- 14 Sep, 2020 2 commits
-
-
Jia Yang authored
I got a use-after-free report when doing some fuzz test: If ttm_bo_init() fails, the "gbo" and "gbo->bo.base" will be freed by ttm_buffer_object_destroy() in ttm_bo_init(). But then drm_gem_vram_create() and drm_gem_vram_init() will free "gbo" and "gbo->bo.base" again. BUG: KMSAN: use-after-free in drm_vma_offset_remove+0xb3/0x150 CPU: 0 PID: 24282 Comm: syz-executor.1 Tainted: G B W 5.7.0-rc4-msan #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 Call Trace: __dump_stack dump_stack+0x1c9/0x220 kmsan_report+0xf7/0x1e0 __msan_warning+0x58/0xa0 drm_vma_offset_remove+0xb3/0x150 drm_gem_free_mmap_offset drm_gem_object_release+0x159/0x180 drm_gem_vram_init drm_gem_vram_create+0x7c5/0x990 drm_gem_vram_fill_create_dumb drm_gem_vram_driver_dumb_create+0x238/0x590 drm_mode_create_dumb drm_mode_create_dumb_ioctl+0x41d/0x450 drm_ioctl_kernel+0x5a4/0x710 drm_ioctl+0xc6f/0x1240 vfs_ioctl ksys_ioctl __do_sys_ioctl __se_sys_ioctl+0x2e9/0x410 __x64_sys_ioctl+0x4a/0x70 do_syscall_64+0xb8/0x160 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x4689b9 Code: fd e0 fa ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb e0 fa ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f368fa4dc98 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000076bf00 RCX: 00000000004689b9 RDX: 0000000020000240 RSI: 00000000c02064b2 RDI: 0000000000000003 RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00000000004d17e0 R14: 00007f368fa4e6d4 R15: 000000000076bf0c Uninit was created at: kmsan_save_stack_with_flags kmsan_internal_poison_shadow+0x66/0xd0 kmsan_slab_free+0x6e/0xb0 slab_free_freelist_hook slab_free kfree+0x571/0x30a0 drm_gem_vram_destroy ttm_buffer_object_destroy+0xc8/0x130 ttm_bo_release kref_put ttm_bo_put+0x117d/0x23e0 ttm_bo_init_reserved+0x11c0/0x11d0 ttm_bo_init+0x289/0x3f0 drm_gem_vram_init drm_gem_vram_create+0x775/0x990 drm_gem_vram_fill_create_dumb drm_gem_vram_driver_dumb_create+0x238/0x590 drm_mode_create_dumb drm_mode_create_dumb_ioctl+0x41d/0x450 drm_ioctl_kernel+0x5a4/0x710 drm_ioctl+0xc6f/0x1240 vfs_ioctl ksys_ioctl __do_sys_ioctl __se_sys_ioctl+0x2e9/0x410 __x64_sys_ioctl+0x4a/0x70 do_syscall_64+0xb8/0x160 entry_SYSCALL_64_after_hwframe+0x44/0xa9 If ttm_bo_init() fails, the "gbo" will be freed by ttm_buffer_object_destroy() in ttm_bo_init(). But then drm_gem_vram_create() and drm_gem_vram_init() will free "gbo" again. Reported-by:
Hulk Robot <hulkci@huawei.com> Reported-by:
butt3rflyh4ck <butterflyhuangxx@gmail.com> Signed-off-by:
Jia Yang <jiayang5@huawei.com> Signed-off-by:
Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by:
-
Thomas Zimmermann authored
VRAM helpers support ref counting for pin and vmap operations, no need to avoid these operations by employing the internal kmap interface. Just use drm_gem_vram_vmap() and let it handle the details. Also unexport the kmap interfaces from VRAM helpers. Vboxvideo was the last user of these internal functions. v2: * fixed a comma in commit description Signed-off-by:
Daniel Vetter <daniel.vetter@ffwll.ch> Tested-by:
Hans de Goede <hdegoede@redhat.com> Link: https://patchwork.freedesktop.org/patch/msgid/20200911075922.19317-1-tzimmermann@suse.de
-
- 12 Sep, 2020 1 commit
-
-
Jason Yan authored
This addresses the following gcc warning with "make W=1": drivers/gpu/drm/xlnx/zynqmp_disp.c:245:18: warning: ‘scaling_factors_666’ defined but not used [-Wunused-const-variable=] 245 | static const u32 scaling_factors_666[] = { | ^~~~~~~~~~~~~~~~~~~ Reported-by:Jason Yan <yanaijie@huawei.com> Signed-off-by:
Hyun Kwon <hyun.kwon@xilinx.com> Link: https://patchwork.freedesktop.org/patch/msgid/20200910140630.1191782-1-yanaijie@huawei.com
-
- 11 Sep, 2020 15 commits
-
-
Neil Armstrong authored
The Amlogic D-PHY in the Amlogic AXG SoC Family does support a frequency higher than 10MHz for the TX Escape Clock, thus make the target rate configurable. Signed-off-by:
Neil Armstrong <narmstrong@baylibre.com> Reviewed-by:
Philippe Cornu <philippe.cornu@st.com> Link: https://patchwork.freedesktop.org/patch/msgid/20200904125531.15248-1-narmstrong@baylibre.com
-
Alex Dewar authored
kmemdup can be used instead of kmalloc+memcpy. Replace an occurrence of this pattern. Issue identified with Coccinelle. Signed-off-by:
Alex Dewar <alex.dewar90@gmail.com> Acked-by:
-
Christian König authored
It's not supported to specify more than one of those flags. So it never made sense to make this a flag in the first place. Nuke the flags and specify directly which memory type to use. Signed-off-by:
Christian König <christian.koenig@amd.com> Reviewed-by:
Dave Airlie <airlied@redhat.com> Link: https://patchwork.freedesktop.org/patch/389826/?series=81551&rev=1
-
Christian König authored
Setting more than one placement flag is illegal. Fix this by using the current flags. Signed-off-by:
-
Christian König authored
Those are going to be removed, stop using them here. Instead use the GEM flags from the UAPI. Signed-off-by:
-
Christian König authored
Those are going to be removed, stop using them here. Instead define separate flags for the helper. Signed-off-by:
-
Nathan Chancellor authored
Clang warns: drivers/gpu/drm/vc4/vc4_plane.c:901:27: warning: operator '?:' has lower precedence than '|'; '|' will be evaluated first [-Wbitwise-conditional-parentheses] fb->format->has_alpha ? ~~~~~~~~~~~~~~~~~~~~~ ^ drivers/gpu/drm/vc4/vc4_plane.c:901:27: note: place parentheses around the '|' expression to silence this warning fb->format->has_alpha ? ~~~~~~~~~~~~~~~~~~~~~ ^ drivers/gpu/drm/vc4/vc4_plane.c:901:27: note: place parentheses around the '?:' expression to evaluate it first fb->format->has_alpha ? ~~~~~~~~~~~~~~~~~~~~~~^ 1 warning generated. Add the parentheses as that was clearly intended, otherwise SCALER5_CTL2_ALPHA_PREMULT won't be added to the list. Fixes: c54619b0 ("drm/vc4: Add support for the BCM2711 HVS5") Signed-off-by:Nathan Chancellor <natechancellor@gmail.com> Link: https://github.com/ClangBuiltLinux/linux/issues/1150Signed-off-by:
Maxime Ripard <maxime@cerno.tech> Link: https://patchwork.freedesktop.org/patch/msgid/20200910171831.4112580-1-natechancellor@gmail.com
-
Nathan Chancellor authored
Clang warns 100+ times in the vc4 driver along the lines of: drivers/gpu/drm/vc4/vc4_hdmi_phy.c:518:13: warning: implicit conversion from enumeration type 'enum vc4_hdmi_field' to different enumeration type 'enum vc4_hdmi_regs' [-Wenum-conversion] HDMI_WRITE(HDMI_TX_PHY_POWERDOWN_CTL, ~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~ The HDMI_READ and HDMI_WRITE macros pass in enumerators of type vc4_hdmi_field but vc4_hdmi_write and vc4_hdmi_read expect a enumerator of type vc4_hdmi_regs, causing a warning for every instance of this. Update the parameter type so there is no more mismatch. Fixes: 311e305f ("drm/vc4: hdmi: Implement a register layout abstraction") Signed-off-by: -
Jason Yan authored
This function always return '0' and no callers use the return value. So make it a void function. This eliminates the following coccicheck warning: drivers/gpu/drm/i810/i810_dma.c:860:8-11: Unneeded variable: "ret". Return "0" on line 885 Reported-by:
-
Daniel Vetter authored
Gets rid of drmm_add_final_kfree, which I want to unexport so that it stops confusion people about this transitional state of rolling drm managed memory out. This also fixes the missing drm_dev_put in the error path of the probe code. v2: Drop the misplaced drm_dev_put from zynqmp_dpsub_drm_init (all other paths leaked on error, this should have been in zynqmp_dpsub_probe), now that subsumed by the auto-cleanup of devm_drm_dev_alloc. Reviewed-by:
Daniel Vetter <daniel.vetter@intel.com> Cc: Hyun Kwon <hyun.kwon@xilinx.com> Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Cc: Michal Simek <michal.simek@xilinx.com> Cc: linux-arm-kernel@lists.infradead.org Link: https://patchwork.freedesktop.org/patch/msgid/20200907082225.150837-1-daniel.vetter@ffwll.ch
-
Daniel Vetter authored
This means we also need to slightly restructure the exit code, so that final cleanup of the drm_device is triggered by unregistering the platform device. Note that devres is both clean up when the driver is unbound (not the case for vkms, we don't bind), and also when unregistering the device (very much the case for vkms). Therefore we can rely on devres even though vkms isn't a proper platform device driver. This also somewhat untangles the load code, since the drm and platform device setup are no longer interleaved, but two distinct steps. v2: use devres_open/release_group so we can use devm without real hacks in the driver core or having to create an entire fake bus for testing drivers. Might want to extract this into helpers eventually, maybe as a mock_drm_dev_alloc or test_drm_dev_alloc. v3: Only deref vkms_device after checking it (Melissa) Reviewed-by:
Melissa Wen <melissa.srw@gmail.com> Cc: Melissa Wen <melissa.srw@gmail.com> Signed-off-by:
-
Daniel Vetter authored
This means we also need to slightly restructure the exit code, so that final cleanup of the drm_device is triggered by unregistering the platform device. Note that devres is both clean up when the driver is unbound (not the case for vgem, we don't bind), and also when unregistering the device (very much the case for vgem). Therefore we can rely on devres even though vgem isn't a proper platform device driver. This also somewhat untangles the load code, since the drm and platform device setup are no longer interleaved, but two distinct steps. v2: use devres_open/release_group so we can use devm without real hacks in the driver core or having to create an entire fake bus for testing drivers. Might want to extract this into helpers eventually, maybe as a mock_drm_dev_alloc or test_drm_dev_alloc. v3: Fix error code handling (Melissa) Cc: Melissa Wen <melissa.srw@gmail.com> Reviewed-by:
-
Daniel Vetter authored
Since aspeed doesn't use devm_kzalloc anymore we can use the managed mode config cleanup. v2: Keep call order as suggested by Sam. Acked-by:
Sam Ravnborg <sam@ravnborg.org> Signed-off-by:
-
Daniel Vetter authored
Upcasting using a container_of macro is more typesafe, faster and easier for the compiler to optimize. Signed-off-by:
-
Daniel Vetter authored
Also remove the now no longer needed build bug on since that's already not needed anymore with drmm_add_final_kfree. Conversion to managed drm_device cleanup is easy, the final drm_dev_put() is already the last thing in both the bind unbind as in the unbind flow. Also, this relies on component.c correctly wrapping bind&unbind in separate devres groups, which it does. Signed-off-by:
-
- 10 Sep, 2020 7 commits
-
-
Steven Price authored
The GPU 'CONFIG' registers used to work around hardware issues are cleared on reset so need to be programmed every time the GPU is reset. However panfrost_device_reset() failed to do this. To avoid this in future instead move the call to panfrost_gpu_init_quirks() to panfrost_gpu_power_on() so that the regsiters are always programmed just before the cores are powered. Fixes: f3ba9122 ("drm/panfrost: Add initial panfrost driver") Signed-off-by:
Steven Price <steven.price@arm.com> Reviewed-by:
Alyssa Rosenzweig <alyssa.rosenzweig@collabora.com> Link: https://patchwork.freedesktop.org/patch/msgid/20200909122957.51667-1-steven.price@arm.com
-
Robin Murphy authored
Since all we do with scatterlists is map them in the MMU, we don't have any hardware constraints on how they're laid out. Let the DMA layer know so it won't warn when DMA API debugging is enabled. Signed-off-by:
Robin Murphy <robin.murphy@arm.com> Reviewed-by:
-
Dan Carpenter authored
The devm_ioremap() function never returns error pointers, it returns NULL. Fixes: 83239891 ("drm/vc4: hdmi: Support the BCM2711 HDMI controllers") Signed-off-by:
Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by:
-
Dan Carpenter authored
The variant->registers[] has ->num_registers elements so the > comparison needs to be changes to >= to prevent an out of bounds access. Fixes: 311e305f ("drm/vc4: hdmi: Implement a register layout abstraction") Signed-off-by:
-
Laurentiu Palcu authored
When compiling for 32bit platforms, the compilation fails with: ERROR: modpost: "__aeabi_ldivmod" [drivers/gpu/drm/imx/dcss/imx-dcss.ko] undefined! ERROR: modpost: "__aeabi_uldivmod" [drivers/gpu/drm/imx/dcss/imx-dcss.ko] undefined! This patch adds a dependency on ARM64 since no 32bit SoCs have DCSS, so far. Signed-off-by:
Laurentiu Palcu <laurentiu.palcu@oss.nxp.com> Reported-by:
Daniel Vetter <daniel@ffwll.ch> Reviewed-by:
Lucas Stach <l.stach@pengutronix.de> Link: https://patchwork.freedesktop.org/patch/msgid/20200910095250.7663-1-laurentiu.palcu@oss.nxp.com
-
YueHaibing authored
Kbuild warns when this file is built as a loadable module: WARNING: modpost: missing MODULE_LICENSE() in drivers/gpu/drm/panel/panel-samsung-s6e63m0.o Add the missing license/author/description tags. Fixes: b7b23e44 ("drm/panel: s6e63m0: Break out SPI transport") Signed-off-by:
YueHaibing <yuehaibing@huawei.com> Signed-off-by:
-
Zheng Bin authored
Fixes coccicheck warning: drivers/gpu/drm/bridge/tc358775.c:488:2-3: Unneeded semicolon Signed-off-by:
Zheng Bin <zhengbin13@huawei.com> Signed-off-by:
-
- 09 Sep, 2020 10 commits
-
-
Laurentiu Palcu authored
Add bindings for iMX8MQ Display Controller Subsystem. Signed-off-by:
Laurentiu Palcu <laurentiu.palcu@nxp.com> Reviewed-by:
Guido Günther <agx@sigxcpu.org> Reviewed-by:
Rob Herring <robh@kernel.org> Signed-off-by:
-
Laurentiu Palcu authored
The driver is part of DRM subsystem and is located in drivers/gpu/drm/imx/dcss. Signed-off-by:
-
Laurentiu Palcu authored
Make use of drm_bridge_connector API to have the connector initialized by the display controller. Signed-off-by:
-
Laurentiu Palcu authored
This adds initial support for iMX8MQ's Display Controller Subsystem (DCSS). Some of its capabilities include: * 4K@60fps; * HDR10; * one graphics and 2 video pipelines; * on-the-fly decompression of compressed video and graphics; The reference manual can be found here: https://www.nxp.com/webapp/Download?colCode=IMX8MDQLQRM The current patch adds only basic functionality: one primary plane for graphics, linear, tiled and super-tiled buffers support (no graphics decompression yet), no HDR10 and no video planes. Video planes support and HDR10 will be added in subsequent patches once per-plane de-gamma/CSC/gamma support is in. Signed-off-by:
-
Laurentiu Palcu authored
Currently the drm/imx/ directory is compiled only if DRM_IMX is set. Adding a new IMX related IP in the same directory would need DRM_IMX to be set, which would bring in also IPUv3 core driver... The current patch would allow adding new IPs in the imx/ directory without needing to set DRM_IMX. Signed-off-by:
-
Bernard Zhao authored
Remove first assignment to info which is meaningless. Put the width and higth check first. This change is to make the code a bit readable. Signed-off-by:
Bernard Zhao <bernard@vivo.com> Signed-off-by:
-
Gurchetan Singh authored
In keeping with other features, report this in the debugfs. Signed-off-by:
Gurchetan Singh <gurchetansingh@chromium.org> Link: http://patchwork.freedesktop.org/patch/msgid/20200902210847.2689-4-gurchetansingh@chromium.orgSigned-off-by:
Gerd Hoffmann <kraxel@redhat.com>
-
Gurchetan Singh authored
smatch reported this with the blob series: drivers/gpu/drm/virtio/virtgpu_kms.c:227 virtio_gpu_init() error: uninitialized symbol 'ret'. Signed-off-by:
-
Doug Horn authored
If a response to virtio_gpu_cmd_get_capset_info takes longer than five seconds to return, the callback will access freed kernel memory in vg->capsets. Signed-off-by:
Doug Horn <doughorn@google.com> Link: http://patchwork.freedesktop.org/patch/msgid/20200902210847.2689-2-gurchetansingh@chromium.orgSigned-off-by:
-
Gerd Hoffmann authored
Add drm_device argument to drm_prime_pages_to_sg(), so we can call dma_max_mapping_size() to figure the segment size limit and call into __sg_alloc_table_from_pages() with the correct limit. This fixes virtio-gpu with sev. Possibly it'll fix other bugs too given that drm seems to totaly ignore segment size limits so far ... v2: place max_segment in drm driver not gem object. v3: move max_segment next to the other gem fields. v4: just use dma_max_mapping_size(). Signed-off-by:
-
- 08 Sep, 2020 5 commits
-
-
Dave Airlie authored
These are now driver side. Reviewed-by:
Ben Skeggs <bskeggs@redhat.com> Signed-off-by:
-
Dave Airlie authored
Since the agp bind/unbind/destroy are now getting called from drivers rather than via the func table, drop the bdev parameter. Reviewed-by:
-
Dave Airlie authored
Reviewed-by:
-
Dave Airlie authored
These aren't used anymore. Reviewed-by:
-
Dave Airlie authored
Acked-by:
-
