BMC/Intel-BMC/linux.git/drivers/gpu/drm/ttm, branch dev-4.10

drm/ttm: fix use-after-free races in vm fault handling

2017-05-14T12:08:30+00:00

commit 3089c1df10e2931b1d72d2ffa7d86431084c86b3 upstream. The vm fault handler relies on the fact that the VMA owns a reference to the BO. However, once mmap_sem is released, other tasks are free to destroy the VMA, which can lead to the BO being freed. Fix two code paths where that can happen, both related to vm fault retries. Found via a lock debugging warning which flagged &bo->wu_mutex as locked while being destroyed. Fixes: cbe12e74ee4e ("drm/ttm: Allow vm fault retries") Signed-off-by: Nicolai Hähnle Reviewed-by: Christian König Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman

drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces

2017-04-12T10:42:03+00:00

commit fe25deb7737ce6c0879ccf79c99fa1221d428bf2 upstream. Previously, when a surface was opened using a legacy (non prime) handle, it was verified to have been created by a client in the same master realm. Relax this so that opening is also allowed recursively if the client already has the surface open. This works around a regression in svga mesa where opening of a shared surface is used recursively to obtain surface information. Signed-off-by: Thomas Hellstrom Reviewed-by: Sinclair Yeh Signed-off-by: Greg Kroah-Hartman

drm/ttm: Make sure BOs being swapped out are cacheable

2017-03-15T02:20:16+00:00

commit 239ac65fa5ffab71adf66e642750f940e7241d99 upstream. The current caching state may not be tt_cached, even though the placement contains TTM_PL_FLAG_CACHED, because placement can contain multiple caching flags. Trying to swap out such a BO would trip up the BUG_ON(ttm->caching_state != tt_cached); in ttm_tt_swapout. Signed-off-by: Michel Dänzer Reviewed-by: Thomas Hellstrom Reviewed-by: Christian König . Reviewed-by: Sinclair Yeh Signed-off-by: Christian König Signed-off-by: Greg Kroah-Hartman

mm: use vmf->address instead of of vmf->virtual_address

2016-12-15T00:04:09+00:00

Every single user of vmf->virtual_address typed that entry to unsigned long before doing anything with it so the type of virtual_address does not really provide us any additional safety. Just use masked vmf->address which already has the appropriate type. Link: http://lkml.kernel.org/r/1479460644-25076-3-git-send-email-jack@suse.cz Signed-off-by: Jan Kara Acked-by: Kirill A. Shutemov Cc: Dan Williams Cc: Ross Zwisler Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

drm/ttm: fix ttm_bo_wait

2016-11-08T19:16:04+00:00

reservation_object_wait_timeout_rcu() should enable signaling even with a zero timeout, but ttm_bo_wait() can also be called from atomic context and then it is not a good idea to do this. Reviewed-by: Alex Deucher Signed-off-by: Christian König Reviewed-by: Gustavo Padovan Signed-off-by: Alex Deucher Signed-off-by: Sumit Semwal [sumits: fix checkpatch warnings] Link: http://patchwork.freedesktop.org/patch/msgid/1478553376-18575-3-git-send-email-alexander.deucher@amd.com

Merge tag 'topic/drm-misc-2016-10-27' of git://anongit.freedesktop.org/git/drm-intel into drm-next

2016-10-28T01:33:52+00:00

Pull request already again to get the s/fence/dma_fence/ stuff in and allow everyone to resync. Otherwise really just misc stuff all over, and a new bridge driver. * tag 'topic/drm-misc-2016-10-27' of git://anongit.freedesktop.org/git/drm-intel: drm/bridge: fix platform_no_drv_owner.cocci warnings drm/bridge: fix semicolon.cocci warnings drm: Print some debug/error info during DP dual mode detect drm: mark drm_of_component_match_add dummy inline drm/bridge: add Silicon Image SiI8620 driver dt-bindings: add Silicon Image SiI8620 bridge bindings video: add header file for Mobile High-Definition Link (MHL) interface drm: convert DT component matching to component_match_add_release() dma-buf: Rename struct fence to dma_fence dma-buf/fence: add an lockdep_assert_held() drm/dp: Factor out helper to distinguish between branch and sink devices drm/edid: Only print the bad edid when aborting drm/msm: add missing header dependencies drm/msm/adreno: move function declarations to header file drm/i2c/tda998x: mark symbol static where possible doc: add missing docbook parameter for fence-array drm: RIP mode_config->rotation_property drm/msm/mdp5: Advertize 180 degree rotation drm/msm/mdp5: Use per-plane rotation property

drm/ttm: make eviction decision a driver callback v2

2016-10-25T18:44:04+00:00

This way the driver can decide if it is valuable to evict a BO or not. The current implementation is added as default to all existing drivers. v2: fix some typos found during internal testing Signed-off-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher

dma-buf: Rename struct fence to dma_fence

2016-10-25T12:40:39+00:00

I plan to usurp the short name of struct fence for a core kernel struct, and so I need to rename the specialised fence/timeline for DMA operations to make room. A consensus was reached in https://lists.freedesktop.org/archives/dri-devel/2016-July/113083.html that making clear this fence applies to DMA operations was a good thing. Since then the patch has grown a bit as usage increases, so hopefully it remains a good thing! (v2...: rebase, rerun spatch) v3: Compile on msm, spotted a manual fixup that I broke. v4: Try again for msm, sorry Daniel coccinelle script: @@ @@ - struct fence + struct dma_fence @@ @@ - struct fence_ops + struct dma_fence_ops @@ @@ - struct fence_cb + struct dma_fence_cb @@ @@ - struct fence_array + struct dma_fence_array @@ @@ - enum fence_flag_bits + enum dma_fence_flag_bits @@ @@ ( - fence_init + dma_fence_init | - fence_release + dma_fence_release | - fence_free + dma_fence_free | - fence_get + dma_fence_get | - fence_get_rcu + dma_fence_get_rcu | - fence_put + dma_fence_put | - fence_signal + dma_fence_signal | - fence_signal_locked + dma_fence_signal_locked | - fence_default_wait + dma_fence_default_wait | - fence_add_callback + dma_fence_add_callback | - fence_remove_callback + dma_fence_remove_callback | - fence_enable_sw_signaling + dma_fence_enable_sw_signaling | - fence_is_signaled_locked + dma_fence_is_signaled_locked | - fence_is_signaled + dma_fence_is_signaled | - fence_is_later + dma_fence_is_later | - fence_later + dma_fence_later | - fence_wait_timeout + dma_fence_wait_timeout | - fence_wait_any_timeout + dma_fence_wait_any_timeout | - fence_wait + dma_fence_wait | - fence_context_alloc + dma_fence_context_alloc | - fence_array_create + dma_fence_array_create | - to_fence_array + to_dma_fence_array | - fence_is_array + dma_fence_is_array | - trace_fence_emit + trace_dma_fence_emit | - FENCE_TRACE + DMA_FENCE_TRACE | - FENCE_WARN + DMA_FENCE_WARN | - FENCE_ERR + DMA_FENCE_ERR ) ( ... ) Signed-off-by: Chris Wilson Reviewed-by: Gustavo Padovan Acked-by: Sumit Semwal Acked-by: Christian König Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/20161025120045.28839-1-chris@chris-wilson.co.uk

drm/ttm: remove cpu_address member from ttm_tt

2016-09-16T19:53:05+00:00

Patch 3d50d4dcb0 exposed the CPU address of DMA-allocated pages as returned by dma_alloc_coherent because Nouveau on Tegra needed it. This is not required anymore - as there were no other users for it, remove it and save some memory for everyone. Reviewed-by: Christian König Signed-off-by: Alexandre Courbot Signed-off-by: Alex Deucher

drm/ttm: use ffs in ttm_mem_type_from_place

2016-09-14T19:10:41+00:00

A bit pointless to search for the first bit set manually. Signed-off-by: Christian König Reviewed-by: Alex Deucher Reviewed-by: Chunming Zhou Signed-off-by: Alex Deucher