1. 18 8月, 2020 23 次提交
  2. 15 7月, 2020 3 次提交
    • V
      drm/i915: Recalculate FBC w/a stride when needed · 92e0575b
      Ville Syrjälä 提交于
      Currently we're failing to recalculate the gen9 FBC w/a stride
      unless something more drastic than just the modifier itself has
      changed. This often leaves us with FBC enabled with the linear
      fbdev framebuffer without the w/a stride enabled. That will cause
      an immediate underrun and FBC will get promptly disabled.
      
      Fix the problem by checking if the w/a stride is about to change,
      and go through the full dance if so. This part of the FBC code
      is still pretty much a disaster and will need lots more work.
      But this should at least fix the immediate issue.
      
      v2: Deactivate FBC when the modifier changes since that will
          likely require resetting the w/a CFB stride
      
      Cc: stable@vger.kernel.org
      Signed-off-by: NVille Syrjälä <ville.syrjala@linux.intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200711080336.13423-1-ville.syrjala@linux.intel.comReviewed-by: NJosé Roberto de Souza <jose.souza@intel.com>
      (cherry picked from commit 0428ab01)
      Signed-off-by: NJani Nikula <jani.nikula@intel.com>
      92e0575b
    • M
      drm/i915: Move cec_notifier to intel_hdmi_connector_unregister, v2. · 6647e6cd
      Maarten Lankhorst 提交于
      This fixes the following KASAN splash on module reload:
      [  145.136327] ==================================================================
      [  145.136502] BUG: KASAN: use-after-free in intel_hdmi_destroy+0x74/0x80 [i915]
      [  145.136514] Read of size 8 at addr ffff888216641830 by task kworker/1:1/134
      
      [  145.136535] CPU: 1 PID: 134 Comm: kworker/1:1 Tainted: G     U          T 5.5.0-rc7-valkyria+ #5783
      [  145.136539] Hardware name: GIGABYTE GB-BKi3A-7100/MFLP3AP-00, BIOS F1 07/27/2016
      [  145.136546] Workqueue: events drm_connector_free_work_fn
      [  145.136551] Call Trace:
      [  145.136560]  dump_stack+0xa1/0xe0
      [  145.136571]  print_address_description.constprop.0+0x1e/0x210
      [  145.136639]  ? intel_hdmi_destroy+0x74/0x80 [i915]
      [  145.136703]  ? intel_hdmi_destroy+0x74/0x80 [i915]
      [  145.136710]  __kasan_report.cold+0x1b/0x37
      [  145.136790]  ? intel_hdmi_destroy+0x74/0x80 [i915]
      [  145.136863]  ? intel_hdmi_destroy+0x74/0x80 [i915]
      [  145.136870]  kasan_report+0x27/0x30
      [  145.136881]  __asan_report_load8_noabort+0x1c/0x20
      [  145.136946]  intel_hdmi_destroy+0x74/0x80 [i915]
      [  145.136954]  drm_connector_free_work_fn+0xd1/0x100
      [  145.136967]  process_one_work+0x86e/0x1610
      [  145.136987]  ? pwq_dec_nr_in_flight+0x2f0/0x2f0
      [  145.137004]  ? move_linked_works+0x128/0x2c0
      [  145.137021]  worker_thread+0x63e/0xc90
      [  145.137048]  kthread+0x2f6/0x3f0
      [  145.137054]  ? calculate_sigpending+0x81/0xa0
      [  145.137059]  ? process_one_work+0x1610/0x1610
      [  145.137064]  ? kthread_bind+0x40/0x40
      [  145.137075]  ret_from_fork+0x24/0x30
      
      [  145.137111] Allocated by task 0:
      [  145.137119] (stack is not available)
      
      [  145.137137] Freed by task 5053:
      [  145.137147]  save_stack+0x28/0x90
      [  145.137152]  __kasan_slab_free+0x136/0x180
      [  145.137157]  kasan_slab_free+0x26/0x30
      [  145.137161]  kfree+0xe6/0x350
      [  145.137242]  intel_ddi_encoder_destroy+0x60/0x80 [i915]
      [  145.137252]  drm_mode_config_cleanup+0x11d/0x8f0
      [  145.137329]  intel_modeset_driver_remove+0x1f5/0x350 [i915]
      [  145.137403]  i915_driver_remove+0xc4/0x130 [i915]
      [  145.137482]  i915_pci_remove+0x3e/0x90 [i915]
      [  145.137489]  pci_device_remove+0x108/0x2d0
      [  145.137494]  device_release_driver_internal+0x1e6/0x4a0
      [  145.137499]  driver_detach+0xcb/0x198
      [  145.137503]  bus_remove_driver+0xde/0x204
      [  145.137508]  driver_unregister+0x6d/0xa0
      [  145.137513]  pci_unregister_driver+0x2e/0x230
      [  145.137576]  i915_exit+0x1f/0x26 [i915]
      [  145.137157]  kasan_slab_free+0x26/0x30
      [  145.137161]  kfree+0xe6/0x350
      [  145.137242]  intel_ddi_encoder_destroy+0x60/0x80 [i915]
      [  145.137252]  drm_mode_config_cleanup+0x11d/0x8f0
      [  145.137329]  intel_modeset_driver_remove+0x1f5/0x350 [i915]
      [  145.137403]  i915_driver_remove+0xc4/0x130 [i915]
      [  145.137482]  i915_pci_remove+0x3e/0x90 [i915]
      [  145.137489]  pci_device_remove+0x108/0x2d0
      [  145.137494]  device_release_driver_internal+0x1e6/0x4a0
      [  145.137499]  driver_detach+0xcb/0x198
      [  145.137503]  bus_remove_driver+0xde/0x204
      [  145.137508]  driver_unregister+0x6d/0xa0
      [  145.137513]  pci_unregister_driver+0x2e/0x230
      [  145.137576]  i915_exit+0x1f/0x26 [i915]
      [  145.137581]  __x64_sys_delete_module+0x35b/0x470
      [  145.137586]  do_syscall_64+0x99/0x4e0
      [  145.137591]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
      [  145.137606] The buggy address belongs to the object at ffff888216640000
                      which belongs to the cache kmalloc-8k of size 8192
      [  145.137618] The buggy address is located 6192 bytes inside of
                      8192-byte region [ffff888216640000, ffff888216642000)
      [  145.137630] The buggy address belongs to the page:
      [  145.137640] page:ffffea0008599000 refcount:1 mapcount:0 mapping:ffff888107c02a80 index:0xffff888216644000 compound_mapcount: 0
      [  145.137647] raw: 0200000000010200 0000000000000000 0000000100000001 ffff888107c02a80
      [  145.137652] raw: ffff888216644000 0000000080020001 00000001ffffffff 0000000000000000
      [  145.137656] page dumped because: kasan: bad access detected
      
      [  145.137668] Memory state around the buggy address:
      [  145.137678]  ffff888216641700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [  145.137687]  ffff888216641780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [  145.137697] >ffff888216641800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [  145.137706]                                      ^
      [  145.137715]  ffff888216641880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [  145.137724]  ffff888216641900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [  145.137733] ==================================================================
      [  145.137742] Disabling lock debugging due to kernel taint
      
      Changes since v1:
      - Add fixes tags.
      - Use early unregister.
      Signed-off-by: NMaarten Lankhorst <maarten.lankhorst@linux.intel.com>
      Fixes: 9c229127 ("drm/i915: hdmi: add CEC notifier to intel_hdmi")
      Cc: <stable@vger.kernel.org> # v4.19+
      Reviewed-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200212135445.1469133-1-maarten.lankhorst@linux.intel.com
      (cherry picked from commit a581483b)
      Signed-off-by: NJani Nikula <jani.nikula@intel.com>
      6647e6cd
    • V
      drm/i915: Recalculate FBC w/a stride when needed · 0428ab01
      Ville Syrjälä 提交于
      Currently we're failing to recalculate the gen9 FBC w/a stride
      unless something more drastic than just the modifier itself has
      changed. This often leaves us with FBC enabled with the linear
      fbdev framebuffer without the w/a stride enabled. That will cause
      an immediate underrun and FBC will get promptly disabled.
      
      Fix the problem by checking if the w/a stride is about to change,
      and go through the full dance if so. This part of the FBC code
      is still pretty much a disaster and will need lots more work.
      But this should at least fix the immediate issue.
      
      v2: Deactivate FBC when the modifier changes since that will
          likely require resetting the w/a CFB stride
      
      Cc: stable@vger.kernel.org
      Signed-off-by: NVille Syrjälä <ville.syrjala@linux.intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200711080336.13423-1-ville.syrjala@linux.intel.comReviewed-by: NJosé Roberto de Souza <jose.souza@intel.com>
      0428ab01
  3. 14 7月, 2020 3 次提交
    • M
      drm/i915: Move cec_notifier to intel_hdmi_connector_unregister, v2. · a581483b
      Maarten Lankhorst 提交于
      This fixes the following KASAN splash on module reload:
      [  145.136327] ==================================================================
      [  145.136502] BUG: KASAN: use-after-free in intel_hdmi_destroy+0x74/0x80 [i915]
      [  145.136514] Read of size 8 at addr ffff888216641830 by task kworker/1:1/134
      
      [  145.136535] CPU: 1 PID: 134 Comm: kworker/1:1 Tainted: G     U          T 5.5.0-rc7-valkyria+ #5783
      [  145.136539] Hardware name: GIGABYTE GB-BKi3A-7100/MFLP3AP-00, BIOS F1 07/27/2016
      [  145.136546] Workqueue: events drm_connector_free_work_fn
      [  145.136551] Call Trace:
      [  145.136560]  dump_stack+0xa1/0xe0
      [  145.136571]  print_address_description.constprop.0+0x1e/0x210
      [  145.136639]  ? intel_hdmi_destroy+0x74/0x80 [i915]
      [  145.136703]  ? intel_hdmi_destroy+0x74/0x80 [i915]
      [  145.136710]  __kasan_report.cold+0x1b/0x37
      [  145.136790]  ? intel_hdmi_destroy+0x74/0x80 [i915]
      [  145.136863]  ? intel_hdmi_destroy+0x74/0x80 [i915]
      [  145.136870]  kasan_report+0x27/0x30
      [  145.136881]  __asan_report_load8_noabort+0x1c/0x20
      [  145.136946]  intel_hdmi_destroy+0x74/0x80 [i915]
      [  145.136954]  drm_connector_free_work_fn+0xd1/0x100
      [  145.136967]  process_one_work+0x86e/0x1610
      [  145.136987]  ? pwq_dec_nr_in_flight+0x2f0/0x2f0
      [  145.137004]  ? move_linked_works+0x128/0x2c0
      [  145.137021]  worker_thread+0x63e/0xc90
      [  145.137048]  kthread+0x2f6/0x3f0
      [  145.137054]  ? calculate_sigpending+0x81/0xa0
      [  145.137059]  ? process_one_work+0x1610/0x1610
      [  145.137064]  ? kthread_bind+0x40/0x40
      [  145.137075]  ret_from_fork+0x24/0x30
      
      [  145.137111] Allocated by task 0:
      [  145.137119] (stack is not available)
      
      [  145.137137] Freed by task 5053:
      [  145.137147]  save_stack+0x28/0x90
      [  145.137152]  __kasan_slab_free+0x136/0x180
      [  145.137157]  kasan_slab_free+0x26/0x30
      [  145.137161]  kfree+0xe6/0x350
      [  145.137242]  intel_ddi_encoder_destroy+0x60/0x80 [i915]
      [  145.137252]  drm_mode_config_cleanup+0x11d/0x8f0
      [  145.137329]  intel_modeset_driver_remove+0x1f5/0x350 [i915]
      [  145.137403]  i915_driver_remove+0xc4/0x130 [i915]
      [  145.137482]  i915_pci_remove+0x3e/0x90 [i915]
      [  145.137489]  pci_device_remove+0x108/0x2d0
      [  145.137494]  device_release_driver_internal+0x1e6/0x4a0
      [  145.137499]  driver_detach+0xcb/0x198
      [  145.137503]  bus_remove_driver+0xde/0x204
      [  145.137508]  driver_unregister+0x6d/0xa0
      [  145.137513]  pci_unregister_driver+0x2e/0x230
      [  145.137576]  i915_exit+0x1f/0x26 [i915]
      [  145.137157]  kasan_slab_free+0x26/0x30
      [  145.137161]  kfree+0xe6/0x350
      [  145.137242]  intel_ddi_encoder_destroy+0x60/0x80 [i915]
      [  145.137252]  drm_mode_config_cleanup+0x11d/0x8f0
      [  145.137329]  intel_modeset_driver_remove+0x1f5/0x350 [i915]
      [  145.137403]  i915_driver_remove+0xc4/0x130 [i915]
      [  145.137482]  i915_pci_remove+0x3e/0x90 [i915]
      [  145.137489]  pci_device_remove+0x108/0x2d0
      [  145.137494]  device_release_driver_internal+0x1e6/0x4a0
      [  145.137499]  driver_detach+0xcb/0x198
      [  145.137503]  bus_remove_driver+0xde/0x204
      [  145.137508]  driver_unregister+0x6d/0xa0
      [  145.137513]  pci_unregister_driver+0x2e/0x230
      [  145.137576]  i915_exit+0x1f/0x26 [i915]
      [  145.137581]  __x64_sys_delete_module+0x35b/0x470
      [  145.137586]  do_syscall_64+0x99/0x4e0
      [  145.137591]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
      [  145.137606] The buggy address belongs to the object at ffff888216640000
                      which belongs to the cache kmalloc-8k of size 8192
      [  145.137618] The buggy address is located 6192 bytes inside of
                      8192-byte region [ffff888216640000, ffff888216642000)
      [  145.137630] The buggy address belongs to the page:
      [  145.137640] page:ffffea0008599000 refcount:1 mapcount:0 mapping:ffff888107c02a80 index:0xffff888216644000 compound_mapcount: 0
      [  145.137647] raw: 0200000000010200 0000000000000000 0000000100000001 ffff888107c02a80
      [  145.137652] raw: ffff888216644000 0000000080020001 00000001ffffffff 0000000000000000
      [  145.137656] page dumped because: kasan: bad access detected
      
      [  145.137668] Memory state around the buggy address:
      [  145.137678]  ffff888216641700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [  145.137687]  ffff888216641780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [  145.137697] >ffff888216641800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [  145.137706]                                      ^
      [  145.137715]  ffff888216641880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [  145.137724]  ffff888216641900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [  145.137733] ==================================================================
      [  145.137742] Disabling lock debugging due to kernel taint
      
      Changes since v1:
      - Add fixes tags.
      - Use early unregister.
      Signed-off-by: NMaarten Lankhorst <maarten.lankhorst@linux.intel.com>
      Fixes: 9c229127 ("drm/i915: hdmi: add CEC notifier to intel_hdmi")
      Cc: <stable@vger.kernel.org> # v4.19+
      Reviewed-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200212135445.1469133-1-maarten.lankhorst@linux.intel.com
      a581483b
    • V
      drm/i915: WARN if max vswing/pre-emphasis violates the DP spec · a133c698
      Ville Syrjälä 提交于
      According to the DP spec a DPTX must support vswing/pre-emphasis
      up to and including level 2. Level 3 is optional (actually DP 1.4a
      seems to make even level 3 mandatory for HBR2/3, while leaving it
      optional for RBR/HBR1).
      
      WARN if out encoders' .voltage_max()/.preemph_max() return
      an illegal value.
      Signed-off-by: NVille Syrjälä <ville.syrjala@linux.intel.com>
      Reviewed-by: NJosé Roberto de Souza <jose.souza@intel.com>
      Signed-off-by: NJosé Roberto de Souza <jose.souza@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200709145845.18118-1-ville.syrjala@linux.intel.com
      a133c698
    • L
      drm/i915/mst: filter out the display mode exceed sink's capability · e398d7c1
      Lee Shawn C 提交于
      So far, max dot clock rate for MST mode rely on physcial
      bandwidth limitation. It would caused compatibility issue
      if source display resolution exceed MST hub output ability.
      
      For example, source DUT had DP 1.2 output capability.
      And MST docking just support HDMI 1.4 spec. When a HDMI 2.0
      monitor connected. Source would retrieve EDID from external
      and get max resolution 4k@60fps. DP 1.2 can support 4K@60fps
      because it did not surpass DP physical bandwidth limitation.
      Do modeset to 4k@60fps, source output display data but MST
      docking can't output HDMI properly due to this resolution
      already over HDMI 1.4 spec.
      
      Refer to commit <fcf46380> ("drm/dp_mst: Use full_pbn
      instead of available_pbn for bandwidth checks").
      Source driver should refer to full_pbn to evaluate sink
      output capability. And filter out the resolution surpass
      sink output limitation.
      
      Changes since v1:
      * Using mgr->base.lock to protect full_pbn.
      Changes since v2:
      * Add ctx lock.
      Changes since v3:
      * s/intel_dp_mst_mode_clock_exceed_pbn_bandwidth/
        intel_dp_mst_mode_clock_exceeds_pbn_bw/
      * Use the new drm_connector_helper_funcs.mode_valid_ctx to properly pipe
        down the drm_modeset_acquire_ctx that the probe helpers are using, so
        we can safely grab &mgr->base.lock without deadlocking
      Changes since v4:
      * Move drm_dp_calc_pbn_mode(mode->clock, bpp, false) > port->full_pbn
        check
      * Fix the bpp we use in drm_dp_calc_pbn_mode()
      * Drop leftover (!mgr) check
      * Don't check for if full_pbn is unset. To be clear - it _can_ be unset,
        but if it is then it's certainly a bug in DRM or a non-compliant sink
        as full_pbn should always be populated by the time we call
        ->mode_valid_ctx.
        We should workaround non-compliant sinks with full_pbn=0, but that
        should happen in the DP MST helpers so we can estimate the full_pbn
        value as best we can.
      Tested-by: NImre Deak <imre.deak@intel.com>
      Reviewed-by: NImre Deak <imre.deak@intel.com>
      Cc: Manasi Navare <manasi.d.navare@intel.com>
      Cc: Jani Nikula <jani.nikula@linux.intel.com>
      Cc: Ville Syrjala <ville.syrjala@linux.intel.com>
      Cc: Cooper Chiou <cooper.chiou@intel.com>
      Co-developed-by: NLyude Paul <lyude@redhat.com>
      Signed-off-by: NLee Shawn C <shawn.c.lee@intel.com>
      Signed-off-by: NLyude Paul <lyude@redhat.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200713170746.254388-3-lyude@redhat.com
      e398d7c1
  4. 10 7月, 2020 3 次提交
  5. 09 7月, 2020 8 次提交