Commit 1ada9c07 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'drm-fixes-2023-08-18-1' of git://anongit.freedesktop.org/drm/drm 

Pull drm fixes from Dave Airlie:
 "Regular enough week, mostly the usual amdgpu and i915 fixes.  Also
  qaic, nouveau, qxl and a revert for an EDID patch that had some side
  effects, along with a couple of panel fixes.

  edid:
   - revert mode parsing fix that had side effects.

  i915:
   - Fix the flow for ignoring GuC SLPC efficient frequency selection
   - Fix SDVO panel_type initialization
   - Fix display probe for IVB Q and IVB D GT2 server

  nouveau:
   - fix use-after-free in connector code

  qaic:
   - integer overflow check fix
   - fix slicing memory leak

  panel:
   - fix JDI LT070ME05000 probing
   - fix AUO G121EAN01 timings

  amdgpu:
   - SMU 13.x fixes
   - Fix mcbp parameter for gfx9
   - SMU 11.x fixes
   - Temporary fix for large numbers of XCP partitions
   - S0ix fixes
   - DCN 2.0 fix

  qxl:
   - fix use after free race in dumb object allocation"

* tag 'drm-fixes-2023-08-18-1' of git://anongit.freedesktop.org/drm/drm:
  drm/qxl: fix UAF on handle creation
  Revert "drm/edid: Fix csync detailed mode parsing"
  drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create
  Revert "Revert "drm/amdgpu/display: change pipe policy for DCN 2.0""
  drm/amd: flush any delayed gfxoff on suspend entry
  drm/amdgpu: skip fence GFX interrupts disable/enable for S0ix
  drm/amdgpu: skip xcp drm device allocation when out of drm resource
  drm/amd/pm: Update pci link width for smu v13.0.6
  drm/amd/pm: Fix temperature unit of SMU v13.0.6
  drm/amdgpu/pm: fix throttle_status for other than MP1 11.0.7
  drm/amdgpu: disable mcbp if parameter zero is set
  drm/amd/pm: disallow the fan setting if there is no fan on smu 13.0.0
  accel/qaic: Clean up integer overflow checking in map_user_pages()
  accel/qaic: Fix slicing memory leak
  drm/i915: fix display probe for IVB Q and IVB D GT2 server
  drm/i915/sdvo: fix panel_type initialization
  drm/i915/guc/slpc: Restore efficient freq earlier
  drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docs
  drm/panel: JDI LT070ME05000 simplify with dev_err_probe()
parents 16931859 c611589b

drivers/accel/qaic/qaic_control.c

+18 −8
Original line number Diff line number Diff line
@@ -392,18 +392,31 @@ static int find_and_map_user_pages(struct qaic_device *qdev, 
				   struct qaic_manage_trans_dma_xfer *in_trans,

				   struct ioctl_resources *resources, struct dma_xfer *xfer)

{

	u64 xfer_start_addr, remaining, end, total;

	unsigned long need_pages;

	struct page **page_list;

	unsigned long nr_pages;

	struct sg_table *sgt;

	u64 xfer_start_addr;

	int ret;

	int i;



	xfer_start_addr = in_trans->addr + resources->xferred_dma_size;

	if (check_add_overflow(in_trans->addr, resources->xferred_dma_size, &xfer_start_addr))

		return -EINVAL;



	if (in_trans->size < resources->xferred_dma_size)

		return -EINVAL;

	remaining = in_trans->size - resources->xferred_dma_size;

	if (remaining == 0)

		return 0;



	if (check_add_overflow(xfer_start_addr, remaining, &end))

		return -EINVAL;



	total = remaining + offset_in_page(xfer_start_addr);

	if (total >= SIZE_MAX)

		return -EINVAL;



	need_pages = DIV_ROUND_UP(in_trans->size + offset_in_page(xfer_start_addr) -

				  resources->xferred_dma_size, PAGE_SIZE);

	need_pages = DIV_ROUND_UP(total, PAGE_SIZE);



	nr_pages = need_pages;
@@ -435,7 +448,7 @@ static int find_and_map_user_pages(struct qaic_device *qdev, 


	ret = sg_alloc_table_from_pages(sgt, page_list, nr_pages,

					offset_in_page(xfer_start_addr),

					in_trans->size - resources->xferred_dma_size, GFP_KERNEL);

					remaining, GFP_KERNEL);

	if (ret) {

		ret = -ENOMEM;

		goto free_sgt;
@@ -566,9 +579,6 @@ static int encode_dma(struct qaic_device *qdev, void *trans, struct wrapper_list 
	    QAIC_MANAGE_EXT_MSG_LENGTH)

		return -ENOMEM;



	if (in_trans->addr + in_trans->size < in_trans->addr || !in_trans->size)

		return -EINVAL;



	xfer = kmalloc(sizeof(*xfer), GFP_KERNEL);

	if (!xfer)

		return -ENOMEM;

drivers/accel/qaic/qaic_data.c

+1 −0
Original line number Diff line number Diff line
@@ -1021,6 +1021,7 @@ int qaic_attach_slice_bo_ioctl(struct drm_device *dev, void *data, struct drm_fi 
	bo->dbc = dbc;

	srcu_read_unlock(&dbc->ch_lock, rcu_id);

	drm_gem_object_put(obj);

	kfree(slice_ent);

	srcu_read_unlock(&qdev->dev_lock, qdev_rcu_id);

	srcu_read_unlock(&usr->qddev_lock, usr_rcu_id);

drivers/gpu/drm/amd/amdgpu/amdgpu_device.c

+6 −4
Original line number Diff line number Diff line
@@ -3722,8 +3722,9 @@ static void amdgpu_device_set_mcbp(struct amdgpu_device *adev) 
{

	if (amdgpu_mcbp == 1)

		adev->gfx.mcbp = true;



	if ((adev->ip_versions[GC_HWIP][0] >= IP_VERSION(9, 0, 0)) &&

	else if (amdgpu_mcbp == 0)

		adev->gfx.mcbp = false;

	else if ((adev->ip_versions[GC_HWIP][0] >= IP_VERSION(9, 0, 0)) &&

		 (adev->ip_versions[GC_HWIP][0] < IP_VERSION(10, 0, 0)) &&

		 adev->gfx.num_gfx_rings)

		adev->gfx.mcbp = true;
@@ -4393,6 +4394,7 @@ int amdgpu_device_suspend(struct drm_device *dev, bool fbcon) 
		drm_fb_helper_set_suspend_unlocked(adev_to_drm(adev)->fb_helper, true);



	cancel_delayed_work_sync(&adev->delayed_init_work);

	flush_delayed_work(&adev->gfx.gfx_off_delay_work);



	amdgpu_ras_suspend(adev);

drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c

+39 −2
Original line number Diff line number Diff line
@@ -551,6 +551,41 @@ int amdgpu_fence_driver_sw_init(struct amdgpu_device *adev) 
	return 0;

}



/**

 * amdgpu_fence_need_ring_interrupt_restore - helper function to check whether

 * fence driver interrupts need to be restored.

 *

 * @ring: ring that to be checked

 *

 * Interrupts for rings that belong to GFX IP don't need to be restored

 * when the target power state is s0ix.

 *

 * Return true if need to restore interrupts, false otherwise.

 */

static bool amdgpu_fence_need_ring_interrupt_restore(struct amdgpu_ring *ring)

{

	struct amdgpu_device *adev = ring->adev;

	bool is_gfx_power_domain = false;



	switch (ring->funcs->type) {

	case AMDGPU_RING_TYPE_SDMA:

	/* SDMA 5.x+ is part of GFX power domain so it's covered by GFXOFF */

		if (adev->ip_versions[SDMA0_HWIP][0] >= IP_VERSION(5, 0, 0))

			is_gfx_power_domain = true;

		break;

	case AMDGPU_RING_TYPE_GFX:

	case AMDGPU_RING_TYPE_COMPUTE:

	case AMDGPU_RING_TYPE_KIQ:

	case AMDGPU_RING_TYPE_MES:

		is_gfx_power_domain = true;

		break;

	default:

		break;

	}



	return !(adev->in_s0ix && is_gfx_power_domain);

}



/**

 * amdgpu_fence_driver_hw_fini - tear down the fence driver

 * for all possible rings.
@@ -579,7 +614,8 @@ void amdgpu_fence_driver_hw_fini(struct amdgpu_device *adev) 
			amdgpu_fence_driver_force_completion(ring);



		if (!drm_dev_is_unplugged(adev_to_drm(adev)) &&

		    ring->fence_drv.irq_src)

		    ring->fence_drv.irq_src &&

		    amdgpu_fence_need_ring_interrupt_restore(ring))

			amdgpu_irq_put(adev, ring->fence_drv.irq_src,

				       ring->fence_drv.irq_type);
@@ -655,7 +691,8 @@ void amdgpu_fence_driver_hw_init(struct amdgpu_device *adev) 
			continue;



		/* enable the interrupt */

		if (ring->fence_drv.irq_src)

		if (ring->fence_drv.irq_src &&

		    amdgpu_fence_need_ring_interrupt_restore(ring))

			amdgpu_irq_get(adev, ring->fence_drv.irq_src,

				       ring->fence_drv.irq_type);

	}

drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c

+1 −8
Original line number Diff line number Diff line
@@ -692,16 +692,9 @@ void amdgpu_gfx_off_ctrl(struct amdgpu_device *adev, bool enable) 


		if (adev->gfx.gfx_off_req_count == 0 &&

		    !adev->gfx.gfx_off_state) {

			/* If going to s2idle, no need to wait */

			if (adev->in_s0ix) {

				if (!amdgpu_dpm_set_powergating_by_smu(adev,

						AMD_IP_BLOCK_TYPE_GFX, true))

					adev->gfx.gfx_off_state = true;

			} else {

			schedule_delayed_work(&adev->gfx.gfx_off_delay_work,

					      delay);

		}

		}

	} else {

		if (adev->gfx.gfx_off_req_count == 0) {

			cancel_delayed_work_sync(&adev->gfx.gfx_off_delay_work);