Skip to content

rust: drm: gpuvm: Add a missing lock#433

Open
WhatAmISupposedToPutHere wants to merge 1468 commits intoAsahiLinux:asahi-wipfrom
WhatAmISupposedToPutHere:bo-put-lockep-fix
Open

rust: drm: gpuvm: Add a missing lock#433
WhatAmISupposedToPutHere wants to merge 1468 commits intoAsahiLinux:asahi-wipfrom
WhatAmISupposedToPutHere:bo-put-lockep-fix

Conversation

@WhatAmISupposedToPutHere

Lockdep complains otherwise:

------------[ cut here ]------------
WARNING: CPU: 5 PID: 885 at drivers/gpu/drm/drm_gpuvm.c:1620 drm_gpuvm_bo_put+0x1b4/0x254
Modules linked in: brcmfmac_wcc uhid overlay squashfs zlib_inflate brcmfmac hci_bcm4377 brcmutil spi_nor aop_las aop_als industrialio cfg80211 fuse nfn>
CPU: 5 UID: 1000 PID: 885 Comm: kwin_wayland Tainted: G S W 6.18.2+ #5 PREEMPTLAZY
Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN
Hardware name: Apple MacBook Pro (14-inch, M1 Pro, 2021) (DT)
pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : drm_gpuvm_bo_put+0x1b4/0x254
lr : drm_gpuvm_bo_put+0x14c/0x254
sp : ffff8000893d7c10
x29: ffff8000893d7c10 x28: ffff00001b8ef9c0 x27: 0000000000000000
x26: 0000000000000002 x25: ffff800081451000 x24: dead000000000100
x23: ffff800080ee82d0 x22: ffff0000108f9d50 x21: ffff0000108f9c00
x20: ffff0000492e0700 x19: ffff000048700000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000008 x13: 0000000000000000 x12: ffff8000815e34d0
x11: 0000000000000001 x10: 00000000ffffffff x9 : 0000000100000000
x8 : 0000000000000000 x7 : 0000000000000000 x6 : ffff8000807d2bcc
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
x2 : 0000000000000000 x1 : ffff000048700258 x0 : 0000000000000000
Call trace:
drm_gpuvm_bo_put+0x1b4/0x254 (P)
RINvNtCs1tcwcP3FgYC_4core3ptr13drop_in_placeINtNtNtCsgIauPoi8ikU_6kernel3drm2mm8NodeDatauNtNtCshTJcMxhWd7O_5asahi3mmu18KernelMappingInnerEEB1t+0xb0/>
RINvNtCs1tcwcP3FgYC_4core3ptr13drop_in_placeNtNtCshTJcMxhWd7O_5asahi4file2VmEBK+0xcc/0xf0
RNvMNtNtCsgIauPoi8ikU_6kernel3drm4fileINtB2_4FileNtNtCshTJcMxhWd7O_5asahi4file4FileE18postclose_callbackBP+0xac/0x2f4
drm_file_free+0x1b8/0x210
drm_release+0xb8/0x140
__fput+0xf8/0x2e4
fput_close_sync+0x44/0x114
__arm64_sys_close+0xb0/0xfc
invoke_syscall+0x48/0xc8
do_el0_svc+0x7c/0xa8
el0_svc+0x3c/0xd8
el0t_64_sync_handler+0x68/0xdc
el0t_64_sync+0x198/0x19c
---[ end trace 0000000000000000 ]---

jannau and others added 30 commits December 22, 2025 22:58
DCP best scored color mode might result in an HDR mode. As long as the
driver (and DRM) is not ready for HDR try to avoid such modes.

Signed-off-by: Janne Grunau <j@jannau.net>
Probably not important but avoids an unnecessary difference compared to
macOS.

Signed-off-by: Janne Grunau <j@jannau.net>
Can be used on devices with camera notch to use the full display height
and thus show the notch.

Signed-off-by: Janne Grunau <j@jannau.net>
This works on both 8-bit and 10-bit modes without any weirdness, and
gives us the native colorspace without any conversion. Color correction
should probably be handled in software anyway.

However, we need to use surface 1 (at least on t600x), since 0 seems
stuck in bg-sRGB mode for some reason...

Signed-off-by: Hector Martin <marcan@marcan.st>
With "drm/apple: Enable 10-bit mode & set colorspace to native" kernel
log messages are shown in an Apple logo shaped region in the middle of
the display when using BGRA.
The field currently identified as "opaque" is mislabeled and has to be
investigated further.

Signed-off-by: Janne Grunau <j@jannau.net>
- opaque -> is_premultiplied
- swap_enabled BIT(31) seems to be update background with
  dcp_swap.bg_color
- add unused fields is_tearing_allowed, ycbcr_matrix, protection_opts,
  unk_num, unk_denom

Changes: use is_premultiplied only for XRGB8/XBGR8, Update background
only when necessary.

Signed-off-by: Janne Grunau <j@jannau.net>
This does not seem to be as racy as drm_aperture_remove_framebuffers()
and seems to reliably takes over simpledrm's device node.

Signed-off-by: Janne Grunau <j@jannau.net>
This check for the "nomodeset" kernel command line parameter in its
register method.

Signed-off-by: Janne Grunau <j@jannau.net>
drm's documentaion explicitly tells us not to use devm_kzalloc(). drm
device structures might out live the device when they are in use by
userspace while the device vanishes.
There was a report of a race between DRM device registration (and
removal of the simpledrm device) and GDM startup.

The component based device binding ensures that all necessary devices
are bind in the probe method of the last missing component.

Technically the piodma-mapper should be a component of dcp but since it
is only used for its iommu it can be a component of the display
subsystem.

Signed-off-by: Janne Grunau <j@jannau.net>
Avoids "[drm] Cannot find any crtc or sizes" during fbdev initialization
if a display is connected.

Signed-off-by: Janne Grunau <j@jannau.net>
Signed-off-by: Janne Grunau <j@jannau.net>
Signed-off-by: Asahi Lina <lina@asahilina.net>
Signed-off-by: Asahi Lina <lina@asahilina.net>
Fixes following warning when systemd-backlight restores the backlight
level on boot before a mode is set:

Call trace:
  drm_atomic_helper_crtc_duplicate_state+0x58/0x74
  drm_atomic_get_crtc_state+0x84/0x120
  dcp_set_brightness+0xd8/0x21c [apple_dcp]
  backlight_device_set_brightness+0x78/0x130
  ...

Signed-off-by: Janne Grunau <j@jannau.net>
Backlight drivers are expected to use this instead of accessing
backlight properties.

Signed-off-by: Janne Grunau <j@jannau.net>
Fixes overwriting the panel's physical dimensions on poweroff/sleep.

Signed-off-by: Janne Grunau <j@jannau.net>
Signed-off-by: Asahi Lina <lina@asahilina.net>
Signed-off-by: Janne Grunau <j@jannau.net>
Signed-off-by: Janne Grunau <j@jannau.net>
This adds support for multiple incompatible DCP firmware versions.
The approach taken here duplicates more than necessary. Unmodified calls
do not need to be templated. For simplicity and in the expectation that
more calls and callbacks are modified in the future everything is
templated.

Signed-off-by: Janne Grunau <j@jannau.net>
MacOS 13.2 does the same and it is unclear if surf[3] can be used at
all. PRobably not necessary but found during debugging to firmware 13.2.

Signed-off-by: Janne Grunau <j@jannau.net>
kwin 5.27.3 adds support for "Night Color" via drm "CTM" properties.
Wire CTM support up via the "set_matrix" iomfb call.

Link: https://bugs.kde.org/show_bug.cgi?id=455720
Signed-off-by: Janne Grunau <j@jannau.net>
Signed-off-by: Hector Martin <marcan@marcan.st>
Signed-off-by: Hector Martin <marcan@marcan.st>
Signed-off-by: Hector Martin <marcan@marcan.st>
Signed-off-by: Hector Martin <marcan@marcan.st>
Signed-off-by: Hector Martin <marcan@marcan.st>
Signed-off-by: Janne Grunau <j@jannau.net>
jannau and others added 14 commits December 22, 2025 23:24
Under certain conditions (more prevalent after a suspend/resume cycle),
the touchscreen controller can send the "boot complete" interrupt before
it actually finished booting. In those cases, attempting to read touch
data resuls in a stream of "not ready" messages being read and
interpreted as a touch report. Check that the response is in fact a
touch report and discard it otherwise.

Reported-by: pitust <piotr@stelmaszek.com>
Closes: https://oftc.catirclogs.org/asahi/2025-12-17#34878715;
Fixes: 471a92f ("Input: apple_z2 - add a driver for Apple Z2 touchscreens")
Signed-off-by: Sasha Finkelstein <fnkl.kernel@gmail.com>
The next display might not the same and the EDID will not necessarily
be replaced on the next connect. This results in confused user space
with hilarious but broken results. In kwin it resulted in a gap between
two displays makling it impossible to move the mouse pointer to the
other display.

Signed-off-by: Janne Grunau <j@jannau.net>
This works around missing (or incomplete) suspend/resume handling in
atc/dcp for the the HDMI output on 14 and 16-inch Macbook Pros.

Signed-off-by: Janne Grunau <j@jannau.net>
Lockdep complains otherwise:

------------[ cut here ]------------
WARNING: CPU: 5 PID: 885 at drivers/gpu/drm/drm_gpuvm.c:1620 drm_gpuvm_bo_put+0x1b4/0x254
Modules linked in: brcmfmac_wcc uhid overlay squashfs zlib_inflate brcmfmac hci_bcm4377 brcmutil spi_nor aop_las aop_als industrialio cfg80211 fuse nfn>
CPU: 5 UID: 1000 PID: 885 Comm: kwin_wayland Tainted: G S      W           6.18.2+ AsahiLinux#5 PREEMPTLAZY
Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN
Hardware name: Apple MacBook Pro (14-inch, M1 Pro, 2021) (DT)
pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : drm_gpuvm_bo_put+0x1b4/0x254
lr : drm_gpuvm_bo_put+0x14c/0x254
sp : ffff8000893d7c10
x29: ffff8000893d7c10 x28: ffff00001b8ef9c0 x27: 0000000000000000
x26: 0000000000000002 x25: ffff800081451000 x24: dead000000000100
x23: ffff800080ee82d0 x22: ffff0000108f9d50 x21: ffff0000108f9c00
x20: ffff0000492e0700 x19: ffff000048700000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000008 x13: 0000000000000000 x12: ffff8000815e34d0
x11: 0000000000000001 x10: 00000000ffffffff x9 : 0000000100000000
x8 : 0000000000000000 x7 : 0000000000000000 x6 : ffff8000807d2bcc
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
x2 : 0000000000000000 x1 : ffff000048700258 x0 : 0000000000000000
Call trace:
 drm_gpuvm_bo_put+0x1b4/0x254 (P)
 _RINvNtCs1tcwcP3FgYC_4core3ptr13drop_in_placeINtNtNtCsgIauPoi8ikU_6kernel3drm2mm8NodeDatauNtNtCshTJcMxhWd7O_5asahi3mmu18KernelMappingInnerEEB1t_+0xb0/>
 _RINvNtCs1tcwcP3FgYC_4core3ptr13drop_in_placeNtNtCshTJcMxhWd7O_5asahi4file2VmEBK_+0xcc/0xf0
 _RNvMNtNtCsgIauPoi8ikU_6kernel3drm4fileINtB2_4FileNtNtCshTJcMxhWd7O_5asahi4file4FileE18postclose_callbackBP_+0xac/0x2f4
 drm_file_free+0x1b8/0x210
 drm_release+0xb8/0x140
 __fput+0xf8/0x2e4
 fput_close_sync+0x44/0x114
 __arm64_sys_close+0xb0/0xfc
 invoke_syscall+0x48/0xc8
 do_el0_svc+0x7c/0xa8
 el0_svc+0x3c/0xd8
 el0t_64_sync_handler+0x68/0xdc
 el0t_64_sync+0x198/0x19c
---[ end trace 0000000000000000 ]---

Signed-off-by: Sasha Finkelstein <fnkl.kernel@gmail.com>
@jannau
Copy link
Member

jannau commented Jan 1, 2026

manually merged to my local bits/210-gpu

iirc I tried to replace the resv lock here with the gpuva lock which resulting in the object being gone at unlock time. The dma_resv_lock probably prevents this. The safety comment is non-sense but this is going to change anyway when we rebase onto the upstream gpuvm bindings.

@jannau jannau closed this Jan 1, 2026
@jannau
Copy link
Member

jannau commented Jan 3, 2026

This still causea NULL pointer derefs under some conditions. Probably the same why it was missing in the first place. I hope this will be fixed by switching to Alice upstream submitted GPUVM abstractions. In the meantime I'll revert.
oops seen by @chadmed:

Jan 03 12:09:28 setsuna kernel: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000140
Jan 03 12:09:28 setsuna kernel: Mem abort info:
Jan 03 12:09:28 setsuna kernel:   ESR = 0x0000000096000004
Jan 03 12:09:28 setsuna kernel:   EC = 0x25: DABT (current EL), IL = 32 bits
Jan 03 12:09:28 setsuna kernel:   SET = 0, FnV = 0
Jan 03 12:09:28 setsuna kernel:   EA = 0, S1PTW = 0
Jan 03 12:09:28 setsuna kernel:   FSC = 0x04: level 0 translation fault
Jan 03 12:09:28 setsuna kernel: Data abort info:
Jan 03 12:09:28 setsuna kernel:   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
Jan 03 12:09:28 setsuna kernel:   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
Jan 03 12:09:28 setsuna kernel:   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
Jan 03 12:09:28 setsuna kernel: user pgtable: 16k pages, 48-bit VAs, pgdp=00000100141e1550
Jan 03 12:09:28 setsuna kernel: [0000000000000140] pgd=0000000000000000, p4d=0000000000000000
Jan 03 12:09:28 setsuna kernel: Internal error: Oops: 0000000096000004 [#1]  SMP
Jan 03 12:09:28 setsuna kernel: Modules linked in: hid_apple joydev usbhid apple_mfi_fastcharge ofpart snd_soc_cs42l84 spi_n>
Jan 03 12:09:28 setsuna kernel: CPU: 10 UID: 219 PID: 1223 Comm: kwin_wayland Tainted: G S      W           6.18.3+ #70 PREE>
Jan 03 12:09:28 setsuna kernel: Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN
Jan 03 12:09:28 setsuna kernel: Hardware name: Apple Mac Studio (M2 Max, 2023) (DT)
Jan 03 12:09:28 setsuna kernel: pstate: 21400009 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
Jan 03 12:09:28 setsuna kernel: pc : mutex_unlock+0x1c/0x70
Jan 03 12:09:28 setsuna kernel: lr : _RNvXs3_NtCsaW4QkOChsom_5asahi3gemNtB5_11AsahiObjectNtNtNtCskkDrWRDAWcV_6kernel3drm3gem>
Jan 03 12:09:28 setsuna kernel: sp : ffff8000824e79f0
Jan 03 12:09:28 setsuna kernel: x29: ffff8000824e79f0 x28: 0000000000000000 x27: ffff00000ff41800
Jan 03 12:09:28 setsuna kernel: x26: ffff0000107d8100 x25: ffff00003b5fcc00 x24: ffff0000107d8000
Jan 03 12:09:28 setsuna kernel: x23: 0000000000000008 x22: 0000000000000001 x21: ffff00000c9d2c00
Jan 03 12:09:28 setsuna kernel: x20: ffff00003b5ffc00 x19: ffff00000ffb4e00 x18: 0000000000000000
Jan 03 12:09:28 setsuna kernel: x17: 0000000000000000 x16: ffffd6fa2cf6a664 x15: 0000ffffc247c5b0
Jan 03 12:09:28 setsuna kernel: x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
Jan 03 12:09:28 setsuna kernel: x11: 0000000000000000 x10: 0000000000000000 x9 : ffff000014740000
Jan 03 12:09:28 setsuna kernel: x8 : ffff000014740000 x7 : 0000000000000000 x6 : 000000000000003f
Jan 03 12:09:28 setsuna kernel: x5 : 0000000000000040 x4 : 0000000000000000 x3 : 0000000000000000
Jan 03 12:09:28 setsuna kernel: x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000140
Jan 03 12:09:28 setsuna kernel: Call trace:
Jan 03 12:09:28 setsuna kernel:  mutex_unlock+0x1c/0x70 (P)
Jan 03 12:09:28 setsuna kernel:  _RNvXs3_NtCsaW4QkOChsom_5asahi3gemNtB5_11AsahiObjectNtNtNtCskkDrWRDAWcV_6kernel3drm3gem12Dr>
Jan 03 12:09:28 setsuna kernel:  drm_gem_object_release_handle.llvm.1832976210900478424+0x3c/0xe0
Jan 03 12:09:28 setsuna kernel:  drm_gem_handle_delete+0x64/0x9c
Jan 03 12:09:28 setsuna kernel:  drm_gem_close_ioctl+0x30/0x54
Jan 03 12:09:28 setsuna kernel:  drm_ioctl_kernel+0xc8/0x120
Jan 03 12:09:28 setsuna kernel:  drm_ioctl+0x2d0/0x4b0
Jan 03 12:09:28 setsuna kernel:  __arm64_sys_ioctl+0x93c/0xadc
Jan 03 12:09:28 setsuna kernel:  invoke_syscall+0x48/0xd4
Jan 03 12:09:28 setsuna kernel:  do_el0_svc+0x7c/0xbc
Jan 03 12:09:28 setsuna kernel:  el0_svc+0x40/0x1a8
Jan 03 12:09:28 setsuna kernel:  el0t_64_sync_handler+0x84/0x13c
Jan 03 12:09:28 setsuna kernel:  el0t_64_sync+0x198/0x19c
Jan 03 12:09:28 setsuna kernel: Code: d5384108 d503201f aa0803e9 aa1f03ea (c8a9fc0a) 
Jan 03 12:09:28 setsuna kernel: ---[ end trace 0000000000000000 ]---

@jannau jannau reopened this Jan 3, 2026
jannau added a commit that referenced this pull request Jan 3, 2026
This reverts commit 0475333.

due to NULL ptr deref, see #433

Signed-off-by: Janne Grunau <j@jannau.net>
jannau added a commit that referenced this pull request Jan 9, 2026
This reverts commit 0475333.

due to NULL ptr deref, see #433

Signed-off-by: Janne Grunau <j@jannau.net>
@jannau jannau force-pushed the asahi-wip branch 2 times, most recently from d9f615d to 33ef1b6 Compare January 20, 2026 22:38
herrnst pushed a commit to herrnst/linux-asahi that referenced this pull request Feb 5, 2026
This reverts commit 0475333.

due to NULL ptr deref, see AsahiLinux/linux#433

Signed-off-by: Janne Grunau <j@jannau.net>
@jannau jannau force-pushed the asahi-wip branch 2 times, most recently from 0031cb6 to 79a307d Compare February 14, 2026 20:09
@jannau jannau force-pushed the asahi-wip branch 2 times, most recently from 7457799 to 89c915d Compare March 1, 2026 16:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.