linux-stable.git/drivers/gpu/drm/amd/display/amdgpu_dm, branch v5.15

drm/amdgpu: Fix even more out of bound writes from debugfs

2021-10-28T02:02:28+00:00

CVE-2021-42327 was fixed by:

commit f23750b5b3d98653b31d4469592935ef6364ad67
Author: Thelford Williams 
Date:   Wed Oct 13 16:04:13 2021 -0400

    drm/amdgpu: fix out of bounds write

but amdgpu_dm_debugfs.c contains more of the same issue so fix the
remaining ones.

v2:
	* Add missing fix in dp_max_bpc_write (Harry Wentland)

Fixes: 918698d5c2b5 ("drm/amd/display: Return the number of bytes parsed than allocated")
Signed-off-by: Patrik Jakobsson 
Reviewed-by: Harry Wentland 
Signed-off-by: Alex Deucher 
Cc: stable@vger.kernel.org

drm/amdgpu: fix out of bounds write

2021-10-20T19:13:50+00:00

Size can be any value and is user controlled resulting in overwriting the
40 byte array wr_buf with an arbitrary length of data from buf.

Signed-off-by: Thelford Williams 
Signed-off-by: Alex Deucher 
Cc: stable@vger.kernel.org

drm/amd/display: Pass PCI deviceid into DC

2021-09-28T18:39:54+00:00

[why]
pci deviceid not passed to dal dc, without proper break,
dcn2.x falls into dcn3.x code path

[how]
pass in pci deviceid, and break once dal_version initialized.

Reviewed-by: Zhan Liu 
Acked-by: Anson Jacob 
Signed-off-by: Charlene Liu 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
Cc: stable@vger.kernel.org

drm/amd/display: initialize backlight_ramping_override to false

2021-09-28T18:39:40+00:00

[Why]
Stack variable params.backlight_ramping_override is uninitialized, so it
contains junk data

[How]
Initialize the variable to false

Reviewed-by: Roman Li 
Acked-by: Anson Jacob 
Signed-off-by: Josip Pavic 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
Cc: stable@vger.kernel.org

drm/amd/display: Fix white screen page fault for gpuvm

2021-09-16T13:56:24+00:00

[Why]
The "base_addr_is_mc_addr" field was added for dcn3.1 support but
pa_config was never updated to set it to false.

Uninitialized memory causes it to be set to true which results in
address mistranslation and white screen.

[How]
Use memset to ensure all fields are initialized to 0 by default.

Fixes: 64b1d0e8d500 ("drm/amd/display: Add DCN3.1 HWSEQ")
Signed-off-by: Nicholas Kazlauskas 
Acked-by: Alex Deucher 
Acked-by: Aaron Liu 
Reviewed-by: Harry Wentland 
Signed-off-by: Alex Deucher 
Cc: stable@vger.kernel.org

amd/display: enable panel orientation quirks

2021-09-16T13:56:24+00:00

This patch allows panel orientation quirks from DRM core to be
used. They attach a DRM connector property "panel orientation"
which indicates in which direction the panel has been mounted.
Some machines have the internal screen mounted with a rotation.

Since the panel orientation quirks need the native mode from the
EDID, check for it in amdgpu_dm_connector_ddc_get_modes.

Signed-off-by: Simon Ser 
Cc: Alex Deucher 
Cc: Harry Wentland 
Cc: Nicholas Kazlauskas 
Reviewed-by: Harry Wentland 
Signed-off-by: Alex Deucher

drm/amd/display: Fix unstable HPCP compliance on Chrome Barcelo

2021-09-16T13:56:24+00:00

[Why]
Intermittently, there presents two occurrences of 0 stream
commits in a single HPD event. Current HDCP sequence does
not consider such scenerio, and will thus disable HDCP.

[How]
Add condition check to include stream remove and re-enable
case for HDCP enable.

Reviewed-by: Bhawanpreet Lakha 
Acked-by: Mikita Lipski 
Signed-off-by: Qingqing Zhuo 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher

drm/amd/display: dsc mst 2 4K displays go dark with 2 lane HBR3

2021-09-16T13:56:23+00:00

[Why]
call stack of amdgpu dsc mst pbn, slot num calculation is as below:
-compute_bpp_x16_from_target_bandwidth
-decide_dsc_target_bpp_x16
-setup_dsc_config
-dc_dsc_compute_bandwidth_range
-compute_mst_dsc_configs_for_link
-compute_mst_dsc_configs_for_state

from pbn -> dsc target bpp_x16

bpp_x16 is calulated by compute_bpp_x16_from_target_bandwidth.
Beside pixel clock and bpp, num_slices_h and bpp_increment_div
will also affect bpp_x16.

from dsc target bpp_x16 -> pbn

within dm_update_mst_vcpi_slots_for_dsc,
pbn = drm_dp_calc_pbn_mode(clock, bpp_x16, true);

drm_dp_calc_pbn_mode(int clock, int bpp, bool dsc)
{
  return DIV_ROUND_UP_ULL(mul_u32_u32(clock * (bpp / 16), 64 * 1006),
            8 * 54 * 1000 * 1000);
}

bpp / 16 trunc digits after decimal point. This will cause calculation
delta. drm_dp_calc_pbn_mode does not have other informations,
like num_slices_h, bpp_increment_div. therefore, it does not do revese
calcuation properly from bpp_x16 to pbn.

pbn from drm_dp_calc_pbn_mode is less than pbn from
compute_mst_dsc_configs_for_state. This cause not enough mst slot
allocated to display. display could not visually light up.

[How]
pass pbn from compute_mst_dsc_configs_for_state to
dm_update_mst_vcpi_slots_for_dsc

Cc: stable@vger.kernel.org

Reviewed-by: Scott Foster 
Acked-by: Mikita Lipski 
Signed-off-by: Hersen Wu 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher

drm/amd/display: dc_assert_fp_enabled assert only if FPU is not enabled

2021-09-16T13:56:23+00:00

Assert only when FPU is not enabled.

Fixes: 0ea7ee821701 ("drm/amd/display: Add DC_FP helper to check FPU state")
Signed-off-by: Anson Jacob 
Cc: Christian König 
Cc: Hersen Wu 
Cc: Harry Wentland 
Cc: Rodrigo Siqueira 
Reviewed-by: Harry Wentland 
Signed-off-by: Alex Deucher

drm/amd/display: Add NULL checks for vblank workqueue

2021-09-16T13:56:23+00:00

[Why]
If we're running a headless config with 0 links then the vblank
workqueue will be NULL - causing a NULL pointer exception during
any commit.

[How]
Guard access to the workqueue if it's NULL and don't queue or flush
work if it is.

Reported-by: Mike Lothian 
BugLink: https://gitlab.freedesktop.org/drm/amd/-/issues/1700
Fixes: 58aa1c50e5a231 ("drm/amd/display: Use vblank control events for PSR enable/disable")
Signed-off-by: Nicholas Kazlauskas 
Reviewed-by: Harry Wentland 
Signed-off-by: Alex Deucher