The patch f045f459 ("drm/nouveau/fbcon: fix out-of-bounds memory accesses")
tries to fix some out of memory accesses. Unfortunatelly, the patch breaks the
display when using fonts with width that is not divisiable by 8.

The monochrome bitmap for each character is stored in memory by lines from top
to bottom. Each line is padded to a full byte.

For example, for 22x11 font, each line is padded to 16 bits, so each
character is consuming 44 bytes total, that is 11 32-bit words. The patch
f045f459 changed the logic to "dsize = ALIGN(image->width *
image->height, 32) >> 5", that is just 8 words - this is incorrect and it
causes display corruption.

This patch adds the necesary padding of lines to 8 bytes.

This patch should be backported to stable kernels where f045f459 was
backported.
Signed-off-by: NMikulas Patocka <mpatocka@redhat.com>
Fixes: f045f459 ("drm/nouveau/fbcon: fix out-of-bounds memory accesses")
Cc: stable@vger.kernel.org
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

This adds drm bridge support for the NXP/Freescale DCU. The patchset
has been discussed on the mailing list since quite some time...
Plus there is a small fix provided by Peter.

* 'for-next' of http://git.agner.ch/git/linux-drm-fsl-dcu:
  drm/fsl-dcu: add support for drm bridge
  drm/fsl-dcu: rework codes to support of_graph dt binding for panel
  drm/fsl-dcu: add missing of_node_put after calling of_parse_phandle

Merge branch 'drm-rockchip-next-fixes-2016-07-19' of https://github.com/markyzq/kernel-drm-rockchip into drm-next

Here are some little fixes for rockchip drm, looks good for me, and there is no doubt on them, So I'd like you can land them.

* 'drm-rockchip-next-fixes-2016-07-19' of https://github.com/markyzq/kernel-drm-rockchip:
  drm/rockchip: allocate correct crtc state structure on reset
  drm/rockchip: Delete an unnecessary check before drm_gem_object_unreference_unlocked()
  drm/rockchip: fix a couple off by one bugs
  drm/rockchip: vop: correct rk3036 register define
  drm/rockchip: vop: correct the source size of uv scale factor setting
  drm/rockchip: vop: add uv_vir register field for RK3036 VOP
  drm/rockchip: fix "should it be static?" warnings
  drm/rockchip: fb: add missing header
  drm/rockchip: dw_hdmi: remove unused #include

This is an update to the previous drm bridge pull request. The ADV7511
driver's conversion from slave encoder to bridge meant that its users
(the rcar-du kms driver) should use the bridge interface too. This pull
request now also contains a commit that updates the rcar-du's hdmi encoder
interface from slave encoder to bridge.

The other updates are as before:

- Converts the ADV7511 i2c slave encoder driver to a bridge driver.
  Adds support for the ADV7533 bridge chip.
- Add bridge driver for TC358767 (DSI/DPI to eDP) encoder chips.

* 'drm_bridge_for_4.8' of https://github.com/boddob/linux:
  drm: rcar-du: Remove i2c slave encoder interface for hdmi encoder
  drm/bridge: tc358767: Add DPI to eDP bridge driver
  dt-bindings: tc358767: add DT documentation
  dt-bindings: drm/bridge: Update bindings for ADV7533
  drm/bridge: adv7533: Change number of DSI lanes dynamically
  drm/bridge: adv7533: Use internal timing generator
  drm/bridge: adv7533: Create a MIPI DSI device
  drm/bridge: adv7533: Initial support for ADV7533
  drm/bridge: adv7511: Fix mutex deadlock when interrupts are disabled
  drm/i2c: adv7511: Move to bridge folder
  drm/i2c: adv7511: Convert to drm_bridge

Because we are using a custom crtc_state structure, we must override the
reset helper to allocate the correct amount of memory.

Cc: stable@vger.kernel.org
Fixes: 4e257d9e ("drm/rockchip: get rid of rockchip_drm_crtc_mode_config")
Signed-off-by: NJohn Keeping <john@metanate.com>
Signed-off-by: NMark Yao <mark.yao@rock-chips.com>
Reviewed-by: NSean Paul <seanpaul@chromium.org>

The drm_gem_object_unreference_unlocked() function tests whether
its argument is NULL and then returns immediately.
Thus the test around the call is not needed.

This issue was detected by using the Coccinelle software.
Signed-off-by: NMarkus Elfring <elfring@users.sourceforge.net>

The priv->crtc_funcs[] array has ROCKCHIP_MAX_CRTC elements so > should
be >= here.

Fixes: 2048e328 ('drm: rockchip: Add basic drm driver')
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: NSean Paul <seanpaul@chromium.org>

Signed-off-by: NMark Yao <mark.yao@rock-chips.com>
Reported-by: NTomasz Figa <tfiga@chromium.org>

When the input color format is YUV, we need to do some external scale
for CBCR. Like,
 * In YUV420 data format:
     cbcr_xscale = dst_w / src_w * 2;
     cbcr_yscale = dst_h / src_h * 2;
 * In YUV422 data format:
     cbcr_xscale = dst_w / src_w * 2;
     cbcr_yscale = dst_h / src_h;
 * In YUV444 data format
     cbcr_xscale = dst_w / src_w;
     cbcr_yscale = dst_h / src_h;
Signed-off-by: NYakir Yang <ykk@rock-chips.com>

The WIN0 of RK3036 VOP could support YUV data format, but driver
forget to add the uv_vir register field for it.
Signed-off-by: NYakir Yang <ykk@rock-chips.com>

Combined with the previous commit, this fixes all of the sparse warnings
in drm/rockchip.
Signed-off-by: NJohn Keeping <john@metanate.com>

This fixes the following sparse warnings:

drivers/gpu/drm/rockchip/rockchip_drm_fb.c:32:23: warning: symbol 'rockchip_fb_get_gem_obj' was not declared. Should it be static?
drivers/gpu/drm/rockchip/rockchip_drm_fb.c:315:24: warning: symbol 'rockchip_drm_framebuffer_init' was not declared. Should it be static?
drivers/gpu/drm/rockchip/rockchip_drm_fb.c:329:6: warning: symbol 'rockchip_drm_mode_config_init' was not declared. Should it be static?
Signed-off-by: NJohn Keeping <john@metanate.com>

drm_encoder_slave is not used in this file.
Signed-off-by: NJohn Keeping <john@metanate.com>

This time, a bunch of cleanups and refactoring work so that we can get
dt bindings upstream.  In general, we keep compatibility with existing
downstream bindings as much as possible, to make backports to device
kernels easier, but now we have cleaner upstream bindings so that we
can start landing gpu/display support in upstream dts files.

Plus shrinker and madvise support, which has been on my todo list for
a long time.  And support for arbitrary # of cmd bufs in submit ioctl
(I've got libdrm+mesa userspace for this on branches) to enable some
of the mesa batch/reorder stuff I'm working on.  Userspace decides
whether this is supported based on advertised driver version.  For the
interesting userspace bits, see:

  https://github.com/freedreno/libdrm/commit/1baf03ac6e77049d9c8be1e3d5164283ce82c9db

Plus support for ASoC hdmi audio codec, and few other random other
cleanups.

* 'msm-next' of git://people.freedesktop.org/~robclark/linux: (52 commits)
  drm/msm: Delete an unnecessary check before drm_gem_object_unreference()
  drm/msm: Delete unnecessary checks before drm_gem_object_unreference_unlocked()
  drm/msm/hdmi: Delete an unnecessary check before the function call "kfree"
  drm/msm: return -EFAULT instead of bytes remaining
  drm/msm/hdmi: use PTR_ERR_OR_ZERO() to simplify the code
  drm/msm: add missing of_node_put after calling of_parse_phandle
  drm/msm: Replace drm_fb_get_bpp_depth() with drm_format_plane_cpp()
  drm/msm/dsi: Fix return value check in msm_dsi_host_set_display_mode()
  drm: msm: Add ASoC generic hdmi audio codec support.
  drm/msm/rd: add module param to dump all bo's
  drm/msm/rd: split out snapshot_buf helper
  drm/msm: bump kernel api version
  drm/msm: deal with arbitrary # of cmd buffers
  drm/msm: wire up vmap shrinker
  drm/msm: change gem->vmap() to get/put
  drm/msm: shrinker support
  drm/msm: add put_iova() helper
  drm/msm: add madvise ioctl
  drm/msm: use mutex_lock_interruptible for submit ioctl
  dt-bindings: msm/mdp: Provide details on MDP interface ports
  ...

The hdmi output in rcar-du uses the i2c slave encoder interface to link
to the adv7511 encoder chip. The kms driver creates encoder and connector
entities that internally uses the drm_encoder_slave_funcs ops provided by
the slave encoder driver.

Change the driver such that it expects a bridge entity instead of a slave
encoder. The hdmi connector code isn't needed anymore as we expect the
adv7511 bridge driver to create/manage the connector.

Note that the kms driver still expects a connector node for hdmi to be
present in DT. This node has no connection to the connector created
by the bridge driver.
Tested-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NArchit Taneja <architt@codeaurora.org>

Add a drm_bridge driver for the Toshiba TC358767 DPI/DSI to
eDP/DP bridge. Currently only DPI input with 24-bit RGB is
supported.
Signed-off-by: NAndrey Gusakov <andrey.gusakov@cogentembedded.com>
Signed-off-by: NPhilipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: NArchit Taneja <architt@codeaurora.org>

Add DT binding documentation for the Toshiba TC358767 eDP bridge.
Acked-by: NRob Herring <robh@kernel.org>
Signed-off-by: NPhilipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: NArchit Taneja <architt@codeaurora.org>

The drm_gem_object_unreference() function tests whether its argument
is NULL and then returns immediately.
Thus the test around the call is not needed.

This issue was detected by using the Coccinelle software.
Signed-off-by: NMarkus Elfring <elfring@users.sourceforge.net>
Signed-off-by: NRob Clark <robdclark@gmail.com>

The drm_gem_object_unreference_unlocked() function tests whether
its argument is NULL and then returns immediately.
Thus the test around the calls is not needed.

This issue was detected by using the Coccinelle software.
Signed-off-by: NMarkus Elfring <elfring@users.sourceforge.net>
Signed-off-by: NRob Clark <robdclark@gmail.com>

The kfree() function tests whether its argument is NULL and then
returns immediately. Thus the test around the call is not needed.

This issue was detected by using the Coccinelle software.
Signed-off-by: NMarkus Elfring <elfring@users.sourceforge.net>
Signed-off-by: NRob Clark <robdclark@gmail.com>

copy_to/from_user returns the number of bytes remaining to be copied but
we want to return -EFAULT.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NRob Clark <robdclark@gmail.com>

Use PTR_ERR_OR_ZERO rather than if(IS_ERR(...)) + PTR_ERR.

Generated by: scripts/coccinelle/api/ptr_ret.cocci
Signed-off-by: NWei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: NRob Clark <robdclark@gmail.com>

of_node_put needs to be called when the device node which is got
from of_parse_phandle has finished using.
Signed-off-by: NPeter Chen <peter.chen@nxp.com>
[rebased on top of Archit's DT rework, so looses one hunk]
Signed-off-by: NRob Clark <robdclark@gmail.com>

The driver needs the number of bytes per pixel, not the bpp and depth
info meant for fbdev compatibility. Use the right API.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NRob Clark <robdclark@gmail.com>

In case of error, the function drm_mode_duplicate() returns NULL
pointer not ERR_PTR(). The IS_ERR() test in the return value check
should be replaced with NULL test.
Signed-off-by: NWei Yongjun <yongjun_wei@trendmicro.com.cn>
Reviewed-by: NArchit Taneja <architt@codeaurora.org>
Signed-off-by: NRob Clark <robdclark@gmail.com>

This patch adds support to generic audio codec via
ASoC hdmi-codec infrastucture which is merged recently.
Signed-off-by: NSrinivas Kandagatla <srinivas.kandagatla@linaro.org>
[rebased on efc9194b]
Signed-off-by: NRob Clark <robdclark@gmail.com>

By default, if using $debugfs/.../rd to log cmdstream, only the
cmdstream buffers themselves are logged.  But in some cases we want
to capture other buffers in the submit (to see VBO's or shaders).
So add a mod-param knob to control this.
Signed-off-by: NRob Clark <robdclark@gmail.com>

(reduce the noise in next patch)
Signed-off-by: NRob Clark <robdclark@gmail.com>

Signed-off-by: NRob Clark <robdclark@gmail.com>

For some optimizations coming on the userspace side, splitting larger
draw or gmem cmds into multiple cmdstream buffers, we need to support
much more than the previous small/arbitrary limit.
Signed-off-by: NRob Clark <robdclark@gmail.com>

Signed-off-by: NRob Clark <robdclark@gmail.com>

Before we can add vmap shrinking, we really need to know which vmap'ings
are currently being used.  So switch to get/put interface.  Stubbed put
fxns for now.
Signed-off-by: NRob Clark <robdclark@gmail.com>

For a first step, only purge obj->madv==DONTNEED objects.  We could be
more agressive and next try unpinning inactive objects..  but that is
only useful if you have swap.
Signed-off-by: NRob Clark <robdclark@gmail.com>

We'll need this too for shrinker/purging.
Signed-off-by: NRob Clark <robdclark@gmail.com>

Doesn't do anything too interesting until we wire up shrinker.  Pretty
much lifted from i915.
Signed-off-by: NRob Clark <robdclark@gmail.com>

Be kinder to things that do lots of signal handling (ie. Xorg)
Signed-off-by: NRob Clark <robdclark@gmail.com>

The MDP4/5 DT node now contains a list of ports that describe how it
connects to external encoder interfaces like DSI and HDMI. These follow
the standard of_graph bindings, and allow us to get rid of the 'connectors'
phandle that contained a list of all the external encoders connected to
MDP.
Acked-by: NRob Herring <robh@kernel.org>
Signed-off-by: NArchit Taneja <architt@codeaurora.org>
Signed-off-by: NRob Clark <robdclark@gmail.com>

Add a new doc for DT bindings for platforms that contain MDP5 display
controller hardware. The doc describes bindings for the top level
MDSS wrapper hardware and MDP5 itself.

Add an example for the bindings as found in MSM8916.
Acked-by: NRob Herring <robh@kernel.org>
Signed-off-by: NArchit Taneja <architt@codeaurora.org>
Signed-off-by: NRob Clark <robdclark@gmail.com>

MDP4 and MDP5 vary a bit in terms of device hierarchy and the properties
they require. Rename the binding doc to mdp4.txt and remove MDP5 specific
pieces. A separate document will be created for MDP5
Acked-by: NRob Herring <robh@kernel.org>
Signed-off-by: NArchit Taneja <architt@codeaurora.org>
Signed-off-by: NRob Clark <robdclark@gmail.com>

The DSI host and PHY driver currently expects the DT bindings to provide
custom properties "qcom,dsi-host-index" and "qcom,dsi-phy-index" so that
the driver can identify which DSI instance it is.

The binding isn't acceptable, but the driver still needs to figure out
what its instance id. This is now done by storing the mmio starting
addresses for each DSI instance in every SoC version in the driver. The
driver then identifies the index number by trying to match the stored
address with comparing the resource start address we get from DT.

We don't have compatible strings for DSI PHY on each SoC, but only the
DSI PHY type. We only support one SoC version for each PHY type, so we
get away doing the same thing above for the PHY driver. We can revisit
this when we support two SoCs with the same DSI PHY.
Signed-off-by: NArchit Taneja <architt@codeaurora.org>
Signed-off-by: NRob Clark <robdclark@gmail.com>