Merge tag 'drm-intel-fixes-2021-09-23' of git://anongit.freedesktop.org/drm/drm-intel...

drm/i915 fixes for v5.15-rc3:
- Fix ADL-P memory bandwidth parameters
- Fix memory corruption due to a double free
- Fix memory leak in DMC firmware handling

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/87o88jbk3o.fsf@intel.com

diff --git a/drivers/gpu/drm/i915/display/intel_bw.c b/drivers/gpu/drm/i915/display/intel_bw.c
index e91e0e0..4b94256 100644 (file)
--- a/drivers/gpu/drm/i915/display/intel_bw.c
+++ b/drivers/gpu/drm/i915/display/intel_bw.c
@@ -222,31 +222,42 @@ static int icl_sagv_max_dclk(const struct intel_qgv_info *qi)
 
 struct intel_sa_info {
        u16 displayrtids;
-       u8 deburst, deprogbwlimit;
+       u8 deburst, deprogbwlimit, derating;
 };
 
 static const struct intel_sa_info icl_sa_info = {
        .deburst = 8,
        .deprogbwlimit = 25, /* GB/s */
        .displayrtids = 128,
+       .derating = 10,
 };
 
 static const struct intel_sa_info tgl_sa_info = {
        .deburst = 16,
        .deprogbwlimit = 34, /* GB/s */
        .displayrtids = 256,
+       .derating = 10,
 };
 
 static const struct intel_sa_info rkl_sa_info = {
        .deburst = 16,
        .deprogbwlimit = 20, /* GB/s */
        .displayrtids = 128,
+       .derating = 10,
 };
 
 static const struct intel_sa_info adls_sa_info = {
        .deburst = 16,
        .deprogbwlimit = 38, /* GB/s */
        .displayrtids = 256,
+       .derating = 10,
+};
+
+static const struct intel_sa_info adlp_sa_info = {
+       .deburst = 16,
+       .deprogbwlimit = 38, /* GB/s */
+       .displayrtids = 256,
+       .derating = 20,
 };
 
 static int icl_get_bw_info(struct drm_i915_private *dev_priv, const struct intel_sa_info *sa)
@@ -302,7 +313,7 @@ static int icl_get_bw_info(struct drm_i915_private *dev_priv, const struct intel
                        bw = icl_calc_bw(sp->dclk, clpchgroup * 32 * num_channels, ct);
 
                        bi->deratedbw[j] = min(maxdebw,
-                                              bw * 9 / 10); /* 90% */
+                                              bw * (100 - sa->derating) / 100);
 
                        drm_dbg_kms(&dev_priv->drm,
                                    "BW%d / QGV %d: num_planes=%d deratedbw=%u\n",
@@ -400,7 +411,9 @@ void intel_bw_init_hw(struct drm_i915_private *dev_priv)
 
        if (IS_DG2(dev_priv))
                dg2_get_bw_info(dev_priv);
-       else if (IS_ALDERLAKE_S(dev_priv) || IS_ALDERLAKE_P(dev_priv))
+       else if (IS_ALDERLAKE_P(dev_priv))
+               icl_get_bw_info(dev_priv, &adlp_sa_info);
+       else if (IS_ALDERLAKE_S(dev_priv))
                icl_get_bw_info(dev_priv, &adls_sa_info);
        else if (IS_ROCKETLAKE(dev_priv))
                icl_get_bw_info(dev_priv, &rkl_sa_info);

diff --git a/drivers/gpu/drm/i915/display/intel_dmc.c b/drivers/gpu/drm/i915/display/intel_dmc.c
index 3c3c6cb..b3c8e1c 100644 (file)
--- a/drivers/gpu/drm/i915/display/intel_dmc.c
+++ b/drivers/gpu/drm/i915/display/intel_dmc.c
@@ -805,11 +805,14 @@ void intel_dmc_ucode_resume(struct drm_i915_private *dev_priv)
  */
 void intel_dmc_ucode_fini(struct drm_i915_private *dev_priv)
 {
+       int id;
+
        if (!HAS_DMC(dev_priv))
                return;
 
        intel_dmc_ucode_suspend(dev_priv);
        drm_WARN_ON(&dev_priv->drm, dev_priv->dmc.wakeref);
 
-       kfree(dev_priv->dmc.dmc_info[DMC_FW_MAIN].payload);
+       for (id = 0; id < DMC_FW_MAX; id++)
+               kfree(dev_priv->dmc.dmc_info[id].payload);
 }

diff --git a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
index 35eedc1..6ea1315 100644 (file)
--- a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
@@ -356,11 +356,8 @@ static void i915_ttm_delete_mem_notify(struct ttm_buffer_object *bo)
 {
        struct drm_i915_gem_object *obj = i915_ttm_to_gem(bo);
 
-       if (likely(obj)) {
-               /* This releases all gem object bindings to the backend. */
+       if (likely(obj))
                i915_ttm_free_cached_io_st(obj);
-               __i915_gem_free_object(obj);
-       }
 }
 
 static struct intel_memory_region *
@@ -875,8 +872,12 @@ void i915_ttm_bo_destroy(struct ttm_buffer_object *bo)
 {
        struct drm_i915_gem_object *obj = i915_ttm_to_gem(bo);
 
+       /* This releases all gem object bindings to the backend. */
+       __i915_gem_free_object(obj);
+
        i915_gem_object_release_memory_region(obj);
        mutex_destroy(&obj->ttm.get_io_page.lock);
+
        if (obj->ttm.created)
                call_rcu(&obj->rcu, __i915_gem_free_object_rcu);
 }