Commit b56fb708 authored by Dave Airlie's avatar Dave Airlie

Merge branch 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel into drm-next

Daniel writes:
Bunch of fixes, all pretty high-priority
- Fix execbuf argument checking (Kees Cook)
- Optionally obfuscate kernel addresses in dumps (Kees Cook)
- Two patches from Takashi Iwai to fix DP link training regressions he's
  seen.
- intel-gfx is no longer subscribers-only (well, just no longer moderated
  in an annoying way for non-subscribers), update MAINTAINERS
- gm45 gmbus irq fallout fix (Jiri Kosina)

* 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel:
  drm/i915: stop using GMBUS IRQs on Gen4 chips
  MAINTAINERS: intel-gfx is no longer subscribers-only
  drm/i915: Use the fixed pixel clock for eDP in intel_dp_set_m_n()
  Revert "drm/i915: try to train DP even harder"
  drm/i915: bounds check execbuffer relocation count
  drm/i915: restrict kernel address leak in debugfs
parents 260b3f12 c12aba5a
...@@ -2623,7 +2623,7 @@ F: include/uapi/drm/ ...@@ -2623,7 +2623,7 @@ F: include/uapi/drm/
INTEL DRM DRIVERS (excluding Poulsbo, Moorestown and derivative chipsets) INTEL DRM DRIVERS (excluding Poulsbo, Moorestown and derivative chipsets)
M: Daniel Vetter <daniel.vetter@ffwll.ch> M: Daniel Vetter <daniel.vetter@ffwll.ch>
L: intel-gfx@lists.freedesktop.org (subscribers-only) L: intel-gfx@lists.freedesktop.org
L: dri-devel@lists.freedesktop.org L: dri-devel@lists.freedesktop.org
T: git git://people.freedesktop.org/~danvet/drm-intel T: git git://people.freedesktop.org/~danvet/drm-intel
S: Supported S: Supported
......
...@@ -103,7 +103,7 @@ static const char *cache_level_str(int type) ...@@ -103,7 +103,7 @@ static const char *cache_level_str(int type)
static void static void
describe_obj(struct seq_file *m, struct drm_i915_gem_object *obj) describe_obj(struct seq_file *m, struct drm_i915_gem_object *obj)
{ {
seq_printf(m, "%p: %s%s %8zdKiB %02x %02x %d %d %d%s%s%s", seq_printf(m, "%pK: %s%s %8zdKiB %02x %02x %d %d %d%s%s%s",
&obj->base, &obj->base,
get_pin_flag(obj), get_pin_flag(obj),
get_tiling_flag(obj), get_tiling_flag(obj),
......
...@@ -732,6 +732,8 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec, ...@@ -732,6 +732,8 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
int count) int count)
{ {
int i; int i;
int relocs_total = 0;
int relocs_max = INT_MAX / sizeof(struct drm_i915_gem_relocation_entry);
for (i = 0; i < count; i++) { for (i = 0; i < count; i++) {
char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr; char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr;
...@@ -740,10 +742,13 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec, ...@@ -740,10 +742,13 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
if (exec[i].flags & __EXEC_OBJECT_UNKNOWN_FLAGS) if (exec[i].flags & __EXEC_OBJECT_UNKNOWN_FLAGS)
return -EINVAL; return -EINVAL;
/* First check for malicious input causing overflow */ /* First check for malicious input causing overflow in
if (exec[i].relocation_count > * the worst case where we need to allocate the entire
INT_MAX / sizeof(struct drm_i915_gem_relocation_entry)) * relocation tree as a single array.
*/
if (exec[i].relocation_count > relocs_max - relocs_total)
return -EINVAL; return -EINVAL;
relocs_total += exec[i].relocation_count;
length = exec[i].relocation_count * length = exec[i].relocation_count *
sizeof(struct drm_i915_gem_relocation_entry); sizeof(struct drm_i915_gem_relocation_entry);
......
...@@ -820,6 +820,7 @@ intel_dp_set_m_n(struct drm_crtc *crtc, struct drm_display_mode *mode, ...@@ -820,6 +820,7 @@ intel_dp_set_m_n(struct drm_crtc *crtc, struct drm_display_mode *mode,
struct intel_link_m_n m_n; struct intel_link_m_n m_n;
int pipe = intel_crtc->pipe; int pipe = intel_crtc->pipe;
enum transcoder cpu_transcoder = intel_crtc->cpu_transcoder; enum transcoder cpu_transcoder = intel_crtc->cpu_transcoder;
int target_clock;
/* /*
* Find the lane count in the intel_encoder private * Find the lane count in the intel_encoder private
...@@ -835,13 +836,22 @@ intel_dp_set_m_n(struct drm_crtc *crtc, struct drm_display_mode *mode, ...@@ -835,13 +836,22 @@ intel_dp_set_m_n(struct drm_crtc *crtc, struct drm_display_mode *mode,
} }
} }
target_clock = mode->clock;
for_each_encoder_on_crtc(dev, crtc, intel_encoder) {
if (intel_encoder->type == INTEL_OUTPUT_EDP) {
target_clock = intel_edp_target_clock(intel_encoder,
mode);
break;
}
}
/* /*
* Compute the GMCH and Link ratios. The '3' here is * Compute the GMCH and Link ratios. The '3' here is
* the number of bytes_per_pixel post-LUT, which we always * the number of bytes_per_pixel post-LUT, which we always
* set up for 8-bits of R/G/B, or 3 bytes total. * set up for 8-bits of R/G/B, or 3 bytes total.
*/ */
intel_link_compute_m_n(intel_crtc->bpp, lane_count, intel_link_compute_m_n(intel_crtc->bpp, lane_count,
mode->clock, adjusted_mode->clock, &m_n); target_clock, adjusted_mode->clock, &m_n);
if (IS_HASWELL(dev)) { if (IS_HASWELL(dev)) {
I915_WRITE(PIPE_DATA_M1(cpu_transcoder), I915_WRITE(PIPE_DATA_M1(cpu_transcoder),
...@@ -1930,7 +1940,7 @@ intel_dp_start_link_train(struct intel_dp *intel_dp) ...@@ -1930,7 +1940,7 @@ intel_dp_start_link_train(struct intel_dp *intel_dp)
for (i = 0; i < intel_dp->lane_count; i++) for (i = 0; i < intel_dp->lane_count; i++)
if ((intel_dp->train_set[i] & DP_TRAIN_MAX_SWING_REACHED) == 0) if ((intel_dp->train_set[i] & DP_TRAIN_MAX_SWING_REACHED) == 0)
break; break;
if (i == intel_dp->lane_count && voltage_tries == 5) { if (i == intel_dp->lane_count) {
++loop_tries; ++loop_tries;
if (loop_tries == 5) { if (loop_tries == 5) {
DRM_DEBUG_KMS("too many full retries, give up\n"); DRM_DEBUG_KMS("too many full retries, give up\n");
......
...@@ -203,7 +203,13 @@ intel_gpio_setup(struct intel_gmbus *bus, u32 pin) ...@@ -203,7 +203,13 @@ intel_gpio_setup(struct intel_gmbus *bus, u32 pin)
algo->data = bus; algo->data = bus;
} }
#define HAS_GMBUS_IRQ(dev) (INTEL_INFO(dev)->gen >= 4) /*
* gmbus on gen4 seems to be able to generate legacy interrupts even when in MSI
* mode. This results in spurious interrupt warnings if the legacy irq no. is
* shared with another device. The kernel then disables that interrupt source
* and so prevents the other device from working properly.
*/
#define HAS_GMBUS_IRQ(dev) (INTEL_INFO(dev)->gen >= 5)
static int static int
gmbus_wait_hw_status(struct drm_i915_private *dev_priv, gmbus_wait_hw_status(struct drm_i915_private *dev_priv,
u32 gmbus2_status, u32 gmbus2_status,
...@@ -214,6 +220,9 @@ gmbus_wait_hw_status(struct drm_i915_private *dev_priv, ...@@ -214,6 +220,9 @@ gmbus_wait_hw_status(struct drm_i915_private *dev_priv,
u32 gmbus2 = 0; u32 gmbus2 = 0;
DEFINE_WAIT(wait); DEFINE_WAIT(wait);
if (!HAS_GMBUS_IRQ(dev_priv->dev))
gmbus4_irq_en = 0;
/* Important: The hw handles only the first bit, so set only one! Since /* Important: The hw handles only the first bit, so set only one! Since
* we also need to check for NAKs besides the hw ready/idle signal, we * we also need to check for NAKs besides the hw ready/idle signal, we
* need to wake up periodically and check that ourselves. */ * need to wake up periodically and check that ourselves. */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment