Commit 42e0a872 authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'drm-intel-fixes-2022-07-07' of... 

Merge tag 'drm-intel-fixes-2022-07-07' of git://anongit.freedesktop.org/drm/drm-intel

 into drm-fixes

- Fix a possible refcount leak in DP MST connector (Hangyu)
- Fix on loading guc on ADL-N (Daniele)
- Fix vm use-after-free in vma destruction (Thomas)

Signed-off-by: default avatarDave Airlie <airlied@redhat.com>

From: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/YsbbgWnLTR8fr4lj@intel.com
parents 7de96365 12058077

drivers/gpu/drm/i915/display/intel_dp_mst.c

+1 −0
Original line number Diff line number Diff line
@@ -839,6 +839,7 @@ static struct drm_connector *intel_dp_add_mst_connector(struct drm_dp_mst_topolo 
	ret = drm_connector_init(dev, connector, &intel_dp_mst_connector_funcs,

				 DRM_MODE_CONNECTOR_DisplayPort);

	if (ret) {

		drm_dp_mst_put_port_malloc(port);

		intel_connector_free(intel_connector);

		return NULL;

	}

drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c

+9 −0
Original line number Diff line number Diff line
@@ -162,6 +162,15 @@ __uc_fw_auto_select(struct drm_i915_private *i915, struct intel_uc_fw *uc_fw) 
	u8 rev = INTEL_REVID(i915);

	int i;



	/*

	 * The only difference between the ADL GuC FWs is the HWConfig support.

	 * ADL-N does not support HWConfig, so we should use the same binary as

	 * ADL-S, otherwise the GuC might attempt to fetch a config table that

	 * does not exist.

	 */

	if (IS_ADLP_N(i915))

		p = INTEL_ALDERLAKE_S;



	GEM_BUG_ON(uc_fw->type >= ARRAY_SIZE(blobs_all));

	fw_blobs = blobs_all[uc_fw->type].blobs;

	fw_count = blobs_all[uc_fw->type].count;

drivers/gpu/drm/i915/i915_vma.c

+8 −4
Original line number Diff line number Diff line
@@ -1637,10 +1637,10 @@ static void force_unbind(struct i915_vma *vma) 
	GEM_BUG_ON(drm_mm_node_allocated(&vma->node));

}



static void release_references(struct i915_vma *vma, bool vm_ddestroy)

static void release_references(struct i915_vma *vma, struct intel_gt *gt,

			       bool vm_ddestroy)

{

	struct drm_i915_gem_object *obj = vma->obj;

	struct intel_gt *gt = vma->vm->gt;



	GEM_BUG_ON(i915_vma_is_active(vma));
@@ -1695,11 +1695,12 @@ void i915_vma_destroy_locked(struct i915_vma *vma) 


	force_unbind(vma);

	list_del_init(&vma->vm_link);

	release_references(vma, false);

	release_references(vma, vma->vm->gt, false);

}



void i915_vma_destroy(struct i915_vma *vma)

{

	struct intel_gt *gt;

	bool vm_ddestroy;



	mutex_lock(&vma->vm->mutex);
@@ -1707,8 +1708,11 @@ void i915_vma_destroy(struct i915_vma *vma) 
	list_del_init(&vma->vm_link);

	vm_ddestroy = vma->vm_ddestroy;

	vma->vm_ddestroy = false;



	/* vma->vm may be freed when releasing vma->vm->mutex. */

	gt = vma->vm->gt;

	mutex_unlock(&vma->vm->mutex);

	release_references(vma, vm_ddestroy);

	release_references(vma, gt, vm_ddestroy);

}



void i915_vma_parked(struct intel_gt *gt)