kernel/linux.git/drivers/gpu/drm/vmwgfx, branch v5.15.7

drm/ttm: remove ttm_bo_vm_insert_huge()

2021-11-18T18:17:08+00:00

[ Upstream commit 0d979509539ed1df883a30d442177ca7be609565 ] The huge page functionality in TTM does not work safely because PUD and PMD entries do not have a special bit. get_user_pages_fast() considers any page that passed pmd_huge() as usable: if (unlikely(pmd_trans_huge(pmd) || pmd_huge(pmd) || pmd_devmap(pmd))) { And vmf_insert_pfn_pmd_prot() unconditionally sets entry = pmd_mkhuge(pfn_t_pmd(pfn, prot)); eg on x86 the page will be _PAGE_PRESENT | PAGE_PSE. As such gup_huge_pmd() will try to deref a struct page: head = try_grab_compound_head(pmd_page(orig), refs, flags); and thus crash. Thomas further notices that the drivers are not expecting the struct page to be used by anything - in particular the refcount incr above will cause them to malfunction. Thus everything about this is not able to fully work correctly considering GUP_fast. Delete it entirely. It can return someday along with a proper PMD/PUD_SPECIAL bit in the page table itself to gate GUP_fast. Fixes: 314b6580adc5 ("drm/ttm, drm/vmwgfx: Support huge TTM pagefaults") Signed-off-by: Jason Gunthorpe Reviewed-by: Thomas Hellström Reviewed-by: Christian König [danvet: Update subject per Thomas' &Christian's review] Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/0-v2-a44694790652+4ac-ttm_pmd_jgg@nvidia.com Signed-off-by: Sasha Levin

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

2021-09-02T21:47:21+00:00

Pull rdma updates from Jason Gunthorpe: "This is quite a small cycle, no major series stands out. The HNS and rxe drivers saw the most activity this cycle, with rxe being broken for a good chunk of time. The significant deleted line count is due to a SPDX cleanup series. Summary: - Various cleanup and small features for rtrs - kmap_local_page() conversions - Driver updates and fixes for: efa, rxe, mlx5, hfi1, qed, hns - Cache the IB subnet prefix - Rework how CRC is calcuated in rxe - Clean reference counting in iwpm's netlink - Pull object allocation and lifecycle for user QPs to the uverbs core code - Several small hns features and continued general code cleanups - Fix the scatterlist confusion of orig_nents/nents introduced in an earlier patch creating the append operation" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (90 commits) RDMA/mlx5: Relax DCS QP creation checks RDMA/hns: Delete unnecessary blank lines. RDMA/hns: Encapsulate the qp db as a function RDMA/hns: Adjust the order in which irq are requested and enabled RDMA/hns: Remove RST2RST error prints for hw v1 RDMA/hns: Remove dqpn filling when modify qp from Init to Init RDMA/hns: Fix QP's resp incomplete assignment RDMA/hns: Fix query destination qpn RDMA/hfi1: Convert to SPDX identifier IB/rdmavt: Convert to SPDX identifier RDMA/hns: Bugfix for incorrect association between dip_idx and dgid RDMA/hns: Bugfix for the missing assignment for dip_idx RDMA/hns: Bugfix for data type of dip_idx RDMA/hns: Fix incorrect lsn field RDMA/irdma: Remove the repeated declaration RDMA/core/sa_query: Retry SA queries RDMA: Use the sg_table directly and remove the opencoded version from umem lib/scatterlist: Fix wrong update of orig_nents lib/scatterlist: Provide a dedicated function to support table append RDMA/hns: Delete unused hns bitmap interface ...

lib/scatterlist: Provide a dedicated function to support table append

2021-08-24T18:21:14+00:00

RDMA is the only in-kernel user that uses __sg_alloc_table_from_pages to append pages dynamically. In the next patch. That mode will be extended and that function will get more parameters. So separate it into a unique function to make such change more clear. Link: https://lore.kernel.org/r/20210824142531.3877007-2-maorg@nvidia.com Signed-off-by: Maor Gottlieb Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe

drm/vmwgfx: Replace "vmw_num_pages" with "PFN_UP"

2021-08-09T21:30:35+00:00

we counld use PFN_UP instead of vmw_num_pages() Signed-off-by: Cai Huoqing Signed-off-by: Zack Rusin Link: https://patchwork.freedesktop.org/patch/msgid/20210802033552.990-1-caihuoqing@baidu.com

drm/vmwgfx: Make use of PFN_ALIGN/PFN_UP helper macro

2021-08-09T21:30:34+00:00

it's a refactor to make use of PFN_ALIGN/PFN_UP helper macro Signed-off-by: Cai Huoqing Signed-off-by: Zack Rusin Link: https://patchwork.freedesktop.org/patch/msgid/20210802033308.927-1-caihuoqing@baidu.com

drm/vmwgfx: fix potential UAF in vmwgfx_surface.c

2021-08-09T21:30:34+00:00

drm_file.master should be protected by either drm_device.master_mutex or drm_file.master_lookup_lock when being dereferenced. However, drm_master_get is called on unprotected file_priv->master pointers in vmw_surface_define_ioctl and vmw_gb_surface_define_internal. This is fixed by replacing drm_master_get with drm_file_get_master. Signed-off-by: Desmond Cheong Zhi Xi Reviewed-by: Daniel Vetter Reviewed-by: Zack Rusin Signed-off-by: Zack Rusin Link: https://patchwork.freedesktop.org/patch/msgid/20210724111824.59266-4-desmondcheongzx@gmail.com

drm/vmwgfx: Use list_move_tail instead of list_del/list_add_tail in vmwgfx_cmdbuf_res.c

2021-08-09T21:29:32+00:00

Using list_move_tail() instead of list_del() + list_add_tail() in vmwgfx_cmdbuf_res.c. Reported-by: Hulk Robot Signed-off-by: Baokun Li Signed-off-by: Zack Rusin Link: https://patchwork.freedesktop.org/patch/msgid/20210609072248.1353421-1-libaokun1@huawei.com

drm/vmwgfx: Use list_move_tail instead of list_del/list_add_tail in vmwgfx_cmdbuf.c

2021-08-09T20:49:48+00:00

Using list_move_tail() instead of list_del() + list_add_tail() in vmwgfx_cmdbuf.c. Reported-by: Hulk Robot Signed-off-by: Baokun Li Signed-off-by: Zack Rusin Link: https://patchwork.freedesktop.org/patch/msgid/20210609071803.1347254-1-libaokun1@huawei.com

drm/vmwgfx: Remove the repeated declaration

2021-08-09T20:49:11+00:00

Function 'vmw_context_binding_list' is declared twice, remove the repeated declaration. Cc: VMware Graphics Cc: Roland Scheidegger Cc: Zack Rusin Signed-off-by: Shaokun Zhang Signed-off-by: Zack Rusin Link: https://patchwork.freedesktop.org/patch/msgid/1621930170-54923-1-git-send-email-zhangshaokun@hisilicon.com

drm/vmwgfx: Fix a 64bit regression on svga3

2021-08-02T19:00:37+00:00

Register accesses are always 4bytes, accidently this was changed to a void pointer whwqich badly breaks 64bit archs when running on top of svga3. Fixes: 2cd80dbd3551 ("drm/vmwgfx: Add basic support for SVGA3") Signed-off-by: Zack Rusin Reviewed-by: Martin Krastev Link: https://patchwork.freedesktop.org/patch/msgid/20210615182336.995192-3-zackr@vmware.com (cherry picked from commit 87360168759879d68550b0c052bbcc2a0339ff74) Signed-off-by: Thomas Zimmermann