The mipi_dsi_packet_create() function dereferences the msg pointer
before checking that it's valid. Move the dereference down to where it
is required to avoid potentially dereferencing a NULL pointer.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>

* tag 'topic/atomic-core-2015-01-27' of git://anongit.freedesktop.org/drm-intel:
  drm/atomic: Fix potential use of state after free
  drm/atomic-helper: debug output for modesets
  drm/atomic-helpers: Saner encoder/crtc callbacks
  drm/atomic-helpers: Recover full cursor plane behaviour
  drm/atomic-helper: add connector->dpms() implementation
  drm/atomic: Add drm_crtc_state->active
  drm: Add standardized boolean props
  drm/plane-helper: Fix transitional helper kerneldocs
  drm/plane-helper: Skip prepare_fb/cleanup_fb when newfb==oldfb

Conflicts:
	include/drm/drm_crtc_helper.h

drm/tegra: Changes for v3.20-rc1

The biggest part of these changes is the conversion to atomic mode-
setting. A lot of cleanup and demidlayering was required before the
conversion, with the result being a whole lot of changes.

Besides the atomic mode-setting support, the host1x bus now has the
proper infrastructure to support suspend/resume for child devices.

Finally, a couple of smaller cleanup patches round things off.

* tag 'drm/tegra/for-3.20-rc1' of git://anongit.freedesktop.org/tegra/linux: (54 commits)
  drm/tegra: Use correct relocation target offsets
  drm/tegra: Add minimal power management
  drm/tegra: dc: Unify enabling the display controller
  drm/tegra: Track tiling and format in plane state
  drm/tegra: Track active planes in CRTC state
  drm/tegra: Remove unused ->mode_fixup() callbacks
  drm/tegra: Atomic conversion, phase 3, step 3
  drm/tegra: Atomic conversion, phase 3, step 2
  drm/tegra: dc: Use atomic clock state in modeset
  drm/tegra: sor: Implement ->atomic_check()
  drm/tegra: hdmi: Implement ->atomic_check()
  drm/tegra: dsi: Implement ->atomic_check()
  drm/tegra: rgb: Implement ->atomic_check()
  drm/tegra: dc: Store clock setup in atomic state
  drm/tegra: Atomic conversion, phase 3, step 1
  drm/tegra: Atomic conversion, phase 2
  drm/tegra: Atomic conversion, phase 1
  drm/tegra: dc: Do not needlessly deassert reset
  drm/tegra: Output cleanup functions cannot fail
  drm/tegra: Remove remnants of the output midlayer
  ...

When copying a relocation from userspace, copy the correct target
offset.
Signed-off-by: David Ung <davidu@nvidia.com>
Fixes: 961e3bea ("drm/tegra: Make job submission 64-bit safe")
Cc: stable@vger.kernel.org
[treding@nvidia.com: provide a better commit message]
Signed-off-by: Thierry Reding <treding@nvidia.com>

For now only disable the KMS hotplug polling helper logic upon suspend
and re-enable it on resume.
Reviewed-by: Sean Paul <seanpaul@chromium.org>
Reviewed-by: Mark Zhang <markz@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>

Previously output drivers would enable continuous display mode and power
up the display controller at various points during the initialization.
This is suboptimal because it accesses display controller registers in
output drivers and duplicates a bit of code.

Move this code into the display controller driver and enable the display
controller as the final step of the ->mode_set_nofb() implementation.
Signed-off-by: Thierry Reding <treding@nvidia.com>

Tracking these in the plane state allows them to be computed in the
->atomic_check() callback and reused when applying the configuration in
->atomic_update().
Signed-off-by: Thierry Reding <treding@nvidia.com>

Wrap struct drm_crtc_state in a driver-specific structure and add the
planes field which keeps track of which planes are updated or disabled
during a modeset. This allows atomic updates of the the display engine
at ->atomic_flush() time.

v2: open-code getting the state of the CRTC that the plane is being
    attached to (Daniel Vetter)
Signed-off-by: Thierry Reding <treding@nvidia.com>

All output drivers have now been converted to use the ->atomic_check()
callback, so the ->mode_fixup() callbacks are no longer used.
Signed-off-by: Thierry Reding <treding@nvidia.com>

Provide a custom ->atomic_commit() implementation which supports async
commits. The generic atomic page-flip helper can use this to implement
page-flipping.
Signed-off-by: Thierry Reding <treding@nvidia.com>

Replace drm_crtc_helper_set_config() by drm_atomic_helper_set_config().
All drivers have now been converted to use ->atomic_check() to set the
atomic state, therefore the atomic mode setting helpers can be used.
Signed-off-by: Thierry Reding <treding@nvidia.com>

All clock state is now stored in the display controller's atomic state,
so the output drivers no longer need to call back into the display
controller driver to set up the clock. This is also required to make
sure no hardware changes are made before validating a configuration.
Signed-off-by: Thierry Reding <treding@nvidia.com>

The implementation of the ->atomic_check() callback precomputes all
parameters to check if the given configuration can be applied. If so the
precomputed values are stored in the atomic state object for the encoder
and applied during modeset. In that way the modeset no longer needs to
perform any checking but simply program values into registers.
Signed-off-by: Thierry Reding <treding@nvidia.com>

The implementation of the ->atomic_check() callback precomputes all
parameters to check if the given configuration can be applied. If so the
precomputed values are stored in the atomic state object for the encoder
and applied during modeset. In that way the modeset no longer needs to
perform any checking but simply program values into registers.
Signed-off-by: Thierry Reding <treding@nvidia.com>

The implementation of the ->atomic_check() callback precomputes all
parameters to check if the given configuration can be applied. If so the
precomputed values are stored in the atomic state object for the encoder
and applied during modeset. In that way the modeset no longer needs to
perform any checking but simply program values into registers.
Signed-off-by: Thierry Reding <treding@nvidia.com>

The implementation of the ->atomic_check() callback precomputes all
parameters to check if the given configuration can be applied. If so the
precomputed values are stored in the atomic state object for the encoder
and applied during modeset. In that way the modeset no longer needs to
perform any checking but simply program values into registers.
Signed-off-by: Thierry Reding <treding@nvidia.com>

This allows the clock setup to be separated from the clock programming
and better matches the expectations of the atomic modesetting where no
code paths must fail during modeset.
Signed-off-by: Thierry Reding <treding@nvidia.com>

Switch out the regular plane helpers for the atomic plane helpers. Also
use the default atomic helpers to implement the ->atomic_check() and
->atomic_commit() callbacks. The driver now exclusively uses the atomic
interfaces.
Signed-off-by: Thierry Reding <treding@nvidia.com>

Hook up the default ->reset() and ->atomic_duplicate_state() helpers.
This ensures that state objects are properly created and framebuffer
reference counts correctly maintained.
Signed-off-by: Thierry Reding <treding@nvidia.com>

Implement initial atomic state handling. Hook up the CRTCs, planes' and
connectors' ->atomic_destroy_state() callback to ensure that the atomic
state objects don't leak.

Furthermore the CRTC now implements the ->mode_set_nofb() callback that
is used by new helpers to implement ->mode_set() and ->mode_set_base().
These new helpers also make use of the new plane helper functions which
the driver now provides.
Signed-off-by: Thierry Reding <treding@nvidia.com>

Commit 9c012700 ("drm/tegra: dc: Add powergate support") changed the
driver's ->probe() implementation to deassert the module reset, and with
there being nobody else to assert it until ->remove() there is no need
to deassert again later on.
Signed-off-by: Thierry Reding <treding@nvidia.com>

The tegra_output_exit() and tegra_output_remove() functions cannot fail,
so make them return void.
Signed-off-by: Thierry Reding <treding@nvidia.com>

The tegra_output midlayer is now completely gone and output drivers use
it purely as a helper library.
Signed-off-by: Thierry Reding <treding@nvidia.com>

The debugfs cleanup code never fails, so no error is returned. Therefore
the functions can all return void instead.
Signed-off-by: Thierry Reding <treding@nvidia.com>

Implement encoder and connector within the eDP driver itself using the
Tegra output helpers rather than using the Tegra output as midlayer. By
doing so one level of indirection is removed and output drivers become
more flexible while keeping the majority of the advantages provided by
the common output helpers.
Signed-off-by: Thierry Reding <treding@nvidia.com>

Implement encoder and connector within the DSI driver itself using the
Tegra output helpers rather than using the Tegra output as midlayer. By
doing so one level of indirection is removed and output drivers become
more flexible while keeping the majority of the advantages provided by
the common output helpers.
Signed-off-by: Thierry Reding <treding@nvidia.com>

Implement encoder and connector within the HDMI driver itself using the
Tegra output helpers rather than using the Tegra output as midlayer. By
doing so one level of indirection is removed and output drivers become
more flexible while keeping the majority of the advantages provided by
the common output helpers.
Signed-off-by: Thierry Reding <treding@nvidia.com>

Implement encoder and connector within the RGB driver itself using the
Tegra output helpers rather than using the Tegra output as midlayer. By
doing so one level of indirection is removed and output drivers become
more flexible while keeping the majority of the advantages provided by
the common output helpers.
Signed-off-by: Thierry Reding <treding@nvidia.com>

This is a small helper that performs the basic steps required by all
output drivers to prepare the display controller for use with a given
encoder.
Signed-off-by: Thierry Reding <treding@nvidia.com>

In order to transition output drivers to using the struct tegra_output
as a helper rather than midlayer, make this callback optional. Instead
drivers should implement the equivalent as part of ->mode_fixup(). For
the conversion to atomic modesetting a new callback ->atomic_check()
should be implemented that updates the display controller's state with
the corresponding parent clock, rate and shift clock divider.
Signed-off-by: Thierry Reding <treding@nvidia.com>

The output layer was initially designed to help reduce the amount of
code duplicated in output drivers. An unfortunate side-effect of that
was that it turned into a midlayer and it became difficult to make the
output drivers work without bending over backwards to fit into the
midlayer.

This commit starts to convert the midlayer into a helper library by
exporting most of the common functions so that they can be used by the
output drivers directly. Doing so will allow output drivers to reuse
common code paths but more easily override them where necessary.
Signed-off-by: Thierry Reding <treding@nvidia.com>

The DRM core should take care of disabling all unneeded planes, so there
is no need to do this explicitly.
Signed-off-by: Thierry Reding <treding@nvidia.com>

This structure will be extended using non-framebuffer related callbacks
in subsequent patches, so it should move to a more central location.
Signed-off-by: Thierry Reding <treding@nvidia.com>

When disabling the display controller, stop it and wait for it to become
idle. Doing so ensures that no further accesses to the framebuffer occur
and the buffers can be safely unmapped or freed.
Signed-off-by: Thierry Reding <treding@nvidia.com>

Previously output drivers would all stop the display controller in their
disable path. However with the transition to atomic modesetting the
display controller needs to be kept running until all planes have been
disabled so that software can properly determine (using VBLANK counts)
when it is safe to remove the framebuffers associated with the planes.

Moving this code into the display controller's disable path also gets
rid of the duplication of this into all output drivers.
Signed-off-by: Thierry Reding <treding@nvidia.com>

All output drivers have open-coded variants of this function, so export
it to remove some code duplication.
Signed-off-by: Thierry Reding <treding@nvidia.com>

This callback can be used instead of the legacy ->mode_fixup() and is
passed the CRTC and connector states. It can thus use these states to
validate the modeset and cache values in the state to be used during
the actual modeset.
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Thierry Reding <treding@nvidia.com>

In order to prevent drivers from having to perform the same checks over
and over again, add an optional ->atomic_disable callback which the core
calls under the right circumstances.

v2: pass old state and detect edges to avoid calling ->atomic_disable on
already disabled planes, remove redundant comment (Daniel Vetter)

v3: rename helper to drm_atomic_plane_disabling() to clarify that it is
checking for transitions, move helper to drm_atomic_helper.h, clarify
check for !old_state and its relation to transitional helpers

Here's an extract from some discussion rationalizing the behaviour (for
a full version, see the reference below):

    > > Hm, thinking about this some more this will result in a slight difference
    > > in behaviour, at least when drivers just use the helper ->reset functions
    > > but don't disable everything:
    > > - With transitional helpers we assume we know nothing and call
    > >   ->atomic_disable.
    > > - With atomic old_state->crtc == NULL in the same situation right after
    > >   boot-up, but we asssume the plane is really off and _dont_ call
    > >   ->atomic_disable.
    > >
    > > Should we instead check for (old_state && old_state->crtc) and state that
    > > drivers need to make sure they don't have stuff hanging around?
    >
    > I don't think we can check for old_state because otherwise this will
    > always return false, whereas we really want it to force-disable planes
    > that could be on (lacking any more accurate information). For
    > transitional helpers anyway.
    >
    > For the atomic helpers, old_state will never be NULL, but I'd assume
    > that the driver would reconstruct the current state in ->reset().

    By the way, the reason for why old_state can be NULL with transitional
    helpers is the ordering of the steps in the atomic transition. Currently
    the Tegra patches do this (based on your blog post and the Exynos proto-
    type):

        1) atomic conversion, phase 1:
           - implement ->atomic_{check,update,disable}()
           - use drm_plane_helper_{update,disable}()

        2) atomic conversion, phase 2:
           - call drm_mode_config_reset() from ->load()
           - implement ->reset()

    That's only a partial list of what's done in these steps, but that's the
    only relevant pieces for why old_state is NULL.

    What happens is that without ->reset() implemented there won't be any
    initial state, hence plane->state (the old_state here) will be NULL the
    first time atomic state is applied.

    We could of course reorder the sequence such that drivers are required
    to hook up ->reset() before they can (or at the same as they) hook up
    the transitional helpers. We could add an appropriate WARN_ON to this
    helper to make that more obvious.

    However, that will not solve the problem because it only gets rid of the
    special case. We still don't know whether old_state->crtc == NULL is the
    current state or just the initial default.

    So no matter which way we do this, I don't see a way to get away without
    requiring specific semantics from drivers. They would be that:

        - drivers recreate the correct state in ->reset() so that
          old_state->crtc != NULL if the plane is really enabled

    or

        - drivers have to ensure that the real state in fact mirrors the
          initial default as encoded in the state (plane disabled)

References: http://lists.freedesktop.org/archives/dri-devel/2015-January/075578.htmlReviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Thierry Reding <treding@nvidia.com>

There is no use-case where it would be useful for drivers not to
implement this function and the transitional plane helpers already
require drivers to provide an implementation.

v2: add new requirement to kerneldoc
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Thierry Reding <treding@nvidia.com>

kfree(ERR_PTR(-ENOMEM)) will not work very well.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>