--- /dev/null
+From 8260731ccad0451207b45844bb66eb161a209218 Mon Sep 17 00:00:00 2001
+From: Thomas Zimmermann <tzimmermann@suse.de>
+Date: Wed, 16 Apr 2025 08:57:45 +0200
+Subject: drm/gem: Internally test import_attach for imported objects
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+commit 8260731ccad0451207b45844bb66eb161a209218 upstream.
+
+Test struct drm_gem_object.import_attach to detect imported objects.
+
+During object clenanup, the dma_buf field might be NULL. Testing it in
+an object's free callback then incorrectly does a cleanup as for native
+objects. Happens for calls to drm_mode_destroy_dumb_ioctl() that
+clears the dma_buf field in drm_gem_object_exported_dma_buf_free().
+
+v3:
+- only test for import_attach (Boris)
+v2:
+- use import_attach.dmabuf instead of dma_buf (Christian)
+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Fixes: b57aa47d39e9 ("drm/gem: Test for imported GEM buffers with helper")
+Reported-by: Andy Yan <andyshrk@163.com>
+Closes: https://lore.kernel.org/dri-devel/38d09d34.4354.196379aa560.Coremail.andyshrk@163.com/
+Tested-by: Andy Yan <andyshrk@163.com>
+Cc: Thomas Zimmermann <tzimmermann@suse.de>
+Cc: Anusha Srivatsa <asrivats@redhat.com>
+Cc: Christian König <christian.koenig@amd.com>
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Maxime Ripard <mripard@kernel.org>
+Cc: David Airlie <airlied@gmail.com>
+Cc: Simona Vetter <simona@ffwll.ch>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Cc: "Christian König" <christian.koenig@amd.com>
+Cc: dri-devel@lists.freedesktop.org
+Cc: linux-media@vger.kernel.org
+Cc: linaro-mm-sig@lists.linaro.org
+Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
+Reviewed-by: Simona Vetter <simona.vetter@ffwll.ch>
+Link: https://lore.kernel.org/r/20250416065820.26076-1-tzimmermann@suse.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/drm/drm_gem.h | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/include/drm/drm_gem.h
++++ b/include/drm/drm_gem.h
+@@ -567,8 +567,7 @@ static inline bool drm_gem_object_is_sha
+ */
+ static inline bool drm_gem_is_imported(const struct drm_gem_object *obj)
+ {
+- /* The dma-buf's priv field points to the original GEM object. */
+- return obj->dma_buf && (obj->dma_buf->priv != obj);
++ return !!obj->import_attach;
+ }
+
+ #ifdef CONFIG_LOCKDEP
--- /dev/null
+From e8d2d287e26d9bd9114cf258a123a6b70812442e Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <nathan@kernel.org>
+Date: Wed, 19 Mar 2025 09:08:01 -0700
+Subject: i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work()
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+commit e8d2d287e26d9bd9114cf258a123a6b70812442e upstream.
+
+Clang warns (or errors with CONFIG_WERROR=y):
+
+ drivers/i3c/master/svc-i3c-master.c:596:2: error: unannotated fall-through between switch labels [-Werror,-Wimplicit-fallthrough]
+ 596 | default:
+ | ^
+ drivers/i3c/master/svc-i3c-master.c:596:2: note: insert 'break;' to avoid fall-through
+ 596 | default:
+ | ^
+ | break;
+ 1 error generated.
+
+Clang is a little more pedantic than GCC, which does not warn when
+falling through to a case that is just break or return. Clang's version
+is more in line with the kernel's own stance in deprecated.rst, which
+states that all switch/case blocks must end in either break,
+fallthrough, continue, goto, or return. Add the missing break to silence
+the warning.
+
+Fixes: 0430bf9bc1ac ("i3c: master: svc: Fix missing STOP for master request")
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Link: https://lore.kernel.org/r/20250319-i3c-fix-clang-fallthrough-v1-1-d8e02be1ef5c@kernel.org
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i3c/master/svc-i3c-master.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/i3c/master/svc-i3c-master.c
++++ b/drivers/i3c/master/svc-i3c-master.c
+@@ -504,6 +504,7 @@ static void svc_i3c_master_ibi_work(stru
+ break;
+ case SVC_I3C_MSTATUS_IBITYPE_MASTER_REQUEST:
+ svc_i3c_master_emit_stop(master);
++ break;
+ default:
+ break;
+ }
--- /dev/null
+From 5a062c3c3b82004766bc3ece82b594d337076152 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@linaro.org>
+Date: Wed, 19 Mar 2025 10:05:47 +0300
+Subject: pinctrl: tegra: Fix off by one in tegra_pinctrl_get_group()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+commit 5a062c3c3b82004766bc3ece82b594d337076152 upstream.
+
+This should be >= pmx->soc->ngroups instead of > to avoid an out of
+bounds access. The pmx->soc->groups[] array is allocated in
+tegra_pinctrl_probe().
+
+Fixes: c12bfa0fee65 ("pinctrl-tegra: Restore SFSEL bit when freeing pins")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Kunwu Chan <kunwu.chan@linux.dev>
+Link: https://lore.kernel.org/82b40d9d-b437-42a9-9eb3-2328aa6877ac@stanley.mountain
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/tegra/pinctrl-tegra.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pinctrl/tegra/pinctrl-tegra.c
++++ b/drivers/pinctrl/tegra/pinctrl-tegra.c
+@@ -307,7 +307,7 @@ static const struct tegra_pingroup *tegr
+ {
+ struct tegra_pmx *pmx = pinctrl_dev_get_drvdata(pctldev);
+
+- if (group_index < 0 || group_index > pmx->soc->ngroups)
++ if (group_index < 0 || group_index >= pmx->soc->ngroups)
+ return NULL;
+
+ return &pmx->soc->groups[group_index];
--- /dev/null
+From 81100b9a7b0515132996d62a7a676a77676cb6e3 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Tue, 4 Mar 2025 20:06:11 +0100
+Subject: serial: sh-sci: Save and restore more registers
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit 81100b9a7b0515132996d62a7a676a77676cb6e3 upstream.
+
+On (H)SCIF with a Baud Rate Generator for External Clock (BRG), there
+are multiple ways to configure the requested serial speed. If firmware
+uses a different method than Linux, and if any debug info is printed
+after the Bit Rate Register (SCBRR) is restored, but before termios is
+reconfigured (which configures the alternative method), the system may
+lock-up during resume.
+
+Fix this by saving and restoring the contents of the BRG Frequency
+Division (SCDL) and Clock Select (SCCKS) registers as well.
+
+Also save and restore the HSCIF's Sampling Rate Register (HSSRR), which
+configures the sampling point, and the SCIFA/SCIFB's Serial Port Control
+and Data Registers (SCPCR/SCPDR), which configure the optional control
+flow signals.
+
+After this, all registers that are not saved/restored are either:
+ - read-only,
+ - write-only,
+ - status registers containing flags with clear-after-set semantics,
+ - FIFO Data Count Trigger registers, which do not matter much for
+ the serial console.
+
+Fixes: 22a6984c5b5df8ea ("serial: sh-sci: Update the suspend/resume support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Reviewed-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Link: https://lore.kernel.org/r/11c2eab45d48211e75d8b8202cce60400880fe55.1741114989.git.geert+renesas@glider.be
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/sh-sci.c | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -105,10 +105,15 @@ struct plat_sci_reg {
+ };
+
+ struct sci_suspend_regs {
++ u16 scdl;
++ u16 sccks;
+ u16 scsmr;
+ u16 scscr;
+ u16 scfcr;
+ u16 scsptr;
++ u16 hssrr;
++ u16 scpcr;
++ u16 scpdr;
+ u8 scbrr;
+ u8 semr;
+ };
+@@ -3491,6 +3496,10 @@ static void sci_console_save(struct sci_
+ struct sci_suspend_regs *regs = &s->suspend_regs;
+ struct uart_port *port = &s->port;
+
++ if (sci_getreg(port, SCDL)->size)
++ regs->scdl = sci_serial_in(port, SCDL);
++ if (sci_getreg(port, SCCKS)->size)
++ regs->sccks = sci_serial_in(port, SCCKS);
+ if (sci_getreg(port, SCSMR)->size)
+ regs->scsmr = sci_serial_in(port, SCSMR);
+ if (sci_getreg(port, SCSCR)->size)
+@@ -3501,6 +3510,12 @@ static void sci_console_save(struct sci_
+ regs->scsptr = sci_serial_in(port, SCSPTR);
+ if (sci_getreg(port, SCBRR)->size)
+ regs->scbrr = sci_serial_in(port, SCBRR);
++ if (sci_getreg(port, HSSRR)->size)
++ regs->hssrr = sci_serial_in(port, HSSRR);
++ if (sci_getreg(port, SCPCR)->size)
++ regs->scpcr = sci_serial_in(port, SCPCR);
++ if (sci_getreg(port, SCPDR)->size)
++ regs->scpdr = sci_serial_in(port, SCPDR);
+ if (sci_getreg(port, SEMR)->size)
+ regs->semr = sci_serial_in(port, SEMR);
+ }
+@@ -3510,6 +3525,10 @@ static void sci_console_restore(struct s
+ struct sci_suspend_regs *regs = &s->suspend_regs;
+ struct uart_port *port = &s->port;
+
++ if (sci_getreg(port, SCDL)->size)
++ sci_serial_out(port, SCDL, regs->scdl);
++ if (sci_getreg(port, SCCKS)->size)
++ sci_serial_out(port, SCCKS, regs->sccks);
+ if (sci_getreg(port, SCSMR)->size)
+ sci_serial_out(port, SCSMR, regs->scsmr);
+ if (sci_getreg(port, SCSCR)->size)
+@@ -3520,6 +3539,12 @@ static void sci_console_restore(struct s
+ sci_serial_out(port, SCSPTR, regs->scsptr);
+ if (sci_getreg(port, SCBRR)->size)
+ sci_serial_out(port, SCBRR, regs->scbrr);
++ if (sci_getreg(port, HSSRR)->size)
++ sci_serial_out(port, HSSRR, regs->hssrr);
++ if (sci_getreg(port, SCPCR)->size)
++ sci_serial_out(port, SCPCR, regs->scpcr);
++ if (sci_getreg(port, SCPDR)->size)
++ sci_serial_out(port, SCPDR, regs->scpdr);
+ if (sci_getreg(port, SEMR)->size)
+ sci_serial_out(port, SEMR, regs->semr);
+ }
x86-boot-compile-boot-code-with-std-gnu11-too.patch
highmem-add-folio_test_partial_kmap.patch
pds_core-prevent-possible-adminq-overflow-stuck-condition.patch
+serial-sh-sci-save-and-restore-more-registers.patch
+watchdog-aspeed-fix-64-bit-division.patch
+pinctrl-tegra-fix-off-by-one-in-tegra_pinctrl_get_group.patch
+i3c-master-svc-fix-implicit-fallthrough-in-svc_i3c_master_ibi_work.patch
+x86-mm-init-handle-the-special-case-of-device-private-pages-in-add_pages-to-not-increase-max_pfn-and-trigger-dma_addressing_limited-bounce-buffers.patch
+drm-gem-internally-test-import_attach-for-imported-objects.patch
--- /dev/null
+From 48a136639ec233614a61653e19f559977d5da2b5 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 14 Mar 2025 17:02:44 +0100
+Subject: watchdog: aspeed: fix 64-bit division
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 48a136639ec233614a61653e19f559977d5da2b5 upstream.
+
+On 32-bit architectures, the new calculation causes a build failure:
+
+ld.lld-21: error: undefined symbol: __aeabi_uldivmod
+
+Since neither value is ever larger than a register, cast both
+sides into a uintptr_t.
+
+Fixes: 5c03f9f4d362 ("watchdog: aspeed: Update bootstatus handling")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20250314160248.502324-1-arnd@kernel.org
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/watchdog/aspeed_wdt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/watchdog/aspeed_wdt.c
++++ b/drivers/watchdog/aspeed_wdt.c
+@@ -252,7 +252,7 @@ static void aspeed_wdt_update_bootstatus
+
+ if (!of_device_is_compatible(pdev->dev.of_node, "aspeed,ast2400-wdt")) {
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- idx = ((intptr_t)wdt->base & 0x00000fff) / resource_size(res);
++ idx = ((intptr_t)wdt->base & 0x00000fff) / (uintptr_t)resource_size(res);
+ }
+
+ scu_base = syscon_regmap_lookup_by_compatible(scu.compatible);
--- /dev/null
+From 7170130e4c72ce0caa0cb42a1627c635cc262821 Mon Sep 17 00:00:00 2001
+From: Balbir Singh <balbirs@nvidia.com>
+Date: Tue, 1 Apr 2025 11:07:52 +1100
+Subject: x86/mm/init: Handle the special case of device private pages in add_pages(), to not increase max_pfn and trigger dma_addressing_limited() bounce buffers
+ bounce buffers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Balbir Singh <balbirs@nvidia.com>
+
+commit 7170130e4c72ce0caa0cb42a1627c635cc262821 upstream.
+
+As Bert Karwatzki reported, the following recent commit causes a
+performance regression on AMD iGPU and dGPU systems:
+
+ 7ffb791423c7 ("x86/kaslr: Reduce KASLR entropy on most x86 systems")
+
+It exposed a bug with nokaslr and zone device interaction.
+
+The root cause of the bug is that, the GPU driver registers a zone
+device private memory region. When KASLR is disabled or the above commit
+is applied, the direct_map_physmem_end is set to much higher than 10 TiB
+typically to the 64TiB address. When zone device private memory is added
+to the system via add_pages(), it bumps up the max_pfn to the same
+value. This causes dma_addressing_limited() to return true, since the
+device cannot address memory all the way up to max_pfn.
+
+This caused a regression for games played on the iGPU, as it resulted in
+the DMA32 zone being used for GPU allocations.
+
+Fix this by not bumping up max_pfn on x86 systems, when pgmap is passed
+into add_pages(). The presence of pgmap is used to determine if device
+private memory is being added via add_pages().
+
+More details:
+
+devm_request_mem_region() and request_free_mem_region() request for
+device private memory. iomem_resource is passed as the base resource
+with start and end parameters. iomem_resource's end depends on several
+factors, including the platform and virtualization. On x86 for example
+on bare metal, this value is set to boot_cpu_data.x86_phys_bits.
+boot_cpu_data.x86_phys_bits can change depending on support for MKTME.
+By default it is set to the same as log2(direct_map_physmem_end) which
+is 46 to 52 bits depending on the number of levels in the page table.
+The allocation routines used iomem_resource's end and
+direct_map_physmem_end to figure out where to allocate the region.
+
+[ arch/powerpc is also impacted by this problem, but this patch does not fix
+ the issue for PowerPC. ]
+
+Testing:
+
+ 1. Tested on a virtual machine with test_hmm for zone device inseration
+
+ 2. A previous version of this patch was tested by Bert, please see:
+ https://lore.kernel.org/lkml/d87680bab997fdc9fb4e638983132af235d9a03a.camel@web.de/
+
+[ mingo: Clarified the comments and the changelog. ]
+
+Reported-by: Bert Karwatzki <spasswolf@web.de>
+Tested-by: Bert Karwatzki <spasswolf@web.de>
+Fixes: 7ffb791423c7 ("x86/kaslr: Reduce KASLR entropy on most x86 systems")
+Signed-off-by: Balbir Singh <balbirs@nvidia.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Brian Gerst <brgerst@gmail.com>
+Cc: Juergen Gross <jgross@suse.com>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Cc: David Airlie <airlied@gmail.com>
+Cc: Simona Vetter <simona@ffwll.ch>
+Link: https://lore.kernel.org/r/20250401000752.249348-1-balbirs@nvidia.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/mm/init_64.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/mm/init_64.c
++++ b/arch/x86/mm/init_64.c
+@@ -959,9 +959,18 @@ int add_pages(int nid, unsigned long sta
+ ret = __add_pages(nid, start_pfn, nr_pages, params);
+ WARN_ON_ONCE(ret);
+
+- /* update max_pfn, max_low_pfn and high_memory */
+- update_end_of_memory_vars(start_pfn << PAGE_SHIFT,
+- nr_pages << PAGE_SHIFT);
++ /*
++ * Special case: add_pages() is called by memremap_pages() for adding device
++ * private pages. Do not bump up max_pfn in the device private path,
++ * because max_pfn changes affect dma_addressing_limited().
++ *
++ * dma_addressing_limited() returning true when max_pfn is the device's
++ * addressable memory can force device drivers to use bounce buffers
++ * and impact their performance negatively:
++ */
++ if (!params->pgmap)
++ /* update max_pfn, max_low_pfn and high_memory */
++ update_end_of_memory_vars(start_pfn << PAGE_SHIFT, nr_pages << PAGE_SHIFT);
+
+ return ret;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
