From 9d3cbe683ab1df52130ca7bf2d5d93d9fae39bda Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 31 Oct 2022 07:36:00 +0100 Subject: [PATCH] 6.0-stable patches added patches: crypto-x86-polyval-fix-crashes-when-keys-are-not-16-byte-aligned.patch drm-amd-display-revert-logic-for-plane-modifiers.patch drm-amdgpu-disallow-gfxoff-until-gc-ip-blocks-complete-s2idle-resume.patch drm-amdgpu-fix-pstate-setting-issue.patch drm-amdgpu-remove-atc-l2-access-for-mmhub-2.1.x.patch drm-amdkfd-correct-the-cache-info-for-gfx1036.patch drm-amdkfd-update-gfx1037-lx-cache-setting.patch drm-i915-extend-wa_1607297627-to-alderlake-p.patch drm-msm-dp-fix-aux-bus-ep-lifetime.patch drm-msm-dp-fix-bridge-lifetime.patch drm-msm-dp-fix-irq-lifetime.patch drm-msm-dp-fix-memory-corruption-with-too-many-bridges.patch drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch drm-msm-fix-use-after-free-on-probe-deferral.patch drm-msm-hdmi-fix-irq-lifetime.patch drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch --- ...es-when-keys-are-not-16-byte-aligned.patch | 99 ++++++++++++++++ ...lay-revert-logic-for-plane-modifiers.patch | 110 ++++++++++++++++++ ...-gc-ip-blocks-complete-s2idle-resume.patch | 55 +++++++++ .../drm-amdgpu-fix-pstate-setting-issue.patch | 50 ++++++++ ...remove-atc-l2-access-for-mmhub-2.1.x.patch | 100 ++++++++++++++++ ...d-correct-the-cache-info-for-gfx1036.patch | 94 +++++++++++++++ ...dkfd-update-gfx1037-lx-cache-setting.patch | 92 +++++++++++++++ ...-extend-wa_1607297627-to-alderlake-p.patch | 50 ++++++++ .../drm-msm-dp-fix-aux-bus-ep-lifetime.patch | 74 ++++++++++++ .../drm-msm-dp-fix-bridge-lifetime.patch | 98 ++++++++++++++++ queue-6.0/drm-msm-dp-fix-irq-lifetime.patch | 49 ++++++++ ...ory-corruption-with-too-many-bridges.patch | 47 ++++++++ ...ory-corruption-with-too-many-bridges.patch | 42 +++++++ ...fix-use-after-free-on-probe-deferral.patch | 41 +++++++ queue-6.0/drm-msm-hdmi-fix-irq-lifetime.patch | 45 +++++++ ...ory-corruption-with-too-many-bridges.patch | 41 +++++++ queue-6.0/series | 16 +++ 17 files changed, 1103 insertions(+) create mode 100644 queue-6.0/crypto-x86-polyval-fix-crashes-when-keys-are-not-16-byte-aligned.patch create mode 100644 queue-6.0/drm-amd-display-revert-logic-for-plane-modifiers.patch create mode 100644 queue-6.0/drm-amdgpu-disallow-gfxoff-until-gc-ip-blocks-complete-s2idle-resume.patch create mode 100644 queue-6.0/drm-amdgpu-fix-pstate-setting-issue.patch create mode 100644 queue-6.0/drm-amdgpu-remove-atc-l2-access-for-mmhub-2.1.x.patch create mode 100644 queue-6.0/drm-amdkfd-correct-the-cache-info-for-gfx1036.patch create mode 100644 queue-6.0/drm-amdkfd-update-gfx1037-lx-cache-setting.patch create mode 100644 queue-6.0/drm-i915-extend-wa_1607297627-to-alderlake-p.patch create mode 100644 queue-6.0/drm-msm-dp-fix-aux-bus-ep-lifetime.patch create mode 100644 queue-6.0/drm-msm-dp-fix-bridge-lifetime.patch create mode 100644 queue-6.0/drm-msm-dp-fix-irq-lifetime.patch create mode 100644 queue-6.0/drm-msm-dp-fix-memory-corruption-with-too-many-bridges.patch create mode 100644 queue-6.0/drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch create mode 100644 queue-6.0/drm-msm-fix-use-after-free-on-probe-deferral.patch create mode 100644 queue-6.0/drm-msm-hdmi-fix-irq-lifetime.patch create mode 100644 queue-6.0/drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch diff --git a/queue-6.0/crypto-x86-polyval-fix-crashes-when-keys-are-not-16-byte-aligned.patch b/queue-6.0/crypto-x86-polyval-fix-crashes-when-keys-are-not-16-byte-aligned.patch new file mode 100644 index 00000000000..97762d0df95 --- /dev/null +++ b/queue-6.0/crypto-x86-polyval-fix-crashes-when-keys-are-not-16-byte-aligned.patch @@ -0,0 +1,99 @@ +From 9f6035af06b526e678808d492fc0830aef6cfbd8 Mon Sep 17 00:00:00 2001 +From: Nathan Huckleberry +Date: Tue, 18 Oct 2022 16:04:12 -0700 +Subject: crypto: x86/polyval - Fix crashes when keys are not 16-byte aligned + +From: Nathan Huckleberry + +commit 9f6035af06b526e678808d492fc0830aef6cfbd8 upstream. + +crypto_tfm::__crt_ctx is not guaranteed to be 16-byte aligned on x86-64. +This causes crashes due to movaps instructions in clmul_polyval_update. + +Add logic to align polyval_tfm_ctx to 16 bytes. + +Cc: +Fixes: 34f7f6c30112 ("crypto: x86/polyval - Add PCLMULQDQ accelerated implementation of POLYVAL") +Reported-by: Bruno Goncalves +Signed-off-by: Nathan Huckleberry +Reviewed-by: Eric Biggers +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/crypto/polyval-clmulni_glue.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +diff --git a/arch/x86/crypto/polyval-clmulni_glue.c b/arch/x86/crypto/polyval-clmulni_glue.c +index b7664d018851..8fa58b0f3cb3 100644 +--- a/arch/x86/crypto/polyval-clmulni_glue.c ++++ b/arch/x86/crypto/polyval-clmulni_glue.c +@@ -27,13 +27,17 @@ + #include + #include + ++#define POLYVAL_ALIGN 16 ++#define POLYVAL_ALIGN_ATTR __aligned(POLYVAL_ALIGN) ++#define POLYVAL_ALIGN_EXTRA ((POLYVAL_ALIGN - 1) & ~(CRYPTO_MINALIGN - 1)) ++#define POLYVAL_CTX_SIZE (sizeof(struct polyval_tfm_ctx) + POLYVAL_ALIGN_EXTRA) + #define NUM_KEY_POWERS 8 + + struct polyval_tfm_ctx { + /* + * These powers must be in the order h^8, ..., h^1. + */ +- u8 key_powers[NUM_KEY_POWERS][POLYVAL_BLOCK_SIZE]; ++ u8 key_powers[NUM_KEY_POWERS][POLYVAL_BLOCK_SIZE] POLYVAL_ALIGN_ATTR; + }; + + struct polyval_desc_ctx { +@@ -45,6 +49,11 @@ asmlinkage void clmul_polyval_update(const struct polyval_tfm_ctx *keys, + const u8 *in, size_t nblocks, u8 *accumulator); + asmlinkage void clmul_polyval_mul(u8 *op1, const u8 *op2); + ++static inline struct polyval_tfm_ctx *polyval_tfm_ctx(struct crypto_shash *tfm) ++{ ++ return PTR_ALIGN(crypto_shash_ctx(tfm), POLYVAL_ALIGN); ++} ++ + static void internal_polyval_update(const struct polyval_tfm_ctx *keys, + const u8 *in, size_t nblocks, u8 *accumulator) + { +@@ -72,7 +81,7 @@ static void internal_polyval_mul(u8 *op1, const u8 *op2) + static int polyval_x86_setkey(struct crypto_shash *tfm, + const u8 *key, unsigned int keylen) + { +- struct polyval_tfm_ctx *tctx = crypto_shash_ctx(tfm); ++ struct polyval_tfm_ctx *tctx = polyval_tfm_ctx(tfm); + int i; + + if (keylen != POLYVAL_BLOCK_SIZE) +@@ -102,7 +111,7 @@ static int polyval_x86_update(struct shash_desc *desc, + const u8 *src, unsigned int srclen) + { + struct polyval_desc_ctx *dctx = shash_desc_ctx(desc); +- const struct polyval_tfm_ctx *tctx = crypto_shash_ctx(desc->tfm); ++ const struct polyval_tfm_ctx *tctx = polyval_tfm_ctx(desc->tfm); + u8 *pos; + unsigned int nblocks; + unsigned int n; +@@ -143,7 +152,7 @@ static int polyval_x86_update(struct shash_desc *desc, + static int polyval_x86_final(struct shash_desc *desc, u8 *dst) + { + struct polyval_desc_ctx *dctx = shash_desc_ctx(desc); +- const struct polyval_tfm_ctx *tctx = crypto_shash_ctx(desc->tfm); ++ const struct polyval_tfm_ctx *tctx = polyval_tfm_ctx(desc->tfm); + + if (dctx->bytes) { + internal_polyval_mul(dctx->buffer, +@@ -167,7 +176,7 @@ static struct shash_alg polyval_alg = { + .cra_driver_name = "polyval-clmulni", + .cra_priority = 200, + .cra_blocksize = POLYVAL_BLOCK_SIZE, +- .cra_ctxsize = sizeof(struct polyval_tfm_ctx), ++ .cra_ctxsize = POLYVAL_CTX_SIZE, + .cra_module = THIS_MODULE, + }, + }; +-- +2.38.1 + diff --git a/queue-6.0/drm-amd-display-revert-logic-for-plane-modifiers.patch b/queue-6.0/drm-amd-display-revert-logic-for-plane-modifiers.patch new file mode 100644 index 00000000000..8059caac5c4 --- /dev/null +++ b/queue-6.0/drm-amd-display-revert-logic-for-plane-modifiers.patch @@ -0,0 +1,110 @@ +From 809734c110548dca410fb0cca52e6b1540319f5e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Joaqu=C3=ADn=20Ignacio=20Aramend=C3=ADa?= + +Date: Mon, 24 Oct 2022 08:33:59 -0300 +Subject: drm/amd/display: Revert logic for plane modifiers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Joaquín Ignacio Aramendía + +commit 809734c110548dca410fb0cca52e6b1540319f5e upstream. + +This file was split in commit 5d945cbcd4b16a29d6470a80dfb19738f9a4319f +("drm/amd/display: Create a file dedicated to planes") and the logic in +dm_plane_format_mod_supported() function got changed by a switch logic. +That change broke drm_plane modifiers setting on series 5000 APUs +(tested on OXP mini AMD 5800U and HP Dev One 5850U PRO) +leading to Gamescope not working as reported on GitHub[1] + +To reproduce the issue, enter a TTY and run: + +$ gamescope -- vkcube + +With said commit applied it will abort. This one restores the old logic, +fixing the issue that affects Gamescope. + +[1](https://github.com/Plagman/gamescope/issues/624) + +Cc: # 6.0.x +Signed-off-by: Joaquín Ignacio Aramendía +Reviewed-by: Bas Nieuwenhuizen +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + .../amd/display/amdgpu_dm/amdgpu_dm_plane.c | 50 +++---------------- + 1 file changed, 7 insertions(+), 43 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c +index dfd3be49eac8..e6854f7270a6 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c +@@ -1369,7 +1369,7 @@ static bool dm_plane_format_mod_supported(struct drm_plane *plane, + { + struct amdgpu_device *adev = drm_to_adev(plane->dev); + const struct drm_format_info *info = drm_format_info(format); +- struct hw_asic_id asic_id = adev->dm.dc->ctx->asic_id; ++ int i; + + enum dm_micro_swizzle microtile = modifier_gfx9_swizzle_mode(modifier) & 3; + +@@ -1386,49 +1386,13 @@ static bool dm_plane_format_mod_supported(struct drm_plane *plane, + return true; + } + +- /* check if swizzle mode is supported by this version of DCN */ +- switch (asic_id.chip_family) { +- case FAMILY_SI: +- case FAMILY_CI: +- case FAMILY_KV: +- case FAMILY_CZ: +- case FAMILY_VI: +- /* asics before AI does not have modifier support */ +- return false; +- case FAMILY_AI: +- case FAMILY_RV: +- case FAMILY_NV: +- case FAMILY_VGH: +- case FAMILY_YELLOW_CARP: +- case AMDGPU_FAMILY_GC_10_3_6: +- case AMDGPU_FAMILY_GC_10_3_7: +- switch (AMD_FMT_MOD_GET(TILE, modifier)) { +- case AMD_FMT_MOD_TILE_GFX9_64K_R_X: +- case AMD_FMT_MOD_TILE_GFX9_64K_D_X: +- case AMD_FMT_MOD_TILE_GFX9_64K_S_X: +- case AMD_FMT_MOD_TILE_GFX9_64K_D: +- return true; +- default: +- return false; +- } +- break; +- case AMDGPU_FAMILY_GC_11_0_0: +- case AMDGPU_FAMILY_GC_11_0_1: +- switch (AMD_FMT_MOD_GET(TILE, modifier)) { +- case AMD_FMT_MOD_TILE_GFX11_256K_R_X: +- case AMD_FMT_MOD_TILE_GFX9_64K_R_X: +- case AMD_FMT_MOD_TILE_GFX9_64K_D_X: +- case AMD_FMT_MOD_TILE_GFX9_64K_S_X: +- case AMD_FMT_MOD_TILE_GFX9_64K_D: +- return true; +- default: +- return false; +- } +- break; +- default: +- ASSERT(0); /* Unknown asic */ +- break; ++ /* Check that the modifier is on the list of the plane's supported modifiers. */ ++ for (i = 0; i < plane->modifier_count; i++) { ++ if (modifier == plane->modifiers[i]) ++ break; + } ++ if (i == plane->modifier_count) ++ return false; + + /* + * For D swizzle the canonical modifier depends on the bpp, so check +-- +2.38.1 + diff --git a/queue-6.0/drm-amdgpu-disallow-gfxoff-until-gc-ip-blocks-complete-s2idle-resume.patch b/queue-6.0/drm-amdgpu-disallow-gfxoff-until-gc-ip-blocks-complete-s2idle-resume.patch new file mode 100644 index 00000000000..09180a4e8fb --- /dev/null +++ b/queue-6.0/drm-amdgpu-disallow-gfxoff-until-gc-ip-blocks-complete-s2idle-resume.patch @@ -0,0 +1,55 @@ +From d61e1d1d5225a9baeb995bcbdb904f66f70ed87e Mon Sep 17 00:00:00 2001 +From: Prike Liang +Date: Fri, 21 Oct 2022 10:04:40 +0800 +Subject: drm/amdgpu: disallow gfxoff until GC IP blocks complete s2idle resume + +From: Prike Liang + +commit d61e1d1d5225a9baeb995bcbdb904f66f70ed87e upstream. + +In the S2idle suspend/resume phase the gfxoff is keeping functional so +some IP blocks will be likely to reinitialize at gfxoff entry and that +will result in failing to program GC registers.Therefore, let disallow +gfxoff until AMDGPU IPs reinitialized completely. + +Signed-off-by: Prike Liang +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 5.15.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -3208,6 +3208,15 @@ static int amdgpu_device_ip_resume_phase + return r; + } + adev->ip_blocks[i].status.hw = true; ++ ++ if (adev->in_s0ix && adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_SMC) { ++ /* disable gfxoff for IP resume. The gfxoff will be re-enabled in ++ * amdgpu_device_resume() after IP resume. ++ */ ++ amdgpu_gfx_off_ctrl(adev, false); ++ DRM_DEBUG("will disable gfxoff for re-initializing other blocks\n"); ++ } ++ + } + + return 0; +@@ -4180,6 +4189,13 @@ int amdgpu_device_resume(struct drm_devi + /* Make sure IB tests flushed */ + flush_delayed_work(&adev->delayed_init_work); + ++ if (adev->in_s0ix) { ++ /* re-enable gfxoff after IP resume. This re-enables gfxoff after ++ * it was disabled for IP resume in amdgpu_device_ip_resume_phase2(). ++ */ ++ amdgpu_gfx_off_ctrl(adev, true); ++ DRM_DEBUG("will enable gfxoff for the mission mode\n"); ++ } + if (fbcon) + drm_fb_helper_set_suspend_unlocked(adev_to_drm(adev)->fb_helper, false); + diff --git a/queue-6.0/drm-amdgpu-fix-pstate-setting-issue.patch b/queue-6.0/drm-amdgpu-fix-pstate-setting-issue.patch new file mode 100644 index 00000000000..b3f5d8ab2de --- /dev/null +++ b/queue-6.0/drm-amdgpu-fix-pstate-setting-issue.patch @@ -0,0 +1,50 @@ +From 79610d3041338dc1ef554d6fd8b3b3e23be527f5 Mon Sep 17 00:00:00 2001 +From: Chengming Gui +Date: Tue, 18 Oct 2022 17:31:38 +0800 +Subject: drm/amdgpu: fix pstate setting issue + +From: Chengming Gui + +commit 79610d3041338dc1ef554d6fd8b3b3e23be527f5 upstream. + +[WHY] +0, original pstate X +1, ctx_A_create -> ctx_A->stable_pstate = X +2, ctx_A_set_pstate (Y) -> current pstate is Y (PEAK or STANDARD) +3, ctx_B_create -> ctx_B->stable_pstate = Y +4, ctx_A_destroy -> restore pstate to X +5, ctx_B_destroy -> restore pstate to Y +Above sequence will cause final pstate is wrong (Y), should be original X. + +[HOW] +When ctx_B create, +if ctx_A touched pstate setting +(not auto, stable_pstate_ctx != NULL), +set ctx_B->stable_pstate the same value as ctx_A saved, +if stable_pstate_ctx == NULL, +fetch current pstate to fill +ctx_B->stable_pstate. + +Signed-off-by: Chengming Gui +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c +@@ -327,7 +327,10 @@ static int amdgpu_ctx_init(struct amdgpu + if (r) + return r; + +- ctx->stable_pstate = current_stable_pstate; ++ if (mgr->adev->pm.stable_pstate_ctx) ++ ctx->stable_pstate = mgr->adev->pm.stable_pstate_ctx->stable_pstate; ++ else ++ ctx->stable_pstate = current_stable_pstate; + + return 0; + } diff --git a/queue-6.0/drm-amdgpu-remove-atc-l2-access-for-mmhub-2.1.x.patch b/queue-6.0/drm-amdgpu-remove-atc-l2-access-for-mmhub-2.1.x.patch new file mode 100644 index 00000000000..12501d7e753 --- /dev/null +++ b/queue-6.0/drm-amdgpu-remove-atc-l2-access-for-mmhub-2.1.x.patch @@ -0,0 +1,100 @@ +From d2c4c1569a7d7d5c8f75963bf2d62d7aeac30e2a Mon Sep 17 00:00:00 2001 +From: Lijo Lazar +Date: Fri, 30 Sep 2022 10:43:08 +0530 +Subject: drm/amdgpu: Remove ATC L2 access for MMHUB 2.1.x + +From: Lijo Lazar + +commit d2c4c1569a7d7d5c8f75963bf2d62d7aeac30e2a upstream. + +MMHUB 2.1.x versions don't have ATCL2. Remove accesses to ATCL2 registers. + +Since they are non-existing registers, read access will cause a +'Completer Abort' and gets reported when AER is enabled with the below patch. +Tagging with the patch so that this is backported along with it. + +v2: squash in uninitialized warning fix (Nathan Chancellor) + +Fixes: 8795e182b02d ("PCI/portdrv: Don't disable AER reporting in get_port_device_capability()") + +Signed-off-by: Lijo Lazar +Reviewed-by: Guchun Chen +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c | 28 ++++++++-------------------- + 1 file changed, 8 insertions(+), 20 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c +@@ -32,8 +32,6 @@ + #include "gc/gc_10_1_0_offset.h" + #include "soc15_common.h" + +-#define mmMM_ATC_L2_MISC_CG_Sienna_Cichlid 0x064d +-#define mmMM_ATC_L2_MISC_CG_Sienna_Cichlid_BASE_IDX 0 + #define mmDAGB0_CNTL_MISC2_Sienna_Cichlid 0x0070 + #define mmDAGB0_CNTL_MISC2_Sienna_Cichlid_BASE_IDX 0 + +@@ -574,7 +572,6 @@ static void mmhub_v2_0_update_medium_gra + case IP_VERSION(2, 1, 0): + case IP_VERSION(2, 1, 1): + case IP_VERSION(2, 1, 2): +- def = data = RREG32_SOC15(MMHUB, 0, mmMM_ATC_L2_MISC_CG_Sienna_Cichlid); + def1 = data1 = RREG32_SOC15(MMHUB, 0, mmDAGB0_CNTL_MISC2_Sienna_Cichlid); + break; + default: +@@ -608,8 +605,6 @@ static void mmhub_v2_0_update_medium_gra + case IP_VERSION(2, 1, 0): + case IP_VERSION(2, 1, 1): + case IP_VERSION(2, 1, 2): +- if (def != data) +- WREG32_SOC15(MMHUB, 0, mmMM_ATC_L2_MISC_CG_Sienna_Cichlid, data); + if (def1 != data1) + WREG32_SOC15(MMHUB, 0, mmDAGB0_CNTL_MISC2_Sienna_Cichlid, data1); + break; +@@ -634,8 +629,8 @@ static void mmhub_v2_0_update_medium_gra + case IP_VERSION(2, 1, 0): + case IP_VERSION(2, 1, 1): + case IP_VERSION(2, 1, 2): +- def = data = RREG32_SOC15(MMHUB, 0, mmMM_ATC_L2_MISC_CG_Sienna_Cichlid); +- break; ++ /* There is no ATCL2 in MMHUB for 2.1.x */ ++ return; + default: + def = data = RREG32_SOC15(MMHUB, 0, mmMM_ATC_L2_MISC_CG); + break; +@@ -646,18 +641,8 @@ static void mmhub_v2_0_update_medium_gra + else + data &= ~MM_ATC_L2_MISC_CG__MEM_LS_ENABLE_MASK; + +- if (def != data) { +- switch (adev->ip_versions[MMHUB_HWIP][0]) { +- case IP_VERSION(2, 1, 0): +- case IP_VERSION(2, 1, 1): +- case IP_VERSION(2, 1, 2): +- WREG32_SOC15(MMHUB, 0, mmMM_ATC_L2_MISC_CG_Sienna_Cichlid, data); +- break; +- default: +- WREG32_SOC15(MMHUB, 0, mmMM_ATC_L2_MISC_CG, data); +- break; +- } +- } ++ if (def != data) ++ WREG32_SOC15(MMHUB, 0, mmMM_ATC_L2_MISC_CG, data); + } + + static int mmhub_v2_0_set_clockgating(struct amdgpu_device *adev, +@@ -695,7 +680,10 @@ static void mmhub_v2_0_get_clockgating(s + case IP_VERSION(2, 1, 0): + case IP_VERSION(2, 1, 1): + case IP_VERSION(2, 1, 2): +- data = RREG32_SOC15(MMHUB, 0, mmMM_ATC_L2_MISC_CG_Sienna_Cichlid); ++ /* There is no ATCL2 in MMHUB for 2.1.x. Keep the status ++ * based on DAGB ++ */ ++ data = MM_ATC_L2_MISC_CG__ENABLE_MASK; + data1 = RREG32_SOC15(MMHUB, 0, mmDAGB0_CNTL_MISC2_Sienna_Cichlid); + break; + default: diff --git a/queue-6.0/drm-amdkfd-correct-the-cache-info-for-gfx1036.patch b/queue-6.0/drm-amdkfd-correct-the-cache-info-for-gfx1036.patch new file mode 100644 index 00000000000..5a3b80bf3a6 --- /dev/null +++ b/queue-6.0/drm-amdkfd-correct-the-cache-info-for-gfx1036.patch @@ -0,0 +1,94 @@ +From 969758bbf5e9360b63bbb2328ac3fda46bbbc9f5 Mon Sep 17 00:00:00 2001 +From: Jesse Zhang +Date: Tue, 11 Oct 2022 05:23:10 +0000 +Subject: drm/amdkfd: correct the cache info for gfx1036 + +From: Jesse Zhang + +commit 969758bbf5e9360b63bbb2328ac3fda46bbbc9f5 upstream. + +correct the cache information for gfx1036 + +Acked-by: Alex Deucher +Reviewed-by: Yifan Zhang +Signed-off-by: Yifan Zhang +Signed-off-by: Jesse Zhang +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 53 +++++++++++++++++++++++++++++++++- + 1 file changed, 52 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c +@@ -843,6 +843,54 @@ static struct kfd_gpu_cache_info gfx1037 + }, + }; + ++static struct kfd_gpu_cache_info gc_10_3_6_cache_info[] = { ++ { ++ /* TCP L1 Cache per CU */ ++ .cache_size = 16, ++ .cache_level = 1, ++ .flags = (CRAT_CACHE_FLAGS_ENABLED | ++ CRAT_CACHE_FLAGS_DATA_CACHE | ++ CRAT_CACHE_FLAGS_SIMD_CACHE), ++ .num_cu_shared = 1, ++ }, ++ { ++ /* Scalar L1 Instruction Cache per SQC */ ++ .cache_size = 32, ++ .cache_level = 1, ++ .flags = (CRAT_CACHE_FLAGS_ENABLED | ++ CRAT_CACHE_FLAGS_INST_CACHE | ++ CRAT_CACHE_FLAGS_SIMD_CACHE), ++ .num_cu_shared = 2, ++ }, ++ { ++ /* Scalar L1 Data Cache per SQC */ ++ .cache_size = 16, ++ .cache_level = 1, ++ .flags = (CRAT_CACHE_FLAGS_ENABLED | ++ CRAT_CACHE_FLAGS_DATA_CACHE | ++ CRAT_CACHE_FLAGS_SIMD_CACHE), ++ .num_cu_shared = 2, ++ }, ++ { ++ /* GL1 Data Cache per SA */ ++ .cache_size = 128, ++ .cache_level = 1, ++ .flags = (CRAT_CACHE_FLAGS_ENABLED | ++ CRAT_CACHE_FLAGS_DATA_CACHE | ++ CRAT_CACHE_FLAGS_SIMD_CACHE), ++ .num_cu_shared = 2, ++ }, ++ { ++ /* L2 Data Cache per GPU (Total Tex Cache) */ ++ .cache_size = 256, ++ .cache_level = 2, ++ .flags = (CRAT_CACHE_FLAGS_ENABLED | ++ CRAT_CACHE_FLAGS_DATA_CACHE | ++ CRAT_CACHE_FLAGS_SIMD_CACHE), ++ .num_cu_shared = 2, ++ }, ++}; ++ + static void kfd_populated_cu_info_cpu(struct kfd_topology_device *dev, + struct crat_subtype_computeunit *cu) + { +@@ -1562,10 +1610,13 @@ static int kfd_fill_gpu_cache_info(struc + num_of_cache_types = ARRAY_SIZE(beige_goby_cache_info); + break; + case IP_VERSION(10, 3, 3): +- case IP_VERSION(10, 3, 6): /* TODO: Double check these on production silicon */ + pcache_info = yellow_carp_cache_info; + num_of_cache_types = ARRAY_SIZE(yellow_carp_cache_info); + break; ++ case IP_VERSION(10, 3, 6): ++ pcache_info = gc_10_3_6_cache_info; ++ num_of_cache_types = ARRAY_SIZE(gc_10_3_6_cache_info); ++ break; + case IP_VERSION(10, 3, 7): + pcache_info = gfx1037_cache_info; + num_of_cache_types = ARRAY_SIZE(gfx1037_cache_info); diff --git a/queue-6.0/drm-amdkfd-update-gfx1037-lx-cache-setting.patch b/queue-6.0/drm-amdkfd-update-gfx1037-lx-cache-setting.patch new file mode 100644 index 00000000000..b7ae5658a38 --- /dev/null +++ b/queue-6.0/drm-amdkfd-update-gfx1037-lx-cache-setting.patch @@ -0,0 +1,92 @@ +From 9656db1b933caf6ffaaef10322093fe018359090 Mon Sep 17 00:00:00 2001 +From: Prike Liang +Date: Thu, 20 Oct 2022 14:44:26 +0800 +Subject: drm/amdkfd: update gfx1037 Lx cache setting + +From: Prike Liang + +commit 9656db1b933caf6ffaaef10322093fe018359090 upstream. + +Update the gfx1037 L1/L2 cache setting. + +Signed-off-by: Prike Liang +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 53 +++++++++++++++++++++++++++++++++- + 1 file changed, 52 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c +@@ -795,6 +795,54 @@ static struct kfd_gpu_cache_info yellow_ + }, + }; + ++static struct kfd_gpu_cache_info gfx1037_cache_info[] = { ++ { ++ /* TCP L1 Cache per CU */ ++ .cache_size = 16, ++ .cache_level = 1, ++ .flags = (CRAT_CACHE_FLAGS_ENABLED | ++ CRAT_CACHE_FLAGS_DATA_CACHE | ++ CRAT_CACHE_FLAGS_SIMD_CACHE), ++ .num_cu_shared = 1, ++ }, ++ { ++ /* Scalar L1 Instruction Cache per SQC */ ++ .cache_size = 32, ++ .cache_level = 1, ++ .flags = (CRAT_CACHE_FLAGS_ENABLED | ++ CRAT_CACHE_FLAGS_INST_CACHE | ++ CRAT_CACHE_FLAGS_SIMD_CACHE), ++ .num_cu_shared = 2, ++ }, ++ { ++ /* Scalar L1 Data Cache per SQC */ ++ .cache_size = 16, ++ .cache_level = 1, ++ .flags = (CRAT_CACHE_FLAGS_ENABLED | ++ CRAT_CACHE_FLAGS_DATA_CACHE | ++ CRAT_CACHE_FLAGS_SIMD_CACHE), ++ .num_cu_shared = 2, ++ }, ++ { ++ /* GL1 Data Cache per SA */ ++ .cache_size = 128, ++ .cache_level = 1, ++ .flags = (CRAT_CACHE_FLAGS_ENABLED | ++ CRAT_CACHE_FLAGS_DATA_CACHE | ++ CRAT_CACHE_FLAGS_SIMD_CACHE), ++ .num_cu_shared = 2, ++ }, ++ { ++ /* L2 Data Cache per GPU (Total Tex Cache) */ ++ .cache_size = 256, ++ .cache_level = 2, ++ .flags = (CRAT_CACHE_FLAGS_ENABLED | ++ CRAT_CACHE_FLAGS_DATA_CACHE | ++ CRAT_CACHE_FLAGS_SIMD_CACHE), ++ .num_cu_shared = 2, ++ }, ++}; ++ + static void kfd_populated_cu_info_cpu(struct kfd_topology_device *dev, + struct crat_subtype_computeunit *cu) + { +@@ -1515,10 +1563,13 @@ static int kfd_fill_gpu_cache_info(struc + break; + case IP_VERSION(10, 3, 3): + case IP_VERSION(10, 3, 6): /* TODO: Double check these on production silicon */ +- case IP_VERSION(10, 3, 7): /* TODO: Double check these on production silicon */ + pcache_info = yellow_carp_cache_info; + num_of_cache_types = ARRAY_SIZE(yellow_carp_cache_info); + break; ++ case IP_VERSION(10, 3, 7): ++ pcache_info = gfx1037_cache_info; ++ num_of_cache_types = ARRAY_SIZE(gfx1037_cache_info); ++ break; + case IP_VERSION(11, 0, 0): + case IP_VERSION(11, 0, 1): + case IP_VERSION(11, 0, 2): diff --git a/queue-6.0/drm-i915-extend-wa_1607297627-to-alderlake-p.patch b/queue-6.0/drm-i915-extend-wa_1607297627-to-alderlake-p.patch new file mode 100644 index 00000000000..387a690850b --- /dev/null +++ b/queue-6.0/drm-i915-extend-wa_1607297627-to-alderlake-p.patch @@ -0,0 +1,50 @@ +From 1a3abd12a394f5c66943fee75cef533069e831fb Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jos=C3=A9=20Roberto=20de=20Souza?= +Date: Mon, 17 Oct 2022 06:24:32 -0700 +Subject: drm/i915: Extend Wa_1607297627 to Alderlake-P +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: José Roberto de Souza + +commit 1a3abd12a394f5c66943fee75cef533069e831fb upstream. + +Workaround 1607297627 was missed for Alderlake-P, so here extending it +to it and adding the fixes tag so this WA is backported to all +stable kernels. + +v2: +- fixed subject +- added Fixes tag + +BSpec: 54369 +Cc: # v5.17+ +Fixes: dfb924e33927 ("drm/i915/adlp: Remove require_force_probe protection") +Reviewed-by: Lucas De Marchi +Cc: Tvrtko Ursulin +Signed-off-by: José Roberto de Souza +Link: https://patchwork.freedesktop.org/patch/msgid/20221017132432.112850-1-jose.souza@intel.com +(cherry picked from commit 847eec69f01a28ca44f5ac7e1d71d3a60263d680) +Signed-off-by: Tvrtko Ursulin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/gt/intel_workarounds.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c ++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c +@@ -2301,11 +2301,11 @@ rcs_engine_wa_init(struct intel_engine_c + } + + if (IS_DG1_GRAPHICS_STEP(i915, STEP_A0, STEP_B0) || +- IS_ROCKETLAKE(i915) || IS_TIGERLAKE(i915)) { ++ IS_ROCKETLAKE(i915) || IS_TIGERLAKE(i915) || IS_ALDERLAKE_P(i915)) { + /* + * Wa_1607030317:tgl + * Wa_1607186500:tgl +- * Wa_1607297627:tgl,rkl,dg1[a0] ++ * Wa_1607297627:tgl,rkl,dg1[a0],adlp + * + * On TGL and RKL there are multiple entries for this WA in the + * BSpec; some indicate this is an A0-only WA, others indicate diff --git a/queue-6.0/drm-msm-dp-fix-aux-bus-ep-lifetime.patch b/queue-6.0/drm-msm-dp-fix-aux-bus-ep-lifetime.patch new file mode 100644 index 00000000000..41aa76c74a7 --- /dev/null +++ b/queue-6.0/drm-msm-dp-fix-aux-bus-ep-lifetime.patch @@ -0,0 +1,74 @@ +From 2b57f726611e294dc4297dd48eb8c98ef1938e82 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 13 Sep 2022 10:53:16 +0200 +Subject: drm/msm/dp: fix aux-bus EP lifetime + +From: Johan Hovold + +commit 2b57f726611e294dc4297dd48eb8c98ef1938e82 upstream. + +Device-managed resources allocated post component bind must be tied to +the lifetime of the aggregate DRM device or they will not necessarily be +released when binding of the aggregate device is deferred. + +This can lead resource leaks or failure to bind the aggregate device +when binding is later retried and a second attempt to allocate the +resources is made. + +For the DP aux-bus, an attempt to populate the bus a second time will +simply fail ("DP AUX EP device already populated"). + +Fix this by tying the lifetime of the EP device to the DRM device rather +than DP controller platform device. + +Fixes: c3bf8e21b38a ("drm/msm/dp: Add eDP support via aux_bus") +Cc: stable@vger.kernel.org # 5.19 +Signed-off-by: Johan Hovold +Reviewed-by: Douglas Anderson +Tested-by: Kuogee Hsieh +Reviewed-by: Kuogee Hsieh +Patchwork: https://patchwork.freedesktop.org/patch/502672/ +Link: https://lore.kernel.org/r/20220913085320.8577-7-johan+linaro@kernel.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/dp/dp_display.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c +index 352cc09f2069..42de690132cf 100644 +--- a/drivers/gpu/drm/msm/dp/dp_display.c ++++ b/drivers/gpu/drm/msm/dp/dp_display.c +@@ -1528,6 +1528,11 @@ void msm_dp_debugfs_init(struct msm_dp *dp_display, struct drm_minor *minor) + } + } + ++static void of_dp_aux_depopulate_bus_void(void *data) ++{ ++ of_dp_aux_depopulate_bus(data); ++} ++ + static int dp_display_get_next_bridge(struct msm_dp *dp) + { + int rc; +@@ -1552,10 +1557,16 @@ static int dp_display_get_next_bridge(struct msm_dp *dp) + * panel driver is probed asynchronously but is the best we + * can do without a bigger driver reorganization. + */ +- rc = devm_of_dp_aux_populate_ep_devices(dp_priv->aux); ++ rc = of_dp_aux_populate_bus(dp_priv->aux, NULL); + of_node_put(aux_bus); + if (rc) + goto error; ++ ++ rc = devm_add_action_or_reset(dp->drm_dev->dev, ++ of_dp_aux_depopulate_bus_void, ++ dp_priv->aux); ++ if (rc) ++ goto error; + } else if (dp->is_edp) { + DRM_ERROR("eDP aux_bus not found\n"); + return -ENODEV; +-- +2.38.1 + diff --git a/queue-6.0/drm-msm-dp-fix-bridge-lifetime.patch b/queue-6.0/drm-msm-dp-fix-bridge-lifetime.patch new file mode 100644 index 00000000000..a24229dc9c3 --- /dev/null +++ b/queue-6.0/drm-msm-dp-fix-bridge-lifetime.patch @@ -0,0 +1,98 @@ +From 16194958f888d63839042d1190f7001e5ddec47b Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 13 Sep 2022 10:53:17 +0200 +Subject: drm/msm/dp: fix bridge lifetime + +From: Johan Hovold + +commit 16194958f888d63839042d1190f7001e5ddec47b upstream. + +Device-managed resources allocated post component bind must be tied to +the lifetime of the aggregate DRM device or they will not necessarily be +released when binding of the aggregate device is deferred. + +This can lead resource leaks or failure to bind the aggregate device +when binding is later retried and a second attempt to allocate the +resources is made. + +For the DP bridges, previously allocated bridges will leak on probe +deferral. + +Fix this by amending the DP parser interface and tying the lifetime of +the bridge device to the DRM device rather than DP platform device. + +Fixes: c3bf8e21b38a ("drm/msm/dp: Add eDP support via aux_bus") +Cc: stable@vger.kernel.org # 5.19 +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Johan Hovold +Tested-by: Kuogee Hsieh +Reviewed-by: Kuogee Hsieh +Patchwork: https://patchwork.freedesktop.org/patch/502667/ +Link: https://lore.kernel.org/r/20220913085320.8577-8-johan+linaro@kernel.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/dp/dp_display.c | 2 +- + drivers/gpu/drm/msm/dp/dp_parser.c | 6 +++--- + drivers/gpu/drm/msm/dp/dp_parser.h | 5 +++-- + 3 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c +index 42de690132cf..a49f6dbbe888 100644 +--- a/drivers/gpu/drm/msm/dp/dp_display.c ++++ b/drivers/gpu/drm/msm/dp/dp_display.c +@@ -1579,7 +1579,7 @@ static int dp_display_get_next_bridge(struct msm_dp *dp) + * For DisplayPort interfaces external bridges are optional, so + * silently ignore an error if one is not present (-ENODEV). + */ +- rc = dp_parser_find_next_bridge(dp_priv->parser); ++ rc = devm_dp_parser_find_next_bridge(dp->drm_dev->dev, dp_priv->parser); + if (!dp->is_edp && rc == -ENODEV) + return 0; + +diff --git a/drivers/gpu/drm/msm/dp/dp_parser.c b/drivers/gpu/drm/msm/dp/dp_parser.c +index dd732215d55b..dcbe893d66d7 100644 +--- a/drivers/gpu/drm/msm/dp/dp_parser.c ++++ b/drivers/gpu/drm/msm/dp/dp_parser.c +@@ -240,12 +240,12 @@ static int dp_parser_clock(struct dp_parser *parser) + return 0; + } + +-int dp_parser_find_next_bridge(struct dp_parser *parser) ++int devm_dp_parser_find_next_bridge(struct device *dev, struct dp_parser *parser) + { +- struct device *dev = &parser->pdev->dev; ++ struct platform_device *pdev = parser->pdev; + struct drm_bridge *bridge; + +- bridge = devm_drm_of_get_bridge(dev, dev->of_node, 1, 0); ++ bridge = devm_drm_of_get_bridge(dev, pdev->dev.of_node, 1, 0); + if (IS_ERR(bridge)) + return PTR_ERR(bridge); + +diff --git a/drivers/gpu/drm/msm/dp/dp_parser.h b/drivers/gpu/drm/msm/dp/dp_parser.h +index 866c1a82bf1a..d30ab773db46 100644 +--- a/drivers/gpu/drm/msm/dp/dp_parser.h ++++ b/drivers/gpu/drm/msm/dp/dp_parser.h +@@ -138,8 +138,9 @@ struct dp_parser { + struct dp_parser *dp_parser_get(struct platform_device *pdev); + + /** +- * dp_parser_find_next_bridge() - find an additional bridge to DP ++ * devm_dp_parser_find_next_bridge() - find an additional bridge to DP + * ++ * @dev: device to tie bridge lifetime to + * @parser: dp_parser data from client + * + * This function is used to find any additional bridge attached to +@@ -147,6 +148,6 @@ struct dp_parser *dp_parser_get(struct platform_device *pdev); + * + * Return: 0 if able to get the bridge, otherwise negative errno for failure. + */ +-int dp_parser_find_next_bridge(struct dp_parser *parser); ++int devm_dp_parser_find_next_bridge(struct device *dev, struct dp_parser *parser); + + #endif +-- +2.38.1 + diff --git a/queue-6.0/drm-msm-dp-fix-irq-lifetime.patch b/queue-6.0/drm-msm-dp-fix-irq-lifetime.patch new file mode 100644 index 00000000000..8052259c0a5 --- /dev/null +++ b/queue-6.0/drm-msm-dp-fix-irq-lifetime.patch @@ -0,0 +1,49 @@ +From a79343dcaba4b11adb57350e0b6426906a9b658e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 13 Sep 2022 10:53:15 +0200 +Subject: drm/msm/dp: fix IRQ lifetime + +From: Johan Hovold + +commit a79343dcaba4b11adb57350e0b6426906a9b658e upstream. + +Device-managed resources allocated post component bind must be tied to +the lifetime of the aggregate DRM device or they will not necessarily be +released when binding of the aggregate device is deferred. + +This is specifically true for the DP IRQ, which will otherwise remain +requested so that the next bind attempt fails when requesting the IRQ a +second time. + +Since commit c3bf8e21b38a ("drm/msm/dp: Add eDP support via aux_bus") +this can happen when the aux-bus panel driver has not yet been loaded so +that probe is deferred. + +Fix this by tying the device-managed lifetime of the DP IRQ to the DRM +device so that it is released when bind fails. + +Fixes: c943b4948b58 ("drm/msm/dp: add displayPort driver support") +Cc: stable@vger.kernel.org # 5.10 +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Johan Hovold +Tested-by: Kuogee Hsieh +Reviewed-by: Kuogee Hsieh +Patchwork: https://patchwork.freedesktop.org/patch/502679/ +Link: https://lore.kernel.org/r/20220913085320.8577-6-johan+linaro@kernel.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/dp/dp_display.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/msm/dp/dp_display.c ++++ b/drivers/gpu/drm/msm/dp/dp_display.c +@@ -1249,7 +1249,7 @@ int dp_display_request_irq(struct msm_dp + return -EINVAL; + } + +- rc = devm_request_irq(&dp->pdev->dev, dp->irq, ++ rc = devm_request_irq(dp_display->drm_dev->dev, dp->irq, + dp_display_irq_handler, + IRQF_TRIGGER_HIGH, "dp_display_isr", dp); + if (rc < 0) { diff --git a/queue-6.0/drm-msm-dp-fix-memory-corruption-with-too-many-bridges.patch b/queue-6.0/drm-msm-dp-fix-memory-corruption-with-too-many-bridges.patch new file mode 100644 index 00000000000..c0efa1076ba --- /dev/null +++ b/queue-6.0/drm-msm-dp-fix-memory-corruption-with-too-many-bridges.patch @@ -0,0 +1,47 @@ +From 74466e46e7543c7f74f1502181e9ba93f7521374 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 13 Sep 2022 10:53:12 +0200 +Subject: drm/msm/dp: fix memory corruption with too many bridges + +From: Johan Hovold + +commit 74466e46e7543c7f74f1502181e9ba93f7521374 upstream. + +Add the missing sanity check on the bridge counter to avoid corrupting +data beyond the fixed-sized bridge array in case there are ever more +than eight bridges. + +Fixes: 8a3b4c17f863 ("drm/msm/dp: employ bridge mechanism for display enable and disable") +Cc: stable@vger.kernel.org # 5.17 +Signed-off-by: Johan Hovold +Tested-by: Kuogee Hsieh +Reviewed-by: Kuogee Hsieh +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/502664/ +Link: https://lore.kernel.org/r/20220913085320.8577-3-johan+linaro@kernel.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/dp/dp_display.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c +index bfd0aeff3f0d..be9ed891dc3f 100644 +--- a/drivers/gpu/drm/msm/dp/dp_display.c ++++ b/drivers/gpu/drm/msm/dp/dp_display.c +@@ -1597,6 +1597,12 @@ int msm_dp_modeset_init(struct msm_dp *dp_display, struct drm_device *dev, + return -EINVAL; + + priv = dev->dev_private; ++ ++ if (priv->num_bridges == ARRAY_SIZE(priv->bridges)) { ++ DRM_DEV_ERROR(dev->dev, "too many bridges\n"); ++ return -ENOSPC; ++ } ++ + dp_display->drm_dev = dev; + + dp_priv = container_of(dp_display, struct dp_display_private, dp_display); +-- +2.38.1 + diff --git a/queue-6.0/drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch b/queue-6.0/drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch new file mode 100644 index 00000000000..e9d0f495ee1 --- /dev/null +++ b/queue-6.0/drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch @@ -0,0 +1,42 @@ +From 2e786eb2f9cebb07e317226b60054df510b60c65 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 13 Sep 2022 10:53:13 +0200 +Subject: drm/msm/dsi: fix memory corruption with too many bridges + +From: Johan Hovold + +commit 2e786eb2f9cebb07e317226b60054df510b60c65 upstream. + +Add the missing sanity check on the bridge counter to avoid corrupting +data beyond the fixed-sized bridge array in case there are ever more +than eight bridges. + +Fixes: a689554ba6ed ("drm/msm: Initial add DSI connector support") +Cc: stable@vger.kernel.org # 4.1 +Signed-off-by: Johan Hovold +Tested-by: Kuogee Hsieh +Reviewed-by: Kuogee Hsieh +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/502668/ +Link: https://lore.kernel.org/r/20220913085320.8577-4-johan+linaro@kernel.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/dsi/dsi.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/gpu/drm/msm/dsi/dsi.c ++++ b/drivers/gpu/drm/msm/dsi/dsi.c +@@ -227,6 +227,12 @@ int msm_dsi_modeset_init(struct msm_dsi + return -EINVAL; + + priv = dev->dev_private; ++ ++ if (priv->num_bridges == ARRAY_SIZE(priv->bridges)) { ++ DRM_DEV_ERROR(dev->dev, "too many bridges\n"); ++ return -ENOSPC; ++ } ++ + msm_dsi->dev = dev; + + ret = msm_dsi_host_modeset_init(msm_dsi->host, dev); diff --git a/queue-6.0/drm-msm-fix-use-after-free-on-probe-deferral.patch b/queue-6.0/drm-msm-fix-use-after-free-on-probe-deferral.patch new file mode 100644 index 00000000000..9391e897d8a --- /dev/null +++ b/queue-6.0/drm-msm-fix-use-after-free-on-probe-deferral.patch @@ -0,0 +1,41 @@ +From 6808abdb33bf90330e70a687d29f038507e06ebb Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 13 Sep 2022 10:53:11 +0200 +Subject: drm/msm: fix use-after-free on probe deferral + +From: Johan Hovold + +commit 6808abdb33bf90330e70a687d29f038507e06ebb upstream. + +The bridge counter was never reset when tearing down the DRM device so +that stale pointers to deallocated structures would be accessed on the +next tear down (e.g. after a second late bind deferral). + +Given enough bridges and a few probe deferrals this could currently also +lead to data beyond the bridge array being corrupted. + +Fixes: d28ea556267c ("drm/msm: properly add and remove internal bridges") +Fixes: a3376e3ec81c ("drm/msm: convert to drm_bridge") +Cc: stable@vger.kernel.org # 3.12 +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Johan Hovold +Tested-by: Kuogee Hsieh +Reviewed-by: Kuogee Hsieh +Patchwork: https://patchwork.freedesktop.org/patch/502665/ +Link: https://lore.kernel.org/r/20220913085320.8577-2-johan+linaro@kernel.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/msm_drv.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/msm/msm_drv.c ++++ b/drivers/gpu/drm/msm/msm_drv.c +@@ -241,6 +241,7 @@ static int msm_drm_uninit(struct device + + for (i = 0; i < priv->num_bridges; i++) + drm_bridge_remove(priv->bridges[i]); ++ priv->num_bridges = 0; + + pm_runtime_get_sync(dev); + msm_irq_uninstall(ddev); diff --git a/queue-6.0/drm-msm-hdmi-fix-irq-lifetime.patch b/queue-6.0/drm-msm-hdmi-fix-irq-lifetime.patch new file mode 100644 index 00000000000..1fcb5af2020 --- /dev/null +++ b/queue-6.0/drm-msm-hdmi-fix-irq-lifetime.patch @@ -0,0 +1,45 @@ +From 152d394842bb564148e68b92486a87db0bf54859 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 13 Sep 2022 10:53:18 +0200 +Subject: drm/msm/hdmi: fix IRQ lifetime + +From: Johan Hovold + +commit 152d394842bb564148e68b92486a87db0bf54859 upstream. + +Device-managed resources allocated post component bind must be tied to +the lifetime of the aggregate DRM device or they will not necessarily be +released when binding of the aggregate device is deferred. + +This is specifically true for the HDMI IRQ, which will otherwise remain +requested so that the next bind attempt fails when requesting the IRQ a +second time. + +Fix this by tying the device-managed lifetime of the HDMI IRQ to the DRM +device so that it is released when bind fails. + +Fixes: 067fef372c73 ("drm/msm/hdmi: refactor bind/init") +Cc: stable@vger.kernel.org # 3.19 +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Johan Hovold +Tested-by: Kuogee Hsieh +Reviewed-by: Kuogee Hsieh +Patchwork: https://patchwork.freedesktop.org/patch/502666/ +Link: https://lore.kernel.org/r/20220913085320.8577-9-johan+linaro@kernel.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/hdmi/hdmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/msm/hdmi/hdmi.c ++++ b/drivers/gpu/drm/msm/hdmi/hdmi.c +@@ -344,7 +344,7 @@ int msm_hdmi_modeset_init(struct hdmi *h + goto fail; + } + +- ret = devm_request_irq(&pdev->dev, hdmi->irq, ++ ret = devm_request_irq(dev->dev, hdmi->irq, + msm_hdmi_irq, IRQF_TRIGGER_HIGH, + "hdmi_isr", hdmi); + if (ret < 0) { diff --git a/queue-6.0/drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch b/queue-6.0/drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch new file mode 100644 index 00000000000..283b2c720fe --- /dev/null +++ b/queue-6.0/drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch @@ -0,0 +1,41 @@ +From 4c1294da6aed1f16d47a417dcfe6602833c3c95c Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 13 Sep 2022 10:53:14 +0200 +Subject: drm/msm/hdmi: fix memory corruption with too many bridges + +From: Johan Hovold + +commit 4c1294da6aed1f16d47a417dcfe6602833c3c95c upstream. + +Add the missing sanity check on the bridge counter to avoid corrupting +data beyond the fixed-sized bridge array in case there are ever more +than eight bridges. + +Fixes: a3376e3ec81c ("drm/msm: convert to drm_bridge") +Cc: stable@vger.kernel.org # 3.12 +Signed-off-by: Johan Hovold +Tested-by: Kuogee Hsieh +Reviewed-by: Kuogee Hsieh +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/502670/ +Link: https://lore.kernel.org/r/20220913085320.8577-5-johan+linaro@kernel.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/hdmi/hdmi.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/gpu/drm/msm/hdmi/hdmi.c ++++ b/drivers/gpu/drm/msm/hdmi/hdmi.c +@@ -300,6 +300,11 @@ int msm_hdmi_modeset_init(struct hdmi *h + struct platform_device *pdev = hdmi->pdev; + int ret; + ++ if (priv->num_bridges == ARRAY_SIZE(priv->bridges)) { ++ DRM_DEV_ERROR(dev->dev, "too many bridges\n"); ++ return -ENOSPC; ++ } ++ + hdmi->dev = dev; + hdmi->encoder = encoder; + diff --git a/queue-6.0/series b/queue-6.0/series index 57f6db51906..14546a0a6b2 100644 --- a/queue-6.0/series +++ b/queue-6.0/series @@ -57,3 +57,19 @@ mac802154-fix-lqi-recording.patch scsi-qla2xxx-use-transport-defined-speed-mask-for-supported_speeds.patch drm-amdgpu-fix-vram-bo-swap-issue.patch drm-amdgpu-fix-for-bo-move-issue.patch +drm-i915-extend-wa_1607297627-to-alderlake-p.patch +drm-amdgpu-remove-atc-l2-access-for-mmhub-2.1.x.patch +drm-amdgpu-disallow-gfxoff-until-gc-ip-blocks-complete-s2idle-resume.patch +drm-amdgpu-fix-pstate-setting-issue.patch +drm-amd-display-revert-logic-for-plane-modifiers.patch +drm-amdkfd-update-gfx1037-lx-cache-setting.patch +drm-amdkfd-correct-the-cache-info-for-gfx1036.patch +drm-msm-fix-use-after-free-on-probe-deferral.patch +drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch +drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch +drm-msm-hdmi-fix-irq-lifetime.patch +drm-msm-dp-fix-memory-corruption-with-too-many-bridges.patch +drm-msm-dp-fix-aux-bus-ep-lifetime.patch +drm-msm-dp-fix-irq-lifetime.patch +drm-msm-dp-fix-bridge-lifetime.patch +crypto-x86-polyval-fix-crashes-when-keys-are-not-16-byte-aligned.patch -- 2.47.3