kernel/linux.git/drivers/gpu/drm/tiny, branch v6.1.168

drm/repaper: fix integer overflows in repeat functions

2025-04-25T08:43:56+00:00

commit 4d098000ac193f359e6b8ca4801dbdbd6a27b41f upstream. There are conditions, albeit somewhat unlikely, under which right hand expressions, calculating the end of time period in functions like repaper_frame_fixed_repeat(), may overflow. For instance, if 'factor10x' in repaper_get_temperature() is high enough (170), as is 'epd->stage_time' in repaper_probe(), then the resulting value of 'end' will not fit in unsigned int expression. Mitigate this by casting 'epd->factored_stage_time' to wider type before any multiplication is done. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. Fixes: 3589211e9b03 ("drm/tinydrm: Add RePaper e-ink driver") Cc: stable@vger.kernel.org Signed-off-by: Nikita Zhandarovich Signed-off-by: Alex Lanzano Link: https://patchwork.freedesktop.org/patch/msgid/20250116134801.22067-1-n.zhandarovich@fintech.ru Signed-off-by: Greg Kroah-Hartman

drm: gm12u320: Fix the timeout usage for usb_bulk_msg()

2023-09-23T09:11:08+00:00

[ Upstream commit 7583028d359db3cd0072badcc576b4f9455fd27a ] The timeout arg of usb_bulk_msg() is ms already, which has been converted to jiffies by msecs_to_jiffies() in usb_start_wait_urb(). So fix the usage by removing the redundant msecs_to_jiffies() in the macros. And as Hans suggested, also remove msecs_to_jiffies() for the IDLE_TIMEOUT macro to make it consistent here and so change IDLE_TIMEOUT to msecs_to_jiffies(IDLE_TIMEOUT) where it is used. Fixes: e4f86e437164 ("drm: Add Grain Media GM12U320 driver v2") Signed-off-by: Jinjie Ruan Suggested-by: Hans de Goede Reviewed-by: Hans de Goede Signed-off-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230904021421.1663892-1-ruanjinjie@huawei.com Signed-off-by: Sasha Levin

drm/repaper: Reduce temporary buffer size in repaper_fb_dirty()

2023-09-13T07:42:42+00:00

[ Upstream commit fedf429e071f6dbbe7a69dfc342492e037692018 ] As the temporary buffer is no longer used to store 8-bit grayscale data, its size can be reduced to the size needed to store the monochrome bitmap data. Fixes: 24c6bedefbe71de9 ("drm/repaper: Use format helper for xrgb8888 to monochrome conversion") Signed-off-by: Geert Uytterhoeven Reviewed-by: Javier Martinez Canillas Signed-off-by: Javier Martinez Canillas Link: https://patchwork.freedesktop.org/patch/msgid/20220317081830.1211400-6-geert@linux-m68k.org Signed-off-by: Sasha Levin

drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update()

2023-03-30T10:49:16+00:00

[ Upstream commit 7245e629dcaaf308f1868aeffa218e9849c77893 ] After having been compared to NULL value at cirrus.c:455, pointer 'pipe->plane.state->fb' is passed as 1st parameter in call to function 'cirrus_fb_blit_rect' at cirrus.c:461, where it is dereferenced at cirrus.c:316. Found by Linux Verification Center (linuxtesting.org) with SVACE. v2: * aligned commit message to line-length limits Signed-off-by: Alexandr Sapozhnikov Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230215171549.16305-1-alsp705@gmail.com Signed-off-by: Sasha Levin

drm/tiny: ili9486: Do not assume 8-bit only SPI controllers

2023-03-10T08:33:55+00:00

[ Upstream commit 77772e607522daa61f3af74df018559db75c43d6 ] The pixel data for the ILI9486 is always 16-bits wide and it must be sent over the SPI bus. When the controller is only able to deal with 8-bit transfers, this 16-bits data needs to be swapped before the sending to account for the big endian bus, this is on the contrary not needed when the SPI controller already supports 16-bits transfers. The decision about swapping the pixel data or not is taken in the MIPI DBI code by probing the controller capabilities: if the controller only suppors 8-bit transfers the data is swapped, otherwise it is not. This swapping/non-swapping is relying on the assumption that when the controller does support 16-bit transactions then the data is sent unswapped in 16-bits-per-word over SPI. The problem with the ILI9486 driver is that it is forcing 8-bit transactions also for controllers supporting 16-bits, violating the assumption and corrupting the pixel data. Align the driver to what is done in the MIPI DBI code by adjusting the transfer size to the maximum allowed by the SPI controller. Reviewed-by: Neil Armstrong Signed-off-by: Carlo Caione Reviewed-by: Kamlesh Gurudasani Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20221116-s905x_spi_ili9486-v4-2-f86b4463b9e4@baylibre.com Signed-off-by: Sasha Levin

drm/simpledrm: Synchronize access to GEM BOs

2022-09-27T08:27:00+00:00

Synchronize CPU access to GEM BOs with other drivers when updating the screen buffer. Imported buffers might otherwise contain stale data. Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Link: https://patchwork.freedesktop.org/patch/msgid/20220922130944.27138-6-tzimmermann@suse.de

drm/simpledrm: Iterate over damage clips

2022-09-27T08:26:57+00:00

Iterate over all damage clips and updated them one by one. Replaces the merging of damage areas, which can result in significant overhead if damage areas are not close to each other. Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Link: https://patchwork.freedesktop.org/patch/msgid/20220922130944.27138-5-tzimmermann@suse.de

drm/simpledrm: Remove !fb check from atomic_update

2022-09-27T08:26:37+00:00

The primary plane implements atomic_disable, so atomic_update will not be called without a framebuffer set. Remove the test for !fb. Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Link: https://patchwork.freedesktop.org/patch/msgid/20220922130944.27138-4-tzimmermann@suse.de

drm/simpledrm: Use drm_atomic_get_new_plane_state()

2022-09-27T08:25:22+00:00

Lookup the plane's state in atomic_update with the helper drm_atomic_get_new_plane_state(). Also rename the helpers' state arguments. No functional changes. Suggested-by: Ville Syrjälä Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Reviewed-by: Michael J. Ruhl Link: https://patchwork.freedesktop.org/patch/msgid/20220922130944.27138-3-tzimmermann@suse.de

drm/simpledrm: Compute linestride with drm_format_info_min_pitch()

2022-09-27T08:24:47+00:00

If not given, compute the stride with drm_format_info_min_pitch(). It's the standard helper for this purpose. Suggested-by: Daniel Vetter Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Fixes: fd9e3169e42b ("drm/simpledrm: Compute framebuffer stride if not set") Cc: Javier Martinez Canillas Cc: dri-devel@lists.freedesktop.org Link: https://patchwork.freedesktop.org/patch/msgid/20220922130944.27138-2-tzimmermann@suse.de