dri-devel July 2020

dri-devel@lists.freedesktop.org

336 participants
772 discussions

[PATCH 0/9] SDM630/36/60 driver enablement
by Konrad Dybcio 04 Aug '20

04 Aug '20

Hi! This series brings most of the changes that have been brought to sdm630/636/660 SoCs apart from device tree part (I cannot add anything unless some [1] smmu quirks are merged.. blame qcom!) So far, the platform is shaping up nicely, though some peripherals seem to be living their own lives (I'm looking at you, modem!) The QPNP-REVID driver is taken from downstream but seems to work fine upstream. I understand it may need some cleaning-up before it's merged. Current out-of-tree progress can be seen at [2]. [1] https://patchwork.kernel.org/patch/11643603/ [2] https://github.com/konradybcio/linux/commits/ninges_labs Konrad Dybcio (8): clk: qcom: gcc-sdm660: Add missing modem reset phy: qcom-qusb2: Add support for SDM630/660 drivers: usb: dwc3-qcom: Add sdm660 compatible drm/msm/dsi: Add phy configuration for SDM630/636/660 drm/msm/mdp5: Add MDP5 configuration for SDM630 drm/msm/dsi: Add DSI configuration for SDM660 drm/msm/mdp5: Add MDP5 configuration for SDM636/660 clk: qcom: gcc-sdm660: Fix up gcc_mss_mnoc_bimc_axi_clk Xiaozhe Shi (1): soc/qcom: Add REVID driver .../devicetree/bindings/display/msm/dsi.txt | 1 + .../bindings/phy/qcom,qusb2-phy.yaml | 1 + .../bindings/soc/qcom/qcom,qpnp-revid.yaml | 38 ++ .../devicetree/bindings/usb/qcom,dwc3.yaml | 1 + drivers/clk/qcom/gcc-sdm660.c | 4 + drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.c | 198 ++++++++++ drivers/gpu/drm/msm/dsi/dsi_cfg.c | 21 + drivers/gpu/drm/msm/dsi/dsi_cfg.h | 1 + drivers/gpu/drm/msm/dsi/phy/dsi_phy.c | 2 + drivers/gpu/drm/msm/dsi/phy/dsi_phy.h | 1 + drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c | 18 + drivers/phy/qualcomm/phy-qcom-qusb2.c | 7 +- drivers/soc/qcom/Kconfig | 9 + drivers/soc/qcom/Makefile | 1 + drivers/soc/qcom/qpnp-revid.c | 288 ++++++++++++++ drivers/usb/dwc3/dwc3-qcom.c | 1 + include/dt-bindings/clock/qcom,gcc-sdm660.h | 1 + include/linux/qpnp/qpnp-revid.h | 369 ++++++++++++++++++ 18 files changed, 961 insertions(+), 1 deletion(-) create mode 100644 Documentation/devicetree/bindings/soc/qcom/qcom,qpnp-revid.yaml create mode 100644 drivers/soc/qcom/qpnp-revid.c create mode 100644 include/linux/qpnp/qpnp-revid.h -- 2.27.0

6 26

[RFC][PATCH] regulator: rpi-panel: Add regulator/backlight driver for RPi panel
by Marek Vasut 04 Aug '20

04 Aug '20

This regulator/backlight driver handles the ATTINY88 present on the RPi 7" touchscreen panel and exposes the power/backlight interfaces. Signed-off-by: Marek Vasut <marex(a)denx.de> To: dri-devel(a)lists.freedesktop.org Cc: Eric Anholt <eric(a)anholt.net> Cc: Mark Brown <broonie(a)kernel.org> Cc: Sam Ravnborg <sam(a)ravnborg.org> --- drivers/regulator/Kconfig | 10 + drivers/regulator/Makefile | 1 + .../regulator/rpi-panel-attiny-regulator.c | 214 ++++++++++++++++++ 3 files changed, 225 insertions(+) create mode 100644 drivers/regulator/rpi-panel-attiny-regulator.c diff --git a/drivers/regulator/Kconfig b/drivers/regulator/Kconfig index de17ef7e18f0..439cc5226bae 100644 --- a/drivers/regulator/Kconfig +++ b/drivers/regulator/Kconfig @@ -864,6 +864,16 @@ config REGULATOR_QCOM_USB_VBUS Say M here if you want to include support for enabling the VBUS output as a module. The module will be named "qcom_usb_vbus_regulator". +config REGULATOR_RASPBERRYPI_TOUCHSCREEN_ATTINY + tristate "Raspberry Pi 7-inch touchscreen panel ATTINY regulator" + depends on BACKLIGHT_CLASS_DEVICE + depends on I2C + select REGMAP_I2C + help + This driver supports ATTINY regulator on the Raspberry Pi 7-inch + touchscreen unit. The regulator is used to enable power to the + TC358762, display and to control backlight. + config REGULATOR_RC5T583 tristate "RICOH RC5T583 Power regulators" depends on MFD_RC5T583 diff --git a/drivers/regulator/Makefile b/drivers/regulator/Makefile index d8d3ecf526a8..6e39ea87901e 100644 --- a/drivers/regulator/Makefile +++ b/drivers/regulator/Makefile @@ -107,6 +107,7 @@ obj-$(CONFIG_REGULATOR_TPS51632) += tps51632-regulator.o obj-$(CONFIG_REGULATOR_PBIAS) += pbias-regulator.o obj-$(CONFIG_REGULATOR_PCAP) += pcap-regulator.o obj-$(CONFIG_REGULATOR_PCF50633) += pcf50633-regulator.o +obj-$(CONFIG_REGULATOR_RASPBERRYPI_TOUCHSCREEN_ATTINY) += rpi-panel-attiny-regulator.o obj-$(CONFIG_REGULATOR_RC5T583) += rc5t583-regulator.o obj-$(CONFIG_REGULATOR_RK808) += rk808-regulator.o obj-$(CONFIG_REGULATOR_RN5T618) += rn5t618-regulator.o diff --git a/drivers/regulator/rpi-panel-attiny-regulator.c b/drivers/regulator/rpi-panel-attiny-regulator.c new file mode 100644 index 000000000000..ee46bfbf5eee --- /dev/null +++ b/drivers/regulator/rpi-panel-attiny-regulator.c @@ -0,0 +1,214 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (C) 2020 Marek Vasut <marex(a)denx.de> + * + * Based on rpi_touchscreen.c by Eric Anholt <eric(a)anholt.net> + */ + +#include <linux/backlight.h> +#include <linux/err.h> +#include <linux/gpio.h> +#include <linux/i2c.h> +#include <linux/init.h> +#include <linux/interrupt.h> +#include <linux/module.h> +#include <linux/regmap.h> +#include <linux/regulator/driver.h> +#include <linux/regulator/machine.h> +#include <linux/regulator/of_regulator.h> +#include <linux/slab.h> + +/* I2C registers of the Atmel microcontroller. */ +#define REG_ID 0x80 +#define REG_PORTA 0x81 +#define REG_PORTA_HF BIT(2) +#define REG_PORTA_VF BIT(3) +#define REG_PORTB 0x82 +#define REG_POWERON 0x85 +#define REG_PWM 0x86 + +static const struct regmap_config attiny_regmap_config = { + .reg_bits = 8, + .val_bits = 8, + .max_register = REG_PWM, + .cache_type = REGCACHE_NONE, +}; + +static int attiny_lcd_power_enable(struct regulator_dev *rdev) +{ + unsigned int data; + + regmap_write(rdev->regmap, REG_POWERON, 1); + /* Wait for nPWRDWN to go low to indicate poweron is done. */ + regmap_read_poll_timeout(rdev->regmap, REG_PORTB, data, + data & BIT(0), 10, 1000000); + + /* Default to the same orientation as the closed source + * firmware used for the panel. Runtime rotation + * configuration will be supported using VC4's plane + * orientation bits. + */ + regmap_write(rdev->regmap, REG_PORTA, BIT(2)); + + return 0; +} + +static int attiny_lcd_power_disable(struct regulator_dev *rdev) +{ + regmap_write(rdev->regmap, REG_PWM, 0); + regmap_write(rdev->regmap, REG_POWERON, 0); + udelay(1); + return 0; +} + +static int attiny_lcd_power_is_enabled(struct regulator_dev *rdev) +{ + unsigned int data; + int ret; + + ret = regmap_read(rdev->regmap, REG_POWERON, &data); + if (ret < 0) + return ret; + + if (!(data & BIT(0))) + return 0; + + ret = regmap_read(rdev->regmap, REG_PORTB, &data); + if (ret < 0) + return ret; + + return data & BIT(0); +} + +static const struct regulator_init_data attiny_regulator_default = { + .constraints = { + .valid_ops_mask = REGULATOR_CHANGE_STATUS, + }, +}; + +static const struct regulator_ops attiny_regulator_ops = { + .enable = attiny_lcd_power_enable, + .disable = attiny_lcd_power_disable, + .is_enabled = attiny_lcd_power_is_enabled, +}; + +static const struct regulator_desc attiny_regulator = { + .name = "tc358762-power", + .ops = &attiny_regulator_ops, + .type = REGULATOR_VOLTAGE, + .owner = THIS_MODULE, +}; + +static int attiny_update_status(struct backlight_device *bl) +{ + struct regmap *regmap = bl_get_data(bl); + int brightness = bl->props.brightness; + + if (bl->props.power != FB_BLANK_UNBLANK || + bl->props.fb_blank != FB_BLANK_UNBLANK) + brightness = 0; + + return regmap_write(regmap, REG_PWM, brightness); +} + +static int attiny_get_brightness(struct backlight_device *bl) +{ + struct regmap *regmap = bl_get_data(bl); + int ret, brightness; + + ret = regmap_read(regmap, REG_PWM, &brightness); + if (ret) + return ret; + + return brightness; +} + +static const struct backlight_ops attiny_bl = { + .update_status = attiny_update_status, + .get_brightness = attiny_get_brightness, +}; + +/* + * I2C driver interface functions + */ +static int attiny_i2c_probe(struct i2c_client *i2c, + const struct i2c_device_id *id) +{ + struct backlight_properties props = { }; + struct regulator_config config = { }; + struct backlight_device *bl; + struct regulator_dev *rdev; + struct regmap *regmap; + unsigned int data; + int ret; + + regmap = devm_regmap_init_i2c(i2c, &attiny_regmap_config); + if (IS_ERR(regmap)) { + ret = PTR_ERR(regmap); + dev_err(&i2c->dev, "Failed to allocate register map: %d\n", + ret); + return ret; + } + + ret = regmap_read(regmap, REG_ID, &data); + if (ret < 0) { + dev_err(&i2c->dev, "Failed to read REG_ID reg: %d\n", ret); + return ret; + } + + switch (data) { + case 0xde: /* ver 1 */ + case 0xc3: /* ver 2 */ + break; + default: + dev_err(&i2c->dev, "Unknown Atmel firmware revision: 0x%02x\n", data); + return -ENODEV; + } + + regmap_write(regmap, REG_POWERON, 0); + mdelay(1); + + config.dev = &i2c->dev; + config.regmap = regmap; + config.of_node = i2c->dev.of_node; + config.init_data = &attiny_regulator_default; + + rdev = devm_regulator_register(&i2c->dev, &attiny_regulator, &config); + if (IS_ERR(rdev)) { + dev_err(&i2c->dev, "Failed to register ATTINY regulator\n"); + return PTR_ERR(rdev); + } + + props.type = BACKLIGHT_RAW; + props.max_brightness = 0xff; + bl = devm_backlight_device_register(&i2c->dev, + "7inch-touchscreen-panel-bl", + &i2c->dev, regmap, &attiny_bl, + &props); + if (IS_ERR(bl)) + return PTR_ERR(bl); + + bl->props.brightness = 0xff; + + return 0; +} + +static const struct of_device_id attiny_dt_ids[] = { + { .compatible = "raspberrypi,7inch-touchscreen-panel-regulator" }, + {}, +}; +MODULE_DEVICE_TABLE(of, attiny_dt_ids); + +static struct i2c_driver attiny_regulator_driver = { + .driver = { + .name = "rpi_touchscreen_attiny", + .of_match_table = of_match_ptr(attiny_dt_ids), + }, + .probe = attiny_i2c_probe, +}; + +module_i2c_driver(attiny_regulator_driver); + +MODULE_AUTHOR("Marek Vasut <marex(a)denx.de>"); +MODULE_DESCRIPTION("Regulator device driver for Raspberry Pi 7-inch touchscreen"); +MODULE_LICENSE("GPL v2"); -- 2.27.0

3 9

[Bug 208333] New: No desktop on 5.8 rc1 rc2 with Gtx 760 driver nouveau
by bugzilla-daemon＠bugzilla.kernel.org 04 Aug '20

04 Aug '20

https://bugzilla.kernel.org/show_bug.cgi?id=208333 Bug ID: 208333 Summary: No desktop on 5.8 rc1 rc2 with Gtx 760 driver nouveau Product: Drivers Version: 2.5 Kernel Version: 5.8 rc2 Hardware: All OS: Linux Tree: Mainline Status: NEW Severity: high Priority: P1 Component: Video(DRI - non Intel) Assignee: drivers_video-dri(a)kernel-bugs.osdl.org Reporter: robyguerrini(a)yahoo.it Regression: No With Kernel 5.8 rc1/rc2/ the desktop don't is visualized.... this on Ubuntu 20.04 and vedeo card Gtx 760 Nvidia with Nouveau Driver. The machine is on... the keyboards led working but the screen is black. -- You are receiving this mail because: You are watching the assignee of the bug.

1 13

[PATCH v2 0/5] make hdmi work on bananapi-r2
by Frank Wunderlich 04 Aug '20

04 Aug '20

This Patch-Series adds missing Patches/Bugfixes to get hdmi working on BPI-R2 This is v2 of series https://patchwork.kernel.org/cover/10903309/ after getting mmsys done v1->v2: - using get_possible_crtc API instead of hardcoded - drop unused dts-nodes - refine commit-messages as far as i can :) "config component output by device node port" is needed to fix a WARN_ON() "fix boot up for 720 and 480 but 1080" fixes flickering, which may cause also some resolutions not working on some TFT (had some problems on my smaller TFT) 2 Patches were already posted, but not yet merged into mainline - config component output by device node port https://patchwork.kernel.org/patch/10609007/ - add display subsystem related device nodes (resend) https://patchwork.kernel.org/patch/10588951/ Bibby Hsieh (1): drm/mediatek: config component output by device node port Jitao Shi (1): drm/mediatek: dpi/dsi: change the getting possible_crtc way Ryder Lee (1): arm: dts: mt7623: add display subsystem related device nodes Stu Hsieh (1): drm: Add get_possible_crtc API for dpi, dsi chunhui dai (1): drm/mediatek: fix boot up for 720 and 480 but 1080 arch/arm/boot/dts/mt7623.dtsi | 177 ++++++++++++++++++ arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts | 85 +++++++++ arch/arm/boot/dts/mt7623n-rfb-emmc.dts | 85 +++++++++ drivers/gpu/drm/mediatek/mtk_dpi.c | 3 +- drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c | 42 +++++ drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h | 2 + drivers/gpu/drm/mediatek/mtk_drm_drv.c | 46 ++++- drivers/gpu/drm/mediatek/mtk_drm_drv.h | 4 +- drivers/gpu/drm/mediatek/mtk_dsi.c | 3 +- drivers/gpu/drm/mediatek/mtk_hdmi_phy.c | 3 + drivers/gpu/drm/mediatek/mtk_hdmi_phy.h | 1 + .../gpu/drm/mediatek/mtk_mt2701_hdmi_phy.c | 1 + 12 files changed, 442 insertions(+), 10 deletions(-) -- 2.25.1

2 18

[RFC][PATCH 0/5] Support GEM object mappings from I/O memory
by Thomas Zimmermann 04 Aug '20

04 Aug '20

DRM's fbdev console uses regular load and store operations to update framebuffer memory. The bochs driver on sparc64 requires the use of I/O-specific load and store operations. We have a workaround, but need a long-term sulotion tothe problem. This patchset adds a GEM object function that returns framebuffers as I/O memory. It further updates fbdev to use the new functionality and implements vmap_iomem for VRAM helpers. This is an RFC patchset to discuss the approach. It still needs testing and polish. Patch #4 has to be rebased onto the recent workaround. Thomas Zimmermann (5): fbdev: Remove trailing whitespace fbdev/core: Export framebuffer read and write code as cfb_ function drm: Add infrastructure for vmap operations of I/O memory drm/fb_helper: Use I/O-memory mappings if available drm/vram_helper: Implement struct drm_gem_object_funcs.vmap_iomem drivers/gpu/drm/ast/ast_cursor.c | 12 ++- drivers/gpu/drm/drm_client.c | 52 +++++++++- drivers/gpu/drm/drm_fb_helper.c | 132 ++++++++++++++++++++++---- drivers/gpu/drm/drm_gem.c | 19 ++++ drivers/gpu/drm/drm_gem_vram_helper.c | 106 +++++++++++++++++++-- drivers/gpu/drm/drm_internal.h | 1 + drivers/video/fbdev/core/fbmem.c | 61 ++++++++---- include/drm/drm_client.h | 8 +- include/drm/drm_gem.h | 17 +++- include/drm/drm_gem_vram_helper.h | 1 + include/linux/fb.h | 23 +++-- 11 files changed, 369 insertions(+), 63 deletions(-) -- 2.27.0

3 16

[PATCH v2 0/3] More IPU cleanups v2
by Paul Cercueil 04 Aug '20

04 Aug '20

Patch [1/3] unchanged. Patches [2/3] and [3/3] have had their commit message slightly modified, but the patches themselves are the same as before. Cheers, -Paul Paul Cercueil (3): drm/ingenic: ipu: Only restart manually on older SoCs drm/ingenic: ipu: Remove YUV422 from supported formats on JZ4725B drm/ingenic: ipu: Only enable clock when needed drivers/gpu/drm/ingenic/ingenic-ipu.c | 38 +++++++++++++++++++++++---- 1 file changed, 33 insertions(+), 5 deletions(-) -- 2.27.0

3 7

[PATCH] drm: omapdrm: Delete surplus GPIO includes
by Linus Walleij 04 Aug '20

04 Aug '20

The OMAP DRM driver includes <linux/gpio.h> into the two hdmi4.c and hdmi5.c files but does not use any symbols from these files. Drop the includes. Cc: Tomi Valkeinen <tomi.valkeinen(a)ti.com> Cc: Tony Lindgren <tony(a)atomide.com> Cc: Jyri Sarha <jsarha(a)ti.com> Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> --- drivers/gpu/drm/omapdrm/dss/hdmi4.c | 1 - drivers/gpu/drm/omapdrm/dss/hdmi5.c | 1 - 2 files changed, 2 deletions(-) diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi4.c b/drivers/gpu/drm/omapdrm/dss/hdmi4.c index 2578c95570f6..a14fbf06cb30 100644 --- a/drivers/gpu/drm/omapdrm/dss/hdmi4.c +++ b/drivers/gpu/drm/omapdrm/dss/hdmi4.c @@ -20,7 +20,6 @@ #include <linux/platform_device.h> #include <linux/pm_runtime.h> #include <linux/clk.h> -#include <linux/gpio.h> #include <linux/regulator/consumer.h> #include <linux/component.h> #include <linux/of.h> diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi5.c b/drivers/gpu/drm/omapdrm/dss/hdmi5.c index 4d4c1fabd0a1..b738d9750686 100644 --- a/drivers/gpu/drm/omapdrm/dss/hdmi5.c +++ b/drivers/gpu/drm/omapdrm/dss/hdmi5.c @@ -24,7 +24,6 @@ #include <linux/platform_device.h> #include <linux/pm_runtime.h> #include <linux/clk.h> -#include <linux/gpio.h> #include <linux/regulator/consumer.h> #include <linux/component.h> #include <linux/of.h> -- 2.25.4

2 1

[PATCH v2] drm/omap: force runtime PM suspend on system suspend
by Tomi Valkeinen 04 Aug '20

04 Aug '20

Use SET_LATE_SYSTEM_SLEEP_PM_OPS in DSS submodules to force runtime PM suspend and resume. We use suspend late version so that omapdrm's system suspend callback is called first, as that will disable all the display outputs after which it's safe to force DSS into suspend. Signed-off-by: Tomi Valkeinen <tomi.valkeinen(a)ti.com> --- drivers/gpu/drm/omapdrm/dss/dispc.c | 1 + drivers/gpu/drm/omapdrm/dss/dsi.c | 1 + drivers/gpu/drm/omapdrm/dss/dss.c | 1 + drivers/gpu/drm/omapdrm/dss/venc.c | 1 + 4 files changed, 4 insertions(+) diff --git a/drivers/gpu/drm/omapdrm/dss/dispc.c b/drivers/gpu/drm/omapdrm/dss/dispc.c index 6639ee9b05d3..48593932bddf 100644 --- a/drivers/gpu/drm/omapdrm/dss/dispc.c +++ b/drivers/gpu/drm/omapdrm/dss/dispc.c @@ -4915,6 +4915,7 @@ static int dispc_runtime_resume(struct device *dev) static const struct dev_pm_ops dispc_pm_ops = { .runtime_suspend = dispc_runtime_suspend, .runtime_resume = dispc_runtime_resume, + SET_LATE_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, pm_runtime_force_resume) }; struct platform_driver omap_dispchw_driver = { diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.c b/drivers/gpu/drm/omapdrm/dss/dsi.c index 79ddfbfd1b58..eeccf40bae41 100644 --- a/drivers/gpu/drm/omapdrm/dss/dsi.c +++ b/drivers/gpu/drm/omapdrm/dss/dsi.c @@ -5467,6 +5467,7 @@ static int dsi_runtime_resume(struct device *dev) static const struct dev_pm_ops dsi_pm_ops = { .runtime_suspend = dsi_runtime_suspend, .runtime_resume = dsi_runtime_resume, + SET_LATE_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, pm_runtime_force_resume) }; struct platform_driver omap_dsihw_driver = { diff --git a/drivers/gpu/drm/omapdrm/dss/dss.c b/drivers/gpu/drm/omapdrm/dss/dss.c index 4d5739fa4a5d..6ccbc29c4ce4 100644 --- a/drivers/gpu/drm/omapdrm/dss/dss.c +++ b/drivers/gpu/drm/omapdrm/dss/dss.c @@ -1614,6 +1614,7 @@ static int dss_runtime_resume(struct device *dev) static const struct dev_pm_ops dss_pm_ops = { .runtime_suspend = dss_runtime_suspend, .runtime_resume = dss_runtime_resume, + SET_LATE_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, pm_runtime_force_resume) }; struct platform_driver omap_dsshw_driver = { diff --git a/drivers/gpu/drm/omapdrm/dss/venc.c b/drivers/gpu/drm/omapdrm/dss/venc.c index 9701843ccf09..01ee6c50b663 100644 --- a/drivers/gpu/drm/omapdrm/dss/venc.c +++ b/drivers/gpu/drm/omapdrm/dss/venc.c @@ -902,6 +902,7 @@ static int venc_runtime_resume(struct device *dev) static const struct dev_pm_ops venc_pm_ops = { .runtime_suspend = venc_runtime_suspend, .runtime_resume = venc_runtime_resume, + SET_LATE_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, pm_runtime_force_resume) }; static const struct of_device_id venc_of_match[] = { -- Texas Instruments Finland Oy, Porkkalankatu 22, 00180 Helsinki. Y-tunnus/Business ID: 0615521-4. Kotipaikka/Domicile: Helsinki

2 6

Re: [PATCH] vgacon: fix out of bounds write to the scrollback buffer
by Jiri Slaby 04 Aug '20

04 Aug '20

Hi, OTOH, you should have CCed all the (public) lists. On 30. 07. 20, 4:50, 张云海 wrote: > Zhang Xiao points out that the check should use > instead of >=, > otherwise the last line will be skip. > I agree with that, so I modify the patch. > Could you please verify that it is still correct and sufficient? IMO, yes, correct -- I was thinking about this yesterday too. Just an example: hypothetically, if we had: size_row = 1 tail = 29 size = 30 data[29] would be the last accessible member. Writing to data + tail (as "29 + 1 > 30" doesn't hold, so the modified check would pass), i.e. data[29] is still OK. So yes, > is OK, >= would waste space and would be actually incorrect. > BTW, Zhang Xiao also points out that the check after the memcpy can be > remove. > I also think that was right, but vgacon_scrollback_cur->tail may keep > the value vgacon_scrollback_cur->size in some case. That is not a > problem in vgacon_scrollback_update because of the check before the > memcpy. However, that may break some other code which assumes that > vgacon_scrollback_cur->tail won't be vgacon_scrollback_cur->size. I do > not know if there are such code, and if it is the code actually should > check it too. But I still not remove the check in the patch to make sure > it won't breaks other code. As I wrote about this yesterday: === I am also not sure the test I was pointing out on the top of this message would be of any use after the change. But maybe leave the code rest in peace. === I would let it as is in this particular code. Especially because vgacon_scrolldelta takes ->tail into consideration and I was too lazy to study the code there. But if you are willing to study the code there and confirm the check is superfluous, feel free to remove it. Perhaps in a separate patch. I was actually testing with the check removed and didn't hit any issue (which means, in fact, exactly nothing). > From ad143ede24ff4e61292cc9c96000100aacd97259 Mon Sep 17 00:00:00 2001 > From: Yunhai Zhang <zhangyunhai(a)nsfocus.com> > Date: Tue, 28 Jul 2020 09:58:03 +0800 > Subject: [PATCH] Fix for missing check in vgacon scrollback handling > > vgacon_scrollback_update() always left enbough room in the scrollback "leaves enough" > buffer for the next call, but if the console size changed that room > might not actually be enough, and so we need to re-check. Also, could you add reasoning why you are adding the check to the loop and not outside (for instance, use your reasoning with numbers or CSI M as an example). Could you add a sample output here, something like I had: === This leads to random crashes or KASAN reports like: BUG: KASAN: slab-out-of-bounds in vgacon_scroll+0x57a/0x8ed === It's then easier to google for when this happens to someone who runs non-patched kernels. > This fixes CVE-2020-14331. > > Reported-and-debugged-by: 张云海 <zhangyunhai(a)nsfocus.com> > Reported-and-debugged-by: Yang Yingliang <yangyingliang(a)huawei.com> > Reported-by: Kyungtae Kim <kt0755(a)gmail.com> > Fixes: 15bdab959c9b ([PATCH] vgacon: Add support for soft scrollback) > Cc: Linus Torvalds <torvalds(a)linux-foundation.org> > Cc: Greg KH <greg(a)kroah.com> > Cc: Solar Designer <solar(a)openwall.com> > Cc: "Srivatsa S. Bhat" <srivatsa(a)csail.mit.edu> > Cc: Anthony Liguori <aliguori(a)amazon.com> > Cc: Yang Yingliang <yangyingliang(a)huawei.com> > Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie(a)samsung.com> Oh, and we should: Cc: stable(a)vger.kernel.org > Signed-off-by: Yunhai Zhang <zhangyunhai(a)nsfocus.com> > --- > drivers/video/console/vgacon.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c > index 998b0de1812f..37b5711cd958 100644 > --- a/drivers/video/console/vgacon.c > +++ b/drivers/video/console/vgacon.c > @@ -251,6 +251,10 @@ static void vgacon_scrollback_update(struct vc_data *c, int t, int count) > p = (void *) (c->vc_origin + t * c->vc_size_row); > > while (count--) { > + if ((vgacon_scrollback_cur->tail + c->vc_size_row) > > + vgacon_scrollback_cur->size) > + vgacon_scrollback_cur->tail = 0; > + > scr_memcpyw(vgacon_scrollback_cur->data + > vgacon_scrollback_cur->tail, > p, c->vc_size_row); thanks, -- js suse labs

5 9

[PATCH] vt: Handle recursion in vc_do_resize().
by Tetsuo Handa 04 Aug '20

04 Aug '20

syzbot is reporting OOB read bug in vc_do_resize() [1] caused by memcpy() based on outdated old_{rows,row_size} values, for resize_screen() can recurse into vc_do_resize() which changes vc->vc_{cols,rows} that outdates old_{rows,row_size} values which were read before calling resize_screen(). Minimal fix might be to read vc->vc_{rows,size_row} after resize_screen(). A different fix might be to forbid recursive vc_do_resize() request. I can't tell which fix is the better. But since I guess that new_cols == vc->vc_cols && new_rows == vc->vc_rows check could become true after returning from resize_screen(), and I assume that not calling clear_selection() when resize_screen() will return error is harmless, let's redo the check by moving resize_screen() earlier. [1] https://syzkaller.appspot.com/bug?id=c70c88cfd16dcf6e1d3c7f0ab8648b3144b5b2… Reported-by: syzbot <syzbot+c37a14770d51a085a520(a)syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> --- drivers/tty/vt/vt.c | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 42d8c67..952a067 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -1217,7 +1217,24 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) return 0; + if (new_screen_size > KMALLOC_MAX_SIZE || !new_screen_size) + return -EINVAL; + /* + * Since fbcon_resize() from resize_screen() can recurse into + * this function via fb_set_var(), handle recursion now. + */ + err = resize_screen(vc, new_cols, new_rows, user); + if (err) + return err; + /* Reload values in case recursion changed vc->vc_{cols,rows}. */ + new_cols = (cols ? cols : vc->vc_cols); + new_rows = (lines ? lines : vc->vc_rows); + new_row_size = new_cols << 1; + new_screen_size = new_row_size * new_rows; + + if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) + return 0; if (new_screen_size > KMALLOC_MAX_SIZE || !new_screen_size) return -EINVAL; newscreen = kzalloc(new_screen_size, GFP_USER); @@ -1238,13 +1255,6 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, old_rows = vc->vc_rows; old_row_size = vc->vc_size_row; - err = resize_screen(vc, new_cols, new_rows, user); - if (err) { - kfree(newscreen); - vc_uniscr_free(new_uniscr); - return err; - } - vc->vc_rows = new_rows; vc->vc_cols = new_cols; vc->vc_size_row = new_row_size; -- 1.8.3.1

4 7

← Newer
1
...
17
18
19
20
21
22
23
...
78
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

dri-devel July 2020