From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 2E5B7C531C9 for ; Sat, 25 Jul 2026 05:16:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: References:In-Reply-To:Cc:To:Subject:From:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=RH9bpn+u99V6fwp8k6xTnFB2qgPoVDfoDF1gjk985Pw=; b=Meqf03PFzI4xsA zwPpa/zuCjLAVJlZtHVkiKD6aSQNjgdrhhBQ1n8Fs8CCfX4Uettn/bSar9X8+GhMsjrwagDJUgvBZ Rj8D+wUap5c0OuWkk352/EBx51D0hpTYkllCUS31trnypdozj7KitF1LA0zGBr+Us+nxrVENu1GiS MeHG+l5qUiqP12vvRcF/YPTfP6noJqaFalRuiabpm2AMmE4oKrgfiGxj01zVVqBwbxXatd/mTUrpp X62NotCmgqMVZfLXD2roj+9phad8pz0EvyygOzxk+yF1olE8MpjouAXnta24BKFsXJdJRZI+WWhk1 G+JOOdLvYD9Y7/lALAUQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wnUkO-000000003tX-2xyb; Sat, 25 Jul 2026 05:16:28 +0000 Received: from tor.source.kernel.org ([2600:3c04:e001:324:0:1991:8:25]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wnUkO-000000003tO-016Z for linux-phy@lists.infradead.org; Sat, 25 Jul 2026 05:16:28 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by tor.source.kernel.org (Postfix) with ESMTP id 61B5B60A77; Sat, 25 Jul 2026 05:16:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9AE561F000E9; Sat, 25 Jul 2026 05:16:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784956587; bh=smB236X8XNJqOB0/6cz9B1Uf3icxzbvnX/NRFA+C+hA=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=Ixww+LbDqOB7nhukK4bNMJfw6x4osZM6BvYUrH9FDKFfceuxfS1PWhqSg0VznYo5t RvNuJ2NZVbM8sKpYEj3A6TLRFU731F3JE0gEV6lbU0lz2Q6sFQmetzkAbxiIZ5gMTC DIc6fWo7r7cPjiWiSUhIvwRrgVt22jW1o9rgS/mpoFrEwHT+kCUB3FP0eIB3RDDueC Sna65R9QhVVKuzsz9MmLPVOkoFy7M8DcAx5NhlZ4+BygrgGycz+dllkt2AmRWdf7q4 e3ersTBsrPDBC6m14gxOXzf+g8eFZhYLsD9PjXX+mmLifrfb6aaJaPR5sXy1hTrC9N KUo4jhy1giiMA== From: sashiko-bot@kernel.org Subject: Re: [PATCH 08/17] drm/spacemit: add Saturn DPU core types, cmdlist and display MMU To: "Cody Kang" Cc: devicetree@vger.kernel.org, linux-phy@lists.infradead.org, dri-devel@lists.freedesktop.org, neil.armstrong@linaro.org, conor+dt@kernel.org, vkoul@kernel.org, robh@kernel.org, olteanv@gmail.com In-Reply-To: <20260724-k3-display-v1-8-f22a10a52867@gmail.com> References: <20260724-k3-display-v1-0-f22a10a52867@gmail.com> <20260724-k3-display-v1-8-f22a10a52867@gmail.com> Date: Sat, 25 Jul 2026 05:16:26 +0000 Message-Id: <20260725051626.9AE561F000E9@smtp.kernel.org> X-BeenThere: linux-phy@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Linux Phy Mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-phy" Errors-To: linux-phy-bounces+linux-phy=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg NiBwb3RlbnRpYWwgaXNzdWUocykgdG8gY29uc2lkZXI6Ci0gW0hpZ2hdIFBhc3NpbmcgZXhoYXVz dGVkIE5VTEwgcG9pbnRlciB0byBoYXJkd2FyZSBwcm9ncmFtbWluZyBmdW5jdGlvbi4KLSBbSGln aF0gTlVMTCBwb2ludGVyIGRlcmVmZXJlbmNlIHdoZW4gYWNjZXNzaW5nIHN0YXRlIGZvciBkaXNh YmxlZCBwbGFuZXMgZHVlIHRvIHN0YWxlIGBpbl91c2VgIGZsYWcuCi0gW0hpZ2hdIERNTVUgcGFn ZSB0YWJsZXMgbWFwIG11bHRpLXBsYW5hciBmcmFtZWJ1ZmZlcnMgb3V0LW9mLWJvdW5kcyBieSBl eGNsdXNpdmVseSB1c2luZyB0aGUgZmlyc3QgR0VNIG9iamVjdC4KLSBbSGlnaF0gSGFyZHdhcmUg RE1BIHN0YXRlIGJ1ZmZlcnMgYXJlIHJldXNlZCBhY3Jvc3MgYXRvbWljIGNvbW1pdHMgd2l0aG91 dCBkb3VibGUtYnVmZmVyaW5nLgotIFtIaWdoXSBNaXNzaW5nIGJvdW5kcyBjaGVjayBpbiBgY21k bGlzdF9yZWdzX3BhY2tpbmdgIGNhdXNlcyBETUEgYnVmZmVyIG92ZXJmbG93LgotIFtNZWRpdW1d IFVuY29uZGl0aW9uYWwgZGVyZWZlcmVuY2Ugb2YgYGZiYCBpbiBgZHB1X3BsYW5lX2luZm9gIHRy YWNlcG9pbnQuCi0tCgotLS0gUGF0Y2ggWzhdOiBbUEFUQ0ggMDgvMTddIGRybS9zcGFjZW1pdDog YWRkIFNhdHVybiBEUFUgY29yZSB0eXBlcywgY21kbGlzdCBhbmQgZGlzcGxheSBNTVUgLS0tCmNv bW1pdCA4MmYwNTk2Y2E2NWZmOTZlMjA4MTY0NmRjY2FiMzdmN2JiOWQxYzBjCkF1dGhvcjogQ29k eSBLYW5nIDxjb2R5a2FuZy5oa0BnbWFpbC5jb20+ClN1YmplY3Q6IGRybS9zcGFjZW1pdDogYWRk IFNhdHVybiBEUFUgY29yZSB0eXBlcywgY21kbGlzdCBhbmQgZGlzcGxheSBNTVUKClRoaXMgY29t bWl0IGludHJvZHVjZXMgdGhlIFNhdHVybiBEUFUgZHJpdmVyIGNvcmUgdHlwZXMsIHJlZ2lzdGVy IGFjY2Vzc29ycywKYW5kIE1NVSB0YWJsZSBjb2RlLiBJdCBpbXBsZW1lbnRzIGEgYmF0Y2hlZCBy ZWdpc3RlciBwcm9ncmFtbWluZyBtb2RlbCB1c2luZwppbi1tZW1vcnkgY29tbWFuZCBsaXN0cyBt YXBwZWQgdGhyb3VnaCB0aGUgRFBVJ3MgcHJpdmF0ZSBhZGRyZXNzIHRyYW5zbGF0aW9uCnVuaXQu Cgo+IGRpZmYgLS1naXQgYS9kcml2ZXJzL2dwdS9kcm0vc3BhY2VtaXQvZHB1L2RwdV90cmFjZS5o IGIvZHJpdmVycy9ncHUvZHJtL3NwYWNlbWl0L2RwdS9kcHVfdHJhY2UuaAo+IG5ldyBmaWxlIG1v ZGUgMTAwNjQ0Cj4gaW5kZXggMDAwMDAwMDAwMDAwMC4uYWJmZTM0YTY3YTRiZAo+IC0tLSAvZGV2 L251bGwKPiArKysgYi9kcml2ZXJzL2dwdS9kcm0vc3BhY2VtaXQvZHB1L2RwdV90cmFjZS5oClsg Li4uIF0KPiArVFJBQ0VfRVZFTlQoZHB1X3BsYW5lX2luZm8sCj4gKwkgICAgVFBfUFJPVE8oc3Ry dWN0IGRybV9wbGFuZV9zdGF0ZSAqc3RhdGUsIHN0cnVjdCBkcm1fZnJhbWVidWZmZXIgKmZiLAo+ ICsJCSAgICAgdTMyIHJkbWFfaWQsIHUzMiBhbHBoYSwgdTMyIHJvdGF0aW9uKSwKPiArCVRQX0FS R1Moc3RhdGUsIGZiLCByZG1hX2lkLCBhbHBoYSwgcm90YXRpb24pLAo+ICsJVFBfU1RSVUNUX19l bnRyeSgKPiArCQkJX19maWVsZCh1MzIsIHJkbWFfaWQpCj4gKwkJCV9fZmllbGQodTMyLCBzcmNf dykKPiArCQkJX19maWVsZCh1MzIsIHNyY19oKQo+ICsJCQlfX2ZpZWxkKHUzMiwgc3JjX3gpCj4g KwkJCV9fZmllbGQodTMyLCBzcmNfeSkKPiArCQkJX19maWVsZCh1MzIsIGNydGNfdykKPiArCQkJ X19maWVsZCh1MzIsIGNydGNfaCkKPiArCQkJX19maWVsZCh1MzIsIGNydGNfeCkKPiArCQkJX19m aWVsZCh1MzIsIGNydGNfeSkKPiArCQkJX19maWVsZCh1MzIsIHdpZHRoKQo+ICsJCQlfX2ZpZWxk KHUzMiwgaGVpZ2h0KQo+ICsJCQlfX2ZpZWxkKHUzMiwgZm9ybWF0KQo+ICsJCQlfX2ZpZWxkKHUz MiwgYmxlbmRfbW9kZSkKPiArCQkJX19maWVsZCh1MzIsIGFscGhhKQo+ICsJCQlfX2ZpZWxkKHUz MiwgenBvcykKPiArCQkJX19maWVsZCh1MzIsIHJvdGF0aW9uKQo+ICsJKSwKPiArCVRQX2Zhc3Rf YXNzaWduKAo+ICsJCQlfX2VudHJ5LT5yZG1hX2lkID0gcmRtYV9pZDsKPiArCQkJX19lbnRyeS0+ c3JjX3cgPSBzdGF0ZS0+c3JjX3cgPj4gMTY7Cj4gKwkJCV9fZW50cnktPnNyY19oID0gc3RhdGUt PnNyY19oID4+IDE2Owo+ICsJCQlfX2VudHJ5LT5zcmNfeCA9IHN0YXRlLT5zcmNfeCA+PiAxNjsK PiArCQkJX19lbnRyeS0+c3JjX3kgPSBzdGF0ZS0+c3JjX3kgPj4gMTY7Cj4gKwkJCV9fZW50cnkt PmNydGNfdyA9IHN0YXRlLT5jcnRjX3c7Cj4gKwkJCV9fZW50cnktPmNydGNfaCA9IHN0YXRlLT5j cnRjX2g7Cj4gKwkJCV9fZW50cnktPmNydGNfeCA9IHN0YXRlLT5jcnRjX3g7Cj4gKwkJCV9fZW50 cnktPmNydGNfeSA9IHN0YXRlLT5jcnRjX3k7Cj4gKwkJCV9fZW50cnktPndpZHRoID0gZmItPndp ZHRoOwo+ICsJCQlfX2VudHJ5LT5oZWlnaHQgPSBmYi0+aGVpZ2h0Owo+ICsJCQlfX2VudHJ5LT5m b3JtYXQgPSBmYi0+Zm9ybWF0LT5mb3JtYXQ7CgpbU2V2ZXJpdHk6IE1lZGl1bV0KSWYgdGhpcyB0 cmFjZXBvaW50IGZpcmVzIGR1cmluZyBhIHBsYW5lIGRpc2FibGUgb3BlcmF0aW9uLCB3aWxsIHRo ZSBmYgpwYXJhbWV0ZXIgYmUgTlVMTD8gU2luY2Ugc3RhdGUtPmZiIGlzIHR5cGljYWxseSBOVUxM IGR1cmluZyBhIGRpc2FibGUsIGl0Cmxvb2tzIGxpa2UgZXZhbHVhdGluZyBmYi0+Zm9ybWF0LT5m b3JtYXQgaGVyZSBjb3VsZCBjYXVzZSBhIGtlcm5lbCBwYW5pYwp3aGVuIHRyYWNpbmcgaXMgZW5h YmxlZC4KCj4gKwkJCV9fZW50cnktPmJsZW5kX21vZGUgPSBzdGF0ZS0+cGl4ZWxfYmxlbmRfbW9k ZTsKPiArCQkJX19lbnRyeS0+YWxwaGEgPSBhbHBoYTsKPiArCQkJX19lbnRyeS0+enBvcyA9IHN0 YXRlLT56cG9zOwo+ICsJCQlfX2VudHJ5LT5yb3RhdGlvbiA9IHJvdGF0aW9uOwo+ICsJKSwKPiAr CVRQX3ByaW50aygicmRtYV9pZD0lZCBzcmM6IHc9JWQgaD0lZCB4PSVkIHk9JWQgY3J0Yzogdz0l ZCBoPSVkIHg9JWQgeT0lZCB3aWR0aD0lZCBoZWlnaHQ9JWQgZm10PTB4JXggYmxlbmQ9JWQgYWxw aGE9JWQgenBvcz0lZCByb3Q9JWQiLApbIC4uLiBdCj4gZGlmZiAtLWdpdCBhL2RyaXZlcnMvZ3B1 L2RybS9zcGFjZW1pdC9zcGFjZW1pdF9jbWRsaXN0LmMgYi9kcml2ZXJzL2dwdS9kcm0vc3BhY2Vt aXQvc3BhY2VtaXRfY21kbGlzdC5jCj4gbmV3IGZpbGUgbW9kZSAxMDA2NDQKPiBpbmRleCAwMDAw MDAwMDAwMDAwLi43ODdkMzhlOWUxMzVmCj4gLS0tIC9kZXYvbnVsbAo+ICsrKyBiL2RyaXZlcnMv Z3B1L2RybS9zcGFjZW1pdC9zcGFjZW1pdF9jbWRsaXN0LmMKWyAuLi4gXQo+ICt2b2lkIGNtZGxp c3RfcmVnc19wYWNraW5nKHN0cnVjdCBjbWRsaXN0ICpjbCwgZW51bSBjbWRsaXN0X21vZGVfdHlw ZSBtb2QsCj4gKwkJCSAgc3RydWN0IGNtZGxpc3RfcmVncyAqY2xfcmVncykKPiArewpbIC4uLiBd Cj4gKwkJaWYgKGNsX3JlZ3MtPmZsYWdzW2ldKSB7Cj4gKwkJCW9mZnNldCA9IGNsX3JlZ3MtPmJh c2UgKyBpICogc2l6ZW9mKHUzMik7Cj4gKwkJCWZvciAodTggaiA9IDA7IGogPCBDTURMSVNUX1JP V19SRUdTOyBqKyspIHsKPiArCQkJCWluZGV4ID0gaSArIGo7Cj4gKwkJCQlpZiAobGlrZWx5KGlu ZGV4IDwgY2xfcmVncy0+c2l6ZSkpIHsKPiArCQkJCQlpZiAoY2xfcmVncy0+ZmxhZ3NbaW5kZXhd KSB7Cj4gKwkJCQkJCXZhbHVlW2pdID0gcmVnX2Jhc2VbaW5kZXhdOwo+ICsJCQkJCQlyZWdzX2lu X3JvdysrOwo+ICsJCQkJCQlzdHJvYmUgfD0gQ01ETElTVF9SRUdfU1RST0JFKGopOwo+ICsJCQkJ CX0KPiArCQkJCX0gZWxzZSB7Cj4gKwkJCQkJYnJlYWs7Cj4gKwkJCQl9Cj4gKwkJCX0KPiArCQkJ aHdkZXYtPmNtZGxpc3RfZmlsbF9kYXRhX3JvdyhjbCwgc3Ryb2JlLCBvZmZzZXQsIHZhbHVlKTsK PiArCQkJLyoKPiArCQkJICogdGhlIHJvdyBjb3ZlcnMgdGhlIHdob2xlIHdpbmRvdzsgYSBzaG9y dGVyIHN0cmlkZQo+ICsJCQkgKiB3b3VsZCByZXZpc2l0IGNvdmVyZWQgd29yZHMgYXMgZHVwbGlj YXRlIHJvd3MKPiArCQkJICovCj4gKwkJCWkgKz0gQ01ETElTVF9ST1dfUkVHUzsKPiArCQkJY2wt Pm5vZF9sZW4rKzsKCltTZXZlcml0eTogSGlnaF0KSXMgdGhlcmUgYSBib3VuZHMgY2hlY2sgbWlz c2luZyBoZXJlIHRvIHByZXZlbnQgY2wtPm5vZF9sZW4gZnJvbSBleGNlZWRpbmcKY2wtPnNpemU/ IElmIGNsIGlzIHNoYWxsb3ctY29waWVkIGFuZCByZXVzZWQgYWNyb3NzIGNvbW1pdHMsIG5vZF9s ZW4gbWlnaHQKYWNjdW11bGF0ZSBhbmQgZXZlbnR1YWxseSBvdmVyZmxvdyB0aGUgNDA5Ni1ieXRl IERNQSBidWZmZXIsIG92ZXJ3cml0aW5nCmFkamFjZW50IHBoeXNpY2FsIG1lbW9yeS4KCj4gKwkJ fSBlbHNlIHsKPiArCQkJaSsrOwo+ICsJCX0KPiArCX0KPiArCj4gKwlkcm1fZGJnKGFfY3J0Yy0+ Y3J0Yy5kZXYsICJyb3dfbnVtID0gJWRcbiIsIGNsLT5ub2RfbGVuKTsKPiArfQpbIC4uLiBdCj4g K3ZvaWQgY21kbGlzdF9hdG9taWNfY29tbWl0KHN0cnVjdCBkcm1fY3J0YyAqY3J0YywKPiArCQkJ ICAgc3RydWN0IGRybV9jcnRjX3N0YXRlICpvbGRfc3RhdGUpCj4gK3sKPiArCWludCBpOwo+ICsJ c3RydWN0IGNtZGxpc3QgKmN1cl9jbCwgKmZpcnN0X2NsOwo+ICsJc3RydWN0IHNwYWNlbWl0X2Ny dGMgKmFfY3J0YyA9IE5VTEw7Cj4gKwl1MzIgY2h5LCBhZGRybCwgYWRkcmg7Cj4gKwlzdHJ1Y3Qg c3BhY2VtaXRfZHJtX3ByaXZhdGUgKnByaXYgPSBjcnRjLT5kZXYtPmRldl9wcml2YXRlOwo+ICsJ c3RydWN0IHNwYWNlbWl0X2h3X2RldmljZSAqaHdkZXYgPSBwcml2LT5od2RldjsKPiArCXN0cnVj dCBzcGFjZW1pdF9jcnRjX3JkbWEgKmN1cl9yZG1hcyA9Cj4gKwkJCXRvX3NwYWNlbWl0X2NydGNf c3RhdGUoY3J0Yy0+c3RhdGUpLT5yZG1hczsKPiArCXN0cnVjdCBzcGFjZW1pdF9jcnRjX3JkbWEg Km9sZF9yZG1hcyA9Cj4gKwkJCXRvX3NwYWNlbWl0X2NydGNfc3RhdGUob2xkX3N0YXRlKS0+cmRt YXM7Cj4gKwo+ICsJYV9jcnRjID0gdG9fc3BhY2VtaXRfY3J0YyhjcnRjKTsKPiArCj4gKwlmb3Ig KGkgPSAwOyBpIDwgaHdkZXYtPnJkbWFfbnVtczsgaSsrKSB7Cj4gKwkJaWYgKG9sZF9yZG1hc1tp XS5pbl91c2UpCj4gKwkJCWh3ZGV2LT5lbmFibGVfY21kbGlzdChhX2NydGMsIGh3ZGV2LCBpLCBm YWxzZSk7Cj4gKwo+ICsJCWlmIChjdXJfcmRtYXNbaV0uaW5fdXNlKSB7Cj4gKwkJCWRybV9kYmco Y3J0Yy0+ZGV2LCAiY21kbGlzdCBncm91cCA9ICVkXG4iLCBpKTsKPiArCQkJY3VyX2NsID0gcHJp di0+Y21kbGlzdF9ncm91cHNbaV07Cj4gKwkJCWZpcnN0X2NsID0gY3VyX2NsOwo+ICsJCQl3aGls ZSAoY3VyX2NsKSB7Cj4gKwkJCQlod2Rldi0+Y21kbGlzdF9maWxsX2NvbmZfcm93KGN1cl9jbCwg aHdkZXYsCj4gKwkJCQkJQ01ETElTVF9DTVBfSU5WQUxJRCk7Cj4gKwkJCQljbWRsaXN0X2R1bXBf bm9kZShjdXJfY2wpOwo+ICsJCQkJY3VyX2NsID0gY3VyX2NsLT5uZXh0Owo+ICsJCQl9Cj4gKwkJ CWNoeSA9IGNsX3RvX3NwYWNlbWl0X3BzdGF0ZShmaXJzdF9jbCktPnN0YXRlLmNydGNfeTsKCltT ZXZlcml0eTogSGlnaF0KQ291bGQgZmlyc3RfY2wgYmUgTlVMTCBoZXJlIGZvciBhIGRpc2FibGVk IHBsYW5lPyBEdXJpbmcgYXRvbWljIHN0YXRlCmR1cGxpY2F0aW9uLCBpdCBzZWVtcyB0aGUgaW5f dXNlIGZsYWcgaXMgaW5oZXJpdGVkLiBJZiBhIHBsYW5lIGlzIGRpc2FibGVkLAppdCBpcyByZW1v dmVkIGZyb20gdGhlIHBsYW5lX21hc2sgYW5kIGNtZGxpc3Rfc29ydF9ieV9ncm91cCBza2lwcyBj bGVhcmluZwp0aGUgZmxhZy4gVGhpcyB3b3VsZCBjYXVzZSBjdXJfY2wgYW5kIGZpcnN0X2NsIHRv IGJlIE5VTEwsIGxlYWRpbmcKY2xfdG9fc3BhY2VtaXRfcHN0YXRlIHRvIGFwcGx5IGNvbnRhaW5l cl9vZiB0byBhIE5VTEwgcG9pbnRlciBhbmQgdHJpZ2dlciBhCm5lZ2F0aXZlIG9mZnNldCBkZXJl ZmVyZW5jZS4KCj4gKwkJCWFkZHJsID0gKGxvd2VyXzMyX2JpdHMocHJpdi0+Y21kbGlzdF9ncm91 cHNbaV0tPnBhKSAmCj4gKwkJCQkgQ01ETElTVF9BRERSTF9BTElHTl9NQVNLKSA+PiBDTURMSVNU X0FERFJMX0FMSUdOX0JJVFM7Cj4gKwo+ICsJCQlhZGRyaCA9IHVwcGVyXzMyX2JpdHMocHJpdi0+ Y21kbGlzdF9ncm91cHNbaV0tPnBhKTsKPiArCQkJaHdkZXYtPmNmZ19jbWRsaXN0KGh3ZGV2LCBp LCBjaHksIGFkZHJsLCBhZGRyaCk7Cj4gKwkJCWh3ZGV2LT5lbmFibGVfY21kbGlzdChhX2NydGMs IGh3ZGV2LCBpLCB0cnVlKTsKPiArCQkJcHJpdi0+Y21kbGlzdF9ncm91cHNbaV0gPSBOVUxMOwo+ ICsJCX0KPiArCX0KPiArfQpbIC4uLiBdCj4gK3ZvaWQgY3J0Y19jbWRsaXN0X2F0b21pY19jb21t aXQoc3RydWN0IHNwYWNlbWl0X2NydGMgKmFfY3J0YykKPiArewo+ICsJc3RydWN0IGNtZGxpc3Qg KmN1cl9jbDsKPiArCXN0cnVjdCBkcm1fY3J0YyAqY3J0YyA9ICZhX2NydGMtPmNydGM7Cj4gKwlz dHJ1Y3Qgc3BhY2VtaXRfZHJtX3ByaXZhdGUgKnByaXYgPSBjcnRjLT5kZXYtPmRldl9wcml2YXRl Owo+ICsJc3RydWN0IHNwYWNlbWl0X2h3X2RldmljZSAqaHdkZXYgPSBwcml2LT5od2RldjsKPiAr CXU4IGNydGNfaWQgPSBkcm1fY3J0Y19pbmRleChjcnRjKTsKPiArCXU4IGRldl9pZCA9IGFfY3J0 Yy0+ZGV2X2lkOwo+ICsKPiArCWRybV9kYmcoY3J0Yy0+ZGV2LCAiY21kbGlzdCBncm91cCA9ICVk XG4iLAo+ICsJCWh3ZGV2LT5yZG1hX251bXMgKyBjcnRjX2lkKTsKPiArCWN1cl9jbCA9IHByaXYt PmNtZGxpc3RfZ3JvdXBzW2h3ZGV2LT5yZG1hX251bXMgKyBjcnRjX2lkXTsKPiArCXdoaWxlIChj dXJfY2wpIHsKPiArCQlod2Rldi0+Y21kbGlzdF9maWxsX2NvbmZfcm93KGN1cl9jbCwgaHdkZXYs IGRldl9pZCk7Cj4gKwkJY21kbGlzdF9kdW1wX25vZGUoY3VyX2NsKTsKPiArCQljdXJfY2wgPSBj dXJfY2wtPm5leHQ7Cj4gKwl9Cj4gKwlod2Rldi0+Y3J0Y19jbWRsaXN0KGN1cl9jbCwgaHdkZXYs IHByaXYsIGNydGNfaWQsIGRldl9pZCk7CgpbU2V2ZXJpdHk6IEhpZ2hdCkRvZXMgdGhpcyBsb29w IGV4aGF1c3QgY3VyX2NsIHRvIE5VTEwgYmVmb3JlIHBhc3NpbmcgaXQgdG8KaHdkZXYtPmNydGNf Y21kbGlzdD8gT25jZSB0aGUgd2hpbGUgbG9vcCBmaW5pc2hlcywgY3VyX2NsIGlzIGd1YXJhbnRl ZWQgdG8gYmUKTlVMTCwgd2hpY2ggc2VlbXMgbGlrZSBpdCB3b3VsZCBwYXNzIGFuIGludmFsaWQg cG9pbnRlciB0byB0aGUgaGFyZHdhcmUKcHJvZ3JhbW1pbmcgZnVuY3Rpb24gaW5zdGVhZCBvZiB0 aGUgaW50ZW5kZWQgY29tbWFuZCBsaXN0IGhlYWQuCgo+ICt9Cj4gKwo+ICsvKiBDYWxsZWQgZnJv bSBhdG9taWNfY2hlY2soKSwgd2hlcmUgLUVOT01FTSBpcyBzdGlsbCBhbiBhbnN3ZXIuICovCj4g K2ludCBzcGFjZW1pdF9jbWRsaXN0X2FsbG9jKHN0cnVjdCBkZXZpY2UgKmRldiwgc3RydWN0IGNt ZGxpc3QgKmNsKQo+ICt7Cj4gKwlpZiAoY2wtPnZhKQo+ICsJCXJldHVybiAwOwo+ICsKPiArCWNs LT5zaXplID0gUEVSX0NNRExJU1RfU0laRTsKPiArCWNsLT52YSA9IGRtYV9hbGxvY19jb2hlcmVu dChkZXYsIGNsLT5zaXplLCAmY2wtPnBhLAo+ICsJCQkJICAgIEdGUF9LRVJORUwgfCBfX0dGUF9a RVJPKTsKCltTZXZlcml0eTogSGlnaF0KRG9lcyBieXBhc3NpbmcgcmVhbGxvY2F0aW9uIHdoZW4g Y2wtPnZhIGlzIHByZXNlbnQgY2F1c2UgdGhlIGFjdGl2ZSBoYXJkd2FyZQpzdGF0ZSB0byBiZSBv dmVyd3JpdHRlbiBkdXJpbmcgdGhlIHByZXBhcmUgcGhhc2Ugb2YgYSBub24tYmxvY2tpbmcgY29t bWl0PwpJdCBsb29rcyBsaWtlIHdyaXRpbmcgbmV3IHJlZ2lzdGVyIHNlcXVlbmNlcyBkaXJlY3Rs eSBpbnRvIHRoaXMgcmV1c2VkIGJ1ZmZlcgpjb3VsZCBjb3JydXB0IHRoZSBpbi1mbGlnaHQgZGlz cGxheSBzdGF0ZSBiZWluZyBzY2FubmVkIG91dCBieSB0aGUgaGFyZHdhcmUuCgo+ICsJaWYgKCFj bC0+dmEpCj4gKwkJcmV0dXJuIC1FTk9NRU07Cj4gKwo+ICsJcmV0dXJuIDA7Cj4gK30KPiBkaWZm IC0tZ2l0IGEvZHJpdmVycy9ncHUvZHJtL3NwYWNlbWl0L3NwYWNlbWl0X2RtbXUuYyBiL2RyaXZl cnMvZ3B1L2RybS9zcGFjZW1pdC9zcGFjZW1pdF9kbW11LmMKPiBuZXcgZmlsZSBtb2RlIDEwMDY0 NAo+IGluZGV4IDAwMDAwMDAwMDAwMDAuLjJhZTMwZGQxYTRmMjMKPiAtLS0gL2Rldi9udWxsCj4g KysrIGIvZHJpdmVycy9ncHUvZHJtL3NwYWNlbWl0L3NwYWNlbWl0X2RtbXUuYwpbIC4uLiBdCj4g K2ludCBzcGFjZW1pdF9kbW11X21hcChzdHJ1Y3QgZHJtX2ZyYW1lYnVmZmVyICpmYiwgc3RydWN0 IGRwdV9tbXVfdGJsICptbXVfdGJsLAo+ICsJCSAgICAgIHU4IHRidV9pZCwgc3RydWN0IGNtZGxp c3RfcmVncyAqY2xfcmRtYSwKPiArCQkgc3RydWN0IGRybV9wbGFuZSAqcGxhbmUpCj4gK3sKPiAr CXN0cnVjdCBzcGFjZW1pdF9kcm1fcHJpdmF0ZSAqcHJpdiA9IGZiLT5kZXYtPmRldl9wcml2YXRl Owo+ICsJc3RydWN0IHNwYWNlbWl0X2h3X2RldmljZSAqaHdkZXYgPSBwcml2LT5od2RldjsKPiAr CWNvbnN0IHN0cnVjdCBkcm1fZm9ybWF0X2luZm8gKmZvcm1hdCA9IE5VTEw7Cj4gKwlzdHJ1Y3Qg c2dfdGFibGUgKnNndCA9IE5VTEw7Cj4gKwl1MzIgdG90YWxfc2l6ZSwgb2Zmc2V0MSwgb2Zmc2V0 MjsKPiArCXN0cnVjdCB0YnVfaW5zdGFuY2UgdGJ1ID0geyB9Owo+ICsJdTggcGxhbmVfbnVtOwo+ ICsJdTMyIHZhbDsKPiArCj4gKwlmb3JtYXQgPSBmYi0+Zm9ybWF0Owo+ICsJc2d0ID0gZHJtX2dl bV9zaG1lbV9nZXRfcGFnZXNfc2d0KHRvX2RybV9nZW1fc2htZW1fb2JqKGZiLT5vYmpbMF0pKTsK PiArCWlmIChJU19FUlIoc2d0KSkKPiArCQlyZXR1cm4gUFRSX0VSUihzZ3QpOwo+ICsKPiArCXBs YW5lX251bSA9IGZvcm1hdC0+bnVtX3BsYW5lczsKPiArCj4gKwl0b3RhbF9zaXplID0gcm91bmR1 cChmYi0+b2JqWzBdLT5zaXplLCBQQUdFX1NJWkUpOwo+ICsKPiArCW9mZnNldDEgPSBwbGFuZV9u dW0gPiAxID8gZmItPm9mZnNldHNbMV0gOiB0b3RhbF9zaXplOwo+ICsJb2Zmc2V0MiA9IHBsYW5l X251bSA+IDIgPyBmYi0+b2Zmc2V0c1syXSA6IHRvdGFsX3NpemU7Cj4gKwo+ICsJc3dpdGNoIChw bGFuZV9udW0pIHsKPiArCWNhc2UgMzoKPiArCQl0YnUudHRiX3BhWzJdID0gbW11X3RibC0+cGEg KyAob2Zmc2V0MiA+PiBQQUdFX1NISUZUKSAqIDQ7Cj4gKwkJdGJ1LnRidV92YVsyXSA9IFRCVV9C QVNFX1ZBKHRidV9pZCkgKyBvZmZzZXQyOwo+ICsJCXRidS50dGJfc2l6ZVsyXSA9IFBBR0VfQUxJ R04odG90YWxfc2l6ZSAtIHJvdW5kZG93bihvZmZzZXQyLCBQQUdFX1NJWkUpKQo+ICsJCQkJICA+ PiBQQUdFX1NISUZUOwo+ICsJCWZhbGx0aHJvdWdoOwo+ICsJY2FzZSAyOgo+ICsJCXRidS50dGJf cGFbMV0gPSBtbXVfdGJsLT5wYSArIChvZmZzZXQxID4+IFBBR0VfU0hJRlQpICogNDsKPiArCQl0 YnUudGJ1X3ZhWzFdID0gVEJVX0JBU0VfVkEodGJ1X2lkKSArIG9mZnNldDE7Cj4gKwkJdGJ1LnR0 Yl9zaXplWzFdID0gUEFHRV9BTElHTihvZmZzZXQyIC0gcm91bmRkb3duKG9mZnNldDEsIFBBR0Vf U0laRSkpID4+IFBBR0VfU0hJRlQ7CgpbU2V2ZXJpdHk6IEhpZ2hdCkZvciBtdWx0aS1wbGFuYXIg Zm9ybWF0cyB3aXRoIGRpc2NyZXRlIEdFTSBvYmplY3RzLCBkb2VzIHRoaXMgbWFwIHRoZQpzZWNv bmRhcnkgcGxhbmVzIG91dCBvZiBib3VuZHM/IFRoZSBzY2F0dGVyL2dhdGhlciB0YWJsZSBpcyBm ZXRjaGVkIHN0cmljdGx5CmZyb20gZmItPm9ialswXS4gQXBwbHlpbmcgc2Vjb25kYXJ5IG9mZnNl dHMgdG8gdGhlIHBoeXNpY2FsIHBhZ2VzIG9mIHRoZQpmaXJzdCBHRU0gb2JqZWN0IG1pZ2h0IGJy ZWFrIGhhcmR3YXJlIGlzb2xhdGlvbi4KCkNvdWxkIHRoZSBzaXplIGNhbGN1bGF0aW9uIG9mZnNl dDIgLSByb3VuZGRvd24ob2Zmc2V0MSwgUEFHRV9TSVpFKSBhbHNvCnVuZGVyZmxvdyBpZiB0aGVz ZSBvZmZzZXRzIGJlbG9uZyB0byBzZXBhcmF0ZSwgdW4tb3JkZXJlZCBidWZmZXJzPwoKPiArCQlm YWxsdGhyb3VnaDsKPiArCWNhc2UgMToKPiArCQl0YnUudHRiX3BhWzBdID0gbW11X3RibC0+cGE7 Cj4gKwkJdGJ1LnRidV92YVswXSA9IFRCVV9CQVNFX1ZBKHRidV9pZCk7Cj4gKwkJdGJ1LnR0Yl9z aXplWzBdID0gUEFHRV9BTElHTihvZmZzZXQxKSA+PiBQQUdFX1NISUZUOwo+ICsJCWZhbGx0aHJv dWdoOwo+ICsJZGVmYXVsdDoKPiArCQlicmVhazsKPiArCX0KPiArCXNwYWNlbWl0X2RtbXVfZmls bF9wZ3RhYmxlKG1tdV90YmwsIHNndCk7ClsgLi4uIF0KCi0tIApTYXNoaWtvIEFJIHJldmlldyDC tyBodHRwczovL3Nhc2hpa28uZGV2LyMvcGF0Y2hzZXQvMjAyNjA3MjQtazMtZGlzcGxheS12MS0w LWYyMmExMGE1Mjg2N0BnbWFpbC5jb20/cGFydD04CgotLSAKbGludXgtcGh5IG1haWxpbmcgbGlz dApsaW51eC1waHlAbGlzdHMuaW5mcmFkZWFkLm9yZwpodHRwczovL2xpc3RzLmluZnJhZGVhZC5v cmcvbWFpbG1hbi9saXN0aW5mby9saW51eC1waHkK From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 3B55EC53200 for ; Sat, 25 Jul 2026 05:16:30 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 9CCBE10F50B; Sat, 25 Jul 2026 05:16:29 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=pass (2048-bit key; unprotected) header.d=kernel.org header.i=@kernel.org header.b="Ixww+LbD"; dkim-atps=neutral Received: from tor.source.kernel.org (tor.source.kernel.org [172.105.4.254]) by gabe.freedesktop.org (Postfix) with ESMTPS id EC57210F50B for ; Sat, 25 Jul 2026 05:16:27 +0000 (UTC) Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by tor.source.kernel.org (Postfix) with ESMTP id 61B5B60A77; Sat, 25 Jul 2026 05:16:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9AE561F000E9; Sat, 25 Jul 2026 05:16:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784956587; bh=smB236X8XNJqOB0/6cz9B1Uf3icxzbvnX/NRFA+C+hA=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=Ixww+LbDqOB7nhukK4bNMJfw6x4osZM6BvYUrH9FDKFfceuxfS1PWhqSg0VznYo5t RvNuJ2NZVbM8sKpYEj3A6TLRFU731F3JE0gEV6lbU0lz2Q6sFQmetzkAbxiIZ5gMTC DIc6fWo7r7cPjiWiSUhIvwRrgVt22jW1o9rgS/mpoFrEwHT+kCUB3FP0eIB3RDDueC Sna65R9QhVVKuzsz9MmLPVOkoFy7M8DcAx5NhlZ4+BygrgGycz+dllkt2AmRWdf7q4 e3ersTBsrPDBC6m14gxOXzf+g8eFZhYLsD9PjXX+mmLifrfb6aaJaPR5sXy1hTrC9N KUo4jhy1giiMA== From: sashiko-bot@kernel.org Subject: Re: [PATCH 08/17] drm/spacemit: add Saturn DPU core types, cmdlist and display MMU To: "Cody Kang" Cc: devicetree@vger.kernel.org, linux-phy@lists.infradead.org, dri-devel@lists.freedesktop.org, neil.armstrong@linaro.org, conor+dt@kernel.org, vkoul@kernel.org, robh@kernel.org, olteanv@gmail.com In-Reply-To: <20260724-k3-display-v1-8-f22a10a52867@gmail.com> References: <20260724-k3-display-v1-0-f22a10a52867@gmail.com> <20260724-k3-display-v1-8-f22a10a52867@gmail.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Sat, 25 Jul 2026 05:16:26 +0000 Message-Id: <20260725051626.9AE561F000E9@smtp.kernel.org> X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" Thank you for your contribution! Sashiko AI review found 6 potential issue(= s) to consider: - [High] Passing exhausted NULL pointer to hardware programming function. - [High] NULL pointer dereference when accessing state for disabled planes = due to stale `in_use` flag. - [High] DMMU page tables map multi-planar framebuffers out-of-bounds by ex= clusively using the first GEM object. - [High] Hardware DMA state buffers are reused across atomic commits withou= t double-buffering. - [High] Missing bounds check in `cmdlist_regs_packing` causes DMA buffer o= verflow. - [Medium] Unconditional dereference of `fb` in `dpu_plane_info` tracepoint. -- --- Patch [8]: [PATCH 08/17] drm/spacemit: add Saturn DPU core types, cmdli= st and display MMU --- commit 82f0596ca65ff96e2081646dccab37f7bb9d1c0c Author: Cody Kang Subject: drm/spacemit: add Saturn DPU core types, cmdlist and display MMU This commit introduces the Saturn DPU driver core types, register accessors, and MMU table code. It implements a batched register programming model using in-memory command lists mapped through the DPU's private address translation unit. > diff --git a/drivers/gpu/drm/spacemit/dpu/dpu_trace.h b/drivers/gpu/drm/s= pacemit/dpu/dpu_trace.h > new file mode 100644 > index 0000000000000..abfe34a67a4bd > --- /dev/null > +++ b/drivers/gpu/drm/spacemit/dpu/dpu_trace.h [ ... ] > +TRACE_EVENT(dpu_plane_info, > + TP_PROTO(struct drm_plane_state *state, struct drm_framebuffer *fb, > + u32 rdma_id, u32 alpha, u32 rotation), > + TP_ARGS(state, fb, rdma_id, alpha, rotation), > + TP_STRUCT__entry( > + __field(u32, rdma_id) > + __field(u32, src_w) > + __field(u32, src_h) > + __field(u32, src_x) > + __field(u32, src_y) > + __field(u32, crtc_w) > + __field(u32, crtc_h) > + __field(u32, crtc_x) > + __field(u32, crtc_y) > + __field(u32, width) > + __field(u32, height) > + __field(u32, format) > + __field(u32, blend_mode) > + __field(u32, alpha) > + __field(u32, zpos) > + __field(u32, rotation) > + ), > + TP_fast_assign( > + __entry->rdma_id =3D rdma_id; > + __entry->src_w =3D state->src_w >> 16; > + __entry->src_h =3D state->src_h >> 16; > + __entry->src_x =3D state->src_x >> 16; > + __entry->src_y =3D state->src_y >> 16; > + __entry->crtc_w =3D state->crtc_w; > + __entry->crtc_h =3D state->crtc_h; > + __entry->crtc_x =3D state->crtc_x; > + __entry->crtc_y =3D state->crtc_y; > + __entry->width =3D fb->width; > + __entry->height =3D fb->height; > + __entry->format =3D fb->format->format; [Severity: Medium] If this tracepoint fires during a plane disable operation, will the fb parameter be NULL? Since state->fb is typically NULL during a disable, it looks like evaluating fb->format->format here could cause a kernel panic when tracing is enabled. > + __entry->blend_mode =3D state->pixel_blend_mode; > + __entry->alpha =3D alpha; > + __entry->zpos =3D state->zpos; > + __entry->rotation =3D rotation; > + ), > + TP_printk("rdma_id=3D%d src: w=3D%d h=3D%d x=3D%d y=3D%d crtc: w=3D%d h= =3D%d x=3D%d y=3D%d width=3D%d height=3D%d fmt=3D0x%x blend=3D%d alpha=3D%d= zpos=3D%d rot=3D%d", [ ... ] > diff --git a/drivers/gpu/drm/spacemit/spacemit_cmdlist.c b/drivers/gpu/dr= m/spacemit/spacemit_cmdlist.c > new file mode 100644 > index 0000000000000..787d38e9e135f > --- /dev/null > +++ b/drivers/gpu/drm/spacemit/spacemit_cmdlist.c [ ... ] > +void cmdlist_regs_packing(struct cmdlist *cl, enum cmdlist_mode_type mod, > + struct cmdlist_regs *cl_regs) > +{ [ ... ] > + if (cl_regs->flags[i]) { > + offset =3D cl_regs->base + i * sizeof(u32); > + for (u8 j =3D 0; j < CMDLIST_ROW_REGS; j++) { > + index =3D i + j; > + if (likely(index < cl_regs->size)) { > + if (cl_regs->flags[index]) { > + value[j] =3D reg_base[index]; > + regs_in_row++; > + strobe |=3D CMDLIST_REG_STROBE(j); > + } > + } else { > + break; > + } > + } > + hwdev->cmdlist_fill_data_row(cl, strobe, offset, value); > + /* > + * the row covers the whole window; a shorter stride > + * would revisit covered words as duplicate rows > + */ > + i +=3D CMDLIST_ROW_REGS; > + cl->nod_len++; [Severity: High] Is there a bounds check missing here to prevent cl->nod_len from exceeding cl->size? If cl is shallow-copied and reused across commits, nod_len might accumulate and eventually overflow the 4096-byte DMA buffer, overwriting adjacent physical memory. > + } else { > + i++; > + } > + } > + > + drm_dbg(a_crtc->crtc.dev, "row_num =3D %d\n", cl->nod_len); > +} [ ... ] > +void cmdlist_atomic_commit(struct drm_crtc *crtc, > + struct drm_crtc_state *old_state) > +{ > + int i; > + struct cmdlist *cur_cl, *first_cl; > + struct spacemit_crtc *a_crtc =3D NULL; > + u32 chy, addrl, addrh; > + struct spacemit_drm_private *priv =3D crtc->dev->dev_private; > + struct spacemit_hw_device *hwdev =3D priv->hwdev; > + struct spacemit_crtc_rdma *cur_rdmas =3D > + to_spacemit_crtc_state(crtc->state)->rdmas; > + struct spacemit_crtc_rdma *old_rdmas =3D > + to_spacemit_crtc_state(old_state)->rdmas; > + > + a_crtc =3D to_spacemit_crtc(crtc); > + > + for (i =3D 0; i < hwdev->rdma_nums; i++) { > + if (old_rdmas[i].in_use) > + hwdev->enable_cmdlist(a_crtc, hwdev, i, false); > + > + if (cur_rdmas[i].in_use) { > + drm_dbg(crtc->dev, "cmdlist group =3D %d\n", i); > + cur_cl =3D priv->cmdlist_groups[i]; > + first_cl =3D cur_cl; > + while (cur_cl) { > + hwdev->cmdlist_fill_conf_row(cur_cl, hwdev, > + CMDLIST_CMP_INVALID); > + cmdlist_dump_node(cur_cl); > + cur_cl =3D cur_cl->next; > + } > + chy =3D cl_to_spacemit_pstate(first_cl)->state.crtc_y; [Severity: High] Could first_cl be NULL here for a disabled plane? During atomic state duplication, it seems the in_use flag is inherited. If a plane is disabled, it is removed from the plane_mask and cmdlist_sort_by_group skips clearing the flag. This would cause cur_cl and first_cl to be NULL, leading cl_to_spacemit_pstate to apply container_of to a NULL pointer and trigger a negative offset dereference. > + addrl =3D (lower_32_bits(priv->cmdlist_groups[i]->pa) & > + CMDLIST_ADDRL_ALIGN_MASK) >> CMDLIST_ADDRL_ALIGN_BITS; > + > + addrh =3D upper_32_bits(priv->cmdlist_groups[i]->pa); > + hwdev->cfg_cmdlist(hwdev, i, chy, addrl, addrh); > + hwdev->enable_cmdlist(a_crtc, hwdev, i, true); > + priv->cmdlist_groups[i] =3D NULL; > + } > + } > +} [ ... ] > +void crtc_cmdlist_atomic_commit(struct spacemit_crtc *a_crtc) > +{ > + struct cmdlist *cur_cl; > + struct drm_crtc *crtc =3D &a_crtc->crtc; > + struct spacemit_drm_private *priv =3D crtc->dev->dev_private; > + struct spacemit_hw_device *hwdev =3D priv->hwdev; > + u8 crtc_id =3D drm_crtc_index(crtc); > + u8 dev_id =3D a_crtc->dev_id; > + > + drm_dbg(crtc->dev, "cmdlist group =3D %d\n", > + hwdev->rdma_nums + crtc_id); > + cur_cl =3D priv->cmdlist_groups[hwdev->rdma_nums + crtc_id]; > + while (cur_cl) { > + hwdev->cmdlist_fill_conf_row(cur_cl, hwdev, dev_id); > + cmdlist_dump_node(cur_cl); > + cur_cl =3D cur_cl->next; > + } > + hwdev->crtc_cmdlist(cur_cl, hwdev, priv, crtc_id, dev_id); [Severity: High] Does this loop exhaust cur_cl to NULL before passing it to hwdev->crtc_cmdlist? Once the while loop finishes, cur_cl is guaranteed to = be NULL, which seems like it would pass an invalid pointer to the hardware programming function instead of the intended command list head. > +} > + > +/* Called from atomic_check(), where -ENOMEM is still an answer. */ > +int spacemit_cmdlist_alloc(struct device *dev, struct cmdlist *cl) > +{ > + if (cl->va) > + return 0; > + > + cl->size =3D PER_CMDLIST_SIZE; > + cl->va =3D dma_alloc_coherent(dev, cl->size, &cl->pa, > + GFP_KERNEL | __GFP_ZERO); [Severity: High] Does bypassing reallocation when cl->va is present cause the active hardware state to be overwritten during the prepare phase of a non-blocking commit? It looks like writing new register sequences directly into this reused buff= er could corrupt the in-flight display state being scanned out by the hardware. > + if (!cl->va) > + return -ENOMEM; > + > + return 0; > +} > diff --git a/drivers/gpu/drm/spacemit/spacemit_dmmu.c b/drivers/gpu/drm/s= pacemit/spacemit_dmmu.c > new file mode 100644 > index 0000000000000..2ae30dd1a4f23 > --- /dev/null > +++ b/drivers/gpu/drm/spacemit/spacemit_dmmu.c [ ... ] > +int spacemit_dmmu_map(struct drm_framebuffer *fb, struct dpu_mmu_tbl *mm= u_tbl, > + u8 tbu_id, struct cmdlist_regs *cl_rdma, > + struct drm_plane *plane) > +{ > + struct spacemit_drm_private *priv =3D fb->dev->dev_private; > + struct spacemit_hw_device *hwdev =3D priv->hwdev; > + const struct drm_format_info *format =3D NULL; > + struct sg_table *sgt =3D NULL; > + u32 total_size, offset1, offset2; > + struct tbu_instance tbu =3D { }; > + u8 plane_num; > + u32 val; > + > + format =3D fb->format; > + sgt =3D drm_gem_shmem_get_pages_sgt(to_drm_gem_shmem_obj(fb->obj[0])); > + if (IS_ERR(sgt)) > + return PTR_ERR(sgt); > + > + plane_num =3D format->num_planes; > + > + total_size =3D roundup(fb->obj[0]->size, PAGE_SIZE); > + > + offset1 =3D plane_num > 1 ? fb->offsets[1] : total_size; > + offset2 =3D plane_num > 2 ? fb->offsets[2] : total_size; > + > + switch (plane_num) { > + case 3: > + tbu.ttb_pa[2] =3D mmu_tbl->pa + (offset2 >> PAGE_SHIFT) * 4; > + tbu.tbu_va[2] =3D TBU_BASE_VA(tbu_id) + offset2; > + tbu.ttb_size[2] =3D PAGE_ALIGN(total_size - rounddown(offset2, PAGE_SI= ZE)) > + >> PAGE_SHIFT; > + fallthrough; > + case 2: > + tbu.ttb_pa[1] =3D mmu_tbl->pa + (offset1 >> PAGE_SHIFT) * 4; > + tbu.tbu_va[1] =3D TBU_BASE_VA(tbu_id) + offset1; > + tbu.ttb_size[1] =3D PAGE_ALIGN(offset2 - rounddown(offset1, PAGE_SIZE)= ) >> PAGE_SHIFT; [Severity: High] For multi-planar formats with discrete GEM objects, does this map the secondary planes out of bounds? The scatter/gather table is fetched strictly from fb->obj[0]. Applying secondary offsets to the physical pages of the first GEM object might break hardware isolation. Could the size calculation offset2 - rounddown(offset1, PAGE_SIZE) also underflow if these offsets belong to separate, un-ordered buffers? > + fallthrough; > + case 1: > + tbu.ttb_pa[0] =3D mmu_tbl->pa; > + tbu.tbu_va[0] =3D TBU_BASE_VA(tbu_id); > + tbu.ttb_size[0] =3D PAGE_ALIGN(offset1) >> PAGE_SHIFT; > + fallthrough; > + default: > + break; > + } > + spacemit_dmmu_fill_pgtable(mmu_tbl, sgt); [ ... ] --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260724-k3-display= -v1-0-f22a10a52867@gmail.com?part=3D8