From 365869a3af6b3010d53791048488f0b47c5e1a3f Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 1 Aug 2023 08:47:53 +0200 Subject: [PATCH] 6.1-stable patches added patches: drm-amd-display-perform-a-bounds-check-before-filling-dirty-rectangles.patch drm-amd-display-set-per-pipe-dppclk-to-0-when-dpp-is-off.patch drm-amd-display-write-to-correct-dirty_rect.patch tracing-fix-trace_event_raw_event_synth-if-else-statement.patch --- ...heck-before-filling-dirty-rectangles.patch | 72 ++++++++++++++++ ...per-pipe-dppclk-to-0-when-dpp-is-off.patch | 85 +++++++++++++++++++ ...-display-write-to-correct-dirty_rect.patch | 43 ++++++++++ queue-6.1/series | 4 + ...nt_raw_event_synth-if-else-statement.patch | 51 +++++++++++ 5 files changed, 255 insertions(+) create mode 100644 queue-6.1/drm-amd-display-perform-a-bounds-check-before-filling-dirty-rectangles.patch create mode 100644 queue-6.1/drm-amd-display-set-per-pipe-dppclk-to-0-when-dpp-is-off.patch create mode 100644 queue-6.1/drm-amd-display-write-to-correct-dirty_rect.patch create mode 100644 queue-6.1/tracing-fix-trace_event_raw_event_synth-if-else-statement.patch diff --git a/queue-6.1/drm-amd-display-perform-a-bounds-check-before-filling-dirty-rectangles.patch b/queue-6.1/drm-amd-display-perform-a-bounds-check-before-filling-dirty-rectangles.patch new file mode 100644 index 00000000000..a192e259a3d --- /dev/null +++ b/queue-6.1/drm-amd-display-perform-a-bounds-check-before-filling-dirty-rectangles.patch @@ -0,0 +1,72 @@ +From af22d6a869cc26b519bfdcd54293c53f2e491870 Mon Sep 17 00:00:00 2001 +From: Hamza Mahfooz +Date: Wed, 21 Jun 2023 15:19:05 -0400 +Subject: drm/amd/display: perform a bounds check before filling dirty rectangles + +From: Hamza Mahfooz + +commit af22d6a869cc26b519bfdcd54293c53f2e491870 upstream. + +Currently, it is possible for us to access memory that we shouldn't. +Since, we acquire (possibly dangling) pointers to dirty rectangles +before doing a bounds check to make sure we can actually accommodate the +number of dirty rectangles userspace has requested to fill. This issue +is especially evident if a compositor requests both MPO and damage clips +at the same time, in which case I have observed a soft-hang. So, to +avoid this issue, perform the bounds check before filling a single dirty +rectangle and WARN() about it, if it is ever attempted in +fill_dc_dirty_rect(). + +Cc: stable@vger.kernel.org # 6.1+ +Fixes: 30ebe41582d1 ("drm/amd/display: add FB_DAMAGE_CLIPS support") +Reviewed-by: Leo Li +Signed-off-by: Hamza Mahfooz +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 13 ++++--------- + 1 file changed, 4 insertions(+), 9 deletions(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -4953,11 +4953,7 @@ static inline void fill_dc_dirty_rect(st + int32_t y, int32_t width, int32_t height, + int *i, bool ffu) + { +- if (*i > DC_MAX_DIRTY_RECTS) +- return; +- +- if (*i == DC_MAX_DIRTY_RECTS) +- goto out; ++ WARN_ON(*i >= DC_MAX_DIRTY_RECTS); + + dirty_rect->x = x; + dirty_rect->y = y; +@@ -4973,7 +4969,6 @@ static inline void fill_dc_dirty_rect(st + "[PLANE:%d] PSR SU dirty rect at (%d, %d) size (%d, %d)", + plane->base.id, x, y, width, height); + +-out: + (*i)++; + } + +@@ -5055,6 +5050,9 @@ static void fill_dc_dirty_rects(struct d + new_plane_state->plane->base.id, + bb_changed, fb_changed, num_clips); + ++ if ((num_clips + (bb_changed ? 2 : 0)) > DC_MAX_DIRTY_RECTS) ++ goto ffu; ++ + if (bb_changed) { + fill_dc_dirty_rect(new_plane_state->plane, &dirty_rects[i], + new_plane_state->crtc_x, +@@ -5084,9 +5082,6 @@ static void fill_dc_dirty_rects(struct d + new_plane_state->crtc_h, &i, false); + } + +- if (i > DC_MAX_DIRTY_RECTS) +- goto ffu; +- + flip_addrs->dirty_rect_count = i; + return; + diff --git a/queue-6.1/drm-amd-display-set-per-pipe-dppclk-to-0-when-dpp-is-off.patch b/queue-6.1/drm-amd-display-set-per-pipe-dppclk-to-0-when-dpp-is-off.patch new file mode 100644 index 00000000000..cf5cb41f59e --- /dev/null +++ b/queue-6.1/drm-amd-display-set-per-pipe-dppclk-to-0-when-dpp-is-off.patch @@ -0,0 +1,85 @@ +From 6609141c49df1b86fbad26a8643d4b4044f28b11 Mon Sep 17 00:00:00 2001 +From: Dmytro Laktyushkin +Date: Tue, 22 Nov 2022 10:06:19 -0500 +Subject: drm/amd/display: set per pipe dppclk to 0 when dpp is off + +From: Dmytro Laktyushkin + +commit 6609141c49df1b86fbad26a8643d4b4044f28b11 upstream. + +The 'commit 52e4fdf09ebc ("drm/amd/display: use low clocks for no plane +configs")' introduced a change that set low clock values for DCN31 and +DCN32. As a result of these changes, DC started to spam the log with the +following warning: + +------------[ cut here ]------------ +WARNING: CPU: 8 PID: 1486 at +drivers/gpu/drm/amd/amdgpu/../display/dc/dcn20/dcn20_dccg.c:58 +dccg2_update_dpp_dto+0x3f/0xf0 [amdgpu] +[..] +CPU: 8 PID: 1486 Comm: kms_atomic Tainted: G W 5.18.0+ #1 +RIP: 0010:dccg2_update_dpp_dto+0x3f/0xf0 [amdgpu] +RSP: 0018:ffffbbd8025334d0 EFLAGS: 00010206 +RAX: 00000000000001ee RBX: ffffa02c87dd3de0 RCX: 00000000000a7f80 +RDX: 000000000007dec3 RSI: 0000000000000000 RDI: ffffa02c87dd3de0 +RBP: ffffbbd8025334e8 R08: 0000000000000001 R09: 0000000000000005 +R10: 00000000000331a0 R11: ffffffffc0b03d80 R12: ffffa02ca576d000 +R13: ffffa02cd02c0000 R14: 00000000001453bc R15: ffffa02cdc280000 +[..] +dcn20_update_clocks_update_dpp_dto+0x4e/0xa0 [amdgpu] +dcn32_update_clocks+0x5d9/0x650 [amdgpu] +dcn20_prepare_bandwidth+0x49/0x100 [amdgpu] +dcn30_prepare_bandwidth+0x63/0x80 [amdgpu] +dc_commit_state_no_check+0x39d/0x13e0 [amdgpu] +dc_commit_streams+0x1f9/0x3b0 [amdgpu] +dc_commit_state+0x37/0x120 [amdgpu] +amdgpu_dm_atomic_commit_tail+0x5e5/0x2520 [amdgpu] +? _raw_spin_unlock_irqrestore+0x1f/0x40 +? down_trylock+0x2c/0x40 +? vprintk_emit+0x186/0x2c0 +? vprintk_default+0x1d/0x20 +? vprintk+0x4e/0x60 + +We can easily trigger this issue by using a 4k@120 or a 2k@165 and +running some of the kms_atomic tests. This warning is triggered because +the per-pipe clock update is not happening; this commit fixes this issue +by ensuring that DPPCLK is updated when calculating the watermark and +dlg is invoked. + +Fixes: 2641c7b78081 ("drm/amd/display: use low clocks for no plane configs") +Reported-by: Mark Broadworth +Reviewed-by: Rodrigo Siqueira +Signed-off-by: Dmytro Laktyushkin +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/dml/dcn31/dcn31_fpu.c | 3 +++ + drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 5 ++++- + 2 files changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn31/dcn31_fpu.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn31/dcn31_fpu.c +@@ -559,6 +559,9 @@ void dcn31_calculate_wm_and_dlg_fp( + context->bw_ctx.bw.dcn.clk.dramclk_khz = 0; + context->bw_ctx.bw.dcn.clk.fclk_khz = 0; + context->bw_ctx.bw.dcn.clk.p_state_change_support = true; ++ for (i = 0; i < dc->res_pool->pipe_count; i++) ++ if (context->res_ctx.pipe_ctx[i].stream) ++ context->res_ctx.pipe_ctx[i].plane_res.bw.dppclk_khz = 0; + } + for (i = 0, pipe_idx = 0; i < dc->res_pool->pipe_count; i++) { + if (!context->res_ctx.pipe_ctx[i].stream) +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +@@ -1305,7 +1305,10 @@ static void dcn32_calculate_dlg_params(s + + if (context->bw_ctx.bw.dcn.clk.dppclk_khz < pipes[pipe_idx].clks_cfg.dppclk_mhz * 1000) + context->bw_ctx.bw.dcn.clk.dppclk_khz = pipes[pipe_idx].clks_cfg.dppclk_mhz * 1000; +- context->res_ctx.pipe_ctx[i].plane_res.bw.dppclk_khz = pipes[pipe_idx].clks_cfg.dppclk_mhz * 1000; ++ if (context->res_ctx.pipe_ctx[i].plane_state) ++ context->res_ctx.pipe_ctx[i].plane_res.bw.dppclk_khz = pipes[pipe_idx].clks_cfg.dppclk_mhz * 1000; ++ else ++ context->res_ctx.pipe_ctx[i].plane_res.bw.dppclk_khz = 0; + context->res_ctx.pipe_ctx[i].pipe_dlg_param = pipes[pipe_idx].pipe.dest; + pipe_idx++; + } diff --git a/queue-6.1/drm-amd-display-write-to-correct-dirty_rect.patch b/queue-6.1/drm-amd-display-write-to-correct-dirty_rect.patch new file mode 100644 index 00000000000..abc5d8a4089 --- /dev/null +++ b/queue-6.1/drm-amd-display-write-to-correct-dirty_rect.patch @@ -0,0 +1,43 @@ +From 751281c55579f0cb0e56c9797d4663f689909681 Mon Sep 17 00:00:00 2001 +From: Benjamin Cheng +Date: Sun, 12 Mar 2023 20:47:39 -0400 +Subject: drm/amd/display: Write to correct dirty_rect + +From: Benjamin Cheng + +commit 751281c55579f0cb0e56c9797d4663f689909681 upstream. + +When FB_DAMAGE_CLIPS are provided in a non-MPO scenario, the loop does +not use the counter i. This causes the fill_dc_dity_rect() to always +fill dirty_rects[0], causing graphical artifacts when a damage clip +aware DRM client sends more than 1 damage clip. + +Instead, use the flip_addrs->dirty_rect_count which is incremented by +fill_dc_dirty_rect() on a successful fill. + +Fixes: 30ebe41582d1 ("drm/amd/display: add FB_DAMAGE_CLIPS support") +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2453 +Signed-off-by: Benjamin Cheng +Signed-off-by: Hamza Mahfooz +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 6.1.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -5023,9 +5023,9 @@ static void fill_dc_dirty_rects(struct d + + for (; flip_addrs->dirty_rect_count < num_clips; clips++) + fill_dc_dirty_rect(new_plane_state->plane, +- &dirty_rects[i], clips->x1, +- clips->y1, clips->x2 - clips->x1, +- clips->y2 - clips->y1, ++ &dirty_rects[flip_addrs->dirty_rect_count], ++ clips->x1, clips->y1, ++ clips->x2 - clips->x1, clips->y2 - clips->y1, + &flip_addrs->dirty_rect_count, + false); + return; diff --git a/queue-6.1/series b/queue-6.1/series index b8caedb25db..c472e985ffb 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -214,3 +214,7 @@ dm-cache-policy-smq-ensure-io-doesn-t-prevent-cleaner-policy-progress.patch rbd-make-get_lock_owner_info-return-a-single-locker-or-null.patch rbd-harden-get_lock_owner_info-a-bit.patch rbd-retrieve-and-check-lock-owner-twice-before-blocklisting.patch +drm-amd-display-set-per-pipe-dppclk-to-0-when-dpp-is-off.patch +tracing-fix-trace_event_raw_event_synth-if-else-statement.patch +drm-amd-display-perform-a-bounds-check-before-filling-dirty-rectangles.patch +drm-amd-display-write-to-correct-dirty_rect.patch diff --git a/queue-6.1/tracing-fix-trace_event_raw_event_synth-if-else-statement.patch b/queue-6.1/tracing-fix-trace_event_raw_event_synth-if-else-statement.patch new file mode 100644 index 00000000000..64b04aac603 --- /dev/null +++ b/queue-6.1/tracing-fix-trace_event_raw_event_synth-if-else-statement.patch @@ -0,0 +1,51 @@ +From 9971c3f944489ff7aacb9d25e0cde841a5f6018a Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Google)" +Date: Tue, 31 Jan 2023 09:52:37 -0500 +Subject: tracing: Fix trace_event_raw_event_synth() if else statement + +From: Steven Rostedt (Google) + +commit 9971c3f944489ff7aacb9d25e0cde841a5f6018a upstream. + +The test to check if the field is a stack is to be done if it is not a +string. But the code had: + + } if (event->fields[i]->is_stack) { + +and not + + } else if (event->fields[i]->is_stack) { + +which would cause it to always be tested. Worse yet, this also included an +"else" statement that was only to be called if the field was not a string +and a stack, but this code allows it to be called if it was a string (and +not a stack). + +Also fixed some whitespace issues. + +Link: https://lore.kernel.org/all/202301302110.mEtNwkBD-lkp@intel.com/ +Link: https://lore.kernel.org/linux-trace-kernel/20230131095237.63e3ca8d@gandalf.local.home + +Cc: Tom Zanussi +Fixes: 00cf3d672a9d ("tracing: Allow synthetic events to pass around stacktraces") +Reported-by: kernel test robot +Signed-off-by: Steven Rostedt (Google) +Acked-by: Masami Hiramatsu (Google) +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace_events_synth.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/kernel/trace/trace_events_synth.c ++++ b/kernel/trace/trace_events_synth.c +@@ -576,8 +576,8 @@ static notrace void trace_event_raw_even + event->fields[i]->is_dynamic, + data_size, &n_u64); + data_size += len; /* only dynamic string increments */ +- } if (event->fields[i]->is_stack) { +- long *stack = (long *)(long)var_ref_vals[val_idx]; ++ } else if (event->fields[i]->is_stack) { ++ long *stack = (long *)(long)var_ref_vals[val_idx]; + + len = trace_stack(entry, event, stack, + data_size, &n_u64); -- 2.47.3