Merge tag 'drm-fixes-2023-06-17' of git://anongit.freedesktop.org/drm/drm

Pull drm fixes from Dave Airlie:
 "A bunch of misc fixes across the board.

  amdgpu is the usual bulk with a revert and other fixes, nouveau has a
  race fix that was causing a UAF that was hard hanging systems,
  otherwise some qaic, bridge and radeon.

  amdgpu:
   - GFX9 preemption fixes
   - Add missing radeon secondary PCI ID
   - vblflash fixes
   - SMU 13 fix
   - VCN 4.0 fix
   - Re-enable TOPDOWN flag for large BAR systems to fix regression
   - eDP fix
   - PSR hang fix
   - DPIA fix

  radeon:
   - fbdev client warning fix

  qaic:
   - leak fix
   - null ptr deref fix

  nouveau:
   - use-after-free caused by fence race fix
   - runtime pm fix
   - NULL ptr checks

  bridge:
   - ti-sn65dsi86: Avoid possible buffer overflow"

* tag 'drm-fixes-2023-06-17' of git://anongit.freedesktop.org/drm/drm: (21 commits)
  nouveau: fix client work fence deletion race
  drm/amd/display: limit DPIA link rate to HBR3
  drm/amd/display: fix the system hang while disable PSR
  drm/amd/display: edp do not add non-edid timings
  Revert "drm/amdgpu: remove TOPDOWN flags when allocating VRAM in large bar system"
  drm/amdgpu: vcn_4_0 set instance 0 init sched score to 1
  drm/radeon: Disable outputs when releasing fbdev client
  drm/amd/pm: workaround for compute workload type on some skus
  drm/amd: Tighten permissions on VBIOS flashing attributes
  drm/amd: Make sure image is written to trigger VBIOS image update flow
  drm/amdgpu: add missing radeon secondary PCI ID
  drm/amdgpu: Implement gfx9 patch functions for resubmission
  drm/amdgpu: Modify indirect buffer packages for resubmission
  drm/amdgpu: Program gds backup address as zero if no gds allocated
  drm/nouveau: add nv_encoder pointer check for NULL
  drm/amdgpu: Reset CP_VMID_PREEMPT after trailing fence signaled
  drm/nouveau/dp: check for NULL nv_connector->native_mode
  drm/bridge: ti-sn65dsi86: Avoid possible buffer overflow
  drm/nouveau: don't detect DSM for non-NVIDIA device
  accel/qaic: Fix NULL pointer deref in qaic_destroy_drm_device()
  ...

1 files changed, 60 insertions, 0 deletions

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring_mux.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring_mux.c
index 62079f0e3ee8..73516abef662 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring_mux.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring_mux.c
@@ -105,6 +105,16 @@ static void amdgpu_mux_resubmit_chunks(struct amdgpu_ring_mux *mux)
 				amdgpu_fence_update_start_timestamp(e->ring,
 								    chunk->sync_seq,
 								    ktime_get());
+				if (chunk->sync_seq ==
+					le32_to_cpu(*(e->ring->fence_drv.cpu_addr + 2))) {
+					if (chunk->cntl_offset <= e->ring->buf_mask)
+						amdgpu_ring_patch_cntl(e->ring,
+								       chunk->cntl_offset);
+					if (chunk->ce_offset <= e->ring->buf_mask)
+						amdgpu_ring_patch_ce(e->ring, chunk->ce_offset);
+					if (chunk->de_offset <= e->ring->buf_mask)
+						amdgpu_ring_patch_de(e->ring, chunk->de_offset);
+				}
 				amdgpu_ring_mux_copy_pkt_from_sw_ring(mux, e->ring,
 								      chunk->start,
 								      chunk->end);
@@ -407,6 +417,17 @@ void amdgpu_sw_ring_ib_end(struct amdgpu_ring *ring)
 	amdgpu_ring_mux_end_ib(mux, ring);
 }
 
+void amdgpu_sw_ring_ib_mark_offset(struct amdgpu_ring *ring, enum amdgpu_ring_mux_offset_type type)
+{
+	struct amdgpu_device *adev = ring->adev;
+	struct amdgpu_ring_mux *mux = &adev->gfx.muxer;
+	unsigned offset;
+
+	offset = ring->wptr & ring->buf_mask;
+
+	amdgpu_ring_mux_ib_mark_offset(mux, ring, offset, type);
+}
+
 void amdgpu_ring_mux_start_ib(struct amdgpu_ring_mux *mux, struct amdgpu_ring *ring)
 {
 	struct amdgpu_mux_entry *e;
@@ -429,6 +450,10 @@ void amdgpu_ring_mux_start_ib(struct amdgpu_ring_mux *mux, struct amdgpu_ring *r
 	}
 
 	chunk->start = ring->wptr;
+	/* the initialized value used to check if they are set by the ib submission*/
+	chunk->cntl_offset = ring->buf_mask + 1;
+	chunk->de_offset = ring->buf_mask + 1;
+	chunk->ce_offset = ring->buf_mask + 1;
 	list_add_tail(&chunk->entry, &e->list);
 }
 
@@ -454,6 +479,41 @@ static void scan_and_remove_signaled_chunk(struct amdgpu_ring_mux *mux, struct a
 	}
 }
 
+void amdgpu_ring_mux_ib_mark_offset(struct amdgpu_ring_mux *mux,
+				    struct amdgpu_ring *ring, u64 offset,
+				    enum amdgpu_ring_mux_offset_type type)
+{
+	struct amdgpu_mux_entry *e;
+	struct amdgpu_mux_chunk *chunk;
+
+	e = amdgpu_ring_mux_sw_entry(mux, ring);
+	if (!e) {
+		DRM_ERROR("cannot find entry!\n");
+		return;
+	}
+
+	chunk = list_last_entry(&e->list, struct amdgpu_mux_chunk, entry);
+	if (!chunk) {
+		DRM_ERROR("cannot find chunk!\n");
+		return;
+	}
+
+	switch (type) {
+	case AMDGPU_MUX_OFFSET_TYPE_CONTROL:
+		chunk->cntl_offset = offset;
+		break;
+	case AMDGPU_MUX_OFFSET_TYPE_DE:
+		chunk->de_offset = offset;
+		break;
+	case AMDGPU_MUX_OFFSET_TYPE_CE:
+		chunk->ce_offset = offset;
+		break;
+	default:
+		DRM_ERROR("invalid type (%d)\n", type);
+		break;
+	}
+}
+
 void amdgpu_ring_mux_end_ib(struct amdgpu_ring_mux *mux, struct amdgpu_ring *ring)
 {
 	struct amdgpu_mux_entry *e;