--- /dev/null
+From af22d6a869cc26b519bfdcd54293c53f2e491870 Mon Sep 17 00:00:00 2001
+From: Hamza Mahfooz <hamza.mahfooz@amd.com>
+Date: Wed, 21 Jun 2023 15:19:05 -0400
+Subject: drm/amd/display: perform a bounds check before filling dirty rectangles
+
+From: Hamza Mahfooz <hamza.mahfooz@amd.com>
+
+commit af22d6a869cc26b519bfdcd54293c53f2e491870 upstream.
+
+Currently, it is possible for us to access memory that we shouldn't.
+Since, we acquire (possibly dangling) pointers to dirty rectangles
+before doing a bounds check to make sure we can actually accommodate the
+number of dirty rectangles userspace has requested to fill. This issue
+is especially evident if a compositor requests both MPO and damage clips
+at the same time, in which case I have observed a soft-hang. So, to
+avoid this issue, perform the bounds check before filling a single dirty
+rectangle and WARN() about it, if it is ever attempted in
+fill_dc_dirty_rect().
+
+Cc: stable@vger.kernel.org # 6.1+
+Fixes: 30ebe41582d1 ("drm/amd/display: add FB_DAMAGE_CLIPS support")
+Reviewed-by: Leo Li <sunpeng.li@amd.com>
+Signed-off-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 13 ++++---------
+ 1 file changed, 4 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -4953,11 +4953,7 @@ static inline void fill_dc_dirty_rect(st
+ int32_t y, int32_t width, int32_t height,
+ int *i, bool ffu)
+ {
+- if (*i > DC_MAX_DIRTY_RECTS)
+- return;
+-
+- if (*i == DC_MAX_DIRTY_RECTS)
+- goto out;
++ WARN_ON(*i >= DC_MAX_DIRTY_RECTS);
+
+ dirty_rect->x = x;
+ dirty_rect->y = y;
+@@ -4973,7 +4969,6 @@ static inline void fill_dc_dirty_rect(st
+ "[PLANE:%d] PSR SU dirty rect at (%d, %d) size (%d, %d)",
+ plane->base.id, x, y, width, height);
+
+-out:
+ (*i)++;
+ }
+
+@@ -5055,6 +5050,9 @@ static void fill_dc_dirty_rects(struct d
+ new_plane_state->plane->base.id,
+ bb_changed, fb_changed, num_clips);
+
++ if ((num_clips + (bb_changed ? 2 : 0)) > DC_MAX_DIRTY_RECTS)
++ goto ffu;
++
+ if (bb_changed) {
+ fill_dc_dirty_rect(new_plane_state->plane, &dirty_rects[i],
+ new_plane_state->crtc_x,
+@@ -5084,9 +5082,6 @@ static void fill_dc_dirty_rects(struct d
+ new_plane_state->crtc_h, &i, false);
+ }
+
+- if (i > DC_MAX_DIRTY_RECTS)
+- goto ffu;
+-
+ flip_addrs->dirty_rect_count = i;
+ return;
+
--- /dev/null
+From 6609141c49df1b86fbad26a8643d4b4044f28b11 Mon Sep 17 00:00:00 2001
+From: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
+Date: Tue, 22 Nov 2022 10:06:19 -0500
+Subject: drm/amd/display: set per pipe dppclk to 0 when dpp is off
+
+From: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
+
+commit 6609141c49df1b86fbad26a8643d4b4044f28b11 upstream.
+
+The 'commit 52e4fdf09ebc ("drm/amd/display: use low clocks for no plane
+configs")' introduced a change that set low clock values for DCN31 and
+DCN32. As a result of these changes, DC started to spam the log with the
+following warning:
+
+------------[ cut here ]------------
+WARNING: CPU: 8 PID: 1486 at
+drivers/gpu/drm/amd/amdgpu/../display/dc/dcn20/dcn20_dccg.c:58
+dccg2_update_dpp_dto+0x3f/0xf0 [amdgpu]
+[..]
+CPU: 8 PID: 1486 Comm: kms_atomic Tainted: G W 5.18.0+ #1
+RIP: 0010:dccg2_update_dpp_dto+0x3f/0xf0 [amdgpu]
+RSP: 0018:ffffbbd8025334d0 EFLAGS: 00010206
+RAX: 00000000000001ee RBX: ffffa02c87dd3de0 RCX: 00000000000a7f80
+RDX: 000000000007dec3 RSI: 0000000000000000 RDI: ffffa02c87dd3de0
+RBP: ffffbbd8025334e8 R08: 0000000000000001 R09: 0000000000000005
+R10: 00000000000331a0 R11: ffffffffc0b03d80 R12: ffffa02ca576d000
+R13: ffffa02cd02c0000 R14: 00000000001453bc R15: ffffa02cdc280000
+[..]
+dcn20_update_clocks_update_dpp_dto+0x4e/0xa0 [amdgpu]
+dcn32_update_clocks+0x5d9/0x650 [amdgpu]
+dcn20_prepare_bandwidth+0x49/0x100 [amdgpu]
+dcn30_prepare_bandwidth+0x63/0x80 [amdgpu]
+dc_commit_state_no_check+0x39d/0x13e0 [amdgpu]
+dc_commit_streams+0x1f9/0x3b0 [amdgpu]
+dc_commit_state+0x37/0x120 [amdgpu]
+amdgpu_dm_atomic_commit_tail+0x5e5/0x2520 [amdgpu]
+? _raw_spin_unlock_irqrestore+0x1f/0x40
+? down_trylock+0x2c/0x40
+? vprintk_emit+0x186/0x2c0
+? vprintk_default+0x1d/0x20
+? vprintk+0x4e/0x60
+
+We can easily trigger this issue by using a 4k@120 or a 2k@165 and
+running some of the kms_atomic tests. This warning is triggered because
+the per-pipe clock update is not happening; this commit fixes this issue
+by ensuring that DPPCLK is updated when calculating the watermark and
+dlg is invoked.
+
+Fixes: 2641c7b78081 ("drm/amd/display: use low clocks for no plane configs")
+Reported-by: Mark Broadworth <mark.broadworth@amd.com>
+Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dml/dcn31/dcn31_fpu.c | 3 +++
+ drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 5 ++++-
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn31/dcn31_fpu.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn31/dcn31_fpu.c
+@@ -559,6 +559,9 @@ void dcn31_calculate_wm_and_dlg_fp(
+ context->bw_ctx.bw.dcn.clk.dramclk_khz = 0;
+ context->bw_ctx.bw.dcn.clk.fclk_khz = 0;
+ context->bw_ctx.bw.dcn.clk.p_state_change_support = true;
++ for (i = 0; i < dc->res_pool->pipe_count; i++)
++ if (context->res_ctx.pipe_ctx[i].stream)
++ context->res_ctx.pipe_ctx[i].plane_res.bw.dppclk_khz = 0;
+ }
+ for (i = 0, pipe_idx = 0; i < dc->res_pool->pipe_count; i++) {
+ if (!context->res_ctx.pipe_ctx[i].stream)
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c
+@@ -1305,7 +1305,10 @@ static void dcn32_calculate_dlg_params(s
+
+ if (context->bw_ctx.bw.dcn.clk.dppclk_khz < pipes[pipe_idx].clks_cfg.dppclk_mhz * 1000)
+ context->bw_ctx.bw.dcn.clk.dppclk_khz = pipes[pipe_idx].clks_cfg.dppclk_mhz * 1000;
+- context->res_ctx.pipe_ctx[i].plane_res.bw.dppclk_khz = pipes[pipe_idx].clks_cfg.dppclk_mhz * 1000;
++ if (context->res_ctx.pipe_ctx[i].plane_state)
++ context->res_ctx.pipe_ctx[i].plane_res.bw.dppclk_khz = pipes[pipe_idx].clks_cfg.dppclk_mhz * 1000;
++ else
++ context->res_ctx.pipe_ctx[i].plane_res.bw.dppclk_khz = 0;
+ context->res_ctx.pipe_ctx[i].pipe_dlg_param = pipes[pipe_idx].pipe.dest;
+ pipe_idx++;
+ }
--- /dev/null
+From 751281c55579f0cb0e56c9797d4663f689909681 Mon Sep 17 00:00:00 2001
+From: Benjamin Cheng <ben@bcheng.me>
+Date: Sun, 12 Mar 2023 20:47:39 -0400
+Subject: drm/amd/display: Write to correct dirty_rect
+
+From: Benjamin Cheng <ben@bcheng.me>
+
+commit 751281c55579f0cb0e56c9797d4663f689909681 upstream.
+
+When FB_DAMAGE_CLIPS are provided in a non-MPO scenario, the loop does
+not use the counter i. This causes the fill_dc_dity_rect() to always
+fill dirty_rects[0], causing graphical artifacts when a damage clip
+aware DRM client sends more than 1 damage clip.
+
+Instead, use the flip_addrs->dirty_rect_count which is incremented by
+fill_dc_dirty_rect() on a successful fill.
+
+Fixes: 30ebe41582d1 ("drm/amd/display: add FB_DAMAGE_CLIPS support")
+Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2453
+Signed-off-by: Benjamin Cheng <ben@bcheng.me>
+Signed-off-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 6.1.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -5023,9 +5023,9 @@ static void fill_dc_dirty_rects(struct d
+
+ for (; flip_addrs->dirty_rect_count < num_clips; clips++)
+ fill_dc_dirty_rect(new_plane_state->plane,
+- &dirty_rects[i], clips->x1,
+- clips->y1, clips->x2 - clips->x1,
+- clips->y2 - clips->y1,
++ &dirty_rects[flip_addrs->dirty_rect_count],
++ clips->x1, clips->y1,
++ clips->x2 - clips->x1, clips->y2 - clips->y1,
+ &flip_addrs->dirty_rect_count,
+ false);
+ return;
rbd-make-get_lock_owner_info-return-a-single-locker-or-null.patch
rbd-harden-get_lock_owner_info-a-bit.patch
rbd-retrieve-and-check-lock-owner-twice-before-blocklisting.patch
+drm-amd-display-set-per-pipe-dppclk-to-0-when-dpp-is-off.patch
+tracing-fix-trace_event_raw_event_synth-if-else-statement.patch
+drm-amd-display-perform-a-bounds-check-before-filling-dirty-rectangles.patch
+drm-amd-display-write-to-correct-dirty_rect.patch
--- /dev/null
+From 9971c3f944489ff7aacb9d25e0cde841a5f6018a Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
+Date: Tue, 31 Jan 2023 09:52:37 -0500
+Subject: tracing: Fix trace_event_raw_event_synth() if else statement
+
+From: Steven Rostedt (Google) <rostedt@goodmis.org>
+
+commit 9971c3f944489ff7aacb9d25e0cde841a5f6018a upstream.
+
+The test to check if the field is a stack is to be done if it is not a
+string. But the code had:
+
+ } if (event->fields[i]->is_stack) {
+
+and not
+
+ } else if (event->fields[i]->is_stack) {
+
+which would cause it to always be tested. Worse yet, this also included an
+"else" statement that was only to be called if the field was not a string
+and a stack, but this code allows it to be called if it was a string (and
+not a stack).
+
+Also fixed some whitespace issues.
+
+Link: https://lore.kernel.org/all/202301302110.mEtNwkBD-lkp@intel.com/
+Link: https://lore.kernel.org/linux-trace-kernel/20230131095237.63e3ca8d@gandalf.local.home
+
+Cc: Tom Zanussi <zanussi@kernel.org>
+Fixes: 00cf3d672a9d ("tracing: Allow synthetic events to pass around stacktraces")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace_events_synth.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/kernel/trace/trace_events_synth.c
++++ b/kernel/trace/trace_events_synth.c
+@@ -576,8 +576,8 @@ static notrace void trace_event_raw_even
+ event->fields[i]->is_dynamic,
+ data_size, &n_u64);
+ data_size += len; /* only dynamic string increments */
+- } if (event->fields[i]->is_stack) {
+- long *stack = (long *)(long)var_ref_vals[val_idx];
++ } else if (event->fields[i]->is_stack) {
++ long *stack = (long *)(long)var_ref_vals[val_idx];
+
+ len = trace_stack(entry, event, stack,
+ data_size, &n_u64);
projects / thirdparty / kernel / stable-queue.git / commitdiff
