1. 20 7月, 2018 2 次提交
  2. 19 7月, 2018 1 次提交
    • B
      drm/nouveau/fb/gp100-: disable address remapper · 2f958e82
      Ben Skeggs 提交于
      This was causing problems on a system with a large amount of RAM, where
      display push buffers were being fetched incorrectly when placed in high
      system memory addresses.
      
      While this commit will resolve the issue on that particular system, the
      issue will be avoided completely with another patch to more fully solve
      problems with display and large amounts of system memory on Pascal.
      
      It's still probably a good idea to disable this to prevent weird issues
      in the future.
      Signed-off-by: NBen Skeggs <bskeggs@redhat.com>
      2f958e82
  3. 18 7月, 2018 4 次提交
  4. 16 7月, 2018 13 次提交
    • L
      drm/nouveau: Set DRIVER_ATOMIC cap earlier to fix debugfs · eb493fbc
      Lyude Paul 提交于
      Currently nouveau doesn't actually expose the state debugfs file that's
      usually provided for any modesetting driver that supports atomic, even
      if nouveau is loaded with atomic=1. This is due to the fact that the
      standard debugfs files that DRM creates for atomic drivers is called
      when drm_get_pci_dev() is called from nouveau_drm.c. This happens well
      before we've initialized the display core, which is currently
      responsible for setting the DRIVER_ATOMIC cap.
      
      So, move the atomic option into nouveau_drm.c and just add the
      DRIVER_ATOMIC cap whenever it's enabled on the kernel commandline. This
      shouldn't cause any actual issues, as the atomic ioctl will still fail
      as expected even if the display core doesn't disable it until later in
      the init sequence. This also provides the added benefit of being able to
      use the state debugfs file to check the current display state even if
      clients aren't allowed to modify it through anything other than the
      legacy ioctls.
      
      Additionally, disable the DRIVER_ATOMIC cap in nv04's display core, as
      this was already disabled there previously.
      Signed-off-by: NLyude Paul <lyude@redhat.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: NBen Skeggs <bskeggs@redhat.com>
      eb493fbc
    • L
      drm/nouveau: Remove bogus crtc check in pmops_runtime_idle · 68fe23a6
      Lyude Paul 提交于
      This both uses the legacy modesetting structures in a racy manner, and
      additionally also doesn't even check the right variable (enabled != the
      CRTC is actually turned on for atomic).
      
      This fixes issues on my P50 regarding the dedicated GPU not entering
      runtime suspend.
      Signed-off-by: NLyude Paul <lyude@redhat.com>
      Cc: stable@vger.kernel.org
      Reviewed-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
      Signed-off-by: NBen Skeggs <bskeggs@redhat.com>
      68fe23a6
    • L
      drm/nouveau/drm/nouveau: Fix runtime PM leak in nv50_disp_atomic_commit() · e5d54f19
      Lyude Paul 提交于
      A CRTC being enabled doesn't mean it's on! It doesn't even necessarily
      mean it's being used. This fixes runtime PM leaks on the P50 I've got
      next to me.
      Signed-off-by: NLyude Paul <lyude@redhat.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: NBen Skeggs <bskeggs@redhat.com>
      e5d54f19
    • L
      drm/nouveau: Avoid looping through fake MST connectors · 37afe55b
      Lyude Paul 提交于
      When MST and atomic were introduced to nouveau, another structure that
      could contain a drm_connector embedded within it was introduced; struct
      nv50_mstc. This meant that we no longer would be able to simply loop
      through our connector list and assume that nouveau_connector() would
      return a proper pointer for each connector, since the assertion that
      all connectors coming from nouveau have a full nouveau_connector struct
      became invalid.
      
      Unfortunately, none of the actual code that looped through connectors
      ever got updated, which means that we've been causing invalid memory
      accesses for quite a while now.
      
      An example that was caught by KASAN:
      
      [  201.038698] ==================================================================
      [  201.038792] BUG: KASAN: slab-out-of-bounds in nvif_notify_get+0x190/0x1a0 [nouveau]
      [  201.038797] Read of size 4 at addr ffff88076738c650 by task kworker/0:3/718
      [  201.038800]
      [  201.038822] CPU: 0 PID: 718 Comm: kworker/0:3 Tainted: G           O      4.18.0-rc4Lyude-Test+ #1
      [  201.038825] Hardware name: LENOVO 20EQS64N0B/20EQS64N0B, BIOS N1EET78W (1.51 ) 05/18/2018
      [  201.038882] Workqueue: events nouveau_display_hpd_work [nouveau]
      [  201.038887] Call Trace:
      [  201.038894]  dump_stack+0xa4/0xfd
      [  201.038900]  print_address_description+0x71/0x239
      [  201.038929]  ? nvif_notify_get+0x190/0x1a0 [nouveau]
      [  201.038935]  kasan_report.cold.6+0x242/0x2fe
      [  201.038942]  __asan_report_load4_noabort+0x19/0x20
      [  201.038970]  nvif_notify_get+0x190/0x1a0 [nouveau]
      [  201.038998]  ? nvif_notify_put+0x1f0/0x1f0 [nouveau]
      [  201.039003]  ? kmsg_dump_rewind_nolock+0xe4/0xe4
      [  201.039049]  nouveau_display_init.cold.12+0x34/0x39 [nouveau]
      [  201.039089]  ? nouveau_user_framebuffer_create+0x120/0x120 [nouveau]
      [  201.039133]  nouveau_display_resume+0x5c0/0x810 [nouveau]
      [  201.039173]  ? nvkm_client_ioctl+0x20/0x20 [nouveau]
      [  201.039215]  nouveau_do_resume+0x19f/0x570 [nouveau]
      [  201.039256]  nouveau_pmops_runtime_resume+0xd8/0x2a0 [nouveau]
      [  201.039264]  pci_pm_runtime_resume+0x130/0x250
      [  201.039269]  ? pci_restore_standard_config+0x70/0x70
      [  201.039275]  __rpm_callback+0x1f2/0x5d0
      [  201.039279]  ? rpm_resume+0x560/0x18a0
      [  201.039283]  ? pci_restore_standard_config+0x70/0x70
      [  201.039287]  ? pci_restore_standard_config+0x70/0x70
      [  201.039291]  ? pci_restore_standard_config+0x70/0x70
      [  201.039296]  rpm_callback+0x175/0x210
      [  201.039300]  ? pci_restore_standard_config+0x70/0x70
      [  201.039305]  rpm_resume+0xcc3/0x18a0
      [  201.039312]  ? rpm_callback+0x210/0x210
      [  201.039317]  ? __pm_runtime_resume+0x9e/0x100
      [  201.039322]  ? kasan_check_write+0x14/0x20
      [  201.039326]  ? do_raw_spin_lock+0xc2/0x1c0
      [  201.039333]  __pm_runtime_resume+0xac/0x100
      [  201.039374]  nouveau_display_hpd_work+0x67/0x1f0 [nouveau]
      [  201.039380]  process_one_work+0x7a0/0x14d0
      [  201.039388]  ? cancel_delayed_work_sync+0x20/0x20
      [  201.039392]  ? lock_acquire+0x113/0x310
      [  201.039398]  ? kasan_check_write+0x14/0x20
      [  201.039402]  ? do_raw_spin_lock+0xc2/0x1c0
      [  201.039409]  worker_thread+0x86/0xb50
      [  201.039418]  kthread+0x2e9/0x3a0
      [  201.039422]  ? process_one_work+0x14d0/0x14d0
      [  201.039426]  ? kthread_create_worker_on_cpu+0xc0/0xc0
      [  201.039431]  ret_from_fork+0x3a/0x50
      [  201.039441]
      [  201.039444] Allocated by task 79:
      [  201.039449]  save_stack+0x43/0xd0
      [  201.039452]  kasan_kmalloc+0xc4/0xe0
      [  201.039456]  kmem_cache_alloc_trace+0x10a/0x260
      [  201.039494]  nv50_mstm_add_connector+0x9a/0x340 [nouveau]
      [  201.039504]  drm_dp_add_port+0xff5/0x1fc0 [drm_kms_helper]
      [  201.039511]  drm_dp_send_link_address+0x4a7/0x740 [drm_kms_helper]
      [  201.039518]  drm_dp_check_and_send_link_address+0x1a7/0x210 [drm_kms_helper]
      [  201.039525]  drm_dp_mst_link_probe_work+0x71/0xb0 [drm_kms_helper]
      [  201.039529]  process_one_work+0x7a0/0x14d0
      [  201.039533]  worker_thread+0x86/0xb50
      [  201.039537]  kthread+0x2e9/0x3a0
      [  201.039541]  ret_from_fork+0x3a/0x50
      [  201.039543]
      [  201.039546] Freed by task 0:
      [  201.039549] (stack is not available)
      [  201.039551]
      [  201.039555] The buggy address belongs to the object at ffff88076738c1a8
                                       which belongs to the cache kmalloc-2048 of size 2048
      [  201.039559] The buggy address is located 1192 bytes inside of
                                       2048-byte region [ffff88076738c1a8, ffff88076738c9a8)
      [  201.039563] The buggy address belongs to the page:
      [  201.039567] page:ffffea001d9ce200 count:1 mapcount:0 mapping:ffff88084000d0c0 index:0x0 compound_mapcount: 0
      [  201.039573] flags: 0x8000000000008100(slab|head)
      [  201.039578] raw: 8000000000008100 ffffea001da3be08 ffffea001da25a08 ffff88084000d0c0
      [  201.039582] raw: 0000000000000000 00000000000d000d 00000001ffffffff 0000000000000000
      [  201.039585] page dumped because: kasan: bad access detected
      [  201.039588]
      [  201.039591] Memory state around the buggy address:
      [  201.039594]  ffff88076738c500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      [  201.039598]  ffff88076738c580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      [  201.039601] >ffff88076738c600: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc
      [  201.039604]                                                  ^
      [  201.039607]  ffff88076738c680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      [  201.039611]  ffff88076738c700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      [  201.039613] ==================================================================
      Signed-off-by: NLyude Paul <lyude@redhat.com>
      Cc: stable@vger.kernel.org
      Cc: Karol Herbst <karolherbst@gmail.com>
      Signed-off-by: NBen Skeggs <bskeggs@redhat.com>
      37afe55b
    • L
      drm/nouveau: Use drm_connector_list_iter_* for iterating connectors · 22b76bbe
      Lyude Paul 提交于
      Every codepath in nouveau that loops through the connector list
      currently does so using the old method, which is prone to race
      conditions from MST connectors being created and destroyed. This has
      been causing a multitude of problems, including memory corruption from
      trying to access connectors that have already been freed!
      Signed-off-by: NLyude Paul <lyude@redhat.com>
      Cc: stable@vger.kernel.org
      Cc: Karol Herbst <karolherbst@gmail.com>
      Signed-off-by: NBen Skeggs <bskeggs@redhat.com>
      22b76bbe
    • D
      drm/nouveau/gem: off by one bugs in nouveau_gem_pushbuf_reloc_apply() · 7f073d01
      Dan Carpenter 提交于
      The bo array has req->nr_buffers elements so the > should be >= so we
      don't read beyond the end of the array.
      
      Fixes: a1606a95 ("drm/nouveau: new gem pushbuf interface, bump to 0.0.16")
      Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: NBen Skeggs <bskeggs@redhat.com>
      7f073d01
    • B
      drm/nouveau/kms/nv50-: ensure window updates are submitted when flushing mst disables · df0c97e2
      Ben Skeggs 提交于
      It was possible for this to be skipped when shutting down MST streams, and
      leaving the core channel interlocked with a wndw channel update that never
      happens - leading to a hung display.
      Signed-off-by: NBen Skeggs <bskeggs@redhat.com>
      Tested-By: NLyude Paul <lyude@redhat.com>
      df0c97e2
    • D
      Merge tag 'drm-intel-fixes-2018-07-12' of... · bf642e3a
      Dave Airlie 提交于
      Merge tag 'drm-intel-fixes-2018-07-12' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes
      
      I already pulled the first fix, pull the GVT fixes.
      
      - GVT fix for KBL vGPU hang to update virtual register from LRI.
      Signed-off-by: NDave Airlie <airlied@redhat.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20180713070922.GA19840@intel.com
      bf642e3a
    • D
    • D
      Merge tag 'drm-misc-fixes-2018-07-13' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes · 99018753
      Dave Airlie 提交于
      Fixes for v4.18-rc5:
      - Single fix for a build error when the driver is builtin,
        but the backend is a loadable module.
      Signed-off-by: NDave Airlie <airlied@redhat.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/9c596cf5-3f24-070e-74f2-c59bfbaf68fa@linux.intel.com
      99018753
    • D
      Merge tag 'drm/tegra/for-4.18-rc5' of git://anongit.freedesktop.org/tegra/linux into drm-fixes · 2757de4c
      Dave Airlie 提交于
      drm/tegra: Fixes for v4.18-rc5
      
      This contains a couple of one- or two-line fixes for various minor
      issues in the Tegra driver.
      Signed-off-by: NDave Airlie <airlied@redhat.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20180712070142.15571-1-thierry.reding@gmail.com
      2757de4c
    • D
      Merge branch 'drm-fixes-4.18' of git://people.freedesktop.org/~agd5f/linux into drm-fixes · e2800577
      Dave Airlie 提交于
      A few display and GPUVM fixes for 4.18.
      
      A few more fixes for 4.18. Two display fixes and a fix to avoid a segfault if
      the GPU does not power up properly on resume.  These are on top of my pull
      from earlier this week.
      Signed-off-by: NDave Airlie <airlied@redhat.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20180712043820.2877-1-alexander.deucher@amd.com
      e2800577
    • D
      Merge tag 'drm-intel-fixes-2018-07-10' of... · f88147e4
      Dave Airlie 提交于
      Merge tag 'drm-intel-fixes-2018-07-10' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes
      
      - Fix hotplug irq ack on i965/g4x (Ville)
      Signed-off-by: NDave Airlie <airlied@redhat.com>
      
      Link: https://patchwork.freedesktop.org/patch/msgid/20180710213249.GA16479@intel.com
      f88147e4
  5. 14 7月, 2018 1 次提交
  6. 12 7月, 2018 3 次提交
  7. 11 7月, 2018 4 次提交
  8. 10 7月, 2018 5 次提交
  9. 09 7月, 2018 7 次提交