 			drm_handle_vblank(dev, id);
-
-	mdp_dispatch_irqs(mdp_kms, status);
 }
  
 irqreturn_t mdp5_irq(struct msm_kms *kms)
@@ -62,11 +62,8 @@
 	dma_addr_t paddr;
 	int ret, size;
  
-	/* only doing ARGB32 since this is what is needed to alpha-blend
-	 * with video overlays:
-	 */
 	sizes->surface_bpp = 32;
-	sizes->surface_depth = 32;
+	sizes->surface_depth = 24;
  
 	DBG("create fbdev: %dx%d@%d (%dx%d)", sizes->surface_width,
 			sizes->surface_height, sizes->surface_bpp,
@@ -118,8 +118,10 @@
  
 		if (iommu_present(&platform_bus_type))
 			drm_gem_put_pages(obj, msm_obj->pages, true, false);
-		else
+		else {
 			drm_mm_remove_node(msm_obj->vram_node);
+			drm_free_large(msm_obj->pages);
+		}
  
 		msm_obj->pages = NULL;
 	}
@@ -312,7 +312,7 @@
 	struct drm_device *drm = crtc->dev;
 	struct drm_plane *plane;
  
-	list_for_each_entry(plane, &drm->mode_config.plane_list, head) {
+	drm_for_each_legacy_plane(plane, &drm->mode_config.plane_list) {
 		if (plane->crtc == crtc) {
 			tegra_plane_disable(plane);
 			plane->crtc = NULL;
@@ -1214,13 +1214,35 @@
 		SVGA3dCmdSurfaceDMA dma;
 	} *cmd;
 	int ret;
+	SVGA3dCmdSurfaceDMASuffix *suffix;
+	uint32_t bo_size;
  
 	cmd = container_of(header, struct vmw_dma_cmd, header);
+	suffix = (SVGA3dCmdSurfaceDMASuffix *)((unsigned long) &cmd->dma +
+					       header->size - sizeof(*suffix));
+
+	/* Make sure device and verifier stays in sync. */
+	if (unlikely(suffix->suffixSize != sizeof(*suffix))) {
+		DRM_ERROR("Invalid DMA suffix size.\n");
+		return -EINVAL;
+	}
+
 	ret = vmw_translate_guest_ptr(dev_priv, sw_context,
 				      &cmd->dma.guest.ptr,
 				      &vmw_bo);
 	if (unlikely(ret != 0))
 		return ret;
+
+	/* Make sure DMA doesn't cross BO boundaries. */
+	bo_size = vmw_bo->base.num_pages * PAGE_SIZE;
+	if (unlikely(cmd->dma.guest.ptr.offset > bo_size)) {
+		DRM_ERROR("Invalid DMA offset.\n");
+		return -EINVAL;
+	}
+
+	bo_size -= cmd->dma.guest.ptr.offset;
+	if (unlikely(suffix->maximumOffset > bo_size))
+		suffix->maximumOffset = bo_size;
  
 	ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
 				user_surface_converter, &cmd->dma.host.sid,
...	...	@@ -3485,6 +3485,12 @@
3485	3485	F: drivers/extcon/
3486	3486	F: Documentation/extcon/
3487	3487
	3488	+EXYNOS DP DRIVER
	3489	+M: Jingoo Han <jg1.han@samsung.com>
	3490	+L: dri-devel@lists.freedesktop.org
	3491	+S: Maintained
	3492	+F: drivers/gpu/drm/exynos/exynos_dp*
	3493	+
3488	3494	EXYNOS MIPI DISPLAY DRIVERS
3489	3495	M: Inki Dae <inki.dae@samsung.com>
3490	3496	M: Donghwa Lee <dh09.lee@samsung.com>
...	...	@@ -145,6 +145,7 @@
145	145
146	146	plane->crtc = crtc;
147	147	plane->fb = crtc->primary->fb;
	148	+ drm_framebuffer_reference(plane->fb);
148	149
149	150	return 0;
150	151	}
...	...	@@ -263,7 +263,7 @@
263	263	buffer->sgt = sgt;
264	264	exynos_gem_obj->base.import_attach = attach;
265	265
266		- DRM_DEBUG_PRIME("dma_addr = 0x%x, size = 0x%lx\n", buffer->dma_addr,
	266	+ DRM_DEBUG_PRIME("dma_addr = %pad, size = 0x%lx\n", &buffer->dma_addr,
267	267	buffer->size);
268	268
269	269	return &exynos_gem_obj->base;
...	...	@@ -1426,9 +1426,9 @@
1426	1426
1427	1427	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
1428	1428	dsi->reg_base = devm_ioremap_resource(&pdev->dev, res);
1429		- if (!dsi->reg_base) {
	1429	+ if (IS_ERR(dsi->reg_base)) {
1430	1430	dev_err(&pdev->dev, "failed to remap io region\n");
1431		- return -EADDRNOTAVAIL;
	1431	+ return PTR_ERR(dsi->reg_base);
1432	1432	}
1433	1433
1434	1434	dsi->phy = devm_phy_get(&pdev->dev, "dsim");
...	...	@@ -220,7 +220,7 @@
220	220
221	221	win_data->enabled = true;
222	222
223		- DRM_DEBUG_KMS("dma_addr = 0x%x\n", win_data->dma_addr);
	223	+ DRM_DEBUG_KMS("dma_addr = %pad\n", &win_data->dma_addr);
224	224
225	225	if (ctx->vblank_on)
226	226	schedule_work(&ctx->work);
...	...	@@ -50,7 +50,7 @@
50	50
51	51	/* Full ppgtt disabled by default for now due to issues. */
52	52	if (full)
53		- return false; /* HAS_PPGTT(dev) */
	53	+ return HAS_PPGTT(dev) && (i915.enable_ppgtt == 2);
54	54	else
55	55	return HAS_ALIASING_PPGTT(dev);
56	56	}
...	...	@@ -1362,10 +1362,20 @@
1362	1362	spin_lock(&dev_priv->irq_lock);
1363	1363	for (i = 1; i < HPD_NUM_PINS; i++) {
1364	1364
1365		- WARN_ONCE(hpd[i] & hotplug_trigger &&
1366		- dev_priv->hpd_stats[i].hpd_mark == HPD_DISABLED,
1367		- "Received HPD interrupt (0x%08x) on pin %d (0x%08x) although disabled\n",
1368		- hotplug_trigger, i, hpd[i]);
	1365	+ if (hpd[i] & hotplug_trigger &&
	1366	+ dev_priv->hpd_stats[i].hpd_mark == HPD_DISABLED) {
	1367	+ /*
	1368	+ * On GMCH platforms the interrupt mask bits only
	1369	+ * prevent irq generation, not the setting of the
	1370	+ * hotplug bits itself. So only WARN about unexpected
	1371	+ * interrupts on saner platforms.
	1372	+ */
	1373	+ WARN_ONCE(INTEL_INFO(dev)->gen >= 5 && !IS_VALLEYVIEW(dev),
	1374	+ "Received HPD interrupt (0x%08x) on pin %d (0x%08x) although disabled\n",
	1375	+ hotplug_trigger, i, hpd[i]);
	1376	+
	1377	+ continue;
	1378	+ }
1369	1379
1370	1380	if (!(hpd[i] & hotplug_trigger) \|\|
1371	1381	dev_priv->hpd_stats[i].hpd_mark != HPD_ENABLED)
...	...	@@ -827,6 +827,7 @@
827	827	# define MI_FLUSH_ENABLE (1 << 12)
828	828	# define ASYNC_FLIP_PERF_DISABLE (1 << 14)
829	829	# define MODE_IDLE (1 << 9)
	830	+# define STOP_RING (1 << 8)
830	831
831	832	#define GEN6_GT_MODE 0x20d0
832	833	#define GEN7_GT_MODE 0x7008
...	...	@@ -9654,11 +9654,22 @@
9654	9654	PIPE_CONF_CHECK_I(pipe_src_w);
9655	9655	PIPE_CONF_CHECK_I(pipe_src_h);
9656	9656
9657		- PIPE_CONF_CHECK_I(gmch_pfit.control);
9658		- /* pfit ratios are autocomputed by the hw on gen4+ */
9659		- if (INTEL_INFO(dev)->gen < 4)
9660		- PIPE_CONF_CHECK_I(gmch_pfit.pgm_ratios);
9661		- PIPE_CONF_CHECK_I(gmch_pfit.lvds_border_bits);
	9657	+ /*
	9658	+ * FIXME: BIOS likes to set up a cloned config with lvds+external
	9659	+ * screen. Since we don't yet re-compute the pipe config when moving
	9660	+ * just the lvds port away to another pipe the sw tracking won't match.
	9661	+ *
	9662	+ * Proper atomic modesets with recomputed global state will fix this.
	9663	+ * Until then just don't check gmch state for inherited modes.
	9664	+ */
	9665	+ if (!PIPE_CONF_QUIRK(PIPE_CONFIG_QUIRK_INHERITED_MODE)) {
	9666	+ PIPE_CONF_CHECK_I(gmch_pfit.control);
	9667	+ /* pfit ratios are autocomputed by the hw on gen4+ */
	9668	+ if (INTEL_INFO(dev)->gen < 4)
	9669	+ PIPE_CONF_CHECK_I(gmch_pfit.pgm_ratios);
	9670	+ PIPE_CONF_CHECK_I(gmch_pfit.lvds_border_bits);
	9671	+ }
	9672	+
9662	9673	PIPE_CONF_CHECK_I(pch_pfit.enabled);
9663	9674	if (current_config->pch_pfit.enabled) {
9664	9675	PIPE_CONF_CHECK_I(pch_pfit.pos);
...	...	@@ -11615,6 +11626,8 @@
11615	11626	list_for_each_entry(crtc, &dev->mode_config.crtc_list,
11616	11627	base.head) {
11617	11628	memset(&crtc->config, 0, sizeof(crtc->config));
	11629	+
	11630	+ crtc->config.quirks \|= PIPE_CONFIG_QUIRK_INHERITED_MODE;
11618	11631
11619	11632	crtc->active = dev_priv->display.get_pipe_config(crtc,
11620	11633	&crtc->config);
...	...	@@ -3619,7 +3619,8 @@
3619	3619	{
3620	3620	struct drm_connector *connector = &intel_connector->base;
3621	3621	struct intel_digital_port *intel_dig_port = dp_to_dig_port(intel_dp);
3622		- struct drm_device *dev = intel_dig_port->base.base.dev;
	3622	+ struct intel_encoder *intel_encoder = &intel_dig_port->base;
	3623	+ struct drm_device *dev = intel_encoder->base.dev;
3623	3624	struct drm_i915_private *dev_priv = dev->dev_private;
3624	3625	struct drm_display_mode *fixed_mode = NULL;
3625	3626	bool has_dpcd;
...	...	@@ -3628,6 +3629,14 @@
3628	3629
3629	3630	if (!is_edp(intel_dp))
3630	3631	return true;
	3632	+
	3633	+ /* The VDD bit needs a power domain reference, so if the bit is already
	3634	+ * enabled when we boot, grab this reference. */
	3635	+ if (edp_have_panel_vdd(intel_dp)) {
	3636	+ enum intel_display_power_domain power_domain;
	3637	+ power_domain = intel_display_port_power_domain(intel_encoder);
	3638	+ intel_display_power_get(dev_priv, power_domain);
	3639	+ }
3631	3640
3632	3641	/* Cache DPCD and EDID for edp. */
3633	3642	intel_edp_panel_vdd_on(intel_dp);