dri-devel October 2021

dri-devel@lists.freedesktop.org

347 participants
825 discussions

[PATCH] drm/edid: Fix crash with zero/invalid EDID
by Douglas Anderson 06 Oct '21

06 Oct '21

In the commit bac9c2948224 ("drm/edid: Break out reading block 0 of the EDID") I broke out reading the base block of the EDID to its own function. Unfortunately, when I did that I messed up the handling when drm_edid_is_zero() indicated that we had an EDID that was all 0x00 or when we went through 4 loops and didn't get a valid EDID. Specifically I needed to pass the broken EDID to connector_bad_edid() but now I was passing an error-pointer. Let's re-jigger things so we can pass the bad EDID in properly. Fixes: bac9c2948224 ("drm/edid: Break out reading block 0 of the EDID") Reported-by: kernel test robot <oliver.sang(a)intel.com> Reported-by: Geert Uytterhoeven <geert(a)linux-m68k.org> Signed-off-by: Douglas Anderson <dianders(a)chromium.org> --- drivers/gpu/drm/drm_edid.c | 27 +++++++++++---------------- 1 file changed, 11 insertions(+), 16 deletions(-) diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c index 9b19eee0e1b4..9c9463ec5465 100644 --- a/drivers/gpu/drm/drm_edid.c +++ b/drivers/gpu/drm/drm_edid.c @@ -1911,13 +1911,15 @@ int drm_add_override_edid_modes(struct drm_connector *connector) } EXPORT_SYMBOL(drm_add_override_edid_modes); -static struct edid *drm_do_get_edid_base_block( +static struct edid *drm_do_get_edid_base_block(struct drm_connector *connector, int (*get_edid_block)(void *data, u8 *buf, unsigned int block, size_t len), - void *data, bool *edid_corrupt, int *null_edid_counter) + void *data) { - int i; + int *null_edid_counter = connector ? &connector->null_edid_counter : NULL; + bool *edid_corrupt = connector ? &connector->edid_corrupt : NULL; void *edid; + int i; edid = kmalloc(EDID_LENGTH, GFP_KERNEL); if (edid == NULL) @@ -1941,9 +1943,8 @@ static struct edid *drm_do_get_edid_base_block( return edid; carp: - kfree(edid); - return ERR_PTR(-EINVAL); - + if (connector) + connector_bad_edid(connector, edid, 1); out: kfree(edid); return NULL; @@ -1982,14 +1983,9 @@ struct edid *drm_do_get_edid(struct drm_connector *connector, if (override) return override; - edid = (u8 *)drm_do_get_edid_base_block(get_edid_block, data, - &connector->edid_corrupt, - &connector->null_edid_counter); - if (IS_ERR_OR_NULL(edid)) { - if (IS_ERR(edid)) - connector_bad_edid(connector, edid, 1); + edid = (u8 *)drm_do_get_edid_base_block(connector, get_edid_block, data); + if (!edid) return NULL; - } /* if there's no extensions or no connector, we're done */ valid_extensions = edid[0x7e]; @@ -2142,14 +2138,13 @@ u32 drm_edid_get_panel_id(struct i2c_adapter *adapter) struct edid *edid; u32 panel_id; - edid = drm_do_get_edid_base_block(drm_do_probe_ddc_edid, adapter, - NULL, NULL); + edid = drm_do_get_edid_base_block(NULL, drm_do_probe_ddc_edid, adapter); /* * There are no manufacturer IDs of 0, so if there is a problem reading * the EDID then we'll just return 0. */ - if (IS_ERR_OR_NULL(edid)) + if (!edid) return 0; panel_id = edid_extract_panel_id(edid); -- 2.33.0.800.g4c38ced690-goog

6 11

[PATCH] drm/bridge/lontium-lt9611uxc: fix provided connector suport
by Dmitry Baryshkov 06 Oct '21

06 Oct '21

- set DRM_CONNECTOR_POLL_HPD as the connector will generate hotplug events on its own - do not call drm_kms_helper_hotplug_event() unless mode_config.funcs pointer is not NULL to remove possible kernel oops. Fixes: bc6fa8676ebb ("drm/bridge/lontium-lt9611uxc: move HPD notification out of IRQ handler") Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> --- drivers/gpu/drm/bridge/lontium-lt9611uxc.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/bridge/lontium-lt9611uxc.c b/drivers/gpu/drm/bridge/lontium-lt9611uxc.c index 3cac16db970f..010657ea7af7 100644 --- a/drivers/gpu/drm/bridge/lontium-lt9611uxc.c +++ b/drivers/gpu/drm/bridge/lontium-lt9611uxc.c @@ -167,9 +167,10 @@ static void lt9611uxc_hpd_work(struct work_struct *work) struct lt9611uxc *lt9611uxc = container_of(work, struct lt9611uxc, work); bool connected; - if (lt9611uxc->connector.dev) - drm_kms_helper_hotplug_event(lt9611uxc->connector.dev); - else { + if (lt9611uxc->connector.dev) { + if (lt9611uxc->connector.dev->mode_config.funcs) + drm_kms_helper_hotplug_event(lt9611uxc->connector.dev); + } else { mutex_lock(&lt9611uxc->ocm_lock); connected = lt9611uxc->hdmi_connected; @@ -339,6 +340,8 @@ static int lt9611uxc_connector_init(struct drm_bridge *bridge, struct lt9611uxc return -ENODEV; } + lt9611uxc->connector.polled = DRM_CONNECTOR_POLL_HPD; + drm_connector_helper_add(&lt9611uxc->connector, &lt9611uxc_bridge_connector_helper_funcs); ret = drm_connector_init(bridge->dev, &lt9611uxc->connector, -- 2.30.2

2 2

[v2 PATCH 0/3] Fix the issues caused by CMDQ refinement of mtk-drm
by jason-jh.lin 06 Oct '21

06 Oct '21

Change in v2: - cmdq_ddp_cb should use struct mbox_clinet to find struct cmdq_client, and then use struct cmdq_clint to find struct mtk_drm_crtc - change data.sta checking condition to stadard error checking jason-jh.lin (3): drm/mediatek: Fix crash at using pkt->cl->chan in cmdq_pkt_finalize drm/mediatek: Fix pkt buf alloc once but free many times drm/mediatek: Fix cursor plane is not config when primary is updating drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 95 ++++++++++++++----------- 1 file changed, 54 insertions(+), 41 deletions(-) -- 2.18.0

3 9

[PULL] drm-misc-next
by Maarten Lankhorst 06 Oct '21

06 Oct '21

Hi Dave, Daniel, Handling drm-misc-next this week for Maxime. drm-misc-next-2021-10-06: drm-misc-next for v5.16: UAPI Changes: - Allow empty drm leases for creating separate GEM namespaces. Cross-subsystem Changes: - Slightly rework dma_buf_poll. - Add dma_resv_for_each_fence_unlocked to iterate, and use it inside the lockless dma-resv functions. Core Changes: - Allow devm_drm_of_get_bridge to build without CONFIG_OF for compile testing. - Add more DP2 headers. - fix CONFIG_FB dependency in fb_helper. - Add DRM_FORMAT_R8 to drm_format_info, and helpers for RGB332 and RGB888. - Fix crash on a 0 or invalid EDID. Driver Changes: - Apply and revert DRM_MODESET_LOCK_ALL_BEGIN. - Add mode_valid to ti-sn65dsi86 bridge. - Support multiple syncobjs in v3d. - Add R8, RGB332 and RGB888 pixel formats to GUD. - Use devm_add_action_or_reset in dw-hdmi-cec. The following changes since commit 9c2fce137852e6434ca0c6fe3d75e00feb168c07: drm: Fix scaling_mode docs (2021-09-22 22:11:53 +0300) are available in the Git repository at: git://anongit.freedesktop.org/drm/drm-misc tags/drm-misc-next-2021-10-06 for you to fetch changes up to 9962601ca5719050906915c3c33a63744ac7b15c: drm/bridge: dw-hdmi-cec: Make use of the helper function devm_add_action_or_reset() (2021-10-06 11:21:46 +0200) ---------------------------------------------------------------- drm-misc-next for v5.16: UAPI Changes: - Allow empty drm leases for creating separate GEM namespaces. Cross-subsystem Changes: - Slightly rework dma_buf_poll. - Add dma_resv_for_each_fence_unlocked to iterate, and use it inside the lockless dma-resv functions. Core Changes: - Allow devm_drm_of_get_bridge to build without CONFIG_OF for compile testing. - Add more DP2 headers. - fix CONFIG_FB dependency in fb_helper. - Add DRM_FORMAT_R8 to drm_format_info, and helpers for RGB332 and RGB888. - Fix crash on a 0 or invalid EDID. Driver Changes: - Apply and revert DRM_MODESET_LOCK_ALL_BEGIN. - Add mode_valid to ti-sn65dsi86 bridge. - Support multiple syncobjs in v3d. - Add R8, RGB332 and RGB888 pixel formats to GUD. - Use devm_add_action_or_reset in dw-hdmi-cec. ---------------------------------------------------------------- Anthoine Bourgeois (2): drm/virtio: implement context init: probe for feature drm/virtio: implement context init: support init ioctl Arnd Bergmann (1): drm: fb_helper: fix CONFIG_FB dependency Cai Huoqing (1): drm/bridge: dw-hdmi-cec: Make use of the helper function devm_add_action_or_reset() Christian König (7): drm/msm: allow compile_test on !ARM dma-buf: fix and rework dma_buf_poll v7 dma-buf: add dma_resv_for_each_fence_unlocked v8 dma-buf: use new iterator in dma_resv_copy_fences dma-buf: use new iterator in dma_resv_get_fences v3 dma-buf: use new iterator in dma_resv_wait_timeout dma-buf: use new iterator in dma_resv_test_signaled Douglas Anderson (4): drm/edid: Fix EDID quirk compile error on older compilers drm/print: Add deprecation notes to DRM_...() functions drm/edid: Fix drm_edid_encode_panel_id() kerneldoc warning drm/edid: Fix crash with zero/invalid EDID Fangzhi Zuo (1): drm/dp: Add Additional DP2 Headers Fernando Ramos (17): drm: cleanup: drm_modeset_lock_all_ctx() --> DRM_MODESET_LOCK_ALL_BEGIN() drm/i915: cleanup: drm_modeset_lock_all_ctx() --> DRM_MODESET_LOCK_ALL_BEGIN() drm/msm: cleanup: drm_modeset_lock_all_ctx() --> DRM_MODESET_LOCK_ALL_BEGIN() drm: cleanup: drm_modeset_lock_all() --> DRM_MODESET_LOCK_ALL_BEGIN() drm/vmwgfx: cleanup: drm_modeset_lock_all() --> DRM_MODESET_LOCK_ALL_BEGIN() drm/tegra: cleanup: drm_modeset_lock_all() --> DRM_MODESET_LOCK_ALL_BEGIN() drm/shmobile: cleanup: drm_modeset_lock_all() --> DRM_MODESET_LOCK_ALL_BEGIN() drm/radeon: cleanup: drm_modeset_lock_all() --> DRM_MODESET_LOCK_ALL_BEGIN() drm/omapdrm: cleanup: drm_modeset_lock_all() --> DRM_MODESET_LOCK_ALL_BEGIN() drm/nouveau: cleanup: drm_modeset_lock_all() --> DRM_MODESET_LOCK_ALL_BEGIN() drm/msm: cleanup: drm_modeset_lock_all() --> DRM_MODESET_LOCK_ALL_BEGIN() drm/i915: cleanup: drm_modeset_lock_all() --> DRM_MODESET_LOCK_ALL_BEGIN() drm/i915: cleanup: drm_modeset_lock_all() --> DRM_MODESET_LOCK_ALL_BEGIN() part 2 drm/gma500: cleanup: drm_modeset_lock_all() --> DRM_MODESET_LOCK_ALL_BEGIN() drm/amd: cleanup: drm_modeset_lock_all() --> DRM_MODESET_LOCK_ALL_BEGIN() drm: cleanup: remove drm_modeset_(un)lock_all() doc: drm: remove TODO entry regarding DRM_MODSET_LOCK_ALL cleanup Gurchetan Singh (10): virtio-gpu api: multiple context types with explicit initialization drm/virtgpu api: create context init feature drm/virtio: implement context init: track valid capabilities in a mask drm/virtio: implement context init: track {ring_idx, emit_fence_info} in virtio_gpu_fence drm/virtio: implement context init: plumb {base_fence_ctx, ring_idx} to virtio_gpu_fence_alloc drm/virtio: implement context init: stop using drv->context when creating fence drm/virtio: implement context init: allocate an array of fence contexts drm/virtio: implement context init: handle VIRTGPU_CONTEXT_PARAM_POLL_RINGS_MASK drm/virtio: implement context init: add virtio_gpu_fence_event drm/virtio: implement context init: advertise feature to userspace Matthew Auld (7): drm/ttm: stop calling tt_swapin in vm_access drm/ttm: stop setting page->index for the ttm_tt drm/ttm: move ttm_tt_{add, clear}_mapping into amdgpu drm/ttm: remove TTM_PAGE_FLAG_NO_RETRY drm/ttm: s/FLAG_SG/FLAG_EXTERNAL/ drm/ttm: add some kernel-doc for TTM_TT_FLAG_* drm/ttm: add TTM_TT_FLAG_EXTERNAL_MAPPABLE Maxime Ripard (8): drm/bridge: Add documentation sections drm/bridge: Document the probe issue with MIPI-DSI bridges drm/mipi-dsi: Create devm device registration drm/mipi-dsi: Create devm device attachment drm/probe-helper: Document drm_helper_hpd_irq_event() return value drm/probe-helper: Create a HPD IRQ event helper for a single connector drm/vc4: hdmi: Actually check for the connector status in hotplug drm/bridge: Add stubs for devm_drm_of_get_bridge when OF is disabled Melissa Wen (4): drm/v3d: decouple adding job dependencies steps from job init drm/v3d: alloc and init job in one shot drm/v3d: add generic ioctl extension drm/v3d: add multiple syncobjs support Noralf Trønnes (6): drm/fourcc: Add R8 to drm_format_info drm/format-helper: Add drm_fb_xrgb8888_to_rgb332() drm/format-helper: Add drm_fb_xrgb8888_to_rgb888() drm/gud: Add GUD_PIXEL_FORMAT_R8 drm/gud: Add GUD_PIXEL_FORMAT_RGB332 drm/gud: Add GUD_PIXEL_FORMAT_RGB888 Philip Chen (2): drm/bridge: parade-ps8640: Use regmap APIs drm/bridge: parade-ps8640: Add support for AUX channel Rob Clark (1): drm/bridge: ti-sn65dsi86: Implement bridge->mode_valid() Sean Paul (16): Revert "drm: cleanup: remove drm_modeset_(un)lock_all()" Revert "drm/amd: cleanup: drm_modeset_lock_all() --> DRM_MODESET_LOCK_ALL_BEGIN()" Revert "drm/gma500: cleanup: drm_modeset_lock_all() --> DRM_MODESET_LOCK_ALL_BEGIN()" Revert "drm/i915: cleanup: drm_modeset_lock_all() --> DRM_MODESET_LOCK_ALL_BEGIN() part 2" Revert "drm/i915: cleanup: drm_modeset_lock_all() --> DRM_MODESET_LOCK_ALL_BEGIN()" Revert "drm/msm: cleanup: drm_modeset_lock_all() --> DRM_MODESET_LOCK_ALL_BEGIN()" Revert "drm/nouveau: cleanup: drm_modeset_lock_all() --> DRM_MODESET_LOCK_ALL_BEGIN()" Revert "drm/omapdrm: cleanup: drm_modeset_lock_all() --> DRM_MODESET_LOCK_ALL_BEGIN()" Revert "drm/radeon: cleanup: drm_modeset_lock_all() --> DRM_MODESET_LOCK_ALL_BEGIN()" Revert "drm/shmobile: cleanup: drm_modeset_lock_all() --> DRM_MODESET_LOCK_ALL_BEGIN()" Revert "drm/tegra: cleanup: drm_modeset_lock_all() --> DRM_MODESET_LOCK_ALL_BEGIN()" Revert "drm/vmwgfx: cleanup: drm_modeset_lock_all() --> DRM_MODESET_LOCK_ALL_BEGIN()" Revert "drm: cleanup: drm_modeset_lock_all() --> DRM_MODESET_LOCK_ALL_BEGIN()" Revert "drm/msm: cleanup: drm_modeset_lock_all_ctx() --> DRM_MODESET_LOCK_ALL_BEGIN()" Revert "drm/i915: cleanup: drm_modeset_lock_all_ctx() --> DRM_MODESET_LOCK_ALL_BEGIN()" Revert "drm: cleanup: drm_modeset_lock_all_ctx() --> DRM_MODESET_LOCK_ALL_BEGIN()" Simon Ser (1): drm/lease: allow empty leases Thomas Zimmermann (10): lib: devres: Add managed arch_phys_wc_add() lib: devres: Add managed arch_io_reserve_memtype_wc() drm/ast: Use managed interfaces for framebuffer write combining drm/mgag200: Use managed interfaces for framebuffer write combining drm/vboxvideo: Use managed interfaces for framebuffer write combining drm/gma500: Replace references to dev_private with helper function drm/gma500: Disable PCI device during shutdown drm/gma500: Embed struct drm_device in struct drm_psb_private drm/gma500: Remove dev_priv branch from unload function drm/gma500: Managed device release Yang Yingliang (1): drm/gma500: Fix wrong pointer passed to PTR_ERR() yangcong (4): dt-bindings: drm/panel: boe-tv101wum-nl6: Support enabling a 3.3V rail drm/panel: boe-tv101wum-nl6: Support enabling a 3.3V rail dt-bindings: boe, tv101wum-n16: Add compatible for boe tv110c9m-ll3 and inx hj110iz-01a drm/panel: support for BOE and INX video mode panel .../bindings/display/panel/boe,tv101wum-nl6.yaml | 7 + Documentation/gpu/drm-kms-helpers.rst | 12 + Documentation/gpu/todo.rst | 17 - Documentation/locking/ww-mutex-design.rst | 2 +- drivers/dma-buf/dma-buf.c | 152 ++--- drivers/dma-buf/dma-resv.c | 418 +++++------- drivers/gpu/drm/Kconfig | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 25 +- drivers/gpu/drm/ast/ast_drv.h | 2 - drivers/gpu/drm/ast/ast_mm.c | 27 +- drivers/gpu/drm/bridge/parade-ps8640.c | 274 +++++++- drivers/gpu/drm/bridge/synopsys/dw-hdmi-cec.c | 6 +- drivers/gpu/drm/bridge/ti-sn65dsi86.c | 25 +- drivers/gpu/drm/drm_bridge.c | 71 +- drivers/gpu/drm/drm_edid.c | 148 ++-- drivers/gpu/drm/drm_format_helper.c | 88 +++ drivers/gpu/drm/drm_fourcc.c | 1 + drivers/gpu/drm/drm_lease.c | 39 +- drivers/gpu/drm/drm_mipi_dsi.c | 81 +++ drivers/gpu/drm/drm_probe_helper.c | 119 +++- drivers/gpu/drm/gma500/backlight.c | 12 +- drivers/gpu/drm/gma500/cdv_device.c | 24 +- drivers/gpu/drm/gma500/cdv_intel_display.c | 10 +- drivers/gpu/drm/gma500/cdv_intel_dp.c | 12 +- drivers/gpu/drm/gma500/cdv_intel_lvds.c | 22 +- drivers/gpu/drm/gma500/framebuffer.c | 16 +- drivers/gpu/drm/gma500/gem.c | 2 +- drivers/gpu/drm/gma500/gma_device.c | 2 +- drivers/gpu/drm/gma500/gma_display.c | 14 +- drivers/gpu/drm/gma500/gtt.c | 18 +- drivers/gpu/drm/gma500/intel_bios.c | 10 +- drivers/gpu/drm/gma500/intel_gmbus.c | 12 +- drivers/gpu/drm/gma500/mid_bios.c | 11 +- drivers/gpu/drm/gma500/mmu.c | 12 +- drivers/gpu/drm/gma500/oaktrail_crtc.c | 8 +- drivers/gpu/drm/gma500/oaktrail_device.c | 20 +- drivers/gpu/drm/gma500/oaktrail_hdmi.c | 18 +- drivers/gpu/drm/gma500/oaktrail_lvds.c | 14 +- drivers/gpu/drm/gma500/oaktrail_lvds_i2c.c | 2 +- drivers/gpu/drm/gma500/opregion.c | 14 +- drivers/gpu/drm/gma500/power.c | 20 +- drivers/gpu/drm/gma500/psb_device.c | 16 +- drivers/gpu/drm/gma500/psb_drv.c | 147 ++-- drivers/gpu/drm/gma500/psb_drv.h | 24 +- drivers/gpu/drm/gma500/psb_intel_display.c | 10 +- drivers/gpu/drm/gma500/psb_intel_lvds.c | 31 +- drivers/gpu/drm/gma500/psb_intel_sdvo.c | 10 +- drivers/gpu/drm/gma500/psb_irq.c | 26 +- drivers/gpu/drm/gma500/psb_lid.c | 2 +- drivers/gpu/drm/gud/gud_drv.c | 6 + drivers/gpu/drm/gud/gud_internal.h | 12 + drivers/gpu/drm/gud/gud_pipe.c | 6 + drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 6 +- drivers/gpu/drm/mgag200/mgag200_drv.h | 2 - drivers/gpu/drm/mgag200/mgag200_mm.c | 35 +- drivers/gpu/drm/msm/Kconfig | 4 +- drivers/gpu/drm/msm/msm_gem.c | 2 +- drivers/gpu/drm/nouveau/nouveau_bo.c | 4 +- drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 743 ++++++++++++++++++++- drivers/gpu/drm/panel/panel-edp.c | 23 +- drivers/gpu/drm/radeon/radeon_ttm.c | 8 +- drivers/gpu/drm/ttm/ttm_bo.c | 4 +- drivers/gpu/drm/ttm/ttm_bo_util.c | 4 +- drivers/gpu/drm/ttm/ttm_bo_vm.c | 15 +- drivers/gpu/drm/ttm/ttm_pool.c | 2 +- drivers/gpu/drm/ttm/ttm_tt.c | 54 +- drivers/gpu/drm/v3d/v3d_drv.c | 10 +- drivers/gpu/drm/v3d/v3d_drv.h | 24 +- drivers/gpu/drm/v3d/v3d_gem.c | 390 ++++++++--- drivers/gpu/drm/vboxvideo/vbox_drv.c | 5 +- drivers/gpu/drm/vboxvideo/vbox_drv.h | 1 - drivers/gpu/drm/vboxvideo/vbox_ttm.c | 17 +- drivers/gpu/drm/vc4/vc4_hdmi.c | 5 +- drivers/gpu/drm/virtio/virtgpu_debugfs.c | 1 + drivers/gpu/drm/virtio/virtgpu_drv.c | 44 +- drivers/gpu/drm/virtio/virtgpu_drv.h | 28 +- drivers/gpu/drm/virtio/virtgpu_fence.c | 30 +- drivers/gpu/drm/virtio/virtgpu_ioctl.c | 195 +++++- drivers/gpu/drm/virtio/virtgpu_kms.c | 26 +- drivers/gpu/drm/virtio/virtgpu_plane.c | 3 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 19 +- include/drm/drm_bridge.h | 23 +- include/drm/drm_dp_helper.h | 20 + include/drm/drm_edid.h | 14 +- include/drm/drm_format_helper.h | 4 + include/drm/drm_mipi_dsi.h | 4 + include/drm/drm_print.h | 30 + include/drm/drm_probe_helper.h | 1 + include/drm/gud.h | 6 +- include/drm/ttm/ttm_device.h | 2 +- include/drm/ttm/ttm_tt.h | 82 ++- include/linux/dma-buf.h | 2 +- include/linux/dma-resv.h | 95 +++ include/linux/io.h | 5 + include/uapi/drm/drm_mode.h | 3 +- include/uapi/drm/v3d_drm.h | 78 +++ include/uapi/drm/virtgpu_drm.h | 27 + include/uapi/linux/virtio_gpu.h | 18 +- lib/devres.c | 82 +++ 99 files changed, 3148 insertions(+), 1131 deletions(-)

1 0

[PATCH] drm/bridge: dw-hdmi-cec: Make use of the helper function devm_add_action_or_reset()
by Cai Huoqing 06 Oct '21

06 Oct '21

The helper function devm_add_action_or_reset() will internally call devm_add_action(), and if devm_add_action() fails then it will execute the action mentioned and return the error code. So use devm_add_action_or_reset() instead of devm_add_action() to simplify the error handling, reduce the code. Signed-off-by: Cai Huoqing <caihuoqing(a)baidu.com> --- drivers/gpu/drm/bridge/synopsys/dw-hdmi-cec.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-cec.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-cec.c index 70ab4fbdc23e..c8f44bcb298a 100644 --- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-cec.c +++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-cec.c @@ -265,11 +265,9 @@ static int dw_hdmi_cec_probe(struct platform_device *pdev) /* override the module pointer */ cec->adap->owner = THIS_MODULE; - ret = devm_add_action(&pdev->dev, dw_hdmi_cec_del, cec); - if (ret) { - cec_delete_adapter(cec->adap); + ret = devm_add_action_or_reset(&pdev->dev, dw_hdmi_cec_del, cec); + if (ret) return ret; - } ret = devm_request_threaded_irq(&pdev->dev, cec->irq, dw_hdmi_cec_hardirq, -- 2.25.1

3 2

[PULL] drm-misc-fixes
by Maarten Lankhorst 06 Oct '21

06 Oct '21

Hi Dave, Daniel, I've rebased the patches and dropped the vc4 changes. I kept the compiler fix, as it appeared to be unrelated to the clock changes. drm-misc-fixes-2021-10-06: Rebased drm-misc-fixes for v5.15-rc5: - Dropped vc4 patches. - Compiler fix for vc4. - Cursor fix for nouveau. - Fix ttm buffer moves for ampere gpu's by adding minimal acceleration support. - Small rockchip fixes. - Fix DT bindings indent for ili9341. - Fix y030xx067a init sequence to not get a yellow tint. - Kconfig fix for fb_simple vs simpledrm. - Assorted nouvaeu memory leaks. - Fix gbefb when built with COMPILE_TEST. The following changes since commit 9e1ff307c779ce1f0f810c7ecce3d95bbae40896: Linux 5.15-rc4 (2021-10-03 14:08:47 -0700) are available in the Git repository at: git://anongit.freedesktop.org/drm/drm-misc tags/drm-misc-fixes-2021-10-06 for you to fetch changes up to f5a8703a9c418c6fc54eb772712dfe7641e3991c: drm/nouveau/debugfs: fix file release memory leak (2021-10-06 11:12:29 +0200) ---------------------------------------------------------------- Rebased drm-misc-fixes for v5.15-rc5: - Dropped vc4 patches. - Compiler fix for vc4. - Cursor fix for nouveau. - Fix ttm buffer moves for ampere gpu's by adding minimal acceleration support. - Small rockchip fixes. - Fix DT bindings indent for ili9341. - Fix y030xx067a init sequence to not get a yellow tint. - Kconfig fix for fb_simple vs simpledrm. - Assorted nouvaeu memory leaks. - Fix gbefb when built with COMPILE_TEST. ---------------------------------------------------------------- Arnd Bergmann (1): fbdev: simplefb: fix Kconfig dependencies Ben Skeggs (3): drm/nouveau/kms/tu102-: delay enabling cursor until after assign_windows drm/nouveau/ga102-: support ttm buffer moves via copy engine drm/nouveau/fifo/ga102: initialise chid on return from channel creation Chris Morgan (1): drm/rockchip: Update crtc fixup to account for fractional clk change Christophe Branchereau (1): drm/panel: abt-y030xx067a: yellow tint fix Edmund Dea (1): drm/kmb: Enable alpha blended second plane Jeremy Cline (1): drm/nouveau: avoid a use-after-free when BO init fails Jernej Skrabec (1): drm/sun4i: dw-hdmi: Fix HDMI PHY clock setup Krzysztof Kozlowski (1): dt-bindings: panel: ili9341: correct indentation Mark Brown (1): video: fbdev: gbefb: Only instantiate device when built for IP32 Maxime Ripard (1): drm/vc4: hdmi: Remove unused struct Randy Dunlap (1): DRM: delete DRM IRQ legacy midlayer docs Yang Yingliang (2): drm/nouveau/kms/nv50-: fix file release memory leak drm/nouveau/debugfs: fix file release memory leak .../bindings/display/panel/ilitek,ili9341.yaml | 2 +- Documentation/gpu/drm-internals.rst | 9 - drivers/gpu/drm/kmb/kmb_drv.c | 8 +- drivers/gpu/drm/kmb/kmb_drv.h | 5 + drivers/gpu/drm/kmb/kmb_plane.c | 81 +++++- drivers/gpu/drm/kmb/kmb_plane.h | 5 +- drivers/gpu/drm/kmb/kmb_regs.h | 3 + drivers/gpu/drm/nouveau/dispnv50/crc.c | 1 + drivers/gpu/drm/nouveau/dispnv50/head.c | 2 +- drivers/gpu/drm/nouveau/include/nvif/class.h | 2 + drivers/gpu/drm/nouveau/include/nvkm/engine/fifo.h | 1 + drivers/gpu/drm/nouveau/nouveau_bo.c | 1 + drivers/gpu/drm/nouveau/nouveau_chan.c | 6 +- drivers/gpu/drm/nouveau/nouveau_debugfs.c | 1 + drivers/gpu/drm/nouveau/nouveau_drm.c | 4 + drivers/gpu/drm/nouveau/nouveau_gem.c | 4 +- drivers/gpu/drm/nouveau/nv84_fence.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 3 + drivers/gpu/drm/nouveau/nvkm/engine/fifo/Kbuild | 1 + drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga102.c | 311 +++++++++++++++++++++ drivers/gpu/drm/nouveau/nvkm/subdev/top/ga100.c | 7 +- drivers/gpu/drm/panel/panel-abt-y030xx067a.c | 4 +- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 26 +- drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c | 7 +- drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h | 4 +- drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c | 97 ++++--- drivers/gpu/drm/vc4/vc4_hdmi.c | 8 - drivers/of/base.c | 1 + drivers/video/fbdev/Kconfig | 5 +- drivers/video/fbdev/gbefb.c | 2 +- 30 files changed, 504 insertions(+), 109 deletions(-) create mode 100644 drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga102.c

1 0

[PATCH v7 1/8] drm/i915/gem: Break out some shmem backend utils
by Matthew Auld 06 Oct '21

06 Oct '21

From: Thomas Hellström <thomas.hellstrom(a)linux.intel.com> Break out some shmem backend utils for future reuse by the TTM backend: shmem_alloc_st(), shmem_free_st() and __shmem_writeback() which we can use to provide a shmem-backed TTM page pool for cached-only TTM buffer objects. Main functional change here is that we now compute the page sizes using the dma segments rather than using the physical page address segments. v2(Reported-by: kernel test robot <lkp(a)intel.com>) - Make sure we initialise the mapping on the error path in shmem_get_pages() Signed-off-by: Thomas Hellström <thomas.hellstrom(a)linux.intel.com> Reviewed-by: Matthew Auld <matthew.auld(a)intel.com> Signed-off-by: Matthew Auld <matthew.auld(a)intel.com> --- drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 181 +++++++++++++--------- 1 file changed, 106 insertions(+), 75 deletions(-) diff --git a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c index 11f072193f3b..36b711ae9e28 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c @@ -25,46 +25,61 @@ static void check_release_pagevec(struct pagevec *pvec) cond_resched(); } -static int shmem_get_pages(struct drm_i915_gem_object *obj) +static void shmem_free_st(struct sg_table *st, struct address_space *mapping, + bool dirty, bool backup) { - struct drm_i915_private *i915 = to_i915(obj->base.dev); - struct intel_memory_region *mem = obj->mm.region; - const unsigned long page_count = obj->base.size / PAGE_SIZE; + struct sgt_iter sgt_iter; + struct pagevec pvec; + struct page *page; + + mapping_clear_unevictable(mapping); + + pagevec_init(&pvec); + for_each_sgt_page(page, sgt_iter, st) { + if (dirty) + set_page_dirty(page); + + if (backup) + mark_page_accessed(page); + + if (!pagevec_add(&pvec, page)) + check_release_pagevec(&pvec); + } + if (pagevec_count(&pvec)) + check_release_pagevec(&pvec); + + sg_free_table(st); + kfree(st); +} + +static struct sg_table *shmem_alloc_st(struct drm_i915_private *i915, + size_t size, struct intel_memory_region *mr, + struct address_space *mapping, + unsigned int max_segment) +{ + const unsigned long page_count = size / PAGE_SIZE; unsigned long i; - struct address_space *mapping; struct sg_table *st; struct scatterlist *sg; - struct sgt_iter sgt_iter; struct page *page; unsigned long last_pfn = 0; /* suppress gcc warning */ - unsigned int max_segment = i915_sg_segment_size(); - unsigned int sg_page_sizes; gfp_t noreclaim; int ret; - /* - * Assert that the object is not currently in any GPU domain. As it - * wasn't in the GTT, there shouldn't be any way it could have been in - * a GPU cache - */ - GEM_BUG_ON(obj->read_domains & I915_GEM_GPU_DOMAINS); - GEM_BUG_ON(obj->write_domain & I915_GEM_GPU_DOMAINS); - /* * If there's no chance of allocating enough pages for the whole * object, bail early. */ - if (obj->base.size > resource_size(&mem->region)) - return -ENOMEM; + if (size > resource_size(&mr->region)) + return ERR_PTR(-ENOMEM); st = kmalloc(sizeof(*st), GFP_KERNEL); if (!st) - return -ENOMEM; + return ERR_PTR(-ENOMEM); -rebuild_st: if (sg_alloc_table(st, page_count, GFP_KERNEL)) { kfree(st); - return -ENOMEM; + return ERR_PTR(-ENOMEM); } /* @@ -73,14 +88,12 @@ static int shmem_get_pages(struct drm_i915_gem_object *obj) * * Fail silently without starting the shrinker */ - mapping = obj->base.filp->f_mapping; mapping_set_unevictable(mapping); noreclaim = mapping_gfp_constraint(mapping, ~__GFP_RECLAIM); noreclaim |= __GFP_NORETRY | __GFP_NOWARN; sg = st->sgl; st->nents = 0; - sg_page_sizes = 0; for (i = 0; i < page_count; i++) { const unsigned int shrink[] = { I915_SHRINK_BOUND | I915_SHRINK_UNBOUND, @@ -135,10 +148,9 @@ static int shmem_get_pages(struct drm_i915_gem_object *obj) if (!i || sg->length >= max_segment || page_to_pfn(page) != last_pfn + 1) { - if (i) { - sg_page_sizes |= sg->length; + if (i) sg = sg_next(sg); - } + st->nents++; sg_set_page(sg, page, PAGE_SIZE, 0); } else { @@ -149,14 +161,65 @@ static int shmem_get_pages(struct drm_i915_gem_object *obj) /* Check that the i965g/gm workaround works. */ GEM_BUG_ON(gfp & __GFP_DMA32 && last_pfn >= 0x00100000UL); } - if (sg) { /* loop terminated early; short sg table */ - sg_page_sizes |= sg->length; + if (sg) /* loop terminated early; short sg table */ sg_mark_end(sg); - } /* Trim unused sg entries to avoid wasting memory. */ i915_sg_trim(st); + return st; +err_sg: + sg_mark_end(sg); + if (sg != st->sgl) { + shmem_free_st(st, mapping, false, false); + } else { + mapping_clear_unevictable(mapping); + sg_free_table(st); + kfree(st); + } + + /* + * shmemfs first checks if there is enough memory to allocate the page + * and reports ENOSPC should there be insufficient, along with the usual + * ENOMEM for a genuine allocation failure. + * + * We use ENOSPC in our driver to mean that we have run out of aperture + * space and so want to translate the error from shmemfs back to our + * usual understanding of ENOMEM. + */ + if (ret == -ENOSPC) + ret = -ENOMEM; + + return ERR_PTR(ret); +} + +static int shmem_get_pages(struct drm_i915_gem_object *obj) +{ + struct drm_i915_private *i915 = to_i915(obj->base.dev); + struct intel_memory_region *mem = obj->mm.region; + struct address_space *mapping = obj->base.filp->f_mapping; + const unsigned long page_count = obj->base.size / PAGE_SIZE; + unsigned int max_segment = i915_sg_segment_size(); + struct sg_table *st; + struct sgt_iter sgt_iter; + struct page *page; + int ret; + + /* + * Assert that the object is not currently in any GPU domain. As it + * wasn't in the GTT, there shouldn't be any way it could have been in + * a GPU cache + */ + GEM_BUG_ON(obj->read_domains & I915_GEM_GPU_DOMAINS); + GEM_BUG_ON(obj->write_domain & I915_GEM_GPU_DOMAINS); + +rebuild_st: + st = shmem_alloc_st(i915, obj->base.size, mem, mapping, max_segment); + if (IS_ERR(st)) { + ret = PTR_ERR(st); + goto err_st; + } + ret = i915_gem_gtt_prepare_pages(obj, st); if (ret) { /* @@ -168,6 +231,7 @@ static int shmem_get_pages(struct drm_i915_gem_object *obj) for_each_sgt_page(page, sgt_iter, st) put_page(page); sg_free_table(st); + kfree(st); max_segment = PAGE_SIZE; goto rebuild_st; @@ -200,28 +264,12 @@ static int shmem_get_pages(struct drm_i915_gem_object *obj) if (IS_JSL_EHL(i915) && obj->flags & I915_BO_ALLOC_USER) obj->cache_dirty = true; - __i915_gem_object_set_pages(obj, st, sg_page_sizes); + __i915_gem_object_set_pages(obj, st, i915_sg_dma_sizes(st->sgl)); return 0; -err_sg: - sg_mark_end(sg); err_pages: - mapping_clear_unevictable(mapping); - if (sg != st->sgl) { - struct pagevec pvec; - - pagevec_init(&pvec); - for_each_sgt_page(page, sgt_iter, st) { - if (!pagevec_add(&pvec, page)) - check_release_pagevec(&pvec); - } - if (pagevec_count(&pvec)) - check_release_pagevec(&pvec); - } - sg_free_table(st); - kfree(st); - + shmem_free_st(st, mapping, false, false); /* * shmemfs first checks if there is enough memory to allocate the page * and reports ENOSPC should there be insufficient, along with the usual @@ -231,6 +279,7 @@ static int shmem_get_pages(struct drm_i915_gem_object *obj) * space and so want to translate the error from shmemfs back to our * usual understanding of ENOMEM. */ +err_st: if (ret == -ENOSPC) ret = -ENOMEM; @@ -251,10 +300,8 @@ shmem_truncate(struct drm_i915_gem_object *obj) obj->mm.pages = ERR_PTR(-EFAULT); } -static void -shmem_writeback(struct drm_i915_gem_object *obj) +static void __shmem_writeback(size_t size, struct address_space *mapping) { - struct address_space *mapping; struct writeback_control wbc = { .sync_mode = WB_SYNC_NONE, .nr_to_write = SWAP_CLUSTER_MAX, @@ -270,10 +317,9 @@ shmem_writeback(struct drm_i915_gem_object *obj) * instead of invoking writeback so they are aged and paged out * as normal. */ - mapping = obj->base.filp->f_mapping; /* Begin writeback on each dirty page */ - for (i = 0; i < obj->base.size >> PAGE_SHIFT; i++) { + for (i = 0; i < size >> PAGE_SHIFT; i++) { struct page *page; page = find_lock_page(mapping, i); @@ -296,6 +342,12 @@ shmem_writeback(struct drm_i915_gem_object *obj) } } +static void +shmem_writeback(struct drm_i915_gem_object *obj) +{ + __shmem_writeback(obj->base.size, obj->base.filp->f_mapping); +} + void __i915_gem_object_release_shmem(struct drm_i915_gem_object *obj, struct sg_table *pages, @@ -316,11 +368,6 @@ __i915_gem_object_release_shmem(struct drm_i915_gem_object *obj, void i915_gem_object_put_pages_shmem(struct drm_i915_gem_object *obj, struct sg_table *pages) { - struct sgt_iter sgt_iter; - struct pagevec pvec; - struct page *page; - - GEM_WARN_ON(IS_DGFX(to_i915(obj->base.dev))); __i915_gem_object_release_shmem(obj, pages, true); i915_gem_gtt_finish_pages(obj, pages); @@ -328,25 +375,9 @@ void i915_gem_object_put_pages_shmem(struct drm_i915_gem_object *obj, struct sg_ if (i915_gem_object_needs_bit17_swizzle(obj)) i915_gem_object_save_bit_17_swizzle(obj, pages); - mapping_clear_unevictable(file_inode(obj->base.filp)->i_mapping); - - pagevec_init(&pvec); - for_each_sgt_page(page, sgt_iter, pages) { - if (obj->mm.dirty) - set_page_dirty(page); - - if (obj->mm.madv == I915_MADV_WILLNEED) - mark_page_accessed(page); - - if (!pagevec_add(&pvec, page)) - check_release_pagevec(&pvec); - } - if (pagevec_count(&pvec)) - check_release_pagevec(&pvec); + shmem_free_st(pages, file_inode(obj->base.filp)->i_mapping, + obj->mm.dirty, obj->mm.madv == I915_MADV_WILLNEED); obj->mm.dirty = false; - - sg_free_table(pages); - kfree(pages); } static void -- 2.26.3

1 7

BUG: unable to handle kernel paging request in drm_fb_helper_damage_work
by Hao Sun 06 Oct '21

06 Oct '21

Hello, When using Healer to fuzz the latest Linux kernel, the following crash was triggered. HEAD commit: 42d43c92fc57 Merge branch 'for-linus' git tree: upstream console output: https://drive.google.com/file/d/1TXbZJ5Reefwpvr_wk3N1rGVKIMnF6fbP/view?usp=… kernel config: https://drive.google.com/file/d/15vWoQRbJuuMu4ovWhUm1h4SrHyNwK8im/view?usp=… Sorry, I don't have a reproducer for this crash, hope the symbolized report can help. If you fix this issue, please add the following tag to the commit: Reported-by: Hao Sun <sunhao.th(a)gmail.com> BUG: unable to handle page fault for address: ffffc900085e8070 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 10c00067 P4D 10c00067 PUD 10dbc067 PMD 1c94d067 PTE 0 Oops: 0002 [#1] PREEMPT SMP KASAN CPU: 3 PID: 33 Comm: kworker/3:0 Not tainted 5.15.0-rc3+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Workqueue: events drm_fb_helper_damage_work RIP: 0010:rep_movs arch/x86/lib/iomem.c:12 [inline] RIP: 0010:memcpy_toio+0x83/0xe0 arch/x86/lib/iomem.c:57 Code: 7a fd 49 89 dd 31 ff 41 83 e5 02 4c 89 ee e8 44 73 7a fd 4d 85 ed 75 2e e8 ba 71 7a fd 48 89 e9 48 89 df 4c 89 e6 48 c1 e9 02 <f3> a5 40 f6 c5 02 74 02 66 a5 40 f6 c5 01 74 01 a4 5b 5d 41 5c 41 RSP: 0018:ffffc90000887be0 EFLAGS: 00010212 RAX: 0000000000000000 RBX: ffffc900085e8070 RCX: 000000000000094c RDX: 0000000000000000 RSI: ffffc90006599070 RDI: ffffc900085e8070 RBP: 0000000000002530 R08: ffffffff83fbd9c6 R09: 0000000000000000 R10: 0000000000000007 R11: fffff52000110f56 R12: ffffc90006599070 R13: 0000000000000000 R14: ffff888019db0140 R15: ffffc90006599070 FS: 0000000000000000(0000) GS:ffff888135d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc900085e8070 CR3: 000000001d3fd000 CR4: 0000000000350ee0 Call Trace: dma_buf_map_memcpy_to ./include/linux/dma-buf-map.h:245 [inline] drm_fb_helper_damage_blit_real drivers/gpu/drm/drm_fb_helper.c:388 [inline] drm_fb_helper_damage_blit drivers/gpu/drm/drm_fb_helper.c:419 [inline] drm_fb_helper_damage_work+0x76d/0xb00 drivers/gpu/drm/drm_fb_helper.c:450 process_one_work+0x9df/0x16d0 kernel/workqueue.c:2297 worker_thread+0x90/0xed0 kernel/workqueue.c:2444 kthread+0x3e5/0x4d0 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Modules linked in: Dumping ftrace buffer: (ftrace buffer empty) CR2: ffffc900085e8070 ---[ end trace 000e7483a76d6bd7 ]--- RIP: 0010:rep_movs arch/x86/lib/iomem.c:12 [inline] RIP: 0010:memcpy_toio+0x83/0xe0 arch/x86/lib/iomem.c:57 Code: 7a fd 49 89 dd 31 ff 41 83 e5 02 4c 89 ee e8 44 73 7a fd 4d 85 ed 75 2e e8 ba 71 7a fd 48 89 e9 48 89 df 4c 89 e6 48 c1 e9 02 <f3> a5 40 f6 c5 02 74 02 66 a5 40 f6 c5 01 74 01 a4 5b 5d 41 5c 41 RSP: 0018:ffffc90000887be0 EFLAGS: 00010212 RAX: 0000000000000000 RBX: ffffc900085e8070 RCX: 000000000000094c RDX: 0000000000000000 RSI: ffffc90006599070 RDI: ffffc900085e8070 RBP: 0000000000002530 R08: ffffffff83fbd9c6 R09: 0000000000000000 R10: 0000000000000007 R11: fffff52000110f56 R12: ffffc90006599070 R13: 0000000000000000 R14: ffff888019db0140 R15: ffffc90006599070 FS: 0000000000000000(0000) GS:ffff888135d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc900085e8070 CR3: 000000001d3fd000 CR4: 0000000000350ee0 ---------------- Code disassembly (best guess): 0: 7a fd jp 0xffffffff 2: 49 89 dd mov %rbx,%r13 5: 31 ff xor %edi,%edi 7: 41 83 e5 02 and $0x2,%r13d b: 4c 89 ee mov %r13,%rsi e: e8 44 73 7a fd callq 0xfd7a7357 13: 4d 85 ed test %r13,%r13 16: 75 2e jne 0x46 18: e8 ba 71 7a fd callq 0xfd7a71d7 1d: 48 89 e9 mov %rbp,%rcx 20: 48 89 df mov %rbx,%rdi 23: 4c 89 e6 mov %r12,%rsi 26: 48 c1 e9 02 shr $0x2,%rcx * 2a: f3 a5 rep movsl %ds:(%rsi),%es:(%rdi) <-- trapping instruction 2c: 40 f6 c5 02 test $0x2,%bpl 30: 74 02 je 0x34 32: 66 a5 movsw %ds:(%rsi),%es:(%rdi) 34: 40 f6 c5 01 test $0x1,%bpl 38: 74 01 je 0x3b 3a: a4 movsb %ds:(%rsi),%es:(%rdi) 3b: 5b pop %rbx 3c: 5d pop %rbp 3d: 41 5c pop %r12 3f: 41 rex.B

1 0

Re: [PATCH 1/1] drm/amdgpu: ignore -EPERM error from debugfs
by Christian König 06 Oct '21

06 Oct '21

Am 05.10.21 um 15:49 schrieb Das, Nirmoy: > > On 10/5/2021 3:22 PM, Christian König wrote: >> >> >> Am 05.10.21 um 15:11 schrieb Nirmoy Das: >>> Debugfs core APIs will throw -EPERM when user disables debugfs >>> using CONFIG_DEBUG_FS_ALLOW_NONE or with kernel param. We shouldn't >>> see that as an error. Also validate drm root dentry before creating >>> amdgpu debugfs files. >>> >>> Signed-off-by: Nirmoy Das <nirmoy.das(a)amd.com> >>> --- >>> drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 10 ++++++++++ >>> 1 file changed, 10 insertions(+) >>> >>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c >>> b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c >>> index 6611b3c7c149..d786072e918b 100644 >>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c >>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c >>> @@ -1617,6 +1617,16 @@ int amdgpu_debugfs_init(struct amdgpu_device >>> *adev) >>> struct dentry *ent; >>> int r, i; >>> + if (IS_ERR(root)) { >>> + /* When debugfs is disabled we get -EPERM which is not an >>> + * error as this is user controllable. >>> + */ >> >> Well setting primary->debugfs_root to an error code is probably not a >> good idea to begin with. >> >> When debugfs is disabled that should most likely be NULL. > > > If we set primary->debugfs_root to NULL then we need to add bunch of > NULL checks everywhere before creating any debugfs files > > because debugfs_create_{file|dir}() with NULL root is still valid. I > am assuming a hypothetical case when debugfs_root dir creation fails > even with debugfs enabled > > but further calls are successful. This wont be a problem if we > propagate the error code. Yeah, but an error code in members is ugly like hell and potentially causes crashes instead. I strongly suggest to fix this so that root is NULL when debugfs isn't available and we add proper checks for that instead. Regards, Christian. > > > Regards, > > Nirmoy > >> >> Regards, >> Christian. >> >>> + if (PTR_ERR(root) == -EPERM) >>> + return 0; >>> + >>> + return PTR_ERR(ent); >>> + } >>> + >>> ent = debugfs_create_file("amdgpu_preempt_ib", 0600, root, adev, >>> &fops_ib_preempt); >>> if (IS_ERR(ent)) { >>

3 7

INFO: rcu detected stall in mld_ifc_work
by Hao Sun 06 Oct '21

06 Oct '21

Hello, When using Healer to fuzz the latest Linux kernel, the following crash was triggered. HEAD commit: 0513e464f900 Merge tag 'perf-tools-fixes-for-v5.15-2021-09-27' git tree: upstream console output: https://drive.google.com/file/d/1xw1nX3KSXOI0GzbKjGw5c0C14We3e0R3/view?usp=… kernel config: https://drive.google.com/file/d/1Jqhc4DpCVE8X7d-XBdQnrMoQzifTG5ho/view?usp=… Sorry, I don't have a reproducer for this crash, hope the symbolized report can help. If you fix this issue, please add the following tag to the commit: Reported-by: Hao Sun <sunhao.th(a)gmail.com> rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: 1-....: (1 ticks this GP) idle=e03/1/0x4000000000000000 softirq=19163/19163 fqs=3 (detected by 0, t=10635 jiffies, g=32217, q=314) Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 11958 Comm: kworker/1:5 Not tainted 5.15.0-rc3+ #21 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 Workqueue: mld mld_ifc_work RIP: 0010:console_trylock_spinning kernel/printk/printk.c:1874 [inline] RIP: 0010:vprintk_emit+0x1c3/0x340 kernel/printk/printk.c:2243 Code: 0f 2d 81 31 f6 41 b8 01 00 00 00 48 c7 c7 c0 9d 93 85 e8 30 9e fe ff 0f b6 05 d1 a1 3a 07 5a 84 c0 74 10 e8 5f 81 0a 00 f3 90 <41> 0f b6 04 24 84 c0 75 f0 e8 4f 81 0a 00 48 c7 c6 0c 10 2d 81 48 RSP: 0018:ffffc90000708e18 EFLAGS: 00010046 RAX: 0000000000010001 RBX: 000000000000002a RCX: 0000000000000000 RDX: ffff888104d7a280 RSI: ffffffff812d1001 RDI: ffffffff853ccbb6 RBP: ffffc90000708e50 R08: 0000000000000000 R09: 0000000000000001 R10: ffffc90000708ce0 R11: 0000000000000005 R12: ffffffff8867b1c8 R13: 0000000000000000 R14: 0000000000000000 R15: ffffc90000708e78 FS: 0000000000000000(0000) GS:ffff88813dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f404556e4a0 CR3: 000000010f89d000 CR4: 0000000000750ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <IRQ> vprintk+0x65/0x80 kernel/printk/printk_safe.c:50 _printk+0x5e/0x7d kernel/printk/printk.c:2265 vkms_vblank_simulate+0x187/0x190 drivers/gpu/drm/vkms/vkms_crtc.c:26 __run_hrtimer kernel/time/hrtimer.c:1685 [inline] __hrtimer_run_queues+0xb8/0x610 kernel/time/hrtimer.c:1749 hrtimer_interrupt+0xfe/0x280 kernel/time/hrtimer.c:1811 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline] __sysvec_apic_timer_interrupt+0x9c/0x2c0 arch/x86/kernel/apic/apic.c:1103 sysvec_apic_timer_interrupt+0x99/0xc0 arch/x86/kernel/apic/apic.c:1097 </IRQ> asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:ip6mr_get_table net/ipv6/ip6mr.c:126 [inline] RIP: 0010:ip6mr_rule_action+0x78/0xe0 net/ipv6/ip6mr.c:173 Code: 5e e8 8c ee 7e fd 45 89 66 20 48 8b 6d 40 4d 8b 6e 10 48 8b 9d 88 0b 00 00 48 81 c5 88 0b 00 00 48 39 dd 74 25 e8 68 ee 7e fd <44> 3b 63 28 75 0d eb 38 e8 5b ee 7e fd 44 39 63 28 74 2d e8 50 ee RSP: 0018:ffffc900036efa50 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff888010f38000 RCX: 0000000000000000 RDX: ffff888104d7a280 RSI: ffffffff83b8a2f8 RDI: ffff88800fa94300 RBP: ffff888015ee3e08 R08: 0000000000000000 R09: 0000000000000000 R10: ffffc900036ef948 R11: 0000000000000004 R12: 00000000000000fe R13: ffffc900036efad0 R14: ffffc900036efad8 R15: ffffc900036efad8 fib_rules_lookup+0x2ba/0x460 net/core/fib_rules.c:318 ip6mr_fib_lookup+0x77/0xc0 net/ipv6/ip6mr.c:145 mroute6_is_socket+0x7b/0xc0 net/ipv6/ip6mr.c:1617 ip6_finish_output2+0x60c/0xcc0 net/ipv6/ip6_output.c:83 __ip6_finish_output+0x143/0x520 net/ipv6/ip6_output.c:191 ip6_finish_output+0x30/0x110 net/ipv6/ip6_output.c:201 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip6_output+0xa8/0x3a0 net/ipv6/ip6_output.c:224 dst_output include/net/dst.h:450 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] mld_sendpack+0x231/0x4a0 net/ipv6/mcast.c:1826 mld_send_cr net/ipv6/mcast.c:2127 [inline] mld_ifc_work+0x2f9/0x5d0 net/ipv6/mcast.c:2659 process_one_work+0x359/0x850 kernel/workqueue.c:2297 worker_thread+0x41/0x4d0 kernel/workqueue.c:2444 kthread+0x178/0x1b0 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 vkms_vblank_simulate: vblank timer overrun vkms_vblank_simulate: vblank timer overrun vkms_vblank_simulate: vblank timer overrun vkms_vblank_simulate: vblank timer overrun vkms_vblank_simulate: vblank timer overrun vkms_vblank_simulate: vblank timer overrun vkms_vblank_simulate: vblank timer overrun vkms_vblank_simulate: vblank timer overrun vkms_vblank_simulate: vblank timer overrun vkms_vblank_simulate: vblank timer overrun vkms_vblank_simulate: vblank timer overrun vkms_vblank_simulate: vblank timer overrun vkms_vblank_simulate: vblank timer overrun vkms_vblank_simulate: vblank timer overrun vkms_vblank_simulate: vblank timer overrun vkms_vblank_simulate: vblank timer overrun vkms_vblank_simulate: vblank timer overrun vkms_vblank_simulate: vblank timer overrun vkms_vblank_simulate: vblank timer overrun NMI backtrace for cpu 3 skipped: idling at native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline] NMI backtrace for cpu 3 skipped: idling at arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline] NMI backtrace for cpu 3 skipped: idling at default_idle+0xb/0x10 arch/x86/kernel/process.c:716 NMI backtrace for cpu 0 CPU: 0 PID: 1284 Comm: kworker/u9:4 Not tainted 5.15.0-rc3+ #21 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 Workqueue: events_unbound toggle_allocation_gate RIP: 0010:preempt_count arch/x86/include/asm/preempt.h:27 [inline] RIP: 0010:check_kcov_mode kernel/kcov.c:163 [inline] RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x60 kernel/kcov.c:197 Code: 7e 31 c0 81 e2 00 01 ff 00 75 10 65 48 8b 04 25 40 70 01 00 48 8b 80 28 15 00 00 c3 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 <65> 8b 05 99 de c9 7e 89 c1 48 8b 34 24 65 48 8b 14 25 40 70 01 00 RSP: 0018:ffffc90005c67c78 EFLAGS: 00000202 RAX: 0000000000000011 RBX: ffff88813dc2f9c0 RCX: 0000000000000000 RDX: ffff88800d8bc500 RSI: ffffffff8132ec00 RDI: 00000000ffffffff RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000001 R10: ffffc90005c67c28 R11: 0000000000000005 R12: ffff88807dc2a900 R13: ffff88807dc2a908 R14: ffffffff85a27660 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fbc80015228 CR3: 000000000588a000 CR4: 0000000000750ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: rep_nop arch/x86/include/asm/vdso/processor.h:13 [inline] cpu_relax arch/x86/include/asm/vdso/processor.h:18 [inline] csd_lock_wait kernel/smp.c:440 [inline] smp_call_function_many_cond+0x1d0/0x550 kernel/smp.c:969 on_each_cpu_cond_mask+0x48/0x90 kernel/smp.c:1135 on_each_cpu include/linux/smp.h:71 [inline] text_poke_sync arch/x86/kernel/alternative.c:929 [inline] text_poke_bp_batch+0x255/0x2c0 arch/x86/kernel/alternative.c:1183 text_poke_flush arch/x86/kernel/alternative.c:1268 [inline] text_poke_finish+0x16/0x30 arch/x86/kernel/alternative.c:1275 arch_jump_label_transform_apply+0x13/0x20 arch/x86/kernel/jump_label.c:146 jump_label_update+0xbc/0x190 kernel/jump_label.c:830 static_key_enable_cpuslocked+0x77/0xb0 kernel/jump_label.c:177 static_key_enable+0x16/0x20 kernel/jump_label.c:190 toggle_allocation_gate+0x71/0x240 mm/kfence/core.c:626 process_one_work+0x359/0x850 kernel/workqueue.c:2297 worker_thread+0x41/0x4d0 kernel/workqueue.c:2444 kthread+0x178/0x1b0 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 NMI backtrace for cpu 1 CPU: 1 PID: 7811 Comm: kworker/u8:4 Not tainted 5.15.0-rc3+ #21 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 Workqueue: netns cleanup_net RIP: 0010:neigh_flush_dev+0xd1/0x360 net/core/neighbour.c:307 Code: 00 85 c0 0f 84 55 01 00 00 e8 db c7 c9 fd 48 8b 5d 00 48 85 db 0f 84 9d 01 00 00 e8 c9 c7 c9 fd 4d 85 f6 74 18 e8 bf c7 c9 fd <4c> 39 b3 f8 02 00 00 74 0a e8 b1 c7 c9 fd 48 89 dd eb b2 e8 a7 c7 RSP: 0018:ffffc90001e07b68 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff8881000bec00 RCX: 0000000000000000 RDX: ffff88810bd4c500 RSI: ffffffff836dc9a1 RDI: ffffffff853ccbb6 RBP: ffff88811289c2b0 R08: 0000000000000001 R09: 0000000000000001 R10: ffffc90001e07aa8 R11: 0000000000000005 R12: ffff88800e677000 R13: ffffffff85edcbf0 R14: ffff88800e677000 R15: ffffffff85edc960 FS: 0000000000000000(0000) GS:ffff88813dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fcb831b5000 CR3: 000000010738c000 CR4: 0000000000750ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: __neigh_ifdown+0x42/0x180 net/core/neighbour.c:358 neigh_ifdown+0x1a/0x20 net/core/neighbour.c:375 ndisc_netdev_event+0x211/0x380 net/ipv6/ndisc.c:1820 notifier_call_chain+0x3b/0xc0 kernel/notifier.c:83 call_netdevice_notifiers_info+0x58/0xa0 net/core/dev.c:1996 call_netdevice_notifiers_extack net/core/dev.c:2008 [inline] call_netdevice_notifiers net/core/dev.c:2022 [inline] dev_close_many+0x116/0x180 net/core/dev.c:1597 unregister_netdevice_many+0x1c8/0x8f0 net/core/dev.c:11020 default_device_exit_batch+0x196/0x1c0 net/core/dev.c:11573 ops_exit_list.isra.8+0x73/0x80 net/core/net_namespace.c:171 cleanup_net+0x2e6/0x4e0 net/core/net_namespace.c:591 process_one_work+0x359/0x850 kernel/workqueue.c:2297 worker_thread+0x41/0x4d0 kernel/workqueue.c:2444 kthread+0x178/0x1b0 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 vkms_vblank_simulate: vblank timer overrun vkms_vblank_simulate: vblank timer overrun ---------------- Code disassembly (best guess): 0: 0f 2d 81 31 f6 41 b8 cvtps2pi -0x47be09cf(%rcx),%mm0 7: 01 00 add %eax,(%rax) 9: 00 00 add %al,(%rax) b: 48 c7 c7 c0 9d 93 85 mov $0xffffffff85939dc0,%rdi 12: e8 30 9e fe ff callq 0xfffe9e47 17: 0f b6 05 d1 a1 3a 07 movzbl 0x73aa1d1(%rip),%eax # 0x73aa1ef 1e: 5a pop %rdx 1f: 84 c0 test %al,%al 21: 74 10 je 0x33 23: e8 5f 81 0a 00 callq 0xa8187 28: f3 90 pause * 2a: 41 0f b6 04 24 movzbl (%r12),%eax <-- trapping instruction 2f: 84 c0 test %al,%al 31: 75 f0 jne 0x23 33: e8 4f 81 0a 00 callq 0xa8187 38: 48 c7 c6 0c 10 2d 81 mov $0xffffffff812d100c,%rsi 3f: 48 rex.W

1 0

← Newer
1
...
68
69
70
71
72
73
74
...
83
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

dri-devel October 2021