drm/i915/gvt fixes for v5.0-rc3

-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEFWWmW3ewYy4RJOWc05gHnSar7m8FAlxAVlYACgkQ05gHnSar
 7m/1/Q//ZwPlIUbWOS+PFklfoY9c0APwMWKzrnnDOxvnpA8KRsaY+yKn5FW91fcZ
 ee9S1fUlySuKVpsWLKhoiVM04tU+gQmO+UeGvNbMG1yTHIOq97sAP/cSIPnOuDkW
 2d1vSihmnx/RSuEgd9E+a8yMoIF+PtXKcSl4nUT4nurYPiUvC12nqS/C9sfF5JP0
 ZQc68ATj9wjJlhenAPjgsr6GP2YOzr9yqAQ1xV/PEg4Gth9uFM+dbbn+8vBOkjCt
 5fiB66cS8aGN5jwOlafqsMKjQeKHdV5bpJjpWirB9vdkiDHk/wOlzOUc2ySp0Krg
 1mJUL0KyWs6PfQvZvXCalQTOq9l6enCbq4N58/l4cC4LBU2Nx7LW7GwmHt9ONxjB
 aBQjTd2gku/DFyYHjCv7zAyHVLTu0TRWJpRlZGP5IpvECK21uFz8OtiiecoCvdm1
 bdQLr3cMXpT8JwLIr/N1lvMQTThFFvBCrnSruqbAikHFrZNkacczw7IqMUWQnsri
 SNTJ4s2hy6eThAIGGR61kXfnymKZ8GDKUYzi+De0OPaQ3VYFqaGQQk+1VkXpr0Qk
 S+r8oawzx5/FlDKZJqcDAXSaROcvFpbpVys+UozVp22lu/PPTwW0ReDG5uGQw/le
 tgEim6CnBj7wpDOZ4DOlH9npLbIvTrQ7M1HgjJ9DJ4DbNWu+R/s=
 =cHcP
 -----END PGP SIGNATURE-----

Merge tag 'drm-intel-fixes-2019-01-17' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes

drm/i915/gvt fixes for v5.0-rc3

"This contains one cmd parser failure fix to allow cmd access for one
register, and fix region cleanup properly in vGPU destroy, and another
fix for critical mmap size check mistake."

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/87ef9bfusc.fsf@intel.com

drivers/gpu/drm/i915/gvt/handlers.c

@@ -2799,6 +2799,7 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
 	MMIO_DFH(_MMIO(0xe2a0), D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
 	MMIO_DFH(_MMIO(0xe2b0), D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
 	MMIO_DFH(_MMIO(0xe2c0), D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+	MMIO_DFH(_MMIO(0x21f0), D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
 	return 0;
 }
 

drivers/gpu/drm/i915/gvt/hypercall.h

@@ -41,7 +41,7 @@ struct intel_gvt_mpt {
 	int (*host_init)(struct device *dev, void *gvt, const void *ops);
 	void (*host_exit)(struct device *dev, void *gvt);
 	int (*attach_vgpu)(void *vgpu, unsigned long *handle);
-	void (*detach_vgpu)(unsigned long handle);
+	void (*detach_vgpu)(void *vgpu);
 	int (*inject_msi)(unsigned long handle, u32 addr, u16 data);
 	unsigned long (*from_virt_to_mfn)(void *p);
 	int (*enable_page_track)(unsigned long handle, u64 gfn);

drivers/gpu/drm/i915/gvt/kvmgt.c

@@ -996,7 +996,7 @@ static int intel_vgpu_mmap(struct mdev_device *mdev, struct vm_area_struct *vma)
 {
 	unsigned int index;
 	u64 virtaddr;
-	unsigned long req_size, pgoff = 0;
+	unsigned long req_size, pgoff, req_start;
 	pgprot_t pg_prot;
 	struct intel_vgpu *vgpu = mdev_get_drvdata(mdev);
 
@@ -1014,7 +1014,17 @@ static int intel_vgpu_mmap(struct mdev_device *mdev, struct vm_area_struct *vma)
 	pg_prot = vma->vm_page_prot;
 	virtaddr = vma->vm_start;
 	req_size = vma->vm_end - vma->vm_start;
-	pgoff = vgpu_aperture_pa_base(vgpu) >> PAGE_SHIFT;
+	pgoff = vma->vm_pgoff &
+		((1U << (VFIO_PCI_OFFSET_SHIFT - PAGE_SHIFT)) - 1);
+	req_start = pgoff << PAGE_SHIFT;
+
+	if (!intel_vgpu_in_aperture(vgpu, req_start))
+		return -EINVAL;
+	if (req_start + req_size >
+	    vgpu_aperture_offset(vgpu) + vgpu_aperture_sz(vgpu))
+		return -EINVAL;
+
+	pgoff = (gvt_aperture_pa_base(vgpu->gvt) >> PAGE_SHIFT) + pgoff;
 
 	return remap_pfn_range(vma, virtaddr, pgoff, req_size, pg_prot);
 }
@@ -1662,9 +1672,21 @@ static int kvmgt_attach_vgpu(void *vgpu, unsigned long *handle)
 	return 0;
 }
 
-static void kvmgt_detach_vgpu(unsigned long handle)
+static void kvmgt_detach_vgpu(void *p_vgpu)
 {
-	/* nothing to do here */
+	int i;
+	struct intel_vgpu *vgpu = (struct intel_vgpu *)p_vgpu;
+
+	if (!vgpu->vdev.region)
+		return;
+
+	for (i = 0; i < vgpu->vdev.num_regions; i++)
+		if (vgpu->vdev.region[i].ops->release)
+			vgpu->vdev.region[i].ops->release(vgpu,
+					&vgpu->vdev.region[i]);
+	vgpu->vdev.num_regions = 0;
+	kfree(vgpu->vdev.region);
+	vgpu->vdev.region = NULL;
 }
 
 static int kvmgt_inject_msi(unsigned long handle, u32 addr, u16 data)

drivers/gpu/drm/i915/gvt/mpt.h

@@ -101,7 +101,7 @@ static inline void intel_gvt_hypervisor_detach_vgpu(struct intel_vgpu *vgpu)
 	if (!intel_gvt_host.mpt->detach_vgpu)
 		return;
 
-	intel_gvt_host.mpt->detach_vgpu(vgpu->handle);
+	intel_gvt_host.mpt->detach_vgpu(vgpu);
 }
 
 #define MSI_CAP_CONTROL(offset) (offset + 2)