46 files changed, 2268 insertions, 1150 deletions

diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index e79577cb4665..d7a8370e3cdc 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -1319,6 +1319,9 @@ static int drm_crtc_convert_umode(struct drm_display_mode *out,
         if (in->clock > INT_MAX || in->vrefresh > INT_MAX)
                 return -ERANGE;
 
+        if ((in->flags & DRM_MODE_FLAG_3D_MASK) > DRM_MODE_FLAG_3D_MAX)
+                return -EINVAL;
+
         out->clock = in->clock;
         out->hdisplay = in->hdisplay;
         out->hsync_start = in->hsync_start;
@@ -1581,6 +1584,19 @@ out:
         return ret;
 }
 
+static bool drm_mode_expose_to_userspace(const struct drm_display_mode *mode,
+                                         const struct drm_file *file_priv)
+{
+        /*
+         * If user-space hasn't configured the driver to expose the stereo 3D
+         * modes, don't expose them.
+         */
+        if (!file_priv->stereo_allowed && drm_mode_is_stereo(mode))
+                return false;
+
+        return true;
+}
+
 /**
  * drm_mode_getconnector - get connector configuration
  * @dev: drm device for the ioctl
@@ -1646,7 +1662,8 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
 
         /* delayed so we get modes regardless of pre-fill_modes state */
         list_for_each_entry(mode, &connector->modes, head)
-                mode_count++;
+                if (drm_mode_expose_to_userspace(mode, file_priv))
+                        mode_count++;
 
         out_resp->connector_id = connector->base.id;
         out_resp->connector_type = connector->connector_type;
@@ -1668,6 +1685,9 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
                 copied = 0;
                 mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr;
                 list_for_each_entry(mode, &connector->modes, head) {
+                        if (!drm_mode_expose_to_userspace(mode, file_priv))
+                                continue;
+
                         drm_crtc_convert_to_umode(&u_mode, mode);
                         if (copy_to_user(mode_ptr + copied,
                                          &u_mode, sizeof(u_mode))) {
@@ -2042,6 +2062,45 @@ int drm_mode_set_config_internal(struct drm_mode_set *set)
 }
 EXPORT_SYMBOL(drm_mode_set_config_internal);
 
+/*
+ * Checks that the framebuffer is big enough for the CRTC viewport
+ * (x, y, hdisplay, vdisplay)
+ */
+static int drm_crtc_check_viewport(const struct drm_crtc *crtc,
+                                   int x, int y,
+                                   const struct drm_display_mode *mode,
+                                   const struct drm_framebuffer *fb)
+
+{
+        int hdisplay, vdisplay;
+
+        hdisplay = mode->hdisplay;
+        vdisplay = mode->vdisplay;
+
+        if (drm_mode_is_stereo(mode)) {
+                struct drm_display_mode adjusted = *mode;
+
+                drm_mode_set_crtcinfo(&adjusted, CRTC_STEREO_DOUBLE);
+                hdisplay = adjusted.crtc_hdisplay;
+                vdisplay = adjusted.crtc_vdisplay;
+        }
+
+        if (crtc->invert_dimensions)
+                swap(hdisplay, vdisplay);
+
+        if (hdisplay > fb->width ||
+            vdisplay > fb->height ||
+            x > fb->width - hdisplay ||
+            y > fb->height - vdisplay) {
+                DRM_DEBUG_KMS("Invalid fb size %ux%u for CRTC viewport %ux%u+%d+%d%s.\n",
+                              fb->width, fb->height, hdisplay, vdisplay, x, y,
+                              crtc->invert_dimensions ? " (inverted)" : "");
+                return -ENOSPC;
+        }
+
+        return 0;
+}
+
 /**
  * drm_mode_setcrtc - set CRTC configuration
  * @dev: drm device for the ioctl
@@ -2089,7 +2148,6 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
         DRM_DEBUG_KMS("[CRTC:%d]\n", crtc->base.id);
 
         if (crtc_req->mode_valid) {
-                int hdisplay, vdisplay;
                 /* If we have a mode we need a framebuffer. */
                 /* If we pass -1, set the mode with the currently bound fb */
                 if (crtc_req->fb_id == -1) {
@@ -2125,23 +2183,11 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
 
                 drm_mode_set_crtcinfo(mode, CRTC_INTERLACE_HALVE_V);