From: "Kumar, Mahesh" <mahesh1.ku...@intel.com>

DDB minimum requirement of crtc configuration (cumulative of all the
enabled planes in crtc) may exceed the allocated DDB for crtc/pipe.
This patch make changes to fail the flip/ioctl if minimum requirement
for pipe exceeds the total ddb allocated to the pipe.
Previously it succeeded but making alloc_size a negative value. Which
will make subsequent calculations for plane ddb allocation bogus & may
lead to screen corruption or system hang.

Changes from V1:
 - Improve commit message as per Ander's comment
 - Remove extra parentheses (Ander)

Signed-off-by: Mahesh Kumar <mahesh1.ku...@intel.com>
---
 drivers/gpu/drm/i915/intel_pm.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 37dd3e7108c9..bbc72069ab57 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -4057,6 +4057,7 @@ skl_allocate_pipe_ddb(struct intel_crtc_state *cstate,
        int num_active;
        unsigned plane_data_rate[I915_MAX_PLANES] = {};
        unsigned plane_y_data_rate[I915_MAX_PLANES] = {};
+       uint16_t total_min_blocks = 0;
 
        /* Clear the partitioning for disabled planes. */
        memset(ddb->plane[pipe], 0, sizeof(ddb->plane[pipe]));
@@ -4084,10 +4085,18 @@ skl_allocate_pipe_ddb(struct intel_crtc_state *cstate,
         */
 
        for_each_plane_id_on_crtc(intel_crtc, plane_id) {
-               alloc_size -= minimum[plane_id];
-               alloc_size -= y_minimum[plane_id];
+               total_min_blocks += minimum[plane_id];
+               total_min_blocks += y_minimum[plane_id];
        }
 
+       if (total_min_blocks > alloc_size) {
+               DRM_DEBUG_KMS("Requested display configuration exceeds system 
DDB limitations");
+               DRM_DEBUG_KMS("minimum required %d/%d\n", total_min_blocks,
+                                                       alloc_size);
+               return -EINVAL;
+       }
+
+       alloc_size -= total_min_blocks;
        ddb->plane[pipe][PLANE_CURSOR].start = alloc->end - 
minimum[PLANE_CURSOR];
        ddb->plane[pipe][PLANE_CURSOR].end = alloc->end;
 
-- 
2.11.0

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Reply via email to