--- /dev/null
+From d89f6048bdcb6a56abb396c584747d5eeae650db Mon Sep 17 00:00:00 2001
+From: Harry Wentland <harry.wentland@amd.com>
+Date: Thu, 22 Apr 2021 19:10:52 -0400
+Subject: drm/amd/display: Reject non-zero src_y and src_x for video planes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Harry Wentland <harry.wentland@amd.com>
+
+commit d89f6048bdcb6a56abb396c584747d5eeae650db upstream.
+
+[Why]
+This hasn't been well tested and leads to complete system hangs on DCN1
+based systems, possibly others.
+
+The system hang can be reproduced by gesturing the video on the YouTube
+Android app on ChromeOS into full screen.
+
+[How]
+Reject atomic commits with non-zero drm_plane_state.src_x or src_y values.
+
+v2:
+ - Add code comment describing the reason we're rejecting non-zero
+ src_x and src_y
+ - Drop gerrit Change-Id
+ - Add stable CC
+ - Based on amd-staging-drm-next
+
+v3: removed trailing whitespace
+
+Signed-off-by: Harry Wentland <harry.wentland@amd.com>
+Cc: stable@vger.kernel.org
+Cc: nicholas.kazlauskas@amd.com
+Cc: amd-gfx@lists.freedesktop.org
+Cc: alexander.deucher@amd.com
+Cc: Roman.Li@amd.com
+Cc: hersenxs.wu@amd.com
+Cc: danny.wang@amd.com
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Acked-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Hersen Wu <hersenxs.wu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -3685,6 +3685,23 @@ static int fill_dc_scaling_info(const st
+ scaling_info->src_rect.x = state->src_x >> 16;
+ scaling_info->src_rect.y = state->src_y >> 16;
+
++ /*
++ * For reasons we don't (yet) fully understand a non-zero
++ * src_y coordinate into an NV12 buffer can cause a
++ * system hang. To avoid hangs (and maybe be overly cautious)
++ * let's reject both non-zero src_x and src_y.
++ *
++ * We currently know of only one use-case to reproduce a
++ * scenario with non-zero src_x and src_y for NV12, which
++ * is to gesture the YouTube Android app into full screen
++ * on ChromeOS.
++ */
++ if (state->fb &&
++ state->fb->format->format == DRM_FORMAT_NV12 &&
++ (scaling_info->src_rect.x != 0 ||
++ scaling_info->src_rect.y != 0))
++ return -EINVAL;
++
+ scaling_info->src_rect.width = state->src_w >> 16;
+ if (scaling_info->src_rect.width == 0)
+ return -EINVAL;
--- /dev/null
+From 20a5f5a98e1bb3d40acd97e89299e8c2d22784be Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+Date: Thu, 22 Apr 2021 13:11:39 +0200
+Subject: drm/amdgpu: fix concurrent VM flushes on Vega/Navi v2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+commit 20a5f5a98e1bb3d40acd97e89299e8c2d22784be upstream.
+
+Starting with Vega the hardware supports concurrent flushes
+of VMID which can be used to implement per process VMID
+allocation.
+
+But concurrent flushes are mutual exclusive with back to
+back VMID allocations, fix this to avoid a VMID used in
+two ways at the same time.
+
+v2: don't set ring to NULL
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: James Zhu <James.Zhu@amd.com>
+Tested-by: James Zhu <James.Zhu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c | 19 +++++++++++--------
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 ++++++
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 1 +
+ 3 files changed, 18 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c
+@@ -215,7 +215,11 @@ static int amdgpu_vmid_grab_idle(struct
+ /* Check if we have an idle VMID */
+ i = 0;
+ list_for_each_entry((*idle), &id_mgr->ids_lru, list) {
+- fences[i] = amdgpu_sync_peek_fence(&(*idle)->active, ring);
++ /* Don't use per engine and per process VMID at the same time */
++ struct amdgpu_ring *r = adev->vm_manager.concurrent_flush ?
++ NULL : ring;
++
++ fences[i] = amdgpu_sync_peek_fence(&(*idle)->active, r);
+ if (!fences[i])
+ break;
+ ++i;
+@@ -280,7 +284,7 @@ static int amdgpu_vmid_grab_reserved(str
+ if (updates && (*id)->flushed_updates &&
+ updates->context == (*id)->flushed_updates->context &&
+ !dma_fence_is_later(updates, (*id)->flushed_updates))
+- updates = NULL;
++ updates = NULL;
+
+ if ((*id)->owner != vm->immediate.fence_context ||
+ job->vm_pd_addr != (*id)->pd_gpu_addr ||
+@@ -289,6 +293,10 @@ static int amdgpu_vmid_grab_reserved(str
+ !dma_fence_is_signaled((*id)->last_flush))) {
+ struct dma_fence *tmp;
+
++ /* Don't use per engine and per process VMID at the same time */
++ if (adev->vm_manager.concurrent_flush)
++ ring = NULL;
++
+ /* to prevent one context starved by another context */
+ (*id)->pd_gpu_addr = 0;
+ tmp = amdgpu_sync_peek_fence(&(*id)->active, ring);
+@@ -364,12 +372,7 @@ static int amdgpu_vmid_grab_used(struct
+ if (updates && (!flushed || dma_fence_is_later(updates, flushed)))
+ needs_flush = true;
+
+- /* Concurrent flushes are only possible starting with Vega10 and
+- * are broken on Navi10 and Navi14.
+- */
+- if (needs_flush && (adev->asic_type < CHIP_VEGA10 ||
+- adev->asic_type == CHIP_NAVI10 ||
+- adev->asic_type == CHIP_NAVI14))
++ if (needs_flush && !adev->vm_manager.concurrent_flush)
+ continue;
+
+ /* Good, we can use this VMID. Remember this submission as
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+@@ -3173,6 +3173,12 @@ void amdgpu_vm_manager_init(struct amdgp
+ {
+ unsigned i;
+
++ /* Concurrent flushes are only possible starting with Vega10 and
++ * are broken on Navi10 and Navi14.
++ */
++ adev->vm_manager.concurrent_flush = !(adev->asic_type < CHIP_VEGA10 ||
++ adev->asic_type == CHIP_NAVI10 ||
++ adev->asic_type == CHIP_NAVI14);
+ amdgpu_vmid_mgr_init(adev);
+
+ adev->vm_manager.fence_context =
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
+@@ -325,6 +325,7 @@ struct amdgpu_vm_manager {
+ /* Handling of VMIDs */
+ struct amdgpu_vmid_mgr id_mgr[AMDGPU_MAX_VMHUBS];
+ unsigned int first_kfd_vmid;
++ bool concurrent_flush;
+
+ /* Handling of VM fences */
+ u64 fence_context;
--- /dev/null
+From 4d906839d321c2efbf3fed4bc31ffd9ff55b75c0 Mon Sep 17 00:00:00 2001
+From: Paul Cercueil <paul@crapouillou.net>
+Date: Sat, 27 Mar 2021 11:57:40 +0000
+Subject: drm: bridge/panel: Cleanup connector on bridge detach
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+commit 4d906839d321c2efbf3fed4bc31ffd9ff55b75c0 upstream.
+
+If we don't call drm_connector_cleanup() manually in
+panel_bridge_detach(), the connector will be cleaned up with the other
+DRM objects in the call to drm_mode_config_cleanup(). However, since our
+drm_connector is devm-allocated, by the time drm_mode_config_cleanup()
+will be called, our connector will be long gone. Therefore, the
+connector must be cleaned up when the bridge is detached to avoid
+use-after-free conditions.
+
+v2: Cleanup connector only if it was created
+
+v3: Add FIXME
+
+v4: (Use connector->dev) directly in if() block
+
+Fixes: 13dfc0540a57 ("drm/bridge: Refactor out the panel wrapper from the lvds-encoder bridge.")
+Cc: <stable@vger.kernel.org> # 4.12+
+Cc: Andrzej Hajda <a.hajda@samsung.com>
+Cc: Neil Armstrong <narmstrong@baylibre.com>
+Cc: Laurent Pinchart <Laurent.pinchart@ideasonboard.com>
+Cc: Jonas Karlman <jonas@kwiboo.se>
+Cc: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210327115742.18986-2-paul@crapouillou.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/bridge/panel.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/gpu/drm/bridge/panel.c
++++ b/drivers/gpu/drm/bridge/panel.c
+@@ -87,6 +87,18 @@ static int panel_bridge_attach(struct dr
+
+ static void panel_bridge_detach(struct drm_bridge *bridge)
+ {
++ struct panel_bridge *panel_bridge = drm_bridge_to_panel_bridge(bridge);
++ struct drm_connector *connector = &panel_bridge->connector;
++
++ /*
++ * Cleanup the connector if we know it was initialized.
++ *
++ * FIXME: This wouldn't be needed if the panel_bridge structure was
++ * allocated with drmm_kzalloc(). This might be tricky since the
++ * drm_device pointer can only be retrieved when the bridge is attached.
++ */
++ if (connector->dev)
++ drm_connector_cleanup(connector);
+ }
+
+ static void panel_bridge_pre_enable(struct drm_bridge *bridge)
--- /dev/null
+From 419e91ea3143bf26991442465ac64d9461e98d96 Mon Sep 17 00:00:00 2001
+From: Wayne Lin <Wayne.Lin@amd.com>
+Date: Wed, 24 Feb 2021 18:15:20 +0800
+Subject: drm/dp_mst: Revise broadcast msg lct & lcr
+
+From: Wayne Lin <Wayne.Lin@amd.com>
+
+commit 419e91ea3143bf26991442465ac64d9461e98d96 upstream.
+
+[Why & How]
+According to DP spec, broadcast message LCT equals to 1 and LCR equals
+to 6. Current implementation is incorrect. Fix it.
+In addition, revise a bit the hdr->rad handling to include broadcast
+case.
+
+Signed-off-by: Wayne Lin <Wayne.Lin@amd.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210224101521.6713-2-Wayne.Lin@amd.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -2829,10 +2829,15 @@ static int set_hdr_from_dst_qlock(struct
+ else
+ hdr->broadcast = 0;
+ hdr->path_msg = txmsg->path_msg;
+- hdr->lct = mstb->lct;
+- hdr->lcr = mstb->lct - 1;
+- if (mstb->lct > 1)
+- memcpy(hdr->rad, mstb->rad, mstb->lct / 2);
++ if (hdr->broadcast) {
++ hdr->lct = 1;
++ hdr->lcr = 6;
++ } else {
++ hdr->lct = mstb->lct;
++ hdr->lcr = mstb->lct - 1;
++ }
++
++ memcpy(hdr->rad, mstb->rad, hdr->lct / 2);
+
+ return 0;
+ }
--- /dev/null
+From d919d3d6cdb31d0f9fe06c880f683a24f2838813 Mon Sep 17 00:00:00 2001
+From: Wayne Lin <Wayne.Lin@amd.com>
+Date: Wed, 24 Feb 2021 18:15:21 +0800
+Subject: drm/dp_mst: Set CLEAR_PAYLOAD_ID_TABLE as broadcast
+
+From: Wayne Lin <Wayne.Lin@amd.com>
+
+commit d919d3d6cdb31d0f9fe06c880f683a24f2838813 upstream.
+
+[Why & How]
+According to DP spec, CLEAR_PAYLOAD_ID_TABLE is a path broadcast request
+message and current implementation is incorrect. Fix it.
+
+Signed-off-by: Wayne Lin <Wayne.Lin@amd.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210224101521.6713-3-Wayne.Lin@amd.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -1154,6 +1154,7 @@ static void build_clear_payload_id_table
+
+ req.req_type = DP_CLEAR_PAYLOAD_ID_TABLE;
+ drm_dp_encode_sideband_req(&req, msg);
++ msg->path_msg = true;
+ }
+
+ static int build_enum_path_resources(struct drm_dp_sideband_msg_tx *msg,
+@@ -2824,7 +2825,8 @@ static int set_hdr_from_dst_qlock(struct
+
+ req_type = txmsg->msg[0] & 0x7f;
+ if (req_type == DP_CONNECTION_STATUS_NOTIFY ||
+- req_type == DP_RESOURCE_STATUS_NOTIFY)
++ req_type == DP_RESOURCE_STATUS_NOTIFY ||
++ req_type == DP_CLEAR_PAYLOAD_ID_TABLE)
+ hdr->broadcast = 1;
+ else
+ hdr->broadcast = 0;
--- /dev/null
+From 3aa0a80fc692c9959c261f4c5bfe9c23ddd90562 Mon Sep 17 00:00:00 2001
+From: Boris Brezillon <boris.brezillon@collabora.com>
+Date: Fri, 5 Feb 2021 12:17:55 +0100
+Subject: drm/panfrost: Clear MMU irqs before handling the fault
+
+From: Boris Brezillon <boris.brezillon@collabora.com>
+
+commit 3aa0a80fc692c9959c261f4c5bfe9c23ddd90562 upstream.
+
+When a fault is handled it will unblock the GPU which will continue
+executing its shader and might fault almost immediately on a different
+page. If we clear interrupts after handling the fault we might miss new
+faults, so clear them before.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 187d2929206e ("drm/panfrost: Add support for GPU heap allocations")
+Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
+Reviewed-by: Steven Price <steven.price@arm.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210205111757.585248-2-boris.brezillon@collabora.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/panfrost/panfrost_mmu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/panfrost/panfrost_mmu.c
++++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c
+@@ -600,6 +600,8 @@ static irqreturn_t panfrost_mmu_irq_hand
+ access_type = (fault_status >> 8) & 0x3;
+ source_id = (fault_status >> 16);
+
++ mmu_write(pfdev, MMU_INT_CLEAR, mask);
++
+ /* Page fault only */
+ ret = -1;
+ if ((status & mask) == BIT(i) && (exception_type & 0xF8) == 0xC0)
+@@ -623,8 +625,6 @@ static irqreturn_t panfrost_mmu_irq_hand
+ access_type, access_type_name(pfdev, fault_status),
+ source_id);
+
+- mmu_write(pfdev, MMU_INT_CLEAR, mask);
+-
+ status &= ~mask;
+ }
+
--- /dev/null
+From f45da8204ff1707c529a8769f5467ff16f504b26 Mon Sep 17 00:00:00 2001
+From: Boris Brezillon <boris.brezillon@collabora.com>
+Date: Fri, 5 Feb 2021 12:17:56 +0100
+Subject: drm/panfrost: Don't try to map pages that are already mapped
+
+From: Boris Brezillon <boris.brezillon@collabora.com>
+
+commit f45da8204ff1707c529a8769f5467ff16f504b26 upstream.
+
+We allocate 2MB chunks at a time, so it might appear that a page fault
+has already been handled by a previous page fault when we reach
+panfrost_mmu_map_fault_addr(). Bail out in that case to avoid mapping the
+same area twice.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 187d2929206e ("drm/panfrost: Add support for GPU heap allocations")
+Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
+Reviewed-by: Steven Price <steven.price@arm.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210205111757.585248-3-boris.brezillon@collabora.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/panfrost/panfrost_mmu.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/panfrost/panfrost_mmu.c
++++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c
+@@ -495,8 +495,14 @@ static int panfrost_mmu_map_fault_addr(s
+ }
+ bo->base.pages = pages;
+ bo->base.pages_use_count = 1;
+- } else
++ } else {
+ pages = bo->base.pages;
++ if (pages[page_offset]) {
++ /* Pages are already mapped, bail out. */
++ mutex_unlock(&bo->base.pages_lock);
++ goto out;
++ }
++ }
+
+ mapping = bo->base.base.filp->f_mapping;
+ mapping_set_unevictable(mapping);
+@@ -529,6 +535,7 @@ static int panfrost_mmu_map_fault_addr(s
+
+ dev_dbg(pfdev->dev, "mapped page fault @ AS%d %llx", as, addr);
+
++out:
+ panfrost_gem_mapping_put(bomapping);
+
+ return 0;
--- /dev/null
+From 8dbc2ccac5a65c5b57e3070e36a3dc97c7970d96 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Wed, 3 Mar 2021 00:27:59 +0000
+Subject: drm/radeon: fix copy of uninitialized variable back to userspace
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Colin Ian King <colin.king@canonical.com>
+
+commit 8dbc2ccac5a65c5b57e3070e36a3dc97c7970d96 upstream.
+
+Currently the ioctl command RADEON_INFO_SI_BACKEND_ENABLED_MASK can
+copy back uninitialised data in value_tmp that pointer *value points
+to. This can occur when rdev->family is less than CHIP_BONAIRE and
+less than CHIP_TAHITI. Fix this by adding in a missing -EINVAL
+so that no invalid value is copied back to userspace.
+
+Addresses-Coverity: ("Uninitialized scalar variable)
+Cc: stable@vger.kernel.org # 3.13+
+Fixes: 439a1cfffe2c ("drm/radeon: expose render backend mask to the userspace")
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/radeon/radeon_kms.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_kms.c
+@@ -512,6 +512,7 @@ static int radeon_info_ioctl(struct drm_
+ *value = rdev->config.si.backend_enable_mask;
+ } else {
+ DRM_DEBUG_KMS("BACKEND_ENABLED_MASK is si+ only!\n");
++ return -EINVAL;
+ }
+ break;
+ case RADEON_INFO_MAX_SCLK:
drm-i915-gvt-fix-virtual-display-setup-for-bxt-apl.patch
drm-i915-gvt-fix-vfio_edid-issue-for-bxt-apl.patch
drm-qxl-use-ttm-bo-priorities.patch
+drm-panfrost-clear-mmu-irqs-before-handling-the-fault.patch
+drm-panfrost-don-t-try-to-map-pages-that-are-already-mapped.patch
+drm-radeon-fix-copy-of-uninitialized-variable-back-to-userspace.patch
+drm-dp_mst-revise-broadcast-msg-lct-lcr.patch
+drm-dp_mst-set-clear_payload_id_table-as-broadcast.patch
+drm-bridge-panel-cleanup-connector-on-bridge-detach.patch
+drm-amd-display-reject-non-zero-src_y-and-src_x-for-video-planes.patch
+drm-amdgpu-fix-concurrent-vm-flushes-on-vega-navi-v2.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
