From: Greg Kroah-Hartman Date: Wed, 12 May 2021 09:54:28 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v5.4.119~65 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=843a2a9c9db648ca8e92501bd999b5daa0c45fab;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: drm-amd-display-reject-non-zero-src_y-and-src_x-for-video-planes.patch drm-panfrost-clear-mmu-irqs-before-handling-the-fault.patch drm-panfrost-don-t-try-to-map-pages-that-are-already-mapped.patch drm-radeon-fix-copy-of-uninitialized-variable-back-to-userspace.patch --- diff --git a/queue-5.4/drm-amd-display-reject-non-zero-src_y-and-src_x-for-video-planes.patch b/queue-5.4/drm-amd-display-reject-non-zero-src_y-and-src_x-for-video-planes.patch new file mode 100644 index 00000000000..9fbe4af8da6 --- /dev/null +++ b/queue-5.4/drm-amd-display-reject-non-zero-src_y-and-src_x-for-video-planes.patch @@ -0,0 +1,75 @@ +From d89f6048bdcb6a56abb396c584747d5eeae650db Mon Sep 17 00:00:00 2001 +From: Harry Wentland +Date: Thu, 22 Apr 2021 19:10:52 -0400 +Subject: drm/amd/display: Reject non-zero src_y and src_x for video planes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Harry Wentland + +commit d89f6048bdcb6a56abb396c584747d5eeae650db upstream. + +[Why] +This hasn't been well tested and leads to complete system hangs on DCN1 +based systems, possibly others. + +The system hang can be reproduced by gesturing the video on the YouTube +Android app on ChromeOS into full screen. + +[How] +Reject atomic commits with non-zero drm_plane_state.src_x or src_y values. + +v2: + - Add code comment describing the reason we're rejecting non-zero + src_x and src_y + - Drop gerrit Change-Id + - Add stable CC + - Based on amd-staging-drm-next + +v3: removed trailing whitespace + +Signed-off-by: Harry Wentland +Cc: stable@vger.kernel.org +Cc: nicholas.kazlauskas@amd.com +Cc: amd-gfx@lists.freedesktop.org +Cc: alexander.deucher@amd.com +Cc: Roman.Li@amd.com +Cc: hersenxs.wu@amd.com +Cc: danny.wang@amd.com +Reviewed-by: Nicholas Kazlauskas +Acked-by: Christian König +Reviewed-by: Hersen Wu +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -2632,6 +2632,23 @@ static int fill_dc_scaling_info(const st + scaling_info->src_rect.x = state->src_x >> 16; + scaling_info->src_rect.y = state->src_y >> 16; + ++ /* ++ * For reasons we don't (yet) fully understand a non-zero ++ * src_y coordinate into an NV12 buffer can cause a ++ * system hang. To avoid hangs (and maybe be overly cautious) ++ * let's reject both non-zero src_x and src_y. ++ * ++ * We currently know of only one use-case to reproduce a ++ * scenario with non-zero src_x and src_y for NV12, which ++ * is to gesture the YouTube Android app into full screen ++ * on ChromeOS. ++ */ ++ if (state->fb && ++ state->fb->format->format == DRM_FORMAT_NV12 && ++ (scaling_info->src_rect.x != 0 || ++ scaling_info->src_rect.y != 0)) ++ return -EINVAL; ++ + scaling_info->src_rect.width = state->src_w >> 16; + if (scaling_info->src_rect.width == 0) + return -EINVAL; diff --git a/queue-5.4/drm-panfrost-clear-mmu-irqs-before-handling-the-fault.patch b/queue-5.4/drm-panfrost-clear-mmu-irqs-before-handling-the-fault.patch new file mode 100644 index 00000000000..3756b0e4f15 --- /dev/null +++ b/queue-5.4/drm-panfrost-clear-mmu-irqs-before-handling-the-fault.patch @@ -0,0 +1,44 @@ +From 3aa0a80fc692c9959c261f4c5bfe9c23ddd90562 Mon Sep 17 00:00:00 2001 +From: Boris Brezillon +Date: Fri, 5 Feb 2021 12:17:55 +0100 +Subject: drm/panfrost: Clear MMU irqs before handling the fault + +From: Boris Brezillon + +commit 3aa0a80fc692c9959c261f4c5bfe9c23ddd90562 upstream. + +When a fault is handled it will unblock the GPU which will continue +executing its shader and might fault almost immediately on a different +page. If we clear interrupts after handling the fault we might miss new +faults, so clear them before. + +Cc: +Fixes: 187d2929206e ("drm/panfrost: Add support for GPU heap allocations") +Signed-off-by: Boris Brezillon +Reviewed-by: Steven Price +Link: https://patchwork.freedesktop.org/patch/msgid/20210205111757.585248-2-boris.brezillon@collabora.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/panfrost/panfrost_mmu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/panfrost/panfrost_mmu.c ++++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c +@@ -600,6 +600,8 @@ static irqreturn_t panfrost_mmu_irq_hand + access_type = (fault_status >> 8) & 0x3; + source_id = (fault_status >> 16); + ++ mmu_write(pfdev, MMU_INT_CLEAR, mask); ++ + /* Page fault only */ + ret = -1; + if ((status & mask) == BIT(i) && (exception_type & 0xF8) == 0xC0) +@@ -623,8 +625,6 @@ static irqreturn_t panfrost_mmu_irq_hand + access_type, access_type_name(pfdev, fault_status), + source_id); + +- mmu_write(pfdev, MMU_INT_CLEAR, mask); +- + status &= ~mask; + } + diff --git a/queue-5.4/drm-panfrost-don-t-try-to-map-pages-that-are-already-mapped.patch b/queue-5.4/drm-panfrost-don-t-try-to-map-pages-that-are-already-mapped.patch new file mode 100644 index 00000000000..6244e76d3f1 --- /dev/null +++ b/queue-5.4/drm-panfrost-don-t-try-to-map-pages-that-are-already-mapped.patch @@ -0,0 +1,50 @@ +From f45da8204ff1707c529a8769f5467ff16f504b26 Mon Sep 17 00:00:00 2001 +From: Boris Brezillon +Date: Fri, 5 Feb 2021 12:17:56 +0100 +Subject: drm/panfrost: Don't try to map pages that are already mapped + +From: Boris Brezillon + +commit f45da8204ff1707c529a8769f5467ff16f504b26 upstream. + +We allocate 2MB chunks at a time, so it might appear that a page fault +has already been handled by a previous page fault when we reach +panfrost_mmu_map_fault_addr(). Bail out in that case to avoid mapping the +same area twice. + +Cc: +Fixes: 187d2929206e ("drm/panfrost: Add support for GPU heap allocations") +Signed-off-by: Boris Brezillon +Reviewed-by: Steven Price +Link: https://patchwork.freedesktop.org/patch/msgid/20210205111757.585248-3-boris.brezillon@collabora.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/panfrost/panfrost_mmu.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/panfrost/panfrost_mmu.c ++++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c +@@ -494,8 +494,14 @@ static int panfrost_mmu_map_fault_addr(s + } + bo->base.pages = pages; + bo->base.pages_use_count = 1; +- } else ++ } else { + pages = bo->base.pages; ++ if (pages[page_offset]) { ++ /* Pages are already mapped, bail out. */ ++ mutex_unlock(&bo->base.pages_lock); ++ goto out; ++ } ++ } + + mapping = bo->base.base.filp->f_mapping; + mapping_set_unevictable(mapping); +@@ -529,6 +535,7 @@ static int panfrost_mmu_map_fault_addr(s + + dev_dbg(pfdev->dev, "mapped page fault @ AS%d %llx", as, addr); + ++out: + panfrost_gem_mapping_put(bomapping); + + return 0; diff --git a/queue-5.4/drm-radeon-fix-copy-of-uninitialized-variable-back-to-userspace.patch b/queue-5.4/drm-radeon-fix-copy-of-uninitialized-variable-back-to-userspace.patch new file mode 100644 index 00000000000..181c1b7f281 --- /dev/null +++ b/queue-5.4/drm-radeon-fix-copy-of-uninitialized-variable-back-to-userspace.patch @@ -0,0 +1,39 @@ +From 8dbc2ccac5a65c5b57e3070e36a3dc97c7970d96 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Wed, 3 Mar 2021 00:27:59 +0000 +Subject: drm/radeon: fix copy of uninitialized variable back to userspace +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Colin Ian King + +commit 8dbc2ccac5a65c5b57e3070e36a3dc97c7970d96 upstream. + +Currently the ioctl command RADEON_INFO_SI_BACKEND_ENABLED_MASK can +copy back uninitialised data in value_tmp that pointer *value points +to. This can occur when rdev->family is less than CHIP_BONAIRE and +less than CHIP_TAHITI. Fix this by adding in a missing -EINVAL +so that no invalid value is copied back to userspace. + +Addresses-Coverity: ("Uninitialized scalar variable) +Cc: stable@vger.kernel.org # 3.13+ +Fixes: 439a1cfffe2c ("drm/radeon: expose render backend mask to the userspace") +Reviewed-by: Christian König +Signed-off-by: Colin Ian King +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/radeon/radeon_kms.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/radeon/radeon_kms.c ++++ b/drivers/gpu/drm/radeon/radeon_kms.c +@@ -512,6 +512,7 @@ static int radeon_info_ioctl(struct drm_ + *value = rdev->config.si.backend_enable_mask; + } else { + DRM_DEBUG_KMS("BACKEND_ENABLED_MASK is si+ only!\n"); ++ return -EINVAL; + } + break; + case RADEON_INFO_MAX_SCLK: diff --git a/queue-5.4/series b/queue-5.4/series index d593c269afe..a31a804b138 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -36,3 +36,7 @@ mips-reinstate-platform-__div64_32-handler.patch ipw2x00-potential-buffer-overflow-in-libipw_wx_set_encodeext.patch cfg80211-scan-drop-entry-from-hidden_list-on-overflow.patch rtw88-fix-array-overrun-in-rtw_get_tx_power_params.patch +drm-panfrost-clear-mmu-irqs-before-handling-the-fault.patch +drm-panfrost-don-t-try-to-map-pages-that-are-already-mapped.patch +drm-radeon-fix-copy-of-uninitialized-variable-back-to-userspace.patch +drm-amd-display-reject-non-zero-src_y-and-src_x-for-video-planes.patch