4 files changed, 29 insertions, 6 deletions

diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index b5475c91e2ef..e9f343b124b0 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -2799,6 +2799,7 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
         MMIO_DFH(_MMIO(0xe2a0), D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(_MMIO(0xe2b0), D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(_MMIO(0xe2c0), D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(_MMIO(0x21f0), D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
         return 0;
 }
 
diff --git a/drivers/gpu/drm/i915/gvt/hypercall.h b/drivers/gpu/drm/i915/gvt/hypercall.h
index 5af11cf1b482..e1675a00df12 100644
--- a/drivers/gpu/drm/i915/gvt/hypercall.h
+++ b/drivers/gpu/drm/i915/gvt/hypercall.h
@@ -41,7 +41,7 @@ struct intel_gvt_mpt {
         int (*host_init)(struct device *dev, void *gvt, const void *ops);
         void (*host_exit)(struct device *dev, void *gvt);
         int (*attach_vgpu)(void *vgpu, unsigned long *handle);
-        void (*detach_vgpu)(unsigned long handle);
+        void (*detach_vgpu)(void *vgpu);
         int (*inject_msi)(unsigned long handle, u32 addr, u16 data);
         unsigned long (*from_virt_to_mfn)(void *p);
         int (*enable_page_track)(unsigned long handle, u64 gfn);
diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index c1072143da1d..dd3dfd00f4e6 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -996,7 +996,7 @@ static int intel_vgpu_mmap(struct mdev_device *mdev, struct vm_area_struct *vma)
 {
         unsigned int index;
         u64 virtaddr;
-        unsigned long req_size, pgoff = 0;
+        unsigned long req_size, pgoff, req_start;
         pgprot_t pg_prot;
         struct intel_vgpu *vgpu = mdev_get_drvdata(mdev);
 
@@ -1014,7 +1014,17 @@ static int intel_vgpu_mmap(struct mdev_device *mdev, struct vm_area_struct *vma)
         pg_prot = vma->vm_page_prot;
         virtaddr = vma->vm_start;
         req_size = vma->vm_end - vma->vm_start;
-        pgoff = vgpu_aperture_pa_base(vgpu) >> PAGE_SHIFT;
+        pgoff = vma->vm_pgoff &
+                ((1U << (VFIO_PCI_OFFSET_SHIFT - PAGE_SHIFT)) - 1);
+        req_start = pgoff << PAGE_SHIFT;
+
+        if (!intel_vgpu_in_aperture(vgpu, req_start))
+                return -EINVAL;
+        if (req_start + req_size >
+            vgpu_aperture_offset(vgpu) + vgpu_aperture_sz(vgpu))
+                return -EINVAL;
+
+        pgoff = (gvt_aperture_pa_base(vgpu->gvt) >> PAGE_SHIFT) + pgoff;
 
         return remap_pfn_range(vma, virtaddr, pgoff, req_size, pg_prot);
 }
@@ -1662,9 +1672,21 @@ static int kvmgt_attach_vgpu(void *vgpu, unsigned long *handle)
         return 0;
 }
 
-static void kvmgt_detach_vgpu(unsigned long handle)
+static void kvmgt_detach_vgpu(void *p_vgpu)
 {
-        /* nothing to do here */
+        int i;
+        struct intel_vgpu *vgpu = (struct intel_vgpu *)p_vgpu;
+
+        if (!vgpu->vdev.region)
+                return;
+
+        for (i = 0; i < vgpu->vdev.num_regions; i++)
+                if (vgpu->vdev.region[i].ops->release)
+                        vgpu->vdev.region[i].ops->release(vgpu,
+                                        &vgpu->vdev.region[i]);
+        vgpu->vdev.num_regions = 0;
+        kfree(vgpu->vdev.region);
+        vgpu->vdev.region = NULL;
 }
 
 static int kvmgt_inject_msi(unsigned long handle, u32 addr, u16 data)
diff --git a/drivers/gpu/drm/i915/gvt/mpt.h b/drivers/gpu/drm/i915/gvt/mpt.h
index 67f19992b226..3ed34123d8d1 100644
--- a/drivers/gpu/drm/i915/gvt/mpt.h
+++ b/drivers/gpu/drm/i915/gvt/mpt.h
@@ -101,7 +101,7 @@ static inline void intel_gvt_hypervisor_detach_vgpu(struct intel_vgpu *vgpu)
         if (!intel_gvt_host.mpt->detach_vgpu)
                 return;
 
-        intel_gvt_host.mpt->detach_vgpu(vgpu->handle);
+        intel_gvt_host.mpt->detach_vgpu(vgpu);
 }
 
 #define MSI_CAP_CONTROL(offset) (offset + 2)