Re: [resend PATCH] drm/ttm: Fix a deadlock if the target BO is not idle during swap

2021-09-09 Thread Christian König

Am 08.09.21 um 20:27 schrieb Daniel Vetter:

On Tue, Sep 07, 2021 at 11:28:23AM +0200, Christian König wrote:

Am 07.09.21 um 11:05 schrieb Daniel Vetter:

On Tue, Sep 07, 2021 at 08:22:20AM +0200, Christian König wrote:

Added a Fixes tag and pushed this to drm-misc-fixes.

We're in the merge window, this should have been drm-misc-next-fixes. I'll
poke misc maintainers so it's not lost.

Hui? It's a fix for a problem in stable and not in drm-misc-next.

Ah the flow chart is confusing. There is no current -rc, so it's always
-next-fixes. Or you're running the risk that it's lost until after -rc1.
Maybe we should clarify that "is the bug in current -rc?" only applies if
there is a current -rc.


Yeah, I've noticed this as well.

But when there is no current -rc because we are in the merge window then 
the question is how do I submit patches to the current stable?


In other words this patch here is really for 5.14 and should then be 
backported to 5.13 and maybe even 5.10 as well.


The code was restructured for 5.15 and I even need to double check if 
that still applies there as well.


Or should I send patches like those directly to Greg?

Regards,
Christian.



Anyway Thomas sent out a pr, so it's all good.
-Daniel


Christian.


-Daniel


It will take a while until it cycles back into the development branches, so
feel free to push some version to amd-staging-drm-next as well. Just ping
Alex when you do this.

Thanks,
Christian.

Am 07.09.21 um 06:08 schrieb xinhui pan:

The ret value might be -EBUSY, caller will think lru lock is still
locked but actually NOT. So return -ENOSPC instead. Otherwise we hit
list corruption.

ttm_bo_cleanup_refs might fail too if BO is not idle. If we return 0,
caller(ttm_tt_populate -> ttm_global_swapout ->ttm_device_swapout) will
be stuck as we actually did not free any BO memory. This usually happens
when the fence is not signaled for a long time.

Signed-off-by: xinhui pan 
Reviewed-by: Christian König 
---
drivers/gpu/drm/ttm/ttm_bo.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 8d7fd65ccced..23f906941ac9 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -1152,9 +1152,9 @@ int ttm_bo_swapout(struct ttm_buffer_object *bo, struct 
ttm_operation_ctx *ctx,
}
if (bo->deleted) {
-   ttm_bo_cleanup_refs(bo, false, false, locked);
+   ret = ttm_bo_cleanup_refs(bo, false, false, locked);
ttm_bo_put(bo);
-   return 0;
+   return ret == -EBUSY ? -ENOSPC : ret;
}
ttm_bo_del_from_lru(bo);
@@ -1208,7 +1208,7 @@ int ttm_bo_swapout(struct ttm_buffer_object *bo, struct 
ttm_operation_ctx *ctx,
if (locked)
dma_resv_unlock(bo->base.resv);
ttm_bo_put(bo);
-   return ret;
+   return ret == -EBUSY ? -ENOSPC : ret;
}
void ttm_bo_tt_destroy(struct ttm_buffer_object *bo)




Re: [PATCH v3 8/8] treewide: Replace the use of mem_encrypt_active() with cc_platform_has()

2021-09-09 Thread Christophe Leroy




On 9/8/21 10:58 PM, Tom Lendacky wrote:


diff --git a/arch/powerpc/include/asm/mem_encrypt.h 
b/arch/powerpc/include/asm/mem_encrypt.h
index ba9dab07c1be..2f26b8fc8d29 100644
--- a/arch/powerpc/include/asm/mem_encrypt.h
+++ b/arch/powerpc/include/asm/mem_encrypt.h
@@ -10,11 +10,6 @@
  
  #include 
  
-static inline bool mem_encrypt_active(void)

-{
-   return is_secure_guest();
-}
-
  static inline bool force_dma_unencrypted(struct device *dev)
  {
return is_secure_guest();
diff --git a/arch/powerpc/platforms/pseries/svm.c 
b/arch/powerpc/platforms/pseries/svm.c
index 87f001b4c4e4..c083ecbbae4d 100644
--- a/arch/powerpc/platforms/pseries/svm.c
+++ b/arch/powerpc/platforms/pseries/svm.c
@@ -8,6 +8,7 @@
  
  #include 

  #include 
+#include 
  #include 
  #include 
  #include 
@@ -63,7 +64,7 @@ void __init svm_swiotlb_init(void)
  
  int set_memory_encrypted(unsigned long addr, int numpages)

  {
-   if (!mem_encrypt_active())
+   if (!cc_platform_has(CC_ATTR_MEM_ENCRYPT))
return 0;
  
  	if (!PAGE_ALIGNED(addr))

@@ -76,7 +77,7 @@ int set_memory_encrypted(unsigned long addr, int numpages)
  
  int set_memory_decrypted(unsigned long addr, int numpages)

  {
-   if (!mem_encrypt_active())
+   if (!cc_platform_has(CC_ATTR_MEM_ENCRYPT))
return 0;
  
  	if (!PAGE_ALIGNED(addr))


This change unnecessarily complexifies the two functions. This is due to 
cc_platform_has() being out-line. It should really remain inline.


Before the change we got:

 <.set_memory_encrypted>:
   0:   7d 20 00 a6 mfmsr   r9
   4:   75 29 00 40 andis.  r9,r9,64
   8:   41 82 00 48 beq 50 <.set_memory_encrypted+0x50>
   c:   78 69 04 20 clrldi  r9,r3,48
  10:   2c 29 00 00 cmpdi   r9,0
  14:   40 82 00 4c bne 60 <.set_memory_encrypted+0x60>
  18:   7c 08 02 a6 mflrr0
  1c:   7c 85 23 78 mr  r5,r4
  20:   78 64 85 02 rldicl  r4,r3,48,20
  24:   61 23 f1 34 ori r3,r9,61748
  28:   f8 01 00 10 std r0,16(r1)
  2c:   f8 21 ff 91 stdur1,-112(r1)
  30:   48 00 00 01 bl  30 <.set_memory_encrypted+0x30>
30: R_PPC64_REL24   .ucall_norets
  34:   60 00 00 00 nop
  38:   38 60 00 00 li  r3,0
  3c:   38 21 00 70 addir1,r1,112
  40:   e8 01 00 10 ld  r0,16(r1)
  44:   7c 08 03 a6 mtlrr0
  48:   4e 80 00 20 blr
  50:   38 60 00 00 li  r3,0
  54:   4e 80 00 20 blr
  60:   38 60 ff ea li  r3,-22
  64:   4e 80 00 20 blr

After the change we get:

 <.set_memory_encrypted>:
   0:   7c 08 02 a6 mflrr0
   4:   fb c1 ff f0 std r30,-16(r1)
   8:   fb e1 ff f8 std r31,-8(r1)
   c:   7c 7f 1b 78 mr  r31,r3
  10:   38 60 00 00 li  r3,0
  14:   7c 9e 23 78 mr  r30,r4
  18:   f8 01 00 10 std r0,16(r1)
  1c:   f8 21 ff 81 stdur1,-128(r1)
  20:   48 00 00 01 bl  20 <.set_memory_encrypted+0x20>
20: R_PPC64_REL24   .cc_platform_has
  24:   60 00 00 00 nop
  28:   2c 23 00 00 cmpdi   r3,0
  2c:   41 82 00 44 beq 70 <.set_memory_encrypted+0x70>
  30:   7b e9 04 20 clrldi  r9,r31,48
  34:   2c 29 00 00 cmpdi   r9,0
  38:   40 82 00 58 bne 90 <.set_memory_encrypted+0x90>
  3c:   38 60 00 00 li  r3,0
  40:   7f c5 f3 78 mr  r5,r30
  44:   7b e4 85 02 rldicl  r4,r31,48,20
  48:   60 63 f1 34 ori r3,r3,61748
  4c:   48 00 00 01 bl  4c <.set_memory_encrypted+0x4c>
4c: R_PPC64_REL24   .ucall_norets
  50:   60 00 00 00 nop
  54:   38 60 00 00 li  r3,0
  58:   38 21 00 80 addir1,r1,128
  5c:   e8 01 00 10 ld  r0,16(r1)
  60:   eb c1 ff f0 ld  r30,-16(r1)
  64:   eb e1 ff f8 ld  r31,-8(r1)
  68:   7c 08 03 a6 mtlrr0
  6c:   4e 80 00 20 blr
  70:   38 21 00 80 addir1,r1,128
  74:   38 60 00 00 li  r3,0
  78:   e8 01 00 10 ld  r0,16(r1)
  7c:   eb c1 ff f0 ld  r30,-16(r1)
  80:   eb e1 ff f8 ld  r31,-8(r1)
  84:   7c 08 03 a6 mtlrr0
  88:   4e 80 00 20 blr
  90:   38 60 ff ea li  r3,-22
  94:   4b ff ff c4 b   58 <.set_memory_encrypted+0x58>



Re: [PATCH v2 60/63] net/af_iucv: Use struct_group() to zero struct iucv_sock region

2021-09-09 Thread Karsten Graul
On 18/08/2021 08:05, Kees Cook wrote:
> In preparation for FORTIFY_SOURCE performing compile-time and run-time
> field bounds checking for memset(), avoid intentionally writing across
> neighboring fields.
> 
> Add struct_group() to mark the region of struct iucv_sock that gets
> initialized to zero. Avoid the future warning:
> 
> In function 'fortify_memset_chk',
> inlined from 'iucv_sock_alloc' at net/iucv/af_iucv.c:476:2:
> ./include/linux/fortify-string.h:199:4: warning: call to 
> '__write_overflow_field' declared with attribute warning: detected write 
> beyond size of field (1st parameter); maybe use struct_group()? 
> [-Wattribute-warning]
>   199 |__write_overflow_field(p_size_field, size);
>   |^~
> 
> Cc: Julian Wiedmann 
> Cc: Karsten Graul 
> Cc: "David S. Miller" 
> Cc: Jakub Kicinski 
> Cc: linux-s...@vger.kernel.org
> Cc: net...@vger.kernel.org
> Signed-off-by: Kees Cook 
> ---
>  include/net/iucv/af_iucv.h | 10 ++
>  net/iucv/af_iucv.c |  2 +-
>  2 files changed, 7 insertions(+), 5 deletions(-)

No objections.
Acked-by: Karsten Graul 

Thank you.


[PATCH] drm/amd/amdkfd: fix possible memory leak in svm_range_restore_pages

2021-09-09 Thread Xiyu Yang
The memory leak issue may take place in an error handling path. When
p->xnack_enabled is NULL, the function simply returns with -EFAULT and
forgets to decrement the reference count of a kfd_process object bumped
by kfd_lookup_process_by_pasid, which may incur memory leaks.

Fix it by jumping to label "out", in which kfd_unref_process() decreases
the refcount.

Signed-off-by: Xiyu Yang 
Signed-off-by: Xin Xiong 
Signed-off-by: Xin Tan 
---
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c 
b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
index e883731c3f8f..0f7f1e5621ea 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -2426,7 +2426,8 @@ svm_range_restore_pages(struct amdgpu_device *adev, 
unsigned int pasid,
}
if (!p->xnack_enabled) {
pr_debug("XNACK not enabled for pasid 0x%x\n", pasid);
-   return -EFAULT;
+   r = -EFAULT;
+   goto out;
}
svms = &p->svms;
 
-- 
2.7.4



Re: [PATCH v3 2/8] mm: Introduce a function to check for confidential computing features

2021-09-09 Thread Christophe Leroy




On 9/8/21 10:58 PM, Tom Lendacky wrote:

In prep for other confidential computing technologies, introduce a generic
helper function, cc_platform_has(), that can be used to check for specific


I have little problem with that naming.

For me CC has always meant Compiler Collection.


active confidential computing attributes, like memory encryption. This is
intended to eliminate having to add multiple technology-specific checks to
the code (e.g. if (sev_active() || tdx_active())).

Co-developed-by: Andi Kleen 
Signed-off-by: Andi Kleen 
Co-developed-by: Kuppuswamy Sathyanarayanan 

Signed-off-by: Kuppuswamy Sathyanarayanan 

Signed-off-by: Tom Lendacky 
---
  arch/Kconfig|  3 ++
  include/linux/cc_platform.h | 88 +
  2 files changed, 91 insertions(+)
  create mode 100644 include/linux/cc_platform.h

diff --git a/arch/Kconfig b/arch/Kconfig
index 3743174da870..ca7c359e5da8 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -1234,6 +1234,9 @@ config RELR
  config ARCH_HAS_MEM_ENCRYPT
bool
  
+config ARCH_HAS_CC_PLATFORM

+   bool
+
  config HAVE_SPARSE_SYSCALL_NR
 bool
 help
diff --git a/include/linux/cc_platform.h b/include/linux/cc_platform.h
new file mode 100644
index ..253f3ea66cd8
--- /dev/null
+++ b/include/linux/cc_platform.h
@@ -0,0 +1,88 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Confidential Computing Platform Capability checks
+ *
+ * Copyright (C) 2021 Advanced Micro Devices, Inc.
+ *
+ * Author: Tom Lendacky 
+ */
+
+#ifndef _CC_PLATFORM_H
+#define _CC_PLATFORM_H
+
+#include 
+#include 
+
+/**
+ * enum cc_attr - Confidential computing attributes
+ *
+ * These attributes represent confidential computing features that are
+ * currently active.
+ */
+enum cc_attr {
+   /**
+* @CC_ATTR_MEM_ENCRYPT: Memory encryption is active
+*
+* The platform/OS is running with active memory encryption. This
+* includes running either as a bare-metal system or a hypervisor
+* and actively using memory encryption or as a guest/virtual machine
+* and actively using memory encryption.
+*
+* Examples include SME, SEV and SEV-ES.
+*/
+   CC_ATTR_MEM_ENCRYPT,
+
+   /**
+* @CC_ATTR_HOST_MEM_ENCRYPT: Host memory encryption is active
+*
+* The platform/OS is running as a bare-metal system or a hypervisor
+* and actively using memory encryption.
+*
+* Examples include SME.
+*/
+   CC_ATTR_HOST_MEM_ENCRYPT,
+
+   /**
+* @CC_ATTR_GUEST_MEM_ENCRYPT: Guest memory encryption is active
+*
+* The platform/OS is running as a guest/virtual machine and actively
+* using memory encryption.
+*
+* Examples include SEV and SEV-ES.
+*/
+   CC_ATTR_GUEST_MEM_ENCRYPT,
+
+   /**
+* @CC_ATTR_GUEST_STATE_ENCRYPT: Guest state encryption is active
+*
+* The platform/OS is running as a guest/virtual machine and actively
+* using memory encryption and register state encryption.
+*
+* Examples include SEV-ES.
+*/
+   CC_ATTR_GUEST_STATE_ENCRYPT,
+};
+
+#ifdef CONFIG_ARCH_HAS_CC_PLATFORM
+
+/**
+ * cc_platform_has() - Checks if the specified cc_attr attribute is active
+ * @attr: Confidential computing attribute to check
+ *
+ * The cc_platform_has() function will return an indicator as to whether the
+ * specified Confidential Computing attribute is currently active.
+ *
+ * Context: Any context
+ * Return:
+ * * TRUE  - Specified Confidential Computing attribute is active
+ * * FALSE - Specified Confidential Computing attribute is not active
+ */
+bool cc_platform_has(enum cc_attr attr);


This declaration make it impossible for architectures to define this 
function inline.


For such function, having it inline would make more sense as it would 
allow GCC to perform constant folding and avoid the overhead  of calling 
a sub-function.



+
+#else  /* !CONFIG_ARCH_HAS_CC_PLATFORM */
+
+static inline bool cc_platform_has(enum cc_attr attr) { return false; }
+
+#endif /* CONFIG_ARCH_HAS_CC_PLATFORM */
+
+#endif /* _CC_PLATFORM_H */



Re: Handling DRM master transitions cooperatively

2021-09-09 Thread Pekka Paalanen
On Wed, 8 Sep 2021 18:27:09 +0200
Daniel Vetter  wrote:

> On Wed, Sep 8, 2021 at 9:36 AM Pekka Paalanen  wrote:
> >
> > On Tue, 7 Sep 2021 14:42:56 +0200
> > Hans de Goede  wrote:
> >  
> > > Hi,
> > >
> > > On 9/7/21 12:07 PM, Pekka Paalanen wrote:  
> > > > On Fri, 3 Sep 2021 21:08:21 +0200
> > > > Dennis Filder  wrote:
> > > >  
> > > >> Hans de Goede asked me to take a topic from a private discussion here.
> > > >> I must also preface that I'm not a graphics person and my knowledge of
> > > >> DRI/DRM is cursory at best.
> > > >>
> > > >> I initiated the conversation with de Goede after learning that the X
> > > >> server now supports being started with an open DRM file descriptor
> > > >> (this was added for Keith Packard's xlease project).  I wondered if
> > > >> that could be used to smoothen the Plymouth->X transition somehow and
> > > >> asked de Goede if there were any such plans.  He denied, but mentioned
> > > >> that a new ioctl is in the works to prevent the kernel from wiping the
> > > >> contents of a frame buffer after a device is closed, and that this
> > > >> would help to keep transitions smooth.  
> > > >
> > > > Hi,
> > > >
> > > > I believe the kernel is not wiping anything on device close. If
> > > > something in the KMS state is wiped, it originates in userspace:
> > > >
> > > > - Plymouth doing something (e.g. RmFB on an in-use FB will turn the
> > > >   output off, you need to be careful to "leak" your FB if you want a
> > > >   smooth hand-over)  
> > >
> > > The "kernel is not wiping anything on device close" is not true,
> > > when closing /dev/dri/card# any remaining FBs from the app closing
> > > it will be dealt with as if they were RmFB-ed, causing the screen
> > > to show what I call "the fallback fb", at least with the i915 driver.  
> >
> > No, that's not what should happen AFAIK.
> >
> > True, all FBs that are not referenced by active CRTCs or planes will
> > get freed, since their refcount drops to zero, but those CRTCs and
> > planes that are active will remain active and therefore keep their
> > reference to the respective FBs and so the FBs remain until replaced or
> > turned off explicitly (by e.g. fbcon if you switch to that rather than
> > another userspace KMS client). I believe that is the whole reason why
> > e.g. DRM_IOCTL_MODE_GETFB2 can be useful, otherwise the next KMS client
> > would not have anything to scrape.
> >
> > danvet, what is the DRM core intention?  
> 
> Historical accidents mostly. There's two things that foil easy
> handover to the next compositor:
> - RMFB instead of CLOSEFB semantics, especially when closing the
> drmfd. This is uapi, so anything we change needs to be opt-in

What does this mean and refer to?

Are you trying to say, that closing the DRM device fd (freeing the file
description) causes an implicit RmFB on all the FBs tied to that DRM
device file description?

I never realised that before.

> - Forced fbdev restore on final close of all drm fd. This is only
> prevented if there's a drm master left around (systemd-logind can keep
> that instead of forcing the compositor to survive until the other has
> taken over, which it needs to do anyway to prevent the drm master
> handover from going sideways). This can be fixed by simply disabling
> fbdev completely, which you really want to do anyway. Again it's uabi,
> people will complain if we break this I think.

Do you mean that it is not enough to leave the tty in KD_GRAPHICS mode
to stop fbcon/fbdev from taking over?

Is it really fbdev on its own rather than fbcon (poking at fbdev) that
will change the KMS state?

That is, it's not enough to disable fbcon?

> > Or am I confused because display servers do not tend to close the DRM
> > device fd on switch-out but Plymouth does (too early)?  
> 
> Yeah, that stops both forced restore/disable from kicking in.

Which "that"?

> > If so, why can't Plymouth keep the device open longer and quit only
> > when the hand-off is complete? Not quitting too early would be a
> > prerequisite for any explicit hand-off protocol as well.  
> 
> With closefb semantics and fbdev disabled plymouth could quit early,
> and things still work.

What is "closefb semantics"?


Thanks,
pq


pgpYfqYztzdGz.pgp
Description: OpenPGP digital signature


Re: [PATCH v3 4/8] powerpc/pseries/svm: Add a powerpc version of cc_platform_has()

2021-09-09 Thread Christophe Leroy




On 9/8/21 10:58 PM, Tom Lendacky wrote:

Introduce a powerpc version of the cc_platform_has() function. This will
be used to replace the powerpc mem_encrypt_active() implementation, so
the implementation will initially only support the CC_ATTR_MEM_ENCRYPT
attribute.

Cc: Michael Ellerman 
Cc: Benjamin Herrenschmidt 
Cc: Paul Mackerras 
Signed-off-by: Tom Lendacky 
---
  arch/powerpc/platforms/pseries/Kconfig   |  1 +
  arch/powerpc/platforms/pseries/Makefile  |  2 ++
  arch/powerpc/platforms/pseries/cc_platform.c | 26 
  3 files changed, 29 insertions(+)
  create mode 100644 arch/powerpc/platforms/pseries/cc_platform.c

diff --git a/arch/powerpc/platforms/pseries/Kconfig 
b/arch/powerpc/platforms/pseries/Kconfig
index 5e037df2a3a1..2e57391e0778 100644
--- a/arch/powerpc/platforms/pseries/Kconfig
+++ b/arch/powerpc/platforms/pseries/Kconfig
@@ -159,6 +159,7 @@ config PPC_SVM
select SWIOTLB
select ARCH_HAS_MEM_ENCRYPT
select ARCH_HAS_FORCE_DMA_UNENCRYPTED
+   select ARCH_HAS_CC_PLATFORM
help
 There are certain POWER platforms which support secure guests using
 the Protected Execution Facility, with the help of an Ultravisor
diff --git a/arch/powerpc/platforms/pseries/Makefile 
b/arch/powerpc/platforms/pseries/Makefile
index 4cda0ef87be0..41d8aee98da4 100644
--- a/arch/powerpc/platforms/pseries/Makefile
+++ b/arch/powerpc/platforms/pseries/Makefile
@@ -31,3 +31,5 @@ obj-$(CONFIG_FA_DUMP) += rtas-fadump.o
  
  obj-$(CONFIG_SUSPEND)		+= suspend.o

  obj-$(CONFIG_PPC_VAS) += vas.o
+
+obj-$(CONFIG_ARCH_HAS_CC_PLATFORM) += cc_platform.o
diff --git a/arch/powerpc/platforms/pseries/cc_platform.c 
b/arch/powerpc/platforms/pseries/cc_platform.c
new file mode 100644
index ..e8021af83a19
--- /dev/null
+++ b/arch/powerpc/platforms/pseries/cc_platform.c
@@ -0,0 +1,26 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Confidential Computing Platform Capability checks
+ *
+ * Copyright (C) 2021 Advanced Micro Devices, Inc.
+ *
+ * Author: Tom Lendacky 
+ */
+
+#include 
+#include 
+
+#include 
+#include 
+
+bool cc_platform_has(enum cc_attr attr)
+{


Please keep this function inline as mem_encrypt_active() is



+   switch (attr) {
+   case CC_ATTR_MEM_ENCRYPT:
+   return is_secure_guest();
+
+   default:
+   return false;
+   }
+}
+EXPORT_SYMBOL_GPL(cc_platform_has);



Re: [PATCH 2/8] drm/i915/xehp: CCS shares the render reset domain

2021-09-09 Thread Tvrtko Ursulin



On 08/09/2021 21:23, Matt Roper wrote:

On Wed, Sep 08, 2021 at 11:07:07AM +0100, Tvrtko Ursulin wrote:


On 07/09/2021 18:19, Matt Roper wrote:

The reset domain is shared between render and all compute engines,
so resetting one will affect the others.

Note:  Before performing a reset on an RCS or CCS engine, the GuC will
attempt to preempt-to-idle the other non-hung RCS/CCS engines to avoid
impacting other clients (since some shared modules will be reset).  If
other engines are executing non-preemptable workloads, the impact is
unavoidable and some work may be lost.


Since here it talks about engine reset, should this patch add warning if
same is attempted by i915 on a GuC platform - to document it is not


Did you mean "on a *non* GuC platform" here?  We aren't going to have
compute engine support on any platforms where GuC submission isn't the
default operating model, so the only way to get compute engines +
execlist submission is to force an override via module parameters (e.g.,
enable_guc=0).  Doing so will taint the kernel, so I think the current
consensus from offline discussion is that the user has already put
themselves into a configuration where it's easier than usual to shoot
themselves in the foot; it's not too much different than the kind of
trouble a user could get themselves into if they loaded the driver with
hangcheck disabled or something.


Yes I meant non GuC. :)

Okay..ish, although I think an explicit warn would still be better. 
Because it is one thing to taint and another to actively allow something 
which we know cannot work.


Unless we could hide the CCS engine until GuC gets loaded, which would 
make i915.enable_guc=0 safe. Hm.. should be doable actually to skip 
intel_engine_add_user in the engine init phase and do the CCS ones after 
GuC has been loaded. Would that make sense?


Regards,

Tvrtko


implemented/supported? Or perhaps later in the series, or future series
works better.

Reviewed-by: Tvrtko Ursulin 

Regards,

Tvrtko


Bspec: 52549
Original-patch-by: Michel Thierry
Cc: Tvrtko Ursulin 
Cc: Vinay Belgaumkar 
Signed-off-by: Daniele Ceraolo Spurio 
Signed-off-by: Aravind Iddamsetty 
Signed-off-by: Matt Roper 
---
   drivers/gpu/drm/i915/gt/intel_reset.c | 4 
   1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/i915/gt/intel_reset.c 
b/drivers/gpu/drm/i915/gt/intel_reset.c
index 91200c43951f..30598c1d070c 100644
--- a/drivers/gpu/drm/i915/gt/intel_reset.c
+++ b/drivers/gpu/drm/i915/gt/intel_reset.c
@@ -507,6 +507,10 @@ static int gen11_reset_engines(struct intel_gt *gt,
[VECS1] = GEN11_GRDOM_VECS2,
[VECS2] = GEN11_GRDOM_VECS3,
[VECS3] = GEN11_GRDOM_VECS4,
+   [CCS0] = GEN11_GRDOM_RENDER,
+   [CCS1] = GEN11_GRDOM_RENDER,
+   [CCS2] = GEN11_GRDOM_RENDER,
+   [CCS3] = GEN11_GRDOM_RENDER,
};
struct intel_engine_cs *engine;
intel_engine_mask_t tmp;





Re: [BUG - BISECTED] display not detected anymore

2021-09-09 Thread Heiko Carstens
Hi Ville,

> > > > ef79d62b5ce5 ("drm/i915: Encapsulate dbuf state handling harder")
> > > > 
> > > > With that commit the display is not detected anymore, one commit
> > > > before that it still works. So this one seems to be broken.
> > > > 
> > > > Ville, Stanislav, any idea how to fix this?
> > > > 
> > > > commit ef79d62b5ce53851901d6c1d21b74cbb9e27219b
> > > > Author: Ville Syrjälä 
> > > > Date:   Fri Jan 22 22:56:32 2021 +0200
> > > > 
> > > > drm/i915: Encapsulate dbuf state handling harder
> > > 
> > > That has nothing to do with display detection, so very mysterious.
> > > 
> > > Please file a bug at https://gitlab.freedesktop.org/drm/intel/issues/new
> > > boot with drm.debug=0xe with both good and bad kernels and attach the
> > > dmesg from both to the bug.
> > 
> > Everything (hopefully) provided here:
> > https://gitlab.freedesktop.org/drm/intel/-/issues/4013
> > 
> > Please let me know if you need more, or if I can help otherwise to
> > resolve this.
> 
> Did you have any time to look into this already?

How do we proceed with this? Saying that this is either "very
mysterious" or "very strange" won't fix the regression. :)

Thanks,
Heiko


Re: [Intel-gfx] [PATCH v7 15/17] drm/i915/pxp: add pxp debugfs

2021-09-09 Thread Teres Alexis, Alan Previn
I dont see any issues except a couple of nits. 

Reviewed-by : Alan Previn 

...alan

On Fri, 2021-08-27 at 18:27 -0700, Daniele Ceraolo Spurio wrote:
> 2 debugfs files, one to query the current status of the pxp session and one
> to trigger an invalidation for testing.
> 
> Signed-off-by: Daniele Ceraolo Spurio 
> ---
>  drivers/gpu/drm/i915/Makefile|  1 +
>  drivers/gpu/drm/i915/gt/debugfs_gt.c |  2 +
>  drivers/gpu/drm/i915/pxp/intel_pxp_debugfs.c | 78 
>  drivers/gpu/drm/i915/pxp/intel_pxp_debugfs.h | 21 ++
>  4 files changed, 102 insertions(+)
>  create mode 100644 drivers/gpu/drm/i915/pxp/intel_pxp_debugfs.c
>  create mode 100644 drivers/gpu/drm/i915/pxp/intel_pxp_debugfs.h
> 
> diff --git a/drivers/gpu/drm/i915/Makefile b/drivers/gpu/drm/i915/Makefile
> index 6f6cbbe98b96..9a44d6f01e3b 100644
> --- a/drivers/gpu/drm/i915/Makefile
> +++ b/drivers/gpu/drm/i915/Makefile
> @@ -284,6 +284,7 @@ i915-y += i915_perf.o
>  i915-$(CONFIG_DRM_I915_PXP) += \
>   pxp/intel_pxp.o \
>   pxp/intel_pxp_cmd.o \
> + pxp/intel_pxp_debugfs.o \
>   pxp/intel_pxp_irq.o \
>   pxp/intel_pxp_pm.o \
>   pxp/intel_pxp_session.o \
> diff --git a/drivers/gpu/drm/i915/gt/debugfs_gt.c 
> b/drivers/gpu/drm/i915/gt/debugfs_gt.c
> index 591eb60785db..c27847ddb796 100644
> --- a/drivers/gpu/drm/i915/gt/debugfs_gt.c
> +++ b/drivers/gpu/drm/i915/gt/debugfs_gt.c
> @@ -9,6 +9,7 @@
>  #include "debugfs_gt.h"
>  #include "debugfs_gt_pm.h"
>  #include "intel_sseu_debugfs.h"
> +#include "pxp/intel_pxp_debugfs.h"
>  #include "uc/intel_uc_debugfs.h"
>  #include "i915_drv.h"
>  
> @@ -28,6 +29,7 @@ void debugfs_gt_register(struct intel_gt *gt)
>   intel_sseu_debugfs_register(gt, root);
>  
>   intel_uc_debugfs_register(>->uc, root);
> + intel_pxp_debugfs_register(>->pxp, root);
>  }
>  
>  void intel_gt_debugfs_register_files(struct dentry *root,
> diff --git a/drivers/gpu/drm/i915/pxp/intel_pxp_debugfs.c 
> b/drivers/gpu/drm/i915/pxp/intel_pxp_debugfs.c
> new file mode 100644
> index ..a26e4396ba6c
> --- /dev/null
> +++ b/drivers/gpu/drm/i915/pxp/intel_pxp_debugfs.c
> @@ -0,0 +1,78 @@
> +// SPDX-License-Identifier: MIT
> +/*
> + * Copyright © 2021 Intel Corporation
> + */
> +
> +#include 
> +#include 
> +
> +#include "gt/debugfs_gt.h"
> +#include "pxp/intel_pxp.h"
> +#include "pxp/intel_pxp_irq.h"
> +#include "i915_drv.h"
> +
> +static int pxp_info_show(struct seq_file *m, void *data)
> +{
> + struct intel_pxp *pxp = m->private;
> + struct drm_printer p = drm_seq_file_printer(m);
> + bool enabled = intel_pxp_is_enabled(pxp);
> +
> + if (!enabled) {
> + drm_printf(&p, "pxp disabled\n");
> + return 0;
> + }
> +
> + drm_printf(&p, "active: %s\n", yesno(intel_pxp_is_active(pxp)));
> + drm_printf(&p, "instance counter: %u\n", pxp->key_instance);
> +
> + return 0;
> +}
> +DEFINE_GT_DEBUGFS_ATTRIBUTE(pxp_info);
> +
> +static int pxp_inval_get(void *data, u64 *val)
> +{
> + /* nothing to read */
> + return -EPERM;
> +}
> +
> +static int pxp_inval_set(void *data, u64 val)
> +{
> + struct intel_pxp *pxp = data;
> + struct intel_gt *gt = pxp_to_gt(pxp);
> +
> + if (!intel_pxp_is_active(pxp))
> + return -ENODEV;
> +
> + /* simulate an invalidation interrupt */
> + spin_lock_irq(>->irq_lock);
> + intel_pxp_irq_handler(pxp, 
> GEN12_DISPLAY_PXP_STATE_TERMINATED_INTERRUPT);
> + spin_unlock_irq(>->irq_lock);
> +
> + if (!wait_for_completion_timeout(&pxp->termination,
> +  msecs_to_jiffies(100)))
> + return -ETIMEDOUT;
> +
> + return 0;
> +}
> +
> +DEFINE_SIMPLE_ATTRIBUTE(pxp_inval_fops, pxp_inval_get, pxp_inval_set, 
> "%llx\n");
> +void intel_pxp_debugfs_register(struct intel_pxp *pxp, struct dentry 
> *gt_root)
> +{
> + static const struct debugfs_gt_file files[] = {
> + { "info", &pxp_info_fops, NULL },
> + { "invalidate", &pxp_inval_fops, NULL },
NIT only: consider naming to "invalidate_display" or "display_inval" since we 
are using this to trigger
display pxp teardown specific irq code path.
> + };
> + struct dentry *root;
> +
> + if (!gt_root)
> + return;
> +
> + if (!HAS_PXP((pxp_to_gt(pxp)->i915)))
> + return;
> +
> + root = debugfs_create_dir("pxp", gt_root);
> + if (IS_ERR(root))
> + return;
> +
> + intel_gt_debugfs_register_files(root, files, ARRAY_SIZE(files), pxp);
> +}
> diff --git a/drivers/gpu/drm/i915/pxp/intel_pxp_debugfs.h 
> b/drivers/gpu/drm/i915/pxp/intel_pxp_debugfs.h
> new file mode 100644
> index ..3b7454d838e9
> --- /dev/null
> +++ b/drivers/gpu/drm/i915/pxp/intel_pxp_debugfs.h
> @@ -0,0 +1,21 @@
> +/* SPDX-License-Identifier: MIT */
> +/*
> + * Copyright © 2020 Intel Corporation
NIT - 2021
> + */
> +
> +#ifndef __INTEL_PXP_DEBUGFS_H__
> +#define __INTEL_PXP_DEBUGFS_H__
> +
> +stru

Re: Handling DRM master transitions cooperatively

2021-09-09 Thread Pekka Paalanen
On Wed, 8 Sep 2021 18:21:12 +0200
Dennis Filder  wrote:

> The idea was that since you would have to have some IPC mechanism in
> user space anyway to quickly effect a flicker-free transition from
> Plymouth to the display manager (since, as de Goede reiterates in the
> other message, both processes must have the device already open and
> call drmSetMaster/drmDropMaster coordinatedly) you might just as well
> look for ways how it could be designed for the benefit of everyone.
> Using "implicit protocols" for things like this is usually the go-to
> way, not because it's good design, but because it is easy to
> implement.  But these "implicit protocols" have a tendency to greatly
> limit what can be done and to not be easily adaptable once the use
> cases become more complicated or refined, and thus they force
> contortions on everyone eventually.
> 
> How such a protocol could look?  I don't know.  Maybe some DBus
> interface for a broker/multiplexer for shared devices that would keep
> track of the current DRM master and tell any process interested in
> obtaining it what process to talk to.

Hi,

such broker daemon exists already. It is called systemd-logind, and
maybe some of the logind replacements as well. Currently it handles
session switching, the D-Bus API replacing the legacy VT switching API
and drmSetMaster/drmDropMaster. It's also independent of the VT
subsystem, so it can be used on all physical seats.

The existing D-Bus API there is probably not flexible enough for the
best hand-over experience though, as Simon said.

Since session switching is what the logind API does, hand-over protocols
would fit there IMO.

>  It could then contact it either
> via DBus or over a separate socket, communicate its capabilities,
> negotiate the modalities for the transition and acquire the necessary
> resources in the form of file descriptors passed over DBus/the socket.
> Then both processes could set themselves up for the transition and
> effect it, which could involve e.g. unlocking a locked mutex/semaphore
> in shared memory.  Alternatively, the donor could refuse the handover,
> e.g. if a screen locker is configured to prohibit release of the
> device.  Complexitywise the sky would be the limit, of course, but it
> needn't be this complicated from the beginning.  An initial version of
> such a protocol could be held just as simple as the status quo.
> 
> As for the point raised by Paalanen that implementing something like
> this would require a lot of effort I must state that, while certainly
> true, many of the things I mentioned here are already implemented
> somehow somewhere.  Plymouth has a control socket and protocol with
> which the state of the splash screen can be controlled from the
> outside to make the transition to gdm smoother.  The xlease project
> apparently was designed with the intent that DRM devices should be
> leased (and subleased) out to processes, and cross-process
> coordination would be governed this way.

DRM leasing was not designed for permanent hand-over. Instead, it was
designed for temporarily leasing some KMS resources to another process,
where the lessor can forcibly revoke them at any time.

That said, I'm not sure what happens to the lessee if the lessor quits.
I would expect the lease to get revoked, since how else would the next
display server instance gain control if the lessor e.g. crashed.

I'd keep the DRM leasing out of the permanent whole-device hand-off
design, it seems like a detour to me.

>  The kmscon project also had
> to come up with something to govern device access since it could no
> longer piggy-back on the VT-API.  systemd-logind also draws up a
> framework for governance over a shared device and how to tie them to
> sessions/seats (with such peculiarities that you cannot auto-spawn a
> getty on tty1 since that is "reserved" for Wayland).  Then there is
> the VT console, and probably lots of other little things I don't even
> know about.
> 
> All this effort is already being expended, and IMO it proves the need
> for some way to gracefully coordinate access to shared devices that
> offers more than what can be done with current "implicit protocols".
> The community should consider acknowledging this need and trying to
> answer the question what such a subsystem should and should not look
> like.  Once the nature of the problem is understood better
> implementational questions will become easier.

Your initial email came out a bit ranty rather than a technical
question. I think it would help if you had a tangible goal, some
specific behaviour you want to implement, and write that down in detail.
Then it would be easier to discuss how to achieve that while not making
the solution excessively single-purpose or hacky. Imaginary use cases
are both fairly abstract so hard to discuss, and uncertain if they would
ever actually be done - putting the effort needed at risk of being
wasted, reducing interest.

I acknowledge a lot of needs all over, but there are

Re: [PATCH] kernel/locking: Add context to ww_mutex_trylock.

2021-09-09 Thread Peter Zijlstra
On Thu, Sep 09, 2021 at 07:38:06AM +0200, Maarten Lankhorst wrote:

> > You'll need a similar hunk in ww_rt_mutex.c
> 
> What tree has that file?

Linus' tree should have it. Per commit:

  f8635d509d80 ("locking/ww_mutex: Implement rtmutex based ww_mutex API 
functions")


Re: [PATCH v3 0/8] Implement generic cc_platform_has() helper function

2021-09-09 Thread Christian Borntraeger




On 09.09.21 00:58, Tom Lendacky wrote:

This patch series provides a generic helper function, cc_platform_has(),
to replace the sme_active(), sev_active(), sev_es_active() and
mem_encrypt_active() functions.

It is expected that as new confidential computing technologies are
added to the kernel, they can all be covered by a single function call
instead of a collection of specific function calls all called from the
same locations.

The powerpc and s390 patches have been compile tested only. Can the
folks copied on this series verify that nothing breaks for them.


Is there a tree somewhere?

 Also,

a new file, arch/powerpc/platforms/pseries/cc_platform.c, has been
created for powerpc to hold the out of line function.

Cc: Andi Kleen 
Cc: Andy Lutomirski 
Cc: Ard Biesheuvel 
Cc: Baoquan He 
Cc: Benjamin Herrenschmidt 
Cc: Borislav Petkov 
Cc: Christian Borntraeger 
Cc: Daniel Vetter 
Cc: Dave Hansen 
Cc: Dave Young 
Cc: David Airlie 
Cc: Heiko Carstens 
Cc: Ingo Molnar 
Cc: Joerg Roedel 
Cc: Maarten Lankhorst 
Cc: Maxime Ripard 
Cc: Michael Ellerman 
Cc: Paul Mackerras 
Cc: Peter Zijlstra 
Cc: Thomas Gleixner 
Cc: Thomas Zimmermann 
Cc: Vasily Gorbik 
Cc: VMware Graphics 
Cc: Will Deacon 
Cc: Christoph Hellwig 

---

Patches based on:
   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
   4b93c544e90e ("thunderbolt: test: split up test cases in 
tb_test_credit_alloc_all")

Changes since v2:
- Changed the name from prot_guest_has() to cc_platform_has()
- Took the cc_platform_has() function out of line. Created two new files,
   cc_platform.c, in both x86 and ppc to implment the function. As a
   result, also changed the attribute defines into enums.
- Removed any received Reviewed-by's and Acked-by's given changes in this
   version.
- Added removal of new instances of mem_encrypt_active() usage in powerpc
   arch.
- Based on latest Linux tree to pick up powerpc changes related to the
   mem_encrypt_active() function.

Changes since v1:
- Moved some arch ioremap functions within #ifdef CONFIG_AMD_MEM_ENCRYPT
   in prep for use of prot_guest_has() by TDX.
- Added type includes to the the protected_guest.h header file to prevent
   build errors outside of x86.
- Made amd_prot_guest_has() EXPORT_SYMBOL_GPL
- Used amd_prot_guest_has() in place of checking sme_me_mask in the
   arch/x86/mm/mem_encrypt.c file.

Tom Lendacky (8):
   x86/ioremap: Selectively build arch override encryption functions
   mm: Introduce a function to check for confidential computing features
   x86/sev: Add an x86 version of cc_platform_has()
   powerpc/pseries/svm: Add a powerpc version of cc_platform_has()
   x86/sme: Replace occurrences of sme_active() with cc_platform_has()
   x86/sev: Replace occurrences of sev_active() with cc_platform_has()
   x86/sev: Replace occurrences of sev_es_active() with cc_platform_has()
   treewide: Replace the use of mem_encrypt_active() with
 cc_platform_has()

  arch/Kconfig |  3 +
  arch/powerpc/include/asm/mem_encrypt.h   |  5 --
  arch/powerpc/platforms/pseries/Kconfig   |  1 +
  arch/powerpc/platforms/pseries/Makefile  |  2 +
  arch/powerpc/platforms/pseries/cc_platform.c | 26 ++
  arch/powerpc/platforms/pseries/svm.c |  5 +-
  arch/s390/include/asm/mem_encrypt.h  |  2 -
  arch/x86/Kconfig |  1 +
  arch/x86/include/asm/io.h|  8 ++
  arch/x86/include/asm/kexec.h |  2 +-
  arch/x86/include/asm/mem_encrypt.h   | 14 +---
  arch/x86/kernel/Makefile |  3 +
  arch/x86/kernel/cc_platform.c| 21 +
  arch/x86/kernel/crash_dump_64.c  |  4 +-
  arch/x86/kernel/head64.c |  4 +-
  arch/x86/kernel/kvm.c|  3 +-
  arch/x86/kernel/kvmclock.c   |  4 +-
  arch/x86/kernel/machine_kexec_64.c   | 19 +++--
  arch/x86/kernel/pci-swiotlb.c|  9 +-
  arch/x86/kernel/relocate_kernel_64.S |  2 +-
  arch/x86/kernel/sev.c|  6 +-
  arch/x86/kvm/svm/svm.c   |  3 +-
  arch/x86/mm/ioremap.c| 18 ++--
  arch/x86/mm/mem_encrypt.c| 57 +++--
  arch/x86/mm/mem_encrypt_identity.c   |  3 +-
  arch/x86/mm/pat/set_memory.c |  3 +-
  arch/x86/platform/efi/efi_64.c   |  9 +-
  arch/x86/realmode/init.c |  8 +-
  drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c  |  4 +-
  drivers/gpu/drm/drm_cache.c  |  4 +-
  drivers/gpu/drm/vmwgfx/vmwgfx_drv.c  |  4 +-
  drivers/gpu/drm/vmwgfx/vmwgfx_msg.c  |  6 +-
  drivers/iommu/amd/init.c |  7 +-
  drivers/iommu/amd/iommu.c|  3 +-
  drivers/iommu/amd/iommu_v2.c |  3 +-
  drivers/iommu/iommu.c|  3 +-
  fs/proc/vmcore.c | 

[PULL] drm-misc-next-fixes

2021-09-09 Thread Maarten Lankhorst
drm-misc-next-fixes-2021-09-09:
drm-misc-next-fixes for v5.15:
- Make some dma-buf config options depend on DMA_SHARED_BUFFER.
- Handle multiplication overflow of fbdev xres/yres in the core.
The following changes since commit efcefc7127290e7e9fa98dea029163ad8eda8fb3:

  drm/ttm: Fix ttm_bo_move_memcpy() for subclassed struct ttm_resource 
(2021-08-31 10:48:26 +0200)

are available in the Git repository at:

  git://anongit.freedesktop.org/drm/drm-misc tags/drm-misc-next-fixes-2021-09-09

for you to fetch changes up to 8c28051cdcbe9dfcec6bd0a4709d67a09df6edae:

  fbmem: don't allow too huge resolutions (2021-09-08 18:52:04 +0200)


drm-misc-next-fixes for v5.15:
- Make some dma-buf config options depend on DMA_SHARED_BUFFER.
- Handle multiplication overflow of fbdev xres/yres in the core.


Geert Uytterhoeven (3):
  dma-buf: DMABUF_MOVE_NOTIFY should depend on DMA_SHARED_BUFFER
  dma-buf: DMABUF_DEBUG should depend on DMA_SHARED_BUFFER
  dma-buf: DMABUF_SYSFS_STATS should depend on DMA_SHARED_BUFFER

Tetsuo Handa (1):
  fbmem: don't allow too huge resolutions

 drivers/dma-buf/Kconfig  | 4 +++-
 drivers/video/fbdev/core/fbmem.c | 6 ++
 2 files changed, 9 insertions(+), 1 deletion(-)


Re: [Intel-gfx] [PATCH v2] drm/i915: Handle Intel igfx + Intel dgfx hybrid graphics setup

2021-09-09 Thread Tvrtko Ursulin



On 08/09/2021 18:06, Daniel Vetter wrote:

On Thu, Sep 02, 2021 at 04:01:40PM +0100, Tvrtko Ursulin wrote:


On 02/09/2021 15:33, Daniel Vetter wrote:

On Tue, Aug 31, 2021 at 02:18:15PM +0100, Tvrtko Ursulin wrote:


On 31/08/2021 13:43, Daniel Vetter wrote:

On Tue, Aug 31, 2021 at 10:15:03AM +0100, Tvrtko Ursulin wrote:


On 30/08/2021 09:26, Daniel Vetter wrote:

On Fri, Aug 27, 2021 at 03:44:42PM +0100, Tvrtko Ursulin wrote:


On 27/08/2021 15:39, Tvrtko Ursulin wrote:

From: Tvrtko Ursulin 

In short this makes i915 work for hybrid setups (DRI_PRIME=1 with Mesa)
when rendering is done on Intel dgfx and scanout/composition on Intel
igfx.

Before this patch the driver was not quite ready for that setup, mainly
because it was able to emit a semaphore wait between the two GPUs, which
results in deadlocks because semaphore target location in HWSP is neither
shared between the two, nor mapped in both GGTT spaces.

To fix it the patch adds an additional check to a couple of relevant code
paths in order to prevent using semaphores for inter-engine
synchronisation between different driver instances.

Patch also moves singly used i915_gem_object_last_write_engine to be
private in its only calling unit (debugfs), while modifying it to only
show activity belonging to the respective driver instance.

What remains in this problem space is the question of the GEM busy ioctl.
We have a somewhat ambigous comment there saying only status of native
fences will be reported, which could be interpreted as either i915, or
native to the drm fd. For now I have decided to leave that as is, meaning
any i915 instance activity continues to be reported.

v2:
  * Avoid adding rq->i915. (Chris)

Signed-off-by: Tvrtko Ursulin 


Can't we just delete semaphore code and done?
- GuC won't have it
- media team benchmarked on top of softpin media driver, found no
  difference


You have S-curve for saturated workloads or something else? How thorough and
which media team I guess.

   From memory it was a nice win for some benchmarks (non-saturated ones), but
as I have told you previously, we haven't been putting numbers in commit
messages since it wasn't allowed. I may be able to dig out some more details
if I went trawling through GEM channel IRC logs, although probably not the
actual numbers since those were usually on pastebin. Or you go an talk with
Chris since he probably remembers more details. Or you just decide you don't
care and remove it. I wouldn't do that without putting the complete story in
writing, but it's your call after all.


Media has also changed, they're not using relocations anymore.


Meaning you think it changes the benchmarking story? When coupled with
removal of GPU relocations then possibly yes.


Unless there's solid data performance tuning of any kind that gets in the
way simply needs to be removed. Yes this is radical, but the codebase is
in a state to require this.

So either way we'd need to rebenchmark this if it's really required. Also


Therefore can you share what benchmarks have been done or is it secret?  As
said, I think the non-saturated case was the more interesting one here.


if we really need this code still someone needs to fix the design, the
current code is making layering violations an art form.


Anyway, without the debugfs churn it is more or less two line patch to fix
igfx + dgfx hybrid setup. So while mulling it over this could go in. I'd
just refine it to use a GGTT check instead of GT. And unless DG1 ends up
being GuC only.


The minimal robust fix here is imo to stop us from upcasting dma_fence to
i915_request if it's not for our device. Not sprinkle code here into the
semaphore code. We shouldn't even get this far with foreign fences.


Device check does not work for multi-tile. It was one of my earlier attempts
before I realized the problem. You'll see v3 which I think handles all the
cases.


There is no hw semaphores on multi-tile.


You mean because of GuC? Okay, there may not be after bringup has been done.
In which case an assert is needed somewhere just in case, if you are adamant
not to accept this fix. It may indeed not matter hugely outside of the
current transition period since I spotted patches to enable GuC on DG1. But
then again it is trivial and fixes current pains for more than just me.


But there _is_ a lot more going on than just hw semaphores that spawn
driver instances. Like priority boosting, clock boosting, and all kinds of
other things. I really dont' think it's very robust if we play
whack-a-mole here with things leaking.


You mean span not spawn? I audited those and they looks good to me. AFAIR
scheduling was in fact designed with a global lock just so that works. Plus
the cases you mention end up not holding pointers to "foreign" instances
anyway, they just do priority inheritance. Which is probably nice not to
lose if not unavoidable.


Yup span. I just think the defensive approach is better, especially since
we're planning to rework the sched

Re: [PATCH v1 6/6] drm/mediatek: Add mt8195 DisplayPort driver

2021-09-09 Thread Markus Schneider-Pargmann
Hi Philipp,

On Tue, Sep 07, 2021 at 10:47:41AM +0200, Philipp Zabel wrote:
> Hi Markus,
> 
> On Mon, 2021-09-06 at 21:35 +0200, Markus Schneider-Pargmann wrote:
> > This patch adds a DisplayPort driver for the Mediatek mt8195 SoC.
> > 
> > It supports both functional units on the mt8195, the embedded
> > DisplayPort as well as the external DisplayPort units. It offers
> > hot-plug-detection, audio up to 8 channels, and DisplayPort 1.4 with up
> > to 4 lanes.
> > 
> > This driver is based on an initial version by
> > Jason-JH.Lin .
> > 
> > Signed-off-by: Markus Schneider-Pargmann 
> > ---
> [...]
> > diff --git a/drivers/gpu/drm/mediatek/mtk_dp.c 
> > b/drivers/gpu/drm/mediatek/mtk_dp.c
> > new file mode 100644
> > index ..1bd07c8d2f69
> > --- /dev/null
> > +++ b/drivers/gpu/drm/mediatek/mtk_dp.c
> > @@ -0,0 +1,2881 @@
> > +// SPDX-License-Identifier: GPL-2.0
> > +/*
> > + * Copyright (c) 2019 MediaTek Inc.
> > + * Copyright (c) 2021 BayLibre
> > + */
> > +
> [...]
> > +#include 
> [...]
> > +#include 
> > +#include 
> [...]
> > +#include 
> > +#include 
> [...]
> > +#include 
> > +#include 
> [...]
> > +#include 
> 
> The list of included headers could be pruned a bit, from a quick look it
> seems like neither of these are actually used.

Thank you. I fixed the includes for the next version.

> 
> [...]
> > +static void mtk_dp_ssc_enable(struct mtk_dp *mtk_dp, bool enable)
> > +{
> > +   mtk_dp_update_bits(mtk_dp, MTK_DP_TOP_PWR_STATE, DP_PWR_STATE_BANDGAP,
> > +  DP_PWR_STATE_MASK);
> > +   mtk_dp_update_bits(mtk_dp, DP_PHY_DIG_PLL_CTL_1,
> > +  enable ? TPLL_SSC_EN : 0, TPLL_SSC_EN);
> > +   mtk_dp_update_bits(mtk_dp, MTK_DP_TOP_PWR_STATE,
> > +  DP_PWR_STATE_BANDGAP_TPLL_LANE, DP_PWR_STATE_MASK);
> > +
> > +   udelay(50);
> 
> Can usleep_range() be used here? Same for the other delays.

Yes, thanks, I replaced it here and everywhere else.

> 
> [...]
> > +static void mtk_dp_hpd_sink_event(struct mtk_dp *mtk_dp)
> > +{
> [...]
> > +
> > +   if (DP_GET_SINK_COUNT(sink_count) &&
> > +   (link_status[2] & DP_DOWNSTREAM_PORT_STATUS_CHANGED)) {
> > +   mtk_dp->train_info.check_cap_count = 0;
> > +   kfree(mtk_dp->edid);
> > +   mtk_dp->edid = NULL;
> 
> Should this be protect by a lock? This looks like it could race with the
> access in mtk_dp_edid_parse_audio_capabilities() or mtk_dp_get_edid()

Completely right, I guarded all edid accesses with a mutex now. Thanks.

> 
> [...]
> > +static int mtk_dp_train_handler(struct mtk_dp *mtk_dp)
> > +{
> > +   int ret = 0;
> > +
> > +   ret = mtk_dp_train_hpd_handle(mtk_dp);
> > +
> > +   if (!mtk_dp->train_info.cable_plugged_in)
> > +   return -ENODEV;
> > +
> > +   if (mtk_dp->train_state == MTK_DP_TRAIN_STATE_NORMAL)
> > +   return ret;
> > +
> > +   switch (mtk_dp->train_state) {
> [...]
> > +   case MTK_DP_TRAIN_STATE_TRAINING:
> > +   ret = mtk_dp_train_start(mtk_dp);
> > +   if (!ret) {
> > +   mtk_dp_video_mute(mtk_dp, true);
> > +   mtk_dp_audio_mute(mtk_dp, true);
> > +   mtk_dp->train_state = MTK_DP_TRAIN_STATE_CHECKTIMING;
> > +   mtk_dp_fec_enable(mtk_dp, mtk_dp->has_fec);
> > +   }  else if (ret != -EAGAIN)
> > +   mtk_dp->train_state = MTK_DP_TRAIN_STATE_DPIDLE;
> 
> A small whitespace issue and missing braces.

Thanks for spotting, fixed.

> 
> Consider running this through checkpatch.pl --strict once for style
> issues.

Thanks for the tip, I didn't know about --strict. I now added it to my
editor tooling. Interesting thing: It picked up the missing braces as
well as all the udelays, but not the extra space before else.

> 
> [...]
> > +static irqreturn_t mtk_dp_hpd_event(int hpd, void *dev)
> > +{
> > +   struct mtk_dp *mtk_dp = dev;
> > +   uint32_t irq_status;
> > +
> > +   irq_status = mtk_dp_read(mtk_dp, MTK_DP_TOP_IRQ_STATUS);
> > +
> > +   if (!irq_status)
> > +   return IRQ_HANDLED;
> 
> This check seems superfluous given that only the
> RGS_IRQ_STATUS_TRANSMITTER bit is checked right below:

Thanks, I removed it.

> 
> > +   if (irq_status & RGS_IRQ_STATUS_TRANSMITTER)
> > +   return mtk_dp_hpd_isr_handler(mtk_dp);
> > +
> > +   return IRQ_HANDLED;
> > +}
> [...]
> > +static struct edid *mtk_dp_get_edid(struct drm_bridge *bridge,
> > +   struct drm_connector *connector)
> > +{
> > +   struct mtk_dp *mtk_dp = mtk_dp_from_bridge(bridge);
> > +   bool pre_enabled = mtk_dp->pre_enabled;
> > +
> > +   if (mtk_dp->edid)
> > +   kfree(mtk_dp->edid);
> 
> Unnecessary check, kfree() accepts NULL.

Fixed.

Thank you Philipp for the review.

Best,
Markus


Re: [PULL] drm-misc-fixes

2021-09-09 Thread Daniel Vetter
On Thu, Sep 9, 2021 at 5:35 AM Dave Airlie  wrote:
>
> On Thu, 9 Sept 2021 at 03:44, Thomas Zimmermann  wrote:
> >
> > Hi Dave and Daniel,
> >
> > here's this week's PR for drm-misc-fixes. One patch is a potential deadlock
> > in TTM, the other enables an additional plane in kmb. I'm slightly unhappy
> > that the latter one ended up in -fixes as it's not a bugfix AFAICT.
>
> To avoid messy merge window, I'm not pulling this until after rc1
> unless there is some major reason?

Christian misplaced a ttm fix, so we really want this. Maybe
cherry-pick to drm-next and then drm-misc-fixes gets rebased instead.

And yeah I dunno what do with our conflicts around merge window, maybe
we're letting trees diverge a bit too much.
-Daniel

>
> the current drm-next doesn't have v5.14 in it, and the merge is rather
> ugly right now.
>
> (maybe I should always pull it in before sending to Linus to avoid
> this in future).
>
> Dave.



-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch


[PATCH v2] kernel/locking: Add context to ww_mutex_trylock.

2021-09-09 Thread Maarten Lankhorst
Op 09-09-2021 om 10:22 schreef Peter Zijlstra:
> On Thu, Sep 09, 2021 at 07:38:06AM +0200, Maarten Lankhorst wrote:
>
>>> You'll need a similar hunk in ww_rt_mutex.c
>> What tree has that file?
> Linus' tree should have it. Per commit:
>
>   f8635d509d80 ("locking/ww_mutex: Implement rtmutex based ww_mutex API 
> functions")

Ah yeah, it seems the drm integration tree missed it.

I only compile tested it against PREEMPT_RT, though it seems locking_selftests 
and fs/inode.c don't build correctly for me.

Improved patch below.

Also hopefully addressed Daniel's concerns.

---8<--
>From d7e867f26b7e2553b0e5b9b5b87a284467b85846 Mon Sep 17 00:00:00 2001
From: Maarten Lankhorst 
Date: Fri, 3 Sep 2021 10:59:49 +0200
Subject: [PATCH] kernel/locking: Add context to ww_mutex_trylock, v2.

i915 will soon gain an eviction path that trylock a whole lot of locks
for eviction, getting dmesg failures like below:

BUG: MAX_LOCK_DEPTH too low!
turning off the locking correctness validator.
depth: 48  max: 48!
48 locks held by i915_selftest/5776:
 #0: 888101a79240 (&dev->mutex){}-{3:3}, at: __driver_attach+0x88/0x160
 #1: c99778c0 (reservation_ww_class_acquire){+.+.}-{0:0}, at: 
i915_vma_pin.constprop.63+0x39/0x1b0 [i915]
 #2: 88800cf74de8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: 
i915_vma_pin.constprop.63+0x5f/0x1b0 [i915]
 #3: 88810c7f9e38 (&vm->mutex/1){+.+.}-{3:3}, at: 
i915_vma_pin_ww+0x1c4/0x9d0 [i915]
 #4: 88810bad5768 (reservation_ww_class_mutex){+.+.}-{3:3}, at: 
i915_gem_evict_something+0x110/0x860 [i915]
 #5: 88810bad60e8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: 
i915_gem_evict_something+0x110/0x860 [i915]
...
 #46: 88811964d768 (reservation_ww_class_mutex){+.+.}-{3:3}, at: 
i915_gem_evict_something+0x110/0x860 [i915]
 #47: 88811964e0e8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: 
i915_gem_evict_something+0x110/0x860 [i915]
INFO: lockdep is turned off.

Fixing eviction to nest into ww_class_acquire is a high priority,
but it requires a rework of the entire driver, which can only be
done one step at a time.

As an intermediate solution, add an acquire context to ww_mutex_trylock,
which allows us to do proper nesting annotations on the trylocks, making
the above lockdep splat disappear.

This is also useful in regulator_lock_nested, which may avoid dropping
regulator_nesting_mutex in the uncontended path, so use it there.

TTM may be another user for this, where we could lock a buffer in a
fastpath with list locks held, without dropping all locks we hold.

Changes since v1:
- Rebase on top of the ww_rt_mutex rework.
- Add extern to ww_mutex_trylock header definition.
- Expand commit message slightly.

Signed-off-by: Maarten Lankhorst 
Cc: Peter Zijlstra 
Cc: Ingo Molnar 
Cc: Will Deacon 
Cc: Waiman Long 
Cc: Boqun Feng 
Cc: Liam Girdwood 
Cc: Mark Brown 
Cc: linux-ker...@vger.kernel.org
---
 drivers/gpu/drm/drm_modeset_lock.c |  2 +-
 drivers/regulator/core.c   |  2 +-
 include/linux/dma-resv.h   |  2 +-
 include/linux/ww_mutex.h   | 15 +-
 kernel/locking/mutex.c | 38 +
 kernel/locking/test-ww_mutex.c | 86 ++
 kernel/locking/ww_rt_mutex.c   | 12 +
 lib/locking-selftest.c |  2 +-
 8 files changed, 121 insertions(+), 38 deletions(-)

diff --git a/drivers/gpu/drm/drm_modeset_lock.c 
b/drivers/gpu/drm/drm_modeset_lock.c
index fcfe1a03c4a1..bf8a6e823a15 100644
--- a/drivers/gpu/drm/drm_modeset_lock.c
+++ b/drivers/gpu/drm/drm_modeset_lock.c
@@ -248,7 +248,7 @@ static inline int modeset_lock(struct drm_modeset_lock 
*lock,
if (ctx->trylock_only) {
lockdep_assert_held(&ctx->ww_ctx);
 
-   if (!ww_mutex_trylock(&lock->mutex))
+   if (!ww_mutex_trylock(&lock->mutex, NULL))
return -EBUSY;
else
return 0;
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index ca6caba8a191..f4d441b1a8bf 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -145,7 +145,7 @@ static inline int regulator_lock_nested(struct 
regulator_dev *rdev,
 
mutex_lock(®ulator_nesting_mutex);
 
-   if (ww_ctx || !ww_mutex_trylock(&rdev->mutex)) {
+   if (!ww_mutex_trylock(&rdev->mutex, ww_ctx)) {
if (rdev->mutex_owner == current)
rdev->ref_cnt++;
else
diff --git a/include/linux/dma-resv.h b/include/linux/dma-resv.h
index 9100dd3dc21f..5de7956818a5 100644
--- a/include/linux/dma-resv.h
+++ b/include/linux/dma-resv.h
@@ -262,7 +262,7 @@ static inline int dma_resv_lock_slow_interruptible(struct 
dma_resv *obj,
  */
 static inline bool __must_check dma_resv_trylock(struct dma_resv *obj)
 {
-   return ww_mutex_trylock(&obj->lock);
+   return ww_mutex_trylock(&obj->lock, NULL);
 }
 
 /**
diff --git a/include/linux/ww_mutex.h b/include/linux/ww_mutex.h
index 29db736af86d..bb763085479a 

Re: [PATCH v2] drm/plane-helper: fix uninitialized variable reference

2021-09-09 Thread Simon Ser
Reviewed-by: Simon Ser 




Re: [PATCH v1 01/12] virtio-gpu api: multiple context types with explicit initialization

2021-09-09 Thread kernel test robot
Hi Gurchetan,

Thank you for the patch! Yet something to improve:

[auto build test ERROR on drm-intel/for-linux-next]
[also build test ERROR on drm-tip/drm-tip drm-exynos/exynos-drm-next 
tegra-drm/drm/tegra/for-next linus/master v5.14 next-20210909]
[cannot apply to drm/drm-next]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url:
https://github.com/0day-ci/linux/commits/Gurchetan-Singh/Context-types/20210909-093950
base:   git://anongit.freedesktop.org/drm-intel for-linux-next
config: i386-randconfig-a013-20210908 (attached as .config)
compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project 
9c476172b93367d2cb88d7d3f4b1b5b456fa6020)
reproduce (this is a W=1 build):
wget 
https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O 
~/bin/make.cross
chmod +x ~/bin/make.cross
# 
https://github.com/0day-ci/linux/commit/bbe6e77e1cfa4b70c78ed31a1dde784cc52c68af
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review 
Gurchetan-Singh/Context-types/20210909-093950
git checkout bbe6e77e1cfa4b70c78ed31a1dde784cc52c68af
# save the attached .config to linux build tree
mkdir build_dir
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross O=build_dir 
ARCH=i386 SHELL=/bin/bash

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot 

All errors (new ones prefixed by >>):

   In file included from :1:
>> ./usr/include/linux/virtio_gpu.h:142:2: error: unknown type name 'u8'
   u8 ring_idx;
   ^
   ./usr/include/linux/virtio_gpu.h:143:2: error: unknown type name 'u8'
   u8 padding[3];
   ^
>> ./usr/include/linux/virtio_gpu.h:339:7: error: flexible array member 
>> 'capset_data' not allowed in otherwise empty struct
   __u8 capset_data[];
^
   3 errors generated.

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-...@lists.01.org


.config.gz
Description: application/gzip


Re: [Intel-gfx] [PATCH v7 15/17] drm/i915/pxp: add pxp debugfs

2021-09-09 Thread Daniele Ceraolo Spurio




On 9/9/2021 1:17 AM, Teres Alexis, Alan Previn wrote:

I dont see any issues except a couple of nits.

Reviewed-by : Alan Previn 

...alan

On Fri, 2021-08-27 at 18:27 -0700, Daniele Ceraolo Spurio wrote:

2 debugfs files, one to query the current status of the pxp session and one
to trigger an invalidation for testing.

Signed-off-by: Daniele Ceraolo Spurio 
---
  drivers/gpu/drm/i915/Makefile|  1 +
  drivers/gpu/drm/i915/gt/debugfs_gt.c |  2 +
  drivers/gpu/drm/i915/pxp/intel_pxp_debugfs.c | 78 
  drivers/gpu/drm/i915/pxp/intel_pxp_debugfs.h | 21 ++
  4 files changed, 102 insertions(+)
  create mode 100644 drivers/gpu/drm/i915/pxp/intel_pxp_debugfs.c
  create mode 100644 drivers/gpu/drm/i915/pxp/intel_pxp_debugfs.h

diff --git a/drivers/gpu/drm/i915/Makefile b/drivers/gpu/drm/i915/Makefile
index 6f6cbbe98b96..9a44d6f01e3b 100644
--- a/drivers/gpu/drm/i915/Makefile
+++ b/drivers/gpu/drm/i915/Makefile
@@ -284,6 +284,7 @@ i915-y += i915_perf.o
  i915-$(CONFIG_DRM_I915_PXP) += \
pxp/intel_pxp.o \
pxp/intel_pxp_cmd.o \
+   pxp/intel_pxp_debugfs.o \
pxp/intel_pxp_irq.o \
pxp/intel_pxp_pm.o \
pxp/intel_pxp_session.o \
diff --git a/drivers/gpu/drm/i915/gt/debugfs_gt.c 
b/drivers/gpu/drm/i915/gt/debugfs_gt.c
index 591eb60785db..c27847ddb796 100644
--- a/drivers/gpu/drm/i915/gt/debugfs_gt.c
+++ b/drivers/gpu/drm/i915/gt/debugfs_gt.c
@@ -9,6 +9,7 @@
  #include "debugfs_gt.h"
  #include "debugfs_gt_pm.h"
  #include "intel_sseu_debugfs.h"
+#include "pxp/intel_pxp_debugfs.h"
  #include "uc/intel_uc_debugfs.h"
  #include "i915_drv.h"
  
@@ -28,6 +29,7 @@ void debugfs_gt_register(struct intel_gt *gt)

intel_sseu_debugfs_register(gt, root);
  
  	intel_uc_debugfs_register(>->uc, root);

+   intel_pxp_debugfs_register(>->pxp, root);
  }
  
  void intel_gt_debugfs_register_files(struct dentry *root,

diff --git a/drivers/gpu/drm/i915/pxp/intel_pxp_debugfs.c 
b/drivers/gpu/drm/i915/pxp/intel_pxp_debugfs.c
new file mode 100644
index ..a26e4396ba6c
--- /dev/null
+++ b/drivers/gpu/drm/i915/pxp/intel_pxp_debugfs.c
@@ -0,0 +1,78 @@
+// SPDX-License-Identifier: MIT
+/*
+ * Copyright © 2021 Intel Corporation
+ */
+
+#include 
+#include 
+
+#include "gt/debugfs_gt.h"
+#include "pxp/intel_pxp.h"
+#include "pxp/intel_pxp_irq.h"
+#include "i915_drv.h"
+
+static int pxp_info_show(struct seq_file *m, void *data)
+{
+   struct intel_pxp *pxp = m->private;
+   struct drm_printer p = drm_seq_file_printer(m);
+   bool enabled = intel_pxp_is_enabled(pxp);
+
+   if (!enabled) {
+   drm_printf(&p, "pxp disabled\n");
+   return 0;
+   }
+
+   drm_printf(&p, "active: %s\n", yesno(intel_pxp_is_active(pxp)));
+   drm_printf(&p, "instance counter: %u\n", pxp->key_instance);
+
+   return 0;
+}
+DEFINE_GT_DEBUGFS_ATTRIBUTE(pxp_info);
+
+static int pxp_inval_get(void *data, u64 *val)
+{
+   /* nothing to read */
+   return -EPERM;
+}
+
+static int pxp_inval_set(void *data, u64 val)
+{
+   struct intel_pxp *pxp = data;
+   struct intel_gt *gt = pxp_to_gt(pxp);
+
+   if (!intel_pxp_is_active(pxp))
+   return -ENODEV;
+
+   /* simulate an invalidation interrupt */
+   spin_lock_irq(>->irq_lock);
+   intel_pxp_irq_handler(pxp, 
GEN12_DISPLAY_PXP_STATE_TERMINATED_INTERRUPT);
+   spin_unlock_irq(>->irq_lock);
+
+   if (!wait_for_completion_timeout(&pxp->termination,
+msecs_to_jiffies(100)))
+   return -ETIMEDOUT;
+
+   return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(pxp_inval_fops, pxp_inval_get, pxp_inval_set, 
"%llx\n");
+void intel_pxp_debugfs_register(struct intel_pxp *pxp, struct dentry *gt_root)
+{
+   static const struct debugfs_gt_file files[] = {
+   { "info", &pxp_info_fops, NULL },
+   { "invalidate", &pxp_inval_fops, NULL },

NIT only: consider naming to "invalidate_display" or "display_inval" since we 
are using this to trigger
display pxp teardown specific irq code path.


I went with "terminate_state", because the termination interrupt can 
come from the display but can also come from the ME and we handle both 
in the same way. What we want to test is the termination path that we 
enter when a termination interrupt is received, we don't really care who 
the source of the interrupt is.


Daniele


+   };
+   struct dentry *root;
+
+   if (!gt_root)
+   return;
+
+   if (!HAS_PXP((pxp_to_gt(pxp)->i915)))
+   return;
+
+   root = debugfs_create_dir("pxp", gt_root);
+   if (IS_ERR(root))
+   return;
+
+   intel_gt_debugfs_register_files(root, files, ARRAY_SIZE(files), pxp);
+}
diff --git a/drivers/gpu/drm/i915/pxp/intel_pxp_debugfs.h 
b/drivers/gpu/drm/i915/pxp/intel_pxp_debugfs.h
new file mode 100644
index ..3b7454d838e9
--- /dev/null
+++ b/drivers/gpu/drm/i915/pxp/intel_p

[PATCH AUTOSEL 5.14 001/252] drm/bridge: ti-sn65dsi86: Don't read EDID blob over DDC

2021-09-09 Thread Sasha Levin
From: Douglas Anderson 

[ Upstream commit a70e558c151043ce46a5e5999f4310e0b3551f57 ]

This is really just a revert of commit 58074b08c04a ("drm/bridge:
ti-sn65dsi86: Read EDID blob over DDC"), resolving conflicts.

The old code failed to read the EDID properly in a very important
case: before the bridge's pre_enable() was called. The way things need
to work:
1. Read the EDID.
2. Based on the EDID, decide on video settings and pixel clock.
3. Enable the bridge w/ the desired settings.

The way things were working:
1. Try to read the EDID but fail; fall back to hardcoded values.
2. Based on hardcoded values, decide on video settings and pixel clock.
3. Enable the bridge w/ the desired settings.
4. Try again to read the EDID, it works now!
5. Realize that the hardcoded settings weren't quite right.
6. Disable / reenable the bridge w/ the right settings.

The reasons for the failures were twofold:
a) Since we never ran the bridge chip's pre-enable then we never set
   the bit to ignore HPD. This meant the bridge chip didn't even _try_
   to go out on the bus and communicate with the panel.
b) Even if we fixed things to ignore HPD, the EDID still wouldn't read
   if the panel wasn't on.

Instead of reverting the code, we could fix it to set the HPD bit and
also power on the panel. However, it also works nicely to just let the
panel code read the EDID. Now that we've split the driver up we can
expose the DDC AUX channel bus to the panel node. The panel can take
charge of reading the EDID.

NOTE: in order for things to work, anyone that needs to read the EDID
will need to instantiate their panel using the new DP AUX bus (AKA by
listing their panel under the "aux-bus" node of the bridge chip in the
device tree).

In the future if we want to use the bridge chip to provide a full
external DP port (which won't have a panel) then we will have to
conditinally add EDID reading back in.

Suggested-by: Andrzej Hajda 
Signed-off-by: Douglas Anderson 
Reviewed-by: Bjorn Andersson 
Link: 
https://patchwork.freedesktop.org/patch/msgid/20210611101711.v10.9.I9330684c25f65bb318eff57f0616500f83eac3cc@changeid
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/bridge/ti-sn65dsi86.c | 22 --
 1 file changed, 22 deletions(-)

diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c 
b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
index 45a2969afb2b..aef850296756 100644
--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c
+++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
@@ -124,7 +124,6 @@
  * @connector:Our connector.
  * @host_node:Remote DSI node.
  * @dsi:  Our MIPI DSI source.
- * @edid: Detected EDID of eDP panel.
  * @refclk:   Our reference clock.
  * @panel:Our panel.
  * @enable_gpio:  The GPIO we toggle to enable the bridge.
@@ -154,7 +153,6 @@ struct ti_sn65dsi86 {
struct drm_dp_aux   aux;
struct drm_bridge   bridge;
struct drm_connectorconnector;
-   struct edid *edid;
struct device_node  *host_node;
struct mipi_dsi_device  *dsi;
struct clk  *refclk;
@@ -403,24 +401,6 @@ connector_to_ti_sn65dsi86(struct drm_connector *connector)
 static int ti_sn_bridge_connector_get_modes(struct drm_connector *connector)
 {
struct ti_sn65dsi86 *pdata = connector_to_ti_sn65dsi86(connector);
-   struct edid *edid = pdata->edid;
-   int num, ret;
-
-   if (!edid) {
-   pm_runtime_get_sync(pdata->dev);
-   edid = pdata->edid = drm_get_edid(connector, &pdata->aux.ddc);
-   pm_runtime_put_autosuspend(pdata->dev);
-   }
-
-   if (edid && drm_edid_is_valid(edid)) {
-   ret = drm_connector_update_edid_property(connector, edid);
-   if (!ret) {
-   num = drm_add_edid_modes(connector, edid);
-   if (num)
-   return num;
-   }
-   }
-
return drm_panel_get_modes(pdata->panel, connector);
 }
 
@@ -1358,8 +1338,6 @@ static void ti_sn_bridge_remove(struct auxiliary_device 
*adev)
mipi_dsi_device_unregister(pdata->dsi);
}
 
-   kfree(pdata->edid);
-
drm_bridge_remove(&pdata->bridge);
 
of_node_put(pdata->host_node);
-- 
2.30.2



[PATCH AUTOSEL 5.14 002/252] drm/vmwgfx: Fix subresource updates with new contexts

2021-09-09 Thread Sasha Levin
From: Zack Rusin 

[ Upstream commit a12be0277316ed923411c9c80b2899ee74d2b033 ]

The has_dx variable was only set during the initialization which
meant that UPDATE_SUBRESOURCE was never used. We were emulating it
with UPDATE_GB_IMAGE but that's always been a stop-gap. Instead
of has_dx which has been deprecated a long time ago we need to check
for whether shader model 4.0 or newer is available to the device.

Signed-off-by: Zack Rusin 
Reviewed-by: Roland Scheidegger 
Reviewed-by: Martin Krastev 
Link: 
https://patchwork.freedesktop.org/patch/msgid/20210609172307.131929-4-za...@vmware.com
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c 
b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index 0835468bb2ee..47c03a276515 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -1872,7 +1872,6 @@ static void vmw_surface_dirty_range_add(struct 
vmw_resource *res, size_t start,
 static int vmw_surface_dirty_sync(struct vmw_resource *res)
 {
struct vmw_private *dev_priv = res->dev_priv;
-   bool has_dx = 0;
u32 i, num_dirty;
struct vmw_surface_dirty *dirty =
(struct vmw_surface_dirty *) res->dirty;
@@ -1899,7 +1898,7 @@ static int vmw_surface_dirty_sync(struct vmw_resource 
*res)
if (!num_dirty)
goto out;
 
-   alloc_size = num_dirty * ((has_dx) ? sizeof(*cmd1) : sizeof(*cmd2));
+   alloc_size = num_dirty * ((has_sm4_context(dev_priv)) ? sizeof(*cmd1) : 
sizeof(*cmd2));
cmd = VMW_CMD_RESERVE(dev_priv, alloc_size);
if (!cmd)
return -ENOMEM;
@@ -1917,7 +1916,7 @@ static int vmw_surface_dirty_sync(struct vmw_resource 
*res)
 * DX_UPDATE_SUBRESOURCE is aware of array surfaces.
 * UPDATE_GB_IMAGE is not.
 */
-   if (has_dx) {
+   if (has_sm4_context(dev_priv)) {
cmd1->header.id = SVGA_3D_CMD_DX_UPDATE_SUBRESOURCE;
cmd1->header.size = sizeof(cmd1->body);
cmd1->body.sid = res->id;
-- 
2.30.2



[PATCH AUTOSEL 5.14 004/252] drm/vc4: hdmi: Set HD_CTL_WHOLSMP and HD_CTL_CHALIGN_SET

2021-09-09 Thread Sasha Levin
From: Dom Cobley 

[ Upstream commit 1698ecb218eb82587dbfc71a2e26ded66e5ecf59 ]

Symptom is random switching of speakers when using multichannel.

Repeatedly running speakertest -c8 occasionally starts with
channels jumbled. This is fixed with HD_CTL_WHOLSMP.

The other bit looks beneficial and apears harmless in testing so
I'd suggest adding it too.

Documentation says: HD_CTL_WHILSMP_SET
Wait for whole sample. When this bit is set MAI transmit will start
only when there is at least one whole sample available in the fifo.

Documentation says: HD_CTL_CHALIGN_SET
Channel Align When Overflow. This bit is used to realign the audio
channels in case of an overflow.
If this bit is set, after the detection of an overflow, equal
amount of dummy words to the missing words will be written to fifo,
filling up the broken sample and maintaining alignment.

Signed-off-by: Dom Cobley 
Signed-off-by: Maxime Ripard 
Reviewed-by: Nicolas Saenz Julienne 
Link: 
https://patchwork.freedesktop.org/patch/msgid/20210525132354.297468-7-max...@cerno.tech
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/vc4/vc4_hdmi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index c2876731ee2d..ad92dbb128b3 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -1372,7 +1372,9 @@ static int vc4_hdmi_audio_trigger(struct 
snd_pcm_substream *substream, int cmd,
HDMI_WRITE(HDMI_MAI_CTL,
   VC4_SET_FIELD(vc4_hdmi->audio.channels,
 VC4_HD_MAI_CTL_CHNUM) |
-  VC4_HD_MAI_CTL_ENABLE);
+VC4_HD_MAI_CTL_WHOLSMP |
+VC4_HD_MAI_CTL_CHALIGN |
+VC4_HD_MAI_CTL_ENABLE);
break;
case SNDRV_PCM_TRIGGER_STOP:
HDMI_WRITE(HDMI_MAI_CTL,
-- 
2.30.2



[PATCH AUTOSEL 5.14 003/252] drm/vmwgfx: Fix some static checker warnings

2021-09-09 Thread Sasha Levin
From: Zack Rusin 

[ Upstream commit 74231041d14030f1ae6582b9233bfe782ac23e33 ]

Fix some minor issues that Coverity spotted in the code. None
of that are serious but they're all valid concerns so fixing
them makes sense.

Signed-off-by: Zack Rusin 
Reviewed-by: Roland Scheidegger 
Reviewed-by: Martin Krastev 
Link: 
https://patchwork.freedesktop.org/patch/msgid/20210609172307.131929-5-za...@vmware.com
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/vmwgfx/ttm_memory.c|  2 ++
 drivers/gpu/drm/vmwgfx/vmwgfx_binding.c| 20 
 drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c |  2 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c |  4 +++-
 drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c|  2 ++
 drivers/gpu/drm/vmwgfx/vmwgfx_mob.c|  4 +++-
 drivers/gpu/drm/vmwgfx/vmwgfx_msg.c|  6 --
 drivers/gpu/drm/vmwgfx/vmwgfx_resource.c   |  8 ++--
 drivers/gpu/drm/vmwgfx/vmwgfx_so.c |  3 ++-
 drivers/gpu/drm/vmwgfx/vmwgfx_validation.c |  4 ++--
 10 files changed, 33 insertions(+), 22 deletions(-)

diff --git a/drivers/gpu/drm/vmwgfx/ttm_memory.c 
b/drivers/gpu/drm/vmwgfx/ttm_memory.c
index aeb0a22a2c34..edd17c30d5a5 100644
--- a/drivers/gpu/drm/vmwgfx/ttm_memory.c
+++ b/drivers/gpu/drm/vmwgfx/ttm_memory.c
@@ -435,8 +435,10 @@ int ttm_mem_global_init(struct ttm_mem_global *glob, 
struct device *dev)
 
si_meminfo(&si);
 
+   spin_lock(&glob->lock);
/* set it as 0 by default to keep original behavior of OOM */
glob->lower_mem_limit = 0;
+   spin_unlock(&glob->lock);
 
ret = ttm_mem_init_kernel_zone(glob, &si);
if (unlikely(ret != 0))
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_binding.c 
b/drivers/gpu/drm/vmwgfx/vmwgfx_binding.c
index 05b324825900..ea6d8c86985f 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_binding.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_binding.c
@@ -715,7 +715,7 @@ static int vmw_binding_scrub_cb(struct vmw_ctx_bindinfo 
*bi, bool rebind)
  * without checking which bindings actually need to be emitted
  *
  * @cbs: Pointer to the context's struct vmw_ctx_binding_state
- * @bi: Pointer to where the binding info array is stored in @cbs
+ * @biv: Pointer to where the binding info array is stored in @cbs
  * @max_num: Maximum number of entries in the @bi array.
  *
  * Scans the @bi array for bindings and builds a buffer of view id data.
@@ -725,11 +725,9 @@ static int vmw_binding_scrub_cb(struct vmw_ctx_bindinfo 
*bi, bool rebind)
  * contains the command data.
  */
 static void vmw_collect_view_ids(struct vmw_ctx_binding_state *cbs,
-const struct vmw_ctx_bindinfo *bi,
+const struct vmw_ctx_bindinfo_view *biv,
 u32 max_num)
 {
-   const struct vmw_ctx_bindinfo_view *biv =
-   container_of(bi, struct vmw_ctx_bindinfo_view, bi);
unsigned long i;
 
cbs->bind_cmd_count = 0;
@@ -838,7 +836,7 @@ static int vmw_emit_set_sr(struct vmw_ctx_binding_state 
*cbs,
  */
 static int vmw_emit_set_rt(struct vmw_ctx_binding_state *cbs)
 {
-   const struct vmw_ctx_bindinfo *loc = &cbs->render_targets[0].bi;
+   const struct vmw_ctx_bindinfo_view *loc = &cbs->render_targets[0];
struct {
SVGA3dCmdHeader header;
SVGA3dCmdDXSetRenderTargets body;
@@ -874,7 +872,7 @@ static int vmw_emit_set_rt(struct vmw_ctx_binding_state 
*cbs)
  * without checking which bindings actually need to be emitted
  *
  * @cbs: Pointer to the context's struct vmw_ctx_binding_state
- * @bi: Pointer to where the binding info array is stored in @cbs
+ * @biso: Pointer to where the binding info array is stored in @cbs
  * @max_num: Maximum number of entries in the @bi array.
  *
  * Scans the @bi array for bindings and builds a buffer of SVGA3dSoTarget data.
@@ -884,11 +882,9 @@ static int vmw_emit_set_rt(struct vmw_ctx_binding_state 
*cbs)
  * contains the command data.
  */
 static void vmw_collect_so_targets(struct vmw_ctx_binding_state *cbs,
-  const struct vmw_ctx_bindinfo *bi,
+  const struct vmw_ctx_bindinfo_so_target 
*biso,
   u32 max_num)
 {
-   const struct vmw_ctx_bindinfo_so_target *biso =
-   container_of(bi, struct vmw_ctx_bindinfo_so_target, bi);
unsigned long i;
SVGA3dSoTarget *so_buffer = (SVGA3dSoTarget *) cbs->bind_cmd_buffer;
 
@@ -919,7 +915,7 @@ static void vmw_collect_so_targets(struct 
vmw_ctx_binding_state *cbs,
  */
 static int vmw_emit_set_so_target(struct vmw_ctx_binding_state *cbs)
 {
-   const struct vmw_ctx_bindinfo *loc = &cbs->so_targets[0].bi;
+   const struct vmw_ctx_bindinfo_so_target *loc = &cbs->so_targets[0];
struct {
SVGA3dCmdHeader header;
SVGA3dCmdDXSetSOTargets body;
@@ -1066,7 +1062,7 @@ static int vmw_emit_set_vb(struct vmw_ctx_binding_state 
*cbs)
 
 static int vmw_emit_set_uav(

[PATCH AUTOSEL 5.14 005/252] drm/ttm: Fix multihop assert on eviction.

2021-09-09 Thread Sasha Levin
From: Andrey Grodzovsky 

[ Upstream commit 403797925768d9fa870f5b1ebcd20016b397083b ]

Problem:
Under memory pressure when GTT domain is almost full multihop assert
will come up when trying to evict LRU BO from VRAM to SYSTEM.

Fix:
Don't assert on multihop error in evict code but rather do a retry
as we do in ttm_bo_move_buffer

Signed-off-by: Andrey Grodzovsky 
Reviewed-by: Christian König 
Link: 
https://patchwork.freedesktop.org/patch/msgid/20210622162339.761651-6-andrey.grodzov...@amd.com
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/ttm/ttm_bo.c | 63 +++-
 1 file changed, 34 insertions(+), 29 deletions(-)

diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 8d7fd65ccced..32202385073a 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -488,6 +488,31 @@ void ttm_bo_unlock_delayed_workqueue(struct ttm_device 
*bdev, int resched)
 }
 EXPORT_SYMBOL(ttm_bo_unlock_delayed_workqueue);
 
+static int ttm_bo_bounce_temp_buffer(struct ttm_buffer_object *bo,
+struct ttm_resource **mem,
+struct ttm_operation_ctx *ctx,
+struct ttm_place *hop)
+{
+   struct ttm_placement hop_placement;
+   struct ttm_resource *hop_mem;
+   int ret;
+
+   hop_placement.num_placement = hop_placement.num_busy_placement = 1;
+   hop_placement.placement = hop_placement.busy_placement = hop;
+
+   /* find space in the bounce domain */
+   ret = ttm_bo_mem_space(bo, &hop_placement, &hop_mem, ctx);
+   if (ret)
+   return ret;
+   /* move to the bounce domain */
+   ret = ttm_bo_handle_move_mem(bo, hop_mem, false, ctx, NULL);
+   if (ret) {
+   ttm_resource_free(bo, &hop_mem);
+   return ret;
+   }
+   return 0;
+}
+
 static int ttm_bo_evict(struct ttm_buffer_object *bo,
struct ttm_operation_ctx *ctx)
 {
@@ -527,12 +552,17 @@ static int ttm_bo_evict(struct ttm_buffer_object *bo,
goto out;
}
 
+bounce:
ret = ttm_bo_handle_move_mem(bo, evict_mem, true, ctx, &hop);
-   if (unlikely(ret)) {
-   WARN(ret == -EMULTIHOP, "Unexpected multihop in eviction - 
likely driver bug\n");
-   if (ret != -ERESTARTSYS)
+   if (ret == -EMULTIHOP) {
+   ret = ttm_bo_bounce_temp_buffer(bo, &evict_mem, ctx, &hop);
+   if (ret) {
pr_err("Buffer eviction failed\n");
-   ttm_resource_free(bo, &evict_mem);
+   ttm_resource_free(bo, &evict_mem);
+   goto out;
+   }
+   /* try and move to final place now. */
+   goto bounce;
}
 out:
return ret;
@@ -847,31 +877,6 @@ int ttm_bo_mem_space(struct ttm_buffer_object *bo,
 }
 EXPORT_SYMBOL(ttm_bo_mem_space);
 
-static int ttm_bo_bounce_temp_buffer(struct ttm_buffer_object *bo,
-struct ttm_resource **mem,
-struct ttm_operation_ctx *ctx,
-struct ttm_place *hop)
-{
-   struct ttm_placement hop_placement;
-   struct ttm_resource *hop_mem;
-   int ret;
-
-   hop_placement.num_placement = hop_placement.num_busy_placement = 1;
-   hop_placement.placement = hop_placement.busy_placement = hop;
-
-   /* find space in the bounce domain */
-   ret = ttm_bo_mem_space(bo, &hop_placement, &hop_mem, ctx);
-   if (ret)
-   return ret;
-   /* move to the bounce domain */
-   ret = ttm_bo_handle_move_mem(bo, hop_mem, false, ctx, NULL);
-   if (ret) {
-   ttm_resource_free(bo, &hop_mem);
-   return ret;
-   }
-   return 0;
-}
-
 static int ttm_bo_move_buffer(struct ttm_buffer_object *bo,
  struct ttm_placement *placement,
  struct ttm_operation_ctx *ctx)
-- 
2.30.2



[PATCH AUTOSEL 5.14 006/252] drm/omap: Follow implicit fencing in prepare_fb

2021-09-09 Thread Sasha Levin
From: Daniel Vetter 

[ Upstream commit 942d8344d5f14b9ea2ae43756f319b9f44216ba4 ]

I guess no one ever tried running omap together with lima or panfrost,
not even sure that's possible. Anyway for consistency, fix this.

Reviewed-by: Tomi Valkeinen 
Signed-off-by: Daniel Vetter 
Cc: Tomi Valkeinen 
Link: 
https://patchwork.freedesktop.org/patch/msgid/20210622165511.3169559-12-daniel.vet...@ffwll.ch
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/omapdrm/omap_plane.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/omapdrm/omap_plane.c 
b/drivers/gpu/drm/omapdrm/omap_plane.c
index 801da917507d..512af976b7e9 100644
--- a/drivers/gpu/drm/omapdrm/omap_plane.c
+++ b/drivers/gpu/drm/omapdrm/omap_plane.c
@@ -6,6 +6,7 @@
 
 #include 
 #include 
+#include 
 #include 
 
 #include "omap_dmm_tiler.h"
@@ -29,6 +30,8 @@ static int omap_plane_prepare_fb(struct drm_plane *plane,
if (!new_state->fb)
return 0;
 
+   drm_gem_plane_helper_prepare_fb(plane, new_state);
+
return omap_framebuffer_pin(new_state->fb);
 }
 
-- 
2.30.2



[PATCH AUTOSEL 5.14 009/252] drm: vc4: Fix pixel-wrap issue with DVP teardown

2021-09-09 Thread Sasha Levin
From: Tim Gover 

[ Upstream commit 0b066a6809d0f8fd9868e383add36aa5a2fa409d ]

Adjust the DVP enable/disable sequence to avoid a pixel getting stuck
in an internal, non resettable FIFO within PixelValve when changing
HDMI resolution.

The blank pixels features of the DVP can prevent signals back to
pixelvalve causing it to not clear the FIFO. Adjust the ordering
and timing of operations to ensure the clear signal makes it through to
pixelvalve.

Signed-off-by: Tim Gover 
Signed-off-by: Maxime Ripard 
Link: 
https://patchwork.freedesktop.org/patch/msgid/20210628130533.144617-1-max...@cerno.tech
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/vc4/vc4_hdmi.c | 15 ---
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index ad92dbb128b3..f91d37beb113 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -613,12 +613,12 @@ static void vc4_hdmi_encoder_post_crtc_disable(struct 
drm_encoder *encoder,
 
HDMI_WRITE(HDMI_RAM_PACKET_CONFIG, 0);
 
-   HDMI_WRITE(HDMI_VID_CTL, HDMI_READ(HDMI_VID_CTL) |
-  VC4_HD_VID_CTL_CLRRGB | VC4_HD_VID_CTL_CLRSYNC);
+   HDMI_WRITE(HDMI_VID_CTL, HDMI_READ(HDMI_VID_CTL) | 
VC4_HD_VID_CTL_CLRRGB);
 
-   HDMI_WRITE(HDMI_VID_CTL,
-  HDMI_READ(HDMI_VID_CTL) | VC4_HD_VID_CTL_BLANKPIX);
+   mdelay(1);
 
+   HDMI_WRITE(HDMI_VID_CTL,
+  HDMI_READ(HDMI_VID_CTL) & ~VC4_HD_VID_CTL_ENABLE);
vc4_hdmi_disable_scrambling(encoder);
 }
 
@@ -628,12 +628,12 @@ static void vc4_hdmi_encoder_post_crtc_powerdown(struct 
drm_encoder *encoder,
struct vc4_hdmi *vc4_hdmi = encoder_to_vc4_hdmi(encoder);
int ret;
 
+   HDMI_WRITE(HDMI_VID_CTL,
+  HDMI_READ(HDMI_VID_CTL) | VC4_HD_VID_CTL_BLANKPIX);
+
if (vc4_hdmi->variant->phy_disable)
vc4_hdmi->variant->phy_disable(vc4_hdmi);
 
-   HDMI_WRITE(HDMI_VID_CTL,
-  HDMI_READ(HDMI_VID_CTL) & ~VC4_HD_VID_CTL_ENABLE);
-
clk_disable_unprepare(vc4_hdmi->pixel_bvb_clock);
clk_disable_unprepare(vc4_hdmi->pixel_clock);
 
@@ -1015,6 +1015,7 @@ static void vc4_hdmi_encoder_post_crtc_enable(struct 
drm_encoder *encoder,
 
HDMI_WRITE(HDMI_VID_CTL,
   VC4_HD_VID_CTL_ENABLE |
+  VC4_HD_VID_CTL_CLRRGB |
   VC4_HD_VID_CTL_UNDERFLOW_ENABLE |
   VC4_HD_VID_CTL_FRAME_COUNTER_RESET |
   (vsync_pos ? 0 : VC4_HD_VID_CTL_VSYNC_LOW) |
-- 
2.30.2



[PATCH AUTOSEL 5.14 008/252] drm/amdgpu: Fix koops when accessing RAS EEPROM

2021-09-09 Thread Sasha Levin
From: Luben Tuikov 

[ Upstream commit 1d9d2ca85b32605ac9c74c8fa42d0c1cfbe019d4 ]

Debugfs RAS EEPROM files are available when
the ASIC supports RAS, and when the debugfs is
enabled, an also when "ras_enable" module
parameter is set to 0. However in this case,
we get a kernel oops when accessing some of
the "ras_..." controls in debugfs. The reason
for this is that struct amdgpu_ras::adev is
unset. This commit sets it, thus enabling access
to those facilities. Note that this facilitates
EEPROM access and not necessarily RAS features or
functionality.

Cc: Alexander Deucher 
Cc: John Clements 
Cc: Hawking Zhang 
Signed-off-by: Luben Tuikov 
Acked-by: Alexander Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 16 
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
index fc66aca28594..95d5842385b3 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
@@ -1966,11 +1966,20 @@ int amdgpu_ras_recovery_init(struct amdgpu_device *adev)
bool exc_err_limit = false;
int ret;
 
-   if (adev->ras_enabled && con)
-   data = &con->eh_data;
-   else
+   if (!con)
+   return 0;
+
+   /* Allow access to RAS EEPROM via debugfs, when the ASIC
+* supports RAS and debugfs is enabled, but when
+* adev->ras_enabled is unset, i.e. when "ras_enable"
+* module parameter is set to 0.
+*/
+   con->adev = adev;
+
+   if (!adev->ras_enabled)
return 0;
 
+   data = &con->eh_data;
*data = kmalloc(sizeof(**data), GFP_KERNEL | __GFP_ZERO);
if (!*data) {
ret = -ENOMEM;
@@ -1980,7 +1989,6 @@ int amdgpu_ras_recovery_init(struct amdgpu_device *adev)
mutex_init(&con->recovery_lock);
INIT_WORK(&con->recovery_work, amdgpu_ras_do_recovery);
atomic_set(&con->in_recovery, 0);
-   con->adev = adev;
 
max_eeprom_records_len = amdgpu_ras_eeprom_get_record_max_length();
amdgpu_ras_validate_threshold(adev, max_eeprom_records_len);
-- 
2.30.2



[PATCH AUTOSEL 5.14 007/252] drm/amdgpu: Fix amdgpu_ras_eeprom_init()

2021-09-09 Thread Sasha Levin
From: Luben Tuikov 

[ Upstream commit dce4400e6516d18313d23de45b5be8a18980b00e ]

No need to account for the 2 bytes of EEPROM
address--this is now well abstracted away by
the fixes the the lower layers.

Cc: Andrey Grodzovsky 
Cc: Alexander Deucher 
Signed-off-by: Luben Tuikov 
Acked-by: Alexander Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
index 38222de921d1..8dd151c9e459 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
@@ -325,7 +325,7 @@ int amdgpu_ras_eeprom_init(struct amdgpu_ras_eeprom_control 
*control,
return ret;
}
 
-   __decode_table_header_from_buff(hdr, &buff[2]);
+   __decode_table_header_from_buff(hdr, buff);
 
if (hdr->header == EEPROM_TABLE_HDR_VAL) {
control->num_recs = (hdr->tbl_size - EEPROM_TABLE_HEADER_SIZE) /
-- 
2.30.2



[PATCH AUTOSEL 5.14 011/252] drm/panel: Fix up DT bindings for Samsung lms397kf04

2021-09-09 Thread Sasha Levin
From: Linus Walleij 

[ Upstream commit 710fa9aa16321f2ffdd8383f6f780c9cc1e5a197 ]

Improve the bindings and make them more usable:

- Pick in spi-cpha and spi-cpol from the SPI node parent,
  this will specify that we are "type 3" in the device tree
  rather than hardcoding it in the operating system.
- Drop the u32 ref from the SPI frequency: comes in from
  the SPI host bindings.
- Make spi-cpha, spi-cpol and port compulsory.
- Update the example with a real-world SPI controller,
  spi-gpio.

Cc: Noralf Trønnes 
Cc: devicet...@vger.kernel.org
Signed-off-by: Linus Walleij 
Reviewed-by: Sam Ravnborg 
Reviewed-by: Douglas Anderson 
Link: 
https://patchwork.freedesktop.org/patch/msgid/20210701213618.3818821-1-linus.wall...@linaro.org
Signed-off-by: Sasha Levin 
---
 .../display/panel/samsung,lms397kf04.yaml  | 18 --
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git 
a/Documentation/devicetree/bindings/display/panel/samsung,lms397kf04.yaml 
b/Documentation/devicetree/bindings/display/panel/samsung,lms397kf04.yaml
index 4cb75a5f2e3a..cd62968426fb 100644
--- a/Documentation/devicetree/bindings/display/panel/samsung,lms397kf04.yaml
+++ b/Documentation/devicetree/bindings/display/panel/samsung,lms397kf04.yaml
@@ -33,8 +33,11 @@ properties:
 
   backlight: true
 
+  spi-cpha: true
+
+  spi-cpol: true
+
   spi-max-frequency:
-$ref: /schemas/types.yaml#/definitions/uint32
 description: inherited as a SPI client node, the datasheet specifies
   maximum 300 ns minimum cycle which gives around 3 MHz max frequency
 maximum: 300
@@ -44,6 +47,9 @@ properties:
 required:
   - compatible
   - reg
+  - spi-cpha
+  - spi-cpol
+  - port
 
 additionalProperties: false
 
@@ -52,15 +58,23 @@ examples:
 #include 
 
 spi {
+  compatible = "spi-gpio";
+  sck-gpios = <&gpio 0 GPIO_ACTIVE_HIGH>;
+  miso-gpios = <&gpio 1 GPIO_ACTIVE_HIGH>;
+  mosi-gpios = <&gpio 2 GPIO_ACTIVE_HIGH>;
+  cs-gpios = <&gpio 3 GPIO_ACTIVE_HIGH>;
+  num-chipselects = <1>;
   #address-cells = <1>;
   #size-cells = <0>;
   panel@0 {
 compatible = "samsung,lms397kf04";
 spi-max-frequency = <300>;
+spi-cpha;
+spi-cpol;
 reg = <0>;
 vci-supply = <&lcd_3v0_reg>;
 vccio-supply = <&lcd_1v8_reg>;
-reset-gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
+reset-gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
 backlight = <&ktd259>;
 
 port {
-- 
2.30.2



[PATCH AUTOSEL 5.14 010/252] dma-buf: fix dma_resv_test_signaled test_all handling v2

2021-09-09 Thread Sasha Levin
From: Christian König 

[ Upstream commit 9d38814d1e346ea37a51cbf31f4424c9d059459e ]

As the name implies if testing all fences is requested we
should indeed test all fences and not skip the exclusive
one because we see shared ones.

v2: fix logic once more

Signed-off-by: Christian König 
Reviewed-by: Daniel Vetter 
Link: 
https://patchwork.freedesktop.org/patch/msgid/20210702111642.17259-3-christian.koe...@amd.com
Signed-off-by: Sasha Levin 
---
 drivers/dma-buf/dma-resv.c | 33 -
 1 file changed, 12 insertions(+), 21 deletions(-)

diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
index f26c71747d43..e744fd87c63c 100644
--- a/drivers/dma-buf/dma-resv.c
+++ b/drivers/dma-buf/dma-resv.c
@@ -615,25 +615,21 @@ static inline int dma_resv_test_signaled_single(struct 
dma_fence *passed_fence)
  */
 bool dma_resv_test_signaled(struct dma_resv *obj, bool test_all)
 {
-   unsigned int seq, shared_count;
+   struct dma_fence *fence;
+   unsigned int seq;
int ret;
 
rcu_read_lock();
 retry:
ret = true;
-   shared_count = 0;
seq = read_seqcount_begin(&obj->seq);
 
if (test_all) {
struct dma_resv_list *fobj = dma_resv_shared_list(obj);
-   unsigned int i;
-
-   if (fobj)
-   shared_count = fobj->shared_count;
+   unsigned int i, shared_count;
 
+   shared_count = fobj ? fobj->shared_count : 0;
for (i = 0; i < shared_count; ++i) {
-   struct dma_fence *fence;
-
fence = rcu_dereference(fobj->shared[i]);
ret = dma_resv_test_signaled_single(fence);
if (ret < 0)
@@ -641,24 +637,19 @@ bool dma_resv_test_signaled(struct dma_resv *obj, bool 
test_all)
else if (!ret)
break;
}
-
-   if (read_seqcount_retry(&obj->seq, seq))
-   goto retry;
}
 
-   if (!shared_count) {
-   struct dma_fence *fence_excl = dma_resv_excl_fence(obj);
-
-   if (fence_excl) {
-   ret = dma_resv_test_signaled_single(fence_excl);
-   if (ret < 0)
-   goto retry;
+   fence = dma_resv_excl_fence(obj);
+   if (ret && fence) {
+   ret = dma_resv_test_signaled_single(fence);
+   if (ret < 0)
+   goto retry;
 
-   if (read_seqcount_retry(&obj->seq, seq))
-   goto retry;
-   }
}
 
+   if (read_seqcount_retry(&obj->seq, seq))
+   goto retry;
+
rcu_read_unlock();
return ret;
 }
-- 
2.30.2



[PATCH AUTOSEL 5.14 018/252] drm/vkms: Let shadow-plane helpers prepare the plane's FB

2021-09-09 Thread Sasha Levin
From: Thomas Zimmermann 

[ Upstream commit b43e2ec03b0de040d536591713ea9c875ff34ba9 ]

Replace vkms' prepare_fb and cleanup_fb functions with the generic
code for shadow-buffered planes. No functional changes.

This change also fixes a problem where IGT kms_flip tests would
create a segmentation fault within vkms. The driver's prepare_fb
function did not report an error if a BO's vmap operation failed.
The kernel later tried to operate on the non-mapped memory areas.
The shared shadow-plane helpers handle errors correctly, so that
the driver now avoids the segmantation fault.

v2:
* include paragraph about IGT tests in commit message (Melissa)

Signed-off-by: Thomas Zimmermann 
Reviewed-by: Melissa Wen 
Link: 
https://patchwork.freedesktop.org/patch/msgid/20210705074633.9425-4-tzimmerm...@suse.de
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/vkms/vkms_plane.c | 38 +--
 1 file changed, 1 insertion(+), 37 deletions(-)

diff --git a/drivers/gpu/drm/vkms/vkms_plane.c 
b/drivers/gpu/drm/vkms/vkms_plane.c
index 107521ace597..092514a2155f 100644
--- a/drivers/gpu/drm/vkms/vkms_plane.c
+++ b/drivers/gpu/drm/vkms/vkms_plane.c
@@ -8,7 +8,6 @@
 #include 
 #include 
 #include 
-#include 
 
 #include "vkms_drv.h"
 
@@ -150,45 +149,10 @@ static int vkms_plane_atomic_check(struct drm_plane 
*plane,
return 0;
 }
 
-static int vkms_prepare_fb(struct drm_plane *plane,
-  struct drm_plane_state *state)
-{
-   struct drm_gem_object *gem_obj;
-   struct dma_buf_map map;
-   int ret;
-
-   if (!state->fb)
-   return 0;
-
-   gem_obj = drm_gem_fb_get_obj(state->fb, 0);
-   ret = drm_gem_shmem_vmap(gem_obj, &map);
-   if (ret)
-   DRM_ERROR("vmap failed: %d\n", ret);
-
-   return drm_gem_plane_helper_prepare_fb(plane, state);
-}
-
-static void vkms_cleanup_fb(struct drm_plane *plane,
-   struct drm_plane_state *old_state)
-{
-   struct drm_gem_object *gem_obj;
-   struct drm_gem_shmem_object *shmem_obj;
-   struct dma_buf_map map;
-
-   if (!old_state->fb)
-   return;
-
-   gem_obj = drm_gem_fb_get_obj(old_state->fb, 0);
-   shmem_obj = to_drm_gem_shmem_obj(drm_gem_fb_get_obj(old_state->fb, 0));
-   dma_buf_map_set_vaddr(&map, shmem_obj->vaddr);
-   drm_gem_shmem_vunmap(gem_obj, &map);
-}
-
 static const struct drm_plane_helper_funcs vkms_primary_helper_funcs = {
.atomic_update  = vkms_plane_atomic_update,
.atomic_check   = vkms_plane_atomic_check,
-   .prepare_fb = vkms_prepare_fb,
-   .cleanup_fb = vkms_cleanup_fb,
+   DRM_GEM_SHADOW_PLANE_HELPER_FUNCS,
 };
 
 struct vkms_plane *vkms_plane_init(struct vkms_device *vkmsdev,
-- 
2.30.2



[PATCH AUTOSEL 5.14 028/252] video: fbdev: kyro: fix a DoS bug by restricting user input

2021-09-09 Thread Sasha Levin
From: Zheyu Ma 

[ Upstream commit 98a65439172dc69cb16834e62e852afc2adb83ed ]

The user can pass in any value to the driver through the 'ioctl'
interface. The driver dost not check, which may cause DoS bugs.

The following log reveals it:

divide error:  [#1] PREEMPT SMP KASAN PTI
RIP: 0010:SetOverlayViewPort+0x133/0x5f0 
drivers/video/fbdev/kyro/STG4000OverlayDevice.c:476
Call Trace:
 kyro_dev_overlay_viewport_set drivers/video/fbdev/kyro/fbdev.c:378 [inline]
 kyrofb_ioctl+0x2eb/0x330 drivers/video/fbdev/kyro/fbdev.c:603
 do_fb_ioctl+0x1f3/0x700 drivers/video/fbdev/core/fbmem.c:1171
 fb_ioctl+0xeb/0x130 drivers/video/fbdev/core/fbmem.c:1185
 vfs_ioctl fs/ioctl.c:48 [inline]
 __do_sys_ioctl fs/ioctl.c:753 [inline]
 __se_sys_ioctl fs/ioctl.c:739 [inline]
 __x64_sys_ioctl+0x19b/0x220 fs/ioctl.c:739
 do_syscall_64+0x32/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Signed-off-by: Zheyu Ma 
Signed-off-by: Sam Ravnborg 
Link: 
https://patchwork.freedesktop.org/patch/msgid/1626235762-2590-1-git-send-email-zheyum...@gmail.com
Signed-off-by: Sasha Levin 
---
 drivers/video/fbdev/kyro/fbdev.c | 5 +
 1 file changed, 5 insertions(+)

diff --git a/drivers/video/fbdev/kyro/fbdev.c b/drivers/video/fbdev/kyro/fbdev.c
index 8fbde92ae8b9..4b8c7c16b1df 100644
--- a/drivers/video/fbdev/kyro/fbdev.c
+++ b/drivers/video/fbdev/kyro/fbdev.c
@@ -372,6 +372,11 @@ static int kyro_dev_overlay_viewport_set(u32 x, u32 y, u32 
ulWidth, u32 ulHeight
/* probably haven't called CreateOverlay yet */
return -EINVAL;
 
+   if (ulWidth == 0 || ulWidth == 0x ||
+   ulHeight == 0 || ulHeight == 0x ||
+   (x < 2 && ulWidth + 2 == 0))
+   return -EINVAL;
+
/* Stop Ramdac Output */
DisableRamdacOutput(deviceInfo.pSTGReg);
 
-- 
2.30.2



[PATCH AUTOSEL 5.14 029/252] drm/ast: Disable fast reset after DRAM initial

2021-09-09 Thread Sasha Levin
From: KuoHsiang Chou 

[ Upstream commit f34bf652d680cf65783e7c57d61c94ee87f092bd ]

[Bug][AST2500]

V1:
When AST2500 acts as stand-alone VGA so that DRAM and DVO initialization
have to be achieved by VGA driver with P2A (PCI to AHB) enabling.
However, HW suggests disable Fast reset mode after DRAM initializaton,
because fast reset mode is mainly designed for ARM ICE debugger.
Once Fast reset is checked as enabling, WDT (Watch Dog Timer) should be
first enabled to avoid system deadlock before disable fast reset mode.

V2:
Use to_pci_dev() to get revision of PCI configuration.

V3:
If SCU00 is not unlocked, just enter its password again.
It is unnecessary to clear AHB lock condition and restore WDT default
setting again, before Fast-reset clearing.

V4:
repatch after "error : could not build fake ancestor" resolved.

V5:
Since CVE_2019_6260 item3, Most of AST2500 have disabled P2A(PCIe to AMBA).
However, for backward compatibility, some patches about P2A, such as items
of v5.2 and v5.3, are considered to be upstreamed with comments.
1. Add define macro to improve source readability.
ast_drv.h, ast_main.c, ast_post.c
2. Add comment about "Fast restet" is enabled for ARM-ICE debugger
ast_post.c
3. Add comment about Reset USB port to patch USB unknown device issue
ast_post.c

Signed-off-by: KuoHsiang Chou 
Signed-off-by: Thomas Zimmermann 
Link: 
https://patchwork.freedesktop.org/patch/msgid/20210709080900.4056-1-kuohsiang_c...@aspeedtech.com
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/ast/ast_drv.h  |  6 +++
 drivers/gpu/drm/ast/ast_main.c |  5 ++
 drivers/gpu/drm/ast/ast_post.c | 91 --
 3 files changed, 76 insertions(+), 26 deletions(-)

diff --git a/drivers/gpu/drm/ast/ast_drv.h b/drivers/gpu/drm/ast/ast_drv.h
index 911f9f414774..39ca338eb80b 100644
--- a/drivers/gpu/drm/ast/ast_drv.h
+++ b/drivers/gpu/drm/ast/ast_drv.h
@@ -337,6 +337,11 @@ int ast_mode_config_init(struct ast_private *ast);
 #define AST_DP501_LINKRATE 0xf014
 #define AST_DP501_EDID_DATA0xf020
 
+/* Define for Soc scratched reg */
+#define AST_VRAM_INIT_STATUS_MASK  GENMASK(7, 6)
+//#define AST_VRAM_INIT_BY_BMC BIT(7)
+//#define AST_VRAM_INIT_READY  BIT(6)
+
 int ast_mm_init(struct ast_private *ast);
 
 /* ast post */
@@ -346,6 +351,7 @@ bool ast_is_vga_enabled(struct drm_device *dev);
 void ast_post_gpu(struct drm_device *dev);
 u32 ast_mindwm(struct ast_private *ast, u32 r);
 void ast_moutdwm(struct ast_private *ast, u32 r, u32 v);
+void ast_patch_ahb_2500(struct ast_private *ast);
 /* ast dp501 */
 void ast_set_dp501_video_output(struct drm_device *dev, u8 mode);
 bool ast_backup_fw(struct drm_device *dev, u8 *addr, u32 size);
diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
index 2aff2e6cf450..79a361867955 100644
--- a/drivers/gpu/drm/ast/ast_main.c
+++ b/drivers/gpu/drm/ast/ast_main.c
@@ -97,6 +97,11 @@ static void ast_detect_config_mode(struct drm_device *dev, 
u32 *scu_rev)
jregd0 = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xd0, 0xff);
jregd1 = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xd1, 0xff);
if (!(jregd0 & 0x80) || !(jregd1 & 0x10)) {
+   /* Patch AST2500 */
+   if (((pdev->revision & 0xF0) == 0x40)
+   && ((jregd0 & AST_VRAM_INIT_STATUS_MASK) == 0))
+   ast_patch_ahb_2500(ast);
+
/* Double check it's actually working */
data = ast_read32(ast, 0xf004);
if ((data != 0x) && (data != 0x00)) {
diff --git a/drivers/gpu/drm/ast/ast_post.c b/drivers/gpu/drm/ast/ast_post.c
index 0607658dde51..b5d92f652fd8 100644
--- a/drivers/gpu/drm/ast/ast_post.c
+++ b/drivers/gpu/drm/ast/ast_post.c
@@ -2028,6 +2028,40 @@ static bool ast_dram_init_2500(struct ast_private *ast)
return true;
 }
 
+void ast_patch_ahb_2500(struct ast_private *ast)
+{
+   u32 data;
+
+   /* Clear bus lock condition */
+   ast_moutdwm(ast, 0x1e60, 0xAEED1A03);
+   ast_moutdwm(ast, 0x1e600084, 0x0001);
+   ast_moutdwm(ast, 0x1e600088, 0x);
+   ast_moutdwm(ast, 0x1e6e2000, 0x1688A8A8);
+   data = ast_mindwm(ast, 0x1e6e2070);
+   if (data & 0x0800) {/* 
check fast reset */
+   /*
+* If "Fast restet" is enabled for ARM-ICE debugger,
+* then WDT needs to enable, that
+* WDT04 is WDT#1 Reload reg.
+* WDT08 is WDT#1 counter restart reg to avoid system deadlock
+* WDT0C is WDT#1 control reg
+*  [6:5]:= 01:Full chip
+*  [4]:= 1:1MHz clock source
+*  [1]:= 1:WDT will be cleeared and disabled after timeout 
occurs
+*  [0]:= 1:WDT enable
+*/
+   ast_moutdwm(ast, 0x1E785004, 0x0010);
+   ast_moutdwm(ast, 0x1E785008, 0x4755);
+

[PATCH AUTOSEL 5.14 034/252] drm: avoid blocking in drm_clients_info's rcu section

2021-09-09 Thread Sasha Levin
From: Desmond Cheong Zhi Xi 

[ Upstream commit 5eff9585de220cdd131237f5665db5e6c6bdf590 ]

Inside drm_clients_info, the rcu_read_lock is held to lock
pid_task()->comm. However, within this protected section, a call to
drm_is_current_master is made, which involves a mutex lock in a future
patch. However, this is illegal because the mutex lock might block
while in the RCU read-side critical section.

Since drm_is_current_master isn't protected by rcu_read_lock, we avoid
this by moving it out of the RCU critical section.

The following report came from intel-gfx ci's
igt@debugfs_test@read_all_entries testcase:

=
[ BUG: Invalid wait context ]
5.13.0-CI-Patchwork_20515+ #1 Tainted: GW
-
debugfs_test/1101 is trying to lock:
888132d901a8 (&dev->master_mutex){+.+.}-{3:3}, at:
drm_is_current_master+0x1e/0x50
other info that might help us debug this:
context-{4:4}
3 locks held by debugfs_test/1101:
 #0: 88810fdffc90 (&p->lock){+.+.}-{3:3}, at:
 seq_read_iter+0x53/0x3b0
 #1: 888132d90240 (&dev->filelist_mutex){+.+.}-{3:3}, at:
 drm_clients_info+0x63/0x2a0
 #2: 82734220 (rcu_read_lock){}-{1:2}, at:
 drm_clients_info+0x1b1/0x2a0
stack backtrace:
CPU: 8 PID: 1101 Comm: debugfs_test Tainted: GW
5.13.0-CI-Patchwork_20515+ #1
Hardware name: Intel Corporation CometLake Client Platform/CometLake S
UDIMM (ERB/CRB), BIOS CMLSFWR1.R00.1263.D00.1906260926 06/26/2019
Call Trace:
 dump_stack+0x7f/0xad
 __lock_acquire.cold.78+0x2af/0x2ca
 lock_acquire+0xd3/0x300
 ? drm_is_current_master+0x1e/0x50
 ? __mutex_lock+0x76/0x970
 ? lockdep_hardirqs_on+0xbf/0x130
 __mutex_lock+0xab/0x970
 ? drm_is_current_master+0x1e/0x50
 ? drm_is_current_master+0x1e/0x50
 ? drm_is_current_master+0x1e/0x50
 drm_is_current_master+0x1e/0x50
 drm_clients_info+0x107/0x2a0
 seq_read_iter+0x178/0x3b0
 seq_read+0x104/0x150
 full_proxy_read+0x4e/0x80
 vfs_read+0xa5/0x1b0
 ksys_read+0x5a/0xd0
 do_syscall_64+0x39/0xb0
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Signed-off-by: Desmond Cheong Zhi Xi 
Signed-off-by: Daniel Vetter 
Link: 
https://patchwork.freedesktop.org/patch/msgid/20210712043508.11584-3-desmondcheon...@gmail.com
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/drm_debugfs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c
index 3d7182001004..b0a826489488 100644
--- a/drivers/gpu/drm/drm_debugfs.c
+++ b/drivers/gpu/drm/drm_debugfs.c
@@ -91,6 +91,7 @@ static int drm_clients_info(struct seq_file *m, void *data)
mutex_lock(&dev->filelist_mutex);
list_for_each_entry_reverse(priv, &dev->filelist, lhead) {
struct task_struct *task;
+   bool is_current_master = drm_is_current_master(priv);
 
rcu_read_lock(); /* locks pid_task()->comm */
task = pid_task(priv->pid, PIDTYPE_PID);
@@ -99,7 +100,7 @@ static int drm_clients_info(struct seq_file *m, void *data)
   task ? task->comm : "",
   pid_vnr(priv->pid),
   priv->minor->index,
-  drm_is_current_master(priv) ? 'y' : 'n',
+  is_current_master ? 'y' : 'n',
   priv->authenticated ? 'y' : 'n',
   from_kuid_munged(seq_user_ns(m), uid),
   priv->magic);
-- 
2.30.2



[PATCH AUTOSEL 5.14 035/252] drm: serialize drm_file.master with a new spinlock

2021-09-09 Thread Sasha Levin
From: Desmond Cheong Zhi Xi 

[ Upstream commit 0b0860a3cf5eccf183760b1177a1dcdb821b0b66 ]

Currently, drm_file.master pointers should be protected by
drm_device.master_mutex when being dereferenced. This is because
drm_file.master is not invariant for the lifetime of drm_file. If
drm_file is not the creator of master, then drm_file.is_master is
false, and a call to drm_setmaster_ioctl will invoke
drm_new_set_master, which then allocates a new master for drm_file and
puts the old master.

Thus, without holding drm_device.master_mutex, the old value of
drm_file.master could be freed while it is being used by another
concurrent process.

However, it is not always possible to lock drm_device.master_mutex to
dereference drm_file.master. Through the fbdev emulation code, this
might occur in a deep nest of other locks. But drm_device.master_mutex
is also the outermost lock in the nesting hierarchy, so this leads to
potential deadlocks.

To address this, we introduce a new spin lock at the bottom of the
lock hierarchy that only serializes drm_file.master. With this change,
the value of drm_file.master changes only when both
drm_device.master_mutex and drm_file.master_lookup_lock are
held. Hence, any process holding either of those locks can ensure that
the value of drm_file.master will not change concurrently.

Since no lock depends on the new drm_file.master_lookup_lock, when
drm_file.master is dereferenced, but drm_device.master_mutex cannot be
held, we can safely protect the master pointer with
drm_file.master_lookup_lock.

Reported-by: Daniel Vetter 
Signed-off-by: Desmond Cheong Zhi Xi 
Signed-off-by: Daniel Vetter 
Link: 
https://patchwork.freedesktop.org/patch/msgid/20210712043508.11584-5-desmondcheon...@gmail.com
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/drm_auth.c | 17 +++--
 drivers/gpu/drm/drm_file.c |  1 +
 include/drm/drm_file.h | 12 +---
 3 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
index b59b26a71ad5..cbb896b91d94 100644
--- a/drivers/gpu/drm/drm_auth.c
+++ b/drivers/gpu/drm/drm_auth.c
@@ -135,16 +135,18 @@ static void drm_set_master(struct drm_device *dev, struct 
drm_file *fpriv,
 static int drm_new_set_master(struct drm_device *dev, struct drm_file *fpriv)
 {
struct drm_master *old_master;
+   struct drm_master *new_master;
 
lockdep_assert_held_once(&dev->master_mutex);
 
WARN_ON(fpriv->is_master);
old_master = fpriv->master;
-   fpriv->master = drm_master_create(dev);
-   if (!fpriv->master) {
-   fpriv->master = old_master;
+   new_master = drm_master_create(dev);
+   if (!new_master)
return -ENOMEM;
-   }
+   spin_lock(&fpriv->master_lookup_lock);
+   fpriv->master = new_master;
+   spin_unlock(&fpriv->master_lookup_lock);
 
fpriv->is_master = 1;
fpriv->authenticated = 1;
@@ -303,10 +305,13 @@ int drm_master_open(struct drm_file *file_priv)
 * any master object for render clients
 */
mutex_lock(&dev->master_mutex);
-   if (!dev->master)
+   if (!dev->master) {
ret = drm_new_set_master(dev, file_priv);
-   else
+   } else {
+   spin_lock(&file_priv->master_lookup_lock);
file_priv->master = drm_master_get(dev->master);
+   spin_unlock(&file_priv->master_lookup_lock);
+   }
mutex_unlock(&dev->master_mutex);
 
return ret;
diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c
index d4f0bac6f8f8..ceb1a9723855 100644
--- a/drivers/gpu/drm/drm_file.c
+++ b/drivers/gpu/drm/drm_file.c
@@ -176,6 +176,7 @@ struct drm_file *drm_file_alloc(struct drm_minor *minor)
init_waitqueue_head(&file->event_wait);
file->event_space = 4096; /* set aside 4k for event buffer */
 
+   spin_lock_init(&file->master_lookup_lock);
mutex_init(&file->event_read_lock);
 
if (drm_core_check_feature(dev, DRIVER_GEM))
diff --git a/include/drm/drm_file.h b/include/drm/drm_file.h
index b81b3bfb08c8..9b82988e3427 100644
--- a/include/drm/drm_file.h
+++ b/include/drm/drm_file.h
@@ -226,15 +226,21 @@ struct drm_file {
/**
 * @master:
 *
-* Master this node is currently associated with. Only relevant if
-* drm_is_primary_client() returns true. Note that this only
-* matches &drm_device.master if the master is the currently active one.
+* Master this node is currently associated with. Protected by struct
+* &drm_device.master_mutex, and serialized by @master_lookup_lock.
+*
+* Only relevant if drm_is_primary_client() returns true. Note that
+* this only matches &drm_device.master if the master is the currently
+* active one.
 *
 * See also @authentication and @is_master and the :ref:`section on
 * primary nodes and authentication `.

[PATCH AUTOSEL 5.14 036/252] drm: protect drm_master pointers in drm_lease.c

2021-09-09 Thread Sasha Levin
From: Desmond Cheong Zhi Xi 

[ Upstream commit 56f0729a510f92151682ff6c89f69724d5595d6e ]

drm_file->master pointers should be protected by
drm_device.master_mutex or drm_file.master_lookup_lock when being
dereferenced.

However, in drm_lease.c, there are multiple instances where
drm_file->master is accessed and dereferenced while neither lock is
held. This makes drm_lease.c vulnerable to use-after-free bugs.

We address this issue in 2 ways:

1. Add a new drm_file_get_master() function that calls drm_master_get
on drm_file->master while holding on to
drm_file.master_lookup_lock. Since drm_master_get increments the
reference count of master, this prevents master from being freed until
we unreference it with drm_master_put.

2. In each case where drm_file->master is directly accessed and
eventually dereferenced in drm_lease.c, we wrap the access in a call
to the new drm_file_get_master function, then unreference the master
pointer once we are done using it.

Reported-by: Daniel Vetter 
Signed-off-by: Desmond Cheong Zhi Xi 
Reviewed-by: Emil Velikov 
Signed-off-by: Daniel Vetter 
Link: 
https://patchwork.freedesktop.org/patch/msgid/20210712043508.11584-6-desmondcheon...@gmail.com
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/drm_auth.c  | 25 
 drivers/gpu/drm/drm_lease.c | 81 -
 include/drm/drm_auth.h  |  1 +
 include/drm/drm_file.h  |  6 +++
 4 files changed, 93 insertions(+), 20 deletions(-)

diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
index cbb896b91d94..3a298df00901 100644
--- a/drivers/gpu/drm/drm_auth.c
+++ b/drivers/gpu/drm/drm_auth.c
@@ -377,6 +377,31 @@ struct drm_master *drm_master_get(struct drm_master 
*master)
 }
 EXPORT_SYMBOL(drm_master_get);
 
+/**
+ * drm_file_get_master - reference &drm_file.master of @file_priv
+ * @file_priv: DRM file private
+ *
+ * Increments the reference count of @file_priv's &drm_file.master and returns
+ * the &drm_file.master. If @file_priv has no &drm_file.master, returns NULL.
+ *
+ * Master pointers returned from this function should be unreferenced using
+ * drm_master_put().
+ */
+struct drm_master *drm_file_get_master(struct drm_file *file_priv)
+{
+   struct drm_master *master = NULL;
+
+   spin_lock(&file_priv->master_lookup_lock);
+   if (!file_priv->master)
+   goto unlock;
+   master = drm_master_get(file_priv->master);
+
+unlock:
+   spin_unlock(&file_priv->master_lookup_lock);
+   return master;
+}
+EXPORT_SYMBOL(drm_file_get_master);
+
 static void drm_master_destroy(struct kref *kref)
 {
struct drm_master *master = container_of(kref, struct drm_master, 
refcount);
diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
index 00fb433bcef1..92eac73d9001 100644
--- a/drivers/gpu/drm/drm_lease.c
+++ b/drivers/gpu/drm/drm_lease.c
@@ -106,10 +106,19 @@ static bool _drm_has_leased(struct drm_master *master, 
int id)
  */
 bool _drm_lease_held(struct drm_file *file_priv, int id)
 {
-   if (!file_priv || !file_priv->master)
+   bool ret;
+   struct drm_master *master;
+
+   if (!file_priv)
return true;
 
-   return _drm_lease_held_master(file_priv->master, id);
+   master = drm_file_get_master(file_priv);
+   if (!master)
+   return true;
+   ret = _drm_lease_held_master(master, id);
+   drm_master_put(&master);
+
+   return ret;
 }
 
 /**
@@ -128,13 +137,22 @@ bool drm_lease_held(struct drm_file *file_priv, int id)
struct drm_master *master;
bool ret;
 
-   if (!file_priv || !file_priv->master || !file_priv->master->lessor)
+   if (!file_priv)
return true;
 
-   master = file_priv->master;
+   master = drm_file_get_master(file_priv);
+   if (!master)
+   return true;
+   if (!master->lessor) {
+   ret = true;
+   goto out;
+   }
mutex_lock(&master->dev->mode_config.idr_mutex);
ret = _drm_lease_held_master(master, id);
mutex_unlock(&master->dev->mode_config.idr_mutex);
+
+out:
+   drm_master_put(&master);
return ret;
 }
 
@@ -154,10 +172,16 @@ uint32_t drm_lease_filter_crtcs(struct drm_file 
*file_priv, uint32_t crtcs_in)
int count_in, count_out;
uint32_t crtcs_out = 0;
 
-   if (!file_priv || !file_priv->master || !file_priv->master->lessor)
+   if (!file_priv)
return crtcs_in;
 
-   master = file_priv->master;
+   master = drm_file_get_master(file_priv);
+   if (!master)
+   return crtcs_in;
+   if (!master->lessor) {
+   crtcs_out = crtcs_in;
+   goto out;
+   }
dev = master->dev;
 
count_in = count_out = 0;
@@ -176,6 +200,9 @@ uint32_t drm_lease_filter_crtcs(struct drm_file *file_priv, 
uint32_t crtcs_in)
count_in++;
}
mutex_unlock(&master->dev->mode_config.idr_mutex);
+
+out:

[PATCH AUTOSEL 5.14 052/252] drm/amd/display: Fix timer_per_pixel unit error

2021-09-09 Thread Sasha Levin
From: Oliver Logush 

[ Upstream commit 23e55639b87fb16a9f0f66032ecb57060df6c46c ]

[why]
The units of the time_per_pixel variable were incorrect, this had to be
changed for the code to properly function.

[how]
The change was very straightforward, only required one line of code to
be changed where the calculation was done.

Acked-by: Rodrigo Siqueira 
Signed-off-by: Oliver Logush 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c 
b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
index b173fa3653b5..c78933a9d31c 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
@@ -2462,7 +2462,7 @@ void dcn20_set_mcif_arb_params(
wb_arb_params->cli_watermark[k] = 
get_wm_writeback_urgent(&context->bw_ctx.dml, pipes, pipe_cnt) * 1000;
wb_arb_params->pstate_watermark[k] = 
get_wm_writeback_dram_clock_change(&context->bw_ctx.dml, pipes, pipe_cnt) * 
1000;
}
-   wb_arb_params->time_per_pixel = 16.0 / 
context->res_ctx.pipe_ctx[i].stream->phy_pix_clk; /* 4 bit fraction, ms */
+   wb_arb_params->time_per_pixel = 16.0 * 1000 / 
(context->res_ctx.pipe_ctx[i].stream->phy_pix_clk / 1000); /* 4 bit fraction, 
ms */
wb_arb_params->slice_lines = 32;
wb_arb_params->arbitration_slice = 2;
wb_arb_params->max_scaled_time = 
dcn20_calc_max_scaled_time(wb_arb_params->time_per_pixel,
-- 
2.30.2



[PATCH AUTOSEL 5.14 061/252] drm/amd/display: Fixed hardware power down bypass during headless boot

2021-09-09 Thread Sasha Levin
From: Jake Wang 

[ Upstream commit 3addbde269f21ffc735f6d3d0c2237664923824e ]

[Why]
During headless boot, DIG may be on which causes HW/SW discrepancies.
To avoid this we power down hardware on boot if DIG is turned on. With
introduction of multiple eDP, hardware power down is being bypassed
under certain conditions.

[How]
Fixed hardware power down bypass, and ensured hardware will power down
if DIG is on and seamless boot is not enabled.

Reviewed-by: Nicholas Kazlauskas 
Acked-by: Rodrigo Siqueira 
Signed-off-by: Jake Wang 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 .../amd/display/dc/dcn10/dcn10_hw_sequencer.c | 27 +--
 .../drm/amd/display/dc/dcn30/dcn30_hwseq.c| 25 -
 .../drm/amd/display/dc/dcn31/dcn31_hwseq.c|  5 +++-
 3 files changed, 27 insertions(+), 30 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c 
b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index c545eddabdcc..dee1ce5f9609 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -1502,25 +1502,22 @@ void dcn10_init_hw(struct dc *dc)
 void dcn10_power_down_on_boot(struct dc *dc)
 {
struct dc_link *edp_links[MAX_NUM_EDP];
-   struct dc_link *edp_link;
+   struct dc_link *edp_link = NULL;
int edp_num;
int i = 0;
 
get_edp_links(dc, edp_links, &edp_num);
-
-   if (edp_num) {
-   for (i = 0; i < edp_num; i++) {
-   edp_link = edp_links[i];
-   if (edp_link->link_enc->funcs->is_dig_enabled &&
-   
edp_link->link_enc->funcs->is_dig_enabled(edp_link->link_enc) &&
-   dc->hwseq->funcs.edp_backlight_control 
&&
-   dc->hwss.power_down &&
-   dc->hwss.edp_power_control) {
-   
dc->hwseq->funcs.edp_backlight_control(edp_link, false);
-   dc->hwss.power_down(dc);
-   dc->hwss.edp_power_control(edp_link, false);
-   }
-   }
+   if (edp_num)
+   edp_link = edp_links[0];
+
+   if (edp_link && edp_link->link_enc->funcs->is_dig_enabled &&
+   
edp_link->link_enc->funcs->is_dig_enabled(edp_link->link_enc) &&
+   dc->hwseq->funcs.edp_backlight_control &&
+   dc->hwss.power_down &&
+   dc->hwss.edp_power_control) {
+   dc->hwseq->funcs.edp_backlight_control(edp_link, false);
+   dc->hwss.power_down(dc);
+   dc->hwss.edp_power_control(edp_link, false);
} else {
for (i = 0; i < dc->link_count; i++) {
struct dc_link *link = dc->links[i];
diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c 
b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
index c68e3a708a33..2e8ab9775fa3 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
@@ -580,22 +580,19 @@ void dcn30_init_hw(struct dc *dc)
 */
if (dc->config.power_down_display_on_boot) {
struct dc_link *edp_links[MAX_NUM_EDP];
-   struct dc_link *edp_link;
+   struct dc_link *edp_link = NULL;
 
get_edp_links(dc, edp_links, &edp_num);
-   if (edp_num) {
-   for (i = 0; i < edp_num; i++) {
-   edp_link = edp_links[i];
-   if (edp_link->link_enc->funcs->is_dig_enabled &&
-   
edp_link->link_enc->funcs->is_dig_enabled(edp_link->link_enc) &&
-   dc->hwss.edp_backlight_control 
&&
-   dc->hwss.power_down &&
-   dc->hwss.edp_power_control) {
-   
dc->hwss.edp_backlight_control(edp_link, false);
-   dc->hwss.power_down(dc);
-   dc->hwss.edp_power_control(edp_link, 
false);
-   }
-   }
+   if (edp_num)
+   edp_link = edp_links[0];
+   if (edp_link && edp_link->link_enc->funcs->is_dig_enabled &&
+   
edp_link->link_enc->funcs->is_dig_enabled(edp_link->link_enc) &&
+   dc->hwss.edp_backlight_control &&
+   dc->hwss.power_down &&
+   dc->hwss.edp_power_control) {
+   dc->hwss.edp_backlight_control(edp_link, false);
+   dc->hwss.power_down(dc);
+   

[PATCH AUTOSEL 5.14 062/252] drm/amdgpu: Fix a printing message

2021-09-09 Thread Sasha Levin
From: Oak Zeng 

[ Upstream commit 95f71f12aa45d65b7f2ccab95569795edffd379a ]

The printing message "PSP loading VCN firmware" is mis-leading because
people might think driver is loading VCN firmware. Actually when this
message is printed, driver is just preparing some VCN ucode, not loading
VCN firmware yet. The actual VCN firmware loading will be in the PSP block
hw_init. Fix the printing message

Signed-off-by: Oak Zeng 
Reviewed-by: Christian Konig 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c | 2 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c | 2 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c | 2 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c 
b/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
index 284bb42d6c86..121ee9f2b8d1 100644
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
@@ -119,7 +119,7 @@ static int vcn_v1_0_sw_init(void *handle)
adev->firmware.ucode[AMDGPU_UCODE_ID_VCN].fw = adev->vcn.fw;
adev->firmware.fw_size +=
ALIGN(le32_to_cpu(hdr->ucode_size_bytes), PAGE_SIZE);
-   DRM_INFO("PSP loading VCN firmware\n");
+   dev_info(adev->dev, "Will use PSP to load VCN firmware\n");
}
 
r = amdgpu_vcn_resume(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c 
b/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c
index 8af567c546db..f4686e918e0d 100644
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c
@@ -122,7 +122,7 @@ static int vcn_v2_0_sw_init(void *handle)
adev->firmware.ucode[AMDGPU_UCODE_ID_VCN].fw = adev->vcn.fw;
adev->firmware.fw_size +=
ALIGN(le32_to_cpu(hdr->ucode_size_bytes), PAGE_SIZE);
-   DRM_INFO("PSP loading VCN firmware\n");
+   dev_info(adev->dev, "Will use PSP to load VCN firmware\n");
}
 
r = amdgpu_vcn_resume(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c 
b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
index 888b17d84691..e0c0c3734432 100644
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
@@ -152,7 +152,7 @@ static int vcn_v2_5_sw_init(void *handle)
adev->firmware.fw_size +=
ALIGN(le32_to_cpu(hdr->ucode_size_bytes), 
PAGE_SIZE);
}
-   DRM_INFO("PSP loading VCN firmware\n");
+   dev_info(adev->dev, "Will use PSP to load VCN firmware\n");
}
 
r = amdgpu_vcn_resume(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c 
b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
index 47d4f04cbd69..2f017560948e 100644
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
@@ -160,7 +160,7 @@ static int vcn_v3_0_sw_init(void *handle)
adev->firmware.fw_size +=
ALIGN(le32_to_cpu(hdr->ucode_size_bytes), 
PAGE_SIZE);
}
-   DRM_INFO("PSP loading VCN firmware\n");
+   dev_info(adev->dev, "Will use PSP to load VCN firmware\n");
}
 
r = amdgpu_vcn_resume(adev);
-- 
2.30.2



[PATCH AUTOSEL 5.14 063/252] drm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex

2021-09-09 Thread Sasha Levin
From: Anson Jacob 

[ Upstream commit 1a394b3c3de2577f200cb623c52a5c2b82805cec ]

link_rate is updated via debugfs using hex values, set it to output
in hex as well.

eg: Resolution: 1920x1080@144Hz
cat /sys/kernel/debug/dri/0/DP-1/link_settings
Current:  4  0x14  0  Verified:  4  0x1e  0  Reported:  4  0x1e  16  Preferred: 
 0  0x0  0

echo "4 0x1e" > /sys/kernel/debug/dri/0/DP-1/link_settings

cat /sys/kernel/debug/dri/0/DP-1/link_settings
Current:  4  0x1e  0  Verified:  4  0x1e  0  Reported:  4  0x1e  16  Preferred: 
 4  0x1e  0

Signed-off-by: Anson Jacob 
Reviewed-by: Harry Wentland 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 .../amd/display/amdgpu_dm/amdgpu_dm_debugfs.c| 16 
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c 
b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
index f1145086a468..1d15a9af9956 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
@@ -197,29 +197,29 @@ static ssize_t dp_link_settings_read(struct file *f, char 
__user *buf,
 
rd_buf_ptr = rd_buf;
 
-   str_len = strlen("Current:  %d  %d  %d  ");
-   snprintf(rd_buf_ptr, str_len, "Current:  %d  %d  %d  ",
+   str_len = strlen("Current:  %d  0x%x  %d  ");
+   snprintf(rd_buf_ptr, str_len, "Current:  %d  0x%x  %d  ",
link->cur_link_settings.lane_count,
link->cur_link_settings.link_rate,
link->cur_link_settings.link_spread);
rd_buf_ptr += str_len;
 
-   str_len = strlen("Verified:  %d  %d  %d  ");
-   snprintf(rd_buf_ptr, str_len, "Verified:  %d  %d  %d  ",
+   str_len = strlen("Verified:  %d  0x%x  %d  ");
+   snprintf(rd_buf_ptr, str_len, "Verified:  %d  0x%x  %d  ",
link->verified_link_cap.lane_count,
link->verified_link_cap.link_rate,
link->verified_link_cap.link_spread);
rd_buf_ptr += str_len;
 
-   str_len = strlen("Reported:  %d  %d  %d  ");
-   snprintf(rd_buf_ptr, str_len, "Reported:  %d  %d  %d  ",
+   str_len = strlen("Reported:  %d  0x%x  %d  ");
+   snprintf(rd_buf_ptr, str_len, "Reported:  %d  0x%x  %d  ",
link->reported_link_cap.lane_count,
link->reported_link_cap.link_rate,
link->reported_link_cap.link_spread);
rd_buf_ptr += str_len;
 
-   str_len = strlen("Preferred:  %d  %d  %d  ");
-   snprintf(rd_buf_ptr, str_len, "Preferred:  %d  %d  %d\n",
+   str_len = strlen("Preferred:  %d  0x%x  %d  ");
+   snprintf(rd_buf_ptr, str_len, "Preferred:  %d  0x%x  %d\n",
link->preferred_link_setting.lane_count,
link->preferred_link_setting.link_rate,
link->preferred_link_setting.link_spread);
-- 
2.30.2



[PATCH AUTOSEL 5.14 066/252] drm/bridge: nwl-dsi: Avoid potential multiplication overflow on 32-bit

2021-09-09 Thread Sasha Levin
From: Geert Uytterhoeven 

[ Upstream commit 47956bc86ee4e8530cac386a04f62a6095f7afbe ]

As nwl_dsi.lanes is u32, and NSEC_PER_SEC is 10L, the second
multiplication in

dsi->lanes * 8 * NSEC_PER_SEC

will overflow on a 32-bit platform.  Fix this by making the constant
unsigned long long, forcing 64-bit arithmetic.

As iMX8 is arm64, this driver is currently used on 64-bit platforms
only, where long is 64-bit, so this cannot happen.  But the issue will
start to happen when the driver is reused for a 32-bit SoC (e.g.
i.MX7ULP), or when code is copied for a new driver.

Signed-off-by: Geert Uytterhoeven 
Reviewed-by: Fabio Estevam 
Reviewed-by: Laurent Pinchart 
Signed-off-by: Sam Ravnborg 
Link: 
https://patchwork.freedesktop.org/patch/msgid/ebb82941a86b4e35c4fcfb1ef5a5cfad7c1fceab.1626255956.git.geert+rene...@glider.be
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/bridge/nwl-dsi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/bridge/nwl-dsi.c b/drivers/gpu/drm/bridge/nwl-dsi.c
index 873995f0a741..6002404ffcb9 100644
--- a/drivers/gpu/drm/bridge/nwl-dsi.c
+++ b/drivers/gpu/drm/bridge/nwl-dsi.c
@@ -196,7 +196,7 @@ static u32 ps2bc(struct nwl_dsi *dsi, unsigned long long ps)
u32 bpp = mipi_dsi_pixel_format_to_bpp(dsi->format);
 
return DIV64_U64_ROUND_UP(ps * dsi->mode.clock * bpp,
- dsi->lanes * 8 * NSEC_PER_SEC);
+ dsi->lanes * 8ULL * NSEC_PER_SEC);
 }
 
 /*
-- 
2.30.2



[PATCH AUTOSEL 5.14 068/252] video: fbdev: asiliantfb: Error out if 'pixclock' equals zero

2021-09-09 Thread Sasha Levin
From: Zheyu Ma 

[ Upstream commit b36b242d4b8ea178f7fd038965e3cac7f30c3f09 ]

The userspace program could pass any values to the driver through
ioctl() interface. If the driver doesn't check the value of 'pixclock',
it may cause divide error.

Fix this by checking whether 'pixclock' is zero first.

The following log reveals it:

[   43.861711] divide error:  [#1] PREEMPT SMP KASAN PTI
[   43.861737] CPU: 2 PID: 11764 Comm: i740 Not tainted 
5.14.0-rc2-00513-gac532c9bbcfb-dirty #224
[   43.861756] RIP: 0010:asiliantfb_check_var+0x4e/0x730
[   43.861843] Call Trace:
[   43.861848]  ? asiliantfb_remove+0x190/0x190
[   43.861858]  fb_set_var+0x2e4/0xeb0
[   43.861866]  ? fb_blank+0x1a0/0x1a0
[   43.861873]  ? lock_acquire+0x1ef/0x530
[   43.861884]  ? lock_release+0x810/0x810
[   43.861892]  ? lock_is_held_type+0x100/0x140
[   43.861903]  ? ___might_sleep+0x1ee/0x2d0
[   43.861914]  ? __mutex_lock+0x620/0x1190
[   43.861921]  ? do_fb_ioctl+0x313/0x700
[   43.861929]  ? mutex_lock_io_nested+0xfa0/0xfa0
[   43.861936]  ? __this_cpu_preempt_check+0x1d/0x30
[   43.861944]  ? _raw_spin_unlock_irqrestore+0x46/0x60
[   43.861952]  ? lockdep_hardirqs_on+0x59/0x100
[   43.861959]  ? _raw_spin_unlock_irqrestore+0x46/0x60
[   43.861967]  ? trace_hardirqs_on+0x6a/0x1c0
[   43.861978]  do_fb_ioctl+0x31e/0x700

Signed-off-by: Zheyu Ma 
Signed-off-by: Sam Ravnborg 
Link: 
https://patchwork.freedesktop.org/patch/msgid/1627293835-17441-2-git-send-email-zheyum...@gmail.com
Signed-off-by: Sasha Levin 
---
 drivers/video/fbdev/asiliantfb.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/video/fbdev/asiliantfb.c b/drivers/video/fbdev/asiliantfb.c
index 3e006da47752..84c56f525889 100644
--- a/drivers/video/fbdev/asiliantfb.c
+++ b/drivers/video/fbdev/asiliantfb.c
@@ -227,6 +227,9 @@ static int asiliantfb_check_var(struct fb_var_screeninfo 
*var,
 {
unsigned long Ftarget, ratio, remainder;
 
+   if (!var->pixclock)
+   return -EINVAL;
+
ratio = 100 / var->pixclock;
remainder = 100 % var->pixclock;
Ftarget = 100 * ratio + (100 * remainder) / var->pixclock;
-- 
2.30.2



[PATCH AUTOSEL 5.14 070/252] video: fbdev: riva: Error out if 'pixclock' equals zero

2021-09-09 Thread Sasha Levin
From: Zheyu Ma 

[ Upstream commit f92763cb0feba247e0939ed137b495601fd072a5 ]

The userspace program could pass any values to the driver through
ioctl() interface. If the driver doesn't check the value of 'pixclock',
it may cause divide error.

Fix this by checking whether 'pixclock' is zero first.

The following log reveals it:

[   33.396850] divide error:  [#1] PREEMPT SMP KASAN PTI
[   33.396864] CPU: 5 PID: 11754 Comm: i740 Not tainted 
5.14.0-rc2-00513-gac532c9bbcfb-dirty #222
[   33.396883] RIP: 0010:riva_load_video_mode+0x417/0xf70
[   33.396969] Call Trace:
[   33.396973]  ? debug_smp_processor_id+0x1c/0x20
[   33.396984]  ? tick_nohz_tick_stopped+0x1a/0x90
[   33.396996]  ? rivafb_copyarea+0x3c0/0x3c0
[   33.397003]  ? wake_up_klogd.part.0+0x99/0xd0
[   33.397014]  ? vprintk_emit+0x110/0x4b0
[   33.397024]  ? vprintk_default+0x26/0x30
[   33.397033]  ? vprintk+0x9c/0x1f0
[   33.397041]  ? printk+0xba/0xed
[   33.397054]  ? record_print_text.cold+0x16/0x16
[   33.397063]  ? __kasan_check_read+0x11/0x20
[   33.397074]  ? profile_tick+0xc0/0x100
[   33.397084]  ? __sanitizer_cov_trace_const_cmp4+0x24/0x80
[   33.397094]  ? riva_set_rop_solid+0x2a0/0x2a0
[   33.397102]  rivafb_set_par+0xbe/0x610
[   33.397111]  ? riva_set_rop_solid+0x2a0/0x2a0
[   33.397119]  fb_set_var+0x5bf/0xeb0
[   33.397127]  ? fb_blank+0x1a0/0x1a0
[   33.397134]  ? lock_acquire+0x1ef/0x530
[   33.397143]  ? lock_release+0x810/0x810
[   33.397151]  ? lock_is_held_type+0x100/0x140
[   33.397159]  ? ___might_sleep+0x1ee/0x2d0
[   33.397170]  ? __mutex_lock+0x620/0x1190
[   33.397180]  ? trace_hardirqs_on+0x6a/0x1c0
[   33.397190]  do_fb_ioctl+0x31e/0x700

Signed-off-by: Zheyu Ma 
Signed-off-by: Sam Ravnborg 
Link: 
https://patchwork.freedesktop.org/patch/msgid/1627293835-17441-4-git-send-email-zheyum...@gmail.com
Signed-off-by: Sasha Levin 
---
 drivers/video/fbdev/riva/fbdev.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/video/fbdev/riva/fbdev.c b/drivers/video/fbdev/riva/fbdev.c
index 4b0433cb..84d5e23ad7d3 100644
--- a/drivers/video/fbdev/riva/fbdev.c
+++ b/drivers/video/fbdev/riva/fbdev.c
@@ -1084,6 +1084,9 @@ static int rivafb_check_var(struct fb_var_screeninfo 
*var, struct fb_info *info)
int mode_valid = 0;

NVTRACE_ENTER();
+   if (!var->pixclock)
+   return -EINVAL;
+
switch (var->bits_per_pixel) {
case 1 ... 8:
var->red.offset = var->green.offset = var->blue.offset = 0;
-- 
2.30.2



[PATCH AUTOSEL 5.14 069/252] video: fbdev: kyro: Error out if 'pixclock' equals zero

2021-09-09 Thread Sasha Levin
From: Zheyu Ma 

[ Upstream commit 1520b4b7ba964f8eec2e7dd14c571d50de3e5191 ]

The userspace program could pass any values to the driver through
ioctl() interface. if the driver doesn't check the value of 'pixclock',
it may cause divide error because the value of 'lineclock' and
'frameclock' will be zero.

Fix this by checking whether 'pixclock' is zero in kyrofb_check_var().

The following log reveals it:

[  103.073930] divide error:  [#1] PREEMPT SMP KASAN PTI
[  103.073942] CPU: 4 PID: 12483 Comm: syz-executor Not tainted 
5.14.0-rc2-00478-g2734d6c1b1a0-dirty #118
[  103.073959] RIP: 0010:kyrofb_set_par+0x316/0xc80
[  103.074045] Call Trace:
[  103.074048]  ? ___might_sleep+0x1ee/0x2d0
[  103.074060]  ? kyrofb_ioctl+0x330/0x330
[  103.074069]  fb_set_var+0x5bf/0xeb0
[  103.074078]  ? fb_blank+0x1a0/0x1a0
[  103.074085]  ? lock_acquire+0x3bd/0x530
[  103.074094]  ? lock_release+0x810/0x810
[  103.074103]  ? ___might_sleep+0x1ee/0x2d0
[  103.074114]  ? __mutex_lock+0x620/0x1190
[  103.074126]  ? trace_hardirqs_on+0x6a/0x1c0
[  103.074137]  do_fb_ioctl+0x31e/0x700
[  103.074144]  ? fb_getput_cmap+0x280/0x280
[  103.074152]  ? rcu_read_lock_sched_held+0x11/0x80
[  103.074162]  ? rcu_read_lock_sched_held+0x11/0x80
[  103.074171]  ? __sanitizer_cov_trace_switch+0x67/0xf0
[  103.074181]  ? __sanitizer_cov_trace_const_cmp2+0x20/0x80
[  103.074191]  ? do_vfs_ioctl+0x14b/0x16c0
[  103.074199]  ? vfs_fileattr_set+0xb60/0xb60
[  103.074207]  ? rcu_read_lock_sched_held+0x11/0x80
[  103.074216]  ? lock_release+0x483/0x810
[  103.074224]  ? __fget_files+0x217/0x3d0
[  103.074234]  ? __fget_files+0x239/0x3d0
[  103.074243]  ? do_fb_ioctl+0x700/0x700
[  103.074250]  fb_ioctl+0xe6/0x130

Signed-off-by: Zheyu Ma 
Signed-off-by: Sam Ravnborg 
Link: 
https://patchwork.freedesktop.org/patch/msgid/1627293835-17441-3-git-send-email-zheyum...@gmail.com
Signed-off-by: Sasha Levin 
---
 drivers/video/fbdev/kyro/fbdev.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/video/fbdev/kyro/fbdev.c b/drivers/video/fbdev/kyro/fbdev.c
index 4b8c7c16b1df..25801e8e3f74 100644
--- a/drivers/video/fbdev/kyro/fbdev.c
+++ b/drivers/video/fbdev/kyro/fbdev.c
@@ -399,6 +399,9 @@ static int kyrofb_check_var(struct fb_var_screeninfo *var, 
struct fb_info *info)
 {
struct kyrofb_info *par = info->par;
 
+   if (!var->pixclock)
+   return -EINVAL;
+
if (var->bits_per_pixel != 16 && var->bits_per_pixel != 32) {
printk(KERN_WARNING "kyrofb: depth not supported: %u\n", 
var->bits_per_pixel);
return -EINVAL;
-- 
2.30.2



[PATCH AUTOSEL 5.14 084/252] drm/amd/display: Fix PSR command version

2021-09-09 Thread Sasha Levin
From: Mikita Lipski 

[ Upstream commit af1f2b19fd7d404d299355cc95930efee5b3ed8b ]

[why]
For dual eDP when setting the new settings we need to set
command version to DMUB_CMD_PSR_CONTROL_VERSION_1, otherwise
DMUB will not read panel_inst parameter.
[how]
Instead of PSR_VERSION_1 pass DMUB_CMD_PSR_CONTROL_VERSION_1

Reviewed-by: Wood Wyatt 
Acked-by: Solomon Chiu 
Signed-off-by: Mikita Lipski 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c 
b/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c
index 10d42ae0cffe..3428334c6c57 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c
@@ -207,7 +207,7 @@ static void dmub_psr_set_level(struct dmub_psr *dmub, 
uint16_t psr_level, uint8_
cmd.psr_set_level.header.sub_type = DMUB_CMD__PSR_SET_LEVEL;
cmd.psr_set_level.header.payload_bytes = sizeof(struct 
dmub_cmd_psr_set_level_data);
cmd.psr_set_level.psr_set_level_data.psr_level = psr_level;
-   cmd.psr_set_level.psr_set_level_data.cmd_version = PSR_VERSION_1;
+   cmd.psr_set_level.psr_set_level_data.cmd_version = 
DMUB_CMD_PSR_CONTROL_VERSION_1;
cmd.psr_set_level.psr_set_level_data.panel_inst = panel_inst;
dc_dmub_srv_cmd_queue(dc->dmub_srv, &cmd);
dc_dmub_srv_cmd_execute(dc->dmub_srv);
@@ -293,7 +293,7 @@ static bool dmub_psr_copy_settings(struct dmub_psr *dmub,
copy_settings_data->debug.bitfields.use_hw_lock_mgr = 1;
copy_settings_data->fec_enable_status = (link->fec_state == 
dc_link_fec_enabled);
copy_settings_data->fec_enable_delay_in100us = 
link->dc->debug.fec_enable_delay_in100us;
-   copy_settings_data->cmd_version =  PSR_VERSION_1;
+   copy_settings_data->cmd_version =  DMUB_CMD_PSR_CONTROL_VERSION_1;
copy_settings_data->panel_inst = panel_inst;
 
dc_dmub_srv_cmd_queue(dc->dmub_srv, &cmd);
-- 
2.30.2



[PATCH AUTOSEL 5.14 089/252] drm: rcar-du: Shutdown the display on system shutdown

2021-09-09 Thread Sasha Levin
From: Laurent Pinchart 

[ Upstream commit 015f2ebb93767d40c442e749642fffaf10316d78 ]

When the system shuts down or warm reboots, the display may be active,
with the hardware accessing system memory. Upon reboot, the DDR will not
be accessible, which may cause issues.

Implement the platform_driver .shutdown() operation and shut down the
display to fix this.

Signed-off-by: Laurent Pinchart 
Reviewed-by: Kieran Bingham 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/rcar-du/rcar_du_drv.c | 8 
 1 file changed, 8 insertions(+)

diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.c 
b/drivers/gpu/drm/rcar-du/rcar_du_drv.c
index bfbff90588cb..43de3d8686e8 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_drv.c
+++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.c
@@ -561,6 +561,13 @@ static int rcar_du_remove(struct platform_device *pdev)
return 0;
 }
 
+static void rcar_du_shutdown(struct platform_device *pdev)
+{
+   struct rcar_du_device *rcdu = platform_get_drvdata(pdev);
+
+   drm_atomic_helper_shutdown(&rcdu->ddev);
+}
+
 static int rcar_du_probe(struct platform_device *pdev)
 {
struct rcar_du_device *rcdu;
@@ -617,6 +624,7 @@ static int rcar_du_probe(struct platform_device *pdev)
 static struct platform_driver rcar_du_platform_driver = {
.probe  = rcar_du_probe,
.remove = rcar_du_remove,
+   .shutdown   = rcar_du_shutdown,
.driver = {
.name   = "rcar-du",
.pm = &rcar_du_pm_ops,
-- 
2.30.2



[PATCH AUTOSEL 5.14 095/252] drm/msm/a6xx: Fix llcc configuration for a660 gpu

2021-09-09 Thread Sasha Levin
From: Akhil P Oommen 

[ Upstream commit a6f24383f6c0a8d64d1f6afa10733ae4e8f236e0 ]

Add the missing scache_cntl0 register programing which is required for
a660 gpu.

Signed-off-by: Akhil P Oommen 
Link: 
https://lore.kernel.org/r/20210730011945.v4.1.I110b87677ef16d97397fb7c81c07a16e1f5d211e@changeid
Signed-off-by: Rob Clark 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 46 ---
 1 file changed, 27 insertions(+), 19 deletions(-)

diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c 
b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
index 9c5e4618aa0a..183b9f9c1b31 100644
--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
@@ -1383,13 +1383,13 @@ static void a6xx_llc_activate(struct a6xx_gpu *a6xx_gpu)
 {
struct adreno_gpu *adreno_gpu = &a6xx_gpu->base;
struct msm_gpu *gpu = &adreno_gpu->base;
-   u32 cntl1_regval = 0;
+   u32 gpu_scid, cntl1_regval = 0;
 
if (IS_ERR(a6xx_gpu->llc_mmio))
return;
 
if (!llcc_slice_activate(a6xx_gpu->llc_slice)) {
-   u32 gpu_scid = llcc_get_slice_id(a6xx_gpu->llc_slice);
+   gpu_scid = llcc_get_slice_id(a6xx_gpu->llc_slice);
 
gpu_scid &= 0x1f;
cntl1_regval = (gpu_scid << 0) | (gpu_scid << 5) | (gpu_scid << 
10) |
@@ -1409,26 +1409,34 @@ static void a6xx_llc_activate(struct a6xx_gpu *a6xx_gpu)
}
}
 
-   if (cntl1_regval) {
+   if (!cntl1_regval)
+   return;
+
+   /*
+* Program the slice IDs for the various GPU blocks and GPU MMU
+* pagetables
+*/
+   if (!a6xx_gpu->have_mmu500) {
+   a6xx_llc_write(a6xx_gpu,
+   REG_A6XX_CX_MISC_SYSTEM_CACHE_CNTL_1, cntl1_regval);
+
/*
-* Program the slice IDs for the various GPU blocks and GPU MMU
-* pagetables
+* Program cacheability overrides to not allocate cache
+* lines on a write miss
 */
-   if (a6xx_gpu->have_mmu500)
-   gpu_rmw(gpu, REG_A6XX_GBIF_SCACHE_CNTL1, GENMASK(24, 0),
-   cntl1_regval);
-   else {
-   a6xx_llc_write(a6xx_gpu,
-   REG_A6XX_CX_MISC_SYSTEM_CACHE_CNTL_1, 
cntl1_regval);
-
-   /*
-* Program cacheability overrides to not allocate cache
-* lines on a write miss
-*/
-   a6xx_llc_rmw(a6xx_gpu,
-   REG_A6XX_CX_MISC_SYSTEM_CACHE_CNTL_0, 0xF, 
0x03);
-   }
+   a6xx_llc_rmw(a6xx_gpu,
+   REG_A6XX_CX_MISC_SYSTEM_CACHE_CNTL_0, 0xF, 0x03);
+   return;
}
+
+   gpu_rmw(gpu, REG_A6XX_GBIF_SCACHE_CNTL1, GENMASK(24, 0), cntl1_regval);
+
+   /* On A660, the SCID programming for UCHE traffic is done in
+* A6XX_GBIF_SCACHE_CNTL0[14:10]
+*/
+   if (adreno_is_a660(adreno_gpu))
+   gpu_rmw(gpu, REG_A6XX_GBIF_SCACHE_CNTL0, (0x1f << 10) |
+   (1 << 8), (gpu_scid << 10) | (1 << 8));
 }
 
 static void a6xx_llc_slices_destroy(struct a6xx_gpu *a6xx_gpu)
-- 
2.30.2



[PATCH AUTOSEL 5.14 127/252] drm/msm: mdp4: drop vblank get/put from prepare/complete_commit

2021-09-09 Thread Sasha Levin
From: David Heidelberg 

[ Upstream commit 56bd931ae506730c9ab1e4cc4bfefa43fc2d18fa ]

msm_atomic is doing vblank get/put's already,
currently there no need to duplicate the effort in MDP4

Fix warning:
...
WARNING: CPU: 3 PID: 79 at drivers/gpu/drm/drm_vblank.c:1194 
drm_vblank_put+0x1cc/0x1d4
...
and multiple vblank time-outs:
...
msm 510.mdp: vblank time out, crtc=1
...

Tested on Nexus 7 2013 (deb), LTS 5.10.50.

Introduced by: 119ecb7fd3b5 ("drm/msm/mdp4: request vblank during modeset")

Signed-off-by: David Heidelberg 
Link: https://lore.kernel.org/r/20210715060925.7880-1-da...@ixit.cz
Signed-off-by: Dmitry Baryshkov 
Signed-off-by: Rob Clark 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | 13 -
 1 file changed, 13 deletions(-)

diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c 
b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
index 4a5b518288b0..1325731282f7 100644
--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
+++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
@@ -108,13 +108,6 @@ static void mdp4_disable_commit(struct msm_kms *kms)
 
 static void mdp4_prepare_commit(struct msm_kms *kms, struct drm_atomic_state 
*state)
 {
-   int i;
-   struct drm_crtc *crtc;
-   struct drm_crtc_state *crtc_state;
-
-   /* see 119ecb7fd */
-   for_each_new_crtc_in_state(state, crtc, crtc_state, i)
-   drm_crtc_vblank_get(crtc);
 }
 
 static void mdp4_flush_commit(struct msm_kms *kms, unsigned crtc_mask)
@@ -133,12 +126,6 @@ static void mdp4_wait_flush(struct msm_kms *kms, unsigned 
crtc_mask)
 
 static void mdp4_complete_commit(struct msm_kms *kms, unsigned crtc_mask)
 {
-   struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(kms));
-   struct drm_crtc *crtc;
-
-   /* see 119ecb7fd */
-   for_each_crtc_mask(mdp4_kms->dev, crtc, crtc_mask)
-   drm_crtc_vblank_put(crtc);
 }
 
 static long mdp4_round_pixclk(struct msm_kms *kms, unsigned long rate,
-- 
2.30.2



[PATCH AUTOSEL 5.14 128/252] drm/msm/dsi: Fix DSI and DSI PHY regulator config from SDM660

2021-09-09 Thread Sasha Levin
From: Konrad Dybcio 

[ Upstream commit 462f7017a6918d152870bfb8852f3c70fd74b296 ]

VDDA is not present and the specified load value is wrong. Fix it.

Signed-off-by: Konrad Dybcio 
Link: 
https://lore.kernel.org/r/20210728222057.52641-1-konrad.dyb...@somainline.org
Reviewed-by: Dmitry Baryshkov 
Signed-off-by: Dmitry Baryshkov 
Signed-off-by: Rob Clark 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/msm/dsi/dsi_cfg.c  | 1 -
 drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/msm/dsi/dsi_cfg.c 
b/drivers/gpu/drm/msm/dsi/dsi_cfg.c
index f3f1c03c7db9..763f127e4621 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_cfg.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_cfg.c
@@ -154,7 +154,6 @@ static const struct msm_dsi_config sdm660_dsi_cfg = {
.reg_cfg = {
.num = 2,
.regs = {
-   {"vdd", 73400, 32 },/* 0.9 V */
{"vdda", 12560, 4 },/* 1.2 V */
},
},
diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c 
b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c
index a34cf151c517..bb31230721bd 100644
--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c
+++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c
@@ -1050,7 +1050,7 @@ const struct msm_dsi_phy_cfg dsi_phy_14nm_660_cfgs = {
.reg_cfg = {
.num = 1,
.regs = {
-   {"vcca", 17000, 32},
+   {"vcca", 73400, 32},
},
},
.ops = {
-- 
2.30.2



[PATCH AUTOSEL 5.14 130/252] drm: xlnx: zynqmp: release reset to DP controller before accessing DP registers

2021-09-09 Thread Sasha Levin
From: Quanyang Wang 

[ Upstream commit a338619bd76011035d462f0f9e8b2f24d7fe5a1e ]

When insmod zynqmp-dpsub.ko after rmmod it, system will hang with the
error log as below:

root@xilinx-zynqmp:~# insmod zynqmp-dpsub.ko
[   88.391289] [drm] Initialized zynqmp-dpsub 1.0.0 20130509 for 
fd4a.display on minor 0
[   88.529906] Console: switching to colour frame buffer device 128x48
[   88.549402] zynqmp-dpsub fd4a.display: [drm] fb0: zynqmp-dpsubdrm frame 
buffer device
[   88.571624] zynqmp-dpsub fd4a.display: ZynqMP DisplayPort Subsystem 
driver probed
root@xilinx-zynqmp:~# rmmod zynqmp_dpsub
[   94.023404] Console: switching to colour dummy device 80x25
root@xilinx-zynqmp:~# insmod zynqmp-dpsub.ko


This is because that in zynqmp_dp_probe it tries to access some DP
registers while the DP controller is still in the reset state. When
running "rmmod zynqmp_dpsub", zynqmp_dp_reset(dp, true) in
zynqmp_dp_phy_exit is called to force the DP controller into the reset
state. Then insmod will call zynqmp_dp_probe to program the DP registers,
but at this moment the DP controller hasn't been brought out of the reset
state yet since the function zynqmp_dp_reset(dp, false) is called later and
this will result the system hang.

Releasing the reset to DP controller before any read/write operation to it
will fix this issue. And for symmetry, move zynqmp_dp_reset() call from
zynqmp_dp_phy_exit() to zynqmp_dp_remove().

Signed-off-by: Quanyang Wang 
Reviewed-by: Laurent Pinchart 
Signed-off-by: Laurent Pinchart 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/xlnx/zynqmp_dp.c | 22 --
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/drivers/gpu/drm/xlnx/zynqmp_dp.c b/drivers/gpu/drm/xlnx/zynqmp_dp.c
index 82430ca9b913..6f588dc09ba6 100644
--- a/drivers/gpu/drm/xlnx/zynqmp_dp.c
+++ b/drivers/gpu/drm/xlnx/zynqmp_dp.c
@@ -402,10 +402,6 @@ static int zynqmp_dp_phy_init(struct zynqmp_dp *dp)
}
}
 
-   ret = zynqmp_dp_reset(dp, false);
-   if (ret < 0)
-   return ret;
-
zynqmp_dp_clr(dp, ZYNQMP_DP_PHY_RESET, ZYNQMP_DP_PHY_RESET_ALL_RESET);
 
/*
@@ -441,8 +437,6 @@ static void zynqmp_dp_phy_exit(struct zynqmp_dp *dp)
ret);
}
 
-   zynqmp_dp_reset(dp, true);
-
for (i = 0; i < dp->num_lanes; i++) {
ret = phy_exit(dp->phy[i]);
if (ret)
@@ -1683,9 +1677,13 @@ int zynqmp_dp_probe(struct zynqmp_dpsub *dpsub, struct 
drm_device *drm)
return PTR_ERR(dp->reset);
}
 
+   ret = zynqmp_dp_reset(dp, false);
+   if (ret < 0)
+   return ret;
+
ret = zynqmp_dp_phy_probe(dp);
if (ret)
-   return ret;
+   goto err_reset;
 
/* Initialize the hardware. */
zynqmp_dp_write(dp, ZYNQMP_DP_TX_PHY_POWER_DOWN,
@@ -1697,7 +1695,7 @@ int zynqmp_dp_probe(struct zynqmp_dpsub *dpsub, struct 
drm_device *drm)
 
ret = zynqmp_dp_phy_init(dp);
if (ret)
-   return ret;
+   goto err_reset;
 
zynqmp_dp_write(dp, ZYNQMP_DP_TRANSMITTER_ENABLE, 1);
 
@@ -1709,15 +1707,18 @@ int zynqmp_dp_probe(struct zynqmp_dpsub *dpsub, struct 
drm_device *drm)
zynqmp_dp_irq_handler, IRQF_ONESHOT,
dev_name(dp->dev), dp);
if (ret < 0)
-   goto error;
+   goto err_phy_exit;
 
dev_dbg(dp->dev, "ZynqMP DisplayPort Tx probed with %u lanes\n",
dp->num_lanes);
 
return 0;
 
-error:
+err_phy_exit:
zynqmp_dp_phy_exit(dp);
+err_reset:
+   zynqmp_dp_reset(dp, true);
+
return ret;
 }
 
@@ -1735,4 +1736,5 @@ void zynqmp_dp_remove(struct zynqmp_dpsub *dpsub)
zynqmp_dp_write(dp, ZYNQMP_DP_INT_DS, 0x);
 
zynqmp_dp_phy_exit(dp);
+   zynqmp_dp_reset(dp, true);
 }
-- 
2.30.2



[PATCH AUTOSEL 5.14 129/252] drm: xlnx: zynqmp_dpsub: Call pm_runtime_get_sync before setting pixel clock

2021-09-09 Thread Sasha Levin
From: Quanyang Wang 

[ Upstream commit a19effb6dbe5bd1be77a6d68eba04dba8993ffeb ]

The Runtime PM subsystem will force the device "fd4a.zynqmp-display"
to enter suspend state while booting if the following conditions are met:
- the usage counter is zero (pm_runtime_get_sync hasn't been called yet)
- no 'active' children (no zynqmp-dp-snd-xx node under dpsub node)
- no other device in the same power domain (dpdma node has no
"power-domains = <&zynqmp_firmware PD_DP>" property)

So there is a scenario as below:
1) DP device enters suspend state   <- call zynqmp_gpd_power_off
2) zynqmp_disp_crtc_setup_clock <- configurate register VPLL_FRAC_CFG
3) pm_runtime_get_sync  <- call zynqmp_gpd_power_on and clear 
previous
   VPLL_FRAC_CFG configuration
4) clk_prepare_enable(disp->pclk)   <- enable failed since VPLL_FRAC_CFG
   configuration is corrupted

>From above, we can see that pm_runtime_get_sync may clear register
VPLL_FRAC_CFG configuration and result the failure of clk enabling.
Putting pm_runtime_get_sync at the very beginning of the function
zynqmp_disp_crtc_atomic_enable can resolve this issue.

Signed-off-by: Quanyang Wang 
Reviewed-by: Laurent Pinchart 
Signed-off-by: Laurent Pinchart 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/xlnx/zynqmp_disp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/xlnx/zynqmp_disp.c 
b/drivers/gpu/drm/xlnx/zynqmp_disp.c
index 109d627968ac..01c6ce7784dd 100644
--- a/drivers/gpu/drm/xlnx/zynqmp_disp.c
+++ b/drivers/gpu/drm/xlnx/zynqmp_disp.c
@@ -1452,9 +1452,10 @@ zynqmp_disp_crtc_atomic_enable(struct drm_crtc *crtc,
struct drm_display_mode *adjusted_mode = &crtc->state->adjusted_mode;
int ret, vrefresh;
 
+   pm_runtime_get_sync(disp->dev);
+
zynqmp_disp_crtc_setup_clock(crtc, adjusted_mode);
 
-   pm_runtime_get_sync(disp->dev);
ret = clk_prepare_enable(disp->pclk);
if (ret) {
dev_err(disp->dev, "failed to enable a pixel clock\n");
-- 
2.30.2



[PATCH AUTOSEL 5.14 135/252] drm/amd/display: fix missing writeback disablement if plane is removed

2021-09-09 Thread Sasha Levin
From: Roy Chan 

[ Upstream commit 82367e7f22d085092728f45fd5fbb15e3fb997c0 ]

[Why]
If the plane has been removed, the writeback disablement logic
doesn't run

[How]
fix the logic order

Acked-by: Anson Jacob 
Signed-off-by: Roy Chan 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 14 --
 drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 12 +++-
 2 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c 
b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
index 5c2853654cca..a47ba1d45be9 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
@@ -1723,13 +1723,15 @@ void dcn20_program_front_end_for_ctx(
 
pipe = pipe->bottom_pipe;
}
-   /* Program secondary blending tree and writeback pipes 
*/
-   pipe = &context->res_ctx.pipe_ctx[i];
-   if (!pipe->prev_odm_pipe && pipe->stream->num_wb_info > 0
-   && (pipe->update_flags.raw || 
pipe->plane_state->update_flags.raw || pipe->stream->update_flags.raw)
-   && 
hws->funcs.program_all_writeback_pipes_in_tree)
-   
hws->funcs.program_all_writeback_pipes_in_tree(dc, pipe->stream, context);
}
+   /* Program secondary blending tree and writeback pipes */
+   pipe = &context->res_ctx.pipe_ctx[i];
+   if (!pipe->top_pipe && !pipe->prev_odm_pipe
+   && pipe->stream && pipe->stream->num_wb_info > 0
+   && (pipe->update_flags.raw || 
(pipe->plane_state && pipe->plane_state->update_flags.raw)
+   || pipe->stream->update_flags.raw)
+   && 
hws->funcs.program_all_writeback_pipes_in_tree)
+   hws->funcs.program_all_writeback_pipes_in_tree(dc, 
pipe->stream, context);
}
 }
 
diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c 
b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
index 2e8ab9775fa3..fafed1e4a998 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
@@ -398,12 +398,22 @@ void dcn30_program_all_writeback_pipes_in_tree(
for (i_pipe = 0; i_pipe < dc->res_pool->pipe_count; 
i_pipe++) {
struct pipe_ctx *pipe_ctx = 
&context->res_ctx.pipe_ctx[i_pipe];
 
+   if (!pipe_ctx->plane_state)
+   continue;
+
if (pipe_ctx->plane_state == 
wb_info.writeback_source_plane) {
wb_info.mpcc_inst = 
pipe_ctx->plane_res.mpcc_inst;
break;
}
}
-   ASSERT(wb_info.mpcc_inst != -1);
+
+   if (wb_info.mpcc_inst == -1) {
+   /* Disable writeback pipe and disconnect from 
MPCC
+* if source plane has been removed
+*/
+   dc->hwss.disable_writeback(dc, 
wb_info.dwb_pipe_inst);
+   continue;
+   }
 
ASSERT(wb_info.dwb_pipe_inst < 
dc->res_pool->res_cap->num_dwb);
dwb = dc->res_pool->dwbc[wb_info.dwb_pipe_inst];
-- 
2.30.2



[PATCH AUTOSEL 5.14 136/252] drm/amd/display: fix incorrect CM/TF programming sequence in dwb

2021-09-09 Thread Sasha Levin
From: Roy Chan 

[ Upstream commit 781e1e23131cce56fb557e6ec2260480a6bd08cc ]

[How]
the programming sequeune was for old asic.
the correct programming sequeunce should be similar to the one
used in mpc. the fix is copied from the mpc programming sequeunce.

Reviewed-by: Anthony Koo 
Acked-by: Anson Jacob 
Signed-off-by: Roy Chan 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 .../drm/amd/display/dc/dcn30/dcn30_dwb_cm.c   | 90 +--
 1 file changed, 64 insertions(+), 26 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dwb_cm.c 
b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dwb_cm.c
index 3fe9e41e4dbd..6a3d3a0ec0a3 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dwb_cm.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dwb_cm.c
@@ -49,6 +49,11 @@
 static void dwb3_get_reg_field_ogam(struct dcn30_dwbc *dwbc30,
struct dcn3_xfer_func_reg *reg)
 {
+   reg->shifts.field_region_start_base = 
dwbc30->dwbc_shift->DWB_OGAM_RAMA_EXP_REGION_START_BASE_B;
+   reg->masks.field_region_start_base = 
dwbc30->dwbc_mask->DWB_OGAM_RAMA_EXP_REGION_START_BASE_B;
+   reg->shifts.field_offset = dwbc30->dwbc_shift->DWB_OGAM_RAMA_OFFSET_B;
+   reg->masks.field_offset = dwbc30->dwbc_mask->DWB_OGAM_RAMA_OFFSET_B;
+
reg->shifts.exp_region0_lut_offset = 
dwbc30->dwbc_shift->DWB_OGAM_RAMA_EXP_REGION0_LUT_OFFSET;
reg->masks.exp_region0_lut_offset = 
dwbc30->dwbc_mask->DWB_OGAM_RAMA_EXP_REGION0_LUT_OFFSET;
reg->shifts.exp_region0_num_segments = 
dwbc30->dwbc_shift->DWB_OGAM_RAMA_EXP_REGION0_NUM_SEGMENTS;
@@ -66,8 +71,6 @@ static void dwb3_get_reg_field_ogam(struct dcn30_dwbc *dwbc30,
reg->masks.field_region_end_base = 
dwbc30->dwbc_mask->DWB_OGAM_RAMA_EXP_REGION_END_BASE_B;
reg->shifts.field_region_linear_slope = 
dwbc30->dwbc_shift->DWB_OGAM_RAMA_EXP_REGION_START_SLOPE_B;
reg->masks.field_region_linear_slope = 
dwbc30->dwbc_mask->DWB_OGAM_RAMA_EXP_REGION_START_SLOPE_B;
-   reg->masks.field_offset = dwbc30->dwbc_mask->DWB_OGAM_RAMA_OFFSET_B;
-   reg->shifts.field_offset = dwbc30->dwbc_shift->DWB_OGAM_RAMA_OFFSET_B;
reg->shifts.exp_region_start = 
dwbc30->dwbc_shift->DWB_OGAM_RAMA_EXP_REGION_START_B;
reg->masks.exp_region_start = 
dwbc30->dwbc_mask->DWB_OGAM_RAMA_EXP_REGION_START_B;
reg->shifts.exp_resion_start_segment = 
dwbc30->dwbc_shift->DWB_OGAM_RAMA_EXP_REGION_START_SEGMENT_B;
@@ -147,18 +150,19 @@ static enum dc_lut_mode dwb3_get_ogam_current(
uint32_t state_mode;
uint32_t ram_select;
 
-   REG_GET(DWB_OGAM_CONTROL,
-   DWB_OGAM_MODE, &state_mode);
-   REG_GET(DWB_OGAM_CONTROL,
-   DWB_OGAM_SELECT, &ram_select);
+   REG_GET_2(DWB_OGAM_CONTROL,
+   DWB_OGAM_MODE_CURRENT, &state_mode,
+   DWB_OGAM_SELECT_CURRENT, &ram_select);
 
if (state_mode == 0) {
mode = LUT_BYPASS;
} else if (state_mode == 2) {
if (ram_select == 0)
mode = LUT_RAM_A;
-   else
+   else if (ram_select == 1)
mode = LUT_RAM_B;
+   else
+   mode = LUT_BYPASS;
} else {
// Reserved value
mode = LUT_BYPASS;
@@ -172,10 +176,10 @@ static void dwb3_configure_ogam_lut(
struct dcn30_dwbc *dwbc30,
bool is_ram_a)
 {
-   REG_UPDATE(DWB_OGAM_LUT_CONTROL,
-   DWB_OGAM_LUT_READ_COLOR_SEL, 7);
-   REG_UPDATE(DWB_OGAM_CONTROL,
-   DWB_OGAM_SELECT, is_ram_a == true ? 0 : 1);
+   REG_UPDATE_2(DWB_OGAM_LUT_CONTROL,
+   DWB_OGAM_LUT_WRITE_COLOR_MASK, 7,
+   DWB_OGAM_LUT_HOST_SEL, (is_ram_a == true) ? 0 : 1);
+
REG_SET(DWB_OGAM_LUT_INDEX, 0, DWB_OGAM_LUT_INDEX, 0);
 }
 
@@ -185,17 +189,45 @@ static void dwb3_program_ogam_pwl(struct dcn30_dwbc 
*dwbc30,
 {
uint32_t i;
 
-// triple base implementation
-   for (i = 0; i < num/2; i++) {
-   REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, 
rgb[2*i+0].red_reg);
-   REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, 
rgb[2*i+0].green_reg);
-   REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, 
rgb[2*i+0].blue_reg);
-   REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, 
rgb[2*i+1].red_reg);
-   REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, 
rgb[2*i+1].green_reg);
-   REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, 
rgb[2*i+1].blue_reg);
-   REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, 
rgb[2*i+2].red_reg);
-   REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, 
rgb[2*i+2].green_reg);
-   REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, 
rgb[2*i+2].blue_reg);
+   uint32_t last_base_value_red = rgb[num-1].red_reg + 
rgb[num-1].delta_red_reg;
+   uint32_t last_base_value_green = rgb[num-1

[PATCH AUTOSEL 5.14 138/252] drm/vmwgfx: fix potential UAF in vmwgfx_surface.c

2021-09-09 Thread Sasha Levin
From: Desmond Cheong Zhi Xi 

[ Upstream commit 2bc5da528dd570c5ecabc107e6fbdbc55974276f ]

drm_file.master should be protected by either drm_device.master_mutex
or drm_file.master_lookup_lock when being dereferenced. However,
drm_master_get is called on unprotected file_priv->master pointers in
vmw_surface_define_ioctl and vmw_gb_surface_define_internal.

This is fixed by replacing drm_master_get with drm_file_get_master.

Signed-off-by: Desmond Cheong Zhi Xi 
Reviewed-by: Daniel Vetter 
Reviewed-by: Zack Rusin 
Signed-off-by: Zack Rusin 
Link: 
https://patchwork.freedesktop.org/patch/msgid/20210724111824.59266-4-desmondcheon...@gmail.com
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c 
b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index 47c03a276515..a04ad7812960 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -865,7 +865,7 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void 
*data,
user_srf->prime.base.shareable = false;
user_srf->prime.base.tfile = NULL;
if (drm_is_primary_client(file_priv))
-   user_srf->master = drm_master_get(file_priv->master);
+   user_srf->master = drm_file_get_master(file_priv);
 
/**
 * From this point, the generic resource management functions
@@ -1534,7 +1534,7 @@ vmw_gb_surface_define_internal(struct drm_device *dev,
 
user_srf = container_of(srf, struct vmw_user_surface, srf);
if (drm_is_primary_client(file_priv))
-   user_srf->master = drm_master_get(file_priv->master);
+   user_srf->master = drm_file_get_master(file_priv);
 
res = &user_srf->srf.res;
 
-- 
2.30.2



[PATCH AUTOSEL 5.14 142/252] drm/msm/dp: reduce link rate if failed at link training 1

2021-09-09 Thread Sasha Levin
From: Kuogee Hsieh 

[ Upstream commit 4b85d405cfe938ae7ad61656484ae88dee289e3b ]

Reduce link rate and re start link training if link training 1
failed due to loss of clock recovery done to fix Link Layer
CTS case 4.3.1.7.  Also only update voltage and pre-emphasis
swing level after link training started to fix Link Layer CTS
case 4.3.1.6.

Changes in V2:
-- replaced cr_status with link_status[DP_LINK_STATUS_SIZE]
-- replaced dp_ctrl_any_lane_cr_done() with dp_ctrl_colco_recovery_any_ok()
-- replaced dp_ctrl_any_ane_cr_lose() with !drm_dp_clock_recovery_ok()

Changes in V3:
-- return failed if lane_count <= 1

Signed-off-by: Kuogee Hsieh 
Reviewed-by: Stephen Boyd 
Link: 
https://lore.kernel.org/r/1628196295-7382-3-git-send-email-khs...@codeaurora.org
[remove unused cr_status variable]
Signed-off-by: Rob Clark 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/msm/dp/dp_ctrl.c | 78 ++--
 1 file changed, 44 insertions(+), 34 deletions(-)

diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
index eaddfd739885..30d20e3beb29 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
@@ -81,13 +81,6 @@ struct dp_ctrl_private {
struct completion video_comp;
 };
 
-struct dp_cr_status {
-   u8 lane_0_1;
-   u8 lane_2_3;
-};
-
-#define DP_LANE0_1_CR_DONE 0x11
-
 static int dp_aux_link_configure(struct drm_dp_aux *aux,
struct dp_link_info *link)
 {
@@ -1078,7 +1071,7 @@ static int dp_ctrl_read_link_status(struct 
dp_ctrl_private *ctrl,
 }
 
 static int dp_ctrl_link_train_1(struct dp_ctrl_private *ctrl,
-   struct dp_cr_status *cr, int *training_step)
+   int *training_step)
 {
int tries, old_v_level, ret = 0;
u8 link_status[DP_LINK_STATUS_SIZE];
@@ -1107,9 +1100,6 @@ static int dp_ctrl_link_train_1(struct dp_ctrl_private 
*ctrl,
if (ret)
return ret;
 
-   cr->lane_0_1 = link_status[0];
-   cr->lane_2_3 = link_status[1];
-
if (drm_dp_clock_recovery_ok(link_status,
ctrl->link->link_params.num_lanes)) {
return 0;
@@ -1186,7 +1176,7 @@ static void dp_ctrl_clear_training_pattern(struct 
dp_ctrl_private *ctrl)
 }
 
 static int dp_ctrl_link_train_2(struct dp_ctrl_private *ctrl,
-   struct dp_cr_status *cr, int *training_step)
+   int *training_step)
 {
int tries = 0, ret = 0;
char pattern;
@@ -1202,10 +1192,6 @@ static int dp_ctrl_link_train_2(struct dp_ctrl_private 
*ctrl,
else
pattern = DP_TRAINING_PATTERN_2;
 
-   ret = dp_ctrl_update_vx_px(ctrl);
-   if (ret)
-   return ret;
-
ret = dp_catalog_ctrl_set_pattern(ctrl->catalog, pattern);
if (ret)
return ret;
@@ -1218,8 +1204,6 @@ static int dp_ctrl_link_train_2(struct dp_ctrl_private 
*ctrl,
ret = dp_ctrl_read_link_status(ctrl, link_status);
if (ret)
return ret;
-   cr->lane_0_1 = link_status[0];
-   cr->lane_2_3 = link_status[1];
 
if (drm_dp_channel_eq_ok(link_status,
ctrl->link->link_params.num_lanes)) {
@@ -1239,7 +1223,7 @@ static int dp_ctrl_link_train_2(struct dp_ctrl_private 
*ctrl,
 static int dp_ctrl_reinitialize_mainlink(struct dp_ctrl_private *ctrl);
 
 static int dp_ctrl_link_train(struct dp_ctrl_private *ctrl,
-   struct dp_cr_status *cr, int *training_step)
+   int *training_step)
 {
int ret = 0;
u8 encoding = DP_SET_ANSI_8B10B;
@@ -1255,7 +1239,7 @@ static int dp_ctrl_link_train(struct dp_ctrl_private 
*ctrl,
drm_dp_dpcd_write(ctrl->aux, DP_MAIN_LINK_CHANNEL_CODING_SET,
&encoding, 1);
 
-   ret = dp_ctrl_link_train_1(ctrl, cr, training_step);
+   ret = dp_ctrl_link_train_1(ctrl, training_step);
if (ret) {
DRM_ERROR("link training #1 failed. ret=%d\n", ret);
goto end;
@@ -1264,7 +1248,7 @@ static int dp_ctrl_link_train(struct dp_ctrl_private 
*ctrl,
/* print success info as this is a result of user initiated action */
DRM_DEBUG_DP("link training #1 successful\n");
 
-   ret = dp_ctrl_link_train_2(ctrl, cr, training_step);
+   ret = dp_ctrl_link_train_2(ctrl, training_step);
if (ret) {
DRM_ERROR("link training #2 failed. ret=%d\n", ret);
goto end;
@@ -1280,7 +1264,7 @@ static int dp_ctrl_link_train(struct dp_ctrl_private 
*ctrl,
 }
 
 static int dp_ctrl_setup_main_link(struct dp_ctrl_private *ctrl,
-   struct dp_cr_status *cr, int *training_step)
+   int *training_step)
 {
int ret = 0;
 
@@ -1295,7 +1279,7 @@ static int dp_ctrl_setup_main_link(struct dp_ctrl_private 
*c

[PATCH AUTOSEL 5.14 143/252] drm/msm/dp: reset aux controller after dp_aux_cmd_fifo_tx() failed.

2021-09-09 Thread Sasha Levin
From: Kuogee Hsieh 

[ Upstream commit 0b324564ff74fa0556002be8fbbace556b9b2ad0 ]

Aux hardware calibration sequence requires resetting the aux controller
in order for the new setting to take effect. However resetting the AUX
controller will also clear HPD interrupt status which may accidentally
cause pending unplug interrupt to get lost. Therefore reset aux
controller only when link is in connection state when dp_aux_cmd_fifo_tx()
fail. This fixes Link Layer CTS cases 4.2.1.1 and 4.2.1.2.

Signed-off-by: Kuogee Hsieh 
Reviewed-by: Stephen Boyd 
Link: 
https://lore.kernel.org/r/1628196295-7382-4-git-send-email-khs...@codeaurora.org
Signed-off-by: Rob Clark 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/msm/dp/dp_aux.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/msm/dp/dp_aux.c b/drivers/gpu/drm/msm/dp/dp_aux.c
index 4a3293b590b0..eb40d8413bca 100644
--- a/drivers/gpu/drm/msm/dp/dp_aux.c
+++ b/drivers/gpu/drm/msm/dp/dp_aux.c
@@ -353,6 +353,9 @@ static ssize_t dp_aux_transfer(struct drm_dp_aux *dp_aux,
if (!(aux->retry_cnt % MAX_AUX_RETRIES))
dp_catalog_aux_update_cfg(aux->catalog);
}
+   /* reset aux if link is in connected state */
+   if (dp_catalog_link_is_connected(aux->catalog))
+   dp_catalog_aux_reset(aux->catalog);
} else {
aux->retry_cnt = 0;
switch (aux->aux_error_num) {
-- 
2.30.2



[PATCH AUTOSEL 5.14 144/252] drm/msm/dp: return correct edid checksum after corrupted edid checksum read

2021-09-09 Thread Sasha Levin
From: Kuogee Hsieh 

[ Upstream commit 7948fe12d47a946fb8025a0534c900e3dd4b5839 ]

Response with correct edid checksum saved at connector after corrupted edid
checksum read. This fixes Link Layer CTS cases 4.2.2.3, 4.2.2.6.

Signed-off-by: Kuogee Hsieh 
Reviewed-by: Stephen Boyd 
Link: 
https://lore.kernel.org/r/1628196295-7382-6-git-send-email-khs...@codeaurora.org
Signed-off-by: Rob Clark 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/msm/dp/dp_panel.c | 9 +++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/msm/dp/dp_panel.c 
b/drivers/gpu/drm/msm/dp/dp_panel.c
index 440b32753430..2181b60e1d1d 100644
--- a/drivers/gpu/drm/msm/dp/dp_panel.c
+++ b/drivers/gpu/drm/msm/dp/dp_panel.c
@@ -271,7 +271,7 @@ static u8 dp_panel_get_edid_checksum(struct edid *edid)
 {
struct edid *last_block;
u8 *raw_edid;
-   bool is_edid_corrupt;
+   bool is_edid_corrupt = false;
 
if (!edid) {
DRM_ERROR("invalid edid input\n");
@@ -303,7 +303,12 @@ void dp_panel_handle_sink_request(struct dp_panel 
*dp_panel)
panel = container_of(dp_panel, struct dp_panel_private, dp_panel);
 
if (panel->link->sink_request & DP_TEST_LINK_EDID_READ) {
-   u8 checksum = dp_panel_get_edid_checksum(dp_panel->edid);
+   u8 checksum;
+
+   if (dp_panel->edid)
+   checksum = dp_panel_get_edid_checksum(dp_panel->edid);
+   else
+   checksum = dp_panel->connector->real_edid_checksum;
 
dp_link_send_edid_checksum(panel->link, checksum);
dp_link_send_test_response(panel->link);
-- 
2.30.2



[PATCH AUTOSEL 5.14 145/252] drm/msm/dp: do not end dp link training until video is ready

2021-09-09 Thread Sasha Levin
From: Kuogee Hsieh 

[ Upstream commit 2e0adc765d884cc080baa501e250bfad97035b09 ]

Initialize both pre-emphasis and voltage swing level to 0 before
start link training and do not end link training until video is
ready to reduce the period between end of link training and video
start to meet Link Layer CTS requirement.  Some dongle main link
symbol may become unlocked again if host did not end link training
soon enough after completion of link training 2. Host have to re
train main link if loss of symbol locked detected before end link
training so that the coming video stream can be transmitted to sink
properly. This fixes Link Layer CTS cases 4.3.2.1, 4.3.2.2, 4.3.2.3
and 4.3.2.4.

Changes in v3:
-- merge retrain link if loss of symbol locked happen into this patch
-- replace dp_ctrl_loss_symbol_lock() with dp_ctrl_channel_eq_ok()

Signed-off-by: Kuogee Hsieh 
Reviewed-by: Stephen Boyd 
Link: 
https://lore.kernel.org/r/1628196295-7382-7-git-send-email-khs...@codeaurora.org
Signed-off-by: Rob Clark 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/msm/dp/dp_ctrl.c | 56 +++-
 1 file changed, 41 insertions(+), 15 deletions(-)

diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
index 30d20e3beb29..6f5e45d54b26 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
@@ -1480,6 +1480,9 @@ static int dp_ctrl_link_maintenance(struct 
dp_ctrl_private *ctrl)
 
dp_ctrl_push_idle(&ctrl->dp_ctrl);
 
+   ctrl->link->phy_params.p_level = 0;
+   ctrl->link->phy_params.v_level = 0;
+
ctrl->dp_ctrl.pixel_rate = ctrl->panel->dp_mode.drm_mode.clock;
 
ret = dp_ctrl_setup_main_link(ctrl, &training_step);
@@ -1632,6 +1635,16 @@ static bool dp_ctrl_clock_recovery_any_ok(
return drm_dp_clock_recovery_ok(link_status, reduced_cnt);
 }
 
+static bool dp_ctrl_channel_eq_ok(struct dp_ctrl_private *ctrl)
+{
+   u8 link_status[DP_LINK_STATUS_SIZE];
+   int num_lanes = ctrl->link->link_params.num_lanes;
+
+   dp_ctrl_read_link_status(ctrl, link_status);
+
+   return drm_dp_channel_eq_ok(link_status, num_lanes);
+}
+
 int dp_ctrl_on_link(struct dp_ctrl *dp_ctrl)
 {
int rc = 0;
@@ -1666,6 +1679,9 @@ int dp_ctrl_on_link(struct dp_ctrl *dp_ctrl)
ctrl->link->link_params.rate,
ctrl->link->link_params.num_lanes, ctrl->dp_ctrl.pixel_rate);
 
+   ctrl->link->phy_params.p_level = 0;
+   ctrl->link->phy_params.v_level = 0;
+
rc = dp_ctrl_enable_mainlink_clocks(ctrl);
if (rc)
return rc;
@@ -1731,17 +1747,19 @@ int dp_ctrl_on_link(struct dp_ctrl *dp_ctrl)
if (ctrl->link->sink_request & DP_TEST_LINK_PHY_TEST_PATTERN)
return rc;
 
-   /* stop txing train pattern */
-   dp_ctrl_clear_training_pattern(ctrl);
+   if (rc == 0) {  /* link train successfully */
+   /*
+* do not stop train pattern here
+* stop link training at on_stream
+* to pass compliance test
+*/
+   } else  {
+   /*
+* link training failed
+* end txing train pattern here
+*/
+   dp_ctrl_clear_training_pattern(ctrl);
 
-   /*
-* keep transmitting idle pattern until video ready
-* to avoid main link from loss of sync
-*/
-   if (rc == 0)  /* link train successfully */
-   dp_ctrl_push_idle(dp_ctrl);
-   else  {
-   /* link training failed */
dp_ctrl_deinitialize_mainlink(ctrl);
rc = -ECONNRESET;
}
@@ -1749,9 +1767,15 @@ int dp_ctrl_on_link(struct dp_ctrl *dp_ctrl)
return rc;
 }
 
+static int dp_ctrl_link_retrain(struct dp_ctrl_private *ctrl)
+{
+   int training_step = DP_TRAINING_NONE;
+
+   return dp_ctrl_setup_main_link(ctrl, &training_step);
+}
+
 int dp_ctrl_on_stream(struct dp_ctrl *dp_ctrl)
 {
-   u32 rate = 0;
int ret = 0;
bool mainlink_ready = false;
struct dp_ctrl_private *ctrl;
@@ -1761,10 +1785,6 @@ int dp_ctrl_on_stream(struct dp_ctrl *dp_ctrl)
 
ctrl = container_of(dp_ctrl, struct dp_ctrl_private, dp_ctrl);
 
-   rate = ctrl->panel->link_info.rate;
-
-   ctrl->link->link_params.rate = rate;
-   ctrl->link->link_params.num_lanes = ctrl->panel->link_info.num_lanes;
ctrl->dp_ctrl.pixel_rate = ctrl->panel->dp_mode.drm_mode.clock;
 
DRM_DEBUG_DP("rate=%d, num_lanes=%d, pixel_rate=%d\n",
@@ -1779,6 +1799,12 @@ int dp_ctrl_on_stream(struct dp_ctrl *dp_ctrl)
}
}
 
+   if (!dp_ctrl_channel_eq_ok(ctrl))
+   dp_ctrl_link_retrain(ctrl);
+
+   /* stop txing train pattern to end link training */
+   dp_ctrl_clear_training_pattern(ctrl);
+
ret = dp_ctrl_enable_stream_clocks(ctrl);
if (ret) {
DRM_ERROR("Failed to start pixel clocks. r

[PATCH AUTOSEL 5.14 147/252] gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable access in amdgpu_i2c_router_select_ddc_port()

2021-09-09 Thread Sasha Levin
From: Tuo Li 

[ Upstream commit a211260c34cfadc6068fece8c9e99e0fe1e2a2b6 ]

The variable val is declared without initialization, and its address is
passed to amdgpu_i2c_get_byte(). In this function, the value of val is
accessed in:
  DRM_DEBUG("i2c 0x%02x 0x%02x read failed\n",
   addr, *val);

Also, when amdgpu_i2c_get_byte() returns, val may remain uninitialized,
but it is accessed in:
  val &= ~amdgpu_connector->router.ddc_mux_control_pin;

To fix this possible uninitialized-variable access, initialize val to 0 in
amdgpu_i2c_router_select_ddc_port().

Reported-by: TOTE Robot 
Signed-off-by: Tuo Li 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c
index bca45a15..82608df43396 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c
@@ -339,7 +339,7 @@ static void amdgpu_i2c_put_byte(struct amdgpu_i2c_chan 
*i2c_bus,
 void
 amdgpu_i2c_router_select_ddc_port(const struct amdgpu_connector 
*amdgpu_connector)
 {
-   u8 val;
+   u8 val = 0;
 
if (!amdgpu_connector->router.ddc_valid)
return;
-- 
2.30.2



[PATCH AUTOSEL 5.14 148/252] drm/display: fix possible null-pointer dereference in dcn10_set_clock()

2021-09-09 Thread Sasha Levin
From: Tuo Li 

[ Upstream commit 554594567b1fa3da74f88ec7b2dc83d000c58e98 ]

The variable dc->clk_mgr is checked in:
  if (dc->clk_mgr && dc->clk_mgr->funcs->get_clock)

This indicates dc->clk_mgr can be NULL.
However, it is dereferenced in:
if (!dc->clk_mgr->funcs->get_clock)

To fix this null-pointer dereference, check dc->clk_mgr and the function
pointer dc->clk_mgr->funcs->get_clock earlier, and return if one of them
is NULL.

Reported-by: TOTE Robot 
Signed-off-by: Tuo Li 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 .../gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 11 +--
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c 
b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index dee1ce5f9609..75fa4adcf5f4 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -3628,13 +3628,12 @@ enum dc_status dcn10_set_clock(struct dc *dc,
struct dc_clock_config clock_cfg = {0};
struct dc_clocks *current_clocks = &context->bw_ctx.bw.dcn.clk;
 
-   if (dc->clk_mgr && dc->clk_mgr->funcs->get_clock)
-   dc->clk_mgr->funcs->get_clock(dc->clk_mgr,
-   context, clock_type, 
&clock_cfg);
-
-   if (!dc->clk_mgr->funcs->get_clock)
+   if (!dc->clk_mgr || !dc->clk_mgr->funcs->get_clock)
return DC_FAIL_UNSUPPORTED_1;
 
+   dc->clk_mgr->funcs->get_clock(dc->clk_mgr,
+   context, clock_type, &clock_cfg);
+
if (clk_khz > clock_cfg.max_clock_khz)
return DC_FAIL_CLK_EXCEED_MAX;
 
@@ -3652,7 +3651,7 @@ enum dc_status dcn10_set_clock(struct dc *dc,
else
return DC_ERROR_UNEXPECTED;
 
-   if (dc->clk_mgr && dc->clk_mgr->funcs->update_clocks)
+   if (dc->clk_mgr->funcs->update_clocks)
dc->clk_mgr->funcs->update_clocks(dc->clk_mgr,
context, true);
return DC_OK;
-- 
2.30.2



[PATCH v5] drm/i915: Use Transparent Hugepages when IOMMU is enabled

2021-09-09 Thread Tvrtko Ursulin
From: Tvrtko Ursulin 

Usage of Transparent Hugepages was disabled in 9987da4b5dcf
("drm/i915: Disable THP until we have a GPU read BW W/A"), but since it
appears majority of performance regressions reported with an enabled IOMMU
can be almost eliminated by turning them on, lets just do that.

To err on the side of safety we keep the current default in cases where
IOMMU is not active, and only when it is default to the "huge=within_size"
mode. Although there probably would be wins to enable them throughout,
more extensive testing across benchmarks and platforms would need to be
done.

With the patch and IOMMU enabled my local testing on a small Skylake part
shows OglVSTangent regression being reduced from ~14% (IOMMU on versus
IOMMU off) to ~2% (same comparison but with THP on).

More detailed testing done in the below referenced Gitlab issue by Eero:

Skylake GT4e:

Performance drops from enabling IOMMU:

30-35% SynMark CSDof
20-25% Unigine Heaven, MemBW GPU write, SynMark VSTangent
~20% GLB Egypt  (1/2 screen window)
10-15% GLB T-Rex (1/2 screen window)
8-10% GfxBench T-Rex, MemBW GPU blit
7-8% SynMark DeferredAA + TerrainFly* + ZBuffer
6-7% GfxBench Manhattan 3.0 + 3.1, SynMark TexMem128 & CSCloth
5-6% GfxBench CarChase, Unigine Valley
3-5% GfxBench Vulkan & GL AztecRuins + ALU2, MemBW GPU texture,
 SynMark Fill*, Deferred, TerrainPan*
1-2% Most of the other tests

With the patch drops become:

20-25% SynMark TexMem*
15-20% GLB Egypt (1/2 screen window)
10-15% GLB T-Rex (1/2 screen window)
4-7% GfxBench T-Rex, GpuTest Triangle
1-8% GfxBench ALU2 (offscreen 1%, onscreen 8%)
3% GfxBench Manhattan 3.0, SynMark CSDof
2-3% Unigine Heaven + Valley, MemBW GPU texture
1-3 GfxBench Manhattan 3.1 + CarChase + Vulkan & GL AztecRuins

Broxton:

Performance drops from IOMMU, without patch:

30% MemBW GPU write
25% SynMark ZBuffer + Fill*
20% MemBW GPU blit
15% MemBW GPU blend, GpuTest Triangle
10-15% MemBW GPU texture
10% GLB Egypt, Unigine Heaven (had hangs), SynMark TerrainFly*
7-9% GLB T-Rex, GfxBench Manhattan 3.0 + T-Rex,
 SynMark Deferred* + TexMem*
6-8% GfxBench CarChase, Unigine Valley,
 SynMark CSCloth + ShMapVsm + TerrainPan*
5-6% GfxBench Manhattan 3.1 + GL AztecRuins,
 SynMark CSDof + TexFilterTri
2-4% GfxBench ALU2, SynMark DrvRes + GSCloth + ShMapPcf + Batch[0-5] +
 TexFilterAniso, GpuTest GiMark + 32-bit Julia

And with patch:

15-20% MemBW GPU texture
10% SynMark TexMem*
8-9% GLB Egypt (1/2 screen window)
4-5% GLB T-Rex (1/2 screen window)
3-6% GfxBench Manhattan 3.0, GpuTest FurMark,
 SynMark Deferred + TexFilterTri
3-4% GfxBench Manhattan 3.1 + T-Rex, SynMark VSInstancing
2-4% GpuTest Triangle, SynMark DeferredAA
2-3% Unigine Heaven + Valley
1-3% SynMark Terrain*
1-2% GfxBench CarChase, SynMark TexFilterAniso + ZBuffer

Tigerlake-H:

20-25% MemBW GPU texture
15-20% GpuTest Triangle
13-15% SynMark TerrainFly* + DeferredAA + HdrBloom
8-10% GfxBench Manhattan 3.1, SynMark TerrainPan* + DrvRes
6-7% GfxBench Manhattan 3.0, SynMark TexMem*
4-8% GLB onscreen Fill + T-Rex + Egypt (more in onscreen than
 offscreen versions of T-Rex/Egypt)
4-6% GfxBench CarChase + GLES AztecRuins + ALU2, GpuTest 32-bit Julia,
 SynMark CSDof + DrvState
3-5% GfxBench T-Rex + Egypt, Unigine Heaven + Valley, GpuTest Plot3D
1-7% Media tests
2-3% MemBW GPU blit
1-3% Most of the rest of 3D tests

With the patch:

6-8% MemBW GPU blend => the only regression in these tests (compared
 to IOMMU without THP)
4-6% SynMark DrvState (not impacted) + HdrBloom (improved)
3-4% GLB T-Rex
~3% GLB Egypt, SynMark DrvRes
1-3% GfxBench T-Rex + Egypt, SynMark TexFilterTri
1-2% GfxBench CarChase + GLES AztecRuins, Unigine Valley,
GpuTest Triangle
~1% GfxBench Manhattan 3.0/3.1, Unigine Heaven

Perf of several tests actually improved with IOMMU + THP, compared to no
IOMMU / no THP:

10-15% SynMark Batch[0-3]
5-10% MemBW GPU texture, SynMark ShMapVsm
3-4% SynMark Fill* + Geom*
2-3% SynMark TexMem512 + CSCloth
1-2% SynMark TexMem128 + DeferredAA

As a summary across all platforms, these are the benchmarks where enabling
THP on top of IOMMU enabled brings regressions:

 * Skylake GT4e:
   20-25% SynMark TexMem*
   (whereas all MemBW GPU tests either improve or are not affected)

 * Broxton J4205:
   7% MemBW GPU texture
   2-3% SynMark TexMem*

 * Tigerlake-H:
   7% MemBW GPU blend

Other benchmarks show either lowering of regressions or improvements.

v2:
 * Add Kconfig dependency to transparent hugepages and some help text.
 * Move to helper for easier handling of kernel build options.

v3:
 * Drop Kconfig. (Daniel)

v4:
 * Add some benchmark results to commit message.

v5:
 * Add explicit regression summary to commit message. (Eero)

[PATCH AUTOSEL 5.14 183/252] drm/exynos: Always initialize mapping in exynos_drm_register_dma()

2021-09-09 Thread Sasha Levin
From: Nathan Chancellor 

[ Upstream commit c626f386428bbe06476b0b497c1330aa4463 ]

In certain randconfigs, clang warns:

drivers/gpu/drm/exynos/exynos_drm_dma.c:121:19: warning: variable
'mapping' is uninitialized when used here [-Wuninitialized]
priv->mapping = mapping;
^~~
drivers/gpu/drm/exynos/exynos_drm_dma.c:111:16: note: initialize the
variable 'mapping' to silence this warning
void *mapping;
 ^
  = NULL
1 warning generated.

This occurs when CONFIG_EXYNOS_IOMMU is enabled and both
CONFIG_ARM_DMA_USE_IOMMU and CONFIG_IOMMU_DMA are disabled, which makes
the code look like

  void *mapping;

  if (0)
mapping = arm_iommu_create_mapping()
  else if (0)
mapping = iommu_get_domain_for_dev()

  ...
  priv->mapping = mapping;

Add an else branch that initializes mapping to the -ENODEV error pointer
so that there is no more warning and the driver does not change during
runtime.

Reported-by: kernel test robot 
Signed-off-by: Nathan Chancellor 
Signed-off-by: Inki Dae 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/exynos/exynos_drm_dma.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/exynos/exynos_drm_dma.c 
b/drivers/gpu/drm/exynos/exynos_drm_dma.c
index 0644936afee2..bf33c3084cb4 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dma.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dma.c
@@ -115,6 +115,8 @@ int exynos_drm_register_dma(struct drm_device *drm, struct 
device *dev,
EXYNOS_DEV_ADDR_START, EXYNOS_DEV_ADDR_SIZE);
else if (IS_ENABLED(CONFIG_IOMMU_DMA))
mapping = iommu_get_domain_for_dev(priv->dma_dev);
+   else
+   mapping = ERR_PTR(-ENODEV);
 
if (IS_ERR(mapping))
return PTR_ERR(mapping);
-- 
2.30.2



[PATCH AUTOSEL 5.14 225/252] drm/amdkfd: Account for SH/SE count when setting up cu masks.

2021-09-09 Thread Sasha Levin
From: Sean Keely 

[ Upstream commit 1ec06c2dee679e9f089e78ed20cb74ee90155f61 ]

On systems with multiple SH per SE compute_static_thread_mgmt_se#
is split into independent masks, one for each SH, in the upper and
lower 16 bits.  We need to detect this and apply cu masking to each
SH.  The cu mask bits are assigned first to each SE, then to
alternate SHs, then finally to higher CU id.  This ensures that
the maximum number of SPIs are engaged as early as possible while
balancing CU assignment to each SH.

v2: Use max SH/SE rather than max SH in cu_per_sh.

v3: Fix comment blocks, ensure se_mask is initially zero filled,
and correctly assign se.sh.cu positions to unset bits in cu_mask.

Signed-off-by: Sean Keely 
Reviewed-by: Felix Kuehling 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c | 84 +++-
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h |  1 +
 2 files changed, 64 insertions(+), 21 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c 
b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
index 88813dad731f..c021519af810 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
@@ -98,36 +98,78 @@ void mqd_symmetrically_map_cu_mask(struct mqd_manager *mm,
uint32_t *se_mask)
 {
struct kfd_cu_info cu_info;
-   uint32_t cu_per_se[KFD_MAX_NUM_SE] = {0};
-   int i, se, sh, cu = 0;
-
+   uint32_t cu_per_sh[KFD_MAX_NUM_SE][KFD_MAX_NUM_SH_PER_SE] = {0};
+   int i, se, sh, cu;
amdgpu_amdkfd_get_cu_info(mm->dev->kgd, &cu_info);
 
if (cu_mask_count > cu_info.cu_active_number)
cu_mask_count = cu_info.cu_active_number;
 
+   /* Exceeding these bounds corrupts the stack and indicates a coding 
error.
+* Returning with no CU's enabled will hang the queue, which should be
+* attention grabbing.
+*/
+   if (cu_info.num_shader_engines > KFD_MAX_NUM_SE) {
+   pr_err("Exceeded KFD_MAX_NUM_SE, chip reports %d\n", 
cu_info.num_shader_engines);
+   return;
+   }
+   if (cu_info.num_shader_arrays_per_engine > KFD_MAX_NUM_SH_PER_SE) {
+   pr_err("Exceeded KFD_MAX_NUM_SH, chip reports %d\n",
+   cu_info.num_shader_arrays_per_engine * 
cu_info.num_shader_engines);
+   return;
+   }
+   /* Count active CUs per SH.
+*
+* Some CUs in an SH may be disabled.   HW expects disabled CUs to be
+* represented in the high bits of each SH's enable mask (the upper and 
lower
+* 16 bits of se_mask) and will take care of the actual distribution of
+* disabled CUs within each SH automatically.
+* Each half of se_mask must be filled only on bits 
0-cu_per_sh[se][sh]-1.
+*
+* See note on Arcturus cu_bitmap layout in gfx_v9_0_get_cu_info.
+*/
for (se = 0; se < cu_info.num_shader_engines; se++)
for (sh = 0; sh < cu_info.num_shader_arrays_per_engine; sh++)
-   cu_per_se[se] += hweight32(cu_info.cu_bitmap[se % 4][sh 
+ (se / 4)]);
-
-   /* Symmetrically map cu_mask to all SEs:
-* cu_mask[0] bit0 -> se_mask[0] bit0;
-* cu_mask[0] bit1 -> se_mask[1] bit0;
-* ... (if # SE is 4)
-* cu_mask[0] bit4 -> se_mask[0] bit1;
+   cu_per_sh[se][sh] = hweight32(cu_info.cu_bitmap[se % 
4][sh + (se / 4)]);
+
+   /* Symmetrically map cu_mask to all SEs & SHs:
+* se_mask programs up to 2 SH in the upper and lower 16 bits.
+*
+* Examples
+* Assuming 1 SH/SE, 4 SEs:
+* cu_mask[0] bit0 -> se_mask[0] bit0
+* cu_mask[0] bit1 -> se_mask[1] bit0
+* ...
+* cu_mask[0] bit4 -> se_mask[0] bit1
+* ...
+*
+* Assuming 2 SH/SE, 4 SEs
+* cu_mask[0] bit0 -> se_mask[0] bit0 (SE0,SH0,CU0)
+* cu_mask[0] bit1 -> se_mask[1] bit0 (SE1,SH0,CU0)
+* ...
+* cu_mask[0] bit4 -> se_mask[0] bit16 (SE0,SH1,CU0)
+* cu_mask[0] bit5 -> se_mask[1] bit16 (SE1,SH1,CU0)
+* ...
+* cu_mask[0] bit8 -> se_mask[0] bit1 (SE0,SH0,CU1)
 * ...
+*
+* First ensure all CUs are disabled, then enable user specified CUs.
 */
-   se = 0;
-   for (i = 0; i < cu_mask_count; i++) {
-   if (cu_mask[i / 32] & (1 << (i % 32)))
-   se_mask[se] |= 1 << cu;
-
-   do {
-   se++;
-   if (se == cu_info.num_shader_engines) {
-   se = 0;
-   cu++;
+   for (i = 0; i < cu_info.num_shader_engines; i++)
+   se_mask[i] = 0;
+
+   i = 0;
+   for (cu = 0; cu < 16; cu++) {
+   for (sh = 0; sh < cu_info.num_shader_arrays_per_engine; sh++) {
+   for (se = 0; se < cu_info.num_sh

[PATCH AUTOSEL 5.13 001/219] drm/vmwgfx: Fix subresource updates with new contexts

2021-09-09 Thread Sasha Levin
From: Zack Rusin 

[ Upstream commit a12be0277316ed923411c9c80b2899ee74d2b033 ]

The has_dx variable was only set during the initialization which
meant that UPDATE_SUBRESOURCE was never used. We were emulating it
with UPDATE_GB_IMAGE but that's always been a stop-gap. Instead
of has_dx which has been deprecated a long time ago we need to check
for whether shader model 4.0 or newer is available to the device.

Signed-off-by: Zack Rusin 
Reviewed-by: Roland Scheidegger 
Reviewed-by: Martin Krastev 
Link: 
https://patchwork.freedesktop.org/patch/msgid/20210609172307.131929-4-za...@vmware.com
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c 
b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index beab3e19d8e2..5ff88f8c2382 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -1883,7 +1883,6 @@ static void vmw_surface_dirty_range_add(struct 
vmw_resource *res, size_t start,
 static int vmw_surface_dirty_sync(struct vmw_resource *res)
 {
struct vmw_private *dev_priv = res->dev_priv;
-   bool has_dx = 0;
u32 i, num_dirty;
struct vmw_surface_dirty *dirty =
(struct vmw_surface_dirty *) res->dirty;
@@ -1910,7 +1909,7 @@ static int vmw_surface_dirty_sync(struct vmw_resource 
*res)
if (!num_dirty)
goto out;
 
-   alloc_size = num_dirty * ((has_dx) ? sizeof(*cmd1) : sizeof(*cmd2));
+   alloc_size = num_dirty * ((has_sm4_context(dev_priv)) ? sizeof(*cmd1) : 
sizeof(*cmd2));
cmd = VMW_CMD_RESERVE(dev_priv, alloc_size);
if (!cmd)
return -ENOMEM;
@@ -1928,7 +1927,7 @@ static int vmw_surface_dirty_sync(struct vmw_resource 
*res)
 * DX_UPDATE_SUBRESOURCE is aware of array surfaces.
 * UPDATE_GB_IMAGE is not.
 */
-   if (has_dx) {
+   if (has_sm4_context(dev_priv)) {
cmd1->header.id = SVGA_3D_CMD_DX_UPDATE_SUBRESOURCE;
cmd1->header.size = sizeof(cmd1->body);
cmd1->body.sid = res->id;
-- 
2.30.2



[PATCH AUTOSEL 5.13 003/219] drm/vc4: hdmi: Set HD_CTL_WHOLSMP and HD_CTL_CHALIGN_SET

2021-09-09 Thread Sasha Levin
From: Dom Cobley 

[ Upstream commit 1698ecb218eb82587dbfc71a2e26ded66e5ecf59 ]

Symptom is random switching of speakers when using multichannel.

Repeatedly running speakertest -c8 occasionally starts with
channels jumbled. This is fixed with HD_CTL_WHOLSMP.

The other bit looks beneficial and apears harmless in testing so
I'd suggest adding it too.

Documentation says: HD_CTL_WHILSMP_SET
Wait for whole sample. When this bit is set MAI transmit will start
only when there is at least one whole sample available in the fifo.

Documentation says: HD_CTL_CHALIGN_SET
Channel Align When Overflow. This bit is used to realign the audio
channels in case of an overflow.
If this bit is set, after the detection of an overflow, equal
amount of dummy words to the missing words will be written to fifo,
filling up the broken sample and maintaining alignment.

Signed-off-by: Dom Cobley 
Signed-off-by: Maxime Ripard 
Reviewed-by: Nicolas Saenz Julienne 
Link: 
https://patchwork.freedesktop.org/patch/msgid/20210525132354.297468-7-max...@cerno.tech
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/vc4/vc4_hdmi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index edee565334d8..155f305e7c4e 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -1205,7 +1205,9 @@ static int vc4_hdmi_audio_trigger(struct 
snd_pcm_substream *substream, int cmd,
HDMI_WRITE(HDMI_MAI_CTL,
   VC4_SET_FIELD(vc4_hdmi->audio.channels,
 VC4_HD_MAI_CTL_CHNUM) |
-  VC4_HD_MAI_CTL_ENABLE);
+VC4_HD_MAI_CTL_WHOLSMP |
+VC4_HD_MAI_CTL_CHALIGN |
+VC4_HD_MAI_CTL_ENABLE);
break;
case SNDRV_PCM_TRIGGER_STOP:
HDMI_WRITE(HDMI_MAI_CTL,
-- 
2.30.2



[PATCH AUTOSEL 5.13 002/219] drm/vmwgfx: Fix some static checker warnings

2021-09-09 Thread Sasha Levin
From: Zack Rusin 

[ Upstream commit 74231041d14030f1ae6582b9233bfe782ac23e33 ]

Fix some minor issues that Coverity spotted in the code. None
of that are serious but they're all valid concerns so fixing
them makes sense.

Signed-off-by: Zack Rusin 
Reviewed-by: Roland Scheidegger 
Reviewed-by: Martin Krastev 
Link: 
https://patchwork.freedesktop.org/patch/msgid/20210609172307.131929-5-za...@vmware.com
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/vmwgfx/ttm_memory.c|  2 ++
 drivers/gpu/drm/vmwgfx/vmwgfx_binding.c| 20 
 drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c |  2 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c |  4 +++-
 drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c|  2 ++
 drivers/gpu/drm/vmwgfx/vmwgfx_mob.c|  4 +++-
 drivers/gpu/drm/vmwgfx/vmwgfx_msg.c|  6 --
 drivers/gpu/drm/vmwgfx/vmwgfx_resource.c   |  8 ++--
 drivers/gpu/drm/vmwgfx/vmwgfx_so.c |  3 ++-
 drivers/gpu/drm/vmwgfx/vmwgfx_validation.c |  4 ++--
 10 files changed, 33 insertions(+), 22 deletions(-)

diff --git a/drivers/gpu/drm/vmwgfx/ttm_memory.c 
b/drivers/gpu/drm/vmwgfx/ttm_memory.c
index aeb0a22a2c34..edd17c30d5a5 100644
--- a/drivers/gpu/drm/vmwgfx/ttm_memory.c
+++ b/drivers/gpu/drm/vmwgfx/ttm_memory.c
@@ -435,8 +435,10 @@ int ttm_mem_global_init(struct ttm_mem_global *glob, 
struct device *dev)
 
si_meminfo(&si);
 
+   spin_lock(&glob->lock);
/* set it as 0 by default to keep original behavior of OOM */
glob->lower_mem_limit = 0;
+   spin_unlock(&glob->lock);
 
ret = ttm_mem_init_kernel_zone(glob, &si);
if (unlikely(ret != 0))
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_binding.c 
b/drivers/gpu/drm/vmwgfx/vmwgfx_binding.c
index 81f525a82b77..4e7de45407c8 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_binding.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_binding.c
@@ -715,7 +715,7 @@ static int vmw_binding_scrub_cb(struct vmw_ctx_bindinfo 
*bi, bool rebind)
  * without checking which bindings actually need to be emitted
  *
  * @cbs: Pointer to the context's struct vmw_ctx_binding_state
- * @bi: Pointer to where the binding info array is stored in @cbs
+ * @biv: Pointer to where the binding info array is stored in @cbs
  * @max_num: Maximum number of entries in the @bi array.
  *
  * Scans the @bi array for bindings and builds a buffer of view id data.
@@ -725,11 +725,9 @@ static int vmw_binding_scrub_cb(struct vmw_ctx_bindinfo 
*bi, bool rebind)
  * contains the command data.
  */
 static void vmw_collect_view_ids(struct vmw_ctx_binding_state *cbs,
-const struct vmw_ctx_bindinfo *bi,
+const struct vmw_ctx_bindinfo_view *biv,
 u32 max_num)
 {
-   const struct vmw_ctx_bindinfo_view *biv =
-   container_of(bi, struct vmw_ctx_bindinfo_view, bi);
unsigned long i;
 
cbs->bind_cmd_count = 0;
@@ -838,7 +836,7 @@ static int vmw_emit_set_sr(struct vmw_ctx_binding_state 
*cbs,
  */
 static int vmw_emit_set_rt(struct vmw_ctx_binding_state *cbs)
 {
-   const struct vmw_ctx_bindinfo *loc = &cbs->render_targets[0].bi;
+   const struct vmw_ctx_bindinfo_view *loc = &cbs->render_targets[0];
struct {
SVGA3dCmdHeader header;
SVGA3dCmdDXSetRenderTargets body;
@@ -874,7 +872,7 @@ static int vmw_emit_set_rt(struct vmw_ctx_binding_state 
*cbs)
  * without checking which bindings actually need to be emitted
  *
  * @cbs: Pointer to the context's struct vmw_ctx_binding_state
- * @bi: Pointer to where the binding info array is stored in @cbs
+ * @biso: Pointer to where the binding info array is stored in @cbs
  * @max_num: Maximum number of entries in the @bi array.
  *
  * Scans the @bi array for bindings and builds a buffer of SVGA3dSoTarget data.
@@ -884,11 +882,9 @@ static int vmw_emit_set_rt(struct vmw_ctx_binding_state 
*cbs)
  * contains the command data.
  */
 static void vmw_collect_so_targets(struct vmw_ctx_binding_state *cbs,
-  const struct vmw_ctx_bindinfo *bi,
+  const struct vmw_ctx_bindinfo_so_target 
*biso,
   u32 max_num)
 {
-   const struct vmw_ctx_bindinfo_so_target *biso =
-   container_of(bi, struct vmw_ctx_bindinfo_so_target, bi);
unsigned long i;
SVGA3dSoTarget *so_buffer = (SVGA3dSoTarget *) cbs->bind_cmd_buffer;
 
@@ -919,7 +915,7 @@ static void vmw_collect_so_targets(struct 
vmw_ctx_binding_state *cbs,
  */
 static int vmw_emit_set_so_target(struct vmw_ctx_binding_state *cbs)
 {
-   const struct vmw_ctx_bindinfo *loc = &cbs->so_targets[0].bi;
+   const struct vmw_ctx_bindinfo_so_target *loc = &cbs->so_targets[0];
struct {
SVGA3dCmdHeader header;
SVGA3dCmdDXSetSOTargets body;
@@ -1066,7 +1062,7 @@ static int vmw_emit_set_vb(struct vmw_ctx_binding_state 
*cbs)
 
 static int vmw_emit_set_uav(

[PATCH AUTOSEL 5.13 004/219] drm/omap: Follow implicit fencing in prepare_fb

2021-09-09 Thread Sasha Levin
From: Daniel Vetter 

[ Upstream commit 942d8344d5f14b9ea2ae43756f319b9f44216ba4 ]

I guess no one ever tried running omap together with lima or panfrost,
not even sure that's possible. Anyway for consistency, fix this.

Reviewed-by: Tomi Valkeinen 
Signed-off-by: Daniel Vetter 
Cc: Tomi Valkeinen 
Link: 
https://patchwork.freedesktop.org/patch/msgid/20210622165511.3169559-12-daniel.vet...@ffwll.ch
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/omapdrm/omap_plane.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/omapdrm/omap_plane.c 
b/drivers/gpu/drm/omapdrm/omap_plane.c
index 801da917507d..512af976b7e9 100644
--- a/drivers/gpu/drm/omapdrm/omap_plane.c
+++ b/drivers/gpu/drm/omapdrm/omap_plane.c
@@ -6,6 +6,7 @@
 
 #include 
 #include 
+#include 
 #include 
 
 #include "omap_dmm_tiler.h"
@@ -29,6 +30,8 @@ static int omap_plane_prepare_fb(struct drm_plane *plane,
if (!new_state->fb)
return 0;
 
+   drm_gem_plane_helper_prepare_fb(plane, new_state);
+
return omap_framebuffer_pin(new_state->fb);
 }
 
-- 
2.30.2



[PATCH AUTOSEL 5.13 005/219] drm/amdgpu: Fix amdgpu_ras_eeprom_init()

2021-09-09 Thread Sasha Levin
From: Luben Tuikov 

[ Upstream commit dce4400e6516d18313d23de45b5be8a18980b00e ]

No need to account for the 2 bytes of EEPROM
address--this is now well abstracted away by
the fixes the the lower layers.

Cc: Andrey Grodzovsky 
Cc: Alexander Deucher 
Signed-off-by: Luben Tuikov 
Acked-by: Alexander Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
index f40c871da0c6..fb701c4fd5c5 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
@@ -321,7 +321,7 @@ int amdgpu_ras_eeprom_init(struct amdgpu_ras_eeprom_control 
*control,
return ret;
}
 
-   __decode_table_header_from_buff(hdr, &buff[2]);
+   __decode_table_header_from_buff(hdr, buff);
 
if (hdr->header == EEPROM_TABLE_HDR_VAL) {
control->num_recs = (hdr->tbl_size - EEPROM_TABLE_HEADER_SIZE) /
-- 
2.30.2



[PATCH AUTOSEL 5.13 012/219] drm/vkms: Let shadow-plane helpers prepare the plane's FB

2021-09-09 Thread Sasha Levin
From: Thomas Zimmermann 

[ Upstream commit b43e2ec03b0de040d536591713ea9c875ff34ba9 ]

Replace vkms' prepare_fb and cleanup_fb functions with the generic
code for shadow-buffered planes. No functional changes.

This change also fixes a problem where IGT kms_flip tests would
create a segmentation fault within vkms. The driver's prepare_fb
function did not report an error if a BO's vmap operation failed.
The kernel later tried to operate on the non-mapped memory areas.
The shared shadow-plane helpers handle errors correctly, so that
the driver now avoids the segmantation fault.

v2:
* include paragraph about IGT tests in commit message (Melissa)

Signed-off-by: Thomas Zimmermann 
Reviewed-by: Melissa Wen 
Link: 
https://patchwork.freedesktop.org/patch/msgid/20210705074633.9425-4-tzimmerm...@suse.de
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/vkms/vkms_plane.c | 38 +--
 1 file changed, 1 insertion(+), 37 deletions(-)

diff --git a/drivers/gpu/drm/vkms/vkms_plane.c 
b/drivers/gpu/drm/vkms/vkms_plane.c
index 6d310d31b75d..1b10ab2b80a3 100644
--- a/drivers/gpu/drm/vkms/vkms_plane.c
+++ b/drivers/gpu/drm/vkms/vkms_plane.c
@@ -8,7 +8,6 @@
 #include 
 #include 
 #include 
-#include 
 
 #include "vkms_drv.h"
 
@@ -150,45 +149,10 @@ static int vkms_plane_atomic_check(struct drm_plane 
*plane,
return 0;
 }
 
-static int vkms_prepare_fb(struct drm_plane *plane,
-  struct drm_plane_state *state)
-{
-   struct drm_gem_object *gem_obj;
-   struct dma_buf_map map;
-   int ret;
-
-   if (!state->fb)
-   return 0;
-
-   gem_obj = drm_gem_fb_get_obj(state->fb, 0);
-   ret = drm_gem_shmem_vmap(gem_obj, &map);
-   if (ret)
-   DRM_ERROR("vmap failed: %d\n", ret);
-
-   return drm_gem_plane_helper_prepare_fb(plane, state);
-}
-
-static void vkms_cleanup_fb(struct drm_plane *plane,
-   struct drm_plane_state *old_state)
-{
-   struct drm_gem_object *gem_obj;
-   struct drm_gem_shmem_object *shmem_obj;
-   struct dma_buf_map map;
-
-   if (!old_state->fb)
-   return;
-
-   gem_obj = drm_gem_fb_get_obj(old_state->fb, 0);
-   shmem_obj = to_drm_gem_shmem_obj(drm_gem_fb_get_obj(old_state->fb, 0));
-   dma_buf_map_set_vaddr(&map, shmem_obj->vaddr);
-   drm_gem_shmem_vunmap(gem_obj, &map);
-}
-
 static const struct drm_plane_helper_funcs vkms_primary_helper_funcs = {
.atomic_update  = vkms_plane_atomic_update,
.atomic_check   = vkms_plane_atomic_check,
-   .prepare_fb = vkms_prepare_fb,
-   .cleanup_fb = vkms_cleanup_fb,
+   DRM_GEM_SHADOW_PLANE_HELPER_FUNCS,
 };
 
 struct drm_plane *vkms_plane_init(struct vkms_device *vkmsdev,
-- 
2.30.2



[PATCH AUTOSEL 5.13 022/219] video: fbdev: kyro: fix a DoS bug by restricting user input

2021-09-09 Thread Sasha Levin
From: Zheyu Ma 

[ Upstream commit 98a65439172dc69cb16834e62e852afc2adb83ed ]

The user can pass in any value to the driver through the 'ioctl'
interface. The driver dost not check, which may cause DoS bugs.

The following log reveals it:

divide error:  [#1] PREEMPT SMP KASAN PTI
RIP: 0010:SetOverlayViewPort+0x133/0x5f0 
drivers/video/fbdev/kyro/STG4000OverlayDevice.c:476
Call Trace:
 kyro_dev_overlay_viewport_set drivers/video/fbdev/kyro/fbdev.c:378 [inline]
 kyrofb_ioctl+0x2eb/0x330 drivers/video/fbdev/kyro/fbdev.c:603
 do_fb_ioctl+0x1f3/0x700 drivers/video/fbdev/core/fbmem.c:1171
 fb_ioctl+0xeb/0x130 drivers/video/fbdev/core/fbmem.c:1185
 vfs_ioctl fs/ioctl.c:48 [inline]
 __do_sys_ioctl fs/ioctl.c:753 [inline]
 __se_sys_ioctl fs/ioctl.c:739 [inline]
 __x64_sys_ioctl+0x19b/0x220 fs/ioctl.c:739
 do_syscall_64+0x32/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Signed-off-by: Zheyu Ma 
Signed-off-by: Sam Ravnborg 
Link: 
https://patchwork.freedesktop.org/patch/msgid/1626235762-2590-1-git-send-email-zheyum...@gmail.com
Signed-off-by: Sasha Levin 
---
 drivers/video/fbdev/kyro/fbdev.c | 5 +
 1 file changed, 5 insertions(+)

diff --git a/drivers/video/fbdev/kyro/fbdev.c b/drivers/video/fbdev/kyro/fbdev.c
index 8fbde92ae8b9..4b8c7c16b1df 100644
--- a/drivers/video/fbdev/kyro/fbdev.c
+++ b/drivers/video/fbdev/kyro/fbdev.c
@@ -372,6 +372,11 @@ static int kyro_dev_overlay_viewport_set(u32 x, u32 y, u32 
ulWidth, u32 ulHeight
/* probably haven't called CreateOverlay yet */
return -EINVAL;
 
+   if (ulWidth == 0 || ulWidth == 0x ||
+   ulHeight == 0 || ulHeight == 0x ||
+   (x < 2 && ulWidth + 2 == 0))
+   return -EINVAL;
+
/* Stop Ramdac Output */
DisableRamdacOutput(deviceInfo.pSTGReg);
 
-- 
2.30.2



[PATCH AUTOSEL 5.13 023/219] drm/ast: Disable fast reset after DRAM initial

2021-09-09 Thread Sasha Levin
From: KuoHsiang Chou 

[ Upstream commit f34bf652d680cf65783e7c57d61c94ee87f092bd ]

[Bug][AST2500]

V1:
When AST2500 acts as stand-alone VGA so that DRAM and DVO initialization
have to be achieved by VGA driver with P2A (PCI to AHB) enabling.
However, HW suggests disable Fast reset mode after DRAM initializaton,
because fast reset mode is mainly designed for ARM ICE debugger.
Once Fast reset is checked as enabling, WDT (Watch Dog Timer) should be
first enabled to avoid system deadlock before disable fast reset mode.

V2:
Use to_pci_dev() to get revision of PCI configuration.

V3:
If SCU00 is not unlocked, just enter its password again.
It is unnecessary to clear AHB lock condition and restore WDT default
setting again, before Fast-reset clearing.

V4:
repatch after "error : could not build fake ancestor" resolved.

V5:
Since CVE_2019_6260 item3, Most of AST2500 have disabled P2A(PCIe to AMBA).
However, for backward compatibility, some patches about P2A, such as items
of v5.2 and v5.3, are considered to be upstreamed with comments.
1. Add define macro to improve source readability.
ast_drv.h, ast_main.c, ast_post.c
2. Add comment about "Fast restet" is enabled for ARM-ICE debugger
ast_post.c
3. Add comment about Reset USB port to patch USB unknown device issue
ast_post.c

Signed-off-by: KuoHsiang Chou 
Signed-off-by: Thomas Zimmermann 
Link: 
https://patchwork.freedesktop.org/patch/msgid/20210709080900.4056-1-kuohsiang_c...@aspeedtech.com
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/ast/ast_drv.h  |  6 +++
 drivers/gpu/drm/ast/ast_main.c |  5 ++
 drivers/gpu/drm/ast/ast_post.c | 91 --
 3 files changed, 76 insertions(+), 26 deletions(-)

diff --git a/drivers/gpu/drm/ast/ast_drv.h b/drivers/gpu/drm/ast/ast_drv.h
index 911f9f414774..39ca338eb80b 100644
--- a/drivers/gpu/drm/ast/ast_drv.h
+++ b/drivers/gpu/drm/ast/ast_drv.h
@@ -337,6 +337,11 @@ int ast_mode_config_init(struct ast_private *ast);
 #define AST_DP501_LINKRATE 0xf014
 #define AST_DP501_EDID_DATA0xf020
 
+/* Define for Soc scratched reg */
+#define AST_VRAM_INIT_STATUS_MASK  GENMASK(7, 6)
+//#define AST_VRAM_INIT_BY_BMC BIT(7)
+//#define AST_VRAM_INIT_READY  BIT(6)
+
 int ast_mm_init(struct ast_private *ast);
 
 /* ast post */
@@ -346,6 +351,7 @@ bool ast_is_vga_enabled(struct drm_device *dev);
 void ast_post_gpu(struct drm_device *dev);
 u32 ast_mindwm(struct ast_private *ast, u32 r);
 void ast_moutdwm(struct ast_private *ast, u32 r, u32 v);
+void ast_patch_ahb_2500(struct ast_private *ast);
 /* ast dp501 */
 void ast_set_dp501_video_output(struct drm_device *dev, u8 mode);
 bool ast_backup_fw(struct drm_device *dev, u8 *addr, u32 size);
diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
index 2aff2e6cf450..79a361867955 100644
--- a/drivers/gpu/drm/ast/ast_main.c
+++ b/drivers/gpu/drm/ast/ast_main.c
@@ -97,6 +97,11 @@ static void ast_detect_config_mode(struct drm_device *dev, 
u32 *scu_rev)
jregd0 = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xd0, 0xff);
jregd1 = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xd1, 0xff);
if (!(jregd0 & 0x80) || !(jregd1 & 0x10)) {
+   /* Patch AST2500 */
+   if (((pdev->revision & 0xF0) == 0x40)
+   && ((jregd0 & AST_VRAM_INIT_STATUS_MASK) == 0))
+   ast_patch_ahb_2500(ast);
+
/* Double check it's actually working */
data = ast_read32(ast, 0xf004);
if ((data != 0x) && (data != 0x00)) {
diff --git a/drivers/gpu/drm/ast/ast_post.c b/drivers/gpu/drm/ast/ast_post.c
index 0607658dde51..b5d92f652fd8 100644
--- a/drivers/gpu/drm/ast/ast_post.c
+++ b/drivers/gpu/drm/ast/ast_post.c
@@ -2028,6 +2028,40 @@ static bool ast_dram_init_2500(struct ast_private *ast)
return true;
 }
 
+void ast_patch_ahb_2500(struct ast_private *ast)
+{
+   u32 data;
+
+   /* Clear bus lock condition */
+   ast_moutdwm(ast, 0x1e60, 0xAEED1A03);
+   ast_moutdwm(ast, 0x1e600084, 0x0001);
+   ast_moutdwm(ast, 0x1e600088, 0x);
+   ast_moutdwm(ast, 0x1e6e2000, 0x1688A8A8);
+   data = ast_mindwm(ast, 0x1e6e2070);
+   if (data & 0x0800) {/* 
check fast reset */
+   /*
+* If "Fast restet" is enabled for ARM-ICE debugger,
+* then WDT needs to enable, that
+* WDT04 is WDT#1 Reload reg.
+* WDT08 is WDT#1 counter restart reg to avoid system deadlock
+* WDT0C is WDT#1 control reg
+*  [6:5]:= 01:Full chip
+*  [4]:= 1:1MHz clock source
+*  [1]:= 1:WDT will be cleeared and disabled after timeout 
occurs
+*  [0]:= 1:WDT enable
+*/
+   ast_moutdwm(ast, 0x1E785004, 0x0010);
+   ast_moutdwm(ast, 0x1E785008, 0x4755);
+

[PATCH AUTOSEL 5.13 027/219] drm: avoid blocking in drm_clients_info's rcu section

2021-09-09 Thread Sasha Levin
From: Desmond Cheong Zhi Xi 

[ Upstream commit 5eff9585de220cdd131237f5665db5e6c6bdf590 ]

Inside drm_clients_info, the rcu_read_lock is held to lock
pid_task()->comm. However, within this protected section, a call to
drm_is_current_master is made, which involves a mutex lock in a future
patch. However, this is illegal because the mutex lock might block
while in the RCU read-side critical section.

Since drm_is_current_master isn't protected by rcu_read_lock, we avoid
this by moving it out of the RCU critical section.

The following report came from intel-gfx ci's
igt@debugfs_test@read_all_entries testcase:

=
[ BUG: Invalid wait context ]
5.13.0-CI-Patchwork_20515+ #1 Tainted: GW
-
debugfs_test/1101 is trying to lock:
888132d901a8 (&dev->master_mutex){+.+.}-{3:3}, at:
drm_is_current_master+0x1e/0x50
other info that might help us debug this:
context-{4:4}
3 locks held by debugfs_test/1101:
 #0: 88810fdffc90 (&p->lock){+.+.}-{3:3}, at:
 seq_read_iter+0x53/0x3b0
 #1: 888132d90240 (&dev->filelist_mutex){+.+.}-{3:3}, at:
 drm_clients_info+0x63/0x2a0
 #2: 82734220 (rcu_read_lock){}-{1:2}, at:
 drm_clients_info+0x1b1/0x2a0
stack backtrace:
CPU: 8 PID: 1101 Comm: debugfs_test Tainted: GW
5.13.0-CI-Patchwork_20515+ #1
Hardware name: Intel Corporation CometLake Client Platform/CometLake S
UDIMM (ERB/CRB), BIOS CMLSFWR1.R00.1263.D00.1906260926 06/26/2019
Call Trace:
 dump_stack+0x7f/0xad
 __lock_acquire.cold.78+0x2af/0x2ca
 lock_acquire+0xd3/0x300
 ? drm_is_current_master+0x1e/0x50
 ? __mutex_lock+0x76/0x970
 ? lockdep_hardirqs_on+0xbf/0x130
 __mutex_lock+0xab/0x970
 ? drm_is_current_master+0x1e/0x50
 ? drm_is_current_master+0x1e/0x50
 ? drm_is_current_master+0x1e/0x50
 drm_is_current_master+0x1e/0x50
 drm_clients_info+0x107/0x2a0
 seq_read_iter+0x178/0x3b0
 seq_read+0x104/0x150
 full_proxy_read+0x4e/0x80
 vfs_read+0xa5/0x1b0
 ksys_read+0x5a/0xd0
 do_syscall_64+0x39/0xb0
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Signed-off-by: Desmond Cheong Zhi Xi 
Signed-off-by: Daniel Vetter 
Link: 
https://patchwork.freedesktop.org/patch/msgid/20210712043508.11584-3-desmondcheon...@gmail.com
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/drm_debugfs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c
index 3d7182001004..b0a826489488 100644
--- a/drivers/gpu/drm/drm_debugfs.c
+++ b/drivers/gpu/drm/drm_debugfs.c
@@ -91,6 +91,7 @@ static int drm_clients_info(struct seq_file *m, void *data)
mutex_lock(&dev->filelist_mutex);
list_for_each_entry_reverse(priv, &dev->filelist, lhead) {
struct task_struct *task;
+   bool is_current_master = drm_is_current_master(priv);
 
rcu_read_lock(); /* locks pid_task()->comm */
task = pid_task(priv->pid, PIDTYPE_PID);
@@ -99,7 +100,7 @@ static int drm_clients_info(struct seq_file *m, void *data)
   task ? task->comm : "",
   pid_vnr(priv->pid),
   priv->minor->index,
-  drm_is_current_master(priv) ? 'y' : 'n',
+  is_current_master ? 'y' : 'n',
   priv->authenticated ? 'y' : 'n',
   from_kuid_munged(seq_user_ns(m), uid),
   priv->magic);
-- 
2.30.2



[PATCH AUTOSEL 5.13 028/219] drm: serialize drm_file.master with a new spinlock

2021-09-09 Thread Sasha Levin
From: Desmond Cheong Zhi Xi 

[ Upstream commit 0b0860a3cf5eccf183760b1177a1dcdb821b0b66 ]

Currently, drm_file.master pointers should be protected by
drm_device.master_mutex when being dereferenced. This is because
drm_file.master is not invariant for the lifetime of drm_file. If
drm_file is not the creator of master, then drm_file.is_master is
false, and a call to drm_setmaster_ioctl will invoke
drm_new_set_master, which then allocates a new master for drm_file and
puts the old master.

Thus, without holding drm_device.master_mutex, the old value of
drm_file.master could be freed while it is being used by another
concurrent process.

However, it is not always possible to lock drm_device.master_mutex to
dereference drm_file.master. Through the fbdev emulation code, this
might occur in a deep nest of other locks. But drm_device.master_mutex
is also the outermost lock in the nesting hierarchy, so this leads to
potential deadlocks.

To address this, we introduce a new spin lock at the bottom of the
lock hierarchy that only serializes drm_file.master. With this change,
the value of drm_file.master changes only when both
drm_device.master_mutex and drm_file.master_lookup_lock are
held. Hence, any process holding either of those locks can ensure that
the value of drm_file.master will not change concurrently.

Since no lock depends on the new drm_file.master_lookup_lock, when
drm_file.master is dereferenced, but drm_device.master_mutex cannot be
held, we can safely protect the master pointer with
drm_file.master_lookup_lock.

Reported-by: Daniel Vetter 
Signed-off-by: Desmond Cheong Zhi Xi 
Signed-off-by: Daniel Vetter 
Link: 
https://patchwork.freedesktop.org/patch/msgid/20210712043508.11584-5-desmondcheon...@gmail.com
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/drm_auth.c | 17 +++--
 drivers/gpu/drm/drm_file.c |  1 +
 include/drm/drm_file.h | 12 +---
 3 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
index 232abbba3686..0024ad93d24b 100644
--- a/drivers/gpu/drm/drm_auth.c
+++ b/drivers/gpu/drm/drm_auth.c
@@ -135,16 +135,18 @@ static void drm_set_master(struct drm_device *dev, struct 
drm_file *fpriv,
 static int drm_new_set_master(struct drm_device *dev, struct drm_file *fpriv)
 {
struct drm_master *old_master;
+   struct drm_master *new_master;
 
lockdep_assert_held_once(&dev->master_mutex);
 
WARN_ON(fpriv->is_master);
old_master = fpriv->master;
-   fpriv->master = drm_master_create(dev);
-   if (!fpriv->master) {
-   fpriv->master = old_master;
+   new_master = drm_master_create(dev);
+   if (!new_master)
return -ENOMEM;
-   }
+   spin_lock(&fpriv->master_lookup_lock);
+   fpriv->master = new_master;
+   spin_unlock(&fpriv->master_lookup_lock);
 
fpriv->is_master = 1;
fpriv->authenticated = 1;
@@ -302,10 +304,13 @@ int drm_master_open(struct drm_file *file_priv)
/* if there is no current master make this fd it, but do not create
 * any master object for render clients */
mutex_lock(&dev->master_mutex);
-   if (!dev->master)
+   if (!dev->master) {
ret = drm_new_set_master(dev, file_priv);
-   else
+   } else {
+   spin_lock(&file_priv->master_lookup_lock);
file_priv->master = drm_master_get(dev->master);
+   spin_unlock(&file_priv->master_lookup_lock);
+   }
mutex_unlock(&dev->master_mutex);
 
return ret;
diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c
index 7efbccffc2ea..c6feeb5651b0 100644
--- a/drivers/gpu/drm/drm_file.c
+++ b/drivers/gpu/drm/drm_file.c
@@ -176,6 +176,7 @@ struct drm_file *drm_file_alloc(struct drm_minor *minor)
init_waitqueue_head(&file->event_wait);
file->event_space = 4096; /* set aside 4k for event buffer */
 
+   spin_lock_init(&file->master_lookup_lock);
mutex_init(&file->event_read_lock);
 
if (drm_core_check_feature(dev, DRIVER_GEM))
diff --git a/include/drm/drm_file.h b/include/drm/drm_file.h
index b81b3bfb08c8..9b82988e3427 100644
--- a/include/drm/drm_file.h
+++ b/include/drm/drm_file.h
@@ -226,15 +226,21 @@ struct drm_file {
/**
 * @master:
 *
-* Master this node is currently associated with. Only relevant if
-* drm_is_primary_client() returns true. Note that this only
-* matches &drm_device.master if the master is the currently active one.
+* Master this node is currently associated with. Protected by struct
+* &drm_device.master_mutex, and serialized by @master_lookup_lock.
+*
+* Only relevant if drm_is_primary_client() returns true. Note that
+* this only matches &drm_device.master if the master is the currently
+* active one.
 *
 * See also @authentication and @is_master and the :ref:

[PATCH AUTOSEL 5.13 029/219] drm: protect drm_master pointers in drm_lease.c

2021-09-09 Thread Sasha Levin
From: Desmond Cheong Zhi Xi 

[ Upstream commit 56f0729a510f92151682ff6c89f69724d5595d6e ]

drm_file->master pointers should be protected by
drm_device.master_mutex or drm_file.master_lookup_lock when being
dereferenced.

However, in drm_lease.c, there are multiple instances where
drm_file->master is accessed and dereferenced while neither lock is
held. This makes drm_lease.c vulnerable to use-after-free bugs.

We address this issue in 2 ways:

1. Add a new drm_file_get_master() function that calls drm_master_get
on drm_file->master while holding on to
drm_file.master_lookup_lock. Since drm_master_get increments the
reference count of master, this prevents master from being freed until
we unreference it with drm_master_put.

2. In each case where drm_file->master is directly accessed and
eventually dereferenced in drm_lease.c, we wrap the access in a call
to the new drm_file_get_master function, then unreference the master
pointer once we are done using it.

Reported-by: Daniel Vetter 
Signed-off-by: Desmond Cheong Zhi Xi 
Reviewed-by: Emil Velikov 
Signed-off-by: Daniel Vetter 
Link: 
https://patchwork.freedesktop.org/patch/msgid/20210712043508.11584-6-desmondcheon...@gmail.com
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/drm_auth.c  | 25 
 drivers/gpu/drm/drm_lease.c | 81 -
 include/drm/drm_auth.h  |  1 +
 include/drm/drm_file.h  |  6 +++
 4 files changed, 93 insertions(+), 20 deletions(-)

diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
index 0024ad93d24b..c7adbeaf10b1 100644
--- a/drivers/gpu/drm/drm_auth.c
+++ b/drivers/gpu/drm/drm_auth.c
@@ -376,6 +376,31 @@ struct drm_master *drm_master_get(struct drm_master 
*master)
 }
 EXPORT_SYMBOL(drm_master_get);
 
+/**
+ * drm_file_get_master - reference &drm_file.master of @file_priv
+ * @file_priv: DRM file private
+ *
+ * Increments the reference count of @file_priv's &drm_file.master and returns
+ * the &drm_file.master. If @file_priv has no &drm_file.master, returns NULL.
+ *
+ * Master pointers returned from this function should be unreferenced using
+ * drm_master_put().
+ */
+struct drm_master *drm_file_get_master(struct drm_file *file_priv)
+{
+   struct drm_master *master = NULL;
+
+   spin_lock(&file_priv->master_lookup_lock);
+   if (!file_priv->master)
+   goto unlock;
+   master = drm_master_get(file_priv->master);
+
+unlock:
+   spin_unlock(&file_priv->master_lookup_lock);
+   return master;
+}
+EXPORT_SYMBOL(drm_file_get_master);
+
 static void drm_master_destroy(struct kref *kref)
 {
struct drm_master *master = container_of(kref, struct drm_master, 
refcount);
diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
index da4f085fc09e..aef22634005e 100644
--- a/drivers/gpu/drm/drm_lease.c
+++ b/drivers/gpu/drm/drm_lease.c
@@ -107,10 +107,19 @@ static bool _drm_has_leased(struct drm_master *master, 
int id)
  */
 bool _drm_lease_held(struct drm_file *file_priv, int id)
 {
-   if (!file_priv || !file_priv->master)
+   bool ret;
+   struct drm_master *master;
+
+   if (!file_priv)
return true;
 
-   return _drm_lease_held_master(file_priv->master, id);
+   master = drm_file_get_master(file_priv);
+   if (!master)
+   return true;
+   ret = _drm_lease_held_master(master, id);
+   drm_master_put(&master);
+
+   return ret;
 }
 
 /**
@@ -129,13 +138,22 @@ bool drm_lease_held(struct drm_file *file_priv, int id)
struct drm_master *master;
bool ret;
 
-   if (!file_priv || !file_priv->master || !file_priv->master->lessor)
+   if (!file_priv)
return true;
 
-   master = file_priv->master;
+   master = drm_file_get_master(file_priv);
+   if (!master)
+   return true;
+   if (!master->lessor) {
+   ret = true;
+   goto out;
+   }
mutex_lock(&master->dev->mode_config.idr_mutex);
ret = _drm_lease_held_master(master, id);
mutex_unlock(&master->dev->mode_config.idr_mutex);
+
+out:
+   drm_master_put(&master);
return ret;
 }
 
@@ -155,10 +173,16 @@ uint32_t drm_lease_filter_crtcs(struct drm_file 
*file_priv, uint32_t crtcs_in)
int count_in, count_out;
uint32_t crtcs_out = 0;
 
-   if (!file_priv || !file_priv->master || !file_priv->master->lessor)
+   if (!file_priv)
return crtcs_in;
 
-   master = file_priv->master;
+   master = drm_file_get_master(file_priv);
+   if (!master)
+   return crtcs_in;
+   if (!master->lessor) {
+   crtcs_out = crtcs_in;
+   goto out;
+   }
dev = master->dev;
 
count_in = count_out = 0;
@@ -177,6 +201,9 @@ uint32_t drm_lease_filter_crtcs(struct drm_file *file_priv, 
uint32_t crtcs_in)
count_in++;
}
mutex_unlock(&master->dev->mode_config.idr_mutex);
+
+out:

[PATCH AUTOSEL 5.13 044/219] drm/amd/display: Fix timer_per_pixel unit error

2021-09-09 Thread Sasha Levin
From: Oliver Logush 

[ Upstream commit 23e55639b87fb16a9f0f66032ecb57060df6c46c ]

[why]
The units of the time_per_pixel variable were incorrect, this had to be
changed for the code to properly function.

[how]
The change was very straightforward, only required one line of code to
be changed where the calculation was done.

Acked-by: Rodrigo Siqueira 
Signed-off-by: Oliver Logush 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c 
b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
index 81f583733fa8..12e92f620483 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
@@ -2461,7 +2461,7 @@ void dcn20_set_mcif_arb_params(
wb_arb_params->cli_watermark[k] = 
get_wm_writeback_urgent(&context->bw_ctx.dml, pipes, pipe_cnt) * 1000;
wb_arb_params->pstate_watermark[k] = 
get_wm_writeback_dram_clock_change(&context->bw_ctx.dml, pipes, pipe_cnt) * 
1000;
}
-   wb_arb_params->time_per_pixel = 16.0 / 
context->res_ctx.pipe_ctx[i].stream->phy_pix_clk; /* 4 bit fraction, ms */
+   wb_arb_params->time_per_pixel = 16.0 * 1000 / 
(context->res_ctx.pipe_ctx[i].stream->phy_pix_clk / 1000); /* 4 bit fraction, 
ms */
wb_arb_params->slice_lines = 32;
wb_arb_params->arbitration_slice = 2;
wb_arb_params->max_scaled_time = 
dcn20_calc_max_scaled_time(wb_arb_params->time_per_pixel,
-- 
2.30.2



[PATCH AUTOSEL 5.13 053/219] drm/amdgpu: Fix a printing message

2021-09-09 Thread Sasha Levin
From: Oak Zeng 

[ Upstream commit 95f71f12aa45d65b7f2ccab95569795edffd379a ]

The printing message "PSP loading VCN firmware" is mis-leading because
people might think driver is loading VCN firmware. Actually when this
message is printed, driver is just preparing some VCN ucode, not loading
VCN firmware yet. The actual VCN firmware loading will be in the PSP block
hw_init. Fix the printing message

Signed-off-by: Oak Zeng 
Reviewed-by: Christian Konig 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c | 2 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c | 2 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c | 2 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c 
b/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
index 27b1ced145d2..14ae2bfad59d 100644
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
@@ -119,7 +119,7 @@ static int vcn_v1_0_sw_init(void *handle)
adev->firmware.ucode[AMDGPU_UCODE_ID_VCN].fw = adev->vcn.fw;
adev->firmware.fw_size +=
ALIGN(le32_to_cpu(hdr->ucode_size_bytes), PAGE_SIZE);
-   DRM_INFO("PSP loading VCN firmware\n");
+   dev_info(adev->dev, "Will use PSP to load VCN firmware\n");
}
 
r = amdgpu_vcn_resume(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c 
b/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c
index 8af567c546db..f4686e918e0d 100644
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c
@@ -122,7 +122,7 @@ static int vcn_v2_0_sw_init(void *handle)
adev->firmware.ucode[AMDGPU_UCODE_ID_VCN].fw = adev->vcn.fw;
adev->firmware.fw_size +=
ALIGN(le32_to_cpu(hdr->ucode_size_bytes), PAGE_SIZE);
-   DRM_INFO("PSP loading VCN firmware\n");
+   dev_info(adev->dev, "Will use PSP to load VCN firmware\n");
}
 
r = amdgpu_vcn_resume(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c 
b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
index 888b17d84691..e0c0c3734432 100644
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
@@ -152,7 +152,7 @@ static int vcn_v2_5_sw_init(void *handle)
adev->firmware.fw_size +=
ALIGN(le32_to_cpu(hdr->ucode_size_bytes), 
PAGE_SIZE);
}
-   DRM_INFO("PSP loading VCN firmware\n");
+   dev_info(adev->dev, "Will use PSP to load VCN firmware\n");
}
 
r = amdgpu_vcn_resume(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c 
b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
index 3b23de996db2..c2c5c4af51d2 100644
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
@@ -152,7 +152,7 @@ static int vcn_v3_0_sw_init(void *handle)
adev->firmware.fw_size +=
ALIGN(le32_to_cpu(hdr->ucode_size_bytes), 
PAGE_SIZE);
}
-   DRM_INFO("PSP loading VCN firmware\n");
+   dev_info(adev->dev, "Will use PSP to load VCN firmware\n");
}
 
r = amdgpu_vcn_resume(adev);
-- 
2.30.2



[PATCH AUTOSEL 5.13 054/219] drm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex

2021-09-09 Thread Sasha Levin
From: Anson Jacob 

[ Upstream commit 1a394b3c3de2577f200cb623c52a5c2b82805cec ]

link_rate is updated via debugfs using hex values, set it to output
in hex as well.

eg: Resolution: 1920x1080@144Hz
cat /sys/kernel/debug/dri/0/DP-1/link_settings
Current:  4  0x14  0  Verified:  4  0x1e  0  Reported:  4  0x1e  16  Preferred: 
 0  0x0  0

echo "4 0x1e" > /sys/kernel/debug/dri/0/DP-1/link_settings

cat /sys/kernel/debug/dri/0/DP-1/link_settings
Current:  4  0x1e  0  Verified:  4  0x1e  0  Reported:  4  0x1e  16  Preferred: 
 4  0x1e  0

Signed-off-by: Anson Jacob 
Reviewed-by: Harry Wentland 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 .../amd/display/amdgpu_dm/amdgpu_dm_debugfs.c| 16 
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c 
b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
index 1b6b15708b96..08ff1166ffc8 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
@@ -197,29 +197,29 @@ static ssize_t dp_link_settings_read(struct file *f, char 
__user *buf,
 
rd_buf_ptr = rd_buf;
 
-   str_len = strlen("Current:  %d  %d  %d  ");
-   snprintf(rd_buf_ptr, str_len, "Current:  %d  %d  %d  ",
+   str_len = strlen("Current:  %d  0x%x  %d  ");
+   snprintf(rd_buf_ptr, str_len, "Current:  %d  0x%x  %d  ",
link->cur_link_settings.lane_count,
link->cur_link_settings.link_rate,
link->cur_link_settings.link_spread);
rd_buf_ptr += str_len;
 
-   str_len = strlen("Verified:  %d  %d  %d  ");
-   snprintf(rd_buf_ptr, str_len, "Verified:  %d  %d  %d  ",
+   str_len = strlen("Verified:  %d  0x%x  %d  ");
+   snprintf(rd_buf_ptr, str_len, "Verified:  %d  0x%x  %d  ",
link->verified_link_cap.lane_count,
link->verified_link_cap.link_rate,
link->verified_link_cap.link_spread);
rd_buf_ptr += str_len;
 
-   str_len = strlen("Reported:  %d  %d  %d  ");
-   snprintf(rd_buf_ptr, str_len, "Reported:  %d  %d  %d  ",
+   str_len = strlen("Reported:  %d  0x%x  %d  ");
+   snprintf(rd_buf_ptr, str_len, "Reported:  %d  0x%x  %d  ",
link->reported_link_cap.lane_count,
link->reported_link_cap.link_rate,
link->reported_link_cap.link_spread);
rd_buf_ptr += str_len;
 
-   str_len = strlen("Preferred:  %d  %d  %d  ");
-   snprintf(rd_buf_ptr, str_len, "Preferred:  %d  %d  %d\n",
+   str_len = strlen("Preferred:  %d  0x%x  %d  ");
+   snprintf(rd_buf_ptr, str_len, "Preferred:  %d  0x%x  %d\n",
link->preferred_link_setting.lane_count,
link->preferred_link_setting.link_rate,
link->preferred_link_setting.link_spread);
-- 
2.30.2



[PATCH AUTOSEL 5.13 057/219] drm/bridge: nwl-dsi: Avoid potential multiplication overflow on 32-bit

2021-09-09 Thread Sasha Levin
From: Geert Uytterhoeven 

[ Upstream commit 47956bc86ee4e8530cac386a04f62a6095f7afbe ]

As nwl_dsi.lanes is u32, and NSEC_PER_SEC is 10L, the second
multiplication in

dsi->lanes * 8 * NSEC_PER_SEC

will overflow on a 32-bit platform.  Fix this by making the constant
unsigned long long, forcing 64-bit arithmetic.

As iMX8 is arm64, this driver is currently used on 64-bit platforms
only, where long is 64-bit, so this cannot happen.  But the issue will
start to happen when the driver is reused for a 32-bit SoC (e.g.
i.MX7ULP), or when code is copied for a new driver.

Signed-off-by: Geert Uytterhoeven 
Reviewed-by: Fabio Estevam 
Reviewed-by: Laurent Pinchart 
Signed-off-by: Sam Ravnborg 
Link: 
https://patchwork.freedesktop.org/patch/msgid/ebb82941a86b4e35c4fcfb1ef5a5cfad7c1fceab.1626255956.git.geert+rene...@glider.be
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/bridge/nwl-dsi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/bridge/nwl-dsi.c b/drivers/gpu/drm/bridge/nwl-dsi.c
index c65ca860712d..6cac2e58cd15 100644
--- a/drivers/gpu/drm/bridge/nwl-dsi.c
+++ b/drivers/gpu/drm/bridge/nwl-dsi.c
@@ -196,7 +196,7 @@ static u32 ps2bc(struct nwl_dsi *dsi, unsigned long long ps)
u32 bpp = mipi_dsi_pixel_format_to_bpp(dsi->format);
 
return DIV64_U64_ROUND_UP(ps * dsi->mode.clock * bpp,
- dsi->lanes * 8 * NSEC_PER_SEC);
+ dsi->lanes * 8ULL * NSEC_PER_SEC);
 }
 
 /*
-- 
2.30.2



[PATCH AUTOSEL 5.13 059/219] video: fbdev: asiliantfb: Error out if 'pixclock' equals zero

2021-09-09 Thread Sasha Levin
From: Zheyu Ma 

[ Upstream commit b36b242d4b8ea178f7fd038965e3cac7f30c3f09 ]

The userspace program could pass any values to the driver through
ioctl() interface. If the driver doesn't check the value of 'pixclock',
it may cause divide error.

Fix this by checking whether 'pixclock' is zero first.

The following log reveals it:

[   43.861711] divide error:  [#1] PREEMPT SMP KASAN PTI
[   43.861737] CPU: 2 PID: 11764 Comm: i740 Not tainted 
5.14.0-rc2-00513-gac532c9bbcfb-dirty #224
[   43.861756] RIP: 0010:asiliantfb_check_var+0x4e/0x730
[   43.861843] Call Trace:
[   43.861848]  ? asiliantfb_remove+0x190/0x190
[   43.861858]  fb_set_var+0x2e4/0xeb0
[   43.861866]  ? fb_blank+0x1a0/0x1a0
[   43.861873]  ? lock_acquire+0x1ef/0x530
[   43.861884]  ? lock_release+0x810/0x810
[   43.861892]  ? lock_is_held_type+0x100/0x140
[   43.861903]  ? ___might_sleep+0x1ee/0x2d0
[   43.861914]  ? __mutex_lock+0x620/0x1190
[   43.861921]  ? do_fb_ioctl+0x313/0x700
[   43.861929]  ? mutex_lock_io_nested+0xfa0/0xfa0
[   43.861936]  ? __this_cpu_preempt_check+0x1d/0x30
[   43.861944]  ? _raw_spin_unlock_irqrestore+0x46/0x60
[   43.861952]  ? lockdep_hardirqs_on+0x59/0x100
[   43.861959]  ? _raw_spin_unlock_irqrestore+0x46/0x60
[   43.861967]  ? trace_hardirqs_on+0x6a/0x1c0
[   43.861978]  do_fb_ioctl+0x31e/0x700

Signed-off-by: Zheyu Ma 
Signed-off-by: Sam Ravnborg 
Link: 
https://patchwork.freedesktop.org/patch/msgid/1627293835-17441-2-git-send-email-zheyum...@gmail.com
Signed-off-by: Sasha Levin 
---
 drivers/video/fbdev/asiliantfb.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/video/fbdev/asiliantfb.c b/drivers/video/fbdev/asiliantfb.c
index 3e006da47752..84c56f525889 100644
--- a/drivers/video/fbdev/asiliantfb.c
+++ b/drivers/video/fbdev/asiliantfb.c
@@ -227,6 +227,9 @@ static int asiliantfb_check_var(struct fb_var_screeninfo 
*var,
 {
unsigned long Ftarget, ratio, remainder;
 
+   if (!var->pixclock)
+   return -EINVAL;
+
ratio = 100 / var->pixclock;
remainder = 100 % var->pixclock;
Ftarget = 100 * ratio + (100 * remainder) / var->pixclock;
-- 
2.30.2



[PATCH AUTOSEL 5.13 061/219] video: fbdev: riva: Error out if 'pixclock' equals zero

2021-09-09 Thread Sasha Levin
From: Zheyu Ma 

[ Upstream commit f92763cb0feba247e0939ed137b495601fd072a5 ]

The userspace program could pass any values to the driver through
ioctl() interface. If the driver doesn't check the value of 'pixclock',
it may cause divide error.

Fix this by checking whether 'pixclock' is zero first.

The following log reveals it:

[   33.396850] divide error:  [#1] PREEMPT SMP KASAN PTI
[   33.396864] CPU: 5 PID: 11754 Comm: i740 Not tainted 
5.14.0-rc2-00513-gac532c9bbcfb-dirty #222
[   33.396883] RIP: 0010:riva_load_video_mode+0x417/0xf70
[   33.396969] Call Trace:
[   33.396973]  ? debug_smp_processor_id+0x1c/0x20
[   33.396984]  ? tick_nohz_tick_stopped+0x1a/0x90
[   33.396996]  ? rivafb_copyarea+0x3c0/0x3c0
[   33.397003]  ? wake_up_klogd.part.0+0x99/0xd0
[   33.397014]  ? vprintk_emit+0x110/0x4b0
[   33.397024]  ? vprintk_default+0x26/0x30
[   33.397033]  ? vprintk+0x9c/0x1f0
[   33.397041]  ? printk+0xba/0xed
[   33.397054]  ? record_print_text.cold+0x16/0x16
[   33.397063]  ? __kasan_check_read+0x11/0x20
[   33.397074]  ? profile_tick+0xc0/0x100
[   33.397084]  ? __sanitizer_cov_trace_const_cmp4+0x24/0x80
[   33.397094]  ? riva_set_rop_solid+0x2a0/0x2a0
[   33.397102]  rivafb_set_par+0xbe/0x610
[   33.397111]  ? riva_set_rop_solid+0x2a0/0x2a0
[   33.397119]  fb_set_var+0x5bf/0xeb0
[   33.397127]  ? fb_blank+0x1a0/0x1a0
[   33.397134]  ? lock_acquire+0x1ef/0x530
[   33.397143]  ? lock_release+0x810/0x810
[   33.397151]  ? lock_is_held_type+0x100/0x140
[   33.397159]  ? ___might_sleep+0x1ee/0x2d0
[   33.397170]  ? __mutex_lock+0x620/0x1190
[   33.397180]  ? trace_hardirqs_on+0x6a/0x1c0
[   33.397190]  do_fb_ioctl+0x31e/0x700

Signed-off-by: Zheyu Ma 
Signed-off-by: Sam Ravnborg 
Link: 
https://patchwork.freedesktop.org/patch/msgid/1627293835-17441-4-git-send-email-zheyum...@gmail.com
Signed-off-by: Sasha Levin 
---
 drivers/video/fbdev/riva/fbdev.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/video/fbdev/riva/fbdev.c b/drivers/video/fbdev/riva/fbdev.c
index 4b0433cb..84d5e23ad7d3 100644
--- a/drivers/video/fbdev/riva/fbdev.c
+++ b/drivers/video/fbdev/riva/fbdev.c
@@ -1084,6 +1084,9 @@ static int rivafb_check_var(struct fb_var_screeninfo 
*var, struct fb_info *info)
int mode_valid = 0;

NVTRACE_ENTER();
+   if (!var->pixclock)
+   return -EINVAL;
+
switch (var->bits_per_pixel) {
case 1 ... 8:
var->red.offset = var->green.offset = var->blue.offset = 0;
-- 
2.30.2



[PATCH AUTOSEL 5.13 060/219] video: fbdev: kyro: Error out if 'pixclock' equals zero

2021-09-09 Thread Sasha Levin
From: Zheyu Ma 

[ Upstream commit 1520b4b7ba964f8eec2e7dd14c571d50de3e5191 ]

The userspace program could pass any values to the driver through
ioctl() interface. if the driver doesn't check the value of 'pixclock',
it may cause divide error because the value of 'lineclock' and
'frameclock' will be zero.

Fix this by checking whether 'pixclock' is zero in kyrofb_check_var().

The following log reveals it:

[  103.073930] divide error:  [#1] PREEMPT SMP KASAN PTI
[  103.073942] CPU: 4 PID: 12483 Comm: syz-executor Not tainted 
5.14.0-rc2-00478-g2734d6c1b1a0-dirty #118
[  103.073959] RIP: 0010:kyrofb_set_par+0x316/0xc80
[  103.074045] Call Trace:
[  103.074048]  ? ___might_sleep+0x1ee/0x2d0
[  103.074060]  ? kyrofb_ioctl+0x330/0x330
[  103.074069]  fb_set_var+0x5bf/0xeb0
[  103.074078]  ? fb_blank+0x1a0/0x1a0
[  103.074085]  ? lock_acquire+0x3bd/0x530
[  103.074094]  ? lock_release+0x810/0x810
[  103.074103]  ? ___might_sleep+0x1ee/0x2d0
[  103.074114]  ? __mutex_lock+0x620/0x1190
[  103.074126]  ? trace_hardirqs_on+0x6a/0x1c0
[  103.074137]  do_fb_ioctl+0x31e/0x700
[  103.074144]  ? fb_getput_cmap+0x280/0x280
[  103.074152]  ? rcu_read_lock_sched_held+0x11/0x80
[  103.074162]  ? rcu_read_lock_sched_held+0x11/0x80
[  103.074171]  ? __sanitizer_cov_trace_switch+0x67/0xf0
[  103.074181]  ? __sanitizer_cov_trace_const_cmp2+0x20/0x80
[  103.074191]  ? do_vfs_ioctl+0x14b/0x16c0
[  103.074199]  ? vfs_fileattr_set+0xb60/0xb60
[  103.074207]  ? rcu_read_lock_sched_held+0x11/0x80
[  103.074216]  ? lock_release+0x483/0x810
[  103.074224]  ? __fget_files+0x217/0x3d0
[  103.074234]  ? __fget_files+0x239/0x3d0
[  103.074243]  ? do_fb_ioctl+0x700/0x700
[  103.074250]  fb_ioctl+0xe6/0x130

Signed-off-by: Zheyu Ma 
Signed-off-by: Sam Ravnborg 
Link: 
https://patchwork.freedesktop.org/patch/msgid/1627293835-17441-3-git-send-email-zheyum...@gmail.com
Signed-off-by: Sasha Levin 
---
 drivers/video/fbdev/kyro/fbdev.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/video/fbdev/kyro/fbdev.c b/drivers/video/fbdev/kyro/fbdev.c
index 4b8c7c16b1df..25801e8e3f74 100644
--- a/drivers/video/fbdev/kyro/fbdev.c
+++ b/drivers/video/fbdev/kyro/fbdev.c
@@ -399,6 +399,9 @@ static int kyrofb_check_var(struct fb_var_screeninfo *var, 
struct fb_info *info)
 {
struct kyrofb_info *par = info->par;
 
+   if (!var->pixclock)
+   return -EINVAL;
+
if (var->bits_per_pixel != 16 && var->bits_per_pixel != 32) {
printk(KERN_WARNING "kyrofb: depth not supported: %u\n", 
var->bits_per_pixel);
return -EINVAL;
-- 
2.30.2



[PATCH AUTOSEL 5.13 076/219] drm: rcar-du: Shutdown the display on system shutdown

2021-09-09 Thread Sasha Levin
From: Laurent Pinchart 

[ Upstream commit 015f2ebb93767d40c442e749642fffaf10316d78 ]

When the system shuts down or warm reboots, the display may be active,
with the hardware accessing system memory. Upon reboot, the DDR will not
be accessible, which may cause issues.

Implement the platform_driver .shutdown() operation and shut down the
display to fix this.

Signed-off-by: Laurent Pinchart 
Reviewed-by: Kieran Bingham 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/rcar-du/rcar_du_drv.c | 8 
 1 file changed, 8 insertions(+)

diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.c 
b/drivers/gpu/drm/rcar-du/rcar_du_drv.c
index bfbff90588cb..43de3d8686e8 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_drv.c
+++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.c
@@ -561,6 +561,13 @@ static int rcar_du_remove(struct platform_device *pdev)
return 0;
 }
 
+static void rcar_du_shutdown(struct platform_device *pdev)
+{
+   struct rcar_du_device *rcdu = platform_get_drvdata(pdev);
+
+   drm_atomic_helper_shutdown(&rcdu->ddev);
+}
+
 static int rcar_du_probe(struct platform_device *pdev)
 {
struct rcar_du_device *rcdu;
@@ -617,6 +624,7 @@ static int rcar_du_probe(struct platform_device *pdev)
 static struct platform_driver rcar_du_platform_driver = {
.probe  = rcar_du_probe,
.remove = rcar_du_remove,
+   .shutdown   = rcar_du_shutdown,
.driver = {
.name   = "rcar-du",
.pm = &rcar_du_pm_ops,
-- 
2.30.2



[PATCH AUTOSEL 5.13 112/219] drm/msm: mdp4: drop vblank get/put from prepare/complete_commit

2021-09-09 Thread Sasha Levin
From: David Heidelberg 

[ Upstream commit 56bd931ae506730c9ab1e4cc4bfefa43fc2d18fa ]

msm_atomic is doing vblank get/put's already,
currently there no need to duplicate the effort in MDP4

Fix warning:
...
WARNING: CPU: 3 PID: 79 at drivers/gpu/drm/drm_vblank.c:1194 
drm_vblank_put+0x1cc/0x1d4
...
and multiple vblank time-outs:
...
msm 510.mdp: vblank time out, crtc=1
...

Tested on Nexus 7 2013 (deb), LTS 5.10.50.

Introduced by: 119ecb7fd3b5 ("drm/msm/mdp4: request vblank during modeset")

Signed-off-by: David Heidelberg 
Link: https://lore.kernel.org/r/20210715060925.7880-1-da...@ixit.cz
Signed-off-by: Dmitry Baryshkov 
Signed-off-by: Rob Clark 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | 13 -
 1 file changed, 13 deletions(-)

diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c 
b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
index 4a5b518288b0..1325731282f7 100644
--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
+++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
@@ -108,13 +108,6 @@ static void mdp4_disable_commit(struct msm_kms *kms)
 
 static void mdp4_prepare_commit(struct msm_kms *kms, struct drm_atomic_state 
*state)
 {
-   int i;
-   struct drm_crtc *crtc;
-   struct drm_crtc_state *crtc_state;
-
-   /* see 119ecb7fd */
-   for_each_new_crtc_in_state(state, crtc, crtc_state, i)
-   drm_crtc_vblank_get(crtc);
 }
 
 static void mdp4_flush_commit(struct msm_kms *kms, unsigned crtc_mask)
@@ -133,12 +126,6 @@ static void mdp4_wait_flush(struct msm_kms *kms, unsigned 
crtc_mask)
 
 static void mdp4_complete_commit(struct msm_kms *kms, unsigned crtc_mask)
 {
-   struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(kms));
-   struct drm_crtc *crtc;
-
-   /* see 119ecb7fd */
-   for_each_crtc_mask(mdp4_kms->dev, crtc, crtc_mask)
-   drm_crtc_vblank_put(crtc);
 }
 
 static long mdp4_round_pixclk(struct msm_kms *kms, unsigned long rate,
-- 
2.30.2



[PATCH AUTOSEL 5.13 113/219] drm/msm/dsi: Fix DSI and DSI PHY regulator config from SDM660

2021-09-09 Thread Sasha Levin
From: Konrad Dybcio 

[ Upstream commit 462f7017a6918d152870bfb8852f3c70fd74b296 ]

VDDA is not present and the specified load value is wrong. Fix it.

Signed-off-by: Konrad Dybcio 
Link: 
https://lore.kernel.org/r/20210728222057.52641-1-konrad.dyb...@somainline.org
Reviewed-by: Dmitry Baryshkov 
Signed-off-by: Dmitry Baryshkov 
Signed-off-by: Rob Clark 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/msm/dsi/dsi_cfg.c  | 1 -
 drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/msm/dsi/dsi_cfg.c 
b/drivers/gpu/drm/msm/dsi/dsi_cfg.c
index f3f1c03c7db9..763f127e4621 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_cfg.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_cfg.c
@@ -154,7 +154,6 @@ static const struct msm_dsi_config sdm660_dsi_cfg = {
.reg_cfg = {
.num = 2,
.regs = {
-   {"vdd", 73400, 32 },/* 0.9 V */
{"vdda", 12560, 4 },/* 1.2 V */
},
},
diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c 
b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c
index 65d68eb9e3cb..c96fd752fa1d 100644
--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c
+++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c
@@ -1049,7 +1049,7 @@ const struct msm_dsi_phy_cfg dsi_phy_14nm_660_cfgs = {
.reg_cfg = {
.num = 1,
.regs = {
-   {"vcca", 17000, 32},
+   {"vcca", 73400, 32},
},
},
.ops = {
-- 
2.30.2



[PATCH AUTOSEL 5.13 114/219] drm: xlnx: zynqmp_dpsub: Call pm_runtime_get_sync before setting pixel clock

2021-09-09 Thread Sasha Levin
From: Quanyang Wang 

[ Upstream commit a19effb6dbe5bd1be77a6d68eba04dba8993ffeb ]

The Runtime PM subsystem will force the device "fd4a.zynqmp-display"
to enter suspend state while booting if the following conditions are met:
- the usage counter is zero (pm_runtime_get_sync hasn't been called yet)
- no 'active' children (no zynqmp-dp-snd-xx node under dpsub node)
- no other device in the same power domain (dpdma node has no
"power-domains = <&zynqmp_firmware PD_DP>" property)

So there is a scenario as below:
1) DP device enters suspend state   <- call zynqmp_gpd_power_off
2) zynqmp_disp_crtc_setup_clock <- configurate register VPLL_FRAC_CFG
3) pm_runtime_get_sync  <- call zynqmp_gpd_power_on and clear 
previous
   VPLL_FRAC_CFG configuration
4) clk_prepare_enable(disp->pclk)   <- enable failed since VPLL_FRAC_CFG
   configuration is corrupted

>From above, we can see that pm_runtime_get_sync may clear register
VPLL_FRAC_CFG configuration and result the failure of clk enabling.
Putting pm_runtime_get_sync at the very beginning of the function
zynqmp_disp_crtc_atomic_enable can resolve this issue.

Signed-off-by: Quanyang Wang 
Reviewed-by: Laurent Pinchart 
Signed-off-by: Laurent Pinchart 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/xlnx/zynqmp_disp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/xlnx/zynqmp_disp.c 
b/drivers/gpu/drm/xlnx/zynqmp_disp.c
index 109d627968ac..01c6ce7784dd 100644
--- a/drivers/gpu/drm/xlnx/zynqmp_disp.c
+++ b/drivers/gpu/drm/xlnx/zynqmp_disp.c
@@ -1452,9 +1452,10 @@ zynqmp_disp_crtc_atomic_enable(struct drm_crtc *crtc,
struct drm_display_mode *adjusted_mode = &crtc->state->adjusted_mode;
int ret, vrefresh;
 
+   pm_runtime_get_sync(disp->dev);
+
zynqmp_disp_crtc_setup_clock(crtc, adjusted_mode);
 
-   pm_runtime_get_sync(disp->dev);
ret = clk_prepare_enable(disp->pclk);
if (ret) {
dev_err(disp->dev, "failed to enable a pixel clock\n");
-- 
2.30.2



[PATCH AUTOSEL 5.13 115/219] drm: xlnx: zynqmp: release reset to DP controller before accessing DP registers

2021-09-09 Thread Sasha Levin
From: Quanyang Wang 

[ Upstream commit a338619bd76011035d462f0f9e8b2f24d7fe5a1e ]

When insmod zynqmp-dpsub.ko after rmmod it, system will hang with the
error log as below:

root@xilinx-zynqmp:~# insmod zynqmp-dpsub.ko
[   88.391289] [drm] Initialized zynqmp-dpsub 1.0.0 20130509 for 
fd4a.display on minor 0
[   88.529906] Console: switching to colour frame buffer device 128x48
[   88.549402] zynqmp-dpsub fd4a.display: [drm] fb0: zynqmp-dpsubdrm frame 
buffer device
[   88.571624] zynqmp-dpsub fd4a.display: ZynqMP DisplayPort Subsystem 
driver probed
root@xilinx-zynqmp:~# rmmod zynqmp_dpsub
[   94.023404] Console: switching to colour dummy device 80x25
root@xilinx-zynqmp:~# insmod zynqmp-dpsub.ko


This is because that in zynqmp_dp_probe it tries to access some DP
registers while the DP controller is still in the reset state. When
running "rmmod zynqmp_dpsub", zynqmp_dp_reset(dp, true) in
zynqmp_dp_phy_exit is called to force the DP controller into the reset
state. Then insmod will call zynqmp_dp_probe to program the DP registers,
but at this moment the DP controller hasn't been brought out of the reset
state yet since the function zynqmp_dp_reset(dp, false) is called later and
this will result the system hang.

Releasing the reset to DP controller before any read/write operation to it
will fix this issue. And for symmetry, move zynqmp_dp_reset() call from
zynqmp_dp_phy_exit() to zynqmp_dp_remove().

Signed-off-by: Quanyang Wang 
Reviewed-by: Laurent Pinchart 
Signed-off-by: Laurent Pinchart 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/xlnx/zynqmp_dp.c | 22 --
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/drivers/gpu/drm/xlnx/zynqmp_dp.c b/drivers/gpu/drm/xlnx/zynqmp_dp.c
index 59d1fb017da0..13811332b349 100644
--- a/drivers/gpu/drm/xlnx/zynqmp_dp.c
+++ b/drivers/gpu/drm/xlnx/zynqmp_dp.c
@@ -402,10 +402,6 @@ static int zynqmp_dp_phy_init(struct zynqmp_dp *dp)
}
}
 
-   ret = zynqmp_dp_reset(dp, false);
-   if (ret < 0)
-   return ret;
-
zynqmp_dp_clr(dp, ZYNQMP_DP_PHY_RESET, ZYNQMP_DP_PHY_RESET_ALL_RESET);
 
/*
@@ -441,8 +437,6 @@ static void zynqmp_dp_phy_exit(struct zynqmp_dp *dp)
ret);
}
 
-   zynqmp_dp_reset(dp, true);
-
for (i = 0; i < dp->num_lanes; i++) {
ret = phy_exit(dp->phy[i]);
if (ret)
@@ -1682,9 +1676,13 @@ int zynqmp_dp_probe(struct zynqmp_dpsub *dpsub, struct 
drm_device *drm)
return PTR_ERR(dp->reset);
}
 
+   ret = zynqmp_dp_reset(dp, false);
+   if (ret < 0)
+   return ret;
+
ret = zynqmp_dp_phy_probe(dp);
if (ret)
-   return ret;
+   goto err_reset;
 
/* Initialize the hardware. */
zynqmp_dp_write(dp, ZYNQMP_DP_TX_PHY_POWER_DOWN,
@@ -1696,7 +1694,7 @@ int zynqmp_dp_probe(struct zynqmp_dpsub *dpsub, struct 
drm_device *drm)
 
ret = zynqmp_dp_phy_init(dp);
if (ret)
-   return ret;
+   goto err_reset;
 
zynqmp_dp_write(dp, ZYNQMP_DP_TRANSMITTER_ENABLE, 1);
 
@@ -1708,15 +1706,18 @@ int zynqmp_dp_probe(struct zynqmp_dpsub *dpsub, struct 
drm_device *drm)
zynqmp_dp_irq_handler, IRQF_ONESHOT,
dev_name(dp->dev), dp);
if (ret < 0)
-   goto error;
+   goto err_phy_exit;
 
dev_dbg(dp->dev, "ZynqMP DisplayPort Tx probed with %u lanes\n",
dp->num_lanes);
 
return 0;
 
-error:
+err_phy_exit:
zynqmp_dp_phy_exit(dp);
+err_reset:
+   zynqmp_dp_reset(dp, true);
+
return ret;
 }
 
@@ -1734,4 +1735,5 @@ void zynqmp_dp_remove(struct zynqmp_dpsub *dpsub)
zynqmp_dp_write(dp, ZYNQMP_DP_INT_DS, 0x);
 
zynqmp_dp_phy_exit(dp);
+   zynqmp_dp_reset(dp, true);
 }
-- 
2.30.2



[PATCH AUTOSEL 5.13 118/219] drm/amd/display: fix missing writeback disablement if plane is removed

2021-09-09 Thread Sasha Levin
From: Roy Chan 

[ Upstream commit 82367e7f22d085092728f45fd5fbb15e3fb997c0 ]

[Why]
If the plane has been removed, the writeback disablement logic
doesn't run

[How]
fix the logic order

Acked-by: Anson Jacob 
Signed-off-by: Roy Chan 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 14 --
 drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 12 +++-
 2 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c 
b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
index 793554e61c52..03b941e76de2 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
@@ -1703,13 +1703,15 @@ void dcn20_program_front_end_for_ctx(
dcn20_program_pipe(dc, pipe, context);
pipe = pipe->bottom_pipe;
}
-   /* Program secondary blending tree and writeback pipes 
*/
-   pipe = &context->res_ctx.pipe_ctx[i];
-   if (!pipe->prev_odm_pipe && pipe->stream->num_wb_info > 0
-   && (pipe->update_flags.raw || 
pipe->plane_state->update_flags.raw || pipe->stream->update_flags.raw)
-   && 
hws->funcs.program_all_writeback_pipes_in_tree)
-   
hws->funcs.program_all_writeback_pipes_in_tree(dc, pipe->stream, context);
}
+   /* Program secondary blending tree and writeback pipes */
+   pipe = &context->res_ctx.pipe_ctx[i];
+   if (!pipe->top_pipe && !pipe->prev_odm_pipe
+   && pipe->stream && pipe->stream->num_wb_info > 0
+   && (pipe->update_flags.raw || 
(pipe->plane_state && pipe->plane_state->update_flags.raw)
+   || pipe->stream->update_flags.raw)
+   && 
hws->funcs.program_all_writeback_pipes_in_tree)
+   hws->funcs.program_all_writeback_pipes_in_tree(dc, 
pipe->stream, context);
}
 }
 
diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c 
b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
index d53f8b39699b..37944f94c693 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
@@ -396,12 +396,22 @@ void dcn30_program_all_writeback_pipes_in_tree(
for (i_pipe = 0; i_pipe < dc->res_pool->pipe_count; 
i_pipe++) {
struct pipe_ctx *pipe_ctx = 
&context->res_ctx.pipe_ctx[i_pipe];
 
+   if (!pipe_ctx->plane_state)
+   continue;
+
if (pipe_ctx->plane_state == 
wb_info.writeback_source_plane) {
wb_info.mpcc_inst = 
pipe_ctx->plane_res.mpcc_inst;
break;
}
}
-   ASSERT(wb_info.mpcc_inst != -1);
+
+   if (wb_info.mpcc_inst == -1) {
+   /* Disable writeback pipe and disconnect from 
MPCC
+* if source plane has been removed
+*/
+   dc->hwss.disable_writeback(dc, 
wb_info.dwb_pipe_inst);
+   continue;
+   }
 
ASSERT(wb_info.dwb_pipe_inst < 
dc->res_pool->res_cap->num_dwb);
dwb = dc->res_pool->dwbc[wb_info.dwb_pipe_inst];
-- 
2.30.2



[PATCH AUTOSEL 5.13 121/219] drm/vmwgfx: fix potential UAF in vmwgfx_surface.c

2021-09-09 Thread Sasha Levin
From: Desmond Cheong Zhi Xi 

[ Upstream commit 2bc5da528dd570c5ecabc107e6fbdbc55974276f ]

drm_file.master should be protected by either drm_device.master_mutex
or drm_file.master_lookup_lock when being dereferenced. However,
drm_master_get is called on unprotected file_priv->master pointers in
vmw_surface_define_ioctl and vmw_gb_surface_define_internal.

This is fixed by replacing drm_master_get with drm_file_get_master.

Signed-off-by: Desmond Cheong Zhi Xi 
Reviewed-by: Daniel Vetter 
Reviewed-by: Zack Rusin 
Signed-off-by: Zack Rusin 
Link: 
https://patchwork.freedesktop.org/patch/msgid/20210724111824.59266-4-desmondcheon...@gmail.com
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c 
b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index 5ff88f8c2382..0c62cd400b64 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -869,7 +869,7 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void 
*data,
user_srf->prime.base.shareable = false;
user_srf->prime.base.tfile = NULL;
if (drm_is_primary_client(file_priv))
-   user_srf->master = drm_master_get(file_priv->master);
+   user_srf->master = drm_file_get_master(file_priv);
 
/**
 * From this point, the generic resource management functions
@@ -1540,7 +1540,7 @@ vmw_gb_surface_define_internal(struct drm_device *dev,
 
user_srf = container_of(srf, struct vmw_user_surface, srf);
if (drm_is_primary_client(file_priv))
-   user_srf->master = drm_master_get(file_priv->master);
+   user_srf->master = drm_file_get_master(file_priv);
 
ret = ttm_read_lock(&dev_priv->reservation_sem, true);
if (unlikely(ret != 0))
-- 
2.30.2



[PATCH AUTOSEL 5.13 119/219] drm/amd/display: fix incorrect CM/TF programming sequence in dwb

2021-09-09 Thread Sasha Levin
From: Roy Chan 

[ Upstream commit 781e1e23131cce56fb557e6ec2260480a6bd08cc ]

[How]
the programming sequeune was for old asic.
the correct programming sequeunce should be similar to the one
used in mpc. the fix is copied from the mpc programming sequeunce.

Reviewed-by: Anthony Koo 
Acked-by: Anson Jacob 
Signed-off-by: Roy Chan 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 .../drm/amd/display/dc/dcn30/dcn30_dwb_cm.c   | 90 +--
 1 file changed, 64 insertions(+), 26 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dwb_cm.c 
b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dwb_cm.c
index 3fe9e41e4dbd..6a3d3a0ec0a3 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dwb_cm.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dwb_cm.c
@@ -49,6 +49,11 @@
 static void dwb3_get_reg_field_ogam(struct dcn30_dwbc *dwbc30,
struct dcn3_xfer_func_reg *reg)
 {
+   reg->shifts.field_region_start_base = 
dwbc30->dwbc_shift->DWB_OGAM_RAMA_EXP_REGION_START_BASE_B;
+   reg->masks.field_region_start_base = 
dwbc30->dwbc_mask->DWB_OGAM_RAMA_EXP_REGION_START_BASE_B;
+   reg->shifts.field_offset = dwbc30->dwbc_shift->DWB_OGAM_RAMA_OFFSET_B;
+   reg->masks.field_offset = dwbc30->dwbc_mask->DWB_OGAM_RAMA_OFFSET_B;
+
reg->shifts.exp_region0_lut_offset = 
dwbc30->dwbc_shift->DWB_OGAM_RAMA_EXP_REGION0_LUT_OFFSET;
reg->masks.exp_region0_lut_offset = 
dwbc30->dwbc_mask->DWB_OGAM_RAMA_EXP_REGION0_LUT_OFFSET;
reg->shifts.exp_region0_num_segments = 
dwbc30->dwbc_shift->DWB_OGAM_RAMA_EXP_REGION0_NUM_SEGMENTS;
@@ -66,8 +71,6 @@ static void dwb3_get_reg_field_ogam(struct dcn30_dwbc *dwbc30,
reg->masks.field_region_end_base = 
dwbc30->dwbc_mask->DWB_OGAM_RAMA_EXP_REGION_END_BASE_B;
reg->shifts.field_region_linear_slope = 
dwbc30->dwbc_shift->DWB_OGAM_RAMA_EXP_REGION_START_SLOPE_B;
reg->masks.field_region_linear_slope = 
dwbc30->dwbc_mask->DWB_OGAM_RAMA_EXP_REGION_START_SLOPE_B;
-   reg->masks.field_offset = dwbc30->dwbc_mask->DWB_OGAM_RAMA_OFFSET_B;
-   reg->shifts.field_offset = dwbc30->dwbc_shift->DWB_OGAM_RAMA_OFFSET_B;
reg->shifts.exp_region_start = 
dwbc30->dwbc_shift->DWB_OGAM_RAMA_EXP_REGION_START_B;
reg->masks.exp_region_start = 
dwbc30->dwbc_mask->DWB_OGAM_RAMA_EXP_REGION_START_B;
reg->shifts.exp_resion_start_segment = 
dwbc30->dwbc_shift->DWB_OGAM_RAMA_EXP_REGION_START_SEGMENT_B;
@@ -147,18 +150,19 @@ static enum dc_lut_mode dwb3_get_ogam_current(
uint32_t state_mode;
uint32_t ram_select;
 
-   REG_GET(DWB_OGAM_CONTROL,
-   DWB_OGAM_MODE, &state_mode);
-   REG_GET(DWB_OGAM_CONTROL,
-   DWB_OGAM_SELECT, &ram_select);
+   REG_GET_2(DWB_OGAM_CONTROL,
+   DWB_OGAM_MODE_CURRENT, &state_mode,
+   DWB_OGAM_SELECT_CURRENT, &ram_select);
 
if (state_mode == 0) {
mode = LUT_BYPASS;
} else if (state_mode == 2) {
if (ram_select == 0)
mode = LUT_RAM_A;
-   else
+   else if (ram_select == 1)
mode = LUT_RAM_B;
+   else
+   mode = LUT_BYPASS;
} else {
// Reserved value
mode = LUT_BYPASS;
@@ -172,10 +176,10 @@ static void dwb3_configure_ogam_lut(
struct dcn30_dwbc *dwbc30,
bool is_ram_a)
 {
-   REG_UPDATE(DWB_OGAM_LUT_CONTROL,
-   DWB_OGAM_LUT_READ_COLOR_SEL, 7);
-   REG_UPDATE(DWB_OGAM_CONTROL,
-   DWB_OGAM_SELECT, is_ram_a == true ? 0 : 1);
+   REG_UPDATE_2(DWB_OGAM_LUT_CONTROL,
+   DWB_OGAM_LUT_WRITE_COLOR_MASK, 7,
+   DWB_OGAM_LUT_HOST_SEL, (is_ram_a == true) ? 0 : 1);
+
REG_SET(DWB_OGAM_LUT_INDEX, 0, DWB_OGAM_LUT_INDEX, 0);
 }
 
@@ -185,17 +189,45 @@ static void dwb3_program_ogam_pwl(struct dcn30_dwbc 
*dwbc30,
 {
uint32_t i;
 
-// triple base implementation
-   for (i = 0; i < num/2; i++) {
-   REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, 
rgb[2*i+0].red_reg);
-   REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, 
rgb[2*i+0].green_reg);
-   REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, 
rgb[2*i+0].blue_reg);
-   REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, 
rgb[2*i+1].red_reg);
-   REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, 
rgb[2*i+1].green_reg);
-   REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, 
rgb[2*i+1].blue_reg);
-   REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, 
rgb[2*i+2].red_reg);
-   REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, 
rgb[2*i+2].green_reg);
-   REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, 
rgb[2*i+2].blue_reg);
+   uint32_t last_base_value_red = rgb[num-1].red_reg + 
rgb[num-1].delta_red_reg;
+   uint32_t last_base_value_green = rgb[num-1

[PATCH AUTOSEL 5.13 125/219] drm/msm/dp: reduce link rate if failed at link training 1

2021-09-09 Thread Sasha Levin
From: Kuogee Hsieh 

[ Upstream commit 4b85d405cfe938ae7ad61656484ae88dee289e3b ]

Reduce link rate and re start link training if link training 1
failed due to loss of clock recovery done to fix Link Layer
CTS case 4.3.1.7.  Also only update voltage and pre-emphasis
swing level after link training started to fix Link Layer CTS
case 4.3.1.6.

Changes in V2:
-- replaced cr_status with link_status[DP_LINK_STATUS_SIZE]
-- replaced dp_ctrl_any_lane_cr_done() with dp_ctrl_colco_recovery_any_ok()
-- replaced dp_ctrl_any_ane_cr_lose() with !drm_dp_clock_recovery_ok()

Changes in V3:
-- return failed if lane_count <= 1

Signed-off-by: Kuogee Hsieh 
Reviewed-by: Stephen Boyd 
Link: 
https://lore.kernel.org/r/1628196295-7382-3-git-send-email-khs...@codeaurora.org
[remove unused cr_status variable]
Signed-off-by: Rob Clark 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/msm/dp/dp_ctrl.c | 78 ++--
 1 file changed, 44 insertions(+), 34 deletions(-)

diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
index 6856223e91e1..eb63920b36e8 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
@@ -83,13 +83,6 @@ struct dp_ctrl_private {
struct completion video_comp;
 };
 
-struct dp_cr_status {
-   u8 lane_0_1;
-   u8 lane_2_3;
-};
-
-#define DP_LANE0_1_CR_DONE 0x11
-
 static int dp_aux_link_configure(struct drm_dp_aux *aux,
struct dp_link_info *link)
 {
@@ -1080,7 +1073,7 @@ static int dp_ctrl_read_link_status(struct 
dp_ctrl_private *ctrl,
 }
 
 static int dp_ctrl_link_train_1(struct dp_ctrl_private *ctrl,
-   struct dp_cr_status *cr, int *training_step)
+   int *training_step)
 {
int tries, old_v_level, ret = 0;
u8 link_status[DP_LINK_STATUS_SIZE];
@@ -1109,9 +1102,6 @@ static int dp_ctrl_link_train_1(struct dp_ctrl_private 
*ctrl,
if (ret)
return ret;
 
-   cr->lane_0_1 = link_status[0];
-   cr->lane_2_3 = link_status[1];
-
if (drm_dp_clock_recovery_ok(link_status,
ctrl->link->link_params.num_lanes)) {
return 0;
@@ -1188,7 +1178,7 @@ static void dp_ctrl_clear_training_pattern(struct 
dp_ctrl_private *ctrl)
 }
 
 static int dp_ctrl_link_train_2(struct dp_ctrl_private *ctrl,
-   struct dp_cr_status *cr, int *training_step)
+   int *training_step)
 {
int tries = 0, ret = 0;
char pattern;
@@ -1204,10 +1194,6 @@ static int dp_ctrl_link_train_2(struct dp_ctrl_private 
*ctrl,
else
pattern = DP_TRAINING_PATTERN_2;
 
-   ret = dp_ctrl_update_vx_px(ctrl);
-   if (ret)
-   return ret;
-
ret = dp_catalog_ctrl_set_pattern(ctrl->catalog, pattern);
if (ret)
return ret;
@@ -1220,8 +1206,6 @@ static int dp_ctrl_link_train_2(struct dp_ctrl_private 
*ctrl,
ret = dp_ctrl_read_link_status(ctrl, link_status);
if (ret)
return ret;
-   cr->lane_0_1 = link_status[0];
-   cr->lane_2_3 = link_status[1];
 
if (drm_dp_channel_eq_ok(link_status,
ctrl->link->link_params.num_lanes)) {
@@ -1241,7 +1225,7 @@ static int dp_ctrl_link_train_2(struct dp_ctrl_private 
*ctrl,
 static int dp_ctrl_reinitialize_mainlink(struct dp_ctrl_private *ctrl);
 
 static int dp_ctrl_link_train(struct dp_ctrl_private *ctrl,
-   struct dp_cr_status *cr, int *training_step)
+   int *training_step)
 {
int ret = 0;
u8 encoding = DP_SET_ANSI_8B10B;
@@ -1257,7 +1241,7 @@ static int dp_ctrl_link_train(struct dp_ctrl_private 
*ctrl,
drm_dp_dpcd_write(ctrl->aux, DP_MAIN_LINK_CHANNEL_CODING_SET,
&encoding, 1);
 
-   ret = dp_ctrl_link_train_1(ctrl, cr, training_step);
+   ret = dp_ctrl_link_train_1(ctrl, training_step);
if (ret) {
DRM_ERROR("link training #1 failed. ret=%d\n", ret);
goto end;
@@ -1266,7 +1250,7 @@ static int dp_ctrl_link_train(struct dp_ctrl_private 
*ctrl,
/* print success info as this is a result of user initiated action */
DRM_DEBUG_DP("link training #1 successful\n");
 
-   ret = dp_ctrl_link_train_2(ctrl, cr, training_step);
+   ret = dp_ctrl_link_train_2(ctrl, training_step);
if (ret) {
DRM_ERROR("link training #2 failed. ret=%d\n", ret);
goto end;
@@ -1282,7 +1266,7 @@ static int dp_ctrl_link_train(struct dp_ctrl_private 
*ctrl,
 }
 
 static int dp_ctrl_setup_main_link(struct dp_ctrl_private *ctrl,
-   struct dp_cr_status *cr, int *training_step)
+   int *training_step)
 {
int ret = 0;
 
@@ -1297,7 +1281,7 @@ static int dp_ctrl_setup_main_link(struct dp_ctrl_private 
*c

[PATCH AUTOSEL 5.13 126/219] drm/msm/dp: return correct edid checksum after corrupted edid checksum read

2021-09-09 Thread Sasha Levin
From: Kuogee Hsieh 

[ Upstream commit 7948fe12d47a946fb8025a0534c900e3dd4b5839 ]

Response with correct edid checksum saved at connector after corrupted edid
checksum read. This fixes Link Layer CTS cases 4.2.2.3, 4.2.2.6.

Signed-off-by: Kuogee Hsieh 
Reviewed-by: Stephen Boyd 
Link: 
https://lore.kernel.org/r/1628196295-7382-6-git-send-email-khs...@codeaurora.org
Signed-off-by: Rob Clark 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/msm/dp/dp_panel.c | 9 +++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/msm/dp/dp_panel.c 
b/drivers/gpu/drm/msm/dp/dp_panel.c
index 9cc816663668..6eeb9a14b584 100644
--- a/drivers/gpu/drm/msm/dp/dp_panel.c
+++ b/drivers/gpu/drm/msm/dp/dp_panel.c
@@ -272,7 +272,7 @@ static u8 dp_panel_get_edid_checksum(struct edid *edid)
 {
struct edid *last_block;
u8 *raw_edid;
-   bool is_edid_corrupt;
+   bool is_edid_corrupt = false;
 
if (!edid) {
DRM_ERROR("invalid edid input\n");
@@ -304,7 +304,12 @@ void dp_panel_handle_sink_request(struct dp_panel 
*dp_panel)
panel = container_of(dp_panel, struct dp_panel_private, dp_panel);
 
if (panel->link->sink_request & DP_TEST_LINK_EDID_READ) {
-   u8 checksum = dp_panel_get_edid_checksum(dp_panel->edid);
+   u8 checksum;
+
+   if (dp_panel->edid)
+   checksum = dp_panel_get_edid_checksum(dp_panel->edid);
+   else
+   checksum = dp_panel->connector->real_edid_checksum;
 
dp_link_send_edid_checksum(panel->link, checksum);
dp_link_send_test_response(panel->link);
-- 
2.30.2



[PATCH AUTOSEL 5.13 127/219] drm/msm/dp: do not end dp link training until video is ready

2021-09-09 Thread Sasha Levin
From: Kuogee Hsieh 

[ Upstream commit 2e0adc765d884cc080baa501e250bfad97035b09 ]

Initialize both pre-emphasis and voltage swing level to 0 before
start link training and do not end link training until video is
ready to reduce the period between end of link training and video
start to meet Link Layer CTS requirement.  Some dongle main link
symbol may become unlocked again if host did not end link training
soon enough after completion of link training 2. Host have to re
train main link if loss of symbol locked detected before end link
training so that the coming video stream can be transmitted to sink
properly. This fixes Link Layer CTS cases 4.3.2.1, 4.3.2.2, 4.3.2.3
and 4.3.2.4.

Changes in v3:
-- merge retrain link if loss of symbol locked happen into this patch
-- replace dp_ctrl_loss_symbol_lock() with dp_ctrl_channel_eq_ok()

Signed-off-by: Kuogee Hsieh 
Reviewed-by: Stephen Boyd 
Link: 
https://lore.kernel.org/r/1628196295-7382-7-git-send-email-khs...@codeaurora.org
Signed-off-by: Rob Clark 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/msm/dp/dp_ctrl.c | 56 +++-
 1 file changed, 41 insertions(+), 15 deletions(-)

diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
index eb63920b36e8..c1514f2cb409 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
@@ -1482,6 +1482,9 @@ static int dp_ctrl_link_maintenance(struct 
dp_ctrl_private *ctrl)
 
dp_ctrl_push_idle(&ctrl->dp_ctrl);
 
+   ctrl->link->phy_params.p_level = 0;
+   ctrl->link->phy_params.v_level = 0;
+
ctrl->dp_ctrl.pixel_rate = ctrl->panel->dp_mode.drm_mode.clock;
 
ret = dp_ctrl_setup_main_link(ctrl, &training_step);
@@ -1634,6 +1637,16 @@ static bool dp_ctrl_clock_recovery_any_ok(
return drm_dp_clock_recovery_ok(link_status, reduced_cnt);
 }
 
+static bool dp_ctrl_channel_eq_ok(struct dp_ctrl_private *ctrl)
+{
+   u8 link_status[DP_LINK_STATUS_SIZE];
+   int num_lanes = ctrl->link->link_params.num_lanes;
+
+   dp_ctrl_read_link_status(ctrl, link_status);
+
+   return drm_dp_channel_eq_ok(link_status, num_lanes);
+}
+
 int dp_ctrl_on_link(struct dp_ctrl *dp_ctrl)
 {
int rc = 0;
@@ -1668,6 +1681,9 @@ int dp_ctrl_on_link(struct dp_ctrl *dp_ctrl)
ctrl->link->link_params.rate,
ctrl->link->link_params.num_lanes, ctrl->dp_ctrl.pixel_rate);
 
+   ctrl->link->phy_params.p_level = 0;
+   ctrl->link->phy_params.v_level = 0;
+
rc = dp_ctrl_enable_mainlink_clocks(ctrl);
if (rc)
return rc;
@@ -1733,17 +1749,19 @@ int dp_ctrl_on_link(struct dp_ctrl *dp_ctrl)
if (ctrl->link->sink_request & DP_TEST_LINK_PHY_TEST_PATTERN)
return rc;
 
-   /* stop txing train pattern */
-   dp_ctrl_clear_training_pattern(ctrl);
+   if (rc == 0) {  /* link train successfully */
+   /*
+* do not stop train pattern here
+* stop link training at on_stream
+* to pass compliance test
+*/
+   } else  {
+   /*
+* link training failed
+* end txing train pattern here
+*/
+   dp_ctrl_clear_training_pattern(ctrl);
 
-   /*
-* keep transmitting idle pattern until video ready
-* to avoid main link from loss of sync
-*/
-   if (rc == 0)  /* link train successfully */
-   dp_ctrl_push_idle(dp_ctrl);
-   else  {
-   /* link training failed */
dp_ctrl_deinitialize_mainlink(ctrl);
rc = -ECONNRESET;
}
@@ -1751,9 +1769,15 @@ int dp_ctrl_on_link(struct dp_ctrl *dp_ctrl)
return rc;
 }
 
+static int dp_ctrl_link_retrain(struct dp_ctrl_private *ctrl)
+{
+   int training_step = DP_TRAINING_NONE;
+
+   return dp_ctrl_setup_main_link(ctrl, &training_step);
+}
+
 int dp_ctrl_on_stream(struct dp_ctrl *dp_ctrl)
 {
-   u32 rate = 0;
int ret = 0;
bool mainlink_ready = false;
struct dp_ctrl_private *ctrl;
@@ -1763,10 +1787,6 @@ int dp_ctrl_on_stream(struct dp_ctrl *dp_ctrl)
 
ctrl = container_of(dp_ctrl, struct dp_ctrl_private, dp_ctrl);
 
-   rate = ctrl->panel->link_info.rate;
-
-   ctrl->link->link_params.rate = rate;
-   ctrl->link->link_params.num_lanes = ctrl->panel->link_info.num_lanes;
ctrl->dp_ctrl.pixel_rate = ctrl->panel->dp_mode.drm_mode.clock;
 
DRM_DEBUG_DP("rate=%d, num_lanes=%d, pixel_rate=%d\n",
@@ -1781,6 +1801,12 @@ int dp_ctrl_on_stream(struct dp_ctrl *dp_ctrl)
}
}
 
+   if (!dp_ctrl_channel_eq_ok(ctrl))
+   dp_ctrl_link_retrain(ctrl);
+
+   /* stop txing train pattern to end link training */
+   dp_ctrl_clear_training_pattern(ctrl);
+
ret = dp_ctrl_enable_stream_clocks(ctrl);
if (ret) {
DRM_ERROR("Failed to start pixel clocks. r

[PATCH AUTOSEL 5.13 129/219] gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable access in amdgpu_i2c_router_select_ddc_port()

2021-09-09 Thread Sasha Levin
From: Tuo Li 

[ Upstream commit a211260c34cfadc6068fece8c9e99e0fe1e2a2b6 ]

The variable val is declared without initialization, and its address is
passed to amdgpu_i2c_get_byte(). In this function, the value of val is
accessed in:
  DRM_DEBUG("i2c 0x%02x 0x%02x read failed\n",
   addr, *val);

Also, when amdgpu_i2c_get_byte() returns, val may remain uninitialized,
but it is accessed in:
  val &= ~amdgpu_connector->router.ddc_mux_control_pin;

To fix this possible uninitialized-variable access, initialize val to 0 in
amdgpu_i2c_router_select_ddc_port().

Reported-by: TOTE Robot 
Signed-off-by: Tuo Li 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c
index bca45a15..82608df43396 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c
@@ -339,7 +339,7 @@ static void amdgpu_i2c_put_byte(struct amdgpu_i2c_chan 
*i2c_bus,
 void
 amdgpu_i2c_router_select_ddc_port(const struct amdgpu_connector 
*amdgpu_connector)
 {
-   u8 val;
+   u8 val = 0;
 
if (!amdgpu_connector->router.ddc_valid)
return;
-- 
2.30.2



[PATCH AUTOSEL 5.13 130/219] drm/display: fix possible null-pointer dereference in dcn10_set_clock()

2021-09-09 Thread Sasha Levin
From: Tuo Li 

[ Upstream commit 554594567b1fa3da74f88ec7b2dc83d000c58e98 ]

The variable dc->clk_mgr is checked in:
  if (dc->clk_mgr && dc->clk_mgr->funcs->get_clock)

This indicates dc->clk_mgr can be NULL.
However, it is dereferenced in:
if (!dc->clk_mgr->funcs->get_clock)

To fix this null-pointer dereference, check dc->clk_mgr and the function
pointer dc->clk_mgr->funcs->get_clock earlier, and return if one of them
is NULL.

Reported-by: TOTE Robot 
Signed-off-by: Tuo Li 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 .../gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 11 +--
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c 
b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index 7c939c0a977b..29f61a8d3e29 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -3938,13 +3938,12 @@ enum dc_status dcn10_set_clock(struct dc *dc,
struct dc_clock_config clock_cfg = {0};
struct dc_clocks *current_clocks = &context->bw_ctx.bw.dcn.clk;
 
-   if (dc->clk_mgr && dc->clk_mgr->funcs->get_clock)
-   dc->clk_mgr->funcs->get_clock(dc->clk_mgr,
-   context, clock_type, 
&clock_cfg);
-
-   if (!dc->clk_mgr->funcs->get_clock)
+   if (!dc->clk_mgr || !dc->clk_mgr->funcs->get_clock)
return DC_FAIL_UNSUPPORTED_1;
 
+   dc->clk_mgr->funcs->get_clock(dc->clk_mgr,
+   context, clock_type, &clock_cfg);
+
if (clk_khz > clock_cfg.max_clock_khz)
return DC_FAIL_CLK_EXCEED_MAX;
 
@@ -3962,7 +3961,7 @@ enum dc_status dcn10_set_clock(struct dc *dc,
else
return DC_ERROR_UNEXPECTED;
 
-   if (dc->clk_mgr && dc->clk_mgr->funcs->update_clocks)
+   if (dc->clk_mgr->funcs->update_clocks)
dc->clk_mgr->funcs->update_clocks(dc->clk_mgr,
context, true);
return DC_OK;
-- 
2.30.2



[PATCH AUTOSEL 5.13 162/219] drm/exynos: Always initialize mapping in exynos_drm_register_dma()

2021-09-09 Thread Sasha Levin
From: Nathan Chancellor 

[ Upstream commit c626f386428bbe06476b0b497c1330aa4463 ]

In certain randconfigs, clang warns:

drivers/gpu/drm/exynos/exynos_drm_dma.c:121:19: warning: variable
'mapping' is uninitialized when used here [-Wuninitialized]
priv->mapping = mapping;
^~~
drivers/gpu/drm/exynos/exynos_drm_dma.c:111:16: note: initialize the
variable 'mapping' to silence this warning
void *mapping;
 ^
  = NULL
1 warning generated.

This occurs when CONFIG_EXYNOS_IOMMU is enabled and both
CONFIG_ARM_DMA_USE_IOMMU and CONFIG_IOMMU_DMA are disabled, which makes
the code look like

  void *mapping;

  if (0)
mapping = arm_iommu_create_mapping()
  else if (0)
mapping = iommu_get_domain_for_dev()

  ...
  priv->mapping = mapping;

Add an else branch that initializes mapping to the -ENODEV error pointer
so that there is no more warning and the driver does not change during
runtime.

Reported-by: kernel test robot 
Signed-off-by: Nathan Chancellor 
Signed-off-by: Inki Dae 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/exynos/exynos_drm_dma.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/exynos/exynos_drm_dma.c 
b/drivers/gpu/drm/exynos/exynos_drm_dma.c
index 0644936afee2..bf33c3084cb4 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dma.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dma.c
@@ -115,6 +115,8 @@ int exynos_drm_register_dma(struct drm_device *drm, struct 
device *dev,
EXYNOS_DEV_ADDR_START, EXYNOS_DEV_ADDR_SIZE);
else if (IS_ENABLED(CONFIG_IOMMU_DMA))
mapping = iommu_get_domain_for_dev(priv->dma_dev);
+   else
+   mapping = ERR_PTR(-ENODEV);
 
if (IS_ERR(mapping))
return PTR_ERR(mapping);
-- 
2.30.2



[PATCH AUTOSEL 5.13 198/219] drm/amdkfd: Account for SH/SE count when setting up cu masks.

2021-09-09 Thread Sasha Levin
From: Sean Keely 

[ Upstream commit 1ec06c2dee679e9f089e78ed20cb74ee90155f61 ]

On systems with multiple SH per SE compute_static_thread_mgmt_se#
is split into independent masks, one for each SH, in the upper and
lower 16 bits.  We need to detect this and apply cu masking to each
SH.  The cu mask bits are assigned first to each SE, then to
alternate SHs, then finally to higher CU id.  This ensures that
the maximum number of SPIs are engaged as early as possible while
balancing CU assignment to each SH.

v2: Use max SH/SE rather than max SH in cu_per_sh.

v3: Fix comment blocks, ensure se_mask is initially zero filled,
and correctly assign se.sh.cu positions to unset bits in cu_mask.

Signed-off-by: Sean Keely 
Reviewed-by: Felix Kuehling 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c | 84 +++-
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h |  1 +
 2 files changed, 64 insertions(+), 21 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c 
b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
index 88813dad731f..c021519af810 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
@@ -98,36 +98,78 @@ void mqd_symmetrically_map_cu_mask(struct mqd_manager *mm,
uint32_t *se_mask)
 {
struct kfd_cu_info cu_info;
-   uint32_t cu_per_se[KFD_MAX_NUM_SE] = {0};
-   int i, se, sh, cu = 0;
-
+   uint32_t cu_per_sh[KFD_MAX_NUM_SE][KFD_MAX_NUM_SH_PER_SE] = {0};
+   int i, se, sh, cu;
amdgpu_amdkfd_get_cu_info(mm->dev->kgd, &cu_info);
 
if (cu_mask_count > cu_info.cu_active_number)
cu_mask_count = cu_info.cu_active_number;
 
+   /* Exceeding these bounds corrupts the stack and indicates a coding 
error.
+* Returning with no CU's enabled will hang the queue, which should be
+* attention grabbing.
+*/
+   if (cu_info.num_shader_engines > KFD_MAX_NUM_SE) {
+   pr_err("Exceeded KFD_MAX_NUM_SE, chip reports %d\n", 
cu_info.num_shader_engines);
+   return;
+   }
+   if (cu_info.num_shader_arrays_per_engine > KFD_MAX_NUM_SH_PER_SE) {
+   pr_err("Exceeded KFD_MAX_NUM_SH, chip reports %d\n",
+   cu_info.num_shader_arrays_per_engine * 
cu_info.num_shader_engines);
+   return;
+   }
+   /* Count active CUs per SH.
+*
+* Some CUs in an SH may be disabled.   HW expects disabled CUs to be
+* represented in the high bits of each SH's enable mask (the upper and 
lower
+* 16 bits of se_mask) and will take care of the actual distribution of
+* disabled CUs within each SH automatically.
+* Each half of se_mask must be filled only on bits 
0-cu_per_sh[se][sh]-1.
+*
+* See note on Arcturus cu_bitmap layout in gfx_v9_0_get_cu_info.
+*/
for (se = 0; se < cu_info.num_shader_engines; se++)
for (sh = 0; sh < cu_info.num_shader_arrays_per_engine; sh++)
-   cu_per_se[se] += hweight32(cu_info.cu_bitmap[se % 4][sh 
+ (se / 4)]);
-
-   /* Symmetrically map cu_mask to all SEs:
-* cu_mask[0] bit0 -> se_mask[0] bit0;
-* cu_mask[0] bit1 -> se_mask[1] bit0;
-* ... (if # SE is 4)
-* cu_mask[0] bit4 -> se_mask[0] bit1;
+   cu_per_sh[se][sh] = hweight32(cu_info.cu_bitmap[se % 
4][sh + (se / 4)]);
+
+   /* Symmetrically map cu_mask to all SEs & SHs:
+* se_mask programs up to 2 SH in the upper and lower 16 bits.
+*
+* Examples
+* Assuming 1 SH/SE, 4 SEs:
+* cu_mask[0] bit0 -> se_mask[0] bit0
+* cu_mask[0] bit1 -> se_mask[1] bit0
+* ...
+* cu_mask[0] bit4 -> se_mask[0] bit1
+* ...
+*
+* Assuming 2 SH/SE, 4 SEs
+* cu_mask[0] bit0 -> se_mask[0] bit0 (SE0,SH0,CU0)
+* cu_mask[0] bit1 -> se_mask[1] bit0 (SE1,SH0,CU0)
+* ...
+* cu_mask[0] bit4 -> se_mask[0] bit16 (SE0,SH1,CU0)
+* cu_mask[0] bit5 -> se_mask[1] bit16 (SE1,SH1,CU0)
+* ...
+* cu_mask[0] bit8 -> se_mask[0] bit1 (SE0,SH0,CU1)
 * ...
+*
+* First ensure all CUs are disabled, then enable user specified CUs.
 */
-   se = 0;
-   for (i = 0; i < cu_mask_count; i++) {
-   if (cu_mask[i / 32] & (1 << (i % 32)))
-   se_mask[se] |= 1 << cu;
-
-   do {
-   se++;
-   if (se == cu_info.num_shader_engines) {
-   se = 0;
-   cu++;
+   for (i = 0; i < cu_info.num_shader_engines; i++)
+   se_mask[i] = 0;
+
+   i = 0;
+   for (cu = 0; cu < 16; cu++) {
+   for (sh = 0; sh < cu_info.num_shader_arrays_per_engine; sh++) {
+   for (se = 0; se < cu_info.num_sh

[PATCH AUTOSEL 5.10 001/176] drm/vc4: hdmi: Set HD_CTL_WHOLSMP and HD_CTL_CHALIGN_SET

2021-09-09 Thread Sasha Levin
From: Dom Cobley 

[ Upstream commit 1698ecb218eb82587dbfc71a2e26ded66e5ecf59 ]

Symptom is random switching of speakers when using multichannel.

Repeatedly running speakertest -c8 occasionally starts with
channels jumbled. This is fixed with HD_CTL_WHOLSMP.

The other bit looks beneficial and apears harmless in testing so
I'd suggest adding it too.

Documentation says: HD_CTL_WHILSMP_SET
Wait for whole sample. When this bit is set MAI transmit will start
only when there is at least one whole sample available in the fifo.

Documentation says: HD_CTL_CHALIGN_SET
Channel Align When Overflow. This bit is used to realign the audio
channels in case of an overflow.
If this bit is set, after the detection of an overflow, equal
amount of dummy words to the missing words will be written to fifo,
filling up the broken sample and maintaining alignment.

Signed-off-by: Dom Cobley 
Signed-off-by: Maxime Ripard 
Reviewed-by: Nicolas Saenz Julienne 
Link: 
https://patchwork.freedesktop.org/patch/msgid/20210525132354.297468-7-max...@cerno.tech
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/vc4/vc4_hdmi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index c58b8840090a..ee293f061f0a 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -1074,7 +1074,9 @@ static int vc4_hdmi_audio_trigger(struct 
snd_pcm_substream *substream, int cmd,
HDMI_WRITE(HDMI_MAI_CTL,
   VC4_SET_FIELD(vc4_hdmi->audio.channels,
 VC4_HD_MAI_CTL_CHNUM) |
-  VC4_HD_MAI_CTL_ENABLE);
+VC4_HD_MAI_CTL_WHOLSMP |
+VC4_HD_MAI_CTL_CHALIGN |
+VC4_HD_MAI_CTL_ENABLE);
break;
case SNDRV_PCM_TRIGGER_STOP:
HDMI_WRITE(HDMI_MAI_CTL,
-- 
2.30.2



[PATCH AUTOSEL 5.10 002/176] drm/amdgpu: Fix amdgpu_ras_eeprom_init()

2021-09-09 Thread Sasha Levin
From: Luben Tuikov 

[ Upstream commit dce4400e6516d18313d23de45b5be8a18980b00e ]

No need to account for the 2 bytes of EEPROM
address--this is now well abstracted away by
the fixes the the lower layers.

Cc: Andrey Grodzovsky 
Cc: Alexander Deucher 
Signed-off-by: Luben Tuikov 
Acked-by: Alexander Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
index 0e64c39a2372..7c3efc5f1be0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
@@ -305,7 +305,7 @@ int amdgpu_ras_eeprom_init(struct amdgpu_ras_eeprom_control 
*control,
return ret;
}
 
-   __decode_table_header_from_buff(hdr, &buff[2]);
+   __decode_table_header_from_buff(hdr, buff);
 
if (hdr->header == EEPROM_TABLE_HDR_VAL) {
control->num_recs = (hdr->tbl_size - EEPROM_TABLE_HEADER_SIZE) /
-- 
2.30.2



  1   2   3   4   >