drm/i915: Move non-phys cursors into the GTT

Cursors need to be in the GTT domain when being accessed by the GPU.
Previously this was a fortuitous byproduct of userspace using pwrite()
to upload the image data into the cursor. The redundant clflush was
removed in commit 9b8c4a and so the image was no longer being flushed
out of the caches into main memory. One could also devise a scenario
where the cursor was rendered by the GPU, prior to being attached as the
cursor, resulting in similar corruption due to the missing MI_FLUSH.

Fixes:

  Bug 28335 - Cursor corruption caused by commit 9b8c4a0b21
  https://bugs.freedesktop.org/show_bug.cgi?id=28335

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reported-and-tested-by: Jeff Chua <jeff.chua.linux@gmail.com>
Tested-by: Linus Torvalds <torvalds@linux-foundation.org>
Reported-by: Andy Isaacson <adi@hexapodia.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 9 insertions, 0 deletions

diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 88a1ab7c05ce..04e1bb499ff8 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -3973,6 +3973,13 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
                         DRM_ERROR("failed to pin cursor bo\n");
                         goto fail_locked;
                 }
+
+                ret = i915_gem_object_set_to_gtt_domain(bo, 0);
+                if (ret) {
+                        DRM_ERROR("failed to move cursor bo into the GTT\n");
+                        goto fail_unpin;
+                }
+
                 addr = obj_priv->gtt_offset;
         } else {
                 ret = i915_gem_attach_phys_object(dev, bo, (pipe == 0) ? I915_GEM_PHYS_CURSOR_0 : I915_GEM_PHYS_CURSOR_1);
@@ -4016,6 +4023,8 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
         intel_crtc->cursor_bo = bo;
 
         return 0;
+fail_unpin:
+        i915_gem_object_unpin(bo);
 fail_locked:
         mutex_unlock(&dev->struct_mutex);
 fail: