Commit 352ef571 authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'drm-fixes-for-v4.15-rc8' of git://people.freedesktop.org/~airlied/linux

Pull drm fixes from Dave Airlie:

 - Nouveau: regression fix

 - Tegra: regression fix

 - vmwgfx: crasher + freed data leak

 - i915: KASAN use after free fix, whitelist register to avoid hang fix,
   GVT fixes

 - vc4: irq/pm fix

* tag 'drm-fixes-for-v4.15-rc8' of git://people.freedesktop.org/~airlied/linux:
  drm/i915: Don't adjust priority on an already signaled fence
  drm/i915: Whitelist SLICE_COMMON_ECO_CHICKEN1 on Geminilake.
  drm/vmwgfx: Potential off by one in vmw_view_add()
  drm/tegra: sor: Fix hang on Tegra124 eDP
  drm/vmwgfx: Don't cache framebuffer maps
  drm/nouveau/disp/gf119: add missing drive vfunc ptr
  drm/i915/gvt: Fix stack-out-of-bounds bug in cmd parser
  drm/i915/gvt: Clear the shadow page table entry after post-sync
  drm/vc4: Move IRQ enable to PM path
parents 1545dec4 fee6c614
...@@ -2777,12 +2777,12 @@ int intel_gvt_scan_and_shadow_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx) ...@@ -2777,12 +2777,12 @@ int intel_gvt_scan_and_shadow_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
} }
static struct cmd_info *find_cmd_entry_any_ring(struct intel_gvt *gvt, static struct cmd_info *find_cmd_entry_any_ring(struct intel_gvt *gvt,
unsigned int opcode, int rings) unsigned int opcode, unsigned long rings)
{ {
struct cmd_info *info = NULL; struct cmd_info *info = NULL;
unsigned int ring; unsigned int ring;
for_each_set_bit(ring, (unsigned long *)&rings, I915_NUM_ENGINES) { for_each_set_bit(ring, &rings, I915_NUM_ENGINES) {
info = find_cmd_entry(gvt, opcode, ring); info = find_cmd_entry(gvt, opcode, ring);
if (info) if (info)
break; break;
......
...@@ -1359,12 +1359,15 @@ static int ppgtt_handle_guest_write_page_table_bytes(void *gp, ...@@ -1359,12 +1359,15 @@ static int ppgtt_handle_guest_write_page_table_bytes(void *gp,
return ret; return ret;
} else { } else {
if (!test_bit(index, spt->post_shadow_bitmap)) { if (!test_bit(index, spt->post_shadow_bitmap)) {
int type = spt->shadow_page.type;
ppgtt_get_shadow_entry(spt, &se, index); ppgtt_get_shadow_entry(spt, &se, index);
ret = ppgtt_handle_guest_entry_removal(gpt, &se, index); ret = ppgtt_handle_guest_entry_removal(gpt, &se, index);
if (ret) if (ret)
return ret; return ret;
ops->set_pfn(&se, vgpu->gtt.scratch_pt[type].page_mfn);
ppgtt_set_shadow_entry(spt, &se, index);
} }
ppgtt_set_post_shadow(spt, index); ppgtt_set_post_shadow(spt, index);
} }
......
...@@ -467,7 +467,7 @@ static void __fence_set_priority(struct dma_fence *fence, int prio) ...@@ -467,7 +467,7 @@ static void __fence_set_priority(struct dma_fence *fence, int prio)
struct drm_i915_gem_request *rq; struct drm_i915_gem_request *rq;
struct intel_engine_cs *engine; struct intel_engine_cs *engine;
if (!dma_fence_is_i915(fence)) if (dma_fence_is_signaled(fence) || !dma_fence_is_i915(fence))
return; return;
rq = to_request(fence); rq = to_request(fence);
......
...@@ -7027,6 +7027,8 @@ enum { ...@@ -7027,6 +7027,8 @@ enum {
#define GEN9_SLICE_COMMON_ECO_CHICKEN0 _MMIO(0x7308) #define GEN9_SLICE_COMMON_ECO_CHICKEN0 _MMIO(0x7308)
#define DISABLE_PIXEL_MASK_CAMMING (1<<14) #define DISABLE_PIXEL_MASK_CAMMING (1<<14)
#define GEN9_SLICE_COMMON_ECO_CHICKEN1 _MMIO(0x731c)
#define GEN7_L3SQCREG1 _MMIO(0xB010) #define GEN7_L3SQCREG1 _MMIO(0xB010)
#define VLV_B0_WA_L3SQCREG1_VALUE 0x00D30000 #define VLV_B0_WA_L3SQCREG1_VALUE 0x00D30000
......
...@@ -1390,6 +1390,11 @@ static int glk_init_workarounds(struct intel_engine_cs *engine) ...@@ -1390,6 +1390,11 @@ static int glk_init_workarounds(struct intel_engine_cs *engine)
if (ret) if (ret)
return ret; return ret;
/* WA #0862: Userspace has to set "Barrier Mode" to avoid hangs. */
ret = wa_ring_whitelist_reg(engine, GEN9_SLICE_COMMON_ECO_CHICKEN1);
if (ret)
return ret;
/* WaToEnableHwFixForPushConstHWBug:glk */ /* WaToEnableHwFixForPushConstHWBug:glk */
WA_SET_BIT_MASKED(COMMON_SLICE_CHICKEN2, WA_SET_BIT_MASKED(COMMON_SLICE_CHICKEN2,
GEN8_SBE_DISABLE_REPLAY_BUF_OPTIMIZATION); GEN8_SBE_DISABLE_REPLAY_BUF_OPTIMIZATION);
......
...@@ -974,6 +974,9 @@ static void execlists_schedule(struct drm_i915_gem_request *request, int prio) ...@@ -974,6 +974,9 @@ static void execlists_schedule(struct drm_i915_gem_request *request, int prio)
GEM_BUG_ON(prio == I915_PRIORITY_INVALID); GEM_BUG_ON(prio == I915_PRIORITY_INVALID);
if (i915_gem_request_completed(request))
return;
if (prio <= READ_ONCE(request->priotree.priority)) if (prio <= READ_ONCE(request->priotree.priority))
return; return;
......
...@@ -174,6 +174,7 @@ gf119_sor = { ...@@ -174,6 +174,7 @@ gf119_sor = {
.links = gf119_sor_dp_links, .links = gf119_sor_dp_links,
.power = g94_sor_dp_power, .power = g94_sor_dp_power,
.pattern = gf119_sor_dp_pattern, .pattern = gf119_sor_dp_pattern,
.drive = gf119_sor_dp_drive,
.vcpi = gf119_sor_dp_vcpi, .vcpi = gf119_sor_dp_vcpi,
.audio = gf119_sor_dp_audio, .audio = gf119_sor_dp_audio,
.audio_sym = gf119_sor_dp_audio_sym, .audio_sym = gf119_sor_dp_audio_sym,
......
...@@ -2656,6 +2656,9 @@ static int tegra_sor_probe(struct platform_device *pdev) ...@@ -2656,6 +2656,9 @@ static int tegra_sor_probe(struct platform_device *pdev)
name, err); name, err);
goto remove; goto remove;
} }
} else {
/* fall back to the module clock on SOR0 (eDP/LVDS only) */
sor->clk_out = sor->clk;
} }
sor->clk_parent = devm_clk_get(&pdev->dev, "parent"); sor->clk_parent = devm_clk_get(&pdev->dev, "parent");
......
...@@ -209,9 +209,6 @@ vc4_irq_postinstall(struct drm_device *dev) ...@@ -209,9 +209,6 @@ vc4_irq_postinstall(struct drm_device *dev)
{ {
struct vc4_dev *vc4 = to_vc4_dev(dev); struct vc4_dev *vc4 = to_vc4_dev(dev);
/* Undo the effects of a previous vc4_irq_uninstall. */
enable_irq(dev->irq);
/* Enable both the render done and out of memory interrupts. */ /* Enable both the render done and out of memory interrupts. */
V3D_WRITE(V3D_INTENA, V3D_DRIVER_IRQS); V3D_WRITE(V3D_INTENA, V3D_DRIVER_IRQS);
......
...@@ -327,6 +327,9 @@ static int vc4_v3d_runtime_resume(struct device *dev) ...@@ -327,6 +327,9 @@ static int vc4_v3d_runtime_resume(struct device *dev)
return ret; return ret;
vc4_v3d_init_hw(vc4->dev); vc4_v3d_init_hw(vc4->dev);
/* We disabled the IRQ as part of vc4_irq_uninstall in suspend. */
enable_irq(vc4->dev->irq);
vc4_irq_postinstall(vc4->dev); vc4_irq_postinstall(vc4->dev);
return 0; return 0;
......
...@@ -2731,6 +2731,8 @@ static int vmw_cmd_dx_view_define(struct vmw_private *dev_priv, ...@@ -2731,6 +2731,8 @@ static int vmw_cmd_dx_view_define(struct vmw_private *dev_priv,
} }
view_type = vmw_view_cmd_to_type(header->id); view_type = vmw_view_cmd_to_type(header->id);
if (view_type == vmw_view_max)
return -EINVAL;
cmd = container_of(header, typeof(*cmd), header); cmd = container_of(header, typeof(*cmd), header);
ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
user_surface_converter, user_surface_converter,
......
...@@ -697,7 +697,6 @@ vmw_du_plane_duplicate_state(struct drm_plane *plane) ...@@ -697,7 +697,6 @@ vmw_du_plane_duplicate_state(struct drm_plane *plane)
vps->pinned = 0; vps->pinned = 0;
/* Mapping is managed by prepare_fb/cleanup_fb */ /* Mapping is managed by prepare_fb/cleanup_fb */
memset(&vps->guest_map, 0, sizeof(vps->guest_map));
memset(&vps->host_map, 0, sizeof(vps->host_map)); memset(&vps->host_map, 0, sizeof(vps->host_map));
vps->cpp = 0; vps->cpp = 0;
...@@ -760,11 +759,6 @@ vmw_du_plane_destroy_state(struct drm_plane *plane, ...@@ -760,11 +759,6 @@ vmw_du_plane_destroy_state(struct drm_plane *plane,
/* Should have been freed by cleanup_fb */ /* Should have been freed by cleanup_fb */
if (vps->guest_map.virtual) {
DRM_ERROR("Guest mapping not freed\n");
ttm_bo_kunmap(&vps->guest_map);
}
if (vps->host_map.virtual) { if (vps->host_map.virtual) {
DRM_ERROR("Host mapping not freed\n"); DRM_ERROR("Host mapping not freed\n");
ttm_bo_kunmap(&vps->host_map); ttm_bo_kunmap(&vps->host_map);
......
...@@ -175,7 +175,7 @@ struct vmw_plane_state { ...@@ -175,7 +175,7 @@ struct vmw_plane_state {
int pinned; int pinned;
/* For CPU Blit */ /* For CPU Blit */
struct ttm_bo_kmap_obj host_map, guest_map; struct ttm_bo_kmap_obj host_map;
unsigned int cpp; unsigned int cpp;
}; };
......
...@@ -114,7 +114,7 @@ struct vmw_screen_target_display_unit { ...@@ -114,7 +114,7 @@ struct vmw_screen_target_display_unit {
bool defined; bool defined;
/* For CPU Blit */ /* For CPU Blit */
struct ttm_bo_kmap_obj host_map, guest_map; struct ttm_bo_kmap_obj host_map;
unsigned int cpp; unsigned int cpp;
}; };
...@@ -695,7 +695,8 @@ static void vmw_stdu_dmabuf_cpu_commit(struct vmw_kms_dirty *dirty) ...@@ -695,7 +695,8 @@ static void vmw_stdu_dmabuf_cpu_commit(struct vmw_kms_dirty *dirty)
s32 src_pitch, dst_pitch; s32 src_pitch, dst_pitch;
u8 *src, *dst; u8 *src, *dst;
bool not_used; bool not_used;
struct ttm_bo_kmap_obj guest_map;
int ret;
if (!dirty->num_hits) if (!dirty->num_hits)
return; return;
...@@ -706,6 +707,13 @@ static void vmw_stdu_dmabuf_cpu_commit(struct vmw_kms_dirty *dirty) ...@@ -706,6 +707,13 @@ static void vmw_stdu_dmabuf_cpu_commit(struct vmw_kms_dirty *dirty)
if (width == 0 || height == 0) if (width == 0 || height == 0)
return; return;
ret = ttm_bo_kmap(&ddirty->buf->base, 0, ddirty->buf->base.num_pages,
&guest_map);
if (ret) {
DRM_ERROR("Failed mapping framebuffer for blit: %d\n",
ret);
goto out_cleanup;
}
/* Assume we are blitting from Host (display_srf) to Guest (dmabuf) */ /* Assume we are blitting from Host (display_srf) to Guest (dmabuf) */
src_pitch = stdu->display_srf->base_size.width * stdu->cpp; src_pitch = stdu->display_srf->base_size.width * stdu->cpp;
...@@ -713,7 +721,7 @@ static void vmw_stdu_dmabuf_cpu_commit(struct vmw_kms_dirty *dirty) ...@@ -713,7 +721,7 @@ static void vmw_stdu_dmabuf_cpu_commit(struct vmw_kms_dirty *dirty)
src += ddirty->top * src_pitch + ddirty->left * stdu->cpp; src += ddirty->top * src_pitch + ddirty->left * stdu->cpp;
dst_pitch = ddirty->pitch; dst_pitch = ddirty->pitch;
dst = ttm_kmap_obj_virtual(&stdu->guest_map, &not_used); dst = ttm_kmap_obj_virtual(&guest_map, &not_used);
dst += ddirty->fb_top * dst_pitch + ddirty->fb_left * stdu->cpp; dst += ddirty->fb_top * dst_pitch + ddirty->fb_left * stdu->cpp;
...@@ -772,6 +780,7 @@ static void vmw_stdu_dmabuf_cpu_commit(struct vmw_kms_dirty *dirty) ...@@ -772,6 +780,7 @@ static void vmw_stdu_dmabuf_cpu_commit(struct vmw_kms_dirty *dirty)
vmw_fifo_commit(dev_priv, sizeof(*cmd)); vmw_fifo_commit(dev_priv, sizeof(*cmd));
} }
ttm_bo_kunmap(&guest_map);
out_cleanup: out_cleanup:
ddirty->left = ddirty->top = ddirty->fb_left = ddirty->fb_top = S32_MAX; ddirty->left = ddirty->top = ddirty->fb_left = ddirty->fb_top = S32_MAX;
ddirty->right = ddirty->bottom = S32_MIN; ddirty->right = ddirty->bottom = S32_MIN;
...@@ -1109,9 +1118,6 @@ vmw_stdu_primary_plane_cleanup_fb(struct drm_plane *plane, ...@@ -1109,9 +1118,6 @@ vmw_stdu_primary_plane_cleanup_fb(struct drm_plane *plane,
{ {
struct vmw_plane_state *vps = vmw_plane_state_to_vps(old_state); struct vmw_plane_state *vps = vmw_plane_state_to_vps(old_state);
if (vps->guest_map.virtual)
ttm_bo_kunmap(&vps->guest_map);
if (vps->host_map.virtual) if (vps->host_map.virtual)
ttm_bo_kunmap(&vps->host_map); ttm_bo_kunmap(&vps->host_map);
...@@ -1277,33 +1283,11 @@ vmw_stdu_primary_plane_prepare_fb(struct drm_plane *plane, ...@@ -1277,33 +1283,11 @@ vmw_stdu_primary_plane_prepare_fb(struct drm_plane *plane,
*/ */
if (vps->content_fb_type == SEPARATE_DMA && if (vps->content_fb_type == SEPARATE_DMA &&
!(dev_priv->capabilities & SVGA_CAP_3D)) { !(dev_priv->capabilities & SVGA_CAP_3D)) {
struct vmw_framebuffer_dmabuf *new_vfbd;
new_vfbd = vmw_framebuffer_to_vfbd(new_fb);
ret = ttm_bo_reserve(&new_vfbd->buffer->base, false, false,
NULL);
if (ret)
goto out_srf_unpin;
ret = ttm_bo_kmap(&new_vfbd->buffer->base, 0,
new_vfbd->buffer->base.num_pages,
&vps->guest_map);
ttm_bo_unreserve(&new_vfbd->buffer->base);
if (ret) {
DRM_ERROR("Failed to map content buffer to CPU\n");
goto out_srf_unpin;
}
ret = ttm_bo_kmap(&vps->surf->res.backup->base, 0, ret = ttm_bo_kmap(&vps->surf->res.backup->base, 0,
vps->surf->res.backup->base.num_pages, vps->surf->res.backup->base.num_pages,
&vps->host_map); &vps->host_map);
if (ret) { if (ret) {
DRM_ERROR("Failed to map display buffer to CPU\n"); DRM_ERROR("Failed to map display buffer to CPU\n");
ttm_bo_kunmap(&vps->guest_map);
goto out_srf_unpin; goto out_srf_unpin;
} }
...@@ -1350,7 +1334,6 @@ vmw_stdu_primary_plane_atomic_update(struct drm_plane *plane, ...@@ -1350,7 +1334,6 @@ vmw_stdu_primary_plane_atomic_update(struct drm_plane *plane,
stdu->display_srf = vps->surf; stdu->display_srf = vps->surf;
stdu->content_fb_type = vps->content_fb_type; stdu->content_fb_type = vps->content_fb_type;
stdu->cpp = vps->cpp; stdu->cpp = vps->cpp;
memcpy(&stdu->guest_map, &vps->guest_map, sizeof(vps->guest_map));
memcpy(&stdu->host_map, &vps->host_map, sizeof(vps->host_map)); memcpy(&stdu->host_map, &vps->host_map, sizeof(vps->host_map));
if (!stdu->defined) if (!stdu->defined)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment