From: Sasha Levin Date: Sun, 31 Mar 2024 13:26:24 +0000 (-0400) Subject: Fixes for 6.6 X-Git-Tag: v6.7.12~88 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a5b10757f3cb04062459ce2ff7389c32148e936e;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.6 Signed-off-by: Sasha Levin --- diff --git a/queue-6.6/drm-amd-display-clear-optc-mem-select-on-disable.patch b/queue-6.6/drm-amd-display-clear-optc-mem-select-on-disable.patch new file mode 100644 index 00000000000..ce5f036aeb1 --- /dev/null +++ b/queue-6.6/drm-amd-display-clear-optc-mem-select-on-disable.patch @@ -0,0 +1,47 @@ +From 0654ff5cd71595e0ec52ed2cc598cb6e8d2d502a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jan 2024 09:42:04 -0500 +Subject: drm/amd/display: Clear OPTC mem select on disable + +From: Ilya Bakoulin + +[ Upstream commit b4e05bb1dec53fe28c3c88425aded824498666e5 ] + +[Why] +Not clearing the memory select bits prior to OPTC disable can cause DSC +corruption issues when attempting to reuse a memory instance for another +OPTC that enables ODM. + +[How] +Clear the memory select bits prior to disabling an OPTC. + +Cc: Mario Limonciello +Cc: Alex Deucher +Cc: stable@vger.kernel.org +Reviewed-by: Charlene Liu +Acked-by: Alex Hung +Signed-off-by: Ilya Bakoulin +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c +index 93592e8051fb7..e817fa4efeee5 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c +@@ -149,6 +149,9 @@ static bool optc32_disable_crtc(struct timing_generator *optc) + OPTC_SEG3_SRC_SEL, 0xf, + OPTC_NUM_OF_INPUT_SEGMENT, 0); + ++ REG_UPDATE(OPTC_MEMORY_CONFIG, ++ OPTC_MEM_SEL, 0); ++ + /* disable otg request until end of the first line + * in the vertical blank region + */ +-- +2.43.0 + diff --git a/queue-6.6/drm-amd-display-disconnect-phantom-pipe-opp-from-opt.patch b/queue-6.6/drm-amd-display-disconnect-phantom-pipe-opp-from-opt.patch new file mode 100644 index 00000000000..dd0f96b27cc --- /dev/null +++ b/queue-6.6/drm-amd-display-disconnect-phantom-pipe-opp-from-opt.patch @@ -0,0 +1,78 @@ +From 2ddbb2385a5361e0496195ed8fcbf5149c557aed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Dec 2023 17:17:57 -0500 +Subject: drm/amd/display: Disconnect phantom pipe OPP from OPTC being disabled + +From: George Shen + +[ Upstream commit 7bdbfb4e36e34eb788e44f27666bf0a2b3b90803 ] + +[Why] +If an OPP is used for a different OPTC without first being disconnected +from the previous OPTC, unexpected behaviour can occur. This also +applies to phantom pipes, which is what the current logic missed. + +[How] +Disconnect OPPs from OPTC for phantom pipes before disabling OTG master. + +Also move the disconnection to before the OTG master disable, since the +register is double buffered. + +Reviewed-by: Dillon Varone +Acked-by: Rodrigo Siqueira +Signed-off-by: George Shen +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Stable-dep-of: b4e05bb1dec5 ("drm/amd/display: Clear OPTC mem select on disable") +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/dc/dcn32/dcn32_optc.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c +index b1fcc91b65a32..93592e8051fb7 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c +@@ -142,12 +142,6 @@ static bool optc32_disable_crtc(struct timing_generator *optc) + { + struct optc *optc1 = DCN10TG_FROM_TG(optc); + +- /* disable otg request until end of the first line +- * in the vertical blank region +- */ +- REG_UPDATE(OTG_CONTROL, +- OTG_MASTER_EN, 0); +- + REG_UPDATE_5(OPTC_DATA_SOURCE_SELECT, + OPTC_SEG0_SRC_SEL, 0xf, + OPTC_SEG1_SRC_SEL, 0xf, +@@ -155,6 +149,12 @@ static bool optc32_disable_crtc(struct timing_generator *optc) + OPTC_SEG3_SRC_SEL, 0xf, + OPTC_NUM_OF_INPUT_SEGMENT, 0); + ++ /* disable otg request until end of the first line ++ * in the vertical blank region ++ */ ++ REG_UPDATE(OTG_CONTROL, ++ OTG_MASTER_EN, 0); ++ + REG_UPDATE(CONTROL, + VTG0_ENABLE, 0); + +@@ -181,6 +181,13 @@ static void optc32_disable_phantom_otg(struct timing_generator *optc) + { + struct optc *optc1 = DCN10TG_FROM_TG(optc); + ++ REG_UPDATE_5(OPTC_DATA_SOURCE_SELECT, ++ OPTC_SEG0_SRC_SEL, 0xf, ++ OPTC_SEG1_SRC_SEL, 0xf, ++ OPTC_SEG2_SRC_SEL, 0xf, ++ OPTC_SEG3_SRC_SEL, 0xf, ++ OPTC_NUM_OF_INPUT_SEGMENT, 0); ++ + REG_UPDATE(OTG_CONTROL, OTG_MASTER_EN, 0); + } + +-- +2.43.0 + diff --git a/queue-6.6/drm-amd-display-fix-hang-underflow-when-transitionin.patch b/queue-6.6/drm-amd-display-fix-hang-underflow-when-transitionin.patch new file mode 100644 index 00000000000..ae35c20eb44 --- /dev/null +++ b/queue-6.6/drm-amd-display-fix-hang-underflow-when-transitionin.patch @@ -0,0 +1,49 @@ +From 002f47c181d83ed09fc8069f732791bbf632315d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Dec 2023 12:19:33 -0500 +Subject: drm/amd/display: Fix hang/underflow when transitioning to ODM4:1 + +From: Ilya Bakoulin + +[ Upstream commit e7b2b108cdeab76a7e7324459e50b0c1214c0386 ] + +[Why] +Under some circumstances, disabling an OPTC and attempting to reclaim +its OPP(s) for a different OPTC could cause a hang/underflow due to OPPs +not being properly disconnected from the disabled OPTC. + +[How] +Ensure that all OPPs are unassigned from an OPTC when it gets disabled. + +Reviewed-by: Alvin Lee +Acked-by: Wayne Lin +Signed-off-by: Ilya Bakoulin +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Stable-dep-of: b4e05bb1dec5 ("drm/amd/display: Clear OPTC mem select on disable") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c +index 8abb94f60078f..b1fcc91b65a32 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c +@@ -148,6 +148,13 @@ static bool optc32_disable_crtc(struct timing_generator *optc) + REG_UPDATE(OTG_CONTROL, + OTG_MASTER_EN, 0); + ++ REG_UPDATE_5(OPTC_DATA_SOURCE_SELECT, ++ OPTC_SEG0_SRC_SEL, 0xf, ++ OPTC_SEG1_SRC_SEL, 0xf, ++ OPTC_SEG2_SRC_SEL, 0xf, ++ OPTC_SEG3_SRC_SEL, 0xf, ++ OPTC_NUM_OF_INPUT_SEGMENT, 0); ++ + REG_UPDATE(CONTROL, + VTG0_ENABLE, 0); + +-- +2.43.0 + diff --git a/queue-6.6/series b/queue-6.6/series index 5fc9682933e..8af5f91dd28 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -349,3 +349,7 @@ mtd-spinand-add-support-for-5-byte-ids.patch revert-usb-phy-generic-get-the-vbus-supply.patch usb-cdc-wdm-close-race-between-read-and-workqueue.patch usb-uas-return-enodev-when-submit-urbs-fail-with-device-not-attached.patch +drm-amd-display-fix-hang-underflow-when-transitionin.patch +drm-amd-display-disconnect-phantom-pipe-opp-from-opt.patch +drm-amd-display-clear-optc-mem-select-on-disable.patch +vfio-pds-make-sure-migration-file-isn-t-accessed-aft.patch diff --git a/queue-6.6/vfio-pds-make-sure-migration-file-isn-t-accessed-aft.patch b/queue-6.6/vfio-pds-make-sure-migration-file-isn-t-accessed-aft.patch new file mode 100644 index 00000000000..42c4d798e98 --- /dev/null +++ b/queue-6.6/vfio-pds-make-sure-migration-file-isn-t-accessed-aft.patch @@ -0,0 +1,110 @@ +From 94b8c8e37d823d33f967f155265c868ab913137a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 10:21:48 -0800 +Subject: vfio/pds: Make sure migration file isn't accessed after reset + +From: Brett Creeley + +[ Upstream commit 457f7308254756b6e4b8fc3876cb770dcf0e7cc7 ] + +It's possible the migration file is accessed after reset when it has +been cleaned up, especially when it's initiated by the device. This is +because the driver doesn't rip out the filep when cleaning up it only +frees the related page structures and sets its local struct +pds_vfio_lm_file pointer to NULL. This can cause a NULL pointer +dereference, which is shown in the example below during a restore after +a device initiated reset: + +BUG: kernel NULL pointer dereference, address: 000000000000000c +PF: supervisor read access in kernel mode +PF: error_code(0x0000) - not-present page +PGD 0 P4D 0 +Oops: 0000 [#1] PREEMPT SMP NOPTI +RIP: 0010:pds_vfio_get_file_page+0x5d/0xf0 [pds_vfio_pci] +[...] +Call Trace: + + pds_vfio_restore_write+0xf6/0x160 [pds_vfio_pci] + vfs_write+0xc9/0x3f0 + ? __fget_light+0xc9/0x110 + ksys_write+0xb5/0xf0 + __x64_sys_write+0x1a/0x20 + do_syscall_64+0x38/0x90 + entry_SYSCALL_64_after_hwframe+0x63/0xcd +[...] + +Add a disabled flag to the driver's struct pds_vfio_lm_file that gets +set during cleanup. Then make sure to check the flag when the migration +file is accessed via its file_operations. By default this flag will be +false as the memory for struct pds_vfio_lm_file is kzalloc'd, which means +the struct pds_vfio_lm_file is enabled and accessible. Also, since the +file_operations and driver's migration file cleanup happen under the +protection of the same pds_vfio_lm_file.lock, using this flag is thread +safe. + +Fixes: 8512ed256334 ("vfio/pds: Always clear the save/restore FDs on reset") +Reviewed-by: Shannon Nelson +Signed-off-by: Brett Creeley +Link: https://lore.kernel.org/r/20240308182149.22036-2-brett.creeley@amd.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/pds/lm.c | 13 +++++++++++++ + drivers/vfio/pci/pds/lm.h | 1 + + 2 files changed, 14 insertions(+) + +diff --git a/drivers/vfio/pci/pds/lm.c b/drivers/vfio/pci/pds/lm.c +index 79fe2e66bb498..6b94cc0bf45b4 100644 +--- a/drivers/vfio/pci/pds/lm.c ++++ b/drivers/vfio/pci/pds/lm.c +@@ -92,8 +92,10 @@ static void pds_vfio_put_lm_file(struct pds_vfio_lm_file *lm_file) + { + mutex_lock(&lm_file->lock); + ++ lm_file->disabled = true; + lm_file->size = 0; + lm_file->alloc_size = 0; ++ lm_file->filep->f_pos = 0; + + /* Free scatter list of file pages */ + sg_free_table(&lm_file->sg_table); +@@ -183,6 +185,12 @@ static ssize_t pds_vfio_save_read(struct file *filp, char __user *buf, + pos = &filp->f_pos; + + mutex_lock(&lm_file->lock); ++ ++ if (lm_file->disabled) { ++ done = -ENODEV; ++ goto out_unlock; ++ } ++ + if (*pos > lm_file->size) { + done = -EINVAL; + goto out_unlock; +@@ -283,6 +291,11 @@ static ssize_t pds_vfio_restore_write(struct file *filp, const char __user *buf, + + mutex_lock(&lm_file->lock); + ++ if (lm_file->disabled) { ++ done = -ENODEV; ++ goto out_unlock; ++ } ++ + while (len) { + size_t page_offset; + struct page *page; +diff --git a/drivers/vfio/pci/pds/lm.h b/drivers/vfio/pci/pds/lm.h +index 13be893198b74..9511b1afc6a11 100644 +--- a/drivers/vfio/pci/pds/lm.h ++++ b/drivers/vfio/pci/pds/lm.h +@@ -27,6 +27,7 @@ struct pds_vfio_lm_file { + struct scatterlist *last_offset_sg; /* Iterator */ + unsigned int sg_last_entry; + unsigned long last_offset; ++ bool disabled; + }; + + struct pds_vfio_pci_device; +-- +2.43.0 +