Skip to content
  1. Dec 20, 2023
  2. Dec 19, 2023
    • Douglas Anderson's avatar
      drm/bridge: ps8640: Fix size mismatch warning w/ len · 35ba6bd5
      Douglas Anderson authored
      After commit 26195af5 ("drm/bridge: ps8640: Drop the ability of
      ps8640 to fetch the EDID"), I got an error compiling:
      
        error: comparison of distinct pointer types
        ('typeof (len) *' (aka 'unsigned int *') and
         'typeof (msg->size) *' (aka 'unsigned long *'))
        [-Werror,-Wcompare-distinct-pointer-types]
      
      Fix it by declaring the `len` as size_t.
      
      The above error only shows up on downstream kernels without commit
      d03eba99 ("minmax: allow min()/max()/clamp() if the arguments have
      the same signedness."), but since commit 26195af5 ("drm/bridge:
      ps8640: Drop the ability of ps8640 to fetch the EDID") is a "Fix" that
      will likely be backported it seems nice to make it easy. ...plus it's
      more correct to declare `len` as size_t anyway.
      
      Fixes: 26195af5
      
       ("drm/bridge: ps8640: Drop the ability of ps8640 to fetch the EDID")
      Reviewed-by: default avatarStephen Boyd <swboyd@chromium.org>
      Signed-off-by: default avatarDouglas Anderson <dianders@chromium.org>
      Link: https://patchwork.freedesktop.org/patch/msgid/20231218090454.1.I5c6eb80b2f746439c4b58efab788e00701d08759@changeid
      35ba6bd5
    • Douglas Anderson's avatar
      drm/bridge: ti-sn65dsi86: Never store more than msg->size bytes in AUX xfer · aca58eac
      Douglas Anderson authored
      For aux reads, the value `msg->size` indicates the size of the buffer
      provided by `msg->buffer`. We should never in any circumstances write
      more bytes to the buffer since it may overflow the buffer.
      
      In the ti-sn65dsi86 driver there is one code path that reads the
      transfer length from hardware. Even though it's never been seen to be
      a problem, we should make extra sure that the hardware isn't
      increasing the length since doing so would cause us to overrun the
      buffer.
      
      Fixes: 982f589b
      
       ("drm/bridge: ti-sn65dsi86: Update reply on aux failures")
      Reviewed-by: default avatarStephen Boyd <swboyd@chromium.org>
      Reviewed-by: default avatarGuenter Roeck <groeck@chromium.org>
      Signed-off-by: default avatarDouglas Anderson <dianders@chromium.org>
      Link: https://patchwork.freedesktop.org/patch/msgid/20231214123752.v3.2.I7b83c0f31aeedc6b1dc98c7c741d3e1f94f040f8@changeid
      aca58eac
    • Douglas Anderson's avatar
      drm/bridge: parade-ps8640: Never store more than msg->size bytes in AUX xfer · 3164c8a7
      Douglas Anderson authored
      While testing, I happened to notice a random crash that looked like:
      
        Kernel panic - not syncing: stack-protector:
        Kernel stack is corrupted in: drm_dp_dpcd_probe+0x120/0x120
      
      Analysis of drm_dp_dpcd_probe() shows that we pass in a 1-byte buffer
      (allocated on the stack) to the aux->transfer() function. Presumably
      if the aux->transfer() writes more than one byte to this buffer then
      we're in a bad shape.
      
      Dropping into kgdb, I noticed that "aux->transfer" pointed at
      ps8640_aux_transfer().
      
      Reading through ps8640_aux_transfer(), I can see that there are cases
      where it could write more bytes to msg->buffer than were specified by
      msg->size. This could happen if the hardware reported back something
      bogus to us. Let's fix this so we never write more than msg->size
      bytes. We'll still read all the bytes from the hardware just in case
      the hardware requires it since the aux transfer data comes through an
      auto-incrementing register.
      
      NOTE: I have no actual way to reproduce this issue but it seems likely
      this is what was happening in the crash I looked at.
      
      Fixes: 13afcdd7
      
       ("drm/bridge: parade-ps8640: Add support for AUX channel")
      Reviewed-by: default avatarStephen Boyd <swboyd@chromium.org>
      Reviewed-by: default avatarGuenter Roeck <groeck@chromium.org>
      Signed-off-by: default avatarDouglas Anderson <dianders@chromium.org>
      Link: https://patchwork.freedesktop.org/patch/msgid/20231214123752.v3.1.I9d1afcaad76a3e2c0ca046dc4adbc2b632c22eda@changeid
      3164c8a7
  3. Dec 16, 2023
  4. Dec 14, 2023
    • Farouk Bouabid's avatar
      drm/panel: ltk050h3146w: Set burst mode for ltk050h3148w · 6c9dbee8
      Farouk Bouabid authored
      The ltk050h3148w variant expects the horizontal component lane byte clock
      cycle(lbcc) to be calculated using lane_mbps (burst mode) instead of the
      pixel clock.
      Using the pixel clock rate by default for this calculation was introduced
      in commit ac87d236 ("drm/bridge: synopsys: dw-mipi-dsi: Use pixel clock
      rate to calculate lbcc") and starting from commit 93e82bb4
      ("drm/bridge: synopsys: dw-mipi-dsi: Fix hcomponent lbcc for burst mode")
      only panels that support burst mode can keep using the lane_mbps. So add
      MIPI_DSI_MODE_VIDEO_BURST as part of the mode_flags for the dsi host.
      
      Fixes: 93e82bb4
      
       ("drm/bridge: synopsys: dw-mipi-dsi: Fix hcomponent lbcc for burst mode")
      Signed-off-by: default avatarFarouk Bouabid <farouk.bouabid@theobroma-systems.com>
      Reviewed-by: default avatarJessica Zhang <quic_jesszhan@quicinc.com>
      Signed-off-by: default avatarHeiko Stuebner <heiko@sntech.de>
      Link: https://patchwork.freedesktop.org/patch/msgid/20231213145045.41020-1-farouk.bouabid@theobroma-systems.com
      6c9dbee8
  5. Dec 13, 2023
  6. Dec 11, 2023
  7. Dec 08, 2023
  8. Dec 07, 2023
  9. Dec 06, 2023
    • Thomas Zimmermann's avatar
      drm/atomic-helpers: Invoke end_fb_access while owning plane state · e0f04e41
      Thomas Zimmermann authored
      
      
      Invoke drm_plane_helper_funcs.end_fb_access before
      drm_atomic_helper_commit_hw_done(). The latter function hands over
      ownership of the plane state to the following commit, which might
      free it. Releasing resources in end_fb_access then operates on undefined
      state. This bug has been observed with non-blocking commits when they
      are being queued up quickly.
      
      Here is an example stack trace from the bug report. The plane state has
      been free'd already, so the pages for drm_gem_fb_vunmap() are gone.
      
      Unable to handle kernel paging request at virtual address 0000000100000049
      [...]
       drm_gem_fb_vunmap+0x18/0x74
       drm_gem_end_shadow_fb_access+0x1c/0x2c
       drm_atomic_helper_cleanup_planes+0x58/0xd8
       drm_atomic_helper_commit_tail+0x90/0xa0
       commit_tail+0x15c/0x188
       commit_work+0x14/0x20
      
      Fix this by running end_fb_access immediately after updating all planes
      in drm_atomic_helper_commit_planes(). The existing clean-up helper
      drm_atomic_helper_cleanup_planes() now only handles cleanup_fb.
      
      For aborted commits, roll back from drm_atomic_helper_prepare_planes()
      in the new helper drm_atomic_helper_unprepare_planes(). This case is
      different from regular cleanup, as we have to release the new state;
      regular cleanup releases the old state. The new helper also invokes
      cleanup_fb for all planes.
      
      The changes mostly involve DRM's atomic helpers. Only two drivers, i915
      and nouveau, implement their own commit function. Update them to invoke
      drm_atomic_helper_unprepare_planes(). Drivers with custom commit_tail
      function do not require changes.
      
      v4:
      	* fix documentation (kernel test robot)
      v3:
      	* add drm_atomic_helper_unprepare_planes() for rolling back
      	* use correct state for end_fb_access
      v2:
      	* fix test in drm_atomic_helper_cleanup_planes()
      
      Reported-by: default avatarAlyssa Ross <hi@alyssa.is>
      Closes: https://lore.kernel.org/dri-devel/87leazm0ya.fsf@alyssa.is/
      Suggested-by: default avatarDaniel Vetter <daniel@ffwll.ch>
      Fixes: 94d879ea
      
       ("drm/atomic-helper: Add {begin,end}_fb_access to plane helpers")
      Tested-by: default avatarAlyssa Ross <hi@alyssa.is>
      Reviewed-by: default avatarAlyssa Ross <hi@alyssa.is>
      Signed-off-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
      Cc: <stable@vger.kernel.org> # v6.2+
      Link: https://patchwork.freedesktop.org/patch/msgid/20231204083247.22006-1-tzimmermann@suse.de
      e0f04e41
  10. Dec 05, 2023
  11. Nov 30, 2023
  12. Nov 29, 2023
  13. Nov 28, 2023
  14. Nov 25, 2023
    • Liu Ying's avatar
      drm/bridge: panel: Check device dependency before managing device link · 39d5b6a6
      Liu Ying authored
      Some panel devices already depend on DRM device, like the panel in
      arch/arm/boot/dts/st/ste-ux500-samsung-skomer.dts, because DRM device is
      the ancestor of those panel devices.  device_link_add() would fail by
      returning a NULL pointer for those panel devices because of the existing
      dependency.  So, check the dependency by calling device_is_dependent()
      before adding or deleting device link between panel device and DRM device
      so that the link is managed only for independent panel devices.
      
      Fixes: 88787801 ("drm/bridge: panel: Fix device link for DRM_BRIDGE_ATTACH_NO_CONNECTOR")
      Fixes: 199cf07e
      
       ("drm/bridge: panel: Add a device link between drm device and panel device")
      Reported-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Closes: https://lore.kernel.org/lkml/CACRpkdaGzXD6HbiX7mVUNJAJtMEPG00Pp6+nJ1P0JrfJ-ArMvQ@mail.gmail.com/T/
      Tested-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Signed-off-by: default avatarLiu Ying <victor.liu@nxp.com>
      Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Link: https://patchwork.freedesktop.org/patch/msgid/20231123032615.3760488-1-victor.liu@nxp.com
      39d5b6a6
  15. Nov 22, 2023
    • Dave Airlie's avatar
      nouveau/gsp: allocate enough space for all channel ids. · ab93edb2
      Dave Airlie authored
      
      
      This probably isn't the ideal fix, but we ended up using chids
      sparsely, and lots of things rely on indexing into the full range,
      so just allocate the full range up front.
      
      The GSP code fixes 8 channels into a userd page, but we end up using
      a single userd page per channel so end up sparsely using the range.
      
      Fixes a few crashes seen with multiple channels.
      
      Link: https://gitlab.freedesktop.org/drm/nouveau/-/issues/277
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      Signed-off-by: default avatarDanilo Krummrich <dakr@redhat.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20231121201109.2988516-1-airlied@gmail.com
      ab93edb2
    • Cong Yang's avatar
      drm/panel: boe-tv101wum-nl6: Fine tune Himax83102-j02 panel HFP and HBP · cea70081
      Cong Yang authored
      The refresh reported by modetest is 60.46Hz, and the actual measurement
      is 60.01Hz, which is outside the expected tolerance. Adjust hporch and
      pixel clock to fix it. After repair, modetest and actual measurement were
      all 60.01Hz.
      
      Modetest refresh = Pixel CLK/ htotal* vtotal, but measurement frame rate
      is HS->LP cycle time(Vblanking). Measured frame rate is not only affecte
      by Htotal/Vtotal/pixel clock, also affected by Lane-num/PixelBit/LineTime
      /DSI CLK. Assume that the DSI controller could not make the mode that we
      requested(presumably it's PLL couldn't generate the exact pixel clock?).
      If you use a different DSI controller, you may need to readjust these
      parameters. Now this panel looks like it's only used by me on the MTK
      platform, so let's change this set of parameters.
      
      Fixes: 1bc2ef06
      
       ("drm/panel: Support for Starry-himax83102-j02 TDDI MIPI-DSI panel")
      Signed-off-by: default avatarCong Yang <yangcong5@huaqin.corp-partner.google.com>
      Reviewed-by: default avatarDouglas Anderson <dianders@chromium.org>
      Signed-off-by: default avatarDouglas Anderson <dianders@chromium.org>
      Link: https://patchwork.freedesktop.org/patch/msgid/20231120020109.3216343-1-yangcong5@huaqin.corp-partner.google.com
      cea70081
  16. Nov 21, 2023
  17. Nov 20, 2023
    • Marek Vasut's avatar
      drm/panel: simple: Fix Innolux G101ICE-L01 timings · 3f9a91b6
      Marek Vasut authored
      The Innolux G101ICE-L01 datasheet [1] page 17 table
      6.1 INPUT SIGNAL TIMING SPECIFICATIONS
      indicates that maximum vertical blanking time is 40 lines.
      Currently the driver uses 29 lines.
      
      Fix it, and since this panel is a DE panel, adjust the timings
      to make them less hostile to controllers which cannot do 1 px
      HSA/VSA, distribute the delays evenly between all three parts.
      
      [1] https://www.data-modul.com/sites/default/files/products/G101ICE-L01-C2-specification-12042389.pdf
      
      Fixes: 1e29b840
      
       ("drm/panel: simple: Add Innolux G101ICE-L01 panel")
      Signed-off-by: default avatarMarek Vasut <marex@denx.de>
      Reviewed-by: default avatarNeil Armstrong <neil.armstrong@linaro.org>
      Link: https://patchwork.freedesktop.org/patch/msgid/20231008223256.279196-1-marex@denx.de
      3f9a91b6
    • Marek Vasut's avatar
      drm/panel: simple: Fix Innolux G101ICE-L01 bus flags · 06fc41b0
      Marek Vasut authored
      Add missing .bus_flags = DRM_BUS_FLAG_DE_HIGH to this panel description,
      ones which match both the datasheet and the panel display_timing flags .
      
      Fixes: 1e29b840
      
       ("drm/panel: simple: Add Innolux G101ICE-L01 panel")
      Signed-off-by: default avatarMarek Vasut <marex@denx.de>
      Reviewed-by: default avatarNeil Armstrong <neil.armstrong@linaro.org>
      Link: https://patchwork.freedesktop.org/patch/msgid/20231008223315.279215-1-marex@denx.de
      06fc41b0
  18. Nov 18, 2023
  19. Nov 16, 2023