- 24 Apr, 2019 16 commits
-
-
Chris Wilson authored
We have to avoid chasing after a userspace race! <3>[ 473.114328] BUG: KASAN: use-after-free in i915_gem_create+0x1d2/0x1f0 [i915] <3>[ 473.114389] Read of size 8 at addr ffff88815bf1d840 by task gem_flink_race/1541 <4>[ 473.114464] CPU: 1 PID: 1541 Comm: gem_flink_race Tainted: G U 5.1.0-rc4-g7d07e025e786-kasan_88+ #1 <4>[ 473.114469] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./J4205-ITX, BIOS P1.10 09/29/2016 <4>[ 473.114474] Call Trace: <4>[ 473.114488] dump_stack+0x7c/0xbb <4>[ 473.114612] ? i915_gem_create+0x1d2/0x1f0 [i915] <4>[ 473.114621] print_address_description+0x65/0x270 <4>[ 473.114728] ? i915_gem_create+0x1d2/0x1f0 [i915] <4>[ 473.114839] ? i915_gem_create+0x1d2/0x1f0 [i915] <4>[ 473.114848] kasan_report+0x149/0x18d <4>[ 473.114962] ? i915_gem_create+0x1d2/0x1f0 [i915] <4>[ 473.115069] i915_gem_create+0x1d2/0x1f0 [i915] <4>[ 473.115176] ? i915_gem_object_create.part.28+0x4b0/0x4b0 [i915] <4>[ 473.115289] ? i915_gem_dumb_create+0x1a0/0x1a0 [i915] <4>[ 473.115297] drm_ioctl_kernel+0x192/0x260 <4>[ 473.115306] ? drm_ioctl_permit+0x280/0x280 <4>[ 473.115326] drm_ioctl+0x67c/0x960 <4>[ 473.115438] ? i915_gem_dumb_create+0x1a0/0x1a0 [i915] <4>[ 473.115448] ? drm_getstats+0x20/0x20 <4>[ 473.115459] ? __lock_acquire+0xa66/0x3fe0 <4>[ 473.115474] ? _raw_spin_unlock_irqrestore+0x39/0x60 <4>[ 473.115485] ? debug_object_active_state+0x2ea/0x4e0 <4>[ 473.115496] ? debug_show_all_locks+0x2d0/0x2d0 <4>[ 473.115513] do_vfs_ioctl+0x18d/0xfa0 <4>[ 473.115522] ? check_flags.part.27+0x440/0x440 <4>[ 473.115532] ? ioctl_preallocate+0x1a0/0x1a0 <4>[ 473.115547] ? __fget+0x2ac/0x410 <4>[ 473.115561] ? __ia32_sys_dup3+0xb0/0xb0 <4>[ 473.115569] ? rwlock_bug.part.0+0x90/0x90 <4>[ 473.115590] ksys_ioctl+0x35/0x70 <4>[ 473.115597] ? lockdep_hardirqs_off+0x1cb/0x2b0 <4>[ 473.115608] __x64_sys_ioctl+0x6a/0xb0 <4>[ 473.115614] ? lockdep_hardirqs_on+0x342/0x590 <4>[ 473.115623] do_syscall_64+0x97/0x400 <4>[ 473.115633] entry_SYSCALL_64_after_hwframe+0x49/0xbe <4>[ 473.115641] RIP: 0033:0x7fce590d55d7 <4>[ 473.115649] Code: b3 66 90 48 8b 05 b1 48 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 81 48 2d 00 f7 d8 64 89 01 48 <4>[ 473.115655] RSP: 002b:00007fce4d525ba8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 <4>[ 473.115662] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fce590d55d7 <4>[ 473.115667] RDX: 00007fce4d525c10 RSI: 00000000c010645b RDI: 0000000000000007 <4>[ 473.115672] RBP: 00007fce4d525c10 R08: 00007fce4d526700 R09: 00007fce4d526700 <4>[ 473.115677] R10: 0000000000000054 R11: 0000000000000246 R12: 00000000c010645b <4>[ 473.115682] R13: 0000000000000007 R14: 0000000000000000 R15: 00007ffe0e4a7450 <3>[ 473.115731] Allocated by task 1541: <4>[ 473.115766] kmem_cache_alloc+0xce/0x290 <4>[ 473.115895] i915_gem_object_create.part.28+0x1c/0x4b0 [i915] <4>[ 473.116000] i915_gem_create+0xe3/0x1f0 [i915] <4>[ 473.116008] drm_ioctl_kernel+0x192/0x260 <4>[ 473.116013] drm_ioctl+0x67c/0x960 <4>[ 473.116020] do_vfs_ioctl+0x18d/0xfa0 <4>[ 473.116026] ksys_ioctl+0x35/0x70 <4>[ 473.116032] __x64_sys_ioctl+0x6a/0xb0 <4>[ 473.116038] do_syscall_64+0x97/0x400 <4>[ 473.116044] entry_SYSCALL_64_after_hwframe+0x49/0xbe <3>[ 473.116071] Freed by task 1542: <4>[ 473.116101] kmem_cache_free+0xb7/0x2f0 <4>[ 473.116205] __i915_gem_free_objects+0x7d4/0xe10 [i915] <4>[ 473.116311] i915_gem_create_ioctl+0xaa/0xd0 [i915] <4>[ 473.116318] drm_ioctl_kernel+0x192/0x260 <4>[ 473.116323] drm_ioctl+0x67c/0x960 <4>[ 473.116330] do_vfs_ioctl+0x18d/0xfa0 <4>[ 473.116335] ksys_ioctl+0x35/0x70 <4>[ 473.116341] __x64_sys_ioctl+0x6a/0xb0 <4>[ 473.116347] do_syscall_64+0x97/0x400 <4>[ 473.116354] entry_SYSCALL_64_after_hwframe+0x49/0xbe Testcase: igt/gem_flink_race/flink_close Fixes: e163484a ("drm/i915: Update size upon return from GEM_CREATE") Signed-off-by:
Chris Wilson <chris@chris-wilson.co.uk> Cc: Michał Winiarski <michal.winiarski@intel.com> Reviewed-by:
Tvrtko Ursulin <tvrtko.ursulin@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20190417132507.27133-1-chris@chris-wilson.co.uk (cherry picked from commit 99534023) Signed-off-by:
Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
-
Dave Airlie authored
This should help with some of the lifetime issues, and move us away from load/unload. Acked-by:
Alex Deucher <alexander.deucher@amd.com> Signed-off-by:
Dave Airlie <airlied@redhat.com> Link: https://patchwork.freedesktop.org/patch/msgid/20190405031715.5959-4-airlied@gmail.com
-
Dave Airlie authored
This just makes it easier to later embed drm into udl. Reviewed-by:
-
Dave Airlie authored
Merge tag 'exynos-drm-next-for-v5.2' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-next Log cleanups - Correct the use of log macro in error case. - Drop unnecessary messages. - Replace DRM_ERROR/DEBUG with DRM_DEV_ERROR/DEBUG. - Print out debug messages with correct device name in vidi and ipp drivers. One trivial cleanup - Just fix checkpatch error, "foo* bar" to "foo *bar" in g2d driver. Signed-off-by:
-
Inki Dae authored
Print out debug messages with correct device name. As for this, this patch adds device pointer to exynos_drm_ipp structure, and in case of exynos_drm_ipp_task structure, replace drm_device pointer with device one. This will make each ipp driver to print out debug messages with correct device name. Signed-off-by:Inki Dae <inki.dae@samsung.com>
-
Inki Dae authored
Add device pointer to vidi_context and remove platform_device pointer. It doesn't need for vidi_context to contain platform_device object. Instead, this patch makes this driver more simply by replacing platform_device pointer with device one. Signed-off-by: -
Inki Dae authored
Use DRM_DEV_DEBUG* instead of DRM_DEBUG macro to print out debug messages. This patch just cleans up the use of debug log macro, which changes the log macro to DRM_DEV_DEBUG*. Signed-off-by: -
Inki Dae authored
This patch just cleans up the use of error log macro, which changes the log macro to DRM_DEV_ERROR. Signed-off-by: -
Inki Dae authored
This patch removes unnecessary messages from fimd_clear_channels and decon_clear_channels functions which print out just function name. Signed-off-by: -
Inki Dae authored
This patch makes error messages to be printed out using DRM_ERROR instead of DRM_INFO. Signed-off-by: -
Seung-Woo Kim authored
Remove checkpatch error, "foo* bar" should be "foo *bar". Signed-off-by:
Seung-Woo Kim <sw0312.kim@samsung.com> Signed-off-by:
-
https://gitlab.freedesktop.org/drm/msmDave Airlie authored
This time around it is a bunch of cleanup and fixes, expanding gpu "zap" shader support (so we can take the GPU out of secure mode on boot) to a6xx, and small UABI extension to support robustness (see mesa MR 673). Signed-off-by:
-
git://people.freedesktop.org/~agd5f/linuxDave Airlie authored
- Add the amdgpu specific bits for timeline support - Add internal interfaces for xgmi pstate support - DC Z ordering fixes for planes - Add support for NV12 planes in DC - Add colorspace properties for planes in DC - eDP optimizations if the GOP driver already initialized eDP - DC bandwidth validation tracing support Signed-off-by:
-
git://anongit.freedesktop.org/tegra/linuxDave Airlie authored
drm/tegra: Changes for v5.2-rc1 This contains a fix for the usage of shared resets that previously generated a WARN on boot. In addition, there's a fix for CPU cache maintenance of GEM buffers allocated using get_pages(). (airlied: contains a merge from a shared tegra tree) Signed-off-by:
-
git://anongit.freedesktop.org/drm/drm-miscDave Airlie authored
drm-misc-next for v5.2: UAPI Changes: - Document which feature flags belong to which command in virtio_gpu.h - Make the FB_DAMAGE_CLIPS available for atomic userspace only, it's useless for legacy. Cross-subsystem Changes: - Add device tree bindings for lg,acx467akm-7 panel and ST-Ericsson Multi Channel Display Engine MCDE - Add parameters to the device tree bindings for tfp410 - iommu/io-pgtable: Add ARM Mali midgard MMU page table format - dma-buf: Only do a 64-bits seqno compare when driver explicitly asks for it, else wraparound. - Use the 64-bits compare for dma-fence-chains Core Changes: - Make the fb conversion functions use __iomem dst. - Rename drm_client_add to drm_client_register - Move intel_fb_initial_config to core. - Add a drm_gem_objects_lookup helper - Add drm_gem_fence_array helpers, and use it in lima. - Add drm_format_helper.c to kerneldoc. Driver Changes: - Add panfrost driver for mali midgard/bitfrost. - Converts bochs to use the simple display type. - Small fixes to sun4i, tinydrm, ti-fp410. - Fid aspeed's Kconfig options. - Make some symbols/functions static in lima, sun4i and meson. - Add a driver for the lg,acx467akm-7 panel. Signed-off-by:
-
git://anongit.freedesktop.org/drm/drm-intelDave Airlie authored
UAPI Changes: - uAPI "Fixes:" patch for the upcoming kernel 5.1, included here too We have an Ack from the media folks (only current user) for this late tweak Cross-subsystem Changes: - ALSA: hda: Fix racy display power access (Takashi, Chris) Driver Changes: - DDI and MIPI-DSI clocks fixes for Icelake (Vandita) - Fix Icelake frequency change/locking (RPS) (Mika) - Temporarily disable ppGTT read-only bit on Icelake (Mika) - Add missing Icelake W/As (Mika) - Enable 12 deep CSB status FIFO on Icelake (Mika) - Inherit more Icelake code for Elkhartlake (Bob, Jani) - Handle catastrophic error on engine reset (Mika) - Shortcut readiness to reset check (Mika) - Regression fix for GEM_BUSY causing us to report a mixed uabi-class request as not busy (Chris) - Revert back to max link rate and lane count on eDP (Jani) - Fix pipe BPP readout for BXT/GLK DSI (Ville) - Set DP min_bpp to 8*3 for non-RGB output formats (Ville) - Enable coarse preemption boundaries for Gen8 (Chris) - Do not enable FEC without DSC (Ville) - Restore correct BXT DDI latency optim setting calculation (Ville) - Always reset context's RING registers to avoid running workload twice during reset (Chris) - Set GPU wedged on driver unload (Janusz) - Consolidate two similar barries from timeline into one (Chris) - Only reset the pinned kernel contexts on resume (Chris) - Wakeref tracking improvements (Chris, Imre) - Lockdep fixes for shrinker interactions (Chris) - Bump ready tasks ahead of busywaits in prep of semaphore use (Chris) - Huge step in splitting display code into fine grained files (Jani) - Refactor the IRQ init/reset macros for code saving (Paulo) - Convert IRQ initialization code to uncore MMIO access (Paulo) - Convert workarounds code to use uncore MMIO access (Chris) - Nuke drm_crtc_state and use intel_atomic_state instead (Manasi) - Update SKL clock-gating WA (Radhakrishna, Ville) - Isolate GuC reset code flow (Chris) - Expose force_dsc_enable through debugfs (Manasi) - Header standalone compile testing framework (Jani) - Code cleanups to reduce driver footprint (Chris) - PSR code fixes and cleanups (Jose) - Sparse and kerneldoc updates (Chris) - Suppress spurious combo PHY B warning (Vile) Signed-off-by:
-
- 23 Apr, 2019 1 commit
-
-
https://gitlab.freedesktop.org/drawat/linuxDave Airlie authored
Resource dirtying improvement by Thomas, user-space error logging improvement and some other minor fixes. Signed-off-by:
-
- 21 Apr, 2019 5 commits
-
-
Jordan Crouse authored
Add CONFIG_DRM_MSM_GPU_STATE to conditionally compile Adreno GPU state code depending on the availability of the dependencies. Reported-by:
Hulk Robot <hulkci@huawei.com> Reported-by:
YueHaibing <yuehaibing@huawei.com> Fixes: 1707add8 ("drm/msm/a6xx: Add a6xx gpu state") Signed-off-by:
Jordan Crouse <jcrouse@codeaurora.org> Signed-off-by:
Rob Clark <robdclark@chromium.org>
-
Jordan Crouse authored
Describe the zap-shader node that defines a reserved memory region to store the zap shader. Signed-off-by:
-
Jordan Crouse authored
The a6xx GPU powers on in secure mode which restricts what memory it can write to. To get out of secure mode the GPU driver can write to REG_A6XX_RBBM_SECVID_TRUST_CNTL but on targets that are "secure" that register region is blocked and writes will cause the system to go down. For those targets we need to execute a special sequence that involves loadinga special shader that clears the GPU registers and use a PM4 sequence to pull the GPU out of secure. Add support for loading the zap shader and executing the secure sequence. For targets that do not support SCM or the specific SCM sequence this should fail and we would fall back to writing the register. Signed-off-by:
-
Jordan Crouse authored
a5xx and a6xx both share (mostly) the same code to load the zap shader and bring the GPU out of secure mode. Move the formerly 5xx specific code to adreno to make it available for a6xx too. Signed-off-by:
-
Jordan Crouse authored
Add documentation for the interconnect and interconnect-names bindings for the GPU node as detailed by bindings/interconnect/interconnect.txt. Signed-off-by:
Douglas Anderson <dianders@chromium.org> Reviewed-by:
Rob Herring <robh@kernel.org> Acked-by:
Georgi Djakov <georgi.djakov@linaro.org> Signed-off-by:
-
- 19 Apr, 2019 12 commits
-
-
Kristian H. Kristensen authored
First loop does copy_from_user() without the table lock held and just stores the handle. Second loop looks up buffer objects with the table_lock held without potentially blocking or faulting. This lets us clean up a bunch of custom, non-faulting copy_from_user() code. Signed-off-by:
Kristian H. Kristensen <hoegsberg@chromium.org> Signed-off-by:
-
Kristian H. Kristensen authored
Now that we don't have the mmap_sem lock inversion, we don't need to jump through this particular hoop anymore. Signed-off-by:
-
Kristian H. Kristensen authored
We use a llist and a worker to delay the object cleanup. This avoids taking mmap_sem and struct_mutex in the wrong order when calling drm_gem_object_put_unlocked() from drm_gem_mmap(). Fixes lockdep problem with copy_from_user() in msm_ioctl_gem_submit(). Signed-off-by:
-
Jordan Crouse authored
The HFI tasklet was removed in df0dff13 ("drm/msm/a6xx: Poll for HFI responses") but the tasklet_struct was accidentally left behind. Signed-off-by:
-
Jordan Crouse authored
Currently if the GMU resume function fails all we try to do is clear the BOOT_SLUMBER oob which usually times out and ends up in a cycle of death. If the resume function fails at any point remove any RPMh votes that might have been added and try to shut down the GMU hardware cleanly. Signed-off-by:
-
Jordan Crouse authored
Now that the GX domain is sorted we can wire up a working GMU reset. IF a GMU hang was detected then try to forcefully shut down the GMU in the power down sequence which should ensure that it can recover normally on the next power up. Signed-off-by:
-
Jordan Crouse authored
99.999% of the time during normal operation the GMU is responsible for power and clock control on the GX domain and the CPU remains blissfully unaware. However, there is one situation where the CPU needs to get involved: The power sequencing rules dictate that the GX needs to be turned off before the CX so that the CX can be turned on before the GX during power up. During normal operation when the CPU is taking down the CX domain a stop command is sent to the GMU which turns off the GX domain and then the CPU handles the CX domain. But if the GMU happened to be unresponsive while the GX domain was left then the CPU will need to step in and turn off the GX domain before resetting the CX and rebooting the GMU. This unfortunately means that the CPU needs to be marginally aware of the GX domain even though it is expected to usually keep its hands off. To support this we create a semi-disabled GX power domain that does nothing to the hardware on power up but tries to shut it down normally on power down. In this method the reference counting is correct and we can step in with the pm_runtime_put() at the right time during the failure path. This patch sets up the connection to the GX power domain and does the magic to "enable" and disable it at the right points. Signed-off-by:
-
Jordan Crouse authored
The GMU should have two power domains defined: "cx" and "gx". "cx" is the actual power domain for the device and "gx" will be attached at runtime to manage reference counting on the GPU device in case of a GMU crash. Signed-off-by:
-
Jordan Crouse authored
The GMU code currently has some misguided code to try to work around a hardware quirk that requires the power domains on the GPU be collapsed in a certain order. Upcoming patches will do this the right way so get rid of the unused and unwanted regulator code. Signed-off-by:
-
Jordan Crouse authored
Add the capability to query information from a submit queue. The first available parameter is for querying the number of GPU faults (hangs) that can be attributed to the queue. This is useful for implementing context robustness. A user context can regularly query the number of faults to see if it is responsible for any and if so it can invalidate itself. This is also helpful for testing by confirming to the user driver if a particular command stream caused a fault (or not as the case may be). Signed-off-by:
-
Rob Clark authored
For KHR_robustness, userspace wants to know two things, the count of GPU faults globally, and the count of faults attributed to a given context. This patch providees the former, and the next patch provides the latter. Signed-off-by:
-
Rob Clark authored
For now it always returns '0' (false), but once the iommu work is in place to enable per-process pagetables we can update the value returned. Userspace needs to know this to make an informed decision about exposing KHR_robustness. Signed-off-by:
-
- 18 Apr, 2019 6 commits
-
-
Wen Yang authored
The call to of_get_child_by_name returns a node pointer with refcount incremented thus it must be explicitly decremented after the last usage. Detected by coccinelle with the following warnings: drivers/gpu/drm/msm/adreno/a5xx_gpu.c:57:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 47, but without a corresponding object release within this function. drivers/gpu/drm/msm/adreno/a5xx_gpu.c:66:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 47, but without a corresponding object release within this function. drivers/gpu/drm/msm/adreno/a5xx_gpu.c:118:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 47, but without a corresponding object release within this function. drivers/gpu/drm/msm/adreno/a5xx_gpu.c:57:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 51, but without a corresponding object release within this function. drivers/gpu/drm/msm/adreno/a5xx_gpu.c:66:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 51, but without a corresponding object release within this function. drivers/gpu/drm/msm/adreno/a5xx_gpu.c:118:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 51, but without a corresponding object release within this function. Signed-off-by:
Wen Yang <wen.yang99@zte.com.cn> Cc: Rob Clark <robdclark@gmail.com> Cc: Sean Paul <sean@poorly.run> Cc: David Airlie <airlied@linux.ie> Cc: Daniel Vetter <daniel@ffwll.ch> Cc: Jordan Crouse <jcrouse@codeaurora.org> Cc: Mamta Shukla <mamtashukla555@gmail.com> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Sharat Masetty <smasetty@codeaurora.org> Cc: linux-arm-msm@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Cc: freedreno@lists.freedesktop.org Cc: linux-kernel@vger.kernel.org (open list) Reviewed-by:
Rob Clark <robdclark@gmail.com> Signed-off-by:
-
Douglas Anderson authored
The patch ("OPP: Add support for parsing the 'opp-level' property") adds an API enabling a cleaner way to read the opp-level. Let's use the new API. Signed-off-by: -
Jeykumar Sankaran authored
Removing unwanted access of crtc_state for finding this information. Use split role information to know whether we have slave ctl. Signed-off-by:
Jeykumar Sankaran <jsanka@codeaurora.org> Signed-off-by:
Sean Paul <seanpaul@chromium.org> Link: https://patchwork.freedesktop.org/patch/msgid/1550107156-17625-8-git-send-email-jsanka@codeaurora.orgSigned-off-by:
-
Jeykumar Sankaran authored
Iterate and assign HW intf block to physical encoders in encoder modeset. Moving all the HW block assignments to encoder modeset to allow easy switching to state based resource management. Signed-off-by:
-
Jeykumar Sankaran authored
After resource allocation, iterate and populate mixer/ctl hw blocks in encoder modeset thereby centralizing all the resource mapping to the CRTC. This change is made for easy switching to state based allocation using private objects later in this series. Signed-off-by:
-
Jeykumar Sankaran authored
encoder->crtc is not really meaningful for atomic path. Use crtc->encoder_mask to identify the crtc attached with an encoder. Signed-off-by:
-
