From ecc2b7478bdc8efaff692e3ae44e71d992bcc85f Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tzimmermann@suse.de>
Date: Tue, 8 Apr 2025 13:52:22 +0200
Subject: [PATCH 01/16] accel/qaic: Test for imported buffers with
 drm_gem_is_imported()

Instead of testing import_attach for imported GEM buffers, invoke
drm_gem_is_imported() to do the test. The helper tests the dma_buf
itself while import_attach is just an artifact of the import. Prepares
to make import_attach optional.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250408115237.428985-1-tzimmermann@suse.de
---
 drivers/accel/qaic/qaic_data.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/accel/qaic/qaic_data.c b/drivers/accel/qaic/qaic_data.c
index 43aba57b48f0..1bce1af7c72c 100644
--- a/drivers/accel/qaic/qaic_data.c
+++ b/drivers/accel/qaic/qaic_data.c
@@ -609,7 +609,7 @@ static int qaic_gem_object_mmap(struct drm_gem_object *obj, struct vm_area_struc
 	struct scatterlist *sg;
 	int ret = 0;
 
-	if (obj->import_attach)
+	if (drm_gem_is_imported(obj))
 		return -EINVAL;
 
 	for (sg = bo->sgt->sgl; sg; sg = sg_next(sg)) {
@@ -630,7 +630,7 @@ static void qaic_free_object(struct drm_gem_object *obj)
 {
 	struct qaic_bo *bo = to_qaic_bo(obj);
 
-	if (obj->import_attach) {
+	if (drm_gem_is_imported(obj)) {
 		/* DMABUF/PRIME Path */
 		drm_prime_gem_destroy(obj, NULL);
 	} else {
@@ -870,7 +870,7 @@ static int qaic_prepare_bo(struct qaic_device *qdev, struct qaic_bo *bo,
 {
 	int ret;
 
-	if (bo->base.import_attach)
+	if (drm_gem_is_imported(&bo->base))
 		ret = qaic_prepare_import_bo(bo, hdr);
 	else
 		ret = qaic_prepare_export_bo(qdev, bo, hdr);
@@ -894,7 +894,7 @@ static void qaic_unprepare_export_bo(struct qaic_device *qdev, struct qaic_bo *b
 
 static void qaic_unprepare_bo(struct qaic_device *qdev, struct qaic_bo *bo)
 {
-	if (bo->base.import_attach)
+	if (drm_gem_is_imported(&bo->base))
 		qaic_unprepare_import_bo(bo);
 	else
 		qaic_unprepare_export_bo(qdev, bo);
-- 
2.51.0


From e7bb7d44c3b97aea1f0e354c6499900154ac67f2 Mon Sep 17 00:00:00 2001
From: Biju Das <biju.das.jz@bp.renesas.com>
Date: Fri, 4 Apr 2025 14:30:45 +0100
Subject: [PATCH 02/16] drm: renesas: Add zpos, alpha and blend properties to
 RZ/G2L DU

Add support for zpos, alpha and blend properties to RZ/G2L DU
driver as the IP supports all these properties.

It is tested by the below modetest commands:

modetest -M rzg2l-du -s 44@42:1920x1080@AR24 -d -P \
37@42:512x300+200+200@XR15

modetest -M rzg2l-du -w {32,37}:alpha:{0,65535}
modetest -M rzg2l-du -w {32,37}:zpos:{0,1}

Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> #On RZ/V2H
Link: https://lore.kernel.org/r/20250404133047.172080-1-biju.das.jz@bp.renesas.com
---
 drivers/gpu/drm/renesas/rz-du/rzg2l_du_vsp.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/gpu/drm/renesas/rz-du/rzg2l_du_vsp.c b/drivers/gpu/drm/renesas/rz-du/rzg2l_du_vsp.c
index 8643ff2eec46..040d4e4aff00 100644
--- a/drivers/gpu/drm/renesas/rz-du/rzg2l_du_vsp.c
+++ b/drivers/gpu/drm/renesas/rz-du/rzg2l_du_vsp.c
@@ -340,6 +340,15 @@ int rzg2l_du_vsp_init(struct rzg2l_du_vsp *vsp, struct device_node *np,
 
 		drm_plane_helper_add(&plane->plane,
 				     &rzg2l_du_vsp_plane_helper_funcs);
+
+		drm_plane_create_alpha_property(&plane->plane);
+		drm_plane_create_zpos_property(&plane->plane, i, 0,
+					       num_planes - 1);
+
+		drm_plane_create_blend_mode_property(&plane->plane,
+					BIT(DRM_MODE_BLEND_PIXEL_NONE) |
+					BIT(DRM_MODE_BLEND_PREMULTI) |
+					BIT(DRM_MODE_BLEND_COVERAGE));
 	}
 
 	return 0;
-- 
2.51.0


From 314c45e39e9abcaf2fe5449a11b6d9ad3b2c7dbc Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tzimmermann@suse.de>
Date: Thu, 10 Apr 2025 10:37:23 +0200
Subject: [PATCH 03/16] drm/sysfb: Split source file

Split drm_sysfb_helper.c into two source files. There's now one
source file for the mode-setting pipeline and one source file for
module meta data. Prepares for adding additional source code to
sysfb helpers.

v2:
- fix typo in commit message (Javier)

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://lore.kernel.org/r/20250410083834.10810-2-tzimmermann@suse.de
---
 drivers/gpu/drm/sysfb/Makefile                            | 3 +++
 drivers/gpu/drm/sysfb/drm_sysfb.c                         | 8 ++++++++
 drivers/gpu/drm/sysfb/drm_sysfb_helper.h                  | 5 +++++
 .../drm/sysfb/{drm_sysfb_helper.c => drm_sysfb_modeset.c} | 4 ----
 4 files changed, 16 insertions(+), 4 deletions(-)
 create mode 100644 drivers/gpu/drm/sysfb/drm_sysfb.c
 rename drivers/gpu/drm/sysfb/{drm_sysfb_helper.c => drm_sysfb_modeset.c} (98%)

diff --git a/drivers/gpu/drm/sysfb/Makefile b/drivers/gpu/drm/sysfb/Makefile
index 0d2518c97163..861b4026f4a6 100644
--- a/drivers/gpu/drm/sysfb/Makefile
+++ b/drivers/gpu/drm/sysfb/Makefile
@@ -1,5 +1,8 @@
 # SPDX-License-Identifier: GPL-2.0-only
 
+drm_sysfb_helper-y := \
+	drm_sysfb.o \
+	drm_sysfb_modeset.o
 obj-$(CONFIG_DRM_SYSFB_HELPER)	+= drm_sysfb_helper.o
 
 obj-$(CONFIG_DRM_EFIDRM)	+= efidrm.o
diff --git a/drivers/gpu/drm/sysfb/drm_sysfb.c b/drivers/gpu/drm/sysfb/drm_sysfb.c
new file mode 100644
index 000000000000..c083d21fd9ca
--- /dev/null
+++ b/drivers/gpu/drm/sysfb/drm_sysfb.c
@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <linux/module.h>
+
+#include "drm_sysfb_helper.h"
+
+MODULE_DESCRIPTION("Helpers for DRM sysfb drivers");
+MODULE_LICENSE("GPL");
diff --git a/drivers/gpu/drm/sysfb/drm_sysfb_helper.h b/drivers/gpu/drm/sysfb/drm_sysfb_helper.h
index 3684bd0ef085..ee94d6199b60 100644
--- a/drivers/gpu/drm/sysfb/drm_sysfb_helper.h
+++ b/drivers/gpu/drm/sysfb/drm_sysfb_helper.h
@@ -11,6 +11,11 @@
 #include <drm/drm_modes.h>
 
 struct drm_format_info;
+struct drm_scanout_buffer;
+
+/*
+ * Display modes
+ */
 
 struct drm_display_mode drm_sysfb_mode(unsigned int width,
 				       unsigned int height,
diff --git a/drivers/gpu/drm/sysfb/drm_sysfb_helper.c b/drivers/gpu/drm/sysfb/drm_sysfb_modeset.c
similarity index 98%
rename from drivers/gpu/drm/sysfb/drm_sysfb_helper.c
rename to drivers/gpu/drm/sysfb/drm_sysfb_modeset.c
index 262490a71792..ffaa2522ab96 100644
--- a/drivers/gpu/drm/sysfb/drm_sysfb_helper.c
+++ b/drivers/gpu/drm/sysfb/drm_sysfb_modeset.c
@@ -2,7 +2,6 @@
 
 #include <linux/export.h>
 #include <linux/slab.h>
-#include <linux/module.h>
 
 #include <drm/drm_atomic.h>
 #include <drm/drm_atomic_helper.h>
@@ -20,9 +19,6 @@
 
 #include "drm_sysfb_helper.h"
 
-MODULE_DESCRIPTION("Helpers for DRM sysfb drivers");
-MODULE_LICENSE("GPL");
-
 struct drm_display_mode drm_sysfb_mode(unsigned int width,
 				       unsigned int height,
 				       unsigned int width_mm,
-- 
2.51.0


From 6046b49bafff47726a377ef05dc55ef7dec01cbd Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tzimmermann@suse.de>
Date: Thu, 10 Apr 2025 10:37:24 +0200
Subject: [PATCH 04/16] drm/sysfb: Share helpers for integer validation

Provide sysfb helpers for validating framebuffer integer values
against limits. Update drivers. If a driver did not specify a limit
for a certain value, use INT_MAX.

v2:
- declare module information near EOF (Javier)

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://lore.kernel.org/r/20250410083834.10810-3-tzimmermann@suse.de
---
 drivers/gpu/drm/sysfb/drm_sysfb.c        | 27 ++++++++++++++++++++++
 drivers/gpu/drm/sysfb/drm_sysfb_helper.h |  9 ++++++++
 drivers/gpu/drm/sysfb/efidrm.c           | 29 ++++--------------------
 drivers/gpu/drm/sysfb/ofdrm.c            | 12 ++--------
 drivers/gpu/drm/sysfb/simpledrm.c        | 14 ++----------
 drivers/gpu/drm/sysfb/vesadrm.c          | 29 ++++--------------------
 6 files changed, 48 insertions(+), 72 deletions(-)

diff --git a/drivers/gpu/drm/sysfb/drm_sysfb.c b/drivers/gpu/drm/sysfb/drm_sysfb.c
index c083d21fd9ca..308f82153b15 100644
--- a/drivers/gpu/drm/sysfb/drm_sysfb.c
+++ b/drivers/gpu/drm/sysfb/drm_sysfb.c
@@ -1,8 +1,35 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
+#include <linux/export.h>
+#include <linux/limits.h>
+#include <linux/minmax.h>
 #include <linux/module.h>
 
+#include <drm/drm_print.h>
+
 #include "drm_sysfb_helper.h"
 
+int drm_sysfb_get_validated_int(struct drm_device *dev, const char *name,
+				u64 value, u32 max)
+{
+	if (value > min(max, INT_MAX)) {
+		drm_warn(dev, "%s of %llu exceeds maximum of %u\n", name, value, max);
+		return -EINVAL;
+	}
+	return value;
+}
+EXPORT_SYMBOL(drm_sysfb_get_validated_int);
+
+int drm_sysfb_get_validated_int0(struct drm_device *dev, const char *name,
+				 u64 value, u32 max)
+{
+	if (!value) {
+		drm_warn(dev, "%s of 0 not allowed\n", name);
+		return -EINVAL;
+	}
+	return drm_sysfb_get_validated_int(dev, name, value, max);
+}
+EXPORT_SYMBOL(drm_sysfb_get_validated_int0);
+
 MODULE_DESCRIPTION("Helpers for DRM sysfb drivers");
 MODULE_LICENSE("GPL");
diff --git a/drivers/gpu/drm/sysfb/drm_sysfb_helper.h b/drivers/gpu/drm/sysfb/drm_sysfb_helper.h
index ee94d6199b60..1697cf7ace97 100644
--- a/drivers/gpu/drm/sysfb/drm_sysfb_helper.h
+++ b/drivers/gpu/drm/sysfb/drm_sysfb_helper.h
@@ -13,6 +13,15 @@
 struct drm_format_info;
 struct drm_scanout_buffer;
 
+/*
+ * Input parsing
+ */
+
+int drm_sysfb_get_validated_int(struct drm_device *dev, const char *name,
+				u64 value, u32 max);
+int drm_sysfb_get_validated_int0(struct drm_device *dev, const char *name,
+				 u64 value, u32 max);
+
 /*
  * Display modes
  */
diff --git a/drivers/gpu/drm/sysfb/efidrm.c b/drivers/gpu/drm/sysfb/efidrm.c
index 3cfd5d2cbf48..e3c7c930e5ad 100644
--- a/drivers/gpu/drm/sysfb/efidrm.c
+++ b/drivers/gpu/drm/sysfb/efidrm.c
@@ -33,28 +33,6 @@
 #define DRIVER_MAJOR	1
 #define DRIVER_MINOR	0
 
-static int efidrm_get_validated_int(struct drm_device *dev, const char *name,
-				    u64 value, u32 max)
-{
-	if (max > INT_MAX)
-		max = INT_MAX;
-	if (value > max) {
-		drm_err(dev, "%s of %llu exceeds maximum of %u\n", name, value, max);
-		return -EINVAL;
-	}
-	return value;
-}
-
-static int efidrm_get_validated_int0(struct drm_device *dev, const char *name,
-				     u64 value, u32 max)
-{
-	if (!value) {
-		drm_err(dev, "%s of 0 not allowed\n", name);
-		return -EINVAL;
-	}
-	return efidrm_get_validated_int(dev, name, value, max);
-}
-
 static s64 efidrm_get_validated_size0(struct drm_device *dev, const char *name,
 				      u64 value, u64 max)
 {
@@ -70,12 +48,12 @@ static s64 efidrm_get_validated_size0(struct drm_device *dev, const char *name,
 
 static int efidrm_get_width_si(struct drm_device *dev, const struct screen_info *si)
 {
-	return efidrm_get_validated_int0(dev, "width", si->lfb_width, U16_MAX);
+	return drm_sysfb_get_validated_int0(dev, "width", si->lfb_width, U16_MAX);
 }
 
 static int efidrm_get_height_si(struct drm_device *dev, const struct screen_info *si)
 {
-	return efidrm_get_validated_int0(dev, "height", si->lfb_height, U16_MAX);
+	return drm_sysfb_get_validated_int0(dev, "height", si->lfb_height, U16_MAX);
 }
 
 static struct resource *efidrm_get_memory_si(struct drm_device *dev,
@@ -102,7 +80,8 @@ static int efidrm_get_stride_si(struct drm_device *dev, const struct screen_info
 	if (!lfb_linelength)
 		lfb_linelength = drm_format_info_min_pitch(format, 0, width);
 
-	return efidrm_get_validated_int0(dev, "stride", lfb_linelength, div64_u64(size, height));
+	return drm_sysfb_get_validated_int0(dev, "stride", lfb_linelength,
+					    div64_u64(size, height));
 }
 
 static u64 efidrm_get_visible_size_si(struct drm_device *dev, const struct screen_info *si,
diff --git a/drivers/gpu/drm/sysfb/ofdrm.c b/drivers/gpu/drm/sysfb/ofdrm.c
index 86c1a0c80ceb..fddfe8bea9f7 100644
--- a/drivers/gpu/drm/sysfb/ofdrm.c
+++ b/drivers/gpu/drm/sysfb/ofdrm.c
@@ -78,20 +78,12 @@ enum ofdrm_model {
 
 static int display_get_validated_int(struct drm_device *dev, const char *name, uint32_t value)
 {
-	if (value > INT_MAX) {
-		drm_err(dev, "invalid framebuffer %s of %u\n", name, value);
-		return -EINVAL;
-	}
-	return (int)value;
+	return drm_sysfb_get_validated_int(dev, name, value, INT_MAX);
 }
 
 static int display_get_validated_int0(struct drm_device *dev, const char *name, uint32_t value)
 {
-	if (!value) {
-		drm_err(dev, "invalid framebuffer %s of %u\n", name, value);
-		return -EINVAL;
-	}
-	return display_get_validated_int(dev, name, value);
+	return drm_sysfb_get_validated_int0(dev, name, value, INT_MAX);
 }
 
 static const struct drm_format_info *display_get_validated_format(struct drm_device *dev,
diff --git a/drivers/gpu/drm/sysfb/simpledrm.c b/drivers/gpu/drm/sysfb/simpledrm.c
index f37b1994de71..a1c3119330de 100644
--- a/drivers/gpu/drm/sysfb/simpledrm.c
+++ b/drivers/gpu/drm/sysfb/simpledrm.c
@@ -42,24 +42,14 @@ static int
 simplefb_get_validated_int(struct drm_device *dev, const char *name,
 			   uint32_t value)
 {
-	if (value > INT_MAX) {
-		drm_err(dev, "simplefb: invalid framebuffer %s of %u\n",
-			name, value);
-		return -EINVAL;
-	}
-	return (int)value;
+	return drm_sysfb_get_validated_int(dev, name, value, INT_MAX);
 }
 
 static int
 simplefb_get_validated_int0(struct drm_device *dev, const char *name,
 			    uint32_t value)
 {
-	if (!value) {
-		drm_err(dev, "simplefb: invalid framebuffer %s of %u\n",
-			name, value);
-		return -EINVAL;
-	}
-	return simplefb_get_validated_int(dev, name, value);
+	return drm_sysfb_get_validated_int0(dev, name, value, INT_MAX);
 }
 
 static const struct drm_format_info *
diff --git a/drivers/gpu/drm/sysfb/vesadrm.c b/drivers/gpu/drm/sysfb/vesadrm.c
index 9cc50e3072ea..d87ff77be20d 100644
--- a/drivers/gpu/drm/sysfb/vesadrm.c
+++ b/drivers/gpu/drm/sysfb/vesadrm.c
@@ -36,28 +36,6 @@
 
 #define VESADRM_GAMMA_LUT_SIZE 256
 
-static int vesadrm_get_validated_int(struct drm_device *dev, const char *name,
-				     u64 value, u32 max)
-{
-	if (max > INT_MAX)
-		max = INT_MAX;
-	if (value > max) {
-		drm_err(dev, "%s of %llu exceeds maximum of %u\n", name, value, max);
-		return -EINVAL;
-	}
-	return value;
-}
-
-static int vesadrm_get_validated_int0(struct drm_device *dev, const char *name,
-				      u64 value, u32 max)
-{
-	if (!value) {
-		drm_err(dev, "%s of 0 not allowed\n", name);
-		return -EINVAL;
-	}
-	return vesadrm_get_validated_int(dev, name, value, max);
-}
-
 static s64 vesadrm_get_validated_size0(struct drm_device *dev, const char *name,
 				       u64 value, u64 max)
 {
@@ -73,12 +51,12 @@ static s64 vesadrm_get_validated_size0(struct drm_device *dev, const char *name,
 
 static int vesadrm_get_width_si(struct drm_device *dev, const struct screen_info *si)
 {
-	return vesadrm_get_validated_int0(dev, "width", si->lfb_width, U16_MAX);
+	return drm_sysfb_get_validated_int0(dev, "width", si->lfb_width, U16_MAX);
 }
 
 static int vesadrm_get_height_si(struct drm_device *dev, const struct screen_info *si)
 {
-	return vesadrm_get_validated_int0(dev, "height", si->lfb_height, U16_MAX);
+	return drm_sysfb_get_validated_int0(dev, "height", si->lfb_height, U16_MAX);
 }
 
 static struct resource *vesadrm_get_memory_si(struct drm_device *dev,
@@ -105,7 +83,8 @@ static int vesadrm_get_stride_si(struct drm_device *dev, const struct screen_inf
 	if (!lfb_linelength)
 		lfb_linelength = drm_format_info_min_pitch(format, 0, width);
 
-	return vesadrm_get_validated_int0(dev, "stride", lfb_linelength, div64_u64(size, height));
+	return drm_sysfb_get_validated_int0(dev, "stride", lfb_linelength,
+					    div64_u64(size, height));
 }
 
 static u64 vesadrm_get_visible_size_si(struct drm_device *dev, const struct screen_info *si,
-- 
2.51.0


From e8c086880b2bac0ebc931b635b3b10bdc5ec6496 Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tzimmermann@suse.de>
Date: Thu, 10 Apr 2025 10:37:25 +0200
Subject: [PATCH 05/16] drm/sysfb: Share helpers for screen_info validation

Share efidrm's and vesadrm's validation of struct screen_info in
shared helpers. Update the drivers.

Most validation helpers test individual values against limits and
can be shared as they are. For color formats, a common helper looks
up the correct DRM format info from a driver-provided list of color
formats.

These screen_info helpers are only available if CONFIG_SCREEN_INFO
has been selected, as done by efidrm and vesadrm.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://lore.kernel.org/r/20250410083834.10810-4-tzimmermann@suse.de
---
 drivers/gpu/drm/sysfb/Makefile                |   1 +
 drivers/gpu/drm/sysfb/drm_sysfb_helper.h      |  34 ++++++
 drivers/gpu/drm/sysfb/drm_sysfb_screen_info.c | 107 ++++++++++++++++++
 drivers/gpu/drm/sysfb/efidrm.c                | 105 ++---------------
 drivers/gpu/drm/sysfb/vesadrm.c               | 105 ++---------------
 5 files changed, 160 insertions(+), 192 deletions(-)
 create mode 100644 drivers/gpu/drm/sysfb/drm_sysfb_screen_info.c

diff --git a/drivers/gpu/drm/sysfb/Makefile b/drivers/gpu/drm/sysfb/Makefile
index 861b4026f4a6..a156c496413d 100644
--- a/drivers/gpu/drm/sysfb/Makefile
+++ b/drivers/gpu/drm/sysfb/Makefile
@@ -3,6 +3,7 @@
 drm_sysfb_helper-y := \
 	drm_sysfb.o \
 	drm_sysfb_modeset.o
+drm_sysfb_helper-$(CONFIG_SCREEN_INFO) += drm_sysfb_screen_info.o
 obj-$(CONFIG_DRM_SYSFB_HELPER)	+= drm_sysfb_helper.o
 
 obj-$(CONFIG_DRM_EFIDRM)	+= efidrm.o
diff --git a/drivers/gpu/drm/sysfb/drm_sysfb_helper.h b/drivers/gpu/drm/sysfb/drm_sysfb_helper.h
index 1697cf7ace97..cb08a88242cc 100644
--- a/drivers/gpu/drm/sysfb/drm_sysfb_helper.h
+++ b/drivers/gpu/drm/sysfb/drm_sysfb_helper.h
@@ -6,12 +6,46 @@
 #include <linux/container_of.h>
 #include <linux/iosys-map.h>
 
+#include <video/pixel_format.h>
+
 #include <drm/drm_crtc.h>
 #include <drm/drm_device.h>
 #include <drm/drm_modes.h>
 
 struct drm_format_info;
 struct drm_scanout_buffer;
+struct screen_info;
+
+/*
+ * Input parsing
+ */
+
+struct drm_sysfb_format {
+	struct pixel_format pixel;
+	u32 fourcc;
+};
+
+int drm_sysfb_get_validated_int(struct drm_device *dev, const char *name,
+				u64 value, u32 max);
+int drm_sysfb_get_validated_int0(struct drm_device *dev, const char *name,
+				 u64 value, u32 max);
+
+#if defined(CONFIG_SCREEN_INFO)
+int drm_sysfb_get_width_si(struct drm_device *dev, const struct screen_info *si);
+int drm_sysfb_get_height_si(struct drm_device *dev, const struct screen_info *si);
+struct resource *drm_sysfb_get_memory_si(struct drm_device *dev,
+					 const struct screen_info *si,
+					 struct resource *res);
+int drm_sysfb_get_stride_si(struct drm_device *dev, const struct screen_info *si,
+			    const struct drm_format_info *format,
+			    unsigned int width, unsigned int height, u64 size);
+u64 drm_sysfb_get_visible_size_si(struct drm_device *dev, const struct screen_info *si,
+				  unsigned int height, unsigned int stride, u64 size);
+const struct drm_format_info *drm_sysfb_get_format_si(struct drm_device *dev,
+						      const struct drm_sysfb_format *formats,
+						      size_t nformats,
+						      const struct screen_info *si);
+#endif
 
 /*
  * Input parsing
diff --git a/drivers/gpu/drm/sysfb/drm_sysfb_screen_info.c b/drivers/gpu/drm/sysfb/drm_sysfb_screen_info.c
new file mode 100644
index 000000000000..0b3fb874a51f
--- /dev/null
+++ b/drivers/gpu/drm/sysfb/drm_sysfb_screen_info.c
@@ -0,0 +1,107 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <linux/export.h>
+#include <linux/limits.h>
+#include <linux/minmax.h>
+#include <linux/screen_info.h>
+
+#include <drm/drm_fourcc.h>
+#include <drm/drm_print.h>
+
+#include "drm_sysfb_helper.h"
+
+static s64 drm_sysfb_get_validated_size0(struct drm_device *dev, const char *name,
+					 u64 value, u64 max)
+{
+	if (!value) {
+		drm_warn(dev, "%s of 0 not allowed\n", name);
+		return -EINVAL;
+	} else if (value > min(max, S64_MAX)) {
+		drm_warn(dev, "%s of %llu exceeds maximum of %llu\n", name, value, max);
+		return -EINVAL;
+	}
+	return value;
+}
+
+int drm_sysfb_get_width_si(struct drm_device *dev, const struct screen_info *si)
+{
+	return drm_sysfb_get_validated_int0(dev, "width", si->lfb_width, U16_MAX);
+}
+EXPORT_SYMBOL(drm_sysfb_get_width_si);
+
+int drm_sysfb_get_height_si(struct drm_device *dev, const struct screen_info *si)
+{
+	return drm_sysfb_get_validated_int0(dev, "height", si->lfb_height, U16_MAX);
+}
+EXPORT_SYMBOL(drm_sysfb_get_height_si);
+
+struct resource *drm_sysfb_get_memory_si(struct drm_device *dev,
+					 const struct screen_info *si,
+					 struct resource *res)
+{
+	ssize_t	num;
+
+	num = screen_info_resources(si, res, 1);
+	if (!num) {
+		drm_warn(dev, "memory resource not found\n");
+		return NULL;
+	}
+
+	return res;
+}
+EXPORT_SYMBOL(drm_sysfb_get_memory_si);
+
+int drm_sysfb_get_stride_si(struct drm_device *dev, const struct screen_info *si,
+			    const struct drm_format_info *format,
+			    unsigned int width, unsigned int height, u64 size)
+{
+	u64 lfb_linelength = si->lfb_linelength;
+
+	if (!lfb_linelength)
+		lfb_linelength = drm_format_info_min_pitch(format, 0, width);
+
+	return drm_sysfb_get_validated_int0(dev, "stride", lfb_linelength, div64_u64(size, height));
+}
+EXPORT_SYMBOL(drm_sysfb_get_stride_si);
+
+u64 drm_sysfb_get_visible_size_si(struct drm_device *dev, const struct screen_info *si,
+				  unsigned int height, unsigned int stride, u64 size)
+{
+	u64 vsize = PAGE_ALIGN(height * stride);
+
+	return drm_sysfb_get_validated_size0(dev, "visible size", vsize, size);
+}
+EXPORT_SYMBOL(drm_sysfb_get_visible_size_si);
+
+const struct drm_format_info *drm_sysfb_get_format_si(struct drm_device *dev,
+						      const struct drm_sysfb_format *formats,
+						      size_t nformats,
+						      const struct screen_info *si)
+{
+	const struct drm_format_info *format = NULL;
+	u32 bits_per_pixel;
+	size_t i;
+
+	bits_per_pixel = __screen_info_lfb_bits_per_pixel(si);
+
+	for (i = 0; i < nformats; ++i) {
+		const struct pixel_format *f = &formats[i].pixel;
+
+		if (bits_per_pixel == f->bits_per_pixel &&
+		    si->red_size == f->red.length &&
+		    si->red_pos == f->red.offset &&
+		    si->green_size == f->green.length &&
+		    si->green_pos == f->green.offset &&
+		    si->blue_size == f->blue.length &&
+		    si->blue_pos == f->blue.offset) {
+			format = drm_format_info(formats[i].fourcc);
+			break;
+		}
+	}
+
+	if (!format)
+		drm_warn(dev, "No compatible color format found\n");
+
+	return format;
+}
+EXPORT_SYMBOL(drm_sysfb_get_format_si);
diff --git a/drivers/gpu/drm/sysfb/efidrm.c b/drivers/gpu/drm/sysfb/efidrm.c
index e3c7c930e5ad..46912924636a 100644
--- a/drivers/gpu/drm/sysfb/efidrm.c
+++ b/drivers/gpu/drm/sysfb/efidrm.c
@@ -33,72 +33,10 @@
 #define DRIVER_MAJOR	1
 #define DRIVER_MINOR	0
 
-static s64 efidrm_get_validated_size0(struct drm_device *dev, const char *name,
-				      u64 value, u64 max)
-{
-	if (!value) {
-		drm_err(dev, "%s of 0 not allowed\n", name);
-		return -EINVAL;
-	} else if (value > max) {
-		drm_err(dev, "%s of %llu exceeds maximum of %llu\n", name, value, max);
-		return -EINVAL;
-	}
-	return value;
-}
-
-static int efidrm_get_width_si(struct drm_device *dev, const struct screen_info *si)
-{
-	return drm_sysfb_get_validated_int0(dev, "width", si->lfb_width, U16_MAX);
-}
-
-static int efidrm_get_height_si(struct drm_device *dev, const struct screen_info *si)
-{
-	return drm_sysfb_get_validated_int0(dev, "height", si->lfb_height, U16_MAX);
-}
-
-static struct resource *efidrm_get_memory_si(struct drm_device *dev,
-					     const struct screen_info *si,
-					     struct resource *res)
-{
-	ssize_t	num;
-
-	num = screen_info_resources(si, res, 1);
-	if (!num) {
-		drm_err(dev, "memory resource not found\n");
-		return NULL;
-	}
-
-	return res;
-}
-
-static int efidrm_get_stride_si(struct drm_device *dev, const struct screen_info *si,
-				const struct drm_format_info *format,
-				unsigned int width, unsigned int height, u64 size)
-{
-	u64 lfb_linelength = si->lfb_linelength;
-
-	if (!lfb_linelength)
-		lfb_linelength = drm_format_info_min_pitch(format, 0, width);
-
-	return drm_sysfb_get_validated_int0(dev, "stride", lfb_linelength,
-					    div64_u64(size, height));
-}
-
-static u64 efidrm_get_visible_size_si(struct drm_device *dev, const struct screen_info *si,
-				      unsigned int height, unsigned int stride, u64 size)
-{
-	u64 vsize = PAGE_ALIGN(height * stride);
-
-	return efidrm_get_validated_size0(dev, "visible size", vsize, size);
-}
-
 static const struct drm_format_info *efidrm_get_format_si(struct drm_device *dev,
 							  const struct screen_info *si)
 {
-	static const struct {
-		struct pixel_format pixel;
-		u32 fourcc;
-	} efi_formats[] = {
+	static const struct drm_sysfb_format formats[] = {
 		{ PIXEL_FORMAT_XRGB1555, DRM_FORMAT_XRGB1555, },
 		{ PIXEL_FORMAT_RGB565, DRM_FORMAT_RGB565, },
 		{ PIXEL_FORMAT_RGB888, DRM_FORMAT_RGB888, },
@@ -106,33 +44,8 @@ static const struct drm_format_info *efidrm_get_format_si(struct drm_device *dev
 		{ PIXEL_FORMAT_XBGR8888, DRM_FORMAT_XBGR8888, },
 		{ PIXEL_FORMAT_XRGB2101010, DRM_FORMAT_XRGB2101010, },
 	};
-	const struct drm_format_info *format = NULL;
-	u32 bits_per_pixel;
-	size_t i;
-
-	bits_per_pixel = __screen_info_lfb_bits_per_pixel(si);
-
-	for (i = 0; i < ARRAY_SIZE(efi_formats); ++i) {
-		const struct pixel_format *f = &efi_formats[i].pixel;
-
-		if (bits_per_pixel == f->bits_per_pixel &&
-		    si->red_size == f->red.length &&
-		    si->red_pos == f->red.offset &&
-		    si->green_size == f->green.length &&
-		    si->green_pos == f->green.offset &&
-		    si->blue_size == f->blue.length &&
-		    si->blue_pos == f->blue.offset) {
-			format = drm_format_info(efi_formats[i].fourcc);
-			break;
-		}
-	}
-
-	if (!format)
-		return ERR_PTR(-EINVAL);
-	if (format->is_color_indexed)
-		return ERR_PTR(-EINVAL);
 
-	return format;
+	return drm_sysfb_get_format_si(dev, formats, ARRAY_SIZE(formats), si);
 }
 
 static u64 efidrm_get_mem_flags(struct drm_device *dev, resource_size_t start,
@@ -268,21 +181,21 @@ static struct efidrm_device *efidrm_device_create(struct drm_driver *drv,
 	 */
 
 	format = efidrm_get_format_si(dev, si);
-	if (IS_ERR(format))
-		return ERR_CAST(format);
-	width = efidrm_get_width_si(dev, si);
+	if (!format)
+		return ERR_PTR(-EINVAL);
+	width = drm_sysfb_get_width_si(dev, si);
 	if (width < 0)
 		return ERR_PTR(width);
-	height = efidrm_get_height_si(dev, si);
+	height = drm_sysfb_get_height_si(dev, si);
 	if (height < 0)
 		return ERR_PTR(height);
-	res = efidrm_get_memory_si(dev, si, &resbuf);
+	res = drm_sysfb_get_memory_si(dev, si, &resbuf);
 	if (!res)
 		return ERR_PTR(-EINVAL);
-	stride = efidrm_get_stride_si(dev, si, format, width, height, resource_size(res));
+	stride = drm_sysfb_get_stride_si(dev, si, format, width, height, resource_size(res));
 	if (stride < 0)
 		return ERR_PTR(stride);
-	vsize = efidrm_get_visible_size_si(dev, si, height, stride, resource_size(res));
+	vsize = drm_sysfb_get_visible_size_si(dev, si, height, stride, resource_size(res));
 	if (!vsize)
 		return ERR_PTR(-EINVAL);
 
diff --git a/drivers/gpu/drm/sysfb/vesadrm.c b/drivers/gpu/drm/sysfb/vesadrm.c
index d87ff77be20d..4d62c78e7d1e 100644
--- a/drivers/gpu/drm/sysfb/vesadrm.c
+++ b/drivers/gpu/drm/sysfb/vesadrm.c
@@ -36,105 +36,18 @@
 
 #define VESADRM_GAMMA_LUT_SIZE 256
 
-static s64 vesadrm_get_validated_size0(struct drm_device *dev, const char *name,
-				       u64 value, u64 max)
-{
-	if (!value) {
-		drm_err(dev, "vesadrm: %s of 0 not allowed\n", name);
-		return -EINVAL;
-	} else if (value > max) {
-		drm_err(dev, "vesadrm: %s of %llu exceeds maximum of %llu\n", name, value, max);
-		return -EINVAL;
-	}
-	return value;
-}
-
-static int vesadrm_get_width_si(struct drm_device *dev, const struct screen_info *si)
-{
-	return drm_sysfb_get_validated_int0(dev, "width", si->lfb_width, U16_MAX);
-}
-
-static int vesadrm_get_height_si(struct drm_device *dev, const struct screen_info *si)
-{
-	return drm_sysfb_get_validated_int0(dev, "height", si->lfb_height, U16_MAX);
-}
-
-static struct resource *vesadrm_get_memory_si(struct drm_device *dev,
-					      const struct screen_info *si,
-					      struct resource *res)
-{
-	ssize_t	num;
-
-	num = screen_info_resources(si, res, 1);
-	if (!num) {
-		drm_err(dev, "vesadrm: memory resource not found\n");
-		return NULL;
-	}
-
-	return res;
-}
-
-static int vesadrm_get_stride_si(struct drm_device *dev, const struct screen_info *si,
-				 const struct drm_format_info *format,
-				 unsigned int width, unsigned int height, u64 size)
-{
-	u64 lfb_linelength = si->lfb_linelength;
-
-	if (!lfb_linelength)
-		lfb_linelength = drm_format_info_min_pitch(format, 0, width);
-
-	return drm_sysfb_get_validated_int0(dev, "stride", lfb_linelength,
-					    div64_u64(size, height));
-}
-
-static u64 vesadrm_get_visible_size_si(struct drm_device *dev, const struct screen_info *si,
-				       unsigned int height, unsigned int stride, u64 size)
-{
-	u64 vsize = PAGE_ALIGN(height * stride);
-
-	return vesadrm_get_validated_size0(dev, "visible size", vsize, size);
-}
-
 static const struct drm_format_info *vesadrm_get_format_si(struct drm_device *dev,
 							   const struct screen_info *si)
 {
-	static const struct {
-		struct pixel_format pixel;
-		u32 fourcc;
-	} vesa_formats[] = {
+	static const struct drm_sysfb_format formats[] = {
 		{ PIXEL_FORMAT_XRGB1555, DRM_FORMAT_XRGB1555, },
 		{ PIXEL_FORMAT_RGB565, DRM_FORMAT_RGB565, },
 		{ PIXEL_FORMAT_RGB888, DRM_FORMAT_RGB888, },
 		{ PIXEL_FORMAT_XRGB8888, DRM_FORMAT_XRGB8888, },
 		{ PIXEL_FORMAT_XBGR8888, DRM_FORMAT_XBGR8888, },
 	};
-	const struct drm_format_info *format = NULL;
-	u32 bits_per_pixel;
-	size_t i;
-
-	bits_per_pixel = __screen_info_lfb_bits_per_pixel(si);
-
-	for (i = 0; i < ARRAY_SIZE(vesa_formats); ++i) {
-		const struct pixel_format *f = &vesa_formats[i].pixel;
 
-		if (bits_per_pixel == f->bits_per_pixel &&
-		    si->red_size == f->red.length &&
-		    si->red_pos == f->red.offset &&
-		    si->green_size == f->green.length &&
-		    si->green_pos == f->green.offset &&
-		    si->blue_size == f->blue.length &&
-		    si->blue_pos == f->blue.offset) {
-			format = drm_format_info(vesa_formats[i].fourcc);
-			break;
-		}
-	}
-
-	if (!format)
-		return ERR_PTR(-EINVAL);
-	if (format->is_color_indexed)
-		return ERR_PTR(-EINVAL);
-
-	return format;
+	return drm_sysfb_get_format_si(dev, formats, ARRAY_SIZE(formats), si);
 }
 
 /*
@@ -426,21 +339,21 @@ static struct vesadrm_device *vesadrm_device_create(struct drm_driver *drv,
 	 */
 
 	format = vesadrm_get_format_si(dev, si);
-	if (IS_ERR(format))
-		return ERR_CAST(format);
-	width = vesadrm_get_width_si(dev, si);
+	if (!format)
+		return ERR_PTR(-EINVAL);
+	width = drm_sysfb_get_width_si(dev, si);
 	if (width < 0)
 		return ERR_PTR(width);
-	height = vesadrm_get_height_si(dev, si);
+	height = drm_sysfb_get_height_si(dev, si);
 	if (height < 0)
 		return ERR_PTR(height);
-	res = vesadrm_get_memory_si(dev, si, &resbuf);
+	res = drm_sysfb_get_memory_si(dev, si, &resbuf);
 	if (!res)
 		return ERR_PTR(-EINVAL);
-	stride = vesadrm_get_stride_si(dev, si, format, width, height, resource_size(res));
+	stride = drm_sysfb_get_stride_si(dev, si, format, width, height, resource_size(res));
 	if (stride < 0)
 		return ERR_PTR(stride);
-	vsize = vesadrm_get_visible_size_si(dev, si, height, stride, resource_size(res));
+	vsize = drm_sysfb_get_visible_size_si(dev, si, height, stride, resource_size(res));
 	if (!vsize)
 		return ERR_PTR(-EINVAL);
 
-- 
2.51.0


From 6d0171c77d1a917cacbafe8a38ed486710d726fe Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tzimmermann@suse.de>
Date: Thu, 10 Apr 2025 12:58:58 +0200
Subject: [PATCH 06/16] drm/udl: Remove unused field dev from struct udl_device

Reduce the size of struct udl_device by removing the unused
field dev.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
Link: https://lore.kernel.org/r/20250410105948.25463-2-tzimmermann@suse.de
---
 drivers/gpu/drm/udl/udl_drv.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/gpu/drm/udl/udl_drv.h b/drivers/gpu/drm/udl/udl_drv.h
index e67e7e2e6f1f..7bae28885f92 100644
--- a/drivers/gpu/drm/udl/udl_drv.h
+++ b/drivers/gpu/drm/udl/udl_drv.h
@@ -50,7 +50,6 @@ struct urb_list {
 
 struct udl_device {
 	struct drm_device drm;
-	struct device *dev;
 
 	struct drm_plane primary_plane;
 	struct drm_crtc crtc;
-- 
2.51.0


From 21c6b386f1eec5586f82b8659f4e0cbc85b03e88 Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tzimmermann@suse.de>
Date: Thu, 10 Apr 2025 12:58:59 +0200
Subject: [PATCH 07/16] drm/udl: Remove unused field gem_lock from struct
 udl_device

Reduce the size of struct udl_device by removing the unused
field gem_lock.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
Link: https://lore.kernel.org/r/20250410105948.25463-3-tzimmermann@suse.de
---
 drivers/gpu/drm/udl/udl_drv.h  | 2 --
 drivers/gpu/drm/udl/udl_main.c | 2 --
 2 files changed, 4 deletions(-)

diff --git a/drivers/gpu/drm/udl/udl_drv.h b/drivers/gpu/drm/udl/udl_drv.h
index 7bae28885f92..1204319fc8e3 100644
--- a/drivers/gpu/drm/udl/udl_drv.h
+++ b/drivers/gpu/drm/udl/udl_drv.h
@@ -56,8 +56,6 @@ struct udl_device {
 	struct drm_encoder encoder;
 	struct drm_connector connector;
 
-	struct mutex gem_lock;
-
 	int sku_pixel_limit;
 
 	struct urb_list urbs;
diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
index 48260a821b8d..f1ffa928d5d9 100644
--- a/drivers/gpu/drm/udl/udl_main.c
+++ b/drivers/gpu/drm/udl/udl_main.c
@@ -320,8 +320,6 @@ int udl_init(struct udl_device *udl)
 		drm_warn(dev, "buffer sharing not supported"); /* not an error */
 	}
 
-	mutex_init(&udl->gem_lock);
-
 	if (!udl_parse_vendor_descriptor(udl)) {
 		ret = -ENODEV;
 		DRM_ERROR("firmware not recognized. Assume incompatible device\n");
-- 
2.51.0


From 0b4346d6898490d03b2d93070103db73ae864f86 Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tzimmermann@suse.de>
Date: Thu, 10 Apr 2025 12:59:00 +0200
Subject: [PATCH 08/16] drm/udl: Improve type safety when using struct
 udl_device

Push upcasts from struct drm_device to struct udl_device outwards
in the call chain; cast earlier and call functions with the upcasted
value. Improves type safety.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
Link: https://lore.kernel.org/r/20250410105948.25463-4-tzimmermann@suse.de
---
 drivers/gpu/drm/udl/udl_drv.c      |  6 ++++--
 drivers/gpu/drm/udl/udl_drv.h      | 12 ++++++------
 drivers/gpu/drm/udl/udl_main.c     | 28 ++++++++++++----------------
 drivers/gpu/drm/udl/udl_modeset.c  | 21 ++++++++++++---------
 drivers/gpu/drm/udl/udl_transfer.c |  6 +++---
 5 files changed, 37 insertions(+), 36 deletions(-)

diff --git a/drivers/gpu/drm/udl/udl_drv.c b/drivers/gpu/drm/udl/udl_drv.c
index d1bc3f165b27..1922988625eb 100644
--- a/drivers/gpu/drm/udl/udl_drv.c
+++ b/drivers/gpu/drm/udl/udl_drv.c
@@ -22,13 +22,14 @@ static int udl_usb_suspend(struct usb_interface *interface,
 			   pm_message_t message)
 {
 	struct drm_device *dev = usb_get_intfdata(interface);
+	struct udl_device *udl = to_udl(dev);
 	int ret;
 
 	ret = drm_mode_config_helper_suspend(dev);
 	if (ret)
 		return ret;
 
-	udl_sync_pending_urbs(dev);
+	udl_sync_pending_urbs(udl);
 	return 0;
 }
 
@@ -109,9 +110,10 @@ static int udl_usb_probe(struct usb_interface *interface,
 static void udl_usb_disconnect(struct usb_interface *interface)
 {
 	struct drm_device *dev = usb_get_intfdata(interface);
+	struct udl_device *udl = to_udl(dev);
 
 	drm_dev_unplug(dev);
-	udl_drop_usb(dev);
+	udl_drop_usb(udl);
 }
 
 /*
diff --git a/drivers/gpu/drm/udl/udl_drv.h b/drivers/gpu/drm/udl/udl_drv.h
index 1204319fc8e3..918738e549d6 100644
--- a/drivers/gpu/drm/udl/udl_drv.h
+++ b/drivers/gpu/drm/udl/udl_drv.h
@@ -69,22 +69,22 @@ static inline struct usb_device *udl_to_usb_device(struct udl_device *udl)
 }
 
 /* modeset */
-int udl_modeset_init(struct drm_device *dev);
+int udl_modeset_init(struct udl_device *udl);
 struct drm_connector *udl_connector_init(struct drm_device *dev);
 
-struct urb *udl_get_urb(struct drm_device *dev);
+struct urb *udl_get_urb(struct udl_device *udl);
 
-int udl_submit_urb(struct drm_device *dev, struct urb *urb, size_t len);
-void udl_sync_pending_urbs(struct drm_device *dev);
+int udl_submit_urb(struct udl_device *udl, struct urb *urb, size_t len);
+void udl_sync_pending_urbs(struct udl_device *udl);
 void udl_urb_completion(struct urb *urb);
 
 int udl_init(struct udl_device *udl);
 
-int udl_render_hline(struct drm_device *dev, int log_bpp, struct urb **urb_ptr,
+int udl_render_hline(struct udl_device *udl, int log_bpp, struct urb **urb_ptr,
 		     const char *front, char **urb_buf_ptr,
 		     u32 byte_offset, u32 device_byte_offset, u32 byte_width);
 
-int udl_drop_usb(struct drm_device *dev);
+int udl_drop_usb(struct udl_device *udl);
 int udl_select_std_channel(struct udl_device *udl);
 
 #endif
diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
index f1ffa928d5d9..47fb6c34bfde 100644
--- a/drivers/gpu/drm/udl/udl_main.c
+++ b/drivers/gpu/drm/udl/udl_main.c
@@ -145,9 +145,8 @@ void udl_urb_completion(struct urb *urb)
 	wake_up(&udl->urbs.sleep);
 }
 
-static void udl_free_urb_list(struct drm_device *dev)
+static void udl_free_urb_list(struct udl_device *udl)
 {
-	struct udl_device *udl = to_udl(dev);
 	struct urb_node *unode;
 	struct urb *urb;
 
@@ -172,9 +171,8 @@ static void udl_free_urb_list(struct drm_device *dev)
 	wake_up_all(&udl->urbs.sleep);
 }
 
-static int udl_alloc_urb_list(struct drm_device *dev, int count, size_t size)
+static int udl_alloc_urb_list(struct udl_device *udl, int count, size_t size)
 {
-	struct udl_device *udl = to_udl(dev);
 	struct urb *urb;
 	struct urb_node *unode;
 	char *buf;
@@ -210,7 +208,7 @@ retry:
 			usb_free_urb(urb);
 			if (size > PAGE_SIZE) {
 				size /= 2;
-				udl_free_urb_list(dev);
+				udl_free_urb_list(udl);
 				goto retry;
 			}
 			break;
@@ -259,9 +257,8 @@ static struct urb *udl_get_urb_locked(struct udl_device *udl, long timeout)
 }
 
 #define GET_URB_TIMEOUT	HZ
-struct urb *udl_get_urb(struct drm_device *dev)
+struct urb *udl_get_urb(struct udl_device *udl)
 {
-	struct udl_device *udl = to_udl(dev);
 	struct urb *urb;
 
 	spin_lock_irq(&udl->urbs.lock);
@@ -270,9 +267,8 @@ struct urb *udl_get_urb(struct drm_device *dev)
 	return urb;
 }
 
-int udl_submit_urb(struct drm_device *dev, struct urb *urb, size_t len)
+int udl_submit_urb(struct udl_device *udl, struct urb *urb, size_t len)
 {
-	struct udl_device *udl = to_udl(dev);
 	int ret;
 
 	if (WARN_ON(len > udl->urbs.size)) {
@@ -290,9 +286,9 @@ int udl_submit_urb(struct drm_device *dev, struct urb *urb, size_t len)
 }
 
 /* wait until all pending URBs have been processed */
-void udl_sync_pending_urbs(struct drm_device *dev)
+void udl_sync_pending_urbs(struct udl_device *udl)
 {
-	struct udl_device *udl = to_udl(dev);
+	struct drm_device *dev = &udl->drm;
 
 	spin_lock_irq(&udl->urbs.lock);
 	/* 2 seconds as a sane timeout */
@@ -329,13 +325,13 @@ int udl_init(struct udl_device *udl)
 	if (udl_select_std_channel(udl))
 		DRM_ERROR("Selecting channel failed\n");
 
-	if (!udl_alloc_urb_list(dev, WRITES_IN_FLIGHT, MAX_TRANSFER)) {
+	if (!udl_alloc_urb_list(udl, WRITES_IN_FLIGHT, MAX_TRANSFER)) {
 		DRM_ERROR("udl_alloc_urb_list failed\n");
 		goto err;
 	}
 
 	DRM_DEBUG("\n");
-	ret = udl_modeset_init(dev);
+	ret = udl_modeset_init(udl);
 	if (ret)
 		goto err;
 
@@ -343,14 +339,14 @@ int udl_init(struct udl_device *udl)
 
 err:
 	if (udl->urbs.count)
-		udl_free_urb_list(dev);
+		udl_free_urb_list(udl);
 	DRM_ERROR("%d\n", ret);
 	return ret;
 }
 
-int udl_drop_usb(struct drm_device *dev)
+int udl_drop_usb(struct udl_device *udl)
 {
-	udl_free_urb_list(dev);
+	udl_free_urb_list(udl);
 
 	return 0;
 }
diff --git a/drivers/gpu/drm/udl/udl_modeset.c b/drivers/gpu/drm/udl/udl_modeset.c
index 3b65e93ea0ae..231e829bd709 100644
--- a/drivers/gpu/drm/udl/udl_modeset.c
+++ b/drivers/gpu/drm/udl/udl_modeset.c
@@ -205,6 +205,7 @@ static int udl_handle_damage(struct drm_framebuffer *fb,
 			     const struct drm_rect *clip)
 {
 	struct drm_device *dev = fb->dev;
+	struct udl_device *udl = to_udl(dev);
 	void *vaddr = map->vaddr; /* TODO: Use mapping abstraction properly */
 	int i, ret;
 	char *cmd;
@@ -216,7 +217,7 @@ static int udl_handle_damage(struct drm_framebuffer *fb,
 		return ret;
 	log_bpp = ret;
 
-	urb = udl_get_urb(dev);
+	urb = udl_get_urb(udl);
 	if (!urb)
 		return -ENOMEM;
 	cmd = urb->transfer_buffer;
@@ -226,7 +227,7 @@ static int udl_handle_damage(struct drm_framebuffer *fb,
 		const int byte_offset = line_offset + (clip->x1 << log_bpp);
 		const int dev_byte_offset = (fb->width * i + clip->x1) << log_bpp;
 		const int byte_width = drm_rect_width(clip) << log_bpp;
-		ret = udl_render_hline(dev, log_bpp, &urb, (char *)vaddr,
+		ret = udl_render_hline(udl, log_bpp, &urb, (char *)vaddr,
 				       &cmd, byte_offset, dev_byte_offset,
 				       byte_width);
 		if (ret)
@@ -239,7 +240,7 @@ static int udl_handle_damage(struct drm_framebuffer *fb,
 		if (cmd < (char *)urb->transfer_buffer + urb->transfer_buffer_length)
 			*cmd++ = UDL_MSG_BULK;
 		len = cmd - (char *)urb->transfer_buffer;
-		ret = udl_submit_urb(dev, urb, len);
+		ret = udl_submit_urb(udl, urb, len);
 	} else {
 		udl_urb_completion(urb);
 	}
@@ -330,6 +331,7 @@ static const struct drm_plane_funcs udl_primary_plane_funcs = {
 static void udl_crtc_helper_atomic_enable(struct drm_crtc *crtc, struct drm_atomic_state *state)
 {
 	struct drm_device *dev = crtc->dev;
+	struct udl_device *udl = to_udl(dev);
 	struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
 	struct drm_display_mode *mode = &crtc_state->mode;
 	struct urb *urb;
@@ -339,7 +341,7 @@ static void udl_crtc_helper_atomic_enable(struct drm_crtc *crtc, struct drm_atom
 	if (!drm_dev_enter(dev, &idx))
 		return;
 
-	urb = udl_get_urb(dev);
+	urb = udl_get_urb(udl);
 	if (!urb)
 		goto out;
 
@@ -355,7 +357,7 @@ static void udl_crtc_helper_atomic_enable(struct drm_crtc *crtc, struct drm_atom
 	buf = udl_vidreg_unlock(buf);
 	buf = udl_dummy_render(buf);
 
-	udl_submit_urb(dev, urb, buf - (char *)urb->transfer_buffer);
+	udl_submit_urb(udl, urb, buf - (char *)urb->transfer_buffer);
 
 out:
 	drm_dev_exit(idx);
@@ -364,6 +366,7 @@ out:
 static void udl_crtc_helper_atomic_disable(struct drm_crtc *crtc, struct drm_atomic_state *state)
 {
 	struct drm_device *dev = crtc->dev;
+	struct udl_device *udl = to_udl(dev);
 	struct urb *urb;
 	char *buf;
 	int idx;
@@ -371,7 +374,7 @@ static void udl_crtc_helper_atomic_disable(struct drm_crtc *crtc, struct drm_ato
 	if (!drm_dev_enter(dev, &idx))
 		return;
 
-	urb = udl_get_urb(dev);
+	urb = udl_get_urb(udl);
 	if (!urb)
 		goto out;
 
@@ -381,7 +384,7 @@ static void udl_crtc_helper_atomic_disable(struct drm_crtc *crtc, struct drm_ato
 	buf = udl_vidreg_unlock(buf);
 	buf = udl_dummy_render(buf);
 
-	udl_submit_urb(dev, urb, buf - (char *)urb->transfer_buffer);
+	udl_submit_urb(udl, urb, buf - (char *)urb->transfer_buffer);
 
 out:
 	drm_dev_exit(idx);
@@ -476,9 +479,9 @@ static const struct drm_mode_config_funcs udl_mode_config_funcs = {
 	.atomic_commit = drm_atomic_helper_commit,
 };
 
-int udl_modeset_init(struct drm_device *dev)
+int udl_modeset_init(struct udl_device *udl)
 {
-	struct udl_device *udl = to_udl(dev);
+	struct drm_device *dev = &udl->drm;
 	struct drm_plane *primary_plane;
 	struct drm_crtc *crtc;
 	struct drm_encoder *encoder;
diff --git a/drivers/gpu/drm/udl/udl_transfer.c b/drivers/gpu/drm/udl/udl_transfer.c
index 62224992988f..7d670b3a5293 100644
--- a/drivers/gpu/drm/udl/udl_transfer.c
+++ b/drivers/gpu/drm/udl/udl_transfer.c
@@ -170,7 +170,7 @@ static void udl_compress_hline16(
  * (that we can only write to, slowly, and can never read), and (optionally)
  * our shadow copy that tracks what's been sent to that hardware buffer.
  */
-int udl_render_hline(struct drm_device *dev, int log_bpp, struct urb **urb_ptr,
+int udl_render_hline(struct udl_device *udl, int log_bpp, struct urb **urb_ptr,
 		     const char *front, char **urb_buf_ptr,
 		     u32 byte_offset, u32 device_byte_offset,
 		     u32 byte_width)
@@ -199,10 +199,10 @@ int udl_render_hline(struct drm_device *dev, int log_bpp, struct urb **urb_ptr,
 
 		if (cmd >= cmd_end) {
 			int len = cmd - (u8 *) urb->transfer_buffer;
-			int ret = udl_submit_urb(dev, urb, len);
+			int ret = udl_submit_urb(udl, urb, len);
 			if (ret)
 				return ret;
-			urb = udl_get_urb(dev);
+			urb = udl_get_urb(udl);
 			if (!urb)
 				return -EAGAIN;
 			*urb_ptr = urb;
-- 
2.51.0


From 89323678d8280f4f8e5971124d3aef8a6dfece0a Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tzimmermann@suse.de>
Date: Thu, 10 Apr 2025 12:59:01 +0200
Subject: [PATCH 09/16] drm/udl: The number of pixels is always positive

Store sku_pixel_limit as type unsigned long instead of int. The
number of pixels available is always positive.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
Link: https://lore.kernel.org/r/20250410105948.25463-5-tzimmermann@suse.de
---
 drivers/gpu/drm/udl/udl_drv.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/udl/udl_drv.h b/drivers/gpu/drm/udl/udl_drv.h
index 918738e549d6..145bb95ccc48 100644
--- a/drivers/gpu/drm/udl/udl_drv.h
+++ b/drivers/gpu/drm/udl/udl_drv.h
@@ -51,13 +51,13 @@ struct urb_list {
 struct udl_device {
 	struct drm_device drm;
 
+	unsigned long sku_pixel_limit;
+
 	struct drm_plane primary_plane;
 	struct drm_crtc crtc;
 	struct drm_encoder encoder;
 	struct drm_connector connector;
 
-	int sku_pixel_limit;
-
 	struct urb_list urbs;
 };
 
-- 
2.51.0


From 895452ae48c1e179df509b6184227a5ea40b4f38 Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tzimmermann@suse.de>
Date: Thu, 10 Apr 2025 12:59:02 +0200
Subject: [PATCH 10/16] drm/udl: Handle errors from usb_get_descriptor()

Reading the vendor descriptor from the udl device can fail with
an error, which the current code fails to capture. Store the return
value in an integer and test for the error. Abort parsing on errors
or treat the value as length on success.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
Link: https://lore.kernel.org/r/20250410105948.25463-6-tzimmermann@suse.de
---
 drivers/gpu/drm/udl/udl_main.c | 24 ++++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
index 47fb6c34bfde..4291ddb7158c 100644
--- a/drivers/gpu/drm/udl/udl_main.c
+++ b/drivers/gpu/drm/udl/udl_main.c
@@ -31,28 +31,32 @@ static int udl_parse_vendor_descriptor(struct udl_device *udl)
 	char *desc;
 	char *buf;
 	char *desc_end;
-
-	u8 total_len = 0;
+	int ret;
+	unsigned int len;
 
 	buf = kzalloc(MAX_VENDOR_DESCRIPTOR_SIZE, GFP_KERNEL);
 	if (!buf)
 		return false;
 	desc = buf;
 
-	total_len = usb_get_descriptor(udev, 0x5f, /* vendor specific */
-				    0, desc, MAX_VENDOR_DESCRIPTOR_SIZE);
-	if (total_len > 5) {
-		DRM_INFO("vendor descriptor length:%x data:%11ph\n",
-			total_len, desc);
+	ret = usb_get_descriptor(udev, 0x5f, /* vendor specific */
+				 0, desc, MAX_VENDOR_DESCRIPTOR_SIZE);
+	if (ret < 0)
+		goto unrecognized;
+	len = ret;
+
+	if (len > 5) {
+		DRM_INFO("vendor descriptor length: %u data:%11ph\n",
+			 len, desc);
 
-		if ((desc[0] != total_len) || /* descriptor length */
+		if ((desc[0] != len) ||    /* descriptor length */
 		    (desc[1] != 0x5f) ||   /* vendor descriptor type */
 		    (desc[2] != 0x01) ||   /* version (2 bytes) */
 		    (desc[3] != 0x00) ||
-		    (desc[4] != total_len - 2)) /* length after type */
+		    (desc[4] != len - 2))  /* length after type */
 			goto unrecognized;
 
-		desc_end = desc + total_len;
+		desc_end = desc + len;
 		desc += 5; /* the fixed header we've already parsed */
 
 		while (desc < desc_end) {
-- 
2.51.0


From 1fad33f04ed1fd14049cda6a35faa4abc0886201 Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tzimmermann@suse.de>
Date: Thu, 10 Apr 2025 12:59:03 +0200
Subject: [PATCH 11/16] drm/udl: Return error if vendor descriptor is too short

There need to be least 5 bytes in the vendor descriptor. Return
an error otherwise. Also change the branching to early-out on
the error. Adjust indention of the rest of the parser function.

The original length test expected more than 5 bytes in the vendor
descriptor. As a descriptor with no key-value pairs has exactly 5
bytes and is still valid, change the test to accept this case as
well.

v2
- clarify changes to length test in commit description (Patrik)

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
Link: https://lore.kernel.org/r/20250410105948.25463-7-tzimmermann@suse.de
---
 drivers/gpu/drm/udl/udl_main.c | 72 +++++++++++++++++-----------------
 1 file changed, 36 insertions(+), 36 deletions(-)

diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
index 4291ddb7158c..58d6065589d3 100644
--- a/drivers/gpu/drm/udl/udl_main.c
+++ b/drivers/gpu/drm/udl/udl_main.c
@@ -45,43 +45,43 @@ static int udl_parse_vendor_descriptor(struct udl_device *udl)
 		goto unrecognized;
 	len = ret;
 
-	if (len > 5) {
-		DRM_INFO("vendor descriptor length: %u data:%11ph\n",
-			 len, desc);
-
-		if ((desc[0] != len) ||    /* descriptor length */
-		    (desc[1] != 0x5f) ||   /* vendor descriptor type */
-		    (desc[2] != 0x01) ||   /* version (2 bytes) */
-		    (desc[3] != 0x00) ||
-		    (desc[4] != len - 2))  /* length after type */
-			goto unrecognized;
-
-		desc_end = desc + len;
-		desc += 5; /* the fixed header we've already parsed */
-
-		while (desc < desc_end) {
-			u8 length;
-			u16 key;
-
-			key = le16_to_cpu(*((u16 *) desc));
-			desc += sizeof(u16);
-			length = *desc;
-			desc++;
-
-			switch (key) {
-			case 0x0200: { /* max_area */
-				u32 max_area;
-				max_area = le32_to_cpu(*((u32 *)desc));
-				DRM_DEBUG("DL chip limited to %d pixel modes\n",
-					max_area);
-				udl->sku_pixel_limit = max_area;
-				break;
-			}
-			default:
-				break;
-			}
-			desc += length;
+	if (len < 5)
+		goto unrecognized;
+
+	DRM_INFO("vendor descriptor length: %u data:%11ph\n", len, desc);
+
+	if ((desc[0] != len) ||    /* descriptor length */
+	    (desc[1] != 0x5f) ||   /* vendor descriptor type */
+	    (desc[2] != 0x01) ||   /* version (2 bytes) */
+	    (desc[3] != 0x00) ||
+	    (desc[4] != len - 2))  /* length after type */
+		goto unrecognized;
+
+	desc_end = desc + len;
+	desc += 5; /* the fixed header we've already parsed */
+
+	while (desc < desc_end) {
+		u8 length;
+		u16 key;
+
+		key = le16_to_cpu(*((u16 *)desc));
+		desc += sizeof(u16);
+		length = *desc;
+		desc++;
+
+		switch (key) {
+		case 0x0200: { /* max_area */
+			u32 max_area = le32_to_cpu(*((u32 *)desc));
+
+			DRM_DEBUG("DL chip limited to %d pixel modes\n",
+				  max_area);
+			udl->sku_pixel_limit = max_area;
+			break;
+		}
+		default:
+			break;
 		}
+		desc += length;
 	}
 
 	goto success;
-- 
2.51.0


From f4fce9ea8473ab8f91c0aa0855b9d51313b8000e Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tzimmermann@suse.de>
Date: Thu, 10 Apr 2025 12:59:04 +0200
Subject: [PATCH 12/16] drm/udl: Treat vendor descriptor as u8

The vendor descriptor is an array of unsigned bytes. It is raw data
that is not to be modified. Declare it as 'const u8'.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
Link: https://lore.kernel.org/r/20250410105948.25463-8-tzimmermann@suse.de
---
 drivers/gpu/drm/udl/udl_main.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
index 58d6065589d3..d3a04bcb65d2 100644
--- a/drivers/gpu/drm/udl/udl_main.c
+++ b/drivers/gpu/drm/udl/udl_main.c
@@ -28,19 +28,18 @@ static struct urb *udl_get_urb_locked(struct udl_device *udl, long timeout);
 static int udl_parse_vendor_descriptor(struct udl_device *udl)
 {
 	struct usb_device *udev = udl_to_usb_device(udl);
-	char *desc;
-	char *buf;
-	char *desc_end;
+	void *buf;
 	int ret;
 	unsigned int len;
+	const u8 *desc;
+	const u8 *desc_end;
 
 	buf = kzalloc(MAX_VENDOR_DESCRIPTOR_SIZE, GFP_KERNEL);
 	if (!buf)
 		return false;
-	desc = buf;
 
 	ret = usb_get_descriptor(udev, 0x5f, /* vendor specific */
-				 0, desc, MAX_VENDOR_DESCRIPTOR_SIZE);
+				 0, buf, MAX_VENDOR_DESCRIPTOR_SIZE);
 	if (ret < 0)
 		goto unrecognized;
 	len = ret;
@@ -48,6 +47,9 @@ static int udl_parse_vendor_descriptor(struct udl_device *udl)
 	if (len < 5)
 		goto unrecognized;
 
+	desc = buf;
+	desc_end = desc + len;
+
 	DRM_INFO("vendor descriptor length: %u data:%11ph\n", len, desc);
 
 	if ((desc[0] != len) ||    /* descriptor length */
@@ -56,9 +58,7 @@ static int udl_parse_vendor_descriptor(struct udl_device *udl)
 	    (desc[3] != 0x00) ||
 	    (desc[4] != len - 2))  /* length after type */
 		goto unrecognized;
-
-	desc_end = desc + len;
-	desc += 5; /* the fixed header we've already parsed */
+	desc += 5;
 
 	while (desc < desc_end) {
 		u8 length;
-- 
2.51.0


From df6dc12e5e6ddbf2a59d5283fcf6ccd0b3d0334d Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tzimmermann@suse.de>
Date: Thu, 10 Apr 2025 12:59:05 +0200
Subject: [PATCH 13/16] drm/udl: Validate length in vendor-descriptor parser

Rewrite the parser for the vendor firmware descriptor with the
following improvements.

- Validate the key-value length given in a vendor descriptor
against the length of the descriptor. The current code fails
to do this and might read more bytes than available. This can
lead to out-of-bounds reads of the allocated buffer.

- Read raw data with helpers for unaligned data. This allows
the code to run on platforms that do now support unaligned memory
access by default.

- Validate the pixel limit against a default value. The default
comes from real-world devices. If the reported number of pixels
is significantly above the limit, it is likely invalid.

- Drop the obsolete print macros. There is still a warning about
invalid firmware descriptors. The rest of the output is bogus.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
Link: https://lore.kernel.org/r/20250410105948.25463-9-tzimmermann@suse.de
---
 drivers/gpu/drm/udl/udl_main.c | 77 ++++++++++++++++++++++------------
 1 file changed, 51 insertions(+), 26 deletions(-)

diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
index d3a04bcb65d2..b5a6b254a202 100644
--- a/drivers/gpu/drm/udl/udl_main.c
+++ b/drivers/gpu/drm/udl/udl_main.c
@@ -8,6 +8,8 @@
  * Copyright (C) 2009 Bernie Thompson <bernie@plugable.com>
  */
 
+#include <linux/unaligned.h>
+
 #include <drm/drm.h>
 #include <drm/drm_print.h>
 #include <drm/drm_probe_helper.h>
@@ -23,10 +25,56 @@
 #define WRITES_IN_FLIGHT (20)
 #define MAX_VENDOR_DESCRIPTOR_SIZE 256
 
+#define UDL_SKU_PIXEL_LIMIT_DEFAULT	2080000
+
 static struct urb *udl_get_urb_locked(struct udl_device *udl, long timeout);
 
+/*
+ * Try to make sense of whatever we parse. Therefore return @end on
+ * errors, but don't fail hard.
+ */
+static const u8 *udl_parse_key_value_pair(struct udl_device *udl, const u8 *pos, const u8 *end)
+{
+	u16 key;
+	u8 len;
+
+	/* read key */
+	if (pos >= end - 2)
+		return end;
+	key = get_unaligned_le16(pos);
+	pos += 2;
+
+	/* read value length */
+	if (pos >= end - 1)
+		return end;
+	len = *pos++;
+
+	/* read value */
+	if (pos >= end - len)
+		return end;
+	switch (key) {
+	case 0x0200: { /* maximum number of pixels */
+		unsigned int sku_pixel_limit;
+
+		if (len < sizeof(__le32))
+			break;
+		sku_pixel_limit = get_unaligned_le32(pos);
+		if (sku_pixel_limit >= 16 * UDL_SKU_PIXEL_LIMIT_DEFAULT)
+			break; /* almost 100 MiB, so probably bogus */
+		udl->sku_pixel_limit = sku_pixel_limit;
+		break;
+	}
+	default:
+		break;
+	}
+	pos += len;
+
+	return pos;
+}
+
 static int udl_parse_vendor_descriptor(struct udl_device *udl)
 {
+	struct drm_device *dev = &udl->drm;
 	struct usb_device *udev = udl_to_usb_device(udl);
 	void *buf;
 	int ret;
@@ -50,8 +98,6 @@ static int udl_parse_vendor_descriptor(struct udl_device *udl)
 	desc = buf;
 	desc_end = desc + len;
 
-	DRM_INFO("vendor descriptor length: %u data:%11ph\n", len, desc);
-
 	if ((desc[0] != len) ||    /* descriptor length */
 	    (desc[1] != 0x5f) ||   /* vendor descriptor type */
 	    (desc[2] != 0x01) ||   /* version (2 bytes) */
@@ -60,35 +106,14 @@ static int udl_parse_vendor_descriptor(struct udl_device *udl)
 		goto unrecognized;
 	desc += 5;
 
-	while (desc < desc_end) {
-		u8 length;
-		u16 key;
-
-		key = le16_to_cpu(*((u16 *)desc));
-		desc += sizeof(u16);
-		length = *desc;
-		desc++;
-
-		switch (key) {
-		case 0x0200: { /* max_area */
-			u32 max_area = le32_to_cpu(*((u32 *)desc));
-
-			DRM_DEBUG("DL chip limited to %d pixel modes\n",
-				  max_area);
-			udl->sku_pixel_limit = max_area;
-			break;
-		}
-		default:
-			break;
-		}
-		desc += length;
-	}
+	while (desc < desc_end)
+		desc = udl_parse_key_value_pair(udl, desc, desc_end);
 
 	goto success;
 
 unrecognized:
 	/* allow udlfb to load for now even if firmware unrecognized */
-	DRM_ERROR("Unrecognized vendor firmware descriptor\n");
+	drm_warn(dev, "Unrecognized vendor firmware descriptor\n");
 
 success:
 	kfree(buf);
-- 
2.51.0


From fb10144ba426b88080c6abcede5f1332bebc3c60 Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tzimmermann@suse.de>
Date: Thu, 10 Apr 2025 12:59:06 +0200
Subject: [PATCH 14/16] drm/udl: Support adapters without firmware descriptor

Set default limit on the number of pixels for adapters without
vendor firmware descriptor. The devices work as expected, they
just don't provide any description.

If parsing the vendor firmware descriptor fails, the device falls
back to the given default limits. Failing to allocate memory is
still an error.

v2:
- fix typo in constant (Patrik)

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
Link: https://lore.kernel.org/r/20250410105948.25463-10-tzimmermann@suse.de
---
 drivers/gpu/drm/udl/udl_main.c | 37 +++++++++++++++++++---------------
 1 file changed, 21 insertions(+), 16 deletions(-)

diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
index b5a6b254a202..3dfeb88cf918 100644
--- a/drivers/gpu/drm/udl/udl_main.c
+++ b/drivers/gpu/drm/udl/udl_main.c
@@ -76,6 +76,7 @@ static int udl_parse_vendor_descriptor(struct udl_device *udl)
 {
 	struct drm_device *dev = &udl->drm;
 	struct usb_device *udev = udl_to_usb_device(udl);
+	bool detected = false;
 	void *buf;
 	int ret;
 	unsigned int len;
@@ -84,16 +85,16 @@ static int udl_parse_vendor_descriptor(struct udl_device *udl)
 
 	buf = kzalloc(MAX_VENDOR_DESCRIPTOR_SIZE, GFP_KERNEL);
 	if (!buf)
-		return false;
+		return -ENOMEM;
 
 	ret = usb_get_descriptor(udev, 0x5f, /* vendor specific */
 				 0, buf, MAX_VENDOR_DESCRIPTOR_SIZE);
 	if (ret < 0)
-		goto unrecognized;
+		goto out;
 	len = ret;
 
 	if (len < 5)
-		goto unrecognized;
+		goto out;
 
 	desc = buf;
 	desc_end = desc + len;
@@ -103,21 +104,20 @@ static int udl_parse_vendor_descriptor(struct udl_device *udl)
 	    (desc[2] != 0x01) ||   /* version (2 bytes) */
 	    (desc[3] != 0x00) ||
 	    (desc[4] != len - 2))  /* length after type */
-		goto unrecognized;
+		goto out;
 	desc += 5;
 
+	detected = true;
+
 	while (desc < desc_end)
 		desc = udl_parse_key_value_pair(udl, desc, desc_end);
 
-	goto success;
-
-unrecognized:
-	/* allow udlfb to load for now even if firmware unrecognized */
-	drm_warn(dev, "Unrecognized vendor firmware descriptor\n");
-
-success:
+out:
+	if (!detected)
+		drm_warn(dev, "Unrecognized vendor firmware descriptor\n");
 	kfree(buf);
-	return true;
+
+	return 0;
 }
 
 /*
@@ -345,11 +345,16 @@ int udl_init(struct udl_device *udl)
 		drm_warn(dev, "buffer sharing not supported"); /* not an error */
 	}
 
-	if (!udl_parse_vendor_descriptor(udl)) {
-		ret = -ENODEV;
-		DRM_ERROR("firmware not recognized. Assume incompatible device\n");
+	/*
+	 * Not all devices provide vendor descriptors with device
+	 * information. Initialize to default values of real-world
+	 * devices. It is just enough memory for FullHD.
+	 */
+	udl->sku_pixel_limit = UDL_SKU_PIXEL_LIMIT_DEFAULT;
+
+	ret = udl_parse_vendor_descriptor(udl);
+	if (ret)
 		goto err;
-	}
 
 	if (udl_select_std_channel(udl))
 		DRM_ERROR("Selecting channel failed\n");
-- 
2.51.0


From 970003de19a9cf7caa68a136b3bfa7334c8e7132 Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tzimmermann@suse.de>
Date: Mon, 17 Mar 2025 14:06:40 +0100
Subject: [PATCH 15/16] drm/etnaviv: Test for imported buffers with
 drm_gem_is_imported()

Instead of testing import_attach for imported GEM buffers, invoke
drm_gem_is_imported() to do the test. The helper tests the dma_buf
itself while import_attach is just an artifact of the import. Prepares
to make import_attach optional.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Lucas Stach <l.stach@pengutronix.de>
Cc: Russell King <linux+etnaviv@armlinux.org.uk>
Cc: Christian Gmeiner <christian.gmeiner@gmail.com>
Cc: etnaviv@lists.freedesktop.org
Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
Link: https://lore.kernel.org/r/20250317131923.238374-3-tzimmermann@suse.de
---
 drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
index 42e57d142554..40a50c60dfff 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
@@ -39,7 +39,7 @@ int etnaviv_gem_prime_vmap(struct drm_gem_object *obj, struct iosys_map *map)
 
 int etnaviv_gem_prime_pin(struct drm_gem_object *obj)
 {
-	if (!obj->import_attach) {
+	if (!drm_gem_is_imported(obj)) {
 		struct etnaviv_gem_object *etnaviv_obj = to_etnaviv_bo(obj);
 
 		mutex_lock(&etnaviv_obj->lock);
@@ -51,7 +51,7 @@ int etnaviv_gem_prime_pin(struct drm_gem_object *obj)
 
 void etnaviv_gem_prime_unpin(struct drm_gem_object *obj)
 {
-	if (!obj->import_attach) {
+	if (!drm_gem_is_imported(obj)) {
 		struct etnaviv_gem_object *etnaviv_obj = to_etnaviv_bo(obj);
 
 		mutex_lock(&etnaviv_obj->lock);
-- 
2.51.0


From e91eb3ae415472b28211d7fed07fa283845b311e Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tzimmermann@suse.de>
Date: Mon, 17 Mar 2025 14:06:41 +0100
Subject: [PATCH 16/16] drm/etnaviv: Use dma_buf from GEM object instance

Avoid dereferencing struct drm_gem_object.import_attach for the
imported dma-buf. The dma_buf field in the GEM object instance refers
to the same buffer. Prepares to make import_attach optional.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Lucas Stach <l.stach@pengutronix.de>
Cc: Russell King <linux+etnaviv@armlinux.org.uk>
Cc: Christian Gmeiner <christian.gmeiner@gmail.com>
Cc: etnaviv@lists.freedesktop.org
Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
Link: https://lore.kernel.org/r/20250317131923.238374-4-tzimmermann@suse.de
---
 drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
index 40a50c60dfff..917ad527c961 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
@@ -65,7 +65,7 @@ static void etnaviv_gem_prime_release(struct etnaviv_gem_object *etnaviv_obj)
 	struct iosys_map map = IOSYS_MAP_INIT_VADDR(etnaviv_obj->vaddr);
 
 	if (etnaviv_obj->vaddr)
-		dma_buf_vunmap_unlocked(etnaviv_obj->base.import_attach->dmabuf, &map);
+		dma_buf_vunmap_unlocked(etnaviv_obj->base.dma_buf, &map);
 
 	/* Don't drop the pages for imported dmabuf, as they are not
 	 * ours, just free the array we allocated:
@@ -82,7 +82,7 @@ static void *etnaviv_gem_prime_vmap_impl(struct etnaviv_gem_object *etnaviv_obj)
 
 	lockdep_assert_held(&etnaviv_obj->lock);
 
-	ret = dma_buf_vmap(etnaviv_obj->base.import_attach->dmabuf, &map);
+	ret = dma_buf_vmap(etnaviv_obj->base.dma_buf, &map);
 	if (ret)
 		return NULL;
 	return map.vaddr;
-- 
2.51.0