Merge branch 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel into drm-next

Daniel writes: Bunch of fixes, all pretty high-priority - Fix execbuf argument checking (Kees Cook) - Optionally obfuscate kernel addresses in dumps (Kees Cook) - Two patches from Takashi Iwai to fix DP link training regressions he's seen. - intel-gfx is no longer subscribers-only (well, just no longer moderated in an annoying way for non-subscribers), update MAINTAINERS - gm45 gmbus irq fallout fix (Jiri Kosina) * 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel: drm/i915: stop using GMBUS IRQs on Gen4 chips MAINTAINERS: intel-gfx is no longer subscribers-only drm/i915: Use the fixed pixel clock for eDP in intel_dp_set_m_n() Revert "drm/i915: try to train DP even harder" drm/i915: bounds check execbuffer relocation count drm/i915: restrict kernel address leak in debugfs

Merge branch 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel into drm-next
Daniel writes: Bunch of fixes, all pretty high-priority - Fix execbuf argument checking (Kees Cook) - Optionally obfuscate kernel addresses in dumps (Kees Cook) - Two patches from Takashi Iwai to fix DP link training regressions he's seen. - intel-gfx is no longer subscribers-only (well, just no longer moderated in an annoying way for non-subscribers), update MAINTAINERS - gm45 gmbus irq fallout fix (Jiri Kosina) * 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel: drm/i915: stop using GMBUS IRQs on Gen4 chips MAINTAINERS: intel-gfx is no longer subscribers-only drm/i915: Use the fixed pixel clock for eDP in intel_dp_set_m_n() Revert "drm/i915: try to train DP even harder" drm/i915: bounds check execbuffer relocation count drm/i915: restrict kernel address leak in debugfs
Dave Airlie
2 parents 260b3f1291 c12aba5aa0
Showing 5 changed files Side-by-side Diff
MAINTAINERS
drivers/gpu/drm/i915/i915_debugfs.c
drivers/gpu/drm/i915/i915_gem_execbuffer.c
drivers/gpu/drm/i915/intel_dp.c
drivers/gpu/drm/i915/intel_i2c.c
@@ -2623,7 +2623,7 @@
  
 INTEL DRM DRIVERS (excluding Poulsbo, Moorestown and derivative chipsets)
 M:	Daniel Vetter <daniel.vetter@ffwll.ch>
-L:	intel-gfx@lists.freedesktop.org (subscribers-only)
+L:	intel-gfx@lists.freedesktop.org
 L:	dri-devel@lists.freedesktop.org
 T:	git git://people.freedesktop.org/~danvet/drm-intel
 S:	Supported
@@ -103,7 +103,7 @@
 static void
 describe_obj(struct seq_file *m, struct drm_i915_gem_object *obj)
 {
-	seq_printf(m, "%p: %s%s %8zdKiB %02x %02x %d %d %d%s%s%s",
+	seq_printf(m, "%pK: %s%s %8zdKiB %02x %02x %d %d %d%s%s%s",
 		   &obj->base,
 		   get_pin_flag(obj),
 		   get_tiling_flag(obj),
@@ -732,6 +732,8 @@
 		   int count)
 {
 	int i;
+	int relocs_total = 0;
+	int relocs_max = INT_MAX / sizeof(struct drm_i915_gem_relocation_entry);
  
 	for (i = 0; i < count; i++) {
 		char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr;
  
@@ -740,10 +742,13 @@
 		if (exec[i].flags & __EXEC_OBJECT_UNKNOWN_FLAGS)
 			return -EINVAL;
  
-		/* First check for malicious input causing overflow */
-		if (exec[i].relocation_count >
-		    INT_MAX / sizeof(struct drm_i915_gem_relocation_entry))
+		/* First check for malicious input causing overflow in
+		 * the worst case where we need to allocate the entire
+		 * relocation tree as a single array.
+		 */
+		if (exec[i].relocation_count > relocs_max - relocs_total)
 			return -EINVAL;
+		relocs_total += exec[i].relocation_count;
  
 		length = exec[i].relocation_count *
 			sizeof(struct drm_i915_gem_relocation_entry);
@@ -820,6 +820,7 @@
 	struct intel_link_m_n m_n;
 	int pipe = intel_crtc->pipe;
 	enum transcoder cpu_transcoder = intel_crtc->cpu_transcoder;
+	int target_clock;
  
 	/*
 	 * Find the lane count in the intel_encoder private
  
@@ -835,13 +836,22 @@
 		}
 	}
  
+	target_clock = mode->clock;
+	for_each_encoder_on_crtc(dev, crtc, intel_encoder) {
+		if (intel_encoder->type == INTEL_OUTPUT_EDP) {
+			target_clock = intel_edp_target_clock(intel_encoder,
+							      mode);
+			break;
+		}
+	}
+
 	/*
 	 * Compute the GMCH and Link ratios. The '3' here is
 	 * the number of bytes_per_pixel post-LUT, which we always
 	 * set up for 8-bits of R/G/B, or 3 bytes total.
 	 */
 	intel_link_compute_m_n(intel_crtc->bpp, lane_count,
-			       mode->clock, adjusted_mode->clock, &m_n);
+			       target_clock, adjusted_mode->clock, &m_n);
  
 	if (IS_HASWELL(dev)) {
 		I915_WRITE(PIPE_DATA_M1(cpu_transcoder),
@@ -1930,7 +1940,7 @@
 		for (i = 0; i < intel_dp->lane_count; i++)
 			if ((intel_dp->train_set[i] & DP_TRAIN_MAX_SWING_REACHED) == 0)
 				break;
-		if (i == intel_dp->lane_count && voltage_tries == 5) {
+		if (i == intel_dp->lane_count) {
 			++loop_tries;
 			if (loop_tries == 5) {
 				DRM_DEBUG_KMS("too many full retries, give up\n");
@@ -203,7 +203,13 @@
 	algo->data = bus;
 }
  
-#define HAS_GMBUS_IRQ(dev) (INTEL_INFO(dev)->gen >= 4)
+/*
+ * gmbus on gen4 seems to be able to generate legacy interrupts even when in MSI
+ * mode. This results in spurious interrupt warnings if the legacy irq no. is
+ * shared with another device. The kernel then disables that interrupt source
+ * and so prevents the other device from working properly.
+ */
+#define HAS_GMBUS_IRQ(dev) (INTEL_INFO(dev)->gen >= 5)
 static int
 gmbus_wait_hw_status(struct drm_i915_private *dev_priv,
 		     u32 gmbus2_status,
@@ -213,6 +219,9 @@
 	int reg_offset = dev_priv->gpio_mmio_base;
 	u32 gmbus2 = 0;
 	DEFINE_WAIT(wait);
+
+	if (!HAS_GMBUS_IRQ(dev_priv->dev))
+		gmbus4_irq_en = 0;
  
 	/* Important: The hw handles only the first bit, so set only one! Since
 	 * we also need to check for NAKs besides the hw ready/idle signal, we
...	...	@@ -2623,7 +2623,7 @@
2623	2623
2624	2624	INTEL DRM DRIVERS (excluding Poulsbo, Moorestown and derivative chipsets)
2625	2625	M: Daniel Vetter <daniel.vetter@ffwll.ch>
2626		-L: intel-gfx@lists.freedesktop.org (subscribers-only)
	2626	+L: intel-gfx@lists.freedesktop.org
2627	2627	L: dri-devel@lists.freedesktop.org
2628	2628	T: git git://people.freedesktop.org/~danvet/drm-intel
2629	2629	S: Supported
...	...	@@ -103,7 +103,7 @@
103	103	static void
104	104	describe_obj(struct seq_file m, struct drm_i915_gem_object obj)
105	105	{
106		- seq_printf(m, "%p: %s%s %8zdKiB %02x %02x %d %d %d%s%s%s",
	106	+ seq_printf(m, "%pK: %s%s %8zdKiB %02x %02x %d %d %d%s%s%s",
107	107	&obj->base,
108	108	get_pin_flag(obj),
109	109	get_tiling_flag(obj),
...	...	@@ -732,6 +732,8 @@
732	732	int count)
733	733	{
734	734	int i;
	735	+ int relocs_total = 0;
	736	+ int relocs_max = INT_MAX / sizeof(struct drm_i915_gem_relocation_entry);
735	737
736	738	for (i = 0; i < count; i++) {
737	739	char __user ptr = (char __user )(uintptr_t)exec[i].relocs_ptr;
738	740
...	...	@@ -740,10 +742,13 @@
740	742	if (exec[i].flags & __EXEC_OBJECT_UNKNOWN_FLAGS)
741	743	return -EINVAL;
742	744
743		- /* First check for malicious input causing overflow */
744		- if (exec[i].relocation_count >
745		- INT_MAX / sizeof(struct drm_i915_gem_relocation_entry))
	745	+ /* First check for malicious input causing overflow in
	746	+ * the worst case where we need to allocate the entire
	747	+ * relocation tree as a single array.
	748	+ */
	749	+ if (exec[i].relocation_count > relocs_max - relocs_total)
746	750	return -EINVAL;
	751	+ relocs_total += exec[i].relocation_count;
747	752
748	753	length = exec[i].relocation_count *
749	754	sizeof(struct drm_i915_gem_relocation_entry);
...	...	@@ -820,6 +820,7 @@
820	820	struct intel_link_m_n m_n;
821	821	int pipe = intel_crtc->pipe;
822	822	enum transcoder cpu_transcoder = intel_crtc->cpu_transcoder;
	823	+ int target_clock;
823	824
824	825	/*
825	826	* Find the lane count in the intel_encoder private
826	827
...	...	@@ -835,13 +836,22 @@
835	836	}
836	837	}
837	838
	839	+ target_clock = mode->clock;
	840	+ for_each_encoder_on_crtc(dev, crtc, intel_encoder) {
	841	+ if (intel_encoder->type == INTEL_OUTPUT_EDP) {
	842	+ target_clock = intel_edp_target_clock(intel_encoder,
	843	+ mode);
	844	+ break;
	845	+ }
	846	+ }
	847	+
838	848	/*
839	849	* Compute the GMCH and Link ratios. The '3' here is
840	850	* the number of bytes_per_pixel post-LUT, which we always
841	851	* set up for 8-bits of R/G/B, or 3 bytes total.
842	852	*/
843	853	intel_link_compute_m_n(intel_crtc->bpp, lane_count,
844		- mode->clock, adjusted_mode->clock, &m_n);
	854	+ target_clock, adjusted_mode->clock, &m_n);
845	855
846	856	if (IS_HASWELL(dev)) {
847	857	I915_WRITE(PIPE_DATA_M1(cpu_transcoder),
...	...	@@ -1930,7 +1940,7 @@
1930	1940	for (i = 0; i < intel_dp->lane_count; i++)
1931	1941	if ((intel_dp->train_set[i] & DP_TRAIN_MAX_SWING_REACHED) == 0)
1932	1942	break;
1933		- if (i == intel_dp->lane_count && voltage_tries == 5) {
	1943	+ if (i == intel_dp->lane_count) {
1934	1944	++loop_tries;
1935	1945	if (loop_tries == 5) {
1936	1946	DRM_DEBUG_KMS("too many full retries, give up\n");
...	...	@@ -203,7 +203,13 @@
203	203	algo->data = bus;
204	204	}
205	205
206		-#define HAS_GMBUS_IRQ(dev) (INTEL_INFO(dev)->gen >= 4)
	206	+/*
	207	+ * gmbus on gen4 seems to be able to generate legacy interrupts even when in MSI
	208	+ * mode. This results in spurious interrupt warnings if the legacy irq no. is
	209	+ * shared with another device. The kernel then disables that interrupt source
	210	+ * and so prevents the other device from working properly.
	211	+ */
	212	+#define HAS_GMBUS_IRQ(dev) (INTEL_INFO(dev)->gen >= 5)
207	213	static int
208	214	gmbus_wait_hw_status(struct drm_i915_private *dev_priv,
209	215	u32 gmbus2_status,
...	...	@@ -213,6 +219,9 @@
213	219	int reg_offset = dev_priv->gpio_mmio_base;
214	220	u32 gmbus2 = 0;
215	221	DEFINE_WAIT(wait);
	222	+
	223	+ if (!HAS_GMBUS_IRQ(dev_priv->dev))
	224	+ gmbus4_irq_en = 0;
216	225
217	226	/* Important: The hw handles only the first bit, so set only one! Since
218	227	* we also need to check for NAKs besides the hw ready/idle signal, we