drm/i915: Move non-phys cursors into the GTT

Cursors need to be in the GTT domain when being accessed by the GPU.
Previously this was a fortuitous byproduct of userspace using pwrite()
to upload the image data into the cursor. The redundant clflush was
removed in commit 9b8c4a and so the image was no longer being flushed
out of the caches into main memory. One could also devise a scenario
where the cursor was rendered by the GPU, prior to being attached as the
cursor, resulting in similar corruption due to the missing MI_FLUSH.

Fixes:

  Bug 28335 - Cursor corruption caused by commit 9b8c4a0b21
  https://bugs.freedesktop.org/show_bug.cgi?id=28335

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reported-and-tested-by: Jeff Chua <jeff.chua.linux@gmail.com>
Tested-by: Linus Torvalds <torvalds@linux-foundation.org>
Reported-by: Andy Isaacson <adi@hexapodia.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 88a1ab7c05ce819165032c328f694d5024f2830d..04e1bb499ff8019bc2e1f9d9d6864bdb673b8448 100644 (file)
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -3973,6 +3973,13 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
                        DRM_ERROR("failed to pin cursor bo\n");
                        goto fail_locked;
                }
+
+               ret = i915_gem_object_set_to_gtt_domain(bo, 0);
+               if (ret) {
+                       DRM_ERROR("failed to move cursor bo into the GTT\n");
+                       goto fail_unpin;
+               }
+
                addr = obj_priv->gtt_offset;
        } else {
                ret = i915_gem_attach_phys_object(dev, bo, (pipe == 0) ? I915_GEM_PHYS_CURSOR_0 : I915_GEM_PHYS_CURSOR_1);
@@ -4016,6 +4023,8 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
        intel_crtc->cursor_bo = bo;
 
        return 0;
+fail_unpin:
+       i915_gem_object_unpin(bo);
 fail_locked:
        mutex_unlock(&dev->struct_mutex);
 fail: