[PATCH OLK-5.10 0/3] drm/stm: Avoid use-after-free issues with crtc and plane
*** BLURB HERE *** Katya Orlova (1): drm/stm: Avoid use-after-free issues with crtc and plane Raphael Gallais-Pou (1): drm/stm: ltdc: add support for CRC hashing feature Yannick Fertre (1): drm/stm: ltdc: support of new hardware version drivers/gpu/drm/stm/drv.c | 3 +- drivers/gpu/drm/stm/ltdc.c | 339 ++++++++++++++++++++++++++++--------- drivers/gpu/drm/stm/ltdc.h | 6 +- 3 files changed, 264 insertions(+), 84 deletions(-) -- 2.34.1
From: Yannick Fertre <yannick.fertre@foss.st.com> stable inclusion from stable-v5.18 commit 1726cee3d0537baa58dc58cf0a1630aa7ce93af7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRAF Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... 3af7 -------------------------------- Add support of new hardware version 0x40100. Signed-off-by: Yannick Fertre <yannick.fertre@foss.st.com> Reviewed-by: Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com> Tested-by: Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com> Acked-by: Philippe Cornu <philippe.cornu@foss.st.com> Signed-off-by: Philippe Cornu <philippe.cornu@foss.st.com> Link: https://patchwork.freedesktop.org/patch/msgid/20211203085618.11314-1-yannick... Signed-off-by: Zhang Kunbo <zhangkunbo@huawei.com> --- drivers/gpu/drm/stm/ltdc.c | 172 ++++++++++++++++++++++++++++++------- drivers/gpu/drm/stm/ltdc.h | 3 +- 2 files changed, 145 insertions(+), 30 deletions(-) diff --git a/drivers/gpu/drm/stm/ltdc.c b/drivers/gpu/drm/stm/ltdc.c index 089c00a8e7d4..cf27622e75ec 100644 --- a/drivers/gpu/drm/stm/ltdc.c +++ b/drivers/gpu/drm/stm/ltdc.c @@ -45,15 +45,15 @@ #define HWVER_10200 0x010200 #define HWVER_10300 0x010300 #define HWVER_20101 0x020101 +#define HWVER_40100 0x040100 /* * The address of some registers depends on the HW version: such registers have - * an extra offset specified with reg_ofs. + * an extra offset specified with layer_ofs. */ -#define REG_OFS_NONE 0 -#define REG_OFS_4 4 /* Insertion of "Layer Conf. 2" reg */ -#define REG_OFS (ldev->caps.reg_ofs) -#define LAY_OFS 0x80 /* Register Offset between 2 layers */ +#define LAY_OFS_0 0x80 +#define LAY_OFS_1 0x100 +#define LAY_OFS (ldev->caps.layer_ofs) /* Global register offsets */ #define LTDC_IDR 0x0000 /* IDentification */ @@ -74,29 +74,34 @@ #define LTDC_LIPCR 0x0040 /* Line Interrupt Position Conf. */ #define LTDC_CPSR 0x0044 /* Current Position Status */ #define LTDC_CDSR 0x0048 /* Current Display Status */ +#define LTDC_FUT 0x0090 /* Fifo underrun Threshold */ /* Layer register offsets */ -#define LTDC_L1LC1R (0x80) /* L1 Layer Configuration 1 */ -#define LTDC_L1LC2R (0x84) /* L1 Layer Configuration 2 */ -#define LTDC_L1CR (0x84 + REG_OFS)/* L1 Control */ -#define LTDC_L1WHPCR (0x88 + REG_OFS)/* L1 Window Hor Position Config */ -#define LTDC_L1WVPCR (0x8C + REG_OFS)/* L1 Window Vert Position Config */ -#define LTDC_L1CKCR (0x90 + REG_OFS)/* L1 Color Keying Configuration */ -#define LTDC_L1PFCR (0x94 + REG_OFS)/* L1 Pixel Format Configuration */ -#define LTDC_L1CACR (0x98 + REG_OFS)/* L1 Constant Alpha Config */ -#define LTDC_L1DCCR (0x9C + REG_OFS)/* L1 Default Color Configuration */ -#define LTDC_L1BFCR (0xA0 + REG_OFS)/* L1 Blend Factors Configuration */ -#define LTDC_L1FBBCR (0xA4 + REG_OFS)/* L1 FrameBuffer Bus Control */ -#define LTDC_L1AFBCR (0xA8 + REG_OFS)/* L1 AuxFB Control */ -#define LTDC_L1CFBAR (0xAC + REG_OFS)/* L1 Color FrameBuffer Address */ -#define LTDC_L1CFBLR (0xB0 + REG_OFS)/* L1 Color FrameBuffer Length */ -#define LTDC_L1CFBLNR (0xB4 + REG_OFS)/* L1 Color FrameBuffer Line Nb */ -#define LTDC_L1AFBAR (0xB8 + REG_OFS)/* L1 AuxFB Address */ -#define LTDC_L1AFBLR (0xBC + REG_OFS)/* L1 AuxFB Length */ -#define LTDC_L1AFBLNR (0xC0 + REG_OFS)/* L1 AuxFB Line Number */ -#define LTDC_L1CLUTWR (0xC4 + REG_OFS)/* L1 CLUT Write */ -#define LTDC_L1YS1R (0xE0 + REG_OFS)/* L1 YCbCr Scale 1 */ -#define LTDC_L1YS2R (0xE4 + REG_OFS)/* L1 YCbCr Scale 2 */ +#define LTDC_L1C0R (ldev->caps.layer_regs[0]) /* L1 configuration 0 */ +#define LTDC_L1C1R (ldev->caps.layer_regs[1]) /* L1 configuration 1 */ +#define LTDC_L1RCR (ldev->caps.layer_regs[2]) /* L1 reload control */ +#define LTDC_L1CR (ldev->caps.layer_regs[3]) /* L1 control register */ +#define LTDC_L1WHPCR (ldev->caps.layer_regs[4]) /* L1 window horizontal position configuration */ +#define LTDC_L1WVPCR (ldev->caps.layer_regs[5]) /* L1 window vertical position configuration */ +#define LTDC_L1CKCR (ldev->caps.layer_regs[6]) /* L1 color keying configuration */ +#define LTDC_L1PFCR (ldev->caps.layer_regs[7]) /* L1 pixel format configuration */ +#define LTDC_L1CACR (ldev->caps.layer_regs[8]) /* L1 constant alpha configuration */ +#define LTDC_L1DCCR (ldev->caps.layer_regs[9]) /* L1 default color configuration */ +#define LTDC_L1BFCR (ldev->caps.layer_regs[10]) /* L1 blending factors configuration */ +#define LTDC_L1BLCR (ldev->caps.layer_regs[11]) /* L1 burst length configuration */ +#define LTDC_L1PCR (ldev->caps.layer_regs[12]) /* L1 planar configuration */ +#define LTDC_L1CFBAR (ldev->caps.layer_regs[13]) /* L1 color frame buffer address */ +#define LTDC_L1CFBLR (ldev->caps.layer_regs[14]) /* L1 color frame buffer length */ +#define LTDC_L1CFBLNR (ldev->caps.layer_regs[15]) /* L1 color frame buffer line number */ +#define LTDC_L1AFBA0R (ldev->caps.layer_regs[16]) /* L1 auxiliary frame buffer address 0 */ +#define LTDC_L1AFBA1R (ldev->caps.layer_regs[17]) /* L1 auxiliary frame buffer address 1 */ +#define LTDC_L1AFBLR (ldev->caps.layer_regs[18]) /* L1 auxiliary frame buffer length */ +#define LTDC_L1AFBLNR (ldev->caps.layer_regs[19]) /* L1 auxiliary frame buffer line number */ +#define LTDC_L1CLUTWR (ldev->caps.layer_regs[20]) /* L1 CLUT write */ +#define LTDC_L1CYR0R (ldev->caps.layer_regs[21]) /* L1 Conversion YCbCr RGB 0 */ +#define LTDC_L1CYR1R (ldev->caps.layer_regs[22]) /* L1 Conversion YCbCr RGB 1 */ +#define LTDC_L1FPF0R (ldev->caps.layer_regs[23]) /* L1 Flexible Pixel Format 0 */ +#define LTDC_L1FPF1R (ldev->caps.layer_regs[24]) /* L1 Flexible Pixel Format 1 */ /* Bit definitions */ #define SSCR_VSH GENMASK(10, 0) /* Vertical Synchronization Height */ @@ -207,7 +212,10 @@ enum ltdc_pix_fmt { /* Indexed formats */ PF_L8, /* Indexed 8 bits [8 bits] */ PF_AL44, /* Alpha:4 bits + indexed 4 bits [8 bits] */ - PF_AL88 /* Alpha:8 bits + indexed 8 bits [16 bits] */ + PF_AL88, /* Alpha:8 bits + indexed 8 bits [16 bits] */ + PF_ABGR8888, /* ABGR [32 bits] */ + PF_BGRA8888, /* BGRA [32 bits] */ + PF_BGR565 /* RGB [16 bits] */ }; /* The index gives the encoding of the pixel format for an HW version */ @@ -233,6 +241,102 @@ static const enum ltdc_pix_fmt ltdc_pix_fmt_a1[NB_PF] = { PF_ARGB4444 /* 0x07 */ }; +static const enum ltdc_pix_fmt ltdc_pix_fmt_a2[NB_PF] = { + PF_ARGB8888, /* 0x00 */ + PF_ABGR8888, /* 0x01 */ + PF_RGBA8888, /* 0x02 */ + PF_BGRA8888, /* 0x03 */ + PF_RGB565, /* 0x04 */ + PF_BGR565, /* 0x05 */ + PF_RGB888, /* 0x06 */ + PF_ARGB1555 /* 0x07 */ +}; + +/* Layer register offsets */ +static const u32 ltdc_layer_regs_a0[] = { + 0x80, /* L1 configuration 0 */ + 0x00, /* not available */ + 0x00, /* not available */ + 0x84, /* L1 control register */ + 0x88, /* L1 window horizontal position configuration */ + 0x8c, /* L1 window vertical position configuration */ + 0x90, /* L1 color keying configuration */ + 0x94, /* L1 pixel format configuration */ + 0x98, /* L1 constant alpha configuration */ + 0x9c, /* L1 default color configuration */ + 0xa0, /* L1 blending factors configuration */ + 0x00, /* not available */ + 0x00, /* not available */ + 0xac, /* L1 color frame buffer address */ + 0xb0, /* L1 color frame buffer length */ + 0xb4, /* L1 color frame buffer line number */ + 0x00, /* not available */ + 0x00, /* not available */ + 0x00, /* not available */ + 0x00, /* not available */ + 0xc4, /* L1 CLUT write */ + 0x00, /* not available */ + 0x00, /* not available */ + 0x00, /* not available */ + 0x00 /* not available */ +}; + +static const u32 ltdc_layer_regs_a1[] = { + 0x80, /* L1 configuration 0 */ + 0x84, /* L1 configuration 1 */ + 0x00, /* L1 reload control */ + 0x88, /* L1 control register */ + 0x8c, /* L1 window horizontal position configuration */ + 0x90, /* L1 window vertical position configuration */ + 0x94, /* L1 color keying configuration */ + 0x98, /* L1 pixel format configuration */ + 0x9c, /* L1 constant alpha configuration */ + 0xa0, /* L1 default color configuration */ + 0xa4, /* L1 blending factors configuration */ + 0xa8, /* L1 burst length configuration */ + 0x00, /* not available */ + 0xac, /* L1 color frame buffer address */ + 0xb0, /* L1 color frame buffer length */ + 0xb4, /* L1 color frame buffer line number */ + 0xb8, /* L1 auxiliary frame buffer address 0 */ + 0xbc, /* L1 auxiliary frame buffer address 1 */ + 0xc0, /* L1 auxiliary frame buffer length */ + 0xc4, /* L1 auxiliary frame buffer line number */ + 0xc8, /* L1 CLUT write */ + 0x00, /* not available */ + 0x00, /* not available */ + 0x00, /* not available */ + 0x00 /* not available */ +}; + +static const u32 ltdc_layer_regs_a2[] = { + 0x100, /* L1 configuration 0 */ + 0x104, /* L1 configuration 1 */ + 0x108, /* L1 reload control */ + 0x10c, /* L1 control register */ + 0x110, /* L1 window horizontal position configuration */ + 0x114, /* L1 window vertical position configuration */ + 0x118, /* L1 color keying configuration */ + 0x11c, /* L1 pixel format configuration */ + 0x120, /* L1 constant alpha configuration */ + 0x124, /* L1 default color configuration */ + 0x128, /* L1 blending factors configuration */ + 0x12c, /* L1 burst length configuration */ + 0x130, /* L1 planar configuration */ + 0x134, /* L1 color frame buffer address */ + 0x138, /* L1 color frame buffer length */ + 0x13c, /* L1 color frame buffer line number */ + 0x140, /* L1 auxiliary frame buffer address 0 */ + 0x144, /* L1 auxiliary frame buffer address 1 */ + 0x148, /* L1 auxiliary frame buffer length */ + 0x14c, /* L1 auxiliary frame buffer line number */ + 0x150, /* L1 CLUT write */ + 0x16c, /* L1 Conversion YCbCr RGB 0 */ + 0x170, /* L1 Conversion YCbCr RGB 1 */ + 0x174, /* L1 Flexible Pixel Format 0 */ + 0x178 /* L1 Flexible Pixel Format 1 */ +}; + static const u64 ltdc_format_modifiers[] = { DRM_FORMAT_MOD_LINEAR, DRM_FORMAT_MOD_INVALID @@ -1160,7 +1264,8 @@ static int ltdc_get_caps(struct drm_device *ddev) switch (ldev->caps.hw_version) { case HWVER_10200: case HWVER_10300: - ldev->caps.reg_ofs = REG_OFS_NONE; + ldev->caps.layer_ofs = LAY_OFS_0; + ldev->caps.layer_regs = ltdc_layer_regs_a0; ldev->caps.pix_fmt_hw = ltdc_pix_fmt_a0; /* * Hw older versions support non-alpha color formats derived @@ -1176,12 +1281,21 @@ static int ltdc_get_caps(struct drm_device *ddev) ldev->caps.nb_irq = 2; break; case HWVER_20101: - ldev->caps.reg_ofs = REG_OFS_4; + ldev->caps.layer_ofs = LAY_OFS_0; + ldev->caps.layer_regs = ltdc_layer_regs_a1; ldev->caps.pix_fmt_hw = ltdc_pix_fmt_a1; ldev->caps.non_alpha_only_l1 = false; ldev->caps.pad_max_freq_hz = 150000000; ldev->caps.nb_irq = 4; break; + case HWVER_40100: + ldev->caps.layer_ofs = LAY_OFS_1; + ldev->caps.layer_regs = ltdc_layer_regs_a2; + ldev->caps.pix_fmt_hw = ltdc_pix_fmt_a2; + ldev->caps.non_alpha_only_l1 = false; + ldev->caps.pad_max_freq_hz = 90000000; + ldev->caps.nb_irq = 2; + break; default: return -ENODEV; } diff --git a/drivers/gpu/drm/stm/ltdc.h b/drivers/gpu/drm/stm/ltdc.h index f153b908c70e..55a125f89af6 100644 --- a/drivers/gpu/drm/stm/ltdc.h +++ b/drivers/gpu/drm/stm/ltdc.h @@ -14,7 +14,8 @@ struct ltdc_caps { u32 hw_version; /* hardware version */ u32 nb_layers; /* number of supported layers */ - u32 reg_ofs; /* register offset for applicable regs */ + u32 layer_ofs; /* layer offset for applicable regs */ + const u32 *layer_regs; /* layer register offset */ u32 bus_width; /* bus width (32 or 64 bits) */ const u32 *pix_fmt_hw; /* supported pixel formats */ bool non_alpha_only_l1; /* non-native no-alpha formats on layer 1 */ -- 2.34.1
From: Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com> stable inclusion from stable-v5.18 commit 79b44684a14e363d24c299b772f037344ad8c8dc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRAF Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- This patch adds the CRC hashing feature supported by some recent hardware versions of the LTDC. This is useful for test suite such as IGT-GPU-tools [1] where a CRTC output frame can be compared to a test reference frame thanks to their respective CRC hash. [1] https://cgit.freedesktop.org/drm/igt-gpu-tools Signed-off-by: Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com> Acked-by: Yannick Fertre <yannick.fertre@foss.st.com> Signed-off-by: Philippe Cornu <philippe.cornu@foss.st.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220211104620.421177-1-raphae... Conflicts: drivers/gpu/drm/stm/ltdc.c drivers/gpu/drm/stm/ltdc.h [ context conflicts ] Signed-off-by: Zhang Kunbo <zhangkunbo@huawei.com> --- drivers/gpu/drm/stm/ltdc.c | 104 +++++++++++++++++++++++++++++++++++-- drivers/gpu/drm/stm/ltdc.h | 3 ++ 2 files changed, 104 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/stm/ltdc.c b/drivers/gpu/drm/stm/ltdc.c index cf27622e75ec..8bc86368069b 100644 --- a/drivers/gpu/drm/stm/ltdc.c +++ b/drivers/gpu/drm/stm/ltdc.c @@ -74,6 +74,7 @@ #define LTDC_LIPCR 0x0040 /* Line Interrupt Position Conf. */ #define LTDC_CPSR 0x0044 /* Current Position Status */ #define LTDC_CDSR 0x0048 /* Current Display Status */ +#define LTDC_CCRCR 0x007C /* Computed CRC value */ #define LTDC_FUT 0x0090 /* Fifo underrun Threshold */ /* Layer register offsets */ @@ -118,6 +119,7 @@ #define GCR_LTDCEN BIT(0) /* LTDC ENable */ #define GCR_DEN BIT(16) /* Dither ENable */ +#define GCR_CRCEN BIT(19) /* CRC ENable */ #define GCR_PCPOL BIT(28) /* Pixel Clock POLarity-Inverted */ #define GCR_DEPOL BIT(29) /* Data Enable POLarity-High */ #define GCR_VSPOL BIT(30) /* Vertical Synchro POLarity-High */ @@ -200,6 +202,13 @@ #define NB_PF 8 /* Max nb of HW pixel format */ +/* + * Skip the first value and the second in case CRC was enabled during + * the thread irq. This is to be sure CRC value is relevant for the + * frame. + */ +#define CRC_SKIP_FRAMES 2 + enum ltdc_pix_fmt { PF_NONE, /* RGB formats */ @@ -467,6 +476,26 @@ static inline u32 get_pixelformat_without_alpha(u32 drm) } } +static inline void ltdc_irq_crc_handle(struct ltdc_device *ldev, + struct drm_crtc *crtc) +{ + u32 crc; + int ret; + + if (ldev->crc_skip_count < CRC_SKIP_FRAMES) { + ldev->crc_skip_count++; + return; + } + + /* Get the CRC of the frame */ + ret = regmap_read(ldev->regmap, LTDC_CCRCR, &crc); + if (ret) + return; + + /* Report to DRM the CRC (hw dependent feature) */ + drm_crtc_add_crc_entry(crtc, true, drm_crtc_accurate_vblank_count(crtc), &crc); +} + static irqreturn_t ltdc_irq_thread(int irq, void *arg) { struct drm_device *ddev = arg; @@ -474,9 +503,14 @@ static irqreturn_t ltdc_irq_thread(int irq, void *arg) struct drm_crtc *crtc = drm_crtc_from_index(ddev, 0); /* Line IRQ : trigger the vblank event */ - if (ldev->irq_status & ISR_LIF) + if (ldev->irq_status & ISR_LIF) { drm_crtc_handle_vblank(crtc); + /* Early return if CRC is not active */ + if (ldev->crc_active) + ltdc_irq_crc_handle(ldev, crtc); + } + /* Save FIFO Underrun & Transfer Error status */ mutex_lock(&ldev->err_lock); if (ldev->irq_status & ISR_FUIF) @@ -840,6 +874,48 @@ static void ltdc_crtc_disable_vblank(struct drm_crtc *crtc) reg_clear(ldev->regs, LTDC_IER, IER_LIE); } +static int ltdc_crtc_set_crc_source(struct drm_crtc *crtc, const char *source) +{ + struct ltdc_device *ldev = crtc_to_ltdc(crtc); + int ret; + + DRM_DEBUG_DRIVER("\n"); + + if (!crtc) + return -ENODEV; + + if (source && strcmp(source, "auto") == 0) { + ldev->crc_active = true; + ret = regmap_set_bits(ldev->regmap, LTDC_GCR, GCR_CRCEN); + } else if (!source) { + ldev->crc_active = false; + ret = regmap_clear_bits(ldev->regmap, LTDC_GCR, GCR_CRCEN); + } else { + ret = -EINVAL; + } + + ldev->crc_skip_count = 0; + return ret; +} + +static int ltdc_crtc_verify_crc_source(struct drm_crtc *crtc, + const char *source, size_t *values_cnt) +{ + DRM_DEBUG_DRIVER("\n"); + + if (!crtc) + return -ENODEV; + + if (source && strcmp(source, "auto") != 0) { + DRM_DEBUG_DRIVER("Unknown CRC source %s for %s\n", + source, crtc->name); + return -EINVAL; + } + + *values_cnt = 1; + return 0; +} + static const struct drm_crtc_funcs ltdc_crtc_funcs = { .destroy = drm_crtc_cleanup, .set_config = drm_atomic_helper_set_config, @@ -853,6 +929,20 @@ static const struct drm_crtc_funcs ltdc_crtc_funcs = { .gamma_set = drm_atomic_helper_legacy_gamma_set, }; +static const struct drm_crtc_funcs ltdc_crtc_with_crc_support_funcs = { + .destroy = drm_crtc_cleanup, + .set_config = drm_atomic_helper_set_config, + .page_flip = drm_atomic_helper_page_flip, + .reset = drm_atomic_helper_crtc_reset, + .atomic_duplicate_state = drm_atomic_helper_crtc_duplicate_state, + .atomic_destroy_state = drm_atomic_helper_crtc_destroy_state, + .enable_vblank = ltdc_crtc_enable_vblank, + .disable_vblank = ltdc_crtc_disable_vblank, + .get_vblank_timestamp = drm_crtc_vblank_helper_get_vblank_timestamp, + .set_crc_source = ltdc_crtc_set_crc_source, + .verify_crc_source = ltdc_crtc_verify_crc_source, +}; + /* * DRM_PLANE */ @@ -1127,8 +1217,13 @@ static int ltdc_crtc_init(struct drm_device *ddev, struct drm_crtc *crtc) return -EINVAL; } - ret = drm_crtc_init_with_planes(ddev, crtc, primary, NULL, - <dc_crtc_funcs, NULL); + /* Init CRTC according to its hardware features */ + if (ldev->caps.crc) + ret = drm_crtc_init_with_planes(ddev, crtc, primary, NULL, + <dc_crtc_with_crc_support_funcs, NULL); + else + ret = drm_crtc_init_with_planes(ddev, crtc, primary, NULL, + <dc_crtc_funcs, NULL); if (ret) { DRM_ERROR("Can not initialize CRTC\n"); goto cleanup; @@ -1279,6 +1374,7 @@ static int ltdc_get_caps(struct drm_device *ddev) if (ldev->caps.hw_version == HWVER_10200) ldev->caps.pad_max_freq_hz = 65000000; ldev->caps.nb_irq = 2; + ldev->caps.crc = false; break; case HWVER_20101: ldev->caps.layer_ofs = LAY_OFS_0; @@ -1287,6 +1383,7 @@ static int ltdc_get_caps(struct drm_device *ddev) ldev->caps.non_alpha_only_l1 = false; ldev->caps.pad_max_freq_hz = 150000000; ldev->caps.nb_irq = 4; + ldev->caps.crc = false; break; case HWVER_40100: ldev->caps.layer_ofs = LAY_OFS_1; @@ -1295,6 +1392,7 @@ static int ltdc_get_caps(struct drm_device *ddev) ldev->caps.non_alpha_only_l1 = false; ldev->caps.pad_max_freq_hz = 90000000; ldev->caps.nb_irq = 2; + ldev->caps.crc = true; break; default: return -ENODEV; diff --git a/drivers/gpu/drm/stm/ltdc.h b/drivers/gpu/drm/stm/ltdc.h index 55a125f89af6..87a46253e444 100644 --- a/drivers/gpu/drm/stm/ltdc.h +++ b/drivers/gpu/drm/stm/ltdc.h @@ -21,6 +21,7 @@ struct ltdc_caps { bool non_alpha_only_l1; /* non-native no-alpha formats on layer 1 */ int pad_max_freq_hz; /* max frequency supported by pad */ int nb_irq; /* number of hardware interrupts */ + bool crc; /* cyclic redundancy check supported */ }; #define LTDC_MAX_LAYER 4 @@ -39,6 +40,8 @@ struct ltdc_device { u32 irq_status; struct fps_info plane_fpsi[LTDC_MAX_LAYER]; struct drm_atomic_state *suspend_state; + int crc_skip_count; + bool crc_active; }; int ltdc_load(struct drm_device *ddev); -- 2.34.1
From: Katya Orlova <e.orlova@ispras.ru> stable inclusion from stable-v6.6.55 commit 0a1741d10da29aa84955ef89ae9a03c4b6038657 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRAF CVE: CVE-2024-49992 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... 8657 -------------------------------- [ Upstream commit 19dd9780b7ac673be95bf6fd6892a184c9db611f ] ltdc_load() calls functions drm_crtc_init_with_planes(), drm_universal_plane_init() and drm_encoder_init(). These functions should not be called with parameters allocated with devm_kzalloc() to avoid use-after-free issues [1]. Use allocations managed by the DRM framework. Found by Linux Verification Center (linuxtesting.org). [1] https://lore.kernel.org/lkml/u366i76e3qhh3ra5oxrtngjtm2u5lterkekcz6y2jkndhux... Signed-off-by: Katya Orlova <e.orlova@ispras.ru> Acked-by: Raphaël Gallais-Pou <raphael.gallais-pou@foss.st.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240216125040.8968-1-e.orlova... Signed-off-by: Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Conflicts: drivers/gpu/drm/stm/drv.c drivers/gpu/drm/stm/ltdc.c [ context conflicts. ] Signed-off-by: Zhang Kunbo <zhangkunbo@huawei.com> --- drivers/gpu/drm/stm/drv.c | 3 +- drivers/gpu/drm/stm/ltdc.c | 73 ++++++++++---------------------------- 2 files changed, 20 insertions(+), 56 deletions(-) diff --git a/drivers/gpu/drm/stm/drv.c b/drivers/gpu/drm/stm/drv.c index 411103f013e2..76dbc5eeb7f7 100644 --- a/drivers/gpu/drm/stm/drv.c +++ b/drivers/gpu/drm/stm/drv.c @@ -23,6 +23,7 @@ #include <drm/drm_gem_framebuffer_helper.h> #include <drm/drm_probe_helper.h> #include <drm/drm_vblank.h> +#include <drm/drm_managed.h> #include "ltdc.h" @@ -73,7 +74,7 @@ static int drv_load(struct drm_device *ddev) DRM_DEBUG("%s\n", __func__); - ldev = devm_kzalloc(ddev->dev, sizeof(*ldev), GFP_KERNEL); + ldev = drmm_kzalloc(ddev, sizeof(*ldev), GFP_KERNEL); if (!ldev) return -ENOMEM; diff --git a/drivers/gpu/drm/stm/ltdc.c b/drivers/gpu/drm/stm/ltdc.c index 8bc86368069b..4ec540951af8 100644 --- a/drivers/gpu/drm/stm/ltdc.c +++ b/drivers/gpu/drm/stm/ltdc.c @@ -32,6 +32,7 @@ #include <drm/drm_plane_helper.h> #include <drm/drm_probe_helper.h> #include <drm/drm_vblank.h> +#include <drm/drm_managed.h> #include <video/videomode.h> @@ -917,7 +918,6 @@ static int ltdc_crtc_verify_crc_source(struct drm_crtc *crtc, } static const struct drm_crtc_funcs ltdc_crtc_funcs = { - .destroy = drm_crtc_cleanup, .set_config = drm_atomic_helper_set_config, .page_flip = drm_atomic_helper_page_flip, .reset = drm_atomic_helper_crtc_reset, @@ -930,7 +930,6 @@ static const struct drm_crtc_funcs ltdc_crtc_funcs = { }; static const struct drm_crtc_funcs ltdc_crtc_with_crc_support_funcs = { - .destroy = drm_crtc_cleanup, .set_config = drm_atomic_helper_set_config, .page_flip = drm_atomic_helper_page_flip, .reset = drm_atomic_helper_crtc_reset, @@ -1130,7 +1129,6 @@ static bool ltdc_plane_format_mod_supported(struct drm_plane *plane, static const struct drm_plane_funcs ltdc_plane_funcs = { .update_plane = drm_atomic_helper_update_plane, .disable_plane = drm_atomic_helper_disable_plane, - .destroy = drm_plane_cleanup, .reset = drm_atomic_helper_plane_reset, .atomic_duplicate_state = drm_atomic_helper_plane_duplicate_state, .atomic_destroy_state = drm_atomic_helper_plane_destroy_state, @@ -1156,7 +1154,6 @@ static struct drm_plane *ltdc_plane_create(struct drm_device *ddev, u32 formats[NB_PF * 2]; u32 drm_fmt, drm_fmt_no_alpha; const u64 *modifiers = ltdc_format_modifiers; - int ret; /* Get supported pixel formats */ for (i = 0; i < NB_PF; i++) { @@ -1178,14 +1175,10 @@ static struct drm_plane *ltdc_plane_create(struct drm_device *ddev, formats[nb_fmt++] = drm_fmt_no_alpha; } - plane = devm_kzalloc(dev, sizeof(*plane), GFP_KERNEL); - if (!plane) - return NULL; - - ret = drm_universal_plane_init(ddev, plane, possible_crtcs, - <dc_plane_funcs, formats, nb_fmt, - modifiers, type, NULL); - if (ret < 0) + plane = drmm_universal_plane_alloc(ddev, struct drm_plane, dev, + possible_crtcs, <dc_plane_funcs, formats, + nb_fmt, modifiers, type, NULL); + if (IS_ERR(plane)) return NULL; drm_plane_helper_add(plane, <dc_plane_helper_funcs); @@ -1195,15 +1188,6 @@ static struct drm_plane *ltdc_plane_create(struct drm_device *ddev, return plane; } -static void ltdc_plane_destroy_all(struct drm_device *ddev) -{ - struct drm_plane *plane, *plane_temp; - - list_for_each_entry_safe(plane, plane_temp, - &ddev->mode_config.plane_list, head) - drm_plane_cleanup(plane); -} - static int ltdc_crtc_init(struct drm_device *ddev, struct drm_crtc *crtc) { struct ltdc_device *ldev = ddev->dev_private; @@ -1219,14 +1203,14 @@ static int ltdc_crtc_init(struct drm_device *ddev, struct drm_crtc *crtc) /* Init CRTC according to its hardware features */ if (ldev->caps.crc) - ret = drm_crtc_init_with_planes(ddev, crtc, primary, NULL, - <dc_crtc_with_crc_support_funcs, NULL); + ret = drmm_crtc_init_with_planes(ddev, crtc, primary, NULL, + <dc_crtc_with_crc_support_funcs, NULL); else - ret = drm_crtc_init_with_planes(ddev, crtc, primary, NULL, - <dc_crtc_funcs, NULL); + ret = drmm_crtc_init_with_planes(ddev, crtc, primary, NULL, + <dc_crtc_funcs, NULL); if (ret) { DRM_ERROR("Can not initialize CRTC\n"); - goto cleanup; + return ret; } drm_crtc_helper_add(crtc, <dc_crtc_helper_funcs); @@ -1240,17 +1224,12 @@ static int ltdc_crtc_init(struct drm_device *ddev, struct drm_crtc *crtc) for (i = 1; i < ldev->caps.nb_layers; i++) { overlay = ltdc_plane_create(ddev, DRM_PLANE_TYPE_OVERLAY); if (!overlay) { - ret = -ENOMEM; DRM_ERROR("Can not create overlay plane %d\n", i); - goto cleanup; + return -ENOMEM; } } return 0; - -cleanup: - ltdc_plane_destroy_all(ddev); - return ret; } /* @@ -1314,23 +1293,19 @@ static int ltdc_encoder_init(struct drm_device *ddev, struct drm_bridge *bridge) struct drm_encoder *encoder; int ret; - encoder = devm_kzalloc(ddev->dev, sizeof(*encoder), GFP_KERNEL); - if (!encoder) - return -ENOMEM; + encoder = drmm_simple_encoder_alloc(ddev, struct drm_encoder, dev, + DRM_MODE_ENCODER_DPI); + if (IS_ERR(encoder)) + return PTR_ERR(encoder); encoder->possible_crtcs = CRTC_MASK; encoder->possible_clones = 0; /* No cloning support */ - drm_encoder_init(ddev, encoder, <dc_encoder_funcs, - DRM_MODE_ENCODER_DPI, NULL); - drm_encoder_helper_add(encoder, <dc_encoder_helper_funcs); ret = drm_bridge_attach(encoder, bridge, NULL, 0); - if (ret) { - drm_encoder_cleanup(encoder); + if (ret) return -EINVAL; - } DRM_DEBUG_DRIVER("Bridge encoder:%d created\n", encoder->base.id); @@ -1473,8 +1448,7 @@ int ltdc_load(struct drm_device *ddev) goto err; if (panel) { - bridge = drm_panel_bridge_add_typed(panel, - DRM_MODE_CONNECTOR_DPI); + bridge = drmm_panel_bridge_add(ddev, panel); if (IS_ERR(bridge)) { DRM_ERROR("panel-bridge endpoint %d\n", i); ret = PTR_ERR(bridge); @@ -1539,7 +1513,7 @@ int ltdc_load(struct drm_device *ddev) } - crtc = devm_kzalloc(dev, sizeof(*crtc), GFP_KERNEL); + crtc = drmm_kzalloc(ddev, sizeof(*crtc), GFP_KERNEL); if (!crtc) { DRM_ERROR("Failed to allocate crtc\n"); ret = -ENOMEM; @@ -1571,9 +1545,6 @@ int ltdc_load(struct drm_device *ddev) return 0; err: - for (i = 0; i < nb_endpoints; i++) - drm_of_panel_bridge_remove(ddev->dev->of_node, 0, i); - clk_disable_unprepare(ldev->pixel_clk); return ret; @@ -1581,16 +1552,8 @@ int ltdc_load(struct drm_device *ddev) void ltdc_unload(struct drm_device *ddev) { - struct device *dev = ddev->dev; - int nb_endpoints, i; - DRM_DEBUG_DRIVER("\n"); - nb_endpoints = of_graph_get_endpoint_count(dev->of_node); - - for (i = 0; i < nb_endpoints; i++) - drm_of_panel_bridge_remove(ddev->dev->of_node, 0, i); - pm_runtime_disable(ddev->dev); } -- 2.34.1
反馈： 您发送到kernel@openeuler.org的补丁/补丁集，已成功转换为PR！ PR链接地址： https://gitee.com/openeuler/kernel/pulls/12494 邮件列表地址：https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/G... FeedBack: The patch(es) which you have sent to kernel@openeuler.org mailing list has been converted to a pull request successfully! Pull request link: https://gitee.com/openeuler/kernel/pulls/12494 Mailing list address: https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/G...
participants (2)
-
patchwork bot -
Zhang Kunbo