from:"Sasha Levin"

[PATCH AUTOSEL 6.5 5/6] drm/amdgpu: fix software pci_unplug on some chips

2023-11-14 Thread Sasha Levin

From: Vitaly Prosyak 

[ Upstream commit 4638e0c29a3f2294d5de0d052a4b8c9f33ccb957 ]

When software 'pci unplug' using IGT is executed we got a sysfs directory
entry is NULL for differant ras blocks like hdp, umc, etc.
Before call 'sysfs_remove_file_from_group' and 'sysfs_remove_group'
check that 'sd' is  not NULL.

[  +0.01] RIP: 0010:sysfs_remove_group+0x83/0x90
[  +0.02] Code: 31 c0 31 d2 31 f6 31 ff e9 9a a8 b4 00 4c 89 e7 e8 f2 a2 ff 
ff eb c2 49 8b 55 00 48 8b 33 48 c7 c7 80 65 94 82 e8 cd 82 bb ff <0f> 0b eb cc 
66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90
[  +0.01] RSP: 0018:c90002067c90 EFLAGS: 00010246
[  +0.02] RAX:  RBX: 824ea180 RCX: 
[  +0.01] RDX:  RSI:  RDI: 
[  +0.01] RBP: c90002067ca8 R08:  R09: 
[  +0.01] R10:  R11:  R12: 
[  +0.01] R13: 88810a395f48 R14: 888101aab0d0 R15: 
[  +0.01] FS:  7f5ddaa43a00() GS:88841e80() 
knlGS:
[  +0.02] CS:  0010 DS:  ES:  CR0: 80050033
[  +0.01] CR2: 7f8ffa61ba50 CR3: 000106432000 CR4: 00350ef0
[  +0.01] Call Trace:
[  +0.01]  
[  +0.01]  ? show_regs+0x72/0x90
[  +0.02]  ? sysfs_remove_group+0x83/0x90
[  +0.02]  ? __warn+0x8d/0x160
[  +0.01]  ? sysfs_remove_group+0x83/0x90
[  +0.01]  ? report_bug+0x1bb/0x1d0
[  +0.03]  ? handle_bug+0x46/0x90
[  +0.01]  ? exc_invalid_op+0x19/0x80
[  +0.02]  ? asm_exc_invalid_op+0x1b/0x20
[  +0.03]  ? sysfs_remove_group+0x83/0x90
[  +0.01]  dpm_sysfs_remove+0x61/0x70
[  +0.02]  device_del+0xa3/0x3d0
[  +0.02]  ? ktime_get_mono_fast_ns+0x46/0xb0
[  +0.02]  device_unregister+0x18/0x70
[  +0.01]  i2c_del_adapter+0x26d/0x330
[  +0.02]  arcturus_i2c_control_fini+0x25/0x50 [amdgpu]
[  +0.000236]  smu_sw_fini+0x38/0x260 [amdgpu]
[  +0.000241]  amdgpu_device_fini_sw+0x116/0x670 [amdgpu]
[  +0.000186]  ? mutex_lock+0x13/0x50
[  +0.03]  amdgpu_driver_release_kms+0x16/0x40 [amdgpu]
[  +0.000192]  drm_minor_release+0x4f/0x80 [drm]
[  +0.25]  drm_release+0xfe/0x150 [drm]
[  +0.27]  __fput+0x9f/0x290
[  +0.02]  fput+0xe/0x20
[  +0.02]  task_work_run+0x61/0xa0
[  +0.02]  exit_to_user_mode_prepare+0x150/0x170
[  +0.02]  syscall_exit_to_user_mode+0x2a/0x50

Cc: Hawking Zhang 
Cc: Luben Tuikov 
Cc: Alex Deucher 
Cc: Christian Koenig 
Signed-off-by: Vitaly Prosyak 
Reviewed-by: Luben Tuikov 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 9 ++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
index 7d5019a884024..2003be3390aab 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
@@ -1380,7 +1380,8 @@ static void amdgpu_ras_sysfs_remove_bad_page_node(struct 
amdgpu_device *adev)
 {
struct amdgpu_ras *con = amdgpu_ras_get_context(adev);
 
-   sysfs_remove_file_from_group(>dev->kobj,
+   if (adev->dev->kobj.sd)
+   sysfs_remove_file_from_group(>dev->kobj,
>badpages_attr.attr,
RAS_FS_NAME);
 }
@@ -1397,7 +1398,8 @@ static int amdgpu_ras_sysfs_remove_feature_node(struct 
amdgpu_device *adev)
.attrs = attrs,
};
 
-   sysfs_remove_group(>dev->kobj, );
+   if (adev->dev->kobj.sd)
+   sysfs_remove_group(>dev->kobj, );
 
return 0;
 }
@@ -1444,7 +1446,8 @@ int amdgpu_ras_sysfs_remove(struct amdgpu_device *adev,
if (!obj || !obj->attr_inuse)
return -EINVAL;
 
-   sysfs_remove_file_from_group(>dev->kobj,
+   if (adev->dev->kobj.sd)
+   sysfs_remove_file_from_group(>dev->kobj,
>sysfs_attr.attr,
RAS_FS_NAME);
obj->attr_inuse = 0;
-- 
2.42.0

[PATCH AUTOSEL 6.6 5/6] drm/amdgpu: fix software pci_unplug on some chips

2023-11-14 Thread Sasha Levin

From: Vitaly Prosyak 

[ Upstream commit 4638e0c29a3f2294d5de0d052a4b8c9f33ccb957 ]

When software 'pci unplug' using IGT is executed we got a sysfs directory
entry is NULL for differant ras blocks like hdp, umc, etc.
Before call 'sysfs_remove_file_from_group' and 'sysfs_remove_group'
check that 'sd' is  not NULL.

[  +0.01] RIP: 0010:sysfs_remove_group+0x83/0x90
[  +0.02] Code: 31 c0 31 d2 31 f6 31 ff e9 9a a8 b4 00 4c 89 e7 e8 f2 a2 ff 
ff eb c2 49 8b 55 00 48 8b 33 48 c7 c7 80 65 94 82 e8 cd 82 bb ff <0f> 0b eb cc 
66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90
[  +0.01] RSP: 0018:c90002067c90 EFLAGS: 00010246
[  +0.02] RAX:  RBX: 824ea180 RCX: 
[  +0.01] RDX:  RSI:  RDI: 
[  +0.01] RBP: c90002067ca8 R08:  R09: 
[  +0.01] R10:  R11:  R12: 
[  +0.01] R13: 88810a395f48 R14: 888101aab0d0 R15: 
[  +0.01] FS:  7f5ddaa43a00() GS:88841e80() 
knlGS:
[  +0.02] CS:  0010 DS:  ES:  CR0: 80050033
[  +0.01] CR2: 7f8ffa61ba50 CR3: 000106432000 CR4: 00350ef0
[  +0.01] Call Trace:
[  +0.01]  
[  +0.01]  ? show_regs+0x72/0x90
[  +0.02]  ? sysfs_remove_group+0x83/0x90
[  +0.02]  ? __warn+0x8d/0x160
[  +0.01]  ? sysfs_remove_group+0x83/0x90
[  +0.01]  ? report_bug+0x1bb/0x1d0
[  +0.03]  ? handle_bug+0x46/0x90
[  +0.01]  ? exc_invalid_op+0x19/0x80
[  +0.02]  ? asm_exc_invalid_op+0x1b/0x20
[  +0.03]  ? sysfs_remove_group+0x83/0x90
[  +0.01]  dpm_sysfs_remove+0x61/0x70
[  +0.02]  device_del+0xa3/0x3d0
[  +0.02]  ? ktime_get_mono_fast_ns+0x46/0xb0
[  +0.02]  device_unregister+0x18/0x70
[  +0.01]  i2c_del_adapter+0x26d/0x330
[  +0.02]  arcturus_i2c_control_fini+0x25/0x50 [amdgpu]
[  +0.000236]  smu_sw_fini+0x38/0x260 [amdgpu]
[  +0.000241]  amdgpu_device_fini_sw+0x116/0x670 [amdgpu]
[  +0.000186]  ? mutex_lock+0x13/0x50
[  +0.03]  amdgpu_driver_release_kms+0x16/0x40 [amdgpu]
[  +0.000192]  drm_minor_release+0x4f/0x80 [drm]
[  +0.25]  drm_release+0xfe/0x150 [drm]
[  +0.27]  __fput+0x9f/0x290
[  +0.02]  fput+0xe/0x20
[  +0.02]  task_work_run+0x61/0xa0
[  +0.02]  exit_to_user_mode_prepare+0x150/0x170
[  +0.02]  syscall_exit_to_user_mode+0x2a/0x50

Cc: Hawking Zhang 
Cc: Luben Tuikov 
Cc: Alex Deucher 
Cc: Christian Koenig 
Signed-off-by: Vitaly Prosyak 
Reviewed-by: Luben Tuikov 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 9 ++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
index 163445baa4fc8..6f6341f702789 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
@@ -1373,7 +1373,8 @@ static void amdgpu_ras_sysfs_remove_bad_page_node(struct 
amdgpu_device *adev)
 {
struct amdgpu_ras *con = amdgpu_ras_get_context(adev);
 
-   sysfs_remove_file_from_group(>dev->kobj,
+   if (adev->dev->kobj.sd)
+   sysfs_remove_file_from_group(>dev->kobj,
>badpages_attr.attr,
RAS_FS_NAME);
 }
@@ -1390,7 +1391,8 @@ static int amdgpu_ras_sysfs_remove_feature_node(struct 
amdgpu_device *adev)
.attrs = attrs,
};
 
-   sysfs_remove_group(>dev->kobj, );
+   if (adev->dev->kobj.sd)
+   sysfs_remove_group(>dev->kobj, );
 
return 0;
 }
@@ -1437,7 +1439,8 @@ int amdgpu_ras_sysfs_remove(struct amdgpu_device *adev,
if (!obj || !obj->attr_inuse)
return -EINVAL;
 
-   sysfs_remove_file_from_group(>dev->kobj,
+   if (adev->dev->kobj.sd)
+   sysfs_remove_file_from_group(>dev->kobj,
>sysfs_attr.attr,
RAS_FS_NAME);
obj->attr_inuse = 0;
-- 
2.42.0

Re: [PATCH AUTOSEL 6.6 09/11] drm/amd: Fix UBSAN array-index-out-of-bounds for Powerplay headers

2023-11-12 Thread Sasha Levin


On Sun, Nov 12, 2023 at 01:00:37PM -0500, Alex Deucher wrote:

On Sun, Nov 12, 2023 at 8:27 AM Sasha Levin  wrote:


From: Alex Deucher 

[ Upstream commit 49afe91370b86566857a3c2c39612cf098110885 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2039926
Reviewed-by: Mario Limonciello 
Acked-by: Christian König 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 


I don't think any of these UBSAN flexible array changes are stable material.


I'll drop it, but in general we've been taking kasan/ubsan/kcsan/...
annotation fixes since it enables (easier) testing on the LTS trees, and
for example finding issues specific to those LTS trees.
--
Thanks,
Sasha

[PATCH AUTOSEL 4.14 4/4] drm/amd: Fix UBSAN array-index-out-of-bounds for Powerplay headers

2023-11-12 Thread Sasha Levin

From: Alex Deucher 

[ Upstream commit 49afe91370b86566857a3c2c39612cf098110885 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2039926
Reviewed-by: Mario Limonciello 
Acked-by: Christian König 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 .../drm/amd/powerplay/hwmgr/pptable_v1_0.h|  4 ++--
 .../drm/amd/powerplay/hwmgr/vega10_pptable.h  | 24 +--
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h 
b/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h
index 1e870f58dd12a..8f6ecbbfa5738 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h
@@ -337,7 +337,7 @@ typedef struct _ATOM_Tonga_VCE_State_Record {
 typedef struct _ATOM_Tonga_VCE_State_Table {
UCHAR ucRevId;
UCHAR ucNumEntries;
-   ATOM_Tonga_VCE_State_Record entries[1];
+   ATOM_Tonga_VCE_State_Record entries[];
 } ATOM_Tonga_VCE_State_Table;
 
 typedef struct _ATOM_Tonga_PowerTune_Table {
@@ -416,7 +416,7 @@ typedef struct _ATOM_Tonga_Hard_Limit_Record {
 typedef struct _ATOM_Tonga_Hard_Limit_Table {
UCHAR ucRevId;
UCHAR ucNumEntries;
-   ATOM_Tonga_Hard_Limit_Record entries[1];
+   ATOM_Tonga_Hard_Limit_Record entries[];
 } ATOM_Tonga_Hard_Limit_Table;
 
 typedef struct _ATOM_Tonga_GPIO_Table {
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_pptable.h 
b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_pptable.h
index b3e63003a789c..465f4ded342e1 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_pptable.h
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_pptable.h
@@ -129,7 +129,7 @@ typedef struct _ATOM_Vega10_State {
 typedef struct _ATOM_Vega10_State_Array {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Vega10_State states[1]; /* Dynamically 
allocate entries. */
+   ATOM_Vega10_State states[]; /* Dynamically 
allocate entries. */
 } ATOM_Vega10_State_Array;
 
 typedef struct _ATOM_Vega10_CLK_Dependency_Record {
@@ -169,37 +169,37 @@ typedef struct _ATOM_Vega10_GFXCLK_Dependency_Table {
 typedef struct _ATOM_Vega10_MCLK_Dependency_Table {
 UCHAR ucRevId;
 UCHAR ucNumEntries; /* Number of 
entries. */
-ATOM_Vega10_MCLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+ATOM_Vega10_MCLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_MCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_SOCCLK_Dependency_Table {
 UCHAR ucRevId;
 UCHAR ucNumEntries; /* Number of 
entries. */
-ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_SOCCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_DCEFCLK_Dependency_Table {
 UCHAR ucRevId;
 UCHAR ucNumEntries; /* Number of 
entries. */
-ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_DCEFCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_PIXCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+   ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_PIXCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_DISPCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries.*/
-   ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+   ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_DISPCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_PHYCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+   ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_PHYCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_MM_Dependency_Record {
@@ -213,7 +213,7 @@ typedef struct _ATOM_Vega10_MM_Dependency_Record {
 typedef struct _ATOM_Vega10_MM_Dependency_Table {
UCHAR ucRevId

[PATCH AUTOSEL 4.19 5/5] drm/amd/display: Avoid NULL dereference of timing generator

2023-11-12 Thread Sasha Levin

From: Wayne Lin 

[ Upstream commit b1904ed480cee3f9f4036ea0e36d139cb5fee2d6 ]

[Why & How]
Check whether assigned timing generator is NULL or not before
accessing its funcs to prevent NULL dereference.

Reviewed-by: Jun Lei 
Acked-by: Hersen Wu 
Signed-off-by: Wayne Lin 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c 
b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
index fdcc8ab19bf3f..25b8a8f933821 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -281,7 +281,7 @@ uint32_t dc_stream_get_vblank_counter(const struct 
dc_stream_state *stream)
for (i = 0; i < MAX_PIPES; i++) {
struct timing_generator *tg = 
res_ctx->pipe_ctx[i].stream_res.tg;
 
-   if (res_ctx->pipe_ctx[i].stream != stream)
+   if (res_ctx->pipe_ctx[i].stream != stream || !tg)
continue;
 
return tg->funcs->get_frame_count(tg);
@@ -305,7 +305,7 @@ bool dc_stream_get_scanoutpos(const struct dc_stream_state 
*stream,
for (i = 0; i < MAX_PIPES; i++) {
struct timing_generator *tg = 
res_ctx->pipe_ctx[i].stream_res.tg;
 
-   if (res_ctx->pipe_ctx[i].stream != stream)
+   if (res_ctx->pipe_ctx[i].stream != stream || !tg)
continue;
 
tg->funcs->get_scanoutpos(tg,
-- 
2.42.0

[PATCH AUTOSEL 4.19 4/5] drm/amd: Fix UBSAN array-index-out-of-bounds for Powerplay headers

2023-11-12 Thread Sasha Levin

From: Alex Deucher 

[ Upstream commit 49afe91370b86566857a3c2c39612cf098110885 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2039926
Reviewed-by: Mario Limonciello 
Acked-by: Christian König 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 .../drm/amd/powerplay/hwmgr/pptable_v1_0.h|  4 ++--
 .../drm/amd/powerplay/hwmgr/vega10_pptable.h  | 24 +--
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h 
b/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h
index 1e870f58dd12a..8f6ecbbfa5738 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h
@@ -337,7 +337,7 @@ typedef struct _ATOM_Tonga_VCE_State_Record {
 typedef struct _ATOM_Tonga_VCE_State_Table {
UCHAR ucRevId;
UCHAR ucNumEntries;
-   ATOM_Tonga_VCE_State_Record entries[1];
+   ATOM_Tonga_VCE_State_Record entries[];
 } ATOM_Tonga_VCE_State_Table;
 
 typedef struct _ATOM_Tonga_PowerTune_Table {
@@ -416,7 +416,7 @@ typedef struct _ATOM_Tonga_Hard_Limit_Record {
 typedef struct _ATOM_Tonga_Hard_Limit_Table {
UCHAR ucRevId;
UCHAR ucNumEntries;
-   ATOM_Tonga_Hard_Limit_Record entries[1];
+   ATOM_Tonga_Hard_Limit_Record entries[];
 } ATOM_Tonga_Hard_Limit_Table;
 
 typedef struct _ATOM_Tonga_GPIO_Table {
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_pptable.h 
b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_pptable.h
index b3e63003a789c..465f4ded342e1 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_pptable.h
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_pptable.h
@@ -129,7 +129,7 @@ typedef struct _ATOM_Vega10_State {
 typedef struct _ATOM_Vega10_State_Array {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Vega10_State states[1]; /* Dynamically 
allocate entries. */
+   ATOM_Vega10_State states[]; /* Dynamically 
allocate entries. */
 } ATOM_Vega10_State_Array;
 
 typedef struct _ATOM_Vega10_CLK_Dependency_Record {
@@ -169,37 +169,37 @@ typedef struct _ATOM_Vega10_GFXCLK_Dependency_Table {
 typedef struct _ATOM_Vega10_MCLK_Dependency_Table {
 UCHAR ucRevId;
 UCHAR ucNumEntries; /* Number of 
entries. */
-ATOM_Vega10_MCLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+ATOM_Vega10_MCLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_MCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_SOCCLK_Dependency_Table {
 UCHAR ucRevId;
 UCHAR ucNumEntries; /* Number of 
entries. */
-ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_SOCCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_DCEFCLK_Dependency_Table {
 UCHAR ucRevId;
 UCHAR ucNumEntries; /* Number of 
entries. */
-ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_DCEFCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_PIXCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+   ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_PIXCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_DISPCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries.*/
-   ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+   ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_DISPCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_PHYCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+   ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_PHYCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_MM_Dependency_Record {
@@ -213,7 +213,7 @@ typedef struct _ATOM_Vega10_MM_Dependency_Record {
 typedef struct _ATOM_Vega10_MM_Dependency_Table {
UCHAR ucRevId

[PATCH AUTOSEL 5.4 6/6] drm/amd/display: Avoid NULL dereference of timing generator

2023-11-12 Thread Sasha Levin

From: Wayne Lin 

[ Upstream commit b1904ed480cee3f9f4036ea0e36d139cb5fee2d6 ]

[Why & How]
Check whether assigned timing generator is NULL or not before
accessing its funcs to prevent NULL dereference.

Reviewed-by: Jun Lei 
Acked-by: Hersen Wu 
Signed-off-by: Wayne Lin 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c 
b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
index bb09243758fe3..71b10b45a9b9e 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -492,7 +492,7 @@ uint32_t dc_stream_get_vblank_counter(const struct 
dc_stream_state *stream)
for (i = 0; i < MAX_PIPES; i++) {
struct timing_generator *tg = 
res_ctx->pipe_ctx[i].stream_res.tg;
 
-   if (res_ctx->pipe_ctx[i].stream != stream)
+   if (res_ctx->pipe_ctx[i].stream != stream || !tg)
continue;
 
return tg->funcs->get_frame_count(tg);
@@ -551,7 +551,7 @@ bool dc_stream_get_scanoutpos(const struct dc_stream_state 
*stream,
for (i = 0; i < MAX_PIPES; i++) {
struct timing_generator *tg = 
res_ctx->pipe_ctx[i].stream_res.tg;
 
-   if (res_ctx->pipe_ctx[i].stream != stream)
+   if (res_ctx->pipe_ctx[i].stream != stream || !tg)
continue;
 
tg->funcs->get_scanoutpos(tg,
-- 
2.42.0

[PATCH AUTOSEL 5.4 5/6] drm/amd: Fix UBSAN array-index-out-of-bounds for Powerplay headers

2023-11-12 Thread Sasha Levin

From: Alex Deucher 

[ Upstream commit 49afe91370b86566857a3c2c39612cf098110885 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2039926
Reviewed-by: Mario Limonciello 
Acked-by: Christian König 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 .../drm/amd/powerplay/hwmgr/pptable_v1_0.h|  4 ++--
 .../drm/amd/powerplay/hwmgr/vega10_pptable.h  | 24 +--
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h 
b/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h
index 1e870f58dd12a..8f6ecbbfa5738 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h
@@ -337,7 +337,7 @@ typedef struct _ATOM_Tonga_VCE_State_Record {
 typedef struct _ATOM_Tonga_VCE_State_Table {
UCHAR ucRevId;
UCHAR ucNumEntries;
-   ATOM_Tonga_VCE_State_Record entries[1];
+   ATOM_Tonga_VCE_State_Record entries[];
 } ATOM_Tonga_VCE_State_Table;
 
 typedef struct _ATOM_Tonga_PowerTune_Table {
@@ -416,7 +416,7 @@ typedef struct _ATOM_Tonga_Hard_Limit_Record {
 typedef struct _ATOM_Tonga_Hard_Limit_Table {
UCHAR ucRevId;
UCHAR ucNumEntries;
-   ATOM_Tonga_Hard_Limit_Record entries[1];
+   ATOM_Tonga_Hard_Limit_Record entries[];
 } ATOM_Tonga_Hard_Limit_Table;
 
 typedef struct _ATOM_Tonga_GPIO_Table {
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_pptable.h 
b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_pptable.h
index c934e9612c1b5..794889917ea1b 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_pptable.h
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_pptable.h
@@ -129,7 +129,7 @@ typedef struct _ATOM_Vega10_State {
 typedef struct _ATOM_Vega10_State_Array {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Vega10_State states[1]; /* Dynamically 
allocate entries. */
+   ATOM_Vega10_State states[]; /* Dynamically 
allocate entries. */
 } ATOM_Vega10_State_Array;
 
 typedef struct _ATOM_Vega10_CLK_Dependency_Record {
@@ -169,37 +169,37 @@ typedef struct _ATOM_Vega10_GFXCLK_Dependency_Table {
 typedef struct _ATOM_Vega10_MCLK_Dependency_Table {
 UCHAR ucRevId;
 UCHAR ucNumEntries; /* Number of 
entries. */
-ATOM_Vega10_MCLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+ATOM_Vega10_MCLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_MCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_SOCCLK_Dependency_Table {
 UCHAR ucRevId;
 UCHAR ucNumEntries; /* Number of 
entries. */
-ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_SOCCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_DCEFCLK_Dependency_Table {
 UCHAR ucRevId;
 UCHAR ucNumEntries; /* Number of 
entries. */
-ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_DCEFCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_PIXCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+   ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_PIXCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_DISPCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries.*/
-   ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+   ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_DISPCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_PHYCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+   ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_PHYCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_MM_Dependency_Record {
@@ -213,7 +213,7 @@ typedef struct _ATOM_Vega10_MM_Dependency_Record {
 typedef struct _ATOM_Vega10_MM_Dependency_Table {
UCHAR ucRevId

[PATCH AUTOSEL 5.10 7/8] drm/amd: Fix UBSAN array-index-out-of-bounds for Powerplay headers

2023-11-12 Thread Sasha Levin

From: Alex Deucher 

[ Upstream commit 49afe91370b86566857a3c2c39612cf098110885 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2039926
Reviewed-by: Mario Limonciello 
Acked-by: Christian König 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 .../drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h |  4 ++--
 .../amd/pm/powerplay/hwmgr/vega10_pptable.h   | 24 +--
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h 
b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
index 1e870f58dd12a..8f6ecbbfa5738 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
@@ -337,7 +337,7 @@ typedef struct _ATOM_Tonga_VCE_State_Record {
 typedef struct _ATOM_Tonga_VCE_State_Table {
UCHAR ucRevId;
UCHAR ucNumEntries;
-   ATOM_Tonga_VCE_State_Record entries[1];
+   ATOM_Tonga_VCE_State_Record entries[];
 } ATOM_Tonga_VCE_State_Table;
 
 typedef struct _ATOM_Tonga_PowerTune_Table {
@@ -416,7 +416,7 @@ typedef struct _ATOM_Tonga_Hard_Limit_Record {
 typedef struct _ATOM_Tonga_Hard_Limit_Table {
UCHAR ucRevId;
UCHAR ucNumEntries;
-   ATOM_Tonga_Hard_Limit_Record entries[1];
+   ATOM_Tonga_Hard_Limit_Record entries[];
 } ATOM_Tonga_Hard_Limit_Table;
 
 typedef struct _ATOM_Tonga_GPIO_Table {
diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h 
b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h
index c934e9612c1b5..794889917ea1b 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h
@@ -129,7 +129,7 @@ typedef struct _ATOM_Vega10_State {
 typedef struct _ATOM_Vega10_State_Array {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Vega10_State states[1]; /* Dynamically 
allocate entries. */
+   ATOM_Vega10_State states[]; /* Dynamically 
allocate entries. */
 } ATOM_Vega10_State_Array;
 
 typedef struct _ATOM_Vega10_CLK_Dependency_Record {
@@ -169,37 +169,37 @@ typedef struct _ATOM_Vega10_GFXCLK_Dependency_Table {
 typedef struct _ATOM_Vega10_MCLK_Dependency_Table {
 UCHAR ucRevId;
 UCHAR ucNumEntries; /* Number of 
entries. */
-ATOM_Vega10_MCLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+ATOM_Vega10_MCLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_MCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_SOCCLK_Dependency_Table {
 UCHAR ucRevId;
 UCHAR ucNumEntries; /* Number of 
entries. */
-ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_SOCCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_DCEFCLK_Dependency_Table {
 UCHAR ucRevId;
 UCHAR ucNumEntries; /* Number of 
entries. */
-ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_DCEFCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_PIXCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+   ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_PIXCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_DISPCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries.*/
-   ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+   ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_DISPCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_PHYCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+   ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_PHYCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_MM_Dependency_Record {
@@ -213,7 +213,7 @@ typedef struct _ATOM_Vega10_MM_Dependency_Record {
 typedef struct _ATOM_Vega10_MM_Dependency_Table

[PATCH AUTOSEL 5.10 8/8] drm/amd/display: Avoid NULL dereference of timing generator

2023-11-12 Thread Sasha Levin

From: Wayne Lin 

[ Upstream commit b1904ed480cee3f9f4036ea0e36d139cb5fee2d6 ]

[Why & How]
Check whether assigned timing generator is NULL or not before
accessing its funcs to prevent NULL dereference.

Reviewed-by: Jun Lei 
Acked-by: Hersen Wu 
Signed-off-by: Wayne Lin 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c 
b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
index d48fd87d3b953..8206c6edba746 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -534,7 +534,7 @@ uint32_t dc_stream_get_vblank_counter(const struct 
dc_stream_state *stream)
for (i = 0; i < MAX_PIPES; i++) {
struct timing_generator *tg = 
res_ctx->pipe_ctx[i].stream_res.tg;
 
-   if (res_ctx->pipe_ctx[i].stream != stream)
+   if (res_ctx->pipe_ctx[i].stream != stream || !tg)
continue;
 
return tg->funcs->get_frame_count(tg);
@@ -593,7 +593,7 @@ bool dc_stream_get_scanoutpos(const struct dc_stream_state 
*stream,
for (i = 0; i < MAX_PIPES; i++) {
struct timing_generator *tg = 
res_ctx->pipe_ctx[i].stream_res.tg;
 
-   if (res_ctx->pipe_ctx[i].stream != stream)
+   if (res_ctx->pipe_ctx[i].stream != stream || !tg)
continue;
 
tg->funcs->get_scanoutpos(tg,
-- 
2.42.0

[PATCH AUTOSEL 5.15 9/9] drm/amd/display: Avoid NULL dereference of timing generator

2023-11-12 Thread Sasha Levin

From: Wayne Lin 

[ Upstream commit b1904ed480cee3f9f4036ea0e36d139cb5fee2d6 ]

[Why & How]
Check whether assigned timing generator is NULL or not before
accessing its funcs to prevent NULL dereference.

Reviewed-by: Jun Lei 
Acked-by: Hersen Wu 
Signed-off-by: Wayne Lin 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c 
b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
index f0f54f4d3d9bc..5dd57cf170f51 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -562,7 +562,7 @@ uint32_t dc_stream_get_vblank_counter(const struct 
dc_stream_state *stream)
for (i = 0; i < MAX_PIPES; i++) {
struct timing_generator *tg = 
res_ctx->pipe_ctx[i].stream_res.tg;
 
-   if (res_ctx->pipe_ctx[i].stream != stream)
+   if (res_ctx->pipe_ctx[i].stream != stream || !tg)
continue;
 
return tg->funcs->get_frame_count(tg);
@@ -621,7 +621,7 @@ bool dc_stream_get_scanoutpos(const struct dc_stream_state 
*stream,
for (i = 0; i < MAX_PIPES; i++) {
struct timing_generator *tg = 
res_ctx->pipe_ctx[i].stream_res.tg;
 
-   if (res_ctx->pipe_ctx[i].stream != stream)
+   if (res_ctx->pipe_ctx[i].stream != stream || !tg)
continue;
 
tg->funcs->get_scanoutpos(tg,
-- 
2.42.0

[PATCH AUTOSEL 5.15 8/9] drm/amd: Fix UBSAN array-index-out-of-bounds for Powerplay headers

2023-11-12 Thread Sasha Levin

From: Alex Deucher 

[ Upstream commit 49afe91370b86566857a3c2c39612cf098110885 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2039926
Reviewed-by: Mario Limonciello 
Acked-by: Christian König 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 .../drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h |  4 ++--
 .../amd/pm/powerplay/hwmgr/vega10_pptable.h   | 24 +--
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h 
b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
index b0ac4d121adca..5eeb49a08c997 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
@@ -367,7 +367,7 @@ typedef struct _ATOM_Tonga_VCE_State_Record {
 typedef struct _ATOM_Tonga_VCE_State_Table {
UCHAR ucRevId;
UCHAR ucNumEntries;
-   ATOM_Tonga_VCE_State_Record entries[1];
+   ATOM_Tonga_VCE_State_Record entries[];
 } ATOM_Tonga_VCE_State_Table;
 
 typedef struct _ATOM_Tonga_PowerTune_Table {
@@ -482,7 +482,7 @@ typedef struct _ATOM_Tonga_Hard_Limit_Record {
 typedef struct _ATOM_Tonga_Hard_Limit_Table {
UCHAR ucRevId;
UCHAR ucNumEntries;
-   ATOM_Tonga_Hard_Limit_Record entries[1];
+   ATOM_Tonga_Hard_Limit_Record entries[];
 } ATOM_Tonga_Hard_Limit_Table;
 
 typedef struct _ATOM_Tonga_GPIO_Table {
diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h 
b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h
index 9c479bd9a786b..a372abcd01be6 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h
@@ -129,7 +129,7 @@ typedef struct _ATOM_Vega10_State {
 typedef struct _ATOM_Vega10_State_Array {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Vega10_State states[1]; /* Dynamically 
allocate entries. */
+   ATOM_Vega10_State states[]; /* Dynamically 
allocate entries. */
 } ATOM_Vega10_State_Array;
 
 typedef struct _ATOM_Vega10_CLK_Dependency_Record {
@@ -169,37 +169,37 @@ typedef struct _ATOM_Vega10_GFXCLK_Dependency_Table {
 typedef struct _ATOM_Vega10_MCLK_Dependency_Table {
 UCHAR ucRevId;
 UCHAR ucNumEntries; /* Number of 
entries. */
-ATOM_Vega10_MCLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+ATOM_Vega10_MCLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_MCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_SOCCLK_Dependency_Table {
 UCHAR ucRevId;
 UCHAR ucNumEntries; /* Number of 
entries. */
-ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_SOCCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_DCEFCLK_Dependency_Table {
 UCHAR ucRevId;
 UCHAR ucNumEntries; /* Number of 
entries. */
-ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_DCEFCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_PIXCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+   ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_PIXCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_DISPCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries.*/
-   ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+   ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_DISPCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_PHYCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+   ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_PHYCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_MM_Dependency_Record {
@@ -213,7 +213,7 @@ typedef struct _ATOM_Vega10_MM_Dependency_Record {
 typedef struct _ATOM_Vega10_MM_Dependency_Table

[PATCH AUTOSEL 6.1 9/9] drm/amd/display: Avoid NULL dereference of timing generator

2023-11-12 Thread Sasha Levin

From: Wayne Lin 

[ Upstream commit b1904ed480cee3f9f4036ea0e36d139cb5fee2d6 ]

[Why & How]
Check whether assigned timing generator is NULL or not before
accessing its funcs to prevent NULL dereference.

Reviewed-by: Jun Lei 
Acked-by: Hersen Wu 
Signed-off-by: Wayne Lin 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c 
b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
index 38d71b5c1f2d5..556c57c390ffd 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -567,7 +567,7 @@ uint32_t dc_stream_get_vblank_counter(const struct 
dc_stream_state *stream)
for (i = 0; i < MAX_PIPES; i++) {
struct timing_generator *tg = 
res_ctx->pipe_ctx[i].stream_res.tg;
 
-   if (res_ctx->pipe_ctx[i].stream != stream)
+   if (res_ctx->pipe_ctx[i].stream != stream || !tg)
continue;
 
return tg->funcs->get_frame_count(tg);
@@ -626,7 +626,7 @@ bool dc_stream_get_scanoutpos(const struct dc_stream_state 
*stream,
for (i = 0; i < MAX_PIPES; i++) {
struct timing_generator *tg = 
res_ctx->pipe_ctx[i].stream_res.tg;
 
-   if (res_ctx->pipe_ctx[i].stream != stream)
+   if (res_ctx->pipe_ctx[i].stream != stream || !tg)
continue;
 
tg->funcs->get_scanoutpos(tg,
-- 
2.42.0

[PATCH AUTOSEL 6.1 8/9] drm/amd: Fix UBSAN array-index-out-of-bounds for Powerplay headers

2023-11-12 Thread Sasha Levin

From: Alex Deucher 

[ Upstream commit 49afe91370b86566857a3c2c39612cf098110885 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2039926
Reviewed-by: Mario Limonciello 
Acked-by: Christian König 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 .../drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h |  4 ++--
 .../amd/pm/powerplay/hwmgr/vega10_pptable.h   | 24 +--
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h 
b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
index b0ac4d121adca..5eeb49a08c997 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
@@ -367,7 +367,7 @@ typedef struct _ATOM_Tonga_VCE_State_Record {
 typedef struct _ATOM_Tonga_VCE_State_Table {
UCHAR ucRevId;
UCHAR ucNumEntries;
-   ATOM_Tonga_VCE_State_Record entries[1];
+   ATOM_Tonga_VCE_State_Record entries[];
 } ATOM_Tonga_VCE_State_Table;
 
 typedef struct _ATOM_Tonga_PowerTune_Table {
@@ -482,7 +482,7 @@ typedef struct _ATOM_Tonga_Hard_Limit_Record {
 typedef struct _ATOM_Tonga_Hard_Limit_Table {
UCHAR ucRevId;
UCHAR ucNumEntries;
-   ATOM_Tonga_Hard_Limit_Record entries[1];
+   ATOM_Tonga_Hard_Limit_Record entries[];
 } ATOM_Tonga_Hard_Limit_Table;
 
 typedef struct _ATOM_Tonga_GPIO_Table {
diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h 
b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h
index 9c479bd9a786b..a372abcd01be6 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h
@@ -129,7 +129,7 @@ typedef struct _ATOM_Vega10_State {
 typedef struct _ATOM_Vega10_State_Array {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Vega10_State states[1]; /* Dynamically 
allocate entries. */
+   ATOM_Vega10_State states[]; /* Dynamically 
allocate entries. */
 } ATOM_Vega10_State_Array;
 
 typedef struct _ATOM_Vega10_CLK_Dependency_Record {
@@ -169,37 +169,37 @@ typedef struct _ATOM_Vega10_GFXCLK_Dependency_Table {
 typedef struct _ATOM_Vega10_MCLK_Dependency_Table {
 UCHAR ucRevId;
 UCHAR ucNumEntries; /* Number of 
entries. */
-ATOM_Vega10_MCLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+ATOM_Vega10_MCLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_MCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_SOCCLK_Dependency_Table {
 UCHAR ucRevId;
 UCHAR ucNumEntries; /* Number of 
entries. */
-ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_SOCCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_DCEFCLK_Dependency_Table {
 UCHAR ucRevId;
 UCHAR ucNumEntries; /* Number of 
entries. */
-ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_DCEFCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_PIXCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+   ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_PIXCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_DISPCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries.*/
-   ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+   ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_DISPCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_PHYCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+   ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_PHYCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_MM_Dependency_Record {
@@ -213,7 +213,7 @@ typedef struct _ATOM_Vega10_MM_Dependency_Record {
 typedef struct _ATOM_Vega10_MM_Dependency_Table

[PATCH AUTOSEL 6.5 10/10] drm/amd/display: Avoid NULL dereference of timing generator

2023-11-12 Thread Sasha Levin

From: Wayne Lin 

[ Upstream commit b1904ed480cee3f9f4036ea0e36d139cb5fee2d6 ]

[Why & How]
Check whether assigned timing generator is NULL or not before
accessing its funcs to prevent NULL dereference.

Reviewed-by: Jun Lei 
Acked-by: Hersen Wu 
Signed-off-by: Wayne Lin 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c 
b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
index 6e11d2b701f82..569d40eb7059d 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -556,7 +556,7 @@ uint32_t dc_stream_get_vblank_counter(const struct 
dc_stream_state *stream)
for (i = 0; i < MAX_PIPES; i++) {
struct timing_generator *tg = 
res_ctx->pipe_ctx[i].stream_res.tg;
 
-   if (res_ctx->pipe_ctx[i].stream != stream)
+   if (res_ctx->pipe_ctx[i].stream != stream || !tg)
continue;
 
return tg->funcs->get_frame_count(tg);
@@ -615,7 +615,7 @@ bool dc_stream_get_scanoutpos(const struct dc_stream_state 
*stream,
for (i = 0; i < MAX_PIPES; i++) {
struct timing_generator *tg = 
res_ctx->pipe_ctx[i].stream_res.tg;
 
-   if (res_ctx->pipe_ctx[i].stream != stream)
+   if (res_ctx->pipe_ctx[i].stream != stream || !tg)
continue;
 
tg->funcs->get_scanoutpos(tg,
-- 
2.42.0

[PATCH AUTOSEL 6.5 09/10] drm/amd: Fix UBSAN array-index-out-of-bounds for Powerplay headers

2023-11-12 Thread Sasha Levin

From: Alex Deucher 

[ Upstream commit 49afe91370b86566857a3c2c39612cf098110885 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2039926
Reviewed-by: Mario Limonciello 
Acked-by: Christian König 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 .../drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h |  4 ++--
 .../amd/pm/powerplay/hwmgr/vega10_pptable.h   | 24 +--
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h 
b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
index b0ac4d121adca..5eeb49a08c997 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
@@ -367,7 +367,7 @@ typedef struct _ATOM_Tonga_VCE_State_Record {
 typedef struct _ATOM_Tonga_VCE_State_Table {
UCHAR ucRevId;
UCHAR ucNumEntries;
-   ATOM_Tonga_VCE_State_Record entries[1];
+   ATOM_Tonga_VCE_State_Record entries[];
 } ATOM_Tonga_VCE_State_Table;
 
 typedef struct _ATOM_Tonga_PowerTune_Table {
@@ -482,7 +482,7 @@ typedef struct _ATOM_Tonga_Hard_Limit_Record {
 typedef struct _ATOM_Tonga_Hard_Limit_Table {
UCHAR ucRevId;
UCHAR ucNumEntries;
-   ATOM_Tonga_Hard_Limit_Record entries[1];
+   ATOM_Tonga_Hard_Limit_Record entries[];
 } ATOM_Tonga_Hard_Limit_Table;
 
 typedef struct _ATOM_Tonga_GPIO_Table {
diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h 
b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h
index 9c479bd9a786b..a372abcd01be6 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h
@@ -129,7 +129,7 @@ typedef struct _ATOM_Vega10_State {
 typedef struct _ATOM_Vega10_State_Array {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Vega10_State states[1]; /* Dynamically 
allocate entries. */
+   ATOM_Vega10_State states[]; /* Dynamically 
allocate entries. */
 } ATOM_Vega10_State_Array;
 
 typedef struct _ATOM_Vega10_CLK_Dependency_Record {
@@ -169,37 +169,37 @@ typedef struct _ATOM_Vega10_GFXCLK_Dependency_Table {
 typedef struct _ATOM_Vega10_MCLK_Dependency_Table {
 UCHAR ucRevId;
 UCHAR ucNumEntries; /* Number of 
entries. */
-ATOM_Vega10_MCLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+ATOM_Vega10_MCLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_MCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_SOCCLK_Dependency_Table {
 UCHAR ucRevId;
 UCHAR ucNumEntries; /* Number of 
entries. */
-ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_SOCCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_DCEFCLK_Dependency_Table {
 UCHAR ucRevId;
 UCHAR ucNumEntries; /* Number of 
entries. */
-ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_DCEFCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_PIXCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+   ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_PIXCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_DISPCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries.*/
-   ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+   ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_DISPCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_PHYCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+   ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_PHYCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_MM_Dependency_Record {
@@ -213,7 +213,7 @@ typedef struct _ATOM_Vega10_MM_Dependency_Record {
 typedef struct _ATOM_Vega10_MM_Dependency_Table

[PATCH AUTOSEL 6.6 10/11] drm/amd/display: Avoid NULL dereference of timing generator

2023-11-12 Thread Sasha Levin

From: Wayne Lin 

[ Upstream commit b1904ed480cee3f9f4036ea0e36d139cb5fee2d6 ]

[Why & How]
Check whether assigned timing generator is NULL or not before
accessing its funcs to prevent NULL dereference.

Reviewed-by: Jun Lei 
Acked-by: Hersen Wu 
Signed-off-by: Wayne Lin 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c 
b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
index 01fe2d2fd2417..ebe571fcefe32 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -582,7 +582,7 @@ uint32_t dc_stream_get_vblank_counter(const struct 
dc_stream_state *stream)
for (i = 0; i < MAX_PIPES; i++) {
struct timing_generator *tg = 
res_ctx->pipe_ctx[i].stream_res.tg;
 
-   if (res_ctx->pipe_ctx[i].stream != stream)
+   if (res_ctx->pipe_ctx[i].stream != stream || !tg)
continue;
 
return tg->funcs->get_frame_count(tg);
@@ -641,7 +641,7 @@ bool dc_stream_get_scanoutpos(const struct dc_stream_state 
*stream,
for (i = 0; i < MAX_PIPES; i++) {
struct timing_generator *tg = 
res_ctx->pipe_ctx[i].stream_res.tg;
 
-   if (res_ctx->pipe_ctx[i].stream != stream)
+   if (res_ctx->pipe_ctx[i].stream != stream || !tg)
continue;
 
tg->funcs->get_scanoutpos(tg,
-- 
2.42.0

[PATCH AUTOSEL 6.6 09/11] drm/amd: Fix UBSAN array-index-out-of-bounds for Powerplay headers

2023-11-12 Thread Sasha Levin

From: Alex Deucher 

[ Upstream commit 49afe91370b86566857a3c2c39612cf098110885 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2039926
Reviewed-by: Mario Limonciello 
Acked-by: Christian König 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 .../drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h |  4 ++--
 .../amd/pm/powerplay/hwmgr/vega10_pptable.h   | 24 +--
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h 
b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
index 7a31cfa5e7fb4..df7cab1a571b3 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
@@ -367,7 +367,7 @@ typedef struct _ATOM_Tonga_VCE_State_Record {
 typedef struct _ATOM_Tonga_VCE_State_Table {
UCHAR ucRevId;
UCHAR ucNumEntries;
-   ATOM_Tonga_VCE_State_Record entries[1];
+   ATOM_Tonga_VCE_State_Record entries[];
 } ATOM_Tonga_VCE_State_Table;
 
 typedef struct _ATOM_Tonga_PowerTune_Table {
@@ -481,7 +481,7 @@ typedef struct _ATOM_Tonga_Hard_Limit_Record {
 typedef struct _ATOM_Tonga_Hard_Limit_Table {
UCHAR ucRevId;
UCHAR ucNumEntries;
-   ATOM_Tonga_Hard_Limit_Record entries[1];
+   ATOM_Tonga_Hard_Limit_Record entries[];
 } ATOM_Tonga_Hard_Limit_Table;
 
 typedef struct _ATOM_Tonga_GPIO_Table {
diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h 
b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h
index 8b0590b834cca..de2926df5ed74 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h
@@ -129,7 +129,7 @@ typedef struct _ATOM_Vega10_State {
 typedef struct _ATOM_Vega10_State_Array {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Vega10_State states[1]; /* Dynamically 
allocate entries. */
+   ATOM_Vega10_State states[]; /* Dynamically 
allocate entries. */
 } ATOM_Vega10_State_Array;
 
 typedef struct _ATOM_Vega10_CLK_Dependency_Record {
@@ -169,37 +169,37 @@ typedef struct _ATOM_Vega10_GFXCLK_Dependency_Table {
 typedef struct _ATOM_Vega10_MCLK_Dependency_Table {
 UCHAR ucRevId;
 UCHAR ucNumEntries; /* Number of 
entries. */
-ATOM_Vega10_MCLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+ATOM_Vega10_MCLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_MCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_SOCCLK_Dependency_Table {
 UCHAR ucRevId;
 UCHAR ucNumEntries; /* Number of 
entries. */
-ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_SOCCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_DCEFCLK_Dependency_Table {
 UCHAR ucRevId;
 UCHAR ucNumEntries; /* Number of 
entries. */
-ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_DCEFCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_PIXCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+   ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_PIXCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_DISPCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries.*/
-   ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+   ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_DISPCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_PHYCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Vega10_CLK_Dependency_Record entries[1];/* Dynamically 
allocate entries. */
+   ATOM_Vega10_CLK_Dependency_Record entries[];/* Dynamically 
allocate entries. */
 } ATOM_Vega10_PHYCLK_Dependency_Table;
 
 typedef struct _ATOM_Vega10_MM_Dependency_Record {
@@ -213,7 +213,7 @@ typedef struct _ATOM_Vega10_MM_Dependency_Record {
 typedef struct _ATOM_Vega10_MM_Dependency_Table

[PATCH AUTOSEL 4.14 3/4] drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit 0f0e59075b5c22f1e871fbd508d6e4f495048356 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2036742
Signed-off-by: Mario Limonciello 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h | 12 ++--
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h 
b/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h
index d5a4a08c6d392..0c61e2bc14cde 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h
@@ -164,7 +164,7 @@ typedef struct _ATOM_Tonga_State {
 typedef struct _ATOM_Tonga_State_Array {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number of entries. */
-   ATOM_Tonga_State entries[1];/* Dynamically allocate entries. */
+   ATOM_Tonga_State entries[]; /* Dynamically allocate entries. */
 } ATOM_Tonga_State_Array;
 
 typedef struct _ATOM_Tonga_MCLK_Dependency_Record {
@@ -210,7 +210,7 @@ typedef struct _ATOM_Polaris_SCLK_Dependency_Record {
 typedef struct _ATOM_Polaris_SCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Polaris_SCLK_Dependency_Record entries[1]; 
 /* Dynamically allocate entries. */
+   ATOM_Polaris_SCLK_Dependency_Record entries[];  
 /* Dynamically allocate entries. */
 } ATOM_Polaris_SCLK_Dependency_Table;
 
 typedef struct _ATOM_Tonga_PCIE_Record {
@@ -222,7 +222,7 @@ typedef struct _ATOM_Tonga_PCIE_Record {
 typedef struct _ATOM_Tonga_PCIE_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_PCIE_Record entries[1];  
/* Dynamically allocate entries. */
+   ATOM_Tonga_PCIE_Record entries[];   
/* Dynamically allocate entries. */
 } ATOM_Tonga_PCIE_Table;
 
 typedef struct _ATOM_Polaris10_PCIE_Record {
@@ -235,7 +235,7 @@ typedef struct _ATOM_Polaris10_PCIE_Record {
 typedef struct _ATOM_Polaris10_PCIE_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Polaris10_PCIE_Record entries[1];  /* 
Dynamically allocate entries. */
+   ATOM_Polaris10_PCIE_Record entries[];  /* 
Dynamically allocate entries. */
 } ATOM_Polaris10_PCIE_Table;
 
 
@@ -252,7 +252,7 @@ typedef struct _ATOM_Tonga_MM_Dependency_Record {
 typedef struct _ATOM_Tonga_MM_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_MM_Dependency_Record entries[1];/* 
Dynamically allocate entries. */
+   ATOM_Tonga_MM_Dependency_Record entries[]; /* 
Dynamically allocate entries. */
 } ATOM_Tonga_MM_Dependency_Table;
 
 typedef struct _ATOM_Tonga_Voltage_Lookup_Record {
@@ -265,7 +265,7 @@ typedef struct _ATOM_Tonga_Voltage_Lookup_Record {
 typedef struct _ATOM_Tonga_Voltage_Lookup_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_Voltage_Lookup_Record entries[1];
/* Dynamically allocate entries. */
+   ATOM_Tonga_Voltage_Lookup_Record entries[]; 
/* Dynamically allocate entries. */
 } ATOM_Tonga_Voltage_Lookup_Table;
 
 typedef struct _ATOM_Tonga_Fan_Table {
-- 
2.42.0

[PATCH AUTOSEL 4.14 2/4] drm/radeon: Fix UBSAN array-index-out-of-bounds for Radeon HD 5430

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit c63079c61177ba1b17fa05c6875699a36924fe39 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Suggested-by: Felix Held 
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2894
Signed-off-by: Mario Limonciello 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/radeon/pptable.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/radeon/pptable.h b/drivers/gpu/drm/radeon/pptable.h
index 4c2eec49dadc9..94947229888ba 100644
--- a/drivers/gpu/drm/radeon/pptable.h
+++ b/drivers/gpu/drm/radeon/pptable.h
@@ -74,7 +74,7 @@ typedef struct _ATOM_PPLIB_THERMALCONTROLLER
 typedef struct _ATOM_PPLIB_STATE
 {
 UCHAR ucNonClockStateIndex;
-UCHAR ucClockStateIndices[1]; // variable-sized
+UCHAR ucClockStateIndices[]; // variable-sized
 } ATOM_PPLIB_STATE;
 
 
-- 
2.42.0

[PATCH AUTOSEL 4.14 1/4] drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit 760efbca74a405dc439a013a5efaa9fadc95a8c3 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Suggested-by: Felix Held 
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2874
Signed-off-by: Mario Limonciello 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/include/pptable.h  | 4 ++--
 drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/include/pptable.h 
b/drivers/gpu/drm/amd/include/pptable.h
index 0b6a057e0a4c4..5aac8d545bdc6 100644
--- a/drivers/gpu/drm/amd/include/pptable.h
+++ b/drivers/gpu/drm/amd/include/pptable.h
@@ -78,7 +78,7 @@ typedef struct _ATOM_PPLIB_THERMALCONTROLLER
 typedef struct _ATOM_PPLIB_STATE
 {
 UCHAR ucNonClockStateIndex;
-UCHAR ucClockStateIndices[1]; // variable-sized
+UCHAR ucClockStateIndices[]; // variable-sized
 } ATOM_PPLIB_STATE;
 
 
@@ -473,7 +473,7 @@ typedef struct _ATOM_PPLIB_STATE_V2
   /**
   * Driver will read the first ucNumDPMLevels in this array
   */
-  UCHAR clockInfoIndex[1];
+  UCHAR clockInfoIndex[];
 } ATOM_PPLIB_STATE_V2;
 
 typedef struct _StateArray{
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h 
b/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h
index 1e870f58dd12a..d5a4a08c6d392 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h
@@ -179,7 +179,7 @@ typedef struct _ATOM_Tonga_MCLK_Dependency_Record {
 typedef struct _ATOM_Tonga_MCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_MCLK_Dependency_Record entries[1];   
/* Dynamically allocate entries. */
+   ATOM_Tonga_MCLK_Dependency_Record entries[];
/* Dynamically allocate entries. */
 } ATOM_Tonga_MCLK_Dependency_Table;
 
 typedef struct _ATOM_Tonga_SCLK_Dependency_Record {
@@ -194,7 +194,7 @@ typedef struct _ATOM_Tonga_SCLK_Dependency_Record {
 typedef struct _ATOM_Tonga_SCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_SCLK_Dependency_Record entries[1];   
 /* Dynamically allocate entries. */
+   ATOM_Tonga_SCLK_Dependency_Record entries[];
 /* Dynamically allocate entries. */
 } ATOM_Tonga_SCLK_Dependency_Table;
 
 typedef struct _ATOM_Polaris_SCLK_Dependency_Record {
-- 
2.42.0

[PATCH AUTOSEL 4.19 4/5] drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL

2023-11-07 Thread Sasha Levin

From: Qu Huang 

[ Upstream commit 5104fdf50d326db2c1a994f8b35dcd46e63ae4ad ]

In certain types of chips, such as VEGA20, reading the amdgpu_regs_smc file 
could result in an abnormal null pointer access when the smc_rreg pointer is 
NULL. Below are the steps to reproduce this issue and the corresponding 
exception log:

1. Navigate to the directory: /sys/kernel/debug/dri/0
2. Execute command: cat amdgpu_regs_smc
3. Exception Log::
[4005007.702554] BUG: kernel NULL pointer dereference, address: 
[4005007.702562] #PF: supervisor instruction fetch in kernel mode
[4005007.702567] #PF: error_code(0x0010) - not-present page
[4005007.702570] PGD 0 P4D 0
[4005007.702576] Oops: 0010 [#1] SMP NOPTI
[4005007.702581] CPU: 4 PID: 62563 Comm: cat Tainted: G   OE 
5.15.0-43-generic #46-Ubunt   u
[4005007.702590] RIP: 0010:0x0
[4005007.702598] Code: Unable to access opcode bytes at RIP 0xffd6.
[4005007.702600] RSP: 0018:a82b46d27da0 EFLAGS: 00010206
[4005007.702605] RAX:  RBX:  RCX: 
a82b46d27e68
[4005007.702609] RDX: 0001 RSI:  RDI: 
9940656e
[4005007.702612] RBP: a82b46d27dd8 R08:  R09: 
994060c07980
[4005007.702615] R10: 0002 R11:  R12: 
7f5e06753000
[4005007.702618] R13: 9940656e R14: a82b46d27e68 R15: 
7f5e06753000
[4005007.702622] FS:  7f5e0755b740() GS:99479d30() 
knlGS:
[4005007.702626] CS:  0010 DS:  ES:  CR0: 80050033
[4005007.702629] CR2: ffd6 CR3: 0003253fc000 CR4: 
003506e0
[4005007.702633] Call Trace:
[4005007.702636]  
[4005007.702640]  amdgpu_debugfs_regs_smc_read+0xb0/0x120 [amdgpu]
[4005007.703002]  full_proxy_read+0x5c/0x80
[4005007.703011]  vfs_read+0x9f/0x1a0
[4005007.703019]  ksys_read+0x67/0xe0
[4005007.703023]  __x64_sys_read+0x19/0x20
[4005007.703028]  do_syscall_64+0x5c/0xc0
[4005007.703034]  ? do_user_addr_fault+0x1e3/0x670
[4005007.703040]  ? exit_to_user_mode_prepare+0x37/0xb0
[4005007.703047]  ? irqentry_exit_to_user_mode+0x9/0x20
[4005007.703052]  ? irqentry_exit+0x19/0x30
[4005007.703057]  ? exc_page_fault+0x89/0x160
[4005007.703062]  ? asm_exc_page_fault+0x8/0x30
[4005007.703068]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[4005007.703075] RIP: 0033:0x7f5e07672992
[4005007.703079] Code: c0 e9 b2 fe ff ff 50 48 8d 3d fa b2 0c 00 e8 c5 1d 02 00 
0f 1f 44 00 00 f3 0f1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 
<48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 e   c 28 48 89 54 24
[4005007.703083] RSP: 002b:7ffe03097898 EFLAGS: 0246 ORIG_RAX: 

[4005007.703088] RAX: ffda RBX: 0002 RCX: 
7f5e07672992
[4005007.703091] RDX: 0002 RSI: 7f5e06753000 RDI: 
0003
[4005007.703094] RBP: 7f5e06753000 R08: 7f5e06752010 R09: 
7f5e06752010
[4005007.703096] R10: 0022 R11: 0246 R12: 
00022000
[4005007.703099] R13: 0003 R14: 0002 R15: 
0002
[4005007.703105]  
[4005007.703107] Modules linked in: nf_tables libcrc32c nfnetlink algif_hash 
af_alg binfmt_misc nls_   iso8859_1 ipmi_ssif ast intel_rapl_msr 
intel_rapl_common drm_vram_helper drm_ttm_helper amd64_edac t   tm 
edac_mce_amd kvm_amd ccp mac_hid k10temp kvm acpi_ipmi ipmi_si rapl 
sch_fq_codel ipmi_devintf ipm   i_msghandler msr parport_pc ppdev lp 
parport mtd pstore_blk efi_pstore ramoops pstore_zone reed_solo   mon 
ip_tables x_tables autofs4 ib_uverbs ib_core amdgpu(OE) amddrm_ttm_helper(OE) 
amdttm(OE) iommu_v   2 amd_sched(OE) amdkcl(OE) drm_kms_helper syscopyarea 
sysfillrect sysimgblt fb_sys_fops cec rc_coredrm igb ahci xhci_pci 
libahci i2c_piix4 i2c_algo_bit xhci_pci_renesas dca
[4005007.703184] CR2: 
[4005007.703188] ---[ end trace ac65a538d240da39 ]---
[4005007.800865] RIP: 0010:0x0
[4005007.800871] Code: Unable to access opcode bytes at RIP 0xffd6.
[4005007.800874] RSP: 0018:a82b46d27da0 EFLAGS: 00010206
[4005007.800878] RAX:  RBX:  RCX: 
a82b46d27e68
[4005007.800881] RDX: 0001 RSI:  RDI: 
9940656e
[4005007.800883] RBP: a82b46d27dd8 R08:  R09: 
994060c07980
[4005007.800886] R10: 0002 R11:  R12: 
7f5e06753000
[4005007.800888] R13: 9940656e R14: a82b46d27e68 R15: 
7f5e06753000
[4005007.800891] FS:  7f5e0755b740() GS:99479d30() 
knlGS:
[4005007.800895] CS:  0010 DS:  ES:  CR0: 80050033
[4005007.800898] CR2: ffd6 CR3: 0003253fc000 CR4: 
003506e0

Signed-off-by: Qu Huang 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 ++
 1 file changed, 6 insertions(+)

diff

[PATCH AUTOSEL 4.19 3/5] drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit 0f0e59075b5c22f1e871fbd508d6e4f495048356 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2036742
Signed-off-by: Mario Limonciello 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h | 12 ++--
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h 
b/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h
index d5a4a08c6d392..0c61e2bc14cde 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h
@@ -164,7 +164,7 @@ typedef struct _ATOM_Tonga_State {
 typedef struct _ATOM_Tonga_State_Array {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number of entries. */
-   ATOM_Tonga_State entries[1];/* Dynamically allocate entries. */
+   ATOM_Tonga_State entries[]; /* Dynamically allocate entries. */
 } ATOM_Tonga_State_Array;
 
 typedef struct _ATOM_Tonga_MCLK_Dependency_Record {
@@ -210,7 +210,7 @@ typedef struct _ATOM_Polaris_SCLK_Dependency_Record {
 typedef struct _ATOM_Polaris_SCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Polaris_SCLK_Dependency_Record entries[1]; 
 /* Dynamically allocate entries. */
+   ATOM_Polaris_SCLK_Dependency_Record entries[];  
 /* Dynamically allocate entries. */
 } ATOM_Polaris_SCLK_Dependency_Table;
 
 typedef struct _ATOM_Tonga_PCIE_Record {
@@ -222,7 +222,7 @@ typedef struct _ATOM_Tonga_PCIE_Record {
 typedef struct _ATOM_Tonga_PCIE_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_PCIE_Record entries[1];  
/* Dynamically allocate entries. */
+   ATOM_Tonga_PCIE_Record entries[];   
/* Dynamically allocate entries. */
 } ATOM_Tonga_PCIE_Table;
 
 typedef struct _ATOM_Polaris10_PCIE_Record {
@@ -235,7 +235,7 @@ typedef struct _ATOM_Polaris10_PCIE_Record {
 typedef struct _ATOM_Polaris10_PCIE_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Polaris10_PCIE_Record entries[1];  /* 
Dynamically allocate entries. */
+   ATOM_Polaris10_PCIE_Record entries[];  /* 
Dynamically allocate entries. */
 } ATOM_Polaris10_PCIE_Table;
 
 
@@ -252,7 +252,7 @@ typedef struct _ATOM_Tonga_MM_Dependency_Record {
 typedef struct _ATOM_Tonga_MM_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_MM_Dependency_Record entries[1];/* 
Dynamically allocate entries. */
+   ATOM_Tonga_MM_Dependency_Record entries[]; /* 
Dynamically allocate entries. */
 } ATOM_Tonga_MM_Dependency_Table;
 
 typedef struct _ATOM_Tonga_Voltage_Lookup_Record {
@@ -265,7 +265,7 @@ typedef struct _ATOM_Tonga_Voltage_Lookup_Record {
 typedef struct _ATOM_Tonga_Voltage_Lookup_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_Voltage_Lookup_Record entries[1];
/* Dynamically allocate entries. */
+   ATOM_Tonga_Voltage_Lookup_Record entries[]; 
/* Dynamically allocate entries. */
 } ATOM_Tonga_Voltage_Lookup_Table;
 
 typedef struct _ATOM_Tonga_Fan_Table {
-- 
2.42.0

[PATCH AUTOSEL 4.19 1/5] drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit 760efbca74a405dc439a013a5efaa9fadc95a8c3 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Suggested-by: Felix Held 
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2874
Signed-off-by: Mario Limonciello 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/include/pptable.h  | 4 ++--
 drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/include/pptable.h 
b/drivers/gpu/drm/amd/include/pptable.h
index 0b6a057e0a4c4..5aac8d545bdc6 100644
--- a/drivers/gpu/drm/amd/include/pptable.h
+++ b/drivers/gpu/drm/amd/include/pptable.h
@@ -78,7 +78,7 @@ typedef struct _ATOM_PPLIB_THERMALCONTROLLER
 typedef struct _ATOM_PPLIB_STATE
 {
 UCHAR ucNonClockStateIndex;
-UCHAR ucClockStateIndices[1]; // variable-sized
+UCHAR ucClockStateIndices[]; // variable-sized
 } ATOM_PPLIB_STATE;
 
 
@@ -473,7 +473,7 @@ typedef struct _ATOM_PPLIB_STATE_V2
   /**
   * Driver will read the first ucNumDPMLevels in this array
   */
-  UCHAR clockInfoIndex[1];
+  UCHAR clockInfoIndex[];
 } ATOM_PPLIB_STATE_V2;
 
 typedef struct _StateArray{
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h 
b/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h
index 1e870f58dd12a..d5a4a08c6d392 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h
@@ -179,7 +179,7 @@ typedef struct _ATOM_Tonga_MCLK_Dependency_Record {
 typedef struct _ATOM_Tonga_MCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_MCLK_Dependency_Record entries[1];   
/* Dynamically allocate entries. */
+   ATOM_Tonga_MCLK_Dependency_Record entries[];
/* Dynamically allocate entries. */
 } ATOM_Tonga_MCLK_Dependency_Table;
 
 typedef struct _ATOM_Tonga_SCLK_Dependency_Record {
@@ -194,7 +194,7 @@ typedef struct _ATOM_Tonga_SCLK_Dependency_Record {
 typedef struct _ATOM_Tonga_SCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_SCLK_Dependency_Record entries[1];   
 /* Dynamically allocate entries. */
+   ATOM_Tonga_SCLK_Dependency_Record entries[];
 /* Dynamically allocate entries. */
 } ATOM_Tonga_SCLK_Dependency_Table;
 
 typedef struct _ATOM_Polaris_SCLK_Dependency_Record {
-- 
2.42.0

[PATCH AUTOSEL 4.19 2/5] drm/radeon: Fix UBSAN array-index-out-of-bounds for Radeon HD 5430

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit c63079c61177ba1b17fa05c6875699a36924fe39 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Suggested-by: Felix Held 
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2894
Signed-off-by: Mario Limonciello 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/radeon/pptable.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/radeon/pptable.h b/drivers/gpu/drm/radeon/pptable.h
index 4c2eec49dadc9..94947229888ba 100644
--- a/drivers/gpu/drm/radeon/pptable.h
+++ b/drivers/gpu/drm/radeon/pptable.h
@@ -74,7 +74,7 @@ typedef struct _ATOM_PPLIB_THERMALCONTROLLER
 typedef struct _ATOM_PPLIB_STATE
 {
 UCHAR ucNonClockStateIndex;
-UCHAR ucClockStateIndices[1]; // variable-sized
+UCHAR ucClockStateIndices[]; // variable-sized
 } ATOM_PPLIB_STATE;
 
 
-- 
2.42.0

[PATCH AUTOSEL 5.4 5/6] drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL

2023-11-07 Thread Sasha Levin

From: Qu Huang 

[ Upstream commit 5104fdf50d326db2c1a994f8b35dcd46e63ae4ad ]

In certain types of chips, such as VEGA20, reading the amdgpu_regs_smc file 
could result in an abnormal null pointer access when the smc_rreg pointer is 
NULL. Below are the steps to reproduce this issue and the corresponding 
exception log:

1. Navigate to the directory: /sys/kernel/debug/dri/0
2. Execute command: cat amdgpu_regs_smc
3. Exception Log::
[4005007.702554] BUG: kernel NULL pointer dereference, address: 
[4005007.702562] #PF: supervisor instruction fetch in kernel mode
[4005007.702567] #PF: error_code(0x0010) - not-present page
[4005007.702570] PGD 0 P4D 0
[4005007.702576] Oops: 0010 [#1] SMP NOPTI
[4005007.702581] CPU: 4 PID: 62563 Comm: cat Tainted: G   OE 
5.15.0-43-generic #46-Ubunt   u
[4005007.702590] RIP: 0010:0x0
[4005007.702598] Code: Unable to access opcode bytes at RIP 0xffd6.
[4005007.702600] RSP: 0018:a82b46d27da0 EFLAGS: 00010206
[4005007.702605] RAX:  RBX:  RCX: 
a82b46d27e68
[4005007.702609] RDX: 0001 RSI:  RDI: 
9940656e
[4005007.702612] RBP: a82b46d27dd8 R08:  R09: 
994060c07980
[4005007.702615] R10: 0002 R11:  R12: 
7f5e06753000
[4005007.702618] R13: 9940656e R14: a82b46d27e68 R15: 
7f5e06753000
[4005007.702622] FS:  7f5e0755b740() GS:99479d30() 
knlGS:
[4005007.702626] CS:  0010 DS:  ES:  CR0: 80050033
[4005007.702629] CR2: ffd6 CR3: 0003253fc000 CR4: 
003506e0
[4005007.702633] Call Trace:
[4005007.702636]  
[4005007.702640]  amdgpu_debugfs_regs_smc_read+0xb0/0x120 [amdgpu]
[4005007.703002]  full_proxy_read+0x5c/0x80
[4005007.703011]  vfs_read+0x9f/0x1a0
[4005007.703019]  ksys_read+0x67/0xe0
[4005007.703023]  __x64_sys_read+0x19/0x20
[4005007.703028]  do_syscall_64+0x5c/0xc0
[4005007.703034]  ? do_user_addr_fault+0x1e3/0x670
[4005007.703040]  ? exit_to_user_mode_prepare+0x37/0xb0
[4005007.703047]  ? irqentry_exit_to_user_mode+0x9/0x20
[4005007.703052]  ? irqentry_exit+0x19/0x30
[4005007.703057]  ? exc_page_fault+0x89/0x160
[4005007.703062]  ? asm_exc_page_fault+0x8/0x30
[4005007.703068]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[4005007.703075] RIP: 0033:0x7f5e07672992
[4005007.703079] Code: c0 e9 b2 fe ff ff 50 48 8d 3d fa b2 0c 00 e8 c5 1d 02 00 
0f 1f 44 00 00 f3 0f1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 
<48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 e   c 28 48 89 54 24
[4005007.703083] RSP: 002b:7ffe03097898 EFLAGS: 0246 ORIG_RAX: 

[4005007.703088] RAX: ffda RBX: 0002 RCX: 
7f5e07672992
[4005007.703091] RDX: 0002 RSI: 7f5e06753000 RDI: 
0003
[4005007.703094] RBP: 7f5e06753000 R08: 7f5e06752010 R09: 
7f5e06752010
[4005007.703096] R10: 0022 R11: 0246 R12: 
00022000
[4005007.703099] R13: 0003 R14: 0002 R15: 
0002
[4005007.703105]  
[4005007.703107] Modules linked in: nf_tables libcrc32c nfnetlink algif_hash 
af_alg binfmt_misc nls_   iso8859_1 ipmi_ssif ast intel_rapl_msr 
intel_rapl_common drm_vram_helper drm_ttm_helper amd64_edac t   tm 
edac_mce_amd kvm_amd ccp mac_hid k10temp kvm acpi_ipmi ipmi_si rapl 
sch_fq_codel ipmi_devintf ipm   i_msghandler msr parport_pc ppdev lp 
parport mtd pstore_blk efi_pstore ramoops pstore_zone reed_solo   mon 
ip_tables x_tables autofs4 ib_uverbs ib_core amdgpu(OE) amddrm_ttm_helper(OE) 
amdttm(OE) iommu_v   2 amd_sched(OE) amdkcl(OE) drm_kms_helper syscopyarea 
sysfillrect sysimgblt fb_sys_fops cec rc_coredrm igb ahci xhci_pci 
libahci i2c_piix4 i2c_algo_bit xhci_pci_renesas dca
[4005007.703184] CR2: 
[4005007.703188] ---[ end trace ac65a538d240da39 ]---
[4005007.800865] RIP: 0010:0x0
[4005007.800871] Code: Unable to access opcode bytes at RIP 0xffd6.
[4005007.800874] RSP: 0018:a82b46d27da0 EFLAGS: 00010206
[4005007.800878] RAX:  RBX:  RCX: 
a82b46d27e68
[4005007.800881] RDX: 0001 RSI:  RDI: 
9940656e
[4005007.800883] RBP: a82b46d27dd8 R08:  R09: 
994060c07980
[4005007.800886] R10: 0002 R11:  R12: 
7f5e06753000
[4005007.800888] R13: 9940656e R14: a82b46d27e68 R15: 
7f5e06753000
[4005007.800891] FS:  7f5e0755b740() GS:99479d30() 
knlGS:
[4005007.800895] CS:  0010 DS:  ES:  CR0: 80050033
[4005007.800898] CR2: ffd6 CR3: 0003253fc000 CR4: 
003506e0

Signed-off-by: Qu Huang 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 ++
 1 file changed, 6 insertions(+)

diff

[PATCH AUTOSEL 5.4 4/6] drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit 0f0e59075b5c22f1e871fbd508d6e4f495048356 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2036742
Signed-off-by: Mario Limonciello 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h | 12 ++--
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h 
b/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h
index d5a4a08c6d392..0c61e2bc14cde 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h
@@ -164,7 +164,7 @@ typedef struct _ATOM_Tonga_State {
 typedef struct _ATOM_Tonga_State_Array {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number of entries. */
-   ATOM_Tonga_State entries[1];/* Dynamically allocate entries. */
+   ATOM_Tonga_State entries[]; /* Dynamically allocate entries. */
 } ATOM_Tonga_State_Array;
 
 typedef struct _ATOM_Tonga_MCLK_Dependency_Record {
@@ -210,7 +210,7 @@ typedef struct _ATOM_Polaris_SCLK_Dependency_Record {
 typedef struct _ATOM_Polaris_SCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Polaris_SCLK_Dependency_Record entries[1]; 
 /* Dynamically allocate entries. */
+   ATOM_Polaris_SCLK_Dependency_Record entries[];  
 /* Dynamically allocate entries. */
 } ATOM_Polaris_SCLK_Dependency_Table;
 
 typedef struct _ATOM_Tonga_PCIE_Record {
@@ -222,7 +222,7 @@ typedef struct _ATOM_Tonga_PCIE_Record {
 typedef struct _ATOM_Tonga_PCIE_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_PCIE_Record entries[1];  
/* Dynamically allocate entries. */
+   ATOM_Tonga_PCIE_Record entries[];   
/* Dynamically allocate entries. */
 } ATOM_Tonga_PCIE_Table;
 
 typedef struct _ATOM_Polaris10_PCIE_Record {
@@ -235,7 +235,7 @@ typedef struct _ATOM_Polaris10_PCIE_Record {
 typedef struct _ATOM_Polaris10_PCIE_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Polaris10_PCIE_Record entries[1];  /* 
Dynamically allocate entries. */
+   ATOM_Polaris10_PCIE_Record entries[];  /* 
Dynamically allocate entries. */
 } ATOM_Polaris10_PCIE_Table;
 
 
@@ -252,7 +252,7 @@ typedef struct _ATOM_Tonga_MM_Dependency_Record {
 typedef struct _ATOM_Tonga_MM_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_MM_Dependency_Record entries[1];/* 
Dynamically allocate entries. */
+   ATOM_Tonga_MM_Dependency_Record entries[]; /* 
Dynamically allocate entries. */
 } ATOM_Tonga_MM_Dependency_Table;
 
 typedef struct _ATOM_Tonga_Voltage_Lookup_Record {
@@ -265,7 +265,7 @@ typedef struct _ATOM_Tonga_Voltage_Lookup_Record {
 typedef struct _ATOM_Tonga_Voltage_Lookup_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_Voltage_Lookup_Record entries[1];
/* Dynamically allocate entries. */
+   ATOM_Tonga_Voltage_Lookup_Record entries[]; 
/* Dynamically allocate entries. */
 } ATOM_Tonga_Voltage_Lookup_Table;
 
 typedef struct _ATOM_Tonga_Fan_Table {
-- 
2.42.0

[PATCH AUTOSEL 5.4 2/6] drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit 760efbca74a405dc439a013a5efaa9fadc95a8c3 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Suggested-by: Felix Held 
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2874
Signed-off-by: Mario Limonciello 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/include/pptable.h  | 4 ++--
 drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/include/pptable.h 
b/drivers/gpu/drm/amd/include/pptable.h
index 0b6a057e0a4c4..5aac8d545bdc6 100644
--- a/drivers/gpu/drm/amd/include/pptable.h
+++ b/drivers/gpu/drm/amd/include/pptable.h
@@ -78,7 +78,7 @@ typedef struct _ATOM_PPLIB_THERMALCONTROLLER
 typedef struct _ATOM_PPLIB_STATE
 {
 UCHAR ucNonClockStateIndex;
-UCHAR ucClockStateIndices[1]; // variable-sized
+UCHAR ucClockStateIndices[]; // variable-sized
 } ATOM_PPLIB_STATE;
 
 
@@ -473,7 +473,7 @@ typedef struct _ATOM_PPLIB_STATE_V2
   /**
   * Driver will read the first ucNumDPMLevels in this array
   */
-  UCHAR clockInfoIndex[1];
+  UCHAR clockInfoIndex[];
 } ATOM_PPLIB_STATE_V2;
 
 typedef struct _StateArray{
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h 
b/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h
index 1e870f58dd12a..d5a4a08c6d392 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h
@@ -179,7 +179,7 @@ typedef struct _ATOM_Tonga_MCLK_Dependency_Record {
 typedef struct _ATOM_Tonga_MCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_MCLK_Dependency_Record entries[1];   
/* Dynamically allocate entries. */
+   ATOM_Tonga_MCLK_Dependency_Record entries[];
/* Dynamically allocate entries. */
 } ATOM_Tonga_MCLK_Dependency_Table;
 
 typedef struct _ATOM_Tonga_SCLK_Dependency_Record {
@@ -194,7 +194,7 @@ typedef struct _ATOM_Tonga_SCLK_Dependency_Record {
 typedef struct _ATOM_Tonga_SCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_SCLK_Dependency_Record entries[1];   
 /* Dynamically allocate entries. */
+   ATOM_Tonga_SCLK_Dependency_Record entries[];
 /* Dynamically allocate entries. */
 } ATOM_Tonga_SCLK_Dependency_Table;
 
 typedef struct _ATOM_Polaris_SCLK_Dependency_Record {
-- 
2.42.0

[PATCH AUTOSEL 5.4 3/6] drm/radeon: Fix UBSAN array-index-out-of-bounds for Radeon HD 5430

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit c63079c61177ba1b17fa05c6875699a36924fe39 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Suggested-by: Felix Held 
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2894
Signed-off-by: Mario Limonciello 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/radeon/pptable.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/radeon/pptable.h b/drivers/gpu/drm/radeon/pptable.h
index 4c2eec49dadc9..94947229888ba 100644
--- a/drivers/gpu/drm/radeon/pptable.h
+++ b/drivers/gpu/drm/radeon/pptable.h
@@ -74,7 +74,7 @@ typedef struct _ATOM_PPLIB_THERMALCONTROLLER
 typedef struct _ATOM_PPLIB_STATE
 {
 UCHAR ucNonClockStateIndex;
-UCHAR ucClockStateIndices[1]; // variable-sized
+UCHAR ucClockStateIndices[]; // variable-sized
 } ATOM_PPLIB_STATE;
 
 
-- 
2.42.0

[PATCH AUTOSEL 5.10 10/11] drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL

2023-11-07 Thread Sasha Levin

From: Qu Huang 

[ Upstream commit 5104fdf50d326db2c1a994f8b35dcd46e63ae4ad ]

In certain types of chips, such as VEGA20, reading the amdgpu_regs_smc file 
could result in an abnormal null pointer access when the smc_rreg pointer is 
NULL. Below are the steps to reproduce this issue and the corresponding 
exception log:

1. Navigate to the directory: /sys/kernel/debug/dri/0
2. Execute command: cat amdgpu_regs_smc
3. Exception Log::
[4005007.702554] BUG: kernel NULL pointer dereference, address: 
[4005007.702562] #PF: supervisor instruction fetch in kernel mode
[4005007.702567] #PF: error_code(0x0010) - not-present page
[4005007.702570] PGD 0 P4D 0
[4005007.702576] Oops: 0010 [#1] SMP NOPTI
[4005007.702581] CPU: 4 PID: 62563 Comm: cat Tainted: G   OE 
5.15.0-43-generic #46-Ubunt   u
[4005007.702590] RIP: 0010:0x0
[4005007.702598] Code: Unable to access opcode bytes at RIP 0xffd6.
[4005007.702600] RSP: 0018:a82b46d27da0 EFLAGS: 00010206
[4005007.702605] RAX:  RBX:  RCX: 
a82b46d27e68
[4005007.702609] RDX: 0001 RSI:  RDI: 
9940656e
[4005007.702612] RBP: a82b46d27dd8 R08:  R09: 
994060c07980
[4005007.702615] R10: 0002 R11:  R12: 
7f5e06753000
[4005007.702618] R13: 9940656e R14: a82b46d27e68 R15: 
7f5e06753000
[4005007.702622] FS:  7f5e0755b740() GS:99479d30() 
knlGS:
[4005007.702626] CS:  0010 DS:  ES:  CR0: 80050033
[4005007.702629] CR2: ffd6 CR3: 0003253fc000 CR4: 
003506e0
[4005007.702633] Call Trace:
[4005007.702636]  
[4005007.702640]  amdgpu_debugfs_regs_smc_read+0xb0/0x120 [amdgpu]
[4005007.703002]  full_proxy_read+0x5c/0x80
[4005007.703011]  vfs_read+0x9f/0x1a0
[4005007.703019]  ksys_read+0x67/0xe0
[4005007.703023]  __x64_sys_read+0x19/0x20
[4005007.703028]  do_syscall_64+0x5c/0xc0
[4005007.703034]  ? do_user_addr_fault+0x1e3/0x670
[4005007.703040]  ? exit_to_user_mode_prepare+0x37/0xb0
[4005007.703047]  ? irqentry_exit_to_user_mode+0x9/0x20
[4005007.703052]  ? irqentry_exit+0x19/0x30
[4005007.703057]  ? exc_page_fault+0x89/0x160
[4005007.703062]  ? asm_exc_page_fault+0x8/0x30
[4005007.703068]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[4005007.703075] RIP: 0033:0x7f5e07672992
[4005007.703079] Code: c0 e9 b2 fe ff ff 50 48 8d 3d fa b2 0c 00 e8 c5 1d 02 00 
0f 1f 44 00 00 f3 0f1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 
<48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 e   c 28 48 89 54 24
[4005007.703083] RSP: 002b:7ffe03097898 EFLAGS: 0246 ORIG_RAX: 

[4005007.703088] RAX: ffda RBX: 0002 RCX: 
7f5e07672992
[4005007.703091] RDX: 0002 RSI: 7f5e06753000 RDI: 
0003
[4005007.703094] RBP: 7f5e06753000 R08: 7f5e06752010 R09: 
7f5e06752010
[4005007.703096] R10: 0022 R11: 0246 R12: 
00022000
[4005007.703099] R13: 0003 R14: 0002 R15: 
0002
[4005007.703105]  
[4005007.703107] Modules linked in: nf_tables libcrc32c nfnetlink algif_hash 
af_alg binfmt_misc nls_   iso8859_1 ipmi_ssif ast intel_rapl_msr 
intel_rapl_common drm_vram_helper drm_ttm_helper amd64_edac t   tm 
edac_mce_amd kvm_amd ccp mac_hid k10temp kvm acpi_ipmi ipmi_si rapl 
sch_fq_codel ipmi_devintf ipm   i_msghandler msr parport_pc ppdev lp 
parport mtd pstore_blk efi_pstore ramoops pstore_zone reed_solo   mon 
ip_tables x_tables autofs4 ib_uverbs ib_core amdgpu(OE) amddrm_ttm_helper(OE) 
amdttm(OE) iommu_v   2 amd_sched(OE) amdkcl(OE) drm_kms_helper syscopyarea 
sysfillrect sysimgblt fb_sys_fops cec rc_coredrm igb ahci xhci_pci 
libahci i2c_piix4 i2c_algo_bit xhci_pci_renesas dca
[4005007.703184] CR2: 
[4005007.703188] ---[ end trace ac65a538d240da39 ]---
[4005007.800865] RIP: 0010:0x0
[4005007.800871] Code: Unable to access opcode bytes at RIP 0xffd6.
[4005007.800874] RSP: 0018:a82b46d27da0 EFLAGS: 00010206
[4005007.800878] RAX:  RBX:  RCX: 
a82b46d27e68
[4005007.800881] RDX: 0001 RSI:  RDI: 
9940656e
[4005007.800883] RBP: a82b46d27dd8 R08:  R09: 
994060c07980
[4005007.800886] R10: 0002 R11:  R12: 
7f5e06753000
[4005007.800888] R13: 9940656e R14: a82b46d27e68 R15: 
7f5e06753000
[4005007.800891] FS:  7f5e0755b740() GS:99479d30() 
knlGS:
[4005007.800895] CS:  0010 DS:  ES:  CR0: 80050033
[4005007.800898] CR2: ffd6 CR3: 0003253fc000 CR4: 
003506e0

Signed-off-by: Qu Huang 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 ++
 1 file changed, 6 insertions(+)

diff

[PATCH AUTOSEL 5.10 06/11] drm/amdgpu: Fix potential null pointer derefernce

2023-11-07 Thread Sasha Levin

From: "Stanley.Yang" 

[ Upstream commit 80285ae1ec8717b597b20de38866c29d84d321a1 ]

The amdgpu_ras_get_context may return NULL if device
not support ras feature, so add check before using.

Signed-off-by: Stanley.Yang 
Reviewed-by: Tao Zhou 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index f0db9724ca85e..a093f1b277244 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -4530,7 +4530,8 @@ int amdgpu_device_gpu_recover(struct amdgpu_device *adev,
 * Flush RAM to disk so that after reboot
 * the user can read log and see why the system rebooted.
 */
-   if (need_emergency_restart && amdgpu_ras_get_context(adev)->reboot) {
+   if (need_emergency_restart && amdgpu_ras_get_context(adev) &&
+   amdgpu_ras_get_context(adev)->reboot) {
DRM_WARN("Emergency reboot.");
 
ksys_sync_helper();
-- 
2.42.0

[PATCH AUTOSEL 5.10 05/11] drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit 0f0e59075b5c22f1e871fbd508d6e4f495048356 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2036742
Signed-off-by: Mario Limonciello 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 .../gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h| 12 ++--
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h 
b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
index d5a4a08c6d392..0c61e2bc14cde 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
@@ -164,7 +164,7 @@ typedef struct _ATOM_Tonga_State {
 typedef struct _ATOM_Tonga_State_Array {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number of entries. */
-   ATOM_Tonga_State entries[1];/* Dynamically allocate entries. */
+   ATOM_Tonga_State entries[]; /* Dynamically allocate entries. */
 } ATOM_Tonga_State_Array;
 
 typedef struct _ATOM_Tonga_MCLK_Dependency_Record {
@@ -210,7 +210,7 @@ typedef struct _ATOM_Polaris_SCLK_Dependency_Record {
 typedef struct _ATOM_Polaris_SCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Polaris_SCLK_Dependency_Record entries[1]; 
 /* Dynamically allocate entries. */
+   ATOM_Polaris_SCLK_Dependency_Record entries[];  
 /* Dynamically allocate entries. */
 } ATOM_Polaris_SCLK_Dependency_Table;
 
 typedef struct _ATOM_Tonga_PCIE_Record {
@@ -222,7 +222,7 @@ typedef struct _ATOM_Tonga_PCIE_Record {
 typedef struct _ATOM_Tonga_PCIE_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_PCIE_Record entries[1];  
/* Dynamically allocate entries. */
+   ATOM_Tonga_PCIE_Record entries[];   
/* Dynamically allocate entries. */
 } ATOM_Tonga_PCIE_Table;
 
 typedef struct _ATOM_Polaris10_PCIE_Record {
@@ -235,7 +235,7 @@ typedef struct _ATOM_Polaris10_PCIE_Record {
 typedef struct _ATOM_Polaris10_PCIE_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Polaris10_PCIE_Record entries[1];  /* 
Dynamically allocate entries. */
+   ATOM_Polaris10_PCIE_Record entries[];  /* 
Dynamically allocate entries. */
 } ATOM_Polaris10_PCIE_Table;
 
 
@@ -252,7 +252,7 @@ typedef struct _ATOM_Tonga_MM_Dependency_Record {
 typedef struct _ATOM_Tonga_MM_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_MM_Dependency_Record entries[1];/* 
Dynamically allocate entries. */
+   ATOM_Tonga_MM_Dependency_Record entries[]; /* 
Dynamically allocate entries. */
 } ATOM_Tonga_MM_Dependency_Table;
 
 typedef struct _ATOM_Tonga_Voltage_Lookup_Record {
@@ -265,7 +265,7 @@ typedef struct _ATOM_Tonga_Voltage_Lookup_Record {
 typedef struct _ATOM_Tonga_Voltage_Lookup_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_Voltage_Lookup_Record entries[1];
/* Dynamically allocate entries. */
+   ATOM_Tonga_Voltage_Lookup_Record entries[]; 
/* Dynamically allocate entries. */
 } ATOM_Tonga_Voltage_Lookup_Table;
 
 typedef struct _ATOM_Tonga_Fan_Table {
-- 
2.42.0

[PATCH AUTOSEL 5.10 04/11] drm/radeon: Fix UBSAN array-index-out-of-bounds for Radeon HD 5430

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit c63079c61177ba1b17fa05c6875699a36924fe39 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Suggested-by: Felix Held 
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2894
Signed-off-by: Mario Limonciello 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/radeon/pptable.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/radeon/pptable.h b/drivers/gpu/drm/radeon/pptable.h
index 4c2eec49dadc9..94947229888ba 100644
--- a/drivers/gpu/drm/radeon/pptable.h
+++ b/drivers/gpu/drm/radeon/pptable.h
@@ -74,7 +74,7 @@ typedef struct _ATOM_PPLIB_THERMALCONTROLLER
 typedef struct _ATOM_PPLIB_STATE
 {
 UCHAR ucNonClockStateIndex;
-UCHAR ucClockStateIndices[1]; // variable-sized
+UCHAR ucClockStateIndices[]; // variable-sized
 } ATOM_PPLIB_STATE;
 
 
-- 
2.42.0

[PATCH AUTOSEL 5.10 03/11] drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit 760efbca74a405dc439a013a5efaa9fadc95a8c3 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Suggested-by: Felix Held 
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2874
Signed-off-by: Mario Limonciello 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/include/pptable.h | 4 ++--
 drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/include/pptable.h 
b/drivers/gpu/drm/amd/include/pptable.h
index 0b6a057e0a4c4..5aac8d545bdc6 100644
--- a/drivers/gpu/drm/amd/include/pptable.h
+++ b/drivers/gpu/drm/amd/include/pptable.h
@@ -78,7 +78,7 @@ typedef struct _ATOM_PPLIB_THERMALCONTROLLER
 typedef struct _ATOM_PPLIB_STATE
 {
 UCHAR ucNonClockStateIndex;
-UCHAR ucClockStateIndices[1]; // variable-sized
+UCHAR ucClockStateIndices[]; // variable-sized
 } ATOM_PPLIB_STATE;
 
 
@@ -473,7 +473,7 @@ typedef struct _ATOM_PPLIB_STATE_V2
   /**
   * Driver will read the first ucNumDPMLevels in this array
   */
-  UCHAR clockInfoIndex[1];
+  UCHAR clockInfoIndex[];
 } ATOM_PPLIB_STATE_V2;
 
 typedef struct _StateArray{
diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h 
b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
index 1e870f58dd12a..d5a4a08c6d392 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
@@ -179,7 +179,7 @@ typedef struct _ATOM_Tonga_MCLK_Dependency_Record {
 typedef struct _ATOM_Tonga_MCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_MCLK_Dependency_Record entries[1];   
/* Dynamically allocate entries. */
+   ATOM_Tonga_MCLK_Dependency_Record entries[];
/* Dynamically allocate entries. */
 } ATOM_Tonga_MCLK_Dependency_Table;
 
 typedef struct _ATOM_Tonga_SCLK_Dependency_Record {
@@ -194,7 +194,7 @@ typedef struct _ATOM_Tonga_SCLK_Dependency_Record {
 typedef struct _ATOM_Tonga_SCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_SCLK_Dependency_Record entries[1];   
 /* Dynamically allocate entries. */
+   ATOM_Tonga_SCLK_Dependency_Record entries[];
 /* Dynamically allocate entries. */
 } ATOM_Tonga_SCLK_Dependency_Table;
 
 typedef struct _ATOM_Polaris_SCLK_Dependency_Record {
-- 
2.42.0

[PATCH AUTOSEL 5.15 18/20] drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL

2023-11-07 Thread Sasha Levin

From: Qu Huang 

[ Upstream commit 5104fdf50d326db2c1a994f8b35dcd46e63ae4ad ]

In certain types of chips, such as VEGA20, reading the amdgpu_regs_smc file 
could result in an abnormal null pointer access when the smc_rreg pointer is 
NULL. Below are the steps to reproduce this issue and the corresponding 
exception log:

1. Navigate to the directory: /sys/kernel/debug/dri/0
2. Execute command: cat amdgpu_regs_smc
3. Exception Log::
[4005007.702554] BUG: kernel NULL pointer dereference, address: 
[4005007.702562] #PF: supervisor instruction fetch in kernel mode
[4005007.702567] #PF: error_code(0x0010) - not-present page
[4005007.702570] PGD 0 P4D 0
[4005007.702576] Oops: 0010 [#1] SMP NOPTI
[4005007.702581] CPU: 4 PID: 62563 Comm: cat Tainted: G   OE 
5.15.0-43-generic #46-Ubunt   u
[4005007.702590] RIP: 0010:0x0
[4005007.702598] Code: Unable to access opcode bytes at RIP 0xffd6.
[4005007.702600] RSP: 0018:a82b46d27da0 EFLAGS: 00010206
[4005007.702605] RAX:  RBX:  RCX: 
a82b46d27e68
[4005007.702609] RDX: 0001 RSI:  RDI: 
9940656e
[4005007.702612] RBP: a82b46d27dd8 R08:  R09: 
994060c07980
[4005007.702615] R10: 0002 R11:  R12: 
7f5e06753000
[4005007.702618] R13: 9940656e R14: a82b46d27e68 R15: 
7f5e06753000
[4005007.702622] FS:  7f5e0755b740() GS:99479d30() 
knlGS:
[4005007.702626] CS:  0010 DS:  ES:  CR0: 80050033
[4005007.702629] CR2: ffd6 CR3: 0003253fc000 CR4: 
003506e0
[4005007.702633] Call Trace:
[4005007.702636]  
[4005007.702640]  amdgpu_debugfs_regs_smc_read+0xb0/0x120 [amdgpu]
[4005007.703002]  full_proxy_read+0x5c/0x80
[4005007.703011]  vfs_read+0x9f/0x1a0
[4005007.703019]  ksys_read+0x67/0xe0
[4005007.703023]  __x64_sys_read+0x19/0x20
[4005007.703028]  do_syscall_64+0x5c/0xc0
[4005007.703034]  ? do_user_addr_fault+0x1e3/0x670
[4005007.703040]  ? exit_to_user_mode_prepare+0x37/0xb0
[4005007.703047]  ? irqentry_exit_to_user_mode+0x9/0x20
[4005007.703052]  ? irqentry_exit+0x19/0x30
[4005007.703057]  ? exc_page_fault+0x89/0x160
[4005007.703062]  ? asm_exc_page_fault+0x8/0x30
[4005007.703068]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[4005007.703075] RIP: 0033:0x7f5e07672992
[4005007.703079] Code: c0 e9 b2 fe ff ff 50 48 8d 3d fa b2 0c 00 e8 c5 1d 02 00 
0f 1f 44 00 00 f3 0f1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 
<48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 e   c 28 48 89 54 24
[4005007.703083] RSP: 002b:7ffe03097898 EFLAGS: 0246 ORIG_RAX: 

[4005007.703088] RAX: ffda RBX: 0002 RCX: 
7f5e07672992
[4005007.703091] RDX: 0002 RSI: 7f5e06753000 RDI: 
0003
[4005007.703094] RBP: 7f5e06753000 R08: 7f5e06752010 R09: 
7f5e06752010
[4005007.703096] R10: 0022 R11: 0246 R12: 
00022000
[4005007.703099] R13: 0003 R14: 0002 R15: 
0002
[4005007.703105]  
[4005007.703107] Modules linked in: nf_tables libcrc32c nfnetlink algif_hash 
af_alg binfmt_misc nls_   iso8859_1 ipmi_ssif ast intel_rapl_msr 
intel_rapl_common drm_vram_helper drm_ttm_helper amd64_edac t   tm 
edac_mce_amd kvm_amd ccp mac_hid k10temp kvm acpi_ipmi ipmi_si rapl 
sch_fq_codel ipmi_devintf ipm   i_msghandler msr parport_pc ppdev lp 
parport mtd pstore_blk efi_pstore ramoops pstore_zone reed_solo   mon 
ip_tables x_tables autofs4 ib_uverbs ib_core amdgpu(OE) amddrm_ttm_helper(OE) 
amdttm(OE) iommu_v   2 amd_sched(OE) amdkcl(OE) drm_kms_helper syscopyarea 
sysfillrect sysimgblt fb_sys_fops cec rc_coredrm igb ahci xhci_pci 
libahci i2c_piix4 i2c_algo_bit xhci_pci_renesas dca
[4005007.703184] CR2: 
[4005007.703188] ---[ end trace ac65a538d240da39 ]---
[4005007.800865] RIP: 0010:0x0
[4005007.800871] Code: Unable to access opcode bytes at RIP 0xffd6.
[4005007.800874] RSP: 0018:a82b46d27da0 EFLAGS: 00010206
[4005007.800878] RAX:  RBX:  RCX: 
a82b46d27e68
[4005007.800881] RDX: 0001 RSI:  RDI: 
9940656e
[4005007.800883] RBP: a82b46d27dd8 R08:  R09: 
994060c07980
[4005007.800886] R10: 0002 R11:  R12: 
7f5e06753000
[4005007.800888] R13: 9940656e R14: a82b46d27e68 R15: 
7f5e06753000
[4005007.800891] FS:  7f5e0755b740() GS:99479d30() 
knlGS:
[4005007.800895] CS:  0010 DS:  ES:  CR0: 80050033
[4005007.800898] CR2: ffd6 CR3: 0003253fc000 CR4: 
003506e0

Signed-off-by: Qu Huang 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 ++
 1 file changed, 6 insertions(+)

diff

[PATCH AUTOSEL 5.15 17/20] drm/amdkfd: Fix shift out-of-bounds issue

2023-11-07 Thread Sasha Levin

From: Jesse Zhang 

[ Upstream commit 282c1d793076c2edac6c3db51b7e8ed2b41d60a5 ]

[  567.613292] shift exponent 255 is too large for 64-bit type 'long unsigned 
int'
[  567.614498] CPU: 5 PID: 238 Comm: kworker/5:1 Tainted: G   OE  
6.2.0-34-generic #34~22.04.1-Ubuntu
[  567.614502] Hardware name: AMD Splinter/Splinter-RPL, BIOS WS43927N_871 
09/25/2023
[  567.614504] Workqueue: events send_exception_work_handler [amdgpu]
[  567.614748] Call Trace:
[  567.614750]  
[  567.614753]  dump_stack_lvl+0x48/0x70
[  567.614761]  dump_stack+0x10/0x20
[  567.614763]  __ubsan_handle_shift_out_of_bounds+0x156/0x310
[  567.614769]  ? srso_alias_return_thunk+0x5/0x7f
[  567.614773]  ? update_sd_lb_stats.constprop.0+0xf2/0x3c0
[  567.614780]  svm_range_split_by_granularity.cold+0x2b/0x34 [amdgpu]
[  567.615047]  ? srso_alias_return_thunk+0x5/0x7f
[  567.615052]  svm_migrate_to_ram+0x185/0x4d0 [amdgpu]
[  567.615286]  do_swap_page+0x7b6/0xa30
[  567.615291]  ? srso_alias_return_thunk+0x5/0x7f
[  567.615294]  ? __free_pages+0x119/0x130
[  567.615299]  handle_pte_fault+0x227/0x280
[  567.615303]  __handle_mm_fault+0x3c0/0x720
[  567.615311]  handle_mm_fault+0x119/0x330
[  567.615314]  ? lock_mm_and_find_vma+0x44/0x250
[  567.615318]  do_user_addr_fault+0x1a9/0x640
[  567.615323]  exc_page_fault+0x81/0x1b0
[  567.615328]  asm_exc_page_fault+0x27/0x30
[  567.615332] RIP: 0010:__get_user_8+0x1c/0x30

Signed-off-by: Jesse Zhang 
Suggested-by: Philip Yang 
Reviewed-by: Yifan Zhang 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c 
b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
index b7d32a5062b6c..53e413d9a3030 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -698,7 +698,7 @@ svm_range_apply_attrs(struct kfd_process *p, struct 
svm_range *prange,
prange->flags &= ~attrs[i].value;
break;
case KFD_IOCTL_SVM_ATTR_GRANULARITY:
-   prange->granularity = attrs[i].value;
+   prange->granularity = min_t(uint32_t, attrs[i].value, 
0x3F);
break;
default:
WARN_ONCE(1, "svm_range_check_attrs wasn't called?");
-- 
2.42.0

[PATCH AUTOSEL 5.15 15/20] drm/amdgpu/vkms: fix a possible null pointer dereference

2023-11-07 Thread Sasha Levin

From: Ma Ke 

[ Upstream commit cd90511557fdfb394bb4ac4c3b539b007383914c ]

In amdgpu_vkms_conn_get_modes(), the return value of drm_cvt_mode()
is assigned to mode, which will lead to a NULL pointer dereference
on failure of drm_cvt_mode(). Add a check to avoid null pointer
dereference.

Signed-off-by: Ma Ke 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c
index 4e8274de8fc0c..083f9c637a82e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c
@@ -238,6 +238,8 @@ static int amdgpu_vkms_conn_get_modes(struct drm_connector 
*connector)
 
for (i = 0; i < ARRAY_SIZE(common_modes); i++) {
mode = drm_cvt_mode(dev, common_modes[i].w, common_modes[i].h, 
60, false, false, false);
+   if (!mode)
+   continue;
drm_mode_probed_add(connector, mode);
}
 
-- 
2.42.0

[PATCH AUTOSEL 5.15 12/20] drm/amdgpu: Fix potential null pointer derefernce

2023-11-07 Thread Sasha Levin

From: "Stanley.Yang" 

[ Upstream commit 80285ae1ec8717b597b20de38866c29d84d321a1 ]

The amdgpu_ras_get_context may return NULL if device
not support ras feature, so add check before using.

Signed-off-by: Stanley.Yang 
Reviewed-by: Tao Zhou 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 2cf49a32ac6c3..e60130653c54e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -5097,7 +5097,8 @@ int amdgpu_device_gpu_recover(struct amdgpu_device *adev,
 * Flush RAM to disk so that after reboot
 * the user can read log and see why the system rebooted.
 */
-   if (need_emergency_restart && amdgpu_ras_get_context(adev)->reboot) {
+   if (need_emergency_restart && amdgpu_ras_get_context(adev) &&
+   amdgpu_ras_get_context(adev)->reboot) {
DRM_WARN("Emergency reboot.");
 
ksys_sync_helper();
-- 
2.42.0

[PATCH AUTOSEL 5.15 11/20] drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit 0f0e59075b5c22f1e871fbd508d6e4f495048356 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2036742
Signed-off-by: Mario Limonciello 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 .../gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h| 12 ++--
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h 
b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
index 41444e27bfc0c..e0e40b054c08b 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
@@ -164,7 +164,7 @@ typedef struct _ATOM_Tonga_State {
 typedef struct _ATOM_Tonga_State_Array {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number of entries. */
-   ATOM_Tonga_State entries[1];/* Dynamically allocate entries. */
+   ATOM_Tonga_State entries[]; /* Dynamically allocate entries. */
 } ATOM_Tonga_State_Array;
 
 typedef struct _ATOM_Tonga_MCLK_Dependency_Record {
@@ -210,7 +210,7 @@ typedef struct _ATOM_Polaris_SCLK_Dependency_Record {
 typedef struct _ATOM_Polaris_SCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Polaris_SCLK_Dependency_Record entries[1]; 
 /* Dynamically allocate entries. */
+   ATOM_Polaris_SCLK_Dependency_Record entries[];  
 /* Dynamically allocate entries. */
 } ATOM_Polaris_SCLK_Dependency_Table;
 
 typedef struct _ATOM_Tonga_PCIE_Record {
@@ -222,7 +222,7 @@ typedef struct _ATOM_Tonga_PCIE_Record {
 typedef struct _ATOM_Tonga_PCIE_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_PCIE_Record entries[1];  
/* Dynamically allocate entries. */
+   ATOM_Tonga_PCIE_Record entries[];   
/* Dynamically allocate entries. */
 } ATOM_Tonga_PCIE_Table;
 
 typedef struct _ATOM_Polaris10_PCIE_Record {
@@ -235,7 +235,7 @@ typedef struct _ATOM_Polaris10_PCIE_Record {
 typedef struct _ATOM_Polaris10_PCIE_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Polaris10_PCIE_Record entries[1];  /* 
Dynamically allocate entries. */
+   ATOM_Polaris10_PCIE_Record entries[];  /* 
Dynamically allocate entries. */
 } ATOM_Polaris10_PCIE_Table;
 
 
@@ -252,7 +252,7 @@ typedef struct _ATOM_Tonga_MM_Dependency_Record {
 typedef struct _ATOM_Tonga_MM_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_MM_Dependency_Record entries[1];/* 
Dynamically allocate entries. */
+   ATOM_Tonga_MM_Dependency_Record entries[]; /* 
Dynamically allocate entries. */
 } ATOM_Tonga_MM_Dependency_Table;
 
 typedef struct _ATOM_Tonga_Voltage_Lookup_Record {
@@ -265,7 +265,7 @@ typedef struct _ATOM_Tonga_Voltage_Lookup_Record {
 typedef struct _ATOM_Tonga_Voltage_Lookup_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_Voltage_Lookup_Record entries[1];
/* Dynamically allocate entries. */
+   ATOM_Tonga_Voltage_Lookup_Record entries[]; 
/* Dynamically allocate entries. */
 } ATOM_Tonga_Voltage_Lookup_Table;
 
 typedef struct _ATOM_Tonga_Fan_Table {
-- 
2.42.0

[PATCH AUTOSEL 5.15 10/20] drm/radeon: Fix UBSAN array-index-out-of-bounds for Radeon HD 5430

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit c63079c61177ba1b17fa05c6875699a36924fe39 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Suggested-by: Felix Held 
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2894
Signed-off-by: Mario Limonciello 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/radeon/pptable.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/radeon/pptable.h b/drivers/gpu/drm/radeon/pptable.h
index 4c2eec49dadc9..94947229888ba 100644
--- a/drivers/gpu/drm/radeon/pptable.h
+++ b/drivers/gpu/drm/radeon/pptable.h
@@ -74,7 +74,7 @@ typedef struct _ATOM_PPLIB_THERMALCONTROLLER
 typedef struct _ATOM_PPLIB_STATE
 {
 UCHAR ucNonClockStateIndex;
-UCHAR ucClockStateIndices[1]; // variable-sized
+UCHAR ucClockStateIndices[]; // variable-sized
 } ATOM_PPLIB_STATE;
 
 
-- 
2.42.0

[PATCH AUTOSEL 5.15 09/20] drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit 760efbca74a405dc439a013a5efaa9fadc95a8c3 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Suggested-by: Felix Held 
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2874
Signed-off-by: Mario Limonciello 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/include/pptable.h | 4 ++--
 drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/include/pptable.h 
b/drivers/gpu/drm/amd/include/pptable.h
index 0b6a057e0a4c4..5aac8d545bdc6 100644
--- a/drivers/gpu/drm/amd/include/pptable.h
+++ b/drivers/gpu/drm/amd/include/pptable.h
@@ -78,7 +78,7 @@ typedef struct _ATOM_PPLIB_THERMALCONTROLLER
 typedef struct _ATOM_PPLIB_STATE
 {
 UCHAR ucNonClockStateIndex;
-UCHAR ucClockStateIndices[1]; // variable-sized
+UCHAR ucClockStateIndices[]; // variable-sized
 } ATOM_PPLIB_STATE;
 
 
@@ -473,7 +473,7 @@ typedef struct _ATOM_PPLIB_STATE_V2
   /**
   * Driver will read the first ucNumDPMLevels in this array
   */
-  UCHAR clockInfoIndex[1];
+  UCHAR clockInfoIndex[];
 } ATOM_PPLIB_STATE_V2;
 
 typedef struct _StateArray{
diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h 
b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
index b0ac4d121adca..41444e27bfc0c 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
@@ -179,7 +179,7 @@ typedef struct _ATOM_Tonga_MCLK_Dependency_Record {
 typedef struct _ATOM_Tonga_MCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_MCLK_Dependency_Record entries[1];   
/* Dynamically allocate entries. */
+   ATOM_Tonga_MCLK_Dependency_Record entries[];
/* Dynamically allocate entries. */
 } ATOM_Tonga_MCLK_Dependency_Table;
 
 typedef struct _ATOM_Tonga_SCLK_Dependency_Record {
@@ -194,7 +194,7 @@ typedef struct _ATOM_Tonga_SCLK_Dependency_Record {
 typedef struct _ATOM_Tonga_SCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_SCLK_Dependency_Record entries[1];   
 /* Dynamically allocate entries. */
+   ATOM_Tonga_SCLK_Dependency_Record entries[];
 /* Dynamically allocate entries. */
 } ATOM_Tonga_SCLK_Dependency_Table;
 
 typedef struct _ATOM_Polaris_SCLK_Dependency_Record {
-- 
2.42.0

[PATCH AUTOSEL 5.15 03/20] drm/amd/display: use full update for clip size increase of large plane source

2023-11-07 Thread Sasha Levin

From: Wenjing Liu 

[ Upstream commit 05b78277ef0efc1deebc8a22384fffec29a3676e ]

[why]
Clip size increase will increase viewport, which could cause us to
switch  to MPC combine.
If we skip full update, we are not able to change to MPC combine in
fast update. This will cause corruption showing on the video plane.

[how]
treat clip size increase of a surface larger than 5k as a full update.

Reviewed-by: Jun Lei 
Acked-by: Aurabindo Pillai 
Signed-off-by: Wenjing Liu 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/display/dc/core/dc.c | 12 ++--
 drivers/gpu/drm/amd/display/dc/dc.h  |  5 +
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c 
b/drivers/gpu/drm/amd/display/dc/core/dc.c
index ffe7479a047d8..3919e75fec16d 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -886,7 +886,8 @@ static bool dc_construct(struct dc *dc,
/* set i2c speed if not done by the respective dcnxxx__resource.c */
if (dc->caps.i2c_speed_in_khz_hdcp == 0)
dc->caps.i2c_speed_in_khz_hdcp = dc->caps.i2c_speed_in_khz;
-
+   if (dc->caps.max_optimizable_video_width == 0)
+   dc->caps.max_optimizable_video_width = 5120;
dc->clk_mgr = dc_clk_mgr_create(dc->ctx, dc->res_pool->pp_smu, 
dc->res_pool->dccg);
if (!dc->clk_mgr)
goto fail;
@@ -2053,6 +2054,7 @@ static enum surface_update_type 
get_plane_info_update_type(const struct dc_surfa
 }
 
 static enum surface_update_type get_scaling_info_update_type(
+   const struct dc *dc,
const struct dc_surface_update *u)
 {
union surface_update_flags *update_flags = >surface->update_flags;
@@ -2087,6 +2089,12 @@ static enum surface_update_type 
get_scaling_info_update_type(
update_flags->bits.clock_change = 1;
}
 
+   if (u->scaling_info->src_rect.width > 
dc->caps.max_optimizable_video_width &&
+   (u->scaling_info->clip_rect.width > u->surface->clip_rect.width 
||
+u->scaling_info->clip_rect.height > 
u->surface->clip_rect.height))
+/* Changing clip size of a large surface may result in MPC 
slice count change */
+   update_flags->bits.bandwidth_change = 1;
+
if (u->scaling_info->src_rect.x != u->surface->src_rect.x
|| u->scaling_info->src_rect.y != u->surface->src_rect.y
|| u->scaling_info->clip_rect.x != 
u->surface->clip_rect.x
@@ -2124,7 +2132,7 @@ static enum surface_update_type det_surface_update(const 
struct dc *dc,
type = get_plane_info_update_type(u);
elevate_update_type(_type, type);
 
-   type = get_scaling_info_update_type(u);
+   type = get_scaling_info_update_type(dc, u);
elevate_update_type(_type, type);
 
if (u->flip_addr)
diff --git a/drivers/gpu/drm/amd/display/dc/dc.h 
b/drivers/gpu/drm/amd/display/dc/dc.h
index e0f58fab5e8ed..09a8726c26399 100644
--- a/drivers/gpu/drm/amd/display/dc/dc.h
+++ b/drivers/gpu/drm/amd/display/dc/dc.h
@@ -164,6 +164,11 @@ struct dc_caps {
uint32_t dmdata_alloc_size;
unsigned int max_cursor_size;
unsigned int max_video_width;
+   /*
+* max video plane width that can be safely assumed to be always
+* supported by single DPP pipe.
+*/
+   unsigned int max_optimizable_video_width;
unsigned int min_horizontal_blanking_period;
int linear_pitch_alignment;
bool dcc_const_color;
-- 
2.42.0

[PATCH AUTOSEL 5.15 02/20] drm/amdkfd: Fix a race condition of vram buffer unref in svm code

2023-11-07 Thread Sasha Levin

From: Xiaogang Chen 

[ Upstream commit 709c348261618da7ed89d6c303e2ceb9e453ba74 ]

prange->svm_bo unref can happen in both mmu callback and a callback after
migrate to system ram. Both are async call in different tasks. Sync svm_bo
unref operation to avoid random "use-after-free".

Signed-off-by: Xiaogang Chen 
Reviewed-by: Philip Yang 
Reviewed-by: Jesse Zhang 
Tested-by: Jesse Zhang 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 11 +--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c 
b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
index 22a70aaccf13c..b7d32a5062b6c 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -550,8 +550,15 @@ svm_range_vram_node_new(struct amdgpu_device *adev, struct 
svm_range *prange,
 
 void svm_range_vram_node_free(struct svm_range *prange)
 {
-   svm_range_bo_unref(prange->svm_bo);
-   prange->ttm_res = NULL;
+   /* serialize prange->svm_bo unref */
+   mutex_lock(>lock);
+   /* prange->svm_bo has not been unref */
+   if (prange->ttm_res) {
+   prange->ttm_res = NULL;
+   mutex_unlock(>lock);
+   svm_range_bo_unref(prange->svm_bo);
+   } else
+   mutex_unlock(>lock);
 }
 
 struct amdgpu_device *
-- 
2.42.0

[PATCH AUTOSEL 6.1 23/25] drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL

2023-11-07 Thread Sasha Levin

From: Qu Huang 

[ Upstream commit 5104fdf50d326db2c1a994f8b35dcd46e63ae4ad ]

In certain types of chips, such as VEGA20, reading the amdgpu_regs_smc file 
could result in an abnormal null pointer access when the smc_rreg pointer is 
NULL. Below are the steps to reproduce this issue and the corresponding 
exception log:

1. Navigate to the directory: /sys/kernel/debug/dri/0
2. Execute command: cat amdgpu_regs_smc
3. Exception Log::
[4005007.702554] BUG: kernel NULL pointer dereference, address: 
[4005007.702562] #PF: supervisor instruction fetch in kernel mode
[4005007.702567] #PF: error_code(0x0010) - not-present page
[4005007.702570] PGD 0 P4D 0
[4005007.702576] Oops: 0010 [#1] SMP NOPTI
[4005007.702581] CPU: 4 PID: 62563 Comm: cat Tainted: G   OE 
5.15.0-43-generic #46-Ubunt   u
[4005007.702590] RIP: 0010:0x0
[4005007.702598] Code: Unable to access opcode bytes at RIP 0xffd6.
[4005007.702600] RSP: 0018:a82b46d27da0 EFLAGS: 00010206
[4005007.702605] RAX:  RBX:  RCX: 
a82b46d27e68
[4005007.702609] RDX: 0001 RSI:  RDI: 
9940656e
[4005007.702612] RBP: a82b46d27dd8 R08:  R09: 
994060c07980
[4005007.702615] R10: 0002 R11:  R12: 
7f5e06753000
[4005007.702618] R13: 9940656e R14: a82b46d27e68 R15: 
7f5e06753000
[4005007.702622] FS:  7f5e0755b740() GS:99479d30() 
knlGS:
[4005007.702626] CS:  0010 DS:  ES:  CR0: 80050033
[4005007.702629] CR2: ffd6 CR3: 0003253fc000 CR4: 
003506e0
[4005007.702633] Call Trace:
[4005007.702636]  
[4005007.702640]  amdgpu_debugfs_regs_smc_read+0xb0/0x120 [amdgpu]
[4005007.703002]  full_proxy_read+0x5c/0x80
[4005007.703011]  vfs_read+0x9f/0x1a0
[4005007.703019]  ksys_read+0x67/0xe0
[4005007.703023]  __x64_sys_read+0x19/0x20
[4005007.703028]  do_syscall_64+0x5c/0xc0
[4005007.703034]  ? do_user_addr_fault+0x1e3/0x670
[4005007.703040]  ? exit_to_user_mode_prepare+0x37/0xb0
[4005007.703047]  ? irqentry_exit_to_user_mode+0x9/0x20
[4005007.703052]  ? irqentry_exit+0x19/0x30
[4005007.703057]  ? exc_page_fault+0x89/0x160
[4005007.703062]  ? asm_exc_page_fault+0x8/0x30
[4005007.703068]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[4005007.703075] RIP: 0033:0x7f5e07672992
[4005007.703079] Code: c0 e9 b2 fe ff ff 50 48 8d 3d fa b2 0c 00 e8 c5 1d 02 00 
0f 1f 44 00 00 f3 0f1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 
<48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 e   c 28 48 89 54 24
[4005007.703083] RSP: 002b:7ffe03097898 EFLAGS: 0246 ORIG_RAX: 

[4005007.703088] RAX: ffda RBX: 0002 RCX: 
7f5e07672992
[4005007.703091] RDX: 0002 RSI: 7f5e06753000 RDI: 
0003
[4005007.703094] RBP: 7f5e06753000 R08: 7f5e06752010 R09: 
7f5e06752010
[4005007.703096] R10: 0022 R11: 0246 R12: 
00022000
[4005007.703099] R13: 0003 R14: 0002 R15: 
0002
[4005007.703105]  
[4005007.703107] Modules linked in: nf_tables libcrc32c nfnetlink algif_hash 
af_alg binfmt_misc nls_   iso8859_1 ipmi_ssif ast intel_rapl_msr 
intel_rapl_common drm_vram_helper drm_ttm_helper amd64_edac t   tm 
edac_mce_amd kvm_amd ccp mac_hid k10temp kvm acpi_ipmi ipmi_si rapl 
sch_fq_codel ipmi_devintf ipm   i_msghandler msr parport_pc ppdev lp 
parport mtd pstore_blk efi_pstore ramoops pstore_zone reed_solo   mon 
ip_tables x_tables autofs4 ib_uverbs ib_core amdgpu(OE) amddrm_ttm_helper(OE) 
amdttm(OE) iommu_v   2 amd_sched(OE) amdkcl(OE) drm_kms_helper syscopyarea 
sysfillrect sysimgblt fb_sys_fops cec rc_coredrm igb ahci xhci_pci 
libahci i2c_piix4 i2c_algo_bit xhci_pci_renesas dca
[4005007.703184] CR2: 
[4005007.703188] ---[ end trace ac65a538d240da39 ]---
[4005007.800865] RIP: 0010:0x0
[4005007.800871] Code: Unable to access opcode bytes at RIP 0xffd6.
[4005007.800874] RSP: 0018:a82b46d27da0 EFLAGS: 00010206
[4005007.800878] RAX:  RBX:  RCX: 
a82b46d27e68
[4005007.800881] RDX: 0001 RSI:  RDI: 
9940656e
[4005007.800883] RBP: a82b46d27dd8 R08:  R09: 
994060c07980
[4005007.800886] R10: 0002 R11:  R12: 
7f5e06753000
[4005007.800888] R13: 9940656e R14: a82b46d27e68 R15: 
7f5e06753000
[4005007.800891] FS:  7f5e0755b740() GS:99479d30() 
knlGS:
[4005007.800895] CS:  0010 DS:  ES:  CR0: 80050033
[4005007.800898] CR2: ffd6 CR3: 0003253fc000 CR4: 
003506e0

Signed-off-by: Qu Huang 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 ++
 1 file changed, 6 insertions(+)

diff

[PATCH AUTOSEL 6.1 22/25] drm/amdkfd: Fix shift out-of-bounds issue

2023-11-07 Thread Sasha Levin

From: Jesse Zhang 

[ Upstream commit 282c1d793076c2edac6c3db51b7e8ed2b41d60a5 ]

[  567.613292] shift exponent 255 is too large for 64-bit type 'long unsigned 
int'
[  567.614498] CPU: 5 PID: 238 Comm: kworker/5:1 Tainted: G   OE  
6.2.0-34-generic #34~22.04.1-Ubuntu
[  567.614502] Hardware name: AMD Splinter/Splinter-RPL, BIOS WS43927N_871 
09/25/2023
[  567.614504] Workqueue: events send_exception_work_handler [amdgpu]
[  567.614748] Call Trace:
[  567.614750]  
[  567.614753]  dump_stack_lvl+0x48/0x70
[  567.614761]  dump_stack+0x10/0x20
[  567.614763]  __ubsan_handle_shift_out_of_bounds+0x156/0x310
[  567.614769]  ? srso_alias_return_thunk+0x5/0x7f
[  567.614773]  ? update_sd_lb_stats.constprop.0+0xf2/0x3c0
[  567.614780]  svm_range_split_by_granularity.cold+0x2b/0x34 [amdgpu]
[  567.615047]  ? srso_alias_return_thunk+0x5/0x7f
[  567.615052]  svm_migrate_to_ram+0x185/0x4d0 [amdgpu]
[  567.615286]  do_swap_page+0x7b6/0xa30
[  567.615291]  ? srso_alias_return_thunk+0x5/0x7f
[  567.615294]  ? __free_pages+0x119/0x130
[  567.615299]  handle_pte_fault+0x227/0x280
[  567.615303]  __handle_mm_fault+0x3c0/0x720
[  567.615311]  handle_mm_fault+0x119/0x330
[  567.615314]  ? lock_mm_and_find_vma+0x44/0x250
[  567.615318]  do_user_addr_fault+0x1a9/0x640
[  567.615323]  exc_page_fault+0x81/0x1b0
[  567.615328]  asm_exc_page_fault+0x27/0x30
[  567.615332] RIP: 0010:__get_user_8+0x1c/0x30

Signed-off-by: Jesse Zhang 
Suggested-by: Philip Yang 
Reviewed-by: Yifan Zhang 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c 
b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
index 86a6d6143f008..c23c7176c6b3d 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -764,7 +764,7 @@ svm_range_apply_attrs(struct kfd_process *p, struct 
svm_range *prange,
prange->flags &= ~attrs[i].value;
break;
case KFD_IOCTL_SVM_ATTR_GRANULARITY:
-   prange->granularity = attrs[i].value;
+   prange->granularity = min_t(uint32_t, attrs[i].value, 
0x3F);
break;
default:
WARN_ONCE(1, "svm_range_check_attrs wasn't called?");
-- 
2.42.0

[PATCH AUTOSEL 6.1 20/25] drm/amdgpu/vkms: fix a possible null pointer dereference

2023-11-07 Thread Sasha Levin

From: Ma Ke 

[ Upstream commit cd90511557fdfb394bb4ac4c3b539b007383914c ]

In amdgpu_vkms_conn_get_modes(), the return value of drm_cvt_mode()
is assigned to mode, which will lead to a NULL pointer dereference
on failure of drm_cvt_mode(). Add a check to avoid null pointer
dereference.

Signed-off-by: Ma Ke 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c
index d60c4a2eeb0c5..06980b8527ff8 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c
@@ -239,6 +239,8 @@ static int amdgpu_vkms_conn_get_modes(struct drm_connector 
*connector)
 
for (i = 0; i < ARRAY_SIZE(common_modes); i++) {
mode = drm_cvt_mode(dev, common_modes[i].w, common_modes[i].h, 
60, false, false, false);
+   if (!mode)
+   continue;
drm_mode_probed_add(connector, mode);
}
 
-- 
2.42.0

[PATCH AUTOSEL 6.1 19/25] drm/radeon: fix a possible null pointer dereference

2023-11-07 Thread Sasha Levin

From: Ma Ke 

[ Upstream commit 2c1fe3c480f9e1deefd50d4b18be4a046011ee1f ]

In radeon_tv_get_modes(), the return value of drm_cvt_mode()
is assigned to mode, which will lead to a NULL pointer
dereference on failure of drm_cvt_mode(). Add a check to
avoid null point dereference.

Signed-off-by: Ma Ke 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/radeon/radeon_connectors.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c 
b/drivers/gpu/drm/radeon/radeon_connectors.c
index f7431d2246044..5837af5123a9f 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1122,6 +1122,8 @@ static int radeon_tv_get_modes(struct drm_connector 
*connector)
else {
/* only 800x600 is supported right now on pre-avivo chips */
tv_mode = drm_cvt_mode(dev, 800, 600, 60, false, false, false);
+   if (!tv_mode)
+   return 0;
tv_mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
drm_mode_probed_add(connector, tv_mode);
}
-- 
2.42.0

[PATCH AUTOSEL 6.1 16/25] drm/amdgpu: Fix potential null pointer derefernce

2023-11-07 Thread Sasha Levin

From: "Stanley.Yang" 

[ Upstream commit 80285ae1ec8717b597b20de38866c29d84d321a1 ]

The amdgpu_ras_get_context may return NULL if device
not support ras feature, so add check before using.

Signed-off-by: Stanley.Yang 
Reviewed-by: Tao Zhou 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 92fa2faf63e41..dc61cc1659326 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -5330,7 +5330,8 @@ int amdgpu_device_gpu_recover(struct amdgpu_device *adev,
 * Flush RAM to disk so that after reboot
 * the user can read log and see why the system rebooted.
 */
-   if (need_emergency_restart && amdgpu_ras_get_context(adev)->reboot) {
+   if (need_emergency_restart && amdgpu_ras_get_context(adev) &&
+   amdgpu_ras_get_context(adev)->reboot) {
DRM_WARN("Emergency reboot.");
 
ksys_sync_helper();
-- 
2.42.0

[PATCH AUTOSEL 6.1 15/25] drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit 0f0e59075b5c22f1e871fbd508d6e4f495048356 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2036742
Signed-off-by: Mario Limonciello 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 .../gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h| 12 ++--
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h 
b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
index 41444e27bfc0c..e0e40b054c08b 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
@@ -164,7 +164,7 @@ typedef struct _ATOM_Tonga_State {
 typedef struct _ATOM_Tonga_State_Array {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number of entries. */
-   ATOM_Tonga_State entries[1];/* Dynamically allocate entries. */
+   ATOM_Tonga_State entries[]; /* Dynamically allocate entries. */
 } ATOM_Tonga_State_Array;
 
 typedef struct _ATOM_Tonga_MCLK_Dependency_Record {
@@ -210,7 +210,7 @@ typedef struct _ATOM_Polaris_SCLK_Dependency_Record {
 typedef struct _ATOM_Polaris_SCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Polaris_SCLK_Dependency_Record entries[1]; 
 /* Dynamically allocate entries. */
+   ATOM_Polaris_SCLK_Dependency_Record entries[];  
 /* Dynamically allocate entries. */
 } ATOM_Polaris_SCLK_Dependency_Table;
 
 typedef struct _ATOM_Tonga_PCIE_Record {
@@ -222,7 +222,7 @@ typedef struct _ATOM_Tonga_PCIE_Record {
 typedef struct _ATOM_Tonga_PCIE_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_PCIE_Record entries[1];  
/* Dynamically allocate entries. */
+   ATOM_Tonga_PCIE_Record entries[];   
/* Dynamically allocate entries. */
 } ATOM_Tonga_PCIE_Table;
 
 typedef struct _ATOM_Polaris10_PCIE_Record {
@@ -235,7 +235,7 @@ typedef struct _ATOM_Polaris10_PCIE_Record {
 typedef struct _ATOM_Polaris10_PCIE_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Polaris10_PCIE_Record entries[1];  /* 
Dynamically allocate entries. */
+   ATOM_Polaris10_PCIE_Record entries[];  /* 
Dynamically allocate entries. */
 } ATOM_Polaris10_PCIE_Table;
 
 
@@ -252,7 +252,7 @@ typedef struct _ATOM_Tonga_MM_Dependency_Record {
 typedef struct _ATOM_Tonga_MM_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_MM_Dependency_Record entries[1];/* 
Dynamically allocate entries. */
+   ATOM_Tonga_MM_Dependency_Record entries[]; /* 
Dynamically allocate entries. */
 } ATOM_Tonga_MM_Dependency_Table;
 
 typedef struct _ATOM_Tonga_Voltage_Lookup_Record {
@@ -265,7 +265,7 @@ typedef struct _ATOM_Tonga_Voltage_Lookup_Record {
 typedef struct _ATOM_Tonga_Voltage_Lookup_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_Voltage_Lookup_Record entries[1];
/* Dynamically allocate entries. */
+   ATOM_Tonga_Voltage_Lookup_Record entries[]; 
/* Dynamically allocate entries. */
 } ATOM_Tonga_Voltage_Lookup_Table;
 
 typedef struct _ATOM_Tonga_Fan_Table {
-- 
2.42.0

[PATCH AUTOSEL 6.1 13/25] drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit 760efbca74a405dc439a013a5efaa9fadc95a8c3 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Suggested-by: Felix Held 
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2874
Signed-off-by: Mario Limonciello 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/include/pptable.h | 4 ++--
 drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/include/pptable.h 
b/drivers/gpu/drm/amd/include/pptable.h
index 0b6a057e0a4c4..5aac8d545bdc6 100644
--- a/drivers/gpu/drm/amd/include/pptable.h
+++ b/drivers/gpu/drm/amd/include/pptable.h
@@ -78,7 +78,7 @@ typedef struct _ATOM_PPLIB_THERMALCONTROLLER
 typedef struct _ATOM_PPLIB_STATE
 {
 UCHAR ucNonClockStateIndex;
-UCHAR ucClockStateIndices[1]; // variable-sized
+UCHAR ucClockStateIndices[]; // variable-sized
 } ATOM_PPLIB_STATE;
 
 
@@ -473,7 +473,7 @@ typedef struct _ATOM_PPLIB_STATE_V2
   /**
   * Driver will read the first ucNumDPMLevels in this array
   */
-  UCHAR clockInfoIndex[1];
+  UCHAR clockInfoIndex[];
 } ATOM_PPLIB_STATE_V2;
 
 typedef struct _StateArray{
diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h 
b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
index b0ac4d121adca..41444e27bfc0c 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
@@ -179,7 +179,7 @@ typedef struct _ATOM_Tonga_MCLK_Dependency_Record {
 typedef struct _ATOM_Tonga_MCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_MCLK_Dependency_Record entries[1];   
/* Dynamically allocate entries. */
+   ATOM_Tonga_MCLK_Dependency_Record entries[];
/* Dynamically allocate entries. */
 } ATOM_Tonga_MCLK_Dependency_Table;
 
 typedef struct _ATOM_Tonga_SCLK_Dependency_Record {
@@ -194,7 +194,7 @@ typedef struct _ATOM_Tonga_SCLK_Dependency_Record {
 typedef struct _ATOM_Tonga_SCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_SCLK_Dependency_Record entries[1];   
 /* Dynamically allocate entries. */
+   ATOM_Tonga_SCLK_Dependency_Record entries[];
 /* Dynamically allocate entries. */
 } ATOM_Tonga_SCLK_Dependency_Table;
 
 typedef struct _ATOM_Polaris_SCLK_Dependency_Record {
-- 
2.42.0

[PATCH AUTOSEL 6.1 14/25] drm/radeon: Fix UBSAN array-index-out-of-bounds for Radeon HD 5430

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit c63079c61177ba1b17fa05c6875699a36924fe39 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Suggested-by: Felix Held 
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2894
Signed-off-by: Mario Limonciello 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/radeon/pptable.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/radeon/pptable.h b/drivers/gpu/drm/radeon/pptable.h
index 4c2eec49dadc9..94947229888ba 100644
--- a/drivers/gpu/drm/radeon/pptable.h
+++ b/drivers/gpu/drm/radeon/pptable.h
@@ -74,7 +74,7 @@ typedef struct _ATOM_PPLIB_THERMALCONTROLLER
 typedef struct _ATOM_PPLIB_STATE
 {
 UCHAR ucNonClockStateIndex;
-UCHAR ucClockStateIndices[1]; // variable-sized
+UCHAR ucClockStateIndices[]; // variable-sized
 } ATOM_PPLIB_STATE;
 
 
-- 
2.42.0

[PATCH AUTOSEL 6.1 06/25] drm/amd/display: use full update for clip size increase of large plane source

2023-11-07 Thread Sasha Levin

From: Wenjing Liu 

[ Upstream commit 05b78277ef0efc1deebc8a22384fffec29a3676e ]

[why]
Clip size increase will increase viewport, which could cause us to
switch  to MPC combine.
If we skip full update, we are not able to change to MPC combine in
fast update. This will cause corruption showing on the video plane.

[how]
treat clip size increase of a surface larger than 5k as a full update.

Reviewed-by: Jun Lei 
Acked-by: Aurabindo Pillai 
Signed-off-by: Wenjing Liu 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/display/dc/core/dc.c | 12 ++--
 drivers/gpu/drm/amd/display/dc/dc.h  |  5 +
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c 
b/drivers/gpu/drm/amd/display/dc/core/dc.c
index 15d3caf3d6d72..9d321f4f486e2 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -996,7 +996,8 @@ static bool dc_construct(struct dc *dc,
/* set i2c speed if not done by the respective dcnxxx__resource.c */
if (dc->caps.i2c_speed_in_khz_hdcp == 0)
dc->caps.i2c_speed_in_khz_hdcp = dc->caps.i2c_speed_in_khz;
-
+   if (dc->caps.max_optimizable_video_width == 0)
+   dc->caps.max_optimizable_video_width = 5120;
dc->clk_mgr = dc_clk_mgr_create(dc->ctx, dc->res_pool->pp_smu, 
dc->res_pool->dccg);
if (!dc->clk_mgr)
goto fail;
@@ -2438,6 +2439,7 @@ static enum surface_update_type 
get_plane_info_update_type(const struct dc_surfa
 }
 
 static enum surface_update_type get_scaling_info_update_type(
+   const struct dc *dc,
const struct dc_surface_update *u)
 {
union surface_update_flags *update_flags = >surface->update_flags;
@@ -2472,6 +2474,12 @@ static enum surface_update_type 
get_scaling_info_update_type(
update_flags->bits.clock_change = 1;
}
 
+   if (u->scaling_info->src_rect.width > 
dc->caps.max_optimizable_video_width &&
+   (u->scaling_info->clip_rect.width > u->surface->clip_rect.width 
||
+u->scaling_info->clip_rect.height > 
u->surface->clip_rect.height))
+/* Changing clip size of a large surface may result in MPC 
slice count change */
+   update_flags->bits.bandwidth_change = 1;
+
if (u->scaling_info->src_rect.x != u->surface->src_rect.x
|| u->scaling_info->src_rect.y != u->surface->src_rect.y
|| u->scaling_info->clip_rect.x != 
u->surface->clip_rect.x
@@ -2509,7 +2517,7 @@ static enum surface_update_type det_surface_update(const 
struct dc *dc,
type = get_plane_info_update_type(u);
elevate_update_type(_type, type);
 
-   type = get_scaling_info_update_type(u);
+   type = get_scaling_info_update_type(dc, u);
elevate_update_type(_type, type);
 
if (u->flip_addr) {
diff --git a/drivers/gpu/drm/amd/display/dc/dc.h 
b/drivers/gpu/drm/amd/display/dc/dc.h
index a4540f83aae59..f773a467fef54 100644
--- a/drivers/gpu/drm/amd/display/dc/dc.h
+++ b/drivers/gpu/drm/amd/display/dc/dc.h
@@ -230,6 +230,11 @@ struct dc_caps {
uint32_t dmdata_alloc_size;
unsigned int max_cursor_size;
unsigned int max_video_width;
+   /*
+* max video plane width that can be safely assumed to be always
+* supported by single DPP pipe.
+*/
+   unsigned int max_optimizable_video_width;
unsigned int min_horizontal_blanking_period;
int linear_pitch_alignment;
bool dcc_const_color;
-- 
2.42.0

[PATCH AUTOSEL 6.1 05/25] drm/amd: Update `update_pcie_parameters` functions to use uint8_t arguments

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit 7752ccf85b929a22e658ec145283e8f31232f4bb ]

The matching values for `pcie_gen_cap` and `pcie_width_cap` when
fetched from powerplay tables are 1 byte, so narrow the arguments
to match to ensure min() and max() comparisons without casts.

Signed-off-by: Mario Limonciello 
Acked-by: Christian König 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c   | 2 +-
 drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h   | 2 +-
 drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h| 4 ++--
 drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 4 ++--
 drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 8 
 drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c  | 4 ++--
 6 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c 
b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
index a664a0a284784..47ff3694ffa57 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
@@ -1221,7 +1221,7 @@ static int smu_smc_hw_setup(struct smu_context *smu)
 {
struct smu_feature *feature = >smu_feature;
struct amdgpu_device *adev = smu->adev;
-   uint32_t pcie_gen = 0, pcie_width = 0;
+   uint8_t pcie_gen = 0, pcie_width = 0;
uint64_t features_supported;
int ret = 0;
 
diff --git a/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h 
b/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h
index 1ab77a6cdb653..4174cb295dd0b 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h
+++ b/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h
@@ -844,7 +844,7 @@ struct pptable_funcs {
 * _gen_cap: Maximum allowed PCIe generation.
 * _width_cap: Maximum allowed PCIe width.
 */
-   int (*update_pcie_parameters)(struct smu_context *smu, uint32_t 
pcie_gen_cap, uint32_t pcie_width_cap);
+   int (*update_pcie_parameters)(struct smu_context *smu, uint8_t 
pcie_gen_cap, uint8_t pcie_width_cap);
 
/**
 * @i2c_init: Initialize i2c.
diff --git a/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h 
b/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h
index d6479a8088554..636b9579b96b0 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h
+++ b/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h
@@ -298,8 +298,8 @@ int smu_v13_0_get_pptable_from_firmware(struct smu_context 
*smu,
uint32_t pptable_id);
 
 int smu_v13_0_update_pcie_parameters(struct smu_context *smu,
-uint32_t pcie_gen_cap,
-uint32_t pcie_width_cap);
+uint8_t pcie_gen_cap,
+uint8_t pcie_width_cap);
 
 #endif
 #endif
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c 
b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c
index ca278280865fa..ed2112efc6c68 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c
@@ -2368,8 +2368,8 @@ static int navi10_get_power_limit(struct smu_context *smu,
 }
 
 static int navi10_update_pcie_parameters(struct smu_context *smu,
-uint32_t pcie_gen_cap,
-uint32_t pcie_width_cap)
+uint8_t pcie_gen_cap,
+uint8_t pcie_width_cap)
 {
struct smu_11_0_dpm_context *dpm_context = smu->smu_dpm.dpm_context;
PPTable_t *pptable = smu->smu_table.driver_pptable;
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c 
b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
index fbc4d706748b7..cfd41d56e9701 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
@@ -2084,14 +2084,14 @@ static int 
sienna_cichlid_display_disable_memory_clock_switch(struct smu_context
 #define MAX(a, b)  ((a) > (b) ? (a) : (b))
 
 static int sienna_cichlid_update_pcie_parameters(struct smu_context *smu,
-uint32_t pcie_gen_cap,
-uint32_t pcie_width_cap)
+uint8_t pcie_gen_cap,
+uint8_t pcie_width_cap)
 {
struct smu_11_0_dpm_context *dpm_context = smu->smu_dpm.dpm_context;
struct smu_11_0_pcie_table *pcie_table = 
_context->dpm_tables.pcie_table;
uint8_t *table_member1, *table_member2;
-   uint32_t min_gen_speed, max_gen_speed;
-   uint32_t min_lane_width, max_lane_width;
+   uint8_t min_gen_speed, max_gen_speed;
+   uint8_t min_lane_width, max_lane_width;
uint32_t smu_pcie_arg;
int ret, i;
 
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c 
b/drivers/gpu/d

[PATCH AUTOSEL 6.1 04/25] drm/amdkfd: Fix a race condition of vram buffer unref in svm code

2023-11-07 Thread Sasha Levin

From: Xiaogang Chen 

[ Upstream commit 709c348261618da7ed89d6c303e2ceb9e453ba74 ]

prange->svm_bo unref can happen in both mmu callback and a callback after
migrate to system ram. Both are async call in different tasks. Sync svm_bo
unref operation to avoid random "use-after-free".

Signed-off-by: Xiaogang Chen 
Reviewed-by: Philip Yang 
Reviewed-by: Jesse Zhang 
Tested-by: Jesse Zhang 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 11 +--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c 
b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
index 63feea08904cb..86a6d6143f008 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -612,8 +612,15 @@ svm_range_vram_node_new(struct amdgpu_device *adev, struct 
svm_range *prange,
 
 void svm_range_vram_node_free(struct svm_range *prange)
 {
-   svm_range_bo_unref(prange->svm_bo);
-   prange->ttm_res = NULL;
+   /* serialize prange->svm_bo unref */
+   mutex_lock(>lock);
+   /* prange->svm_bo has not been unref */
+   if (prange->ttm_res) {
+   prange->ttm_res = NULL;
+   mutex_unlock(>lock);
+   svm_range_bo_unref(prange->svm_bo);
+   } else
+   mutex_unlock(>lock);
 }
 
 struct amdgpu_device *
-- 
2.42.0

[PATCH AUTOSEL 6.1 03/25] drm/amdgpu: not to save bo in the case of RAS err_event_athub

2023-11-07 Thread Sasha Levin

From: "David (Ming Qiang) Wu" 

[ Upstream commit fa1f1cc09d588a90c8ce3f507c47df257461d148 ]

err_event_athub will corrupt VCPU buffer and not good to
be restored in amdgpu_vcn_resume() and in this case
the VCPU buffer needs to be cleared for VCN firmware to
work properly.

Acked-by: Leo Liu 
Signed-off-by: David (Ming Qiang) Wu 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 7 +++
 1 file changed, 7 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
index 5c1193dd7d88c..48e612023d0c7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
@@ -391,8 +391,15 @@ int amdgpu_vcn_suspend(struct amdgpu_device *adev)
void *ptr;
int i, idx;
 
+   bool in_ras_intr = amdgpu_ras_intr_triggered();
+
cancel_delayed_work_sync(>vcn.idle_work);
 
+   /* err_event_athub will corrupt VCPU buffer, so we need to
+* restore fw data and clear buffer in amdgpu_vcn_resume() */
+   if (in_ras_intr)
+   return 0;
+
for (i = 0; i < adev->vcn.num_vcn_inst; ++i) {
if (adev->vcn.harvest_config & (1 << i))
continue;
-- 
2.42.0

[PATCH AUTOSEL 6.5 32/37] drm/amd: check num of link levels when update pcie param

2023-11-07 Thread Sasha Levin

From: "Lin.Cao" 

[ Upstream commit 406e8845356d18bdf3d3a23b347faf67706472ec ]

In SR-IOV environment, the value of pcie_table->num_of_link_levels will
be 0, and num_of_levels - 1 will cause array index out of bounds

Signed-off-by: Lin.Cao 
Acked-by: Jingwen Chen 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c 
b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
index 223e890575a2b..3bc60ecc7bfef 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
@@ -2436,6 +2436,9 @@ int smu_v13_0_update_pcie_parameters(struct smu_context 
*smu,
uint32_t smu_pcie_arg;
int ret, i;
 
+   if (!num_of_levels)
+   return 0;
+
if (!(smu->adev->pm.pp_feature & PP_PCIE_DPM_MASK)) {
if (pcie_table->pcie_gen[num_of_levels - 1] < pcie_gen_cap)
pcie_gen_cap = pcie_table->pcie_gen[num_of_levels - 1];
-- 
2.42.0

[PATCH AUTOSEL 6.5 31/37] drm/amd/display: fix num_ways overflow error

2023-11-07 Thread Sasha Levin

From: Samson Tam 

[ Upstream commit 79f3f1b66753b3a3a269d73676bf50987921f267 ]

[Why]
Helper function calculates num_ways using 32-bit.  But is
 returned as 8-bit.  If num_ways exceeds 8-bit, then it
 reports back the incorrect num_ways and erroneously
 uses MALL when it should not

[How]
Make returned value 32-bit and convert after it checks
 against caps.cache_num_ways, which is under 8-bit

Reviewed-by: Alvin Lee 
Acked-by: Roman Li 
Signed-off-by: Samson Tam 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c | 7 ---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c 
b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c
index 5b3d0e5b90a3e..ccbcfd6bd6b85 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c
@@ -216,7 +216,7 @@ static bool dcn32_check_no_memory_request_for_cab(struct dc 
*dc)
 static uint32_t dcn32_calculate_cab_allocation(struct dc *dc, struct dc_state 
*ctx)
 {
int i;
-   uint8_t num_ways = 0;
+   uint32_t num_ways = 0;
uint32_t mall_ss_size_bytes = 0;
 
mall_ss_size_bytes = ctx->bw_ctx.bw.dcn.mall_ss_size_bytes;
@@ -246,7 +246,8 @@ static uint32_t dcn32_calculate_cab_allocation(struct dc 
*dc, struct dc_state *c
 bool dcn32_apply_idle_power_optimizations(struct dc *dc, bool enable)
 {
union dmub_rb_cmd cmd;
-   uint8_t ways, i;
+   uint8_t i;
+   uint32_t ways;
int j;
bool mall_ss_unsupported = false;
struct dc_plane_state *plane = NULL;
@@ -306,7 +307,7 @@ bool dcn32_apply_idle_power_optimizations(struct dc *dc, 
bool enable)
cmd.cab.header.type = DMUB_CMD__CAB_FOR_SS;
cmd.cab.header.sub_type = 
DMUB_CMD__CAB_DCN_SS_FIT_IN_CAB;
cmd.cab.header.payload_bytes = sizeof(cmd.cab) 
- sizeof(cmd.cab.header);
-   cmd.cab.cab_alloc_ways = ways;
+   cmd.cab.cab_alloc_ways = (uint8_t)ways;
 
dm_execute_dmub_cmd(dc->ctx, , 
DM_DMUB_WAIT_TYPE_NO_WAIT);
 
-- 
2.42.0

[PATCH AUTOSEL 6.5 30/37] drm/amd: Disable PP_PCIE_DPM_MASK when dynamic speed switching not supported

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit fbf1035b033a51eee48d5f42e781b02fff272ca0 ]

Rather than individual ASICs checking for the quirk, set the quirk at the
driver level.

Signed-off-by: Mario Limonciello 
Reviewed-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c  | 2 ++
 drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 4 +---
 drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 2 +-
 drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c  | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index ecc61a6d13e13..65779cbdbad13 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -2318,6 +2318,8 @@ static int amdgpu_device_ip_early_init(struct 
amdgpu_device *adev)
adev->pm.pp_feature &= ~PP_GFXOFF_MASK;
if (amdgpu_sriov_vf(adev) && adev->asic_type == CHIP_SIENNA_CICHLID)
adev->pm.pp_feature &= ~PP_OVERDRIVE_MASK;
+   if (!amdgpu_device_pcie_dynamic_switching_supported())
+   adev->pm.pp_feature &= ~PP_PCIE_DPM_MASK;
 
total = true;
for (i = 0; i < adev->num_ip_blocks; i++) {
diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c 
b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
index 1cb4022644977..a3176805d 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
@@ -1823,9 +1823,7 @@ static void smu7_init_dpm_defaults(struct pp_hwmgr *hwmgr)
 
data->mclk_dpm_key_disabled = hwmgr->feature_mask & PP_MCLK_DPM_MASK ? 
false : true;
data->sclk_dpm_key_disabled = hwmgr->feature_mask & PP_SCLK_DPM_MASK ? 
false : true;
-   data->pcie_dpm_key_disabled =
-   !amdgpu_device_pcie_dynamic_switching_supported() ||
-   !(hwmgr->feature_mask & PP_PCIE_DPM_MASK);
+   data->pcie_dpm_key_disabled = !(hwmgr->feature_mask & PP_PCIE_DPM_MASK);
/* need to set voltage control types before EVV patching */
data->voltage_control = SMU7_VOLTAGE_CONTROL_NONE;
data->vddci_control = SMU7_VOLTAGE_CONTROL_NONE;
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c 
b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
index 9a5f3d31e7780..94f22df5ac205 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
@@ -2107,7 +2107,7 @@ static int sienna_cichlid_update_pcie_parameters(struct 
smu_context *smu,
min_lane_width = min_lane_width > max_lane_width ?
 max_lane_width : min_lane_width;
 
-   if (!amdgpu_device_pcie_dynamic_switching_supported()) {
+   if (!(smu->adev->pm.pp_feature & PP_PCIE_DPM_MASK)) {
pcie_table->pcie_gen[0] = max_gen_speed;
pcie_table->pcie_lane[0] = max_lane_width;
} else {
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c 
b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
index 4fa94f583b87c..223e890575a2b 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
@@ -2436,7 +2436,7 @@ int smu_v13_0_update_pcie_parameters(struct smu_context 
*smu,
uint32_t smu_pcie_arg;
int ret, i;
 
-   if (!amdgpu_device_pcie_dynamic_switching_supported()) {
+   if (!(smu->adev->pm.pp_feature & PP_PCIE_DPM_MASK)) {
if (pcie_table->pcie_gen[num_of_levels - 1] < pcie_gen_cap)
pcie_gen_cap = pcie_table->pcie_gen[num_of_levels - 1];
 
-- 
2.42.0

[PATCH AUTOSEL 6.5 29/37] drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL

2023-11-07 Thread Sasha Levin

From: Qu Huang 

[ Upstream commit 5104fdf50d326db2c1a994f8b35dcd46e63ae4ad ]

In certain types of chips, such as VEGA20, reading the amdgpu_regs_smc file 
could result in an abnormal null pointer access when the smc_rreg pointer is 
NULL. Below are the steps to reproduce this issue and the corresponding 
exception log:

1. Navigate to the directory: /sys/kernel/debug/dri/0
2. Execute command: cat amdgpu_regs_smc
3. Exception Log::
[4005007.702554] BUG: kernel NULL pointer dereference, address: 
[4005007.702562] #PF: supervisor instruction fetch in kernel mode
[4005007.702567] #PF: error_code(0x0010) - not-present page
[4005007.702570] PGD 0 P4D 0
[4005007.702576] Oops: 0010 [#1] SMP NOPTI
[4005007.702581] CPU: 4 PID: 62563 Comm: cat Tainted: G   OE 
5.15.0-43-generic #46-Ubunt   u
[4005007.702590] RIP: 0010:0x0
[4005007.702598] Code: Unable to access opcode bytes at RIP 0xffd6.
[4005007.702600] RSP: 0018:a82b46d27da0 EFLAGS: 00010206
[4005007.702605] RAX:  RBX:  RCX: 
a82b46d27e68
[4005007.702609] RDX: 0001 RSI:  RDI: 
9940656e
[4005007.702612] RBP: a82b46d27dd8 R08:  R09: 
994060c07980
[4005007.702615] R10: 0002 R11:  R12: 
7f5e06753000
[4005007.702618] R13: 9940656e R14: a82b46d27e68 R15: 
7f5e06753000
[4005007.702622] FS:  7f5e0755b740() GS:99479d30() 
knlGS:
[4005007.702626] CS:  0010 DS:  ES:  CR0: 80050033
[4005007.702629] CR2: ffd6 CR3: 0003253fc000 CR4: 
003506e0
[4005007.702633] Call Trace:
[4005007.702636]  
[4005007.702640]  amdgpu_debugfs_regs_smc_read+0xb0/0x120 [amdgpu]
[4005007.703002]  full_proxy_read+0x5c/0x80
[4005007.703011]  vfs_read+0x9f/0x1a0
[4005007.703019]  ksys_read+0x67/0xe0
[4005007.703023]  __x64_sys_read+0x19/0x20
[4005007.703028]  do_syscall_64+0x5c/0xc0
[4005007.703034]  ? do_user_addr_fault+0x1e3/0x670
[4005007.703040]  ? exit_to_user_mode_prepare+0x37/0xb0
[4005007.703047]  ? irqentry_exit_to_user_mode+0x9/0x20
[4005007.703052]  ? irqentry_exit+0x19/0x30
[4005007.703057]  ? exc_page_fault+0x89/0x160
[4005007.703062]  ? asm_exc_page_fault+0x8/0x30
[4005007.703068]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[4005007.703075] RIP: 0033:0x7f5e07672992
[4005007.703079] Code: c0 e9 b2 fe ff ff 50 48 8d 3d fa b2 0c 00 e8 c5 1d 02 00 
0f 1f 44 00 00 f3 0f1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 
<48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 e   c 28 48 89 54 24
[4005007.703083] RSP: 002b:7ffe03097898 EFLAGS: 0246 ORIG_RAX: 

[4005007.703088] RAX: ffda RBX: 0002 RCX: 
7f5e07672992
[4005007.703091] RDX: 0002 RSI: 7f5e06753000 RDI: 
0003
[4005007.703094] RBP: 7f5e06753000 R08: 7f5e06752010 R09: 
7f5e06752010
[4005007.703096] R10: 0022 R11: 0246 R12: 
00022000
[4005007.703099] R13: 0003 R14: 0002 R15: 
0002
[4005007.703105]  
[4005007.703107] Modules linked in: nf_tables libcrc32c nfnetlink algif_hash 
af_alg binfmt_misc nls_   iso8859_1 ipmi_ssif ast intel_rapl_msr 
intel_rapl_common drm_vram_helper drm_ttm_helper amd64_edac t   tm 
edac_mce_amd kvm_amd ccp mac_hid k10temp kvm acpi_ipmi ipmi_si rapl 
sch_fq_codel ipmi_devintf ipm   i_msghandler msr parport_pc ppdev lp 
parport mtd pstore_blk efi_pstore ramoops pstore_zone reed_solo   mon 
ip_tables x_tables autofs4 ib_uverbs ib_core amdgpu(OE) amddrm_ttm_helper(OE) 
amdttm(OE) iommu_v   2 amd_sched(OE) amdkcl(OE) drm_kms_helper syscopyarea 
sysfillrect sysimgblt fb_sys_fops cec rc_coredrm igb ahci xhci_pci 
libahci i2c_piix4 i2c_algo_bit xhci_pci_renesas dca
[4005007.703184] CR2: 
[4005007.703188] ---[ end trace ac65a538d240da39 ]---
[4005007.800865] RIP: 0010:0x0
[4005007.800871] Code: Unable to access opcode bytes at RIP 0xffd6.
[4005007.800874] RSP: 0018:a82b46d27da0 EFLAGS: 00010206
[4005007.800878] RAX:  RBX:  RCX: 
a82b46d27e68
[4005007.800881] RDX: 0001 RSI:  RDI: 
9940656e
[4005007.800883] RBP: a82b46d27dd8 R08:  R09: 
994060c07980
[4005007.800886] R10: 0002 R11:  R12: 
7f5e06753000
[4005007.800888] R13: 9940656e R14: a82b46d27e68 R15: 
7f5e06753000
[4005007.800891] FS:  7f5e0755b740() GS:99479d30() 
knlGS:
[4005007.800895] CS:  0010 DS:  ES:  CR0: 80050033
[4005007.800898] CR2: ffd6 CR3: 0003253fc000 CR4: 
003506e0

Signed-off-by: Qu Huang 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 ++
 1 file changed, 6 insertions(+)

diff

[PATCH AUTOSEL 6.5 28/37] drm/amdkfd: Fix shift out-of-bounds issue

2023-11-07 Thread Sasha Levin

From: Jesse Zhang 

[ Upstream commit 282c1d793076c2edac6c3db51b7e8ed2b41d60a5 ]

[  567.613292] shift exponent 255 is too large for 64-bit type 'long unsigned 
int'
[  567.614498] CPU: 5 PID: 238 Comm: kworker/5:1 Tainted: G   OE  
6.2.0-34-generic #34~22.04.1-Ubuntu
[  567.614502] Hardware name: AMD Splinter/Splinter-RPL, BIOS WS43927N_871 
09/25/2023
[  567.614504] Workqueue: events send_exception_work_handler [amdgpu]
[  567.614748] Call Trace:
[  567.614750]  
[  567.614753]  dump_stack_lvl+0x48/0x70
[  567.614761]  dump_stack+0x10/0x20
[  567.614763]  __ubsan_handle_shift_out_of_bounds+0x156/0x310
[  567.614769]  ? srso_alias_return_thunk+0x5/0x7f
[  567.614773]  ? update_sd_lb_stats.constprop.0+0xf2/0x3c0
[  567.614780]  svm_range_split_by_granularity.cold+0x2b/0x34 [amdgpu]
[  567.615047]  ? srso_alias_return_thunk+0x5/0x7f
[  567.615052]  svm_migrate_to_ram+0x185/0x4d0 [amdgpu]
[  567.615286]  do_swap_page+0x7b6/0xa30
[  567.615291]  ? srso_alias_return_thunk+0x5/0x7f
[  567.615294]  ? __free_pages+0x119/0x130
[  567.615299]  handle_pte_fault+0x227/0x280
[  567.615303]  __handle_mm_fault+0x3c0/0x720
[  567.615311]  handle_mm_fault+0x119/0x330
[  567.615314]  ? lock_mm_and_find_vma+0x44/0x250
[  567.615318]  do_user_addr_fault+0x1a9/0x640
[  567.615323]  exc_page_fault+0x81/0x1b0
[  567.615328]  asm_exc_page_fault+0x27/0x30
[  567.615332] RIP: 0010:__get_user_8+0x1c/0x30

Signed-off-by: Jesse Zhang 
Suggested-by: Philip Yang 
Reviewed-by: Yifan Zhang 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c 
b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
index ed365f8ebf53f..6b5747b35a31e 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -756,7 +756,7 @@ svm_range_apply_attrs(struct kfd_process *p, struct 
svm_range *prange,
prange->flags &= ~attrs[i].value;
break;
case KFD_IOCTL_SVM_ATTR_GRANULARITY:
-   prange->granularity = attrs[i].value;
+   prange->granularity = min_t(uint32_t, attrs[i].value, 
0x3F);
break;
default:
WARN_ONCE(1, "svm_range_check_attrs wasn't called?");
-- 
2.42.0

[PATCH AUTOSEL 6.5 26/37] drm/amdgpu/vkms: fix a possible null pointer dereference

2023-11-07 Thread Sasha Levin

From: Ma Ke 

[ Upstream commit cd90511557fdfb394bb4ac4c3b539b007383914c ]

In amdgpu_vkms_conn_get_modes(), the return value of drm_cvt_mode()
is assigned to mode, which will lead to a NULL pointer dereference
on failure of drm_cvt_mode(). Add a check to avoid null pointer
dereference.

Signed-off-by: Ma Ke 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c
index d0748bcfad16b..75d25fba80821 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c
@@ -239,6 +239,8 @@ static int amdgpu_vkms_conn_get_modes(struct drm_connector 
*connector)
 
for (i = 0; i < ARRAY_SIZE(common_modes); i++) {
mode = drm_cvt_mode(dev, common_modes[i].w, common_modes[i].h, 
60, false, false, false);
+   if (!mode)
+   continue;
drm_mode_probed_add(connector, mode);
}
 
-- 
2.42.0

[PATCH AUTOSEL 6.5 25/37] drm/radeon: fix a possible null pointer dereference

2023-11-07 Thread Sasha Levin

From: Ma Ke 

[ Upstream commit 2c1fe3c480f9e1deefd50d4b18be4a046011ee1f ]

In radeon_tv_get_modes(), the return value of drm_cvt_mode()
is assigned to mode, which will lead to a NULL pointer
dereference on failure of drm_cvt_mode(). Add a check to
avoid null point dereference.

Signed-off-by: Ma Ke 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/radeon/radeon_connectors.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c 
b/drivers/gpu/drm/radeon/radeon_connectors.c
index 07193cd0c4174..4859d965d67e3 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1122,6 +1122,8 @@ static int radeon_tv_get_modes(struct drm_connector 
*connector)
else {
/* only 800x600 is supported right now on pre-avivo chips */
tv_mode = drm_cvt_mode(dev, 800, 600, 60, false, false, false);
+   if (!tv_mode)
+   return 0;
tv_mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
drm_mode_probed_add(connector, tv_mode);
}
-- 
2.42.0

[PATCH AUTOSEL 6.5 22/37] drm/amdgpu: Fix potential null pointer derefernce

2023-11-07 Thread Sasha Levin

From: "Stanley.Yang" 

[ Upstream commit 80285ae1ec8717b597b20de38866c29d84d321a1 ]

The amdgpu_ras_get_context may return NULL if device
not support ras feature, so add check before using.

Signed-off-by: Stanley.Yang 
Reviewed-by: Tao Zhou 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 8940ee73f2dfe..ecc61a6d13e13 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -5399,7 +5399,8 @@ int amdgpu_device_gpu_recover(struct amdgpu_device *adev,
 * Flush RAM to disk so that after reboot
 * the user can read log and see why the system rebooted.
 */
-   if (need_emergency_restart && amdgpu_ras_get_context(adev)->reboot) {
+   if (need_emergency_restart && amdgpu_ras_get_context(adev) &&
+   amdgpu_ras_get_context(adev)->reboot) {
DRM_WARN("Emergency reboot.");
 
ksys_sync_helper();
-- 
2.42.0

[PATCH AUTOSEL 6.5 21/37] drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit 0f0e59075b5c22f1e871fbd508d6e4f495048356 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2036742
Signed-off-by: Mario Limonciello 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 .../gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h| 12 ++--
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h 
b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
index 41444e27bfc0c..e0e40b054c08b 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
@@ -164,7 +164,7 @@ typedef struct _ATOM_Tonga_State {
 typedef struct _ATOM_Tonga_State_Array {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number of entries. */
-   ATOM_Tonga_State entries[1];/* Dynamically allocate entries. */
+   ATOM_Tonga_State entries[]; /* Dynamically allocate entries. */
 } ATOM_Tonga_State_Array;
 
 typedef struct _ATOM_Tonga_MCLK_Dependency_Record {
@@ -210,7 +210,7 @@ typedef struct _ATOM_Polaris_SCLK_Dependency_Record {
 typedef struct _ATOM_Polaris_SCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Polaris_SCLK_Dependency_Record entries[1]; 
 /* Dynamically allocate entries. */
+   ATOM_Polaris_SCLK_Dependency_Record entries[];  
 /* Dynamically allocate entries. */
 } ATOM_Polaris_SCLK_Dependency_Table;
 
 typedef struct _ATOM_Tonga_PCIE_Record {
@@ -222,7 +222,7 @@ typedef struct _ATOM_Tonga_PCIE_Record {
 typedef struct _ATOM_Tonga_PCIE_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_PCIE_Record entries[1];  
/* Dynamically allocate entries. */
+   ATOM_Tonga_PCIE_Record entries[];   
/* Dynamically allocate entries. */
 } ATOM_Tonga_PCIE_Table;
 
 typedef struct _ATOM_Polaris10_PCIE_Record {
@@ -235,7 +235,7 @@ typedef struct _ATOM_Polaris10_PCIE_Record {
 typedef struct _ATOM_Polaris10_PCIE_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Polaris10_PCIE_Record entries[1];  /* 
Dynamically allocate entries. */
+   ATOM_Polaris10_PCIE_Record entries[];  /* 
Dynamically allocate entries. */
 } ATOM_Polaris10_PCIE_Table;
 
 
@@ -252,7 +252,7 @@ typedef struct _ATOM_Tonga_MM_Dependency_Record {
 typedef struct _ATOM_Tonga_MM_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_MM_Dependency_Record entries[1];/* 
Dynamically allocate entries. */
+   ATOM_Tonga_MM_Dependency_Record entries[]; /* 
Dynamically allocate entries. */
 } ATOM_Tonga_MM_Dependency_Table;
 
 typedef struct _ATOM_Tonga_Voltage_Lookup_Record {
@@ -265,7 +265,7 @@ typedef struct _ATOM_Tonga_Voltage_Lookup_Record {
 typedef struct _ATOM_Tonga_Voltage_Lookup_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_Voltage_Lookup_Record entries[1];
/* Dynamically allocate entries. */
+   ATOM_Tonga_Voltage_Lookup_Record entries[]; 
/* Dynamically allocate entries. */
 } ATOM_Tonga_Voltage_Lookup_Table;
 
 typedef struct _ATOM_Tonga_Fan_Table {
-- 
2.42.0

[PATCH AUTOSEL 6.5 20/37] drm/radeon: Fix UBSAN array-index-out-of-bounds for Radeon HD 5430

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit c63079c61177ba1b17fa05c6875699a36924fe39 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Suggested-by: Felix Held 
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2894
Signed-off-by: Mario Limonciello 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/radeon/pptable.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/radeon/pptable.h b/drivers/gpu/drm/radeon/pptable.h
index 4c2eec49dadc9..94947229888ba 100644
--- a/drivers/gpu/drm/radeon/pptable.h
+++ b/drivers/gpu/drm/radeon/pptable.h
@@ -74,7 +74,7 @@ typedef struct _ATOM_PPLIB_THERMALCONTROLLER
 typedef struct _ATOM_PPLIB_STATE
 {
 UCHAR ucNonClockStateIndex;
-UCHAR ucClockStateIndices[1]; // variable-sized
+UCHAR ucClockStateIndices[]; // variable-sized
 } ATOM_PPLIB_STATE;
 
 
-- 
2.42.0

[PATCH AUTOSEL 6.5 19/37] drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit 760efbca74a405dc439a013a5efaa9fadc95a8c3 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Suggested-by: Felix Held 
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2874
Signed-off-by: Mario Limonciello 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/include/pptable.h | 4 ++--
 drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/include/pptable.h 
b/drivers/gpu/drm/amd/include/pptable.h
index 0b6a057e0a4c4..5aac8d545bdc6 100644
--- a/drivers/gpu/drm/amd/include/pptable.h
+++ b/drivers/gpu/drm/amd/include/pptable.h
@@ -78,7 +78,7 @@ typedef struct _ATOM_PPLIB_THERMALCONTROLLER
 typedef struct _ATOM_PPLIB_STATE
 {
 UCHAR ucNonClockStateIndex;
-UCHAR ucClockStateIndices[1]; // variable-sized
+UCHAR ucClockStateIndices[]; // variable-sized
 } ATOM_PPLIB_STATE;
 
 
@@ -473,7 +473,7 @@ typedef struct _ATOM_PPLIB_STATE_V2
   /**
   * Driver will read the first ucNumDPMLevels in this array
   */
-  UCHAR clockInfoIndex[1];
+  UCHAR clockInfoIndex[];
 } ATOM_PPLIB_STATE_V2;
 
 typedef struct _StateArray{
diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h 
b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
index b0ac4d121adca..41444e27bfc0c 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
@@ -179,7 +179,7 @@ typedef struct _ATOM_Tonga_MCLK_Dependency_Record {
 typedef struct _ATOM_Tonga_MCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_MCLK_Dependency_Record entries[1];   
/* Dynamically allocate entries. */
+   ATOM_Tonga_MCLK_Dependency_Record entries[];
/* Dynamically allocate entries. */
 } ATOM_Tonga_MCLK_Dependency_Table;
 
 typedef struct _ATOM_Tonga_SCLK_Dependency_Record {
@@ -194,7 +194,7 @@ typedef struct _ATOM_Tonga_SCLK_Dependency_Record {
 typedef struct _ATOM_Tonga_SCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_SCLK_Dependency_Record entries[1];   
 /* Dynamically allocate entries. */
+   ATOM_Tonga_SCLK_Dependency_Record entries[];
 /* Dynamically allocate entries. */
 } ATOM_Tonga_SCLK_Dependency_Table;
 
 typedef struct _ATOM_Polaris_SCLK_Dependency_Record {
-- 
2.42.0

[PATCH AUTOSEL 6.5 12/37] drm/amd/display: use full update for clip size increase of large plane source

2023-11-07 Thread Sasha Levin

From: Wenjing Liu 

[ Upstream commit 05b78277ef0efc1deebc8a22384fffec29a3676e ]

[why]
Clip size increase will increase viewport, which could cause us to
switch  to MPC combine.
If we skip full update, we are not able to change to MPC combine in
fast update. This will cause corruption showing on the video plane.

[how]
treat clip size increase of a surface larger than 5k as a full update.

Reviewed-by: Jun Lei 
Acked-by: Aurabindo Pillai 
Signed-off-by: Wenjing Liu 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/display/dc/core/dc.c | 12 ++--
 drivers/gpu/drm/amd/display/dc/dc.h  |  5 +
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c 
b/drivers/gpu/drm/amd/display/dc/core/dc.c
index 93e6265e58509..b386f3b0fd428 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -993,7 +993,8 @@ static bool dc_construct(struct dc *dc,
/* set i2c speed if not done by the respective dcnxxx__resource.c */
if (dc->caps.i2c_speed_in_khz_hdcp == 0)
dc->caps.i2c_speed_in_khz_hdcp = dc->caps.i2c_speed_in_khz;
-
+   if (dc->caps.max_optimizable_video_width == 0)
+   dc->caps.max_optimizable_video_width = 5120;
dc->clk_mgr = dc_clk_mgr_create(dc->ctx, dc->res_pool->pp_smu, 
dc->res_pool->dccg);
if (!dc->clk_mgr)
goto fail;
@@ -2430,6 +2431,7 @@ static enum surface_update_type 
get_plane_info_update_type(const struct dc_surfa
 }
 
 static enum surface_update_type get_scaling_info_update_type(
+   const struct dc *dc,
const struct dc_surface_update *u)
 {
union surface_update_flags *update_flags = >surface->update_flags;
@@ -2464,6 +2466,12 @@ static enum surface_update_type 
get_scaling_info_update_type(
update_flags->bits.clock_change = 1;
}
 
+   if (u->scaling_info->src_rect.width > 
dc->caps.max_optimizable_video_width &&
+   (u->scaling_info->clip_rect.width > u->surface->clip_rect.width 
||
+u->scaling_info->clip_rect.height > 
u->surface->clip_rect.height))
+/* Changing clip size of a large surface may result in MPC 
slice count change */
+   update_flags->bits.bandwidth_change = 1;
+
if (u->scaling_info->src_rect.x != u->surface->src_rect.x
|| u->scaling_info->src_rect.y != u->surface->src_rect.y
|| u->scaling_info->clip_rect.x != 
u->surface->clip_rect.x
@@ -2501,7 +2509,7 @@ static enum surface_update_type det_surface_update(const 
struct dc *dc,
type = get_plane_info_update_type(u);
elevate_update_type(_type, type);
 
-   type = get_scaling_info_update_type(u);
+   type = get_scaling_info_update_type(dc, u);
elevate_update_type(_type, type);
 
if (u->flip_addr) {
diff --git a/drivers/gpu/drm/amd/display/dc/dc.h 
b/drivers/gpu/drm/amd/display/dc/dc.h
index 81258392d44a1..dc0e0af616506 100644
--- a/drivers/gpu/drm/amd/display/dc/dc.h
+++ b/drivers/gpu/drm/amd/display/dc/dc.h
@@ -229,6 +229,11 @@ struct dc_caps {
uint32_t dmdata_alloc_size;
unsigned int max_cursor_size;
unsigned int max_video_width;
+   /*
+* max video plane width that can be safely assumed to be always
+* supported by single DPP pipe.
+*/
+   unsigned int max_optimizable_video_width;
unsigned int min_horizontal_blanking_period;
int linear_pitch_alignment;
bool dcc_const_color;
-- 
2.42.0

[PATCH AUTOSEL 6.5 11/37] drm/amd: Update `update_pcie_parameters` functions to use uint8_t arguments

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit 7752ccf85b929a22e658ec145283e8f31232f4bb ]

The matching values for `pcie_gen_cap` and `pcie_width_cap` when
fetched from powerplay tables are 1 byte, so narrow the arguments
to match to ensure min() and max() comparisons without casts.

Signed-off-by: Mario Limonciello 
Acked-by: Christian König 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c   | 2 +-
 drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h   | 2 +-
 drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h| 4 ++--
 drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 4 ++--
 drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 8 
 drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c  | 4 ++--
 6 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c 
b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
index 222af2fae7458..16c03771c1239 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
@@ -1232,7 +1232,7 @@ static int smu_smc_hw_setup(struct smu_context *smu)
 {
struct smu_feature *feature = >smu_feature;
struct amdgpu_device *adev = smu->adev;
-   uint32_t pcie_gen = 0, pcie_width = 0;
+   uint8_t pcie_gen = 0, pcie_width = 0;
uint64_t features_supported;
int ret = 0;
 
diff --git a/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h 
b/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h
index 6e2069dcb6b9d..d1d7713b97794 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h
+++ b/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h
@@ -856,7 +856,7 @@ struct pptable_funcs {
 * _gen_cap: Maximum allowed PCIe generation.
 * _width_cap: Maximum allowed PCIe width.
 */
-   int (*update_pcie_parameters)(struct smu_context *smu, uint32_t 
pcie_gen_cap, uint32_t pcie_width_cap);
+   int (*update_pcie_parameters)(struct smu_context *smu, uint8_t 
pcie_gen_cap, uint8_t pcie_width_cap);
 
/**
 * @i2c_init: Initialize i2c.
diff --git a/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h 
b/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h
index 355c156d871af..cc02f979e9e98 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h
+++ b/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h
@@ -296,8 +296,8 @@ int smu_v13_0_get_pptable_from_firmware(struct smu_context 
*smu,
uint32_t pptable_id);
 
 int smu_v13_0_update_pcie_parameters(struct smu_context *smu,
-uint32_t pcie_gen_cap,
-uint32_t pcie_width_cap);
+uint8_t pcie_gen_cap,
+uint8_t pcie_width_cap);
 
 #endif
 #endif
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c 
b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c
index 95f6d821bacbc..addaa69119b8e 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c
@@ -2375,8 +2375,8 @@ static int navi10_get_power_limit(struct smu_context *smu,
 }
 
 static int navi10_update_pcie_parameters(struct smu_context *smu,
-uint32_t pcie_gen_cap,
-uint32_t pcie_width_cap)
+uint8_t pcie_gen_cap,
+uint8_t pcie_width_cap)
 {
struct smu_11_0_dpm_context *dpm_context = smu->smu_dpm.dpm_context;
PPTable_t *pptable = smu->smu_table.driver_pptable;
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c 
b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
index 9119b0df2419f..9a5f3d31e7780 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
@@ -2084,14 +2084,14 @@ static int 
sienna_cichlid_display_disable_memory_clock_switch(struct smu_context
 #define MAX(a, b)  ((a) > (b) ? (a) : (b))
 
 static int sienna_cichlid_update_pcie_parameters(struct smu_context *smu,
-uint32_t pcie_gen_cap,
-uint32_t pcie_width_cap)
+uint8_t pcie_gen_cap,
+uint8_t pcie_width_cap)
 {
struct smu_11_0_dpm_context *dpm_context = smu->smu_dpm.dpm_context;
struct smu_11_0_pcie_table *pcie_table = 
_context->dpm_tables.pcie_table;
uint8_t *table_member1, *table_member2;
-   uint32_t min_gen_speed, max_gen_speed;
-   uint32_t min_lane_width, max_lane_width;
+   uint8_t min_gen_speed, max_gen_speed;
+   uint8_t min_lane_width, max_lane_width;
uint32_t smu_pcie_arg;
int ret, i;
 
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c 
b/drivers/gpu/d

[PATCH AUTOSEL 6.5 10/37] drm/amdkfd: Fix a race condition of vram buffer unref in svm code

2023-11-07 Thread Sasha Levin

From: Xiaogang Chen 

[ Upstream commit 709c348261618da7ed89d6c303e2ceb9e453ba74 ]

prange->svm_bo unref can happen in both mmu callback and a callback after
migrate to system ram. Both are async call in different tasks. Sync svm_bo
unref operation to avoid random "use-after-free".

Signed-off-by: Xiaogang Chen 
Reviewed-by: Philip Yang 
Reviewed-by: Jesse Zhang 
Tested-by: Jesse Zhang 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 11 +--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c 
b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
index 5ff1a5a89d968..ed365f8ebf53f 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -617,8 +617,15 @@ svm_range_vram_node_new(struct kfd_node *node, struct 
svm_range *prange,
 
 void svm_range_vram_node_free(struct svm_range *prange)
 {
-   svm_range_bo_unref(prange->svm_bo);
-   prange->ttm_res = NULL;
+   /* serialize prange->svm_bo unref */
+   mutex_lock(>lock);
+   /* prange->svm_bo has not been unref */
+   if (prange->ttm_res) {
+   prange->ttm_res = NULL;
+   mutex_unlock(>lock);
+   svm_range_bo_unref(prange->svm_bo);
+   } else
+   mutex_unlock(>lock);
 }
 
 struct kfd_node *
-- 
2.42.0

[PATCH AUTOSEL 6.5 09/37] drm/amdgpu: not to save bo in the case of RAS err_event_athub

2023-11-07 Thread Sasha Levin

From: "David (Ming Qiang) Wu" 

[ Upstream commit fa1f1cc09d588a90c8ce3f507c47df257461d148 ]

err_event_athub will corrupt VCPU buffer and not good to
be restored in amdgpu_vcn_resume() and in this case
the VCPU buffer needs to be cleared for VCN firmware to
work properly.

Acked-by: Leo Liu 
Signed-off-by: David (Ming Qiang) Wu 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 7 +++
 1 file changed, 7 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
index ae455aab5d29d..7e54abca45206 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
@@ -292,8 +292,15 @@ int amdgpu_vcn_suspend(struct amdgpu_device *adev)
void *ptr;
int i, idx;
 
+   bool in_ras_intr = amdgpu_ras_intr_triggered();
+
cancel_delayed_work_sync(>vcn.idle_work);
 
+   /* err_event_athub will corrupt VCPU buffer, so we need to
+* restore fw data and clear buffer in amdgpu_vcn_resume() */
+   if (in_ras_intr)
+   return 0;
+
for (i = 0; i < adev->vcn.num_vcn_inst; ++i) {
if (adev->vcn.harvest_config & (1 << i))
continue;
-- 
2.42.0

[PATCH AUTOSEL 6.5 06/37] drm/amd/display: add seamless pipe topology transition check

2023-11-07 Thread Sasha Levin

From: Wenjing Liu 

[ Upstream commit 15c6798ae26d5c7a7776f4f7d0c1fa8c462688a2 ]

[why]
We have a few cases where we need to perform update topology update
in dc update interface. However some of the updates are not seamless
This could cause user noticible glitches. To enforce seamless transition
we are adding a checking condition and error logging so the corruption
as result of non seamless transition can be easily spotted.

Reviewed-by: Dillon Varone 
Acked-by: Stylon Wang 
Signed-off-by: Wenjing Liu 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/display/dc/core/dc.c  |  8 +++
 .../drm/amd/display/dc/dcn32/dcn32_hwseq.c| 52 +++
 .../drm/amd/display/dc/dcn32/dcn32_hwseq.h|  4 ++
 .../gpu/drm/amd/display/dc/dcn32/dcn32_init.c |  1 +
 .../gpu/drm/amd/display/dc/inc/hw_sequencer.h |  3 ++
 5 files changed, 68 insertions(+)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c 
b/drivers/gpu/drm/amd/display/dc/core/dc.c
index ab79bcd264164..93e6265e58509 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -4414,6 +4414,14 @@ bool dc_update_planes_and_stream(struct dc *dc,
update_type,
context);
} else {
+   if (!stream_update &&
+   dc->hwss.is_pipe_topology_transition_seamless &&
+   !dc->hwss.is_pipe_topology_transition_seamless(
+   dc, dc->current_state, 
context)) {
+
+   DC_LOG_ERROR("performing non-seamless pipe topology 
transition with surface only update!\n");
+   BREAK_TO_DEBUGGER();
+   }
commit_planes_for_stream(
dc,
srf_updates,
diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c 
b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c
index b6608d7ab4450..5b3d0e5b90a3e 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c
@@ -1621,3 +1621,55 @@ void dcn32_blank_phantom(struct dc *dc,
if (tg->funcs->is_tg_enabled(tg))
hws->funcs.wait_for_blank_complete(opp);
 }
+
+bool dcn32_is_pipe_topology_transition_seamless(struct dc *dc,
+   const struct dc_state *cur_ctx,
+   const struct dc_state *new_ctx)
+{
+   int i;
+   const struct pipe_ctx *cur_pipe, *new_pipe;
+   bool is_seamless = true;
+
+   for (i = 0; i < dc->res_pool->pipe_count; i++) {
+   cur_pipe = _ctx->res_ctx.pipe_ctx[i];
+   new_pipe = _ctx->res_ctx.pipe_ctx[i];
+
+   if (resource_is_pipe_type(cur_pipe, FREE_PIPE) ||
+   resource_is_pipe_type(new_pipe, FREE_PIPE))
+   /* adding or removing free pipes is always seamless */
+   continue;
+   else if (resource_is_pipe_type(cur_pipe, OTG_MASTER)) {
+   if (resource_is_pipe_type(new_pipe, OTG_MASTER))
+   if (cur_pipe->stream->stream_id == 
new_pipe->stream->stream_id)
+   /* OTG master with the same stream is seamless 
*/
+   continue;
+   } else if (resource_is_pipe_type(cur_pipe, OPP_HEAD)) {
+   if (resource_is_pipe_type(new_pipe, OPP_HEAD)) {
+   if (cur_pipe->stream_res.tg == 
new_pipe->stream_res.tg)
+   /*
+* OPP heads sharing the same timing
+* generator is seamless
+*/
+   continue;
+   }
+   } else if (resource_is_pipe_type(cur_pipe, DPP_PIPE)) {
+   if (resource_is_pipe_type(new_pipe, DPP_PIPE)) {
+   if (cur_pipe->stream_res.opp == 
new_pipe->stream_res.opp)
+   /*
+* DPP pipes sharing the same OPP head 
is
+* seamless
+*/
+   continue;
+   }
+   }
+
+   /*
+* This pipe's transition doesn't fall under any seamless
+* conditions
+*/
+   is_seamless = false;
+   break;
+   }
+
+   return is_seamless;
+}
diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.h 
b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.h
index 616d5219119e9..9992e40a

[PATCH AUTOSEL 6.5 05/37] drm/amd/display: Don't lock phantom pipe on disabling

2023-11-07 Thread Sasha Levin

From: Alvin Lee 

[ Upstream commit cbb4c9bc55427774ca4d819933e1b5fa38a6fb44 ]

[Description]
- When disabling a phantom pipe, we first enable the phantom
  OTG so the double buffer update can successfully take place
- However, want to avoid locking the phantom otherwise setting
  DPG_EN=1 for the phantom pipe is blocked (without this we could
  hit underflow due to phantom HUBP being blanked by default)

Reviewed-by: Samson Tam 
Acked-by: Stylon Wang 
Signed-off-by: Alvin Lee 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c 
b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index 9834b75f1837b..79befa17bb037 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -111,7 +111,8 @@ void dcn10_lock_all_pipes(struct dc *dc,
if (pipe_ctx->top_pipe ||
!pipe_ctx->stream ||
(!pipe_ctx->plane_state && !old_pipe_ctx->plane_state) ||
-   !tg->funcs->is_tg_enabled(tg))
+   !tg->funcs->is_tg_enabled(tg) ||
+   pipe_ctx->stream->mall_stream_config.type == 
SUBVP_PHANTOM)
continue;
 
if (lock)
-- 
2.42.0

[PATCH AUTOSEL 6.5 04/37] drm/amd/display: Blank phantom OTG before enabling

2023-11-07 Thread Sasha Levin

From: Alvin Lee 

[ Upstream commit e87a6c5b7780b5f423797351eb586ed96cc6d151 ]

[Description]
Before enabling the phantom OTG for an update we
must enable DPG to avoid underflow.

Reviewed-by: Samson Tam 
Acked-by: Stylon Wang 
Signed-off-by: Alvin Lee 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/display/dc/core/dc.c  | 50 +--
 .../drm/amd/display/dc/dcn20/dcn20_hwseq.c| 10 +++-
 .../drm/amd/display/dc/dcn32/dcn32_hwseq.c| 46 +
 .../drm/amd/display/dc/dcn32/dcn32_hwseq.h|  5 ++
 .../gpu/drm/amd/display/dc/dcn32/dcn32_init.c |  1 +
 .../gpu/drm/amd/display/dc/inc/hw_sequencer.h |  5 ++
 6 files changed, 68 insertions(+), 49 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c 
b/drivers/gpu/drm/amd/display/dc/core/dc.c
index 609048160aa20..ab79bcd264164 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -1070,53 +1070,6 @@ static void apply_ctx_interdependent_lock(struct dc *dc, 
struct dc_state *contex
}
 }
 
-static void phantom_pipe_blank(
-   struct dc *dc,
-   struct timing_generator *tg,
-   int width,
-   int height)
-{
-   struct dce_hwseq *hws = dc->hwseq;
-   enum dc_color_space color_space;
-   struct tg_color black_color = {0};
-   struct output_pixel_processor *opp = NULL;
-   uint32_t num_opps, opp_id_src0, opp_id_src1;
-   uint32_t otg_active_width, otg_active_height;
-   uint32_t i;
-
-   /* program opp dpg blank color */
-   color_space = COLOR_SPACE_SRGB;
-   color_space_to_black_color(dc, color_space, _color);
-
-   otg_active_width = width;
-   otg_active_height = height;
-
-   /* get the OPTC source */
-   tg->funcs->get_optc_source(tg, _opps, _id_src0, _id_src1);
-   ASSERT(opp_id_src0 < dc->res_pool->res_cap->num_opp);
-
-   for (i = 0; i < dc->res_pool->res_cap->num_opp; i++) {
-   if (dc->res_pool->opps[i] != NULL && 
dc->res_pool->opps[i]->inst == opp_id_src0) {
-   opp = dc->res_pool->opps[i];
-   break;
-   }
-   }
-
-   if (opp && opp->funcs->opp_set_disp_pattern_generator)
-   opp->funcs->opp_set_disp_pattern_generator(
-   opp,
-   CONTROLLER_DP_TEST_PATTERN_SOLID_COLOR,
-   CONTROLLER_DP_COLOR_SPACE_UDEFINED,
-   COLOR_DEPTH_UNDEFINED,
-   _color,
-   otg_active_width,
-   otg_active_height,
-   0);
-
-   if (tg->funcs->is_tg_enabled(tg))
-   hws->funcs.wait_for_blank_complete(opp);
-}
-
 static void dc_update_viusal_confirm_color(struct dc *dc, struct dc_state 
*context, struct pipe_ctx *pipe_ctx)
 {
if (dc->ctx->dce_version >= DCN_VERSION_1_0) {
@@ -1207,7 +1160,8 @@ static void disable_dangling_plane(struct dc *dc, struct 
dc_state *context)
 
main_pipe_width = 
old_stream->mall_stream_config.paired_stream->dst.width;
main_pipe_height = 
old_stream->mall_stream_config.paired_stream->dst.height;
-   phantom_pipe_blank(dc, tg, 
main_pipe_width, main_pipe_height);
+   if (dc->hwss.blank_phantom)
+   dc->hwss.blank_phantom(dc, tg, 
main_pipe_width, main_pipe_height);
tg->funcs->enable_crtc(tg);
}
}
diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c 
b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
index 62a077adcdbfa..84fe449a2c7ed 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
@@ -1846,8 +1846,16 @@ void dcn20_program_front_end_for_ctx(

dc->current_state->res_ctx.pipe_ctx[i].stream->mall_stream_config.type == 
SUBVP_PHANTOM) {
struct timing_generator *tg = 
dc->current_state->res_ctx.pipe_ctx[i].stream_res.tg;
 
-   if (tg->funcs->enable_crtc)
+   if (tg->funcs->enable_crtc) {
+   if (dc->hwss.blank_phantom) {
+   int main_pipe_width, main_pipe_height;
+
+   main_pipe_width = 
dc->current_state->res_ctx.pipe_ctx[i].stream->mall_stream_config.paired_stream->dst.width;
+   main_pipe_height

[PATCH AUTOSEL 6.5 02/37] drm/amdkfd: ratelimited SQ interrupt messages

2023-11-07 Thread Sasha Levin

From: Harish Kasiviswanathan 

[ Upstream commit 37fb87910724f21a1f27a75743d4f9accdee77fb ]

No functional change. Use ratelimited version of pr_ to avoid
overflowing of dmesg buffer

Signed-off-by: Harish Kasiviswanathan 
Reviewed-by: Philip Yang 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdkfd/kfd_int_process_v10.c | 6 +++---
 drivers/gpu/drm/amd/amdkfd/kfd_int_process_v11.c | 6 +++---
 drivers/gpu/drm/amd/amdkfd/kfd_int_process_v9.c  | 6 +++---
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_int_process_v10.c 
b/drivers/gpu/drm/amd/amdkfd/kfd_int_process_v10.c
index c7991e07b6be5..a7697ec8188e0 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_int_process_v10.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_int_process_v10.c
@@ -268,7 +268,7 @@ static void event_interrupt_wq_v10(struct kfd_node *dev,
SQ_INTERRUPT_WORD_WAVE_CTXID1, 
ENCODING);
switch (encoding) {
case SQ_INTERRUPT_WORD_ENCODING_AUTO:
-   pr_debug(
+   pr_debug_ratelimited(
"sq_intr: auto, se %d, ttrace %d, wlt 
%d, ttrac_buf0_full %d, ttrac_buf1_full %d, ttrace_utc_err %d\n",
REG_GET_FIELD(context_id1, 
SQ_INTERRUPT_WORD_AUTO_CTXID1,
SE_ID),
@@ -284,7 +284,7 @@ static void event_interrupt_wq_v10(struct kfd_node *dev,

THREAD_TRACE_UTC_ERROR));
break;
case SQ_INTERRUPT_WORD_ENCODING_INST:
-   pr_debug("sq_intr: inst, se %d, data 0x%x, sa 
%d, priv %d, wave_id %d, simd_id %d, wgp_id %d\n",
+   pr_debug_ratelimited("sq_intr: inst, se %d, 
data 0x%x, sa %d, priv %d, wave_id %d, simd_id %d, wgp_id %d\n",
REG_GET_FIELD(context_id1, 
SQ_INTERRUPT_WORD_WAVE_CTXID1,
SE_ID),
REG_GET_FIELD(context_id0, 
SQ_INTERRUPT_WORD_WAVE_CTXID0,
@@ -310,7 +310,7 @@ static void event_interrupt_wq_v10(struct kfd_node *dev,
case SQ_INTERRUPT_WORD_ENCODING_ERROR:
sq_intr_err_type = REG_GET_FIELD(context_id0, 
KFD_CTXID0,
ERR_TYPE);
-   pr_warn("sq_intr: error, se %d, data 0x%x, sa 
%d, priv %d, wave_id %d, simd_id %d, wgp_id %d, err_type %d\n",
+   pr_warn_ratelimited("sq_intr: error, se %d, 
data 0x%x, sa %d, priv %d, wave_id %d, simd_id %d, wgp_id %d, err_type %d\n",
REG_GET_FIELD(context_id1, 
SQ_INTERRUPT_WORD_WAVE_CTXID1,
SE_ID),
REG_GET_FIELD(context_id0, 
SQ_INTERRUPT_WORD_WAVE_CTXID0,
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_int_process_v11.c 
b/drivers/gpu/drm/amd/amdkfd/kfd_int_process_v11.c
index f933bd231fb9c..2a65792fd1162 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_int_process_v11.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_int_process_v11.c
@@ -150,7 +150,7 @@ enum SQ_INTERRUPT_ERROR_TYPE {
 
 static void print_sq_intr_info_auto(uint32_t context_id0, uint32_t context_id1)
 {
-   pr_debug(
+   pr_debug_ratelimited(
"sq_intr: auto, ttrace %d, wlt %d, ttrace_buf_full %d, reg_tms 
%d, cmd_tms %d, host_cmd_ovf %d, host_reg_ovf %d, immed_ovf %d, ttrace_utc_err 
%d\n",
REG_GET_FIELD(context_id0, SQ_INTERRUPT_WORD_AUTO_CTXID0, 
THREAD_TRACE),
REG_GET_FIELD(context_id0, SQ_INTERRUPT_WORD_AUTO_CTXID0, WLT),
@@ -165,7 +165,7 @@ static void print_sq_intr_info_auto(uint32_t context_id0, 
uint32_t context_id1)
 
 static void print_sq_intr_info_inst(uint32_t context_id0, uint32_t context_id1)
 {
-   pr_debug(
+   pr_debug_ratelimited(
"sq_intr: inst, data 0x%08x, sh %d, priv %d, wave_id %d, 
simd_id %d, wgp_id %d\n",
REG_GET_FIELD(context_id0, SQ_INTERRUPT_WORD_WAVE_CTXID0, DATA),
REG_GET_FIELD(context_id0, SQ_INTERRUPT_WORD_WAVE_CTXID0, 
SH_ID),
@@ -177,7 +177,7 @@ static void print_sq_intr_info_inst(uint32_t context_id0, 
uint32_t context_id1)
 
 static void print_sq_intr_info_error(uint32_t context_id0, uint32_t 
context_id1)
 {
-   pr_warn(
+   pr_warn_ratelimited(
"sq_intr: error, detail 0x%08x, type %d, sh %d, priv %d, 
wave_id %d, simd_id %d, wgp_id %d\n",
REG_GET_FIELD(context_id0, SQ_INTERRUPT_WORD_ERROR_CTXID0, 
DETAIL),
REG_GET_FIELD(context_id0,

[PATCH AUTOSEL 6.6 33/40] drm/amd: check num of link levels when update pcie param

2023-11-07 Thread Sasha Levin

From: "Lin.Cao" 

[ Upstream commit 406e8845356d18bdf3d3a23b347faf67706472ec ]

In SR-IOV environment, the value of pcie_table->num_of_link_levels will
be 0, and num_of_levels - 1 will cause array index out of bounds

Signed-off-by: Lin.Cao 
Acked-by: Jingwen Chen 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c 
b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
index 4aeb84572e5b8..5355f621388bb 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
@@ -2430,6 +2430,9 @@ int smu_v13_0_update_pcie_parameters(struct smu_context 
*smu,
uint32_t smu_pcie_arg;
int ret, i;
 
+   if (!num_of_levels)
+   return 0;
+
if (!(smu->adev->pm.pp_feature & PP_PCIE_DPM_MASK)) {
if (pcie_table->pcie_gen[num_of_levels - 1] < pcie_gen_cap)
pcie_gen_cap = pcie_table->pcie_gen[num_of_levels - 1];
-- 
2.42.0

[PATCH AUTOSEL 6.6 32/40] drm/amd/display: fix num_ways overflow error

2023-11-07 Thread Sasha Levin

From: Samson Tam 

[ Upstream commit 79f3f1b66753b3a3a269d73676bf50987921f267 ]

[Why]
Helper function calculates num_ways using 32-bit.  But is
 returned as 8-bit.  If num_ways exceeds 8-bit, then it
 reports back the incorrect num_ways and erroneously
 uses MALL when it should not

[How]
Make returned value 32-bit and convert after it checks
 against caps.cache_num_ways, which is under 8-bit

Reviewed-by: Alvin Lee 
Acked-by: Roman Li 
Signed-off-by: Samson Tam 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c | 7 ---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c 
b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c
index 018376146d977..be59e1c02f8aa 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c
@@ -214,7 +214,7 @@ static bool dcn32_check_no_memory_request_for_cab(struct dc 
*dc)
 static uint32_t dcn32_calculate_cab_allocation(struct dc *dc, struct dc_state 
*ctx)
 {
int i;
-   uint8_t num_ways = 0;
+   uint32_t num_ways = 0;
uint32_t mall_ss_size_bytes = 0;
 
mall_ss_size_bytes = ctx->bw_ctx.bw.dcn.mall_ss_size_bytes;
@@ -244,7 +244,8 @@ static uint32_t dcn32_calculate_cab_allocation(struct dc 
*dc, struct dc_state *c
 bool dcn32_apply_idle_power_optimizations(struct dc *dc, bool enable)
 {
union dmub_rb_cmd cmd;
-   uint8_t ways, i;
+   uint8_t i;
+   uint32_t ways;
int j;
bool mall_ss_unsupported = false;
struct dc_plane_state *plane = NULL;
@@ -304,7 +305,7 @@ bool dcn32_apply_idle_power_optimizations(struct dc *dc, 
bool enable)
cmd.cab.header.type = DMUB_CMD__CAB_FOR_SS;
cmd.cab.header.sub_type = 
DMUB_CMD__CAB_DCN_SS_FIT_IN_CAB;
cmd.cab.header.payload_bytes = sizeof(cmd.cab) 
- sizeof(cmd.cab.header);
-   cmd.cab.cab_alloc_ways = ways;
+   cmd.cab.cab_alloc_ways = (uint8_t)ways;
 
dm_execute_dmub_cmd(dc->ctx, , 
DM_DMUB_WAIT_TYPE_NO_WAIT);
 
-- 
2.42.0

[PATCH AUTOSEL 6.6 31/40] drm/amd: Disable PP_PCIE_DPM_MASK when dynamic speed switching not supported

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit fbf1035b033a51eee48d5f42e781b02fff272ca0 ]

Rather than individual ASICs checking for the quirk, set the quirk at the
driver level.

Signed-off-by: Mario Limonciello 
Reviewed-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c  | 2 ++
 drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 4 +---
 drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 2 +-
 drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c  | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 69f72bca229c9..b9fd755419fb4 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -2103,6 +2103,8 @@ static int amdgpu_device_ip_early_init(struct 
amdgpu_device *adev)
adev->pm.pp_feature &= ~PP_GFXOFF_MASK;
if (amdgpu_sriov_vf(adev) && adev->asic_type == CHIP_SIENNA_CICHLID)
adev->pm.pp_feature &= ~PP_OVERDRIVE_MASK;
+   if (!amdgpu_device_pcie_dynamic_switching_supported())
+   adev->pm.pp_feature &= ~PP_PCIE_DPM_MASK;
 
total = true;
for (i = 0; i < adev->num_ip_blocks; i++) {
diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c 
b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
index 5a2371484a58c..11372fcc59c8f 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
@@ -1823,9 +1823,7 @@ static void smu7_init_dpm_defaults(struct pp_hwmgr *hwmgr)
 
data->mclk_dpm_key_disabled = hwmgr->feature_mask & PP_MCLK_DPM_MASK ? 
false : true;
data->sclk_dpm_key_disabled = hwmgr->feature_mask & PP_SCLK_DPM_MASK ? 
false : true;
-   data->pcie_dpm_key_disabled =
-   !amdgpu_device_pcie_dynamic_switching_supported() ||
-   !(hwmgr->feature_mask & PP_PCIE_DPM_MASK);
+   data->pcie_dpm_key_disabled = !(hwmgr->feature_mask & PP_PCIE_DPM_MASK);
/* need to set voltage control types before EVV patching */
data->voltage_control = SMU7_VOLTAGE_CONTROL_NONE;
data->vddci_control = SMU7_VOLTAGE_CONTROL_NONE;
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c 
b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
index 0cc5d9769d382..a7f4f82d23b4b 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
@@ -2108,7 +2108,7 @@ static int sienna_cichlid_update_pcie_parameters(struct 
smu_context *smu,
min_lane_width = min_lane_width > max_lane_width ?
 max_lane_width : min_lane_width;
 
-   if (!amdgpu_device_pcie_dynamic_switching_supported()) {
+   if (!(smu->adev->pm.pp_feature & PP_PCIE_DPM_MASK)) {
pcie_table->pcie_gen[0] = max_gen_speed;
pcie_table->pcie_lane[0] = max_lane_width;
} else {
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c 
b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
index a280c1ed007f6..4aeb84572e5b8 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
@@ -2430,7 +2430,7 @@ int smu_v13_0_update_pcie_parameters(struct smu_context 
*smu,
uint32_t smu_pcie_arg;
int ret, i;
 
-   if (!amdgpu_device_pcie_dynamic_switching_supported()) {
+   if (!(smu->adev->pm.pp_feature & PP_PCIE_DPM_MASK)) {
if (pcie_table->pcie_gen[num_of_levels - 1] < pcie_gen_cap)
pcie_gen_cap = pcie_table->pcie_gen[num_of_levels - 1];
 
-- 
2.42.0

[PATCH AUTOSEL 6.6 30/40] drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL

2023-11-07 Thread Sasha Levin

From: Qu Huang 

[ Upstream commit 5104fdf50d326db2c1a994f8b35dcd46e63ae4ad ]

In certain types of chips, such as VEGA20, reading the amdgpu_regs_smc file 
could result in an abnormal null pointer access when the smc_rreg pointer is 
NULL. Below are the steps to reproduce this issue and the corresponding 
exception log:

1. Navigate to the directory: /sys/kernel/debug/dri/0
2. Execute command: cat amdgpu_regs_smc
3. Exception Log::
[4005007.702554] BUG: kernel NULL pointer dereference, address: 
[4005007.702562] #PF: supervisor instruction fetch in kernel mode
[4005007.702567] #PF: error_code(0x0010) - not-present page
[4005007.702570] PGD 0 P4D 0
[4005007.702576] Oops: 0010 [#1] SMP NOPTI
[4005007.702581] CPU: 4 PID: 62563 Comm: cat Tainted: G   OE 
5.15.0-43-generic #46-Ubunt   u
[4005007.702590] RIP: 0010:0x0
[4005007.702598] Code: Unable to access opcode bytes at RIP 0xffd6.
[4005007.702600] RSP: 0018:a82b46d27da0 EFLAGS: 00010206
[4005007.702605] RAX:  RBX:  RCX: 
a82b46d27e68
[4005007.702609] RDX: 0001 RSI:  RDI: 
9940656e
[4005007.702612] RBP: a82b46d27dd8 R08:  R09: 
994060c07980
[4005007.702615] R10: 0002 R11:  R12: 
7f5e06753000
[4005007.702618] R13: 9940656e R14: a82b46d27e68 R15: 
7f5e06753000
[4005007.702622] FS:  7f5e0755b740() GS:99479d30() 
knlGS:
[4005007.702626] CS:  0010 DS:  ES:  CR0: 80050033
[4005007.702629] CR2: ffd6 CR3: 0003253fc000 CR4: 
003506e0
[4005007.702633] Call Trace:
[4005007.702636]  
[4005007.702640]  amdgpu_debugfs_regs_smc_read+0xb0/0x120 [amdgpu]
[4005007.703002]  full_proxy_read+0x5c/0x80
[4005007.703011]  vfs_read+0x9f/0x1a0
[4005007.703019]  ksys_read+0x67/0xe0
[4005007.703023]  __x64_sys_read+0x19/0x20
[4005007.703028]  do_syscall_64+0x5c/0xc0
[4005007.703034]  ? do_user_addr_fault+0x1e3/0x670
[4005007.703040]  ? exit_to_user_mode_prepare+0x37/0xb0
[4005007.703047]  ? irqentry_exit_to_user_mode+0x9/0x20
[4005007.703052]  ? irqentry_exit+0x19/0x30
[4005007.703057]  ? exc_page_fault+0x89/0x160
[4005007.703062]  ? asm_exc_page_fault+0x8/0x30
[4005007.703068]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[4005007.703075] RIP: 0033:0x7f5e07672992
[4005007.703079] Code: c0 e9 b2 fe ff ff 50 48 8d 3d fa b2 0c 00 e8 c5 1d 02 00 
0f 1f 44 00 00 f3 0f1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 
<48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 e   c 28 48 89 54 24
[4005007.703083] RSP: 002b:7ffe03097898 EFLAGS: 0246 ORIG_RAX: 

[4005007.703088] RAX: ffda RBX: 0002 RCX: 
7f5e07672992
[4005007.703091] RDX: 0002 RSI: 7f5e06753000 RDI: 
0003
[4005007.703094] RBP: 7f5e06753000 R08: 7f5e06752010 R09: 
7f5e06752010
[4005007.703096] R10: 0022 R11: 0246 R12: 
00022000
[4005007.703099] R13: 0003 R14: 0002 R15: 
0002
[4005007.703105]  
[4005007.703107] Modules linked in: nf_tables libcrc32c nfnetlink algif_hash 
af_alg binfmt_misc nls_   iso8859_1 ipmi_ssif ast intel_rapl_msr 
intel_rapl_common drm_vram_helper drm_ttm_helper amd64_edac t   tm 
edac_mce_amd kvm_amd ccp mac_hid k10temp kvm acpi_ipmi ipmi_si rapl 
sch_fq_codel ipmi_devintf ipm   i_msghandler msr parport_pc ppdev lp 
parport mtd pstore_blk efi_pstore ramoops pstore_zone reed_solo   mon 
ip_tables x_tables autofs4 ib_uverbs ib_core amdgpu(OE) amddrm_ttm_helper(OE) 
amdttm(OE) iommu_v   2 amd_sched(OE) amdkcl(OE) drm_kms_helper syscopyarea 
sysfillrect sysimgblt fb_sys_fops cec rc_coredrm igb ahci xhci_pci 
libahci i2c_piix4 i2c_algo_bit xhci_pci_renesas dca
[4005007.703184] CR2: 
[4005007.703188] ---[ end trace ac65a538d240da39 ]---
[4005007.800865] RIP: 0010:0x0
[4005007.800871] Code: Unable to access opcode bytes at RIP 0xffd6.
[4005007.800874] RSP: 0018:a82b46d27da0 EFLAGS: 00010206
[4005007.800878] RAX:  RBX:  RCX: 
a82b46d27e68
[4005007.800881] RDX: 0001 RSI:  RDI: 
9940656e
[4005007.800883] RBP: a82b46d27dd8 R08:  R09: 
994060c07980
[4005007.800886] R10: 0002 R11:  R12: 
7f5e06753000
[4005007.800888] R13: 9940656e R14: a82b46d27e68 R15: 
7f5e06753000
[4005007.800891] FS:  7f5e0755b740() GS:99479d30() 
knlGS:
[4005007.800895] CS:  0010 DS:  ES:  CR0: 80050033
[4005007.800898] CR2: ffd6 CR3: 0003253fc000 CR4: 
003506e0

Signed-off-by: Qu Huang 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 ++
 1 file changed, 6 insertions(+)

diff

[PATCH AUTOSEL 6.6 27/40] drm/amdgpu/vkms: fix a possible null pointer dereference

2023-11-07 Thread Sasha Levin

From: Ma Ke 

[ Upstream commit cd90511557fdfb394bb4ac4c3b539b007383914c ]

In amdgpu_vkms_conn_get_modes(), the return value of drm_cvt_mode()
is assigned to mode, which will lead to a NULL pointer dereference
on failure of drm_cvt_mode(). Add a check to avoid null pointer
dereference.

Signed-off-by: Ma Ke 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c
index 7148a216ae2fe..db6fc0cb18eb8 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c
@@ -239,6 +239,8 @@ static int amdgpu_vkms_conn_get_modes(struct drm_connector 
*connector)
 
for (i = 0; i < ARRAY_SIZE(common_modes); i++) {
mode = drm_cvt_mode(dev, common_modes[i].w, common_modes[i].h, 
60, false, false, false);
+   if (!mode)
+   continue;
drm_mode_probed_add(connector, mode);
}
 
-- 
2.42.0

[PATCH AUTOSEL 6.6 29/40] drm/amdkfd: Fix shift out-of-bounds issue

2023-11-07 Thread Sasha Levin

From: Jesse Zhang 

[ Upstream commit 282c1d793076c2edac6c3db51b7e8ed2b41d60a5 ]

[  567.613292] shift exponent 255 is too large for 64-bit type 'long unsigned 
int'
[  567.614498] CPU: 5 PID: 238 Comm: kworker/5:1 Tainted: G   OE  
6.2.0-34-generic #34~22.04.1-Ubuntu
[  567.614502] Hardware name: AMD Splinter/Splinter-RPL, BIOS WS43927N_871 
09/25/2023
[  567.614504] Workqueue: events send_exception_work_handler [amdgpu]
[  567.614748] Call Trace:
[  567.614750]  
[  567.614753]  dump_stack_lvl+0x48/0x70
[  567.614761]  dump_stack+0x10/0x20
[  567.614763]  __ubsan_handle_shift_out_of_bounds+0x156/0x310
[  567.614769]  ? srso_alias_return_thunk+0x5/0x7f
[  567.614773]  ? update_sd_lb_stats.constprop.0+0xf2/0x3c0
[  567.614780]  svm_range_split_by_granularity.cold+0x2b/0x34 [amdgpu]
[  567.615047]  ? srso_alias_return_thunk+0x5/0x7f
[  567.615052]  svm_migrate_to_ram+0x185/0x4d0 [amdgpu]
[  567.615286]  do_swap_page+0x7b6/0xa30
[  567.615291]  ? srso_alias_return_thunk+0x5/0x7f
[  567.615294]  ? __free_pages+0x119/0x130
[  567.615299]  handle_pte_fault+0x227/0x280
[  567.615303]  __handle_mm_fault+0x3c0/0x720
[  567.615311]  handle_mm_fault+0x119/0x330
[  567.615314]  ? lock_mm_and_find_vma+0x44/0x250
[  567.615318]  do_user_addr_fault+0x1a9/0x640
[  567.615323]  exc_page_fault+0x81/0x1b0
[  567.615328]  asm_exc_page_fault+0x27/0x30
[  567.615332] RIP: 0010:__get_user_8+0x1c/0x30

Signed-off-by: Jesse Zhang 
Suggested-by: Philip Yang 
Reviewed-by: Yifan Zhang 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c 
b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
index 175090be3760c..84fbf1118d426 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -767,7 +767,7 @@ svm_range_apply_attrs(struct kfd_process *p, struct 
svm_range *prange,
prange->flags &= ~attrs[i].value;
break;
case KFD_IOCTL_SVM_ATTR_GRANULARITY:
-   prange->granularity = attrs[i].value;
+   prange->granularity = min_t(uint32_t, attrs[i].value, 
0x3F);
break;
default:
WARN_ONCE(1, "svm_range_check_attrs wasn't called?");
-- 
2.42.0

[PATCH AUTOSEL 6.6 26/40] drm/radeon: fix a possible null pointer dereference

2023-11-07 Thread Sasha Levin

From: Ma Ke 

[ Upstream commit 2c1fe3c480f9e1deefd50d4b18be4a046011ee1f ]

In radeon_tv_get_modes(), the return value of drm_cvt_mode()
is assigned to mode, which will lead to a NULL pointer
dereference on failure of drm_cvt_mode(). Add a check to
avoid null point dereference.

Signed-off-by: Ma Ke 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/radeon/radeon_connectors.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c 
b/drivers/gpu/drm/radeon/radeon_connectors.c
index d2f02c3dfce29..b84b58926106a 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1119,6 +1119,8 @@ static int radeon_tv_get_modes(struct drm_connector 
*connector)
else {
/* only 800x600 is supported right now on pre-avivo chips */
tv_mode = drm_cvt_mode(dev, 800, 600, 60, false, false, false);
+   if (!tv_mode)
+   return 0;
tv_mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
drm_mode_probed_add(connector, tv_mode);
}
-- 
2.42.0

[PATCH AUTOSEL 6.6 23/40] drm/amdgpu: Fix potential null pointer derefernce

2023-11-07 Thread Sasha Levin

From: "Stanley.Yang" 

[ Upstream commit 80285ae1ec8717b597b20de38866c29d84d321a1 ]

The amdgpu_ras_get_context may return NULL if device
not support ras feature, so add check before using.

Signed-off-by: Stanley.Yang 
Reviewed-by: Tao Zhou 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 2b8356699f235..69f72bca229c9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -5183,7 +5183,8 @@ int amdgpu_device_gpu_recover(struct amdgpu_device *adev,
 * Flush RAM to disk so that after reboot
 * the user can read log and see why the system rebooted.
 */
-   if (need_emergency_restart && amdgpu_ras_get_context(adev)->reboot) {
+   if (need_emergency_restart && amdgpu_ras_get_context(adev) &&
+   amdgpu_ras_get_context(adev)->reboot) {
DRM_WARN("Emergency reboot.");
 
ksys_sync_helper();
-- 
2.42.0

[PATCH AUTOSEL 6.6 22/40] drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit 0f0e59075b5c22f1e871fbd508d6e4f495048356 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2036742
Signed-off-by: Mario Limonciello 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 .../gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h| 12 ++--
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h 
b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
index 57bca1e81d3a7..9fcad69a9f344 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
@@ -164,7 +164,7 @@ typedef struct _ATOM_Tonga_State {
 typedef struct _ATOM_Tonga_State_Array {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number of entries. */
-   ATOM_Tonga_State entries[1];/* Dynamically allocate entries. */
+   ATOM_Tonga_State entries[]; /* Dynamically allocate entries. */
 } ATOM_Tonga_State_Array;
 
 typedef struct _ATOM_Tonga_MCLK_Dependency_Record {
@@ -210,7 +210,7 @@ typedef struct _ATOM_Polaris_SCLK_Dependency_Record {
 typedef struct _ATOM_Polaris_SCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Polaris_SCLK_Dependency_Record entries[1]; 
 /* Dynamically allocate entries. */
+   ATOM_Polaris_SCLK_Dependency_Record entries[];  
 /* Dynamically allocate entries. */
 } ATOM_Polaris_SCLK_Dependency_Table;
 
 typedef struct _ATOM_Tonga_PCIE_Record {
@@ -222,7 +222,7 @@ typedef struct _ATOM_Tonga_PCIE_Record {
 typedef struct _ATOM_Tonga_PCIE_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_PCIE_Record entries[1];  
/* Dynamically allocate entries. */
+   ATOM_Tonga_PCIE_Record entries[];   
/* Dynamically allocate entries. */
 } ATOM_Tonga_PCIE_Table;
 
 typedef struct _ATOM_Polaris10_PCIE_Record {
@@ -235,7 +235,7 @@ typedef struct _ATOM_Polaris10_PCIE_Record {
 typedef struct _ATOM_Polaris10_PCIE_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number 
of entries. */
-   ATOM_Polaris10_PCIE_Record entries[1];  /* 
Dynamically allocate entries. */
+   ATOM_Polaris10_PCIE_Record entries[];  /* 
Dynamically allocate entries. */
 } ATOM_Polaris10_PCIE_Table;
 
 
@@ -252,7 +252,7 @@ typedef struct _ATOM_Tonga_MM_Dependency_Record {
 typedef struct _ATOM_Tonga_MM_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_MM_Dependency_Record entries[1];/* 
Dynamically allocate entries. */
+   ATOM_Tonga_MM_Dependency_Record entries[]; /* 
Dynamically allocate entries. */
 } ATOM_Tonga_MM_Dependency_Table;
 
 typedef struct _ATOM_Tonga_Voltage_Lookup_Record {
@@ -265,7 +265,7 @@ typedef struct _ATOM_Tonga_Voltage_Lookup_Record {
 typedef struct _ATOM_Tonga_Voltage_Lookup_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_Voltage_Lookup_Record entries[1];
/* Dynamically allocate entries. */
+   ATOM_Tonga_Voltage_Lookup_Record entries[]; 
/* Dynamically allocate entries. */
 } ATOM_Tonga_Voltage_Lookup_Table;
 
 typedef struct _ATOM_Tonga_Fan_Table {
-- 
2.42.0

[PATCH AUTOSEL 6.6 21/40] drm/radeon: Fix UBSAN array-index-out-of-bounds for Radeon HD 5430

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit c63079c61177ba1b17fa05c6875699a36924fe39 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Suggested-by: Felix Held 
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2894
Signed-off-by: Mario Limonciello 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/radeon/pptable.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/radeon/pptable.h b/drivers/gpu/drm/radeon/pptable.h
index 4c2eec49dadc9..94947229888ba 100644
--- a/drivers/gpu/drm/radeon/pptable.h
+++ b/drivers/gpu/drm/radeon/pptable.h
@@ -74,7 +74,7 @@ typedef struct _ATOM_PPLIB_THERMALCONTROLLER
 typedef struct _ATOM_PPLIB_STATE
 {
 UCHAR ucNonClockStateIndex;
-UCHAR ucClockStateIndices[1]; // variable-sized
+UCHAR ucClockStateIndices[]; // variable-sized
 } ATOM_PPLIB_STATE;
 
 
-- 
2.42.0

[PATCH AUTOSEL 6.6 20/40] drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit 760efbca74a405dc439a013a5efaa9fadc95a8c3 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Suggested-by: Felix Held 
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2874
Signed-off-by: Mario Limonciello 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/include/pptable.h | 4 ++--
 drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/include/pptable.h 
b/drivers/gpu/drm/amd/include/pptable.h
index 0b6a057e0a4c4..5aac8d545bdc6 100644
--- a/drivers/gpu/drm/amd/include/pptable.h
+++ b/drivers/gpu/drm/amd/include/pptable.h
@@ -78,7 +78,7 @@ typedef struct _ATOM_PPLIB_THERMALCONTROLLER
 typedef struct _ATOM_PPLIB_STATE
 {
 UCHAR ucNonClockStateIndex;
-UCHAR ucClockStateIndices[1]; // variable-sized
+UCHAR ucClockStateIndices[]; // variable-sized
 } ATOM_PPLIB_STATE;
 
 
@@ -473,7 +473,7 @@ typedef struct _ATOM_PPLIB_STATE_V2
   /**
   * Driver will read the first ucNumDPMLevels in this array
   */
-  UCHAR clockInfoIndex[1];
+  UCHAR clockInfoIndex[];
 } ATOM_PPLIB_STATE_V2;
 
 typedef struct _StateArray{
diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h 
b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
index 7a31cfa5e7fb4..57bca1e81d3a7 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
@@ -179,7 +179,7 @@ typedef struct _ATOM_Tonga_MCLK_Dependency_Record {
 typedef struct _ATOM_Tonga_MCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_MCLK_Dependency_Record entries[1];   
/* Dynamically allocate entries. */
+   ATOM_Tonga_MCLK_Dependency_Record entries[];
/* Dynamically allocate entries. */
 } ATOM_Tonga_MCLK_Dependency_Table;
 
 typedef struct _ATOM_Tonga_SCLK_Dependency_Record {
@@ -194,7 +194,7 @@ typedef struct _ATOM_Tonga_SCLK_Dependency_Record {
 typedef struct _ATOM_Tonga_SCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; 
/* Number of entries. */
-   ATOM_Tonga_SCLK_Dependency_Record entries[1];   
 /* Dynamically allocate entries. */
+   ATOM_Tonga_SCLK_Dependency_Record entries[];
 /* Dynamically allocate entries. */
 } ATOM_Tonga_SCLK_Dependency_Table;
 
 typedef struct _ATOM_Polaris_SCLK_Dependency_Record {
-- 
2.42.0

[PATCH AUTOSEL 6.6 13/40] drm/amd/display: use full update for clip size increase of large plane source

2023-11-07 Thread Sasha Levin

From: Wenjing Liu 

[ Upstream commit 05b78277ef0efc1deebc8a22384fffec29a3676e ]

[why]
Clip size increase will increase viewport, which could cause us to
switch  to MPC combine.
If we skip full update, we are not able to change to MPC combine in
fast update. This will cause corruption showing on the video plane.

[how]
treat clip size increase of a surface larger than 5k as a full update.

Reviewed-by: Jun Lei 
Acked-by: Aurabindo Pillai 
Signed-off-by: Wenjing Liu 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/display/dc/core/dc.c | 12 ++--
 drivers/gpu/drm/amd/display/dc/dc.h  |  5 +
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c 
b/drivers/gpu/drm/amd/display/dc/core/dc.c
index 14c3c1907b953..38abbd0c9d997 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -990,7 +990,8 @@ static bool dc_construct(struct dc *dc,
/* set i2c speed if not done by the respective dcnxxx__resource.c */
if (dc->caps.i2c_speed_in_khz_hdcp == 0)
dc->caps.i2c_speed_in_khz_hdcp = dc->caps.i2c_speed_in_khz;
-
+   if (dc->caps.max_optimizable_video_width == 0)
+   dc->caps.max_optimizable_video_width = 5120;
dc->clk_mgr = dc_clk_mgr_create(dc->ctx, dc->res_pool->pp_smu, 
dc->res_pool->dccg);
if (!dc->clk_mgr)
goto fail;
@@ -2442,6 +2443,7 @@ static enum surface_update_type 
get_plane_info_update_type(const struct dc_surfa
 }
 
 static enum surface_update_type get_scaling_info_update_type(
+   const struct dc *dc,
const struct dc_surface_update *u)
 {
union surface_update_flags *update_flags = >surface->update_flags;
@@ -2474,6 +2476,12 @@ static enum surface_update_type 
get_scaling_info_update_type(
update_flags->bits.clock_change = 1;
}
 
+   if (u->scaling_info->src_rect.width > 
dc->caps.max_optimizable_video_width &&
+   (u->scaling_info->clip_rect.width > u->surface->clip_rect.width 
||
+u->scaling_info->clip_rect.height > 
u->surface->clip_rect.height))
+/* Changing clip size of a large surface may result in MPC 
slice count change */
+   update_flags->bits.bandwidth_change = 1;
+
if (u->scaling_info->src_rect.x != u->surface->src_rect.x
|| u->scaling_info->src_rect.y != u->surface->src_rect.y
|| u->scaling_info->clip_rect.x != 
u->surface->clip_rect.x
@@ -2511,7 +2519,7 @@ static enum surface_update_type det_surface_update(const 
struct dc *dc,
type = get_plane_info_update_type(u);
elevate_update_type(_type, type);
 
-   type = get_scaling_info_update_type(u);
+   type = get_scaling_info_update_type(dc, u);
elevate_update_type(_type, type);
 
if (u->flip_addr) {
diff --git a/drivers/gpu/drm/amd/display/dc/dc.h 
b/drivers/gpu/drm/amd/display/dc/dc.h
index 31e3183497a7f..c05e91b257ace 100644
--- a/drivers/gpu/drm/amd/display/dc/dc.h
+++ b/drivers/gpu/drm/amd/display/dc/dc.h
@@ -231,6 +231,11 @@ struct dc_caps {
uint32_t dmdata_alloc_size;
unsigned int max_cursor_size;
unsigned int max_video_width;
+   /*
+* max video plane width that can be safely assumed to be always
+* supported by single DPP pipe.
+*/
+   unsigned int max_optimizable_video_width;
unsigned int min_horizontal_blanking_period;
int linear_pitch_alignment;
bool dcc_const_color;
-- 
2.42.0

[PATCH AUTOSEL 6.6 12/40] drm/amd: Update `update_pcie_parameters` functions to use uint8_t arguments

2023-11-07 Thread Sasha Levin

From: Mario Limonciello 

[ Upstream commit 7752ccf85b929a22e658ec145283e8f31232f4bb ]

The matching values for `pcie_gen_cap` and `pcie_width_cap` when
fetched from powerplay tables are 1 byte, so narrow the arguments
to match to ensure min() and max() comparisons without casts.

Signed-off-by: Mario Limonciello 
Acked-by: Christian König 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c   | 2 +-
 drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h   | 2 +-
 drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h| 4 ++--
 drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 4 ++--
 drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 8 
 drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c  | 4 ++--
 6 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c 
b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
index f005a90c35af4..b47fd42414f46 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
@@ -1232,7 +1232,7 @@ static int smu_smc_hw_setup(struct smu_context *smu)
 {
struct smu_feature *feature = >smu_feature;
struct amdgpu_device *adev = smu->adev;
-   uint32_t pcie_gen = 0, pcie_width = 0;
+   uint8_t pcie_gen = 0, pcie_width = 0;
uint64_t features_supported;
int ret = 0;
 
diff --git a/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h 
b/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h
index 5a52098bcf166..72ed836328966 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h
+++ b/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h
@@ -844,7 +844,7 @@ struct pptable_funcs {
 * _gen_cap: Maximum allowed PCIe generation.
 * _width_cap: Maximum allowed PCIe width.
 */
-   int (*update_pcie_parameters)(struct smu_context *smu, uint32_t 
pcie_gen_cap, uint32_t pcie_width_cap);
+   int (*update_pcie_parameters)(struct smu_context *smu, uint8_t 
pcie_gen_cap, uint8_t pcie_width_cap);
 
/**
 * @i2c_init: Initialize i2c.
diff --git a/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h 
b/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h
index 355c156d871af..cc02f979e9e98 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h
+++ b/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h
@@ -296,8 +296,8 @@ int smu_v13_0_get_pptable_from_firmware(struct smu_context 
*smu,
uint32_t pptable_id);
 
 int smu_v13_0_update_pcie_parameters(struct smu_context *smu,
-uint32_t pcie_gen_cap,
-uint32_t pcie_width_cap);
+uint8_t pcie_gen_cap,
+uint8_t pcie_width_cap);
 
 #endif
 #endif
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c 
b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c
index 18487ae10bcff..c564f6e191f84 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c
@@ -2376,8 +2376,8 @@ static int navi10_get_power_limit(struct smu_context *smu,
 }
 
 static int navi10_update_pcie_parameters(struct smu_context *smu,
-uint32_t pcie_gen_cap,
-uint32_t pcie_width_cap)
+uint8_t pcie_gen_cap,
+uint8_t pcie_width_cap)
 {
struct smu_11_0_dpm_context *dpm_context = smu->smu_dpm.dpm_context;
PPTable_t *pptable = smu->smu_table.driver_pptable;
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c 
b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
index da2860da60188..0cc5d9769d382 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
@@ -2085,14 +2085,14 @@ static int 
sienna_cichlid_display_disable_memory_clock_switch(struct smu_context
 #define MAX(a, b)  ((a) > (b) ? (a) : (b))
 
 static int sienna_cichlid_update_pcie_parameters(struct smu_context *smu,
-uint32_t pcie_gen_cap,
-uint32_t pcie_width_cap)
+uint8_t pcie_gen_cap,
+uint8_t pcie_width_cap)
 {
struct smu_11_0_dpm_context *dpm_context = smu->smu_dpm.dpm_context;
struct smu_11_0_pcie_table *pcie_table = 
_context->dpm_tables.pcie_table;
uint8_t *table_member1, *table_member2;
-   uint32_t min_gen_speed, max_gen_speed;
-   uint32_t min_lane_width, max_lane_width;
+   uint8_t min_gen_speed, max_gen_speed;
+   uint8_t min_lane_width, max_lane_width;
uint32_t smu_pcie_arg;
int ret, i;
 
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c 
b/drivers/gpu/d

[PATCH AUTOSEL 6.6 11/40] drm/amdgpu: update retry times for psp vmbx wait

2023-11-07 Thread Sasha Levin

From: Tao Zhou 

[ Upstream commit fc598890715669ff794b253fdf387cd02b9396f8 ]

Increase the retry loops and replace the constant number with macro.

Signed-off-by: Tao Zhou 
Reviewed-by: Hawking Zhang 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/psp_v13_0.c | 5 -
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/psp_v13_0.c 
b/drivers/gpu/drm/amd/amdgpu/psp_v13_0.c
index 469eed084976c..52d80f286b3dd 100644
--- a/drivers/gpu/drm/amd/amdgpu/psp_v13_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/psp_v13_0.c
@@ -59,6 +59,9 @@ MODULE_FIRMWARE("amdgpu/psp_14_0_0_ta.bin");
 /* Read USB-PD from LFB */
 #define GFX_CMD_USB_PD_USE_LFB 0x480
 
+/* Retry times for vmbx ready wait */
+#define PSP_VMBX_POLLING_LIMIT 2
+
 /* VBIOS gfl defines */
 #define MBOX_READY_MASK 0x8000
 #define MBOX_STATUS_MASK 0x
@@ -138,7 +141,7 @@ static int psp_v13_0_wait_for_vmbx_ready(struct psp_context 
*psp)
struct amdgpu_device *adev = psp->adev;
int retry_loop, ret;
 
-   for (retry_loop = 0; retry_loop < 70; retry_loop++) {
+   for (retry_loop = 0; retry_loop < PSP_VMBX_POLLING_LIMIT; retry_loop++) 
{
/* Wait for bootloader to signify that is
   ready having bit 31 of C2PMSG_33 set to 1 */
ret = psp_wait_for(
-- 
2.42.0

[PATCH AUTOSEL 6.6 10/40] drm/amdkfd: Fix a race condition of vram buffer unref in svm code

2023-11-07 Thread Sasha Levin

From: Xiaogang Chen 

[ Upstream commit 709c348261618da7ed89d6c303e2ceb9e453ba74 ]

prange->svm_bo unref can happen in both mmu callback and a callback after
migrate to system ram. Both are async call in different tasks. Sync svm_bo
unref operation to avoid random "use-after-free".

Signed-off-by: Xiaogang Chen 
Reviewed-by: Philip Yang 
Reviewed-by: Jesse Zhang 
Tested-by: Jesse Zhang 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 11 +--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c 
b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
index bb16b795d1bc2..175090be3760c 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -628,8 +628,15 @@ svm_range_vram_node_new(struct kfd_node *node, struct 
svm_range *prange,
 
 void svm_range_vram_node_free(struct svm_range *prange)
 {
-   svm_range_bo_unref(prange->svm_bo);
-   prange->ttm_res = NULL;
+   /* serialize prange->svm_bo unref */
+   mutex_lock(>lock);
+   /* prange->svm_bo has not been unref */
+   if (prange->ttm_res) {
+   prange->ttm_res = NULL;
+   mutex_unlock(>lock);
+   svm_range_bo_unref(prange->svm_bo);
+   } else
+   mutex_unlock(>lock);
 }
 
 struct kfd_node *
-- 
2.42.0

[PATCH AUTOSEL 6.6 09/40] drm/amdgpu: not to save bo in the case of RAS err_event_athub

2023-11-07 Thread Sasha Levin

From: "David (Ming Qiang) Wu" 

[ Upstream commit fa1f1cc09d588a90c8ce3f507c47df257461d148 ]

err_event_athub will corrupt VCPU buffer and not good to
be restored in amdgpu_vcn_resume() and in this case
the VCPU buffer needs to be cleared for VCN firmware to
work properly.

Acked-by: Leo Liu 
Signed-off-by: David (Ming Qiang) Wu 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 7 +++
 1 file changed, 7 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
index 36b55d2bd51a9..03b4bcfca1963 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
@@ -292,8 +292,15 @@ int amdgpu_vcn_suspend(struct amdgpu_device *adev)
void *ptr;
int i, idx;
 
+   bool in_ras_intr = amdgpu_ras_intr_triggered();
+
cancel_delayed_work_sync(>vcn.idle_work);
 
+   /* err_event_athub will corrupt VCPU buffer, so we need to
+* restore fw data and clear buffer in amdgpu_vcn_resume() */
+   if (in_ras_intr)
+   return 0;
+
for (i = 0; i < adev->vcn.num_vcn_inst; ++i) {
if (adev->vcn.harvest_config & (1 << i))
continue;
-- 
2.42.0

[PATCH AUTOSEL 6.6 06/40] drm/amd/display: add seamless pipe topology transition check

2023-11-07 Thread Sasha Levin

From: Wenjing Liu 

[ Upstream commit 15c6798ae26d5c7a7776f4f7d0c1fa8c462688a2 ]

[why]
We have a few cases where we need to perform update topology update
in dc update interface. However some of the updates are not seamless
This could cause user noticible glitches. To enforce seamless transition
we are adding a checking condition and error logging so the corruption
as result of non seamless transition can be easily spotted.

Reviewed-by: Dillon Varone 
Acked-by: Stylon Wang 
Signed-off-by: Wenjing Liu 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/display/dc/core/dc.c  |  8 +++
 .../drm/amd/display/dc/dcn32/dcn32_hwseq.c| 52 +++
 .../drm/amd/display/dc/dcn32/dcn32_hwseq.h|  4 ++
 .../gpu/drm/amd/display/dc/dcn32/dcn32_init.c |  1 +
 .../gpu/drm/amd/display/dc/inc/hw_sequencer.h |  3 ++
 5 files changed, 68 insertions(+)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c 
b/drivers/gpu/drm/amd/display/dc/core/dc.c
index 3b9d6fa50d170..14c3c1907b953 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -4328,6 +4328,14 @@ bool dc_update_planes_and_stream(struct dc *dc,
update_type,
context);
} else {
+   if (!stream_update &&
+   dc->hwss.is_pipe_topology_transition_seamless &&
+   !dc->hwss.is_pipe_topology_transition_seamless(
+   dc, dc->current_state, 
context)) {
+
+   DC_LOG_ERROR("performing non-seamless pipe topology 
transition with surface only update!\n");
+   BREAK_TO_DEBUGGER();
+   }
commit_planes_for_stream(
dc,
srf_updates,
diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c 
b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c
index cae5e1e68c860..018376146d977 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c
@@ -1619,3 +1619,55 @@ void dcn32_blank_phantom(struct dc *dc,
if (tg->funcs->is_tg_enabled(tg))
hws->funcs.wait_for_blank_complete(opp);
 }
+
+bool dcn32_is_pipe_topology_transition_seamless(struct dc *dc,
+   const struct dc_state *cur_ctx,
+   const struct dc_state *new_ctx)
+{
+   int i;
+   const struct pipe_ctx *cur_pipe, *new_pipe;
+   bool is_seamless = true;
+
+   for (i = 0; i < dc->res_pool->pipe_count; i++) {
+   cur_pipe = _ctx->res_ctx.pipe_ctx[i];
+   new_pipe = _ctx->res_ctx.pipe_ctx[i];
+
+   if (resource_is_pipe_type(cur_pipe, FREE_PIPE) ||
+   resource_is_pipe_type(new_pipe, FREE_PIPE))
+   /* adding or removing free pipes is always seamless */
+   continue;
+   else if (resource_is_pipe_type(cur_pipe, OTG_MASTER)) {
+   if (resource_is_pipe_type(new_pipe, OTG_MASTER))
+   if (cur_pipe->stream->stream_id == 
new_pipe->stream->stream_id)
+   /* OTG master with the same stream is seamless 
*/
+   continue;
+   } else if (resource_is_pipe_type(cur_pipe, OPP_HEAD)) {
+   if (resource_is_pipe_type(new_pipe, OPP_HEAD)) {
+   if (cur_pipe->stream_res.tg == 
new_pipe->stream_res.tg)
+   /*
+* OPP heads sharing the same timing
+* generator is seamless
+*/
+   continue;
+   }
+   } else if (resource_is_pipe_type(cur_pipe, DPP_PIPE)) {
+   if (resource_is_pipe_type(new_pipe, DPP_PIPE)) {
+   if (cur_pipe->stream_res.opp == 
new_pipe->stream_res.opp)
+   /*
+* DPP pipes sharing the same OPP head 
is
+* seamless
+*/
+   continue;
+   }
+   }
+
+   /*
+* This pipe's transition doesn't fall under any seamless
+* conditions
+*/
+   is_seamless = false;
+   break;
+   }
+
+   return is_seamless;
+}
diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.h 
b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.h
index 616d5219119e9..9992e40a

[PATCH AUTOSEL 6.6 05/40] drm/amd/display: Don't lock phantom pipe on disabling

2023-11-07 Thread Sasha Levin

From: Alvin Lee 

[ Upstream commit cbb4c9bc55427774ca4d819933e1b5fa38a6fb44 ]

[Description]
- When disabling a phantom pipe, we first enable the phantom
  OTG so the double buffer update can successfully take place
- However, want to avoid locking the phantom otherwise setting
  DPG_EN=1 for the phantom pipe is blocked (without this we could
  hit underflow due to phantom HUBP being blanked by default)

Reviewed-by: Samson Tam 
Acked-by: Stylon Wang 
Signed-off-by: Alvin Lee 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c 
b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index 9834b75f1837b..79befa17bb037 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -111,7 +111,8 @@ void dcn10_lock_all_pipes(struct dc *dc,
if (pipe_ctx->top_pipe ||
!pipe_ctx->stream ||
(!pipe_ctx->plane_state && !old_pipe_ctx->plane_state) ||
-   !tg->funcs->is_tg_enabled(tg))
+   !tg->funcs->is_tg_enabled(tg) ||
+   pipe_ctx->stream->mall_stream_config.type == 
SUBVP_PHANTOM)
continue;
 
if (lock)
-- 
2.42.0

[PATCH AUTOSEL 6.6 04/40] drm/amd/display: Blank phantom OTG before enabling

2023-11-07 Thread Sasha Levin

From: Alvin Lee 

[ Upstream commit e87a6c5b7780b5f423797351eb586ed96cc6d151 ]

[Description]
Before enabling the phantom OTG for an update we
must enable DPG to avoid underflow.

Reviewed-by: Samson Tam 
Acked-by: Stylon Wang 
Signed-off-by: Alvin Lee 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/display/dc/core/dc.c  | 50 +--
 .../drm/amd/display/dc/dcn20/dcn20_hwseq.c| 10 +++-
 .../drm/amd/display/dc/dcn32/dcn32_hwseq.c| 46 +
 .../drm/amd/display/dc/dcn32/dcn32_hwseq.h|  5 ++
 .../gpu/drm/amd/display/dc/dcn32/dcn32_init.c |  1 +
 .../gpu/drm/amd/display/dc/inc/hw_sequencer.h |  5 ++
 6 files changed, 68 insertions(+), 49 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c 
b/drivers/gpu/drm/amd/display/dc/core/dc.c
index d08e60dff46de..3b9d6fa50d170 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -1069,53 +1069,6 @@ static void apply_ctx_interdependent_lock(struct dc *dc,
}
 }
 
-static void phantom_pipe_blank(
-   struct dc *dc,
-   struct timing_generator *tg,
-   int width,
-   int height)
-{
-   struct dce_hwseq *hws = dc->hwseq;
-   enum dc_color_space color_space;
-   struct tg_color black_color = {0};
-   struct output_pixel_processor *opp = NULL;
-   uint32_t num_opps, opp_id_src0, opp_id_src1;
-   uint32_t otg_active_width, otg_active_height;
-   uint32_t i;
-
-   /* program opp dpg blank color */
-   color_space = COLOR_SPACE_SRGB;
-   color_space_to_black_color(dc, color_space, _color);
-
-   otg_active_width = width;
-   otg_active_height = height;
-
-   /* get the OPTC source */
-   tg->funcs->get_optc_source(tg, _opps, _id_src0, _id_src1);
-   ASSERT(opp_id_src0 < dc->res_pool->res_cap->num_opp);
-
-   for (i = 0; i < dc->res_pool->res_cap->num_opp; i++) {
-   if (dc->res_pool->opps[i] != NULL && 
dc->res_pool->opps[i]->inst == opp_id_src0) {
-   opp = dc->res_pool->opps[i];
-   break;
-   }
-   }
-
-   if (opp && opp->funcs->opp_set_disp_pattern_generator)
-   opp->funcs->opp_set_disp_pattern_generator(
-   opp,
-   CONTROLLER_DP_TEST_PATTERN_SOLID_COLOR,
-   CONTROLLER_DP_COLOR_SPACE_UDEFINED,
-   COLOR_DEPTH_UNDEFINED,
-   _color,
-   otg_active_width,
-   otg_active_height,
-   0);
-
-   if (tg->funcs->is_tg_enabled(tg))
-   hws->funcs.wait_for_blank_complete(opp);
-}
-
 static void dc_update_viusal_confirm_color(struct dc *dc, struct dc_state 
*context, struct pipe_ctx *pipe_ctx)
 {
if (dc->ctx->dce_version >= DCN_VERSION_1_0) {
@@ -1206,7 +1159,8 @@ static void disable_dangling_plane(struct dc *dc, struct 
dc_state *context)
 
main_pipe_width = 
old_stream->mall_stream_config.paired_stream->dst.width;
main_pipe_height = 
old_stream->mall_stream_config.paired_stream->dst.height;
-   phantom_pipe_blank(dc, tg, 
main_pipe_width, main_pipe_height);
+   if (dc->hwss.blank_phantom)
+   dc->hwss.blank_phantom(dc, tg, 
main_pipe_width, main_pipe_height);
tg->funcs->enable_crtc(tg);
}
}
diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c 
b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
index aeadc587433fd..a2e1ca3b93e86 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
@@ -1830,8 +1830,16 @@ void dcn20_program_front_end_for_ctx(

dc->current_state->res_ctx.pipe_ctx[i].stream->mall_stream_config.type == 
SUBVP_PHANTOM) {
struct timing_generator *tg = 
dc->current_state->res_ctx.pipe_ctx[i].stream_res.tg;
 
-   if (tg->funcs->enable_crtc)
+   if (tg->funcs->enable_crtc) {
+   if (dc->hwss.blank_phantom) {
+   int main_pipe_width, main_pipe_height;
+
+   main_pipe_width = 
dc->current_state->res_ctx.pipe_ctx[i].stream->mall_stream_config.paired_stream->dst.width;
+   main_pipe_height = 
dc->current

[PATCH AUTOSEL 6.6 02/40] drm/amdkfd: ratelimited SQ interrupt messages

2023-11-07 Thread Sasha Levin

From: Harish Kasiviswanathan 

[ Upstream commit 37fb87910724f21a1f27a75743d4f9accdee77fb ]

No functional change. Use ratelimited version of pr_ to avoid
overflowing of dmesg buffer

Signed-off-by: Harish Kasiviswanathan 
Reviewed-by: Philip Yang 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdkfd/kfd_int_process_v10.c | 6 +++---
 drivers/gpu/drm/amd/amdkfd/kfd_int_process_v11.c | 6 +++---
 drivers/gpu/drm/amd/amdkfd/kfd_int_process_v9.c  | 6 +++---
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_int_process_v10.c 
b/drivers/gpu/drm/amd/amdkfd/kfd_int_process_v10.c
index c7991e07b6be5..a7697ec8188e0 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_int_process_v10.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_int_process_v10.c
@@ -268,7 +268,7 @@ static void event_interrupt_wq_v10(struct kfd_node *dev,
SQ_INTERRUPT_WORD_WAVE_CTXID1, 
ENCODING);
switch (encoding) {
case SQ_INTERRUPT_WORD_ENCODING_AUTO:
-   pr_debug(
+   pr_debug_ratelimited(
"sq_intr: auto, se %d, ttrace %d, wlt 
%d, ttrac_buf0_full %d, ttrac_buf1_full %d, ttrace_utc_err %d\n",
REG_GET_FIELD(context_id1, 
SQ_INTERRUPT_WORD_AUTO_CTXID1,
SE_ID),
@@ -284,7 +284,7 @@ static void event_interrupt_wq_v10(struct kfd_node *dev,

THREAD_TRACE_UTC_ERROR));
break;
case SQ_INTERRUPT_WORD_ENCODING_INST:
-   pr_debug("sq_intr: inst, se %d, data 0x%x, sa 
%d, priv %d, wave_id %d, simd_id %d, wgp_id %d\n",
+   pr_debug_ratelimited("sq_intr: inst, se %d, 
data 0x%x, sa %d, priv %d, wave_id %d, simd_id %d, wgp_id %d\n",
REG_GET_FIELD(context_id1, 
SQ_INTERRUPT_WORD_WAVE_CTXID1,
SE_ID),
REG_GET_FIELD(context_id0, 
SQ_INTERRUPT_WORD_WAVE_CTXID0,
@@ -310,7 +310,7 @@ static void event_interrupt_wq_v10(struct kfd_node *dev,
case SQ_INTERRUPT_WORD_ENCODING_ERROR:
sq_intr_err_type = REG_GET_FIELD(context_id0, 
KFD_CTXID0,
ERR_TYPE);
-   pr_warn("sq_intr: error, se %d, data 0x%x, sa 
%d, priv %d, wave_id %d, simd_id %d, wgp_id %d, err_type %d\n",
+   pr_warn_ratelimited("sq_intr: error, se %d, 
data 0x%x, sa %d, priv %d, wave_id %d, simd_id %d, wgp_id %d, err_type %d\n",
REG_GET_FIELD(context_id1, 
SQ_INTERRUPT_WORD_WAVE_CTXID1,
SE_ID),
REG_GET_FIELD(context_id0, 
SQ_INTERRUPT_WORD_WAVE_CTXID0,
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_int_process_v11.c 
b/drivers/gpu/drm/amd/amdkfd/kfd_int_process_v11.c
index f933bd231fb9c..2a65792fd1162 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_int_process_v11.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_int_process_v11.c
@@ -150,7 +150,7 @@ enum SQ_INTERRUPT_ERROR_TYPE {
 
 static void print_sq_intr_info_auto(uint32_t context_id0, uint32_t context_id1)
 {
-   pr_debug(
+   pr_debug_ratelimited(
"sq_intr: auto, ttrace %d, wlt %d, ttrace_buf_full %d, reg_tms 
%d, cmd_tms %d, host_cmd_ovf %d, host_reg_ovf %d, immed_ovf %d, ttrace_utc_err 
%d\n",
REG_GET_FIELD(context_id0, SQ_INTERRUPT_WORD_AUTO_CTXID0, 
THREAD_TRACE),
REG_GET_FIELD(context_id0, SQ_INTERRUPT_WORD_AUTO_CTXID0, WLT),
@@ -165,7 +165,7 @@ static void print_sq_intr_info_auto(uint32_t context_id0, 
uint32_t context_id1)
 
 static void print_sq_intr_info_inst(uint32_t context_id0, uint32_t context_id1)
 {
-   pr_debug(
+   pr_debug_ratelimited(
"sq_intr: inst, data 0x%08x, sh %d, priv %d, wave_id %d, 
simd_id %d, wgp_id %d\n",
REG_GET_FIELD(context_id0, SQ_INTERRUPT_WORD_WAVE_CTXID0, DATA),
REG_GET_FIELD(context_id0, SQ_INTERRUPT_WORD_WAVE_CTXID0, 
SH_ID),
@@ -177,7 +177,7 @@ static void print_sq_intr_info_inst(uint32_t context_id0, 
uint32_t context_id1)
 
 static void print_sq_intr_info_error(uint32_t context_id0, uint32_t 
context_id1)
 {
-   pr_warn(
+   pr_warn_ratelimited(
"sq_intr: error, detail 0x%08x, type %d, sh %d, priv %d, 
wave_id %d, simd_id %d, wgp_id %d\n",
REG_GET_FIELD(context_id0, SQ_INTERRUPT_WORD_ERROR_CTXID0, 
DETAIL),
REG_GET_FIELD(context_id0,

[PATCH AUTOSEL 6.1 39/39] drm/amdgpu: Reserve fences for VM update

2023-10-29 Thread Sasha Levin

From: Felix Kuehling 

[ Upstream commit 316baf09d355aec1179981b6dfe28eba50c5ee5b ]

In amdgpu_dma_buf_move_notify reserve fences for the page table updates
in amdgpu_vm_clear_freed and amdgpu_vm_handle_moved. This fixes a BUG_ON
in dma_resv_add_fence when using SDMA for page table updates.

Signed-off-by: Felix Kuehling 
Reviewed-by: Christian König 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 5 -
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c
index 7bd8e33b14be5..e8b3e9520cf6e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c
@@ -400,7 +400,10 @@ amdgpu_dma_buf_move_notify(struct dma_buf_attachment 
*attach)
continue;
}
 
-   r = amdgpu_vm_clear_freed(adev, vm, NULL);
+   /* Reserve fences for two SDMA page table updates */
+   r = dma_resv_reserve_fences(resv, 2);
+   if (!r)
+   r = amdgpu_vm_clear_freed(adev, vm, NULL);
if (!r)
r = amdgpu_vm_handle_moved(adev, vm);
 
-- 
2.42.0

[PATCH AUTOSEL 6.1 29/39] gpu/drm: Eliminate DRM_SCHED_PRIORITY_UNSET

2023-10-29 Thread Sasha Levin

From: Luben Tuikov 

[ Upstream commit fa8391ad68c16716e2c06ada397e99ceed2fb647 ]

Eliminate DRM_SCHED_PRIORITY_UNSET, value of -2, whose only user was
amdgpu. Furthermore, eliminate an index bug, in that when amdgpu boots, it
calls drm_sched_entity_init() with DRM_SCHED_PRIORITY_UNSET, which uses it to
index sched->sched_rq[].

Cc: Alex Deucher 
Cc: Christian König 
Signed-off-by: Luben Tuikov 
Acked-by: Alex Deucher 
Link: https://lore.kernel.org/r/20231017035656.8211-2-luben.tui...@amd.com
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 3 ++-
 include/drm/gpu_scheduler.h | 3 +--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
index fdbeafda4e80a..1ed2142a6e7bf 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
@@ -64,7 +64,8 @@ amdgpu_ctx_to_drm_sched_prio(int32_t ctx_prio)
 {
switch (ctx_prio) {
case AMDGPU_CTX_PRIORITY_UNSET:
-   return DRM_SCHED_PRIORITY_UNSET;
+   pr_warn_once("AMD-->DRM context priority value UNSET-->NORMAL");
+   return DRM_SCHED_PRIORITY_NORMAL;
 
case AMDGPU_CTX_PRIORITY_VERY_LOW:
return DRM_SCHED_PRIORITY_MIN;
diff --git a/include/drm/gpu_scheduler.h b/include/drm/gpu_scheduler.h
index 2ae4fd62e01c4..17e7e3145a058 100644
--- a/include/drm/gpu_scheduler.h
+++ b/include/drm/gpu_scheduler.h
@@ -55,8 +55,7 @@ enum drm_sched_priority {
DRM_SCHED_PRIORITY_HIGH,
DRM_SCHED_PRIORITY_KERNEL,
 
-   DRM_SCHED_PRIORITY_COUNT,
-   DRM_SCHED_PRIORITY_UNSET = -2
+   DRM_SCHED_PRIORITY_COUNT
 };
 
 /**
-- 
2.42.0

[PATCH AUTOSEL 6.1 28/39] drm/amdgpu: Unset context priority is now invalid

2023-10-29 Thread Sasha Levin

From: Luben Tuikov 

[ Upstream commit eab0261967aeab528db4d0a51806df8209aec179 ]

A context priority value of AMD_CTX_PRIORITY_UNSET is now invalid--instead of
carrying it around and passing it to the Direct Rendering Manager--and it
becomes AMD_CTX_PRIORITY_NORMAL in amdgpu_ctx_ioctl(), the gateway to context
creation.

Cc: Alex Deucher 
Cc: Christian König 
Signed-off-by: Luben Tuikov 
Acked-by: Alex Deucher 
Link: https://lore.kernel.org/r/20231017035656.8211-1-luben.tui...@amd.com
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
index d2139ac121595..fdbeafda4e80a 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
@@ -47,7 +47,6 @@ const unsigned int amdgpu_ctx_num_entities[AMDGPU_HW_IP_NUM] 
= {
 bool amdgpu_ctx_priority_is_valid(int32_t ctx_prio)
 {
switch (ctx_prio) {
-   case AMDGPU_CTX_PRIORITY_UNSET:
case AMDGPU_CTX_PRIORITY_VERY_LOW:
case AMDGPU_CTX_PRIORITY_LOW:
case AMDGPU_CTX_PRIORITY_NORMAL:
@@ -55,6 +54,7 @@ bool amdgpu_ctx_priority_is_valid(int32_t ctx_prio)
case AMDGPU_CTX_PRIORITY_VERY_HIGH:
return true;
default:
+   case AMDGPU_CTX_PRIORITY_UNSET:
return false;
}
 }
-- 
2.42.0

[PATCH AUTOSEL 6.5 52/52] drm/amdgpu: Reserve fences for VM update

2023-10-29 Thread Sasha Levin

From: Felix Kuehling 

[ Upstream commit 316baf09d355aec1179981b6dfe28eba50c5ee5b ]

In amdgpu_dma_buf_move_notify reserve fences for the page table updates
in amdgpu_vm_clear_freed and amdgpu_vm_handle_moved. This fixes a BUG_ON
in dma_resv_add_fence when using SDMA for page table updates.

Signed-off-by: Felix Kuehling 
Reviewed-by: Christian König 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 5 -
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c
index 12210598e5b8e..ba3a87cb88ccc 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c
@@ -403,7 +403,10 @@ amdgpu_dma_buf_move_notify(struct dma_buf_attachment 
*attach)
continue;
}
 
-   r = amdgpu_vm_clear_freed(adev, vm, NULL);
+   /* Reserve fences for two SDMA page table updates */
+   r = dma_resv_reserve_fences(resv, 2);
+   if (!r)
+   r = amdgpu_vm_clear_freed(adev, vm, NULL);
if (!r)
r = amdgpu_vm_handle_moved(adev, vm);
 
-- 
2.42.0

[PATCH AUTOSEL 6.5 39/52] gpu/drm: Eliminate DRM_SCHED_PRIORITY_UNSET

2023-10-29 Thread Sasha Levin

From: Luben Tuikov 

[ Upstream commit fa8391ad68c16716e2c06ada397e99ceed2fb647 ]

Eliminate DRM_SCHED_PRIORITY_UNSET, value of -2, whose only user was
amdgpu. Furthermore, eliminate an index bug, in that when amdgpu boots, it
calls drm_sched_entity_init() with DRM_SCHED_PRIORITY_UNSET, which uses it to
index sched->sched_rq[].

Cc: Alex Deucher 
Cc: Christian König 
Signed-off-by: Luben Tuikov 
Acked-by: Alex Deucher 
Link: https://lore.kernel.org/r/20231017035656.8211-2-luben.tui...@amd.com
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 3 ++-
 include/drm/gpu_scheduler.h | 3 +--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
index 092962b93064f..aac52d9754e6d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
@@ -64,7 +64,8 @@ amdgpu_ctx_to_drm_sched_prio(int32_t ctx_prio)
 {
switch (ctx_prio) {
case AMDGPU_CTX_PRIORITY_UNSET:
-   return DRM_SCHED_PRIORITY_UNSET;
+   pr_warn_once("AMD-->DRM context priority value UNSET-->NORMAL");
+   return DRM_SCHED_PRIORITY_NORMAL;
 
case AMDGPU_CTX_PRIORITY_VERY_LOW:
return DRM_SCHED_PRIORITY_MIN;
diff --git a/include/drm/gpu_scheduler.h b/include/drm/gpu_scheduler.h
index f9544d9b670d3..ac65f0626cfc9 100644
--- a/include/drm/gpu_scheduler.h
+++ b/include/drm/gpu_scheduler.h
@@ -68,8 +68,7 @@ enum drm_sched_priority {
DRM_SCHED_PRIORITY_HIGH,
DRM_SCHED_PRIORITY_KERNEL,
 
-   DRM_SCHED_PRIORITY_COUNT,
-   DRM_SCHED_PRIORITY_UNSET = -2
+   DRM_SCHED_PRIORITY_COUNT
 };
 
 /* Used to chose between FIFO and RR jobs scheduling */
-- 
2.42.0

[PATCH AUTOSEL 6.5 38/52] drm/amdgpu: Unset context priority is now invalid

2023-10-29 Thread Sasha Levin

From: Luben Tuikov 

[ Upstream commit eab0261967aeab528db4d0a51806df8209aec179 ]

A context priority value of AMD_CTX_PRIORITY_UNSET is now invalid--instead of
carrying it around and passing it to the Direct Rendering Manager--and it
becomes AMD_CTX_PRIORITY_NORMAL in amdgpu_ctx_ioctl(), the gateway to context
creation.

Cc: Alex Deucher 
Cc: Christian König 
Signed-off-by: Luben Tuikov 
Acked-by: Alex Deucher 
Link: https://lore.kernel.org/r/20231017035656.8211-1-luben.tui...@amd.com
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
index 0dc9c655c4fbd..092962b93064f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
@@ -47,7 +47,6 @@ const unsigned int amdgpu_ctx_num_entities[AMDGPU_HW_IP_NUM] 
= {
 bool amdgpu_ctx_priority_is_valid(int32_t ctx_prio)
 {
switch (ctx_prio) {
-   case AMDGPU_CTX_PRIORITY_UNSET:
case AMDGPU_CTX_PRIORITY_VERY_LOW:
case AMDGPU_CTX_PRIORITY_LOW:
case AMDGPU_CTX_PRIORITY_NORMAL:
@@ -55,6 +54,7 @@ bool amdgpu_ctx_priority_is_valid(int32_t ctx_prio)
case AMDGPU_CTX_PRIORITY_VERY_HIGH:
return true;
default:
+   case AMDGPU_CTX_PRIORITY_UNSET:
return false;
}
 }
-- 
2.42.0

< 2 3 4 5 6 7 8 9 10 11 >

601 - 700 of 2597 matches

Mail list logo