Skip to content

Allow dcp interchange to scanout interchange compressed#449

Open
oliverbestmann wants to merge 4407 commits into
AsahiLinux:asahifrom
oliverbestmann:asahi-dcp-interchange
Open

Allow dcp interchange to scanout interchange compressed#449
oliverbestmann wants to merge 4407 commits into
AsahiLinux:asahifrom
oliverbestmann:asahi-dcp-interchange

Conversation

@oliverbestmann

Copy link
Copy Markdown

@Conan-Kudo Conan-Kudo left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The UAPI change needs to be separately contributed to Linux directly, not this fork.

See this documentation: https://docs.kernel.org/process/submitting-patches.html

Comment thread include/uapi/drm/drm_fourcc.h Outdated
*/
#define DRM_FORMAT_MOD_APPLE_GPU_TILED fourcc_mod_code(APPLE, 1)
#define DRM_FORMAT_MOD_APPLE_GPU_TILED_COMPRESSED fourcc_mod_code(APPLE, 2)
#define DRM_FORMAT_MOD_APPLE_INTERCHANGE_COMPRESSED fourcc_mod_code(APPLE, 3)

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For experimenting we should move this into the driver with

#ifndef DRM_FORMAT_MOD_APPLE_INTERCHANGE_COMPRESSED
#define DRM_FORMAT_MOD_APPLE_INTERCHANGE_COMPRESSED fourcc_mod_code(APPLE, 3)
#endif

I'm not sure if we want one or more APPLE_INTERCHANGE_COMPRESSED modifiers to handle YCbCr formats which use 32x32 tiles for Y

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this enough of a difference to warrant a new format modifier? If the tile size only changes for the luma channel of Y'CbCr textures, can we not just handle that by checking is_yuv for the framebuffer format info struct? E.g.

tile_w = fb->format->is_yuv ? 32 : 16

@jannau jannau force-pushed the asahi-wip branch 2 times, most recently from 0031cb6 to 79a307d Compare February 14, 2026 20:09
@waltmck

waltmck commented Feb 23, 2026

Copy link
Copy Markdown

Thank you for the exciting work!

I tested this with nixos-apple-silicon 6.10 using your flake, on an M2 Macbook Air. Hyprland fails to launch with the following repeated log message:

kernel: apple-dcp 231c00000.dcp: swap failed! status 4
kernel: dcp: plane 0 modifiers: c00000000000003
kernel: apple-dcp 231c00000.dcp: RTKit: syslog message: UPPipe.cpp:3920: IOMFB verify_uc_surface: Planesize insufficient for data plane size 17039360, data size 17301504
kernel: apple-dcp 231c00000.dcp: RTKit: syslog message: UPPipeDCP_H13P.cpp:4554: bool IOMFB::UPPipeDCP_H13P::verify_surfaces(IOMFB::SwapRequest *): Error with the interchange surface
kernel: apple-dcp 231c00000.dcp: RTKit: syslog message: FramebufferDCP.cpp:2175: AppleCLCD: verify_swap failed for swap id: 4285

@oliverbestmann oliverbestmann force-pushed the asahi-dcp-interchange branch 3 times, most recently from 368641c to cdeaea6 Compare February 24, 2026 11:19
@oliverbestmann

Copy link
Copy Markdown
Author

@waltmck

I tested this with nixos-apple-silicon 6.10 using your flake, on an M2 Macbook Air.

Thank you. Is that with the notch enabled or disabled? And what's your selected display resolution?

It was not working with hyprland on my machine too. I've fixed the issue now. Please try again with the latest update to the flake.

@waltmck

waltmck commented Feb 25, 2026

Copy link
Copy Markdown

@waltmck

I tested this with nixos-apple-silicon 6.10 using your flake, on an M2 Macbook Air.

Thank you. Is that with the notch enabled or disabled? And what's your selected display resolution?

It was not working with hyprland on my machine too. I've fixed the issue now. Please try again with the latest update to the flake.

With your latest flake I can run Hyprland (and I've been using it to work for the last few hours without issues). Is there an easy way to check with certainty that compressed scanout is actually being used?

@oliverbestmann

Copy link
Copy Markdown
Author

You can use drm_info to see that modifier c00000000000003 is used for the plane.

@waltmck

waltmck commented Feb 25, 2026

Copy link
Copy Markdown

You can use drm_info to see that modifier c00000000000003 is used for the plane.

yep, I do see that so it seems to be working.

Comment thread drivers/gpu/drm/apple/plane.c Outdated
Comment thread drivers/gpu/drm/apple/plane.c Outdated
Comment thread drivers/gpu/drm/apple/plane.c Outdated
Comment thread drivers/gpu/drm/apple/plane.c Outdated
Comment thread drivers/gpu/drm/apple/plane.c Outdated
Comment thread drivers/gpu/drm/apple/plane.c Outdated
Comment thread drivers/gpu/drm/apple/plane.c Outdated
Comment thread drivers/gpu/drm/apple/plane.c Outdated
Comment thread drivers/gpu/drm/apple/plane.c
@jannau

jannau commented Mar 1, 2026

Copy link
Copy Markdown
Member

the code misses a check to ensure the computed surface size for interchange framebuffers fits into the framebuffer's reported buffer size

@oliverbestmann

Copy link
Copy Markdown
Author

the code misses a check to ensure the computed surface size for interchange framebuffers fits into the framebuffer's reported buffer size

Whats the expected behavior in that case? assert and kernel panic, or some logging and quietly ignoring the plane?

@jannau

jannau commented Mar 1, 2026

Copy link
Copy Markdown
Member

the code misses a check to ensure the computed surface size for interchange framebuffers fits into the framebuffer's reported buffer size

Whats the expected behavior in that case? assert and kernel panic, or some logging and quietly ignoring the plane?

check needs to happen in atomic_check where it can fail, possible that there there are drm_format helpers for that using driver specific formats (I would have to check myself)

@chadmed

chadmed commented Mar 1, 2026

Copy link
Copy Markdown
Member

Tested as mostly-working on G14G, G14S and G13S, however overlays are broken on kwin. May be size/alignment related, as fractional scaling factors and certain cursor images (notably the Breeze I-beam) cause framebuffer creation to fail. This is most obvious with the cursor, but may occur with other oddly-sized overlay framebuffers.

@oliverbestmann

Copy link
Copy Markdown
Author

Tested as mostly-working on G14G, G14S and G13S, however overlays are broken on kwin. May be size/alignment related, as fractional scaling factors and certain cursor images (notably the Breeze I-beam) cause framebuffer creation to fail. This is most obvious with the cursor, but may occur with other oddly-sized overlay framebuffers.

Thank you. I had no problems running this with kde. I'll try to reproduce the issues as soon as I can.

@oliverbestmann oliverbestmann force-pushed the asahi-dcp-interchange branch from cdeaea6 to 0ddf41f Compare March 2, 2026 18:00
@oliverbestmann oliverbestmann changed the base branch from asahi-wip to asahi March 2, 2026 18:03
Comment thread drivers/gpu/drm/apple/plane.c Outdated
* The metadata buffer contains 8 bytes per 16x16 compression tile.
* Addressing is fully twiddled, so both width and height are padded to
* powers-of-two.
*/

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the comment from the drm_fourcc.h description would be more more appropriate:

/*
 *  ... The metadata section rounds the image dimensions to
 * powers-of-two and contains 8 bytes for each 16x16 compression subtile.
 * Subtiles are interleaved (Morton order).
 */

It's the most up to date description.

Comment thread drivers/gpu/drm/apple/plane.c Outdated
Comment thread drivers/gpu/drm/apple/plane.c Outdated
Comment thread drivers/gpu/drm/apple/plane.c
@oliverbestmann oliverbestmann force-pushed the asahi-dcp-interchange branch 2 times, most recently from e5f989a to 3ccde48 Compare March 10, 2026 13:25
vanyuan599 and others added 3 commits April 22, 2026 13:30
[ Upstream commit 7a57354 ]

Add missing error handling for mcp251x_power_enable() calls in both
mcp251x_open() and mcp251x_can_resume() functions.

In mcp251x_open(), if power enable fails, jump to error path to close
candev without attempting to disable power again.

In mcp251x_can_resume(), properly check return values of power enable calls
for both power and transceiver regulators. If any fails, return the error
code to the PM framework and log the failure.

This ensures the driver properly handles power control failures and
maintains correct device state.

Signed-off-by: Wenyuan Li <2063309626@qq.com>
Link: https://patch.msgid.link/tencent_F3EFC5D7738AC548857B91657715E2D3AA06@qq.com
[mkl: fix patch description]
[mkl: mcp251x_can_resume(): replace goto by return]
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 2594196 ]

Add a DMI quirk entry for ASUS HN7306EA in the ACP SoundWire legacy
machine driver.

Set driver_data to ASOC_SDW_ACP_DMIC for this board so the
platform-specific DMIC quirk path is selected.

Signed-off-by: Hasun Park <hasunpark@gmail.com>
Link: https://patch.msgid.link/20260319163321.30326-1-hasunpark@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit b8bee48 ]

The build can fail with:

ERROR: modpost: "__auxiliary_driver_register"
[sound/usb/qcom/snd-usb-audio-qmi.ko] undefined!
ERROR: modpost: "auxiliary_driver_unregister"
[sound/usb/qcom/snd-usb-audio-qmi.ko] undefined!

Select AUXILIARY_BUS when SND_USB_AUDIO_QMI is enabled.

Signed-off-by: Frank Zhang <rmxpzlb@gmail.com>
Link: https://patch.msgid.link/20260317102527.556248-1-rmxpzlb@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
jannau and others added 17 commits April 30, 2026 09:20
After discussion with the devicetree maintainers we agreed to not extend
lists with the generic compatible "apple,wdt" anymore [1]. Use
"apple,t8103-wdt" as base compatible as it is the SoC the driver and
bindings were written for.

[1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/

Reviewed-by: Neal Gompa <neal@gompa.dev>
Signed-off-by: Janne Grunau <j@jannau.net>
- WLAN/BT (SMC PMU GPIO AsahiLinux#13) (all devices)
- ASM3142 (SMC PMU GPIO AsahiLinux#14) (j434, iMac with 4 USB-C ports)
- SD card reader (SMC PMU GPIO AsahiLinux#23) (j504, 14-inch MacBook Pro)

Signed-off-by: Janne Grunau <j@jannau.net>
The internal keyboard and trackpad HID on MacBook variants
of the Apple M3 (t8122) SoC are connected through a Apple
-developed protocol called DockChannel and mediated by a
coprocessor known as the Multi-Touch Processor (MTP).

This commit adds the nessecary device tree nodes to the
M3's device tree for internal HID to work. It is disabled
by default, to be enabled only in MacBook board files
where it is tested and confirmed to work.

Co-developed-by: Alyssa Milburn <amilburn@zall.org>
Signed-off-by: Alyssa Milburn <amilburn@zall.org>
Signed-off-by: Michael Reeves <michael.reeves077@gmail.com>
Add mtp device nodes for t8122 (M3) based MacBooks.

Signed-off-by: Michael Reeves <michael.reeves077@gmail.com>
Certain Broadcom bluetooth chips (bcm4377/bcm4378/bcm438) need ACL
streams carrying audio to be set as "high priority" using a vendor
specific command to prevent 10-ish second-long dropouts whenever
something does a device scan. This patch sends the command when the
socket priority is set to TC_PRIO_INTERACTIVE, as BlueZ does for audio.

Signed-off-by: Sasha Finkelstein <fnkl.kernel@gmail.com>
AF_ALG AEAD AIO requests currently use the socket-wide IV buffer during
request processing.  For async requests, later socket activity can
update that shared state before the original request has fully
completed, which can lead to inconsistent IV handling.

Snapshot the IV into per-request storage when preparing the AEAD
request, so in-flight operations no longer depend on mutable socket
state.

Fixes: d887c52 ("crypto: algif_aead - overhaul memory management")
Cc: stable@kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Co-developed-by: Luxing Yin <tr0jan@lzu.edu.cn>
Signed-off-by: Luxing Yin <tr0jan@lzu.edu.cn>
Tested-by: Yucheng Lu <kanolyc@gmail.com>
Signed-off-by: Douya Le <ldy3087146292@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
The src SG list offset wasn't set properly when decrypting in-place,
fix it.

Reported-by: Wolfgang Walter <linux@stwm.de>
Fixes: e024941 ("crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
HexRabbit and others added 10 commits May 7, 2026 22:57
MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP
marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(),
so later paths that may modify packet data can first make a private
copy. The IPv4/IPv6 datagram append paths did not set this flag when
splicing pages into UDP skbs.

That leaves an ESP-in-UDP packet made from shared pipe pages looking
like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW
fast path for uncloned skbs without a frag_list and decrypts in place
over data that is not owned privately by the skb.

Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching
TCP. Also make ESP input fall back to skb_cow_data() when the flag is
present, so ESP does not decrypt externally backed frags in place.
Private nonlinear skb frags still use the existing fast path.

This intentionally does not change ESP output. In esp_output_head(),
the path that appends the ESP trailer to existing skb tailroom without
calling skb_cow_data() is not reachable for nonlinear skbs:
skb_tailroom() returns zero when skb->data_len is nonzero, while ESP
tailen is positive. Thus ESP output will either use the separate
destination-frag path or fall back to skb_cow_data().

Fixes: cac2661 ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 03e2a30 ("esp6: Avoid skb_cow_data whenever possible")
Fixes: 7da0dde ("ip, udp: Support MSG_SPLICE_PAGES")
Fixes: 6d8192b ("ip6, udp6: Support MSG_SPLICE_PAGES")
Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
Reported-by: Kuan-Ting Chen <h3xrabbit@gmail.com>
Tested-by: Hyunwoo Kim <imv4bel@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Kuan-Ting Chen <h3xrabbit@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
commit 1f27401 upstream.

If skb_unshare() fails to unshare a packet due to allocation failure in
rxrpc_input_packet(), the skb pointer in the parent (rxrpc_io_thread())
will be NULL'd out.  This will likely cause the call to
trace_rxrpc_rx_done() to oops.

Fix this by moving the unsharing down to where rxrpc_input_call_event()
calls rxrpc_input_call_packet().  There are a number of places prior to
that where we ignore DATA packets for a variety of reasons (such as the
call already being complete) for which an unshare is then avoided.

And with that, rxrpc_input_packet() doesn't need to take a pointer to the
pointer to the packet, so change that to just a pointer.

Fixes: 2d1faf7 ("rxrpc: Simplify skbuff accounting in receive path")
Closes: https://sashiko.dev/#/patchset/20260408121252.2249051-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20260422161438.2593376-4-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 34f61a0 upstream.

Fix rxkad_verify_response() to free the ticket and the server key under all
circumstances by initialising the ticket pointer to NULL and then making
all paths through the function after the first allocation has been done go
through a single common epilogue that just releases everything - where all
the releases skip on a NULL pointer.

Fixes: 57af281 ("rxrpc: Tidy up abort generation infrastructure")
Fixes: ec832bd ("rxrpc: Don't retain the server key in the connection")
Closes: https://sashiko.dev/#/patchset/20260408121252.2249051-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20260422161438.2593376-2-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 24481a7 upstream.

The security operations that verify the RESPONSE packets decrypt bits of it
in place - however, the sk_buff may be shared with a packet sniffer, which
would lead to the sniffer seeing an apparently corrupt packet (actually
decrypted).

Fix this by handing a copy of the packet off to the specific security
handler if the packet was cloned.

Fixes: 17926a7 ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
Closes: https://sashiko.dev/#/patchset/20260408121252.2249051-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20260422161438.2593376-5-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit def304a upstream.

Fix handling of a packet with a misaligned crypto length.  Also handle
non-ENOMEM errors from decryption by aborting.  Further, remove the
WARN_ON_ONCE() so that it can't be remotely triggered (a trace line can
still be emitted).

Fixes: f93af41 ("rxrpc: Fix missing error checks for rxkad encryption/decryption failure")
Closes: https://sashiko.dev/#/patchset/20260408121252.2249051-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20260422161438.2593376-3-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 3476c8b upstream.

Fix a missing bit of error handling in rxgk_extract_token(): in the event
that rxgk_decrypt_skb() returns -ENOMEM, it should just return that rather
than continuing on (for anything else, it generates an abort).

Fixes: 64863f4 ("rxrpc: Fix unhandled errors in rxgk_verify_packet_integrity()")
Closes: https://sashiko.dev/#/patchset/20260422161438.2593376-4-dhowells@redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20260423200909.3049438-4-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 0422e7a upstream.

If a RESPONSE packet gets a temporary failure during processing, it may end
up in a partially decrypted state - and then get requeued for a retry.

Fix this by just discarding the packet; we will send another CHALLENGE
packet and thereby elicit a further response.  Similarly, discard an
incoming CHALLENGE packet if we get an error whilst generating a RESPONSE;
the server will send another CHALLENGE.

Fixes: 17926a7 ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
Closes: https://sashiko.dev/#/patchset/20260422161438.2593376-4-dhowells@redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20260423200909.3049438-3-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 55b2984 upstream.

Fix rxrpc_input_call_event() to only unshare DATA packets and not ACK,
ABORT, etc..

And with that, rxrpc_input_packet() doesn't need to take a pointer to the
pointer to the packet, so change that to just a pointer.

Fixes: 1f27401 ("rxrpc: Fix potential UAF after skb_unshare() failure")
Closes: https://sashiko.dev/#/patchset/20260422161438.2593376-4-dhowells@redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20260423200909.3049438-2-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE
handler in rxrpc_verify_response() copy the skb to a linear one before
calling into the security ops only when skb_cloned() is true.  An skb
that is not cloned but still carries paged fragments (skb->data_len != 0)
falls through to the in-place decryption path, which binds the frag
pages directly into the AEAD/skcipher SGL via skb_to_sgvec().

Extend the gate so that any skb with non-linear data is also copied,
ensuring the security handler always operates on a fully linear skb.
The OOM/trace handling already in place is reused.

Fixes: d0d5c0c ("rxrpc: Use skb_unshare() rather than skb_cow_data()")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Oliver Bestmann <oliver.bestmann@googlemail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.