]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
Fixes for 6.8
authorSasha Levin <sashal@kernel.org>
Thu, 11 Apr 2024 08:03:23 +0000 (04:03 -0400)
committerSasha Levin <sashal@kernel.org>
Thu, 11 Apr 2024 08:03:23 +0000 (04:03 -0400)
Signed-off-by: Sasha Levin <sashal@kernel.org>
queue-6.8/media-mediatek-vcodec-adding-lock-to-protect-decoder.patch [new file with mode: 0644]
queue-6.8/media-mediatek-vcodec-adding-lock-to-protect-encoder.patch [new file with mode: 0644]
queue-6.8/media-mediatek-vcodec-fix-oops-when-hevc-init-fails.patch [new file with mode: 0644]
queue-6.8/nouveau-fix-devinit-paths-to-only-handle-display-on-.patch [new file with mode: 0644]
queue-6.8/platform-x86-intel-hid-don-t-wake-on-5-button-releas.patch [new file with mode: 0644]
queue-6.8/platform-x86-intel-vbtn-update-tablet-mode-switch-at.patch [new file with mode: 0644]
queue-6.8/randomize_kstack-improve-entropy-diffusion.patch [new file with mode: 0644]
queue-6.8/series

diff --git a/queue-6.8/media-mediatek-vcodec-adding-lock-to-protect-decoder.patch b/queue-6.8/media-mediatek-vcodec-adding-lock-to-protect-decoder.patch
new file mode 100644 (file)
index 0000000..33b6bc6
--- /dev/null
@@ -0,0 +1,158 @@
+From 2fefaf8aeb2e5f0bd564195a2559298f589a4730 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Mar 2024 20:30:08 +0800
+Subject: media: mediatek: vcodec: adding lock to protect decoder context list
+
+From: Yunfei Dong <yunfei.dong@mediatek.com>
+
+[ Upstream commit 6467cda18c9f9b5f2f9a0aa1e2861c653e41f382 ]
+
+Add a lock for the ctx_list, to avoid accessing a NULL pointer
+within the 'vpu_dec_ipi_handler' function when the ctx_list has
+been deleted due to an unexpected behavior on the SCP IP block.
+
+Hardware name: Google juniper sku16 board (DT)
+pstate: 20400005 (nzCv daif +PAN -UAO -TCO BTYPE=--)
+pc : vpu_dec_ipi_handler+0x58/0x1f8 [mtk_vcodec_dec]
+lr : scp_ipi_handler+0xd0/0x194 [mtk_scp]
+sp : ffffffc0131dbbd0
+x29: ffffffc0131dbbd0 x28: 0000000000000000
+x27: ffffff9bb277f348 x26: ffffff9bb242ad00
+x25: ffffffd2d440d3b8 x24: ffffffd2a13ff1d4
+x23: ffffff9bb7fe85a0 x22: ffffffc0133fbdb0
+x21: 0000000000000010 x20: ffffff9b050ea328
+x19: ffffffc0131dbc08 x18: 0000000000001000
+x17: 0000000000000000 x16: ffffffd2d461c6e0
+x15: 0000000000000242 x14: 000000000000018f
+x13: 000000000000004d x12: 0000000000000000
+x11: 0000000000000001 x10: fffffffffffffff0
+x9 : ffffff9bb6e793a8 x8 : 0000000000000000
+x7 : 0000000000000000 x6 : 000000000000003f
+x5 : 0000000000000040 x4 : fffffffffffffff0
+x3 : 0000000000000020 x2 : ffffff9bb6e79080
+x1 : 0000000000000010 x0 : ffffffc0131dbc08
+Call trace:
+vpu_dec_ipi_handler+0x58/0x1f8 [mtk_vcodec_dec (HASH:6c3f 2)]
+scp_ipi_handler+0xd0/0x194 [mtk_scp (HASH:7046 3)]
+mt8183_scp_irq_handler+0x44/0x88 [mtk_scp (HASH:7046 3)]
+scp_irq_handler+0x48/0x90 [mtk_scp (HASH:7046 3)]
+irq_thread_fn+0x38/0x94
+irq_thread+0x100/0x1c0
+kthread+0x140/0x1fc
+ret_from_fork+0x10/0x30
+Code: 54000088 f94ca50a eb14015f 54000060 (f9400108)
+---[ end trace ace43ce36cbd5c93 ]---
+Kernel panic - not syncing: Oops: Fatal exception
+SMP: stopping secondary CPUs
+Kernel Offset: 0x12c4000000 from 0xffffffc010000000
+PHYS_OFFSET: 0xffffffe580000000
+CPU features: 0x08240002,2188200c
+Memory Limit: none
+
+Fixes: 655b86e52eac ("media: mediatek: vcodec: Fix possible invalid memory access for decoder")
+Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c      | 4 ++--
+ .../platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c    | 5 +++++
+ .../platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h    | 2 ++
+ drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c | 2 ++
+ 4 files changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
+index 4c34344dc7dcb..62cafe25fed94 100644
+--- a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
++++ b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
+@@ -50,12 +50,12 @@ static void mtk_vcodec_vpu_reset_dec_handler(void *priv)
+       dev_err(&dev->plat_dev->dev, "Watchdog timeout!!");
+-      mutex_lock(&dev->dev_mutex);
++      mutex_lock(&dev->dev_ctx_lock);
+       list_for_each_entry(ctx, &dev->ctx_list, list) {
+               ctx->state = MTK_STATE_ABORT;
+               mtk_v4l2_vdec_dbg(0, ctx, "[%d] Change to state MTK_STATE_ABORT", ctx->id);
+       }
+-      mutex_unlock(&dev->dev_mutex);
++      mutex_unlock(&dev->dev_ctx_lock);
+ }
+ static void mtk_vcodec_vpu_reset_enc_handler(void *priv)
+diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
+index f47c98faf068b..2073781ccadb1 100644
+--- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
++++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
+@@ -268,7 +268,9 @@ static int fops_vcodec_open(struct file *file)
+       ctx->dev->vdec_pdata->init_vdec_params(ctx);
++      mutex_lock(&dev->dev_ctx_lock);
+       list_add(&ctx->list, &dev->ctx_list);
++      mutex_unlock(&dev->dev_ctx_lock);
+       mtk_vcodec_dbgfs_create(ctx);
+       mutex_unlock(&dev->dev_mutex);
+@@ -311,7 +313,9 @@ static int fops_vcodec_release(struct file *file)
+       v4l2_ctrl_handler_free(&ctx->ctrl_hdl);
+       mtk_vcodec_dbgfs_remove(dev, ctx->id);
++      mutex_lock(&dev->dev_ctx_lock);
+       list_del_init(&ctx->list);
++      mutex_unlock(&dev->dev_ctx_lock);
+       kfree(ctx);
+       mutex_unlock(&dev->dev_mutex);
+       return 0;
+@@ -404,6 +408,7 @@ static int mtk_vcodec_probe(struct platform_device *pdev)
+       for (i = 0; i < MTK_VDEC_HW_MAX; i++)
+               mutex_init(&dev->dec_mutex[i]);
+       mutex_init(&dev->dev_mutex);
++      mutex_init(&dev->dev_ctx_lock);
+       spin_lock_init(&dev->irqlock);
+       snprintf(dev->v4l2_dev.name, sizeof(dev->v4l2_dev.name), "%s",
+diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h
+index 849b89dd205c2..85b2c0d3d8bcd 100644
+--- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h
++++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h
+@@ -241,6 +241,7 @@ struct mtk_vcodec_dec_ctx {
+  *
+  * @dec_mutex: decoder hardware lock
+  * @dev_mutex: video_device lock
++ * @dev_ctx_lock: the lock of context list
+  * @decode_workqueue: decode work queue
+  *
+  * @irqlock: protect data access by irq handler and work thread
+@@ -282,6 +283,7 @@ struct mtk_vcodec_dec_dev {
+       /* decoder hardware mutex lock */
+       struct mutex dec_mutex[MTK_VDEC_HW_MAX];
+       struct mutex dev_mutex;
++      struct mutex dev_ctx_lock;
+       struct workqueue_struct *decode_workqueue;
+       spinlock_t irqlock;
+diff --git a/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c b/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c
+index 82e57ae983d55..da6be556727bb 100644
+--- a/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c
++++ b/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c
+@@ -77,12 +77,14 @@ static bool vpu_dec_check_ap_inst(struct mtk_vcodec_dec_dev *dec_dev, struct vde
+       struct mtk_vcodec_dec_ctx *ctx;
+       int ret = false;
++      mutex_lock(&dec_dev->dev_ctx_lock);
+       list_for_each_entry(ctx, &dec_dev->ctx_list, list) {
+               if (!IS_ERR_OR_NULL(ctx) && ctx->vpu_inst == vpu) {
+                       ret = true;
+                       break;
+               }
+       }
++      mutex_unlock(&dec_dev->dev_ctx_lock);
+       return ret;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/media-mediatek-vcodec-adding-lock-to-protect-encoder.patch b/queue-6.8/media-mediatek-vcodec-adding-lock-to-protect-encoder.patch
new file mode 100644 (file)
index 0000000..728a3a3
--- /dev/null
@@ -0,0 +1,120 @@
+From d127d19b73d6164afd4a623b0bfd206794df273f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Mar 2024 20:30:09 +0800
+Subject: media: mediatek: vcodec: adding lock to protect encoder context list
+
+From: Yunfei Dong <yunfei.dong@mediatek.com>
+
+[ Upstream commit afaaf3a0f647a24a7bf6a2145d8ade37baaf75ad ]
+
+Add a lock for the ctx_list, to avoid accessing a NULL pointer
+within the 'vpu_enc_ipi_handler' function when the ctx_list has
+been deleted due to an unexpected behavior on the SCP IP block.
+
+Fixes: 1972e32431ed ("media: mediatek: vcodec: Fix possible invalid memory access for encoder")
+Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c      | 4 ++--
+ .../platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c    | 5 +++++
+ .../platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h    | 2 ++
+ drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c | 2 ++
+ 4 files changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
+index 62cafe25fed94..d7027d600208f 100644
+--- a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
++++ b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
+@@ -65,12 +65,12 @@ static void mtk_vcodec_vpu_reset_enc_handler(void *priv)
+       dev_err(&dev->plat_dev->dev, "Watchdog timeout!!");
+-      mutex_lock(&dev->dev_mutex);
++      mutex_lock(&dev->dev_ctx_lock);
+       list_for_each_entry(ctx, &dev->ctx_list, list) {
+               ctx->state = MTK_STATE_ABORT;
+               mtk_v4l2_vdec_dbg(0, ctx, "[%d] Change to state MTK_STATE_ABORT", ctx->id);
+       }
+-      mutex_unlock(&dev->dev_mutex);
++      mutex_unlock(&dev->dev_ctx_lock);
+ }
+ static const struct mtk_vcodec_fw_ops mtk_vcodec_vpu_msg = {
+diff --git a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c
+index 6319f24bc714b..3cb8a16222220 100644
+--- a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c
++++ b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c
+@@ -177,7 +177,9 @@ static int fops_vcodec_open(struct file *file)
+       mtk_v4l2_venc_dbg(2, ctx, "Create instance [%d]@%p m2m_ctx=%p ",
+                         ctx->id, ctx, ctx->m2m_ctx);
++      mutex_lock(&dev->dev_ctx_lock);
+       list_add(&ctx->list, &dev->ctx_list);
++      mutex_unlock(&dev->dev_ctx_lock);
+       mutex_unlock(&dev->dev_mutex);
+       mtk_v4l2_venc_dbg(0, ctx, "%s encoder [%d]", dev_name(&dev->plat_dev->dev),
+@@ -212,7 +214,9 @@ static int fops_vcodec_release(struct file *file)
+       v4l2_fh_exit(&ctx->fh);
+       v4l2_ctrl_handler_free(&ctx->ctrl_hdl);
++      mutex_lock(&dev->dev_ctx_lock);
+       list_del_init(&ctx->list);
++      mutex_unlock(&dev->dev_ctx_lock);
+       kfree(ctx);
+       mutex_unlock(&dev->dev_mutex);
+       return 0;
+@@ -294,6 +298,7 @@ static int mtk_vcodec_probe(struct platform_device *pdev)
+       mutex_init(&dev->enc_mutex);
+       mutex_init(&dev->dev_mutex);
++      mutex_init(&dev->dev_ctx_lock);
+       spin_lock_init(&dev->irqlock);
+       snprintf(dev->v4l2_dev.name, sizeof(dev->v4l2_dev.name), "%s",
+diff --git a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h
+index a042f607ed8d1..0bd85d0fb379a 100644
+--- a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h
++++ b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h
+@@ -178,6 +178,7 @@ struct mtk_vcodec_enc_ctx {
+  *
+  * @enc_mutex: encoder hardware lock.
+  * @dev_mutex: video_device lock
++ * @dev_ctx_lock: the lock of context list
+  * @encode_workqueue: encode work queue
+  *
+  * @enc_irq: h264 encoder irq resource
+@@ -205,6 +206,7 @@ struct mtk_vcodec_enc_dev {
+       /* encoder hardware mutex lock */
+       struct mutex enc_mutex;
+       struct mutex dev_mutex;
++      struct mutex dev_ctx_lock;
+       struct workqueue_struct *encode_workqueue;
+       int enc_irq;
+diff --git a/drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c b/drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c
+index 84ad1cc6ad171..51bb7ee141b9e 100644
+--- a/drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c
++++ b/drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c
+@@ -47,12 +47,14 @@ static bool vpu_enc_check_ap_inst(struct mtk_vcodec_enc_dev *enc_dev, struct ven
+       struct mtk_vcodec_enc_ctx *ctx;
+       int ret = false;
++      mutex_lock(&enc_dev->dev_ctx_lock);
+       list_for_each_entry(ctx, &enc_dev->ctx_list, list) {
+               if (!IS_ERR_OR_NULL(ctx) && ctx->vpu_inst == vpu) {
+                       ret = true;
+                       break;
+               }
+       }
++      mutex_unlock(&enc_dev->dev_ctx_lock);
+       return ret;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/media-mediatek-vcodec-fix-oops-when-hevc-init-fails.patch b/queue-6.8/media-mediatek-vcodec-fix-oops-when-hevc-init-fails.patch
new file mode 100644 (file)
index 0000000..8d511aa
--- /dev/null
@@ -0,0 +1,84 @@
+From 2e680d62bd7f997857d5b2d86767d1b35f7605d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Feb 2024 16:19:52 -0500
+Subject: media: mediatek: vcodec: Fix oops when HEVC init fails
+
+From: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+
+[ Upstream commit 97c75ee5de060d271d80109b0c47cb6008439e5b ]
+
+The stateless HEVC decoder saves the instance pointer in the context
+regardless if the initialization worked or not. This caused a use after
+free, when the pointer is freed in case of a failure in the deinit
+function.
+Only store the instance pointer when the initialization was successful,
+to solve this issue.
+
+ Hardware name: Acer Tomato (rev3 - 4) board (DT)
+ pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+ pc : vcodec_vpu_send_msg+0x4c/0x190 [mtk_vcodec_dec]
+ lr : vcodec_send_ap_ipi+0x78/0x170 [mtk_vcodec_dec]
+ sp : ffff80008750bc20
+ x29: ffff80008750bc20 x28: ffff1299f6d70000 x27: 0000000000000000
+ x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
+ x23: ffff80008750bc98 x22: 000000000000a003 x21: ffffd45c4cfae000
+ x20: 0000000000000010 x19: ffff1299fd668310 x18: 000000000000001a
+ x17: 000000040044ffff x16: ffffd45cb15dc648 x15: 0000000000000000
+ x14: ffff1299c08da1c0 x13: ffffd45cb1f87a10 x12: ffffd45cb2f5fe80
+ x11: 0000000000000001 x10: 0000000000001b30 x9 : ffffd45c4d12b488
+ x8 : 1fffe25339380d81 x7 : 0000000000000001 x6 : ffff1299c9c06c00
+ x5 : 0000000000000132 x4 : 0000000000000000 x3 : 0000000000000000
+ x2 : 0000000000000010 x1 : ffff80008750bc98 x0 : 0000000000000000
+ Call trace:
+  vcodec_vpu_send_msg+0x4c/0x190 [mtk_vcodec_dec]
+  vcodec_send_ap_ipi+0x78/0x170 [mtk_vcodec_dec]
+  vpu_dec_deinit+0x1c/0x30 [mtk_vcodec_dec]
+  vdec_hevc_slice_deinit+0x30/0x98 [mtk_vcodec_dec]
+  vdec_if_deinit+0x38/0x68 [mtk_vcodec_dec]
+  mtk_vcodec_dec_release+0x20/0x40 [mtk_vcodec_dec]
+  fops_vcodec_release+0x64/0x118 [mtk_vcodec_dec]
+  v4l2_release+0x7c/0x100
+  __fput+0x80/0x2d8
+  __fput_sync+0x58/0x70
+  __arm64_sys_close+0x40/0x90
+  invoke_syscall+0x50/0x128
+  el0_svc_common.constprop.0+0x48/0xf0
+  do_el0_svc+0x24/0x38
+  el0_svc+0x38/0xd8
+  el0t_64_sync_handler+0xc0/0xc8
+  el0t_64_sync+0x1a8/0x1b0
+ Code: d503201f f9401660 b900127f b900227f (f9400400)
+
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Fixes: 2674486aac7d ("media: mediatek: vcodec: support stateless hevc decoder")
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c       | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c
+index 06ed47df693bf..21836dd6ef85a 100644
+--- a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c
++++ b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c
+@@ -869,7 +869,6 @@ static int vdec_hevc_slice_init(struct mtk_vcodec_dec_ctx *ctx)
+       inst->vpu.codec_type = ctx->current_codec;
+       inst->vpu.capture_type = ctx->capture_fourcc;
+-      ctx->drv_handle = inst;
+       err = vpu_dec_init(&inst->vpu);
+       if (err) {
+               mtk_vdec_err(ctx, "vdec_hevc init err=%d", err);
+@@ -898,6 +897,7 @@ static int vdec_hevc_slice_init(struct mtk_vcodec_dec_ctx *ctx)
+       mtk_vdec_debug(ctx, "lat hevc instance >> %p, codec_type = 0x%x",
+                      inst, inst->vpu.codec_type);
++      ctx->drv_handle = inst;
+       return 0;
+ error_free_inst:
+       kfree(inst);
+-- 
+2.43.0
+
diff --git a/queue-6.8/nouveau-fix-devinit-paths-to-only-handle-display-on-.patch b/queue-6.8/nouveau-fix-devinit-paths-to-only-handle-display-on-.patch
new file mode 100644 (file)
index 0000000..bd9b68f
--- /dev/null
@@ -0,0 +1,74 @@
+From 0f7b66430032dfc3b05586fb97ff5da6121f7047 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Apr 2024 16:42:43 +1000
+Subject: nouveau: fix devinit paths to only handle display on GSP.
+
+From: Dave Airlie <airlied@gmail.com>
+
+[ Upstream commit 718c4fb221dbeff9072810841b949413c5ffc345 ]
+
+This reverts:
+nouveau/gsp: don't check devinit disable on GSP.
+and applies a further fix.
+
+It turns out the open gpu driver, checks this register,
+but only for display.
+
+Match that behaviour and in the turing path only disable
+the display block. (ampere already only does displays).
+
+Fixes: 5d4e8ae6e57b ("nouveau/gsp: don't check devinit disable on GSP.")
+Reviewed-by: Danilo Krummrich <dakr@redhat.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240408064243.2219527-1-airlied@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm107.c | 12 ++++++++----
+ drivers/gpu/drm/nouveau/nvkm/subdev/devinit/r535.c  |  1 +
+ 2 files changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm107.c b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm107.c
+index 7bcbc4895ec22..271bfa038f5bc 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm107.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm107.c
+@@ -25,6 +25,7 @@
+ #include <subdev/bios.h>
+ #include <subdev/bios/init.h>
++#include <subdev/gsp.h>
+ void
+ gm107_devinit_disable(struct nvkm_devinit *init)
+@@ -33,10 +34,13 @@ gm107_devinit_disable(struct nvkm_devinit *init)
+       u32 r021c00 = nvkm_rd32(device, 0x021c00);
+       u32 r021c04 = nvkm_rd32(device, 0x021c04);
+-      if (r021c00 & 0x00000001)
+-              nvkm_subdev_disable(device, NVKM_ENGINE_CE, 0);
+-      if (r021c00 & 0x00000004)
+-              nvkm_subdev_disable(device, NVKM_ENGINE_CE, 2);
++      /* gsp only wants to enable/disable display */
++      if (!nvkm_gsp_rm(device->gsp)) {
++              if (r021c00 & 0x00000001)
++                      nvkm_subdev_disable(device, NVKM_ENGINE_CE, 0);
++              if (r021c00 & 0x00000004)
++                      nvkm_subdev_disable(device, NVKM_ENGINE_CE, 2);
++      }
+       if (r021c04 & 0x00000001)
+               nvkm_subdev_disable(device, NVKM_ENGINE_DISP, 0);
+ }
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/r535.c b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/r535.c
+index 11b4c9c274a1a..666eb93b1742c 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/r535.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/r535.c
+@@ -41,6 +41,7 @@ r535_devinit_new(const struct nvkm_devinit_func *hw,
+       rm->dtor = r535_devinit_dtor;
+       rm->post = hw->post;
++      rm->disable = hw->disable;
+       ret = nv50_devinit_new_(rm, device, type, inst, pdevinit);
+       if (ret)
+-- 
+2.43.0
+
diff --git a/queue-6.8/platform-x86-intel-hid-don-t-wake-on-5-button-releas.patch b/queue-6.8/platform-x86-intel-hid-don-t-wake-on-5-button-releas.patch
new file mode 100644 (file)
index 0000000..34abf04
--- /dev/null
@@ -0,0 +1,63 @@
+From 54aae6802f6cee97a0d2f2c0b41a01022eee3ef3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Apr 2024 08:41:45 -0300
+Subject: platform/x86/intel/hid: Don't wake on 5-button releases
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David McFarland <corngood@gmail.com>
+
+[ Upstream commit 5864e479ca4344f3a5df8074524da24c960f440b ]
+
+If, for example, the power button is configured to suspend, holding it
+and releasing it after the machine has suspended, will wake the machine.
+
+Also on some machines, power button release events are sent during
+hibernation, even if the button wasn't used to hibernate the machine.
+This causes hibernation to be aborted.
+
+Fixes: 0c4cae1bc00d ("PM: hibernate: Avoid missing wakeup events during hibernation")
+Signed-off-by: David McFarland <corngood@gmail.com>
+Tested-by: Enrik Berkhan <Enrik.Berkhan@inka.de>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/878r1tpd6u.fsf_-_@gmail.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/hid.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/intel/hid.c b/drivers/platform/x86/intel/hid.c
+index 7457ca2b27a60..9ffbdc988fe50 100644
+--- a/drivers/platform/x86/intel/hid.c
++++ b/drivers/platform/x86/intel/hid.c
+@@ -504,6 +504,7 @@ static void notify_handler(acpi_handle handle, u32 event, void *context)
+       struct platform_device *device = context;
+       struct intel_hid_priv *priv = dev_get_drvdata(&device->dev);
+       unsigned long long ev_index;
++      struct key_entry *ke;
+       int err;
+       /*
+@@ -545,11 +546,15 @@ static void notify_handler(acpi_handle handle, u32 event, void *context)
+               if (event == 0xc0 || !priv->array)
+                       return;
+-              if (!sparse_keymap_entry_from_scancode(priv->array, event)) {
++              ke = sparse_keymap_entry_from_scancode(priv->array, event);
++              if (!ke) {
+                       dev_info(&device->dev, "unknown event 0x%x\n", event);
+                       return;
+               }
++              if (ke->type == KE_IGNORE)
++                      return;
++
+ wakeup:
+               pm_wakeup_hard_event(&device->dev);
+-- 
+2.43.0
+
diff --git a/queue-6.8/platform-x86-intel-vbtn-update-tablet-mode-switch-at.patch b/queue-6.8/platform-x86-intel-vbtn-update-tablet-mode-switch-at.patch
new file mode 100644 (file)
index 0000000..f50bef4
--- /dev/null
@@ -0,0 +1,80 @@
+From 186a8f34fbbb4e32eeb02627cce5078f9703467a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Mar 2024 07:32:06 -0700
+Subject: platform/x86: intel-vbtn: Update tablet mode switch at end of probe
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Gwendal Grignou <gwendal@chromium.org>
+
+[ Upstream commit 434e5781d8cd2d0ed512d920c6cdeba4b33a2e81 ]
+
+ACER Vivobook Flip (TP401NAS) virtual intel switch is implemented as
+follow:
+
+   Device (VGBI)
+   {
+       Name (_HID, EisaId ("INT33D6") ...
+       Name (VBDS, Zero)
+       Method (_STA, 0, Serialized)  // _STA: Status ...
+       Method (VBDL, 0, Serialized)
+       {
+           PB1E |= 0x20
+           VBDS |= 0x40
+       }
+       Method (VGBS, 0, Serialized)
+       {
+           Return (VBDS) /* \_SB_.PCI0.SBRG.EC0_.VGBI.VBDS */
+       }
+       ...
+    }
+
+By default VBDS is set to 0. At boot it is set to clamshell (bit 6 set)
+only after method VBDL is executed.
+
+Since VBDL is now evaluated in the probe routine later, after the device
+is registered, the retrieved value of VBDS was still 0 ("tablet mode")
+when setting up the virtual switch.
+
+Make sure to evaluate VGBS after VBDL, to ensure the
+convertible boots in clamshell mode, the expected default.
+
+Fixes: 26173179fae1 ("platform/x86: intel-vbtn: Eval VBDL after registering our notifier")
+Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20240329143206.2977734-3-gwendal@chromium.org
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/vbtn.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/intel/vbtn.c b/drivers/platform/x86/intel/vbtn.c
+index 084c355c86f5f..5d13452bb947a 100644
+--- a/drivers/platform/x86/intel/vbtn.c
++++ b/drivers/platform/x86/intel/vbtn.c
+@@ -136,8 +136,6 @@ static int intel_vbtn_input_setup(struct platform_device *device)
+       priv->switches_dev->id.bustype = BUS_HOST;
+       if (priv->has_switches) {
+-              detect_tablet_mode(&device->dev);
+-
+               ret = input_register_device(priv->switches_dev);
+               if (ret)
+                       return ret;
+@@ -316,6 +314,9 @@ static int intel_vbtn_probe(struct platform_device *device)
+               if (ACPI_FAILURE(status))
+                       dev_err(&device->dev, "Error VBDL failed with ACPI status %d\n", status);
+       }
++      // Check switches after buttons since VBDL may have side effects.
++      if (has_switches)
++              detect_tablet_mode(&device->dev);
+       device_init_wakeup(&device->dev, true);
+       /*
+-- 
+2.43.0
+
diff --git a/queue-6.8/randomize_kstack-improve-entropy-diffusion.patch b/queue-6.8/randomize_kstack-improve-entropy-diffusion.patch
new file mode 100644 (file)
index 0000000..6c001f7
--- /dev/null
@@ -0,0 +1,37 @@
+From 3d39c175b3d80760a0b27950e55d7f7a1e873251 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Mar 2024 12:24:48 -0800
+Subject: randomize_kstack: Improve entropy diffusion
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit 9c573cd313433f6c1f7236fe64b9b743500c1628 ]
+
+The kstack_offset variable was really only ever using the low bits for
+kernel stack offset entropy. Add a ror32() to increase bit diffusion.
+
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Fixes: 39218ff4c625 ("stack: Optionally randomize kernel stack offset each syscall")
+Link: https://lore.kernel.org/r/20240309202445.work.165-kees@kernel.org
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/randomize_kstack.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/randomize_kstack.h b/include/linux/randomize_kstack.h
+index 5d868505a94e4..6d92b68efbf6c 100644
+--- a/include/linux/randomize_kstack.h
++++ b/include/linux/randomize_kstack.h
+@@ -80,7 +80,7 @@ DECLARE_PER_CPU(u32, kstack_offset);
+       if (static_branch_maybe(CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT, \
+                               &randomize_kstack_offset)) {            \
+               u32 offset = raw_cpu_read(kstack_offset);               \
+-              offset ^= (rand);                                       \
++              offset = ror32(offset, 5) ^ (rand);                     \
+               raw_cpu_write(kstack_offset, offset);                   \
+       }                                                               \
+ } while (0)
+-- 
+2.43.0
+
index 789fedfb018d51d78e1be7acbc72ee5cc2a361df..e8ac392829991c85ff45f62f8aba2e4acc1e931a 100644 (file)
@@ -129,3 +129,10 @@ fbmon-prevent-division-by-zero-in-fb_videomode_from_.patch
 alsa-hda-realtek-add-quirks-for-some-clevo-laptops.patch
 drm-amdgpu-init-zone-device-and-drm-client-after-mod.patch
 gcc-plugins-stackleak-avoid-.head.text-section.patch
+media-mediatek-vcodec-fix-oops-when-hevc-init-fails.patch
+media-mediatek-vcodec-adding-lock-to-protect-decoder.patch
+media-mediatek-vcodec-adding-lock-to-protect-encoder.patch
+randomize_kstack-improve-entropy-diffusion.patch
+platform-x86-intel-hid-don-t-wake-on-5-button-releas.patch
+platform-x86-intel-vbtn-update-tablet-mode-switch-at.patch
+nouveau-fix-devinit-paths-to-only-handle-display-on-.patch