1. 14 7月, 2020 10 次提交
    • M
      drm/i915: Move cec_notifier to intel_hdmi_connector_unregister, v2. · a581483b
      Maarten Lankhorst 提交于
      This fixes the following KASAN splash on module reload:
      [  145.136327] ==================================================================
      [  145.136502] BUG: KASAN: use-after-free in intel_hdmi_destroy+0x74/0x80 [i915]
      [  145.136514] Read of size 8 at addr ffff888216641830 by task kworker/1:1/134
      
      [  145.136535] CPU: 1 PID: 134 Comm: kworker/1:1 Tainted: G     U          T 5.5.0-rc7-valkyria+ #5783
      [  145.136539] Hardware name: GIGABYTE GB-BKi3A-7100/MFLP3AP-00, BIOS F1 07/27/2016
      [  145.136546] Workqueue: events drm_connector_free_work_fn
      [  145.136551] Call Trace:
      [  145.136560]  dump_stack+0xa1/0xe0
      [  145.136571]  print_address_description.constprop.0+0x1e/0x210
      [  145.136639]  ? intel_hdmi_destroy+0x74/0x80 [i915]
      [  145.136703]  ? intel_hdmi_destroy+0x74/0x80 [i915]
      [  145.136710]  __kasan_report.cold+0x1b/0x37
      [  145.136790]  ? intel_hdmi_destroy+0x74/0x80 [i915]
      [  145.136863]  ? intel_hdmi_destroy+0x74/0x80 [i915]
      [  145.136870]  kasan_report+0x27/0x30
      [  145.136881]  __asan_report_load8_noabort+0x1c/0x20
      [  145.136946]  intel_hdmi_destroy+0x74/0x80 [i915]
      [  145.136954]  drm_connector_free_work_fn+0xd1/0x100
      [  145.136967]  process_one_work+0x86e/0x1610
      [  145.136987]  ? pwq_dec_nr_in_flight+0x2f0/0x2f0
      [  145.137004]  ? move_linked_works+0x128/0x2c0
      [  145.137021]  worker_thread+0x63e/0xc90
      [  145.137048]  kthread+0x2f6/0x3f0
      [  145.137054]  ? calculate_sigpending+0x81/0xa0
      [  145.137059]  ? process_one_work+0x1610/0x1610
      [  145.137064]  ? kthread_bind+0x40/0x40
      [  145.137075]  ret_from_fork+0x24/0x30
      
      [  145.137111] Allocated by task 0:
      [  145.137119] (stack is not available)
      
      [  145.137137] Freed by task 5053:
      [  145.137147]  save_stack+0x28/0x90
      [  145.137152]  __kasan_slab_free+0x136/0x180
      [  145.137157]  kasan_slab_free+0x26/0x30
      [  145.137161]  kfree+0xe6/0x350
      [  145.137242]  intel_ddi_encoder_destroy+0x60/0x80 [i915]
      [  145.137252]  drm_mode_config_cleanup+0x11d/0x8f0
      [  145.137329]  intel_modeset_driver_remove+0x1f5/0x350 [i915]
      [  145.137403]  i915_driver_remove+0xc4/0x130 [i915]
      [  145.137482]  i915_pci_remove+0x3e/0x90 [i915]
      [  145.137489]  pci_device_remove+0x108/0x2d0
      [  145.137494]  device_release_driver_internal+0x1e6/0x4a0
      [  145.137499]  driver_detach+0xcb/0x198
      [  145.137503]  bus_remove_driver+0xde/0x204
      [  145.137508]  driver_unregister+0x6d/0xa0
      [  145.137513]  pci_unregister_driver+0x2e/0x230
      [  145.137576]  i915_exit+0x1f/0x26 [i915]
      [  145.137157]  kasan_slab_free+0x26/0x30
      [  145.137161]  kfree+0xe6/0x350
      [  145.137242]  intel_ddi_encoder_destroy+0x60/0x80 [i915]
      [  145.137252]  drm_mode_config_cleanup+0x11d/0x8f0
      [  145.137329]  intel_modeset_driver_remove+0x1f5/0x350 [i915]
      [  145.137403]  i915_driver_remove+0xc4/0x130 [i915]
      [  145.137482]  i915_pci_remove+0x3e/0x90 [i915]
      [  145.137489]  pci_device_remove+0x108/0x2d0
      [  145.137494]  device_release_driver_internal+0x1e6/0x4a0
      [  145.137499]  driver_detach+0xcb/0x198
      [  145.137503]  bus_remove_driver+0xde/0x204
      [  145.137508]  driver_unregister+0x6d/0xa0
      [  145.137513]  pci_unregister_driver+0x2e/0x230
      [  145.137576]  i915_exit+0x1f/0x26 [i915]
      [  145.137581]  __x64_sys_delete_module+0x35b/0x470
      [  145.137586]  do_syscall_64+0x99/0x4e0
      [  145.137591]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
      [  145.137606] The buggy address belongs to the object at ffff888216640000
                      which belongs to the cache kmalloc-8k of size 8192
      [  145.137618] The buggy address is located 6192 bytes inside of
                      8192-byte region [ffff888216640000, ffff888216642000)
      [  145.137630] The buggy address belongs to the page:
      [  145.137640] page:ffffea0008599000 refcount:1 mapcount:0 mapping:ffff888107c02a80 index:0xffff888216644000 compound_mapcount: 0
      [  145.137647] raw: 0200000000010200 0000000000000000 0000000100000001 ffff888107c02a80
      [  145.137652] raw: ffff888216644000 0000000080020001 00000001ffffffff 0000000000000000
      [  145.137656] page dumped because: kasan: bad access detected
      
      [  145.137668] Memory state around the buggy address:
      [  145.137678]  ffff888216641700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [  145.137687]  ffff888216641780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [  145.137697] >ffff888216641800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [  145.137706]                                      ^
      [  145.137715]  ffff888216641880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [  145.137724]  ffff888216641900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [  145.137733] ==================================================================
      [  145.137742] Disabling lock debugging due to kernel taint
      
      Changes since v1:
      - Add fixes tags.
      - Use early unregister.
      Signed-off-by: NMaarten Lankhorst <maarten.lankhorst@linux.intel.com>
      Fixes: 9c229127 ("drm/i915: hdmi: add CEC notifier to intel_hdmi")
      Cc: <stable@vger.kernel.org> # v4.19+
      Reviewed-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200212135445.1469133-1-maarten.lankhorst@linux.intel.com
      a581483b
    • L
      drm/i915/dg1: Add fake PCH · 51e3a64f
      Lucas De Marchi 提交于
      DG1 has the south engine display on the same PCI device. Ideally we
      could use HAS_PCH_SPLIT(), but that macro is misused all across the
      code base to rather signify a range of gens. So add a fake one for DG1
      to be used where needed.
      
      Cc: Aditya Swarup <aditya.swarup@intel.com>
      Signed-off-by: NLucas De Marchi <lucas.demarchi@intel.com>
      Reviewed-by: NAnusha Srivatsa <anusha.srivatsa@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200713182321.12390-6-lucas.demarchi@intel.com
      51e3a64f
    • A
      drm/i915/dg1: Remove SHPD_FILTER_CNT register programming · f619e516
      Anusha Srivatsa 提交于
      Bspec asks us to remove the special programming of the
      SHPD_FILTER_CNT register which we have been doing since CNP+.
      
      Bspec: 49305
      
      Cc: Matt Roper <matthew.d.roper@intel.com>
      Signed-off-by: NAnusha Srivatsa <anusha.srivatsa@intel.com>
      Signed-off-by: NLucas De Marchi <lucas.demarchi@intel.com>
      Reviewed-by: NJosé Roberto de Souza <jose.souza@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200713182321.12390-5-lucas.demarchi@intel.com
      f619e516
    • L
      drm/i915/dg1: add support for the master unit interrupt · 97b492f5
      Lucas De Marchi 提交于
      DG1 has master unit interrupt register which is used to indicate the
      correct source of interrupt.
      
      v2: fix coding style on register definition
      
      Cc: Radhakrishna Sripada <radhakrishna.sripada@intel.com>
      Cc: Daniele Spurio Ceraolo <daniele.ceraolospurio@intel.com>
      Cc: Matt Roper <matthew.d.roper@intel.com>
      Signed-off-by: NLucas De Marchi <lucas.demarchi@intel.com>
      Reviewed-by: NJosé Roberto de Souza <jose.souza@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200713182321.12390-4-lucas.demarchi@intel.com
      97b492f5
    • A
      drm/i915/dg1: add initial DG-1 definitions · 05e26584
      Abdiel Janulgue 提交于
      Bspec: 33617, 33617
      
      v2: s/intel_dg1_info/dg1_info/ as done for other platforms before and
          try to shut up compiler about ununsed variable that we know
          shouldn't be used (Lucas)
      v3: replace explicit attribute with __maybe_unused (Lucas)
      
      Cc: José Roberto de Souza <jose.souza@intel.com>
      Cc: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
      Cc: Stuart Summers <stuart.summers@intel.com>
      Cc: Vanshidhar Konda <vanshidhar.r.konda@intel.com>
      Cc: Lucas De Marchi <lucas.demarchi@intel.com>
      Cc: Aravind Iddamsetty <aravind.iddamsetty@intel.com>
      Cc: Matt Roper <matthew.d.roper@intel.com>
      Signed-off-by: NAbdiel Janulgue <abdiel.janulgue@linux.intel.com>
      Signed-off-by: NLucas De Marchi <lucas.demarchi@intel.com>
      Reviewed-by: NJosé Roberto de Souza <jose.souza@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200713182321.12390-2-lucas.demarchi@intel.com
      05e26584
    • S
      drm/i915: Add has_master_unit_irq flag · 2ffcfd8d
      Stuart Summers 提交于
      Add flag to differentiate platforms with and without the master
      IRQ control bit.
      Signed-off-by: NStuart Summers <stuart.summers@intel.com>
      Signed-off-by: NLucas De Marchi <lucas.demarchi@intel.com>
      Reviewed-by: NJosé Roberto de Souza <jose.souza@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200713182321.12390-1-lucas.demarchi@intel.com
      2ffcfd8d
    • V
      drm/i915: WARN if max vswing/pre-emphasis violates the DP spec · a133c698
      Ville Syrjälä 提交于
      According to the DP spec a DPTX must support vswing/pre-emphasis
      up to and including level 2. Level 3 is optional (actually DP 1.4a
      seems to make even level 3 mandatory for HBR2/3, while leaving it
      optional for RBR/HBR1).
      
      WARN if out encoders' .voltage_max()/.preemph_max() return
      an illegal value.
      Signed-off-by: NVille Syrjälä <ville.syrjala@linux.intel.com>
      Reviewed-by: NJosé Roberto de Souza <jose.souza@intel.com>
      Signed-off-by: NJosé Roberto de Souza <jose.souza@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200709145845.18118-1-ville.syrjala@linux.intel.com
      a133c698
    • L
      drm/i915/mst: filter out the display mode exceed sink's capability · e398d7c1
      Lee Shawn C 提交于
      So far, max dot clock rate for MST mode rely on physcial
      bandwidth limitation. It would caused compatibility issue
      if source display resolution exceed MST hub output ability.
      
      For example, source DUT had DP 1.2 output capability.
      And MST docking just support HDMI 1.4 spec. When a HDMI 2.0
      monitor connected. Source would retrieve EDID from external
      and get max resolution 4k@60fps. DP 1.2 can support 4K@60fps
      because it did not surpass DP physical bandwidth limitation.
      Do modeset to 4k@60fps, source output display data but MST
      docking can't output HDMI properly due to this resolution
      already over HDMI 1.4 spec.
      
      Refer to commit <fcf46380> ("drm/dp_mst: Use full_pbn
      instead of available_pbn for bandwidth checks").
      Source driver should refer to full_pbn to evaluate sink
      output capability. And filter out the resolution surpass
      sink output limitation.
      
      Changes since v1:
      * Using mgr->base.lock to protect full_pbn.
      Changes since v2:
      * Add ctx lock.
      Changes since v3:
      * s/intel_dp_mst_mode_clock_exceed_pbn_bandwidth/
        intel_dp_mst_mode_clock_exceeds_pbn_bw/
      * Use the new drm_connector_helper_funcs.mode_valid_ctx to properly pipe
        down the drm_modeset_acquire_ctx that the probe helpers are using, so
        we can safely grab &mgr->base.lock without deadlocking
      Changes since v4:
      * Move drm_dp_calc_pbn_mode(mode->clock, bpp, false) > port->full_pbn
        check
      * Fix the bpp we use in drm_dp_calc_pbn_mode()
      * Drop leftover (!mgr) check
      * Don't check for if full_pbn is unset. To be clear - it _can_ be unset,
        but if it is then it's certainly a bug in DRM or a non-compliant sink
        as full_pbn should always be populated by the time we call
        ->mode_valid_ctx.
        We should workaround non-compliant sinks with full_pbn=0, but that
        should happen in the DP MST helpers so we can estimate the full_pbn
        value as best we can.
      Tested-by: NImre Deak <imre.deak@intel.com>
      Reviewed-by: NImre Deak <imre.deak@intel.com>
      Cc: Manasi Navare <manasi.d.navare@intel.com>
      Cc: Jani Nikula <jani.nikula@linux.intel.com>
      Cc: Ville Syrjala <ville.syrjala@linux.intel.com>
      Cc: Cooper Chiou <cooper.chiou@intel.com>
      Co-developed-by: NLyude Paul <lyude@redhat.com>
      Signed-off-by: NLee Shawn C <shawn.c.lee@intel.com>
      Signed-off-by: NLyude Paul <lyude@redhat.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200713170746.254388-3-lyude@redhat.com
      e398d7c1
    • C
      drm/i915: Skip signaling a signaled request · 1d9221e9
      Chris Wilson 提交于
      Preempt-to-busy introduces various fascinating complications in that the
      requests may complete as we are unsubmitting them from HW. As they may
      then signal after unsubmission, we may find ourselves having to cleanup
      the signaling request from within the signaling callback. This causes us
      to recurse onto the same i915_request.lock.
      
      However, if the request is already signaled (as it will be before we
      enter the signal callbacks), we know we can skip the signaling of that
      request during submission, neatly evading the spinlock recursion.
      
      unsubmit(ve.rq0) # timeslice expiration or other preemption
       -> virtual_submit_request(ve.rq0)
      dma_fence_signal(ve.rq0) # request completed before preemption ack
       -> submit_notify(ve.rq1)
         -> virtual_submit_request(ve.rq1) # sees that we have completed ve.rq0
            -> __i915_request_submit(ve.rq0)
      
      [  264.210142] BUG: spinlock recursion on CPU#2, sample_multi_tr/2093
      [  264.210150]  lock: 0xffff9efd6ac55080, .magic: dead4ead, .owner: sample_multi_tr/2093, .owner_cpu: 2
      [  264.210155] CPU: 2 PID: 2093 Comm: sample_multi_tr Tainted: G     U
      [  264.210158] Hardware name: Intel Corporation CoffeeLake Client Platform/CoffeeLake S UDIMM RVP, BIOS CNLSFWR1.R00.X212.B01.1909060036 09/06/2019
      [  264.210160] Call Trace:
      [  264.210167]  dump_stack+0x98/0xda
      [  264.210174]  spin_dump.cold+0x24/0x3c
      [  264.210178]  do_raw_spin_lock+0x9a/0xd0
      [  264.210184]  _raw_spin_lock_nested+0x6a/0x70
      [  264.210314]  __i915_request_submit+0x10a/0x3c0 [i915]
      [  264.210415]  virtual_submit_request+0x9b/0x380 [i915]
      [  264.210516]  submit_notify+0xaf/0x14c [i915]
      [  264.210602]  __i915_sw_fence_complete+0x8a/0x230 [i915]
      [  264.210692]  i915_sw_fence_complete+0x2d/0x40 [i915]
      [  264.210762]  __dma_i915_sw_fence_wake+0x19/0x30 [i915]
      [  264.210767]  dma_fence_signal_locked+0xb1/0x1c0
      [  264.210772]  dma_fence_signal+0x29/0x50
      [  264.210871]  i915_request_wait+0x5cb/0x830 [i915]
      [  264.210876]  ? dma_resv_get_fences_rcu+0x294/0x5d0
      [  264.210974]  i915_gem_object_wait_fence+0x2f/0x40 [i915]
      [  264.211084]  i915_gem_object_wait+0xce/0x400 [i915]
      [  264.211178]  i915_gem_wait_ioctl+0xff/0x290 [i915]
      
      Fixes: 22b7a426 ("drm/i915/execlists: Preempt-to-busy")
      References: 6d06779e ("drm/i915: Load balancing across a virtual engine")
      Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>
      Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
      Cc: "Nayana, Venkata Ramana" <venkata.ramana.nayana@intel.com>
      Cc: <stable@vger.kernel.org> # v5.4+
      Reviewed-by: NTvrtko Ursulin <tvrtko.ursulin@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200713141636.29326-1-chris@chris-wilson.co.uk
      1d9221e9
    • C
      drm/i915/gt: Only swap to a random sibling once upon creation · 90a98720
      Chris Wilson 提交于
      The danger in switching at random upon intel_context_pin is that the
      context may still actually be inflight, as it will not be scheduled out
      until a context switch after it is complete -- that may be a long time
      after we do a final intel_context_unpin.
      
      Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/2118
      Fixes: 6d06779e ("drm/i915: Load balancing across a virtual engine")
      Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>
      Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
      Cc: <stable@vger.kernel.org> # v5.3+
      Reviewed-by: NTvrtko Ursulin <tvrtko.ursulin@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200713160549.17344-1-chris@chris-wilson.co.uk
      90a98720
  2. 13 7月, 2020 3 次提交
  3. 11 7月, 2020 1 次提交
  4. 10 7月, 2020 9 次提交
  5. 09 7月, 2020 17 次提交