--- /dev/null
+From 2fefaf8aeb2e5f0bd564195a2559298f589a4730 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Mar 2024 20:30:08 +0800
+Subject: media: mediatek: vcodec: adding lock to protect decoder context list
+
+From: Yunfei Dong <yunfei.dong@mediatek.com>
+
+[ Upstream commit 6467cda18c9f9b5f2f9a0aa1e2861c653e41f382 ]
+
+Add a lock for the ctx_list, to avoid accessing a NULL pointer
+within the 'vpu_dec_ipi_handler' function when the ctx_list has
+been deleted due to an unexpected behavior on the SCP IP block.
+
+Hardware name: Google juniper sku16 board (DT)
+pstate: 20400005 (nzCv daif +PAN -UAO -TCO BTYPE=--)
+pc : vpu_dec_ipi_handler+0x58/0x1f8 [mtk_vcodec_dec]
+lr : scp_ipi_handler+0xd0/0x194 [mtk_scp]
+sp : ffffffc0131dbbd0
+x29: ffffffc0131dbbd0 x28: 0000000000000000
+x27: ffffff9bb277f348 x26: ffffff9bb242ad00
+x25: ffffffd2d440d3b8 x24: ffffffd2a13ff1d4
+x23: ffffff9bb7fe85a0 x22: ffffffc0133fbdb0
+x21: 0000000000000010 x20: ffffff9b050ea328
+x19: ffffffc0131dbc08 x18: 0000000000001000
+x17: 0000000000000000 x16: ffffffd2d461c6e0
+x15: 0000000000000242 x14: 000000000000018f
+x13: 000000000000004d x12: 0000000000000000
+x11: 0000000000000001 x10: fffffffffffffff0
+x9 : ffffff9bb6e793a8 x8 : 0000000000000000
+x7 : 0000000000000000 x6 : 000000000000003f
+x5 : 0000000000000040 x4 : fffffffffffffff0
+x3 : 0000000000000020 x2 : ffffff9bb6e79080
+x1 : 0000000000000010 x0 : ffffffc0131dbc08
+Call trace:
+vpu_dec_ipi_handler+0x58/0x1f8 [mtk_vcodec_dec (HASH:6c3f 2)]
+scp_ipi_handler+0xd0/0x194 [mtk_scp (HASH:7046 3)]
+mt8183_scp_irq_handler+0x44/0x88 [mtk_scp (HASH:7046 3)]
+scp_irq_handler+0x48/0x90 [mtk_scp (HASH:7046 3)]
+irq_thread_fn+0x38/0x94
+irq_thread+0x100/0x1c0
+kthread+0x140/0x1fc
+ret_from_fork+0x10/0x30
+Code: 54000088 f94ca50a eb14015f 54000060 (f9400108)
+---[ end trace ace43ce36cbd5c93 ]---
+Kernel panic - not syncing: Oops: Fatal exception
+SMP: stopping secondary CPUs
+Kernel Offset: 0x12c4000000 from 0xffffffc010000000
+PHYS_OFFSET: 0xffffffe580000000
+CPU features: 0x08240002,2188200c
+Memory Limit: none
+
+Fixes: 655b86e52eac ("media: mediatek: vcodec: Fix possible invalid memory access for decoder")
+Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c | 4 ++--
+ .../platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c | 5 +++++
+ .../platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h | 2 ++
+ drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c | 2 ++
+ 4 files changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
+index 4c34344dc7dcb..62cafe25fed94 100644
+--- a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
++++ b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
+@@ -50,12 +50,12 @@ static void mtk_vcodec_vpu_reset_dec_handler(void *priv)
+
+ dev_err(&dev->plat_dev->dev, "Watchdog timeout!!");
+
+- mutex_lock(&dev->dev_mutex);
++ mutex_lock(&dev->dev_ctx_lock);
+ list_for_each_entry(ctx, &dev->ctx_list, list) {
+ ctx->state = MTK_STATE_ABORT;
+ mtk_v4l2_vdec_dbg(0, ctx, "[%d] Change to state MTK_STATE_ABORT", ctx->id);
+ }
+- mutex_unlock(&dev->dev_mutex);
++ mutex_unlock(&dev->dev_ctx_lock);
+ }
+
+ static void mtk_vcodec_vpu_reset_enc_handler(void *priv)
+diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
+index f47c98faf068b..2073781ccadb1 100644
+--- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
++++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
+@@ -268,7 +268,9 @@ static int fops_vcodec_open(struct file *file)
+
+ ctx->dev->vdec_pdata->init_vdec_params(ctx);
+
++ mutex_lock(&dev->dev_ctx_lock);
+ list_add(&ctx->list, &dev->ctx_list);
++ mutex_unlock(&dev->dev_ctx_lock);
+ mtk_vcodec_dbgfs_create(ctx);
+
+ mutex_unlock(&dev->dev_mutex);
+@@ -311,7 +313,9 @@ static int fops_vcodec_release(struct file *file)
+ v4l2_ctrl_handler_free(&ctx->ctrl_hdl);
+
+ mtk_vcodec_dbgfs_remove(dev, ctx->id);
++ mutex_lock(&dev->dev_ctx_lock);
+ list_del_init(&ctx->list);
++ mutex_unlock(&dev->dev_ctx_lock);
+ kfree(ctx);
+ mutex_unlock(&dev->dev_mutex);
+ return 0;
+@@ -404,6 +408,7 @@ static int mtk_vcodec_probe(struct platform_device *pdev)
+ for (i = 0; i < MTK_VDEC_HW_MAX; i++)
+ mutex_init(&dev->dec_mutex[i]);
+ mutex_init(&dev->dev_mutex);
++ mutex_init(&dev->dev_ctx_lock);
+ spin_lock_init(&dev->irqlock);
+
+ snprintf(dev->v4l2_dev.name, sizeof(dev->v4l2_dev.name), "%s",
+diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h
+index 849b89dd205c2..85b2c0d3d8bcd 100644
+--- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h
++++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h
+@@ -241,6 +241,7 @@ struct mtk_vcodec_dec_ctx {
+ *
+ * @dec_mutex: decoder hardware lock
+ * @dev_mutex: video_device lock
++ * @dev_ctx_lock: the lock of context list
+ * @decode_workqueue: decode work queue
+ *
+ * @irqlock: protect data access by irq handler and work thread
+@@ -282,6 +283,7 @@ struct mtk_vcodec_dec_dev {
+ /* decoder hardware mutex lock */
+ struct mutex dec_mutex[MTK_VDEC_HW_MAX];
+ struct mutex dev_mutex;
++ struct mutex dev_ctx_lock;
+ struct workqueue_struct *decode_workqueue;
+
+ spinlock_t irqlock;
+diff --git a/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c b/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c
+index 82e57ae983d55..da6be556727bb 100644
+--- a/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c
++++ b/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c
+@@ -77,12 +77,14 @@ static bool vpu_dec_check_ap_inst(struct mtk_vcodec_dec_dev *dec_dev, struct vde
+ struct mtk_vcodec_dec_ctx *ctx;
+ int ret = false;
+
++ mutex_lock(&dec_dev->dev_ctx_lock);
+ list_for_each_entry(ctx, &dec_dev->ctx_list, list) {
+ if (!IS_ERR_OR_NULL(ctx) && ctx->vpu_inst == vpu) {
+ ret = true;
+ break;
+ }
+ }
++ mutex_unlock(&dec_dev->dev_ctx_lock);
+
+ return ret;
+ }
+--
+2.43.0
+
--- /dev/null
+From d127d19b73d6164afd4a623b0bfd206794df273f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Mar 2024 20:30:09 +0800
+Subject: media: mediatek: vcodec: adding lock to protect encoder context list
+
+From: Yunfei Dong <yunfei.dong@mediatek.com>
+
+[ Upstream commit afaaf3a0f647a24a7bf6a2145d8ade37baaf75ad ]
+
+Add a lock for the ctx_list, to avoid accessing a NULL pointer
+within the 'vpu_enc_ipi_handler' function when the ctx_list has
+been deleted due to an unexpected behavior on the SCP IP block.
+
+Fixes: 1972e32431ed ("media: mediatek: vcodec: Fix possible invalid memory access for encoder")
+Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c | 4 ++--
+ .../platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c | 5 +++++
+ .../platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h | 2 ++
+ drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c | 2 ++
+ 4 files changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
+index 62cafe25fed94..d7027d600208f 100644
+--- a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
++++ b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
+@@ -65,12 +65,12 @@ static void mtk_vcodec_vpu_reset_enc_handler(void *priv)
+
+ dev_err(&dev->plat_dev->dev, "Watchdog timeout!!");
+
+- mutex_lock(&dev->dev_mutex);
++ mutex_lock(&dev->dev_ctx_lock);
+ list_for_each_entry(ctx, &dev->ctx_list, list) {
+ ctx->state = MTK_STATE_ABORT;
+ mtk_v4l2_vdec_dbg(0, ctx, "[%d] Change to state MTK_STATE_ABORT", ctx->id);
+ }
+- mutex_unlock(&dev->dev_mutex);
++ mutex_unlock(&dev->dev_ctx_lock);
+ }
+
+ static const struct mtk_vcodec_fw_ops mtk_vcodec_vpu_msg = {
+diff --git a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c
+index 6319f24bc714b..3cb8a16222220 100644
+--- a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c
++++ b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c
+@@ -177,7 +177,9 @@ static int fops_vcodec_open(struct file *file)
+ mtk_v4l2_venc_dbg(2, ctx, "Create instance [%d]@%p m2m_ctx=%p ",
+ ctx->id, ctx, ctx->m2m_ctx);
+
++ mutex_lock(&dev->dev_ctx_lock);
+ list_add(&ctx->list, &dev->ctx_list);
++ mutex_unlock(&dev->dev_ctx_lock);
+
+ mutex_unlock(&dev->dev_mutex);
+ mtk_v4l2_venc_dbg(0, ctx, "%s encoder [%d]", dev_name(&dev->plat_dev->dev),
+@@ -212,7 +214,9 @@ static int fops_vcodec_release(struct file *file)
+ v4l2_fh_exit(&ctx->fh);
+ v4l2_ctrl_handler_free(&ctx->ctrl_hdl);
+
++ mutex_lock(&dev->dev_ctx_lock);
+ list_del_init(&ctx->list);
++ mutex_unlock(&dev->dev_ctx_lock);
+ kfree(ctx);
+ mutex_unlock(&dev->dev_mutex);
+ return 0;
+@@ -294,6 +298,7 @@ static int mtk_vcodec_probe(struct platform_device *pdev)
+
+ mutex_init(&dev->enc_mutex);
+ mutex_init(&dev->dev_mutex);
++ mutex_init(&dev->dev_ctx_lock);
+ spin_lock_init(&dev->irqlock);
+
+ snprintf(dev->v4l2_dev.name, sizeof(dev->v4l2_dev.name), "%s",
+diff --git a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h
+index a042f607ed8d1..0bd85d0fb379a 100644
+--- a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h
++++ b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h
+@@ -178,6 +178,7 @@ struct mtk_vcodec_enc_ctx {
+ *
+ * @enc_mutex: encoder hardware lock.
+ * @dev_mutex: video_device lock
++ * @dev_ctx_lock: the lock of context list
+ * @encode_workqueue: encode work queue
+ *
+ * @enc_irq: h264 encoder irq resource
+@@ -205,6 +206,7 @@ struct mtk_vcodec_enc_dev {
+ /* encoder hardware mutex lock */
+ struct mutex enc_mutex;
+ struct mutex dev_mutex;
++ struct mutex dev_ctx_lock;
+ struct workqueue_struct *encode_workqueue;
+
+ int enc_irq;
+diff --git a/drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c b/drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c
+index 84ad1cc6ad171..51bb7ee141b9e 100644
+--- a/drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c
++++ b/drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c
+@@ -47,12 +47,14 @@ static bool vpu_enc_check_ap_inst(struct mtk_vcodec_enc_dev *enc_dev, struct ven
+ struct mtk_vcodec_enc_ctx *ctx;
+ int ret = false;
+
++ mutex_lock(&enc_dev->dev_ctx_lock);
+ list_for_each_entry(ctx, &enc_dev->ctx_list, list) {
+ if (!IS_ERR_OR_NULL(ctx) && ctx->vpu_inst == vpu) {
+ ret = true;
+ break;
+ }
+ }
++ mutex_unlock(&enc_dev->dev_ctx_lock);
+
+ return ret;
+ }
+--
+2.43.0
+
--- /dev/null
+From 2e680d62bd7f997857d5b2d86767d1b35f7605d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Feb 2024 16:19:52 -0500
+Subject: media: mediatek: vcodec: Fix oops when HEVC init fails
+
+From: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+
+[ Upstream commit 97c75ee5de060d271d80109b0c47cb6008439e5b ]
+
+The stateless HEVC decoder saves the instance pointer in the context
+regardless if the initialization worked or not. This caused a use after
+free, when the pointer is freed in case of a failure in the deinit
+function.
+Only store the instance pointer when the initialization was successful,
+to solve this issue.
+
+ Hardware name: Acer Tomato (rev3 - 4) board (DT)
+ pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+ pc : vcodec_vpu_send_msg+0x4c/0x190 [mtk_vcodec_dec]
+ lr : vcodec_send_ap_ipi+0x78/0x170 [mtk_vcodec_dec]
+ sp : ffff80008750bc20
+ x29: ffff80008750bc20 x28: ffff1299f6d70000 x27: 0000000000000000
+ x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
+ x23: ffff80008750bc98 x22: 000000000000a003 x21: ffffd45c4cfae000
+ x20: 0000000000000010 x19: ffff1299fd668310 x18: 000000000000001a
+ x17: 000000040044ffff x16: ffffd45cb15dc648 x15: 0000000000000000
+ x14: ffff1299c08da1c0 x13: ffffd45cb1f87a10 x12: ffffd45cb2f5fe80
+ x11: 0000000000000001 x10: 0000000000001b30 x9 : ffffd45c4d12b488
+ x8 : 1fffe25339380d81 x7 : 0000000000000001 x6 : ffff1299c9c06c00
+ x5 : 0000000000000132 x4 : 0000000000000000 x3 : 0000000000000000
+ x2 : 0000000000000010 x1 : ffff80008750bc98 x0 : 0000000000000000
+ Call trace:
+ vcodec_vpu_send_msg+0x4c/0x190 [mtk_vcodec_dec]
+ vcodec_send_ap_ipi+0x78/0x170 [mtk_vcodec_dec]
+ vpu_dec_deinit+0x1c/0x30 [mtk_vcodec_dec]
+ vdec_hevc_slice_deinit+0x30/0x98 [mtk_vcodec_dec]
+ vdec_if_deinit+0x38/0x68 [mtk_vcodec_dec]
+ mtk_vcodec_dec_release+0x20/0x40 [mtk_vcodec_dec]
+ fops_vcodec_release+0x64/0x118 [mtk_vcodec_dec]
+ v4l2_release+0x7c/0x100
+ __fput+0x80/0x2d8
+ __fput_sync+0x58/0x70
+ __arm64_sys_close+0x40/0x90
+ invoke_syscall+0x50/0x128
+ el0_svc_common.constprop.0+0x48/0xf0
+ do_el0_svc+0x24/0x38
+ el0_svc+0x38/0xd8
+ el0t_64_sync_handler+0xc0/0xc8
+ el0t_64_sync+0x1a8/0x1b0
+ Code: d503201f f9401660 b900127f b900227f (f9400400)
+
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Fixes: 2674486aac7d ("media: mediatek: vcodec: support stateless hevc decoder")
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c
+index 06ed47df693bf..21836dd6ef85a 100644
+--- a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c
++++ b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c
+@@ -869,7 +869,6 @@ static int vdec_hevc_slice_init(struct mtk_vcodec_dec_ctx *ctx)
+ inst->vpu.codec_type = ctx->current_codec;
+ inst->vpu.capture_type = ctx->capture_fourcc;
+
+- ctx->drv_handle = inst;
+ err = vpu_dec_init(&inst->vpu);
+ if (err) {
+ mtk_vdec_err(ctx, "vdec_hevc init err=%d", err);
+@@ -898,6 +897,7 @@ static int vdec_hevc_slice_init(struct mtk_vcodec_dec_ctx *ctx)
+ mtk_vdec_debug(ctx, "lat hevc instance >> %p, codec_type = 0x%x",
+ inst, inst->vpu.codec_type);
+
++ ctx->drv_handle = inst;
+ return 0;
+ error_free_inst:
+ kfree(inst);
+--
+2.43.0
+
--- /dev/null
+From 0f7b66430032dfc3b05586fb97ff5da6121f7047 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Apr 2024 16:42:43 +1000
+Subject: nouveau: fix devinit paths to only handle display on GSP.
+
+From: Dave Airlie <airlied@gmail.com>
+
+[ Upstream commit 718c4fb221dbeff9072810841b949413c5ffc345 ]
+
+This reverts:
+nouveau/gsp: don't check devinit disable on GSP.
+and applies a further fix.
+
+It turns out the open gpu driver, checks this register,
+but only for display.
+
+Match that behaviour and in the turing path only disable
+the display block. (ampere already only does displays).
+
+Fixes: 5d4e8ae6e57b ("nouveau/gsp: don't check devinit disable on GSP.")
+Reviewed-by: Danilo Krummrich <dakr@redhat.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240408064243.2219527-1-airlied@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm107.c | 12 ++++++++----
+ drivers/gpu/drm/nouveau/nvkm/subdev/devinit/r535.c | 1 +
+ 2 files changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm107.c b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm107.c
+index 7bcbc4895ec22..271bfa038f5bc 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm107.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm107.c
+@@ -25,6 +25,7 @@
+
+ #include <subdev/bios.h>
+ #include <subdev/bios/init.h>
++#include <subdev/gsp.h>
+
+ void
+ gm107_devinit_disable(struct nvkm_devinit *init)
+@@ -33,10 +34,13 @@ gm107_devinit_disable(struct nvkm_devinit *init)
+ u32 r021c00 = nvkm_rd32(device, 0x021c00);
+ u32 r021c04 = nvkm_rd32(device, 0x021c04);
+
+- if (r021c00 & 0x00000001)
+- nvkm_subdev_disable(device, NVKM_ENGINE_CE, 0);
+- if (r021c00 & 0x00000004)
+- nvkm_subdev_disable(device, NVKM_ENGINE_CE, 2);
++ /* gsp only wants to enable/disable display */
++ if (!nvkm_gsp_rm(device->gsp)) {
++ if (r021c00 & 0x00000001)
++ nvkm_subdev_disable(device, NVKM_ENGINE_CE, 0);
++ if (r021c00 & 0x00000004)
++ nvkm_subdev_disable(device, NVKM_ENGINE_CE, 2);
++ }
+ if (r021c04 & 0x00000001)
+ nvkm_subdev_disable(device, NVKM_ENGINE_DISP, 0);
+ }
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/r535.c b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/r535.c
+index 11b4c9c274a1a..666eb93b1742c 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/r535.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/r535.c
+@@ -41,6 +41,7 @@ r535_devinit_new(const struct nvkm_devinit_func *hw,
+
+ rm->dtor = r535_devinit_dtor;
+ rm->post = hw->post;
++ rm->disable = hw->disable;
+
+ ret = nv50_devinit_new_(rm, device, type, inst, pdevinit);
+ if (ret)
+--
+2.43.0
+
--- /dev/null
+From 54aae6802f6cee97a0d2f2c0b41a01022eee3ef3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Apr 2024 08:41:45 -0300
+Subject: platform/x86/intel/hid: Don't wake on 5-button releases
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David McFarland <corngood@gmail.com>
+
+[ Upstream commit 5864e479ca4344f3a5df8074524da24c960f440b ]
+
+If, for example, the power button is configured to suspend, holding it
+and releasing it after the machine has suspended, will wake the machine.
+
+Also on some machines, power button release events are sent during
+hibernation, even if the button wasn't used to hibernate the machine.
+This causes hibernation to be aborted.
+
+Fixes: 0c4cae1bc00d ("PM: hibernate: Avoid missing wakeup events during hibernation")
+Signed-off-by: David McFarland <corngood@gmail.com>
+Tested-by: Enrik Berkhan <Enrik.Berkhan@inka.de>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/878r1tpd6u.fsf_-_@gmail.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/hid.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/intel/hid.c b/drivers/platform/x86/intel/hid.c
+index 7457ca2b27a60..9ffbdc988fe50 100644
+--- a/drivers/platform/x86/intel/hid.c
++++ b/drivers/platform/x86/intel/hid.c
+@@ -504,6 +504,7 @@ static void notify_handler(acpi_handle handle, u32 event, void *context)
+ struct platform_device *device = context;
+ struct intel_hid_priv *priv = dev_get_drvdata(&device->dev);
+ unsigned long long ev_index;
++ struct key_entry *ke;
+ int err;
+
+ /*
+@@ -545,11 +546,15 @@ static void notify_handler(acpi_handle handle, u32 event, void *context)
+ if (event == 0xc0 || !priv->array)
+ return;
+
+- if (!sparse_keymap_entry_from_scancode(priv->array, event)) {
++ ke = sparse_keymap_entry_from_scancode(priv->array, event);
++ if (!ke) {
+ dev_info(&device->dev, "unknown event 0x%x\n", event);
+ return;
+ }
+
++ if (ke->type == KE_IGNORE)
++ return;
++
+ wakeup:
+ pm_wakeup_hard_event(&device->dev);
+
+--
+2.43.0
+
--- /dev/null
+From 186a8f34fbbb4e32eeb02627cce5078f9703467a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Mar 2024 07:32:06 -0700
+Subject: platform/x86: intel-vbtn: Update tablet mode switch at end of probe
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Gwendal Grignou <gwendal@chromium.org>
+
+[ Upstream commit 434e5781d8cd2d0ed512d920c6cdeba4b33a2e81 ]
+
+ACER Vivobook Flip (TP401NAS) virtual intel switch is implemented as
+follow:
+
+ Device (VGBI)
+ {
+ Name (_HID, EisaId ("INT33D6") ...
+ Name (VBDS, Zero)
+ Method (_STA, 0, Serialized) // _STA: Status ...
+ Method (VBDL, 0, Serialized)
+ {
+ PB1E |= 0x20
+ VBDS |= 0x40
+ }
+ Method (VGBS, 0, Serialized)
+ {
+ Return (VBDS) /* \_SB_.PCI0.SBRG.EC0_.VGBI.VBDS */
+ }
+ ...
+ }
+
+By default VBDS is set to 0. At boot it is set to clamshell (bit 6 set)
+only after method VBDL is executed.
+
+Since VBDL is now evaluated in the probe routine later, after the device
+is registered, the retrieved value of VBDS was still 0 ("tablet mode")
+when setting up the virtual switch.
+
+Make sure to evaluate VGBS after VBDL, to ensure the
+convertible boots in clamshell mode, the expected default.
+
+Fixes: 26173179fae1 ("platform/x86: intel-vbtn: Eval VBDL after registering our notifier")
+Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20240329143206.2977734-3-gwendal@chromium.org
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/vbtn.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/intel/vbtn.c b/drivers/platform/x86/intel/vbtn.c
+index 084c355c86f5f..5d13452bb947a 100644
+--- a/drivers/platform/x86/intel/vbtn.c
++++ b/drivers/platform/x86/intel/vbtn.c
+@@ -136,8 +136,6 @@ static int intel_vbtn_input_setup(struct platform_device *device)
+ priv->switches_dev->id.bustype = BUS_HOST;
+
+ if (priv->has_switches) {
+- detect_tablet_mode(&device->dev);
+-
+ ret = input_register_device(priv->switches_dev);
+ if (ret)
+ return ret;
+@@ -316,6 +314,9 @@ static int intel_vbtn_probe(struct platform_device *device)
+ if (ACPI_FAILURE(status))
+ dev_err(&device->dev, "Error VBDL failed with ACPI status %d\n", status);
+ }
++ // Check switches after buttons since VBDL may have side effects.
++ if (has_switches)
++ detect_tablet_mode(&device->dev);
+
+ device_init_wakeup(&device->dev, true);
+ /*
+--
+2.43.0
+
--- /dev/null
+From 3d39c175b3d80760a0b27950e55d7f7a1e873251 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Mar 2024 12:24:48 -0800
+Subject: randomize_kstack: Improve entropy diffusion
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit 9c573cd313433f6c1f7236fe64b9b743500c1628 ]
+
+The kstack_offset variable was really only ever using the low bits for
+kernel stack offset entropy. Add a ror32() to increase bit diffusion.
+
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Fixes: 39218ff4c625 ("stack: Optionally randomize kernel stack offset each syscall")
+Link: https://lore.kernel.org/r/20240309202445.work.165-kees@kernel.org
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/randomize_kstack.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/randomize_kstack.h b/include/linux/randomize_kstack.h
+index 5d868505a94e4..6d92b68efbf6c 100644
+--- a/include/linux/randomize_kstack.h
++++ b/include/linux/randomize_kstack.h
+@@ -80,7 +80,7 @@ DECLARE_PER_CPU(u32, kstack_offset);
+ if (static_branch_maybe(CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT, \
+ &randomize_kstack_offset)) { \
+ u32 offset = raw_cpu_read(kstack_offset); \
+- offset ^= (rand); \
++ offset = ror32(offset, 5) ^ (rand); \
+ raw_cpu_write(kstack_offset, offset); \
+ } \
+ } while (0)
+--
+2.43.0
+
alsa-hda-realtek-add-quirks-for-some-clevo-laptops.patch
drm-amdgpu-init-zone-device-and-drm-client-after-mod.patch
gcc-plugins-stackleak-avoid-.head.text-section.patch
+media-mediatek-vcodec-fix-oops-when-hevc-init-fails.patch
+media-mediatek-vcodec-adding-lock-to-protect-decoder.patch
+media-mediatek-vcodec-adding-lock-to-protect-encoder.patch
+randomize_kstack-improve-entropy-diffusion.patch
+platform-x86-intel-hid-don-t-wake-on-5-button-releas.patch
+platform-x86-intel-vbtn-update-tablet-mode-switch-at.patch
+nouveau-fix-devinit-paths-to-only-handle-display-on-.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
