Driver code did not remove event from the list of pending events before destroy.
As a result drm core later tried to inspect invalid memory location.
The patch replaces removal code with call to core helper.

The bug was detected using KASAN:

[   10.107249] ==================================================================
[   10.107518] BUG: KASAN: use-after-free in drm_release+0xe9c/0x1000 at addr ffffffc089154a18
[   10.107784] Read of size 8 by task modetest/103
[   10.107931] =============================================================================
[   10.113191] BUG kmalloc-128 (Not tainted): kasan: bad access detected
[   10.119608] -----------------------------------------------------------------------------
[   10.119608]
[   10.129243] Disabling lock debugging due to kernel taint
[   10.134551] INFO: Allocated in drm_mode_page_flip_ioctl+0x500/0xa98 age=4 cpu=0 pid=103
[   10.142532] 	alloc_debug_processing+0x18c/0x198
[   10.147043] 	___slab_alloc.constprop.28+0x360/0x380
[   10.151906] 	__slab_alloc.isra.25.constprop.27+0x54/0xa0
[   10.157197] 	kmem_cache_alloc_trace+0x370/0x3b0
[   10.161709] 	drm_mode_page_flip_ioctl+0x500/0xa98
[   10.166400] 	drm_ioctl+0x4c4/0xb68
[   10.169787] 	do_vfs_ioctl+0x16c/0xeb8
[   10.173429] 	SyS_ioctl+0x8c/0xa0
[   10.176642] 	el0_svc_naked+0x24/0x28
[   10.180204] INFO: Freed in exynos_drm_crtc_cancel_page_flip+0xe0/0x160 age=0 cpu=0 pid=103
[   10.188447] 	free_debug_processing+0x174/0x388
[   10.192871] 	__slab_free+0x2e8/0x438
[   10.196431] 	kfree+0x350/0x360
[   10.199469] 	exynos_drm_crtc_cancel_page_flip+0xe0/0x160
[   10.204762] 	exynos_drm_preclose+0x58/0xa0
[   10.208844] 	drm_release+0x1f0/0x1000
[   10.212491] 	__fput+0x1c4/0x5b8
[   10.215613] 	____fput+0xc/0x18
[   10.218654] 	task_work_run+0x130/0x198
[   10.222385] 	do_exit+0x700/0x2278
[   10.225681] 	do_group_exit+0xe4/0x2c8
[   10.229327] 	SyS_exit_group+0x1c/0x20
[   10.232973] 	el0_svc_naked+0x24/0x28
[   10.236532] INFO: Slab 0xffffffbdc2a45500 objects=32 used=10 fp=0xffffffc089154a00 flags=0x4080
[   10.245210] INFO: Object 0xffffffc089154a00 @offset=2560 fp=0xffffffc089157600
[   10.245210]
...
[   10.384532] CPU: 0 PID: 103 Comm: modetest Tainted: G    B           4.5.0-rc3-00748-gd5e2881 #271
[   10.398325] Call trace:
[   10.400764] [<ffffffc000091428>] dump_backtrace+0x0/0x328
[   10.406141] [<ffffffc000091764>] show_stack+0x14/0x20
[   10.411176] [<ffffffc00089c550>] dump_stack+0xb0/0xe8
[   10.416210] [<ffffffc000395778>] print_trailer+0xf8/0x160
[   10.421592] [<ffffffc00039b5cc>] object_err+0x3c/0x50
[   10.426626] [<ffffffc00039d630>] kasan_report_error+0x248/0x550
[   10.432527] [<ffffffc00039da50>] __asan_report_load8_noabort+0x40/0x48
[   10.439039] [<ffffffc000b5b724>] drm_release+0xe9c/0x1000
[   10.444419] [<ffffffc0003d340c>] __fput+0x1c4/0x5b8
[   10.449280] [<ffffffc0003d3884>] ____fput+0xc/0x18
[   10.454055] [<ffffffc000101aa8>] task_work_run+0x130/0x198
[   10.459522] [<ffffffc0000bc058>] do_exit+0x700/0x2278
[   10.464557] [<ffffffc0000bdcfc>] do_group_exit+0xe4/0x2c8
[   10.469939] [<ffffffc0000bdefc>] SyS_exit_group+0x1c/0x20
[   10.475320] [<ffffffc000087530>] el0_svc_naked+0x24/0x28
Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>

Software trigger should not be used if hardware trigger is configured.
Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>

vblank should be signaled to userspace after reading framebuffers not before,
signaling it in TE interrupt looks wrong. TE triggers reading framebuffers
so it is the worst moment. Tearing is not observable because hardware prevents
it, but there are frequently skipped vblank events.
Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>

HDMI-PHY clock should be accessible from other components in the pipeline.
Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>

MT8173 DRM support

- device tree binding documentation for all MT8173 display
  subsystem components
- basic mediatek-drm driver for MT8173 with two optional,
  currently fixed output paths:
- DSI encoder support for DSI and (via bridge) eDP panels
- DPI encoder support for output to HDMI bridge
- necessary clock tree changes for the DPI->HDMI path
- export mtk-smi functions used by mediatek-drm

* tag 'mediatek-drm-2016-05-09' of git://git.pengutronix.de/git/pza/linux:
  clk: mediatek: remove hdmitx_dig_cts from TOP clocks
  clk: mediatek: Add hdmi_ref HDMI PHY PLL reference clock output
  clk: mediatek: make dpi0_sel propagate rate changes
  drm/mediatek: Add DPI sub driver
  drm/mediatek: Add DSI sub driver
  drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.
  dt-bindings: drm/mediatek: Add Mediatek display subsystem dts binding
  memory: mtk-smi: export mtk_smi_larb_get/put

Merge this back as we've built up a fair few conflicts, and I have
some newer trees to pull in.

Same fix went in previously for some other files.
Signed-off-by: Dave Airlie <airlied@redhat.com>

Mostly cleanups, fixes, and 'struct fence' conversion this time
around, with one reservation patch which is a-b Sumit (which the fence
conversion patches depend on).

* 'msm-next' of git://people.freedesktop.org/~robclark/linux: (25 commits)
  drm/msm: Drop load/unload drm_driver ops
  drm/msm: Centralize connector registration/unregistration
  drm/msm/hdmi: Prevent gpio_free related kernel warnings
  drm/msm: print offender task name on hangcheck recovery
  drm/msm: fix leak in failed submit path
  drm/msm: de-indent submit_create()
  drm/msm: drop return from gpu->submit()
  drm/msm/mdp4: Don't manage DSI PLL regulators in MDP driver
  drm/msm/edp: Drop regulator_set_voltage call
  drm/msm/dsi: Fix regulator API abuse
  drm/msm: Move call to PTR_ERR_OR_ZERO after reassignment
  drm/msm/mdp: Add support for more RGBX formats
  drm: msm: remove unused variable
  drm/msm: fix ->last_fence() after recover
  drm/msm: 'struct fence' conversion
  drm/msm: remove fence_cbs
  drm/msm: introduce msm_fence_context
  drm/msm: split locking and pinning BO's
  drm/msm/gpu: simplify tracking in-flight bo's
  drm/msm: split out timeout_to_jiffies helper
  ...

Refcounting is hard, so here's a quick pull request with the one-liner to
fix up i915. Otherwise just a few other small things I picked up. Plus the
regression fix from Marten for rmfb behaviour that lingered around forever
since no testers. Feel free to cherry-pick that over to drm-fixes, but
given that there's not many who seemed to have cared, meh.

* tag 'topic/drm-misc-2016-05-08' of git://anongit.freedesktop.org/drm-intel:
  drm/i915: Correctly refcount connectors in hw state readou
  drm/panel: Flesh out kerneldoc
  drm: Add gpu.tmpl docbook to MAINTAINERS entry
  drm/core: Do not preserve framebuffer on rmfb, v4.
  drm: Fix up markup fumble
  drm/fb_helper: Fix a few typos

The load/unload drm_driver ops are deprecated. They should be removed as
they result in creation of devices visible to userspace even before
the drm_device is registered.

Drop these ops and use drm_dev_alloc/register and drm_dev_unregister/unref
to explicitly create and destroy the drm device in the msm platform
driver's bind and unbind ops. With this in use, the drm connectors are
only registered once the drm_device is registered.

It also fixes the issue of stray debugfs files after the msm module is
removed. With this, all the debugfs files are removed, and allows
successive module insertions/removals.
Signed-off-by: Archit Taneja <architt@codeaurora.org>

Move the drm_connector registration from the encoder(HDMI/DSI etc) drivers
to the msm platform driver. This will simplify the task of ensuring that
the connectors are registered only after the drm_device itself is
registered.

The connectors' destroy ops are made to use kzalloc instead of
devm_kzalloc to ensure that that the connectors can be successfully
unregistered when the msm driver module is removed. The memory for the
connectors is unallocated when drm_mode_config_cleanup() is called
during either during an error or during driver remove.
Signed-off-by: Archit Taneja <architt@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>

Calling the legacy gpio_free on an invalid GPIO (a GPIO numbered -1)
results in kernel warnings. This causes a lot of backtraces when
we try to unload the drm/msm module.

Call gpio_free only on valid GPIOs.
Signed-off-by: Archit Taneja <architt@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>

Track the pid per submit, so we can print the name of the task which
submitted the batch that caused the gpu to hang.
Signed-off-by: Rob Clark <robdclark@gmail.com>

Signed-off-by: Rob Clark <robdclark@gmail.com>

Signed-off-by: Rob Clark <robdclark@gmail.com>

At this point, there is nothing left to fail.  And submit already has a
fence assigned and is added to the submit_list.  Any problems from here
on out are asynchronous (ie. hangcheck/recovery).
Signed-off-by: Rob Clark <robdclark@gmail.com>

The MDP4 driver tries to request and set voltages for regulators required
by the DSI PLLs.

Firstly, the MDP4 driver shouldn't manage the DSI regulators, this should
be handled in the DSI driver. Secondly, it shouldn't try to set a fixed
voltage for regulators. Voltage constraints should be specified on the
regulator via DT and managed by the regulator core.

Remove all the DSI PLL regulator related code from the MDP4 driver. It's
managed in the DSI driver for MSM8960/APQ8064 already.
Signed-off-by: Archit Taneja <architt@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>

The eDP driver tries to set a fixed voltage for one of its regulators(vdda)
before enabling it. This shouldn't be done by the driver, the voltage
constraints should be specified on the regulator via DT and managed by
the regulator core. A driver should call regulator_set_voltage only if
it needs to change the voltage during runtime. Drop the
regulator_set_voltage call. Mention in a comment the voltage that the
regulator expects.
Signed-off-by: Archit Taneja <architt@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>

The voltage changing code in this driver is broken and should be
removed.  The driver sets a single, exact voltage on probe.  Unless
there is a very good reason for this (which should be documented in
comments) constraints like this need to be set via the machine
constraints, voltage setting in a driver is expected to be used in cases
where the voltage varies at runtime.

In addition client drivers should almost never be calling
regulator_can_set_voltage(), if the device needs to set a voltage it
needs to set the voltage and the regulator core will handle the case
where the regulator is fixed voltage.  If the driver simply skips
setting the voltage if it doesn't have permission then it should just
not bother in the first place.

Originally authored by Mark Brown <broonie@kernel.org>

Remove the min/max voltage data entries per SoC managed by the driver.
These aren't needed as we don't try to set voltages any more. Mention in
comments the voltages that each regulator expects.
Signed-off-by: Archit Taneja <architt@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>

Here, a location is reset to NULL before being passed to PTR_ERR.
So, PTR_ERR should be called before its argument is reassigned
to NULL. Further to simplify things use PTR_ERR_OR_ZERO instead
of PTR_ERR and IS_ERR.

Problem found using Coccinelle.
Signed-off-by: Vaishali Thakkar <vaishali.thakkar@oracle.com>
Reviewed-by: Eric Engestrom <eric.engestrom@imgtec.com>
[fixed fmt string warning (s/%ld/%d/)]
Signed-off-by: Rob Clark <robdclark@gmail.com>

Android needs XBGR8888 format. Add all the missing 32-bpp formats
without alpha for completeness.

Cc: Archit Taneja <architt@codeaurora.org>
Cc: Rob Clark <robdclark@gmail.com>
Signed-off-by: Rob Herring <robh@kernel.org>
Reviewed-by: Archit Taneja  <architt@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>

A recent cleanup removed the only user of the 'kms' variable in
msm_preclose(), causing a harmless compiler warning:

drivers/gpu/drm/msm/msm_drv.c: In function 'msm_preclose':
drivers/gpu/drm/msm/msm_drv.c:468:18: error: unused variable 'kms' [-Werror=unused-variable]

This removes the variable as well.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: 4016260b ("drm/msm: fix bug after preclose removal")
Signed-off-by: Rob Clark <robdclark@gmail.com>

It is no longer true that we discard all in-flight submits on recover
(these days we only discard the first one that hung).  After the first
re-submitted batch completes it would overwrite the fence with a correct
value, but there would be a window of time which showed all re-submitted
batches as already complete.
Signed-off-by: Rob Clark <robdclark@gmail.com>

Signed-off-by: Rob Clark <robdclark@gmail.com>

This was only used for atomic commit these days.  So instead just give
atomic it's own work-queue where we can do a block on each bo in turn.
Simplifies things a whole bunch and makes the 'struct fence' conversion
easier.
Signed-off-by: Rob Clark <robdclark@gmail.com>

Better encapsulate the per-timeline stuff into fence-context.  For now
there is just a single fence-context, but eventually we'll also have one
per-CRTC to enable fully explicit fencing.
Signed-off-by: Rob Clark <robdclark@gmail.com>

Split up locking and pinning buffers in the submit path.  This is needed
because we'll want to insert fencing in between the two steps.

This makes things end up looking more similar to etnaviv submit code
(which was originally modelled on the msm code but has already added
'struct fence' support).
Signed-off-by: Rob Clark <robdclark@gmail.com>

Since we already track the array of bo's in the submit object, just
unconditionally take and drop ref's per submit (rather than only taking
ref's if bo is not already active).  This simplifies later patches.
Signed-off-by: Rob Clark <robdclark@gmail.com>

Signed-off-by: Rob Clark <robdclark@gmail.com>

This was always the intention, but somehow it was never wired up
properly.
Signed-off-by: Rob Clark <robdclark@gmail.com>

Signed-off-by: Rob Clark <robdclark@gmail.com>

Signed-off-by: Rob Clark <robdclark@gmail.com>

In the atomic modesetting path, each driver simply wants to grab a ref
to the exclusive fence from a reservation object to store in the incoming
drm_plane_state, without doing the whole RCU dance.  Since each driver
will need to do this, lets make a helper.

v2: rename to _rcu instead of _unlocked to be more consistent
Signed-off-by: Rob Clark <robdclark@gmail.com>
Acked-by: Sumit Semwal <sumit.semwal@linaro.org>

It is already optional at runtime.  But this at least simplifies
backports to kernels without QCOM_SCM.
Signed-off-by: Rob Clark <robdclark@gmail.com>

Pull misc driver fixes from Gfreg KH:
 "Here are three small fixes for some driver problems that were
  reported.  Full details in the shortlog below.

  All of these have been in linux-next with no reported issues"

* tag 'char-misc-4.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  nvmem: mxs-ocotp: fix buffer overflow in read
  Drivers: hv: vmbus: Fix signaling logic in hv_need_to_signal_on_read()
  misc: mic: Fix for double fetch security bug in VOP driver

Pull IIO driver fixes from Grek KH:
 "It's really just IIO drivers here, some small fixes that resolve some
  'crash on boot' errors that have shown up in the -rc series, and other
  bugfixes that are required.

  All have been in linux-next with no reported problems"

* tag 'staging-4.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  iio: imu: mpu6050: Fix name/chip_id when using ACPI
  iio: imu: mpu6050: fix possible NULL dereferences
  iio:adc:at91-sama5d2: Repair crash on module removal
  iio: ak8975: fix maybe-uninitialized warning
  iio: ak8975: Fix NULL pointer exception on early interrupt

Pull USB fixes from Greg KH:
 "Here are some last-remaining fixes for USB drivers to resolve issues
  that have shown up in testing.  And two new device ids as well.

  All of these have been in linux-next with no reported issues"

* tag 'usb-4.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  Revert "USB / PM: Allow USB devices to remain runtime-suspended when sleeping"
  usb: musb: jz4740: fix error check of usb_get_phy()
  Revert "usb: musb: musb_host: Enable HCD_BH flag to handle urb return in bottom half"
  usb: musb: gadget: nuke endpoint before setting its descriptor to NULL
  USB: serial: cp210x: add Straizona Focusers device ids
  USB: serial: cp210x: add ID for Link ECU

Pull ARM fixes from Russell King:
 "These are a number of updates to fix a few problems found in the ARM
  nommu code over the last couple of years, caused mostly by changes on
  the mmu side"

* 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm:
  ARM: 8573/1: domain: move {set,get}_domain under config guard
  ARM: 8572/1: nommu: change memory reserve for the vectors
  ARM: 8571/1: nommu: fix PMSAv7 setup

Pull media fixes from Mauro Carvalho Chehab:

  - deadlock fixes on driver probe at exynos4-is and s43-camif drivers

  - a build breakage if media controller is enabled and USB or PCI is
   built as module.

* tag 'media/v4.6-5' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  [media] media-device: fix builds when USB or PCI is compiled as module
  [media] media: s3c-camif: fix deadlock on driver probe()
  [media] media: exynos4-is: fix deadlock on driver probe