From d2df9b28629ff097a38e2a43848ddc70fe2a267d Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 21 Aug 2023 13:50:45 +0200 Subject: [PATCH] 6.4-stable patches added patches: drm-amd-flush-any-delayed-gfxoff-on-suspend-entry.patch drm-amdgpu-pm-fix-throttle_status-for-other-than-mp1-11.0.7.patch drm-amdgpu-skip-fence-gfx-interrupts-disable-enable-for-s0ix.patch drm-i915-sdvo-fix-panel_type-initialization.patch drm-qxl-fix-uaf-on-handle-creation.patch mmc-sunplus-fix-error-handling-in-spmmc_drv_probe.patch mmc-sunplus-fix-return-value-check-of-mmc_add_host.patch revert-drm-edid-fix-csync-detailed-mode-parsing.patch revert-revert-drm-amdgpu-display-change-pipe-policy-for-dcn-2.0.patch --- ...-any-delayed-gfxoff-on-suspend-entry.patch | 66 ++++ ...tle_status-for-other-than-mp1-11.0.7.patch | 68 ++++ ...x-interrupts-disable-enable-for-s0ix.patch | 95 +++++ ...5-sdvo-fix-panel_type-initialization.patch | 47 +++ .../drm-qxl-fix-uaf-on-handle-creation.patch | 352 ++++++++++++++++++ ...ix-error-handling-in-spmmc_drv_probe.patch | 71 ++++ ...x-return-value-check-of-mmc_add_host.patch | 73 ++++ ...edid-fix-csync-detailed-mode-parsing.patch | 109 ++++++ ...splay-change-pipe-policy-for-dcn-2.0.patch | 41 ++ queue-6.4/series | 9 + 10 files changed, 931 insertions(+) create mode 100644 queue-6.4/drm-amd-flush-any-delayed-gfxoff-on-suspend-entry.patch create mode 100644 queue-6.4/drm-amdgpu-pm-fix-throttle_status-for-other-than-mp1-11.0.7.patch create mode 100644 queue-6.4/drm-amdgpu-skip-fence-gfx-interrupts-disable-enable-for-s0ix.patch create mode 100644 queue-6.4/drm-i915-sdvo-fix-panel_type-initialization.patch create mode 100644 queue-6.4/drm-qxl-fix-uaf-on-handle-creation.patch create mode 100644 queue-6.4/mmc-sunplus-fix-error-handling-in-spmmc_drv_probe.patch create mode 100644 queue-6.4/mmc-sunplus-fix-return-value-check-of-mmc_add_host.patch create mode 100644 queue-6.4/revert-drm-edid-fix-csync-detailed-mode-parsing.patch create mode 100644 queue-6.4/revert-revert-drm-amdgpu-display-change-pipe-policy-for-dcn-2.0.patch diff --git a/queue-6.4/drm-amd-flush-any-delayed-gfxoff-on-suspend-entry.patch b/queue-6.4/drm-amd-flush-any-delayed-gfxoff-on-suspend-entry.patch new file mode 100644 index 00000000000..3154f0ee27f --- /dev/null +++ b/queue-6.4/drm-amd-flush-any-delayed-gfxoff-on-suspend-entry.patch @@ -0,0 +1,66 @@ +From a7b7d9e8aee4f71b4c7151702fd74237b8cef989 Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Thu, 18 May 2023 11:52:51 -0500 +Subject: drm/amd: flush any delayed gfxoff on suspend entry + +From: Mario Limonciello + +commit a7b7d9e8aee4f71b4c7151702fd74237b8cef989 upstream. + +DCN 3.1.4 is reported to hang on s2idle entry if graphics activity +is happening during entry. This is because GFXOFF was scheduled as +delayed but RLC gets disabled in s2idle entry sequence which will +hang GFX IP if not already in GFXOFF. + +To help this problem, flush any delayed work for GFXOFF early in +s2idle entry sequence to ensure that it's off when RLC is changed. + +commit 4b31b92b143f ("drm/amdgpu: complete gfxoff allow signal during +suspend without delay") modified power gating flow so that if called +in s0ix that it ensured that GFXOFF wasn't put in work queue but +instead processed immediately. + +This is dead code due to commit 10cb67eb8a1b ("drm/amdgpu: skip +CG/PG for gfx during S0ix") because GFXOFF will now not be explicitly +called as part of the suspend entry code. Remove that dead code. + +Signed-off-by: Mario Limonciello +Signed-off-by: Tim Huang +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 1 + + drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 9 +-------- + 2 files changed, 2 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -4250,6 +4250,7 @@ int amdgpu_device_suspend(struct drm_dev + drm_fb_helper_set_suspend_unlocked(adev_to_drm(adev)->fb_helper, true); + + cancel_delayed_work_sync(&adev->delayed_init_work); ++ flush_delayed_work(&adev->gfx.gfx_off_delay_work); + + amdgpu_ras_suspend(adev); + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +@@ -589,15 +589,8 @@ void amdgpu_gfx_off_ctrl(struct amdgpu_d + + if (adev->gfx.gfx_off_req_count == 0 && + !adev->gfx.gfx_off_state) { +- /* If going to s2idle, no need to wait */ +- if (adev->in_s0ix) { +- if (!amdgpu_dpm_set_powergating_by_smu(adev, +- AMD_IP_BLOCK_TYPE_GFX, true)) +- adev->gfx.gfx_off_state = true; +- } else { +- schedule_delayed_work(&adev->gfx.gfx_off_delay_work, ++ schedule_delayed_work(&adev->gfx.gfx_off_delay_work, + delay); +- } + } + } else { + if (adev->gfx.gfx_off_req_count == 0) { diff --git a/queue-6.4/drm-amdgpu-pm-fix-throttle_status-for-other-than-mp1-11.0.7.patch b/queue-6.4/drm-amdgpu-pm-fix-throttle_status-for-other-than-mp1-11.0.7.patch new file mode 100644 index 00000000000..c76bbc48b9c --- /dev/null +++ b/queue-6.4/drm-amdgpu-pm-fix-throttle_status-for-other-than-mp1-11.0.7.patch @@ -0,0 +1,68 @@ +From 6a92761a86817ad15c9a562e2a809386237fae3e Mon Sep 17 00:00:00 2001 +From: Umio Yasuno +Date: Tue, 8 Aug 2023 06:40:42 +0000 +Subject: drm/amdgpu/pm: fix throttle_status for other than MP1 11.0.7 + +From: Umio Yasuno + +commit 6a92761a86817ad15c9a562e2a809386237fae3e upstream. + +Use the right metrics table version based on the firmware. + +Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2720 +Reviewed-by: Evan Quan +Signed-off-by: Umio Yasuno +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c +@@ -588,7 +588,9 @@ err0_out: + return -ENOMEM; + } + +-static uint32_t sienna_cichlid_get_throttler_status_locked(struct smu_context *smu) ++static uint32_t sienna_cichlid_get_throttler_status_locked(struct smu_context *smu, ++ bool use_metrics_v3, ++ bool use_metrics_v2) + { + struct smu_table_context *smu_table= &smu->smu_table; + SmuMetricsExternal_t *metrics_ext = +@@ -596,13 +598,11 @@ static uint32_t sienna_cichlid_get_throt + uint32_t throttler_status = 0; + int i; + +- if ((smu->adev->ip_versions[MP1_HWIP][0] == IP_VERSION(11, 0, 7)) && +- (smu->smc_fw_version >= 0x3A4900)) { ++ if (use_metrics_v3) { + for (i = 0; i < THROTTLER_COUNT; i++) + throttler_status |= + (metrics_ext->SmuMetrics_V3.ThrottlingPercentage[i] ? 1U << i : 0); +- } else if ((smu->adev->ip_versions[MP1_HWIP][0] == IP_VERSION(11, 0, 7)) && +- (smu->smc_fw_version >= 0x3A4300)) { ++ } else if (use_metrics_v2) { + for (i = 0; i < THROTTLER_COUNT; i++) + throttler_status |= + (metrics_ext->SmuMetrics_V2.ThrottlingPercentage[i] ? 1U << i : 0); +@@ -864,7 +864,7 @@ static int sienna_cichlid_get_smu_metric + metrics->TemperatureVrSoc) * SMU_TEMPERATURE_UNITS_PER_CENTIGRADES; + break; + case METRICS_THROTTLER_STATUS: +- *value = sienna_cichlid_get_throttler_status_locked(smu); ++ *value = sienna_cichlid_get_throttler_status_locked(smu, use_metrics_v3, use_metrics_v2); + break; + case METRICS_CURR_FANSPEED: + *value = use_metrics_v3 ? metrics_v3->CurrFanSpeed : +@@ -4017,7 +4017,7 @@ static ssize_t sienna_cichlid_get_gpu_me + gpu_metrics->current_dclk1 = use_metrics_v3 ? metrics_v3->CurrClock[PPCLK_DCLK_1] : + use_metrics_v2 ? metrics_v2->CurrClock[PPCLK_DCLK_1] : metrics->CurrClock[PPCLK_DCLK_1]; + +- gpu_metrics->throttle_status = sienna_cichlid_get_throttler_status_locked(smu); ++ gpu_metrics->throttle_status = sienna_cichlid_get_throttler_status_locked(smu, use_metrics_v3, use_metrics_v2); + gpu_metrics->indep_throttle_status = + smu_cmn_get_indep_throttler_status(gpu_metrics->throttle_status, + sienna_cichlid_throttler_map); diff --git a/queue-6.4/drm-amdgpu-skip-fence-gfx-interrupts-disable-enable-for-s0ix.patch b/queue-6.4/drm-amdgpu-skip-fence-gfx-interrupts-disable-enable-for-s0ix.patch new file mode 100644 index 00000000000..ce51c0f073f --- /dev/null +++ b/queue-6.4/drm-amdgpu-skip-fence-gfx-interrupts-disable-enable-for-s0ix.patch @@ -0,0 +1,95 @@ +From f1740b1ab2703b2a057da7cf33b03297e0381aa0 Mon Sep 17 00:00:00 2001 +From: Tim Huang +Date: Mon, 14 Aug 2023 15:13:04 +0800 +Subject: drm/amdgpu: skip fence GFX interrupts disable/enable for S0ix + +From: Tim Huang + +commit f1740b1ab2703b2a057da7cf33b03297e0381aa0 upstream. + +GFX v11.0.1 reported fence fallback timer expired issue on +SDMA and GFX rings after S0ix resume. This is generated by +EOP interrupts are disabled when S0ix suspend but fails to +re-enable when resume because of the GFX is in GFXOFF. + +[ 203.349571] [drm] Fence fallback timer expired on ring sdma0 +[ 203.349572] [drm] Fence fallback timer expired on ring gfx_0.0.0 +[ 203.861635] [drm] Fence fallback timer expired on ring gfx_0.0.0 + +For S0ix, GFX is in GFXOFF state, avoid to touch the GFX registers +to configure the fence driver interrupts for rings that belong to GFX. +The interrupts configuration will be restored by GFXOFF exit. + +Signed-off-by: Tim Huang +Reviewed-by: Mario Limonciello +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 41 ++++++++++++++++++++++++++++-- + 1 file changed, 39 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c +@@ -556,6 +556,41 @@ int amdgpu_fence_driver_sw_init(struct a + } + + /** ++ * amdgpu_fence_need_ring_interrupt_restore - helper function to check whether ++ * fence driver interrupts need to be restored. ++ * ++ * @ring: ring that to be checked ++ * ++ * Interrupts for rings that belong to GFX IP don't need to be restored ++ * when the target power state is s0ix. ++ * ++ * Return true if need to restore interrupts, false otherwise. ++ */ ++static bool amdgpu_fence_need_ring_interrupt_restore(struct amdgpu_ring *ring) ++{ ++ struct amdgpu_device *adev = ring->adev; ++ bool is_gfx_power_domain = false; ++ ++ switch (ring->funcs->type) { ++ case AMDGPU_RING_TYPE_SDMA: ++ /* SDMA 5.x+ is part of GFX power domain so it's covered by GFXOFF */ ++ if (adev->ip_versions[SDMA0_HWIP][0] >= IP_VERSION(5, 0, 0)) ++ is_gfx_power_domain = true; ++ break; ++ case AMDGPU_RING_TYPE_GFX: ++ case AMDGPU_RING_TYPE_COMPUTE: ++ case AMDGPU_RING_TYPE_KIQ: ++ case AMDGPU_RING_TYPE_MES: ++ is_gfx_power_domain = true; ++ break; ++ default: ++ break; ++ } ++ ++ return !(adev->in_s0ix && is_gfx_power_domain); ++} ++ ++/** + * amdgpu_fence_driver_hw_fini - tear down the fence driver + * for all possible rings. + * +@@ -583,7 +618,8 @@ void amdgpu_fence_driver_hw_fini(struct + amdgpu_fence_driver_force_completion(ring); + + if (!drm_dev_is_unplugged(adev_to_drm(adev)) && +- ring->fence_drv.irq_src) ++ ring->fence_drv.irq_src && ++ amdgpu_fence_need_ring_interrupt_restore(ring)) + amdgpu_irq_put(adev, ring->fence_drv.irq_src, + ring->fence_drv.irq_type); + +@@ -658,7 +694,8 @@ void amdgpu_fence_driver_hw_init(struct + continue; + + /* enable the interrupt */ +- if (ring->fence_drv.irq_src) ++ if (ring->fence_drv.irq_src && ++ amdgpu_fence_need_ring_interrupt_restore(ring)) + amdgpu_irq_get(adev, ring->fence_drv.irq_src, + ring->fence_drv.irq_type); + } diff --git a/queue-6.4/drm-i915-sdvo-fix-panel_type-initialization.patch b/queue-6.4/drm-i915-sdvo-fix-panel_type-initialization.patch new file mode 100644 index 00000000000..c2d9299205e --- /dev/null +++ b/queue-6.4/drm-i915-sdvo-fix-panel_type-initialization.patch @@ -0,0 +1,47 @@ +From 2002eb6d3ea954dde9f8a223018d5335779937d0 Mon Sep 17 00:00:00 2001 +From: Jani Nikula +Date: Thu, 3 Aug 2023 15:27:06 +0300 +Subject: drm/i915/sdvo: fix panel_type initialization +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jani Nikula + +commit 2002eb6d3ea954dde9f8a223018d5335779937d0 upstream. + +Commit 3f9ffce5765d ("drm/i915: Do panel VBT init early if the VBT +declares an explicit panel type") started using -1 as the value for +unset panel_type. It gets initialized in intel_panel_init_alloc(), but +the SDVO code never calls it. + +Call intel_panel_init_alloc() to initialize the panel, including the +panel_type. + +Reported-by: Tomi Leppänen +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8896 +Fixes: 3f9ffce5765d ("drm/i915: Do panel VBT init early if the VBT declares an explicit panel type") +Cc: Ville Syrjälä +Cc: # v6.1+ +Reviewed-by: Uma Shankar +Tested-by: Tomi Leppänen +Signed-off-by: Jani Nikula +Link: https://patchwork.freedesktop.org/patch/msgid/20230803122706.838721-1-jani.nikula@intel.com +(cherry picked from commit 26e60294e8eacedc8ebb33405b2c375fd80e0900) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_sdvo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/display/intel_sdvo.c ++++ b/drivers/gpu/drm/i915/display/intel_sdvo.c +@@ -2752,7 +2752,7 @@ static struct intel_sdvo_connector *inte + __drm_atomic_helper_connector_reset(&sdvo_connector->base.base, + &conn_state->base.base); + +- INIT_LIST_HEAD(&sdvo_connector->base.panel.fixed_modes); ++ intel_panel_init_alloc(&sdvo_connector->base); + + return sdvo_connector; + } diff --git a/queue-6.4/drm-qxl-fix-uaf-on-handle-creation.patch b/queue-6.4/drm-qxl-fix-uaf-on-handle-creation.patch new file mode 100644 index 00000000000..60fa239bdda --- /dev/null +++ b/queue-6.4/drm-qxl-fix-uaf-on-handle-creation.patch @@ -0,0 +1,352 @@ +From c611589b4259ed63b9b77be6872b1ce07ec0ac16 Mon Sep 17 00:00:00 2001 +From: Wander Lairson Costa +Date: Mon, 14 Aug 2023 13:51:19 -0300 +Subject: drm/qxl: fix UAF on handle creation + +From: Wander Lairson Costa + +commit c611589b4259ed63b9b77be6872b1ce07ec0ac16 upstream. + +qxl_mode_dumb_create() dereferences the qobj returned by +qxl_gem_object_create_with_handle(), but the handle is the only one +holding a reference to it. + +A potential attacker could guess the returned handle value and closes it +between the return of qxl_gem_object_create_with_handle() and the qobj +usage, triggering a use-after-free scenario. + +Reproducer: + +int dri_fd =-1; +struct drm_mode_create_dumb arg = {0}; + +void gem_close(int handle); + +void* trigger(void* ptr) +{ + int ret; + arg.width = arg.height = 0x20; + arg.bpp = 32; + ret = ioctl(dri_fd, DRM_IOCTL_MODE_CREATE_DUMB, &arg); + if(ret) + { + perror("[*] DRM_IOCTL_MODE_CREATE_DUMB Failed"); + exit(-1); + } + gem_close(arg.handle); + while(1) { + struct drm_mode_create_dumb args = {0}; + args.width = args.height = 0x20; + args.bpp = 32; + ret = ioctl(dri_fd, DRM_IOCTL_MODE_CREATE_DUMB, &args); + if (ret) { + perror("[*] DRM_IOCTL_MODE_CREATE_DUMB Failed"); + exit(-1); + } + + printf("[*] DRM_IOCTL_MODE_CREATE_DUMB created, %d\n", args.handle); + gem_close(args.handle); + } + return NULL; +} + +void gem_close(int handle) +{ + struct drm_gem_close args; + args.handle = handle; + int ret = ioctl(dri_fd, DRM_IOCTL_GEM_CLOSE, &args); // gem close handle + if (!ret) + printf("gem close handle %d\n", args.handle); +} + +int main(void) +{ + dri_fd= open("/dev/dri/card0", O_RDWR); + printf("fd:%d\n", dri_fd); + + if(dri_fd == -1) + return -1; + + pthread_t tid1; + + if(pthread_create(&tid1,NULL,trigger,NULL)){ + perror("[*] thread_create tid1\n"); + return -1; + } + while (1) + { + gem_close(arg.handle); + } + return 0; +} + +This is a KASAN report: + +================================================================== +BUG: KASAN: slab-use-after-free in qxl_mode_dumb_create+0x3c2/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:69 +Write of size 1 at addr ffff88801136c240 by task poc/515 + +CPU: 1 PID: 515 Comm: poc Not tainted 6.3.0 #3 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-4 04/01/2014 +Call Trace: + +__dump_stack linux/lib/dump_stack.c:88 +dump_stack_lvl+0x48/0x70 linux/lib/dump_stack.c:106 +print_address_description linux/mm/kasan/report.c:319 +print_report+0xd2/0x660 linux/mm/kasan/report.c:430 +kasan_report+0xd2/0x110 linux/mm/kasan/report.c:536 +__asan_report_store1_noabort+0x17/0x30 linux/mm/kasan/report_generic.c:383 +qxl_mode_dumb_create+0x3c2/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:69 +drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96 +drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102 +drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788 +drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891 +vfs_ioctl linux/fs/ioctl.c:51 +__do_sys_ioctl linux/fs/ioctl.c:870 +__se_sys_ioctl linux/fs/ioctl.c:856 +__x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856 +do_syscall_x64 linux/arch/x86/entry/common.c:50 +do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120 +RIP: 0033:0x7ff5004ff5f7 +Code: 00 00 00 48 8b 05 99 c8 0d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 69 c8 0d 00 f7 d8 64 89 01 48 + +RSP: 002b:00007ff500408ea8 EFLAGS: 00000286 ORIG_RAX: 0000000000000010 +RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff5004ff5f7 +RDX: 00007ff500408ec0 RSI: 00000000c02064b2 RDI: 0000000000000003 +RBP: 00007ff500408ef0 R08: 0000000000000000 R09: 000000000000002a +R10: 0000000000000000 R11: 0000000000000286 R12: 00007fff1c6cdafe +R13: 00007fff1c6cdaff R14: 00007ff500408fc0 R15: 0000000000802000 + + +Allocated by task 515: +kasan_save_stack+0x38/0x70 linux/mm/kasan/common.c:45 +kasan_set_track+0x25/0x40 linux/mm/kasan/common.c:52 +kasan_save_alloc_info+0x1e/0x40 linux/mm/kasan/generic.c:510 +____kasan_kmalloc linux/mm/kasan/common.c:374 +__kasan_kmalloc+0xc3/0xd0 linux/mm/kasan/common.c:383 +kasan_kmalloc linux/./include/linux/kasan.h:196 +kmalloc_trace+0x48/0xc0 linux/mm/slab_common.c:1066 +kmalloc linux/./include/linux/slab.h:580 +kzalloc linux/./include/linux/slab.h:720 +qxl_bo_create+0x11a/0x610 linux/drivers/gpu/drm/qxl/qxl_object.c:124 +qxl_gem_object_create+0xd9/0x360 linux/drivers/gpu/drm/qxl/qxl_gem.c:58 +qxl_gem_object_create_with_handle+0xa1/0x180 linux/drivers/gpu/drm/qxl/qxl_gem.c:89 +qxl_mode_dumb_create+0x1cd/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:63 +drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96 +drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102 +drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788 +drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891 +vfs_ioctl linux/fs/ioctl.c:51 +__do_sys_ioctl linux/fs/ioctl.c:870 +__se_sys_ioctl linux/fs/ioctl.c:856 +__x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856 +do_syscall_x64 linux/arch/x86/entry/common.c:50 +do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120 + +Freed by task 515: +kasan_save_stack+0x38/0x70 linux/mm/kasan/common.c:45 +kasan_set_track+0x25/0x40 linux/mm/kasan/common.c:52 +kasan_save_free_info+0x2e/0x60 linux/mm/kasan/generic.c:521 +____kasan_slab_free linux/mm/kasan/common.c:236 +____kasan_slab_free+0x180/0x1f0 linux/mm/kasan/common.c:200 +__kasan_slab_free+0x12/0x30 linux/mm/kasan/common.c:244 +kasan_slab_free linux/./include/linux/kasan.h:162 +slab_free_hook linux/mm/slub.c:1781 +slab_free_freelist_hook+0xd2/0x1a0 linux/mm/slub.c:1807 +slab_free linux/mm/slub.c:3787 +__kmem_cache_free+0x196/0x2d0 linux/mm/slub.c:3800 +kfree+0x78/0x120 linux/mm/slab_common.c:1019 +qxl_ttm_bo_destroy+0x140/0x1a0 linux/drivers/gpu/drm/qxl/qxl_object.c:49 +ttm_bo_release+0x678/0xa30 linux/drivers/gpu/drm/ttm/ttm_bo.c:381 +kref_put linux/./include/linux/kref.h:65 +ttm_bo_put+0x50/0x80 linux/drivers/gpu/drm/ttm/ttm_bo.c:393 +qxl_gem_object_free+0x3e/0x60 linux/drivers/gpu/drm/qxl/qxl_gem.c:42 +drm_gem_object_free+0x5c/0x90 linux/drivers/gpu/drm/drm_gem.c:974 +kref_put linux/./include/linux/kref.h:65 +__drm_gem_object_put linux/./include/drm/drm_gem.h:431 +drm_gem_object_put linux/./include/drm/drm_gem.h:444 +qxl_gem_object_create_with_handle+0x151/0x180 linux/drivers/gpu/drm/qxl/qxl_gem.c:100 +qxl_mode_dumb_create+0x1cd/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:63 +drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96 +drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102 +drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788 +drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891 +vfs_ioctl linux/fs/ioctl.c:51 +__do_sys_ioctl linux/fs/ioctl.c:870 +__se_sys_ioctl linux/fs/ioctl.c:856 +__x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856 +do_syscall_x64 linux/arch/x86/entry/common.c:50 +do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120 + +The buggy address belongs to the object at ffff88801136c000 +which belongs to the cache kmalloc-1k of size 1024 +The buggy address is located 576 bytes inside of +freed 1024-byte region [ffff88801136c000, ffff88801136c400) + +The buggy address belongs to the physical page: +page:0000000089fc329b refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11368 +head:0000000089fc329b order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 +flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) +raw: 000fffffc0010200 ffff888007841dc0 dead000000000122 0000000000000000 +raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 +page dumped because: kasan: bad access detected + +Memory state around the buggy address: +ffff88801136c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +ffff88801136c180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +>ffff88801136c200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +^ +ffff88801136c280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +ffff88801136c300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +================================================================== +Disabling lock debugging due to kernel taint + +Instead of returning a weak reference to the qxl_bo object, return the +created drm_gem_object and let the caller decrement the reference count +when it no longer needs it. As a convenience, if the caller is not +interested in the gobj object, it can pass NULL to the parameter and the +reference counting is descremented internally. + +The bug and the reproducer were originally found by the Zero Day Initiative project (ZDI-CAN-20940). + +Link: https://www.zerodayinitiative.com/ +Signed-off-by: Wander Lairson Costa +Cc: stable@vger.kernel.org +Reviewed-by: Dave Airlie +Signed-off-by: Dave Airlie +Link: https://patchwork.freedesktop.org/patch/msgid/20230814165119.90847-1-wander@redhat.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/qxl/qxl_drv.h | 2 +- + drivers/gpu/drm/qxl/qxl_dumb.c | 5 ++++- + drivers/gpu/drm/qxl/qxl_gem.c | 25 +++++++++++++++++-------- + drivers/gpu/drm/qxl/qxl_ioctl.c | 6 ++---- + 4 files changed, 24 insertions(+), 14 deletions(-) + +--- a/drivers/gpu/drm/qxl/qxl_drv.h ++++ b/drivers/gpu/drm/qxl/qxl_drv.h +@@ -310,7 +310,7 @@ int qxl_gem_object_create_with_handle(st + u32 domain, + size_t size, + struct qxl_surface *surf, +- struct qxl_bo **qobj, ++ struct drm_gem_object **gobj, + uint32_t *handle); + void qxl_gem_object_free(struct drm_gem_object *gobj); + int qxl_gem_object_open(struct drm_gem_object *obj, struct drm_file *file_priv); +--- a/drivers/gpu/drm/qxl/qxl_dumb.c ++++ b/drivers/gpu/drm/qxl/qxl_dumb.c +@@ -34,6 +34,7 @@ int qxl_mode_dumb_create(struct drm_file + { + struct qxl_device *qdev = to_qxl(dev); + struct qxl_bo *qobj; ++ struct drm_gem_object *gobj; + uint32_t handle; + int r; + struct qxl_surface surf; +@@ -62,11 +63,13 @@ int qxl_mode_dumb_create(struct drm_file + + r = qxl_gem_object_create_with_handle(qdev, file_priv, + QXL_GEM_DOMAIN_CPU, +- args->size, &surf, &qobj, ++ args->size, &surf, &gobj, + &handle); + if (r) + return r; ++ qobj = gem_to_qxl_bo(gobj); + qobj->is_dumb = true; ++ drm_gem_object_put(gobj); + args->pitch = pitch; + args->handle = handle; + return 0; +--- a/drivers/gpu/drm/qxl/qxl_gem.c ++++ b/drivers/gpu/drm/qxl/qxl_gem.c +@@ -72,32 +72,41 @@ int qxl_gem_object_create(struct qxl_dev + return 0; + } + ++/* ++ * If the caller passed a valid gobj pointer, it is responsible to call ++ * drm_gem_object_put() when it no longer needs to acess the object. ++ * ++ * If gobj is NULL, it is handled internally. ++ */ + int qxl_gem_object_create_with_handle(struct qxl_device *qdev, + struct drm_file *file_priv, + u32 domain, + size_t size, + struct qxl_surface *surf, +- struct qxl_bo **qobj, ++ struct drm_gem_object **gobj, + uint32_t *handle) + { +- struct drm_gem_object *gobj; + int r; ++ struct drm_gem_object *local_gobj; + +- BUG_ON(!qobj); + BUG_ON(!handle); + + r = qxl_gem_object_create(qdev, size, 0, + domain, + false, false, surf, +- &gobj); ++ &local_gobj); + if (r) + return -ENOMEM; +- r = drm_gem_handle_create(file_priv, gobj, handle); ++ r = drm_gem_handle_create(file_priv, local_gobj, handle); + if (r) + return r; +- /* drop reference from allocate - handle holds it now */ +- *qobj = gem_to_qxl_bo(gobj); +- drm_gem_object_put(gobj); ++ ++ if (gobj) ++ *gobj = local_gobj; ++ else ++ /* drop reference from allocate - handle holds it now */ ++ drm_gem_object_put(local_gobj); ++ + return 0; + } + +--- a/drivers/gpu/drm/qxl/qxl_ioctl.c ++++ b/drivers/gpu/drm/qxl/qxl_ioctl.c +@@ -38,7 +38,6 @@ int qxl_alloc_ioctl(struct drm_device *d + struct qxl_device *qdev = to_qxl(dev); + struct drm_qxl_alloc *qxl_alloc = data; + int ret; +- struct qxl_bo *qobj; + uint32_t handle; + u32 domain = QXL_GEM_DOMAIN_VRAM; + +@@ -50,7 +49,7 @@ int qxl_alloc_ioctl(struct drm_device *d + domain, + qxl_alloc->size, + NULL, +- &qobj, &handle); ++ NULL, &handle); + if (ret) { + DRM_ERROR("%s: failed to create gem ret=%d\n", + __func__, ret); +@@ -386,7 +385,6 @@ int qxl_alloc_surf_ioctl(struct drm_devi + { + struct qxl_device *qdev = to_qxl(dev); + struct drm_qxl_alloc_surf *param = data; +- struct qxl_bo *qobj; + int handle; + int ret; + int size, actual_stride; +@@ -406,7 +404,7 @@ int qxl_alloc_surf_ioctl(struct drm_devi + QXL_GEM_DOMAIN_SURFACE, + size, + &surf, +- &qobj, &handle); ++ NULL, &handle); + if (ret) { + DRM_ERROR("%s: failed to create gem ret=%d\n", + __func__, ret); diff --git a/queue-6.4/mmc-sunplus-fix-error-handling-in-spmmc_drv_probe.patch b/queue-6.4/mmc-sunplus-fix-error-handling-in-spmmc_drv_probe.patch new file mode 100644 index 00000000000..e7baf683f8e --- /dev/null +++ b/queue-6.4/mmc-sunplus-fix-error-handling-in-spmmc_drv_probe.patch @@ -0,0 +1,71 @@ +From cf3f15b8c6601c1dc70f85949788ee993dd9a439 Mon Sep 17 00:00:00 2001 +From: Harshit Mogalapalli +Date: Wed, 9 Aug 2023 00:18:11 -0700 +Subject: mmc: sunplus: Fix error handling in spmmc_drv_probe() + +From: Harshit Mogalapalli + +commit cf3f15b8c6601c1dc70f85949788ee993dd9a439 upstream. + +When mmc allocation succeeds, the error paths are not freeing mmc. + +Fix the above issue by changing mmc_alloc_host() to devm_mmc_alloc_host() +to simplify the error handling. Remove label 'probe_free_host' as devm_* +api takes care of freeing, also remove mmc_free_host() from remove +function as devm_* takes care of freeing. + +Fixes: 4e268fed8b18 ("mmc: Add mmc driver for Sunplus SP7021") +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/all/a3829ed3-d827-4b9d-827e-9cc24a3ec3bc@moroto.mountain/ +Signed-off-by: Harshit Mogalapalli +Reviewed-by: Dan Carpenter +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230809071812.547229-1-harshit.m.mogalapalli@oracle.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sunplus-mmc.c | 14 +++----------- + 1 file changed, 3 insertions(+), 11 deletions(-) + +diff --git a/drivers/mmc/host/sunplus-mmc.c b/drivers/mmc/host/sunplus-mmc.c +index a55a87f64d2a..2bdebeb1f8e4 100644 +--- a/drivers/mmc/host/sunplus-mmc.c ++++ b/drivers/mmc/host/sunplus-mmc.c +@@ -863,11 +863,9 @@ static int spmmc_drv_probe(struct platform_device *pdev) + struct spmmc_host *host; + int ret = 0; + +- mmc = mmc_alloc_host(sizeof(*host), &pdev->dev); +- if (!mmc) { +- ret = -ENOMEM; +- goto probe_free_host; +- } ++ mmc = devm_mmc_alloc_host(&pdev->dev, sizeof(struct spmmc_host)); ++ if (!mmc) ++ return -ENOMEM; + + host = mmc_priv(mmc); + host->mmc = mmc; +@@ -938,11 +936,6 @@ static int spmmc_drv_probe(struct platform_device *pdev) + + clk_disable: + clk_disable_unprepare(host->clk); +- +-probe_free_host: +- if (mmc) +- mmc_free_host(mmc); +- + return ret; + } + +@@ -956,7 +949,6 @@ static int spmmc_drv_remove(struct platform_device *dev) + pm_runtime_put_noidle(&dev->dev); + pm_runtime_disable(&dev->dev); + platform_set_drvdata(dev, NULL); +- mmc_free_host(host->mmc); + + return 0; + } +-- +2.41.0 + diff --git a/queue-6.4/mmc-sunplus-fix-return-value-check-of-mmc_add_host.patch b/queue-6.4/mmc-sunplus-fix-return-value-check-of-mmc_add_host.patch new file mode 100644 index 00000000000..313a09440ad --- /dev/null +++ b/queue-6.4/mmc-sunplus-fix-return-value-check-of-mmc_add_host.patch @@ -0,0 +1,73 @@ +From dce6d8f985fa1ef5c2af47f4f86ea65511b78656 Mon Sep 17 00:00:00 2001 +From: Wei Chen +Date: Thu, 22 Jun 2023 09:02:33 +0000 +Subject: mmc: sunplus: fix return value check of mmc_add_host() + +From: Wei Chen + +commit dce6d8f985fa1ef5c2af47f4f86ea65511b78656 upstream. + +mmc_add_host() may return error, if we ignore its return value, +1. the memory allocated in mmc_alloc_host() will be leaked +2. null-ptr-deref will happen when calling mmc_remove_host() +in remove function spmmc_drv_remove() because deleting not +added device. + +Fix this by checking the return value of mmc_add_host(). Moreover, +I fixed the error handling path of spmmc_drv_probe() to clean up. + +Fixes: 4e268fed8b18 ("mmc: Add mmc driver for Sunplus SP7021") +Cc: stable@vger.kernel.org +Signed-off-by: Wei Chen +Link: https://lore.kernel.org/r/20230622090233.188539-1-harperchen1110@gmail.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sunplus-mmc.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/drivers/mmc/host/sunplus-mmc.c b/drivers/mmc/host/sunplus-mmc.c +index db5e0dcdfa7f..a55a87f64d2a 100644 +--- a/drivers/mmc/host/sunplus-mmc.c ++++ b/drivers/mmc/host/sunplus-mmc.c +@@ -902,7 +902,7 @@ static int spmmc_drv_probe(struct platform_device *pdev) + + ret = mmc_of_parse(mmc); + if (ret) +- goto probe_free_host; ++ goto clk_disable; + + mmc->ops = &spmmc_ops; + mmc->f_min = SPMMC_MIN_CLK; +@@ -911,7 +911,7 @@ static int spmmc_drv_probe(struct platform_device *pdev) + + ret = mmc_regulator_get_supply(mmc); + if (ret) +- goto probe_free_host; ++ goto clk_disable; + + if (!mmc->ocr_avail) + mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34; +@@ -927,9 +927,17 @@ static int spmmc_drv_probe(struct platform_device *pdev) + host->tuning_info.enable_tuning = 1; + pm_runtime_set_active(&pdev->dev); + pm_runtime_enable(&pdev->dev); +- mmc_add_host(mmc); ++ ret = mmc_add_host(mmc); ++ if (ret) ++ goto pm_disable; + +- return ret; ++ return 0; ++ ++pm_disable: ++ pm_runtime_disable(&pdev->dev); ++ ++clk_disable: ++ clk_disable_unprepare(host->clk); + + probe_free_host: + if (mmc) +-- +2.41.0 + diff --git a/queue-6.4/revert-drm-edid-fix-csync-detailed-mode-parsing.patch b/queue-6.4/revert-drm-edid-fix-csync-detailed-mode-parsing.patch new file mode 100644 index 00000000000..9690c3373bd --- /dev/null +++ b/queue-6.4/revert-drm-edid-fix-csync-detailed-mode-parsing.patch @@ -0,0 +1,109 @@ +From 50b6f2c8297793f7f3315623db78dcff85158e96 Mon Sep 17 00:00:00 2001 +From: Jani Nikula +Date: Tue, 15 Aug 2023 13:19:07 +0300 +Subject: Revert "drm/edid: Fix csync detailed mode parsing" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jani Nikula + +commit 50b6f2c8297793f7f3315623db78dcff85158e96 upstream. + +This reverts commit ca62297b2085b5b3168bd891ca24862242c635a1. + +Commit ca62297b2085 ("drm/edid: Fix csync detailed mode parsing") fixed +EDID detailed mode sync parsing. Unfortunately, there are quite a few +displays out there that have bogus (zero) sync field that are broken by +the change. Zero means analog composite sync, which is not right for +digital displays, and the modes get rejected. Regardless, it used to +work, and it needs to continue to work. Revert the change. + +Rejecting modes with analog composite sync was the part that fixed the +gitlab issue 8146 [1]. We'll need to get back to the drawing board with +that. + +[1] https://gitlab.freedesktop.org/drm/intel/-/issues/8146 + +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8789 +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8930 +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/9044 +Fixes: ca62297b2085 ("drm/edid: Fix csync detailed mode parsing") +Cc: Ville Syrjälä +Cc: dri-devel@lists.freedesktop.org +Cc: # v6.4+ +Signed-off-by: Jani Nikula +Acked-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20230815101907.2900768-1-jani.nikula@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_edid.c | 29 ++++++++--------------------- + include/drm/drm_edid.h | 12 +++--------- + 2 files changed, 11 insertions(+), 30 deletions(-) + +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -3424,6 +3424,10 @@ static struct drm_display_mode *drm_mode + connector->base.id, connector->name); + return NULL; + } ++ if (!(pt->misc & DRM_EDID_PT_SEPARATE_SYNC)) { ++ drm_dbg_kms(dev, "[CONNECTOR:%d:%s] Composite sync not supported\n", ++ connector->base.id, connector->name); ++ } + + /* it is incorrect if hsync/vsync width is zero */ + if (!hsync_pulse_width || !vsync_pulse_width) { +@@ -3470,27 +3474,10 @@ static struct drm_display_mode *drm_mode + if (info->quirks & EDID_QUIRK_DETAILED_SYNC_PP) { + mode->flags |= DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC; + } else { +- switch (pt->misc & DRM_EDID_PT_SYNC_MASK) { +- case DRM_EDID_PT_ANALOG_CSYNC: +- case DRM_EDID_PT_BIPOLAR_ANALOG_CSYNC: +- drm_dbg_kms(dev, "[CONNECTOR:%d:%s] Analog composite sync!\n", +- connector->base.id, connector->name); +- mode->flags |= DRM_MODE_FLAG_CSYNC | DRM_MODE_FLAG_NCSYNC; +- break; +- case DRM_EDID_PT_DIGITAL_CSYNC: +- drm_dbg_kms(dev, "[CONNECTOR:%d:%s] Digital composite sync!\n", +- connector->base.id, connector->name); +- mode->flags |= DRM_MODE_FLAG_CSYNC; +- mode->flags |= (pt->misc & DRM_EDID_PT_HSYNC_POSITIVE) ? +- DRM_MODE_FLAG_PCSYNC : DRM_MODE_FLAG_NCSYNC; +- break; +- case DRM_EDID_PT_DIGITAL_SEPARATE_SYNC: +- mode->flags |= (pt->misc & DRM_EDID_PT_HSYNC_POSITIVE) ? +- DRM_MODE_FLAG_PHSYNC : DRM_MODE_FLAG_NHSYNC; +- mode->flags |= (pt->misc & DRM_EDID_PT_VSYNC_POSITIVE) ? +- DRM_MODE_FLAG_PVSYNC : DRM_MODE_FLAG_NVSYNC; +- break; +- } ++ mode->flags |= (pt->misc & DRM_EDID_PT_HSYNC_POSITIVE) ? ++ DRM_MODE_FLAG_PHSYNC : DRM_MODE_FLAG_NHSYNC; ++ mode->flags |= (pt->misc & DRM_EDID_PT_VSYNC_POSITIVE) ? ++ DRM_MODE_FLAG_PVSYNC : DRM_MODE_FLAG_NVSYNC; + } + + set_size: +--- a/include/drm/drm_edid.h ++++ b/include/drm/drm_edid.h +@@ -61,15 +61,9 @@ struct std_timing { + u8 vfreq_aspect; + } __attribute__((packed)); + +-#define DRM_EDID_PT_SYNC_MASK (3 << 3) +-# define DRM_EDID_PT_ANALOG_CSYNC (0 << 3) +-# define DRM_EDID_PT_BIPOLAR_ANALOG_CSYNC (1 << 3) +-# define DRM_EDID_PT_DIGITAL_CSYNC (2 << 3) +-# define DRM_EDID_PT_CSYNC_ON_RGB (1 << 1) /* analog csync only */ +-# define DRM_EDID_PT_CSYNC_SERRATE (1 << 2) +-# define DRM_EDID_PT_DIGITAL_SEPARATE_SYNC (3 << 3) +-# define DRM_EDID_PT_HSYNC_POSITIVE (1 << 1) /* also digital csync */ +-# define DRM_EDID_PT_VSYNC_POSITIVE (1 << 2) ++#define DRM_EDID_PT_HSYNC_POSITIVE (1 << 1) ++#define DRM_EDID_PT_VSYNC_POSITIVE (1 << 2) ++#define DRM_EDID_PT_SEPARATE_SYNC (3 << 3) + #define DRM_EDID_PT_STEREO (1 << 5) + #define DRM_EDID_PT_INTERLACED (1 << 7) + diff --git a/queue-6.4/revert-revert-drm-amdgpu-display-change-pipe-policy-for-dcn-2.0.patch b/queue-6.4/revert-revert-drm-amdgpu-display-change-pipe-policy-for-dcn-2.0.patch new file mode 100644 index 00000000000..17b34e798ce --- /dev/null +++ b/queue-6.4/revert-revert-drm-amdgpu-display-change-pipe-policy-for-dcn-2.0.patch @@ -0,0 +1,41 @@ +From 6ecc10295abb2fdd9c21dd17b34e4cacfd829cd4 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Tue, 15 Aug 2023 17:25:37 -0400 +Subject: Revert "Revert "drm/amdgpu/display: change pipe policy for DCN 2.0"" + +From: Alex Deucher + +commit 6ecc10295abb2fdd9c21dd17b34e4cacfd829cd4 upstream. + +This reverts commit 27dd79c00aeab36cd7542c7a4481a32549038659. + +It appears MPC_SPLIT_DYNAMIC still causes problems with multiple +displays on DCN2.0 hardware. Switch back to MPC_SPLIT_AVOID_MULT_DISP. +This increases power usage with multiple displays, but avoids hangs. + +Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2475 +Cc: Rodrigo Siqueira +Reviewed-by: Harry Wentland +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 6.4.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +index 4cc8de2627ce..9f2e24398cd7 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +@@ -712,7 +712,7 @@ static const struct dc_debug_options debug_defaults_drv = { + .timing_trace = false, + .clock_trace = true, + .disable_pplib_clock_request = true, +- .pipe_split_policy = MPC_SPLIT_DYNAMIC, ++ .pipe_split_policy = MPC_SPLIT_AVOID_MULT_DISP, + .force_single_disp_pipe_split = false, + .disable_dcc = DCC_ENABLE, + .vsr_support = true, +-- +2.41.0 + diff --git a/queue-6.4/series b/queue-6.4/series index 77cb93de993..01896b65298 100644 --- a/queue-6.4/series +++ b/queue-6.4/series @@ -219,3 +219,12 @@ dt-bindings-pinctrl-qcom-sa8775p-tlmm-add-gpio-function-constant.patch mmc-f-sdh30-fix-order-of-function-calls-in-sdhci_f_sdh30_remove.patch mmc-wbsd-fix-double-mmc_free_host-in-wbsd_init.patch mmc-block-fix-in_flight-value-error.patch +mmc-sunplus-fix-return-value-check-of-mmc_add_host.patch +mmc-sunplus-fix-error-handling-in-spmmc_drv_probe.patch +drm-qxl-fix-uaf-on-handle-creation.patch +revert-drm-edid-fix-csync-detailed-mode-parsing.patch +revert-revert-drm-amdgpu-display-change-pipe-policy-for-dcn-2.0.patch +drm-i915-sdvo-fix-panel_type-initialization.patch +drm-amd-flush-any-delayed-gfxoff-on-suspend-entry.patch +drm-amdgpu-skip-fence-gfx-interrupts-disable-enable-for-s0ix.patch +drm-amdgpu-pm-fix-throttle_status-for-other-than-mp1-11.0.7.patch -- 2.47.2