Linux Framebuffer Layer development
 help / color / mirror / Atom feed
* [PATCH v2 4/5] fbcon: Move fbcon callbacks into struct fbcon_bitops
From: Thomas Zimmermann @ 2025-09-09 12:44 UTC (permalink / raw)
  To: sam, simona, deller
  Cc: linux-fbdev, dri-devel, linux-kernel, Thomas Zimmermann
In-Reply-To: <20250909124616.143365-1-tzimmermann@suse.de>

Depending on rotation settings, fbcon sets different callback
functions in struct fbcon_par from within fbcon_set_bitops(). Declare
the callback functions in the new type struct fbcon_bitops. Then
only replace the single bitops pointer in struct fbcon_par.

Keeping callbacks in constant instances of struct fbcon_bitops
makes it harder to exploit the callbacks. Also makes the code slightly
easier to maintain.

For tile-based consoles, there's a separate instance of the bitops
structure.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
---
 drivers/video/fbdev/core/bitblit.c   | 17 ++++---
 drivers/video/fbdev/core/fbcon.c     | 67 +++++++++++++++-------------
 drivers/video/fbdev/core/fbcon.h     |  7 ++-
 drivers/video/fbdev/core/fbcon_ccw.c | 18 +++++---
 drivers/video/fbdev/core/fbcon_cw.c  | 18 +++++---
 drivers/video/fbdev/core/fbcon_ud.c  | 18 +++++---
 drivers/video/fbdev/core/tileblit.c  | 16 ++++---
 7 files changed, 94 insertions(+), 67 deletions(-)

diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
index ebadc9619699..7a68372f0444 100644
--- a/drivers/video/fbdev/core/bitblit.c
+++ b/drivers/video/fbdev/core/bitblit.c
@@ -384,15 +384,18 @@ static int bit_update_start(struct fb_info *info)
 	return err;
 }
 
+static const struct fbcon_bitops bit_fbcon_bitops = {
+	.bmove = bit_bmove,
+	.clear = bit_clear,
+	.putcs = bit_putcs,
+	.clear_margins = bit_clear_margins,
+	.cursor = bit_cursor,
+	.update_start = bit_update_start,
+};
+
 void fbcon_set_bitops(struct fbcon_par *par)
 {
-	par->bmove = bit_bmove;
-	par->clear = bit_clear;
-	par->putcs = bit_putcs;
-	par->clear_margins = bit_clear_margins;
-	par->cursor = bit_cursor;
-	par->update_start = bit_update_start;
-	par->rotate_font = NULL;
+	par->bitops = &bit_fbcon_bitops;
 
 	if (par->rotate)
 		fbcon_set_rotate(par);
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 7f871ef3e624..1074dc90ed92 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -405,9 +405,9 @@ static void fb_flashcursor(struct work_struct *work)
 
 	c = scr_readw((u16 *) vc->vc_pos);
 	enable = par->cursor_flash && !par->cursor_state.enable;
-	par->cursor(vc, info, enable,
-		    get_fg_color(vc, info, c),
-		    get_bg_color(vc, info, c));
+	par->bitops->cursor(vc, info, enable,
+			    get_fg_color(vc, info, c),
+			    get_bg_color(vc, info, c));
 	console_unlock();
 
 	queue_delayed_work(system_power_efficient_wq, &par->cursor_work,
@@ -1162,7 +1162,7 @@ static void fbcon_init(struct vc_data *vc, bool init)
 	if (logo)
 		fbcon_prepare_logo(vc, info, cols, rows, new_cols, new_rows);
 
-	if (par->rotate_font && par->rotate_font(info, vc)) {
+	if (par->bitops->rotate_font && par->bitops->rotate_font(info, vc)) {
 		par->rotate = FB_ROTATE_UR;
 		set_blitting_type(vc, info);
 	}
@@ -1303,10 +1303,11 @@ static void __fbcon_clear(struct vc_data *vc, unsigned int sy, unsigned int sx,
 	y_break = p->vrows - p->yscroll;
 	if (sy < y_break && sy + height - 1 >= y_break) {
 		u_int b = y_break - sy;
-		par->clear(vc, info, real_y(p, sy), sx, b, width, fg, bg);
-		par->clear(vc, info, real_y(p, sy + b), sx, height - b, width, fg, bg);
+		par->bitops->clear(vc, info, real_y(p, sy), sx, b, width, fg, bg);
+		par->bitops->clear(vc, info, real_y(p, sy + b), sx, height - b,
+				     width, fg, bg);
 	} else
-		par->clear(vc, info, real_y(p, sy), sx, height, width, fg, bg);
+		par->bitops->clear(vc, info, real_y(p, sy), sx, height, width, fg, bg);
 }
 
 static void fbcon_clear(struct vc_data *vc, unsigned int sy, unsigned int sx,
@@ -1323,9 +1324,9 @@ static void fbcon_putcs(struct vc_data *vc, const u16 *s, unsigned int count,
 	struct fbcon_par *par = info->fbcon_par;
 
 	if (fbcon_is_active(vc, info))
-		par->putcs(vc, info, s, count, real_y(p, ypos), xpos,
-			   get_fg_color(vc, info, scr_readw(s)),
-			   get_bg_color(vc, info, scr_readw(s)));
+		par->bitops->putcs(vc, info, s, count, real_y(p, ypos), xpos,
+				   get_fg_color(vc, info, scr_readw(s)),
+				   get_bg_color(vc, info, scr_readw(s)));
 }
 
 static void fbcon_clear_margins(struct vc_data *vc, int bottom_only)
@@ -1334,7 +1335,7 @@ static void fbcon_clear_margins(struct vc_data *vc, int bottom_only)
 	struct fbcon_par *par = info->fbcon_par;
 
 	if (fbcon_is_active(vc, info))
-		par->clear_margins(vc, info, margin_color, bottom_only);
+		par->bitops->clear_margins(vc, info, margin_color, bottom_only);
 }
 
 static void fbcon_cursor(struct vc_data *vc, bool enable)
@@ -1355,12 +1356,12 @@ static void fbcon_cursor(struct vc_data *vc, bool enable)
 
 	par->cursor_flash = enable;
 
-	if (!par->cursor)
+	if (!par->bitops->cursor)
 		return;
 
-	par->cursor(vc, info, enable,
-		    get_fg_color(vc, info, c),
-		    get_bg_color(vc, info, c));
+	par->bitops->cursor(vc, info, enable,
+			    get_fg_color(vc, info, c),
+			    get_bg_color(vc, info, c));
 }
 
 static int scrollback_phys_max = 0;
@@ -1444,7 +1445,7 @@ static __inline__ void ywrap_up(struct vc_data *vc, int count)
 	par->var.xoffset = 0;
 	par->var.yoffset = p->yscroll * vc->vc_font.height;
 	par->var.vmode |= FB_VMODE_YWRAP;
-	par->update_start(info);
+	par->bitops->update_start(info);
 	scrollback_max += count;
 	if (scrollback_max > scrollback_phys_max)
 		scrollback_max = scrollback_phys_max;
@@ -1463,7 +1464,7 @@ static __inline__ void ywrap_down(struct vc_data *vc, int count)
 	par->var.xoffset = 0;
 	par->var.yoffset = p->yscroll * vc->vc_font.height;
 	par->var.vmode |= FB_VMODE_YWRAP;
-	par->update_start(info);
+	par->bitops->update_start(info);
 	scrollback_max -= count;
 	if (scrollback_max < 0)
 		scrollback_max = 0;
@@ -1478,15 +1479,15 @@ static __inline__ void ypan_up(struct vc_data *vc, int count)
 
 	p->yscroll += count;
 	if (p->yscroll > p->vrows - vc->vc_rows) {
-		par->bmove(vc, info, p->vrows - vc->vc_rows,
-			    0, 0, 0, vc->vc_rows, vc->vc_cols);
+		par->bitops->bmove(vc, info, p->vrows - vc->vc_rows,
+				   0, 0, 0, vc->vc_rows, vc->vc_cols);
 		p->yscroll -= p->vrows - vc->vc_rows;
 	}
 
 	par->var.xoffset = 0;
 	par->var.yoffset = p->yscroll * vc->vc_font.height;
 	par->var.vmode &= ~FB_VMODE_YWRAP;
-	par->update_start(info);
+	par->bitops->update_start(info);
 	fbcon_clear_margins(vc, 1);
 	scrollback_max += count;
 	if (scrollback_max > scrollback_phys_max)
@@ -1510,7 +1511,7 @@ static __inline__ void ypan_up_redraw(struct vc_data *vc, int t, int count)
 	par->var.xoffset = 0;
 	par->var.yoffset = p->yscroll * vc->vc_font.height;
 	par->var.vmode &= ~FB_VMODE_YWRAP;
-	par->update_start(info);
+	par->bitops->update_start(info);
 	fbcon_clear_margins(vc, 1);
 	scrollback_max += count;
 	if (scrollback_max > scrollback_phys_max)
@@ -1526,15 +1527,15 @@ static __inline__ void ypan_down(struct vc_data *vc, int count)
 
 	p->yscroll -= count;
 	if (p->yscroll < 0) {
-		par->bmove(vc, info, 0, 0, p->vrows - vc->vc_rows,
-			    0, vc->vc_rows, vc->vc_cols);
+		par->bitops->bmove(vc, info, 0, 0, p->vrows - vc->vc_rows,
+				   0, vc->vc_rows, vc->vc_cols);
 		p->yscroll += p->vrows - vc->vc_rows;
 	}
 
 	par->var.xoffset = 0;
 	par->var.yoffset = p->yscroll * vc->vc_font.height;
 	par->var.vmode &= ~FB_VMODE_YWRAP;
-	par->update_start(info);
+	par->bitops->update_start(info);
 	fbcon_clear_margins(vc, 1);
 	scrollback_max -= count;
 	if (scrollback_max < 0)
@@ -1558,7 +1559,7 @@ static __inline__ void ypan_down_redraw(struct vc_data *vc, int t, int count)
 	par->var.xoffset = 0;
 	par->var.yoffset = p->yscroll * vc->vc_font.height;
 	par->var.vmode &= ~FB_VMODE_YWRAP;
-	par->update_start(info);
+	par->bitops->update_start(info);
 	fbcon_clear_margins(vc, 1);
 	scrollback_max -= count;
 	if (scrollback_max < 0)
@@ -1620,8 +1621,8 @@ static void fbcon_redraw_blit(struct vc_data *vc, struct fb_info *info,
 
 			if (c == scr_readw(d)) {
 				if (s > start) {
-					par->bmove(vc, info, line + ycount, x,
-						   line, x, 1, s - start);
+					par->bitops->bmove(vc, info, line + ycount, x,
+							   line, x, 1, s - start);
 					x += s - start + 1;
 					start = s + 1;
 				} else {
@@ -1636,7 +1637,8 @@ static void fbcon_redraw_blit(struct vc_data *vc, struct fb_info *info,
 			d++;
 		} while (s < le);
 		if (s > start)
-			par->bmove(vc, info, line + ycount, x, line, x, 1, s - start);
+			par->bitops->bmove(vc, info, line + ycount, x, line, x, 1,
+					     s - start);
 		console_conditional_schedule();
 		if (ycount > 0)
 			line++;
@@ -1741,7 +1743,8 @@ static void fbcon_bmove_rec(struct vc_data *vc, struct fbcon_display *p, int sy,
 		}
 		return;
 	}
-	par->bmove(vc, info, real_y(p, sy), sx, real_y(p, dy), dx, height, width);
+	par->bitops->bmove(vc, info, real_y(p, sy), sx, real_y(p, dy), dx,
+			     height, width);
 }
 
 static void fbcon_bmove(struct vc_data *vc, int sy, int sx, int dy, int dx,
@@ -2161,7 +2164,7 @@ static bool fbcon_switch(struct vc_data *vc)
 	set_blitting_type(vc, info);
 	par->cursor_reset = 1;
 
-	if (par->rotate_font && par->rotate_font(info, vc)) {
+	if (par->bitops->rotate_font && par->bitops->rotate_font(info, vc)) {
 		par->rotate = FB_ROTATE_UR;
 		set_blitting_type(vc, info);
 	}
@@ -2194,7 +2197,7 @@ static bool fbcon_switch(struct vc_data *vc)
 
 	if (fbcon_is_active(vc, info)) {
 		par->var.xoffset = par->var.yoffset = p->yscroll = 0;
-		par->update_start(info);
+		par->bitops->update_start(info);
 	}
 
 	fbcon_set_palette(vc, color_table);
@@ -2693,7 +2696,7 @@ static void fbcon_modechanged(struct fb_info *info)
 
 		if (fbcon_is_active(vc, info)) {
 			par->var.xoffset = par->var.yoffset = p->yscroll = 0;
-			par->update_start(info);
+			par->bitops->update_start(info);
 		}
 
 		fbcon_set_palette(vc, color_table);
diff --git a/drivers/video/fbdev/core/fbcon.h b/drivers/video/fbdev/core/fbcon.h
index 94991a1ba11f..4bff4f5b3ec1 100644
--- a/drivers/video/fbdev/core/fbcon.h
+++ b/drivers/video/fbdev/core/fbcon.h
@@ -51,7 +51,7 @@ struct fbcon_display {
     const struct fb_videomode *mode;
 };
 
-struct fbcon_par {
+struct fbcon_bitops {
 	void (*bmove)(struct vc_data *vc, struct fb_info *info, int sy,
 		      int sx, int dy, int dx, int height, int width);
 	void (*clear)(struct vc_data *vc, struct fb_info *info, int sy,
@@ -65,6 +65,9 @@ struct fbcon_par {
 		       bool enable, int fg, int bg);
 	int  (*update_start)(struct fb_info *info);
 	int  (*rotate_font)(struct fb_info *info, struct vc_data *vc);
+};
+
+struct fbcon_par {
 	struct fb_var_screeninfo var;  /* copy of the current fb_var_screeninfo */
 	struct delayed_work cursor_work; /* Cursor timer */
 	struct fb_cursor cursor_state;
@@ -86,6 +89,8 @@ struct fbcon_par {
 	u8    *cursor_src;
 	u32    cursor_size;
 	u32    fd_size;
+
+	const struct fbcon_bitops *bitops;
 };
 
     /*
diff --git a/drivers/video/fbdev/core/fbcon_ccw.c b/drivers/video/fbdev/core/fbcon_ccw.c
index ba744b67a4fd..4721f4b5e29a 100644
--- a/drivers/video/fbdev/core/fbcon_ccw.c
+++ b/drivers/video/fbdev/core/fbcon_ccw.c
@@ -390,13 +390,17 @@ static int ccw_update_start(struct fb_info *info)
 	return err;
 }
 
+static const struct fbcon_bitops ccw_fbcon_bitops = {
+	.bmove = ccw_bmove,
+	.clear = ccw_clear,
+	.putcs = ccw_putcs,
+	.clear_margins = ccw_clear_margins,
+	.cursor = ccw_cursor,
+	.update_start = ccw_update_start,
+	.rotate_font = fbcon_rotate_font,
+};
+
 void fbcon_rotate_ccw(struct fbcon_par *par)
 {
-	par->bmove = ccw_bmove;
-	par->clear = ccw_clear;
-	par->putcs = ccw_putcs;
-	par->clear_margins = ccw_clear_margins;
-	par->cursor = ccw_cursor;
-	par->update_start = ccw_update_start;
-	par->rotate_font = fbcon_rotate_font;
+	par->bitops = &ccw_fbcon_bitops;
 }
diff --git a/drivers/video/fbdev/core/fbcon_cw.c b/drivers/video/fbdev/core/fbcon_cw.c
index 974bd9d9b770..2771924d0fb7 100644
--- a/drivers/video/fbdev/core/fbcon_cw.c
+++ b/drivers/video/fbdev/core/fbcon_cw.c
@@ -373,13 +373,17 @@ static int cw_update_start(struct fb_info *info)
 	return err;
 }
 
+static const struct fbcon_bitops cw_fbcon_bitops = {
+	.bmove = cw_bmove,
+	.clear = cw_clear,
+	.putcs = cw_putcs,
+	.clear_margins = cw_clear_margins,
+	.cursor = cw_cursor,
+	.update_start = cw_update_start,
+	.rotate_font = fbcon_rotate_font,
+};
+
 void fbcon_rotate_cw(struct fbcon_par *par)
 {
-	par->bmove = cw_bmove;
-	par->clear = cw_clear;
-	par->putcs = cw_putcs;
-	par->clear_margins = cw_clear_margins;
-	par->cursor = cw_cursor;
-	par->update_start = cw_update_start;
-	par->rotate_font = fbcon_rotate_font;
+	par->bitops = &cw_fbcon_bitops;
 }
diff --git a/drivers/video/fbdev/core/fbcon_ud.c b/drivers/video/fbdev/core/fbcon_ud.c
index 1a214a4d538f..148ca9b539d1 100644
--- a/drivers/video/fbdev/core/fbcon_ud.c
+++ b/drivers/video/fbdev/core/fbcon_ud.c
@@ -417,13 +417,17 @@ static int ud_update_start(struct fb_info *info)
 	return err;
 }
 
+static const struct fbcon_bitops ud_fbcon_bitops = {
+	.bmove = ud_bmove,
+	.clear = ud_clear,
+	.putcs = ud_putcs,
+	.clear_margins = ud_clear_margins,
+	.cursor = ud_cursor,
+	.update_start = ud_update_start,
+	.rotate_font = fbcon_rotate_font,
+};
+
 void fbcon_rotate_ud(struct fbcon_par *par)
 {
-	par->bmove = ud_bmove;
-	par->clear = ud_clear;
-	par->putcs = ud_putcs;
-	par->clear_margins = ud_clear_margins;
-	par->cursor = ud_cursor;
-	par->update_start = ud_update_start;
-	par->rotate_font = fbcon_rotate_font;
+	par->bitops = &ud_fbcon_bitops;
 }
diff --git a/drivers/video/fbdev/core/tileblit.c b/drivers/video/fbdev/core/tileblit.c
index 4428f2bcd3f8..a9db668caf72 100644
--- a/drivers/video/fbdev/core/tileblit.c
+++ b/drivers/video/fbdev/core/tileblit.c
@@ -161,17 +161,21 @@ static int tile_update_start(struct fb_info *info)
 	return err;
 }
 
+static const struct fbcon_bitops tile_fbcon_bitops = {
+	.bmove = tile_bmove,
+	.clear = tile_clear,
+	.putcs = tile_putcs,
+	.clear_margins = tile_clear_margins,
+	.cursor = tile_cursor,
+	.update_start = tile_update_start,
+};
+
 void fbcon_set_tileops(struct vc_data *vc, struct fb_info *info)
 {
 	struct fb_tilemap map;
 	struct fbcon_par *par = info->fbcon_par;
 
-	par->bmove = tile_bmove;
-	par->clear = tile_clear;
-	par->putcs = tile_putcs;
-	par->clear_margins = tile_clear_margins;
-	par->cursor = tile_cursor;
-	par->update_start = tile_update_start;
+	par->bitops = &tile_fbcon_bitops;
 
 	if (par->p) {
 		map.width = vc->vc_font.width;
-- 
2.51.0


^ permalink raw reply related

* [PATCH v2 1/5] fbcon: Fix empty lines in fbcon.h
From: Thomas Zimmermann @ 2025-09-09 12:44 UTC (permalink / raw)
  To: sam, simona, deller
  Cc: linux-fbdev, dri-devel, linux-kernel, Thomas Zimmermann
In-Reply-To: <20250909124616.143365-1-tzimmermann@suse.de>

Add and remove empty lines as necessary to fix coding style. No
functional changes.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
---
 drivers/video/fbdev/core/fbcon.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/core/fbcon.h b/drivers/video/fbdev/core/fbcon.h
index 4d97e6d8a16a..c535d8f84356 100644
--- a/drivers/video/fbdev/core/fbcon.h
+++ b/drivers/video/fbdev/core/fbcon.h
@@ -87,6 +87,7 @@ struct fbcon_ops {
 	u32    cursor_size;
 	u32    fd_size;
 };
+
     /*
      *  Attribute Decoding
      */
@@ -106,7 +107,6 @@ struct fbcon_ops {
 	((s) & 0x400)
 #define attr_blink(s) \
 	((s) & 0x8000)
-	
 
 static inline int mono_col(const struct fb_info *info)
 {
-- 
2.51.0


^ permalink raw reply related

* [PATCH v2 3/5] fbcon: Set rotate_font callback with related callbacks
From: Thomas Zimmermann @ 2025-09-09 12:44 UTC (permalink / raw)
  To: sam, simona, deller
  Cc: linux-fbdev, dri-devel, linux-kernel, Thomas Zimmermann
In-Reply-To: <20250909124616.143365-1-tzimmermann@suse.de>

The field struct fbcon_par.rotate_font points to fbcon_rotate_font() if
the console is rotated. Set the callback in the same place as the other
callbacks. Prepares for declaring all fbcon callbacks in a dedicated
struct type.

If not rotated, fbcon_set_bitops() still clears the callback to NULL.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
---
 drivers/video/fbdev/core/fbcon_ccw.c    | 1 +
 drivers/video/fbdev/core/fbcon_cw.c     | 1 +
 drivers/video/fbdev/core/fbcon_rotate.c | 4 +---
 drivers/video/fbdev/core/fbcon_rotate.h | 3 +++
 drivers/video/fbdev/core/fbcon_ud.c     | 1 +
 5 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/video/fbdev/core/fbcon_ccw.c b/drivers/video/fbdev/core/fbcon_ccw.c
index 2ba8ec4c3e2b..ba744b67a4fd 100644
--- a/drivers/video/fbdev/core/fbcon_ccw.c
+++ b/drivers/video/fbdev/core/fbcon_ccw.c
@@ -398,4 +398,5 @@ void fbcon_rotate_ccw(struct fbcon_par *par)
 	par->clear_margins = ccw_clear_margins;
 	par->cursor = ccw_cursor;
 	par->update_start = ccw_update_start;
+	par->rotate_font = fbcon_rotate_font;
 }
diff --git a/drivers/video/fbdev/core/fbcon_cw.c b/drivers/video/fbdev/core/fbcon_cw.c
index 4bd22d5ee5f4..974bd9d9b770 100644
--- a/drivers/video/fbdev/core/fbcon_cw.c
+++ b/drivers/video/fbdev/core/fbcon_cw.c
@@ -381,4 +381,5 @@ void fbcon_rotate_cw(struct fbcon_par *par)
 	par->clear_margins = cw_clear_margins;
 	par->cursor = cw_cursor;
 	par->update_start = cw_update_start;
+	par->rotate_font = fbcon_rotate_font;
 }
diff --git a/drivers/video/fbdev/core/fbcon_rotate.c b/drivers/video/fbdev/core/fbcon_rotate.c
index 380b2746451a..0c7cac71a9c2 100644
--- a/drivers/video/fbdev/core/fbcon_rotate.c
+++ b/drivers/video/fbdev/core/fbcon_rotate.c
@@ -18,7 +18,7 @@
 #include "fbcon.h"
 #include "fbcon_rotate.h"
 
-static int fbcon_rotate_font(struct fb_info *info, struct vc_data *vc)
+int fbcon_rotate_font(struct fb_info *info, struct vc_data *vc)
 {
 	struct fbcon_par *par = info->fbcon_par;
 	int len, err = 0;
@@ -95,8 +95,6 @@ static int fbcon_rotate_font(struct fb_info *info, struct vc_data *vc)
 
 void fbcon_set_rotate(struct fbcon_par *par)
 {
-	par->rotate_font = fbcon_rotate_font;
-
 	switch (par->rotate) {
 	case FB_ROTATE_CW:
 		fbcon_rotate_cw(par);
diff --git a/drivers/video/fbdev/core/fbcon_rotate.h b/drivers/video/fbdev/core/fbcon_rotate.h
index 48305e1a0763..784f3231a958 100644
--- a/drivers/video/fbdev/core/fbcon_rotate.h
+++ b/drivers/video/fbdev/core/fbcon_rotate.h
@@ -90,7 +90,10 @@ static inline void rotate_ccw(const char *in, char *out, u32 width, u32 height)
 	}
 }
 
+int fbcon_rotate_font(struct fb_info *info, struct vc_data *vc);
+
 extern void fbcon_rotate_cw(struct fbcon_par *par);
 extern void fbcon_rotate_ud(struct fbcon_par *par);
 extern void fbcon_rotate_ccw(struct fbcon_par *par);
+
 #endif
diff --git a/drivers/video/fbdev/core/fbcon_ud.c b/drivers/video/fbdev/core/fbcon_ud.c
index 14b40e2bf323..1a214a4d538f 100644
--- a/drivers/video/fbdev/core/fbcon_ud.c
+++ b/drivers/video/fbdev/core/fbcon_ud.c
@@ -425,4 +425,5 @@ void fbcon_rotate_ud(struct fbcon_par *par)
 	par->clear_margins = ud_clear_margins;
 	par->cursor = ud_cursor;
 	par->update_start = ud_update_start;
+	par->rotate_font = fbcon_rotate_font;
 }
-- 
2.51.0


^ permalink raw reply related

* [PATCH v2 0/5] fbcon: Move bitops callbacks into separate struct
From: Thomas Zimmermann @ 2025-09-09 12:44 UTC (permalink / raw)
  To: sam, simona, deller
  Cc: linux-fbdev, dri-devel, linux-kernel, Thomas Zimmermann

Instances of fbcon use a number callbacks to support tile-based
drawing or console rotation. The fields are writeable in struct
fbcon_ops. Each case; unrotated, various rotated and tile-based
drawing; uses a set of related calbacks. Updating these 'bitops'
at runtime is spread throughout various helper functions.

This series puts related callbacks into dedicated instances of the
new type struct fbcon_bitops. Changing the callbacks at runtime
then only requires to pick the correct instance. It further allows
the various struct fbcon_bitops' to be declared 'static const', which
makes them write-protected at runtime.

v2:
- rename struct fbcon_ops to struct fbcon_par
- drop patch 6

Thomas Zimmermann (5):
  fbcon: Fix empty lines in fbcon.h
  fbcon: Rename struct fbcon_ops to struct fbcon_par
  fbcon: Set rotate_font callback with related callbacks
  fbcon: Move fbcon callbacks into struct fbcon_bitops
  fbcon: Streamline setting rotated/unrotated bitops

 drivers/video/fbdev/core/bitblit.c      | 122 +++----
 drivers/video/fbdev/core/fbcon.c        | 459 ++++++++++++------------
 drivers/video/fbdev/core/fbcon.h        |  17 +-
 drivers/video/fbdev/core/fbcon_ccw.c    | 151 ++++----
 drivers/video/fbdev/core/fbcon_cw.c     | 151 ++++----
 drivers/video/fbdev/core/fbcon_rotate.c |  47 +--
 drivers/video/fbdev/core/fbcon_rotate.h |  18 +-
 drivers/video/fbdev/core/fbcon_ud.c     | 167 ++++-----
 drivers/video/fbdev/core/softcursor.c   |  18 +-
 drivers/video/fbdev/core/tileblit.c     |  32 +-
 10 files changed, 604 insertions(+), 578 deletions(-)

-- 
2.51.0


^ permalink raw reply

* Re: [PATCH v2 0/2] fix coding style issues in sm750.h
From: Dan Carpenter @ 2025-09-09  7:54 UTC (permalink / raw)
  To: Yiming Qian
  Cc: gregkh, linux-fbdev, linux-kernel, linux-staging,
	sudipm.mukherjee, teddy.wang
In-Reply-To: <20250909060130.12919-1-qianym1996@gmail.com>

On Tue, Sep 09, 2025 at 02:01:28PM +0800, Yiming Qian wrote:
> Fix volatile and camelCase issues in coding style:
> 
> changes in v2:
> - Split single patch into two separate patches as suggested
> 

Thanks!

Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>

regards,
dan carpenter

^ permalink raw reply

* [PATCH v1 1/1] video: backlight: lp855x_bl: set correct eprom start for LP8556
From: Svyatoslav Ryhel @ 2025-09-09  7:43 UTC (permalink / raw)
  To: Lee Jones, Daniel Thompson, Jingoo Han, Helge Deller
  Cc: dri-devel, linux-fbdev, linux-kernel
In-Reply-To: <20250909074304.92135-1-clamor95@gmail.com>

According to LP8556 datasheet eprom region starts at 0x98 so adjust value
in the driver accordingly.

Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
---
 drivers/video/backlight/lp855x_bl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/backlight/lp855x_bl.c b/drivers/video/backlight/lp855x_bl.c
index 7075bfab59c4..d191560ce285 100644
--- a/drivers/video/backlight/lp855x_bl.c
+++ b/drivers/video/backlight/lp855x_bl.c
@@ -22,7 +22,7 @@
 #define LP855X_DEVICE_CTRL		0x01
 #define LP855X_EEPROM_START		0xA0
 #define LP855X_EEPROM_END		0xA7
-#define LP8556_EPROM_START		0xA0
+#define LP8556_EPROM_START		0x98
 #define LP8556_EPROM_END		0xAF
 
 /* LP8555/7 Registers */
-- 
2.48.1


^ permalink raw reply related

* [PATCH v1 0/1] video: backlight: lp855x_bl: set correct eprom start for LP8556
From: Svyatoslav Ryhel @ 2025-09-09  7:43 UTC (permalink / raw)
  To: Lee Jones, Daniel Thompson, Jingoo Han, Helge Deller
  Cc: dri-devel, linux-fbdev, linux-kernel

According to datasheet LP8556s eprom region starts at 0x98, not 0xA0.
Adjust start value in the driver accordingly.

Svyatoslav Ryhel (1):
  video: backlight: lp855x_bl: set correct eprom start for LP8556

 drivers/video/backlight/lp855x_bl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

-- 
2.48.1


^ permalink raw reply

* Re: [PATCH 4/6] fbcon: Move fbcon callbacks into struct fbcon_bitops
From: Thomas Zimmermann @ 2025-09-09  7:04 UTC (permalink / raw)
  To: Sam Ravnborg; +Cc: simona, deller, linux-fbdev, dri-devel, linux-kernel
In-Reply-To: <20250908185109.GA643261@ravnborg.org>

Hi

Am 08.09.25 um 20:51 schrieb Sam Ravnborg:
> Hi Thomas.
>
> On Mon, Sep 08, 2025 at 03:06:46PM +0200, Thomas Zimmermann wrote:
>> Hi Sam,
>>
>> thanks for doing the review.
>>
>> Am 05.09.25 um 20:53 schrieb Sam Ravnborg:
>>> Hi Thomas.
>>>
>>> On Mon, Aug 18, 2025 at 12:36:39PM +0200, Thomas Zimmermann wrote:
>>>> Depending on rotation settings, fbcon sets different callback
>>>> functions in struct fbcon from within fbcon_set_bitops(). Declare
>>>> the callback functions in the new type struct fbcon_bitops. Then
>>>> only replace the single bitops pointer in struct fbcon.
>>>>
>>>> Keeping callbacks in constant instances of struct fbcon_bitops
>>>> makes it harder to exploit the callbacks. Also makes the code slightly
>>>> easier to maintain.
>>>>
>>>> For tile-based consoles, there's a separate instance of the bitops
>>>> structure.
>>>>
>>>> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
>>>> ---
>>>>    drivers/video/fbdev/core/bitblit.c   | 17 ++++---
>>>>    drivers/video/fbdev/core/fbcon.c     | 67 +++++++++++++++-------------
>>>>    drivers/video/fbdev/core/fbcon.h     |  7 ++-
>>>>    drivers/video/fbdev/core/fbcon_ccw.c | 18 +++++---
>>>>    drivers/video/fbdev/core/fbcon_cw.c  | 18 +++++---
>>>>    drivers/video/fbdev/core/fbcon_ud.c  | 18 +++++---
>>>>    drivers/video/fbdev/core/tileblit.c  | 16 ++++---
>>>>    7 files changed, 94 insertions(+), 67 deletions(-)
>>>>
>>>> diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
>>>> index a2202cae0691..267bd1635a41 100644
>>>> --- a/drivers/video/fbdev/core/bitblit.c
>>>> +++ b/drivers/video/fbdev/core/bitblit.c
>>>> @@ -384,15 +384,18 @@ static int bit_update_start(struct fb_info *info)
>>>>    	return err;
>>>>    }
>>>> +static const struct fbcon_bitops bit_fbcon_bitops = {
>>>> +	.bmove = bit_bmove,
>>>> +	.clear = bit_clear,
>>>> +	.putcs = bit_putcs,
>>>> +	.clear_margins = bit_clear_margins,
>>>> +	.cursor = bit_cursor,
>>>> +	.update_start = bit_update_start,
>>>> +};
>>>> +
>>>>    void fbcon_set_bitops(struct fbcon *confb)
>>>>    {
>>>> -	confb->bmove = bit_bmove;
>>>> -	confb->clear = bit_clear;
>>>> -	confb->putcs = bit_putcs;
>>>> -	confb->clear_margins = bit_clear_margins;
>>>> -	confb->cursor = bit_cursor;
>>>> -	confb->update_start = bit_update_start;
>>>> -	confb->rotate_font = NULL;
>>>> +	confb->bitops = &bit_fbcon_bitops;
>>>>    	if (confb->rotate)
>>>>    		fbcon_set_rotate(confb);
>>> fbcon_set_rotate() is only used to set the correct bitops.
>>>
>>> It would be simpler to just do
>>>
>>> 	if (confb->rotate)
>>> 		confb->bitops = fbcon_rotate_get_ops();
>>>
>>> And rename fbcon_set_rotate() to fbcon_rotate_get_ops() and return the
>>> pointer to the struct.
>>>
>>> The no need to pass the struct, and it is obvious that the bitops are
>>> overwritten.
>> I tried to keep the changes here to a minimum and avoided changing the
>> function interfaces too much.
>>
>> But did you read patch 5 already? I think the cleanup you're looking for is
>> there. fbcon_set_rotate() will be gone. And the update bit-op selection is
>> contained in fbcon_set_bitops(). I guess this could be renamed to
>> fbcon_update_bitops() to make it clear that it updates from internal state.
> Patch 5 looks good, and is again a nice cleanup.
> I like that the code is now more explicit in what it does and do not
> do overwrites.
>
> Returning a pointer or adding the assignment in a helper is not a big
> deal.
>
> With or without the suggested renaming both patch 4 + 5 are r-b.
>
> That said, I am not expert in this field, but at least you had another
> pair of eyes on the changes.

Thanks a lot. I'll update the series and keep it around for a bit, in 
case anyone else wants to comment.

Best regards
Thomas

> I look forward to see the next batches of refactoring you have planned.
>
> 	Sam

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstrasse 146, 90461 Nuernberg, Germany
GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman
HRB 36809 (AG Nuernberg)



^ permalink raw reply

* [PATCH 2/3] Documentation: fbcon: Reindent 8th step of attach/detach/unload
From: Bagas Sanjaya @ 2025-09-09  6:37 UTC (permalink / raw)
  To: Linux Kernel Mailing List, Linux Documentation, Linux Framebuffer,
	Linux DRI Development
  Cc: Helge Deller, Jonathan Corbet, Bagas Sanjaya
In-Reply-To: <20250909063744.30053-1-bagasdotme@gmail.com>

Properly indent 8th step text (as enumerated list item) to be inline
with other steps.

Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
---
 Documentation/fb/fbcon.rst | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/Documentation/fb/fbcon.rst b/Documentation/fb/fbcon.rst
index b9ddc145aa9f6a..3ed98b3ce64713 100644
--- a/Documentation/fb/fbcon.rst
+++ b/Documentation/fb/fbcon.rst
@@ -251,11 +251,11 @@ restored properly. The following is one of the several methods that you can do:
        echo 1 > /sys/class/vtconsole/vtcon1/bind
 
 8. Once fbcon is unbound, all drivers registered to the system will also
-become unbound.  This means that fbcon and individual framebuffer drivers
-can be unloaded or reloaded at will. Reloading the drivers or fbcon will
-automatically bind the console, fbcon and the drivers together. Unloading
-all the drivers without unloading fbcon will make it impossible for the
-console to bind fbcon.
+   become unbound.  This means that fbcon and individual framebuffer drivers
+   can be unloaded or reloaded at will. Reloading the drivers or fbcon will
+   automatically bind the console, fbcon and the drivers together. Unloading
+   all the drivers without unloading fbcon will make it impossible for the
+   console to bind fbcon.
 
 Notes for vesafb users:
 =======================
-- 
An old man doll... just what I always wanted! - Clara


^ permalink raw reply related

* [PATCH 3/3] Documentation: fbcon: Use admonition directives
From: Bagas Sanjaya @ 2025-09-09  6:37 UTC (permalink / raw)
  To: Linux Kernel Mailing List, Linux Documentation, Linux Framebuffer,
	Linux DRI Development
  Cc: Helge Deller, Jonathan Corbet, Bagas Sanjaya
In-Reply-To: <20250909063744.30053-1-bagasdotme@gmail.com>

Use reST syntax for admonitions (notes and custom admonition
for gotcha).

Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
---
 Documentation/fb/fbcon.rst | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/Documentation/fb/fbcon.rst b/Documentation/fb/fbcon.rst
index 3ed98b3ce64713..a98a5cb0b0d8bd 100644
--- a/Documentation/fb/fbcon.rst
+++ b/Documentation/fb/fbcon.rst
@@ -39,11 +39,13 @@ Also, you will need to select at least one compiled-in font, but if
 you don't do anything, the kernel configuration tool will select one for you,
 usually an 8x16 font.
 
-GOTCHA: A common bug report is enabling the framebuffer without enabling the
-framebuffer console.  Depending on the driver, you may get a blanked or
-garbled display, but the system still boots to completion.  If you are
-fortunate to have a driver that does not alter the graphics chip, then you
-will still get a VGA console.
+.. admonition:: GOTCHA
+
+   A common bug report is enabling the framebuffer without enabling the
+   framebuffer console.  Depending on the driver, you may get a blanked or
+   garbled display, but the system still boots to completion.  If you are
+   fortunate to have a driver that does not alter the graphics chip, then you
+   will still get a VGA console.
 
 B. Loading
 ==========
@@ -117,9 +119,10 @@ C. Boot options
 	outside the given range will still be controlled by the standard
 	console driver.
 
-	NOTE: For x86 machines, the standard console is the VGA console which
-	is typically located on the same video card.  Thus, the consoles that
-	are controlled by the VGA console will be garbled.
+	.. note::
+	   For x86 machines, the standard console is the VGA console which
+	   is typically located on the same video card.  Thus, the consoles that
+	   are controlled by the VGA console will be garbled.
 
 4. fbcon=rotate:<n>
 
@@ -141,10 +144,11 @@ C. Boot options
 	Console rotation will only become available if Framebuffer Console
 	Rotation support is compiled in your kernel.
 
-	NOTE: This is purely console rotation.  Any other applications that
-	use the framebuffer will remain at their 'normal' orientation.
-	Actually, the underlying fb driver is totally ignorant of console
-	rotation.
+	.. note::
+	   This is purely console rotation.  Any other applications that
+	   use the framebuffer will remain at their 'normal' orientation.
+	   Actually, the underlying fb driver is totally ignorant of console
+	   rotation.
 
 5. fbcon=margin:<color>
 
-- 
An old man doll... just what I always wanted! - Clara


^ permalink raw reply related

* [PATCH 0/3] Documentation: fbcon: formatting cleanup and improvements
From: Bagas Sanjaya @ 2025-09-09  6:37 UTC (permalink / raw)
  To: Linux Kernel Mailing List, Linux Documentation, Linux Framebuffer,
	Linux DRI Development
  Cc: Helge Deller, Jonathan Corbet, Bagas Sanjaya

Hi,

Here are reST formatting cleanup and improvements for fbcon documentation.
The shortlog below should be self-explanatory.

This series is based on docs-next tree.

Enjoy!

Bagas Sanjaya (3):
  Documentation: fbcon: Add boot options and attach/detach/unload
    section headings
  Documentation: fbcon: Reindent 8th step of attach/detach/unload
  Documentation: fbcon: Use admonition directives

 Documentation/fb/fbcon.rst | 42 ++++++++++++++++++++++----------------
 1 file changed, 24 insertions(+), 18 deletions(-)


base-commit: 7e5a0fe4e8ae2eb341f8ebbee2b24231a58fc28b
-- 
An old man doll... just what I always wanted! - Clara


^ permalink raw reply

* [PATCH 1/3] Documentation: fbcon: Add boot options and attach/detach/unload section headings
From: Bagas Sanjaya @ 2025-09-09  6:37 UTC (permalink / raw)
  To: Linux Kernel Mailing List, Linux Documentation, Linux Framebuffer,
	Linux DRI Development
  Cc: Helge Deller, Jonathan Corbet, Bagas Sanjaya
In-Reply-To: <20250909063744.30053-1-bagasdotme@gmail.com>

These last two enumerated sections headings are in normal paragraphs,
making both sections merged into "Loading" section instead.

Add the headings.

Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
---
 Documentation/fb/fbcon.rst | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Documentation/fb/fbcon.rst b/Documentation/fb/fbcon.rst
index 212f7003cfbab2..b9ddc145aa9f6a 100644
--- a/Documentation/fb/fbcon.rst
+++ b/Documentation/fb/fbcon.rst
@@ -74,6 +74,7 @@ Possible scenarios:
 	 over the console.
 
 C. Boot options
+===============
 
 	 The framebuffer console has several, largely unknown, boot options
 	 that can change its behavior.
@@ -172,7 +173,8 @@ C. Boot options
 	The value 'n' overrides the number of bootup logos. 0 disables the
 	logo, and -1 gives the default which is the number of online CPUs.
 
-C. Attaching, Detaching and Unloading
+D. Attaching, Detaching and Unloading
+=====================================
 
 Before going on to how to attach, detach and unload the framebuffer console, an
 illustration of the dependencies may help.
-- 
An old man doll... just what I always wanted! - Clara


^ permalink raw reply related

* Re: [PATCH v1 2/2] Drivers: hv: Make CONFIG_HYPERV bool
From: Greg KH @ 2025-09-09  6:23 UTC (permalink / raw)
  To: Mukesh R
  Cc: dri-devel, linux-kernel, linux-input, linux-hyperv, netdev,
	linux-pci, linux-scsi, linux-fbdev, linux-arch, virtualization,
	maarten.lankhorst, mripard, tzimmermann, airlied, simona, jikos,
	bentiss, kys, haiyangz, wei.liu, decui, dmitry.torokhov,
	andrew+netdev, davem, edumazet, kuba, pabeni, bhelgaas,
	James.Bottomley, martin.petersen, deller, arnd, sgarzare, horms
In-Reply-To: <d7d7b23f-eaea-2dbc-9c9d-4bee082f6fe7@linux.microsoft.com>

On Mon, Sep 08, 2025 at 02:01:34PM -0700, Mukesh R wrote:
> On 9/6/25 04:36, Greg KH wrote:
> > On Fri, Sep 05, 2025 at 06:09:52PM -0700, Mukesh Rathor wrote:
> >> With CONFIG_HYPERV and CONFIG_HYPERV_VMBUS separated, change CONFIG_HYPERV
> >> to bool from tristate. CONFIG_HYPERV now becomes the core Hyper-V
> >> hypervisor support, such as hypercalls, clocks/timers, Confidential
> >> Computing setup, PCI passthru, etc. that doesn't involve VMBus or VMBus
> >> devices.
> > 
> > But why are you making it so that this can not be a module anymore?  You
> > are now forcing ALL Linux distro users to always have this code in their
> > system, despite not ever using the feature.  That feels like a waste to
> > me.
> > 
> > What is preventing this from staying as a module?  Why must you always
> > have this code loaded at all times for everyone?
> 
> This is currently not a module. I assume it was at the beginning. In
> drivers/Makefile today:
> 
> obj-$(subst m,y,$(CONFIG_HYPERV))       += hv/
> 
> 
> More context: CONFIG_HYPERV doesn't really reflect one module. It is
> both for kernel built in code and building of stuff in drivers/hv.
> 
> drivers/hv then builds 4 modules:
> 
> obj-$(CONFIG_HYPERV)            += hv_vmbus.o
> obj-$(CONFIG_HYPERV_UTILS)      += hv_utils.o
> obj-$(CONFIG_HYPERV_BALLOON)    += hv_balloon.o
> obj-$(CONFIG_MSHV_ROOT)         += mshv_root.o
> 
> Notice vmbus is using CONFIG_HYPERV because there is no 
> CONFIG_HYPERV_VMBUS. We are trying to fix that here.

Ah, I missed that this was getting changed in the Makefile in patch 1,
that is what I was worried about.

Nevermind, this should be fine, sorry for the noise.  I'll go queue it
up later today.

greg k-h

^ permalink raw reply

* [PATCH v2 2/2] staging: sm750fb: rename snake case variables
From: Yiming Qian @ 2025-09-09  6:01 UTC (permalink / raw)
  To: dan.carpenter
  Cc: gregkh, linux-fbdev, linux-kernel, linux-staging, qianym1996,
	sudipm.mukherjee, teddy.wang
In-Reply-To: <20250909060130.12919-1-qianym1996@gmail.com>

Replaces CamelCase variable names with snake_case:
- dprBase -> dpr_base
- dpPortBase -> dp_port_base

Signed-off-by: Yiming Qian <qianym1996@gmail.com>
---
 drivers/staging/sm750fb/sm750.h       | 4 ++--
 drivers/staging/sm750fb/sm750_accel.c | 6 +++---
 drivers/staging/sm750fb/sm750_hw.c    | 4 ++--
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/staging/sm750fb/sm750.h b/drivers/staging/sm750fb/sm750.h
index 41f1fb390..fcb7d586e 100644
--- a/drivers/staging/sm750fb/sm750.h
+++ b/drivers/staging/sm750fb/sm750.h
@@ -50,9 +50,9 @@ struct init_status {
 
 struct lynx_accel {
 	/* base virtual address of DPR registers */
-	unsigned char __iomem *dprBase;
+	unsigned char __iomem *dpr_base;
 	/* base virtual address of de data port */
-	unsigned char __iomem *dpPortBase;
+	unsigned char __iomem *dp_port_base;
 
 	/* function pointers */
 	void (*de_init)(struct lynx_accel *accel);
diff --git a/drivers/staging/sm750fb/sm750_accel.c b/drivers/staging/sm750fb/sm750_accel.c
index 44b9e3fe3..7ac2e7b6e 100644
--- a/drivers/staging/sm750fb/sm750_accel.c
+++ b/drivers/staging/sm750fb/sm750_accel.c
@@ -19,17 +19,17 @@
 #include "sm750_accel.h"
 static inline void write_dpr(struct lynx_accel *accel, int offset, u32 regValue)
 {
-	writel(regValue, accel->dprBase + offset);
+	writel(regValue, accel->dpr_base + offset);
 }
 
 static inline u32 read_dpr(struct lynx_accel *accel, int offset)
 {
-	return readl(accel->dprBase + offset);
+	return readl(accel->dpr_base + offset);
 }
 
 static inline void write_dpPort(struct lynx_accel *accel, u32 data)
 {
-	writel(data, accel->dpPortBase);
+	writel(data, accel->dp_port_base);
 }
 
 void sm750_hw_de_init(struct lynx_accel *accel)
diff --git a/drivers/staging/sm750fb/sm750_hw.c b/drivers/staging/sm750fb/sm750_hw.c
index 7119b67ef..ce46f240c 100644
--- a/drivers/staging/sm750fb/sm750_hw.c
+++ b/drivers/staging/sm750fb/sm750_hw.c
@@ -58,8 +58,8 @@ int hw_sm750_map(struct sm750_dev *sm750_dev, struct pci_dev *pdev)
 	}
 	pr_info("mmio virtual addr = %p\n", sm750_dev->pvReg);
 
-	sm750_dev->accel.dprBase = sm750_dev->pvReg + DE_BASE_ADDR_TYPE1;
-	sm750_dev->accel.dpPortBase = sm750_dev->pvReg + DE_PORT_ADDR_TYPE1;
+	sm750_dev->accel.dpr_base = sm750_dev->pvReg + DE_BASE_ADDR_TYPE1;
+	sm750_dev->accel.dp_port_base = sm750_dev->pvReg + DE_PORT_ADDR_TYPE1;
 
 	mmio750 = sm750_dev->pvReg;
 	sm750_set_chip_type(sm750_dev->devid, sm750_dev->revid);
-- 
2.51.0


^ permalink raw reply related

* [PATCH v2 1/2] staging: sm750fb: remove unnecessary volatile qualifiers
From: Yiming Qian @ 2025-09-09  6:01 UTC (permalink / raw)
  To: dan.carpenter
  Cc: gregkh, linux-fbdev, linux-kernel, linux-staging, qianym1996,
	sudipm.mukherjee, teddy.wang
In-Reply-To: <20250909060130.12919-1-qianym1996@gmail.com>

The use of 'volatile' for memory-mapped I/O pointers is discouraged
in the Linux kernel as per
Documentation/process/volatile-considered-harmful.rst.

This patch removes the unnecessary 'volatile' qualifiers from the
lynx_accel struct members, improving code quality and maintainability.

Signed-off-by: Yiming Qian <qianym1996@gmail.com>
---
 drivers/staging/sm750fb/sm750.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/sm750fb/sm750.h b/drivers/staging/sm750fb/sm750.h
index d7f40efe3..41f1fb390 100644
--- a/drivers/staging/sm750fb/sm750.h
+++ b/drivers/staging/sm750fb/sm750.h
@@ -50,9 +50,9 @@ struct init_status {
 
 struct lynx_accel {
 	/* base virtual address of DPR registers */
-	volatile unsigned char __iomem *dprBase;
+	unsigned char __iomem *dprBase;
 	/* base virtual address of de data port */
-	volatile unsigned char __iomem *dpPortBase;
+	unsigned char __iomem *dpPortBase;
 
 	/* function pointers */
 	void (*de_init)(struct lynx_accel *accel);
@@ -128,7 +128,7 @@ struct lynx_cursor {
 	char __iomem *vstart;
 	int offset;
 	/* mmio addr of hw cursor */
-	volatile char __iomem *mmio;
+	char __iomem *mmio;
 };
 
 struct lynxfb_crtc {
-- 
2.51.0


^ permalink raw reply related

* [PATCH v2 0/2] fix coding style issues in sm750.h
From: Yiming Qian @ 2025-09-09  6:01 UTC (permalink / raw)
  To: dan.carpenter
  Cc: gregkh, linux-fbdev, linux-kernel, linux-staging, qianym1996,
	sudipm.mukherjee, teddy.wang
In-Reply-To: <aL5tjv_2YkvHPs5C@stanley.mountain>

Fix volatile and camelCase issues in coding style:

changes in v2:
- Split single patch into two separate patches as suggested


Yiming Qian (2):
  staging: sm750fb: remove unnecessary volatile qualifiers
  staging: sm750fb: rename snake case variables

 drivers/staging/sm750fb/sm750.h       | 6 +++---
 drivers/staging/sm750fb/sm750_accel.c | 6 +++---
 drivers/staging/sm750fb/sm750_hw.c    | 4 ++--
 3 files changed, 8 insertions(+), 8 deletions(-)

-- 
2.51.0


^ permalink raw reply

* [report] BUG: KASAN: slab-out-of-bounds in soft_cursor+0x454/0xa30
From: Wang Liang @ 2025-09-09  3:24 UTC (permalink / raw)
  To: gregkh, jirislaby, npitre, simona, deller, soci
  Cc: yuehaibing, zhangchangzhong, wangliang74, linux-fbdev, netdev,
	linux-kernel

Hello, my local syzkaller report a KASAN slab-out-of-bounds issue:

 ==================================================================
 BUG: KASAN: slab-out-of-bounds in soft_cursor+0x454/0xa30
 Read of size 128 at addr ffff88810f53d000 by task test/674

 CPU: 1 UID: 0 PID: 674 Comm: test Not tainted 6.17.0-rc4+ #272 PREEMPT(none)
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
 Call Trace:
  <TASK>
  dump_stack_lvl+0xab/0xe0
  print_address_description.constprop.0+0x2c/0x3d0
  print_report+0xb4/0x270
  kasan_report+0xb8/0xf0
  kasan_check_range+0x39/0x1c0
  __asan_memcpy+0x24/0x60
  soft_cursor+0x454/0xa30
  ccw_cursor+0x1715/0x1ce0
  fbcon_cursor+0x410/0x5f0
  hide_cursor+0x8b/0x230
  redraw_screen+0x5c7/0x740
  vc_do_resize+0xcdd/0xe90
  fbcon_do_set_font+0x45d/0x940
  fbcon_set_font+0x83b/0x980
  con_font_op+0x805/0xa10
  vt_k_ioctl+0x2f9/0xb00
  vt_ioctl+0x14a/0x1870
  tty_ioctl+0x6d0/0x1610
  __x64_sys_ioctl+0x194/0x210
  do_syscall_64+0x5f/0x2d0
  entry_SYSCALL_64_after_hwframe+0x76/0x7e
  </TASK>

 Allocated by task 613:
  kasan_save_stack+0x24/0x50
  kasan_save_track+0x14/0x30
  __kasan_kmalloc+0x7f/0x90
  __kmalloc_noprof+0x1f5/0x510
  fbcon_rotate_font+0x440/0xee0
  fbcon_switch+0x751/0x1480
  redraw_screen+0x2b6/0x740
  vc_do_resize+0xcdd/0xe90
  fbcon_modechanged+0x333/0x6d0
  fbcon_set_all_vcs+0x1e0/0x3c0
  rotate_all_store+0x2e4/0x370
  dev_attr_store+0x5c/0x90
  sysfs_kf_write+0x1db/0x270
  kernfs_fop_write_iter+0x365/0x510
  vfs_write+0xa5e/0xd70
  ksys_write+0x129/0x240
  do_syscall_64+0x5f/0x2d0
  entry_SYSCALL_64_after_hwframe+0x76/0x7e

This issue can be reproduced by:
 echo 3 > /sys/devices/virtual/graphics/fbcon/rotate_all
 ioctl(fd, KDFONTOP, &font_op); // set bigger width or height

When exec KD_FONT_OP_SET cmd, function fbcon_do_set_font() update
vc->vc_font.width/height, but visit the old ops->fontbuffer in
ccw_cursor(), which will be updated in fbcon_rotate_font() later.

fbcon_set_font
    fbcon_do_set_font
        // update vc->vc_font.width/height
        vc->vc_font.width = w;
        vc->vc_font.height = h;
        vc_do_resize
            redraw_screen
                // ops->fontbuffer is old, but width/height is new
                hide_cursor
                    ccw_cursor
                        src = ops->fontbuffer + (...*vc->vc_font.width));
                // update ops->fontbuffer
                fbcon_switch
                    fbcon_rotate_font
                        ops->fontbuffer = kmalloc_array(len, d_cellsize);

I am not sure below code is ok to fix this issue, although it can prevent
the KASAN report.

diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 62049ceb34de..12dc2fa30417 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -953,7 +953,6 @@  void redraw_screen(struct vc_data *vc, int is_switch)
 		if (tty0dev)
 			sysfs_notify(&tty0dev->kobj, NULL, "active");
 	} else {
-		hide_cursor(vc);
 		redraw = 1;
 	}
 
@@ -964,6 +963,8 @@  void redraw_screen(struct vc_data *vc, int is_switch)
 		set_origin(vc);
 		update = vc->vc_sw->con_switch(vc);
 		set_palette(vc);
+		if (!is_switch)
+			hide_cursor(vc);
 		/*
 		 * If console changed from mono<->color, the best we can do
 		 * is to clear the buffer attributes. As it currently stands,

^ permalink raw reply related

* [PATCH v2] fbdev/simplefb: Fix use after free in simplefb_detach_genpds()
From: Janne Grunau @ 2025-09-08 21:23 UTC (permalink / raw)
  To: Hans de Goede, Helge Deller, Thierry Reding
  Cc: linux-fbdev, dri-devel, linux-kernel, Daniel Huhardeaux, stable,
	Janne Grunau

The pm_domain cleanup can not be devres managed as it uses struct
simplefb_par which is allocated within struct fb_info by
framebuffer_alloc(). This allocation is explicitly freed by
unregister_framebuffer() in simplefb_remove().
Devres managed cleanup runs after the device remove call and thus can no
longer access struct simplefb_par.
Call simplefb_detach_genpds() explicitly from simplefb_destroy() like
the cleanup functions for clocks and regulators.

Fixes an use after free on M2 Mac mini during
aperture_remove_conflicting_devices() using the downstream asahi kernel
with Debian's kernel config. For unknown reasons this started to
consistently dereference an invalid pointer in v6.16.3 based kernels.

[    6.736134] BUG: KASAN: slab-use-after-free in simplefb_detach_genpds+0x58/0x220
[    6.743545] Read of size 4 at addr ffff8000304743f0 by task (udev-worker)/227
[    6.750697]
[    6.752182] CPU: 6 UID: 0 PID: 227 Comm: (udev-worker) Tainted: G S                  6.16.3-asahi+ #16 PREEMPTLAZY
[    6.752186] Tainted: [S]=CPU_OUT_OF_SPEC
[    6.752187] Hardware name: Apple Mac mini (M2, 2023) (DT)
[    6.752189] Call trace:
[    6.752190]  show_stack+0x34/0x98 (C)
[    6.752194]  dump_stack_lvl+0x60/0x80
[    6.752197]  print_report+0x17c/0x4d8
[    6.752201]  kasan_report+0xb4/0x100
[    6.752206]  __asan_report_load4_noabort+0x20/0x30
[    6.752209]  simplefb_detach_genpds+0x58/0x220
[    6.752213]  devm_action_release+0x50/0x98
[    6.752216]  release_nodes+0xd0/0x2c8
[    6.752219]  devres_release_all+0xfc/0x178
[    6.752221]  device_unbind_cleanup+0x28/0x168
[    6.752224]  device_release_driver_internal+0x34c/0x470
[    6.752228]  device_release_driver+0x20/0x38
[    6.752231]  bus_remove_device+0x1b0/0x380
[    6.752234]  device_del+0x314/0x820
[    6.752238]  platform_device_del+0x3c/0x1e8
[    6.752242]  platform_device_unregister+0x20/0x50
[    6.752246]  aperture_detach_platform_device+0x1c/0x30
[    6.752250]  aperture_detach_devices+0x16c/0x290
[    6.752253]  aperture_remove_conflicting_devices+0x34/0x50
...
[    6.752343]
[    6.967409] Allocated by task 62:
[    6.970724]  kasan_save_stack+0x3c/0x70
[    6.974560]  kasan_save_track+0x20/0x40
[    6.978397]  kasan_save_alloc_info+0x40/0x58
[    6.982670]  __kasan_kmalloc+0xd4/0xd8
[    6.986420]  __kmalloc_noprof+0x194/0x540
[    6.990432]  framebuffer_alloc+0xc8/0x130
[    6.994444]  simplefb_probe+0x258/0x2378
...
[    7.054356]
[    7.055838] Freed by task 227:
[    7.058891]  kasan_save_stack+0x3c/0x70
[    7.062727]  kasan_save_track+0x20/0x40
[    7.066565]  kasan_save_free_info+0x4c/0x80
[    7.070751]  __kasan_slab_free+0x6c/0xa0
[    7.074675]  kfree+0x10c/0x380
[    7.077727]  framebuffer_release+0x5c/0x90
[    7.081826]  simplefb_destroy+0x1b4/0x2c0
[    7.085837]  put_fb_info+0x98/0x100
[    7.089326]  unregister_framebuffer+0x178/0x320
[    7.093861]  simplefb_remove+0x3c/0x60
[    7.097611]  platform_remove+0x60/0x98
[    7.101361]  device_remove+0xb8/0x160
[    7.105024]  device_release_driver_internal+0x2fc/0x470
[    7.110256]  device_release_driver+0x20/0x38
[    7.114529]  bus_remove_device+0x1b0/0x380
[    7.118628]  device_del+0x314/0x820
[    7.122116]  platform_device_del+0x3c/0x1e8
[    7.126302]  platform_device_unregister+0x20/0x50
[    7.131012]  aperture_detach_platform_device+0x1c/0x30
[    7.136157]  aperture_detach_devices+0x16c/0x290
[    7.140779]  aperture_remove_conflicting_devices+0x34/0x50
...

Reported-by: Daniel Huhardeaux <tech@tootai.net>
Cc: stable@vger.kernel.org
Fixes: 92a511a568e44 ("fbdev/simplefb: Add support for generic power-domains")
Signed-off-by: Janne Grunau <j@jannau.net>
---
Changes in v2:
- reworked change due to missed use of `par->num_genpds` before setting
  it. Missed in testing due to FB_SIMPLE vs. SYSFB_SIMPLEFB.
- Link to v1: https://lore.kernel.org/r/20250901-simplefb-genpd-uaf-v1-1-0d9f3a34c4dc@jannau.net
---
 drivers/video/fbdev/simplefb.c | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/drivers/video/fbdev/simplefb.c b/drivers/video/fbdev/simplefb.c
index 1893815dc67f4c1403eea42c0e10a7ead4d96ba9..2f3e5449509d1824a3d26f73e103af82d56d558a 100644
--- a/drivers/video/fbdev/simplefb.c
+++ b/drivers/video/fbdev/simplefb.c
@@ -93,6 +93,7 @@ struct simplefb_par {
 
 static void simplefb_clocks_destroy(struct simplefb_par *par);
 static void simplefb_regulators_destroy(struct simplefb_par *par);
+static void simplefb_detach_genpds(void *res);
 
 /*
  * fb_ops.fb_destroy is called by the last put_fb_info() call at the end
@@ -105,6 +106,7 @@ static void simplefb_destroy(struct fb_info *info)
 
 	simplefb_regulators_destroy(info->par);
 	simplefb_clocks_destroy(info->par);
+	simplefb_detach_genpds(info->par);
 	if (info->screen_base)
 		iounmap(info->screen_base);
 
@@ -451,7 +453,7 @@ static int simplefb_attach_genpds(struct simplefb_par *par,
 				  struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
-	unsigned int i;
+	unsigned int i, num_genpds;
 	int err;
 
 	err = of_count_phandle_with_args(dev->of_node, "power-domains",
@@ -465,26 +467,33 @@ static int simplefb_attach_genpds(struct simplefb_par *par,
 		return err;
 	}
 
-	par->num_genpds = err;
+	num_genpds = err;
 
 	/*
 	 * Single power-domain devices are handled by the driver core, so
 	 * nothing to do here.
 	 */
-	if (par->num_genpds <= 1)
+	if (num_genpds <= 1)
 		return 0;
 
-	par->genpds = devm_kcalloc(dev, par->num_genpds, sizeof(*par->genpds),
+	par->genpds = devm_kcalloc(dev, num_genpds, sizeof(*par->genpds),
 				   GFP_KERNEL);
 	if (!par->genpds)
 		return -ENOMEM;
 
-	par->genpd_links = devm_kcalloc(dev, par->num_genpds,
+	par->genpd_links = devm_kcalloc(dev, num_genpds,
 					sizeof(*par->genpd_links),
 					GFP_KERNEL);
 	if (!par->genpd_links)
 		return -ENOMEM;
 
+	/*
+	 * Set par->num_genpds only after genpds and genpd_links are allocated
+	 * to exit early from simplefb_detach_genpds() without full
+	 * initialisation.
+	 */
+	par->num_genpds = num_genpds;
+
 	for (i = 0; i < par->num_genpds; i++) {
 		par->genpds[i] = dev_pm_domain_attach_by_id(dev, i);
 		if (IS_ERR(par->genpds[i])) {
@@ -506,9 +515,10 @@ static int simplefb_attach_genpds(struct simplefb_par *par,
 			dev_warn(dev, "failed to link power-domain %u\n", i);
 	}
 
-	return devm_add_action_or_reset(dev, simplefb_detach_genpds, par);
+	return 0;
 }
 #else
+static void simplefb_detach_genpds(void *res) { }
 static int simplefb_attach_genpds(struct simplefb_par *par,
 				  struct platform_device *pdev)
 {

---
base-commit: 8f5ae30d69d7543eee0d70083daf4de8fe15d585
change-id: 20250901-simplefb-genpd-uaf-352704761a29

Best regards,
-- 
Janne Grunau <j@jannau.net>


^ permalink raw reply related

* Re: [PATCH v1 2/2] Drivers: hv: Make CONFIG_HYPERV bool
From: Mukesh R @ 2025-09-08 21:01 UTC (permalink / raw)
  To: Greg KH
  Cc: dri-devel, linux-kernel, linux-input, linux-hyperv, netdev,
	linux-pci, linux-scsi, linux-fbdev, linux-arch, virtualization,
	maarten.lankhorst, mripard, tzimmermann, airlied, simona, jikos,
	bentiss, kys, haiyangz, wei.liu, decui, dmitry.torokhov,
	andrew+netdev, davem, edumazet, kuba, pabeni, bhelgaas,
	James.Bottomley, martin.petersen, deller, arnd, sgarzare, horms
In-Reply-To: <2025090621-rumble-cost-2c0d@gregkh>

On 9/6/25 04:36, Greg KH wrote:
> On Fri, Sep 05, 2025 at 06:09:52PM -0700, Mukesh Rathor wrote:
>> With CONFIG_HYPERV and CONFIG_HYPERV_VMBUS separated, change CONFIG_HYPERV
>> to bool from tristate. CONFIG_HYPERV now becomes the core Hyper-V
>> hypervisor support, such as hypercalls, clocks/timers, Confidential
>> Computing setup, PCI passthru, etc. that doesn't involve VMBus or VMBus
>> devices.
> 
> But why are you making it so that this can not be a module anymore?  You
> are now forcing ALL Linux distro users to always have this code in their
> system, despite not ever using the feature.  That feels like a waste to
> me.
> 
> What is preventing this from staying as a module?  Why must you always
> have this code loaded at all times for everyone?

This is currently not a module. I assume it was at the beginning. In
drivers/Makefile today:

obj-$(subst m,y,$(CONFIG_HYPERV))       += hv/


More context: CONFIG_HYPERV doesn't really reflect one module. It is
both for kernel built in code and building of stuff in drivers/hv.

drivers/hv then builds 4 modules:

obj-$(CONFIG_HYPERV)            += hv_vmbus.o
obj-$(CONFIG_HYPERV_UTILS)      += hv_utils.o
obj-$(CONFIG_HYPERV_BALLOON)    += hv_balloon.o
obj-$(CONFIG_MSHV_ROOT)         += mshv_root.o

Notice vmbus is using CONFIG_HYPERV because there is no 
CONFIG_HYPERV_VMBUS. We are trying to fix that here.

Thanks,
-Mukesh

> thanks,
> 
> greg k-h


^ permalink raw reply

* [syzbot] [fbdev?] KASAN: vmalloc-out-of-bounds Write in imageblit (5)
From: syzbot @ 2025-09-08 19:19 UTC (permalink / raw)
  To: deller, dri-devel, linux-fbdev, linux-kernel, simona, soci,
	syzkaller-bugs

Hello,

syzbot found the following issue on:

HEAD commit:    76eeb9b8de98 Linux 6.17-rc5
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14379562580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=e0bea6c0b97a2002
dashboard link: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b2c9b90de8ba/disk-76eeb9b8.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/dd1bcf1fd25e/vmlinux-76eeb9b8.xz
kernel image: https://storage.googleapis.com/syzbot-assets/dc7e94f5dffb/bzImage-76eeb9b8.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: vmalloc-out-of-bounds in fb_write_offset drivers/video/fbdev/core/sysmem.h:30 [inline]
BUG: KASAN: vmalloc-out-of-bounds in fb_bitmap_2ppw drivers/video/fbdev/core/fb_imageblit.h:364 [inline]
BUG: KASAN: vmalloc-out-of-bounds in fb_bitmap_imageblit drivers/video/fbdev/core/fb_imageblit.h:462 [inline]
BUG: KASAN: vmalloc-out-of-bounds in fb_imageblit drivers/video/fbdev/core/fb_imageblit.h:492 [inline]
BUG: KASAN: vmalloc-out-of-bounds in sys_imageblit+0x1a6f/0x1e60 drivers/video/fbdev/core/sysimgblt.c:24
Write of size 8 at addr ffffc90003649000 by task syz.1.259/7231

CPU: 0 UID: 0 PID: 7231 Comm: syz.1.259 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xcd/0x630 mm/kasan/report.c:482
 kasan_report+0xe0/0x110 mm/kasan/report.c:595
 fb_write_offset drivers/video/fbdev/core/sysmem.h:30 [inline]
 fb_bitmap_2ppw drivers/video/fbdev/core/fb_imageblit.h:364 [inline]
 fb_bitmap_imageblit drivers/video/fbdev/core/fb_imageblit.h:462 [inline]
 fb_imageblit drivers/video/fbdev/core/fb_imageblit.h:492 [inline]
 sys_imageblit+0x1a6f/0x1e60 drivers/video/fbdev/core/sysimgblt.c:24
 drm_fbdev_shmem_defio_imageblit+0x20/0x130 drivers/gpu/drm/drm_fbdev_shmem.c:38
 bit_putcs_unaligned drivers/video/fbdev/core/bitblit.c:138 [inline]
 bit_putcs+0x90f/0xde0 drivers/video/fbdev/core/bitblit.c:187
 fbcon_putcs+0x384/0x4a0 drivers/video/fbdev/core/fbcon.c:1327
 do_update_region+0x2e6/0x3f0 drivers/tty/vt/vt.c:627
 update_region+0xc1/0x160 drivers/tty/vt/vt.c:641
 vcs_write+0x7c7/0xdb0 drivers/tty/vt/vc_screen.c:698
 vfs_write+0x29d/0x11d0 fs/read_write.c:684
 ksys_write+0x12a/0x250 fs/read_write.c:738
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7effcbf8ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007effccda6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007effcc1c6270 RCX: 00007effcbf8ebe9
RDX: 000000000000ffd8 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007effcc011e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007effcc1c6308 R14: 00007effcc1c6270 R15: 00007ffd4fcb0c08
 </TASK>

The buggy address belongs to a 0-page vmalloc region starting at 0xffffc90003349000 allocated at drm_gem_shmem_vmap_locked+0x561/0x7e0 drivers/gpu/drm/drm_gem_shmem_helper.c:371
Memory state around the buggy address:
 ffffc90003648f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc90003648f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc90003649000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
                   ^
 ffffc90003649080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc90003649100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

^ permalink raw reply

* Re: [PATCH 4/6] fbcon: Move fbcon callbacks into struct fbcon_bitops
From: Sam Ravnborg @ 2025-09-08 18:51 UTC (permalink / raw)
  To: Thomas Zimmermann; +Cc: simona, deller, linux-fbdev, dri-devel, linux-kernel
In-Reply-To: <c1674a81-3435-445c-b359-e2b094b7f8a5@suse.de>

Hi Thomas.

On Mon, Sep 08, 2025 at 03:06:46PM +0200, Thomas Zimmermann wrote:
> Hi Sam,
> 
> thanks for doing the review.
> 
> Am 05.09.25 um 20:53 schrieb Sam Ravnborg:
> > Hi Thomas.
> > 
> > On Mon, Aug 18, 2025 at 12:36:39PM +0200, Thomas Zimmermann wrote:
> > > Depending on rotation settings, fbcon sets different callback
> > > functions in struct fbcon from within fbcon_set_bitops(). Declare
> > > the callback functions in the new type struct fbcon_bitops. Then
> > > only replace the single bitops pointer in struct fbcon.
> > > 
> > > Keeping callbacks in constant instances of struct fbcon_bitops
> > > makes it harder to exploit the callbacks. Also makes the code slightly
> > > easier to maintain.
> > > 
> > > For tile-based consoles, there's a separate instance of the bitops
> > > structure.
> > > 
> > > Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
> > > ---
> > >   drivers/video/fbdev/core/bitblit.c   | 17 ++++---
> > >   drivers/video/fbdev/core/fbcon.c     | 67 +++++++++++++++-------------
> > >   drivers/video/fbdev/core/fbcon.h     |  7 ++-
> > >   drivers/video/fbdev/core/fbcon_ccw.c | 18 +++++---
> > >   drivers/video/fbdev/core/fbcon_cw.c  | 18 +++++---
> > >   drivers/video/fbdev/core/fbcon_ud.c  | 18 +++++---
> > >   drivers/video/fbdev/core/tileblit.c  | 16 ++++---
> > >   7 files changed, 94 insertions(+), 67 deletions(-)
> > > 
> > > diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
> > > index a2202cae0691..267bd1635a41 100644
> > > --- a/drivers/video/fbdev/core/bitblit.c
> > > +++ b/drivers/video/fbdev/core/bitblit.c
> > > @@ -384,15 +384,18 @@ static int bit_update_start(struct fb_info *info)
> > >   	return err;
> > >   }
> > > +static const struct fbcon_bitops bit_fbcon_bitops = {
> > > +	.bmove = bit_bmove,
> > > +	.clear = bit_clear,
> > > +	.putcs = bit_putcs,
> > > +	.clear_margins = bit_clear_margins,
> > > +	.cursor = bit_cursor,
> > > +	.update_start = bit_update_start,
> > > +};
> > > +
> > >   void fbcon_set_bitops(struct fbcon *confb)
> > >   {
> > > -	confb->bmove = bit_bmove;
> > > -	confb->clear = bit_clear;
> > > -	confb->putcs = bit_putcs;
> > > -	confb->clear_margins = bit_clear_margins;
> > > -	confb->cursor = bit_cursor;
> > > -	confb->update_start = bit_update_start;
> > > -	confb->rotate_font = NULL;
> > > +	confb->bitops = &bit_fbcon_bitops;
> > >   	if (confb->rotate)
> > >   		fbcon_set_rotate(confb);
> > fbcon_set_rotate() is only used to set the correct bitops.
> > 
> > It would be simpler to just do
> > 
> > 	if (confb->rotate)
> > 		confb->bitops = fbcon_rotate_get_ops();
> > 
> > And rename fbcon_set_rotate() to fbcon_rotate_get_ops() and return the
> > pointer to the struct.
> > 
> > The no need to pass the struct, and it is obvious that the bitops are
> > overwritten.
> 
> I tried to keep the changes here to a minimum and avoided changing the
> function interfaces too much.
> 
> But did you read patch 5 already? I think the cleanup you're looking for is
> there. fbcon_set_rotate() will be gone. And the update bit-op selection is
> contained in fbcon_set_bitops(). I guess this could be renamed to
> fbcon_update_bitops() to make it clear that it updates from internal state.

Patch 5 looks good, and is again a nice cleanup.
I like that the code is now more explicit in what it does and do not
do overwrites.

Returning a pointer or adding the assignment in a helper is not a big
deal.

With or without the suggested renaming both patch 4 + 5 are r-b.

That said, I am not expert in this field, but at least you had another
pair of eyes on the changes.
I look forward to see the next batches of refactoring you have planned.

	Sam

^ permalink raw reply

* Re: [PATCH 6/6] fbcon: Pass struct fbcon to callbacks in struct fbcon_bitops
From: Thomas Zimmermann @ 2025-09-08 13:08 UTC (permalink / raw)
  To: Sam Ravnborg; +Cc: simona, deller, linux-fbdev, dri-devel, linux-kernel
In-Reply-To: <20250905190004.GB361827@ravnborg.org>

Hi

Am 05.09.25 um 21:00 schrieb Sam Ravnborg:
> On Mon, Aug 18, 2025 at 12:36:41PM +0200, Thomas Zimmermann wrote:
>> The callbacks in struct fbcon_bitops are for struct fbcon. Pass an
>> instance to the callbacks; instead of the respective struct fb_info.
> This looks looks like a pointless change.
> All the operations requires fb_info and needs to pcik it anyway.

Yeah, it's in preparation of a later change. As I already had the patch 
ready, i submitted it. I'll drop it now and re-submit when it's required.

Best regards
Thomas

>
> 	Sam

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstrasse 146, 90461 Nuernberg, Germany
GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman
HRB 36809 (AG Nuernberg)



^ permalink raw reply

* Re: [PATCH 4/6] fbcon: Move fbcon callbacks into struct fbcon_bitops
From: Thomas Zimmermann @ 2025-09-08 13:06 UTC (permalink / raw)
  To: Sam Ravnborg; +Cc: simona, deller, linux-fbdev, dri-devel, linux-kernel
In-Reply-To: <20250905185358.GA361827@ravnborg.org>

Hi Sam,

thanks for doing the review.

Am 05.09.25 um 20:53 schrieb Sam Ravnborg:
> Hi Thomas.
>
> On Mon, Aug 18, 2025 at 12:36:39PM +0200, Thomas Zimmermann wrote:
>> Depending on rotation settings, fbcon sets different callback
>> functions in struct fbcon from within fbcon_set_bitops(). Declare
>> the callback functions in the new type struct fbcon_bitops. Then
>> only replace the single bitops pointer in struct fbcon.
>>
>> Keeping callbacks in constant instances of struct fbcon_bitops
>> makes it harder to exploit the callbacks. Also makes the code slightly
>> easier to maintain.
>>
>> For tile-based consoles, there's a separate instance of the bitops
>> structure.
>>
>> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
>> ---
>>   drivers/video/fbdev/core/bitblit.c   | 17 ++++---
>>   drivers/video/fbdev/core/fbcon.c     | 67 +++++++++++++++-------------
>>   drivers/video/fbdev/core/fbcon.h     |  7 ++-
>>   drivers/video/fbdev/core/fbcon_ccw.c | 18 +++++---
>>   drivers/video/fbdev/core/fbcon_cw.c  | 18 +++++---
>>   drivers/video/fbdev/core/fbcon_ud.c  | 18 +++++---
>>   drivers/video/fbdev/core/tileblit.c  | 16 ++++---
>>   7 files changed, 94 insertions(+), 67 deletions(-)
>>
>> diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
>> index a2202cae0691..267bd1635a41 100644
>> --- a/drivers/video/fbdev/core/bitblit.c
>> +++ b/drivers/video/fbdev/core/bitblit.c
>> @@ -384,15 +384,18 @@ static int bit_update_start(struct fb_info *info)
>>   	return err;
>>   }
>>   
>> +static const struct fbcon_bitops bit_fbcon_bitops = {
>> +	.bmove = bit_bmove,
>> +	.clear = bit_clear,
>> +	.putcs = bit_putcs,
>> +	.clear_margins = bit_clear_margins,
>> +	.cursor = bit_cursor,
>> +	.update_start = bit_update_start,
>> +};
>> +
>>   void fbcon_set_bitops(struct fbcon *confb)
>>   {
>> -	confb->bmove = bit_bmove;
>> -	confb->clear = bit_clear;
>> -	confb->putcs = bit_putcs;
>> -	confb->clear_margins = bit_clear_margins;
>> -	confb->cursor = bit_cursor;
>> -	confb->update_start = bit_update_start;
>> -	confb->rotate_font = NULL;
>> +	confb->bitops = &bit_fbcon_bitops;
>>   
>>   	if (confb->rotate)
>>   		fbcon_set_rotate(confb);
> fbcon_set_rotate() is only used to set the correct bitops.
>
> It would be simpler to just do
>
> 	if (confb->rotate)
> 		confb->bitops = fbcon_rotate_get_ops();
>
> And rename fbcon_set_rotate() to fbcon_rotate_get_ops() and return the
> pointer to the struct.
>
> The no need to pass the struct, and it is obvious that the bitops are
> overwritten.

I tried to keep the changes here to a minimum and avoided changing the 
function interfaces too much.

But did you read patch 5 already? I think the cleanup you're looking for 
is there. fbcon_set_rotate() will be gone. And the update bit-op 
selection is contained in fbcon_set_bitops(). I guess this could be 
renamed to fbcon_update_bitops() to make it clear that it updates from 
internal state.

Best regards
Thomas

>
> 	Sam
>

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstrasse 146, 90461 Nuernberg, Germany
GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman
HRB 36809 (AG Nuernberg)



^ permalink raw reply

* Re: [PATCH] staging: sm750fb: fix coding style issues in sm750.h
From: Dan Carpenter @ 2025-09-08  5:45 UTC (permalink / raw)
  To: Yiming Qian
  Cc: sudipm.mukherjee, teddy.wang, gregkh, linux-fbdev, linux-staging,
	linux-kernel
In-Reply-To: <20250908052133.8888-1-qianym1996@gmail.com>

On Mon, Sep 08, 2025 at 01:21:33PM +0800, Yiming Qian wrote:
> This patch addresses several coding style warnings
> reported by checkpatch.pl:
> 
> 1. Replaces CamelCase variable names with snake_case:
>    - dprBase -> dpr_base
>    - dpPortBase -> dp_port_base
> 
> 2. Removes unnecessary use of 'volatile' qualifier
>    from the lynx_share_struct members.
> 
> These changes improve code readability and maintain
> consistency with the kernel coding style guidelines.
> No functional changes are introduced.
> 
> Signed-off-by: Yiming Qian <qianym1996@gmail.com>

You need to split this into "one thing per patch".
[patch 1] remove volatile
[patch 2] rename snake case variables

regards,
dan carpenter



^ permalink raw reply

* [PATCH] staging: sm750fb: fix coding style issues in sm750.h
From: Yiming Qian @ 2025-09-08  5:21 UTC (permalink / raw)
  To: sudipm.mukherjee, teddy.wang
  Cc: gregkh, linux-fbdev, linux-staging, linux-kernel, Yiming Qian

This patch addresses several coding style warnings
reported by checkpatch.pl:

1. Replaces CamelCase variable names with snake_case:
   - dprBase -> dpr_base
   - dpPortBase -> dp_port_base

2. Removes unnecessary use of 'volatile' qualifier
   from the lynx_share_struct members.

These changes improve code readability and maintain
consistency with the kernel coding style guidelines.
No functional changes are introduced.

Signed-off-by: Yiming Qian <qianym1996@gmail.com>
---
 drivers/staging/sm750fb/sm750.h       | 6 +++---
 drivers/staging/sm750fb/sm750_accel.c | 7 +++----
 drivers/staging/sm750fb/sm750_hw.c    | 4 ++--
 3 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/drivers/staging/sm750fb/sm750.h b/drivers/staging/sm750fb/sm750.h
index d7f40efe3..fcb7d586e 100644
--- a/drivers/staging/sm750fb/sm750.h
+++ b/drivers/staging/sm750fb/sm750.h
@@ -50,9 +50,9 @@ struct init_status {
 
 struct lynx_accel {
 	/* base virtual address of DPR registers */
-	volatile unsigned char __iomem *dprBase;
+	unsigned char __iomem *dpr_base;
 	/* base virtual address of de data port */
-	volatile unsigned char __iomem *dpPortBase;
+	unsigned char __iomem *dp_port_base;
 
 	/* function pointers */
 	void (*de_init)(struct lynx_accel *accel);
@@ -128,7 +128,7 @@ struct lynx_cursor {
 	char __iomem *vstart;
 	int offset;
 	/* mmio addr of hw cursor */
-	volatile char __iomem *mmio;
+	char __iomem *mmio;
 };
 
 struct lynxfb_crtc {
diff --git a/drivers/staging/sm750fb/sm750_accel.c b/drivers/staging/sm750fb/sm750_accel.c
index 44b9e3fe3..6bee37bf5 100644
--- a/drivers/staging/sm750fb/sm750_accel.c
+++ b/drivers/staging/sm750fb/sm750_accel.c
@@ -19,17 +19,17 @@
 #include "sm750_accel.h"
 static inline void write_dpr(struct lynx_accel *accel, int offset, u32 regValue)
 {
-	writel(regValue, accel->dprBase + offset);
+	writel(regValue, accel->dpr_base + offset);
 }
 
 static inline u32 read_dpr(struct lynx_accel *accel, int offset)
 {
-	return readl(accel->dprBase + offset);
+	return readl(accel->dpr_base + offset);
 }
 
 static inline void write_dpPort(struct lynx_accel *accel, u32 data)
 {
-	writel(data, accel->dpPortBase);
+	writel(data, accel->dp_port_base);
 }
 
 void sm750_hw_de_init(struct lynx_accel *accel)
@@ -410,4 +410,3 @@ int sm750_hw_imageblit(struct lynx_accel *accel, const char *pSrcbuf,
 
 	return 0;
 }
-
diff --git a/drivers/staging/sm750fb/sm750_hw.c b/drivers/staging/sm750fb/sm750_hw.c
index 7119b67ef..ce46f240c 100644
--- a/drivers/staging/sm750fb/sm750_hw.c
+++ b/drivers/staging/sm750fb/sm750_hw.c
@@ -58,8 +58,8 @@ int hw_sm750_map(struct sm750_dev *sm750_dev, struct pci_dev *pdev)
 	}
 	pr_info("mmio virtual addr = %p\n", sm750_dev->pvReg);
 
-	sm750_dev->accel.dprBase = sm750_dev->pvReg + DE_BASE_ADDR_TYPE1;
-	sm750_dev->accel.dpPortBase = sm750_dev->pvReg + DE_PORT_ADDR_TYPE1;
+	sm750_dev->accel.dpr_base = sm750_dev->pvReg + DE_BASE_ADDR_TYPE1;
+	sm750_dev->accel.dp_port_base = sm750_dev->pvReg + DE_PORT_ADDR_TYPE1;
 
 	mmio750 = sm750_dev->pvReg;
 	sm750_set_chip_type(sm750_dev->devid, sm750_dev->revid);
-- 
2.51.0


^ permalink raw reply related


This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox