dri-devel March 2022

dri-devel@lists.freedesktop.org

370 participants
780 discussions

[PATCH v13 1/6] MIPS: Loongson64: dts: update the display controller device node
by Sui Jingfeng 30 Mar '22

30 Mar '22

The display controller is a pci device, it is used in ls2k1000 SoC and LS7A1000 bridge. Its PCI vendor id is 0x0014, its PCI device id is 0x7a06. In order to let the driver to know which chip the DC is contained in, the compatible of the display controller is named according to the chip's name. For LS7A1000, there are 4 dedicated GPIOs whose control register is located at the DC register space. They are used to emulate i2c for reading edid from the monitor. One for DVO0, another for DVO1. … [View More]LS2K1000 and LS2K0500 SoC don't have such GPIOs, they grab i2c adapter from other module, either general purpose GPIO emulated i2c or hardware i2c adapter. This patch add common part of the DC device node only, it does not contain ports device note. As it is for the generic, boards only with transparent encoders should works simply by inherit from this. Signed-off-by: Sui Jingfeng <15330273260(a)189.cn> --- .../boot/dts/loongson/loongson64-2k1000.dtsi | 8 +++++++ arch/mips/boot/dts/loongson/ls7a-pch.dtsi | 24 +++++++++++++++---- 2 files changed, 27 insertions(+), 5 deletions(-) diff --git a/arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi b/arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi index 8143a61111e3..2ecb5a232f22 100644 --- a/arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi +++ b/arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi @@ -198,6 +198,14 @@ sata@8,0 { interrupt-parent = <&liointc0>; }; + lsdc: display-controller@6,0 { + compatible = "loongson,ls2k1000-dc"; + + reg = <0x3000 0x0 0x0 0x0 0x0>; + interrupts = <28 IRQ_TYPE_LEVEL_LOW>; + interrupt-parent = <&liointc0>; + }; + pci_bridge@9,0 { compatible = "pci0014,7a19.0", "pci0014,7a19", diff --git a/arch/mips/boot/dts/loongson/ls7a-pch.dtsi b/arch/mips/boot/dts/loongson/ls7a-pch.dtsi index 2f45fce2cdc4..1d3fe73b31d5 100644 --- a/arch/mips/boot/dts/loongson/ls7a-pch.dtsi +++ b/arch/mips/boot/dts/loongson/ls7a-pch.dtsi @@ -160,15 +160,29 @@ gpu@6,0 { interrupt-parent = <&pic>; }; - dc@6,1 { - compatible = "pci0014,7a06.0", - "pci0014,7a06", - "pciclass030000", - "pciclass0300"; + lsdc: display-controller@6,1 { + compatible = "loongson,ls7a1000-dc"; reg = <0x3100 0x0 0x0 0x0 0x0>; interrupts = <28 IRQ_TYPE_LEVEL_HIGH>; interrupt-parent = <&pic>; + + #address-cells = <1>; + #size-cells = <0>; + + i2c6: i2c@6 { + compatible = "loongson,gpio-i2c"; + loongson,sda = <0>; + loongson,scl = <1>; + loongson,nr = <6>; + }; + + i2c7: i2c@7 { + compatible = "loongson,gpio-i2c"; + loongson,sda = <2>; + loongson,scl = <3>; + loongson,nr = <7>; + }; }; hda@7,0 { -- 2.25.1 [View Less]

4 11

[PATCH] drm/amdgpu: fix that issue that the number of the crtc of the 3250c is not correct
by RyanLin 30 Mar '22

30 Mar '22

[Why] External displays take priority over internal display when there are fewer display controllers than displays. [How] The root cause is because of that number of the crtc is not correct. The number of the crtc on the 3250c is 3, but on the 3500c is 4. On the source code, we can see that number of the crtc has been fixed at 4. Needs to set the num_crtc to 3 for 3250c platform. Signed-off-by: RyanLin <Tsung-Hua.Lin(a)amd.com> Change-Id: I837df7101cc4849d2c3021fd529b4061edab4bb1 --- … [View More]

7 9

[PATCH 3/3] arm64: dts: qcom: sdm845-xiaomi-beryllium: enable qcom wled backlight and link to panel
by Joel Selvaraj 30 Mar '22

30 Mar '22

Xiaomi Poco F1 uses the QCOM WLED driver for backlight control. Enable and link it to the panel to use it. Signed-off-by: Joel Selvaraj <jo(a)jsfamily.in> --- .../arm64/boot/dts/qcom/sdm845-xiaomi-beryllium.dts | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium.dts b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium.dts index 798fc72578a7..3ebb0f9905d3 100644 --- a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium.dts +++ b/… [View More]

2 2

[PATCH v6 00/12] clk: Improve clock range handling
by Maxime Ripard 30 Mar '22

30 Mar '22

Hi, This is a follow-up of the discussion here: https://lore.kernel.org/linux-clk/20210319150355.xzw7ikwdaga2dwhv@gilmour/ and here: https://lore.kernel.org/all/20210914093515.260031-1-maxime@cerno.tech/ While the initial proposal implemented a new API to temporarily raise and lower clock rates based on consumer workloads, Stephen suggested an alternative approach implemented here. The main issue that needed to be addressed in our case was that in a situation where we would have multiple … [View More]calls to clk_set_rate_range, we would end up with a clock at the maximum of the minimums being set. This would be expected, but the issue was that if one of the users was to relax or drop its requirements, the rate would be left unchanged, even though the ideal rate would have changed. So something like clk_set_rate(user1_clk, 1000); clk_set_min_rate(user1_clk, 2000); clk_set_min_rate(user2_clk, 3000); clk_set_min_rate(user2_clk, 1000); Would leave the clock running at 3000Hz, while the minimum would now be 2000Hz. This was mostly due to the fact that the core only triggers a rate change in clk_set_rate_range() if the current rate is outside of the boundaries, but not if it's within the new boundaries. That series changes that and will trigger a rate change on every call, with the former rate being tried again. This way, providers have a chance to follow whatever policy they see fit for a given clock each time the boundaries change. This series also implements some kunit tests, first to test a few rate related functions in the CCF, and then extends it to make sure that behaviour has some test coverage. Let me know what you think Maxime Changes from v5: - Changed clk_hw_create_clk for clk_hw_get_clk since the former isn't exported to modules. - Added fix for clk_hw_get_clk Changes from v4: - Rename the test file - Move all the tests to the first patch, and fix them up as fixes are done - Improved the test conditions - Added more tests - Improved commit messages - Fixed a regression where two disjoints clock ranges would now be accepted Changes from v3: - Renamed the test file and Kconfig option - Add option to .kunitconfig - Switch to kunit_kzalloc - Use KUNIT_EXPECT_* instead of KUNIT_ASSERT_* where relevant - Test directly relevant calls instead of going through a temporary variable - Switch to more precise KUNIT_ASSERT_* macros where relevant Changes from v2: - Rebased on current next - Rewrote the whole thing according to Stephen reviews - Implemented some kunit tests Changes from v1: - Return NULL in clk_request_start if clk pointer is NULL - Test for clk_req pointer in clk_request_done - Add another user in vc4 - Rebased on top of v5.15-rc1 Maxime Ripard (12): clk: Fix clk_hw_get_clk() when dev is NULL clk: Introduce Kunit Tests for the framework clk: Enforce that disjoints limits are invalid clk: Always clamp the rounded rate clk: Use clamp instead of open-coding our own clk: Always set the rate on clk_set_range_rate clk: Add clk_drop_range clk: bcm: rpi: Add variant structure clk: bcm: rpi: Set a default minimum rate clk: bcm: rpi: Run some clocks at the minimum rate allowed drm/vc4: Add logging and comments drm/vc4: hdmi: Remove clock rate initialization drivers/clk/.kunitconfig | 1 + drivers/clk/Kconfig | 7 + drivers/clk/Makefile | 1 + drivers/clk/bcm/clk-raspberrypi.c | 125 ++++- drivers/clk/clk.c | 76 ++- drivers/clk/clk_test.c | 790 ++++++++++++++++++++++++++++++ drivers/gpu/drm/vc4/vc4_hdmi.c | 13 - drivers/gpu/drm/vc4/vc4_kms.c | 11 + include/linux/clk.h | 11 + 9 files changed, 980 insertions(+), 55 deletions(-) create mode 100644 drivers/clk/clk_test.c -- 2.35.1 [View Less]

3 28

[PATCH 2/3] dt-bindings: display: novatek, nt36672a: add backlight property
by Joel Selvaraj 30 Mar '22

30 Mar '22

Add backlight property and update example to include it. Signed-off-by: Joel Selvaraj <jo(a)jsfamily.in> --- .../devicetree/bindings/display/panel/novatek,nt36672a.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Documentation/devicetree/bindings/display/panel/novatek,nt36672a.yaml b/Documentation/devicetree/bindings/display/panel/novatek,nt36672a.yaml index 563766d283f6..41ee3157a1cd 100644 --- a/Documentation/devicetree/bindings/display/panel/novatek,nt36672a.yaml +++ b/… [View More]

1 0

[PATCH 1/3] drm/panel: nt36672a: add backlight support
by Joel Selvaraj 30 Mar '22

30 Mar '22

Add support for backlight. This panel supports backlight control through the QCOM WLED driver in Xiaomi Poco F1 device. Signed-off-by: Joel Selvaraj <jo(a)jsfamily.in> --- drivers/gpu/drm/panel/panel-novatek-nt36672a.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/panel/panel-novatek-nt36672a.c b/drivers/gpu/drm/panel/panel-novatek-nt36672a.c index 231f371901e8..6d6ce42787e2 100644 --- a/drivers/gpu/drm/panel/panel-novatek-nt36672a.c +++ b/drivers/gpu/drm/panel/… [View More]

1 0

[PATCH 0/3] drm/panel: nt36672a: add backlight support
by Joel Selvaraj 30 Mar '22

30 Mar '22

Joel Selvaraj (3): drm/panel: nt36672a: add backlight support dt-bindings: display: novatek,nt36672a: add backlight property arm64: dts: qcom: sdm845-xiaomi-beryllium: enable qcom wled backlight and link to panel .../bindings/display/panel/novatek,nt36672a.yaml | 2 ++ .../arm64/boot/dts/qcom/sdm845-xiaomi-beryllium.dts | 13 +++++++++++++ drivers/gpu/drm/panel/panel-novatek-nt36672a.c | 4 ++++ 3 files changed, 19 insertions(+) -- 2.35.1

1 0

Re: [PATCH v11] drm/amdgpu: add drm buddy support to amdgpu
by Arunpravin Paneer Selvam 30 Mar '22

30 Mar '22

> -----Original Message----- > From: amd-gfx <amd-gfx-bounces(a)lists.freedesktop.org> On Behalf Of Christian König > Sent: Wednesday, March 23, 2022 1:07 PM > To: Paneer Selvam, Arunpravin <Arunpravin.PaneerSelvam(a)amd.com>; intel-gfx(a)lists.freedesktop.org; dri-devel(a)lists.freedesktop.org; amd-gfx(a)lists.freedesktop.org > Cc: Deucher, Alexander <Alexander.Deucher(a)amd.com>; matthew.auld(a)intel.com; daniel(a)ffwll.ch; Koenig, Christian <Christian.… [View More]Koenig(a)amd.com> > Subject: Re: [PATCH v11] drm/amdgpu: add drm buddy support to amdgpu > > Am 23.03.22 um 07:25 schrieb Arunpravin Paneer Selvam: >> [SNIP] >> @@ -415,48 +409,86 @@ static int amdgpu_vram_mgr_new(struct ttm_resource_manager *man, >> goto error_fini; >> } >> >> - mode = DRM_MM_INSERT_BEST; >> + INIT_LIST_HEAD(&node->blocks); >> + >> if (place->flags & TTM_PL_FLAG_TOPDOWN) >> - mode = DRM_MM_INSERT_HIGH; >> + node->flags |= DRM_BUDDY_TOPDOWN_ALLOCATION; >> >> - pages_left = node->base.num_pages; >> + if (place->fpfn || lpfn != man->size >> PAGE_SHIFT) >> + /* Allocate blocks in desired range */ >> + node->flags |= DRM_BUDDY_RANGE_ALLOCATION; >> >> - /* Limit maximum size to 2GB due to SG table limitations */ >> - pages = min(pages_left, 2UL << (30 - PAGE_SHIFT)); >> + BUG_ON(!node->base.num_pages); > > Please drop this BUG_ON(). This is not something which prevents further data corruption, so the BUG_ON() is not justified. ok > >> + pages_left = node->base.num_pages; >> >> i = 0; >> - spin_lock(&mgr->lock); >> while (pages_left) { >> - uint32_t alignment = tbo->page_alignment; >> + if (tbo->page_alignment) >> + min_page_size = tbo->page_alignment << PAGE_SHIFT; >> + else >> + min_page_size = mgr->default_page_size; > > The handling here looks extremely awkward to me. > > min_page_size should be determined outside of the loop, based on default_page_size, alignment and contiguous flag. I kept min_page_size determine logic inside the loop for cases 2GiB+ requirements, Since now we are round up the size to the required alignment, I modified the min_page_size determine logic outside of the loop in v12. Please review. > > Then why do you drop the lock and grab it again inside the loop? And what is "i" actually good for? modified the lock/unlock placement in v12. "i" is to track when there is 2GiB+ contiguous allocation request, first we allocate 2GiB (due to SG table limit) continuously and the remaining pages in the next iteration, hence this request can't be a continuous. To set the placement flag we make use of "i" value. In our case "i" value becomes 2 and we don't set the below flag. node->base.placement |= TTM_PL_FLAG_CONTIGUOUS; If we don't get such requests, I will remove "i". > >> + >> + /* Limit maximum size to 2GB due to SG table limitations */ >> + pages = min(pages_left, 2UL << (30 - PAGE_SHIFT)); >> >> if (pages >= pages_per_node) >> - alignment = pages_per_node; >> - >> - r = drm_mm_insert_node_in_range(mm, &node->mm_nodes[i], pages, >> - alignment, 0, place->fpfn, >> - lpfn, mode); >> - if (unlikely(r)) { >> - if (pages > pages_per_node) { >> - if (is_power_of_2(pages)) >> - pages = pages / 2; >> - else >> - pages = rounddown_pow_of_two(pages); >> - continue; >> - } >> - goto error_free; >> + min_page_size = pages_per_node << PAGE_SHIFT; >> + >> + if (!is_contiguous && !IS_ALIGNED(pages, min_page_size >> PAGE_SHIFT)) >> + is_contiguous = 1; >> + >> + if (is_contiguous) { >> + pages = roundup_pow_of_two(pages); >> + min_page_size = pages << PAGE_SHIFT; >> + >> + if (pages > lpfn) >> + lpfn = pages; >> } >> >> - vis_usage += amdgpu_vram_mgr_vis_size(adev, &node->mm_nodes[i]); >> - amdgpu_vram_mgr_virt_start(&node->base, &node->mm_nodes[i]); >> - pages_left -= pages; >> + BUG_ON(min_page_size < mm->chunk_size); >> + >> + mutex_lock(&mgr->lock); >> + r = drm_buddy_alloc_blocks(mm, (u64)place->fpfn << PAGE_SHIFT, >> + (u64)lpfn << PAGE_SHIFT, >> + (u64)pages << PAGE_SHIFT, >> + min_page_size, >> + &node->blocks, >> + node->flags); >> + mutex_unlock(&mgr->lock); >> + if (unlikely(r)) >> + goto error_free_blocks; >> + >> ++i; >> >> if (pages > pages_left) >> - pages = pages_left; >> + pages_left = 0; >> + else >> + pages_left -= pages; >> } >> - spin_unlock(&mgr->lock); >> >> - if (i == 1) >> + /* Free unused pages for contiguous allocation */ >> + if (is_contiguous) { > > Well that looks really odd, why is trimming not part of > drm_buddy_alloc_blocks() ? we didn't place trim function part of drm_buddy_alloc_blocks since we thought this function can be a generic one and it can be used by any other application as well. For example, now we are using it for trimming the last block in case of size non-alignment with min_page_size. > >> + u64 actual_size = (u64)node->base.num_pages << PAGE_SHIFT; >> + >> + mutex_lock(&mgr->lock); >> + drm_buddy_block_trim(mm, >> + actual_size, >> + &node->blocks); > > Why is the drm_buddy_block_trim() function given all the blocks and not just the last one? modified in v12. > > Regards, > Christian. > >> + mutex_unlock(&mgr->lock); >> + } >> + >> + list_for_each_entry(block, &node->blocks, link) >> + vis_usage += amdgpu_vram_mgr_vis_size(adev, block); >> + >> + block = amdgpu_vram_mgr_first_block(&node->blocks); >> + if (!block) { >> + r = -EINVAL; >> + goto error_fini; >> + } >> + >> + node->base.start = amdgpu_node_start(block) >> PAGE_SHIFT; >> + >> + if (i == 1 && is_contiguous) >> node->base.placement |= TTM_PL_FLAG_CONTIGUOUS; >> >> if (adev->gmc.xgmi.connected_to_cpu) @@ -468,13 +500,13 @@ static >> int amdgpu_vram_mgr_new(struct ttm_resource_manager *man, >> *res = &node->base; >> return 0; >> >> -error_free: >> - while (i--) >> - drm_mm_remove_node(&node->mm_nodes[i]); >> - spin_unlock(&mgr->lock); >> +error_free_blocks: >> + mutex_lock(&mgr->lock); >> + drm_buddy_free_list(mm, &node->blocks); >> + mutex_unlock(&mgr->lock); >> error_fini: >> ttm_resource_fini(man, &node->base); >> - kvfree(node); >> + kfree(node); >> >> return r; >> } >> @@ -490,27 +522,26 @@ static int amdgpu_vram_mgr_new(struct ttm_resource_manager *man, >> static void amdgpu_vram_mgr_del(struct ttm_resource_manager *man, >> struct ttm_resource *res) >> { >> - struct ttm_range_mgr_node *node = to_ttm_range_mgr_node(res); >> + struct amdgpu_vram_mgr_node *node = to_amdgpu_vram_mgr_node(res); >> struct amdgpu_vram_mgr *mgr = to_vram_mgr(man); >> struct amdgpu_device *adev = to_amdgpu_device(mgr); >> + struct drm_buddy *mm = &mgr->mm; >> + struct drm_buddy_block *block; >> uint64_t vis_usage = 0; >> - unsigned i, pages; >> >> - spin_lock(&mgr->lock); >> - for (i = 0, pages = res->num_pages; pages; >> - pages -= node->mm_nodes[i].size, ++i) { >> - struct drm_mm_node *mm = &node->mm_nodes[i]; >> + mutex_lock(&mgr->lock); >> + list_for_each_entry(block, &node->blocks, link) >> + vis_usage += amdgpu_vram_mgr_vis_size(adev, block); >> >> - drm_mm_remove_node(mm); >> - vis_usage += amdgpu_vram_mgr_vis_size(adev, mm); >> - } >> amdgpu_vram_mgr_do_reserve(man); >> - spin_unlock(&mgr->lock); >> + >> + drm_buddy_free_list(mm, &node->blocks); >> + mutex_unlock(&mgr->lock); >> >> atomic64_sub(vis_usage, &mgr->vis_usage); >> >> ttm_resource_fini(man, res); >> - kvfree(node); >> + kfree(node); >> } >> >> /** >> @@ -648,13 +679,22 @@ static void amdgpu_vram_mgr_debug(struct ttm_resource_manager *man, >> struct drm_printer *printer) >> { >> struct amdgpu_vram_mgr *mgr = to_vram_mgr(man); >> + struct drm_buddy *mm = &mgr->mm; >> + struct drm_buddy_block *block; >> >> drm_printf(printer, " vis usage:%llu\n", >> amdgpu_vram_mgr_vis_usage(mgr)); >> >> - spin_lock(&mgr->lock); >> - drm_mm_print(&mgr->mm, printer); >> - spin_unlock(&mgr->lock); >> + mutex_lock(&mgr->lock); >> + drm_printf(printer, "default_page_size: %lluKiB\n", >> + mgr->default_page_size >> 10); >> + >> + drm_buddy_print(mm, printer); >> + >> + drm_printf(printer, "reserved:\n"); >> + list_for_each_entry(block, &mgr->reserved_pages, link) >> + drm_buddy_block_print(mm, block, printer); >> + mutex_unlock(&mgr->lock); >> } >> >> static const struct ttm_resource_manager_func amdgpu_vram_mgr_func = >> { @@ -674,16 +714,21 @@ int amdgpu_vram_mgr_init(struct amdgpu_device *adev) >> { >> struct amdgpu_vram_mgr *mgr = &adev->mman.vram_mgr; >> struct ttm_resource_manager *man = &mgr->manager; >> + int err; >> >> ttm_resource_manager_init(man, &adev->mman.bdev, >> adev->gmc.real_vram_size); >> >> man->func = &amdgpu_vram_mgr_func; >> >> - drm_mm_init(&mgr->mm, 0, man->size >> PAGE_SHIFT); >> - spin_lock_init(&mgr->lock); >> + err = drm_buddy_init(&mgr->mm, man->size, PAGE_SIZE); >> + if (err) >> + return err; >> + >> + mutex_init(&mgr->lock); >> INIT_LIST_HEAD(&mgr->reservations_pending); >> INIT_LIST_HEAD(&mgr->reserved_pages); >> + mgr->default_page_size = PAGE_SIZE; >> >> ttm_set_driver_manager(&adev->mman.bdev, TTM_PL_VRAM, &mgr->manager); >> ttm_resource_manager_set_used(man, true); @@ -711,16 +756,16 @@ >> void amdgpu_vram_mgr_fini(struct amdgpu_device *adev) >> if (ret) >> return; >> >> - spin_lock(&mgr->lock); >> + mutex_lock(&mgr->lock); >> list_for_each_entry_safe(rsv, temp, &mgr->reservations_pending, node) >> kfree(rsv); >> >> list_for_each_entry_safe(rsv, temp, &mgr->reserved_pages, node) { >> - drm_mm_remove_node(&rsv->mm_node); >> + drm_buddy_free_list(&mgr->mm, &rsv->block); >> kfree(rsv); >> } >> - drm_mm_takedown(&mgr->mm); >> - spin_unlock(&mgr->lock); >> + drm_buddy_fini(&mgr->mm); >> + mutex_unlock(&mgr->lock); >> >> ttm_resource_manager_cleanup(man); >> ttm_set_driver_manager(&adev->mman.bdev, TTM_PL_VRAM, NULL); >> >> base-commit: a678f97326454b60ffbbde6abf52d23997d71a27 [View Less]

2 4

[syzbot] general protection fault in dma_fence_array_first
by syzbot 29 Mar '22

29 Mar '22

Hello, syzbot found the following issue on: HEAD commit: 8515d05bf6bc Add linux-next specific files for 20220328 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=1694e21b700000 kernel config: https://syzkaller.appspot.com/x/.config?x=530c68bef4e2b8a8 dashboard link: https://syzkaller.appspot.com/bug?extid=5c943fe38e86d615cac2 compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 syz repro: https://syzkaller.… [View More]appspot.com/x/repro.syz?x=1467313b700000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=121b7cb9700000 The issue was bisected to: commit 519f490db07e1a539490612f376487f61e48e39c Author: Christian König <christian.koenig(a)amd.com> Date: Fri Mar 11 09:32:26 2022 +0000 dma-buf/sync-file: fix warning about fence containers bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1058277d700000 final oops: https://syzkaller.appspot.com/x/report.txt?x=1258277d700000 console output: https://syzkaller.appspot.com/x/log.txt?x=1458277d700000 IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+5c943fe38e86d615cac2(a)syzkaller.appspotmail.com Fixes: 519f490db07e ("dma-buf/sync-file: fix warning about fence containers") general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 1 PID: 3595 Comm: syz-executor814 Not tainted 5.17.0-next-20220328-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:dma_fence_array_first+0x78/0xb0 drivers/dma-buf/dma-fence-array.c:234 Code: 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 43 48 8b 9b 88 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 da 48 c1 ea 03 <80> 3c 02 00 75 1b 4c 8b 23 e8 fa a9 e0 fc 4c 89 e0 5b 41 5c c3 45 RSP: 0018:ffffc90003a4fd48 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000010 RCX: 0000000000000000 RDX: 0000000000000002 RSI: ffffffff84980052 RDI: ffff888015c76388 RBP: ffff888015c76300 R08: 0000000000000000 R09: ffff888015c7633b R10: ffffffff8498f6ba R11: 0000000000000000 R12: ffff888015c76300 R13: ffff888015c76690 R14: 00000000c0383e04 R15: 0000000020001840 FS: 0000555556872300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020001528 CR3: 000000001e82f000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __dma_fence_unwrap_array include/linux/dma-fence-unwrap.h:42 [inline] dma_fence_unwrap_first include/linux/dma-fence-unwrap.h:57 [inline] sync_file_ioctl_fence_info drivers/dma-buf/sync_file.c:414 [inline] sync_file_ioctl+0x248/0x22c0 drivers/dma-buf/sync_file.c:477 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f6aae8951b9 Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffedd290238 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6aae8951b9 RDX: 0000000020001840 RSI: 00000000c0383e04 RDI: 0000000000000007 RBP: 00007f6aae8591a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6aae859230 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:dma_fence_array_first+0x78/0xb0 drivers/dma-buf/dma-fence-array.c:234 Code: 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 43 48 8b 9b 88 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 da 48 c1 ea 03 <80> 3c 02 00 75 1b 4c 8b 23 e8 fa a9 e0 fc 4c 89 e0 5b 41 5c c3 45 RSP: 0018:ffffc90003a4fd48 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000010 RCX: 0000000000000000 RDX: 0000000000000002 RSI: ffffffff84980052 RDI: ffff888015c76388 RBP: ffff888015c76300 R08: 0000000000000000 R09: ffff888015c7633b R10: ffffffff8498f6ba R11: 0000000000000000 R12: ffff888015c76300 R13: ffff888015c76690 R14: 00000000c0383e04 R15: 0000000020001840 FS: 0000555556872300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020001528 CR3: 000000001e82f000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess), 4 bytes skipped: 0: df 48 89 fisttps -0x77(%rax) 3: fa cli 4: 48 c1 ea 03 shr $0x3,%rdx 8: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) c: 75 43 jne 0x51 e: 48 8b 9b 88 00 00 00 mov 0x88(%rbx),%rbx 15: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 1c: fc ff df 1f: 48 89 da mov %rbx,%rdx 22: 48 c1 ea 03 shr $0x3,%rdx * 26: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction 2a: 75 1b jne 0x47 2c: 4c 8b 23 mov (%rbx),%r12 2f: e8 fa a9 e0 fc callq 0xfce0aa2e 34: 4c 89 e0 mov %r12,%rax 37: 5b pop %rbx 38: 41 5c pop %r12 3a: c3 retq 3b: 45 rex.RB --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. For information about bisection process see: https://goo.gl/tpsmEJ#bisection syzbot can test patches for this issue, for details see: https://goo.gl/tpsmEJ#testing-patches [View Less]

2 2

[PATCH 1/3] drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx
by Dmitry Baryshkov 29 Mar '22

29 Mar '22

Remove loops over hw_vbif. Instead always VBIF's idx as an index in the array. This fixes an error in dpu_kms_hw_init(), where we fill dpu_kms->hw_vbif[i], but check for an error pointer at dpu_kms->hw_vbif[vbif_idx]. Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> --- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 10 ++++---- drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c | 29 +++++++++++------------- 2 files changed,… [View More] 17 insertions(+), 22 deletions(-) diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c index d0653a9ec694..81a35c8d62e7 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c @@ -790,11 +790,9 @@ static void _dpu_kms_hw_destroy(struct dpu_kms *dpu_kms) _dpu_kms_mmu_destroy(dpu_kms); if (dpu_kms->catalog) { - for (i = 0; i < dpu_kms->catalog->vbif_count; i++) { - u32 vbif_idx = dpu_kms->catalog->vbif[i].id; - - if ((vbif_idx < VBIF_MAX) && dpu_kms->hw_vbif[vbif_idx]) - dpu_hw_vbif_destroy(dpu_kms->hw_vbif[vbif_idx]); + for (i = 0; i < ARRAY_SIZE(dpu_kms->hw_vbif); i++) { + if (dpu_kms->hw_vbif[i]) + dpu_hw_vbif_destroy(dpu_kms->hw_vbif[i]); } } @@ -1102,7 +1100,7 @@ static int dpu_kms_hw_init(struct msm_kms *kms) for (i = 0; i < dpu_kms->catalog->vbif_count; i++) { u32 vbif_idx = dpu_kms->catalog->vbif[i].id; - dpu_kms->hw_vbif[i] = dpu_hw_vbif_init(vbif_idx, + dpu_kms->hw_vbif[vbif_idx] = dpu_hw_vbif_init(vbif_idx, dpu_kms->vbif[vbif_idx], dpu_kms->catalog); if (IS_ERR_OR_NULL(dpu_kms->hw_vbif[vbif_idx])) { rc = PTR_ERR(dpu_kms->hw_vbif[vbif_idx]); diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c index 21d20373eb8b..cbbf77b17fc3 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c @@ -11,6 +11,14 @@ #include "dpu_hw_vbif.h" #include "dpu_trace.h" +static struct dpu_hw_vbif *dpu_get_vbif(struct dpu_kms *dpu_kms, enum dpu_vbif vbif_idx) +{ + if (vbif_idx > ARRAY_SIZE(dpu_kms->hw_vbif)) + return dpu_kms->hw_vbif[vbif_idx]; + + return NULL; +} + /** * _dpu_vbif_wait_for_xin_halt - wait for the xin to halt * @vbif: Pointer to hardware vbif driver @@ -148,20 +156,15 @@ static u32 _dpu_vbif_get_ot_limit(struct dpu_hw_vbif *vbif, void dpu_vbif_set_ot_limit(struct dpu_kms *dpu_kms, struct dpu_vbif_set_ot_params *params) { - struct dpu_hw_vbif *vbif = NULL; + struct dpu_hw_vbif *vbif; struct dpu_hw_mdp *mdp; bool forced_on = false; u32 ot_lim; - int ret, i; + int ret; mdp = dpu_kms->hw_mdp; - for (i = 0; i < ARRAY_SIZE(dpu_kms->hw_vbif); i++) { - if (dpu_kms->hw_vbif[i] && - dpu_kms->hw_vbif[i]->idx == params->vbif_idx) - vbif = dpu_kms->hw_vbif[i]; - } - + vbif = dpu_get_vbif(dpu_kms, params->vbif_idx); if (!vbif || !mdp) { DRM_DEBUG_ATOMIC("invalid arguments vbif %d mdp %d\n", vbif != NULL, mdp != NULL); @@ -204,7 +207,7 @@ void dpu_vbif_set_ot_limit(struct dpu_kms *dpu_kms, void dpu_vbif_set_qos_remap(struct dpu_kms *dpu_kms, struct dpu_vbif_set_qos_params *params) { - struct dpu_hw_vbif *vbif = NULL; + struct dpu_hw_vbif *vbif; struct dpu_hw_mdp *mdp; bool forced_on = false; const struct dpu_vbif_qos_tbl *qos_tbl; @@ -216,13 +219,7 @@ void dpu_vbif_set_qos_remap(struct dpu_kms *dpu_kms, } mdp = dpu_kms->hw_mdp; - for (i = 0; i < ARRAY_SIZE(dpu_kms->hw_vbif); i++) { - if (dpu_kms->hw_vbif[i] && - dpu_kms->hw_vbif[i]->idx == params->vbif_idx) { - vbif = dpu_kms->hw_vbif[i]; - break; - } - } + vbif = dpu_get_vbif(dpu_kms, params->vbif_idx); if (!vbif || !vbif->cap) { DPU_ERROR("invalid vbif %d\n", params->vbif_idx); -- 2.34.1 [View Less]

2 5

← Newer
1
...
18
19
20
21
22
23
24
...
78
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

dri-devel March 2022