]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
Fixes for 5.15
authorSasha Levin <sashal@kernel.org>
Sun, 25 Aug 2024 23:46:20 +0000 (19:46 -0400)
committerSasha Levin <sashal@kernel.org>
Sun, 25 Aug 2024 23:46:20 +0000 (19:46 -0400)
Signed-off-by: Sasha Levin <sashal@kernel.org>
queue-5.15/drm-msm-dp-reset-the-link-phy-params-before-link-tra.patch [new file with mode: 0644]
queue-5.15/drm-msm-dpu-cleanup-fb-if-dpu_format_populate_layout.patch [new file with mode: 0644]
queue-5.15/drm-msm-dpu-don-t-play-tricks-with-debug-macros.patch [new file with mode: 0644]
queue-5.15/mmc-mmc_test-fix-null-dereference-on-allocation-fail.patch [new file with mode: 0644]
queue-5.15/series

diff --git a/queue-5.15/drm-msm-dp-reset-the-link-phy-params-before-link-tra.patch b/queue-5.15/drm-msm-dp-reset-the-link-phy-params-before-link-tra.patch
new file mode 100644 (file)
index 0000000..88aee94
--- /dev/null
@@ -0,0 +1,42 @@
+From 84351add3ce9036ba1f1970dd7cd0213a2578432 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jul 2024 15:04:50 -0700
+Subject: drm/msm/dp: reset the link phy params before link training
+
+From: Abhinav Kumar <quic_abhinavk@quicinc.com>
+
+[ Upstream commit 319aca883bfa1b85ee08411541b51b9a934ac858 ]
+
+Before re-starting link training reset the link phy params namely
+the pre-emphasis and voltage swing levels otherwise the next
+link training begins at the previously cached levels which can result
+in link training failures.
+
+Fixes: 8ede2ecc3e5e ("drm/msm/dp: Add DP compliance tests on Snapdragon Chipsets")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> # SM8350-HDK
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Patchwork: https://patchwork.freedesktop.org/patch/605946/
+Link: https://lore.kernel.org/r/20240725220450.131245-1-quic_abhinavk@quicinc.com
+Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dp/dp_ctrl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
+index 854173df67018..85f86afc55052 100644
+--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
++++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
+@@ -1237,6 +1237,8 @@ static int dp_ctrl_link_train(struct dp_ctrl_private *ctrl,
+       link_info.rate = ctrl->link->link_params.rate;
+       link_info.capabilities = DP_LINK_CAP_ENHANCED_FRAMING;
++      dp_link_reset_phy_params_vx_px(ctrl->link);
++
+       dp_aux_link_configure(ctrl->aux, &link_info);
+       drm_dp_dpcd_write(ctrl->aux, DP_MAIN_LINK_CHANNEL_CODING_SET,
+                               &encoding, 1);
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-msm-dpu-cleanup-fb-if-dpu_format_populate_layout.patch b/queue-5.15/drm-msm-dpu-cleanup-fb-if-dpu_format_populate_layout.patch
new file mode 100644 (file)
index 0000000..ac33ed3
--- /dev/null
@@ -0,0 +1,70 @@
+From fbdbc6ecf8ef4f8f7c55717e51c60a124c4a63a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jun 2024 00:13:41 +0300
+Subject: drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit bfa1a6283be390947d3649c482e5167186a37016 ]
+
+If the dpu_format_populate_layout() fails, then FB is prepared, but not
+cleaned up. This ends up leaking the pin_count on the GEM object and
+causes a splat during DRM file closure:
+
+msm_obj->pin_count
+WARNING: CPU: 2 PID: 569 at drivers/gpu/drm/msm/msm_gem.c:121 update_lru_locked+0xc4/0xcc
+[...]
+Call trace:
+ update_lru_locked+0xc4/0xcc
+ put_pages+0xac/0x100
+ msm_gem_free_object+0x138/0x180
+ drm_gem_object_free+0x1c/0x30
+ drm_gem_object_handle_put_unlocked+0x108/0x10c
+ drm_gem_object_release_handle+0x58/0x70
+ idr_for_each+0x68/0xec
+ drm_gem_release+0x28/0x40
+ drm_file_free+0x174/0x234
+ drm_release+0xb0/0x160
+ __fput+0xc0/0x2c8
+ __fput_sync+0x50/0x5c
+ __arm64_sys_close+0x38/0x7c
+ invoke_syscall+0x48/0x118
+ el0_svc_common.constprop.0+0x40/0xe0
+ do_el0_svc+0x1c/0x28
+ el0_svc+0x4c/0x120
+ el0t_64_sync_handler+0x100/0x12c
+ el0t_64_sync+0x190/0x194
+irq event stamp: 129818
+hardirqs last  enabled at (129817): [<ffffa5f6d953fcc0>] console_unlock+0x118/0x124
+hardirqs last disabled at (129818): [<ffffa5f6da7dcf04>] el1_dbg+0x24/0x8c
+softirqs last  enabled at (129808): [<ffffa5f6d94afc18>] handle_softirqs+0x4c8/0x4e8
+softirqs last disabled at (129785): [<ffffa5f6d94105e4>] __do_softirq+0x14/0x20
+
+Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/600714/
+Link: https://lore.kernel.org/r/20240625-dpu-mode-config-width-v5-1-501d984d634f@linaro.org
+Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
+index 9c30ab106b0a1..3ee9a92ffed57 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
+@@ -906,6 +906,9 @@ static int dpu_plane_prepare_fb(struct drm_plane *plane,
+                       new_state->fb, &layout);
+       if (ret) {
+               DPU_ERROR_PLANE(pdpu, "failed to get format layout, %d\n", ret);
++              if (pstate->aspace)
++                      msm_framebuffer_cleanup(new_state->fb, pstate->aspace,
++                                              pstate->needs_dirtyfb);
+               return ret;
+       }
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-msm-dpu-don-t-play-tricks-with-debug-macros.patch b/queue-5.15/drm-msm-dpu-don-t-play-tricks-with-debug-macros.patch
new file mode 100644 (file)
index 0000000..ce0c995
--- /dev/null
@@ -0,0 +1,66 @@
+From 924241b9f33b17d0a845c4ce3d93455919167e30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Aug 2024 22:47:34 +0300
+Subject: drm/msm/dpu: don't play tricks with debug macros
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit df24373435f5899a2a98b7d377479c8d4376613b ]
+
+DPU debugging macros need to be converted to a proper drm_debug_*
+macros, however this is a going an intrusive patch, not suitable for a
+fix. Wire DPU_DEBUG and DPU_DEBUG_DRIVER to always use DRM_DEBUG_DRIVER
+to make sure that DPU debugging messages always end up in the drm debug
+messages and are controlled via the usual drm.debug mask.
+
+I don't think that it is a good idea for a generic DPU_DEBUG macro to be
+tied to DRM_UT_KMS. It is used to report a debug message from driver, so by
+default it should go to the DRM_UT_DRIVER channel. While refactoring
+debug macros later on we might end up with particular messages going to
+ATOMIC or KMS, but DRIVER should be the default.
+
+Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/606932/
+Link: https://lore.kernel.org/r/20240802-dpu-fix-wb-v2-2-7eac9eb8e895@linaro.org
+Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h | 14 ++------------
+ 1 file changed, 2 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h
+index 170b3e9dd4b00..73aef80a8556a 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h
+@@ -32,24 +32,14 @@
+  * @fmt: Pointer to format string
+  */
+ #define DPU_DEBUG(fmt, ...)                                                \
+-      do {                                                               \
+-              if (drm_debug_enabled(DRM_UT_KMS))                         \
+-                      DRM_DEBUG(fmt, ##__VA_ARGS__); \
+-              else                                                       \
+-                      pr_debug(fmt, ##__VA_ARGS__);                      \
+-      } while (0)
++      DRM_DEBUG_DRIVER(fmt, ##__VA_ARGS__)
+ /**
+  * DPU_DEBUG_DRIVER - macro for hardware driver logging
+  * @fmt: Pointer to format string
+  */
+ #define DPU_DEBUG_DRIVER(fmt, ...)                                         \
+-      do {                                                               \
+-              if (drm_debug_enabled(DRM_UT_DRIVER))                      \
+-                      DRM_ERROR(fmt, ##__VA_ARGS__); \
+-              else                                                       \
+-                      pr_debug(fmt, ##__VA_ARGS__);                      \
+-      } while (0)
++      DRM_DEBUG_DRIVER(fmt, ##__VA_ARGS__)
+ #define DPU_ERROR(fmt, ...) pr_err("[dpu error]" fmt, ##__VA_ARGS__)
+ #define DPU_ERROR_RATELIMITED(fmt, ...) pr_err_ratelimited("[dpu error]" fmt, ##__VA_ARGS__)
+-- 
+2.43.0
+
diff --git a/queue-5.15/mmc-mmc_test-fix-null-dereference-on-allocation-fail.patch b/queue-5.15/mmc-mmc_test-fix-null-dereference-on-allocation-fail.patch
new file mode 100644 (file)
index 0000000..022a1d4
--- /dev/null
@@ -0,0 +1,55 @@
+From 44f5f86bde71cc135a8514604602a8817cae6138 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2024 11:44:08 +0300
+Subject: mmc: mmc_test: Fix NULL dereference on allocation failure
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit a1e627af32ed60713941cbfc8075d44cad07f6dd ]
+
+If the "test->highmem = alloc_pages()" allocation fails then calling
+__free_pages(test->highmem) will result in a NULL dereference.  Also
+change the error code to -ENOMEM instead of returning success.
+
+Fixes: 2661081f5ab9 ("mmc_test: highmem tests")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/8c90be28-67b4-4b0d-a105-034dc72a0b31@stanley.mountain
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/mmc_test.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mmc/core/mmc_test.c b/drivers/mmc/core/mmc_test.c
+index 4052f828f75e7..e03d4405cda36 100644
+--- a/drivers/mmc/core/mmc_test.c
++++ b/drivers/mmc/core/mmc_test.c
+@@ -3111,13 +3111,13 @@ static ssize_t mtf_test_write(struct file *file, const char __user *buf,
+       test->buffer = kzalloc(BUFFER_SIZE, GFP_KERNEL);
+ #ifdef CONFIG_HIGHMEM
+       test->highmem = alloc_pages(GFP_KERNEL | __GFP_HIGHMEM, BUFFER_ORDER);
++      if (!test->highmem) {
++              count = -ENOMEM;
++              goto free_test_buffer;
++      }
+ #endif
+-#ifdef CONFIG_HIGHMEM
+-      if (test->buffer && test->highmem) {
+-#else
+       if (test->buffer) {
+-#endif
+               mutex_lock(&mmc_test_lock);
+               mmc_test_run(test, testcase);
+               mutex_unlock(&mmc_test_lock);
+@@ -3125,6 +3125,7 @@ static ssize_t mtf_test_write(struct file *file, const char __user *buf,
+ #ifdef CONFIG_HIGHMEM
+       __free_pages(test->highmem, BUFFER_ORDER);
++free_test_buffer:
+ #endif
+       kfree(test->buffer);
+       kfree(test);
+-- 
+2.43.0
+
index de5f583047284c937754b71a992a6eb4235bea96..3aecfe74badb5fb6a425383d11086541caa1f0d3 100644 (file)
@@ -152,3 +152,7 @@ ipv6-prevent-possible-uaf-in-ip6_xmit.patch
 netfilter-flowtable-validate-vlan-header.patch
 net-xilinx-axienet-always-disable-promiscuous-mode.patch
 net-xilinx-axienet-fix-dangling-multicast-addresses.patch
+drm-msm-dpu-don-t-play-tricks-with-debug-macros.patch
+drm-msm-dp-reset-the-link-phy-params-before-link-tra.patch
+drm-msm-dpu-cleanup-fb-if-dpu_format_populate_layout.patch
+mmc-mmc_test-fix-null-dereference-on-allocation-fail.patch