| Message ID | 20250211-dsc-10-bit-v1-1-1c85a9430d9a@somainline.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | drm/msm/dpu: Don't leak bits_per_component into random DSC_ENC fields | expand |
On 2/10/2025 3:19 PM, Marijn Suijten wrote: > What used to be the input_10_bits boolean - feeding into the lowest > bit of DSC_ENC - on MSM downstream turned into an accidental OR with > the full bits_per_component number when it was ported to the upstream > kernel. > > On typical bpc=8 setups we don't notice this because line_buf_depth is > always an odd value (it contains bpc+1) and will also set the 4th bit > after left-shifting by 3 (hence this |= bits_per_component is a no-op). > > Now that guards are being removed to allow more bits_per_component > values besides 8 (possible since commit 49fd30a7153b ("drm/msm/dsi: use > DRM DSC helpers for DSC setup")), a bpc of 10 will instead clash with > the 5th bit which is convert_rgb. This is "fortunately" also always set > to true by MSM's dsi_populate_dsc_params() already, but once a bpc of 12 > starts being used it'll write into simple_422 which is normally false. > > To solve all these overlaps, simply replicate downstream code and only > set this lowest bit if bits_per_component is equal to 10. It is unclear > why DSC requires this only for bpc=10 but not bpc=12, and also notice > that this lowest bit wasn't set previously despite having a panel and > patch on the list using it without any mentioned issues. > > Fixes: c110cfd1753e ("drm/msm/disp/dpu1: Add support for DSC") > Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org> > --- > drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > Good catch ! Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
On 11.02.2025 12:19 AM, Marijn Suijten wrote: > What used to be the input_10_bits boolean - feeding into the lowest > bit of DSC_ENC - on MSM downstream turned into an accidental OR with > the full bits_per_component number when it was ported to the upstream > kernel. > > On typical bpc=8 setups we don't notice this because line_buf_depth is > always an odd value (it contains bpc+1) and will also set the 4th bit > after left-shifting by 3 (hence this |= bits_per_component is a no-op). > > Now that guards are being removed to allow more bits_per_component > values besides 8 (possible since commit 49fd30a7153b ("drm/msm/dsi: use > DRM DSC helpers for DSC setup")), a bpc of 10 will instead clash with > the 5th bit which is convert_rgb. This is "fortunately" also always set > to true by MSM's dsi_populate_dsc_params() already, but once a bpc of 12 > starts being used it'll write into simple_422 which is normally false. > > To solve all these overlaps, simply replicate downstream code and only > set this lowest bit if bits_per_component is equal to 10. It is unclear > why DSC requires this only for bpc=10 but not bpc=12, and also notice > that this lowest bit wasn't set previously despite having a panel and > patch on the list using it without any mentioned issues. > > Fixes: c110cfd1753e ("drm/msm/disp/dpu1: Add support for DSC") > Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org> > --- Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Konrad
On Tue, Feb 11, 2025 at 12:19:32AM +0100, Marijn Suijten wrote: > What used to be the input_10_bits boolean - feeding into the lowest > bit of DSC_ENC - on MSM downstream turned into an accidental OR with > the full bits_per_component number when it was ported to the upstream > kernel. > > On typical bpc=8 setups we don't notice this because line_buf_depth is > always an odd value (it contains bpc+1) and will also set the 4th bit > after left-shifting by 3 (hence this |= bits_per_component is a no-op). > > Now that guards are being removed to allow more bits_per_component > values besides 8 (possible since commit 49fd30a7153b ("drm/msm/dsi: use > DRM DSC helpers for DSC setup")), a bpc of 10 will instead clash with > the 5th bit which is convert_rgb. This is "fortunately" also always set > to true by MSM's dsi_populate_dsc_params() already, but once a bpc of 12 > starts being used it'll write into simple_422 which is normally false. > > To solve all these overlaps, simply replicate downstream code and only > set this lowest bit if bits_per_component is equal to 10. It is unclear > why DSC requires this only for bpc=10 but not bpc=12, and also notice > that this lowest bit wasn't set previously despite having a panel and > patch on the list using it without any mentioned issues. > > Fixes: c110cfd1753e ("drm/msm/disp/dpu1: Add support for DSC") > Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org> > --- > drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
On Tue, 11 Feb 2025 00:19:32 +0100, Marijn Suijten wrote: > What used to be the input_10_bits boolean - feeding into the lowest > bit of DSC_ENC - on MSM downstream turned into an accidental OR with > the full bits_per_component number when it was ported to the upstream > kernel. > > On typical bpc=8 setups we don't notice this because line_buf_depth is > always an odd value (it contains bpc+1) and will also set the 4th bit > after left-shifting by 3 (hence this |= bits_per_component is a no-op). > > [...] Applied to msm-fixes, thanks! [1/1] drm/msm/dpu: Don't leak bits_per_component into random DSC_ENC fields https://gitlab.freedesktop.org/drm/msm/-/commit/144429831f44 Best regards,
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.c index 657200401f57635481a22f018ff00076dfd2ba34..cec6d4e8baec4d00282465cfd2885d365f835976 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.c @@ -52,6 +52,7 @@ static void dpu_hw_dsc_config(struct dpu_hw_dsc *hw_dsc, u32 slice_last_group_size; u32 det_thresh_flatness; bool is_cmd_mode = !(mode & DSC_MODE_VIDEO); + bool input_10_bits = dsc->bits_per_component == 10; DPU_REG_WRITE(c, DSC_COMMON_MODE, mode); @@ -68,7 +69,7 @@ static void dpu_hw_dsc_config(struct dpu_hw_dsc *hw_dsc, data |= (dsc->line_buf_depth << 3); data |= (dsc->simple_422 << 2); data |= (dsc->convert_rgb << 1); - data |= dsc->bits_per_component; + data |= input_10_bits; DPU_REG_WRITE(c, DSC_ENC, data);
What used to be the input_10_bits boolean - feeding into the lowest bit of DSC_ENC - on MSM downstream turned into an accidental OR with the full bits_per_component number when it was ported to the upstream kernel. On typical bpc=8 setups we don't notice this because line_buf_depth is always an odd value (it contains bpc+1) and will also set the 4th bit after left-shifting by 3 (hence this |= bits_per_component is a no-op). Now that guards are being removed to allow more bits_per_component values besides 8 (possible since commit 49fd30a7153b ("drm/msm/dsi: use DRM DSC helpers for DSC setup")), a bpc of 10 will instead clash with the 5th bit which is convert_rgb. This is "fortunately" also always set to true by MSM's dsi_populate_dsc_params() already, but once a bpc of 12 starts being used it'll write into simple_422 which is normally false. To solve all these overlaps, simply replicate downstream code and only set this lowest bit if bits_per_component is equal to 10. It is unclear why DSC requires this only for bpc=10 but not bpc=12, and also notice that this lowest bit wasn't set previously despite having a panel and patch on the list using it without any mentioned issues. Fixes: c110cfd1753e ("drm/msm/disp/dpu1: Add support for DSC") Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org> --- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- base-commit: 77969bdf11bca51038df66410338d088b327fc49 change-id: 20250211-dsc-10-bit-2228bd23bd07 Best regards,