Commit 746b9c62 authored by Thomas Zimmermann's avatar Thomas Zimmermann
Browse files

drm/gem: Ignore color planes that are unused by framebuffer format 



Only handle color planes that exist in a framebuffer's color format.
Ignore non-existing planes.

So far, several helpers assumed that all 4 planes are available and
silently ignored non-existing planes. This lead to subtil bugs with
uninitialized data in instances of struct iosys_map. [1]

Signed-off-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: default avatarJavier Martinez Canillas <javierm@redhat.com>
Tested-by: default avatarNoralf Trønnes <noralf@tronnes.org>
Acked-by: default avatarChristian König <christian.koenig@amd.com>
Link: https://lore.kernel.org/dri-devel/20210730183511.20080-1-tzimmermann@suse.de/T/#md0172b10bb588d8f20f4f456e304f08d2a4505f7 # 1
Link: https://patchwork.freedesktop.org/patch/msgid/20220517113327.26919-3-tzimmermann@suse.de
parent f159b1b2

drivers/gpu/drm/drm_gem_atomic_helper.c

+4 −2
Original line number Diff line number Diff line
@@ -169,8 +169,10 @@ int drm_gem_plane_helper_prepare_fb(struct drm_plane *plane, 
		struct drm_gem_object *obj = drm_gem_fb_get_obj(state->fb, i);

		struct dma_fence *new;



		if (WARN_ON_ONCE(!obj))

			continue;

		if (!obj) {

			ret = -EINVAL;

			goto error;

		}



		ret = dma_resv_get_singleton(obj->resv, usage, &new);

		if (ret)

drivers/gpu/drm/drm_gem_framebuffer_helper.c

+20 −17
Original line number Diff line number Diff line
@@ -92,9 +92,9 @@ drm_gem_fb_init(struct drm_device *dev, 
 */

void drm_gem_fb_destroy(struct drm_framebuffer *fb)

{

	size_t i;

	unsigned int i;



	for (i = 0; i < ARRAY_SIZE(fb->obj); i++)

	for (i = 0; i < fb->format->num_planes; i++)

		drm_gem_object_put(fb->obj[i]);



	drm_framebuffer_cleanup(fb);
@@ -329,24 +329,26 @@ EXPORT_SYMBOL_GPL(drm_gem_fb_create_with_dirty); 
 * The argument returns the addresses of the data stored in each BO. This

 * is different from @map if the framebuffer's offsets field is non-zero.

 *

 * Both, @map and @data, must each refer to arrays with at least

 * fb->format->num_planes elements.

 *

 * See drm_gem_fb_vunmap() for unmapping.

 *

 * Returns:

 * 0 on success, or a negative errno code otherwise.

 */

int drm_gem_fb_vmap(struct drm_framebuffer *fb,

		    struct iosys_map map[static DRM_FORMAT_MAX_PLANES],

		    struct iosys_map data[DRM_FORMAT_MAX_PLANES])

int drm_gem_fb_vmap(struct drm_framebuffer *fb, struct iosys_map *map,

		    struct iosys_map *data)

{

	struct drm_gem_object *obj;

	unsigned int i;

	int ret;



	for (i = 0; i < DRM_FORMAT_MAX_PLANES; ++i) {

	for (i = 0; i < fb->format->num_planes; ++i) {

		obj = drm_gem_fb_get_obj(fb, i);

		if (!obj) {

			iosys_map_clear(&map[i]);

			continue;

			ret = -EINVAL;

			goto err_drm_gem_vunmap;

		}

		ret = drm_gem_vmap(obj, &map[i]);

		if (ret)
@@ -354,7 +356,7 @@ int drm_gem_fb_vmap(struct drm_framebuffer *fb, 
	}



	if (data) {

		for (i = 0; i < DRM_FORMAT_MAX_PLANES; ++i) {

		for (i = 0; i < fb->format->num_planes; ++i) {

			memcpy(&data[i], &map[i], sizeof(data[i]));

			if (iosys_map_is_null(&data[i]))

				continue;
@@ -385,10 +387,9 @@ EXPORT_SYMBOL(drm_gem_fb_vmap); 
 *

 * See drm_gem_fb_vmap() for more information.

 */

void drm_gem_fb_vunmap(struct drm_framebuffer *fb,

		       struct iosys_map map[static DRM_FORMAT_MAX_PLANES])

void drm_gem_fb_vunmap(struct drm_framebuffer *fb, struct iosys_map *map)

{

	unsigned int i = DRM_FORMAT_MAX_PLANES;

	unsigned int i = fb->format->num_planes;

	struct drm_gem_object *obj;



	while (i) {
@@ -443,13 +444,15 @@ int drm_gem_fb_begin_cpu_access(struct drm_framebuffer *fb, enum dma_data_direct 
{

	struct dma_buf_attachment *import_attach;

	struct drm_gem_object *obj;

	size_t i;

	unsigned int i;

	int ret;



	for (i = 0; i < ARRAY_SIZE(fb->obj); ++i) {

	for (i = 0; i < fb->format->num_planes; ++i) {

		obj = drm_gem_fb_get_obj(fb, i);

		if (!obj)

			continue;

		if (!obj) {

			ret = -EINVAL;

			goto err___drm_gem_fb_end_cpu_access;

		}

		import_attach = obj->import_attach;

		if (!import_attach)

			continue;
@@ -479,7 +482,7 @@ EXPORT_SYMBOL(drm_gem_fb_begin_cpu_access); 
 */

void drm_gem_fb_end_cpu_access(struct drm_framebuffer *fb, enum dma_data_direction dir)

{

	__drm_gem_fb_end_cpu_access(fb, dir, ARRAY_SIZE(fb->obj));

	__drm_gem_fb_end_cpu_access(fb, dir, fb->format->num_planes);

}

EXPORT_SYMBOL(drm_gem_fb_end_cpu_access);

include/drm/drm_gem_framebuffer_helper.h

+3 −7
Original line number Diff line number Diff line
@@ -4,8 +4,6 @@ 
#include <linux/dma-buf.h>

#include <linux/iosys-map.h>



#include <drm/drm_fourcc.h>



struct drm_afbc_framebuffer;

struct drm_device;

struct drm_fb_helper_surface_size;
@@ -39,11 +37,9 @@ struct drm_framebuffer * 
drm_gem_fb_create_with_dirty(struct drm_device *dev, struct drm_file *file,

			     const struct drm_mode_fb_cmd2 *mode_cmd);



int drm_gem_fb_vmap(struct drm_framebuffer *fb,

		    struct iosys_map map[static DRM_FORMAT_MAX_PLANES],

		    struct iosys_map data[DRM_FORMAT_MAX_PLANES]);

void drm_gem_fb_vunmap(struct drm_framebuffer *fb,

		       struct iosys_map map[static DRM_FORMAT_MAX_PLANES]);

int drm_gem_fb_vmap(struct drm_framebuffer *fb, struct iosys_map *map,

		    struct iosys_map *data);

void drm_gem_fb_vunmap(struct drm_framebuffer *fb, struct iosys_map *map);

int drm_gem_fb_begin_cpu_access(struct drm_framebuffer *fb, enum dma_data_direction dir);

void drm_gem_fb_end_cpu_access(struct drm_framebuffer *fb, enum dma_data_direction dir);