linux-stable.git/drivers/gpu, branch v6.4.5

drm/atomic: Fix potential use-after-free in nonblocking commits

2023-07-23T11:54:17+00:00

commit 4e076c73e4f6e90816b30fcd4a0d7ab365087255 upstream.

This requires a bit of background.  Properly done a modeset driver's
unload/remove sequence should be

	drm_dev_unplug();
	drm_atomic_helper_shutdown();
	drm_dev_put();

The trouble is that the drm_dev_unplugged() checks are by design racy,
they do not synchronize against all outstanding ioctl.  This is because
those ioctl could block forever (both for modeset and for driver
specific ioctls), leading to deadlocks in hotunplug.  Instead the code
sections that touch the hardware need to be annotated with
drm_dev_enter/exit, to avoid accessing hardware resources after the
unload/remove has finished.

To avoid use-after-free issues all the involved userspace visible
objects are supposed to hold a reference on the underlying drm_device,
like drm_file does.

The issue now is that we missed one, the atomic modeset ioctl can be run
in a nonblocking fashion, and in that case it cannot rely on the implied
drm_device reference provided by the ioctl calling context.  This can
result in a use-after-free if an nonblocking atomic commit is carefully
raced against a driver unload.

Fix this by unconditionally grabbing a drm_device reference for any
drm_atomic_state structures.  Strictly speaking this isn't required for
blocking commits and TEST_ONLY calls, but it's the simpler approach.

Thanks to shanzhulig for the initial idea of grabbing an unconditional
reference, I just added comments, a condensed commit message and fixed a
minor potential issue in where exactly we drop the final reference.

Reported-by: shanzhulig 
Suggested-by: shanzhulig 
Reviewed-by: Maxime Ripard 
Cc: Maarten Lankhorst 
Cc: Thomas Zimmermann 
Cc: David Airlie 
Cc: stable@kernel.org
Signed-off-by: Daniel Vetter 
Signed-off-by: Daniel Vetter 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

Revert "drm/amd: Disable PSR-SU on Parade 0803 TCON"

2023-07-23T11:54:17+00:00

commit 1e66a17ce546eabad753178bbd4175cb52bafca8 upstream.

This reverts commit 072030b1783056b5de8b0fac5303a5e9dbc6cfde.
This is no longer necessary when using newer DMUB F/W.

Cc: stable@vger.kernel.org
Cc: Sean Wang 
Cc: Marc Rossi 
Cc: Hamza Mahfooz 
Cc: Tsung-hua (Ryan) Lin 
Reviewed-by: Leo Li 
Signed-off-by: Mario Limonciello 
Signed-off-by: Alex Deucher 
Signed-off-by: Greg Kroah-Hartman

drm/amd/pm: conditionally disable pcie lane/speed switching for SMU13

2023-07-23T11:54:10+00:00

commit 31c7a3b378a136adc63296a2ff17645896fcf303 upstream.

Intel platforms such as Sapphire Rapids and Raptor Lake don't support
dynamic pcie lane or speed switching.

This limitation seems to carry over from one generation to another.
To be safer, disable dynamic pcie lane width and speed switching when
running on an Intel platform.

Link: https://edc.intel.com/content/www/us/en/design/products/platforms/details/raptor-lake-s/13th-generation-core-processors-datasheet-volume-1-of-2/005/pci-express-support/
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2663
Co-developed-by: Evan Quan 
Signed-off-by: Evan Quan 
Signed-off-by: Mario Limonciello 
Reviewed-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Cc: stable@vger.kernel.org # 6.1.x
Signed-off-by: Greg Kroah-Hartman

drm/amd/pm: share the code around SMU13 pcie parameters update

2023-07-23T11:54:10+00:00

commit dcb489bae65d92cfd26da22c7a0d6665b06ecc63 upstream.

So that SMU13.0.0 and SMU13.0.7 do not need to have one copy each.

Signed-off-by: Evan Quan 
Signed-off-by: Mario Limonciello 
Reviewed-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Cc: stable@vger.kernel.org # 6.1.x
Signed-off-by: Greg Kroah-Hartman

drm/ttm: Don't leak a resource on swapout move error

2023-07-23T11:54:05+00:00

commit a590f03d8de7c4cb7ce4916dc7f2fd10711faabe upstream.

If moving the bo to system for swapout failed, we were leaking
a resource. Fix.

Fixes: bfa3357ef9ab ("drm/ttm: allocate resource object instead of embedding it v2")
Cc: Christian König 
Cc: "Christian König" 
Cc: dri-devel@lists.freedesktop.org
Cc:  # v5.14+
Signed-off-by: Thomas Hellström 
Reviewed-by: Nirmoy Das 
Reviewed-by: Andi Shyti 
Reviewed-by: Christian König 
Link: https://patchwork.freedesktop.org/patch/msgid/20230626091450.14757-5-thomas.hellstrom@linux.intel.com
Signed-off-by: Greg Kroah-Hartman

drm/ttm: Don't leak a resource on eviction error

2023-07-23T11:54:05+00:00

commit e8188c461ee015ba0b9ab2fc82dbd5ebca5a5532 upstream.

On eviction errors other than -EMULTIHOP we were leaking a resource.
Fix.

v2:
- Avoid yet another goto (Andi Shyti)

Fixes: 403797925768 ("drm/ttm: Fix multihop assert on eviction.")
Cc: Andrey Grodzovsky 
Cc: Christian König 
Cc: Christian Koenig 
Cc: Huang Rui 
Cc: dri-devel@lists.freedesktop.org
Cc:  # v5.15+
Signed-off-by: Thomas Hellström 
Reviewed-by: Nirmoy Das  #v1
Reviewed-by: Andi Shyti 
Reviewed-by: Christian König 
Link: https://patchwork.freedesktop.org/patch/msgid/20230626091450.14757-4-thomas.hellstrom@linux.intel.com
Signed-off-by: Greg Kroah-Hartman

drm/amd/pm: fix smu i2c data read risk

2023-07-23T11:54:05+00:00

commit d934e537c14bfe1227ced6341472571f354383e8 upstream.

the smu driver_table is used for all types of smu
tables data transcation (e.g: PPtable, Metrics, i2c, Ecc..).

it is necessary to hold this lock to avoiding data tampering
during the i2c read operation.

Signed-off-by: Yang Wang 
Reviewed-by: Lijo Lazar 
Signed-off-by: Alex Deucher 
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman

drm/amdgpu: avoid restore process run into dead loop.

2023-07-23T11:54:04+00:00

commit 8a774fe912ff09e39c2d3a3589c729330113f388 upstream.

In restore process worker, pinned BO cause update PTE fail, then
the function re-schedule the restore_work. This will generate dead loop.

Signed-off-by: gaba 
Reviewed-by: Felix Kuehling 
Signed-off-by: Alex Deucher 
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman

drm/amd/display: Add monitor specific edid quirk

2023-07-23T11:54:04+00:00

commit 613a7956deb3b1ffa2810c6d4c90ee9c3d743dbb upstream.

Disable FAMS on a Samsung Odyssey G9 monitor. Experiments show that this
monitor does not work well under some use cases, and is likely
implementation specific bug on the monitor's firmware.

Cc: stable@vger.kernel.org
Reviewed-by: Rodrigo Siqueira 
Signed-off-by: Aurabindo Pillai 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
Signed-off-by: Greg Kroah-Hartman

drm/amd/display: Correct `DMUB_FW_VERSION` macro

2023-07-23T11:54:04+00:00

commit 274d205cb59f43815542e04b42a9e6d0b9b95eff upstream.

The `DMUB_FW_VERSION` macro has a mistake in that the revision field
is off by one byte. The last byte is typically used for other purposes
and not a revision.

Cc: stable@vger.kernel.org
Cc: Sean Wang 
Cc: Marc Rossi 
Cc: Hamza Mahfooz 
Cc: Tsung-hua (Ryan) Lin 
Reviewed-by: Leo Li 
Signed-off-by: Mario Limonciello 
Signed-off-by: Alex Deucher 
Signed-off-by: Greg Kroah-Hartman