Commit d90eb183 authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'drm-fixes-for-v4.17-rc6' of git://people.freedesktop.org/~airlied/linux

Pull drm fixes from Dave Airlie:
 "Pretty quiet week again: one vmwgfx regression fix, one core buffer
  overflow fix, one vc4 leak fix and three i915 fixes"

* tag 'drm-fixes-for-v4.17-rc6' of git://people.freedesktop.org/~airlied/linux:
  drm/dumb-buffers: Integer overflow in drm_mode_create_ioctl()
  drm/i915/gen9: Add WaClearHIZ_WM_CHICKEN3 for bxt and glk
  drm/vmwgfx: Set dmabuf_size when vmw_dmabuf_init is successful
  drm/vc4: Fix leak of the file_priv that stored the perfmon.
  drm/i915/execlists: Use rmb() to order CSB reads
  drm/i915/userptr: reject zero user_size
  drm: Match sysfs name in link removal to link creation
parents 3acf4e39 1827cad9
...@@ -716,7 +716,7 @@ static void remove_compat_control_link(struct drm_device *dev) ...@@ -716,7 +716,7 @@ static void remove_compat_control_link(struct drm_device *dev)
if (!minor) if (!minor)
return; return;
name = kasprintf(GFP_KERNEL, "controlD%d", minor->index); name = kasprintf(GFP_KERNEL, "controlD%d", minor->index + 64);
if (!name) if (!name)
return; return;
......
...@@ -65,12 +65,13 @@ int drm_mode_create_dumb_ioctl(struct drm_device *dev, ...@@ -65,12 +65,13 @@ int drm_mode_create_dumb_ioctl(struct drm_device *dev,
return -EINVAL; return -EINVAL;
/* overflow checks for 32bit size calculations */ /* overflow checks for 32bit size calculations */
/* NOTE: DIV_ROUND_UP() can overflow */ if (args->bpp > U32_MAX - 8)
return -EINVAL;
cpp = DIV_ROUND_UP(args->bpp, 8); cpp = DIV_ROUND_UP(args->bpp, 8);
if (!cpp || cpp > 0xffffffffU / args->width) if (cpp > U32_MAX / args->width)
return -EINVAL; return -EINVAL;
stride = cpp * args->width; stride = cpp * args->width;
if (args->height > 0xffffffffU / stride) if (args->height > U32_MAX / stride)
return -EINVAL; return -EINVAL;
/* test for wrap-around */ /* test for wrap-around */
......
...@@ -778,6 +778,9 @@ i915_gem_userptr_ioctl(struct drm_device *dev, ...@@ -778,6 +778,9 @@ i915_gem_userptr_ioctl(struct drm_device *dev,
I915_USERPTR_UNSYNCHRONIZED)) I915_USERPTR_UNSYNCHRONIZED))
return -EINVAL; return -EINVAL;
if (!args->user_size)
return -EINVAL;
if (offset_in_page(args->user_ptr | args->user_size)) if (offset_in_page(args->user_ptr | args->user_size))
return -EINVAL; return -EINVAL;
......
...@@ -7326,6 +7326,9 @@ enum { ...@@ -7326,6 +7326,9 @@ enum {
#define SLICE_ECO_CHICKEN0 _MMIO(0x7308) #define SLICE_ECO_CHICKEN0 _MMIO(0x7308)
#define PIXEL_MASK_CAMMING_DISABLE (1 << 14) #define PIXEL_MASK_CAMMING_DISABLE (1 << 14)
#define GEN9_WM_CHICKEN3 _MMIO(0x5588)
#define GEN9_FACTOR_IN_CLR_VAL_HIZ (1 << 9)
/* WaCatErrorRejectionIssue */ /* WaCatErrorRejectionIssue */
#define GEN7_SQ_CHICKEN_MBCUNIT_CONFIG _MMIO(0x9030) #define GEN7_SQ_CHICKEN_MBCUNIT_CONFIG _MMIO(0x9030)
#define GEN7_SQ_CHICKEN_MBCUNIT_SQINTMOB (1<<11) #define GEN7_SQ_CHICKEN_MBCUNIT_SQINTMOB (1<<11)
......
...@@ -1149,6 +1149,10 @@ static int gen9_init_workarounds(struct intel_engine_cs *engine) ...@@ -1149,6 +1149,10 @@ static int gen9_init_workarounds(struct intel_engine_cs *engine)
WA_SET_FIELD_MASKED(GEN8_CS_CHICKEN1, GEN9_PREEMPT_GPGPU_LEVEL_MASK, WA_SET_FIELD_MASKED(GEN8_CS_CHICKEN1, GEN9_PREEMPT_GPGPU_LEVEL_MASK,
GEN9_PREEMPT_GPGPU_COMMAND_LEVEL); GEN9_PREEMPT_GPGPU_COMMAND_LEVEL);
/* WaClearHIZ_WM_CHICKEN3:bxt,glk */
if (IS_GEN9_LP(dev_priv))
WA_SET_BIT_MASKED(GEN9_WM_CHICKEN3, GEN9_FACTOR_IN_CLR_VAL_HIZ);
/* WaVFEStateAfterPipeControlwithMediaStateClear:skl,bxt,glk,cfl */ /* WaVFEStateAfterPipeControlwithMediaStateClear:skl,bxt,glk,cfl */
ret = wa_ring_whitelist_reg(engine, GEN9_CTX_PREEMPT_REG); ret = wa_ring_whitelist_reg(engine, GEN9_CTX_PREEMPT_REG);
if (ret) if (ret)
......
...@@ -884,6 +884,7 @@ static void execlists_submission_tasklet(unsigned long data) ...@@ -884,6 +884,7 @@ static void execlists_submission_tasklet(unsigned long data)
head = execlists->csb_head; head = execlists->csb_head;
tail = READ_ONCE(buf[write_idx]); tail = READ_ONCE(buf[write_idx]);
rmb(); /* Hopefully paired with a wmb() in HW */
} }
GEM_TRACE("%s cs-irq head=%d [%d%s], tail=%d [%d%s]\n", GEM_TRACE("%s cs-irq head=%d [%d%s], tail=%d [%d%s]\n",
engine->name, engine->name,
......
...@@ -130,6 +130,7 @@ static void vc4_close(struct drm_device *dev, struct drm_file *file) ...@@ -130,6 +130,7 @@ static void vc4_close(struct drm_device *dev, struct drm_file *file)
struct vc4_file *vc4file = file->driver_priv; struct vc4_file *vc4file = file->driver_priv;
vc4_perfmon_close_file(vc4file); vc4_perfmon_close_file(vc4file);
kfree(vc4file);
} }
static const struct vm_operations_struct vc4_vm_ops = { static const struct vm_operations_struct vc4_vm_ops = {
......
...@@ -482,6 +482,8 @@ vmw_sou_primary_plane_prepare_fb(struct drm_plane *plane, ...@@ -482,6 +482,8 @@ vmw_sou_primary_plane_prepare_fb(struct drm_plane *plane,
return ret; return ret;
} }
vps->dmabuf_size = size;
/* /*
* TTM already thinks the buffer is pinned, but make sure the * TTM already thinks the buffer is pinned, but make sure the
* pin_count is upped. * pin_count is upped.
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment