Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux (80e06794) · Commits · 戴 / test

drivers/gpu/drm/i915/i915_dma.c

+0 −1

Original line number	Diff line number	Diff line
		@@ -1833,7 +1833,6 @@ int i915_driver_unload(struct drm_device *dev)
		flush_workqueue(dev_priv->wq);

		mutex_lock(&dev->struct_mutex);
		i915_gem_free_all_phys_object(dev);
		i915_gem_cleanup_ringbuffer(dev);
		i915_gem_context_fini(dev);
		WARN_ON(dev_priv->mm.aliasing_ppgtt);

drivers/gpu/drm/i915/i915_drv.h

+7 −23

Original line number	Diff line number	Diff line
		@@ -242,18 +242,6 @@ struct intel_ddi_plls {
		#define WATCH_LISTS 0
		#define WATCH_GTT 0

		#define I915_GEM_PHYS_CURSOR_0 1
		#define I915_GEM_PHYS_CURSOR_1 2
		#define I915_GEM_PHYS_OVERLAY_REGS 3
		#define I915_MAX_PHYS_OBJECT (I915_GEM_PHYS_OVERLAY_REGS)

		struct drm_i915_gem_phys_object {
		int id;
		struct page **page_list;
		drm_dma_handle_t *handle;
		struct drm_i915_gem_object *cur_obj;
		};

		struct opregion_header;
		struct opregion_acpi;
		struct opregion_swsci;
		@@ -1187,9 +1175,6 @@ struct i915_gem_mm {
		/** Bit 6 swizzling required for Y tiling */
		uint32_t bit_6_swizzle_y;

		/* storage for physical objects */
		struct drm_i915_gem_phys_object *phys_objs[I915_MAX_PHYS_OBJECT];

		/* accounting, useful for userland debugging */
		spinlock_t object_stat_lock;
		size_t object_memory;
		@@ -1769,7 +1754,7 @@ struct drm_i915_gem_object {
		struct drm_file *pin_filp;

		/** for phy allocated objects */
		struct drm_i915_gem_phys_object *phys_obj;
		drm_dma_handle_t *phys_handle;
		};

		#define to_intel_bo(x) container_of(x, struct drm_i915_gem_object, base)
		@@ -2204,10 +2189,12 @@ void i915_gem_vma_destroy(struct i915_vma *vma);
		#define PIN_MAPPABLE 0x1
		#define PIN_NONBLOCK 0x2
		#define PIN_GLOBAL 0x4
		#define PIN_OFFSET_BIAS 0x8
		#define PIN_OFFSET_MASK (~4095)
		int __must_check i915_gem_object_pin(struct drm_i915_gem_object *obj,
		struct i915_address_space *vm,
		uint32_t alignment,
		unsigned flags);
		uint64_t flags);
		int __must_check i915_vma_unbind(struct i915_vma *vma);
		int i915_gem_object_put_pages(struct drm_i915_gem_object *obj);
		void i915_gem_release_all_mmaps(struct drm_i915_private *dev_priv);
		@@ -2334,13 +2321,8 @@ i915_gem_object_pin_to_display_plane(struct drm_i915_gem_object *obj,
		u32 alignment,
		struct intel_ring_buffer *pipelined);
		void i915_gem_object_unpin_from_display_plane(struct drm_i915_gem_object *obj);
		int i915_gem_attach_phys_object(struct drm_device *dev,
		struct drm_i915_gem_object *obj,
		int id,
		int i915_gem_object_attach_phys(struct drm_i915_gem_object *obj,
		int align);
		void i915_gem_detach_phys_object(struct drm_device *dev,
		struct drm_i915_gem_object *obj);
		void i915_gem_free_all_phys_object(struct drm_device *dev);
		int i915_gem_open(struct drm_device dev, struct drm_file file);
		void i915_gem_release(struct drm_device dev, struct drm_file file);

		@@ -2465,6 +2447,8 @@ int __must_check i915_gem_evict_something(struct drm_device *dev,
		int min_size,
		unsigned alignment,
		unsigned cache_level,
		unsigned long start,
		unsigned long end,
		unsigned flags);
		int i915_gem_evict_vm(struct i915_address_space *vm, bool do_idle);
		int i915_gem_evict_everything(struct drm_device *dev);

drivers/gpu/drm/i915/i915_gem.c

+160 −205

Original line number	Diff line number	Diff line
		@@ -43,10 +43,6 @@ static void i915_gem_object_flush_cpu_write_domain(struct drm_i915_gem_object *o
		static __must_check int
		i915_gem_object_wait_rendering(struct drm_i915_gem_object *obj,
		bool readonly);
		static int i915_gem_phys_pwrite(struct drm_device *dev,
		struct drm_i915_gem_object *obj,
		struct drm_i915_gem_pwrite *args,
		struct drm_file *file);

		static void i915_gem_write_fence(struct drm_device *dev, int reg,
		struct drm_i915_gem_object *obj);
		@@ -209,6 +205,128 @@ i915_gem_get_aperture_ioctl(struct drm_device dev, void data,
		return 0;
		}

		static void i915_gem_object_detach_phys(struct drm_i915_gem_object *obj)
		{
		drm_dma_handle_t *phys = obj->phys_handle;

		if (!phys)
		return;

		if (obj->madv == I915_MADV_WILLNEED) {
		struct address_space *mapping = file_inode(obj->base.filp)->i_mapping;
		char *vaddr = phys->vaddr;
		int i;

		for (i = 0; i < obj->base.size / PAGE_SIZE; i++) {
		struct page *page = shmem_read_mapping_page(mapping, i);
		if (!IS_ERR(page)) {
		char *dst = kmap_atomic(page);
		memcpy(dst, vaddr, PAGE_SIZE);
		drm_clflush_virt_range(dst, PAGE_SIZE);
		kunmap_atomic(dst);

		set_page_dirty(page);
		mark_page_accessed(page);
		page_cache_release(page);
		}
		vaddr += PAGE_SIZE;
		}
		i915_gem_chipset_flush(obj->base.dev);
		}

		#ifdef CONFIG_X86
		set_memory_wb((unsigned long)phys->vaddr, phys->size / PAGE_SIZE);
		#endif
		drm_pci_free(obj->base.dev, phys);
		obj->phys_handle = NULL;
		}

		int
		i915_gem_object_attach_phys(struct drm_i915_gem_object *obj,
		int align)
		{
		drm_dma_handle_t *phys;
		struct address_space *mapping;
		char *vaddr;
		int i;

		if (obj->phys_handle) {
		if ((unsigned long)obj->phys_handle->vaddr & (align -1))
		return -EBUSY;

		return 0;
		}

		if (obj->madv != I915_MADV_WILLNEED)
		return -EFAULT;

		if (obj->base.filp == NULL)
		return -EINVAL;

		/* create a new object */
		phys = drm_pci_alloc(obj->base.dev, obj->base.size, align);
		if (!phys)
		return -ENOMEM;

		vaddr = phys->vaddr;
		#ifdef CONFIG_X86
		set_memory_wc((unsigned long)vaddr, phys->size / PAGE_SIZE);
		#endif
		mapping = file_inode(obj->base.filp)->i_mapping;
		for (i = 0; i < obj->base.size / PAGE_SIZE; i++) {
		struct page *page;
		char *src;

		page = shmem_read_mapping_page(mapping, i);
		if (IS_ERR(page)) {
		#ifdef CONFIG_X86
		set_memory_wb((unsigned long)phys->vaddr, phys->size / PAGE_SIZE);
		#endif
		drm_pci_free(obj->base.dev, phys);
		return PTR_ERR(page);
		}

		src = kmap_atomic(page);
		memcpy(vaddr, src, PAGE_SIZE);
		kunmap_atomic(src);

		mark_page_accessed(page);
		page_cache_release(page);

		vaddr += PAGE_SIZE;
		}

		obj->phys_handle = phys;
		return 0;
		}

		static int
		i915_gem_phys_pwrite(struct drm_i915_gem_object *obj,
		struct drm_i915_gem_pwrite *args,
		struct drm_file *file_priv)
		{
		struct drm_device *dev = obj->base.dev;
		void *vaddr = obj->phys_handle->vaddr + args->offset;
		char __user *user_data = to_user_ptr(args->data_ptr);

		if (__copy_from_user_inatomic_nocache(vaddr, user_data, args->size)) {
		unsigned long unwritten;

		/* The physical object once assigned is fixed for the lifetime
		* of the obj, so we can safely drop the lock and continue
		* to access vaddr.
		*/
		mutex_unlock(&dev->struct_mutex);
		unwritten = copy_from_user(vaddr, user_data, args->size);
		mutex_lock(&dev->struct_mutex);
		if (unwritten)
		return -EFAULT;
		}

		i915_gem_chipset_flush(dev);
		return 0;
		}

		void i915_gem_object_alloc(struct drm_device dev)
		{
		struct drm_i915_private *dev_priv = dev->dev_private;
		@@ -921,8 +1039,8 @@ i915_gem_pwrite_ioctl(struct drm_device dev, void data,
		* pread/pwrite currently are reading and writing from the CPU
		* perspective, requiring manual detiling by the client.
		*/
		if (obj->phys_obj) {
		ret = i915_gem_phys_pwrite(dev, obj, args, file);
		if (obj->phys_handle) {
		ret = i915_gem_phys_pwrite(obj, args, file);
		goto out;
		}

		@@ -3208,12 +3326,14 @@ static struct i915_vma *
		i915_gem_object_bind_to_vm(struct drm_i915_gem_object *obj,
		struct i915_address_space *vm,
		unsigned alignment,
		unsigned flags)
		uint64_t flags)
		{
		struct drm_device *dev = obj->base.dev;
		struct drm_i915_private *dev_priv = dev->dev_private;
		u32 size, fence_size, fence_alignment, unfenced_alignment;
		size_t gtt_max =
		unsigned long start =
		flags & PIN_OFFSET_BIAS ? flags & PIN_OFFSET_MASK : 0;
		unsigned long end =
		flags & PIN_MAPPABLE ? dev_priv->gtt.mappable_end : vm->total;
		struct i915_vma *vma;
		int ret;
		@@ -3242,11 +3362,11 @@ i915_gem_object_bind_to_vm(struct drm_i915_gem_object *obj,
		/* If the object is bigger than the entire aperture, reject it early
		* before evicting everything in a vain attempt to find space.
		*/
		if (obj->base.size > gtt_max) {
		DRM_DEBUG("Attempting to bind an object larger than the aperture: object=%zd > %s aperture=%zu\n",
		if (obj->base.size > end) {
		DRM_DEBUG("Attempting to bind an object larger than the aperture: object=%zd > %s aperture=%lu\n",
		obj->base.size,
		flags & PIN_MAPPABLE ? "mappable" : "total",
		gtt_max);
		end);
		return ERR_PTR(-E2BIG);
		}

		@@ -3263,12 +3383,15 @@ i915_gem_object_bind_to_vm(struct drm_i915_gem_object *obj,
		search_free:
		ret = drm_mm_insert_node_in_range_generic(&vm->mm, &vma->node,
		size, alignment,
		obj->cache_level, 0, gtt_max,
		obj->cache_level,
		start, end,
		DRM_MM_SEARCH_DEFAULT,
		DRM_MM_CREATE_DEFAULT);
		if (ret) {
		ret = i915_gem_evict_something(dev, vm, size, alignment,
		obj->cache_level, flags);
		obj->cache_level,
		start, end,
		flags);
		if (ret == 0)
		goto search_free;

		@@ -3828,11 +3951,30 @@ i915_gem_ring_throttle(struct drm_device dev, struct drm_file file)
		return ret;
		}

		static bool
		i915_vma_misplaced(struct i915_vma *vma, uint32_t alignment, uint64_t flags)
		{
		struct drm_i915_gem_object *obj = vma->obj;

		if (alignment &&
		vma->node.start & (alignment - 1))
		return true;

		if (flags & PIN_MAPPABLE && !obj->map_and_fenceable)
		return true;

		if (flags & PIN_OFFSET_BIAS &&
		vma->node.start < (flags & PIN_OFFSET_MASK))
		return true;

		return false;
		}

		int
		i915_gem_object_pin(struct drm_i915_gem_object *obj,
		struct i915_address_space *vm,
		uint32_t alignment,
		unsigned flags)
		uint64_t flags)
		{
		struct i915_vma *vma;
		int ret;
		@@ -3845,15 +3987,13 @@ i915_gem_object_pin(struct drm_i915_gem_object *obj,
		if (WARN_ON(vma->pin_count == DRM_I915_GEM_OBJECT_MAX_PIN_COUNT))
		return -EBUSY;

		if ((alignment &&
		vma->node.start & (alignment - 1)) \|\|
		(flags & PIN_MAPPABLE && !obj->map_and_fenceable)) {
		if (i915_vma_misplaced(vma, alignment, flags)) {
		WARN(vma->pin_count,
		"bo is already pinned with incorrect alignment:"
		" offset=%lx, req.alignment=%x, req.map_and_fenceable=%d,"
		" obj->map_and_fenceable=%d\n",
		i915_gem_obj_offset(obj, vm), alignment,
		flags & PIN_MAPPABLE,
		!!(flags & PIN_MAPPABLE),
		obj->map_and_fenceable);
		ret = i915_vma_unbind(vma);
		if (ret)
		@@ -4163,9 +4303,6 @@ void i915_gem_free_object(struct drm_gem_object *gem_obj)

		trace_i915_gem_object_destroy(obj);

		if (obj->phys_obj)
		i915_gem_detach_phys_object(dev, obj);

		list_for_each_entry_safe(vma, next, &obj->vma_list, vma_link) {
		int ret;

		@@ -4183,6 +4320,8 @@ void i915_gem_free_object(struct drm_gem_object *gem_obj)
		}
		}

		i915_gem_object_detach_phys(obj);

		/* Stolen objects don't hold a ref, but do hold pin count. Fix that up
		* before progressing. */
		if (obj->stolen)
		@@ -4646,190 +4785,6 @@ i915_gem_load(struct drm_device *dev)
		register_shrinker(&dev_priv->mm.inactive_shrinker);
		}

		/*
		* Create a physically contiguous memory object for this object
		* e.g. for cursor + overlay regs
		*/
		static int i915_gem_init_phys_object(struct drm_device *dev,
		int id, int size, int align)
		{
		struct drm_i915_private *dev_priv = dev->dev_private;
		struct drm_i915_gem_phys_object *phys_obj;
		int ret;

		if (dev_priv->mm.phys_objs[id - 1] \|\| !size)
		return 0;

		phys_obj = kzalloc(sizeof(*phys_obj), GFP_KERNEL);
		if (!phys_obj)
		return -ENOMEM;

		phys_obj->id = id;

		phys_obj->handle = drm_pci_alloc(dev, size, align);
		if (!phys_obj->handle) {
		ret = -ENOMEM;
		goto kfree_obj;
		}
		#ifdef CONFIG_X86
		set_memory_wc((unsigned long)phys_obj->handle->vaddr, phys_obj->handle->size / PAGE_SIZE);
		#endif

		dev_priv->mm.phys_objs[id - 1] = phys_obj;

		return 0;
		kfree_obj:
		kfree(phys_obj);
		return ret;
		}

		static void i915_gem_free_phys_object(struct drm_device *dev, int id)
		{
		struct drm_i915_private *dev_priv = dev->dev_private;
		struct drm_i915_gem_phys_object *phys_obj;

		if (!dev_priv->mm.phys_objs[id - 1])
		return;

		phys_obj = dev_priv->mm.phys_objs[id - 1];
		if (phys_obj->cur_obj) {
		i915_gem_detach_phys_object(dev, phys_obj->cur_obj);
		}

		#ifdef CONFIG_X86
		set_memory_wb((unsigned long)phys_obj->handle->vaddr, phys_obj->handle->size / PAGE_SIZE);
		#endif
		drm_pci_free(dev, phys_obj->handle);
		kfree(phys_obj);
		dev_priv->mm.phys_objs[id - 1] = NULL;
		}

		void i915_gem_free_all_phys_object(struct drm_device *dev)
		{
		int i;

		for (i = I915_GEM_PHYS_CURSOR_0; i <= I915_MAX_PHYS_OBJECT; i++)
		i915_gem_free_phys_object(dev, i);
		}

		void i915_gem_detach_phys_object(struct drm_device *dev,
		struct drm_i915_gem_object *obj)
		{
		struct address_space *mapping = file_inode(obj->base.filp)->i_mapping;
		char *vaddr;
		int i;
		int page_count;

		if (!obj->phys_obj)
		return;
		vaddr = obj->phys_obj->handle->vaddr;

		page_count = obj->base.size / PAGE_SIZE;
		for (i = 0; i < page_count; i++) {
		struct page *page = shmem_read_mapping_page(mapping, i);
		if (!IS_ERR(page)) {
		char *dst = kmap_atomic(page);
		memcpy(dst, vaddr + i*PAGE_SIZE, PAGE_SIZE);
		kunmap_atomic(dst);

		drm_clflush_pages(&page, 1);

		set_page_dirty(page);
		mark_page_accessed(page);
		page_cache_release(page);
		}
		}
		i915_gem_chipset_flush(dev);

		obj->phys_obj->cur_obj = NULL;
		obj->phys_obj = NULL;
		}

		int
		i915_gem_attach_phys_object(struct drm_device *dev,
		struct drm_i915_gem_object *obj,
		int id,
		int align)
		{
		struct address_space *mapping = file_inode(obj->base.filp)->i_mapping;
		struct drm_i915_private *dev_priv = dev->dev_private;
		int ret = 0;
		int page_count;
		int i;

		if (id > I915_MAX_PHYS_OBJECT)
		return -EINVAL;

		if (obj->phys_obj) {
		if (obj->phys_obj->id == id)
		return 0;
		i915_gem_detach_phys_object(dev, obj);
		}

		/* create a new object */
		if (!dev_priv->mm.phys_objs[id - 1]) {
		ret = i915_gem_init_phys_object(dev, id,
		obj->base.size, align);
		if (ret) {
		DRM_ERROR("failed to init phys object %d size: %zu\n",
		id, obj->base.size);
		return ret;
		}
		}

		/* bind to the object */
		obj->phys_obj = dev_priv->mm.phys_objs[id - 1];
		obj->phys_obj->cur_obj = obj;

		page_count = obj->base.size / PAGE_SIZE;

		for (i = 0; i < page_count; i++) {
		struct page *page;
		char dst, src;

		page = shmem_read_mapping_page(mapping, i);
		if (IS_ERR(page))
		return PTR_ERR(page);

		src = kmap_atomic(page);
		dst = obj->phys_obj->handle->vaddr + (i * PAGE_SIZE);
		memcpy(dst, src, PAGE_SIZE);
		kunmap_atomic(src);

		mark_page_accessed(page);
		page_cache_release(page);
		}

		return 0;
		}

		static int
		i915_gem_phys_pwrite(struct drm_device *dev,
		struct drm_i915_gem_object *obj,
		struct drm_i915_gem_pwrite *args,
		struct drm_file *file_priv)
		{
		void *vaddr = obj->phys_obj->handle->vaddr + args->offset;
		char __user *user_data = to_user_ptr(args->data_ptr);

		if (__copy_from_user_inatomic_nocache(vaddr, user_data, args->size)) {
		unsigned long unwritten;

		/* The physical object once assigned is fixed for the lifetime
		* of the obj, so we can safely drop the lock and continue
		* to access vaddr.
		*/
		mutex_unlock(&dev->struct_mutex);
		unwritten = copy_from_user(vaddr, user_data, args->size);
		mutex_lock(&dev->struct_mutex);
		if (unwritten)
		return -EFAULT;
		}

		i915_gem_chipset_flush(dev);
		return 0;
		}

		void i915_gem_release(struct drm_device dev, struct drm_file file)
		{
		struct drm_i915_file_private *file_priv = file->driver_priv;

drivers/gpu/drm/i915/i915_gem_evict.c

+4 −5

Original line number	Diff line number	Diff line
		@@ -68,9 +68,9 @@ mark_free(struct i915_vma vma, struct list_head unwind)
		int
		i915_gem_evict_something(struct drm_device dev, struct i915_address_space vm,
		int min_size, unsigned alignment, unsigned cache_level,
		unsigned long start, unsigned long end,
		unsigned flags)
		{
		struct drm_i915_private *dev_priv = dev->dev_private;
		struct list_head eviction_list, unwind_list;
		struct i915_vma *vma;
		int ret = 0;
		@@ -102,11 +102,10 @@ i915_gem_evict_something(struct drm_device dev, struct i915_address_space vm,
		*/

		INIT_LIST_HEAD(&unwind_list);
		if (flags & PIN_MAPPABLE) {
		BUG_ON(!i915_is_ggtt(vm));
		if (start != 0 \|\| end != vm->total) {
		drm_mm_init_scan_with_range(&vm->mm, min_size,
		alignment, cache_level, 0,
		dev_priv->gtt.mappable_end);
		alignment, cache_level,
		start, end);
		} else
		drm_mm_init_scan(&vm->mm, min_size, alignment, cache_level);

drivers/gpu/drm/i915/i915_gem_execbuffer.c

+89 −41

Original line number	Diff line number	Diff line
		@@ -35,6 +35,9 @@

		#define __EXEC_OBJECT_HAS_PIN (1<<31)
		#define __EXEC_OBJECT_HAS_FENCE (1<<30)
		#define __EXEC_OBJECT_NEEDS_BIAS (1<<28)

		#define BATCH_OFFSET_BIAS (256*1024)

		struct eb_vmas {
		struct list_head vmas;
		@@ -545,7 +548,7 @@ i915_gem_execbuffer_reserve_vma(struct i915_vma *vma,
		struct drm_i915_gem_exec_object2 *entry = vma->exec_entry;
		bool has_fenced_gpu_access = INTEL_INFO(ring->dev)->gen < 4;
		bool need_fence;
		unsigned flags;
		uint64_t flags;
		int ret;

		flags = 0;
		@@ -559,6 +562,8 @@ i915_gem_execbuffer_reserve_vma(struct i915_vma *vma,

		if (entry->flags & EXEC_OBJECT_NEEDS_GTT)
		flags \|= PIN_GLOBAL;
		if (entry->flags & __EXEC_OBJECT_NEEDS_BIAS)
		flags \|= BATCH_OFFSET_BIAS \| PIN_OFFSET_BIAS;

		ret = i915_gem_object_pin(obj, vma->vm, entry->alignment, flags);
		if (ret)
		@@ -592,6 +597,36 @@ i915_gem_execbuffer_reserve_vma(struct i915_vma *vma,
		return 0;
		}

		static bool
		eb_vma_misplaced(struct i915_vma *vma, bool has_fenced_gpu_access)
		{
		struct drm_i915_gem_exec_object2 *entry = vma->exec_entry;
		struct drm_i915_gem_object *obj = vma->obj;
		bool need_fence, need_mappable;

		need_fence =
		has_fenced_gpu_access &&
		entry->flags & EXEC_OBJECT_NEEDS_FENCE &&
		obj->tiling_mode != I915_TILING_NONE;
		need_mappable = need_fence \|\| need_reloc_mappable(vma);

		WARN_ON((need_mappable \|\| need_fence) &&
		!i915_is_ggtt(vma->vm));

		if (entry->alignment &&
		vma->node.start & (entry->alignment - 1))
		return true;

		if (need_mappable && !obj->map_and_fenceable)
		return true;

		if (entry->flags & __EXEC_OBJECT_NEEDS_BIAS &&
		vma->node.start < BATCH_OFFSET_BIAS)
		return true;

		return false;
		}

		static int
		i915_gem_execbuffer_reserve(struct intel_ring_buffer *ring,
		struct list_head *vmas,
		@@ -653,26 +688,10 @@ i915_gem_execbuffer_reserve(struct intel_ring_buffer *ring,

		/* Unbind any ill-fitting objects or pin. */
		list_for_each_entry(vma, vmas, exec_list) {
		struct drm_i915_gem_exec_object2 *entry = vma->exec_entry;
		bool need_fence, need_mappable;

		obj = vma->obj;

		if (!drm_mm_node_allocated(&vma->node))
		continue;

		need_fence =
		has_fenced_gpu_access &&
		entry->flags & EXEC_OBJECT_NEEDS_FENCE &&
		obj->tiling_mode != I915_TILING_NONE;
		need_mappable = need_fence \|\| need_reloc_mappable(vma);

		WARN_ON((need_mappable \|\| need_fence) &&
		!i915_is_ggtt(vma->vm));

		if ((entry->alignment &&
		vma->node.start & (entry->alignment - 1)) \|\|
		(need_mappable && !obj->map_and_fenceable))
		if (eb_vma_misplaced(vma, has_fenced_gpu_access))
		ret = i915_vma_unbind(vma);
		else
		ret = i915_gem_execbuffer_reserve_vma(vma, ring, need_relocs);
		@@ -773,7 +792,7 @@ i915_gem_execbuffer_relocate_slow(struct drm_device *dev,
		* relocations were valid.
		*/
		for (j = 0; j < exec[i].relocation_count; j++) {
		if (copy_to_user(&user_relocs[j].presumed_offset,
		if (__copy_to_user(&user_relocs[j].presumed_offset,
		&invalid_offset,
		sizeof(invalid_offset))) {
		ret = -EFAULT;
		@@ -999,6 +1018,25 @@ i915_reset_gen7_sol_offsets(struct drm_device *dev,
		return 0;
		}

		static struct drm_i915_gem_object *
		eb_get_batch(struct eb_vmas *eb)
		{
		struct i915_vma vma = list_entry(eb->vmas.prev, typeof(vma), exec_list);

		/*
		* SNA is doing fancy tricks with compressing batch buffers, which leads
		* to negative relocation deltas. Usually that works out ok since the
		* relocate address is still positive, except when the batch is placed
		* very low in the GTT. Ensure this doesn't happen.
		*
		* Note that actual hangs have only been observed on gen7, but for
		* paranoia do it everywhere.
		*/
		vma->exec_entry->flags \|= __EXEC_OBJECT_NEEDS_BIAS;

		return vma->obj;
		}

		static int
		i915_gem_do_execbuffer(struct drm_device dev, void data,
		struct drm_file *file,
		@@ -1153,7 +1191,7 @@ i915_gem_do_execbuffer(struct drm_device dev, void data,
		goto err;

		/* take note of the batch buffer before we might reorder the lists */
		batch_obj = list_entry(eb->vmas.prev, struct i915_vma, exec_list)->obj;
		batch_obj = eb_get_batch(eb);

		/* Move the objects en-masse into the GTT, evicting if necessary. */
		need_relocs = (args->flags & I915_EXEC_NO_RELOC) == 0;
		@@ -1355,18 +1393,21 @@ i915_gem_execbuffer(struct drm_device dev, void data,

		ret = i915_gem_do_execbuffer(dev, data, file, &exec2, exec2_list);
		if (!ret) {
		struct drm_i915_gem_exec_object __user *user_exec_list =
		to_user_ptr(args->buffers_ptr);

		/* Copy the new buffer offsets back to the user's exec list. */
		for (i = 0; i < args->buffer_count; i++)
		exec_list[i].offset = exec2_list[i].offset;
		/* ... and back out to userspace */
		ret = copy_to_user(to_user_ptr(args->buffers_ptr),
		exec_list,
		sizeof(exec_list) args->buffer_count);
		for (i = 0; i < args->buffer_count; i++) {
		ret = __copy_to_user(&user_exec_list[i].offset,
		&exec2_list[i].offset,
		sizeof(user_exec_list[i].offset));
		if (ret) {
		ret = -EFAULT;
		DRM_DEBUG("failed to copy %d exec entries "
		"back to user (%d)\n",
		args->buffer_count, ret);
		break;
		}
		}
		}

		@@ -1412,14 +1453,21 @@ i915_gem_execbuffer2(struct drm_device dev, void data,
		ret = i915_gem_do_execbuffer(dev, data, file, args, exec2_list);
		if (!ret) {
		/* Copy the new buffer offsets back to the user's exec list. */
		ret = copy_to_user(to_user_ptr(args->buffers_ptr),
		exec2_list,
		sizeof(exec2_list) args->buffer_count);
		struct drm_i915_gem_exec_object2 *user_exec_list =
		to_user_ptr(args->buffers_ptr);
		int i;

		for (i = 0; i < args->buffer_count; i++) {
		ret = __copy_to_user(&user_exec_list[i].offset,
		&exec2_list[i].offset,
		sizeof(user_exec_list[i].offset));
		if (ret) {
		ret = -EFAULT;
		DRM_DEBUG("failed to copy %d exec entries "
		"back to user (%d)\n",
		args->buffer_count, ret);
		"back to user\n",
		args->buffer_count);
		break;
		}
		}
		}

Admin message