5.15-stable patches

added patches:
	drm-amd-display-change-the-dmcub-mailbox-memory-location-from-fb-to-inbox.patch
	drm-amdgpu-don-t-use-atrm-for-external-devices.patch
	drm-amdgpu-fix-error-handling-in-amdgpu_bo_list_get.patch
	drm-i915-fix-potential-spectre-vulnerability.patch

diff --git a/queue-5.15/drm-amd-display-change-the-dmcub-mailbox-memory-location-from-fb-to-inbox.patch b/queue-5.15/drm-amd-display-change-the-dmcub-mailbox-memory-location-from-fb-to-inbox.patch
new file mode 100644 (file)
index 0000000..199f855
--- /dev/null
+++ b/queue-5.15/drm-amd-display-change-the-dmcub-mailbox-memory-location-from-fb-to-inbox.patch
@@ -0,0 +1,208 @@
+From 5911d02cac70d7fb52009fbd37423e63f8f6f9bc Mon Sep 17 00:00:00 2001
+From: Lewis Huang <lewis.huang@amd.com>
+Date: Thu, 19 Oct 2023 17:22:21 +0800
+Subject: drm/amd/display: Change the DMCUB mailbox memory location from FB to inbox
+
+From: Lewis Huang <lewis.huang@amd.com>
+
+commit 5911d02cac70d7fb52009fbd37423e63f8f6f9bc upstream.
+
+[WHY]
+Flush command sent to DMCUB spends more time for execution on
+a dGPU than on an APU. This causes cursor lag when using high
+refresh rate mouses.
+
+[HOW]
+1. Change the DMCUB mailbox memory location from FB to inbox.
+2. Only change windows memory to inbox.
+
+Cc: Mario Limonciello <mario.limonciello@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Acked-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Lewis Huang <lewis.huang@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c |   13 ++++----
+ drivers/gpu/drm/amd/display/dmub/dmub_srv.h       |   22 +++++++++------
+ drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c   |   32 ++++++++++++++++------
+ 3 files changed, 45 insertions(+), 22 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -1911,7 +1911,7 @@ static int dm_dmub_sw_init(struct amdgpu
+       struct dmub_srv_create_params create_params;
+       struct dmub_srv_region_params region_params;
+       struct dmub_srv_region_info region_info;
+-      struct dmub_srv_fb_params fb_params;
++      struct dmub_srv_memory_params memory_params;
+       struct dmub_srv_fb_info *fb_info;
+       struct dmub_srv *dmub_srv;
+       const struct dmcub_firmware_header_v1_0 *hdr;
+@@ -2021,6 +2021,7 @@ static int dm_dmub_sw_init(struct amdgpu
+               adev->dm.dmub_fw->data +
+               le32_to_cpu(hdr->header.ucode_array_offset_bytes) +
+               PSP_HEADER_BYTES;
++      region_params.is_mailbox_in_inbox = false;
+ 
+       status = dmub_srv_calc_region_info(dmub_srv, &region_params,
+                                          &region_info);
+@@ -2042,10 +2043,10 @@ static int dm_dmub_sw_init(struct amdgpu
+               return r;
+ 
+       /* Rebase the regions on the framebuffer address. */
+-      memset(&fb_params, 0, sizeof(fb_params));
+-      fb_params.cpu_addr = adev->dm.dmub_bo_cpu_addr;
+-      fb_params.gpu_addr = adev->dm.dmub_bo_gpu_addr;
+-      fb_params.region_info = &region_info;
++      memset(&memory_params, 0, sizeof(memory_params));
++      memory_params.cpu_fb_addr = adev->dm.dmub_bo_cpu_addr;
++      memory_params.gpu_fb_addr = adev->dm.dmub_bo_gpu_addr;
++      memory_params.region_info = &region_info;
+ 
+       adev->dm.dmub_fb_info =
+               kzalloc(sizeof(*adev->dm.dmub_fb_info), GFP_KERNEL);
+@@ -2057,7 +2058,7 @@ static int dm_dmub_sw_init(struct amdgpu
+               return -ENOMEM;
+       }
+ 
+-      status = dmub_srv_calc_fb_info(dmub_srv, &fb_params, fb_info);
++      status = dmub_srv_calc_mem_info(dmub_srv, &memory_params, fb_info);
+       if (status != DMUB_STATUS_OK) {
+               DRM_ERROR("Error calculating DMUB FB info: %d\n", status);
+               return -EINVAL;
+--- a/drivers/gpu/drm/amd/display/dmub/dmub_srv.h
++++ b/drivers/gpu/drm/amd/display/dmub/dmub_srv.h
+@@ -166,6 +166,7 @@ struct dmub_srv_region_params {
+       uint32_t vbios_size;
+       const uint8_t *fw_inst_const;
+       const uint8_t *fw_bss_data;
++      bool is_mailbox_in_inbox;
+ };
+ 
+ /**
+@@ -185,20 +186,25 @@ struct dmub_srv_region_params {
+  */
+ struct dmub_srv_region_info {
+       uint32_t fb_size;
++      uint32_t inbox_size;
+       uint8_t num_regions;
+       struct dmub_region regions[DMUB_WINDOW_TOTAL];
+ };
+ 
+ /**
+- * struct dmub_srv_fb_params - parameters used for driver fb setup
++ * struct dmub_srv_memory_params - parameters used for driver fb setup
+  * @region_info: region info calculated by dmub service
+- * @cpu_addr: base cpu address for the framebuffer
+- * @gpu_addr: base gpu virtual address for the framebuffer
++ * @cpu_fb_addr: base cpu address for the framebuffer
++ * @cpu_inbox_addr: base cpu address for the gart
++ * @gpu_fb_addr: base gpu virtual address for the framebuffer
++ * @gpu_inbox_addr: base gpu virtual address for the gart
+  */
+-struct dmub_srv_fb_params {
++struct dmub_srv_memory_params {
+       const struct dmub_srv_region_info *region_info;
+-      void *cpu_addr;
+-      uint64_t gpu_addr;
++      void *cpu_fb_addr;
++      void *cpu_inbox_addr;
++      uint64_t gpu_fb_addr;
++      uint64_t gpu_inbox_addr;
+ };
+ 
+ /**
+@@ -496,8 +502,8 @@ dmub_srv_calc_region_info(struct dmub_sr
+  *   DMUB_STATUS_OK - success
+  *   DMUB_STATUS_INVALID - unspecified error
+  */
+-enum dmub_status dmub_srv_calc_fb_info(struct dmub_srv *dmub,
+-                                     const struct dmub_srv_fb_params *params,
++enum dmub_status dmub_srv_calc_mem_info(struct dmub_srv *dmub,
++                                     const struct dmub_srv_memory_params *params,
+                                      struct dmub_srv_fb_info *out);
+ 
+ /**
+--- a/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c
++++ b/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c
+@@ -318,7 +318,7 @@ dmub_srv_calc_region_info(struct dmub_sr
+       uint32_t fw_state_size = DMUB_FW_STATE_SIZE;
+       uint32_t trace_buffer_size = DMUB_TRACE_BUFFER_SIZE;
+       uint32_t scratch_mem_size = DMUB_SCRATCH_MEM_SIZE;
+-
++      uint32_t previous_top = 0;
+       if (!dmub->sw_init)
+               return DMUB_STATUS_INVALID;
+ 
+@@ -343,8 +343,15 @@ dmub_srv_calc_region_info(struct dmub_sr
+       bios->base = dmub_align(stack->top, 256);
+       bios->top = bios->base + params->vbios_size;
+ 
+-      mail->base = dmub_align(bios->top, 256);
+-      mail->top = mail->base + DMUB_MAILBOX_SIZE;
++      if (params->is_mailbox_in_inbox) {
++              mail->base = 0;
++              mail->top = mail->base + DMUB_MAILBOX_SIZE;
++              previous_top = bios->top;
++      } else {
++              mail->base = dmub_align(bios->top, 256);
++              mail->top = mail->base + DMUB_MAILBOX_SIZE;
++              previous_top = mail->top;
++      }
+ 
+       fw_info = dmub_get_fw_meta_info(params);
+ 
+@@ -363,7 +370,7 @@ dmub_srv_calc_region_info(struct dmub_sr
+                       dmub->fw_version = fw_info->fw_version;
+       }
+ 
+-      trace_buff->base = dmub_align(mail->top, 256);
++      trace_buff->base = dmub_align(previous_top, 256);
+       trace_buff->top = trace_buff->base + dmub_align(trace_buffer_size, 64);
+ 
+       fw_state->base = dmub_align(trace_buff->top, 256);
+@@ -374,11 +381,14 @@ dmub_srv_calc_region_info(struct dmub_sr
+ 
+       out->fb_size = dmub_align(scratch_mem->top, 4096);
+ 
++      if (params->is_mailbox_in_inbox)
++              out->inbox_size = dmub_align(mail->top, 4096);
++
+       return DMUB_STATUS_OK;
+ }
+ 
+-enum dmub_status dmub_srv_calc_fb_info(struct dmub_srv *dmub,
+-                                     const struct dmub_srv_fb_params *params,
++enum dmub_status dmub_srv_calc_mem_info(struct dmub_srv *dmub,
++                                     const struct dmub_srv_memory_params *params,
+                                      struct dmub_srv_fb_info *out)
+ {
+       uint8_t *cpu_base;
+@@ -393,8 +403,8 @@ enum dmub_status dmub_srv_calc_fb_info(s
+       if (params->region_info->num_regions != DMUB_NUM_WINDOWS)
+               return DMUB_STATUS_INVALID;
+ 
+-      cpu_base = (uint8_t *)params->cpu_addr;
+-      gpu_base = params->gpu_addr;
++      cpu_base = (uint8_t *)params->cpu_fb_addr;
++      gpu_base = params->gpu_fb_addr;
+ 
+       for (i = 0; i < DMUB_NUM_WINDOWS; ++i) {
+               const struct dmub_region *reg =
+@@ -402,6 +412,12 @@ enum dmub_status dmub_srv_calc_fb_info(s
+ 
+               out->fb[i].cpu_addr = cpu_base + reg->base;
+               out->fb[i].gpu_addr = gpu_base + reg->base;
++
++              if (i == DMUB_WINDOW_4_MAILBOX && params->cpu_inbox_addr != 0) {
++                      out->fb[i].cpu_addr = (uint8_t *)params->cpu_inbox_addr + reg->base;
++                      out->fb[i].gpu_addr = params->gpu_inbox_addr + reg->base;
++              }
++
+               out->fb[i].size = reg->top - reg->base;
+       }
+ 

diff --git a/queue-5.15/drm-amdgpu-don-t-use-atrm-for-external-devices.patch b/queue-5.15/drm-amdgpu-don-t-use-atrm-for-external-devices.patch
new file mode 100644 (file)
index 0000000..913ee8f
--- /dev/null
+++ b/queue-5.15/drm-amdgpu-don-t-use-atrm-for-external-devices.patch
@@ -0,0 +1,48 @@
+From 432e664e7c98c243fab4c3c95bd463bea3aeed28 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 17 Oct 2023 15:40:01 -0400
+Subject: drm/amdgpu: don't use ATRM for external devices
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 432e664e7c98c243fab4c3c95bd463bea3aeed28 upstream.
+
+The ATRM ACPI method is for fetching the dGPU vbios rom
+image on laptops and all-in-one systems.  It should not be
+used for external add in cards.  If the dGPU is thunderbolt
+connected, don't try ATRM.
+
+v2: pci_is_thunderbolt_attached only works for Intel.  Use
+    pdev->external_facing instead.
+v3: dev_is_removable() seems to be what we want
+
+Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2925
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
+@@ -29,6 +29,7 @@
+ #include "amdgpu.h"
+ #include "atom.h"
+ 
++#include <linux/device.h>
+ #include <linux/pci.h>
+ #include <linux/slab.h>
+ #include <linux/acpi.h>
+@@ -289,6 +290,10 @@ static bool amdgpu_atrm_get_bios(struct
+       if (adev->flags & AMD_IS_APU)
+               return false;
+ 
++      /* ATRM is for on-platform devices only */
++      if (dev_is_removable(&adev->pdev->dev))
++              return false;
++
+       while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_VGA << 8, pdev)) != NULL) {
+               dhandle = ACPI_HANDLE(&pdev->dev);
+               if (!dhandle)

diff --git a/queue-5.15/drm-amdgpu-fix-error-handling-in-amdgpu_bo_list_get.patch b/queue-5.15/drm-amdgpu-fix-error-handling-in-amdgpu_bo_list_get.patch
new file mode 100644 (file)
index 0000000..2381dcb
--- /dev/null
+++ b/queue-5.15/drm-amdgpu-fix-error-handling-in-amdgpu_bo_list_get.patch
@@ -0,0 +1,35 @@
+From 12f76050d8d4d10dab96333656b821bd4620d103 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+Date: Thu, 9 Nov 2023 10:12:39 +0100
+Subject: drm/amdgpu: fix error handling in amdgpu_bo_list_get()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+commit 12f76050d8d4d10dab96333656b821bd4620d103 upstream.
+
+We should not leak the pointer where we couldn't grab the reference
+on to the caller because it can be that the error handling still
+tries to put the reference then.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
+@@ -178,6 +178,7 @@ int amdgpu_bo_list_get(struct amdgpu_fpr
+       }
+ 
+       rcu_read_unlock();
++      *result = NULL;
+       return -ENOENT;
+ }
+ 

diff --git a/queue-5.15/drm-i915-fix-potential-spectre-vulnerability.patch b/queue-5.15/drm-i915-fix-potential-spectre-vulnerability.patch
new file mode 100644 (file)
index 0000000..90a54bb
--- /dev/null
+++ b/queue-5.15/drm-i915-fix-potential-spectre-vulnerability.patch
@@ -0,0 +1,36 @@
+From 1a8e9bad6ef563c28ab0f8619628d5511be55431 Mon Sep 17 00:00:00 2001
+From: Kunwu Chan <chentao@kylinos.cn>
+Date: Fri, 3 Nov 2023 11:09:22 +0000
+Subject: drm/i915: Fix potential spectre vulnerability
+
+From: Kunwu Chan <chentao@kylinos.cn>
+
+commit 1a8e9bad6ef563c28ab0f8619628d5511be55431 upstream.
+
+Fix smatch warning:
+drivers/gpu/drm/i915/gem/i915_gem_context.c:847 set_proto_ctx_sseu()
+warn: potential spectre issue 'pc->user_engines' [r] (local cap)
+
+Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)")
+Cc: <stable@vger.kernel.org> # v5.15+
+Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
+Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231103110922.430122-1-tvrtko.ursulin@linux.intel.com
+(cherry picked from commit 27b086382c22efb7e0a16442f7bdc2e120108ef3)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gem/i915_gem_context.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c
++++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c
+@@ -642,6 +642,7 @@ static int set_proto_ctx_sseu(struct drm
+               if (idx >= pc->num_user_engines)
+                       return -EINVAL;
+ 
++              idx = array_index_nospec(idx, pc->num_user_engines);
+               pe = &pc->user_engines[idx];
+ 
+               /* Only render engine supports RPCS configuration. */

diff --git a/queue-5.15/series b/queue-5.15/series
index 0c9bc2a43308f809733f6ceb3a1fb9a4cf526b49..438bcd2846bea8b221c9b0b68b9a8d1b4e1e9175 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -295,3 +295,7 @@ ext4-remove-gdb-backup-copy-for-meta-bg-in-setup_new_flex_group_blocks.patch
 ext4-add-missed-brelse-in-update_backups.patch
 ext4-properly-sync-file-size-update-after-o_sync-direct-io.patch
 drm-amd-pm-handle-non-terminated-overdrive-commands.patch
+drm-i915-fix-potential-spectre-vulnerability.patch
+drm-amdgpu-don-t-use-atrm-for-external-devices.patch
+drm-amdgpu-fix-error-handling-in-amdgpu_bo_list_get.patch
+drm-amd-display-change-the-dmcub-mailbox-memory-location-from-fb-to-inbox.patch