linux-stable.git/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c, branch v5.15 Linux kernel stable tree drm/amdgpu: Fix even more out of bound writes from debugfs 2021-10-28T02:02:28+00:00 Patrik Jakobsson patrik.r.jakobsson@gmail.com 2021-10-27T14:27:30+00:00 3f4e54bd312d3dafb59daf2b97ffa08abebe60f5 CVE-2021-42327 was fixed by: commit f23750b5b3d98653b31d4469592935ef6364ad67 Author: Thelford Williams <tdwilliamsiv@gmail.com> Date: Wed Oct 13 16:04:13 2021 -0400 drm/amdgpu: fix out of bounds write but amdgpu_dm_debugfs.c contains more of the same issue so fix the remaining ones. v2: * Add missing fix in dp_max_bpc_write (Harry Wentland) Fixes: 918698d5c2b5 ("drm/amd/display: Return the number of bytes parsed than allocated") Signed-off-by: Patrik Jakobsson <pjakobsson@suse.de> Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org 
CVE-2021-42327 was fixed by:

commit f23750b5b3d98653b31d4469592935ef6364ad67
Author: Thelford Williams <tdwilliamsiv@gmail.com>
Date:   Wed Oct 13 16:04:13 2021 -0400

    drm/amdgpu: fix out of bounds write

but amdgpu_dm_debugfs.c contains more of the same issue so fix the
remaining ones.

v2:
	* Add missing fix in dp_max_bpc_write (Harry Wentland)

Fixes: 918698d5c2b5 ("drm/amd/display: Return the number of bytes parsed than allocated")
Signed-off-by: Patrik Jakobsson <pjakobsson@suse.de>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
drm/amdgpu: fix out of bounds write 2021-10-20T19:13:50+00:00 Thelford Williams tdwilliamsiv@gmail.com 2021-10-13T20:04:13+00:00 5afa7898ab7a0ec9c28556a91df714bf3c2f725e Size can be any value and is user controlled resulting in overwriting the 40 byte array wr_buf with an arbitrary length of data from buf. Signed-off-by: Thelford Williams <tdwilliamsiv@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org 
Size can be any value and is user controlled resulting in overwriting the
40 byte array wr_buf with an arbitrary length of data from buf.

Signed-off-by: Thelford Williams <tdwilliamsiv@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
drm/amd/amdgpu: Add a new line to debugfs phy_settings output 2021-07-23T14:08:00+00:00 Anson Jacob Anson.Jacob@amd.com 2021-07-20T15:43:20+00:00 6d7f735366c7b31655ff5e6dfff22b38440e2be4 Add new line to phy_settings output Signed-off-by: Anson Jacob <Anson.Jacob@amd.com> Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> 
Add new line to phy_settings output

Signed-off-by: Anson Jacob <Anson.Jacob@amd.com>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex 2021-07-23T14:08:00+00:00 Anson Jacob Anson.Jacob@amd.com 2021-07-20T15:00:44+00:00 1a394b3c3de2577f200cb623c52a5c2b82805cec link_rate is updated via debugfs using hex values, set it to output in hex as well. eg: Resolution: 1920x1080@144Hz cat /sys/kernel/debug/dri/0/DP-1/link_settings Current: 4 0x14 0 Verified: 4 0x1e 0 Reported: 4 0x1e 16 Preferred: 0 0x0 0 echo "4 0x1e" > /sys/kernel/debug/dri/0/DP-1/link_settings cat /sys/kernel/debug/dri/0/DP-1/link_settings Current: 4 0x1e 0 Verified: 4 0x1e 0 Reported: 4 0x1e 16 Preferred: 4 0x1e 0 Signed-off-by: Anson Jacob <Anson.Jacob@amd.com> Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> 
link_rate is updated via debugfs using hex values, set it to output
in hex as well.

eg: Resolution: 1920x1080@144Hz
cat /sys/kernel/debug/dri/0/DP-1/link_settings
Current:  4  0x14  0  Verified:  4  0x1e  0  Reported:  4  0x1e  16  Preferred:  0  0x0  0

echo "4 0x1e" > /sys/kernel/debug/dri/0/DP-1/link_settings

cat /sys/kernel/debug/dri/0/DP-1/link_settings
Current:  4  0x1e  0  Verified:  4  0x1e  0  Reported:  4  0x1e  16  Preferred:  4  0x1e  0

Signed-off-by: Anson Jacob <Anson.Jacob@amd.com>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drm/amd/display: Add debugfs entry for dsc passthrough 2021-06-08T16:23:36+00:00 Fangzhi Zuo Jerry.Zuo@amd.com 2021-05-26T00:39:12+00:00 fcd1e484c8aedb0c125d4a22f7f20b418c4a9e6d [Why & How] Add debugfs entry to force dsc decoding at PCON when DSC capable external RX is connected. In such case, it is free to test DSC decoding at external RX or at PCON. Signed-off-by: Fangzhi Zuo <Jerry.Zuo@amd.com> Reviewed-by: Hersen Wu <hersenxs.wu@amd.com> Acked-by: Stylon Wang <stylon.wang@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> 
[Why & How]
Add debugfs entry to force dsc decoding at PCON when DSC capable
external RX is connected. In such case, it is free to test DSC
decoding at external RX or at PCON.

Signed-off-by: Fangzhi Zuo <Jerry.Zuo@amd.com>
Reviewed-by: Hersen Wu <hersenxs.wu@amd.com>
Acked-by: Stylon Wang <stylon.wang@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drm/amd/display: multi-eDP backlight support 2021-05-10T22:06:44+00:00 Mikita Lipski mikita.lipski@amd.com 2021-04-14T18:51:02+00:00 118b4627d6777d8d422786ded6a0bd8e2934d11f [why] Currently the assumption is that we are using a single eDP connector so there will only be one backlight object. Need changes to allow brightness update and reading for multiple eDP connectors. [how] - register a single device - turn backlight link from a pointer to an array of pointers - update brightness of all eDP links at the same time when request is registered - read brightness level only of the primary eDP panel - turn current_backlight_pwm and targer_backlight_pwm debugfs enteries into per connector enteries. Signed-off-by: Mikita Lipski <mikita.lipski@amd.com> Reviewed-by: Nicholas Kazlauskas <Nicholas.Kazlauskas@amd.com> Acked-by: Wayne Lin <waynelin@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> 
[why]
Currently the assumption is that we are using a single eDP
connector so there will only be one backlight object. Need changes
to allow brightness update and reading for multiple eDP connectors.

[how]
- register a single device
- turn backlight link from a pointer to an array of pointers
- update brightness of all eDP links at the same time when request
is registered
- read brightness level only of the primary eDP panel
- turn current_backlight_pwm and targer_backlight_pwm debugfs enteries
into per connector enteries.

Signed-off-by: Mikita Lipski <mikita.lipski@amd.com>
Reviewed-by: Nicholas Kazlauskas <Nicholas.Kazlauskas@amd.com>
Acked-by: Wayne Lin <waynelin@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drm/amd/display: fix wrong statement in mst hpd debugfs 2021-04-29T03:35:50+00:00 Mikita Lipski mikita.lipski@amd.com 2021-04-14T18:15:52+00:00 abf1f863e08dc23764ce617dd55e1b533e525a3f [why] Previous statement would always evaluate to true making it meaningless [how] Just check if a connector is MST by checking if its port exists. Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Mikita Lipski <mikita.lipski@amd.com> Reviewed-by: Nicholas Kazlauskas <Nicholas.Kazlauskas@amd.com> Acked-by: Wayne Lin <waynelin@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> 
[why]
Previous statement would always evaluate to true
making it meaningless
[how]
Just check if a connector is MST by checking if its port exists.

Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Mikita Lipski <mikita.lipski@amd.com>
Reviewed-by: Nicholas Kazlauskas <Nicholas.Kazlauskas@amd.com>
Acked-by: Wayne Lin <waynelin@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drm/amd/display: Expose internal display flag via debugfs 2021-04-29T03:35:50+00:00 Stylon Wang stylon.wang@amd.com 2021-04-07T10:14:55+00:00 b7cc1312c110f8760a3d3e8e41a6d84e32f71a61 [Why & How] Add a per-connector debugfs entry to expose internal display flag, which is indication that the display is "internally connected" and not hotpluggable. Signed-off-by: Stylon Wang <stylon.wang@amd.com> Reviewed-by: Wayne Lin <Wayne.Lin@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> 
[Why & How]
Add a per-connector debugfs entry to expose internal display flag,
which is indication that the display is "internally connected"
and not hotpluggable.

Signed-off-by: Stylon Wang <stylon.wang@amd.com>
Reviewed-by: Wayne Lin <Wayne.Lin@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drm/amd/display: Add debugfs to repress HPD and HPR_RX IRQs 2021-04-15T20:31:59+00:00 Harry Wentland harry.wentland@amd.com 2020-10-02T17:32:00+00:00 b972b4f913eee029233be88e1a84a7cc36073c8b [Why] For debugging reasons it can be beneficial to disable any hotplug and DP shortpulse interrupt handling. [How] Expose a debugfs to set a flag to bypass HPD IRQ handling and skip IRQ handling if flag is set. Signed-off-by: Harry Wentland <harry.wentland@amd.com> Acked-by: Bindu Ramamurthy <bindur12@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> 
[Why]
For debugging reasons it can be beneficial to disable any hotplug and DP shortpulse interrupt handling.

[How]
Expose a debugfs to set a flag to bypass HPD IRQ handling and skip IRQ handling if flag is set.

Signed-off-by: Harry Wentland <harry.wentland@amd.com>
Acked-by: Bindu Ramamurthy <bindur12@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drm/amd/display: Add MST capability to trigger_hotplug interface 2021-04-09T20:53:12+00:00 Mikita Lipski mikita.lipski@amd.com 2020-09-15T12:50:49+00:00 41efcd3879b1df7213dcd1b190a9feb86765cc9b [Why] Need to be able to trigger software hotplug for MST connectors [How] For unplug the driver calls to disable topologies manager that connector is attached to. For plugging in it does the whole rediscovery of all connectors in drm device and enbles their topologies if attached. The interface for MST connectors works in the following way: 1. To disconnect all MST topologies currently connected: echo 0 > /sys/kernel/debug/dri/0/amdgpu_dm_trigger_hpd_mst 2. To reconnect/rediscover all topologies that are physically connected to the card: echo 1 > /sys/kernel/debug/dri/0/amdgpu_dm_trigger_hpd_mst A related fix which has been merged with this patch Leo Ma(Hanghong Ma)'s work: Set power states before disable MST topology [Why] When we try to disable MST topology from the debugfs entry, some receiver will hang. [How] Set DPCD 600h power states to 2(power down mode)before disable MST topology. Signed-off-by: Mikita Lipski <mikita.lipski@amd.com> Reviewed-by: Sun peng Li <Sunpeng.Li@amd.com> Acked-by: Qingqing Zhuo <qingqing.zhuo@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> 
[Why]
Need to be able to trigger software hotplug for MST connectors

[How]
For unplug the driver calls to disable topologies manager
that connector is attached to. For plugging in it does the
whole rediscovery of all connectors in drm device and enbles their
topologies if attached.

The interface for MST connectors works in the following way:

1. To disconnect all MST topologies currently connected:
   echo 0 > /sys/kernel/debug/dri/0/amdgpu_dm_trigger_hpd_mst

2. To reconnect/rediscover all topologies that are physically
connected to the card:
   echo 1 > /sys/kernel/debug/dri/0/amdgpu_dm_trigger_hpd_mst

A related fix which has been merged with this patch
Leo Ma(Hanghong Ma)'s work:

Set power states before disable MST topology
[Why]
	When we try to disable MST topology from the
	debugfs entry, some receiver will hang.
[How]
	Set DPCD 600h power states to
	2(power down mode)before disable MST topology.

Signed-off-by: Mikita Lipski <mikita.lipski@amd.com>
Reviewed-by: Sun peng Li <Sunpeng.Li@amd.com>
Acked-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>