dri-devel May 2022

dri-devel@lists.freedesktop.org

344 participants
736 discussions

[PATCH v2 00/20] drm/edid: CEA data block iterators, and more
by Jani Nikula 05 May '22

05 May '22

I've kind of lost track of the version numbers on some of the iterator patches, but this is the next version (or mostly a resend) of [1]. There's an additional rename patch for SCDS. BR, Jani. [1] https://patchwork.freedesktop.org/series/102703/ Jani Nikula (19): drm/edid: reset display info in drm_add_edid_modes() for NULL edid drm/edid: rename HDMI Forum VSDB to SCDS drm/edid: clean up CTA data block tag definitions drm/edid: add iterator for EDID base and extension blocks drm/edid: add iterator for CTA data blocks drm/edid: clean up cea_db_is_*() functions drm/edid: convert add_cea_modes() to use cea db iter drm/edid: convert drm_edid_to_speaker_allocation() to use cea db iter drm/edid: convert drm_edid_to_sad() to use cea db iter drm/edid: convert drm_detect_hdmi_monitor() to use cea db iter drm/edid: convert drm_detect_monitor_audio() to use cea db iter drm/edid: convert drm_parse_cea_ext() to use cea db iter drm/edid: convert drm_edid_to_eld() to use cea db iter drm/edid: sunset the old unused cea data block iterators drm/edid: restore some type safety to cea_db_*() functions drm/edid: detect basic audio in all CEA extensions drm/edid: detect color formats and CTA revision in all CTA extensions drm/edid: skip CTA extension scan in drm_edid_to_eld() just for CTA rev drm/edid: sunset drm_find_cea_extension() Lee Shawn C (1): drm/edid: check for HF-SCDB block drivers/gpu/drm/drm_edid.c | 799 +++++++++++++++++++++---------------- 1 file changed, 458 insertions(+), 341 deletions(-) -- 2.30.2

2 23

[PATCH v2] drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected
by Jessica Zhang 05 May '22

05 May '22

mdp5_get_global_state runs the risk of hitting a -EDEADLK when acquiring the modeset lock, but currently mdp5_pipe_release doesn't check for if an error is returned. Because of this, there is a possibility of mdp5_pipe_release hitting a NULL dereference error. To avoid this, let's have mdp5_pipe_release check if mdp5_get_global_state returns an error and propogate that error. Changes since v1: - Separated declaration and initialization of *new_state to avoid compiler warning - Fixed some spelling mistakes in commit message Signed-off-by: Jessica Zhang <quic_jesszhan(a)quicinc.com> --- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c | 15 +++++++++++---- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 20 ++++++++++++++++---- 3 files changed, 28 insertions(+), 9 deletions(-) diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c index ba6695963aa6..97887a2be082 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c @@ -119,18 +119,23 @@ int mdp5_pipe_assign(struct drm_atomic_state *s, struct drm_plane *plane, return 0; } -void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) +int mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) { struct msm_drm_private *priv = s->dev->dev_private; struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(priv->kms)); struct mdp5_global_state *state = mdp5_get_global_state(s); - struct mdp5_hw_pipe_state *new_state = &state->hwpipe; + struct mdp5_hw_pipe_state *new_state; if (!hwpipe) - return; + return -EINVAL; + + if (IS_ERR(state)) + return PTR_ERR(state); + + new_state = &state->hwpipe; if (WARN_ON(!new_state->hwpipe_to_plane[hwpipe->idx])) - return; + return -EINVAL; DBG("%s: release from plane %s", hwpipe->name, new_state->hwpipe_to_plane[hwpipe->idx]->name); @@ -141,6 +146,8 @@ void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) } new_state->hwpipe_to_plane[hwpipe->idx] = NULL; + + return 0; } void mdp5_pipe_destroy(struct mdp5_hw_pipe *hwpipe) diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h index 9b26d0761bd4..cca67938cab2 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h @@ -37,7 +37,7 @@ int mdp5_pipe_assign(struct drm_atomic_state *s, struct drm_plane *plane, uint32_t caps, uint32_t blkcfg, struct mdp5_hw_pipe **hwpipe, struct mdp5_hw_pipe **r_hwpipe); -void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe); +int mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe); struct mdp5_hw_pipe *mdp5_pipe_init(enum mdp5_pipe pipe, uint32_t reg_offset, uint32_t caps); diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c index 228b22830970..979458482841 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c @@ -311,12 +311,24 @@ static int mdp5_plane_atomic_check_with_state(struct drm_crtc_state *crtc_state, mdp5_state->r_hwpipe = NULL; - mdp5_pipe_release(state->state, old_hwpipe); - mdp5_pipe_release(state->state, old_right_hwpipe); + ret = mdp5_pipe_release(state->state, old_hwpipe); + if (ret) + return ret; + + ret = mdp5_pipe_release(state->state, old_right_hwpipe); + if (ret) + return ret; + } } else { - mdp5_pipe_release(state->state, mdp5_state->hwpipe); - mdp5_pipe_release(state->state, mdp5_state->r_hwpipe); + ret = mdp5_pipe_release(state->state, mdp5_state->hwpipe); + if (ret) + return ret; + + ret = mdp5_pipe_release(state->state, mdp5_state->r_hwpipe); + if (ret) + return ret; + mdp5_state->hwpipe = mdp5_state->r_hwpipe = NULL; } -- 2.35.1

3 3

[PATCH 1/2] drm/i915: Don't use DRM_DEBUG_WARN_ON for unexpected l3bank/mslice config
by Tvrtko Ursulin 05 May '22

05 May '22

From: Tvrtko Ursulin <tvrtko.ursulin(a)intel.com> DRM_DEBUG_WARN_ON should only be used when we are certain CI is guaranteed to exercise a certain code path, so in case of values coming from MMIO reads we cannot be sure CI will have all the possible SKUs and parts. Use drm_warn instead and move logging to init phase while at it. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin(a)intel.com> Cc: Matt Roper <matthew.d.roper(a)intel.com> Cc: Jani Nikula <jani.nikula(a)intel.com> --- drivers/gpu/drm/i915/gt/intel_gt.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/i915/gt/intel_gt.c b/drivers/gpu/drm/i915/gt/intel_gt.c index 53307ca0eed0..c474e5c3ea5e 100644 --- a/drivers/gpu/drm/i915/gt/intel_gt.c +++ b/drivers/gpu/drm/i915/gt/intel_gt.c @@ -153,11 +153,14 @@ int intel_gt_init_mmio(struct intel_gt *gt) * An mslice is unavailable only if both the meml3 for the slice is * disabled *and* all of the DSS in the slice (quadrant) are disabled. */ - if (HAS_MSLICES(i915)) + if (HAS_MSLICES(i915)) { gt->info.mslice_mask = slicemask(gt, GEN_DSS_PER_MSLICE) | (intel_uncore_read(gt->uncore, GEN10_MIRROR_FUSE3) & GEN12_MEML3_EN_MASK); + if (!gt->info.mslice_mask) /* should be impossible! */ + drm_warn(&i915->drm, "mslice mask all zero!\n"); + } if (IS_DG2(i915)) { gt->steering_table[MSLICE] = xehpsdv_mslice_steering_table; @@ -171,6 +174,8 @@ int intel_gt_init_mmio(struct intel_gt *gt) gt->info.l3bank_mask = ~intel_uncore_read(gt->uncore, GEN10_MIRROR_FUSE3) & GEN10_L3BANK_MASK; + if (!gt->info.l3bank_mask) /* should be impossible! */ + drm_warn(&i915->drm, "L3 bank mask is all zero!\n"); } else if (HAS_MSLICES(i915)) { MISSING_CASE(INTEL_INFO(i915)->platform); } @@ -882,20 +887,14 @@ static void intel_gt_get_valid_steering(struct intel_gt *gt, { switch (type) { case L3BANK: - GEM_DEBUG_WARN_ON(!gt->info.l3bank_mask); /* should be impossible! */ - *sliceid = 0; /* unused */ *subsliceid = __ffs(gt->info.l3bank_mask); break; case MSLICE: - GEM_DEBUG_WARN_ON(!gt->info.mslice_mask); /* should be impossible! */ - *sliceid = __ffs(gt->info.mslice_mask); *subsliceid = 0; /* unused */ break; case LNCF: - GEM_DEBUG_WARN_ON(!gt->info.mslice_mask); /* should be impossible! */ - /* * An LNCF is always present if its mslice is present, so we * can safely just steer to LNCF 0 in all cases. -- 2.32.0

3 7

[PULL] drm-misc-fixes
by Maarten Lankhorst 05 May '22

05 May '22

drm-misc-fixes-2022-05-05: drm-misc-fixes for v5.18-rc6: - Small fix for hot-unplugging fb devices. - Kconfig fix for it6505. The following changes since commit dc3ae06c5f2170d879ff58696f629d8c3868aec3: drm/sun4i: Remove obsolete references to PHYS_OFFSET (2022-04-26 14:39:56 +0200) are available in the Git repository at: git://anongit.freedesktop.org/drm/drm-misc tags/drm-misc-fixes-2022-05-05 for you to fetch changes up to 841e512ffb64898db6322c0619f6bbc41266d86f: drm/bridge: ite-it6505: add missing Kconfig option select (2022-05-04 10:14:16 +0200) ---------------------------------------------------------------- drm-misc-fixes for v5.18-rc6: - Small fix for hot-unplugging fb devices. - Kconfig fix for it6505. ---------------------------------------------------------------- Fabien Parent (1): drm/bridge: ite-it6505: add missing Kconfig option select Javier Martinez Canillas (1): fbdev: Make fb_release() return -ENODEV if fbdev was unregistered drivers/gpu/drm/bridge/Kconfig | 1 + drivers/video/fbdev/core/fbmem.c | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-)

1 0

Re: [PATCH v3] drm/edid: detect color formats and CTA revision in all CTA extensions
by Ville Syrjälä 05 May '22

05 May '22

On Thu, May 05, 2022 at 01:52:42PM +0300, Jani Nikula wrote: > Convert drm_find_cea_extension() to EDID block iterator in color format > and CTA revision detection. Detect them in all CTA extensions. > > Also parse CTA Data Blocks in DisplayID even if there's no CTA EDID > extension. > > v2: > - Don't assume DRM_COLOR_FORMAT_RGB444 support if there's only DisplayID > CTA Data Blocks (Ville) > > Cc: Ville Syrjälä <ville.syrjala(a)linux.intel.com> > Signed-off-by: Jani Nikula <jani.nikula(a)intel.com> Reviewed-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com> > --- > drivers/gpu/drm/drm_edid.c | 21 +++++++++++++-------- > 1 file changed, 13 insertions(+), 8 deletions(-) > > diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c > index 3b18a6e501df..8d737322145c 100644 > --- a/drivers/gpu/drm/drm_edid.c > +++ b/drivers/gpu/drm/drm_edid.c > @@ -5447,26 +5447,31 @@ static void drm_parse_cea_ext(struct drm_connector *connector, > const struct edid *edid) > { > struct drm_display_info *info = &connector->display_info; > + struct drm_edid_iter edid_iter; > const struct cea_db *db; > struct cea_db_iter iter; > const u8 *edid_ext; > > - edid_ext = drm_find_cea_extension(edid); > - if (!edid_ext) > - return; > + drm_edid_iter_begin(edid, &edid_iter); > + drm_edid_iter_for_each(edid_ext, &edid_iter) { > + if (edid_ext[0] != CEA_EXT) > + continue; > > - info->cea_rev = edid_ext[1]; > + if (!info->cea_rev) > + info->cea_rev = edid_ext[1]; > > - /* The existence of a CEA block should imply RGB support */ > - info->color_formats = DRM_COLOR_FORMAT_RGB444; > + if (info->cea_rev != edid_ext[1]) > + DRM_DEBUG_KMS("CEA extension version mismatch %u != %u\n", > + info->cea_rev, edid_ext[1]); > > - /* CTA DisplayID Data Block does not have byte #3 */ > - if (edid_ext[0] == CEA_EXT) { > + /* The existence of a CTA extension should imply RGB support */ > + info->color_formats = DRM_COLOR_FORMAT_RGB444; > if (edid_ext[3] & EDID_CEA_YCRCB444) > info->color_formats |= DRM_COLOR_FORMAT_YCBCR444; > if (edid_ext[3] & EDID_CEA_YCRCB422) > info->color_formats |= DRM_COLOR_FORMAT_YCBCR422; > } > + drm_edid_iter_end(&edid_iter); > > cea_db_iter_edid_begin(edid, &iter); > cea_db_iter_for_each(db, &iter) { > -- > 2.30.2 -- Ville Syrjälä Intel

1 0

[PATCH 1/2] drm/fourcc: Introduce format modifier for DG2 clear color
by Mika Kahola 05 May '22

05 May '22

DG2 clear color render compression uses Tile4 layout. Therefore, we need to define a new format modifier for uAPI to support clear color rendering. v2: Display version is fixed. [Imre] KDoc is enhanced for cc modifier. [Nanley & Lionel] v3: Split out the modifier addition to a separate patch. Clarify the modifier layout description. Cc: dri-devel(a)lists.freedesktop.org Signed-off-by: Mika Kahola <mika.kahola(a)intel.com> cc: Anshuman Gupta <anshuman.gupta(a)intel.com> Signed-off-by: Juha-Pekka Heikkilä <juha-pekka.heikkila(a)intel.com> Signed-off-by: Ramalingam C <ramalingam.c(a)intel.com> Signed-off-by: Imre Deak <imre.deak(a)intel.com> Acked-by: Nanley Chery <nanley.g.chery(a)intel.com> Reviewed-by: Juha-Pekka Heikkila <juhapekka.heikkila(a)gmail.com> Acked-by: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220411143405.1073845-4-imre… (cherry picked from commit 9035039e1ed691cd893777a42e048003a2f349d6) --- include/uapi/drm/drm_fourcc.h | 36 +++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/include/uapi/drm/drm_fourcc.h b/include/uapi/drm/drm_fourcc.h index 0038aa01508a..b06840297cf0 100644 --- a/include/uapi/drm/drm_fourcc.h +++ b/include/uapi/drm/drm_fourcc.h @@ -557,6 +557,42 @@ extern "C" { */ #define I915_FORMAT_MOD_4_TILED fourcc_mod_code(INTEL, 9) +/* + * Intel color control surfaces (CCS) for DG2 render compression. + * + * The main surface is Tile 4 and at plane index 0. The CCS data is stored + * outside of the GEM object in a reserved memory area dedicated for the + * storage of the CCS data for all RC/RC_CC/MC compressible GEM objects. The + * main surface pitch is required to be a multiple of four Tile 4 widths. + */ +#define I915_FORMAT_MOD_4_TILED_DG2_RC_CCS fourcc_mod_code(INTEL, 10) + +/* + * Intel color control surfaces (CCS) for DG2 media compression. + * + * The main surface is Tile 4 and at plane index 0. For semi-planar formats + * like NV12, the Y and UV planes are Tile 4 and are located at plane indices + * 0 and 1, respectively. The CCS for all planes are stored outside of the + * GEM object in a reserved memory area dedicated for the storage of the + * CCS data for all RC/RC_CC/MC compressible GEM objects. The main surface + * pitch is required to be a multiple of four Tile 4 widths. + */ +#define I915_FORMAT_MOD_4_TILED_DG2_MC_CCS fourcc_mod_code(INTEL, 11) + +/* + * Intel Color Control Surface with Clear Color (CCS) for DG2 render compression. + * + * The main surface is Tile 4 and at plane index 0. The CCS data is stored + * outside of the GEM object in a reserved memory area dedicated for the + * storage of the CCS data for all RC/RC_CC/MC compressible GEM objects. The + * main surface pitch is required to be a multiple of four Tile 4 widths. The + * clear color is stored at plane index 1 and the pitch should be ignored. The + * format of the 256 bits of clear color data matches the one used for the + * I915_FORMAT_MOD_Y_TILED_GEN12_RC_CCS_CC modifier, see its description + * for details. + */ +#define I915_FORMAT_MOD_4_TILED_DG2_RC_CCS_CC fourcc_mod_code(INTEL, 12) + /* * Tiled, NV12MT, grouped in 64 (pixels) x 32 (lines) -sized macroblocks *

1 0

[PATCH v2 0/4] fbdev: Fix use-after-free caused by wrong fb_info cleanup in drivers
by Javier Martinez Canillas 05 May '22

05 May '22

Hello, This series contains patches suggested by Daniel Vetter to fix a use-after-free error in the fb_release() function, due a fb_info associated with a fbdev being freed too early while a user-space process still has the fbdev dev node opened. That is caused by a wrong management of the struct fb_info lifetime in drivers, but the fbdev core can also be made more resilient about it an leak This can easily be reproduced with the simplefb driver doing the following: $ cat < /dev/fb0 & $ echo simple-framebuffer.0 > /sys/bus/platform/drivers/simple-framebuffer/unbind $ kill %1 [ 257.490471] ------------[ cut here ]------------ ... [ 257.495125] refcount_t: underflow; use-after-free. [ 257.495222] WARNING: CPU: 0 PID: 975 at lib/refcount.c:28 refcount_warn_saturate+0xf4/0x144 ... [ 257.637482] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 257.644441] pc : refcount_warn_saturate+0xf4/0x144 [ 257.649226] lr : refcount_warn_saturate+0xf4/0x144 [ 257.654009] sp : ffff80000a06bbf0 [ 257.657315] x29: ffff80000a06bbf0 x28: 000000000000000a x27: 000000000000000a [ 257.664448] x26: 0000000000000000 x25: ffff470b88c6a180 x24: 000000000000000a [ 257.671581] x23: ffff470b81706480 x22: ffff470b808c2160 x21: ffff470b8922ba20 [ 257.678713] x20: ffff470b891f5810 x19: ffff470b891f5800 x18: ffffffffffffffff [ 257.685846] x17: 3a725f7463656a62 x16: ffffbb18c6465fd4 x15: 0720072007200720 [ 257.692978] x14: 0720072d072d072d x13: 0a2e656572662d72 x12: 657466612d657375 [ 257.700110] x11: 203b776f6c667265 x10: 646e75203a745f74 x9 : ffffbb18c58f6c90 [ 257.707242] x8 : 75203b776f6c6672 x7 : 65646e75203a745f x6 : 0000000000000001 [ 257.714373] x5 : ffff470bff8ec418 x4 : 0000000000000000 x3 : 0000000000000027 [ 257.721506] x2 : 0000000000000000 x1 : 0000000000000027 x0 : 0000000000000026 [ 257.728638] Call trace: [ 257.731075] refcount_warn_saturate+0xf4/0x144 [ 257.735513] put_fb_info+0x70/0x7c [ 257.738916] fb_release+0x60/0x74 [ 257.742225] __fput+0x88/0x240 [ 257.745276] ____fput+0x1c/0x30 [ 257.748410] task_work_run+0xc4/0x21c [ 257.752066] do_exit+0x170/0x370 [ 257.755288] do_group_exit+0x40/0xb4 [ 257.758858] get_signal+0x8e0/0x90c [ 257.762339] do_signal+0x1a0/0x280 [ 257.765733] do_notify_resume+0xc8/0x390 [ 257.769650] el0_da+0xe8/0xf0 [ 257.772613] el0t_64_sync_handler+0xe8/0x130 [ 257.776877] el0t_64_sync+0x190/0x194 [ 257.780534] ---[ end trace 0000000000000000 ]--- Patch #1 adds a WARN_ON() to framebuffer_release() to prevent the use-after-free to happen. Patch #2, #3 and #4 fix the simplefb, efifb and vesafb drivers respectively, to free the resources at the correct place. Changes in v2: - Also do the change for vesafb (Thomas Zimmermann). Daniel Vetter (1): fbdev: Prevent possible use-after-free in fb_release() Javier Martinez Canillas (3): fbdev: simplefb: Cleanup fb_info in .fb_destroy rather than .remove fbdev: efifb: Cleanup fb_info in .fb_destroy rather than .remove fbdev: vesafb: Cleanup fb_info in .fb_destroy rather than .remove drivers/video/fbdev/core/fbsysfs.c | 4 ++++ drivers/video/fbdev/efifb.c | 9 ++++++++- drivers/video/fbdev/simplefb.c | 8 +++++++- drivers/video/fbdev/vesafb.c | 14 +++++++++++--- 4 files changed, 30 insertions(+), 5 deletions(-) -- 2.35.1

3 7

[PULL] drm-misc-next
by Maxime Ripard 05 May '22

05 May '22

Hi Dave, Daniel, Here's this week drm-misc-next PR Maxime drm-misc-next-2022-05-05: drm-misc-next for 5.19: UAPI Changes: Cross-subsystem Changes: Core Changes: - Add DRM-managed mutex initialisation - edid: Doc improvements - fbdev: deferred io improvements - format-helper: consolidate format conversion helpers - gem: Rework fence handling in drm_gem_plane_helper_prepare_fb Driver Changes: - ast: DisplayPort support, locking improvements - exynos: Revert conversion to devm_drm_of_get_bridge for DSI - mgag200: locking improvements - mxsfb: LCDIF CRC support - nouveau: switch to drm_gem_plane_helper_prepare_fb - rockchip: Refactor IOMMU initialisation, make some structures static, replace drm_detect_hdmi_monitor with drm_display_info.is_hdmi, support swapped YUV formats, clock improvements, rk3568 support, VOP2 support - bridge: - adv7511: Enable CEC for ADV7535 - it6505: Send DPCD SET_POWER to monitor at disable - mcde_dsi: Revert conversion to devm_drm_of_get_bridge - tc358767: Fix for eDP and DP DT endpoint parsing - new bridge: i.MX8MP LDB - panel: - new panel: Startek KD070WVFPA043-C069A The following changes since commit e954d2c94d007afe487044ecfa48f2518643df0e: Backmerge tag 'v5.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into drm-next (2022-05-03 16:08:48 +1000) are available in the Git repository at: git://anongit.freedesktop.org/drm/drm-misc tags/drm-misc-next-2022-05-05 for you to fetch changes up to 6071c4c2a319da360b0bf2bc397d4fefad10b2c8: drm/qxl: add drm_gem_plane_helper_prepare_fb (2022-05-05 12:30:10 +0200) ---------------------------------------------------------------- drm-misc-next for 5.19: UAPI Changes: Cross-subsystem Changes: Core Changes: - Add DRM-managed mutex initialisation - edid: Doc improvements - fbdev: deferred io improvements - format-helper: consolidate format conversion helpers - gem: Rework fence handling in drm_gem_plane_helper_prepare_fb Driver Changes: - ast: DisplayPort support, locking improvements - exynos: Revert conversion to devm_drm_of_get_bridge for DSI - mgag200: locking improvements - mxsfb: LCDIF CRC support - nouveau: switch to drm_gem_plane_helper_prepare_fb - rockchip: Refactor IOMMU initialisation, make some structures static, replace drm_detect_hdmi_monitor with drm_display_info.is_hdmi, support swapped YUV formats, clock improvements, rk3568 support, VOP2 support - bridge: - adv7511: Enable CEC for ADV7535 - it6505: Send DPCD SET_POWER to monitor at disable - mcde_dsi: Revert conversion to devm_drm_of_get_bridge - tc358767: Fix for eDP and DP DT endpoint parsing - new bridge: i.MX8MP LDB - panel: - new panel: Startek KD070WVFPA043-C069A ---------------------------------------------------------------- Alvin Šipraga (2): drm: bridge: adv7511: enable CEC support for ADV7535 drm: bridge: adv7511: use non-legacy mode for CEC RX Andy Yan (1): drm/rockchip: Add VOP2 driver Benjamin Gaignard (1): dt-bindings: display: rockchip: dw-hdmi: Add compatible for rk3568 HDMI Chen-Yu Tsai (1): drm/rockchip: Support YUV formats with U/V swapped Christian König (5): drm: handle kernel fences in drm_gem_plane_helper_prepare_fb v2 drm/nouveau: use drm_gem_plane_helper_prepare_fb dma-buf/sync_file: cleanup fence merging a bit drm/nouveau: remove trace_dma_fence_emit drm/qxl: add drm_gem_plane_helper_prepare_fb Dan Carpenter (1): drm/sun4i: dsi: delete unnecessary IS_ERR() checks Fabio Estevam (1): dt-bindings: display: simple: Add Startek KD070WVFPA043-C069A panel Guo Zhengkui (1): drm/nouveau/devinit: fix returnvar.cocci warnings Heiko Schocher (1): drm/panel: simple: Add Startek KD070WVFPA043-C069A panel support Jagan Teki (4): drm/panel: panel-simple: Fix proper bpc for AM-1280800N3TZQW-T00H Revert "drm: bridge: mcde_dsi: Drop explicit bridge remove" Revert "drm: bridge: mcde_dsi: Switch to devm_drm_of_get_bridge" drm: exynos: dsi: Use child panel or bridge find helpers Jani Nikula (2): drm/edid: fix kernel-doc parameter name mismatches drm/edid: drop kernel-doc for static functions Javier Martinez Canillas (2): drm/display: Select DP helper for DRM_DP_AUX_CHARDEV and DRM_DP_CEC drm/todo: Add entry for using kunit in the subsystem José Expósito (2): drm/rockchip: inno_hdmi: Replace drm_detect_hdmi_monitor() with is_hdmi drm/rockchip: rk3066_hdmi: Replace drm_detect_hdmi_monitor() with is_hdmi KuoHsiang Chou (1): drm/ast: Create the driver for ASPEED proprietory Display-Port Lucas Stach (1): drm/etnaviv: avoid cleaning up sched_job when submit succeeded Lyude Paul (1): drm/nouveau/subdev/bus: Ratelimit logging for fault errors Marek Vasut (5): drm/bridge: tc358767: Fix (e)DP bridge endpoint parsing in dedicated function dt-bindings: display: bridge: ldb: Implement simple Freescale i.MX8MP LDB bridge drm: bridge: ldb: Implement simple Freescale i.MX8MP LDB bridge drm: mxsfb: Implement LCDIF scanout CRC32 support drm/bridge: tc358767: Fix DP bridge mode detection from DT endpoints Maxime Ripard (1): Merge drm/drm-next into drm-misc-next Miaoqian Lin (1): malidp: Fix NULL vs IS_ERR() checking Minghao Chi (4): drm/vc4: simplify the return expression of vc4_prepare_fb() drm/vc4: simplify the return expression of vc4_grab_bin_bo() drm/nouveau: simplify the return expression of nouveau_debugfs_init() drm: simplify the return expression of ast_drm_resume() Pin-Yen Lin (1): drm/bridge: it6505: Send DPCD SET_POWER to downstream Raphael Gallais-Pou (1): drm: fix typo in comment Robin Murphy (1): drm/rockchip: Refactor IOMMU initialisation Sascha Hauer (11): drm/rockchip: Embed drm_encoder into rockchip_decoder drm/rockchip: Add crtc_endpoint_id to rockchip_encoder drm/rockchip: dw_hdmi: rename vpll clock to reference clock dt-bindings: display: rockchip: dw-hdmi: use "ref" as clock name drm/rockchip: dw_hdmi: add rk3568 support dt-bindings: display: rockchip: dw-hdmi: Add regulator support drm/rockchip: dw_hdmi: add regulator support dt-bindings: display: rockchip: dw-hdmi: Make unwedge pinctrl optional dt-bindings: display: rockchip: Add binding for VOP2 dt-bindings: display: rockchip: dw-hdmi: fix ports description drm/rockchip: Make VOP driver optional Steven Price (1): drm/plane: Move range check for format_count earlier Thomas Zimmermann (13): fbdev: Put mmap for deferred I/O into drivers fbdev: Track deferred-I/O pages in pageref struct fbdev: Refactor implementation of page_mkwrite fbdev: Rename pagelist to pagereflist for deferred I/O fbdev: Use pageref offset for deferred-I/O writeback drm/simpledrm: Use fbdev defaults for shadow buffering drm/format-helper: Implement drm_fb_swab() with per-line helpers drm/format-helper: Remove optional byte-swap from line convertion drm/format-helper: Unify the parameters of all per-line conversion helpers drm/format-helper: Share implementation among conversion helpers drm: Add DRM-managed mutex_init() drm/ast: Protect concurrent access to I/O registers with lock drm/mgag200: Protect concurrent access to I/O registers with lock Tom Rix (1): drm/rockchip: cdn-dp: change rk3399_cdn_dp from global to static Uwe Kleine-König (1): drm/bridge: tfp410: Make tfp410_fini() return void Wayne Lin (1): drm/dp_mst: Lower down debug info level when receive NAK Yang Yingliang (1): drm/rockchip: vop: fix possible null-ptr-deref in vop_bind() .../bindings/display/bridge/fsl,ldb.yaml | 92 + .../bindings/display/panel/panel-simple.yaml | 2 + .../display/rockchip/rockchip,dw-hdmi.yaml | 46 +- .../bindings/display/rockchip/rockchip-vop2.yaml | 140 + Documentation/gpu/todo.rst | 14 + drivers/dma-buf/sync_file.c | 21 +- drivers/gpu/drm/arm/malidp_planes.c | 2 +- drivers/gpu/drm/ast/Makefile | 2 +- drivers/gpu/drm/ast/ast_dp.c | 282 ++ drivers/gpu/drm/ast/ast_drv.c | 7 +- drivers/gpu/drm/ast/ast_drv.h | 116 + drivers/gpu/drm/ast/ast_main.c | 9 +- drivers/gpu/drm/ast/ast_mode.c | 174 +- drivers/gpu/drm/ast/ast_post.c | 4 +- drivers/gpu/drm/bridge/Kconfig | 8 + drivers/gpu/drm/bridge/Makefile | 1 + drivers/gpu/drm/bridge/adv7511/adv7511.h | 27 +- drivers/gpu/drm/bridge/adv7511/adv7511_cec.c | 116 +- drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 19 +- drivers/gpu/drm/bridge/fsl-ldb.c | 342 +++ drivers/gpu/drm/bridge/ite-it6505.c | 29 +- drivers/gpu/drm/bridge/tc358767.c | 8 +- drivers/gpu/drm/bridge/ti-tfp410.c | 12 +- drivers/gpu/drm/display/Kconfig | 6 +- drivers/gpu/drm/display/drm_dp_mst_topology.c | 5 +- drivers/gpu/drm/drm_atomic_uapi.c | 47 +- drivers/gpu/drm/drm_color_mgmt.c | 2 +- drivers/gpu/drm/drm_edid.c | 65 +- drivers/gpu/drm/drm_fb_helper.c | 15 +- drivers/gpu/drm/drm_format_helper.c | 482 ++-- drivers/gpu/drm/drm_gem_atomic_helper.c | 73 +- drivers/gpu/drm/drm_managed.c | 27 + drivers/gpu/drm/drm_plane.c | 14 +- drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 10 +- drivers/gpu/drm/exynos/exynos_drm_dsi.c | 12 +- drivers/gpu/drm/mcde/mcde_dsi.c | 43 +- drivers/gpu/drm/mgag200/mgag200_drv.c | 6 + drivers/gpu/drm/mgag200/mgag200_drv.h | 1 + drivers/gpu/drm/mgag200/mgag200_mode.c | 14 + drivers/gpu/drm/mxsfb/mxsfb_drv.c | 14 +- drivers/gpu/drm/mxsfb/mxsfb_drv.h | 3 + drivers/gpu/drm/mxsfb/mxsfb_kms.c | 61 +- drivers/gpu/drm/mxsfb/mxsfb_regs.h | 1 + drivers/gpu/drm/nouveau/dispnv50/wndw.c | 5 +- drivers/gpu/drm/nouveau/include/nvkm/core/subdev.h | 2 + drivers/gpu/drm/nouveau/nouveau_debugfs.c | 12 +- drivers/gpu/drm/nouveau/nouveau_fence.c | 1 - drivers/gpu/drm/nouveau/nvkm/subdev/bus/gf100.c | 14 +- drivers/gpu/drm/nouveau/nvkm/subdev/bus/nv31.c | 6 +- drivers/gpu/drm/nouveau/nvkm/subdev/bus/nv50.c | 6 +- drivers/gpu/drm/nouveau/nvkm/subdev/devinit/g98.c | 3 +- .../gpu/drm/nouveau/nvkm/subdev/devinit/gf100.c | 3 +- .../gpu/drm/nouveau/nvkm/subdev/devinit/gm107.c | 3 +- drivers/gpu/drm/panel/panel-simple.c | 40 +- drivers/gpu/drm/qxl/qxl_display.c | 8 +- drivers/gpu/drm/rockchip/Kconfig | 14 + drivers/gpu/drm/rockchip/Makefile | 4 +- drivers/gpu/drm/rockchip/analogix_dp-rockchip.c | 32 +- drivers/gpu/drm/rockchip/cdn-dp-core.c | 20 +- drivers/gpu/drm/rockchip/cdn-dp-core.h | 2 +- drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c | 17 +- drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c | 108 +- drivers/gpu/drm/rockchip/inno_hdmi.c | 40 +- drivers/gpu/drm/rockchip/rk3066_hdmi.c | 40 +- drivers/gpu/drm/rockchip/rockchip_drm_drv.c | 96 +- drivers/gpu/drm/rockchip/rockchip_drm_drv.h | 23 +- drivers/gpu/drm/rockchip/rockchip_drm_fb.c | 2 + drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 24 +- drivers/gpu/drm/rockchip/rockchip_drm_vop.h | 15 + drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 2706 ++++++++++++++++++++ drivers/gpu/drm/rockchip/rockchip_drm_vop2.h | 477 ++++ drivers/gpu/drm/rockchip/rockchip_lvds.c | 26 +- drivers/gpu/drm/rockchip/rockchip_vop2_reg.c | 281 ++ drivers/gpu/drm/rockchip/rockchip_vop_reg.c | 11 + drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 7 +- drivers/gpu/drm/tiny/simpledrm.c | 1 - drivers/gpu/drm/vc4/vc4_bo.c | 8 +- drivers/gpu/drm/vc4/vc4_plane.c | 7 +- drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 10 +- drivers/hid/hid-picolcd_fb.c | 3 +- drivers/staging/fbtft/fbtft-core.c | 21 +- drivers/video/fbdev/broadsheetfb.c | 27 +- drivers/video/fbdev/core/fb_defio.c | 212 +- drivers/video/fbdev/core/fbmem.c | 22 +- drivers/video/fbdev/hecubafb.c | 4 +- drivers/video/fbdev/hyperv_fb.c | 10 +- drivers/video/fbdev/metronomefb.c | 23 +- drivers/video/fbdev/sh_mobile_lcdcfb.c | 27 +- drivers/video/fbdev/smscufx.c | 13 +- drivers/video/fbdev/ssd1307fb.c | 4 +- drivers/video/fbdev/udlfb.c | 18 +- drivers/video/fbdev/xen-fbfront.c | 10 +- include/drm/drm_atomic_uapi.h | 2 - include/drm/drm_fb_helper.h | 3 +- include/drm/drm_managed.h | 3 + include/drm/drm_plane.h | 4 +- include/dt-bindings/soc/rockchip,vop2.h | 14 + include/linux/fb.h | 17 +- 98 files changed, 6004 insertions(+), 881 deletions(-) create mode 100644 Documentation/devicetree/bindings/display/bridge/fsl,ldb.yaml create mode 100644 Documentation/devicetree/bindings/display/rockchip/rockchip-vop2.yaml create mode 100644 drivers/gpu/drm/ast/ast_dp.c create mode 100644 drivers/gpu/drm/bridge/fsl-ldb.c create mode 100644 drivers/gpu/drm/rockchip/rockchip_drm_vop2.c create mode 100644 drivers/gpu/drm/rockchip/rockchip_drm_vop2.h create mode 100644 drivers/gpu/drm/rockchip/rockchip_vop2_reg.c create mode 100644 include/dt-bindings/soc/rockchip,vop2.h

1 0

[PATCH v3 0/3] drm: Allow simpledrm to setup its emulated FB as firmware provided
by Javier Martinez Canillas 05 May '22

05 May '22

Hello, This series contain patches suggested by Thomas Zimmermann as a feedback for "[RFC PATCH v4 00/11] Fix some race between sysfb device registration and drivers probe" [0]. Since other changes in [0] were more controversial, I decided to just split this part in a new patch-set and revisit the rest of the patches later. This is a v2 that addresses issues pointed out in v1. Patch #1 is just a cleanup since when working on this noticed that some DRM drivers were passing as preferred bits per pixel to drm_fbdev_generic_setup() the value that is the default anyways. Patch #2 renames the 'preferred_bpp' drm_fbdev_generic_setup() parameter to 'options', and make this a multi field parameter so that it can be extended later to pass other options as well. Patch #3 finally adds the new DRM_FB_FW option and makes simpledrm to use it so that the registered framebuffer device is also marked as firmware provided. The patches were tested on a rpi4 board with the vc4 DRM driver built as a module and either simplefb or simpledrm built-in. [0]: https://lore.kernel.org/lkml/20220429084253.1085911-1-javierm@redhat.com/ Changes in v3: - Drop the preferred_bpp local variable (Laurent Pinchart). - Add a const qualifier to options parameter (Laurent Pinchart). - Drop the firmware local variable (Laurent Pinchart). - Use DRM_FB_OPTION() since DRM_FB_SET_OPTION() got renamed (kernel test robot). Changes in v2: - Rename DRM_FB_SET_OPTION() to DRM_FB_OPTION() and make more clear in the kernel-doc what this macro does (Laurent Pinchart). - Fix some kernel-doc issues I didn't notice in v1. - Add Reviewed-by tags from Thomas and Laurent. Javier Martinez Canillas (3): drm: Remove superfluous arg when calling to drm_fbdev_generic_setup() drm/fb-helper: Rename preferred_bpp drm_fbdev_generic_setup() parameter drm: Allow simpledrm to setup its emulated FB as firmware provided drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 6 ++-- drivers/gpu/drm/arm/hdlcd_drv.c | 2 +- drivers/gpu/drm/arm/malidp_drv.c | 2 +- drivers/gpu/drm/aspeed/aspeed_gfx_drv.c | 2 +- drivers/gpu/drm/ast/ast_drv.c | 2 +- drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_dc.c | 2 +- drivers/gpu/drm/drm_drv.c | 2 +- drivers/gpu/drm/drm_fb_helper.c | 34 ++++++++++++++----- drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c | 2 +- .../gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 2 +- .../gpu/drm/hisilicon/kirin/kirin_drm_drv.c | 2 +- drivers/gpu/drm/imx/dcss/dcss-kms.c | 2 +- drivers/gpu/drm/imx/imx-drm-core.c | 2 +- drivers/gpu/drm/ingenic/ingenic-drm-drv.c | 2 +- drivers/gpu/drm/mcde/mcde_drv.c | 2 +- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 2 +- drivers/gpu/drm/meson/meson_drv.c | 2 +- drivers/gpu/drm/mxsfb/mxsfb_drv.c | 2 +- drivers/gpu/drm/pl111/pl111_drv.c | 2 +- drivers/gpu/drm/qxl/qxl_drv.c | 2 +- drivers/gpu/drm/rcar-du/rcar_du_drv.c | 2 +- drivers/gpu/drm/sti/sti_drv.c | 2 +- drivers/gpu/drm/stm/drv.c | 2 +- drivers/gpu/drm/sun4i/sun4i_drv.c | 2 +- drivers/gpu/drm/tidss/tidss_drv.c | 2 +- drivers/gpu/drm/tilcdc/tilcdc_drv.c | 2 +- drivers/gpu/drm/tiny/arcpgu.c | 2 +- drivers/gpu/drm/tiny/bochs.c | 2 +- drivers/gpu/drm/tiny/cirrus.c | 2 +- drivers/gpu/drm/tiny/simpledrm.c | 2 +- drivers/gpu/drm/tve200/tve200_drv.c | 2 +- drivers/gpu/drm/vboxvideo/vbox_drv.c | 2 +- drivers/gpu/drm/vc4/vc4_drv.c | 2 +- drivers/gpu/drm/virtio/virtgpu_drv.c | 2 +- drivers/gpu/drm/xlnx/zynqmp_dpsub.c | 2 +- include/drm/drm_fb_helper.h | 24 ++++++++++++- 36 files changed, 85 insertions(+), 45 deletions(-) -- 2.35.1

3 9

[PATCH 0/3] fbdev: Fix use-after-free caused by wrong fb_info cleanup in drivers
by Javier Martinez Canillas 05 May '22

05 May '22

Hello, This series contains patches suggested by Daniel Vetter to fix a use-after-free error in the fb_release() function, due a fb_info associated with a fbdev being freed too early while a user-space process still has the fbdev dev node opened. The is cuused by a wrong management of the struct fb_info lifetime in drivers, but the fbdev core can also be made more resilient about it an leak This can easily be reproduced with the simplefb driver doing the following: $ cat < /dev/fb0 & $ echo simple-framebuffer.0 > /sys/bus/platform/drivers/simple-framebuffer/unbind $ kill %1 [ 257.490471] ------------[ cut here ]------------ ... [ 257.495125] refcount_t: underflow; use-after-free. [ 257.495222] WARNING: CPU: 0 PID: 975 at lib/refcount.c:28 refcount_warn_saturate+0xf4/0x144 ... [ 257.637482] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 257.644441] pc : refcount_warn_saturate+0xf4/0x144 [ 257.649226] lr : refcount_warn_saturate+0xf4/0x144 [ 257.654009] sp : ffff80000a06bbf0 [ 257.657315] x29: ffff80000a06bbf0 x28: 000000000000000a x27: 000000000000000a [ 257.664448] x26: 0000000000000000 x25: ffff470b88c6a180 x24: 000000000000000a [ 257.671581] x23: ffff470b81706480 x22: ffff470b808c2160 x21: ffff470b8922ba20 [ 257.678713] x20: ffff470b891f5810 x19: ffff470b891f5800 x18: ffffffffffffffff [ 257.685846] x17: 3a725f7463656a62 x16: ffffbb18c6465fd4 x15: 0720072007200720 [ 257.692978] x14: 0720072d072d072d x13: 0a2e656572662d72 x12: 657466612d657375 [ 257.700110] x11: 203b776f6c667265 x10: 646e75203a745f74 x9 : ffffbb18c58f6c90 [ 257.707242] x8 : 75203b776f6c6672 x7 : 65646e75203a745f x6 : 0000000000000001 [ 257.714373] x5 : ffff470bff8ec418 x4 : 0000000000000000 x3 : 0000000000000027 [ 257.721506] x2 : 0000000000000000 x1 : 0000000000000027 x0 : 0000000000000026 [ 257.728638] Call trace: [ 257.731075] refcount_warn_saturate+0xf4/0x144 [ 257.735513] put_fb_info+0x70/0x7c [ 257.738916] fb_release+0x60/0x74 [ 257.742225] __fput+0x88/0x240 [ 257.745276] ____fput+0x1c/0x30 [ 257.748410] task_work_run+0xc4/0x21c [ 257.752066] do_exit+0x170/0x370 [ 257.755288] do_group_exit+0x40/0xb4 [ 257.758858] get_signal+0x8e0/0x90c [ 257.762339] do_signal+0x1a0/0x280 [ 257.765733] do_notify_resume+0xc8/0x390 [ 257.769650] el0_da+0xe8/0xf0 [ 257.772613] el0t_64_sync_handler+0xe8/0x130 [ 257.776877] el0t_64_sync+0x190/0x194 [ 257.780534] ---[ end trace 0000000000000000 ]--- Patch #1 adds a WARN_ON() to framebuffer_release() to prevent the use-after-free to happen. Patch #2 and patch #3 fixes the simplefb and efifb drivers respectively, to free the resources at the correct place. Daniel Vetter (1): fbdev: Prevent possible use-after-free in fb_release() Javier Martinez Canillas (2): fbdev/simplefb: Cleanup fb_info in .fb_destroy rather than .remove fbdev/efifb: Cleanup fb_info in .fb_destroy rather than .remove drivers/video/fbdev/core/fbsysfs.c | 4 ++++ drivers/video/fbdev/efifb.c | 9 ++++++++- drivers/video/fbdev/simplefb.c | 8 +++++++- 3 files changed, 19 insertions(+), 2 deletions(-) -- 2.35.1

3 15

← Newer
1
...
60
61
62
63
64
65
66
...
74
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

dri-devel May 2022