Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'drm-fixes-2025-01-03' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
"Happy New Year.

It was fairly quiet for holidays period, certainly nothing that worth
getting off the couch before I needed to, this is for the past two
weeks, i915, xe and some adv7511, I expect we will see some amdgpu etc
happening next week, but otherwise all quiet.

i915:
- Fix C10 pll programming sequence [cx0_phy]
- Fix power gate sequence. [dg1]

xe:
- uapi: Revert some devcoredump file format changes breaking a mesa
debug tool
- Fixes around waits when moving to system
- Fix a typo when checking for LMEM provisioning
- Fix a fault on fd close after unbind
- A couple of OA fixes squashed for stable backporting

adv7511:
- fix UAF
- drop single lane support
- audio infoframe fix"

* tag 'drm-fixes-2025-01-03' of https://gitlab.freedesktop.org/drm/kernel:
xe/oa: Fix query mode of operation for OAR/OAC
drm/i915/dg1: Fix power gate sequence.
drm/i915/cx0_phy: Fix C10 pll programming sequence
drm/xe: Fix fault on fd close after unbind
drm/xe/pf: Use correct function to check LMEM provisioning
drm/xe: Wait for migration job before unmapping pages
drm/xe: Use non-interruptible wait when moving BO to system
drm/xe: Revert some changes that break a mesa debug tool
drm: adv7511: Drop dsi single lane support
dt-bindings: display: adi,adv7533: Drop single lane support
drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
drm/bridge: adv7511_audio: Update Audio InfoFrame properly

+112 -111
+1 -1
Documentation/devicetree/bindings/display/bridge/adi,adv7533.yaml
··· 90 90 adi,dsi-lanes: 91 91 description: Number of DSI data lanes connected to the DSI host. 92 92 $ref: /schemas/types.yaml#/definitions/uint32 93 - enum: [ 1, 2, 3, 4 ] 93 + enum: [ 2, 3, 4 ] 94 94 95 95 "#sound-dai-cells": 96 96 const: 0
+12 -2
drivers/gpu/drm/bridge/adv7511/adv7511_audio.c
··· 153 153 ADV7511_AUDIO_CFG3_LEN_MASK, len); 154 154 regmap_update_bits(adv7511->regmap, ADV7511_REG_I2C_FREQ_ID_CFG, 155 155 ADV7511_I2C_FREQ_ID_CFG_RATE_MASK, rate << 4); 156 - regmap_write(adv7511->regmap, 0x73, 0x1); 156 + 157 + /* send current Audio infoframe values while updating */ 158 + regmap_update_bits(adv7511->regmap, ADV7511_REG_INFOFRAME_UPDATE, 159 + BIT(5), BIT(5)); 160 + 161 + regmap_write(adv7511->regmap, ADV7511_REG_AUDIO_INFOFRAME(0), 0x1); 162 + 163 + /* use Audio infoframe updated info */ 164 + regmap_update_bits(adv7511->regmap, ADV7511_REG_INFOFRAME_UPDATE, 165 + BIT(5), 0); 157 166 158 167 return 0; 159 168 } ··· 193 184 regmap_update_bits(adv7511->regmap, ADV7511_REG_GC(0), 194 185 BIT(7) | BIT(6), BIT(7)); 195 186 /* use Audio infoframe updated info */ 196 - regmap_update_bits(adv7511->regmap, ADV7511_REG_GC(1), 187 + regmap_update_bits(adv7511->regmap, ADV7511_REG_INFOFRAME_UPDATE, 197 188 BIT(5), 0); 189 + 198 190 /* enable SPDIF receiver */ 199 191 if (adv7511->audio_source == ADV7511_AUDIO_SOURCE_SPDIF) 200 192 regmap_update_bits(adv7511->regmap, ADV7511_REG_AUDIO_CONFIG,
+8 -2
drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
··· 1241 1241 return ret; 1242 1242 1243 1243 ret = adv7511_init_regulators(adv7511); 1244 - if (ret) 1245 - return dev_err_probe(dev, ret, "failed to init regulators\n"); 1244 + if (ret) { 1245 + dev_err_probe(dev, ret, "failed to init regulators\n"); 1246 + goto err_of_node_put; 1247 + } 1246 1248 1247 1249 /* 1248 1250 * The power down GPIO is optional. If present, toggle it from active to ··· 1365 1363 i2c_unregister_device(adv7511->i2c_edid); 1366 1364 uninit_regulators: 1367 1365 adv7511_uninit_regulators(adv7511); 1366 + err_of_node_put: 1367 + of_node_put(adv7511->host_node); 1368 1368 1369 1369 return ret; 1370 1370 } ··· 1374 1370 static void adv7511_remove(struct i2c_client *i2c) 1375 1371 { 1376 1372 struct adv7511 *adv7511 = i2c_get_clientdata(i2c); 1373 + 1374 + of_node_put(adv7511->host_node); 1377 1375 1378 1376 adv7511_uninit_regulators(adv7511); 1379 1377
+1 -3
drivers/gpu/drm/bridge/adv7511/adv7533.c
··· 172 172 173 173 of_property_read_u32(np, "adi,dsi-lanes", &num_lanes); 174 174 175 - if (num_lanes < 1 || num_lanes > 4) 175 + if (num_lanes < 2 || num_lanes > 4) 176 176 return -EINVAL; 177 177 178 178 adv->num_dsi_lanes = num_lanes; ··· 180 180 adv->host_node = of_graph_get_remote_node(np, 0, 0); 181 181 if (!adv->host_node) 182 182 return -ENODEV; 183 - 184 - of_node_put(adv->host_node); 185 183 186 184 adv->use_timing_gen = !of_property_read_bool(np, 187 185 "adi,disable-timing-generator");
+4 -8
drivers/gpu/drm/i915/display/intel_cx0_phy.c
··· 2115 2115 0, C10_VDR_CTRL_MSGBUS_ACCESS, 2116 2116 MB_WRITE_COMMITTED); 2117 2117 2118 - /* Custom width needs to be programmed to 0 for both the phy lanes */ 2119 - intel_cx0_rmw(encoder, INTEL_CX0_BOTH_LANES, PHY_C10_VDR_CUSTOM_WIDTH, 2120 - C10_VDR_CUSTOM_WIDTH_MASK, C10_VDR_CUSTOM_WIDTH_8_10, 2121 - MB_WRITE_COMMITTED); 2122 - intel_cx0_rmw(encoder, INTEL_CX0_BOTH_LANES, PHY_C10_VDR_CONTROL(1), 2123 - 0, C10_VDR_CTRL_UPDATE_CFG, 2124 - MB_WRITE_COMMITTED); 2125 - 2126 2118 /* Program the pll values only for the master lane */ 2127 2119 for (i = 0; i < ARRAY_SIZE(pll_state->pll); i++) 2128 2120 intel_cx0_write(encoder, INTEL_CX0_LANE0, PHY_C10_VDR_PLL(i), ··· 2124 2132 intel_cx0_write(encoder, INTEL_CX0_LANE0, PHY_C10_VDR_CMN(0), pll_state->cmn, MB_WRITE_COMMITTED); 2125 2133 intel_cx0_write(encoder, INTEL_CX0_LANE0, PHY_C10_VDR_TX(0), pll_state->tx, MB_WRITE_COMMITTED); 2126 2134 2135 + /* Custom width needs to be programmed to 0 for both the phy lanes */ 2136 + intel_cx0_rmw(encoder, INTEL_CX0_BOTH_LANES, PHY_C10_VDR_CUSTOM_WIDTH, 2137 + C10_VDR_CUSTOM_WIDTH_MASK, C10_VDR_CUSTOM_WIDTH_8_10, 2138 + MB_WRITE_COMMITTED); 2127 2139 intel_cx0_rmw(encoder, INTEL_CX0_LANE0, PHY_C10_VDR_CONTROL(1), 2128 2140 0, C10_VDR_CTRL_MASTER_LANE | C10_VDR_CTRL_UPDATE_CFG, 2129 2141 MB_WRITE_COMMITTED);
+1 -1
drivers/gpu/drm/i915/gt/intel_rc6.c
··· 133 133 GEN9_MEDIA_PG_ENABLE | 134 134 GEN11_MEDIA_SAMPLER_PG_ENABLE; 135 135 136 - if (GRAPHICS_VER(gt->i915) >= 12) { 136 + if (GRAPHICS_VER(gt->i915) >= 12 && !IS_DG1(gt->i915)) { 137 137 for (i = 0; i < I915_MAX_VCS; i++) 138 138 if (HAS_ENGINE(gt, _VCS(i))) 139 139 pg_enable |= (VDN_HCP_POWERGATE_ENABLE(i) |
+10 -2
drivers/gpu/drm/xe/xe_bo.c
··· 724 724 new_mem->mem_type == XE_PL_SYSTEM) { 725 725 long timeout = dma_resv_wait_timeout(ttm_bo->base.resv, 726 726 DMA_RESV_USAGE_BOOKKEEP, 727 - true, 727 + false, 728 728 MAX_SCHEDULE_TIMEOUT); 729 729 if (timeout < 0) { 730 730 ret = timeout; ··· 848 848 849 849 out: 850 850 if ((!ttm_bo->resource || ttm_bo->resource->mem_type == XE_PL_SYSTEM) && 851 - ttm_bo->ttm) 851 + ttm_bo->ttm) { 852 + long timeout = dma_resv_wait_timeout(ttm_bo->base.resv, 853 + DMA_RESV_USAGE_KERNEL, 854 + false, 855 + MAX_SCHEDULE_TIMEOUT); 856 + if (timeout < 0) 857 + ret = timeout; 858 + 852 859 xe_tt_unmap_sg(ttm_bo->ttm); 860 + } 853 861 854 862 return ret; 855 863 }
+14 -1
drivers/gpu/drm/xe/xe_devcoredump.c
··· 109 109 drm_puts(&p, "\n**** GuC CT ****\n"); 110 110 xe_guc_ct_snapshot_print(ss->guc.ct, &p); 111 111 112 - drm_puts(&p, "\n**** Contexts ****\n"); 112 + /* 113 + * Don't add a new section header here because the mesa debug decoder 114 + * tool expects the context information to be in the 'GuC CT' section. 115 + */ 116 + /* drm_puts(&p, "\n**** Contexts ****\n"); */ 113 117 xe_guc_exec_queue_snapshot_print(ss->ge, &p); 114 118 115 119 drm_puts(&p, "\n**** Job ****\n"); ··· 366 362 const u32 *blob32 = (const u32 *)blob; 367 363 char buff[ASCII85_BUFSZ], *line_buff; 368 364 size_t line_pos = 0; 365 + 366 + /* 367 + * Splitting blobs across multiple lines is not compatible with the mesa 368 + * debug decoder tool. Note that even dropping the explicit '\n' below 369 + * doesn't help because the GuC log is so big some underlying implementation 370 + * still splits the lines at 512K characters. So just bail completely for 371 + * the moment. 372 + */ 373 + return; 369 374 370 375 #define DMESG_MAX_LINE_LEN 800 371 376 #define MIN_SPACE (ASCII85_BUFSZ + 2) /* 85 + "\n\0" */
+9
drivers/gpu/drm/xe/xe_exec_queue.c
··· 8 8 #include <linux/nospec.h> 9 9 10 10 #include <drm/drm_device.h> 11 + #include <drm/drm_drv.h> 11 12 #include <drm/drm_file.h> 12 13 #include <uapi/drm/xe_drm.h> 13 14 ··· 763 762 */ 764 763 void xe_exec_queue_update_run_ticks(struct xe_exec_queue *q) 765 764 { 765 + struct xe_device *xe = gt_to_xe(q->gt); 766 766 struct xe_file *xef; 767 767 struct xe_lrc *lrc; 768 768 u32 old_ts, new_ts; 769 + int idx; 769 770 770 771 /* 771 772 * Jobs that are run during driver load may use an exec_queue, but are ··· 775 772 * for kernel specific work. 776 773 */ 777 774 if (!q->vm || !q->vm->xef) 775 + return; 776 + 777 + /* Synchronize with unbind while holding the xe file open */ 778 + if (!drm_dev_enter(&xe->drm, &idx)) 778 779 return; 779 780 780 781 xef = q->vm->xef; ··· 794 787 lrc = q->lrc[0]; 795 788 new_ts = xe_lrc_update_timestamp(lrc, &old_ts); 796 789 xef->run_ticks[q->class] += (new_ts - old_ts) * q->width; 790 + 791 + drm_dev_exit(idx); 797 792 } 798 793 799 794 /**
+1 -1
drivers/gpu/drm/xe/xe_gt_sriov_pf_config.c
··· 2046 2046 valid_any = valid_any || (valid_ggtt && is_primary); 2047 2047 2048 2048 if (IS_DGFX(xe)) { 2049 - bool valid_lmem = pf_get_vf_config_ggtt(primary_gt, vfid); 2049 + bool valid_lmem = pf_get_vf_config_lmem(primary_gt, vfid); 2050 2050 2051 2051 valid_any = valid_any || (valid_lmem && is_primary); 2052 2052 valid_all = valid_all && valid_lmem;
+45 -89
drivers/gpu/drm/xe/xe_oa.c
··· 74 74 struct rcu_head rcu; 75 75 }; 76 76 77 - struct flex { 78 - struct xe_reg reg; 79 - u32 offset; 80 - u32 value; 81 - }; 82 - 83 77 struct xe_oa_open_param { 84 78 struct xe_file *xef; 85 79 u32 oa_unit_id; ··· 590 596 return ret; 591 597 } 592 598 599 + static void xe_oa_lock_vma(struct xe_exec_queue *q) 600 + { 601 + if (q->vm) { 602 + down_read(&q->vm->lock); 603 + xe_vm_lock(q->vm, false); 604 + } 605 + } 606 + 607 + static void xe_oa_unlock_vma(struct xe_exec_queue *q) 608 + { 609 + if (q->vm) { 610 + xe_vm_unlock(q->vm); 611 + up_read(&q->vm->lock); 612 + } 613 + } 614 + 593 615 static struct dma_fence *xe_oa_submit_bb(struct xe_oa_stream *stream, enum xe_oa_submit_deps deps, 594 616 struct xe_bb *bb) 595 617 { 618 + struct xe_exec_queue *q = stream->exec_q ?: stream->k_exec_q; 596 619 struct xe_sched_job *job; 597 620 struct dma_fence *fence; 598 621 int err = 0; 599 622 600 - /* Kernel configuration is issued on stream->k_exec_q, not stream->exec_q */ 601 - job = xe_bb_create_job(stream->k_exec_q, bb); 623 + xe_oa_lock_vma(q); 624 + 625 + job = xe_bb_create_job(q, bb); 602 626 if (IS_ERR(job)) { 603 627 err = PTR_ERR(job); 604 628 goto exit; 605 629 } 630 + job->ggtt = true; 606 631 607 632 if (deps == XE_OA_SUBMIT_ADD_DEPS) { 608 633 for (int i = 0; i < stream->num_syncs && !err; i++) ··· 636 623 fence = dma_fence_get(&job->drm.s_fence->finished); 637 624 xe_sched_job_push(job); 638 625 626 + xe_oa_unlock_vma(q); 627 + 639 628 return fence; 640 629 err_put_job: 641 630 xe_sched_job_put(job); 642 631 exit: 632 + xe_oa_unlock_vma(q); 643 633 return ERR_PTR(err); 644 634 } 645 635 ··· 691 675 dma_fence_put(stream->last_fence); 692 676 } 693 677 694 - static void xe_oa_store_flex(struct xe_oa_stream *stream, struct xe_lrc *lrc, 695 - struct xe_bb *bb, const struct flex *flex, u32 count) 696 - { 697 - u32 offset = xe_bo_ggtt_addr(lrc->bo); 698 - 699 - do { 700 - bb->cs[bb->len++] = MI_STORE_DATA_IMM | MI_SDI_GGTT | MI_SDI_NUM_DW(1); 701 - bb->cs[bb->len++] = offset + flex->offset * sizeof(u32); 702 - bb->cs[bb->len++] = 0; 703 - bb->cs[bb->len++] = flex->value; 704 - 705 - } while (flex++, --count); 706 - } 707 - 708 - static int xe_oa_modify_ctx_image(struct xe_oa_stream *stream, struct xe_lrc *lrc, 709 - const struct flex *flex, u32 count) 678 + static int xe_oa_load_with_lri(struct xe_oa_stream *stream, struct xe_oa_reg *reg_lri, u32 count) 710 679 { 711 680 struct dma_fence *fence; 712 681 struct xe_bb *bb; 713 682 int err; 714 683 715 - bb = xe_bb_new(stream->gt, 4 * count, false); 684 + bb = xe_bb_new(stream->gt, 2 * count + 1, false); 716 685 if (IS_ERR(bb)) { 717 686 err = PTR_ERR(bb); 718 687 goto exit; 719 688 } 720 689 721 - xe_oa_store_flex(stream, lrc, bb, flex, count); 722 - 723 - fence = xe_oa_submit_bb(stream, XE_OA_SUBMIT_NO_DEPS, bb); 724 - if (IS_ERR(fence)) { 725 - err = PTR_ERR(fence); 726 - goto free_bb; 727 - } 728 - xe_bb_free(bb, fence); 729 - dma_fence_put(fence); 730 - 731 - return 0; 732 - free_bb: 733 - xe_bb_free(bb, NULL); 734 - exit: 735 - return err; 736 - } 737 - 738 - static int xe_oa_load_with_lri(struct xe_oa_stream *stream, struct xe_oa_reg *reg_lri) 739 - { 740 - struct dma_fence *fence; 741 - struct xe_bb *bb; 742 - int err; 743 - 744 - bb = xe_bb_new(stream->gt, 3, false); 745 - if (IS_ERR(bb)) { 746 - err = PTR_ERR(bb); 747 - goto exit; 748 - } 749 - 750 - write_cs_mi_lri(bb, reg_lri, 1); 690 + write_cs_mi_lri(bb, reg_lri, count); 751 691 752 692 fence = xe_oa_submit_bb(stream, XE_OA_SUBMIT_NO_DEPS, bb); 753 693 if (IS_ERR(fence)) { ··· 723 751 static int xe_oa_configure_oar_context(struct xe_oa_stream *stream, bool enable) 724 752 { 725 753 const struct xe_oa_format *format = stream->oa_buffer.format; 726 - struct xe_lrc *lrc = stream->exec_q->lrc[0]; 727 - u32 regs_offset = xe_lrc_regs_offset(lrc) / sizeof(u32); 728 754 u32 oacontrol = __format_to_oactrl(format, OAR_OACONTROL_COUNTER_SEL_MASK) | 729 755 (enable ? OAR_OACONTROL_COUNTER_ENABLE : 0); 730 756 731 - struct flex regs_context[] = { 757 + struct xe_oa_reg reg_lri[] = { 732 758 { 733 759 OACTXCONTROL(stream->hwe->mmio_base), 734 - stream->oa->ctx_oactxctrl_offset[stream->hwe->class] + 1, 735 760 enable ? OA_COUNTER_RESUME : 0, 736 761 }, 737 762 { 763 + OAR_OACONTROL, 764 + oacontrol, 765 + }, 766 + { 738 767 RING_CONTEXT_CONTROL(stream->hwe->mmio_base), 739 - regs_offset + CTX_CONTEXT_CONTROL, 740 - _MASKED_BIT_ENABLE(CTX_CTRL_OAC_CONTEXT_ENABLE), 768 + _MASKED_FIELD(CTX_CTRL_OAC_CONTEXT_ENABLE, 769 + enable ? CTX_CTRL_OAC_CONTEXT_ENABLE : 0) 741 770 }, 742 771 }; 743 - struct xe_oa_reg reg_lri = { OAR_OACONTROL, oacontrol }; 744 - int err; 745 772 746 - /* Modify stream hwe context image with regs_context */ 747 - err = xe_oa_modify_ctx_image(stream, stream->exec_q->lrc[0], 748 - regs_context, ARRAY_SIZE(regs_context)); 749 - if (err) 750 - return err; 751 - 752 - /* Apply reg_lri using LRI */ 753 - return xe_oa_load_with_lri(stream, &reg_lri); 773 + return xe_oa_load_with_lri(stream, reg_lri, ARRAY_SIZE(reg_lri)); 754 774 } 755 775 756 776 static int xe_oa_configure_oac_context(struct xe_oa_stream *stream, bool enable) 757 777 { 758 778 const struct xe_oa_format *format = stream->oa_buffer.format; 759 - struct xe_lrc *lrc = stream->exec_q->lrc[0]; 760 - u32 regs_offset = xe_lrc_regs_offset(lrc) / sizeof(u32); 761 779 u32 oacontrol = __format_to_oactrl(format, OAR_OACONTROL_COUNTER_SEL_MASK) | 762 780 (enable ? OAR_OACONTROL_COUNTER_ENABLE : 0); 763 - struct flex regs_context[] = { 781 + struct xe_oa_reg reg_lri[] = { 764 782 { 765 783 OACTXCONTROL(stream->hwe->mmio_base), 766 - stream->oa->ctx_oactxctrl_offset[stream->hwe->class] + 1, 767 784 enable ? OA_COUNTER_RESUME : 0, 768 785 }, 769 786 { 787 + OAC_OACONTROL, 788 + oacontrol 789 + }, 790 + { 770 791 RING_CONTEXT_CONTROL(stream->hwe->mmio_base), 771 - regs_offset + CTX_CONTEXT_CONTROL, 772 - _MASKED_BIT_ENABLE(CTX_CTRL_OAC_CONTEXT_ENABLE) | 792 + _MASKED_FIELD(CTX_CTRL_OAC_CONTEXT_ENABLE, 793 + enable ? CTX_CTRL_OAC_CONTEXT_ENABLE : 0) | 773 794 _MASKED_FIELD(CTX_CTRL_RUN_ALONE, enable ? CTX_CTRL_RUN_ALONE : 0), 774 795 }, 775 796 }; 776 - struct xe_oa_reg reg_lri = { OAC_OACONTROL, oacontrol }; 777 - int err; 778 797 779 798 /* Set ccs select to enable programming of OAC_OACONTROL */ 780 799 xe_mmio_write32(&stream->gt->mmio, __oa_regs(stream)->oa_ctrl, 781 800 __oa_ccs_select(stream)); 782 801 783 - /* Modify stream hwe context image with regs_context */ 784 - err = xe_oa_modify_ctx_image(stream, stream->exec_q->lrc[0], 785 - regs_context, ARRAY_SIZE(regs_context)); 786 - if (err) 787 - return err; 788 - 789 - /* Apply reg_lri using LRI */ 790 - return xe_oa_load_with_lri(stream, &reg_lri); 802 + return xe_oa_load_with_lri(stream, reg_lri, ARRAY_SIZE(reg_lri)); 791 803 } 792 804 793 805 static int xe_oa_configure_oa_context(struct xe_oa_stream *stream, bool enable) ··· 2022 2066 if (XE_IOCTL_DBG(oa->xe, !param.exec_q)) 2023 2067 return -ENOENT; 2024 2068 2025 - if (param.exec_q->width > 1) 2026 - drm_dbg(&oa->xe->drm, "exec_q->width > 1, programming only exec_q->lrc[0]\n"); 2069 + if (XE_IOCTL_DBG(oa->xe, param.exec_q->width > 1)) 2070 + return -EOPNOTSUPP; 2027 2071 } 2028 2072 2029 2073 /*
+4 -1
drivers/gpu/drm/xe/xe_ring_ops.c
··· 221 221 222 222 static u32 get_ppgtt_flag(struct xe_sched_job *job) 223 223 { 224 - return job->q->vm ? BIT(8) : 0; 224 + if (job->q->vm && !job->ggtt) 225 + return BIT(8); 226 + 227 + return 0; 225 228 } 226 229 227 230 static int emit_copy_timestamp(struct xe_lrc *lrc, u32 *dw, int i)
+2
drivers/gpu/drm/xe/xe_sched_job_types.h
··· 56 56 u32 migrate_flush_flags; 57 57 /** @ring_ops_flush_tlb: The ring ops need to flush TLB before payload. */ 58 58 bool ring_ops_flush_tlb; 59 + /** @ggtt: mapped in ggtt. */ 60 + bool ggtt; 59 61 /** @ptrs: per instance pointers. */ 60 62 struct xe_job_ptrs ptrs[]; 61 63 };