talos-obmc-linux/drivers/gpu, branch dev-4.10

drm/ttm: fix use-after-free races in vm fault handling

2017-05-14T12:08:30+00:00

commit 3089c1df10e2931b1d72d2ffa7d86431084c86b3 upstream. The vm fault handler relies on the fact that the VMA owns a reference to the BO. However, once mmap_sem is released, other tasks are free to destroy the VMA, which can lead to the BO being freed. Fix two code paths where that can happen, both related to vm fault retries. Found via a lock debugging warning which flagged &bo->wu_mutex as locked while being destroyed. Fixes: cbe12e74ee4e ("drm/ttm: Allow vm fault retries") Signed-off-by: Nicolai Hähnle Reviewed-by: Christian König Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman

drm: mxsfb: drm_dev_alloc() returns error pointers

2017-05-14T12:08:30+00:00

commit e89e50ac35d9126907a436dabe70f9a8311b9981 upstream. We should be checking for IS_ERR() instead of NULL because drm_dev_alloc() returns error pointers. Fixes: 45d59d704080 ("drm: Add new driver for MXSFB controller") Signed-off-by: Dan Carpenter Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/20161213122332.GA7519@elgon.mountain Signed-off-by: Greg Kroah-Hartman

drm/hisilicon/hibmc: Fix wrong pointer passed to PTR_ERR()

2017-05-14T12:08:30+00:00

commit bdf6f135973acb409b3ec5a6214fb597670a0bc0 upstream. PTR_ERR should access the value just tested by IS_ERR, otherwise the wrong error code will be returned. Fixes: d1667b86795a ("drm/hisilicon/hibmc: Add support for frame buffer") Signed-off-by: Wei Yongjun Reviewed-by: Gustavo Padovan Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/20170112151921.16538-1-weiyj.lk@gmail.com Signed-off-by: Greg Kroah-Hartman

drm/sti: fix GDP size to support up to UHD resolution

2017-05-14T12:08:19+00:00

commit 2f410f88c0a1c7e19762918d2614f506a7b63a82 upstream. On stih407-410 chip family the GDP layers are able to support up to UHD resolution (3840 x 2160). Signed-off-by: Vincent Abriou Acked-by: Lee Jones Tested-by: Lee Jones Link: http://patchwork.freedesktop.org/patch/msgid/1490280292-30466-1-git-send-email-vincent.abriou@st.com Signed-off-by: Greg Kroah-Hartman

drm/i915/gvt: set the correct default value of CTX STATUS PTR

2017-04-21T07:32:41+00:00

commit a34f83639490a5cc11a9d5c1b3773d4b6eb69a9e upstream. Fix wrong initial csb read pointer value. This fixes the random engine timeout issue in guest when guest boots up. Fixes: 8453d674ae7e ("drm/i915/gvt: vGPU execlist virtualization") Signed-off-by: Min He Signed-off-by: Zhenyu Wang Signed-off-by: Greg Kroah-Hartman

drm/fb-helper: Allow var->x/yres(_virtual) < fb->width/height again

2017-04-21T07:32:37+00:00

commit 12ffed96d4369f086261ba2ee734fa8c932d7f55 upstream. Otherwise this can also prevent modesets e.g. for switching VTs, when multiple monitors with different native resolutions are connected. The depths must match though, so keep the != test for that. Also update the DRM_DEBUG output to be slightly more accurate, this doesn't only affect requests from userspace. Bugzilla: https://bugs.freedesktop.org/99841 Fixes: 865afb11949e ("drm/fb-helper: reject any changes to the fbdev") Signed-off-by: Michel Dänzer Reviewed-by: Daniel Stone Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/20170323085326.20185-1-michel@daenzer.net Signed-off-by: Greg Kroah-Hartman

drm/etnaviv: fix missing unlock on error in etnaviv_gpu_submit()

2017-04-21T07:32:37+00:00

commit 45abdf35cf82e4270328c7237e7812de960ac560 upstream. Add the missing unlock before return from function etnaviv_gpu_submit() in the error handling case. lst: fixed label name. Fixes: f3cd1b064f11 ("drm/etnaviv: (re-)protect fence allocation with GPU mutex") Signed-off-by: Wei Yongjun Signed-off-by: Lucas Stach Signed-off-by: Greg Kroah-Hartman

drm/nouveau: initial support (display-only) for GP107

2017-04-21T07:32:37+00:00

commit da2ba564a6dcf46df4f828624ff55531ff11d5b0 upstream. Forked from GP106 implementation. Split out from commit enabling secboot/gr support so that it can be added to earlier kernels. Signed-off-by: Ben Skeggs Signed-off-by: Greg Kroah-Hartman

drm/nouveau/kms/nv50: fix double dma_fence_put() when destroying plane state

2017-04-21T07:32:37+00:00

commit 2907e8670b6ef253bffb33bf47fd2182969cf2a0 upstream. When the atomic support was added to nouveau, the DRM core did not do this. However, later in the same merge window, a commit (drm/fence: add in-fences support) was merged that added it, leading to use-after-frees of the fence object. Signed-off-by: Ben Skeggs Signed-off-by: Greg Kroah-Hartman

drm/nouveau/kms/nv50: fix setting of HeadSetRasterVertBlankDmi method

2017-04-21T07:32:37+00:00

commit d639fbcc102745187f747a21bdcffcf628e174c8 upstream. Signed-off-by: Ben Skeggs Signed-off-by: Greg Kroah-Hartman