From 45050ebc181d27911a0a642d118aeb7bc15553ed Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 31 Oct 2022 07:39:29 +0100 Subject: [PATCH] 5.15-stable patches added patches: coresight-cti-fix-hang-in-cti_disable_hw.patch drm-amdgpu-disallow-gfxoff-until-gc-ip-blocks-complete-s2idle-resume.patch drm-msm-dp-fix-irq-lifetime.patch drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch --- ...sight-cti-fix-hang-in-cti_disable_hw.patch | 129 ++++++++++++++++++ ...-gc-ip-blocks-complete-s2idle-resume.patch | 55 ++++++++ queue-5.15/drm-msm-dp-fix-irq-lifetime.patch | 49 +++++++ ...ory-corruption-with-too-many-bridges.patch | 42 ++++++ ...ory-corruption-with-too-many-bridges.patch | 41 ++++++ queue-5.15/series | 5 + 6 files changed, 321 insertions(+) create mode 100644 queue-5.15/coresight-cti-fix-hang-in-cti_disable_hw.patch create mode 100644 queue-5.15/drm-amdgpu-disallow-gfxoff-until-gc-ip-blocks-complete-s2idle-resume.patch create mode 100644 queue-5.15/drm-msm-dp-fix-irq-lifetime.patch create mode 100644 queue-5.15/drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch create mode 100644 queue-5.15/drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch diff --git a/queue-5.15/coresight-cti-fix-hang-in-cti_disable_hw.patch b/queue-5.15/coresight-cti-fix-hang-in-cti_disable_hw.patch new file mode 100644 index 00000000000..5dbe49ac4d3 --- /dev/null +++ b/queue-5.15/coresight-cti-fix-hang-in-cti_disable_hw.patch @@ -0,0 +1,129 @@ +From 6746eae4bbaddcc16b40efb33dab79210828b3ce Mon Sep 17 00:00:00 2001 +From: James Clark +Date: Tue, 25 Oct 2022 14:10:32 +0100 +Subject: coresight: cti: Fix hang in cti_disable_hw() + +From: James Clark + +commit 6746eae4bbaddcc16b40efb33dab79210828b3ce upstream. + +cti_enable_hw() and cti_disable_hw() are called from an atomic context +so shouldn't use runtime PM because it can result in a sleep when +communicating with firmware. + +Since commit 3c6656337852 ("Revert "firmware: arm_scmi: Add clock +management to the SCMI power domain""), this causes a hang on Juno when +running the Perf Coresight tests or running this command: + + perf record -e cs_etm//u -- ls + +This was also missed until the revert commit because pm_runtime_put() +was called with the wrong device until commit 692c9a499b28 ("coresight: +cti: Correct the parameter for pm_runtime_put") + +With lock and scheduler debugging enabled the following is output: + + coresight cti_sys0: cti_enable_hw -- dev:cti_sys0 parent: 20020000.cti + BUG: sleeping function called from invalid context at drivers/base/power/runtime.c:1151 + in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 330, name: perf-exec + preempt_count: 2, expected: 0 + RCU nest depth: 0, expected: 0 + INFO: lockdep is turned off. + irq event stamp: 0 + hardirqs last enabled at (0): [<0000000000000000>] 0x0 + hardirqs last disabled at (0): [] copy_process+0xa0c/0x1948 + softirqs last enabled at (0): [] copy_process+0xa0c/0x1948 + softirqs last disabled at (0): [<0000000000000000>] 0x0 + CPU: 3 PID: 330 Comm: perf-exec Not tainted 6.0.0-00053-g042116d99298 #7 + Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS EDK II Sep 13 2022 + Call trace: + dump_backtrace+0x134/0x140 + show_stack+0x20/0x58 + dump_stack_lvl+0x8c/0xb8 + dump_stack+0x18/0x34 + __might_resched+0x180/0x228 + __might_sleep+0x50/0x88 + __pm_runtime_resume+0xac/0xb0 + cti_enable+0x44/0x120 + coresight_control_assoc_ectdev+0xc0/0x150 + coresight_enable_path+0xb4/0x288 + etm_event_start+0x138/0x170 + etm_event_add+0x48/0x70 + event_sched_in.isra.122+0xb4/0x280 + merge_sched_in+0x1fc/0x3d0 + visit_groups_merge.constprop.137+0x16c/0x4b0 + ctx_sched_in+0x114/0x1f0 + perf_event_sched_in+0x60/0x90 + ctx_resched+0x68/0xb0 + perf_event_exec+0x138/0x508 + begin_new_exec+0x52c/0xd40 + load_elf_binary+0x6b8/0x17d0 + bprm_execve+0x360/0x7f8 + do_execveat_common.isra.47+0x218/0x238 + __arm64_sys_execve+0x48/0x60 + invoke_syscall+0x4c/0x110 + el0_svc_common.constprop.4+0xfc/0x120 + do_el0_svc+0x34/0xc0 + el0_svc+0x40/0x98 + el0t_64_sync_handler+0x98/0xc0 + el0t_64_sync+0x170/0x174 + +Fix the issue by removing the runtime PM calls completely. They are not +needed here because it must have already been done when building the +path for a trace. + +Fixes: 835d722ba10a ("coresight: cti: Initial CoreSight CTI Driver") +Cc: stable +Reported-by: Aishwarya TCV +Reported-by: Cristian Marussi +Suggested-by: Suzuki K Poulose +Signed-off-by: James Clark +Reviewed-by: Mike Leach +Tested-by: Mike Leach +[ Fix build warnings ] +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20221025131032.1149459-1-suzuki.poulose@arm.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwtracing/coresight/coresight-cti-core.c | 5 ----- + 1 file changed, 5 deletions(-) + +--- a/drivers/hwtracing/coresight/coresight-cti-core.c ++++ b/drivers/hwtracing/coresight/coresight-cti-core.c +@@ -90,11 +90,9 @@ void cti_write_all_hw_regs(struct cti_dr + static int cti_enable_hw(struct cti_drvdata *drvdata) + { + struct cti_config *config = &drvdata->config; +- struct device *dev = &drvdata->csdev->dev; + unsigned long flags; + int rc = 0; + +- pm_runtime_get_sync(dev->parent); + spin_lock_irqsave(&drvdata->spinlock, flags); + + /* no need to do anything if enabled or unpowered*/ +@@ -119,7 +117,6 @@ cti_state_unchanged: + /* cannot enable due to error */ + cti_err_not_enabled: + spin_unlock_irqrestore(&drvdata->spinlock, flags); +- pm_runtime_put(dev->parent); + return rc; + } + +@@ -153,7 +150,6 @@ cti_hp_not_enabled: + static int cti_disable_hw(struct cti_drvdata *drvdata) + { + struct cti_config *config = &drvdata->config; +- struct device *dev = &drvdata->csdev->dev; + struct coresight_device *csdev = drvdata->csdev; + + spin_lock(&drvdata->spinlock); +@@ -175,7 +171,6 @@ static int cti_disable_hw(struct cti_drv + coresight_disclaim_device_unlocked(csdev); + CS_LOCK(drvdata->base); + spin_unlock(&drvdata->spinlock); +- pm_runtime_put(dev->parent); + return 0; + + /* not disabled this call */ diff --git a/queue-5.15/drm-amdgpu-disallow-gfxoff-until-gc-ip-blocks-complete-s2idle-resume.patch b/queue-5.15/drm-amdgpu-disallow-gfxoff-until-gc-ip-blocks-complete-s2idle-resume.patch new file mode 100644 index 00000000000..cdd384e4451 --- /dev/null +++ b/queue-5.15/drm-amdgpu-disallow-gfxoff-until-gc-ip-blocks-complete-s2idle-resume.patch @@ -0,0 +1,55 @@ +From d61e1d1d5225a9baeb995bcbdb904f66f70ed87e Mon Sep 17 00:00:00 2001 +From: Prike Liang +Date: Fri, 21 Oct 2022 10:04:40 +0800 +Subject: drm/amdgpu: disallow gfxoff until GC IP blocks complete s2idle resume + +From: Prike Liang + +commit d61e1d1d5225a9baeb995bcbdb904f66f70ed87e upstream. + +In the S2idle suspend/resume phase the gfxoff is keeping functional so +some IP blocks will be likely to reinitialize at gfxoff entry and that +will result in failing to program GC registers.Therefore, let disallow +gfxoff until AMDGPU IPs reinitialized completely. + +Signed-off-by: Prike Liang +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 5.15.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -3185,6 +3185,15 @@ static int amdgpu_device_ip_resume_phase + return r; + } + adev->ip_blocks[i].status.hw = true; ++ ++ if (adev->in_s0ix && adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_SMC) { ++ /* disable gfxoff for IP resume. The gfxoff will be re-enabled in ++ * amdgpu_device_resume() after IP resume. ++ */ ++ amdgpu_gfx_off_ctrl(adev, false); ++ DRM_DEBUG("will disable gfxoff for re-initializing other blocks\n"); ++ } ++ + } + + return 0; +@@ -4114,6 +4123,13 @@ int amdgpu_device_resume(struct drm_devi + /* Make sure IB tests flushed */ + flush_delayed_work(&adev->delayed_init_work); + ++ if (adev->in_s0ix) { ++ /* re-enable gfxoff after IP resume. This re-enables gfxoff after ++ * it was disabled for IP resume in amdgpu_device_ip_resume_phase2(). ++ */ ++ amdgpu_gfx_off_ctrl(adev, true); ++ DRM_DEBUG("will enable gfxoff for the mission mode\n"); ++ } + if (fbcon) + amdgpu_fbdev_set_suspend(adev, 0); + diff --git a/queue-5.15/drm-msm-dp-fix-irq-lifetime.patch b/queue-5.15/drm-msm-dp-fix-irq-lifetime.patch new file mode 100644 index 00000000000..81882011996 --- /dev/null +++ b/queue-5.15/drm-msm-dp-fix-irq-lifetime.patch @@ -0,0 +1,49 @@ +From a79343dcaba4b11adb57350e0b6426906a9b658e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 13 Sep 2022 10:53:15 +0200 +Subject: drm/msm/dp: fix IRQ lifetime + +From: Johan Hovold + +commit a79343dcaba4b11adb57350e0b6426906a9b658e upstream. + +Device-managed resources allocated post component bind must be tied to +the lifetime of the aggregate DRM device or they will not necessarily be +released when binding of the aggregate device is deferred. + +This is specifically true for the DP IRQ, which will otherwise remain +requested so that the next bind attempt fails when requesting the IRQ a +second time. + +Since commit c3bf8e21b38a ("drm/msm/dp: Add eDP support via aux_bus") +this can happen when the aux-bus panel driver has not yet been loaded so +that probe is deferred. + +Fix this by tying the device-managed lifetime of the DP IRQ to the DRM +device so that it is released when bind fails. + +Fixes: c943b4948b58 ("drm/msm/dp: add displayPort driver support") +Cc: stable@vger.kernel.org # 5.10 +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Johan Hovold +Tested-by: Kuogee Hsieh +Reviewed-by: Kuogee Hsieh +Patchwork: https://patchwork.freedesktop.org/patch/502679/ +Link: https://lore.kernel.org/r/20220913085320.8577-6-johan+linaro@kernel.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/dp/dp_display.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/msm/dp/dp_display.c ++++ b/drivers/gpu/drm/msm/dp/dp_display.c +@@ -1229,7 +1229,7 @@ int dp_display_request_irq(struct msm_dp + return -EINVAL; + } + +- rc = devm_request_irq(&dp->pdev->dev, dp->irq, ++ rc = devm_request_irq(dp_display->drm_dev->dev, dp->irq, + dp_display_irq_handler, + IRQF_TRIGGER_HIGH, "dp_display_isr", dp); + if (rc < 0) { diff --git a/queue-5.15/drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch b/queue-5.15/drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch new file mode 100644 index 00000000000..31f3462aa0d --- /dev/null +++ b/queue-5.15/drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch @@ -0,0 +1,42 @@ +From 2e786eb2f9cebb07e317226b60054df510b60c65 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 13 Sep 2022 10:53:13 +0200 +Subject: drm/msm/dsi: fix memory corruption with too many bridges + +From: Johan Hovold + +commit 2e786eb2f9cebb07e317226b60054df510b60c65 upstream. + +Add the missing sanity check on the bridge counter to avoid corrupting +data beyond the fixed-sized bridge array in case there are ever more +than eight bridges. + +Fixes: a689554ba6ed ("drm/msm: Initial add DSI connector support") +Cc: stable@vger.kernel.org # 4.1 +Signed-off-by: Johan Hovold +Tested-by: Kuogee Hsieh +Reviewed-by: Kuogee Hsieh +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/502668/ +Link: https://lore.kernel.org/r/20220913085320.8577-4-johan+linaro@kernel.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/dsi/dsi.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/gpu/drm/msm/dsi/dsi.c ++++ b/drivers/gpu/drm/msm/dsi/dsi.c +@@ -212,6 +212,12 @@ int msm_dsi_modeset_init(struct msm_dsi + return -EINVAL; + + priv = dev->dev_private; ++ ++ if (priv->num_bridges == ARRAY_SIZE(priv->bridges)) { ++ DRM_DEV_ERROR(dev->dev, "too many bridges\n"); ++ return -ENOSPC; ++ } ++ + msm_dsi->dev = dev; + + ret = msm_dsi_host_modeset_init(msm_dsi->host, dev); diff --git a/queue-5.15/drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch b/queue-5.15/drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch new file mode 100644 index 00000000000..b29435ba09f --- /dev/null +++ b/queue-5.15/drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch @@ -0,0 +1,41 @@ +From 4c1294da6aed1f16d47a417dcfe6602833c3c95c Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 13 Sep 2022 10:53:14 +0200 +Subject: drm/msm/hdmi: fix memory corruption with too many bridges + +From: Johan Hovold + +commit 4c1294da6aed1f16d47a417dcfe6602833c3c95c upstream. + +Add the missing sanity check on the bridge counter to avoid corrupting +data beyond the fixed-sized bridge array in case there are ever more +than eight bridges. + +Fixes: a3376e3ec81c ("drm/msm: convert to drm_bridge") +Cc: stable@vger.kernel.org # 3.12 +Signed-off-by: Johan Hovold +Tested-by: Kuogee Hsieh +Reviewed-by: Kuogee Hsieh +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/502670/ +Link: https://lore.kernel.org/r/20220913085320.8577-5-johan+linaro@kernel.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/hdmi/hdmi.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/gpu/drm/msm/hdmi/hdmi.c ++++ b/drivers/gpu/drm/msm/hdmi/hdmi.c +@@ -295,6 +295,11 @@ int msm_hdmi_modeset_init(struct hdmi *h + struct platform_device *pdev = hdmi->pdev; + int ret; + ++ if (priv->num_bridges == ARRAY_SIZE(priv->bridges)) { ++ DRM_DEV_ERROR(dev->dev, "too many bridges\n"); ++ return -ENOSPC; ++ } ++ + hdmi->dev = dev; + hdmi->encoder = encoder; + diff --git a/queue-5.15/series b/queue-5.15/series index 8126811cf8d..8eb4bd0c485 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -28,3 +28,8 @@ fs-binfmt_elf-fix-memory-leak-in-load_elf_binary.patch exec-copy-oldsighand-action-under-spin-lock.patch mac802154-fix-lqi-recording.patch scsi-qla2xxx-use-transport-defined-speed-mask-for-supported_speeds.patch +drm-amdgpu-disallow-gfxoff-until-gc-ip-blocks-complete-s2idle-resume.patch +drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch +drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch +drm-msm-dp-fix-irq-lifetime.patch +coresight-cti-fix-hang-in-cti_disable_hw.patch -- 2.47.3