[Intel-gfx] [PATCH] drm/i915: Fix oops in vlv_force_pll_on()

Wed Apr 20 13:47:20 UTC 2016

On Wed, Apr 20, 2016 at 03:19:49PM +0200, Daniel Vetter wrote:
> On Tue, Apr 19, 2016 at 03:01:31PM +0300, Ville Syrjälä wrote:
> > On Tue, Apr 19, 2016 at 02:25:40PM +0300, Jani Nikula wrote:
> > > On Mon, 18 Apr 2016, ville.syrjala at linux.intel.com wrote:
> > > > From: Ville Syrjälä <ville.syrjala at linux.intel.com>
> > > >
> > > > intel_pipe_will_have_type() doesn't just look at the passied in
> > > > pipe_config, instead it expects there to be a full atomic state behind
> > > > it. Obviously that won't go so well when vlv_force_pll_on() just uses a
> > > > temp pipe_config. Fix things by using pipe_config->has_dsi_encoder
> > > > instead intel_pipe_will_have_type(INTEL_OUTPUT_DSI) to check if we need
> > > > to actually enable the DPLL.
> > > >
> > > > Here's an example oops for reference:
> > > > BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
> > > > IP: [<ffffffffa0389a5b>] intel_pipe_will_have_type+0x15/0x7b [i915]
> > > > PGD 7acda067 PUD 72696067 PMD 0
> > > > Oops: 0000 [#1] PREEMPT SMP
> > > > Modules linked in: i915 i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm intel_gtt agpgart netconsole psmouse atkbd iTCO_wdt libps2 coretemp hwmon efi_pstore intel_rapl punit_atom_debug efivars pcspkr i2c_i801 r8169 lpc_ich mii processor_thermal_device snd_soc_rt5670 intel_soc_dts_iosf snd_soc_rl6231 i2c_hid hid snd_intel_sst_acpi snd_intel_sst_core snd_soc_sst_mfld_platform snd_soc_sst_match snd_soc_core i8042 serio snd_compress snd_pcm snd_timer snd i2c_designware_platform sdhci_acpi i2c_designware_core soundcore sdhci pwm_lpss_platform mmc_core pwm_lpss spi_pxa2xx_platform evdev int3403_thermal int3400_thermal int340x_thermal_zone acpi_thermal_rel sch_fq_codel ip_tables x_tables ipv6 autofs4
> > > > CPU: 3 PID: 290 Comm: Xorg Tainted: G     U          4.6.0-rc4-bsw+ #2876
> > > > Hardware name: Intel Corporation CHERRYVIEW C0 PLATFORM/Braswell CRB, BIOS BRAS.X64.X088.R00.1510270350 10/27/2015
> > > > task: ffff88007a8dd200 ti: ffff880173ac4000 task.ti: ffff880173ac4000
> > > > RIP: 0010:[<ffffffffa0389a5b>]  [<ffffffffa0389a5b>] intel_pipe_will_have_type+0x15/0x7b [i915]
> > > > RSP: 0018:ffff880173ac7928  EFLAGS: 00010246
> > > > RAX: 0000000000000000 RBX: ffff880176594000 RCX: 0000000000000000
> > > > RDX: 0000000000000000 RSI: 0000000000000009 RDI: ffff880176594000
> > > > RBP: ffff880173ac7930 R08: 0000000000019290 R09: 0000000000000000
> > > > R10: ffff880173ac7890 R11: 00000000000080cf R12: ffff88017fbd4000
> > > > R13: ffffffffa03e3c44 R14: ffff88007492c000 R15: ffff88007492c000
> > > > FS:  00007ff8936a6940(0000) GS:ffff88017ef80000(0000) knlGS:0000000000000000
> > > > CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > > > CR2: 0000000000000030 CR3: 0000000177e08000 CR4: 00000000001006e0
> > > > Stack:
> > > >  ffff880176594000 ffff880173ac7948 ffffffffa0389b42 ffff880176594000
> > > >  ffff880173ac7978 ffffffffa0396e02 ffff8801765b0000 ffff88007af660d8
> > > >  0000000000000000 0000000000000004 ffff880173ac79c0 ffffffffa03b6b64
> > > > Call Trace:
> > > >  [<ffffffffa0389b42>] chv_compute_dpll.isra.39+0x33/0x55 [i915]
> > > >  [<ffffffffa0396e02>] vlv_force_pll_on+0x80/0xc6 [i915]
> > > >  [<ffffffffa03b6b64>] vlv_power_sequencer_pipe+0x29b/0x3dd [i915]
> > > >  [<ffffffffa03b6cd4>] _pp_stat_reg+0x2e/0x38 [i915]
> > > >  [<ffffffffa03b6dc1>] wait_panel_status+0x4c/0x1ec [i915]
> > > >  [<ffffffffa03b6fcb>] wait_panel_power_cycle+0x6a/0xb4 [i915]
> > > >  [<ffffffffa03b70da>] edp_panel_vdd_on+0xc5/0x1d1 [i915]
> > > >  [<ffffffffa03b861b>] intel_dp_aux_ch+0x55/0x572 [i915]
> > > >  [<ffffffff810af5c8>] ? mark_held_locks+0x5d/0x74
> > > >  [<ffffffff81518e61>] ? mutex_lock_nested+0x321/0x346
> > > >  [<ffffffff81094007>] ? preempt_count_sub+0xf2/0x102
> > > >  [<ffffffffa03b8cb4>] intel_dp_aux_transfer+0x17c/0x1b5 [i915]
> > > >  [<ffffffffa03028ef>] drm_dp_dpcd_access+0x62/0xed [drm_kms_helper]
> > > >  [<ffffffffa0302995>] drm_dp_dpcd_read+0x1b/0x1f [drm_kms_helper]
> > > >  [<ffffffffa03b5147>] intel_dp_dpcd_read_wake+0x31/0x69 [i915]
> > > >  [<ffffffffa03bb36a>] intel_dp_long_pulse+0x15f/0x5ed [i915]
> > > >  [<ffffffffa03bbb09>] intel_dp_detect+0x79/0x95 [i915]
> > > >  [<ffffffffa030340e>] drm_helper_probe_single_connector_modes+0xc7/0x3db [drm_kms_helper]
> > > >  [<ffffffffa029de23>] drm_mode_getconnector+0xe9/0x333 [drm]
> > > >  [<ffffffff810b1cfb>] ? lock_acquire+0x137/0x1df
> > > >  [<ffffffffa0292364>] drm_ioctl+0x266/0x3ae [drm]
> > > >  [<ffffffffa029dd3a>] ? drm_mode_getcrtc+0x126/0x126 [drm]
> > > >  [<ffffffff811af082>] vfs_ioctl+0x18/0x34
> > > >  [<ffffffff811af682>] do_vfs_ioctl+0x547/0x5fe
> > > >  [<ffffffff811b9acb>] ? __fget_light+0x62/0x71
> > > >  [<ffffffff811af77c>] SyS_ioctl+0x43/0x61
> > > >  [<ffffffff81001a82>] do_syscall_64+0x63/0xf8
> > > >  [<ffffffff8151bc9a>] entry_SYSCALL64_slow_path+0x25/0x25
> > > > Code: 35 00 40 a0 e8 97 4b ce e0 b8 17 00 00 00 5d c3 b8 17 00 00 00 c3 0f 1f 44 00 00 55 31 c0 31 d2 48 89 e5 53 48 8b 8f e8 01 00 00 <44> 8b 49 30 41 39 c1 7e 2d 4c 8b 51 38 4c 8b 41 40 49 83 3c c2
> > > > RIP  [<ffffffffa0389a5b>] intel_pipe_will_have_type+0x15/0x7b [i915]
> > > >  RSP <ffff880173ac7928>
> > > > CR2: 0000000000000030
> > > >
> > > > The regressing patch wasn't exactly new (as in first posted more than
> > > > six months ago), so I'm a bit baffled how I didn't manage to hit this
> > > > myself so far.
> > > >
> > > > Cc: Jani Nikula <jani.nikula at intel.com>
> > > > Cc: Marius Vlad <marius.c.vlad at intel.com>
> > > > Reported-by: Marius Vlad <marius.c.vlad at intel.com>
> > > > Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=94995
> > > > Fixes: cd2d34d9b61f ("drm/i915: Setup DPLL/DPLLMD for DSI too on VLV/CHV")
> > > 
> > > Whoever reviewed the regressing commit was an idiot...
> > 
> > Patch author as well. In my hunt for an excuse I considered that maybe
> > intel_panel_will_have_type() didn't yet depend on the atomic state when
> > I wrote the patch, but looks like that theory won't fly either.
> > 
> > > 
> > > Reviewed-by: Jani Nikula <jani.nikula at intel.com>
> > 
> > Thanks. Patch pushed to dinq.
> 
> Might be worth it to nuke the few will_have_type(HDMI) we have left, and
> completely relegate will_have_type to legacy encoders (lvds, sdvo&dvo).
> It's indeed a surprisingly fragile function ...

I have a much nicer version of this function in
https://github.com/vsyrjala/linux/commit/571aa46aabfbe9cf67368e80a0cdd855ec08528d
https://github.com/vsyrjala/linux/commit/556ee4ee38ddc2c7b132d919b71d92086b800de2

Sadly I haven't found the time to start upstreaming anything from that
branch yet.

-- 
Ville Syrjälä
Intel OTC