i915n: a display device without a display instead of a NULL display #17

Merged

toasterson merged 2 commits from x230-nodisplay-device into main 2026-10-05 18:55:32 +00:00

Conversation 0 Commits 2 Files changed 3 +48 -8

toasterson commented 2026-10-05 18:17:53 +00:00

Owner

Copy link

The headless i915n build stubbed intel_display_device_probe() to return NULL, so i915->display was NULL. Linux never has a NULL i915->display: a device without a display gets a display structure whose device info is the empty no_display, and code outside display/ reads it through macros and inlines.

The first attach on real hardware (ThinkPad X230, HD 4000 8086:0166, illumos 2053dc3e46) panicked on the first of them:

BAD TRAP: type=e (#pf Page fault) rp=fffffe000ff61710 addr=448 occurred in module "i915n" due to a NULL pointer dereference
intel_uncore_init_mmio+0x60()      <- HAS_FPGA_DBG_UNCLAIMED(display): movq 0x448(%r13), r13 = i915->display = 0
i915_driver_mmio_probe+0x44()
i915_driver_probe+0xb9()
i915_pci_probe+0x8a()
lkpi_pci_attach+0x10e()
i915n_attach+0x17()

The generated stub now does what Linux's no_display case does: it allocates the structure, sets the drm and parent back pointers and points the device info at an empty no_display, so every DISPLAY_INFO/DISPLAY_RUNTIME_INFO question (HAS_DISPLAY, DISPLAY_VER, has_fpga_dbg, ...) answers "no display". intel_display_device_remove() frees it. i915_nodisplay.c is regenerated with gen-nodisplay.py against the pinned, patched tree; the unchanged generator reproduces the committed file.

A survey of the 157 compiled TUs found no other direct dereference outside macros and inlines: every other use passes display to stubbed display functions. No glue relied on a NULL display.

Tested on the X230 (together with the other x230-* fixes, branch x230-test): the probe passes intel_uncore_init_mmio(), GGTT (2 GiB), stolen memory (64 MiB), GT and engine setup; i915n attaches, /dev/dri/card0 and renderD128 exist, Mesa crocus renders on the render node. Build: oibuild, 157/157 TUs, -z defs 0 unresolved.

The headless i915n build stubbed `intel_display_device_probe()` to return NULL, so `i915->display` was NULL. Linux never has a NULL `i915->display`: a device without a display gets a display structure whose device info is the empty `no_display`, and code outside `display/` reads it through macros and inlines. The first attach on real hardware (ThinkPad X230, HD 4000 `8086:0166`, illumos `2053dc3e46`) panicked on the first of them: ``` BAD TRAP: type=e (#pf Page fault) rp=fffffe000ff61710 addr=448 occurred in module "i915n" due to a NULL pointer dereference intel_uncore_init_mmio+0x60() <- HAS_FPGA_DBG_UNCLAIMED(display): movq 0x448(%r13), r13 = i915->display = 0 i915_driver_mmio_probe+0x44() i915_driver_probe+0xb9() i915_pci_probe+0x8a() lkpi_pci_attach+0x10e() i915n_attach+0x17() ``` The generated stub now does what Linux's `no_display` case does: it allocates the structure, sets the `drm` and `parent` back pointers and points the device info at an empty `no_display`, so every `DISPLAY_INFO`/`DISPLAY_RUNTIME_INFO` question (`HAS_DISPLAY`, `DISPLAY_VER`, `has_fpga_dbg`, ...) answers "no display". `intel_display_device_remove()` frees it. `i915_nodisplay.c` is regenerated with `gen-nodisplay.py` against the pinned, patched tree; the unchanged generator reproduces the committed file. A survey of the 157 compiled TUs found no other direct dereference outside macros and inlines: every other use passes `display` to stubbed display functions. No glue relied on a NULL display. **Tested on the X230** (together with the other x230-* fixes, branch `x230-test`): the probe passes `intel_uncore_init_mmio()`, GGTT (2 GiB), stolen memory (64 MiB), GT and engine setup; i915n attaches, `/dev/dri/card0` and `renderD128` exist, Mesa crocus renders on the render node. Build: oibuild, 157/157 TUs, `-z defs` 0 unresolved.

toasterson added 1 commit 2026-10-05 18:17:53 +00:00

i915n: a display device without a display instead of a NULL display ... bf72cd0e3c

The headless build stubbed intel_display_device_probe() to return NULL,
so i915->display was NULL. Linux never has a NULL i915->display: a
device without a display gets a display structure whose device info is
the empty no_display. Code outside display/ relies on that and reads the
display through macros and inlines. The first attach on real hardware
(ThinkPad X230, HD 4000 8086:0166) panicked on the first of them:

  BAD TRAP: type=e (#pf Page fault) addr=448 occurred in module "i915n"
  due to a NULL pointer dereference
  intel_uncore_init_mmio+0x60   (HAS_FPGA_DBG_UNCLAIMED(display))
  i915_driver_mmio_probe+0x44
  i915_driver_probe+0xb9
  i915_pci_probe+0x8a
  lkpi_pci_attach+0x10e
  i915n_attach+0x17

The generated stub now does what Linux's no_display case does: it
allocates the structure, sets the drm and parent back pointers, and
points the device info at an empty no_display, so that every
DISPLAY_INFO/DISPLAY_RUNTIME_INFO question (HAS_DISPLAY, DISPLAY_VER,
has_fpga_dbg, ...) answers "no display". intel_display_device_remove()
frees it. No display parameters are copied, so none are freed.
i915_nodisplay.c is regenerated with gen-nodisplay.py against the
pinned, patched tree; the unchanged generator reproduces the committed
file before this change.

toasterson added 1 commit 2026-10-05 18:44:45 +00:00

i915n: the refusal of an uncovered GPU frees the display structure ... d0a300ea07

Review of the no-display device: i915_driver_create() now allocates
i915->display (a display without a display), and patch 0009's refusal
of an uncovered GPU returns -ENODEV from i915_driver_probe() before
do_release is set, so neither i915_driver_late_release() nor
i915_driver_release() frees it: every refused attach leaked one struct
intel_display. The refusal now calls intel_display_device_remove() and
clears the pointer before pci_disable_device().

toasterson merged commit 93be1f5b6d into main 2026-10-05 18:55:32 +00:00

toasterson referenced this pull request from a commit 2026-10-05 18:55:34 +00:00

Merge pull request 'i915n: a display device without a display instead of a NULL display' (#17) from x230-nodisplay-device into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

illumos/illumos-drm!17

No description provided.