Merge tag 'drm-fixes-for-4.8-rc5' of git://people.freedesktop.org/~airlied/linux

+3 -2

drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c

··· 280 280 int amdgpu_ib_ring_tests(struct amdgpu_device *adev) 281 281 { 282 282 unsigned i; 283 - int r; 283 + int r, ret = 0; 284 284 285 285 for (i = 0; i < AMDGPU_MAX_RINGS; ++i) { 286 286 struct amdgpu_ring *ring = adev->rings[i]; ··· 301 301 } else { 302 302 /* still not good, but we can live with it */ 303 303 DRM_ERROR("amdgpu: failed testing IB on ring %d (%d).\n", i, r); 304 + ret = r; 304 305 } 305 306 } 306 307 } 307 - return 0; 308 + return ret; 308 309 } 309 310 310 311 /*

+3

drivers/gpu/drm/amd/amdgpu/cik_sdma.c

··· 52 52 static void cik_sdma_set_irq_funcs(struct amdgpu_device *adev); 53 53 static void cik_sdma_set_buffer_funcs(struct amdgpu_device *adev); 54 54 static void cik_sdma_set_vm_pte_funcs(struct amdgpu_device *adev); 55 + static int cik_sdma_soft_reset(void *handle); 55 56 56 57 MODULE_FIRMWARE("radeon/bonaire_sdma.bin"); 57 58 MODULE_FIRMWARE("radeon/bonaire_sdma1.bin"); ··· 1037 1036 static int cik_sdma_resume(void *handle) 1038 1037 { 1039 1038 struct amdgpu_device *adev = (struct amdgpu_device *)handle; 1039 + 1040 + cik_sdma_soft_reset(handle); 1040 1041 1041 1042 return cik_sdma_hw_init(adev); 1042 1043 }

+9 -3

drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c

··· 2755 2755 u64 wb_gpu_addr; 2756 2756 u32 *buf; 2757 2757 struct bonaire_mqd *mqd; 2758 - 2759 - gfx_v7_0_cp_compute_enable(adev, true); 2758 + struct amdgpu_ring *ring; 2760 2759 2761 2760 /* fix up chicken bits */ 2762 2761 tmp = RREG32(mmCP_CPF_DEBUG); ··· 2790 2791 2791 2792 /* init the queues. Just two for now. */ 2792 2793 for (i = 0; i < adev->gfx.num_compute_rings; i++) { 2793 - struct amdgpu_ring *ring = &adev->gfx.compute_ring[i]; 2794 + ring = &adev->gfx.compute_ring[i]; 2794 2795 2795 2796 if (ring->mqd_obj == NULL) { 2796 2797 r = amdgpu_bo_create(adev, ··· 2969 2970 amdgpu_bo_unreserve(ring->mqd_obj); 2970 2971 2971 2972 ring->ready = true; 2973 + } 2974 + 2975 + gfx_v7_0_cp_compute_enable(adev, true); 2976 + 2977 + for (i = 0; i < adev->gfx.num_compute_rings; i++) { 2978 + ring = &adev->gfx.compute_ring[i]; 2979 + 2972 2980 r = amdgpu_ring_test_ring(ring); 2973 2981 if (r) 2974 2982 ring->ready = false;

+25 -1

drivers/gpu/drm/imx/imx-drm-core.c

··· 171 171 drm_fbdev_cma_hotplug_event(imxdrm->fbhelper); 172 172 } 173 173 174 + static int imx_drm_atomic_check(struct drm_device *dev, 175 + struct drm_atomic_state *state) 176 + { 177 + int ret; 178 + 179 + ret = drm_atomic_helper_check_modeset(dev, state); 180 + if (ret) 181 + return ret; 182 + 183 + ret = drm_atomic_helper_check_planes(dev, state); 184 + if (ret) 185 + return ret; 186 + 187 + /* 188 + * Check modeset again in case crtc_state->mode_changed is 189 + * updated in plane's ->atomic_check callback. 190 + */ 191 + ret = drm_atomic_helper_check_modeset(dev, state); 192 + if (ret) 193 + return ret; 194 + 195 + return ret; 196 + } 197 + 174 198 static const struct drm_mode_config_funcs imx_drm_mode_config_funcs = { 175 199 .fb_create = drm_fb_cma_create, 176 200 .output_poll_changed = imx_drm_output_poll_changed, 177 - .atomic_check = drm_atomic_helper_check, 201 + .atomic_check = imx_drm_atomic_check, 178 202 .atomic_commit = drm_atomic_helper_commit, 179 203 }; 180 204

+4

drivers/gpu/drm/imx/ipuv3-crtc.c

··· 76 76 crtc->state->event = NULL; 77 77 } 78 78 spin_unlock_irq(&crtc->dev->event_lock); 79 + 80 + drm_crtc_vblank_off(crtc); 79 81 } 80 82 81 83 static void imx_drm_crtc_reset(struct drm_crtc *crtc) ··· 177 175 static void ipu_crtc_atomic_begin(struct drm_crtc *crtc, 178 176 struct drm_crtc_state *old_crtc_state) 179 177 { 178 + drm_crtc_vblank_on(crtc); 179 + 180 180 spin_lock_irq(&crtc->dev->event_lock); 181 181 if (crtc->state->event) { 182 182 WARN_ON(drm_crtc_vblank_get(crtc));

+14 -7

drivers/gpu/drm/imx/ipuv3-plane.c

··· 319 319 return -EINVAL; 320 320 321 321 /* 322 - * since we cannot touch active IDMAC channels, we do not support 323 - * resizing the enabled plane or changing its format 322 + * We support resizing active plane or changing its format by 323 + * forcing CRTC mode change and disabling-enabling plane in plane's 324 + * ->atomic_update callback. 324 325 */ 325 326 if (old_fb && (state->src_w != old_state->src_w || 326 327 state->src_h != old_state->src_h || 327 328 fb->pixel_format != old_fb->pixel_format)) 328 - return -EINVAL; 329 + crtc_state->mode_changed = true; 329 330 330 331 eba = drm_plane_state_to_eba(state); 331 332 ··· 337 336 return -EINVAL; 338 337 339 338 if (old_fb && fb->pitches[0] != old_fb->pitches[0]) 340 - return -EINVAL; 339 + crtc_state->mode_changed = true; 341 340 342 341 switch (fb->pixel_format) { 343 342 case DRM_FORMAT_YUV420: ··· 373 372 return -EINVAL; 374 373 375 374 if (old_fb && old_fb->pitches[1] != fb->pitches[1]) 376 - return -EINVAL; 375 + crtc_state->mode_changed = true; 377 376 } 378 377 379 378 return 0; ··· 393 392 enum ipu_color_space ics; 394 393 395 394 if (old_state->fb) { 396 - ipu_plane_atomic_set_base(ipu_plane, old_state); 397 - return; 395 + struct drm_crtc_state *crtc_state = state->crtc->state; 396 + 397 + if (!crtc_state->mode_changed) { 398 + ipu_plane_atomic_set_base(ipu_plane, old_state); 399 + return; 400 + } 401 + 402 + ipu_disable_plane(plane); 398 403 } 399 404 400 405 switch (ipu_plane->dp_flow) {

+6

drivers/gpu/drm/msm/msm_drv.h

··· 157 157 struct shrinker shrinker; 158 158 159 159 struct msm_vblank_ctrl vblank_ctrl; 160 + 161 + /* task holding struct_mutex.. currently only used in submit path 162 + * to detect and reject faults from copy_from_user() for submit 163 + * ioctl. 164 + */ 165 + struct task_struct *struct_mutex_task; 160 166 }; 161 167 162 168 struct msm_format {

+9

drivers/gpu/drm/msm/msm_gem.c

··· 196 196 { 197 197 struct drm_gem_object *obj = vma->vm_private_data; 198 198 struct drm_device *dev = obj->dev; 199 + struct msm_drm_private *priv = dev->dev_private; 199 200 struct page **pages; 200 201 unsigned long pfn; 201 202 pgoff_t pgoff; 202 203 int ret; 204 + 205 + /* This should only happen if userspace tries to pass a mmap'd 206 + * but unfaulted gem bo vaddr into submit ioctl, triggering 207 + * a page fault while struct_mutex is already held. This is 208 + * not a valid use-case so just bail. 209 + */ 210 + if (priv->struct_mutex_task == current) 211 + return VM_FAULT_SIGBUS; 203 212 204 213 /* Make sure we don't parallel update on a fault, nor move or remove 205 214 * something from beneath our feet

+25 -5

drivers/gpu/drm/msm/msm_gem_submit.c

··· 64 64 kfree(submit); 65 65 } 66 66 67 + static inline unsigned long __must_check 68 + copy_from_user_inatomic(void *to, const void __user *from, unsigned long n) 69 + { 70 + if (access_ok(VERIFY_READ, from, n)) 71 + return __copy_from_user_inatomic(to, from, n); 72 + return -EFAULT; 73 + } 74 + 67 75 static int submit_lookup_objects(struct msm_gem_submit *submit, 68 76 struct drm_msm_gem_submit *args, struct drm_file *file) 69 77 { ··· 79 71 int ret = 0; 80 72 81 73 spin_lock(&file->table_lock); 74 + pagefault_disable(); 82 75 83 76 for (i = 0; i < args->nr_bos; i++) { 84 77 struct drm_msm_gem_submit_bo submit_bo; ··· 93 84 */ 94 85 submit->bos[i].flags = 0; 95 86 96 - ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo)); 97 - if (ret) { 98 - ret = -EFAULT; 99 - goto out_unlock; 87 + ret = copy_from_user_inatomic(&submit_bo, userptr, sizeof(submit_bo)); 88 + if (unlikely(ret)) { 89 + pagefault_enable(); 90 + spin_unlock(&file->table_lock); 91 + ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo)); 92 + if (ret) 93 + goto out; 94 + spin_lock(&file->table_lock); 95 + pagefault_disable(); 100 96 } 101 97 102 98 if (submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) { ··· 141 127 } 142 128 143 129 out_unlock: 144 - submit->nr_bos = i; 130 + pagefault_enable(); 145 131 spin_unlock(&file->table_lock); 132 + 133 + out: 134 + submit->nr_bos = i; 146 135 147 136 return ret; 148 137 } ··· 394 377 if (ret) 395 378 return ret; 396 379 380 + priv->struct_mutex_task = current; 381 + 397 382 submit = submit_create(dev, gpu, args->nr_bos, args->nr_cmds); 398 383 if (!submit) { 399 384 ret = -ENOMEM; ··· 487 468 if (ret) 488 469 msm_gem_submit_free(submit); 489 470 out_unlock: 471 + priv->struct_mutex_task = NULL; 490 472 mutex_unlock(&dev->struct_mutex); 491 473 return ret; 492 474 }

+11

drivers/gpu/drm/nouveau/nouveau_acpi.c

··· 225 225 if (!parent_pdev) 226 226 return false; 227 227 228 + if (!parent_pdev->bridge_d3) { 229 + /* 230 + * Parent PCI bridge is currently not power managed. 231 + * Since userspace can change these afterwards to be on 232 + * the safe side we stick with _DSM and prevent usage of 233 + * _PR3 from the bridge. 234 + */ 235 + pci_d3cold_disable(pdev); 236 + return false; 237 + } 238 + 228 239 parent_adev = ACPI_COMPANION(&parent_pdev->dev); 229 240 if (!parent_adev) 230 241 return false;

+3 -3

drivers/gpu/drm/vc4/vc4_drv.c

··· 57 57 switch (args->param) { 58 58 case DRM_VC4_PARAM_V3D_IDENT0: 59 59 ret = pm_runtime_get_sync(&vc4->v3d->pdev->dev); 60 - if (ret) 60 + if (ret < 0) 61 61 return ret; 62 62 args->value = V3D_READ(V3D_IDENT0); 63 63 pm_runtime_put(&vc4->v3d->pdev->dev); 64 64 break; 65 65 case DRM_VC4_PARAM_V3D_IDENT1: 66 66 ret = pm_runtime_get_sync(&vc4->v3d->pdev->dev); 67 - if (ret) 67 + if (ret < 0) 68 68 return ret; 69 69 args->value = V3D_READ(V3D_IDENT1); 70 70 pm_runtime_put(&vc4->v3d->pdev->dev); 71 71 break; 72 72 case DRM_VC4_PARAM_V3D_IDENT2: 73 73 ret = pm_runtime_get_sync(&vc4->v3d->pdev->dev); 74 - if (ret) 74 + if (ret < 0) 75 75 return ret; 76 76 args->value = V3D_READ(V3D_IDENT2); 77 77 pm_runtime_put(&vc4->v3d->pdev->dev);

+9

drivers/gpu/drm/vc4/vc4_drv.h

··· 321 321 struct vc4_exec_info, head); 322 322 } 323 323 324 + static inline struct vc4_exec_info * 325 + vc4_last_render_job(struct vc4_dev *vc4) 326 + { 327 + if (list_empty(&vc4->render_job_list)) 328 + return NULL; 329 + return list_last_entry(&vc4->render_job_list, 330 + struct vc4_exec_info, head); 331 + } 332 + 324 333 /** 325 334 * struct vc4_texture_sample_info - saves the offsets into the UBO for texture 326 335 * setup parameters.

+9 -9

drivers/gpu/drm/vc4/vc4_gem.c

··· 534 534 return -EINVAL; 535 535 } 536 536 537 - exec->bo = kcalloc(exec->bo_count, sizeof(struct drm_gem_cma_object *), 538 - GFP_KERNEL); 537 + exec->bo = drm_calloc_large(exec->bo_count, 538 + sizeof(struct drm_gem_cma_object *)); 539 539 if (!exec->bo) { 540 540 DRM_ERROR("Failed to allocate validated BO pointers\n"); 541 541 return -ENOMEM; ··· 572 572 spin_unlock(&file_priv->table_lock); 573 573 574 574 fail: 575 - kfree(handles); 576 - return 0; 575 + drm_free_large(handles); 576 + return ret; 577 577 } 578 578 579 579 static int ··· 608 608 * read the contents back for validation, and I think the 609 609 * bo->vaddr is uncached access. 610 610 */ 611 - temp = kmalloc(temp_size, GFP_KERNEL); 611 + temp = drm_malloc_ab(temp_size, 1); 612 612 if (!temp) { 613 613 DRM_ERROR("Failed to allocate storage for copying " 614 614 "in bin/render CLs.\n"); ··· 675 675 ret = vc4_validate_shader_recs(dev, exec); 676 676 677 677 fail: 678 - kfree(temp); 678 + drm_free_large(temp); 679 679 return ret; 680 680 } 681 681 ··· 688 688 if (exec->bo) { 689 689 for (i = 0; i < exec->bo_count; i++) 690 690 drm_gem_object_unreference_unlocked(&exec->bo[i]->base); 691 - kfree(exec->bo); 691 + drm_free_large(exec->bo); 692 692 } 693 693 694 694 while (!list_empty(&exec->unref_list)) { ··· 942 942 vc4->overflow_mem = NULL; 943 943 } 944 944 945 - vc4_bo_cache_destroy(dev); 946 - 947 945 if (vc4->hang_state) 948 946 vc4_free_hang_state(dev, vc4->hang_state); 947 + 948 + vc4_bo_cache_destroy(dev); 949 949 }

+3 -1

drivers/gpu/drm/vc4/vc4_irq.c

··· 83 83 84 84 spin_lock_irqsave(&vc4->job_lock, irqflags); 85 85 current_exec = vc4_first_bin_job(vc4); 86 + if (!current_exec) 87 + current_exec = vc4_last_render_job(vc4); 86 88 if (current_exec) { 87 - vc4->overflow_mem->seqno = vc4->finished_seqno + 1; 89 + vc4->overflow_mem->seqno = current_exec->seqno; 88 90 list_add_tail(&vc4->overflow_mem->unref_head, 89 91 &current_exec->unref_list); 90 92 vc4->overflow_mem = NULL;

Configure Feed

Configure Feed