kernel/linux.git/drivers/gpu/drm/msm, branch v4.4.109

drm/msm: fix an integer overflow test

2017-11-08T09:06:28+00:00

commit 65e93108891e571f177c202add9288eda9ac4100 upstream. We recently added an integer overflow check but it needs an additional tweak to work properly on 32 bit systems. The problem is that we're doing the right hand side of the assignment as type unsigned long so the max it will have an integer overflow instead of being larger than SIZE_MAX. That means the "sz > SIZE_MAX" condition is never true even on 32 bit systems. We need to first cast it to u64 and then do the math. Fixes: 4a630fadbb29 ("drm/msm: Fix potential buffer overflow issue") Signed-off-by: Dan Carpenter Acked-by: Jordan Crouse Signed-off-by: Rob Clark Cc: Ben Hutchings Signed-off-by: Greg Kroah-Hartman

drm/msm: Fix potential buffer overflow issue

2017-11-08T09:06:28+00:00

commit 4a630fadbb29d9efaedb525f1a8f7449ad107641 upstream. In function submit_create, if nr_cmds or nr_bos is assigned with negative value, the allocated buffer may be small than intended. Using this buffer will lead to buffer overflow issue. Signed-off-by: Kasin Li Signed-off-by: Jordan Crouse Signed-off-by: Rob Clark Cc: Ben Hutchings Signed-off-by: Greg Kroah-Hartman

drm/msm: Verify that MSM_SUBMIT_BO_FLAGS are set

2017-08-07T02:19:44+00:00

[ Upstream commit a6cb3b864b21b7345f824a4faa12b723c8aaf099 ] For every submission buffer object one of MSM_SUBMIT_BO_WRITE and MSM_SUBMIT_BO_READ must be set (and nothing else). If we allowed zero then the buffer object would never get queued to be unreferenced. Signed-off-by: Jordan Crouse Signed-off-by: Rob Clark Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

drm/msm: Ensure that the hardware write pointer is valid

2017-08-07T02:19:44+00:00

[ Upstream commit 88b333b0ed790f9433ff542b163bf972953b74d3 ] Currently the value written to CP_RB_WPTR is calculated on the fly as (rb->next - rb->start). But as the code is designed rb->next is wrapped before writing the commands so if a series of commands happened to fit perfectly in the ringbuffer, rb->next would end up being equal to rb->size / 4 and thus result in an out of bounds address to CP_RB_WPTR. The easiest way to fix this is to mask WPTR when writing it to the hardware; it makes the hardware happy and the rest of the ringbuffer math appears to work and there isn't any point in upsetting anything. Signed-off-by: Jordan Crouse [squash in is_power_of_2() check] Signed-off-by: Rob Clark Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

drm/msm: Expose our reservation object when exporting a dmabuf.

2017-06-14T11:16:23+00:00

commit 43523eba79bda8f5b4c27f8ffe20ea078d20113a upstream. Without this, polling on the dma-buf (and presumably other devices synchronizing against our rendering) would return immediately, even while the BO was busy. Signed-off-by: Eric Anholt Reviewed-by: Daniel Vetter Cc: Rob Clark Cc: linux-arm-msm@vger.kernel.org Cc: freedreno@lists.freedesktop.org Reviewed-by: Rob Clark Signed-off-by: Rob Clark Signed-off-by: Greg Kroah-Hartman

drm/msm: fix use of copy_from_user() while holding spinlock

2016-09-15T06:27:51+00:00

commit 89f82cbb0d5c0ab768c8d02914188aa2211cd2e3 upstream. Use instead __copy_from_user_inatomic() and fallback to slow-path where we drop and re-aquire the lock in case of fault. Reported-by: Vaishali Thakkar Signed-off-by: Rob Clark Signed-off-by: Greg Kroah-Hartman

drm/msm: Remove local fbdev emulation Kconfig option

2015-10-22T19:46:36+00:00

DRM_MSM_FBDEV config is used to enable/disable fbdev emulation for the msm kms driver. Replace this with the top level DRM_FBDEV_EMULATION config option where applicable. This also prevents build breaks caused by undefined drm_fb_helper_* functions when legacy fbdev support was disabled. Signed-off-by: Archit Taneja Signed-off-by: Rob Clark

drm/msm/mdp5: Basic support for MDP5 v1.7 (MSM8996)

2015-10-22T19:39:57+00:00

This change adds the basic MDP5 support for MSM8996. Signed-off-by: Stephane Viau Signed-off-by: Rob Clark

drm/msm/mdp: Add Software Pixel Extension support

2015-10-22T19:39:56+00:00

In order to produce an image, the scalar needs to be fed extra pixels. These top/bottom/left/right values depend on a various of factors, including resolution, scaling type, phase step and initial phase. Pixel Extension are programmed by hardware in most targets - and can be overwritten by software. For some targets (e.g.: msm8996), software *must* program those registers. In order to ease this computation, let's always use bilinear filters, which are easier to program from kernel. Eventually, all of these values will come down from user space for better quality. Signed-off-by: Stephane Viau Signed-off-by: Rob Clark

drm/msm/mdp5: Use the newly introduced enum mdp_component_type

2015-10-22T19:39:56+00:00

When calculating phase steps, let's use the same enum mdp_component_type in order to ease the readability; 0/1 indexes are a bit confusing and we now have explicit values to index this type of arrays. Signed-off-by: Stephane Viau Signed-off-by: Rob Clark