From: Greg Kroah-Hartman Date: Wed, 12 May 2021 09:55:03 +0000 (+0200) Subject: 5.11-stable patches X-Git-Tag: v5.4.119~63 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=faa6be8a6791363aaeca0d99dba0f948d25a53a8;p=thirdparty%2Fkernel%2Fstable-queue.git 5.11-stable patches added patches: drm-amd-display-reject-non-zero-src_y-and-src_x-for-video-planes.patch drm-amdgpu-add-new-mc-firmware-for-polaris12-32bit-asic.patch drm-amdgpu-fix-concurrent-vm-flushes-on-vega-navi-v2.patch drm-amdgpu-init-gfx10_addr_config-for-vcn-v3-in-dpg-mode.patch drm-bridge-fix-anx7625-use-of-mipi_dsi_-functions.patch drm-bridge-panel-cleanup-connector-on-bridge-detach.patch drm-dp_mst-revise-broadcast-msg-lct-lcr.patch drm-dp_mst-set-clear_payload_id_table-as-broadcast.patch drm-ingenic-fix-non-osd-mode.patch drm-panfrost-clear-mmu-irqs-before-handling-the-fault.patch drm-panfrost-don-t-try-to-map-pages-that-are-already-mapped.patch drm-radeon-fix-copy-of-uninitialized-variable-back-to-userspace.patch --- diff --git a/queue-5.11/drm-amd-display-reject-non-zero-src_y-and-src_x-for-video-planes.patch b/queue-5.11/drm-amd-display-reject-non-zero-src_y-and-src_x-for-video-planes.patch new file mode 100644 index 00000000000..4b3573ed134 --- /dev/null +++ b/queue-5.11/drm-amd-display-reject-non-zero-src_y-and-src_x-for-video-planes.patch @@ -0,0 +1,75 @@ +From d89f6048bdcb6a56abb396c584747d5eeae650db Mon Sep 17 00:00:00 2001 +From: Harry Wentland +Date: Thu, 22 Apr 2021 19:10:52 -0400 +Subject: drm/amd/display: Reject non-zero src_y and src_x for video planes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Harry Wentland + +commit d89f6048bdcb6a56abb396c584747d5eeae650db upstream. + +[Why] +This hasn't been well tested and leads to complete system hangs on DCN1 +based systems, possibly others. + +The system hang can be reproduced by gesturing the video on the YouTube +Android app on ChromeOS into full screen. + +[How] +Reject atomic commits with non-zero drm_plane_state.src_x or src_y values. + +v2: + - Add code comment describing the reason we're rejecting non-zero + src_x and src_y + - Drop gerrit Change-Id + - Add stable CC + - Based on amd-staging-drm-next + +v3: removed trailing whitespace + +Signed-off-by: Harry Wentland +Cc: stable@vger.kernel.org +Cc: nicholas.kazlauskas@amd.com +Cc: amd-gfx@lists.freedesktop.org +Cc: alexander.deucher@amd.com +Cc: Roman.Li@amd.com +Cc: hersenxs.wu@amd.com +Cc: danny.wang@amd.com +Reviewed-by: Nicholas Kazlauskas +Acked-by: Christian König +Reviewed-by: Hersen Wu +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -3740,6 +3740,23 @@ static int fill_dc_scaling_info(const st + scaling_info->src_rect.x = state->src_x >> 16; + scaling_info->src_rect.y = state->src_y >> 16; + ++ /* ++ * For reasons we don't (yet) fully understand a non-zero ++ * src_y coordinate into an NV12 buffer can cause a ++ * system hang. To avoid hangs (and maybe be overly cautious) ++ * let's reject both non-zero src_x and src_y. ++ * ++ * We currently know of only one use-case to reproduce a ++ * scenario with non-zero src_x and src_y for NV12, which ++ * is to gesture the YouTube Android app into full screen ++ * on ChromeOS. ++ */ ++ if (state->fb && ++ state->fb->format->format == DRM_FORMAT_NV12 && ++ (scaling_info->src_rect.x != 0 || ++ scaling_info->src_rect.y != 0)) ++ return -EINVAL; ++ + scaling_info->src_rect.width = state->src_w >> 16; + if (scaling_info->src_rect.width == 0) + return -EINVAL; diff --git a/queue-5.11/drm-amdgpu-add-new-mc-firmware-for-polaris12-32bit-asic.patch b/queue-5.11/drm-amdgpu-add-new-mc-firmware-for-polaris12-32bit-asic.patch new file mode 100644 index 00000000000..265e4679b8b --- /dev/null +++ b/queue-5.11/drm-amdgpu-add-new-mc-firmware-for-polaris12-32bit-asic.patch @@ -0,0 +1,50 @@ +From c83c4e1912446db697a120eb30126cd80cbf6349 Mon Sep 17 00:00:00 2001 +From: Evan Quan +Date: Wed, 28 Apr 2021 12:00:20 +0800 +Subject: drm/amdgpu: add new MC firmware for Polaris12 32bit ASIC + +From: Evan Quan + +commit c83c4e1912446db697a120eb30126cd80cbf6349 upstream. + +Polaris12 32bit ASIC needs a special MC firmware. + +Signed-off-by: Evan Quan +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c +@@ -59,6 +59,7 @@ MODULE_FIRMWARE("amdgpu/tonga_mc.bin"); + MODULE_FIRMWARE("amdgpu/polaris11_mc.bin"); + MODULE_FIRMWARE("amdgpu/polaris10_mc.bin"); + MODULE_FIRMWARE("amdgpu/polaris12_mc.bin"); ++MODULE_FIRMWARE("amdgpu/polaris12_32_mc.bin"); + MODULE_FIRMWARE("amdgpu/polaris11_k_mc.bin"); + MODULE_FIRMWARE("amdgpu/polaris10_k_mc.bin"); + MODULE_FIRMWARE("amdgpu/polaris12_k_mc.bin"); +@@ -243,10 +244,16 @@ static int gmc_v8_0_init_microcode(struc + chip_name = "polaris10"; + break; + case CHIP_POLARIS12: +- if (ASICID_IS_P23(adev->pdev->device, adev->pdev->revision)) ++ if (ASICID_IS_P23(adev->pdev->device, adev->pdev->revision)) { + chip_name = "polaris12_k"; +- else +- chip_name = "polaris12"; ++ } else { ++ WREG32(mmMC_SEQ_IO_DEBUG_INDEX, ixMC_IO_DEBUG_UP_159); ++ /* Polaris12 32bit ASIC needs a special MC firmware */ ++ if (RREG32(mmMC_SEQ_IO_DEBUG_DATA) == 0x05b4dc40) ++ chip_name = "polaris12_32"; ++ else ++ chip_name = "polaris12"; ++ } + break; + case CHIP_FIJI: + case CHIP_CARRIZO: diff --git a/queue-5.11/drm-amdgpu-fix-concurrent-vm-flushes-on-vega-navi-v2.patch b/queue-5.11/drm-amdgpu-fix-concurrent-vm-flushes-on-vega-navi-v2.patch new file mode 100644 index 00000000000..8e9905f2acf --- /dev/null +++ b/queue-5.11/drm-amdgpu-fix-concurrent-vm-flushes-on-vega-navi-v2.patch @@ -0,0 +1,108 @@ +From 20a5f5a98e1bb3d40acd97e89299e8c2d22784be Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20K=C3=B6nig?= +Date: Thu, 22 Apr 2021 13:11:39 +0200 +Subject: drm/amdgpu: fix concurrent VM flushes on Vega/Navi v2 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian König + +commit 20a5f5a98e1bb3d40acd97e89299e8c2d22784be upstream. + +Starting with Vega the hardware supports concurrent flushes +of VMID which can be used to implement per process VMID +allocation. + +But concurrent flushes are mutual exclusive with back to +back VMID allocations, fix this to avoid a VMID used in +two ways at the same time. + +v2: don't set ring to NULL + +Signed-off-by: Christian König +Reviewed-by: James Zhu +Tested-by: James Zhu +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c | 19 +++++++++++-------- + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 ++++++ + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 1 + + 3 files changed, 18 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c +@@ -215,7 +215,11 @@ static int amdgpu_vmid_grab_idle(struct + /* Check if we have an idle VMID */ + i = 0; + list_for_each_entry((*idle), &id_mgr->ids_lru, list) { +- fences[i] = amdgpu_sync_peek_fence(&(*idle)->active, ring); ++ /* Don't use per engine and per process VMID at the same time */ ++ struct amdgpu_ring *r = adev->vm_manager.concurrent_flush ? ++ NULL : ring; ++ ++ fences[i] = amdgpu_sync_peek_fence(&(*idle)->active, r); + if (!fences[i]) + break; + ++i; +@@ -281,7 +285,7 @@ static int amdgpu_vmid_grab_reserved(str + if (updates && (*id)->flushed_updates && + updates->context == (*id)->flushed_updates->context && + !dma_fence_is_later(updates, (*id)->flushed_updates)) +- updates = NULL; ++ updates = NULL; + + if ((*id)->owner != vm->immediate.fence_context || + job->vm_pd_addr != (*id)->pd_gpu_addr || +@@ -290,6 +294,10 @@ static int amdgpu_vmid_grab_reserved(str + !dma_fence_is_signaled((*id)->last_flush))) { + struct dma_fence *tmp; + ++ /* Don't use per engine and per process VMID at the same time */ ++ if (adev->vm_manager.concurrent_flush) ++ ring = NULL; ++ + /* to prevent one context starved by another context */ + (*id)->pd_gpu_addr = 0; + tmp = amdgpu_sync_peek_fence(&(*id)->active, ring); +@@ -365,12 +373,7 @@ static int amdgpu_vmid_grab_used(struct + if (updates && (!flushed || dma_fence_is_later(updates, flushed))) + needs_flush = true; + +- /* Concurrent flushes are only possible starting with Vega10 and +- * are broken on Navi10 and Navi14. +- */ +- if (needs_flush && (adev->asic_type < CHIP_VEGA10 || +- adev->asic_type == CHIP_NAVI10 || +- adev->asic_type == CHIP_NAVI14)) ++ if (needs_flush && !adev->vm_manager.concurrent_flush) + continue; + + /* Good, we can use this VMID. Remember this submission as +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +@@ -3145,6 +3145,12 @@ void amdgpu_vm_manager_init(struct amdgp + { + unsigned i; + ++ /* Concurrent flushes are only possible starting with Vega10 and ++ * are broken on Navi10 and Navi14. ++ */ ++ adev->vm_manager.concurrent_flush = !(adev->asic_type < CHIP_VEGA10 || ++ adev->asic_type == CHIP_NAVI10 || ++ adev->asic_type == CHIP_NAVI14); + amdgpu_vmid_mgr_init(adev); + + adev->vm_manager.fence_context = +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h +@@ -331,6 +331,7 @@ struct amdgpu_vm_manager { + /* Handling of VMIDs */ + struct amdgpu_vmid_mgr id_mgr[AMDGPU_MAX_VMHUBS]; + unsigned int first_kfd_vmid; ++ bool concurrent_flush; + + /* Handling of VM fences */ + u64 fence_context; diff --git a/queue-5.11/drm-amdgpu-init-gfx10_addr_config-for-vcn-v3-in-dpg-mode.patch b/queue-5.11/drm-amdgpu-init-gfx10_addr_config-for-vcn-v3-in-dpg-mode.patch new file mode 100644 index 00000000000..b52d95a8a7c --- /dev/null +++ b/queue-5.11/drm-amdgpu-init-gfx10_addr_config-for-vcn-v3-in-dpg-mode.patch @@ -0,0 +1,37 @@ +From 8bf073ca9235fe38d7b74a0b4e779cfa7cc70fc9 Mon Sep 17 00:00:00 2001 +From: Bas Nieuwenhuizen +Date: Wed, 5 May 2021 03:27:49 +0200 +Subject: drm/amdgpu: Init GFX10_ADDR_CONFIG for VCN v3 in DPG mode. + +From: Bas Nieuwenhuizen + +commit 8bf073ca9235fe38d7b74a0b4e779cfa7cc70fc9 upstream. + +Otherwise tiling modes that require the values form this field +(In particular _*_X) would be corrupted upon video decode. + +Copied from the VCN v2 code. + +Fixes: 99541f392b4d ("drm/amdgpu: add mc resume DPG mode for VCN3.0") +Reviewed-and-Tested by: Leo Liu +Signed-off-by: Bas Nieuwenhuizen +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c +@@ -584,6 +584,10 @@ static void vcn_v3_0_mc_resume_dpg_mode( + WREG32_SOC15_DPG_MODE(inst_idx, SOC15_DPG_MODE_OFFSET( + VCN, inst_idx, mmUVD_VCPU_NONCACHE_SIZE0), + AMDGPU_GPU_PAGE_ALIGN(sizeof(struct amdgpu_fw_shared)), 0, indirect); ++ ++ /* VCN global tiling registers */ ++ WREG32_SOC15_DPG_MODE(0, SOC15_DPG_MODE_OFFSET( ++ UVD, 0, mmUVD_GFX10_ADDR_CONFIG), adev->gfx.config.gb_addr_config, 0, indirect); + } + + static void vcn_v3_0_disable_static_power_gating(struct amdgpu_device *adev, int inst) diff --git a/queue-5.11/drm-bridge-fix-anx7625-use-of-mipi_dsi_-functions.patch b/queue-5.11/drm-bridge-fix-anx7625-use-of-mipi_dsi_-functions.patch new file mode 100644 index 00000000000..ca0f2668cbd --- /dev/null +++ b/queue-5.11/drm-bridge-fix-anx7625-use-of-mipi_dsi_-functions.patch @@ -0,0 +1,46 @@ +From ed01fca38717169fcb61bd45ad1c3750d9c40d59 Mon Sep 17 00:00:00 2001 +From: Randy Dunlap +Date: Thu, 15 Apr 2021 11:36:19 -0700 +Subject: drm: bridge: fix ANX7625 use of mipi_dsi_() functions + +From: Randy Dunlap + +commit ed01fca38717169fcb61bd45ad1c3750d9c40d59 upstream. + +The Analogix DRM ANX7625 bridge driver uses mips_dsi_() function +interfaces so it should select DRM_MIPI_DSI to prevent build errors. + +ERROR: modpost: "mipi_dsi_attach" [drivers/gpu/drm/bridge/analogix/anx7625.ko] undefined! +ERROR: modpost: "mipi_dsi_device_register_full" [drivers/gpu/drm/bridge/analogix/anx7625.ko] undefined! +ERROR: modpost: "of_find_mipi_dsi_host_by_node" [drivers/gpu/drm/bridge/analogix/anx7625.ko] undefined! +ERROR: modpost: "mipi_dsi_device_unregister" [drivers/gpu/drm/bridge/analogix/anx7625.ko] undefined! +ERROR: modpost: "mipi_dsi_detach" [drivers/gpu/drm/bridge/analogix/anx7625.ko] undefined! + +Fixes: 8bdfc5dae4e3 ("drm/bridge: anx7625: Add anx7625 MIPI DSI/DPI to DP") +Reported-by: kernel test robot +Signed-off-by: Randy Dunlap +Reviewed-by: Robert Foss +Cc: Xin Ji +Cc: Sam Ravnborg +Cc: dri-devel@lists.freedesktop.org +Cc: Andrzej Hajda +Cc: Neil Armstrong +Cc: Robert Foss +Cc: stable@vger.kernel.org +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20210415183619.1431-1-rdunlap@infradead.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/bridge/analogix/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/bridge/analogix/Kconfig ++++ b/drivers/gpu/drm/bridge/analogix/Kconfig +@@ -30,6 +30,7 @@ config DRM_ANALOGIX_ANX7625 + tristate "Analogix Anx7625 MIPI to DP interface support" + depends on DRM + depends on OF ++ select DRM_MIPI_DSI + help + ANX7625 is an ultra-low power 4K mobile HD transmitter + designed for portable devices. It converts MIPI/DPI to diff --git a/queue-5.11/drm-bridge-panel-cleanup-connector-on-bridge-detach.patch b/queue-5.11/drm-bridge-panel-cleanup-connector-on-bridge-detach.patch new file mode 100644 index 00000000000..4c605ac05cb --- /dev/null +++ b/queue-5.11/drm-bridge-panel-cleanup-connector-on-bridge-detach.patch @@ -0,0 +1,59 @@ +From 4d906839d321c2efbf3fed4bc31ffd9ff55b75c0 Mon Sep 17 00:00:00 2001 +From: Paul Cercueil +Date: Sat, 27 Mar 2021 11:57:40 +0000 +Subject: drm: bridge/panel: Cleanup connector on bridge detach + +From: Paul Cercueil + +commit 4d906839d321c2efbf3fed4bc31ffd9ff55b75c0 upstream. + +If we don't call drm_connector_cleanup() manually in +panel_bridge_detach(), the connector will be cleaned up with the other +DRM objects in the call to drm_mode_config_cleanup(). However, since our +drm_connector is devm-allocated, by the time drm_mode_config_cleanup() +will be called, our connector will be long gone. Therefore, the +connector must be cleaned up when the bridge is detached to avoid +use-after-free conditions. + +v2: Cleanup connector only if it was created + +v3: Add FIXME + +v4: (Use connector->dev) directly in if() block + +Fixes: 13dfc0540a57 ("drm/bridge: Refactor out the panel wrapper from the lvds-encoder bridge.") +Cc: # 4.12+ +Cc: Andrzej Hajda +Cc: Neil Armstrong +Cc: Laurent Pinchart +Cc: Jonas Karlman +Cc: Jernej Skrabec +Signed-off-by: Paul Cercueil +Reviewed-by: Laurent Pinchart +Link: https://patchwork.freedesktop.org/patch/msgid/20210327115742.18986-2-paul@crapouillou.net +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/bridge/panel.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/gpu/drm/bridge/panel.c ++++ b/drivers/gpu/drm/bridge/panel.c +@@ -87,6 +87,18 @@ static int panel_bridge_attach(struct dr + + static void panel_bridge_detach(struct drm_bridge *bridge) + { ++ struct panel_bridge *panel_bridge = drm_bridge_to_panel_bridge(bridge); ++ struct drm_connector *connector = &panel_bridge->connector; ++ ++ /* ++ * Cleanup the connector if we know it was initialized. ++ * ++ * FIXME: This wouldn't be needed if the panel_bridge structure was ++ * allocated with drmm_kzalloc(). This might be tricky since the ++ * drm_device pointer can only be retrieved when the bridge is attached. ++ */ ++ if (connector->dev) ++ drm_connector_cleanup(connector); + } + + static void panel_bridge_pre_enable(struct drm_bridge *bridge) diff --git a/queue-5.11/drm-dp_mst-revise-broadcast-msg-lct-lcr.patch b/queue-5.11/drm-dp_mst-revise-broadcast-msg-lct-lcr.patch new file mode 100644 index 00000000000..6786270e895 --- /dev/null +++ b/queue-5.11/drm-dp_mst-revise-broadcast-msg-lct-lcr.patch @@ -0,0 +1,47 @@ +From 419e91ea3143bf26991442465ac64d9461e98d96 Mon Sep 17 00:00:00 2001 +From: Wayne Lin +Date: Wed, 24 Feb 2021 18:15:20 +0800 +Subject: drm/dp_mst: Revise broadcast msg lct & lcr + +From: Wayne Lin + +commit 419e91ea3143bf26991442465ac64d9461e98d96 upstream. + +[Why & How] +According to DP spec, broadcast message LCT equals to 1 and LCR equals +to 6. Current implementation is incorrect. Fix it. +In addition, revise a bit the hdr->rad handling to include broadcast +case. + +Signed-off-by: Wayne Lin +Cc: stable@vger.kernel.org +Reviewed-by: Lyude Paul +Signed-off-by: Lyude Paul +Link: https://patchwork.freedesktop.org/patch/msgid/20210224101521.6713-2-Wayne.Lin@amd.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_dp_mst_topology.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -2829,10 +2829,15 @@ static int set_hdr_from_dst_qlock(struct + else + hdr->broadcast = 0; + hdr->path_msg = txmsg->path_msg; +- hdr->lct = mstb->lct; +- hdr->lcr = mstb->lct - 1; +- if (mstb->lct > 1) +- memcpy(hdr->rad, mstb->rad, mstb->lct / 2); ++ if (hdr->broadcast) { ++ hdr->lct = 1; ++ hdr->lcr = 6; ++ } else { ++ hdr->lct = mstb->lct; ++ hdr->lcr = mstb->lct - 1; ++ } ++ ++ memcpy(hdr->rad, mstb->rad, hdr->lct / 2); + + return 0; + } diff --git a/queue-5.11/drm-dp_mst-set-clear_payload_id_table-as-broadcast.patch b/queue-5.11/drm-dp_mst-set-clear_payload_id_table-as-broadcast.patch new file mode 100644 index 00000000000..fefe5a4faea --- /dev/null +++ b/queue-5.11/drm-dp_mst-set-clear_payload_id_table-as-broadcast.patch @@ -0,0 +1,43 @@ +From d919d3d6cdb31d0f9fe06c880f683a24f2838813 Mon Sep 17 00:00:00 2001 +From: Wayne Lin +Date: Wed, 24 Feb 2021 18:15:21 +0800 +Subject: drm/dp_mst: Set CLEAR_PAYLOAD_ID_TABLE as broadcast + +From: Wayne Lin + +commit d919d3d6cdb31d0f9fe06c880f683a24f2838813 upstream. + +[Why & How] +According to DP spec, CLEAR_PAYLOAD_ID_TABLE is a path broadcast request +message and current implementation is incorrect. Fix it. + +Signed-off-by: Wayne Lin +Cc: stable@vger.kernel.org +Reviewed-by: Lyude Paul +Signed-off-by: Lyude Paul +Link: https://patchwork.freedesktop.org/patch/msgid/20210224101521.6713-3-Wayne.Lin@amd.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_dp_mst_topology.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -1154,6 +1154,7 @@ static void build_clear_payload_id_table + + req.req_type = DP_CLEAR_PAYLOAD_ID_TABLE; + drm_dp_encode_sideband_req(&req, msg); ++ msg->path_msg = true; + } + + static int build_enum_path_resources(struct drm_dp_sideband_msg_tx *msg, +@@ -2824,7 +2825,8 @@ static int set_hdr_from_dst_qlock(struct + + req_type = txmsg->msg[0] & 0x7f; + if (req_type == DP_CONNECTION_STATUS_NOTIFY || +- req_type == DP_RESOURCE_STATUS_NOTIFY) ++ req_type == DP_RESOURCE_STATUS_NOTIFY || ++ req_type == DP_CLEAR_PAYLOAD_ID_TABLE) + hdr->broadcast = 1; + else + hdr->broadcast = 0; diff --git a/queue-5.11/drm-ingenic-fix-non-osd-mode.patch b/queue-5.11/drm-ingenic-fix-non-osd-mode.patch new file mode 100644 index 00000000000..f8b6c33a95a --- /dev/null +++ b/queue-5.11/drm-ingenic-fix-non-osd-mode.patch @@ -0,0 +1,71 @@ +From 7b4957684e5d813fcbdc98144e3cc5c4467b3e2e Mon Sep 17 00:00:00 2001 +From: Paul Cercueil +Date: Sun, 24 Jan 2021 08:55:52 +0000 +Subject: drm/ingenic: Fix non-OSD mode + +From: Paul Cercueil + +commit 7b4957684e5d813fcbdc98144e3cc5c4467b3e2e upstream. + +Even though the JZ4740 did not have the OSD mode, it had (according to +the documentation) two DMA channels, but there is absolutely no +information about how to select the second DMA channel. + +Make the ingenic-drm driver work in non-OSD mode by using the +foreground0 plane (which is bound to the DMA0 channel) as the primary +plane, instead of the foreground1 plane, which is the primary plane +when in OSD mode. + +Fixes: 3c9bea4ef32b ("drm/ingenic: Add support for OSD mode") +Cc: # v5.8+ +Signed-off-by: Paul Cercueil +Acked-by: Daniel Vetter +Tested-by: H. Nikolaus Schaller +Link: https://patchwork.freedesktop.org/patch/msgid/20210124085552.29146-5-paul@crapouillou.net +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/ingenic/ingenic-drm-drv.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/ingenic/ingenic-drm-drv.c ++++ b/drivers/gpu/drm/ingenic/ingenic-drm-drv.c +@@ -553,7 +553,7 @@ static void ingenic_drm_plane_atomic_upd + height = state->src_h >> 16; + cpp = state->fb->format->cpp[0]; + +- if (priv->soc_info->has_osd && plane->type == DRM_PLANE_TYPE_OVERLAY) ++ if (!priv->soc_info->has_osd || plane->type == DRM_PLANE_TYPE_OVERLAY) + hwdesc = &priv->dma_hwdescs->hwdesc_f0; + else + hwdesc = &priv->dma_hwdescs->hwdesc_f1; +@@ -809,6 +809,7 @@ static int ingenic_drm_bind(struct devic + const struct jz_soc_info *soc_info; + struct ingenic_drm *priv; + struct clk *parent_clk; ++ struct drm_plane *primary; + struct drm_bridge *bridge; + struct drm_panel *panel; + struct drm_encoder *encoder; +@@ -923,9 +924,11 @@ static int ingenic_drm_bind(struct devic + if (soc_info->has_osd) + priv->ipu_plane = drm_plane_from_index(drm, 0); + +- drm_plane_helper_add(&priv->f1, &ingenic_drm_plane_helper_funcs); ++ primary = priv->soc_info->has_osd ? &priv->f1 : &priv->f0; + +- ret = drm_universal_plane_init(drm, &priv->f1, 1, ++ drm_plane_helper_add(primary, &ingenic_drm_plane_helper_funcs); ++ ++ ret = drm_universal_plane_init(drm, primary, 1, + &ingenic_drm_primary_plane_funcs, + priv->soc_info->formats_f1, + priv->soc_info->num_formats_f1, +@@ -937,7 +940,7 @@ static int ingenic_drm_bind(struct devic + + drm_crtc_helper_add(&priv->crtc, &ingenic_drm_crtc_helper_funcs); + +- ret = drm_crtc_init_with_planes(drm, &priv->crtc, &priv->f1, ++ ret = drm_crtc_init_with_planes(drm, &priv->crtc, primary, + NULL, &ingenic_drm_crtc_funcs, NULL); + if (ret) { + dev_err(dev, "Failed to init CRTC: %i\n", ret); diff --git a/queue-5.11/drm-panfrost-clear-mmu-irqs-before-handling-the-fault.patch b/queue-5.11/drm-panfrost-clear-mmu-irqs-before-handling-the-fault.patch new file mode 100644 index 00000000000..1553f736d50 --- /dev/null +++ b/queue-5.11/drm-panfrost-clear-mmu-irqs-before-handling-the-fault.patch @@ -0,0 +1,44 @@ +From 3aa0a80fc692c9959c261f4c5bfe9c23ddd90562 Mon Sep 17 00:00:00 2001 +From: Boris Brezillon +Date: Fri, 5 Feb 2021 12:17:55 +0100 +Subject: drm/panfrost: Clear MMU irqs before handling the fault + +From: Boris Brezillon + +commit 3aa0a80fc692c9959c261f4c5bfe9c23ddd90562 upstream. + +When a fault is handled it will unblock the GPU which will continue +executing its shader and might fault almost immediately on a different +page. If we clear interrupts after handling the fault we might miss new +faults, so clear them before. + +Cc: +Fixes: 187d2929206e ("drm/panfrost: Add support for GPU heap allocations") +Signed-off-by: Boris Brezillon +Reviewed-by: Steven Price +Link: https://patchwork.freedesktop.org/patch/msgid/20210205111757.585248-2-boris.brezillon@collabora.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/panfrost/panfrost_mmu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/panfrost/panfrost_mmu.c ++++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c +@@ -593,6 +593,8 @@ static irqreturn_t panfrost_mmu_irq_hand + access_type = (fault_status >> 8) & 0x3; + source_id = (fault_status >> 16); + ++ mmu_write(pfdev, MMU_INT_CLEAR, mask); ++ + /* Page fault only */ + ret = -1; + if ((status & mask) == BIT(i) && (exception_type & 0xF8) == 0xC0) +@@ -616,8 +618,6 @@ static irqreturn_t panfrost_mmu_irq_hand + access_type, access_type_name(pfdev, fault_status), + source_id); + +- mmu_write(pfdev, MMU_INT_CLEAR, mask); +- + status &= ~mask; + } + diff --git a/queue-5.11/drm-panfrost-don-t-try-to-map-pages-that-are-already-mapped.patch b/queue-5.11/drm-panfrost-don-t-try-to-map-pages-that-are-already-mapped.patch new file mode 100644 index 00000000000..ecfa2a80211 --- /dev/null +++ b/queue-5.11/drm-panfrost-don-t-try-to-map-pages-that-are-already-mapped.patch @@ -0,0 +1,50 @@ +From f45da8204ff1707c529a8769f5467ff16f504b26 Mon Sep 17 00:00:00 2001 +From: Boris Brezillon +Date: Fri, 5 Feb 2021 12:17:56 +0100 +Subject: drm/panfrost: Don't try to map pages that are already mapped + +From: Boris Brezillon + +commit f45da8204ff1707c529a8769f5467ff16f504b26 upstream. + +We allocate 2MB chunks at a time, so it might appear that a page fault +has already been handled by a previous page fault when we reach +panfrost_mmu_map_fault_addr(). Bail out in that case to avoid mapping the +same area twice. + +Cc: +Fixes: 187d2929206e ("drm/panfrost: Add support for GPU heap allocations") +Signed-off-by: Boris Brezillon +Reviewed-by: Steven Price +Link: https://patchwork.freedesktop.org/patch/msgid/20210205111757.585248-3-boris.brezillon@collabora.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/panfrost/panfrost_mmu.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/panfrost/panfrost_mmu.c ++++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c +@@ -488,8 +488,14 @@ static int panfrost_mmu_map_fault_addr(s + } + bo->base.pages = pages; + bo->base.pages_use_count = 1; +- } else ++ } else { + pages = bo->base.pages; ++ if (pages[page_offset]) { ++ /* Pages are already mapped, bail out. */ ++ mutex_unlock(&bo->base.pages_lock); ++ goto out; ++ } ++ } + + mapping = bo->base.base.filp->f_mapping; + mapping_set_unevictable(mapping); +@@ -522,6 +528,7 @@ static int panfrost_mmu_map_fault_addr(s + + dev_dbg(pfdev->dev, "mapped page fault @ AS%d %llx", as, addr); + ++out: + panfrost_gem_mapping_put(bomapping); + + return 0; diff --git a/queue-5.11/drm-radeon-fix-copy-of-uninitialized-variable-back-to-userspace.patch b/queue-5.11/drm-radeon-fix-copy-of-uninitialized-variable-back-to-userspace.patch new file mode 100644 index 00000000000..5132bceb13b --- /dev/null +++ b/queue-5.11/drm-radeon-fix-copy-of-uninitialized-variable-back-to-userspace.patch @@ -0,0 +1,39 @@ +From 8dbc2ccac5a65c5b57e3070e36a3dc97c7970d96 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Wed, 3 Mar 2021 00:27:59 +0000 +Subject: drm/radeon: fix copy of uninitialized variable back to userspace +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Colin Ian King + +commit 8dbc2ccac5a65c5b57e3070e36a3dc97c7970d96 upstream. + +Currently the ioctl command RADEON_INFO_SI_BACKEND_ENABLED_MASK can +copy back uninitialised data in value_tmp that pointer *value points +to. This can occur when rdev->family is less than CHIP_BONAIRE and +less than CHIP_TAHITI. Fix this by adding in a missing -EINVAL +so that no invalid value is copied back to userspace. + +Addresses-Coverity: ("Uninitialized scalar variable) +Cc: stable@vger.kernel.org # 3.13+ +Fixes: 439a1cfffe2c ("drm/radeon: expose render backend mask to the userspace") +Reviewed-by: Christian König +Signed-off-by: Colin Ian King +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/radeon/radeon_kms.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/radeon/radeon_kms.c ++++ b/drivers/gpu/drm/radeon/radeon_kms.c +@@ -514,6 +514,7 @@ int radeon_info_ioctl(struct drm_device + *value = rdev->config.si.backend_enable_mask; + } else { + DRM_DEBUG_KMS("BACKEND_ENABLED_MASK is si+ only!\n"); ++ return -EINVAL; + } + break; + case RADEON_INFO_MAX_SCLK: diff --git a/queue-5.11/series b/queue-5.11/series index df3f013df58..a66aaa7a627 100644 --- a/queue-5.11/series +++ b/queue-5.11/series @@ -60,3 +60,15 @@ rtw88-fix-array-overrun-in-rtw_get_tx_power_params.patch mt76-fix-potential-dma-mapping-leak.patch fddi-defxx-make-mmio-the-configuration-default-except-for-eisa.patch drm-qxl-use-ttm-bo-priorities.patch +drm-ingenic-fix-non-osd-mode.patch +drm-panfrost-clear-mmu-irqs-before-handling-the-fault.patch +drm-panfrost-don-t-try-to-map-pages-that-are-already-mapped.patch +drm-radeon-fix-copy-of-uninitialized-variable-back-to-userspace.patch +drm-dp_mst-revise-broadcast-msg-lct-lcr.patch +drm-dp_mst-set-clear_payload_id_table-as-broadcast.patch +drm-bridge-fix-anx7625-use-of-mipi_dsi_-functions.patch +drm-bridge-panel-cleanup-connector-on-bridge-detach.patch +drm-amd-display-reject-non-zero-src_y-and-src_x-for-video-planes.patch +drm-amdgpu-fix-concurrent-vm-flushes-on-vega-navi-v2.patch +drm-amdgpu-add-new-mc-firmware-for-polaris12-32bit-asic.patch +drm-amdgpu-init-gfx10_addr_config-for-vcn-v3-in-dpg-mode.patch