1. 26 Jun, 2017 3 commits
    • Chris Wilson's avatar
      drm/i915: Clear execbuf's vma backpointer upon release · bdbbf7d6
      Chris Wilson authored
      commit 2889caa9 ("drm/i915: Eliminate lots of iterations over the
      execobjects array") jiggled around the error handling and replace a test
      that we cleaned up properly after ourselves with an assertion. That
      assertion failed because in the release function (moments after the
      assertion) we were indeed forgetting to mark the vma as cleared. The
      consequence was when testing an invalid relocation address, we would try
      to release the vma twice (following the couple of attempts to verify the
      address) and on the second release notice that the first release was
      incomplete.
      
      Testcase: igt/gem_reloc_overflow/invalid-address
      Fixes: 2889caa9 ("drm/i915: Eliminate lots of iterations over the execobjects array")
      Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
      Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
      Link: http://patchwork.freedesktop.org/patch/msgid/20170622104722.2583-1-chris@chris-wilson.co.ukReviewed-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
      (cherry picked from commit 51d05e1b)
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      bdbbf7d6
    • Chris Wilson's avatar
      drm/i915: Pass the right flags to i915_vma_move_to_active() · b88eb199
      Chris Wilson authored
      i915_vma_move_to_active() takes the execobject flags and not a boolean!
      Instead of passing EXEC_OBJECT_WRITE we passed true [i.e.
      EXEC_OBJECT_NEEDS_FENCE] causing us to start tracking the
      vma->last_fence access and since we forgot to clear that on unbinding,
      we caused a use-after-free.
      
      [  321.263854] BUG: KASAN: use-after-free in i915_gem_request_retire+0x1728/0x1740 [i915]
      [  321.264001] Read of size 8 at addr ffff880100fc67d8 by task gem_exec_reloc/2868
      
      [  321.264181] CPU: 0 PID: 2868 Comm: gem_exec_reloc Not tainted 4.12.0-rc6-CI-Custom_2759+ #1
      [  321.264195] Hardware name: GIGABYTE GB-BXBT-1900/MZBAYAB-00, BIOS F6 02/17/2015
      [  321.264208] Call Trace:
      [  321.264234]  dump_stack+0x67/0x99
      [  321.264260]  print_address_description+0x77/0x290
      [  321.264437]  ? i915_gem_request_retire+0x1728/0x1740 [i915]
      [  321.264459]  kasan_report+0x269/0x350
      [  321.264487]  __asan_report_load8_noabort+0x14/0x20
      [  321.264660]  i915_gem_request_retire+0x1728/0x1740 [i915]
      [  321.264841]  ? intel_ring_context_pin+0x131/0x690 [i915]
      [  321.265021]  i915_gem_request_alloc+0x2c6/0x1220 [i915]
      [  321.265044]  ? _raw_spin_unlock_irqrestore+0x3d/0x60
      [  321.265226]  i915_gem_do_execbuffer+0xac0/0x2a20 [i915]
      [  321.265250]  ? __lock_acquire+0xceb/0x5450
      [  321.265269]  ? entry_SYSCALL_64_fastpath+0x1c/0xb1
      [  321.265291]  ? kvmalloc_node+0x6b/0x80
      [  321.265310]  ? kvmalloc_node+0x6b/0x80
      [  321.265489]  ? eb_relocate_slow+0xbe0/0xbe0 [i915]
      [  321.265520]  ? ___slab_alloc.constprop.28+0x2ab/0x3d0
      [  321.265549]  ? debug_check_no_locks_freed+0x280/0x280
      [  321.265591]  ? __might_fault+0xc6/0x1b0
      [  321.265782]  i915_gem_execbuffer2+0x14a/0x3f0 [i915]
      [  321.265815]  drm_ioctl+0x4ba/0xaa0
      [  321.265986]  ? i915_gem_execbuffer+0xde0/0xde0 [i915]
      [  321.266017]  ? drm_getunique+0x270/0x270
      [  321.266068]  do_vfs_ioctl+0x17f/0xfa0
      [  321.266091]  ? __fget+0x1ba/0x330
      [  321.266112]  ? lock_acquire+0x390/0x390
      [  321.266133]  ? ioctl_preallocate+0x1d0/0x1d0
      [  321.266164]  ? __fget+0x1db/0x330
      [  321.266194]  ? __fget_light+0x79/0x1f0
      [  321.266219]  SyS_ioctl+0x3c/0x70
      [  321.266247]  entry_SYSCALL_64_fastpath+0x1c/0xb1
      [  321.266265] RIP: 0033:0x7fcede207357
      [  321.266279] RSP: 002b:00007ffef0effe58 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
      [  321.266307] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fcede207357
      [  321.266321] RDX: 00007ffef0effef0 RSI: 0000000040406469 RDI: 0000000000000004
      [  321.266335] RBP: ffffffff812097c6 R08: 0000000000000008 R09: 0000000000000000
      [  321.266349] R10: 0000000000000008 R11: 0000000000000246 R12: ffff880116bcff98
      [  321.266363] R13: ffffffff81cb7cb3 R14: ffff880116bcff70 R15: 0000000000000000
      [  321.266385]  ? __this_cpu_preempt_check+0x13/0x20
      [  321.266406]  ? trace_hardirqs_off_caller+0x1d6/0x2c0
      
      [  321.266487] Allocated by task 2868:
      [  321.266568]  save_stack_trace+0x16/0x20
      [  321.266586]  kasan_kmalloc+0xee/0x180
      [  321.266602]  kasan_slab_alloc+0x12/0x20
      [  321.266620]  kmem_cache_alloc+0xc7/0x2e0
      [  321.266795]  i915_vma_instance+0x28c/0x1540 [i915]
      [  321.266964]  eb_lookup_vmas+0x5a7/0x2250 [i915]
      [  321.267130]  i915_gem_do_execbuffer+0x69a/0x2a20 [i915]
      [  321.267296]  i915_gem_execbuffer2+0x14a/0x3f0 [i915]
      [  321.267315]  drm_ioctl+0x4ba/0xaa0
      [  321.267333]  do_vfs_ioctl+0x17f/0xfa0
      [  321.267350]  SyS_ioctl+0x3c/0x70
      [  321.267369]  entry_SYSCALL_64_fastpath+0x1c/0xb1
      
      [  321.267428] Freed by task 177:
      [  321.267502]  save_stack_trace+0x16/0x20
      [  321.267521]  kasan_slab_free+0xad/0x180
      [  321.267539]  kmem_cache_free+0xc5/0x340
      [  321.267710]  i915_vma_unbind+0x666/0x10a0 [i915]
      [  321.267880]  i915_vma_close+0x23a/0x2f0 [i915]
      [  321.268048]  __i915_gem_free_objects+0x17d/0xc70 [i915]
      [  321.268215]  __i915_gem_free_work+0x49/0x70 [i915]
      [  321.268234]  process_one_work+0x66f/0x1410
      [  321.268252]  worker_thread+0xe1/0xe90
      [  321.268269]  kthread+0x304/0x410
      [  321.268285]  ret_from_fork+0x27/0x40
      
      [  321.268346] The buggy address belongs to the object at ffff880100fc6640
                      which belongs to the cache i915_vma of size 656
      [  321.268550] The buggy address is located 408 bytes inside of
                      656-byte region [ffff880100fc6640, ffff880100fc68d0)
      [  321.268741] The buggy address belongs to the page:
      [  321.268837] page:ffffea000403f000 count:1 mapcount:0 mapping:          (null) index:0xffff880100fc5980 compound_mapcount: 0
      [  321.269045] flags: 0x8000000000008100(slab|head)
      [  321.269147] raw: 8000000000008100 0000000000000000 ffff880100fc5980 00000001001e001d
      [  321.269312] raw: ffffea0004038e20 ffff880116b46240 ffff88011646c640 0000000000000000
      [  321.269484] page dumped because: kasan: bad access detected
      
      [  321.269665] Memory state around the buggy address:
      [  321.269778]  ffff880100fc6680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [  321.269949]  ffff880100fc6700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [  321.270115] >ffff880100fc6780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [  321.270279]                                                     ^
      [  321.270410]  ffff880100fc6800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [  321.270576]  ffff880100fc6880: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc
      [  321.270740] ==================================================================
      [  321.270903] Disabling lock debugging due to kernel taint
      
      Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=101511
      Fixes: 7dd4f672 ("drm/i915: Async GPU relocation processing")
      Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
      Cc: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
      Link: http://patchwork.freedesktop.org/patch/msgid/20170620124321.1108-2-chris@chris-wilson.co.ukReviewed-by: default avatarTvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
      (cherry picked from commit 25ffaa67)
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      b88eb199
    • Rodrigo Vivi's avatar
      drm/i915/cnl: Fix RMW on ddi vswing sequence. · 33b92c1e
      Rodrigo Vivi authored
      Paulo noticed that we were missing few bits clear
      before writing values back to the register on
      these RMW MMIO operations.
      
      v2: Remove "POST_" from CURSOR_COEFF_MASK. (Paulo).
      v3: Remove unnecessary braces. (Jani).
      
      Fixes: cf54ca8b ("drm/i915/cnl: Implement voltage swing sequence.")
      Cc: Paulo Zanoni <paulo.r.zanoni@intel.com>
      Cc: Manasi Navare <manasi.d.navare@intel.com>
      Cc: Jani Nikula <jani.nikula@intel.com>
      Signed-off-by: default avatarRodrigo Vivi <rodrigo.vivi@intel.com>
      Reviewed-by: default avatarPaulo Zanoni <paulo.r.zanoni@intel.com>
      Link: http://patchwork.freedesktop.org/patch/msgid/1497897572-22520-1-git-send-email-rodrigo.vivi@intel.com
      (cherry picked from commit 1f588aeb)
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      33b92c1e
  2. 20 Jun, 2017 8 commits
    • Dave Airlie's avatar
      Merge tag 'drm-misc-next-2017-06-19_0' of git://anongit.freedesktop.org/git/drm-misc into drm-next · 047b8e21
      Dave Airlie authored
      UAPI Changes:
      - vc4: Add get/set tiling format ioctls (Eric)
      
      Driver Changes:
      - vc4: Add tiling T-format support for scanout (Eric)
      - vc4: Use atomic helpers in commit (Boris)
      
      Cc: Boris Brezillon <boris.brezillon@free-electrons.com>
      Cc: Eric Anholt <eric@anholt.net>
      
      * tag 'drm-misc-next-2017-06-19_0' of git://anongit.freedesktop.org/git/drm-misc:
        drm/vc4: Mimic drm_atomic_helper_commit() behavior
        drm/vc4: Add get/set tiling ioctls.
        drm/vc4: Add T-format scanout support.
      047b8e21
    • Dave Airlie's avatar
      drm/i915: remove rate_to_index, messed up merge. · 296923e1
      Dave Airlie authored
      This was from a merge I did incorrectly.
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      296923e1
    • Dave Airlie's avatar
      Merge tag 'drm-intel-next-2017-06-19' of git://anongit.freedesktop.org/git/drm-intel into drm-next · 305b9edd
      Dave Airlie authored
      Final pile of features for 4.13
      
      New uabi:
      - batch bo in first slot, for faster execbuf assembly in userspace
        (Chris Wilson)
      - (sub)slice getparam, needed for mesa perf support (Robert Bragg)
      
      First pile of patches for cnl/cfl support, maintained by Rodrigo but
      with lots of contributions from others. Still incomplete since public
      review still ongoing.
      
      Features/refactoring:
      - Make execbuf faster (Chris Wilson), a pile of series to make execbuf
        buffer handling have fewer passes, use less list walking, postpone
        more work to async workers and shuffle buffers less, all to make the
        common case much faster (in some cases at least).
      - cold boot support for glk dsi (Madhav Chauhan)
      - Clean up pipe A quirk and related old platform hacks (Ville)
      - perf sampling support for kbl/glk (Lionel)
      - perf cleanups (Robert Bragg)
      - wire atomic state to backlight code, to avoid pipe lookup hacks
        (Maarten)
      - reduce request waiting latency/overhead to remove the spinning and
        associated cpu cycle wasting (Chris)
      - fix 90/270 rotation wm computation (Ville)
      - new ddb allocation algo for skl (Kumar Mahesh)
      - fix regression due to system suspend optimiazatino (Imre)
      - the usual pile of small cleanups and refactors all over
      
      GVT updates contained in this tag:
      - optimization for per-VM mmio save/restore (Changbin)
      - optimization for mmio hash table (Changbin)
      - scheduler optimization with event (Ping)
      - vGPU reset refinement (Fred)
      - other misc refactor and cleanups, etc.
      
      * tag 'drm-intel-next-2017-06-19' of git://anongit.freedesktop.org/git/drm-intel: (170 commits)
        drm/i915: Update DRIVER_DATE to 20170619
        drm/i915/cfl: Introduce Coffee Lake workarounds.
        drm/i915: Store 9 bits of PCI Device ID for platforms with a LP PCH
        drm/i915: Stash a pointer to the obj's resv in the vma
        drm/i915: Async GPU relocation processing
        drm/i915: Allow execbuffer to use the first object as the batch
        drm/i915: Wait upon userptr get-user-pages within execbuffer
        drm/i915: First try the previous execbuffer location
        drm/i915: Store a persistent reference for an object in the execbuffer cache
        drm/i915: Eliminate lots of iterations over the execobjects array
        drm/i915: Disable EXEC_OBJECT_ASYNC when doing relocations
        drm/i915: Pass vma to relocate entry
        drm/i915: Store a direct lookup from object handle to vma
        drm/i915: Fix retrieval of hangcheck stats
        drm/i915: Store i915_gem_object_is_coherent() as a bit next to cache-dirty
        drm/i915: Mark CPU cache as dirty on every transition for CPU writes
        drm/i915: Make i915_vma_destroy() static
        drm/i915: Actually attach the tv_format property to the SDVO connector
        Revert "drm/i915/skl: New ddb allocation algorithm"
        drm/i915/glk: Add cold boot sequence for GLK DSI
        ...
      305b9edd
    • Dave Airlie's avatar
      Merge tag 'drm-msm-next-2017-06-20' of git://people.freedesktop.org/~robclark/linux into drm-next · eafae133
      Dave Airlie authored
      This time around, the biggest thing is a bunch of GEM rework for more
      fine grained locking and prep work to handle multiple address spaces
      (ie. per-process pagetables).  Also some HDMI fixes for 8x96
      (snapdragon 820).
      
      One unrelated bus patch, for something that seems to get merged
      through whatever random tree (and has all the right ack's).
      
      * tag 'drm-msm-next-2017-06-20' of git://people.freedesktop.org/~robclark/linux:
        drm/msm: Fix potential buffer overflow issue
        bus: SIMPLE_PM_BUS does not depend on ARCH_RENESAS
        drm/msm: Separate locking of buffer resources from struct_mutex
        drm/msm/hdmi: Fix HDMI pink strip issue seen on 8x96
        drm/msm/hdmi: 8996 PLL: Populate unprepare
        drm/msm/hdmi: Use bitwise operators when building register values
        drm/msm: update generated headers
        drm/msm: remove address-space id
        drm/msm: support for an arbitrary number of address spaces
        drm/msm: refactor how we handle vram carveout buffers
        drm/msm: pass address-space to _get_iova() and friends
        drm/msm/mdp4+5: move aspace/id to base class
        drm/msm/mdp5: kill pipe_lock
        drm/msm: fix locking inconsistency for gpu->hw_init()
        drm/msm: Remove memptrs->wptr
        drm/msm: Add a struct to pass configuration to msm_gpu_init()
        drm/msm: Add hint to DRM_IOCTL_MSM_GEM_INFO to return an object IOVA
        drm/msm: Remove idle function hook
        drm/msm: Remove DRM_MSM_NUM_IOCTLS
        drm/msm: gpu: Enable zap shader for A5XX
      eafae133
    • Dave Airlie's avatar
      Merge branch 'drm-next-4.13' of git://people.freedesktop.org/~agd5f/linux into drm-next · 8c52f364
      Dave Airlie authored
      A few more things for 4.13:
      - Semaphore support using sync objects
      - Drop fb location programming
      - Optimize bo list ioctl
      
      * 'drm-next-4.13' of git://people.freedesktop.org/~agd5f/linux:
        drm/amdgpu: Optimize mutex usage (v4)
        drm/amdgpu: Optimization of AMDGPU_BO_LIST_OP_CREATE (v2)
        amdgpu: use drm sync objects for shared semaphores (v6)
        amdgpu/cs: split out fence dependency checking (v2)
        drm/amdgpu: don't check the default value for vm size
      8c52f364
    • Dave Airlie's avatar
      Merge branch 'for-upstream/mali-dp' of git://linux-arm.org/linux-ld into drm-next · 3aaf4d95
      Dave Airlie authored
      Here are the Mali DP driver changes. They include the mali-dp specific
      changes from Jose Abreu on crtc->mode_valid() as well as a couple of
      patches for fixing the sharing of IRQ lines and use of DRM CMA helper
      for framebuffer physical address calculation. Please pull!
      
      * 'for-upstream/mali-dp' of git://linux-arm.org/linux-ld:
        drm/arm: mali-dp: Use CMA helper for plane buffer address calculation
        drm/mali-dp: Check PM status when sharing interrupt lines
        drm/arm: malidp: Use crtc->mode_valid() callback
      3aaf4d95
    • Dave Airlie's avatar
      Merge branch 'linux-4.13' of git://github.com/skeggsb/linux into drm-next · d02b0ffb
      Dave Airlie authored
      - HDMI stereoscopic support
      - Rework of display code to properly support SOR pad macro routing on
      >=GM20x GPUs
      - Various other fixes/improvements.
      
      * 'linux-4.13' of git://github.com/skeggsb/linux: (73 commits)
        drm/nouveau/disp/nv50-: avoid creating ORs that aren't present on HW
        drm/nouveau: use proper prototype in nouveau_pmops_runtime() definition
        drm/nouveau: Skip vga_fini on non-PCI device
        drm/nouveau/tegra: Don't leave GPU in reset
        drm/nouveau/tegra: Skip manual unpowergating when not necessary
        drm/nouveau/hwmon: Change permissions to numeric
        drm/nouveau/hwmon: expose the auto_point and pwm_min/max attrs
        drm/nouveau/hwmon: Remove old code, add .write/.read operations
        drm/nouveau/hwmon: Add nouveau_hwmon_ops structure with .is_visible/.read_string
        drm/nouveau/hwmon: Add config for all sensors and their settings
        drm/nouveau/disp/gm200-: allow non-identity mapping of SOR <-> macro links
        drm/nouveau/disp/nv50-: implement a common supervisor 3.0
        drm/nouveau/disp/nv50-: implement a common supervisor 2.2
        drm/nouveau/disp/nv50-: implement a common supervisor 2.1
        drm/nouveau/disp/nv50-: implement a common supervisor 2.0
        drm/nouveau/disp/nv50-: implement a common supervisor 1.0
        drm/nouveau/disp/nv50-gt21x: remove workaround for dp->tmds hotplug issues
        drm/nouveau/disp/dp: use new devinit script interpreter entry-point
        drm/nouveau/disp/dp: determine link bandwidth requirements from head state
        drm/nouveau/disp: introduce acquire/release display path methods
        ...
      d02b0ffb
    • Dave Airlie's avatar
      Merge tag 'drm/tegra/for-4.13-rc1' of git://anongit.freedesktop.org/tegra/linux into drm-next · 4a525bad
      Dave Airlie authored
      drm/tegra: Changes for v4.13-rc1
      
      This starts off with the addition of more documentation for the host1x
      and DRM drivers and finishes with a slew of fixes and enhancements for
      the staging IOCTLs as a result of the awesome work done by Dmitry and
      Erik on the grate reverse-engineering effort.
      
      * tag 'drm/tegra/for-4.13-rc1' of git://anongit.freedesktop.org/tegra/linux:
        gpu: host1x: At first try a non-blocking allocation for the gather copy
        gpu: host1x: Refactor channel allocation code
        gpu: host1x: Remove unused host1x_cdma_stop() definition
        gpu: host1x: Remove unused 'struct host1x_cmdbuf'
        gpu: host1x: Check waits in the firewall
        gpu: host1x: Correct swapped arguments in the is_addr_reg() definition
        gpu: host1x: Forbid unrelated SETCLASS opcode in the firewall
        gpu: host1x: Forbid RESTART opcode in the firewall
        gpu: host1x: Forbid relocation address shifting in the firewall
        gpu: host1x: Do not leak BO's phys address to userspace
        gpu: host1x: Correct host1x_job_pin() error handling
        gpu: host1x: Initialize firewall class to the job's one
        drm/tegra: dc: Disable plane if it is invisible
        drm/tegra: dc: Apply clipping to the plane
        drm/tegra: dc: Avoid reset asserts on Tegra20
        drm/tegra: Check syncpoint ID in the 'submit' IOCTL
        drm/tegra: Correct copying of waitchecks and disable them in the 'submit' IOCTL
        drm/tegra: Check for malformed offsets and sizes in the 'submit' IOCTL
        drm/tegra: Add driver documentation
        gpu: host1x: Flesh out kerneldoc
      4a525bad
  3. 19 Jun, 2017 4 commits
  4. 17 Jun, 2017 3 commits
  5. 16 Jun, 2017 22 commits