Commit f7e3a1ba authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'drm-fixes-2023-07-21' of git://anongit.freedesktop.org/drm/drm 

Pull drm fixes from Dave Airlie:
 "Mostly amdgpu fixes, a couple of i915 fixes, some nouveau and then a
  few misc accel and other fixes.

  client:
   - memory leak fix

  dma-buf:
   - memory leak fix

  qaic:
   - bound check fixes
   - map_user_pages leak
   - int overflow fixes

  habanalabs:
   - debugfs stub helper

  nouveau:
   - aux event slot fixes
   - anx9805 cards fixes

  i915:
   - Add sentinel to xehp_oa_b_counters
   - Revert "drm/i915: use localized __diag_ignore_all() instead of per
     file"

  amdgpu:
   - More PCIe DPM fixes for Intel platforms
   - DCN3.0.1 fixes
   - Virtual display timer fix
   - Async flip fix
   - SMU13 clock reporting fixes
   - Add missing PSP firmware declaration
   - DP MST fix
   - DCN3.1.x fixes
   - Slab out of bounds fix"

* tag 'drm-fixes-2023-07-21' of git://anongit.freedesktop.org/drm/drm: (31 commits)
  accel/habanalabs: add more debugfs stub helpers
  drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP
  drm/nouveau/disp: PIOR DP uses GPIO for HPD, not PMGR AUX interrupts
  drm/nouveau/i2c: fix number of aux event slots
  drm/amdgpu: use a macro to define no xcp partition case
  drm/amdgpu/vm: use the same xcp_id from root PD
  drm/amdgpu: fix slab-out-of-bounds issue in amdgpu_vm_pt_create
  drm/amdgpu: Allocate root PD on correct partition
  drm/amd/display: Keep PHY active for DP displays on DCN31
  drm/amd/display: Prevent vtotal from being set to 0
  drm/amd/display: Disable MPC split by default on special asic
  drm/amd/display: check TG is non-null before checking if enabled
  drm/amd/display: Add polling method to handle MST reply packet
  drm/amd/display: Clean up errors & warnings in amdgpu_dm.c
  drm/amdgpu: Allow the initramfs generator to include psp_13_0_6_ta
  drm/amdgpu/pm: make mclk consistent for smu 13.0.7
  drm/amdgpu/pm: make gfxclock consistent for sienna cichlid
  drm/amd/display: only accept async flips for fast updates
  drm/amdgpu/vkms: relax timer deactivation by hrtimer_try_to_cancel
  drm/amd/display: add DCN301 specific logic for OTG programming
  ...
parents 12a5088e 28801cc8

drivers/accel/habanalabs/common/habanalabs.h

+9 −0
Original line number Original line Diff line number Diff line
@@ -3980,6 +3980,15 @@ static inline void hl_debugfs_fini(void) 
{

{

}

}





static inline int hl_debugfs_device_init(struct hl_device *hdev)

{

	return 0;

}



static inline void hl_debugfs_device_fini(struct hl_device *hdev)

{

}



static inline void hl_debugfs_add_device(struct hl_device *hdev)

static inline void hl_debugfs_add_device(struct hl_device *hdev)

{

{

}

}

drivers/accel/qaic/qaic_control.c

+25 −14
Original line number Original line Diff line number Diff line
@@ -14,6 +14,7 @@ 
#include <linux/mm.h>

#include <linux/mm.h>

#include <linux/moduleparam.h>

#include <linux/moduleparam.h>

#include <linux/mutex.h>

#include <linux/mutex.h>

#include <linux/overflow.h>

#include <linux/pci.h>

#include <linux/pci.h>

#include <linux/scatterlist.h>

#include <linux/scatterlist.h>

#include <linux/types.h>

#include <linux/types.h>
@@ -366,7 +367,7 @@ static int encode_passthrough(struct qaic_device *qdev, void *trans, struct wrap 
	if (in_trans->hdr.len % 8 != 0)

	if (in_trans->hdr.len % 8 != 0)

		return -EINVAL;

		return -EINVAL;





	if (msg_hdr_len + in_trans->hdr.len > QAIC_MANAGE_EXT_MSG_LENGTH)

	if (size_add(msg_hdr_len, in_trans->hdr.len) > QAIC_MANAGE_EXT_MSG_LENGTH)

		return -ENOSPC;

		return -ENOSPC;





	trans_wrapper = add_wrapper(wrappers,

	trans_wrapper = add_wrapper(wrappers,
@@ -418,9 +419,12 @@ static int find_and_map_user_pages(struct qaic_device *qdev, 
	}

	}





	ret = get_user_pages_fast(xfer_start_addr, nr_pages, 0, page_list);

	ret = get_user_pages_fast(xfer_start_addr, nr_pages, 0, page_list);

	if (ret < 0 || ret != nr_pages) {

	if (ret < 0)

		ret = -EFAULT;

		goto free_page_list;

		goto free_page_list;

	if (ret != nr_pages) {

		nr_pages = ret;

		ret = -EFAULT;

		goto put_pages;

	}

	}





	sgt = kmalloc(sizeof(*sgt), GFP_KERNEL);

	sgt = kmalloc(sizeof(*sgt), GFP_KERNEL);
@@ -557,11 +561,8 @@ static int encode_dma(struct qaic_device *qdev, void *trans, struct wrapper_list 
	msg = &wrapper->msg;

	msg = &wrapper->msg;

	msg_hdr_len = le32_to_cpu(msg->hdr.len);

	msg_hdr_len = le32_to_cpu(msg->hdr.len);





	if (msg_hdr_len > (UINT_MAX - QAIC_MANAGE_EXT_MSG_LENGTH))

		return -EINVAL;



	/* There should be enough space to hold at least one ASP entry. */

	/* There should be enough space to hold at least one ASP entry. */

	if (msg_hdr_len + sizeof(*out_trans) + sizeof(struct wire_addr_size_pair) >

	if (size_add(msg_hdr_len, sizeof(*out_trans) + sizeof(struct wire_addr_size_pair)) >

	    QAIC_MANAGE_EXT_MSG_LENGTH)

	    QAIC_MANAGE_EXT_MSG_LENGTH)

		return -ENOMEM;

		return -ENOMEM;
@@ -634,7 +635,7 @@ static int encode_activate(struct qaic_device *qdev, void *trans, struct wrapper 
	msg = &wrapper->msg;

	msg = &wrapper->msg;

	msg_hdr_len = le32_to_cpu(msg->hdr.len);

	msg_hdr_len = le32_to_cpu(msg->hdr.len);





	if (msg_hdr_len + sizeof(*out_trans) > QAIC_MANAGE_MAX_MSG_LENGTH)

	if (size_add(msg_hdr_len, sizeof(*out_trans)) > QAIC_MANAGE_MAX_MSG_LENGTH)

		return -ENOSPC;

		return -ENOSPC;





	if (!in_trans->queue_size)

	if (!in_trans->queue_size)
@@ -718,7 +719,7 @@ static int encode_status(struct qaic_device *qdev, void *trans, struct wrapper_l 
	msg = &wrapper->msg;

	msg = &wrapper->msg;

	msg_hdr_len = le32_to_cpu(msg->hdr.len);

	msg_hdr_len = le32_to_cpu(msg->hdr.len);





	if (msg_hdr_len + in_trans->hdr.len > QAIC_MANAGE_MAX_MSG_LENGTH)

	if (size_add(msg_hdr_len, in_trans->hdr.len) > QAIC_MANAGE_MAX_MSG_LENGTH)

		return -ENOSPC;

		return -ENOSPC;





	trans_wrapper = add_wrapper(wrappers, sizeof(*trans_wrapper));

	trans_wrapper = add_wrapper(wrappers, sizeof(*trans_wrapper));
@@ -748,7 +749,8 @@ static int encode_message(struct qaic_device *qdev, struct manage_msg *user_msg, 
	int ret;

	int ret;

	int i;

	int i;





	if (!user_msg->count) {

	if (!user_msg->count ||

	    user_msg->len < sizeof(*trans_hdr)) {

		ret = -EINVAL;

		ret = -EINVAL;

		goto out;

		goto out;

	}

	}
@@ -765,12 +767,13 @@ static int encode_message(struct qaic_device *qdev, struct manage_msg *user_msg, 
	}

	}





	for (i = 0; i < user_msg->count; ++i) {

	for (i = 0; i < user_msg->count; ++i) {

		if (user_len >= user_msg->len) {

		if (user_len > user_msg->len - sizeof(*trans_hdr)) {

			ret = -EINVAL;

			ret = -EINVAL;

			break;

			break;

		}

		}

		trans_hdr = (struct qaic_manage_trans_hdr *)(user_msg->data + user_len);

		trans_hdr = (struct qaic_manage_trans_hdr *)(user_msg->data + user_len);

		if (user_len + trans_hdr->len > user_msg->len) {

		if (trans_hdr->len < sizeof(trans_hdr) ||

		    size_add(user_len, trans_hdr->len) > user_msg->len) {

			ret = -EINVAL;

			ret = -EINVAL;

			break;

			break;

		}

		}
@@ -953,15 +956,23 @@ static int decode_message(struct qaic_device *qdev, struct manage_msg *user_msg, 
	int ret;

	int ret;

	int i;

	int i;





	if (msg_hdr_len > QAIC_MANAGE_MAX_MSG_LENGTH)

	if (msg_hdr_len < sizeof(*trans_hdr) ||

	    msg_hdr_len > QAIC_MANAGE_MAX_MSG_LENGTH)

		return -EINVAL;

		return -EINVAL;





	user_msg->len = 0;

	user_msg->len = 0;

	user_msg->count = le32_to_cpu(msg->hdr.count);

	user_msg->count = le32_to_cpu(msg->hdr.count);





	for (i = 0; i < user_msg->count; ++i) {

	for (i = 0; i < user_msg->count; ++i) {

		u32 hdr_len;



		if (msg_len > msg_hdr_len - sizeof(*trans_hdr))

			return -EINVAL;



		trans_hdr = (struct wire_trans_hdr *)(msg->data + msg_len);

		trans_hdr = (struct wire_trans_hdr *)(msg->data + msg_len);

		if (msg_len + le32_to_cpu(trans_hdr->len) > msg_hdr_len)

		hdr_len = le32_to_cpu(trans_hdr->len);

		if (hdr_len < sizeof(*trans_hdr) ||

		    size_add(msg_len, hdr_len) > msg_hdr_len)

			return -EINVAL;

			return -EINVAL;





		switch (le32_to_cpu(trans_hdr->type)) {

		switch (le32_to_cpu(trans_hdr->type)) {

drivers/dma-buf/dma-resv.c

+9 −4
Original line number Original line Diff line number Diff line
@@ -571,6 +571,7 @@ int dma_resv_get_fences(struct dma_resv *obj, enum dma_resv_usage usage, 
	dma_resv_for_each_fence_unlocked(&cursor, fence) {

	dma_resv_for_each_fence_unlocked(&cursor, fence) {





		if (dma_resv_iter_is_restarted(&cursor)) {

		if (dma_resv_iter_is_restarted(&cursor)) {

			struct dma_fence **new_fences;

			unsigned int count;

			unsigned int count;





			while (*num_fences)

			while (*num_fences)
@@ -579,13 +580,17 @@ int dma_resv_get_fences(struct dma_resv *obj, enum dma_resv_usage usage, 
			count = cursor.num_fences + 1;

			count = cursor.num_fences + 1;





			/* Eventually re-allocate the array */

			/* Eventually re-allocate the array */

			*fences = krealloc_array(*fences, count,

			new_fences = krealloc_array(*fences, count,

						    sizeof(void *),

						    sizeof(void *),

						    GFP_KERNEL);

						    GFP_KERNEL);

			if (count && !*fences) {

			if (count && !new_fences) {

				kfree(*fences);

				*fences = NULL;

				*num_fences = 0;

				dma_resv_iter_end(&cursor);

				dma_resv_iter_end(&cursor);

				return -ENOMEM;

				return -ENOMEM;

			}

			}

			*fences = new_fences;

		}

		}





		(*fences)[(*num_fences)++] = dma_fence_get(fence);

		(*fences)[(*num_fences)++] = dma_fence_get(fence);

drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c

+2 −1
Original line number Original line Diff line number Diff line
@@ -1709,7 +1709,8 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu( 
			alloc_flags |= (flags & KFD_IOC_ALLOC_MEM_FLAGS_PUBLIC) ?

			alloc_flags |= (flags & KFD_IOC_ALLOC_MEM_FLAGS_PUBLIC) ?

			AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED : 0;

			AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED : 0;

		}

		}

		xcp_id = fpriv->xcp_id == ~0 ? 0 : fpriv->xcp_id;

		xcp_id = fpriv->xcp_id == AMDGPU_XCP_NO_PARTITION ?

					0 : fpriv->xcp_id;

	} else if (flags & KFD_IOC_ALLOC_MEM_FLAGS_GTT) {

	} else if (flags & KFD_IOC_ALLOC_MEM_FLAGS_GTT) {

		domain = alloc_domain = AMDGPU_GEM_DOMAIN_GTT;

		domain = alloc_domain = AMDGPU_GEM_DOMAIN_GTT;

		alloc_flags = 0;

		alloc_flags = 0;

drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c

+3 −3
Original line number Original line Diff line number Diff line
@@ -1229,13 +1229,13 @@ int amdgpu_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv) 
		pasid = 0;

		pasid = 0;

	}

	}





	r = amdgpu_vm_init(adev, &fpriv->vm);

	r = amdgpu_xcp_open_device(adev, fpriv, file_priv);

	if (r)

	if (r)

		goto error_pasid;

		goto error_pasid;





	r = amdgpu_xcp_open_device(adev, fpriv, file_priv);

	r = amdgpu_vm_init(adev, &fpriv->vm, fpriv->xcp_id);

	if (r)

	if (r)

		goto error_vm;

		goto error_pasid;





	r = amdgpu_vm_set_pasid(adev, &fpriv->vm, pasid);

	r = amdgpu_vm_set_pasid(adev, &fpriv->vm, pasid);

	if (r)

	if (r)