1. 20 11月, 2020 2 次提交
    • C
      drm/i915/gt: Fixup tgl mocs for PTE tracking · be33805c
      Chris Wilson 提交于
      Forcing mocs:1 [used for our winsys follows-pte mode] to be cached
      caused display glitches. Though it is documented as deprecated (and so
      likely behaves as uncached) use the follow-pte bit and force it out of
      L3 cache.
      
      Testcase: igt/kms_frontbuffer_tracking
      Testcase: igt/kms_big_fb
      Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>
      Cc: Ayaz A Siddiqui <ayaz.siddiqui@intel.com>
      Cc: Lucas De Marchi <lucas.demarchi@intel.com>
      Cc: Matt Roper <matthew.d.roper@intel.com>
      Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
      Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
      Reviewed-by: NVille Syrjälä <ville.syrjala@linux.intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20201015122138.30161-4-chris@chris-wilson.co.uk
      (cherry picked from commit a04ac827)
      Fixes: 849c0fe9 ("drm/i915/gt: Initialize reserved and unspecified MOCS indices")
      Signed-off-by: NRodrigo Vivi <rodrigo.vivi@intel.com>
      [Rodrigo: Updated Fixes tag]
      be33805c
    • T
      drm/vram-helper: Fix use of top-down placement · 01822dd1
      Thomas Zimmermann 提交于
      Commit 7053e0ea ("drm/vram-helper: stop using TTM placement flags")
      cleared the BO placement flags if top-down placement had been selected.
      Hence, BOs that were supposed to go into VRAM are now placed in a default
      location in system memory.
      
      Trying to scanout the incorrectly pinned BO results in displayed garbage
      and an error message.
      
      [  146.108127] ------------[ cut here ]------------
      [  146.1V08180] WARNING: CPU: 0 PID: 152 at drivers/gpu/drm/drm_gem_vram_helper.c:284 drm_gem_vram_offset+0x59/0x60 [drm_vram_helper]
      ...
      [  146.108591]  ast_cursor_page_flip+0x3e/0x150 [ast]
      [  146.108622]  ast_cursor_plane_helper_atomic_update+0x8a/0xc0 [ast]
      [  146.108654]  drm_atomic_helper_commit_planes+0x197/0x4c0
      [  146.108699]  drm_atomic_helper_commit_tail_rpm+0x59/0xa0
      [  146.108718]  commit_tail+0x103/0x1c0
      ...
      [  146.109302] ---[ end trace d901a1ba1d949036 ]---
      
      Fix the bug by keeping the placement flags. The top-down placement flag
      is stored in a separate variable.
      Signed-off-by: NThomas Zimmermann <tzimmermann@suse.de>
      Reviewed-by: NChristian König <christian.koenig@amd.com>
      Fixes: 7053e0ea ("drm/vram-helper: stop using TTM placement flags")
      Reported-by: Pu Wen <puwen@hygon.cn> [for 5.10-rc1]
      Tested-by: NPu Wen <puwen@hygon.cn>
      Cc: Christian König <christian.koenig@amd.com>
      Cc: Dave Airlie <airlied@redhat.com>
      Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
      Cc: Maxime Ripard <mripard@kernel.org>
      Cc: Thomas Zimmermann <tzimmermann@suse.de>
      Cc: David Airlie <airlied@linux.ie>
      Cc: Daniel Vetter <daniel@ffwll.ch>
      Cc: dri-devel@lists.freedesktop.org
      Link: https://patchwork.freedesktop.org/patch/msgid/20200921142536.4392-1-tzimmermann@suse.de
      (cherry picked from commit b8f8dbf6)
      [pulled into fixes from drm-next]
      Signed-off-by: NDave Airlie <airlied@redhat.com>
      01822dd1
  2. 19 11月, 2020 3 次提交
    • C
      drm/i915/gt: Remember to free the virtual breadcrumbs · b4ca4354
      Chris Wilson 提交于
      Since we allocate some breadcrumbs for the virtual engine, and the
      virtual engine has a custom destructor, we also need to free the
      breadcrumbs after use.
      
      Fixes: b3786b29 ("drm/i915/gt: Distinguish the virtual breadcrumbs from the irq breadcrumbs")
      Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>
      Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
      Reviewed-by: NTvrtko Ursulin <tvrtko.ursulin@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20201118133839.1783-1-chris@chris-wilson.co.uk
      (cherry picked from commit 45e50f48)
      Signed-off-by: NRodrigo Vivi <rodrigo.vivi@intel.com>
      b4ca4354
    • V
      drm/i915: Handle max_bpc==16 · d2e3fce9
      Ville Syrjälä 提交于
      EDID can declare the maximum supported bpc up to 16,
      and apparently there are displays that do so. Currently
      we assume 12 bpc is tha max. Fix the assumption and
      toss in a MISSING_CASE() for any other value we don't
      expect to see.
      
      This fixes modesets with a display with EDID max bpc > 12.
      Previously any modeset would just silently fail on platforms
      that didn't otherwise limit this via the max_bpc property.
      In particular we don't add the max_bpc property to HDMI
      ports on gmch platforms, and thus we would see the raw
      max_bpc coming from the EDID.
      
      I suppose we could already adjust this to also allow 16bpc,
      but seeing as no current platform supports that there is
      little point.
      
      Cc: stable@vger.kernel.org
      Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/2632Signed-off-by: NVille Syrjälä <ville.syrjala@linux.intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20201110210447.27454-1-ville.syrjala@linux.intel.comReviewed-by: NJosé Roberto de Souza <jose.souza@intel.com>
      (cherry picked from commit 2ca5a7b8)
      Signed-off-by: NRodrigo Vivi <rodrigo.vivi@intel.com>
      d2e3fce9
    • R
      drm/amd/display: Always get CRTC updated constant values inside commit tail · 2b3af270
      Rodrigo Siqueira 提交于
      We recently improved our display atomic commit and tail sequence to
      avoid some issues related to concurrency. One of the major changes
      consisted of moving the interrupt disable and the stream release from
      our atomic commit to our atomic tail (commit 6d90a208
      ("drm/amd/display: Move disable interrupt into commit tail")) .
      However, the new code introduced inside our commit tail function was
      inserted right after the function
      drm_atomic_helper_update_legacy_modeset_state(), which has routines for
      updating internal data structs related to timestamps. As a result, in
      certain conditions, the display module can reach a situation where we
      update our constants and, after that, clean it. This situation generates
      the following warning:
      
       amdgpu 0000:03:00.0: drm_WARN_ON_ONCE(drm_drv_uses_atomic_modeset(dev))
       WARNING: CPU: 6 PID: 1269 at drivers/gpu/drm/drm_vblank.c:722
       drm_crtc_vblank_helper_get_vblank_timestamp_internal+0x32b/0x340 [drm]
       ...
       RIP:
       0010:drm_crtc_vblank_helper_get_vblank_timestamp_internal+0x32b/0x340
       [drm]
       ...
       Call Trace:
        ? dc_stream_get_vblank_counter+0x57/0x60 [amdgpu]
        drm_crtc_vblank_helper_get_vblank_timestamp+0x1c/0x20 [drm]
        drm_get_last_vbltimestamp+0xad/0xc0 [drm]
        drm_reset_vblank_timestamp+0x63/0xd0 [drm]
        drm_crtc_vblank_on+0x85/0x150 [drm]
        amdgpu_dm_atomic_commit_tail+0xaf1/0x2330 [amdgpu]
        commit_tail+0x99/0x130 [drm_kms_helper]
        drm_atomic_helper_commit+0x123/0x150 [drm_kms_helper]
        amdgpu_dm_atomic_commit+0x11/0x20 [amdgpu]
        drm_atomic_commit+0x4a/0x50 [drm]
        drm_atomic_helper_set_config+0x7c/0xc0 [drm_kms_helper]
        drm_mode_setcrtc+0x20b/0x7e0 [drm]
        ? tomoyo_path_number_perm+0x6f/0x200
        ? drm_mode_getcrtc+0x190/0x190 [drm]
        drm_ioctl_kernel+0xae/0xf0 [drm]
        drm_ioctl+0x245/0x400 [drm]
        ? drm_mode_getcrtc+0x190/0x190 [drm]
        amdgpu_drm_ioctl+0x4e/0x80 [amdgpu]
        __x64_sys_ioctl+0x91/0xc0
        do_syscall_64+0x38/0x90
        entry_SYSCALL_64_after_hwframe+0x44/0xa9
       ...
      
      For fixing this issue we rely upon a refactor introduced on
      drm_atomic_helper_update_legacy_modeset_state ("Remove the timestamping
      constant update from drm_atomic_helper_update_legacy_modeset_state()")
      which decouples constant values update from
      drm_atomic_helper_update_legacy_modeset_state to a new helper.
      Basically, this commit uses this new helper and place it right after our
      release module to avoid a situation where our CRTC struct gets wrong
      values.
      
      Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1373
      Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1349Reviewed-by: NHarry Wentland <harry.wentland@amd.com>
      Signed-off-by: NRodrigo Siqueira <Rodrigo.Siqueira@amd.com>
      Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>
      2b3af270
  3. 18 11月, 2020 2 次提交
  4. 17 11月, 2020 6 次提交
  5. 14 11月, 2020 3 次提交
    • L
      drm/nouveau/kms/nv50-: Use atomic encoder callbacks everywhere · 5c6fb4b2
      Lyude Paul 提交于
      It turns out that I forgot to go through and make sure that I converted all
      encoder callbacks to use atomic_enable/atomic_disable(), so let's go and
      actually do that.
      Signed-off-by: NLyude Paul <lyude@redhat.com>
      Cc: Kirill A. Shutemov <kirill@shutemov.name>
      Fixes: 09838c4e ("drm/nouveau/kms: Search for encoders' connectors properly")
      Signed-off-by: NBen Skeggs <bskeggs@redhat.com>
      5c6fb4b2
    • B
      drm/nouveau/ttm: avoid using nouveau_drm.ttm.type_vram prior to nv50 · 6c27ffab
      Ben Skeggs 提交于
      Pre-NV50 chipsets don't currently use the MMU subsystem that later
      chipsets use, and type_vram is negative here, leading to an OOB memory
      access.
      
      This was previously guarded by a chipset check, restore that.
      Reported-by: NThomas Zimmermann <tzimmermann@suse.de>
      Fixes: 5839172f ("drm/nouveau: explicitly specify caching to use")
      Signed-off-by: NBen Skeggs <bskeggs@redhat.com>
      6c27ffab
    • A
      drm/nouveau/kms: Fix NULL pointer dereference in nouveau_connector_detect_depth · 630f5122
      Alexander Kapshuk 提交于
      This oops manifests itself on the following hardware:
      01:00.0 VGA compatible controller: NVIDIA Corporation G98M [GeForce G 103M] (rev a1)
      
      Oct 09 14:17:46 lp-sasha kernel: BUG: kernel NULL pointer dereference, address: 0000000000000000
      Oct 09 14:17:46 lp-sasha kernel: #PF: supervisor read access in kernel mode
      Oct 09 14:17:46 lp-sasha kernel: #PF: error_code(0x0000) - not-present page
      Oct 09 14:17:46 lp-sasha kernel: PGD 0 P4D 0
      Oct 09 14:17:46 lp-sasha kernel: Oops: 0000 [#1] SMP PTI
      Oct 09 14:17:46 lp-sasha kernel: CPU: 1 PID: 191 Comm: systemd-udevd Not tainted 5.9.0-rc8-next-20201009 #38
      Oct 09 14:17:46 lp-sasha kernel: Hardware name: Hewlett-Packard Compaq Presario CQ61 Notebook PC/306A, BIOS F.03 03/23/2009
      Oct 09 14:17:46 lp-sasha kernel: RIP: 0010:nouveau_connector_detect_depth+0x71/0xc0 [nouveau]
      Oct 09 14:17:46 lp-sasha kernel: Code: 0a 00 00 48 8b 49 48 c7 87 b8 00 00 00 06 00 00 00 80 b9 4d 0a 00 00 00 75 1e 83 fa 41 75 05 48 85 c0 75 29 8b 81 10 0d 00 00 <39> 06 7c 25 f6 81 14 0d 00 00 02 75 b7 c3 80 b9 0c 0d 00 00 00 75
      Oct 09 14:17:46 lp-sasha kernel: RSP: 0018:ffffc9000028f8c0 EFLAGS: 00010297
      Oct 09 14:17:46 lp-sasha kernel: RAX: 0000000000014c08 RBX: ffff8880369d4000 RCX: ffff8880369d3000
      Oct 09 14:17:46 lp-sasha kernel: RDX: 0000000000000040 RSI: 0000000000000000 RDI: ffff8880369d4000
      Oct 09 14:17:46 lp-sasha kernel: RBP: ffff88800601cc00 R08: ffff8880051da298 R09: ffffffff8226201a
      Oct 09 14:17:46 lp-sasha kernel: R10: ffff88800469aa80 R11: ffff888004c84ff8 R12: 0000000000000000
      Oct 09 14:17:46 lp-sasha kernel: R13: ffff8880051da000 R14: 0000000000002000 R15: 0000000000000003
      Oct 09 14:17:46 lp-sasha kernel: FS:  00007fd0192b3440(0000) GS:ffff8880bc900000(0000) knlGS:0000000000000000
      Oct 09 14:17:46 lp-sasha kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      Oct 09 14:17:46 lp-sasha kernel: CR2: 0000000000000000 CR3: 0000000004976000 CR4: 00000000000006e0
      Oct 09 14:17:46 lp-sasha kernel: Call Trace:
      Oct 09 14:17:46 lp-sasha kernel:  nouveau_connector_get_modes+0x1e6/0x240 [nouveau]
      Oct 09 14:17:46 lp-sasha kernel:  ? kfree+0xb9/0x240
      Oct 09 14:17:46 lp-sasha kernel:  ? drm_connector_list_iter_next+0x7c/0xa0
      Oct 09 14:17:46 lp-sasha kernel:  drm_helper_probe_single_connector_modes+0x1ba/0x7c0
      Oct 09 14:17:46 lp-sasha kernel:  drm_client_modeset_probe+0x27e/0x1360
      Oct 09 14:17:46 lp-sasha kernel:  ? nvif_object_sclass_put+0xc/0x20 [nouveau]
      Oct 09 14:17:46 lp-sasha kernel:  ? nouveau_cli_init+0x3cc/0x440 [nouveau]
      Oct 09 14:17:46 lp-sasha kernel:  ? ktime_get_mono_fast_ns+0x49/0xa0
      Oct 09 14:17:46 lp-sasha kernel:  ? nouveau_drm_open+0x4e/0x180 [nouveau]
      Oct 09 14:17:46 lp-sasha kernel:  __drm_fb_helper_initial_config_and_unlock+0x3f/0x4a0
      Oct 09 14:17:46 lp-sasha kernel:  ? drm_file_alloc+0x18f/0x260
      Oct 09 14:17:46 lp-sasha kernel:  ? mutex_lock+0x9/0x40
      Oct 09 14:17:46 lp-sasha kernel:  ? drm_client_init+0x110/0x160
      Oct 09 14:17:46 lp-sasha kernel:  nouveau_fbcon_init+0x14d/0x1c0 [nouveau]
      Oct 09 14:17:46 lp-sasha kernel:  nouveau_drm_device_init+0x1c0/0x880 [nouveau]
      Oct 09 14:17:46 lp-sasha kernel:  nouveau_drm_probe+0x11a/0x1e0 [nouveau]
      Oct 09 14:17:46 lp-sasha kernel:  pci_device_probe+0xcd/0x140
      Oct 09 14:17:46 lp-sasha kernel:  really_probe+0xd8/0x400
      Oct 09 14:17:46 lp-sasha kernel:  driver_probe_device+0x4a/0xa0
      Oct 09 14:17:46 lp-sasha kernel:  device_driver_attach+0x9c/0xc0
      Oct 09 14:17:46 lp-sasha kernel:  __driver_attach+0x6f/0x100
      Oct 09 14:17:46 lp-sasha kernel:  ? device_driver_attach+0xc0/0xc0
      Oct 09 14:17:46 lp-sasha kernel:  bus_for_each_dev+0x75/0xc0
      Oct 09 14:17:46 lp-sasha kernel:  bus_add_driver+0x106/0x1c0
      Oct 09 14:17:46 lp-sasha kernel:  driver_register+0x86/0xe0
      Oct 09 14:17:46 lp-sasha kernel:  ? 0xffffffffa044e000
      Oct 09 14:17:46 lp-sasha kernel:  do_one_initcall+0x48/0x1e0
      Oct 09 14:17:46 lp-sasha kernel:  ? _cond_resched+0x11/0x60
      Oct 09 14:17:46 lp-sasha kernel:  ? kmem_cache_alloc_trace+0x19c/0x1e0
      Oct 09 14:17:46 lp-sasha kernel:  do_init_module+0x57/0x220
      Oct 09 14:17:46 lp-sasha kernel:  __do_sys_finit_module+0xa0/0xe0
      Oct 09 14:17:46 lp-sasha kernel:  do_syscall_64+0x33/0x40
      Oct 09 14:17:46 lp-sasha kernel:  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      Oct 09 14:17:46 lp-sasha kernel: RIP: 0033:0x7fd01a060d5d
      Oct 09 14:17:46 lp-sasha kernel: Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e3 70 0c 00 f7 d8 64 89 01 48
      Oct 09 14:17:46 lp-sasha kernel: RSP: 002b:00007ffc8ad38a98 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
      Oct 09 14:17:46 lp-sasha kernel: RAX: ffffffffffffffda RBX: 0000563f6e7fd530 RCX: 00007fd01a060d5d
      Oct 09 14:17:46 lp-sasha kernel: RDX: 0000000000000000 RSI: 00007fd01a19f95d RDI: 000000000000000f
      Oct 09 14:17:46 lp-sasha kernel: RBP: 0000000000020000 R08: 0000000000000000 R09: 0000000000000007
      Oct 09 14:17:46 lp-sasha kernel: R10: 000000000000000f R11: 0000000000000246 R12: 00007fd01a19f95d
      Oct 09 14:17:46 lp-sasha kernel: R13: 0000000000000000 R14: 0000563f6e7fbc10 R15: 0000563f6e7fd530
      Oct 09 14:17:46 lp-sasha kernel: Modules linked in: nouveau(+) ttm xt_string xt_mark xt_LOG vgem v4l2_dv_timings uvcvideo ulpi udf ts_kmp ts_fsm ts_bm snd_aloop sil164 qat_dh895xccvf nf_nat_sip nf_nat_irc nf_nat_ftp nf_nat nf_log_ipv6 nf_log_ipv4 nf_log_common ltc2990 lcd intel_qat input_leds i2c_mux gspca_main videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common videodev mc drivetemp cuse fuse crc_itu_t coretemp ch7006 ath5k ath algif_hash
      Oct 09 14:17:46 lp-sasha kernel: CR2: 0000000000000000
      Oct 09 14:17:46 lp-sasha kernel: ---[ end trace 0ddafe218ad30017 ]---
      Oct 09 14:17:46 lp-sasha kernel: RIP: 0010:nouveau_connector_detect_depth+0x71/0xc0 [nouveau]
      Oct 09 14:17:46 lp-sasha kernel: Code: 0a 00 00 48 8b 49 48 c7 87 b8 00 00 00 06 00 00 00 80 b9 4d 0a 00 00 00 75 1e 83 fa 41 75 05 48 85 c0 75 29 8b 81 10 0d 00 00 <39> 06 7c 25 f6 81 14 0d 00 00 02 75 b7 c3 80 b9 0c 0d 00 00 00 75
      Oct 09 14:17:46 lp-sasha kernel: RSP: 0018:ffffc9000028f8c0 EFLAGS: 00010297
      Oct 09 14:17:46 lp-sasha kernel: RAX: 0000000000014c08 RBX: ffff8880369d4000 RCX: ffff8880369d3000
      Oct 09 14:17:46 lp-sasha kernel: RDX: 0000000000000040 RSI: 0000000000000000 RDI: ffff8880369d4000
      Oct 09 14:17:46 lp-sasha kernel: RBP: ffff88800601cc00 R08: ffff8880051da298 R09: ffffffff8226201a
      Oct 09 14:17:46 lp-sasha kernel: R10: ffff88800469aa80 R11: ffff888004c84ff8 R12: 0000000000000000
      Oct 09 14:17:46 lp-sasha kernel: R13: ffff8880051da000 R14: 0000000000002000 R15: 0000000000000003
      Oct 09 14:17:46 lp-sasha kernel: FS:  00007fd0192b3440(0000) GS:ffff8880bc900000(0000) knlGS:0000000000000000
      Oct 09 14:17:46 lp-sasha kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      Oct 09 14:17:46 lp-sasha kernel: CR2: 0000000000000000 CR3: 0000000004976000 CR4: 00000000000006e0
      
      The disassembly:
      Code: 0a 00 00 48 8b 49 48 c7 87 b8 00 00 00 06 00 00 00 80 b9 4d 0a 00 00 00 75 1e 83 fa 41 75 05 48 85 c0 75 29 8b 81 10 0d 00 00 <39> 06 7c 25 f6 81 14 0d 00 00 02 75 b7 c3 80 b9 0c 0d 00 00 00 75
      All code
      ========
         0:   0a 00                   or     (%rax),%al
         2:   00 48 8b                add    %cl,-0x75(%rax)
         5:   49                      rex.WB
         6:   48 c7 87 b8 00 00 00    movq   $0x6,0xb8(%rdi)
         d:   06 00 00 00
        11:   80 b9 4d 0a 00 00 00    cmpb   $0x0,0xa4d(%rcx)
        18:   75 1e                   jne    0x38
        1a:   83 fa 41                cmp    $0x41,%edx
        1d:   75 05                   jne    0x24
        1f:   48 85 c0                test   %rax,%rax
        22:   75 29                   jne    0x4d
        24:   8b 81 10 0d 00 00       mov    0xd10(%rcx),%eax
        2a:*  39 06                   cmp    %eax,(%rsi)              <-- trapping instruction
        2c:   7c 25                   jl     0x53
        2e:   f6 81 14 0d 00 00 02    testb  $0x2,0xd14(%rcx)
        35:   75 b7                   jne    0xffffffffffffffee
        37:   c3                      retq
        38:   80 b9 0c 0d 00 00 00    cmpb   $0x0,0xd0c(%rcx)
        3f:   75                      .byte 0x75
      
      Code starting with the faulting instruction
      ===========================================
         0:   39 06                   cmp    %eax,(%rsi)
         2:   7c 25                   jl     0x29
         4:   f6 81 14 0d 00 00 02    testb  $0x2,0xd14(%rcx)
         b:   75 b7                   jne    0xffffffffffffffc4
         d:   c3                      retq
         e:   80 b9 0c 0d 00 00 00    cmpb   $0x0,0xd0c(%rcx)
        15:   75                      .byte 0x75
      
      objdump -SF --disassemble=nouveau_connector_detect_depth
      [...]
              if (nv_connector->edid &&
         c85e1:       83 fa 41                cmp    $0x41,%edx
         c85e4:       75 05                   jne    c85eb <nouveau_connector_detect_depth+0x6b> (File Offset: 0xc866b)
         c85e6:       48 85 c0                test   %rax,%rax
         c85e9:       75 29                   jne    c8614 <nouveau_connector_detect_depth+0x94> (File Offset: 0xc8694)
                  nv_connector->type == DCB_CONNECTOR_LVDS_SPWG)
                      duallink = ((u8 *)nv_connector->edid)[121] == 2;
              else
                      duallink = mode->clock >= bios->fp.duallink_transition_clk;
      
              if ((!duallink && (bios->fp.strapless_is_24bit & 1)) ||
         c85eb:       8b 81 10 0d 00 00       mov    0xd10(%rcx),%eax
         c85f1:       39 06                   cmp    %eax,(%rsi)
         c85f3:       7c 25                   jl     c861a <nouveau_connector_detect_depth+0x9a> (File Offset: 0xc869a)
                  ( duallink && (bios->fp.strapless_is_24bit & 2)))
         c85f5:       f6 81 14 0d 00 00 02    testb  $0x2,0xd14(%rcx)
         c85fc:       75 b7                   jne    c85b5 <nouveau_connector_detect_depth+0x35> (File Offset: 0xc8635)
                      connector->display_info.bpc = 8;
      [...]
      
      % scripts/faddr2line /lib/modules/5.9.0-rc8-next-20201009/kernel/drivers/gpu/drm/nouveau/nouveau.ko nouveau_connector_detect_depth+0x71/0xc0
      nouveau_connector_detect_depth+0x71/0xc0:
      nouveau_connector_detect_depth at /home/sasha/linux-next/drivers/gpu/drm/nouveau/nouveau_connector.c:891
      
      It is actually line 889. See the disassembly below.
      889                     duallink = mode->clock >= bios->fp.duallink_transition_clk;
      
      The NULL pointer being dereferenced is mode.
      
      Git bisect has identified the following commit as bad:
      f28e32d3 drm/nouveau/kms: Don't change EDID when it hasn't actually changed
      
      Here is the chain of events that causes the oops.
      On entry to nouveau_connector_detect_lvds, edid is set to NULL.  The call
      to nouveau_connector_detect sets nv_connector->edid to valid memory,
      with status set to connector_status_connected and the flow of execution
      branching to the out label.
      
      The subsequent call to nouveau_connector_set_edid erronously clears
      nv_connector->edid, via the local edid pointer which remains set to NULL.
      
      Fix this by setting edid to the value of the just acquired
      nv_connector->edid and executing the body of nouveau_connector_set_edid
      only if nv_connector->edid and edid point to different memory addresses
      thus preventing nv_connector->edid from being turned into a dangling
      pointer.
      
      Fixes: f28e32d3 ("drm/nouveau/kms: Don't change EDID when it hasn't actually changed")
      Signed-off-by: NAlexander Kapshuk <alexander.kapshuk@gmail.com>
      Reviewed-by: NLyude Paul <lyude@redhat.com>
      Signed-off-by: NBen Skeggs <bskeggs@redhat.com>
      630f5122
  6. 13 11月, 2020 7 次提交
  7. 12 11月, 2020 1 次提交
  8. 11 11月, 2020 1 次提交
  9. 10 11月, 2020 1 次提交
  10. 09 11月, 2020 1 次提交
    • T
      drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[] · 06ad8d33
      Thomas Zimmermann 提交于
      The gma500 driver expects 3 pipelines in several it's IRQ functions.
      Accessing struct drm_device.vblank[], this fails with devices that only
      have 2 pipelines. An example KASAN report is shown below.
      
        [   62.267688] ==================================================================
        [   62.268856] BUG: KASAN: slab-out-of-bounds in psb_irq_postinstall+0x250/0x3c0 [gma500_gfx]
        [   62.269450] Read of size 1 at addr ffff8880012bc6d0 by task systemd-udevd/285
        [   62.269949]
        [   62.270192] CPU: 0 PID: 285 Comm: systemd-udevd Tainted: G            E     5.10.0-rc1-1-default+ #572
        [   62.270807] Hardware name:  /DN2800MT, BIOS MTCDT10N.86A.0164.2012.1213.1024 12/13/2012
        [   62.271366] Call Trace:
        [   62.271705]  dump_stack+0xae/0xe5
        [   62.272180]  print_address_description.constprop.0+0x17/0xf0
        [   62.272987]  ? psb_irq_postinstall+0x250/0x3c0 [gma500_gfx]
        [   62.273474]  __kasan_report.cold+0x20/0x38
        [   62.273989]  ? psb_irq_postinstall+0x250/0x3c0 [gma500_gfx]
        [   62.274460]  kasan_report+0x3a/0x50
        [   62.274891]  psb_irq_postinstall+0x250/0x3c0 [gma500_gfx]
        [   62.275380]  drm_irq_install+0x131/0x1f0
        <...>
        [   62.300751] Allocated by task 285:
        [   62.301223]  kasan_save_stack+0x1b/0x40
        [   62.301731]  __kasan_kmalloc.constprop.0+0xbf/0xd0
        [   62.302293]  drmm_kmalloc+0x55/0x100
        [   62.302773]  drm_vblank_init+0x77/0x210
      
      Resolve the issue by only handling vblank entries up to the number of
      CRTCs.
      
      I'm adding a Fixes tag for reference, although the bug has been present
      since the driver's initial commit.
      Signed-off-by: NThomas Zimmermann <tzimmermann@suse.de>
      Reviewed-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
      Fixes: 5c49fd3a ("gma500: Add the core DRM files and headers")
      Cc: Alan Cox <alan@linux.intel.com>
      Cc: Dave Airlie <airlied@redhat.com>
      Cc: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
      Cc: dri-devel@lists.freedesktop.org
      Cc: stable@vger.kernel.org#v3.3+
      Link: https://patchwork.freedesktop.org/patch/msgid/20201105190256.3893-1-tzimmermann@suse.de
      06ad8d33
  11. 08 11月, 2020 1 次提交
  12. 06 11月, 2020 1 次提交
  13. 04 11月, 2020 11 次提交