Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'drm-fixes-for-v4.15-rc8' of git://people.freedesktop.org/~airlied/linux

Pull drm fixes from Dave Airlie:

- Nouveau: regression fix

- Tegra: regression fix

- vmwgfx: crasher + freed data leak

- i915: KASAN use after free fix, whitelist register to avoid hang fix,
GVT fixes

- vc4: irq/pm fix

* tag 'drm-fixes-for-v4.15-rc8' of git://people.freedesktop.org/~airlied/linux:
drm/i915: Don't adjust priority on an already signaled fence
drm/i915: Whitelist SLICE_COMMON_ECO_CHICKEN1 on Geminilake.
drm/vmwgfx: Potential off by one in vmw_view_add()
drm/tegra: sor: Fix hang on Tegra124 eDP
drm/vmwgfx: Don't cache framebuffer maps
drm/nouveau/disp/gf119: add missing drive vfunc ptr
drm/i915/gvt: Fix stack-out-of-bounds bug in cmd parser
drm/i915/gvt: Clear the shadow page table entry after post-sync
drm/vc4: Move IRQ enable to PM path

+39 -43
+2 -2
drivers/gpu/drm/i915/gvt/cmd_parser.c
··· 2777 2777 } 2778 2778 2779 2779 static struct cmd_info *find_cmd_entry_any_ring(struct intel_gvt *gvt, 2780 - unsigned int opcode, int rings) 2780 + unsigned int opcode, unsigned long rings) 2781 2781 { 2782 2782 struct cmd_info *info = NULL; 2783 2783 unsigned int ring; 2784 2784 2785 - for_each_set_bit(ring, (unsigned long *)&rings, I915_NUM_ENGINES) { 2785 + for_each_set_bit(ring, &rings, I915_NUM_ENGINES) { 2786 2786 info = find_cmd_entry(gvt, opcode, ring); 2787 2787 if (info) 2788 2788 break;
+4 -1
drivers/gpu/drm/i915/gvt/gtt.c
··· 1359 1359 return ret; 1360 1360 } else { 1361 1361 if (!test_bit(index, spt->post_shadow_bitmap)) { 1362 + int type = spt->shadow_page.type; 1363 + 1362 1364 ppgtt_get_shadow_entry(spt, &se, index); 1363 1365 ret = ppgtt_handle_guest_entry_removal(gpt, &se, index); 1364 1366 if (ret) 1365 1367 return ret; 1368 + ops->set_pfn(&se, vgpu->gtt.scratch_pt[type].page_mfn); 1369 + ppgtt_set_shadow_entry(spt, &se, index); 1366 1370 } 1367 - 1368 1371 ppgtt_set_post_shadow(spt, index); 1369 1372 } 1370 1373
+1 -1
drivers/gpu/drm/i915/i915_gem.c
··· 467 467 struct drm_i915_gem_request *rq; 468 468 struct intel_engine_cs *engine; 469 469 470 - if (!dma_fence_is_i915(fence)) 470 + if (dma_fence_is_signaled(fence) || !dma_fence_is_i915(fence)) 471 471 return; 472 472 473 473 rq = to_request(fence);
+2
drivers/gpu/drm/i915/i915_reg.h
··· 7027 7027 #define GEN9_SLICE_COMMON_ECO_CHICKEN0 _MMIO(0x7308) 7028 7028 #define DISABLE_PIXEL_MASK_CAMMING (1<<14) 7029 7029 7030 + #define GEN9_SLICE_COMMON_ECO_CHICKEN1 _MMIO(0x731c) 7031 + 7030 7032 #define GEN7_L3SQCREG1 _MMIO(0xB010) 7031 7033 #define VLV_B0_WA_L3SQCREG1_VALUE 0x00D30000 7032 7034
+5
drivers/gpu/drm/i915/intel_engine_cs.c
··· 1390 1390 if (ret) 1391 1391 return ret; 1392 1392 1393 + /* WA #0862: Userspace has to set "Barrier Mode" to avoid hangs. */ 1394 + ret = wa_ring_whitelist_reg(engine, GEN9_SLICE_COMMON_ECO_CHICKEN1); 1395 + if (ret) 1396 + return ret; 1397 + 1393 1398 /* WaToEnableHwFixForPushConstHWBug:glk */ 1394 1399 WA_SET_BIT_MASKED(COMMON_SLICE_CHICKEN2, 1395 1400 GEN8_SBE_DISABLE_REPLAY_BUF_OPTIMIZATION);
+3
drivers/gpu/drm/i915/intel_lrc.c
··· 974 974 975 975 GEM_BUG_ON(prio == I915_PRIORITY_INVALID); 976 976 977 + if (i915_gem_request_completed(request)) 978 + return; 979 + 977 980 if (prio <= READ_ONCE(request->priotree.priority)) 978 981 return; 979 982
+1
drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c
··· 174 174 .links = gf119_sor_dp_links, 175 175 .power = g94_sor_dp_power, 176 176 .pattern = gf119_sor_dp_pattern, 177 + .drive = gf119_sor_dp_drive, 177 178 .vcpi = gf119_sor_dp_vcpi, 178 179 .audio = gf119_sor_dp_audio, 179 180 .audio_sym = gf119_sor_dp_audio_sym,
+3
drivers/gpu/drm/tegra/sor.c
··· 2656 2656 name, err); 2657 2657 goto remove; 2658 2658 } 2659 + } else { 2660 + /* fall back to the module clock on SOR0 (eDP/LVDS only) */ 2661 + sor->clk_out = sor->clk; 2659 2662 } 2660 2663 2661 2664 sor->clk_parent = devm_clk_get(&pdev->dev, "parent");
-3
drivers/gpu/drm/vc4/vc4_irq.c
··· 209 209 { 210 210 struct vc4_dev *vc4 = to_vc4_dev(dev); 211 211 212 - /* Undo the effects of a previous vc4_irq_uninstall. */ 213 - enable_irq(dev->irq); 214 - 215 212 /* Enable both the render done and out of memory interrupts. */ 216 213 V3D_WRITE(V3D_INTENA, V3D_DRIVER_IRQS); 217 214
+3
drivers/gpu/drm/vc4/vc4_v3d.c
··· 327 327 return ret; 328 328 329 329 vc4_v3d_init_hw(vc4->dev); 330 + 331 + /* We disabled the IRQ as part of vc4_irq_uninstall in suspend. */ 332 + enable_irq(vc4->dev->irq); 330 333 vc4_irq_postinstall(vc4->dev); 331 334 332 335 return 0;
+2
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
··· 2731 2731 } 2732 2732 2733 2733 view_type = vmw_view_cmd_to_type(header->id); 2734 + if (view_type == vmw_view_max) 2735 + return -EINVAL; 2734 2736 cmd = container_of(header, typeof(*cmd), header); 2735 2737 ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, 2736 2738 user_surface_converter,
-6
drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
··· 697 697 vps->pinned = 0; 698 698 699 699 /* Mapping is managed by prepare_fb/cleanup_fb */ 700 - memset(&vps->guest_map, 0, sizeof(vps->guest_map)); 701 700 memset(&vps->host_map, 0, sizeof(vps->host_map)); 702 701 vps->cpp = 0; 703 702 ··· 759 760 760 761 761 762 /* Should have been freed by cleanup_fb */ 762 - if (vps->guest_map.virtual) { 763 - DRM_ERROR("Guest mapping not freed\n"); 764 - ttm_bo_kunmap(&vps->guest_map); 765 - } 766 - 767 763 if (vps->host_map.virtual) { 768 764 DRM_ERROR("Host mapping not freed\n"); 769 765 ttm_bo_kunmap(&vps->host_map);
+1 -1
drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
··· 175 175 int pinned; 176 176 177 177 /* For CPU Blit */ 178 - struct ttm_bo_kmap_obj host_map, guest_map; 178 + struct ttm_bo_kmap_obj host_map; 179 179 unsigned int cpp; 180 180 }; 181 181
+12 -29
drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
··· 114 114 bool defined; 115 115 116 116 /* For CPU Blit */ 117 - struct ttm_bo_kmap_obj host_map, guest_map; 117 + struct ttm_bo_kmap_obj host_map; 118 118 unsigned int cpp; 119 119 }; 120 120 ··· 695 695 s32 src_pitch, dst_pitch; 696 696 u8 *src, *dst; 697 697 bool not_used; 698 - 698 + struct ttm_bo_kmap_obj guest_map; 699 + int ret; 699 700 700 701 if (!dirty->num_hits) 701 702 return; ··· 707 706 if (width == 0 || height == 0) 708 707 return; 709 708 709 + ret = ttm_bo_kmap(&ddirty->buf->base, 0, ddirty->buf->base.num_pages, 710 + &guest_map); 711 + if (ret) { 712 + DRM_ERROR("Failed mapping framebuffer for blit: %d\n", 713 + ret); 714 + goto out_cleanup; 715 + } 710 716 711 717 /* Assume we are blitting from Host (display_srf) to Guest (dmabuf) */ 712 718 src_pitch = stdu->display_srf->base_size.width * stdu->cpp; ··· 721 713 src += ddirty->top * src_pitch + ddirty->left * stdu->cpp; 722 714 723 715 dst_pitch = ddirty->pitch; 724 - dst = ttm_kmap_obj_virtual(&stdu->guest_map, &not_used); 716 + dst = ttm_kmap_obj_virtual(&guest_map, &not_used); 725 717 dst += ddirty->fb_top * dst_pitch + ddirty->fb_left * stdu->cpp; 726 718 727 719 ··· 780 772 vmw_fifo_commit(dev_priv, sizeof(*cmd)); 781 773 } 782 774 775 + ttm_bo_kunmap(&guest_map); 783 776 out_cleanup: 784 777 ddirty->left = ddirty->top = ddirty->fb_left = ddirty->fb_top = S32_MAX; 785 778 ddirty->right = ddirty->bottom = S32_MIN; ··· 1118 1109 { 1119 1110 struct vmw_plane_state *vps = vmw_plane_state_to_vps(old_state); 1120 1111 1121 - if (vps->guest_map.virtual) 1122 - ttm_bo_kunmap(&vps->guest_map); 1123 - 1124 1112 if (vps->host_map.virtual) 1125 1113 ttm_bo_kunmap(&vps->host_map); 1126 1114 ··· 1283 1277 */ 1284 1278 if (vps->content_fb_type == SEPARATE_DMA && 1285 1279 !(dev_priv->capabilities & SVGA_CAP_3D)) { 1286 - 1287 - struct vmw_framebuffer_dmabuf *new_vfbd; 1288 - 1289 - new_vfbd = vmw_framebuffer_to_vfbd(new_fb); 1290 - 1291 - ret = ttm_bo_reserve(&new_vfbd->buffer->base, false, false, 1292 - NULL); 1293 - if (ret) 1294 - goto out_srf_unpin; 1295 - 1296 - ret = ttm_bo_kmap(&new_vfbd->buffer->base, 0, 1297 - new_vfbd->buffer->base.num_pages, 1298 - &vps->guest_map); 1299 - 1300 - ttm_bo_unreserve(&new_vfbd->buffer->base); 1301 - 1302 - if (ret) { 1303 - DRM_ERROR("Failed to map content buffer to CPU\n"); 1304 - goto out_srf_unpin; 1305 - } 1306 - 1307 1280 ret = ttm_bo_kmap(&vps->surf->res.backup->base, 0, 1308 1281 vps->surf->res.backup->base.num_pages, 1309 1282 &vps->host_map); 1310 1283 if (ret) { 1311 1284 DRM_ERROR("Failed to map display buffer to CPU\n"); 1312 - ttm_bo_kunmap(&vps->guest_map); 1313 1285 goto out_srf_unpin; 1314 1286 } 1315 1287 ··· 1334 1350 stdu->display_srf = vps->surf; 1335 1351 stdu->content_fb_type = vps->content_fb_type; 1336 1352 stdu->cpp = vps->cpp; 1337 - memcpy(&stdu->guest_map, &vps->guest_map, sizeof(vps->guest_map)); 1338 1353 memcpy(&stdu->host_map, &vps->host_map, sizeof(vps->host_map)); 1339 1354 1340 1355 if (!stdu->defined)