<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux.git/drivers/gpu/drm/imagination, branch v6.9</title>
<subtitle>Linux kernel source tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/'/>
<entry>
<title>drm/imagination: Ensure PVR_MIPS_PT_PAGE_COUNT is never zero</title>
<updated>2024-04-29T11:31:28+00:00</updated>
<author>
<name>Matt Coster</name>
<email>matt.coster@imgtec.com</email>
</author>
<published>2024-03-05T10:28:33+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=e4236b14fe32a8d92686ec656c870a6bb1d6f50a'/>
<id>e4236b14fe32a8d92686ec656c870a6bb1d6f50a</id>
<content type='text'>
When the host page size was more than 4 times larger than the FW page
size, this macro evaluated to zero resulting in zero-sized arrays.

Use DIV_ROUND_UP() to ensure the correct behavior.

Reported-by: 20240228012313.5934-1-yaolu@kylinos.cn
Closes: https://lore.kernel.org/dri-devel/20240228012313.5934-1-yaolu@kylinos.cn
Link: https://lore.kernel.org/dri-devel/20240228012313.5934-1-yaolu@kylinos.cn
Fixes: 927f3e0253c1 ("drm/imagination: Implement MIPS firmware processor and MMU support")
Cc: stable@vger.kernel.org
Signed-off-by: Matt Coster &lt;matt.coster@imgtec.com&gt;
Reviewed-by: Frank Binns &lt;frank.binns@imgtec.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
When the host page size was more than 4 times larger than the FW page
size, this macro evaluated to zero resulting in zero-sized arrays.

Use DIV_ROUND_UP() to ensure the correct behavior.

Reported-by: 20240228012313.5934-1-yaolu@kylinos.cn
Closes: https://lore.kernel.org/dri-devel/20240228012313.5934-1-yaolu@kylinos.cn
Link: https://lore.kernel.org/dri-devel/20240228012313.5934-1-yaolu@kylinos.cn
Fixes: 927f3e0253c1 ("drm/imagination: Implement MIPS firmware processor and MMU support")
Cc: stable@vger.kernel.org
Signed-off-by: Matt Coster &lt;matt.coster@imgtec.com&gt;
Reviewed-by: Frank Binns &lt;frank.binns@imgtec.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'drm-misc-next-fixes-2024-01-04' of git://anongit.freedesktop.org/drm/drm-misc into drm-next</title>
<updated>2024-01-05T00:31:54+00:00</updated>
<author>
<name>Dave Airlie</name>
<email>airlied@redhat.com</email>
</author>
<published>2024-01-05T00:31:29+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=3c064aea46d071ccf95a142be5532768a7fa6f02'/>
<id>3c064aea46d071ccf95a142be5532768a7fa6f02</id>
<content type='text'>
One fix for drm/plane to avoid a use-after-free and some additional
warnings to prevent more of these occurences, a lock inversion
dependency fix and an indentation fix for drm/rockchip, and some doc
warning fixes for imagination and gpuvm.

Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;

From: Maxime Ripard &lt;mripard@redhat.com&gt;
Link: https://patchwork.freedesktop.org/patch/msgid/enhl33v2oeihktta2yfyc4exvezdvm3eexcuwxkethc5ommrjo@lkidkv2kwakq
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
One fix for drm/plane to avoid a use-after-free and some additional
warnings to prevent more of these occurences, a lock inversion
dependency fix and an indentation fix for drm/rockchip, and some doc
warning fixes for imagination and gpuvm.

Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;

From: Maxime Ripard &lt;mripard@redhat.com&gt;
Link: https://patchwork.freedesktop.org/patch/msgid/enhl33v2oeihktta2yfyc4exvezdvm3eexcuwxkethc5ommrjo@lkidkv2kwakq
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/imagination: pvr_device.h: fix all kernel-doc warnings</title>
<updated>2024-01-02T10:50:05+00:00</updated>
<author>
<name>Randy Dunlap</name>
<email>rdunlap@infradead.org</email>
</author>
<published>2023-12-31T05:49:10+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=eee706839333ec0643f1b4898a37588025bf4cb5'/>
<id>eee706839333ec0643f1b4898a37588025bf4cb5</id>
<content type='text'>
Correct all kernel-doc notation on pvr_device.h so that there are no
kernel-doc warnings remaining.

pvr_device.h:292: warning: Excess struct member 'active' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'idle' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'lock' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'work' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'old_kccb_cmds_executed' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'kccb_stall_count' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'ccb' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'rtn_q' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'rtn_obj' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'rtn' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'slot_count' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'reserved_count' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'waiters' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'fence_ctx' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'id' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'seqno' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'lock' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'active' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'idle' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'lock' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'work' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'old_kccb_cmds_executed' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'kccb_stall_count' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'ccb' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'rtn_q' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'rtn_obj' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'rtn' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'slot_count' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'reserved_count' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'waiters' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'fence_ctx' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'id' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'seqno' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'lock' description in 'pvr_device'

Signed-off-by: Randy Dunlap &lt;rdunlap@infradead.org&gt;
Cc: Frank Binns &lt;frank.binns@imgtec.com&gt;
Cc: Donald Robson &lt;donald.robson@imgtec.com&gt;
Cc: Matt Coster &lt;matt.coster@imgtec.com&gt;
Cc: Maarten Lankhorst &lt;maarten.lankhorst@linux.intel.com&gt;
Cc: Maxime Ripard &lt;mripard@kernel.org&gt;
Cc: Thomas Zimmermann &lt;tzimmermann@suse.de&gt;
Cc: David Airlie &lt;airlied@gmail.com&gt;
Cc: Daniel Vetter &lt;daniel@ffwll.ch&gt;
Cc: dri-devel@lists.freedesktop.org
Cc: Jonathan Corbet &lt;corbet@lwn.net&gt;
Cc: Vegard Nossum &lt;vegard.nossum@oracle.com&gt;
Signed-off-by: Maxime Ripard &lt;mripard@kernel.org&gt;
Link: https://patchwork.freedesktop.org/patch/msgid/20231231054910.31805-1-rdunlap@infradead.org
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Correct all kernel-doc notation on pvr_device.h so that there are no
kernel-doc warnings remaining.

pvr_device.h:292: warning: Excess struct member 'active' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'idle' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'lock' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'work' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'old_kccb_cmds_executed' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'kccb_stall_count' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'ccb' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'rtn_q' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'rtn_obj' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'rtn' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'slot_count' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'reserved_count' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'waiters' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'fence_ctx' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'id' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'seqno' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'lock' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'active' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'idle' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'lock' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'work' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'old_kccb_cmds_executed' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'kccb_stall_count' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'ccb' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'rtn_q' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'rtn_obj' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'rtn' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'slot_count' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'reserved_count' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'waiters' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'fence_ctx' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'id' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'seqno' description in 'pvr_device'
pvr_device.h:292: warning: Excess struct member 'lock' description in 'pvr_device'

Signed-off-by: Randy Dunlap &lt;rdunlap@infradead.org&gt;
Cc: Frank Binns &lt;frank.binns@imgtec.com&gt;
Cc: Donald Robson &lt;donald.robson@imgtec.com&gt;
Cc: Matt Coster &lt;matt.coster@imgtec.com&gt;
Cc: Maarten Lankhorst &lt;maarten.lankhorst@linux.intel.com&gt;
Cc: Maxime Ripard &lt;mripard@kernel.org&gt;
Cc: Thomas Zimmermann &lt;tzimmermann@suse.de&gt;
Cc: David Airlie &lt;airlied@gmail.com&gt;
Cc: Daniel Vetter &lt;daniel@ffwll.ch&gt;
Cc: dri-devel@lists.freedesktop.org
Cc: Jonathan Corbet &lt;corbet@lwn.net&gt;
Cc: Vegard Nossum &lt;vegard.nossum@oracle.com&gt;
Signed-off-by: Maxime Ripard &lt;mripard@kernel.org&gt;
Link: https://patchwork.freedesktop.org/patch/msgid/20231231054910.31805-1-rdunlap@infradead.org
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'drm-misc-next-fixes-2023-12-21' of git://anongit.freedesktop.org/drm/drm-misc into drm-next</title>
<updated>2023-12-22T04:36:03+00:00</updated>
<author>
<name>Dave Airlie</name>
<email>airlied@redhat.com</email>
</author>
<published>2023-12-22T03:13:36+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=dc83fb6e38fe5a507b4d714a5dfb0902790c3b3f'/>
<id>dc83fb6e38fe5a507b4d714a5dfb0902790c3b3f</id>
<content type='text'>
More fixes for the new imagination drier, a DT node refcount fix for the
new aux bridge driver and a missing header fix for the LUT management
code.

Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;

From: Maxime Ripard &lt;mripard@redhat.com&gt;
Link: https://patchwork.freedesktop.org/patch/msgid/42dw6ok2g5kz5xljrw7t6lzrgafhwslgw3j4rbaaivluv24vkj@k4smx5r3y2gh
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
More fixes for the new imagination drier, a DT node refcount fix for the
new aux bridge driver and a missing header fix for the LUT management
code.

Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;

From: Maxime Ripard &lt;mripard@redhat.com&gt;
Link: https://patchwork.freedesktop.org/patch/msgid/42dw6ok2g5kz5xljrw7t6lzrgafhwslgw3j4rbaaivluv24vkj@k4smx5r3y2gh
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'drm-msm-next-2023-12-15' of https://gitlab.freedesktop.org/drm/msm into drm-next</title>
<updated>2023-12-19T21:54:03+00:00</updated>
<author>
<name>Dave Airlie</name>
<email>airlied@redhat.com</email>
</author>
<published>2023-12-19T21:43:25+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=22a2decedfbeb981df04dca880412b9520b2f8a1'/>
<id>22a2decedfbeb981df04dca880412b9520b2f8a1</id>
<content type='text'>
Updates for v6.8:

Core:
- Add support for SDM670, SM8650
- Handle the CFG interconnect to fix the obscure hangs / timeouts
  on register write
- Kconfig fix for QMP dependency
- DT schema fixes

DPU:
- Add support for SDM670, SM8650
- Enable SmartDMA on SM8350 and SM8450
- Correct UBWC settings for SC8280XP
- Fix catalog settings for SC8180X
- Actually make use of the version to switch between QSEED3/3LITE/4
  scalers
- Use devres-managed and drm-managed allocations where appropriate
- misc other fixes
- Enabled YUV writeback on SC7280, SM8250
- Enabled writeback on SM8350, SM8450
- CRC fix when encoder is selected as the input source
- other misc fixes

MDP4:
- Use devres-managed and drm-managed allocations where appropriate
- flush vblank event on CRTC disable

MDP5:
- Use devres-managed and drm-managed allocations where appropriate

DP:
- Add support for SM8650
- Enable PM runtime support
- Merge msm-specific debugfs dir with the generic one
- Described DisplayPort on SM8150 in DeviceTree bindings
- Moved dp_display_get_next_bridge() to probe()

DSI:
- Add support for SM8650
- Enable PM runtime support

GPU/GEM:
- demote userspace triggerable warnings to debug
- add GEM object metadata UAPI
- move GPU devcoredumps to GPU device
- fix hangcheck to skip retired submits
- expose UBWC config to userspace
- fix a680 chip-id
- drm_exec conversion
- drm/ci: remove rebase-merge directory (to unblock CI)

[airlied: fix drm_exec/amd interaction]
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
From: Rob Clark &lt;robdclark@gmail.com&gt;
Link: https://patchwork.freedesktop.org/patch/msgid/CAF6AEGs9auYqmo-7NSd9FsbNBCDf7aBevd=4xkcF3A5G_OGvMQ@mail.gmail.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Updates for v6.8:

Core:
- Add support for SDM670, SM8650
- Handle the CFG interconnect to fix the obscure hangs / timeouts
  on register write
- Kconfig fix for QMP dependency
- DT schema fixes

DPU:
- Add support for SDM670, SM8650
- Enable SmartDMA on SM8350 and SM8450
- Correct UBWC settings for SC8280XP
- Fix catalog settings for SC8180X
- Actually make use of the version to switch between QSEED3/3LITE/4
  scalers
- Use devres-managed and drm-managed allocations where appropriate
- misc other fixes
- Enabled YUV writeback on SC7280, SM8250
- Enabled writeback on SM8350, SM8450
- CRC fix when encoder is selected as the input source
- other misc fixes

MDP4:
- Use devres-managed and drm-managed allocations where appropriate
- flush vblank event on CRTC disable

MDP5:
- Use devres-managed and drm-managed allocations where appropriate

DP:
- Add support for SM8650
- Enable PM runtime support
- Merge msm-specific debugfs dir with the generic one
- Described DisplayPort on SM8150 in DeviceTree bindings
- Moved dp_display_get_next_bridge() to probe()

DSI:
- Add support for SM8650
- Enable PM runtime support

GPU/GEM:
- demote userspace triggerable warnings to debug
- add GEM object metadata UAPI
- move GPU devcoredumps to GPU device
- fix hangcheck to skip retired submits
- expose UBWC config to userspace
- fix a680 chip-id
- drm_exec conversion
- drm/ci: remove rebase-merge directory (to unblock CI)

[airlied: fix drm_exec/amd interaction]
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
From: Rob Clark &lt;robdclark@gmail.com&gt;
Link: https://patchwork.freedesktop.org/patch/msgid/CAF6AEGs9auYqmo-7NSd9FsbNBCDf7aBevd=4xkcF3A5G_OGvMQ@mail.gmail.com
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/imagination: Fix error path in pvr_vm_create_context</title>
<updated>2023-12-15T13:04:21+00:00</updated>
<author>
<name>Donald Robson</name>
<email>donald.robson@imgtec.com</email>
</author>
<published>2023-12-13T14:44:31+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=8a53e29fe05c56f643eaab285f224c09b9c3dd4c'/>
<id>8a53e29fe05c56f643eaab285f224c09b9c3dd4c</id>
<content type='text'>
It is possible to double free the vm_ctx-&gt;mmu_ctx object in this
function.

    630 err_page_table_destroy:
--&gt; 631         pvr_mmu_context_destroy(vm_ctx-&gt;mmu_ctx);

The pvr_vm_context_put() function does:

        kref_put(&amp;vm_ctx-&gt;ref_count, pvr_vm_context_release);

Here the pvr_vm_context_release() will call:

        pvr_mmu_context_destroy(vm_ctx-&gt;mmu_ctx);

Refactor to an unwind style.

Reported-by: Dan Carpenter &lt;dan.carpenter@linaro.org&gt;
Signed-off-by: Donald Robson &lt;donald.robson@imgtec.com&gt;
Reviewed-by: Dan Carpenter &lt;dan.carpenter@linaro.org&gt;
Signed-off-by: Maxime Ripard &lt;mripard@kernel.org&gt;
Link: https://patchwork.freedesktop.org/patch/msgid/20231213144431.94956-2-donald.robson@imgtec.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
It is possible to double free the vm_ctx-&gt;mmu_ctx object in this
function.

    630 err_page_table_destroy:
--&gt; 631         pvr_mmu_context_destroy(vm_ctx-&gt;mmu_ctx);

The pvr_vm_context_put() function does:

        kref_put(&amp;vm_ctx-&gt;ref_count, pvr_vm_context_release);

Here the pvr_vm_context_release() will call:

        pvr_mmu_context_destroy(vm_ctx-&gt;mmu_ctx);

Refactor to an unwind style.

Reported-by: Dan Carpenter &lt;dan.carpenter@linaro.org&gt;
Signed-off-by: Donald Robson &lt;donald.robson@imgtec.com&gt;
Reviewed-by: Dan Carpenter &lt;dan.carpenter@linaro.org&gt;
Signed-off-by: Maxime Ripard &lt;mripard@kernel.org&gt;
Link: https://patchwork.freedesktop.org/patch/msgid/20231213144431.94956-2-donald.robson@imgtec.com
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/imagination: Fix ERR_PTR test on pointer to pointer.</title>
<updated>2023-12-15T13:04:16+00:00</updated>
<author>
<name>Donald Robson</name>
<email>donald.robson@imgtec.com</email>
</author>
<published>2023-12-13T14:44:30+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=f175498378bdae2ebcf61170a2a866cb96e8a69a'/>
<id>f175498378bdae2ebcf61170a2a866cb96e8a69a</id>
<content type='text'>
drivers/gpu/drm/imagination/pvr_vm.c:631 pvr_vm_create_context()
  error: 'vm_ctx-&gt;mmu_ctx' dereferencing possible ERR_PTR()

612         vm_ctx-&gt;mmu_ctx = pvr_mmu_context_create(pvr_dev);
613         err = PTR_ERR_OR_ZERO(&amp;vm_ctx-&gt;mmu_ctx);
                                      ^
The address is never an error pointer so this will always return 0.
Remove the ampersand.

Reported-by: Dan Carpenter &lt;dan.carpenter@linaro.org&gt;
Signed-off-by: Donald Robson &lt;donald.robson@imgtec.com&gt;
Signed-off-by: Maxime Ripard &lt;mripard@kernel.org&gt;
Link: https://patchwork.freedesktop.org/patch/msgid/20231213144431.94956-1-donald.robson@imgtec.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
drivers/gpu/drm/imagination/pvr_vm.c:631 pvr_vm_create_context()
  error: 'vm_ctx-&gt;mmu_ctx' dereferencing possible ERR_PTR()

612         vm_ctx-&gt;mmu_ctx = pvr_mmu_context_create(pvr_dev);
613         err = PTR_ERR_OR_ZERO(&amp;vm_ctx-&gt;mmu_ctx);
                                      ^
The address is never an error pointer so this will always return 0.
Remove the ampersand.

Reported-by: Dan Carpenter &lt;dan.carpenter@linaro.org&gt;
Signed-off-by: Donald Robson &lt;donald.robson@imgtec.com&gt;
Signed-off-by: Maxime Ripard &lt;mripard@kernel.org&gt;
Link: https://patchwork.freedesktop.org/patch/msgid/20231213144431.94956-1-donald.robson@imgtec.com
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/imagination: Fixed oops when misusing ioctl CREATE_HWRT_DATASET</title>
<updated>2023-12-15T13:04:08+00:00</updated>
<author>
<name>Donald Robson</name>
<email>donald.robson@imgtec.com</email>
</author>
<published>2023-12-08T16:30:19+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=f1f55ed3ffe4212f5c96106bf6396c461a2bf223'/>
<id>f1f55ed3ffe4212f5c96106bf6396c461a2bf223</id>
<content type='text'>
While writing the matching IGT suite I discovered that it's possible to
cause a kernel oops when using DRM_IOCTL_PVR_CREATE_HWRT_DATASET when
the call to hwrt_init_common_fw_structure() fails.

Use an unwind-type error path to avoid cleaning up the object using the
the release function before it is fully resolved.

Signed-off-by: Donald Robson &lt;donald.robson@imgtec.com&gt;
Signed-off-by: Maxime Ripard &lt;mripard@kernel.org&gt;
Link: https://patchwork.freedesktop.org/patch/msgid/20231208163019.95913-1-donald.robson@imgtec.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
While writing the matching IGT suite I discovered that it's possible to
cause a kernel oops when using DRM_IOCTL_PVR_CREATE_HWRT_DATASET when
the call to hwrt_init_common_fw_structure() fails.

Use an unwind-type error path to avoid cleaning up the object using the
the release function before it is fully resolved.

Signed-off-by: Donald Robson &lt;donald.robson@imgtec.com&gt;
Signed-off-by: Maxime Ripard &lt;mripard@kernel.org&gt;
Link: https://patchwork.freedesktop.org/patch/msgid/20231208163019.95913-1-donald.robson@imgtec.com
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/imagination: Fixed infinite loop in pvr_vm_mips_map()</title>
<updated>2023-12-15T13:03:57+00:00</updated>
<author>
<name>Donald Robson</name>
<email>donald.robson@imgtec.com</email>
</author>
<published>2023-12-08T16:08:25+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=b39610c773431ac7991cf6235e26d693ccabd9e9'/>
<id>b39610c773431ac7991cf6235e26d693ccabd9e9</id>
<content type='text'>
Unwinding loop in error path for this function uses unsigned limit
variable, causing the promotion of the signed counter variable.

--&gt; 204         for (; pfn &gt;= start_pfn; pfn--)
                       ^^^^^^^^^^^^^^^^
If start_pfn can be zero then this is an endless loop.  I've seen this
code in other places as well.  This loop is slightly off as well.  It
should decrement pfn on the first iteration.

Fix by making the loop limit variables signed. Also fix missing
predecrement by modifying to while loop.

Reported-by: Dan Carpenter &lt;dan.carpenter@linaro.org&gt;
Signed-off-by: Donald Robson &lt;donald.robson@imgtec.com&gt;
Signed-off-by: Maxime Ripard &lt;mripard@kernel.org&gt;
Link: https://patchwork.freedesktop.org/patch/msgid/20231208160825.92933-1-donald.robson@imgtec.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Unwinding loop in error path for this function uses unsigned limit
variable, causing the promotion of the signed counter variable.

--&gt; 204         for (; pfn &gt;= start_pfn; pfn--)
                       ^^^^^^^^^^^^^^^^
If start_pfn can be zero then this is an endless loop.  I've seen this
code in other places as well.  This loop is slightly off as well.  It
should decrement pfn on the first iteration.

Fix by making the loop limit variables signed. Also fix missing
predecrement by modifying to while loop.

Reported-by: Dan Carpenter &lt;dan.carpenter@linaro.org&gt;
Signed-off-by: Donald Robson &lt;donald.robson@imgtec.com&gt;
Signed-off-by: Maxime Ripard &lt;mripard@kernel.org&gt;
Link: https://patchwork.freedesktop.org/patch/msgid/20231208160825.92933-1-donald.robson@imgtec.com
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/imagination: vm: Fix heap lookup condition</title>
<updated>2023-12-13T15:19:01+00:00</updated>
<author>
<name>Alex Bee</name>
<email>knaerzche@gmail.com</email>
</author>
<published>2023-12-08T17:08:56+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=ec2cbaf604f4a5f4bc5484ae86016ebe91236fdc'/>
<id>ec2cbaf604f4a5f4bc5484ae86016ebe91236fdc</id>
<content type='text'>
When conditionally checking for heap existence of a certian address in
pvr_vm_bind_op_map_init the condition whether the map request comes from a
user is incorrect: The context must not be the kernel-context to be a
user(space) context and should be looked up in pvr_heaps.

That makes addresses coming from userspace not being verfied against the
defined ranges and prevents firmware loading for meta cores.

Fixes: ff5f643de0bf ("drm/imagination: Add GEM and VM related code")
Signed-off-by: Alex Bee &lt;knaerzche@gmail.com&gt;
Reviewed-by: Donald Robson &lt;donald.robson@imgtec.com&gt;
Signed-off-by: Maxime Ripard &lt;mripard@kernel.org&gt;
Link: https://patchwork.freedesktop.org/patch/msgid/20231208170856.1748413-1-knaerzche@gmail.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
When conditionally checking for heap existence of a certian address in
pvr_vm_bind_op_map_init the condition whether the map request comes from a
user is incorrect: The context must not be the kernel-context to be a
user(space) context and should be looked up in pvr_heaps.

That makes addresses coming from userspace not being verfied against the
defined ranges and prevents firmware loading for meta cores.

Fixes: ff5f643de0bf ("drm/imagination: Add GEM and VM related code")
Signed-off-by: Alex Bee &lt;knaerzche@gmail.com&gt;
Reviewed-by: Donald Robson &lt;donald.robson@imgtec.com&gt;
Signed-off-by: Maxime Ripard &lt;mripard@kernel.org&gt;
Link: https://patchwork.freedesktop.org/patch/msgid/20231208170856.1748413-1-knaerzche@gmail.com
</pre>
</div>
</content>
</entry>
</feed>
