1. 15 Oct, 2020 7 commits
    • Zwane Mwaikambo's avatar
      drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor() · 73b62cdb
      Zwane Mwaikambo authored
      I observed this when unplugging a DP monitor whilst a computer is asleep
      and then waking it up. This left DP chardev nodes still being present on
      the filesystem and accessing these device nodes caused an oops because
      drm_dp_aux_dev_get_by_minor() assumes a device exists if it is opened.
      This can also be reproduced by creating a device node with mknod(1) and
      issuing an open(2)
      
      [166164.933198] BUG: kernel NULL pointer dereference, address: 0000000000000018
      [166164.933202] #PF: supervisor read access in kernel mode
      [166164.933204] #PF: error_code(0x0000) - not-present page
      [166164.933205] PGD 0 P4D 0
      [166164.933208] Oops: 0000 [#1] PREEMPT SMP NOPTI
      [166164.933211] CPU: 4 PID: 99071 Comm: fwupd Tainted: G        W
      5.8.0-rc6+ #1
      [166164.933213] Hardware name: LENOVO 20RD002VUS/20RD002VUS, BIOS R16ET25W
      (1.11 ) 04/21/2020
      [166164.933232] RIP: 0010:drm_dp_aux_dev_get_by_minor+0x29/0x70
      [drm_kms_helper]
      [166164.933234] Code: 00 0f 1f 44 00 00 55 48 89 e5 41 54 41 89 fc 48 c7
      c7 60 01 a4 c0 e8 26 ab 30 d7 44 89 e6 48 c7 c7 80 01 a4 c0 e8 47 94 d6 d6
      <8b> 50 18 49 89 c4 48 8d 78 18 85 d2 74 33 8d 4a 01 89 d0 f0 0f b1
      [166164.933236] RSP: 0018:ffffb7d7c41cbbf0 EFLAGS: 00010246
      [166164.933237] RAX: 0000000000000000 RBX: ffff8a90001fe900 RCX: 0000000000000000
      [166164.933238] RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffffffffc0a40180
      [166164.933239] RBP: ffffb7d7c41cbbf8 R08: 0000000000000000 R09: ffff8a93e157d6d0
      [166164.933240] R10: 0000000000000000 R11: ffffffffc0a40188 R12: 0000000000000003
      [166164.933241] R13: ffff8a9402200e80 R14: ffff8a90001fe900 R15: 0000000000000000
      [166164.933244] FS:  00007f7fb041eb00(0000) GS:ffff8a9411500000(0000)
      knlGS:0000000000000000
      [166164.933245] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [166164.933246] CR2: 0000000000000018 CR3: 00000000352c2003 CR4: 00000000003606e0
      [166164.933247] Call Trace:
      [166164.933264]  auxdev_open+0x1b/0x40 [drm_kms_helper]
      [166164.933278]  chrdev_open+0xa7/0x1c0
      [166164.933282]  ? cdev_put.part.0+0x20/0x20
      [166164.933287]  do_dentry_open+0x161/0x3c0
      [166164.933291]  vfs_open+0x2d/0x30
      [166164.933297]  path_openat+0xb27/0x10e0
      [166164.933306]  ? atime_needs_update+0x73/0xd0
      [166164.933309]  do_filp_open+0x91/0x100
      [166164.933313]  ? __alloc_fd+0xb2/0x150
      [166164.933316]  do_sys_openat2+0x210/0x2d0
      [166164.933318]  do_sys_open+0x46/0x80
      [166164.933320]  __x64_sys_openat+0x20/0x30
      [166164.933328]  do_syscall_64+0x52/0xc0
      [166164.933336]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      
      (gdb) disassemble drm_dp_aux_dev_get_by_minor+0x29
      Dump of assembler code for function drm_dp_aux_dev_get_by_minor:
         0x0000000000017b10 <+0>:     callq  0x17b15 <drm_dp_aux_dev_get_by_minor+5>
         0x0000000000017b15 <+5>:     push   %rbp
         0x0000000000017b16 <+6>:     mov    %rsp,%rbp
         0x0000000000017b19 <+9>:     push   %r12
         0x0000000000017b1b <+11>:    mov    %edi,%r12d
         0x0000000000017b1e <+14>:    mov    $0x0,%rdi
         0x0000000000017b25 <+21>:    callq  0x17b2a <drm_dp_aux_dev_get_by_minor+26>
         0x0000000000017b2a <+26>:    mov    %r12d,%esi
         0x0000000000017b2d <+29>:    mov    $0x0,%rdi
         0x0000000000017b34 <+36>:    callq  0x17b39 <drm_dp_aux_dev_get_by_minor+41>
         0x0000000000017b39 <+41>:    mov    0x18(%rax),%edx <=========
         0x0000000000017b3c <+44>:    mov    %rax,%r12
         0x0000000000017b3f <+47>:    lea    0x18(%rax),%rdi
         0x0000000000017b43 <+51>:    test   %edx,%edx
         0x0000000000017b45 <+53>:    je     0x17b7a <drm_dp_aux_dev_get_by_minor+106>
         0x0000000000017b47 <+55>:    lea    0x1(%rdx),%ecx
         0x0000000000017b4a <+58>:    mov    %edx,%eax
         0x0000000000017b4c <+60>:    lock cmpxchg %ecx,(%rdi)
         0x0000000000017b50 <+64>:    jne    0x17b76 <drm_dp_aux_dev_get_by_minor+102>
         0x0000000000017b52 <+66>:    test   %edx,%edx
         0x0000000000017b54 <+68>:    js     0x17b6d <drm_dp_aux_dev_get_by_minor+93>
         0x0000000000017b56 <+70>:    test   %ecx,%ecx
         0x0000000000017b58 <+72>:    js     0x17b6d <drm_dp_aux_dev_get_by_minor+93>
         0x0000000000017b5a <+74>:    mov    $0x0,%rdi
         0x0000000000017b61 <+81>:    callq  0x17b66 <drm_dp_aux_dev_get_by_minor+86>
         0x0000000000017b66 <+86>:    mov    %r12,%rax
         0x0000000000017b69 <+89>:    pop    %r12
         0x0000000000017b6b <+91>:    pop    %rbp
         0x0000000000017b6c <+92>:    retq
         0x0000000000017b6d <+93>:    xor    %esi,%esi
         0x0000000000017b6f <+95>:    callq  0x17b74 <drm_dp_aux_dev_get_by_minor+100>
         0x0000000000017b74 <+100>:   jmp    0x17b5a <drm_dp_aux_dev_get_by_minor+74>
         0x0000000000017b76 <+102>:   mov    %eax,%edx
         0x0000000000017b78 <+104>:   jmp    0x17b43 <drm_dp_aux_dev_get_by_minor+51>
         0x0000000000017b7a <+106>:   xor    %r12d,%r12d
         0x0000000000017b7d <+109>:   jmp    0x17b5a <drm_dp_aux_dev_get_by_minor+74>
      End of assembler dump.
      
      (gdb) list *drm_dp_aux_dev_get_by_minor+0x29
      0x17b39 is in drm_dp_aux_dev_get_by_minor (drivers/gpu/drm/drm_dp_aux_dev.c:65).
      60      static struct drm_dp_aux_dev *drm_dp_aux_dev_get_by_minor(unsigned index)
      61      {
      62              struct drm_dp_aux_dev *aux_dev = NULL;
      63
      64              mutex_lock(&aux_idr_mutex);
      65              aux_dev = idr_find(&aux_idr, index);
      66              if (!kref_get_unless_zero(&aux_dev->refcount))
      67                      aux_dev = NULL;
      68              mutex_unlock(&aux_idr_mutex);
      69
      (gdb) p/x &((struct drm_dp_aux_dev *)(0x0))->refcount
      $8 = 0x18
      
      Looking at the caller, checks on the minor are pushed down to
      drm_dp_aux_dev_get_by_minor()
      
      static int auxdev_open(struct inode *inode, struct file *file)
      {
          unsigned int minor = iminor(inode);
          struct drm_dp_aux_dev *aux_dev;
      
          aux_dev = drm_dp_aux_dev_get_by_minor(minor); <====
          if (!aux_dev)
              return -ENODEV;
      
          file->private_data = aux_dev;
          return 0;
      }
      
      Fixes: e94cb37b ("drm/dp: Add a drm_aux-dev module for reading/writing dpcd registers.")
      Cc: <stable@vger.kernel.org> # v4.6+
      Signed-off-by: default avatarZwane Mwaikambo <zwane@yosper.io>
      Reviewed-by: default avatarLyude Paul <lyude@redhat.com>
      [added Cc to stable]
      Signed-off-by: default avatarLyude Paul <lyude@redhat.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/alpine.DEB.2.21.2010122231070.38717@montezuma.home
      73b62cdb
    • Christian König's avatar
      drm/ttm: nuke caching placement flags · ce65b874
      Christian König authored
      Changing the caching on the fly never really worked
      flawlessly.
      
      So stop this completely and just let drivers specific the
      desired caching in the tt or bus object.
      Signed-off-by: default avatarChristian König <christian.koenig@amd.com>
      Reviewed-by: default avatarMichael J. Ruhl <michael.j.ruhl@intel.com>
      Link: https://patchwork.freedesktop.org/patch/394256/
      ce65b874
    • Christian König's avatar
      drm/ttm: use caching instead of placement for ttm_io_prot · 867bcecd
      Christian König authored
      Instead of the placement flags use the caching of the bus
      mapping or tt object for the page protection flags.
      Signed-off-by: default avatarChristian König <christian.koenig@amd.com>
      Reviewed-by: default avatarMichael J. Ruhl <michael.j.ruhl@intel.com>
      Link: https://patchwork.freedesktop.org/patch/394255/
      867bcecd
    • Christian König's avatar
      drm/ttm: add caching state to ttm_bus_placement · 1cf65c45
      Christian König authored
      And implement setting it up correctly in the drivers.
      
      This allows getting rid of the placement flags for this.
      Signed-off-by: default avatarChristian König <christian.koenig@amd.com>
      Reviewed-by: default avatarMichael J. Ruhl <michael.j.ruhl@intel.com>
      Link: https://patchwork.freedesktop.org/patch/394254/
      1cf65c45
    • Christian König's avatar
      drm/ttm: set the tt caching state at creation time · 1b4ea4c5
      Christian König authored
      All drivers can determine the tt caching state at creation time,
      no need to do this on the fly during every validation.
      Signed-off-by: default avatarChristian König <christian.koenig@amd.com>
      Reviewed-by: default avatarMichael J. Ruhl <michael.j.ruhl@intel.com>
      Link: https://patchwork.freedesktop.org/patch/394253/
      1b4ea4c5
    • Sumit Semwal's avatar
      drm: panel: Add novatek nt36672a panel driver · 070c7fa5
      Sumit Semwal authored
      Novatek NT36672a is a generic DSI IC that drives command and video mode
      panels. Add the driver for it.
      
      Right now adding support for some Poco F1 phones that have an LCD panel
      from Tianma connected with this IC, with a resolution of 1080x2246 that
      operates in DSI video mode.
      
      During testing, Benni Steini <bennisteinir@gmail.com> helped us fix
      the reset sequence timing (from 10ms to 20ms), to get the bootanimation
      to work on Android.
      
      With current AOSP, we need to increase it to 200ms - this seems to be a
      safe high value to avoid a white screen occasionally.
      Signed-off-by: default avatarSumit Semwal <sumit.semwal@linaro.org>
      Cc: Benni Steini <bennisteinir@gmail.com>
      Reviewed-by: default avatarBjorn Andersson <bjorn.andersson@linaro.org>
      Reviewed-by: default avatarSam Ravnborg <sam@ravnborg.org>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200902064407.30712-3-sumit.semwal@linaro.org
      070c7fa5
    • Sumit Semwal's avatar
      dt-bindings: display: panel: Add bindings for Novatek nt36672a · 9528a024
      Sumit Semwal authored
      Novatek nt36672a is a display driver IC that can drive DSI panel. It
      is also present in the Tianma video mode panel, which is a FHD+ panel
      with a resolution of 1080x2246 and 6.18 inches size. It is found in
      some of the Poco F1 phones.
      
      This patch adds the display driver for the IC, with support added for
      this tianma fhd video mode panel.
      Signed-off-by: default avatarSumit Semwal <sumit.semwal@linaro.org>
      Reviewed-by: default avatarRob Herring <robh@kernel.org>
      Reviewed-by: default avatarBjorn Andersson <bjorn.andersson@linaro.org>
      Reviewed-by: default avatarSam Ravnborg <sam@ravnborg.org>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200902064407.30712-2-sumit.semwal@linaro.org
      9528a024
  2. 14 Oct, 2020 1 commit
  3. 13 Oct, 2020 2 commits
  4. 12 Oct, 2020 1 commit
    • Randy Dunlap's avatar
      drm/aspeed: Fix Kconfig warning & subsequent build errors · bf296b35
      Randy Dunlap authored
      Kernel test robot reported build errors (undefined references)
      that didn't make much sense. After reproducing them, there is also
      a Kconfig warning that is the root cause of the build errors, so
      fix that Kconfig problem.
      
      Fixes this Kconfig warning:
      WARNING: unmet direct dependencies detected for CMA
        Depends on [n]: MMU [=n]
        Selected by [m]:
        - DRM_ASPEED_GFX [=m] && HAS_IOMEM [=y] && DRM [=m] && OF [=y] && (COMPILE_TEST [=y] || ARCH_ASPEED) && HAVE_DMA_CONTIGUOUS [=y]
      
      and these dependent build errors:
      (.text+0x10c8c): undefined reference to `start_isolate_page_range'
      microblaze-linux-ld: (.text+0x10f14): undefined reference to `test_pages_isolated'
      microblaze-linux-ld: (.text+0x10fd0): undefined reference to `undo_isolate_page_range'
      
      Fixes: 76356a96 ("drm: aspeed: Clean up Kconfig options")
      Reported-by: default avatarkernel test robot <lkp@intel.com>
      Signed-off-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Reviewed-by: default avatarJoel Stanley <joel@jms.id.au>
      Cc: Joel Stanley <joel@jms.id.au>
      Cc: Andrew Jeffery <andrew@aj.id.au>
      Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
      Cc: Michal Simek <monstr@monstr.eu>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Mike Rapoport <rppt@linux.ibm.com>
      Cc: linux-mm@kvack.org
      Cc: linux-aspeed@lists.ozlabs.org
      Cc: linux-arm-kernel@lists.infradead.org
      Cc: David Airlie <airlied@linux.ie>
      Cc: dri-devel@lists.freedesktop.org
      Signed-off-by: default avatarJoel Stanley <joel@jms.id.au>
      Link: https://patchwork.freedesktop.org/patch/msgid/20201011230131.4922-1-rdunlap@infradead.orgSigned-off-by: default avatarJoel Stanley <joel@jms.id.au>
      bf296b35
  5. 10 Oct, 2020 2 commits
  6. 09 Oct, 2020 5 commits
    • Simon Ser's avatar
      drm/fourcc: document modifier uniqueness requirements · ec5722ad
      Simon Ser authored
      There have suggestions to bake pitch alignment, address alignment,
      contiguous memory or other placement (hidden VRAM, GTT/BAR, etc)
      constraints into modifiers. Last time this was brought up it seemed
      like the consensus was to not allow this. Document this in drm_fourcc.h.
      
      There are several reasons for this.
      
      - Encoding all of these constraints in the modifiers would explode the
        search space pretty quickly (we only have 64 bits to work with).
      - Modifiers need to be unambiguous: a buffer can only have a single
        modifier.
      - Modifier users aren't expected to parse modifiers (except drivers).
      
      v2: add paragraph about aliases (Daniel)
      
      v3: fix unrelated changes sent with the patch
      
      v4: disambiguate users between driver and higher-level programs (Brian,
      Daniel)
      
      v5: fix AFBC example (Brian, Daniel)
      
      v6: remove duplicated paragraph (Daniel)
      Signed-off-by: default avatarSimon Ser <contact@emersion.fr>
      Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Reviewed-by: default avatarBrian Starkey <brian.starkey@arm.com>
      Cc: Daniel Stone <daniel@fooishbar.org>
      Cc: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>
      Cc: Dave Airlie <airlied@gmail.com>
      Cc: Marek Olšák <maraeo@gmail.com>
      Cc: Alex Deucher <alexdeucher@gmail.com>
      Cc: Neil Armstrong <narmstrong@baylibre.com>
      Cc: Michel Dänzer <michel@daenzer.net>
      Link: https://patchwork.freedesktop.org/patch/msgid/MGwgeXojKNdNXjCxuMhRlwcJM4vdYph_WJcMeGPPGMcRKtHV41XAXlh2tCc-pPJZCAhS3gwbWMWTd8f03NBA2ZYKfr0QxLhcPivpopr5c6M=@emersion.fr
      ec5722ad
    • Thomas Zimmermann's avatar
      drm/aspeed: Set driver CMA functions with DRM_GEM_CMA_DRIVER_OPS · 178c7235
      Thomas Zimmermann authored
      DRM_GEM_CMA_DRIVER_OPS sets the functions in struct drm_driver
      to their defaults. No functional changes are made.
      Signed-off-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
      Reviewed-by: default avatarJoel Stanley <joel@jms.id.au>
      Acked-by: default avatarEmil Velikov <emil.velikov@collabora.com>
      Signed-off-by: default avatarJoel Stanley <joel@jms.id.au>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200603083132.4610-5-tzimmermann@suse.de
      178c7235
    • Maxime Ripard's avatar
      drm/atomic: Pass the full state to CRTC atomic enable/disable · 351f950d
      Maxime Ripard authored
      If the CRTC driver ever needs to access the full DRM state, it can't do so
      at atomic_enable / atomic_disable time since drm_atomic_helper_swap_state
      will have cleared the pointer from the struct drm_crtc_state to the struct
      drm_atomic_state before calling those hooks.
      
      In order to allow that, let's pass the full DRM state to atomic_enable and
      atomic_disable. The conversion was done using the coccinelle script below,
      built tested on all the drivers and actually tested on vc4.
      
      virtual report
      
      @@
      struct drm_crtc_helper_funcs *FUNCS;
      identifier dev, state;
      identifier crtc, crtc_state;
      @@
      
       disable_outputs(struct drm_device *dev, struct drm_atomic_state *state)
       {
       	<...
      -	FUNCS->atomic_disable(crtc, crtc_state);
      +	FUNCS->atomic_disable(crtc, state);
       	...>
       }
      
      @@
      struct drm_crtc_helper_funcs *FUNCS;
      identifier dev, state;
      identifier crtc, crtc_state;
      @@
      
       drm_atomic_helper_commit_modeset_enables(struct drm_device *dev, struct drm_atomic_state *state)
       {
       	<...
      -	FUNCS->atomic_enable(crtc, crtc_state);
      +	FUNCS->atomic_enable(crtc, state);
       	...>
       }
      
      @@
      identifier crtc, old_state;
      @@
      
       struct drm_crtc_helper_funcs {
      	...
      -	void (*atomic_enable)(struct drm_crtc *crtc, struct drm_crtc_state *old_state);
      +	void (*atomic_enable)(struct drm_crtc *crtc, struct drm_atomic_state *state);
      	...
      -	void (*atomic_disable)(struct drm_crtc *crtc, struct drm_crtc_state *old_state);
      +	void (*atomic_disable)(struct drm_crtc *crtc, struct drm_atomic_state *state);
      	...
      }
      
      @ crtc_atomic_func @
      identifier helpers;
      identifier func;
      @@
      
      (
      static struct drm_crtc_helper_funcs helpers = {
      	...,
      	.atomic_enable = func,
      	...,
      };
      |
      static struct drm_crtc_helper_funcs helpers = {
      	...,
      	.atomic_disable = func,
      	...,
      };
      )
      
      @ ignores_old_state @
      identifier crtc_atomic_func.func;
      identifier crtc, old_state;
      @@
      
      void func(struct drm_crtc *crtc,
      		struct drm_crtc_state *old_state)
      {
      	... when != old_state
      }
      
      @ adds_old_state depends on crtc_atomic_func && !ignores_old_state @
      identifier crtc_atomic_func.func;
      identifier crtc, old_state;
      @@
      
      void func(struct drm_crtc *crtc, struct drm_crtc_state *old_state)
      {
      +	struct drm_crtc_state *old_state = drm_atomic_get_old_crtc_state(state, crtc);
      	...
      }
      
      @ depends on crtc_atomic_func @
      identifier crtc_atomic_func.func;
      expression E;
      type T;
      @@
      
      void func(...)
      {
      	...
      -	T state = E;
      +	T crtc_state = E;
      	<+...
      -	state
      +	crtc_state
      	...+>
      
      }
      
      @ depends on crtc_atomic_func @
      identifier crtc_atomic_func.func;
      type T;
      @@
      
      void func(...)
      {
      	...
      -	T state;
      +	T crtc_state;
      	<+...
      -	state
      +	crtc_state
      	...+>
      
      }
      
      @ depends on crtc_atomic_func @
      identifier crtc_atomic_func.func;
      identifier old_state;
      identifier crtc;
      @@
      
      void func(struct drm_crtc *crtc,
      -	       struct drm_crtc_state *old_state
      +	       struct drm_atomic_state *state
      	       )
      		{ ... }
      
      @ include depends on adds_old_state @
      @@
      
       #include <drm/drm_atomic.h>
      
      @ no_include depends on !include && adds_old_state @
      @@
      
      + #include <drm/drm_atomic.h>
        #include <drm/...>
      Signed-off-by: default avatarMaxime Ripard <maxime@cerno.tech>
      Acked-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Link: https://patchwork.freedesktop.org/patch/msgid/845aa10ef171fc0ea060495efef142a0c13f7870.1602161031.git-series.maxime@cerno.tech
      351f950d
    • Ondrej Jirman's avatar
      c76eb355
    • Joel Stanley's avatar
      drm/aspeed: Add sysfs for output settings · 696029eb
      Joel Stanley authored
      These settings are used by an ASPEED BMC to determine when the host is
      trying to drive the display over PCIe (vga_pw) and to switch the
      output between PCIe and the internal graphics device (dac_mux).
      
      The valid values for the dac mux are:
      
       00: VGA mode (default, aka PCIe)
       01: Graphics CRT (aka BMC internal graphics, this driver)
       10: Pass through mode from video input port A
       11: Pass through mode from video input port B
      
      Values for the read-only vga password register are:
      
       1: Host driving the display
       0: Host not driving the display
      Signed-off-by: default avatarJoel Stanley <joel@jms.id.au>
      Reviewed-by: default avatarAndrew Jeffery <andrew@aj.id.au>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200916083413.777307-1-joel@jms.id.au
      696029eb
  7. 08 Oct, 2020 5 commits
  8. 07 Oct, 2020 13 commits
  9. 06 Oct, 2020 1 commit
  10. 05 Oct, 2020 3 commits