Commit 1c52cf5e authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'drm-fixes-2024-06-28' of https://gitlab.freedesktop.org/drm/kernel 

Pull drm fixes from Dave Airlie:
 "Regular fixes, mostly amdgpu with some minor fixes in other places,
  along with a fix for a very narrow UAF race in the pid handover code.

  core:
   - fix refcounting race on pid handover

  fbdev:
   - Fix fb_info when vmalloc is used, regression from
     CONFIG_DRM_FBDEV_LEAK_PHYS_SMEM.

  amdgpu:
   - SMU 14.x fix
   - vram info parsing fix
   - mode1 reset fix
   - LTTPR fix
   - Virtual display fix
   - Avoid spurious error in PSP init

  i915:
   - Fix potential UAF due to race on fence register revocation

  nouveau
   - nouveau tv mode fixes

  panel:
   - Add KOE TX26D202VM0BWA timings"

* tag 'drm-fixes-2024-06-28' of https://gitlab.freedesktop.org/drm/kernel:
  drm/drm_file: Fix pid refcounting race
  drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
  drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
  drm/amdgpu: Don't show false warning for reg list
  drm/amdgpu: avoid using null object of framebuffer
  drm/amd/display: Send DP_TOTAL_LTTPR_CNT during detection if LTTPR is present
  drm/amdgpu: Fix pci state save during mode-1 reset
  drm/amdgpu/atomfirmware: fix parsing of vram_info
  drm/amd/swsmu: add MALL init support workaround for smu_v14_0_1
  drm/i915/gt: Fix potential UAF by revoke of fence registers
  drm/panel: simple: Add missing display timing flags for KOE TX26D202VM0BWA
  drm/fbdev-dma: Only set smem_start is enable per module option
parents ef8abe96 4f2a129b

drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c

+1 −1
Original line number Diff line number Diff line
@@ -400,7 +400,7 @@ amdgpu_atomfirmware_get_vram_info(struct amdgpu_device *adev, 
					mem_channel_number = vram_info->v30.channel_num;

					mem_channel_width = vram_info->v30.channel_width;

					if (vram_width)

						*vram_width = mem_channel_number * (1 << mem_channel_width);

						*vram_width = mem_channel_number * 16;

					break;

				default:

					return -EINVAL;

drivers/gpu/drm/amd/amdgpu/amdgpu_device.c

+5 −2
Original line number Diff line number Diff line
@@ -5220,11 +5220,14 @@ int amdgpu_device_mode1_reset(struct amdgpu_device *adev) 


	dev_info(adev->dev, "GPU mode1 reset\n");



	/* Cache the state before bus master disable. The saved config space

	 * values are used in other cases like restore after mode-2 reset.

	 */

	amdgpu_device_cache_pci_state(adev->pdev);



	/* disable BM */

	pci_clear_master(adev->pdev);



	amdgpu_device_cache_pci_state(adev->pdev);



	if (amdgpu_dpm_is_mode1_reset_supported(adev)) {

		dev_info(adev->dev, "GPU smu mode1 reset\n");

		ret = amdgpu_dpm_mode1_reset(adev);

drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c

+21 −4
Original line number Diff line number Diff line
@@ -640,6 +640,20 @@ static const char *psp_gfx_cmd_name(enum psp_gfx_cmd_id cmd_id) 
	}

}



static bool psp_err_warn(struct psp_context *psp)

{

	struct psp_gfx_cmd_resp *cmd = psp->cmd_buf_mem;



	/* This response indicates reg list is already loaded */

	if (amdgpu_ip_version(psp->adev, MP0_HWIP, 0) == IP_VERSION(13, 0, 2) &&

	    cmd->cmd_id == GFX_CMD_ID_LOAD_IP_FW &&

	    cmd->cmd.cmd_load_ip_fw.fw_type == GFX_FW_TYPE_REG_LIST &&

	    cmd->resp.status == TEE_ERROR_CANCEL)

		return false;



	return true;

}



static int

psp_cmd_submit_buf(struct psp_context *psp,

		   struct amdgpu_firmware_info *ucode,
@@ -699,9 +713,12 @@ psp_cmd_submit_buf(struct psp_context *psp, 
			dev_warn(psp->adev->dev,

				 "failed to load ucode %s(0x%X) ",

				 amdgpu_ucode_name(ucode->ucode_id), ucode->ucode_id);

		dev_warn(psp->adev->dev,

		if (psp_err_warn(psp))

			dev_warn(

				psp->adev->dev,

				"psp gfx command %s(0x%X) failed and response status is (0x%X)\n",

			 psp_gfx_cmd_name(psp->cmd_buf_mem->cmd_id), psp->cmd_buf_mem->cmd_id,

				psp_gfx_cmd_name(psp->cmd_buf_mem->cmd_id),

				psp->cmd_buf_mem->cmd_id,

				psp->cmd_buf_mem->resp.status);

		/* If any firmware (including CAP) load fails under SRIOV, it should

		 * return failure to stop the VF from initializing.

drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c

+16 −2
Original line number Diff line number Diff line
@@ -3,6 +3,7 @@ 
#include <drm/drm_atomic_helper.h>

#include <drm/drm_edid.h>

#include <drm/drm_simple_kms_helper.h>

#include <drm/drm_gem_framebuffer_helper.h>

#include <drm/drm_vblank.h>



#include "amdgpu.h"
@@ -314,7 +315,13 @@ static int amdgpu_vkms_prepare_fb(struct drm_plane *plane, 
		return 0;

	}

	afb = to_amdgpu_framebuffer(new_state->fb);

	obj = new_state->fb->obj[0];



	obj = drm_gem_fb_get_obj(new_state->fb, 0);

	if (!obj) {

		DRM_ERROR("Failed to get obj from framebuffer\n");

		return -EINVAL;

	}



	rbo = gem_to_amdgpu_bo(obj);

	adev = amdgpu_ttm_adev(rbo->tbo.bdev);
@@ -368,12 +375,19 @@ static void amdgpu_vkms_cleanup_fb(struct drm_plane *plane, 
				   struct drm_plane_state *old_state)

{

	struct amdgpu_bo *rbo;

	struct drm_gem_object *obj;

	int r;



	if (!old_state->fb)

		return;



	rbo = gem_to_amdgpu_bo(old_state->fb->obj[0]);

	obj = drm_gem_fb_get_obj(old_state->fb, 0);

	if (!obj) {

		DRM_ERROR("Failed to get obj from framebuffer\n");

		return;

	}



	rbo = gem_to_amdgpu_bo(obj);

	r = amdgpu_bo_reserve(rbo, false);

	if (unlikely(r)) {

		DRM_ERROR("failed to reserve rbo before unpin\n");

drivers/gpu/drm/amd/amdgpu/psp_gfx_if.h

+3 −2
Original line number Diff line number Diff line
@@ -465,6 +465,7 @@ struct psp_gfx_rb_frame 


enum tee_error_code {

	TEE_SUCCESS			= 0x00000000,

	TEE_ERROR_CANCEL		= 0xFFFF0002,

	TEE_ERROR_NOT_SUPPORTED		= 0xFFFF000A,

};