Skip to content

Commit c13276a

Browse files
airliedairlied
committed
Merge tag 'amd-drm-fixes-6.15-2025-05-01' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes
amd-drm-fixes-6.15-2025-05-01: amdgpu: - Fix possible UAF in HDCP - XGMI dma-buf fix - NBIO 7.11 fix - VCN 5.0.1 fix Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://lore.kernel.org/r/20250501185634.4132187-1-alexander.deucher@amd.com
2 parents 1cbbec1 + 6718b10 commit c13276a

File tree

4 files changed

+76
-4
lines changed

4 files changed

+76
-4
lines changed

‎drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -199,6 +199,11 @@ static struct sg_table *amdgpu_dma_buf_map(struct dma_buf_attachment *attach,
199199
break;
200200

201201
case TTM_PL_VRAM:
202+
/* XGMI-accessible memory should never be DMA-mapped */
203+
if (WARN_ON(amdgpu_dmabuf_is_xgmi_accessible(
204+
dma_buf_attach_adev(attach), bo)))
205+
return ERR_PTR(-EINVAL);
206+
202207
r = amdgpu_vram_mgr_alloc_sgt(adev, bo->tbo.resource, 0,
203208
bo->tbo.base.size, attach->dev,
204209
dir, &sgt);

‎drivers/gpu/drm/amd/amdgpu/nbio_v7_11.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -360,7 +360,7 @@ static void nbio_v7_11_get_clockgating_state(struct amdgpu_device *adev,
360360
*flags |= AMD_CG_SUPPORT_BIF_LS;
361361
}
362362

363-
#define MMIO_REG_HOLE_OFFSET (0x80000 - PAGE_SIZE)
363+
#define MMIO_REG_HOLE_OFFSET 0x44000
364364

365365
static void nbio_v7_11_set_reg_remap(struct amdgpu_device *adev)
366366
{

‎drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -502,6 +502,52 @@ static void vcn_v5_0_1_enable_clock_gating(struct amdgpu_vcn_inst *vinst)
502502
{
503503
}
504504

505+
/**
506+
* vcn_v5_0_1_pause_dpg_mode - VCN pause with dpg mode
507+
*
508+
* @vinst: VCN instance
509+
* @new_state: pause state
510+
*
511+
* Pause dpg mode for VCN block
512+
*/
513+
static int vcn_v5_0_1_pause_dpg_mode(struct amdgpu_vcn_inst *vinst,
514+
struct dpg_pause_state *new_state)
515+
{
516+
struct amdgpu_device *adev = vinst->adev;
517+
uint32_t reg_data = 0;
518+
int vcn_inst;
519+
520+
vcn_inst = GET_INST(VCN, vinst->inst);
521+
522+
/* pause/unpause if state is changed */
523+
if (vinst->pause_state.fw_based != new_state->fw_based) {
524+
DRM_DEV_DEBUG(adev->dev, "dpg pause state changed %d -> %d %s\n",
525+
vinst->pause_state.fw_based, new_state->fw_based,
526+
new_state->fw_based ? "VCN_DPG_STATE__PAUSE" : "VCN_DPG_STATE__UNPAUSE");
527+
reg_data = RREG32_SOC15(VCN, vcn_inst, regUVD_DPG_PAUSE) &
528+
(~UVD_DPG_PAUSE__NJ_PAUSE_DPG_ACK_MASK);
529+
530+
if (new_state->fw_based == VCN_DPG_STATE__PAUSE) {
531+
/* pause DPG */
532+
reg_data |= UVD_DPG_PAUSE__NJ_PAUSE_DPG_REQ_MASK;
533+
WREG32_SOC15(VCN, vcn_inst, regUVD_DPG_PAUSE, reg_data);
534+
535+
/* wait for ACK */
536+
SOC15_WAIT_ON_RREG(VCN, vcn_inst, regUVD_DPG_PAUSE,
537+
UVD_DPG_PAUSE__NJ_PAUSE_DPG_ACK_MASK,
538+
UVD_DPG_PAUSE__NJ_PAUSE_DPG_ACK_MASK);
539+
} else {
540+
/* unpause DPG, no need to wait */
541+
reg_data &= ~UVD_DPG_PAUSE__NJ_PAUSE_DPG_REQ_MASK;
542+
WREG32_SOC15(VCN, vcn_inst, regUVD_DPG_PAUSE, reg_data);
543+
}
544+
vinst->pause_state.fw_based = new_state->fw_based;
545+
}
546+
547+
return 0;
548+
}
549+
550+
505551
/**
506552
* vcn_v5_0_1_start_dpg_mode - VCN start with dpg mode
507553
*
@@ -518,6 +564,7 @@ static int vcn_v5_0_1_start_dpg_mode(struct amdgpu_vcn_inst *vinst,
518564
volatile struct amdgpu_vcn5_fw_shared *fw_shared =
519565
adev->vcn.inst[inst_idx].fw_shared.cpu_addr;
520566
struct amdgpu_ring *ring;
567+
struct dpg_pause_state state = {.fw_based = VCN_DPG_STATE__PAUSE};
521568
int vcn_inst;
522569
uint32_t tmp;
523570

@@ -582,6 +629,9 @@ static int vcn_v5_0_1_start_dpg_mode(struct amdgpu_vcn_inst *vinst,
582629
if (indirect)
583630
amdgpu_vcn_psp_update_sram(adev, inst_idx, AMDGPU_UCODE_ID_VCN0_RAM);
584631

632+
/* Pause dpg */
633+
vcn_v5_0_1_pause_dpg_mode(vinst, &state);
634+
585635
ring = &adev->vcn.inst[inst_idx].ring_enc[0];
586636

587637
WREG32_SOC15(VCN, vcn_inst, regUVD_RB_BASE_LO, lower_32_bits(ring->gpu_addr));
@@ -775,9 +825,13 @@ static void vcn_v5_0_1_stop_dpg_mode(struct amdgpu_vcn_inst *vinst)
775825
int inst_idx = vinst->inst;
776826
uint32_t tmp;
777827
int vcn_inst;
828+
struct dpg_pause_state state = {.fw_based = VCN_DPG_STATE__UNPAUSE};
778829

779830
vcn_inst = GET_INST(VCN, inst_idx);
780831

832+
/* Unpause dpg */
833+
vcn_v5_0_1_pause_dpg_mode(vinst, &state);
834+
781835
/* Wait for power status to be 1 */
782836
SOC15_WAIT_ON_RREG(VCN, vcn_inst, regUVD_POWER_STATUS, 1,
783837
UVD_POWER_STATUS__UVD_POWER_STATUS_MASK);

‎drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -173,6 +173,9 @@ void hdcp_update_display(struct hdcp_workqueue *hdcp_work,
173173
unsigned int conn_index = aconnector->base.index;
174174

175175
guard(mutex)(&hdcp_w->mutex);
176+
drm_connector_get(&aconnector->base);
177+
if (hdcp_w->aconnector[conn_index])
178+
drm_connector_put(&hdcp_w->aconnector[conn_index]->base);
176179
hdcp_w->aconnector[conn_index] = aconnector;
177180

178181
memset(&link_adjust, 0, sizeof(link_adjust));
@@ -220,7 +223,6 @@ static void hdcp_remove_display(struct hdcp_workqueue *hdcp_work,
220223
unsigned int conn_index = aconnector->base.index;
221224

222225
guard(mutex)(&hdcp_w->mutex);
223-
hdcp_w->aconnector[conn_index] = aconnector;
224226

225227
/* the removal of display will invoke auth reset -> hdcp destroy and
226228
* we'd expect the Content Protection (CP) property changed back to
@@ -236,7 +238,10 @@ static void hdcp_remove_display(struct hdcp_workqueue *hdcp_work,
236238
}
237239

238240
mod_hdcp_remove_display(&hdcp_w->hdcp, aconnector->base.index, &hdcp_w->output);
239-
241+
if (hdcp_w->aconnector[conn_index]) {
242+
drm_connector_put(&hdcp_w->aconnector[conn_index]->base);
243+
hdcp_w->aconnector[conn_index] = NULL;
244+
}
240245
process_output(hdcp_w);
241246
}
242247

@@ -254,6 +259,10 @@ void hdcp_reset_display(struct hdcp_workqueue *hdcp_work, unsigned int link_inde
254259
for (conn_index = 0; conn_index < AMDGPU_DM_MAX_DISPLAY_INDEX; conn_index++) {
255260
hdcp_w->encryption_status[conn_index] =
256261
MOD_HDCP_ENCRYPTION_STATUS_HDCP_OFF;
262+
if (hdcp_w->aconnector[conn_index]) {
263+
drm_connector_put(&hdcp_w->aconnector[conn_index]->base);
264+
hdcp_w->aconnector[conn_index] = NULL;
265+
}
257266
}
258267

259268
process_output(hdcp_w);
@@ -488,6 +497,7 @@ static void update_config(void *handle, struct cp_psp_stream_config *config)
488497
struct hdcp_workqueue *hdcp_work = handle;
489498
struct amdgpu_dm_connector *aconnector = config->dm_stream_ctx;
490499
int link_index = aconnector->dc_link->link_index;
500+
unsigned int conn_index = aconnector->base.index;
491501
struct mod_hdcp_display *display = &hdcp_work[link_index].display;
492502
struct mod_hdcp_link *link = &hdcp_work[link_index].link;
493503
struct hdcp_workqueue *hdcp_w = &hdcp_work[link_index];
@@ -544,7 +554,10 @@ static void update_config(void *handle, struct cp_psp_stream_config *config)
544554
guard(mutex)(&hdcp_w->mutex);
545555

546556
mod_hdcp_add_display(&hdcp_w->hdcp, link, display, &hdcp_w->output);
547-
557+
drm_connector_get(&aconnector->base);
558+
if (hdcp_w->aconnector[conn_index])
559+
drm_connector_put(&hdcp_w->aconnector[conn_index]->base);
560+
hdcp_w->aconnector[conn_index] = aconnector;
548561
process_output(hdcp_w);
549562
}
550563

0 commit comments

Comments
 (0)