From: Greg Kroah-Hartman Date: Thu, 21 Aug 2025 14:42:54 +0000 (+0200) Subject: 6.16-stable patches X-Git-Tag: v6.16.3~75 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7ea8b2d871a737da7c679303fffa5e6e21a3d9ac;p=thirdparty%2Fkernel%2Fstable-queue.git 6.16-stable patches added patches: drm-amd-amdgpu-fix-missing-lock-for-cper.ring-rptr-wptr-access.patch drm-amd-display-add-primary-plane-to-commits-for-correct-vrr-handling.patch drm-amd-display-don-t-overwrite-dce60_clk_mgr.patch drm-amd-display-fix-a-null-pointer-dereference-vulnerability.patch drm-amd-display-fix-dce-6.0-and-6.4-pll-programming.patch drm-amd-display-fix-initial-backlight-brightness-calculation.patch drm-amd-display-pass-up-errors-for-reset-gpu-that-fails-to-init-hw.patch drm-amd-display-revert-drm-amd-display-fix-amdgpu_max_bl_level-value.patch drm-amd-restore-cached-power-limit-during-resume.patch drm-amdgpu-add-kicker-fws-loading-for-gfx12-smu14-psp14.patch drm-amdgpu-add-missing-vram-lost-check-for-legacy-reset.patch drm-amdgpu-avoid-extra-evict-restore-process.patch drm-amdgpu-check-if-hubbub-is-null-in-debugfs-amdgpu_dm_capabilities.patch drm-amdgpu-discovery-fix-fw-based-ip-discovery.patch drm-amdgpu-initialize-data-to-null-in-imu_v12_0_program_rlc_ram.patch drm-amdgpu-retain-job-vm-in-amdgpu_job_prepare_job.patch drm-amdgpu-track-whether-a-queue-is-a-kernel-queue-in-amdgpu_mqd_prop.patch drm-amdgpu-update-external-revid-for-gc-v9.5.0.patch drm-amdgpu-update-mmhub-3.0.1-client-id-mappings.patch drm-amdgpu-update-mmhub-3.3-client-id-mappings.patch drm-amdgpu-update-mmhub-4.1.0-client-id-mappings.patch drm-amdgpu-update-supported-modes-for-gc-v9.5.0.patch drm-amdkfd-destroy-kfd-debugfs-after-destroy-kfd-wq.patch drm-amdkfd-fix-checkpoint-restore-on-multi-xcc.patch drm-xe-bmg-add-one-additional-pci-id.patch drm-xe-defer-buffer-object-shrinker-write-backs-and-gpu-waits.patch media-iris-avoid-updating-frame-size-to-firmware-during-reconfig.patch media-iris-drop-port-check-for-session-property-response.patch media-iris-fix-buffer-preparation-failure-during-resolution-change.patch media-iris-fix-missing-function-pointer-initialization.patch media-iris-fix-null-pointer-dereference.patch media-iris-fix-typo-in-depth-variable.patch media-iris-prevent-hfi-queue-writes-when-core-is-in-deinit-state.patch media-iris-remove-deprecated-property-setting-to-firmware.patch media-iris-remove-error-check-for-non-zero-v4l2-controls.patch media-iris-remove-unnecessary-re-initialization-of-flush-completion.patch media-iris-send-v4l2_buf_flag_error-for-capture-buffers-with-0-filled-length.patch media-iris-skip-destroying-internal-buffer-if-not-dequeued.patch media-iris-skip-flush-on-first-sequence-change.patch media-iris-track-flush-responses-to-prevent-premature-completion.patch media-iris-update-capture-format-info-based-on-output-format.patch media-iris-verify-internal-buffer-release-on-close.patch media-qcom-camss-cleanup-media-device-allocated-resource-on-error-path.patch media-qcom-camss-csiphy-3ph-fix-inadvertent-dropping-of-sdm660-sdm670-phy-init.patch media-qcom-camss-remove-extraneous-supply-postfix-on-supply-names.patch media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch media-venus-fix-msm8998-frequency-table.patch media-venus-hfi-explicitly-release-irq-during-teardown.patch media-venus-protect-against-spurious-interrupts-during-probe.patch media-venus-vdec-clamp-param-smaller-than-1fps-and-bigger-than-240.patch media-venus-venc-clamp-param-smaller-than-1fps-and-bigger-than-240.patch --- diff --git a/queue-6.16/drm-amd-amdgpu-fix-missing-lock-for-cper.ring-rptr-wptr-access.patch b/queue-6.16/drm-amd-amdgpu-fix-missing-lock-for-cper.ring-rptr-wptr-access.patch new file mode 100644 index 0000000000..667498e317 --- /dev/null +++ b/queue-6.16/drm-amd-amdgpu-fix-missing-lock-for-cper.ring-rptr-wptr-access.patch @@ -0,0 +1,51 @@ +From 8e0d1edb5c16732b695eaf4bd7096b1569817cf0 Mon Sep 17 00:00:00 2001 +From: Yang Wang +Date: Thu, 24 Jul 2025 15:16:18 +0800 +Subject: drm/amd/amdgpu: fix missing lock for cper.ring->rptr/wptr access + +From: Yang Wang + +commit 8e0d1edb5c16732b695eaf4bd7096b1569817cf0 upstream. + +Add lock protection for 'ring->wptr'/'ring->rptr' to ensure the correct execution. + +Fixes: 8652920d2c00 ("drm/amdgpu: add mutex lock for cper ring") +Signed-off-by: Yang Wang +Reviewed-by: Tao Zhou +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_cper.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cper.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cper.c +index 15dde1f50328..25252231a68a 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cper.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cper.c +@@ -459,7 +459,7 @@ static u32 amdgpu_cper_ring_get_ent_sz(struct amdgpu_ring *ring, u64 pos) + + void amdgpu_cper_ring_write(struct amdgpu_ring *ring, void *src, int count) + { +- u64 pos, wptr_old, rptr = *ring->rptr_cpu_addr & ring->ptr_mask; ++ u64 pos, wptr_old, rptr; + int rec_cnt_dw = count >> 2; + u32 chunk, ent_sz; + u8 *s = (u8 *)src; +@@ -472,9 +472,11 @@ void amdgpu_cper_ring_write(struct amdgpu_ring *ring, void *src, int count) + return; + } + +- wptr_old = ring->wptr; +- + mutex_lock(&ring->adev->cper.ring_lock); ++ ++ wptr_old = ring->wptr; ++ rptr = *ring->rptr_cpu_addr & ring->ptr_mask; ++ + while (count) { + ent_sz = amdgpu_cper_ring_get_ent_sz(ring, ring->wptr); + chunk = umin(ent_sz, count); +-- +2.50.1 + diff --git a/queue-6.16/drm-amd-display-add-primary-plane-to-commits-for-correct-vrr-handling.patch b/queue-6.16/drm-amd-display-add-primary-plane-to-commits-for-correct-vrr-handling.patch new file mode 100644 index 0000000000..958f9a07c8 --- /dev/null +++ b/queue-6.16/drm-amd-display-add-primary-plane-to-commits-for-correct-vrr-handling.patch @@ -0,0 +1,53 @@ +From 3477c1b0972dc1c8a46f78e8fb1fa6966095b5ec Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michel=20D=C3=A4nzer?= +Date: Wed, 30 Jul 2025 10:09:02 +0200 +Subject: drm/amd/display: Add primary plane to commits for correct VRR handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michel Dänzer + +commit 3477c1b0972dc1c8a46f78e8fb1fa6966095b5ec upstream. + +amdgpu_dm_commit_planes calls update_freesync_state_on_stream only for +the primary plane. If a commit affects a CRTC but not its primary plane, +it would previously not trigger a refresh cycle or affect LFC, violating +current UAPI semantics. + +Fixes e.g. atomic commits affecting only the cursor plane being limited +to the minimum refresh rate. + +Don't do this for the legacy cursor ioctls though, it would break the +UAPI semantics for those. + +Suggested-by: Xaver Hugl +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3034 +Signed-off-by: Michel Dänzer +Reviewed-by: Harry Wentland +Signed-off-by: Alex Deucher +(cherry picked from commit cc7bfba95966251b254cb970c21627124da3b7f4) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c +@@ -661,6 +661,15 @@ static int amdgpu_dm_crtc_helper_atomic_ + return -EINVAL; + } + ++ if (!state->legacy_cursor_update && amdgpu_dm_crtc_vrr_active(dm_crtc_state)) { ++ struct drm_plane_state *primary_state; ++ ++ /* Pull in primary plane for correct VRR handling */ ++ primary_state = drm_atomic_get_plane_state(state, crtc->primary); ++ if (IS_ERR(primary_state)) ++ return PTR_ERR(primary_state); ++ } ++ + /* In some use cases, like reset, no stream is attached */ + if (!dm_crtc_state->stream) + return 0; diff --git a/queue-6.16/drm-amd-display-don-t-overwrite-dce60_clk_mgr.patch b/queue-6.16/drm-amd-display-don-t-overwrite-dce60_clk_mgr.patch new file mode 100644 index 0000000000..137f9f722b --- /dev/null +++ b/queue-6.16/drm-amd-display-don-t-overwrite-dce60_clk_mgr.patch @@ -0,0 +1,38 @@ +From 4db9cd554883e051df1840d4d58d636043101034 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Timur=20Krist=C3=B3f?= +Date: Tue, 22 Jul 2025 17:58:29 +0200 +Subject: drm/amd/display: Don't overwrite dce60_clk_mgr +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +commit 4db9cd554883e051df1840d4d58d636043101034 upstream. + +dc_clk_mgr_create accidentally overwrites the dce60_clk_mgr +with the dce_clk_mgr, causing incorrect behaviour on DCE6. +Fix it by removing the extra dce_clk_mgr_construct. + +Fixes: 62eab49faae7 ("drm/amd/display: hide VGH asic specific structs") +Reviewed-by: Rodrigo Siqueira +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +(cherry picked from commit bbddcbe36a686af03e91341b9bbfcca94bd45fb6) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c +@@ -158,7 +158,6 @@ struct clk_mgr *dc_clk_mgr_create(struct + return NULL; + } + dce60_clk_mgr_construct(ctx, clk_mgr); +- dce_clk_mgr_construct(ctx, clk_mgr); + return &clk_mgr->base; + } + #endif diff --git a/queue-6.16/drm-amd-display-fix-a-null-pointer-dereference-vulnerability.patch b/queue-6.16/drm-amd-display-fix-a-null-pointer-dereference-vulnerability.patch new file mode 100644 index 0000000000..ab1ac04152 --- /dev/null +++ b/queue-6.16/drm-amd-display-fix-a-null-pointer-dereference-vulnerability.patch @@ -0,0 +1,67 @@ +From 1bcf63a44381691d6192872801f830ce3250e367 Mon Sep 17 00:00:00 2001 +From: Siyang Liu +Date: Fri, 4 Jul 2025 11:16:22 +0800 +Subject: drm/amd/display: fix a Null pointer dereference vulnerability + +From: Siyang Liu + +commit 1bcf63a44381691d6192872801f830ce3250e367 upstream. + +[Why] +A null pointer dereference vulnerability exists in the AMD display driver's +(DC module) cleanup function dc_destruct(). +When display control context (dc->ctx) construction fails +(due to memory allocation failure), this pointer remains NULL. +During subsequent error handling when dc_destruct() is called, +there's no NULL check before dereferencing the perf_trace member +(dc->ctx->perf_trace), causing a kernel null pointer dereference crash. + +[How] +Check if dc->ctx is non-NULL before dereferencing. + +Link: https://lore.kernel.org/r/tencent_54FF4252EDFB6533090A491A25EEF3EDBF06@qq.com +Co-developed-by: Mario Limonciello +Signed-off-by: Mario Limonciello +(Updated commit text and removed unnecessary error message) +Signed-off-by: Siyang Liu +Signed-off-by: Roman Li +Reviewed-by: Alex Hung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 9dd8e2ba268c636c240a918e0a31e6feaee19404) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/core/dc.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/core/dc.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c +@@ -938,17 +938,18 @@ static void dc_destruct(struct dc *dc) + if (dc->link_srv) + link_destroy_link_service(&dc->link_srv); + +- if (dc->ctx->gpio_service) +- dal_gpio_service_destroy(&dc->ctx->gpio_service); ++ if (dc->ctx) { ++ if (dc->ctx->gpio_service) ++ dal_gpio_service_destroy(&dc->ctx->gpio_service); + +- if (dc->ctx->created_bios) +- dal_bios_parser_destroy(&dc->ctx->dc_bios); ++ if (dc->ctx->created_bios) ++ dal_bios_parser_destroy(&dc->ctx->dc_bios); ++ kfree(dc->ctx->logger); ++ dc_perf_trace_destroy(&dc->ctx->perf_trace); + +- kfree(dc->ctx->logger); +- dc_perf_trace_destroy(&dc->ctx->perf_trace); +- +- kfree(dc->ctx); +- dc->ctx = NULL; ++ kfree(dc->ctx); ++ dc->ctx = NULL; ++ } + + kfree(dc->bw_vbios); + dc->bw_vbios = NULL; diff --git a/queue-6.16/drm-amd-display-fix-dce-6.0-and-6.4-pll-programming.patch b/queue-6.16/drm-amd-display-fix-dce-6.0-and-6.4-pll-programming.patch new file mode 100644 index 0000000000..65f42d12c5 --- /dev/null +++ b/queue-6.16/drm-amd-display-fix-dce-6.0-and-6.4-pll-programming.patch @@ -0,0 +1,133 @@ +From 1c8dc3e088e09531bcdfc9fe348204abc3decb6c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Timur=20Krist=C3=B3f?= +Date: Tue, 22 Jul 2025 17:58:30 +0200 +Subject: drm/amd/display: Fix DCE 6.0 and 6.4 PLL programming. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +commit 1c8dc3e088e09531bcdfc9fe348204abc3decb6c upstream. + +Apparently, both DCE 6.0 and 6.4 have 3 PLLs, but PLL0 can only +be used for DP. Make sure to initialize the correct amount of PLLs +in DC for these DCE versions and use PLL0 only for DP. + +Also, on DCE 6.0 and 6.4, the PLL0 needs to be powered on at +initialization as opposed to DCE 6.1 and 7.x which use a different +clock source for DFS. + +The following functions were used as reference from the old +radeon driver implementation of DCE 6.x: +- radeon_atom_pick_pll +- atombios_crtc_set_disp_eng_pll + +Reviewed-by: Rodrigo Siqueira +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +(cherry picked from commit 35222b5934ec8d762473592ece98659baf6bc48e) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/clk_mgr/dce100/dce_clk_mgr.c | 5 + + drivers/gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c | 34 +++++----- + 2 files changed, 25 insertions(+), 14 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dce100/dce_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dce100/dce_clk_mgr.c +@@ -245,6 +245,11 @@ int dce_set_clock( + pxl_clk_params.target_pixel_clock_100hz = requested_clk_khz * 10; + pxl_clk_params.pll_id = CLOCK_SOURCE_ID_DFS; + ++ /* DCE 6.0, DCE 6.4: engine clock is the same as PLL0 */ ++ if (clk_mgr_base->ctx->dce_version == DCE_VERSION_6_0 || ++ clk_mgr_base->ctx->dce_version == DCE_VERSION_6_4) ++ pxl_clk_params.pll_id = CLOCK_SOURCE_ID_PLL0; ++ + if (clk_mgr_dce->dfs_bypass_active) + pxl_clk_params.flags.SET_DISPCLK_DFS_BYPASS = true; + +--- a/drivers/gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c +@@ -373,7 +373,7 @@ static const struct resource_caps res_ca + .num_timing_generator = 6, + .num_audio = 6, + .num_stream_encoder = 6, +- .num_pll = 2, ++ .num_pll = 3, + .num_ddc = 6, + }; + +@@ -389,7 +389,7 @@ static const struct resource_caps res_ca + .num_timing_generator = 2, + .num_audio = 2, + .num_stream_encoder = 2, +- .num_pll = 2, ++ .num_pll = 3, + .num_ddc = 2, + }; + +@@ -973,21 +973,24 @@ static bool dce60_construct( + + if (bp->fw_info_valid && bp->fw_info.external_clock_source_frequency_for_dp != 0) { + pool->base.dp_clock_source = +- dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_EXTERNAL, NULL, true); ++ dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_EXTERNAL, NULL, true); + ++ /* DCE 6.0 and 6.4: PLL0 can only be used with DP. Don't initialize it here. */ + pool->base.clock_sources[0] = +- dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL0, &clk_src_regs[0], false); ++ dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL1, &clk_src_regs[1], false); + pool->base.clock_sources[1] = +- dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL1, &clk_src_regs[1], false); ++ dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL2, &clk_src_regs[2], false); + pool->base.clk_src_count = 2; + + } else { + pool->base.dp_clock_source = +- dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL0, &clk_src_regs[0], true); ++ dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL0, &clk_src_regs[0], true); + + pool->base.clock_sources[0] = +- dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL1, &clk_src_regs[1], false); +- pool->base.clk_src_count = 1; ++ dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL1, &clk_src_regs[1], false); ++ pool->base.clock_sources[1] = ++ dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL2, &clk_src_regs[2], false); ++ pool->base.clk_src_count = 2; + } + + if (pool->base.dp_clock_source == NULL) { +@@ -1365,21 +1368,24 @@ static bool dce64_construct( + + if (bp->fw_info_valid && bp->fw_info.external_clock_source_frequency_for_dp != 0) { + pool->base.dp_clock_source = +- dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_EXTERNAL, NULL, true); ++ dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_EXTERNAL, NULL, true); + ++ /* DCE 6.0 and 6.4: PLL0 can only be used with DP. Don't initialize it here. */ + pool->base.clock_sources[0] = +- dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL1, &clk_src_regs[0], false); ++ dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL1, &clk_src_regs[1], false); + pool->base.clock_sources[1] = +- dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL2, &clk_src_regs[1], false); ++ dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL2, &clk_src_regs[2], false); + pool->base.clk_src_count = 2; + + } else { + pool->base.dp_clock_source = +- dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL1, &clk_src_regs[0], true); ++ dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL0, &clk_src_regs[0], true); + + pool->base.clock_sources[0] = +- dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL2, &clk_src_regs[1], false); +- pool->base.clk_src_count = 1; ++ dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL1, &clk_src_regs[1], false); ++ pool->base.clock_sources[1] = ++ dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL2, &clk_src_regs[2], false); ++ pool->base.clk_src_count = 2; + } + + if (pool->base.dp_clock_source == NULL) { diff --git a/queue-6.16/drm-amd-display-fix-initial-backlight-brightness-calculation.patch b/queue-6.16/drm-amd-display-fix-initial-backlight-brightness-calculation.patch new file mode 100644 index 0000000000..d162d3d1a4 --- /dev/null +++ b/queue-6.16/drm-amd-display-fix-initial-backlight-brightness-calculation.patch @@ -0,0 +1,39 @@ +From 9c2883057b3c861879b647f34e8bc448954e8729 Mon Sep 17 00:00:00 2001 +From: Lauri Tirkkonen +Date: Mon, 21 Jul 2025 09:59:40 +0900 +Subject: drm/amd/display: fix initial backlight brightness calculation + +From: Lauri Tirkkonen + +commit 9c2883057b3c861879b647f34e8bc448954e8729 upstream. + +DIV_ROUND_CLOSEST(x, 100) returns either 0 or 1 if 0 +Cc: stable@vger.kernel.org +Reviewed-by: Mario Limonciello +Link: https://lore.kernel.org/r/aH2Q_HJvxKbW74vU@hacktheplanet.fi +Signed-off-by: Mario Limonciello +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -4952,9 +4952,9 @@ amdgpu_dm_register_backlight_device(stru + caps = &dm->backlight_caps[aconnector->bl_idx]; + if (get_brightness_range(caps, &min, &max)) { + if (power_supply_is_system_supplied() > 0) +- props.brightness = (max - min) * DIV_ROUND_CLOSEST(caps->ac_level, 100); ++ props.brightness = DIV_ROUND_CLOSEST((max - min) * caps->ac_level, 100); + else +- props.brightness = (max - min) * DIV_ROUND_CLOSEST(caps->dc_level, 100); ++ props.brightness = DIV_ROUND_CLOSEST((max - min) * caps->dc_level, 100); + /* min is zero, so max needs to be adjusted */ + props.max_brightness = max - min; + drm_dbg(drm, "Backlight caps: min: %d, max: %d, ac %d, dc %d\n", min, max, diff --git a/queue-6.16/drm-amd-display-pass-up-errors-for-reset-gpu-that-fails-to-init-hw.patch b/queue-6.16/drm-amd-display-pass-up-errors-for-reset-gpu-that-fails-to-init-hw.patch new file mode 100644 index 0000000000..ee96f5143e --- /dev/null +++ b/queue-6.16/drm-amd-display-pass-up-errors-for-reset-gpu-that-fails-to-init-hw.patch @@ -0,0 +1,41 @@ +From 2b6943df54136f40aff8a6d7ba7c26724d89a0bd Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Thu, 15 May 2025 15:16:17 -0500 +Subject: drm/amd/display: Pass up errors for reset GPU that fails to init HW + +From: Mario Limonciello + +commit 2b6943df54136f40aff8a6d7ba7c26724d89a0bd upstream. + +[Why] +If a GPU is in reset and the hardware fails to initialize the rest of the +resume sequence shouldn't be run. + +[How] +Pass error code up to caller of dm_resume(). + +Reviewed-by: Alex Hung +Signed-off-by: Mario Limonciello +Signed-off-by: Ivan Lipski +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -3343,8 +3343,10 @@ static int dm_resume(struct amdgpu_ip_bl + link_enc_cfg_copy(adev->dm.dc->current_state, dc_state); + + r = dm_dmub_hw_init(adev); +- if (r) ++ if (r) { + drm_err(adev_to_drm(adev), "DMUB interface failed to initialize: status=%d\n", r); ++ return r; ++ } + + dc_dmub_srv_set_power_state(dm->dc->ctx->dmub_srv, DC_ACPI_CM_POWER_STATE_D0); + dc_set_power_state(dm->dc, DC_ACPI_CM_POWER_STATE_D0); diff --git a/queue-6.16/drm-amd-display-revert-drm-amd-display-fix-amdgpu_max_bl_level-value.patch b/queue-6.16/drm-amd-display-revert-drm-amd-display-fix-amdgpu_max_bl_level-value.patch new file mode 100644 index 0000000000..64376d1868 --- /dev/null +++ b/queue-6.16/drm-amd-display-revert-drm-amd-display-fix-amdgpu_max_bl_level-value.patch @@ -0,0 +1,52 @@ +From 8e6a18cbf3ee2c1e3d0afd8d3debd0ba8738ad0c Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Sun, 20 Jul 2025 23:39:41 -0500 +Subject: drm/amd/display: Revert "drm/amd/display: Fix AMDGPU_MAX_BL_LEVEL value" + +From: Mario Limonciello + +commit 8e6a18cbf3ee2c1e3d0afd8d3debd0ba8738ad0c upstream. + +This reverts commit 66abb996999de0d440a02583a6e70c2c24deab45. +This broke custom brightness curves but it wasn't obvious because +of other related changes. Custom brightness curves are always +from a 0-255 input signal. The correct fix was to fix the default +value which was done by [1]. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4412 +Link: https://lore.kernel.org/amd-gfx/0f094c4b-d2a3-42cd-824c-dc2858a5618d@kernel.org/T/#m69f875a7e69aa22df3370b3e3a9e69f4a61fdaf2 +Reviewed-by: Alex Hung +Signed-off-by: Mario Limonciello +Signed-off-by: Roman Li +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 6ec8a5cbec751625133461600d0d4950ffd3a214) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -4733,16 +4733,16 @@ static int get_brightness_range(const st + return 1; + } + +-/* Rescale from [min..max] to [0..MAX_BACKLIGHT_LEVEL] */ ++/* Rescale from [min..max] to [0..AMDGPU_MAX_BL_LEVEL] */ + static inline u32 scale_input_to_fw(int min, int max, u64 input) + { +- return DIV_ROUND_CLOSEST_ULL(input * MAX_BACKLIGHT_LEVEL, max - min); ++ return DIV_ROUND_CLOSEST_ULL(input * AMDGPU_MAX_BL_LEVEL, max - min); + } + +-/* Rescale from [0..MAX_BACKLIGHT_LEVEL] to [min..max] */ ++/* Rescale from [0..AMDGPU_MAX_BL_LEVEL] to [min..max] */ + static inline u32 scale_fw_to_input(int min, int max, u64 input) + { +- return min + DIV_ROUND_CLOSEST_ULL(input * (max - min), MAX_BACKLIGHT_LEVEL); ++ return min + DIV_ROUND_CLOSEST_ULL(input * (max - min), AMDGPU_MAX_BL_LEVEL); + } + + static void convert_custom_brightness(const struct amdgpu_dm_backlight_caps *caps, diff --git a/queue-6.16/drm-amd-restore-cached-power-limit-during-resume.patch b/queue-6.16/drm-amd-restore-cached-power-limit-during-resume.patch new file mode 100644 index 0000000000..800d61af6c --- /dev/null +++ b/queue-6.16/drm-amd-restore-cached-power-limit-during-resume.patch @@ -0,0 +1,40 @@ +From ed4efe426a49729952b3dc05d20e33b94409bdd1 Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Thu, 24 Jul 2025 22:12:21 -0500 +Subject: drm/amd: Restore cached power limit during resume + +From: Mario Limonciello + +commit ed4efe426a49729952b3dc05d20e33b94409bdd1 upstream. + +The power limit will be cached in smu->current_power_limit but +if the ASIC goes into S3 this value won't be restored. + +Restore the value during SMU resume. + +Acked-by: Alex Deucher +Link: https://lore.kernel.org/r/20250725031222.3015095-2-superm1@kernel.org +Signed-off-by: Mario Limonciello +Signed-off-by: Alex Deucher +(cherry picked from commit 26a609e053a6fc494403e95403bc6a2470383bec) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +@@ -2175,6 +2175,12 @@ static int smu_resume(struct amdgpu_ip_b + + adev->pm.dpm_enabled = true; + ++ if (smu->current_power_limit) { ++ ret = smu_set_power_limit(smu, smu->current_power_limit); ++ if (ret && ret != -EOPNOTSUPP) ++ return ret; ++ } ++ + dev_info(adev->dev, "SMU is resumed successfully!\n"); + + return 0; diff --git a/queue-6.16/drm-amdgpu-add-kicker-fws-loading-for-gfx12-smu14-psp14.patch b/queue-6.16/drm-amdgpu-add-kicker-fws-loading-for-gfx12-smu14-psp14.patch new file mode 100644 index 0000000000..9a7a0e1c2f --- /dev/null +++ b/queue-6.16/drm-amdgpu-add-kicker-fws-loading-for-gfx12-smu14-psp14.patch @@ -0,0 +1,154 @@ +From 0395cde08e1f7eee810b5799466e41635a21e599 Mon Sep 17 00:00:00 2001 +From: Frank Min +Date: Wed, 4 Jun 2025 21:39:34 +0800 +Subject: drm/amdgpu: add kicker fws loading for gfx12/smu14/psp14 + +From: Frank Min + +commit 0395cde08e1f7eee810b5799466e41635a21e599 upstream. + +1. Add kicker firmwares loading for gfx12/smu14/psp14 +2. Register additional MODULE_FIRMWARE entries for kicker fws + - gc_12_0_1_rlc_kicker.bin + - gc_12_0_1_imu_kicker.bin + - psp_14_0_3_sos_kicker.bin + - psp_14_0_3_ta_kicker.bin + - smu_14_0_3_kicker.bin + +Signed-off-by: Frank Min +Reviewed-by: Gui Chengming +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | 1 + + drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 14 ++++++++++---- + drivers/gpu/drm/amd/amdgpu/imu_v12_0.c | 11 ++++++++--- + drivers/gpu/drm/amd/amdgpu/psp_v14_0.c | 2 ++ + drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 11 ++++++++--- + 5 files changed, 29 insertions(+), 10 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c +@@ -32,6 +32,7 @@ + + static const struct kicker_device kicker_device_list[] = { + {0x744B, 0x00}, ++ {0x7551, 0xC8} + }; + + static void amdgpu_ucode_print_common_hdr(const struct common_firmware_header *hdr) +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c +@@ -79,6 +79,7 @@ MODULE_FIRMWARE("amdgpu/gc_12_0_1_pfp.bi + MODULE_FIRMWARE("amdgpu/gc_12_0_1_me.bin"); + MODULE_FIRMWARE("amdgpu/gc_12_0_1_mec.bin"); + MODULE_FIRMWARE("amdgpu/gc_12_0_1_rlc.bin"); ++MODULE_FIRMWARE("amdgpu/gc_12_0_1_rlc_kicker.bin"); + MODULE_FIRMWARE("amdgpu/gc_12_0_1_toc.bin"); + + static const struct amdgpu_hwip_reg_entry gc_reg_list_12_0[] = { +@@ -586,7 +587,7 @@ out: + + static int gfx_v12_0_init_microcode(struct amdgpu_device *adev) + { +- char ucode_prefix[15]; ++ char ucode_prefix[30]; + int err; + const struct rlc_firmware_header_v2_0 *rlc_hdr; + uint16_t version_major; +@@ -613,9 +614,14 @@ static int gfx_v12_0_init_microcode(stru + amdgpu_gfx_cp_init_microcode(adev, AMDGPU_UCODE_ID_CP_RS64_ME_P0_STACK); + + if (!amdgpu_sriov_vf(adev)) { +- err = amdgpu_ucode_request(adev, &adev->gfx.rlc_fw, +- AMDGPU_UCODE_REQUIRED, +- "amdgpu/%s_rlc.bin", ucode_prefix); ++ if (amdgpu_is_kicker_fw(adev)) ++ err = amdgpu_ucode_request(adev, &adev->gfx.rlc_fw, ++ AMDGPU_UCODE_REQUIRED, ++ "amdgpu/%s_rlc_kicker.bin", ucode_prefix); ++ else ++ err = amdgpu_ucode_request(adev, &adev->gfx.rlc_fw, ++ AMDGPU_UCODE_REQUIRED, ++ "amdgpu/%s_rlc.bin", ucode_prefix); + if (err) + goto out; + rlc_hdr = (const struct rlc_firmware_header_v2_0 *)adev->gfx.rlc_fw->data; +--- a/drivers/gpu/drm/amd/amdgpu/imu_v12_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/imu_v12_0.c +@@ -34,12 +34,13 @@ + + MODULE_FIRMWARE("amdgpu/gc_12_0_0_imu.bin"); + MODULE_FIRMWARE("amdgpu/gc_12_0_1_imu.bin"); ++MODULE_FIRMWARE("amdgpu/gc_12_0_1_imu_kicker.bin"); + + #define TRANSFER_RAM_MASK 0x001c0000 + + static int imu_v12_0_init_microcode(struct amdgpu_device *adev) + { +- char ucode_prefix[15]; ++ char ucode_prefix[30]; + int err; + const struct imu_firmware_header_v1_0 *imu_hdr; + struct amdgpu_firmware_info *info = NULL; +@@ -47,8 +48,12 @@ static int imu_v12_0_init_microcode(stru + DRM_DEBUG("\n"); + + amdgpu_ucode_ip_version_decode(adev, GC_HWIP, ucode_prefix, sizeof(ucode_prefix)); +- err = amdgpu_ucode_request(adev, &adev->gfx.imu_fw, AMDGPU_UCODE_REQUIRED, +- "amdgpu/%s_imu.bin", ucode_prefix); ++ if (amdgpu_is_kicker_fw(adev)) ++ err = amdgpu_ucode_request(adev, &adev->gfx.imu_fw, AMDGPU_UCODE_REQUIRED, ++ "amdgpu/%s_imu_kicker.bin", ucode_prefix); ++ else ++ err = amdgpu_ucode_request(adev, &adev->gfx.imu_fw, AMDGPU_UCODE_REQUIRED, ++ "amdgpu/%s_imu.bin", ucode_prefix); + if (err) + goto out; + +--- a/drivers/gpu/drm/amd/amdgpu/psp_v14_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/psp_v14_0.c +@@ -34,7 +34,9 @@ + MODULE_FIRMWARE("amdgpu/psp_14_0_2_sos.bin"); + MODULE_FIRMWARE("amdgpu/psp_14_0_2_ta.bin"); + MODULE_FIRMWARE("amdgpu/psp_14_0_3_sos.bin"); ++MODULE_FIRMWARE("amdgpu/psp_14_0_3_sos_kicker.bin"); + MODULE_FIRMWARE("amdgpu/psp_14_0_3_ta.bin"); ++MODULE_FIRMWARE("amdgpu/psp_14_0_3_ta_kicker.bin"); + MODULE_FIRMWARE("amdgpu/psp_14_0_5_toc.bin"); + MODULE_FIRMWARE("amdgpu/psp_14_0_5_ta.bin"); + +--- a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c +@@ -62,13 +62,14 @@ const int decoded_link_width[8] = {0, 1, + + MODULE_FIRMWARE("amdgpu/smu_14_0_2.bin"); + MODULE_FIRMWARE("amdgpu/smu_14_0_3.bin"); ++MODULE_FIRMWARE("amdgpu/smu_14_0_3_kicker.bin"); + + #define ENABLE_IMU_ARG_GFXOFF_ENABLE 1 + + int smu_v14_0_init_microcode(struct smu_context *smu) + { + struct amdgpu_device *adev = smu->adev; +- char ucode_prefix[15]; ++ char ucode_prefix[30]; + int err = 0; + const struct smc_firmware_header_v1_0 *hdr; + const struct common_firmware_header *header; +@@ -79,8 +80,12 @@ int smu_v14_0_init_microcode(struct smu_ + return 0; + + amdgpu_ucode_ip_version_decode(adev, MP1_HWIP, ucode_prefix, sizeof(ucode_prefix)); +- err = amdgpu_ucode_request(adev, &adev->pm.fw, AMDGPU_UCODE_REQUIRED, +- "amdgpu/%s.bin", ucode_prefix); ++ if (amdgpu_is_kicker_fw(adev)) ++ err = amdgpu_ucode_request(adev, &adev->pm.fw, AMDGPU_UCODE_REQUIRED, ++ "amdgpu/%s_kicker.bin", ucode_prefix); ++ else ++ err = amdgpu_ucode_request(adev, &adev->pm.fw, AMDGPU_UCODE_REQUIRED, ++ "amdgpu/%s.bin", ucode_prefix); + if (err) + goto out; + diff --git a/queue-6.16/drm-amdgpu-add-missing-vram-lost-check-for-legacy-reset.patch b/queue-6.16/drm-amdgpu-add-missing-vram-lost-check-for-legacy-reset.patch new file mode 100644 index 0000000000..b0b45cd757 --- /dev/null +++ b/queue-6.16/drm-amdgpu-add-missing-vram-lost-check-for-legacy-reset.patch @@ -0,0 +1,31 @@ +From 81699fe81b0be287fb28b6210324db48e8458d9f Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 4 Aug 2025 11:40:20 -0400 +Subject: drm/amdgpu: add missing vram lost check for LEGACY RESET + +From: Alex Deucher + +commit 81699fe81b0be287fb28b6210324db48e8458d9f upstream. + +Legacy resets reset the memory controllers so VRAM contents +may be unreliable after reset. + +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +(cherry picked from commit aae94897b6661a2a4b1de2d328090fc388b3e0af) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -3234,6 +3234,7 @@ static bool amdgpu_device_check_vram_los + * always assumed to be lost. + */ + switch (amdgpu_asic_reset_method(adev)) { ++ case AMD_RESET_METHOD_LEGACY: + case AMD_RESET_METHOD_LINK: + case AMD_RESET_METHOD_BACO: + case AMD_RESET_METHOD_MODE1: diff --git a/queue-6.16/drm-amdgpu-avoid-extra-evict-restore-process.patch b/queue-6.16/drm-amdgpu-avoid-extra-evict-restore-process.patch new file mode 100644 index 0000000000..877fc2c891 --- /dev/null +++ b/queue-6.16/drm-amdgpu-avoid-extra-evict-restore-process.patch @@ -0,0 +1,62 @@ +From 1f02f2044bda1db1fd995bc35961ab075fa7b5a2 Mon Sep 17 00:00:00 2001 +From: Gang Ba +Date: Tue, 8 Jul 2025 14:36:13 -0400 +Subject: drm/amdgpu: Avoid extra evict-restore process. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Gang Ba + +commit 1f02f2044bda1db1fd995bc35961ab075fa7b5a2 upstream. + +If vm belongs to another process, this is fclose after fork, +wait may enable signaling KFD eviction fence and cause parent process queue evicted. + +[677852.634569] amdkfd_fence_enable_signaling+0x56/0x70 [amdgpu] +[677852.634814] __dma_fence_enable_signaling+0x3e/0xe0 +[677852.634820] dma_fence_wait_timeout+0x3a/0x140 +[677852.634825] amddma_resv_wait_timeout+0x7f/0xf0 [amdkcl] +[677852.634831] amdgpu_vm_wait_idle+0x2d/0x60 [amdgpu] +[677852.635026] amdgpu_flush+0x34/0x50 [amdgpu] +[677852.635208] filp_flush+0x38/0x90 +[677852.635213] filp_close+0x14/0x30 +[677852.635216] do_close_on_exec+0xdd/0x130 +[677852.635221] begin_new_exec+0x1da/0x490 +[677852.635225] load_elf_binary+0x307/0xea0 +[677852.635231] ? srso_alias_return_thunk+0x5/0xfbef5 +[677852.635235] ? ima_bprm_check+0xa2/0xd0 +[677852.635240] search_binary_handler+0xda/0x260 +[677852.635245] exec_binprm+0x58/0x1a0 +[677852.635249] bprm_execve.part.0+0x16f/0x210 +[677852.635254] bprm_execve+0x45/0x80 +[677852.635257] do_execveat_common.isra.0+0x190/0x200 + +Suggested-by: Christian König +Signed-off-by: Gang Ba +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +@@ -2409,13 +2409,11 @@ void amdgpu_vm_adjust_size(struct amdgpu + */ + long amdgpu_vm_wait_idle(struct amdgpu_vm *vm, long timeout) + { +- timeout = dma_resv_wait_timeout(vm->root.bo->tbo.base.resv, +- DMA_RESV_USAGE_BOOKKEEP, +- true, timeout); ++ timeout = drm_sched_entity_flush(&vm->immediate, timeout); + if (timeout <= 0) + return timeout; + +- return dma_fence_wait_timeout(vm->last_unlocked, true, timeout); ++ return drm_sched_entity_flush(&vm->delayed, timeout); + } + + static void amdgpu_vm_destroy_task_info(struct kref *kref) diff --git a/queue-6.16/drm-amdgpu-check-if-hubbub-is-null-in-debugfs-amdgpu_dm_capabilities.patch b/queue-6.16/drm-amdgpu-check-if-hubbub-is-null-in-debugfs-amdgpu_dm_capabilities.patch new file mode 100644 index 0000000000..711d221aef --- /dev/null +++ b/queue-6.16/drm-amdgpu-check-if-hubbub-is-null-in-debugfs-amdgpu_dm_capabilities.patch @@ -0,0 +1,32 @@ +From b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288 Mon Sep 17 00:00:00 2001 +From: Peter Shkenev +Date: Thu, 17 Jul 2025 23:48:17 +0300 +Subject: drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities + +From: Peter Shkenev + +commit b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288 upstream. + +HUBBUB structure is not initialized on DCE hardware, so check if it is NULL +to avoid null dereference while accessing amdgpu_dm_capabilities file in +debugfs. + +Signed-off-by: Peter Shkenev +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c +@@ -3988,7 +3988,7 @@ static int capabilities_show(struct seq_ + + struct hubbub *hubbub = dc->res_pool->hubbub; + +- if (hubbub->funcs->get_mall_en) ++ if (hubbub && hubbub->funcs->get_mall_en) + hubbub->funcs->get_mall_en(hubbub, &mall_in_use); + + if (dc->cap_funcs.get_subvp_en) diff --git a/queue-6.16/drm-amdgpu-discovery-fix-fw-based-ip-discovery.patch b/queue-6.16/drm-amdgpu-discovery-fix-fw-based-ip-discovery.patch new file mode 100644 index 0000000000..2bf2204537 --- /dev/null +++ b/queue-6.16/drm-amdgpu-discovery-fix-fw-based-ip-discovery.patch @@ -0,0 +1,171 @@ +From 514678da56da089b756b4d433efd964fa22b2079 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 30 Jul 2025 11:16:05 -0400 +Subject: drm/amdgpu/discovery: fix fw based ip discovery + +From: Alex Deucher + +commit 514678da56da089b756b4d433efd964fa22b2079 upstream. + +We only need the fw based discovery table for sysfs. No +need to parse it. Additionally parsing some of the board +specific tables may result in incorrect data on some boards. +just load the binary and don't parse it on those boards. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4441 +Fixes: 80a0e8282933 ("drm/amdgpu/discovery: optionally use fw based ip discovery") +Reviewed-by: Mario Limonciello (AMD) +Signed-off-by: Alex Deucher +(cherry picked from commit 62eedd150fa11aefc2d377fc746633fdb1baeb55) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 5 - + drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 72 ++++++++++++++------------ + 2 files changed, 41 insertions(+), 36 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -2561,9 +2561,6 @@ static int amdgpu_device_parse_gpu_info_ + + adev->firmware.gpu_info_fw = NULL; + +- if (adev->mman.discovery_bin) +- return 0; +- + switch (adev->asic_type) { + default: + return 0; +@@ -2585,6 +2582,8 @@ static int amdgpu_device_parse_gpu_info_ + chip_name = "arcturus"; + break; + case CHIP_NAVI12: ++ if (adev->mman.discovery_bin) ++ return 0; + chip_name = "navi12"; + break; + } +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +@@ -2555,40 +2555,11 @@ int amdgpu_discovery_set_ip_blocks(struc + + switch (adev->asic_type) { + case CHIP_VEGA10: +- case CHIP_VEGA12: +- case CHIP_RAVEN: +- case CHIP_VEGA20: +- case CHIP_ARCTURUS: +- case CHIP_ALDEBARAN: +- /* this is not fatal. We have a fallback below +- * if the new firmwares are not present. some of +- * this will be overridden below to keep things +- * consistent with the current behavior. ++ /* This is not fatal. We only need the discovery ++ * binary for sysfs. We don't need it for a ++ * functional system. + */ +- r = amdgpu_discovery_reg_base_init(adev); +- if (!r) { +- amdgpu_discovery_harvest_ip(adev); +- amdgpu_discovery_get_gfx_info(adev); +- amdgpu_discovery_get_mall_info(adev); +- amdgpu_discovery_get_vcn_info(adev); +- } +- break; +- default: +- r = amdgpu_discovery_reg_base_init(adev); +- if (r) { +- drm_err(&adev->ddev, "discovery failed: %d\n", r); +- return r; +- } +- +- amdgpu_discovery_harvest_ip(adev); +- amdgpu_discovery_get_gfx_info(adev); +- amdgpu_discovery_get_mall_info(adev); +- amdgpu_discovery_get_vcn_info(adev); +- break; +- } +- +- switch (adev->asic_type) { +- case CHIP_VEGA10: ++ amdgpu_discovery_init(adev); + vega10_reg_base_init(adev); + adev->sdma.num_instances = 2; + adev->gmc.num_umc = 4; +@@ -2611,6 +2582,11 @@ int amdgpu_discovery_set_ip_blocks(struc + adev->ip_versions[DCI_HWIP][0] = IP_VERSION(12, 0, 0); + break; + case CHIP_VEGA12: ++ /* This is not fatal. We only need the discovery ++ * binary for sysfs. We don't need it for a ++ * functional system. ++ */ ++ amdgpu_discovery_init(adev); + vega10_reg_base_init(adev); + adev->sdma.num_instances = 2; + adev->gmc.num_umc = 4; +@@ -2633,6 +2609,11 @@ int amdgpu_discovery_set_ip_blocks(struc + adev->ip_versions[DCI_HWIP][0] = IP_VERSION(12, 0, 1); + break; + case CHIP_RAVEN: ++ /* This is not fatal. We only need the discovery ++ * binary for sysfs. We don't need it for a ++ * functional system. ++ */ ++ amdgpu_discovery_init(adev); + vega10_reg_base_init(adev); + adev->sdma.num_instances = 1; + adev->vcn.num_vcn_inst = 1; +@@ -2674,6 +2655,11 @@ int amdgpu_discovery_set_ip_blocks(struc + } + break; + case CHIP_VEGA20: ++ /* This is not fatal. We only need the discovery ++ * binary for sysfs. We don't need it for a ++ * functional system. ++ */ ++ amdgpu_discovery_init(adev); + vega20_reg_base_init(adev); + adev->sdma.num_instances = 2; + adev->gmc.num_umc = 8; +@@ -2697,6 +2683,11 @@ int amdgpu_discovery_set_ip_blocks(struc + adev->ip_versions[DCI_HWIP][0] = IP_VERSION(12, 1, 0); + break; + case CHIP_ARCTURUS: ++ /* This is not fatal. We only need the discovery ++ * binary for sysfs. We don't need it for a ++ * functional system. ++ */ ++ amdgpu_discovery_init(adev); + arct_reg_base_init(adev); + adev->sdma.num_instances = 8; + adev->vcn.num_vcn_inst = 2; +@@ -2725,6 +2716,11 @@ int amdgpu_discovery_set_ip_blocks(struc + adev->ip_versions[UVD_HWIP][1] = IP_VERSION(2, 5, 0); + break; + case CHIP_ALDEBARAN: ++ /* This is not fatal. We only need the discovery ++ * binary for sysfs. We don't need it for a ++ * functional system. ++ */ ++ amdgpu_discovery_init(adev); + aldebaran_reg_base_init(adev); + adev->sdma.num_instances = 5; + adev->vcn.num_vcn_inst = 2; +@@ -2751,6 +2747,16 @@ int amdgpu_discovery_set_ip_blocks(struc + adev->ip_versions[XGMI_HWIP][0] = IP_VERSION(6, 1, 0); + break; + default: ++ r = amdgpu_discovery_reg_base_init(adev); ++ if (r) { ++ drm_err(&adev->ddev, "discovery failed: %d\n", r); ++ return r; ++ } ++ ++ amdgpu_discovery_harvest_ip(adev); ++ amdgpu_discovery_get_gfx_info(adev); ++ amdgpu_discovery_get_mall_info(adev); ++ amdgpu_discovery_get_vcn_info(adev); + break; + } + diff --git a/queue-6.16/drm-amdgpu-initialize-data-to-null-in-imu_v12_0_program_rlc_ram.patch b/queue-6.16/drm-amdgpu-initialize-data-to-null-in-imu_v12_0_program_rlc_ram.patch new file mode 100644 index 0000000000..26704f85ad --- /dev/null +++ b/queue-6.16/drm-amdgpu-initialize-data-to-null-in-imu_v12_0_program_rlc_ram.patch @@ -0,0 +1,50 @@ +From c90f2e1172c51fa25492471dc9910e2d7c1444b9 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Tue, 15 Jul 2025 16:50:22 -0700 +Subject: drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() + +From: Nathan Chancellor + +commit c90f2e1172c51fa25492471dc9910e2d7c1444b9 upstream. + +After a recent change in clang to expose uninitialized warnings from +const variables and pointers [1], there is a warning in +imu_v12_0_program_rlc_ram() because data is passed uninitialized to +program_imu_rlc_ram(): + + drivers/gpu/drm/amd/amdgpu/imu_v12_0.c:374:30: error: variable 'data' is uninitialized when used here [-Werror,-Wuninitialized] + 374 | program_imu_rlc_ram(adev, data, (const u32)size); + | ^~~~ + +As this warning happens early in clang's frontend, it does not realize +that due to the assignment of r to -EINVAL, program_imu_rlc_ram() is +never actually called, and even if it were, data would not be +dereferenced because size is 0. + +Just initialize data to NULL to silence the warning, as the commit that +added program_imu_rlc_ram() mentioned it would eventually be used over +the old method, at which point data can be properly initialized and +used. + +Cc: stable@vger.kernel.org +Closes: https://github.com/ClangBuiltLinux/linux/issues/2107 +Fixes: 56159fffaab5 ("drm/amdgpu: use new method to program rlc ram") +Link: https://github.com/llvm/llvm-project/commit/2464313eef01c5b1edf0eccf57a32cdee01472c7 [1] +Signed-off-by: Nathan Chancellor +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/imu_v12_0.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/imu_v12_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/imu_v12_0.c +@@ -367,7 +367,7 @@ static void program_imu_rlc_ram(struct a + static void imu_v12_0_program_rlc_ram(struct amdgpu_device *adev) + { + u32 reg_data, size = 0; +- const u32 *data; ++ const u32 *data = NULL; + int r = -EINVAL; + + WREG32_SOC15(GC, 0, regGFX_IMU_RLC_RAM_INDEX, 0x2); diff --git a/queue-6.16/drm-amdgpu-retain-job-vm-in-amdgpu_job_prepare_job.patch b/queue-6.16/drm-amdgpu-retain-job-vm-in-amdgpu_job_prepare_job.patch new file mode 100644 index 0000000000..001aa10337 --- /dev/null +++ b/queue-6.16/drm-amdgpu-retain-job-vm-in-amdgpu_job_prepare_job.patch @@ -0,0 +1,43 @@ +From c00d8b79fd2167c6ac65e096619535acdf8678d5 Mon Sep 17 00:00:00 2001 +From: YuanShang +Date: Wed, 23 Jul 2025 16:44:49 +0800 +Subject: drm/amdgpu: Retain job->vm in amdgpu_job_prepare_job + +From: YuanShang + +commit c00d8b79fd2167c6ac65e096619535acdf8678d5 upstream. + +The field job->vm is used in function amdgpu_job_run to get the page +table re-generation counter and decide whether the job should be skipped. + +Specifically, function amdgpu_vm_generation checks if the VM is valid for this job to use. +For instance, if a gfx job depends on a cancelled sdma job from entity vm->delayed, +then the gfx job should be skipped. + +Fixes: 26c95e838e63 ("drm/amdgpu: set the VM pointer to NULL in amdgpu_job_prepare") +Signed-off-by: YuanShang +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +(cherry picked from commit ed76936c6b10b547c6df4ca75412331e9ef6d339) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 7 ------- + 1 file changed, 7 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c +@@ -387,13 +387,6 @@ amdgpu_job_prepare_job(struct drm_sched_ + dev_err(ring->adev->dev, "Error getting VM ID (%d)\n", r); + goto error; + } +- /* +- * The VM structure might be released after the VMID is +- * assigned, we had multiple problems with people trying to use +- * the VM pointer so better set it to NULL. +- */ +- if (!fence) +- job->vm = NULL; + return fence; + } + diff --git a/queue-6.16/drm-amdgpu-track-whether-a-queue-is-a-kernel-queue-in-amdgpu_mqd_prop.patch b/queue-6.16/drm-amdgpu-track-whether-a-queue-is-a-kernel-queue-in-amdgpu_mqd_prop.patch new file mode 100644 index 0000000000..3ddf4efd1c --- /dev/null +++ b/queue-6.16/drm-amdgpu-track-whether-a-queue-is-a-kernel-queue-in-amdgpu_mqd_prop.patch @@ -0,0 +1,45 @@ +From 284d4dfe850e665f0e7d4dfaf4d3d3da76d11fb0 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Tue, 24 Jun 2025 11:22:26 -0400 +Subject: drm/amdgpu: track whether a queue is a kernel queue in amdgpu_mqd_prop +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +commit 284d4dfe850e665f0e7d4dfaf4d3d3da76d11fb0 upstream. + +Used to to set the MQD appropriately for each queue type. +Kernel queues have additional privileges. + +Acked-by: Christian König +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 6.16.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 + + drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h +@@ -886,6 +886,7 @@ struct amdgpu_mqd_prop { + uint64_t csa_addr; + uint64_t fence_address; + bool tmz_queue; ++ bool kernel_queue; + }; + + struct amdgpu_mqd { +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c +@@ -687,6 +687,7 @@ static void amdgpu_ring_to_mqd_prop(stru + prop->eop_gpu_addr = ring->eop_gpu_addr; + prop->use_doorbell = ring->use_doorbell; + prop->doorbell_index = ring->doorbell_index; ++ prop->kernel_queue = true; + + /* map_queues packet doesn't need activate the queue, + * so only kiq need set this field. diff --git a/queue-6.16/drm-amdgpu-update-external-revid-for-gc-v9.5.0.patch b/queue-6.16/drm-amdgpu-update-external-revid-for-gc-v9.5.0.patch new file mode 100644 index 0000000000..d766c0ff19 --- /dev/null +++ b/queue-6.16/drm-amdgpu-update-external-revid-for-gc-v9.5.0.patch @@ -0,0 +1,33 @@ +From 05c8b690511854ba31d8d1bff7139a13ec66b9e7 Mon Sep 17 00:00:00 2001 +From: Lijo Lazar +Date: Fri, 25 Jul 2025 10:21:10 +0530 +Subject: drm/amdgpu: Update external revid for GC v9.5.0 + +From: Lijo Lazar + +commit 05c8b690511854ba31d8d1bff7139a13ec66b9e7 upstream. + +Use different external revid for GC v9.5.0 SOCs. + +Signed-off-by: Lijo Lazar +Reviewed-by: Hawking Zhang +Reviewed-by: Asad Kamal +Signed-off-by: Alex Deucher +(cherry picked from commit 21c6764ed4bfaecad034bc4fd15dd64c5a436325) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/soc15.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/soc15.c ++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c +@@ -1218,6 +1218,8 @@ static int soc15_common_early_init(struc + AMD_PG_SUPPORT_JPEG; + /*TODO: need a new external_rev_id for GC 9.4.4? */ + adev->external_rev_id = adev->rev_id + 0x46; ++ if (amdgpu_ip_version(adev, GC_HWIP, 0) == IP_VERSION(9, 5, 0)) ++ adev->external_rev_id = adev->rev_id + 0x50; + break; + default: + /* FIXME: not supported yet */ diff --git a/queue-6.16/drm-amdgpu-update-mmhub-3.0.1-client-id-mappings.patch b/queue-6.16/drm-amdgpu-update-mmhub-3.0.1-client-id-mappings.patch new file mode 100644 index 0000000000..2ea801b325 --- /dev/null +++ b/queue-6.16/drm-amdgpu-update-mmhub-3.0.1-client-id-mappings.patch @@ -0,0 +1,96 @@ +From 0bae62cc989fa99ac9cb564eb573aad916d1eb61 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Fri, 18 Jul 2025 15:52:04 -0400 +Subject: drm/amdgpu: update mmhub 3.0.1 client id mappings + +From: Alex Deucher + +commit 0bae62cc989fa99ac9cb564eb573aad916d1eb61 upstream. + +Update the client id mapping so the correct clients +get printed when there is a mmhub page fault. + +Reviewed-by: David (Ming Qiang) Wu +Signed-off-by: Alex Deucher +(cherry picked from commit 2a2681eda73b99a2c1ee8cdb006099ea5d0c2505) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c | 57 ++++++++++++++++-------------- + 1 file changed, 32 insertions(+), 25 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c ++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c +@@ -36,40 +36,47 @@ + + static const char *mmhub_client_ids_v3_0_1[][2] = { + [0][0] = "VMC", ++ [1][0] = "ISPXT", ++ [2][0] = "ISPIXT", + [4][0] = "DCEDMC", + [5][0] = "DCEVGA", + [6][0] = "MP0", + [7][0] = "MP1", +- [8][0] = "MPIO", +- [16][0] = "HDP", +- [17][0] = "LSDMA", +- [18][0] = "JPEG", +- [19][0] = "VCNU0", +- [21][0] = "VSCH", +- [22][0] = "VCNU1", +- [23][0] = "VCN1", +- [32+20][0] = "VCN0", +- [2][1] = "DBGUNBIO", ++ [8][0] = "MPM", ++ [12][0] = "ISPTNR", ++ [14][0] = "ISPCRD0", ++ [15][0] = "ISPCRD1", ++ [16][0] = "ISPCRD2", ++ [22][0] = "HDP", ++ [23][0] = "LSDMA", ++ [24][0] = "JPEG", ++ [27][0] = "VSCH", ++ [28][0] = "VCNU", ++ [29][0] = "VCN", ++ [1][1] = "ISPXT", ++ [2][1] = "ISPIXT", + [3][1] = "DCEDWB", + [4][1] = "DCEDMC", + [5][1] = "DCEVGA", + [6][1] = "MP0", + [7][1] = "MP1", +- [8][1] = "MPIO", +- [10][1] = "DBGU0", +- [11][1] = "DBGU1", +- [12][1] = "DBGU2", +- [13][1] = "DBGU3", +- [14][1] = "XDP", +- [15][1] = "OSSSYS", +- [16][1] = "HDP", +- [17][1] = "LSDMA", +- [18][1] = "JPEG", +- [19][1] = "VCNU0", +- [20][1] = "VCN0", +- [21][1] = "VSCH", +- [22][1] = "VCNU1", +- [23][1] = "VCN1", ++ [8][1] = "MPM", ++ [10][1] = "ISPMWR0", ++ [11][1] = "ISPMWR1", ++ [12][1] = "ISPTNR", ++ [13][1] = "ISPSWR", ++ [14][1] = "ISPCWR0", ++ [15][1] = "ISPCWR1", ++ [16][1] = "ISPCWR2", ++ [17][1] = "ISPCWR3", ++ [18][1] = "XDP", ++ [21][1] = "OSSSYS", ++ [22][1] = "HDP", ++ [23][1] = "LSDMA", ++ [24][1] = "JPEG", ++ [27][1] = "VSCH", ++ [28][1] = "VCNU", ++ [29][1] = "VCN", + }; + + static uint32_t mmhub_v3_0_1_get_invalidate_req(unsigned int vmid, diff --git a/queue-6.16/drm-amdgpu-update-mmhub-3.3-client-id-mappings.patch b/queue-6.16/drm-amdgpu-update-mmhub-3.3-client-id-mappings.patch new file mode 100644 index 0000000000..e8f1cc7fd0 --- /dev/null +++ b/queue-6.16/drm-amdgpu-update-mmhub-3.3-client-id-mappings.patch @@ -0,0 +1,174 @@ +From 9f9bddfa31d87b084700a6e9eca1a8b4f8ddcdf6 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Fri, 18 Jul 2025 15:53:21 -0400 +Subject: drm/amdgpu: update mmhub 3.3 client id mappings + +From: Alex Deucher + +commit 9f9bddfa31d87b084700a6e9eca1a8b4f8ddcdf6 upstream. + +Update the client id mapping so the correct clients +get printed when there is a mmhub page fault. + +v2: fix typos spotted by David Wu. +v3: fix additional typo spotted by David. + +Reviewed-by: David (Ming Qiang) Wu +Signed-off-by: Alex Deucher +(cherry picked from commit e932f4779a2d329841bb9ca70bb80a4bb2d707b6) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/mmhub_v3_3.c | 105 +++++++++++++++++++++++++++++++- + 1 file changed, 104 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v3_3.c ++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v3_3.c +@@ -40,30 +40,129 @@ + + static const char *mmhub_client_ids_v3_3[][2] = { + [0][0] = "VMC", ++ [1][0] = "ISPXT", ++ [2][0] = "ISPIXT", + [4][0] = "DCEDMC", + [6][0] = "MP0", + [7][0] = "MP1", + [8][0] = "MPM", ++ [9][0] = "ISPPDPRD", ++ [10][0] = "ISPCSTATRD", ++ [11][0] = "ISPBYRPRD", ++ [12][0] = "ISPRGBPRD", ++ [13][0] = "ISPMCFPRD", ++ [14][0] = "ISPMCFPRD1", ++ [15][0] = "ISPYUVPRD", ++ [16][0] = "ISPMCSCRD", ++ [17][0] = "ISPGDCRD", ++ [18][0] = "ISPLMERD", ++ [22][0] = "ISPXT1", ++ [23][0] = "ISPIXT1", + [24][0] = "HDP", + [25][0] = "LSDMA", + [26][0] = "JPEG", + [27][0] = "VPE", ++ [28][0] = "VSCH", + [29][0] = "VCNU", + [30][0] = "VCN", ++ [1][1] = "ISPXT", ++ [2][1] = "ISPIXT", + [3][1] = "DCEDWB", + [4][1] = "DCEDMC", ++ [5][1] = "ISPCSISWR", + [6][1] = "MP0", + [7][1] = "MP1", + [8][1] = "MPM", ++ [9][1] = "ISPPDPWR", ++ [10][1] = "ISPCSTATWR", ++ [11][1] = "ISPBYRPWR", ++ [12][1] = "ISPRGBPWR", ++ [13][1] = "ISPMCFPWR", ++ [14][1] = "ISPMWR0", ++ [15][1] = "ISPYUVPWR", ++ [16][1] = "ISPMCSCWR", ++ [17][1] = "ISPGDCWR", ++ [18][1] = "ISPLMEWR", ++ [20][1] = "ISPMWR2", + [21][1] = "OSSSYS", ++ [22][1] = "ISPXT1", ++ [23][1] = "ISPIXT1", + [24][1] = "HDP", + [25][1] = "LSDMA", + [26][1] = "JPEG", + [27][1] = "VPE", ++ [28][1] = "VSCH", + [29][1] = "VCNU", + [30][1] = "VCN", + }; + ++static const char *mmhub_client_ids_v3_3_1[][2] = { ++ [0][0] = "VMC", ++ [4][0] = "DCEDMC", ++ [6][0] = "MP0", ++ [7][0] = "MP1", ++ [8][0] = "MPM", ++ [24][0] = "HDP", ++ [25][0] = "LSDMA", ++ [26][0] = "JPEG0", ++ [27][0] = "VPE0", ++ [28][0] = "VSCH", ++ [29][0] = "VCNU0", ++ [30][0] = "VCN0", ++ [32+1][0] = "ISPXT", ++ [32+2][0] = "ISPIXT", ++ [32+9][0] = "ISPPDPRD", ++ [32+10][0] = "ISPCSTATRD", ++ [32+11][0] = "ISPBYRPRD", ++ [32+12][0] = "ISPRGBPRD", ++ [32+13][0] = "ISPMCFPRD", ++ [32+14][0] = "ISPMCFPRD1", ++ [32+15][0] = "ISPYUVPRD", ++ [32+16][0] = "ISPMCSCRD", ++ [32+17][0] = "ISPGDCRD", ++ [32+18][0] = "ISPLMERD", ++ [32+22][0] = "ISPXT1", ++ [32+23][0] = "ISPIXT1", ++ [32+26][0] = "JPEG1", ++ [32+27][0] = "VPE1", ++ [32+29][0] = "VCNU1", ++ [32+30][0] = "VCN1", ++ [3][1] = "DCEDWB", ++ [4][1] = "DCEDMC", ++ [6][1] = "MP0", ++ [7][1] = "MP1", ++ [8][1] = "MPM", ++ [21][1] = "OSSSYS", ++ [24][1] = "HDP", ++ [25][1] = "LSDMA", ++ [26][1] = "JPEG0", ++ [27][1] = "VPE0", ++ [28][1] = "VSCH", ++ [29][1] = "VCNU0", ++ [30][1] = "VCN0", ++ [32+1][1] = "ISPXT", ++ [32+2][1] = "ISPIXT", ++ [32+5][1] = "ISPCSISWR", ++ [32+9][1] = "ISPPDPWR", ++ [32+10][1] = "ISPCSTATWR", ++ [32+11][1] = "ISPBYRPWR", ++ [32+12][1] = "ISPRGBPWR", ++ [32+13][1] = "ISPMCFPWR", ++ [32+14][1] = "ISPMWR0", ++ [32+15][1] = "ISPYUVPWR", ++ [32+16][1] = "ISPMCSCWR", ++ [32+17][1] = "ISPGDCWR", ++ [32+18][1] = "ISPLMEWR", ++ [32+19][1] = "ISPMWR1", ++ [32+20][1] = "ISPMWR2", ++ [32+22][1] = "ISPXT1", ++ [32+23][1] = "ISPIXT1", ++ [32+26][1] = "JPEG1", ++ [32+27][1] = "VPE1", ++ [32+29][1] = "VCNU1", ++ [32+30][1] = "VCN1", ++}; ++ + static uint32_t mmhub_v3_3_get_invalidate_req(unsigned int vmid, + uint32_t flush_type) + { +@@ -102,12 +201,16 @@ mmhub_v3_3_print_l2_protection_fault_sta + + switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) { + case IP_VERSION(3, 3, 0): +- case IP_VERSION(3, 3, 1): + case IP_VERSION(3, 3, 2): + mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_v3_3) ? + mmhub_client_ids_v3_3[cid][rw] : + cid == 0x140 ? "UMSCH" : NULL; + break; ++ case IP_VERSION(3, 3, 1): ++ mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_v3_3_1) ? ++ mmhub_client_ids_v3_3_1[cid][rw] : ++ cid == 0x140 ? "UMSCH" : NULL; ++ break; + default: + mmhub_cid = NULL; + break; diff --git a/queue-6.16/drm-amdgpu-update-mmhub-4.1.0-client-id-mappings.patch b/queue-6.16/drm-amdgpu-update-mmhub-4.1.0-client-id-mappings.patch new file mode 100644 index 0000000000..ec129d8fed --- /dev/null +++ b/queue-6.16/drm-amdgpu-update-mmhub-4.1.0-client-id-mappings.patch @@ -0,0 +1,76 @@ +From a0b34e4c8663b13e45c78267b4de3004b1a72490 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Fri, 18 Jul 2025 15:53:54 -0400 +Subject: drm/amdgpu: update mmhub 4.1.0 client id mappings + +From: Alex Deucher + +commit a0b34e4c8663b13e45c78267b4de3004b1a72490 upstream. + +Update the client id mapping so the correct clients +get printed when there is a mmhub page fault. + +Tested-by: David (Ming Qiang) Wu +Reviewed-by: David (Ming Qiang) Wu +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/mmhub_v4_1_0.c | 34 +++++++++++------------------- + 1 file changed, 13 insertions(+), 21 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v4_1_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v4_1_0.c +@@ -37,39 +37,31 @@ + static const char *mmhub_client_ids_v4_1_0[][2] = { + [0][0] = "VMC", + [4][0] = "DCEDMC", +- [5][0] = "DCEVGA", + [6][0] = "MP0", + [7][0] = "MP1", + [8][0] = "MPIO", +- [16][0] = "HDP", +- [17][0] = "LSDMA", +- [18][0] = "JPEG", +- [19][0] = "VCNU0", +- [21][0] = "VSCH", +- [22][0] = "VCNU1", +- [23][0] = "VCN1", +- [32+20][0] = "VCN0", +- [2][1] = "DBGUNBIO", ++ [16][0] = "LSDMA", ++ [17][0] = "JPEG", ++ [19][0] = "VCNU", ++ [22][0] = "VSCH", ++ [23][0] = "HDP", ++ [32+23][0] = "VCNRD", + [3][1] = "DCEDWB", + [4][1] = "DCEDMC", +- [5][1] = "DCEVGA", + [6][1] = "MP0", + [7][1] = "MP1", + [8][1] = "MPIO", + [10][1] = "DBGU0", + [11][1] = "DBGU1", +- [12][1] = "DBGU2", +- [13][1] = "DBGU3", ++ [12][1] = "DBGUNBIO", + [14][1] = "XDP", + [15][1] = "OSSSYS", +- [16][1] = "HDP", +- [17][1] = "LSDMA", +- [18][1] = "JPEG", +- [19][1] = "VCNU0", +- [20][1] = "VCN0", +- [21][1] = "VSCH", +- [22][1] = "VCNU1", +- [23][1] = "VCN1", ++ [16][1] = "LSDMA", ++ [17][1] = "JPEG", ++ [18][1] = "VCNWR", ++ [19][1] = "VCNU", ++ [22][1] = "VSCH", ++ [23][1] = "HDP", + }; + + static uint32_t mmhub_v4_1_0_get_invalidate_req(unsigned int vmid, diff --git a/queue-6.16/drm-amdgpu-update-supported-modes-for-gc-v9.5.0.patch b/queue-6.16/drm-amdgpu-update-supported-modes-for-gc-v9.5.0.patch new file mode 100644 index 0000000000..ed1226b0f5 --- /dev/null +++ b/queue-6.16/drm-amdgpu-update-supported-modes-for-gc-v9.5.0.patch @@ -0,0 +1,49 @@ +From 389d79a195a9f71a103b39097ee8341a7ca60927 Mon Sep 17 00:00:00 2001 +From: Lijo Lazar +Date: Tue, 8 Jul 2025 13:17:18 +0530 +Subject: drm/amdgpu: Update supported modes for GC v9.5.0 + +From: Lijo Lazar + +commit 389d79a195a9f71a103b39097ee8341a7ca60927 upstream. + +For GC v9.5.0 SOCs, both CPX and QPX compute modes are also supported in +NPS2 mode. + +Signed-off-by: Lijo Lazar +Acked-by: Mangesh Gadre +Reviewed-by: Asad Kamal +Signed-off-by: Alex Deucher +(cherry picked from commit 9d1ac25c7f830e0132aa816393b1e9f140e71148) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c ++++ b/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c +@@ -453,6 +453,7 @@ static int __aqua_vanjaram_get_px_mode_i + uint16_t *nps_modes) + { + struct amdgpu_device *adev = xcp_mgr->adev; ++ uint32_t gc_ver = amdgpu_ip_version(adev, GC_HWIP, 0); + + if (!num_xcp || !nps_modes || !(xcp_mgr->supp_xcp_modes & BIT(px_mode))) + return -EINVAL; +@@ -476,12 +477,14 @@ static int __aqua_vanjaram_get_px_mode_i + *num_xcp = 4; + *nps_modes = BIT(AMDGPU_NPS1_PARTITION_MODE) | + BIT(AMDGPU_NPS4_PARTITION_MODE); ++ if (gc_ver == IP_VERSION(9, 5, 0)) ++ *nps_modes |= BIT(AMDGPU_NPS2_PARTITION_MODE); + break; + case AMDGPU_CPX_PARTITION_MODE: + *num_xcp = NUM_XCC(adev->gfx.xcc_mask); + *nps_modes = BIT(AMDGPU_NPS1_PARTITION_MODE) | + BIT(AMDGPU_NPS4_PARTITION_MODE); +- if (amdgpu_sriov_vf(adev)) ++ if (gc_ver == IP_VERSION(9, 5, 0)) + *nps_modes |= BIT(AMDGPU_NPS2_PARTITION_MODE); + break; + default: diff --git a/queue-6.16/drm-amdkfd-destroy-kfd-debugfs-after-destroy-kfd-wq.patch b/queue-6.16/drm-amdkfd-destroy-kfd-debugfs-after-destroy-kfd-wq.patch new file mode 100644 index 0000000000..7731e393e5 --- /dev/null +++ b/queue-6.16/drm-amdkfd-destroy-kfd-debugfs-after-destroy-kfd-wq.patch @@ -0,0 +1,41 @@ +From 2e58401a24e7b2d4ec619104e1a76590c1284a4c Mon Sep 17 00:00:00 2001 +From: Amber Lin +Date: Thu, 31 Jul 2025 20:45:00 -0400 +Subject: drm/amdkfd: Destroy KFD debugfs after destroy KFD wq + +From: Amber Lin + +commit 2e58401a24e7b2d4ec619104e1a76590c1284a4c upstream. + +Since KFD proc content was moved to kernel debugfs, we can't destroy KFD +debugfs before kfd_process_destroy_wq. Move kfd_process_destroy_wq prior +to kfd_debugfs_fini to fix a kernel NULL pointer problem. It happens +when /sys/kernel/debug/kfd was already destroyed in kfd_debugfs_fini but +kfd_process_destroy_wq calls kfd_debugfs_remove_process. This line + debugfs_remove_recursive(entry->proc_dentry); +tries to remove /sys/kernel/debug/kfd/proc/ while +/sys/kernel/debug/kfd is already gone. It hangs the kernel by kernel +NULL pointer. + +Signed-off-by: Amber Lin +Reviewed-by: Eric Huang +Signed-off-by: Alex Deucher +(cherry picked from commit 0333052d90683d88531558dcfdbf2525cc37c233) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/kfd_module.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_module.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_module.c +@@ -78,8 +78,8 @@ err_ioctl: + static void kfd_exit(void) + { + kfd_cleanup_processes(); +- kfd_debugfs_fini(); + kfd_process_destroy_wq(); ++ kfd_debugfs_fini(); + kfd_procfs_shutdown(); + kfd_topology_shutdown(); + kfd_chardev_exit(); diff --git a/queue-6.16/drm-amdkfd-fix-checkpoint-restore-on-multi-xcc.patch b/queue-6.16/drm-amdkfd-fix-checkpoint-restore-on-multi-xcc.patch new file mode 100644 index 0000000000..b2060e9375 --- /dev/null +++ b/queue-6.16/drm-amdkfd-fix-checkpoint-restore-on-multi-xcc.patch @@ -0,0 +1,196 @@ +From f6c0f3d24478a0792e50a64c2eba9f34d65519f2 Mon Sep 17 00:00:00 2001 +From: David Yat Sin +Date: Wed, 16 Jul 2025 22:04:28 +0000 +Subject: drm/amdkfd: Fix checkpoint-restore on multi-xcc + +From: David Yat Sin + +commit f6c0f3d24478a0792e50a64c2eba9f34d65519f2 upstream. + +GPUs with multi-xcc have multiple MQDs per queue. This patch saves and +restores all the MQDs within the partition. + +Signed-off-by: David Yat Sin +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +(cherry picked from commit a578f2a58c3ab38f0643b1b6e7534af860233cb1) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 2 + drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | 61 ++++++++++++++--- + drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 20 ++++- + 3 files changed, 67 insertions(+), 16 deletions(-) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +@@ -2716,7 +2716,7 @@ static void get_queue_checkpoint_info(st + + dqm_lock(dqm); + mqd_mgr = dqm->mqd_mgrs[mqd_type]; +- *mqd_size = mqd_mgr->mqd_size; ++ *mqd_size = mqd_mgr->mqd_size * NUM_XCC(mqd_mgr->dev->xcc_mask); + *ctl_stack_size = 0; + + if (q->properties.type == KFD_QUEUE_TYPE_COMPUTE && mqd_mgr->get_checkpoint_info) +--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c +@@ -373,7 +373,7 @@ static void get_checkpoint_info(struct m + { + struct v9_mqd *m = get_mqd(mqd); + +- *ctl_stack_size = m->cp_hqd_cntl_stack_size; ++ *ctl_stack_size = m->cp_hqd_cntl_stack_size * NUM_XCC(mm->dev->xcc_mask); + } + + static void checkpoint_mqd(struct mqd_manager *mm, void *mqd, void *mqd_dst, void *ctl_stack_dst) +@@ -388,6 +388,24 @@ static void checkpoint_mqd(struct mqd_ma + memcpy(ctl_stack_dst, ctl_stack, m->cp_hqd_cntl_stack_size); + } + ++static void checkpoint_mqd_v9_4_3(struct mqd_manager *mm, ++ void *mqd, ++ void *mqd_dst, ++ void *ctl_stack_dst) ++{ ++ struct v9_mqd *m; ++ int xcc; ++ uint64_t size = get_mqd(mqd)->cp_mqd_stride_size; ++ ++ for (xcc = 0; xcc < NUM_XCC(mm->dev->xcc_mask); xcc++) { ++ m = get_mqd(mqd + size * xcc); ++ ++ checkpoint_mqd(mm, m, ++ (uint8_t *)mqd_dst + sizeof(*m) * xcc, ++ (uint8_t *)ctl_stack_dst + m->cp_hqd_cntl_stack_size * xcc); ++ } ++} ++ + static void restore_mqd(struct mqd_manager *mm, void **mqd, + struct kfd_mem_obj *mqd_mem_obj, uint64_t *gart_addr, + struct queue_properties *qp, +@@ -764,13 +782,35 @@ static void restore_mqd_v9_4_3(struct mq + const void *mqd_src, + const void *ctl_stack_src, u32 ctl_stack_size) + { +- restore_mqd(mm, mqd, mqd_mem_obj, gart_addr, qp, mqd_src, ctl_stack_src, ctl_stack_size); +- if (amdgpu_sriov_multi_vf_mode(mm->dev->adev)) { +- struct v9_mqd *m; ++ struct kfd_mem_obj xcc_mqd_mem_obj; ++ u32 mqd_ctl_stack_size; ++ struct v9_mqd *m; ++ u32 num_xcc; ++ int xcc; + +- m = (struct v9_mqd *) mqd_mem_obj->cpu_ptr; +- m->cp_hqd_pq_doorbell_control |= 1 << +- CP_HQD_PQ_DOORBELL_CONTROL__DOORBELL_MODE__SHIFT; ++ uint64_t offset = mm->mqd_stride(mm, qp); ++ ++ mm->dev->dqm->current_logical_xcc_start++; ++ ++ num_xcc = NUM_XCC(mm->dev->xcc_mask); ++ mqd_ctl_stack_size = ctl_stack_size / num_xcc; ++ ++ memset(&xcc_mqd_mem_obj, 0x0, sizeof(struct kfd_mem_obj)); ++ ++ /* Set the MQD pointer and gart address to XCC0 MQD */ ++ *mqd = mqd_mem_obj->cpu_ptr; ++ if (gart_addr) ++ *gart_addr = mqd_mem_obj->gpu_addr; ++ ++ for (xcc = 0; xcc < num_xcc; xcc++) { ++ get_xcc_mqd(mqd_mem_obj, &xcc_mqd_mem_obj, offset * xcc); ++ restore_mqd(mm, (void **)&m, ++ &xcc_mqd_mem_obj, ++ NULL, ++ qp, ++ (uint8_t *)mqd_src + xcc * sizeof(*m), ++ (uint8_t *)ctl_stack_src + xcc * mqd_ctl_stack_size, ++ mqd_ctl_stack_size); + } + } + static int destroy_mqd_v9_4_3(struct mqd_manager *mm, void *mqd, +@@ -906,7 +946,6 @@ struct mqd_manager *mqd_manager_init_v9( + mqd->free_mqd = kfd_free_mqd_cp; + mqd->is_occupied = kfd_is_occupied_cp; + mqd->get_checkpoint_info = get_checkpoint_info; +- mqd->checkpoint_mqd = checkpoint_mqd; + mqd->mqd_size = sizeof(struct v9_mqd); + mqd->mqd_stride = mqd_stride_v9; + #if defined(CONFIG_DEBUG_FS) +@@ -918,16 +957,18 @@ struct mqd_manager *mqd_manager_init_v9( + mqd->init_mqd = init_mqd_v9_4_3; + mqd->load_mqd = load_mqd_v9_4_3; + mqd->update_mqd = update_mqd_v9_4_3; +- mqd->restore_mqd = restore_mqd_v9_4_3; + mqd->destroy_mqd = destroy_mqd_v9_4_3; + mqd->get_wave_state = get_wave_state_v9_4_3; ++ mqd->checkpoint_mqd = checkpoint_mqd_v9_4_3; ++ mqd->restore_mqd = restore_mqd_v9_4_3; + } else { + mqd->init_mqd = init_mqd; + mqd->load_mqd = load_mqd; + mqd->update_mqd = update_mqd; +- mqd->restore_mqd = restore_mqd; + mqd->destroy_mqd = kfd_destroy_mqd_cp; + mqd->get_wave_state = get_wave_state; ++ mqd->checkpoint_mqd = checkpoint_mqd; ++ mqd->restore_mqd = restore_mqd; + } + break; + case KFD_MQD_TYPE_HIQ: +--- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c +@@ -914,7 +914,10 @@ static int criu_checkpoint_queues_device + + q_data = (struct kfd_criu_queue_priv_data *)q_private_data; + +- /* data stored in this order: priv_data, mqd, ctl_stack */ ++ /* ++ * data stored in this order: ++ * priv_data, mqd[xcc0], mqd[xcc1],..., ctl_stack[xcc0], ctl_stack[xcc1]... ++ */ + q_data->mqd_size = mqd_size; + q_data->ctl_stack_size = ctl_stack_size; + +@@ -963,7 +966,7 @@ int kfd_criu_checkpoint_queues(struct kf + } + + static void set_queue_properties_from_criu(struct queue_properties *qp, +- struct kfd_criu_queue_priv_data *q_data) ++ struct kfd_criu_queue_priv_data *q_data, uint32_t num_xcc) + { + qp->is_interop = false; + qp->queue_percent = q_data->q_percent; +@@ -976,7 +979,11 @@ static void set_queue_properties_from_cr + qp->eop_ring_buffer_size = q_data->eop_ring_buffer_size; + qp->ctx_save_restore_area_address = q_data->ctx_save_restore_area_address; + qp->ctx_save_restore_area_size = q_data->ctx_save_restore_area_size; +- qp->ctl_stack_size = q_data->ctl_stack_size; ++ if (q_data->type == KFD_QUEUE_TYPE_COMPUTE) ++ qp->ctl_stack_size = q_data->ctl_stack_size / num_xcc; ++ else ++ qp->ctl_stack_size = q_data->ctl_stack_size; ++ + qp->type = q_data->type; + qp->format = q_data->format; + } +@@ -1036,12 +1043,15 @@ int kfd_criu_restore_queue(struct kfd_pr + goto exit; + } + +- /* data stored in this order: mqd, ctl_stack */ ++ /* ++ * data stored in this order: ++ * mqd[xcc0], mqd[xcc1],..., ctl_stack[xcc0], ctl_stack[xcc1]... ++ */ + mqd = q_extra_data; + ctl_stack = mqd + q_data->mqd_size; + + memset(&qp, 0, sizeof(qp)); +- set_queue_properties_from_criu(&qp, q_data); ++ set_queue_properties_from_criu(&qp, q_data, NUM_XCC(pdd->dev->adev->gfx.xcc_mask)); + + print_queue_properties(&qp); + diff --git a/queue-6.16/drm-xe-bmg-add-one-additional-pci-id.patch b/queue-6.16/drm-xe-bmg-add-one-additional-pci-id.patch new file mode 100644 index 0000000000..6333d67d5a --- /dev/null +++ b/queue-6.16/drm-xe-bmg-add-one-additional-pci-id.patch @@ -0,0 +1,34 @@ +From ccfb15b8158c11a8304204aeac354c7b1cfb18a3 Mon Sep 17 00:00:00 2001 +From: "Vodapalli, Ravi Kumar" +Date: Fri, 4 Jul 2025 16:05:27 +0530 +Subject: drm/xe/bmg: Add one additional PCI ID + +From: Vodapalli, Ravi Kumar + +commit ccfb15b8158c11a8304204aeac354c7b1cfb18a3 upstream. + +One additional PCI ID is added in Bspec for BMG, Add it so that +driver recognizes this device with this new ID. + +Bspec: 68090 +Cc: stable@vger.kernel.org # v6.12+ +Signed-off-by: Vodapalli, Ravi Kumar +Reviewed-by: Shekhar Chauhan +Acked-by: Matthew Auld +Signed-off-by: Matthew Auld +Link: https://lore.kernel.org/r/20250704103527.100178-1-ravi.kumar.vodapalli@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + include/drm/intel/pciids.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/include/drm/intel/pciids.h ++++ b/include/drm/intel/pciids.h +@@ -846,6 +846,7 @@ + /* BMG */ + #define INTEL_BMG_IDS(MACRO__, ...) \ + MACRO__(0xE202, ## __VA_ARGS__), \ ++ MACRO__(0xE209, ## __VA_ARGS__), \ + MACRO__(0xE20B, ## __VA_ARGS__), \ + MACRO__(0xE20C, ## __VA_ARGS__), \ + MACRO__(0xE20D, ## __VA_ARGS__), \ diff --git a/queue-6.16/drm-xe-defer-buffer-object-shrinker-write-backs-and-gpu-waits.patch b/queue-6.16/drm-xe-defer-buffer-object-shrinker-write-backs-and-gpu-waits.patch new file mode 100644 index 0000000000..ce29562611 --- /dev/null +++ b/queue-6.16/drm-xe-defer-buffer-object-shrinker-write-backs-and-gpu-waits.patch @@ -0,0 +1,117 @@ +From 2dd7a47669ae6c1da18c55f8e89c4a44418c7006 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Thomas=20Hellstr=C3=B6m?= +Date: Tue, 5 Aug 2025 09:48:42 +0200 +Subject: drm/xe: Defer buffer object shrinker write-backs and GPU waits +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Hellström + +commit 2dd7a47669ae6c1da18c55f8e89c4a44418c7006 upstream. + +When the xe buffer-object shrinker allows GPU waits and write-back, +(typically from kswapd), perform multiple passes, skipping +subsequent passes if the shrinker number of scanned objects target +is reached. + +1) Without GPU waits and write-back +2) Without write-back +3) With both GPU-waits and write-back + +This is to avoid stalls and costly write- and readbacks unless they +are really necessary. + +v2: +- Don't test for scan completion twice. (Stuart Summers) +- Update tags. + +Reported-by: melvyn +Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/5557 +Cc: Summers Stuart +Fixes: 00c8efc3180f ("drm/xe: Add a shrinker for xe bos") +Cc: # v6.15+ +Signed-off-by: Thomas Hellström +Reviewed-by: Stuart Summers +Link: https://lore.kernel.org/r/20250805074842.11359-1-thomas.hellstrom@linux.intel.com +(cherry picked from commit 80944d334182ce5eb27d00e2bf20a88bfc32dea1) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_shrinker.c | 51 +++++++++++++++++++++++++++++++++++---- + 1 file changed, 47 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/xe/xe_shrinker.c ++++ b/drivers/gpu/drm/xe/xe_shrinker.c +@@ -53,10 +53,10 @@ xe_shrinker_mod_pages(struct xe_shrinker + write_unlock(&shrinker->lock); + } + +-static s64 xe_shrinker_walk(struct xe_device *xe, +- struct ttm_operation_ctx *ctx, +- const struct xe_bo_shrink_flags flags, +- unsigned long to_scan, unsigned long *scanned) ++static s64 __xe_shrinker_walk(struct xe_device *xe, ++ struct ttm_operation_ctx *ctx, ++ const struct xe_bo_shrink_flags flags, ++ unsigned long to_scan, unsigned long *scanned) + { + unsigned int mem_type; + s64 freed = 0, lret; +@@ -86,6 +86,48 @@ static s64 xe_shrinker_walk(struct xe_de + return freed; + } + ++/* ++ * Try shrinking idle objects without writeback first, then if not sufficient, ++ * try also non-idle objects and finally if that's not sufficient either, ++ * add writeback. This avoids stalls and explicit writebacks with light or ++ * moderate memory pressure. ++ */ ++static s64 xe_shrinker_walk(struct xe_device *xe, ++ struct ttm_operation_ctx *ctx, ++ const struct xe_bo_shrink_flags flags, ++ unsigned long to_scan, unsigned long *scanned) ++{ ++ bool no_wait_gpu = true; ++ struct xe_bo_shrink_flags save_flags = flags; ++ s64 lret, freed; ++ ++ swap(no_wait_gpu, ctx->no_wait_gpu); ++ save_flags.writeback = false; ++ lret = __xe_shrinker_walk(xe, ctx, save_flags, to_scan, scanned); ++ swap(no_wait_gpu, ctx->no_wait_gpu); ++ if (lret < 0 || *scanned >= to_scan) ++ return lret; ++ ++ freed = lret; ++ if (!ctx->no_wait_gpu) { ++ lret = __xe_shrinker_walk(xe, ctx, save_flags, to_scan, scanned); ++ if (lret < 0) ++ return lret; ++ freed += lret; ++ if (*scanned >= to_scan) ++ return freed; ++ } ++ ++ if (flags.writeback) { ++ lret = __xe_shrinker_walk(xe, ctx, flags, to_scan, scanned); ++ if (lret < 0) ++ return lret; ++ freed += lret; ++ } ++ ++ return freed; ++} ++ + static unsigned long + xe_shrinker_count(struct shrinker *shrink, struct shrink_control *sc) + { +@@ -192,6 +234,7 @@ static unsigned long xe_shrinker_scan(st + runtime_pm = xe_shrinker_runtime_pm_get(shrinker, true, 0, can_backup); + + shrink_flags.purge = false; ++ + lret = xe_shrinker_walk(shrinker->xe, &ctx, shrink_flags, + nr_to_scan, &nr_scanned); + if (lret >= 0) diff --git a/queue-6.16/media-iris-avoid-updating-frame-size-to-firmware-during-reconfig.patch b/queue-6.16/media-iris-avoid-updating-frame-size-to-firmware-during-reconfig.patch new file mode 100644 index 0000000000..c6ddd1842d --- /dev/null +++ b/queue-6.16/media-iris-avoid-updating-frame-size-to-firmware-during-reconfig.patch @@ -0,0 +1,81 @@ +From caf2055487694b6cb52f2ecb161c6c5de660dd72 Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Fri, 9 May 2025 14:08:50 +0530 +Subject: media: iris: Avoid updating frame size to firmware during reconfig + +From: Dikshita Agarwal + +commit caf2055487694b6cb52f2ecb161c6c5de660dd72 upstream. + +During reconfig, the firmware sends the resolution aligned to 8 bytes. +If the driver sends the same resolution back to the firmware the resolution +will be aligned to 16 bytes not 8. + +The alignment mismatch would then subsequently cause the firmware to +send another redundant sequence change event. + +Fix this by not setting the resolution property during reconfig. + +Cc: stable@vger.kernel.org +Fixes: 3a19d7b9e08b ("media: iris: implement set properties to firmware during streamon") +Reviewed-by: Bryan O'Donoghue +Tested-by: Neil Armstrong # on SM8550-QRD +Tested-by: Neil Armstrong # on SM8550-HDK +Tested-by: Neil Armstrong # on SM8650-QRD +Tested-by: Neil Armstrong # on SM8650-HDK +Signed-off-by: Dikshita Agarwal +Tested-by: Vikash Garodia # on sa8775p-ride +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c | 15 ++++++++------- + drivers/media/platform/qcom/iris/iris_state.c | 2 +- + drivers/media/platform/qcom/iris/iris_state.h | 1 + + 3 files changed, 10 insertions(+), 8 deletions(-) + +--- a/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c ++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c +@@ -546,14 +546,15 @@ static int iris_hfi_gen1_set_resolution( + struct hfi_framesize fs; + int ret; + +- fs.buffer_type = HFI_BUFFER_INPUT; +- fs.width = inst->fmt_src->fmt.pix_mp.width; +- fs.height = inst->fmt_src->fmt.pix_mp.height; +- +- ret = hfi_gen1_set_property(inst, ptype, &fs, sizeof(fs)); +- if (ret) +- return ret; ++ if (!iris_drc_pending(inst)) { ++ fs.buffer_type = HFI_BUFFER_INPUT; ++ fs.width = inst->fmt_src->fmt.pix_mp.width; ++ fs.height = inst->fmt_src->fmt.pix_mp.height; + ++ ret = hfi_gen1_set_property(inst, ptype, &fs, sizeof(fs)); ++ if (ret) ++ return ret; ++ } + fs.buffer_type = HFI_BUFFER_OUTPUT2; + fs.width = inst->fmt_dst->fmt.pix_mp.width; + fs.height = inst->fmt_dst->fmt.pix_mp.height; +--- a/drivers/media/platform/qcom/iris/iris_state.c ++++ b/drivers/media/platform/qcom/iris/iris_state.c +@@ -245,7 +245,7 @@ int iris_inst_sub_state_change_pause(str + return iris_inst_change_sub_state(inst, 0, set_sub_state); + } + +-static inline bool iris_drc_pending(struct iris_inst *inst) ++bool iris_drc_pending(struct iris_inst *inst) + { + return inst->sub_state & IRIS_INST_SUB_DRC && + inst->sub_state & IRIS_INST_SUB_DRC_LAST; +--- a/drivers/media/platform/qcom/iris/iris_state.h ++++ b/drivers/media/platform/qcom/iris/iris_state.h +@@ -140,5 +140,6 @@ int iris_inst_sub_state_change_drain_las + int iris_inst_sub_state_change_drc_last(struct iris_inst *inst); + int iris_inst_sub_state_change_pause(struct iris_inst *inst, u32 plane); + bool iris_allow_cmd(struct iris_inst *inst, u32 cmd); ++bool iris_drc_pending(struct iris_inst *inst); + + #endif diff --git a/queue-6.16/media-iris-drop-port-check-for-session-property-response.patch b/queue-6.16/media-iris-drop-port-check-for-session-property-response.patch new file mode 100644 index 0000000000..3846917046 --- /dev/null +++ b/queue-6.16/media-iris-drop-port-check-for-session-property-response.patch @@ -0,0 +1,49 @@ +From f3516f856d1f11d9dff7d72491d474a2bae1cf8e Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Fri, 9 May 2025 14:08:51 +0530 +Subject: media: iris: Drop port check for session property response + +From: Dikshita Agarwal + +commit f3516f856d1f11d9dff7d72491d474a2bae1cf8e upstream. + +Currently, port check enforces that session property response must +arrive only on the BITSTREAM port. However, firmware can send some +responses on other port as well. + +Remove the strict port validation to correctly handle session property +responses from the firmware. + +Cc: stable@vger.kernel.org +Fixes: 3a19d7b9e08b ("media: iris: implement set properties to firmware during streamon") +Acked-by: Vikash Garodia +Tested-by: Neil Armstrong # on SM8550-QRD +Tested-by: Neil Armstrong # on SM8550-HDK +Tested-by: Neil Armstrong # on SM8650-QRD +Tested-by: Neil Armstrong # on SM8650-HDK +Signed-off-by: Dikshita Agarwal +Tested-by: Vikash Garodia # on sa8775p-ride +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c b/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c +index b75a01641d5d..d1a2a497a7b2 100644 +--- a/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c ++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c +@@ -636,9 +636,6 @@ static int iris_hfi_gen2_handle_session_property(struct iris_inst *inst, + { + struct iris_inst_hfi_gen2 *inst_hfi_gen2 = to_iris_inst_hfi_gen2(inst); + +- if (pkt->port != HFI_PORT_BITSTREAM) +- return 0; +- + if (pkt->flags & HFI_FW_FLAGS_INFORMATION) + return 0; + +-- +2.50.1 + diff --git a/queue-6.16/media-iris-fix-buffer-preparation-failure-during-resolution-change.patch b/queue-6.16/media-iris-fix-buffer-preparation-failure-during-resolution-change.patch new file mode 100644 index 0000000000..090bfd4fb9 --- /dev/null +++ b/queue-6.16/media-iris-fix-buffer-preparation-failure-during-resolution-change.patch @@ -0,0 +1,62 @@ +From 91c6d55b477e1b66578c268214e915dff9f5ea57 Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Fri, 9 May 2025 14:08:59 +0530 +Subject: media: iris: Fix buffer preparation failure during resolution change + +From: Dikshita Agarwal + +commit 91c6d55b477e1b66578c268214e915dff9f5ea57 upstream. + +When the resolution changes, the driver internally updates the width and +height, but the client continue to queue buffers with the older +resolution until the last flag is received. This results in a mismatch +when the buffers are prepared, causing failure due to outdated size. + +Introduce a check to prevent size validation during buffer preparation +if a resolution reconfiguration is in progress, to handle this. + +Cc: stable@vger.kernel.org +Fixes: 17f2a485ca67 ("media: iris: implement vb2 ops for buf_queue and firmware response") +Reviewed-by: Vikash Garodia +Tested-by: Neil Armstrong # on SM8550-QRD +Tested-by: Neil Armstrong # on SM8550-HDK +Tested-by: Neil Armstrong # on SM8650-QRD +Tested-by: Neil Armstrong # on SM8650-HDK +Signed-off-by: Dikshita Agarwal +Tested-by: Vikash Garodia # on sa8775p-ride +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_vb2.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/drivers/media/platform/qcom/iris/iris_vb2.c b/drivers/media/platform/qcom/iris/iris_vb2.c +index cdf11feb590b..b3bde10eb6d2 100644 +--- a/drivers/media/platform/qcom/iris/iris_vb2.c ++++ b/drivers/media/platform/qcom/iris/iris_vb2.c +@@ -259,13 +259,14 @@ int iris_vb2_buf_prepare(struct vb2_buffer *vb) + return -EINVAL; + } + +- if (vb->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE && +- vb2_plane_size(vb, 0) < iris_get_buffer_size(inst, BUF_OUTPUT)) +- return -EINVAL; +- if (vb->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE && +- vb2_plane_size(vb, 0) < iris_get_buffer_size(inst, BUF_INPUT)) +- return -EINVAL; +- ++ if (!(inst->sub_state & IRIS_INST_SUB_DRC)) { ++ if (vb->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE && ++ vb2_plane_size(vb, 0) < iris_get_buffer_size(inst, BUF_OUTPUT)) ++ return -EINVAL; ++ if (vb->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE && ++ vb2_plane_size(vb, 0) < iris_get_buffer_size(inst, BUF_INPUT)) ++ return -EINVAL; ++ } + return 0; + } + +-- +2.50.1 + diff --git a/queue-6.16/media-iris-fix-missing-function-pointer-initialization.patch b/queue-6.16/media-iris-fix-missing-function-pointer-initialization.patch new file mode 100644 index 0000000000..761e2e463f --- /dev/null +++ b/queue-6.16/media-iris-fix-missing-function-pointer-initialization.patch @@ -0,0 +1,45 @@ +From c314a28cdabe45f050fe7bd403ddeaf4b9c960d1 Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Fri, 9 May 2025 14:08:55 +0530 +Subject: media: iris: Fix missing function pointer initialization + +From: Dikshita Agarwal + +commit c314a28cdabe45f050fe7bd403ddeaf4b9c960d1 upstream. + +The function pointers responsible for setting firmware properties were +never initialized in the instance capability structure, causing it to +remain NULL. As a result, the firmware properties were not being set +correctly. + +Fix this by properly assigning the function pointers from the core +capability to the instance capability, ensuring that the properties are +correctly applied to the firmware. + +Cc: stable@vger.kernel.org +Fixes: 3a19d7b9e08b ("media: iris: implement set properties to firmware during streamon") +Acked-by: Vikash Garodia +Reviewed-by: Bryan O'Donoghue +Tested-by: Neil Armstrong # on SM8550-QRD +Tested-by: Neil Armstrong # on SM8550-HDK +Tested-by: Neil Armstrong # on SM8650-QRD +Tested-by: Neil Armstrong # on SM8650-HDK +Signed-off-by: Dikshita Agarwal +Tested-by: Vikash Garodia # on sa8775p-ride +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_ctrls.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/platform/qcom/iris/iris_ctrls.c ++++ b/drivers/media/platform/qcom/iris/iris_ctrls.c +@@ -163,6 +163,7 @@ void iris_session_init_caps(struct iris_ + core->inst_fw_caps[cap_id].value = caps[i].value; + core->inst_fw_caps[cap_id].flags = caps[i].flags; + core->inst_fw_caps[cap_id].hfi_id = caps[i].hfi_id; ++ core->inst_fw_caps[cap_id].set = caps[i].set; + } + } + diff --git a/queue-6.16/media-iris-fix-null-pointer-dereference.patch b/queue-6.16/media-iris-fix-null-pointer-dereference.patch new file mode 100644 index 0000000000..070ed2bf14 --- /dev/null +++ b/queue-6.16/media-iris-fix-null-pointer-dereference.patch @@ -0,0 +1,52 @@ +From 0f837559ccdd275c5a059e6ac4d5034b03409f1d Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Fri, 9 May 2025 14:08:56 +0530 +Subject: media: iris: Fix NULL pointer dereference + +From: Dikshita Agarwal + +commit 0f837559ccdd275c5a059e6ac4d5034b03409f1d upstream. + +A warning reported by smatch indicated a possible null pointer +dereference where one of the arguments to API +"iris_hfi_gen2_handle_system_error" could sometimes be null. + +To fix this, add a check to validate that the argument passed is not +null before accessing its members. + +Cc: stable@vger.kernel.org +Fixes: fb583a214337 ("media: iris: introduce host firmware interface with necessary hooks") +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/linux-media/634cc9b8-f099-4b54-8556-d879fb2b5169@stanley.mountain/ +Acked-by: Vikash Garodia +Reviewed-by: Bryan O'Donoghue +Tested-by: Neil Armstrong # on SM8550-QRD +Tested-by: Neil Armstrong # on SM8550-HDK +Tested-by: Neil Armstrong # on SM8650-QRD +Tested-by: Neil Armstrong # on SM8650-HDK +Signed-off-by: Dikshita Agarwal +Tested-by: Vikash Garodia # on sa8775p-ride +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c b/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c +index d1a2a497a7b2..4488540d1d41 100644 +--- a/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c ++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c +@@ -265,7 +265,8 @@ static int iris_hfi_gen2_handle_system_error(struct iris_core *core, + { + struct iris_inst *instance; + +- dev_err(core->dev, "received system error of type %#x\n", pkt->type); ++ if (pkt) ++ dev_err(core->dev, "received system error of type %#x\n", pkt->type); + + core->state = IRIS_CORE_ERROR; + +-- +2.50.1 + diff --git a/queue-6.16/media-iris-fix-typo-in-depth-variable.patch b/queue-6.16/media-iris-fix-typo-in-depth-variable.patch new file mode 100644 index 0000000000..bb9c946a46 --- /dev/null +++ b/queue-6.16/media-iris-fix-typo-in-depth-variable.patch @@ -0,0 +1,53 @@ +From 58edc8a68de7af45a4c815636595daa530f02c13 Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Fri, 9 May 2025 14:08:57 +0530 +Subject: media: iris: Fix typo in depth variable + +From: Dikshita Agarwal + +commit 58edc8a68de7af45a4c815636595daa530f02c13 upstream. + +Correct a typo from "dpeth" to "depth". + +Cc: stable@vger.kernel.org +Fixes: 3a19d7b9e08b ("media: iris: implement set properties to firmware during streamon") +Acked-by: Vikash Garodia +Reviewed-by: Bryan O'Donoghue +Tested-by: Neil Armstrong # on SM8550-QRD +Tested-by: Neil Armstrong # on SM8550-HDK +Tested-by: Neil Armstrong # on SM8650-QRD +Tested-by: Neil Armstrong # on SM8650-HDK +Signed-off-by: Dikshita Agarwal +Tested-by: Vikash Garodia # on sa8775p-ride +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_hfi_gen2_command.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen2_command.c b/drivers/media/platform/qcom/iris/iris_hfi_gen2_command.c +index a908b41e2868..802fa62c26eb 100644 +--- a/drivers/media/platform/qcom/iris/iris_hfi_gen2_command.c ++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen2_command.c +@@ -178,7 +178,7 @@ static int iris_hfi_gen2_set_crop_offsets(struct iris_inst *inst) + sizeof(u64)); + } + +-static int iris_hfi_gen2_set_bit_dpeth(struct iris_inst *inst) ++static int iris_hfi_gen2_set_bit_depth(struct iris_inst *inst) + { + struct iris_inst_hfi_gen2 *inst_hfi_gen2 = to_iris_inst_hfi_gen2(inst); + u32 port = iris_hfi_gen2_get_port(V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE); +@@ -378,7 +378,7 @@ static int iris_hfi_gen2_session_set_config_params(struct iris_inst *inst, u32 p + {HFI_PROP_BITSTREAM_RESOLUTION, iris_hfi_gen2_set_bitstream_resolution }, + {HFI_PROP_CROP_OFFSETS, iris_hfi_gen2_set_crop_offsets }, + {HFI_PROP_CODED_FRAMES, iris_hfi_gen2_set_coded_frames }, +- {HFI_PROP_LUMA_CHROMA_BIT_DEPTH, iris_hfi_gen2_set_bit_dpeth }, ++ {HFI_PROP_LUMA_CHROMA_BIT_DEPTH, iris_hfi_gen2_set_bit_depth }, + {HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT, iris_hfi_gen2_set_min_output_count }, + {HFI_PROP_PIC_ORDER_CNT_TYPE, iris_hfi_gen2_set_picture_order_count }, + {HFI_PROP_SIGNAL_COLOR_INFO, iris_hfi_gen2_set_colorspace }, +-- +2.50.1 + diff --git a/queue-6.16/media-iris-prevent-hfi-queue-writes-when-core-is-in-deinit-state.patch b/queue-6.16/media-iris-prevent-hfi-queue-writes-when-core-is-in-deinit-state.patch new file mode 100644 index 0000000000..d19b50dfb1 --- /dev/null +++ b/queue-6.16/media-iris-prevent-hfi-queue-writes-when-core-is-in-deinit-state.patch @@ -0,0 +1,45 @@ +From 2781662dee7bbb9675e5440f5dff4e3991dc5624 Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Fri, 9 May 2025 14:08:52 +0530 +Subject: media: iris: Prevent HFI queue writes when core is in deinit state + +From: Dikshita Agarwal + +commit 2781662dee7bbb9675e5440f5dff4e3991dc5624 upstream. + +The current check only considers the core error state before allowing +writes to the HFI queues. However, the core can also transition to the +deinit state due to a system error triggered by the response thread. +In such cases, writing to the HFI queues should not be allowed. + +Fix this by adding a check for the core deinit state, ensuring that +writes are rejected when core is not in a valid state. + +Cc: stable@vger.kernel.org +Fixes: fb583a214337 ("media: iris: introduce host firmware interface with necessary hooks") +Acked-by: Vikash Garodia +Tested-by: Neil Armstrong # on SM8550-QRD +Tested-by: Neil Armstrong # on SM8550-HDK +Tested-by: Neil Armstrong # on SM8650-QRD +Tested-by: Neil Armstrong # on SM8650-HDK +Signed-off-by: Dikshita Agarwal +Reviewed-by: Bryan O'Donoghue +Tested-by: Vikash Garodia # on sa8775p-ride +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_hfi_queue.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/platform/qcom/iris/iris_hfi_queue.c ++++ b/drivers/media/platform/qcom/iris/iris_hfi_queue.c +@@ -113,7 +113,7 @@ int iris_hfi_queue_cmd_write_locked(stru + { + struct iris_iface_q_info *q_info = &core->command_queue; + +- if (core->state == IRIS_CORE_ERROR) ++ if (core->state == IRIS_CORE_ERROR || core->state == IRIS_CORE_DEINIT) + return -EINVAL; + + if (!iris_hfi_queue_write(q_info, pkt, pkt_size)) { diff --git a/queue-6.16/media-iris-remove-deprecated-property-setting-to-firmware.patch b/queue-6.16/media-iris-remove-deprecated-property-setting-to-firmware.patch new file mode 100644 index 0000000000..81b3fe38a5 --- /dev/null +++ b/queue-6.16/media-iris-remove-deprecated-property-setting-to-firmware.patch @@ -0,0 +1,108 @@ +From a693b4a3e7a95c010bedef4c8b3122bd8b0961b7 Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Fri, 9 May 2025 14:08:54 +0530 +Subject: media: iris: Remove deprecated property setting to firmware + +From: Dikshita Agarwal + +commit a693b4a3e7a95c010bedef4c8b3122bd8b0961b7 upstream. + +HFI_PROPERTY_CONFIG_VDEC_POST_LOOP_DEBLOCKER is deprecated and no longer +supported on current firmware, remove setting the same to firmware. + +Cc: stable@vger.kernel.org +Fixes: 79865252acb6 ("media: iris: enable video driver probe of SM8250 SoC") +Acked-by: Vikash Garodia +Tested-by: Neil Armstrong # on SM8550-QRD +Tested-by: Neil Armstrong # on SM8550-HDK +Tested-by: Neil Armstrong # on SM8650-QRD +Tested-by: Neil Armstrong # on SM8650-HDK +Signed-off-by: Dikshita Agarwal +Tested-by: Vikash Garodia # on sa8775p-ride +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_ctrls.c | 4 ---- + drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c | 8 -------- + drivers/media/platform/qcom/iris/iris_hfi_gen1_defines.h | 1 - + drivers/media/platform/qcom/iris/iris_platform_common.h | 2 +- + drivers/media/platform/qcom/iris/iris_platform_sm8250.c | 9 --------- + 5 files changed, 1 insertion(+), 23 deletions(-) + +--- a/drivers/media/platform/qcom/iris/iris_ctrls.c ++++ b/drivers/media/platform/qcom/iris/iris_ctrls.c +@@ -17,8 +17,6 @@ static inline bool iris_valid_cap_id(enu + static enum platform_inst_fw_cap_type iris_get_cap_id(u32 id) + { + switch (id) { +- case V4L2_CID_MPEG_VIDEO_DECODER_MPEG4_DEBLOCK_FILTER: +- return DEBLOCK; + case V4L2_CID_MPEG_VIDEO_H264_PROFILE: + return PROFILE; + case V4L2_CID_MPEG_VIDEO_H264_LEVEL: +@@ -34,8 +32,6 @@ static u32 iris_get_v4l2_id(enum platfor + return 0; + + switch (cap_id) { +- case DEBLOCK: +- return V4L2_CID_MPEG_VIDEO_DECODER_MPEG4_DEBLOCK_FILTER; + case PROFILE: + return V4L2_CID_MPEG_VIDEO_H264_PROFILE; + case LEVEL: +--- a/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c ++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c +@@ -490,14 +490,6 @@ iris_hfi_gen1_packet_session_set_propert + packet->shdr.hdr.size += sizeof(u32) + sizeof(*wm); + break; + } +- case HFI_PROPERTY_CONFIG_VDEC_POST_LOOP_DEBLOCKER: { +- struct hfi_enable *en = prop_data; +- u32 *in = pdata; +- +- en->enable = *in; +- packet->shdr.hdr.size += sizeof(u32) + sizeof(*en); +- break; +- } + default: + return -EINVAL; + } +--- a/drivers/media/platform/qcom/iris/iris_hfi_gen1_defines.h ++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen1_defines.h +@@ -65,7 +65,6 @@ + + #define HFI_PROPERTY_CONFIG_BUFFER_REQUIREMENTS 0x202001 + +-#define HFI_PROPERTY_CONFIG_VDEC_POST_LOOP_DEBLOCKER 0x1200001 + #define HFI_PROPERTY_PARAM_VDEC_DPB_COUNTS 0x120300e + #define HFI_PROPERTY_CONFIG_VDEC_ENTROPY 0x1204004 + +--- a/drivers/media/platform/qcom/iris/iris_platform_common.h ++++ b/drivers/media/platform/qcom/iris/iris_platform_common.h +@@ -89,7 +89,7 @@ enum platform_inst_fw_cap_type { + CODED_FRAMES, + BIT_DEPTH, + RAP_FRAME, +- DEBLOCK, ++ TIER, + INST_FW_CAP_MAX, + }; + +--- a/drivers/media/platform/qcom/iris/iris_platform_sm8250.c ++++ b/drivers/media/platform/qcom/iris/iris_platform_sm8250.c +@@ -30,15 +30,6 @@ static struct platform_inst_fw_cap inst_ + .hfi_id = HFI_PROPERTY_PARAM_WORK_MODE, + .set = iris_set_stage, + }, +- { +- .cap_id = DEBLOCK, +- .min = 0, +- .max = 1, +- .step_or_mask = 1, +- .value = 0, +- .hfi_id = HFI_PROPERTY_CONFIG_VDEC_POST_LOOP_DEBLOCKER, +- .set = iris_set_u32, +- }, + }; + + static struct platform_inst_caps platform_inst_cap_sm8250 = { diff --git a/queue-6.16/media-iris-remove-error-check-for-non-zero-v4l2-controls.patch b/queue-6.16/media-iris-remove-error-check-for-non-zero-v4l2-controls.patch new file mode 100644 index 0000000000..621bfdde36 --- /dev/null +++ b/queue-6.16/media-iris-remove-error-check-for-non-zero-v4l2-controls.patch @@ -0,0 +1,38 @@ +From 03e29ab0e94831fcca2f62c96121fd14263b399b Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Fri, 9 May 2025 14:08:53 +0530 +Subject: media: iris: Remove error check for non-zero v4l2 controls + +From: Dikshita Agarwal + +commit 03e29ab0e94831fcca2f62c96121fd14263b399b upstream. + +Remove the check for non-zero number of v4l2 controls as some SOCs might +not expose any capability which requires v4l2 control. + +Cc: stable@vger.kernel.org +Fixes: 33be1dde17e3 ("media: iris: implement iris v4l2_ctrl_ops") +Tested-by: Neil Armstrong # on SM8550-QRD +Tested-by: Neil Armstrong # on SM8550-HDK +Tested-by: Neil Armstrong # on SM8650-QRD +Tested-by: Neil Armstrong # on SM8650-HDK +Signed-off-by: Dikshita Agarwal +Tested-by: Vikash Garodia # on sa8775p-ride +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_ctrls.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/media/platform/qcom/iris/iris_ctrls.c ++++ b/drivers/media/platform/qcom/iris/iris_ctrls.c +@@ -80,8 +80,6 @@ int iris_ctrls_init(struct iris_inst *in + if (iris_get_v4l2_id(cap[idx].cap_id)) + num_ctrls++; + } +- if (!num_ctrls) +- return -EINVAL; + + /* Adding 1 to num_ctrls to include V4L2_CID_MIN_BUFFERS_FOR_CAPTURE */ + diff --git a/queue-6.16/media-iris-remove-unnecessary-re-initialization-of-flush-completion.patch b/queue-6.16/media-iris-remove-unnecessary-re-initialization-of-flush-completion.patch new file mode 100644 index 0000000000..9d703082c7 --- /dev/null +++ b/queue-6.16/media-iris-remove-unnecessary-re-initialization-of-flush-completion.patch @@ -0,0 +1,46 @@ +From b7a898184e74a8261c34f1265139ac1799ee4e1c Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Fri, 9 May 2025 14:09:02 +0530 +Subject: media: iris: Remove unnecessary re-initialization of flush completion + +From: Dikshita Agarwal + +commit b7a898184e74a8261c34f1265139ac1799ee4e1c upstream. + +Currently, The flush completion signal is being re-initialized even +though no response is expected during a sequence change. + +Simplify the code by removing re-initialization of flush completion +signal as it is redundant. + +Cc: stable@vger.kernel.org +Fixes: 84e17adae3e3 ("media: iris: add support for dynamic resolution change") +Acked-by: Vikash Garodia +Tested-by: Neil Armstrong # on SM8550-QRD +Tested-by: Neil Armstrong # on SM8550-HDK +Tested-by: Neil Armstrong # on SM8650-QRD +Tested-by: Neil Armstrong # on SM8650-HDK +Signed-off-by: Dikshita Agarwal +Tested-by: Vikash Garodia # on sa8775p-ride +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c b/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c +index aaad32a70b9e..c8c0aa23536b 100644 +--- a/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c ++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c +@@ -201,7 +201,6 @@ static void iris_hfi_gen1_event_seq_changed(struct iris_inst *inst, + iris_hfi_gen1_read_changed_params(inst, pkt); + + if (inst->state != IRIS_INST_ERROR && !(inst->sub_state & IRIS_INST_SUB_FIRST_IPSC)) { +- reinit_completion(&inst->flush_completion); + + flush_pkt.shdr.hdr.size = sizeof(struct hfi_session_flush_pkt); + flush_pkt.shdr.hdr.pkt_type = HFI_CMD_SESSION_FLUSH; +-- +2.50.1 + diff --git a/queue-6.16/media-iris-send-v4l2_buf_flag_error-for-capture-buffers-with-0-filled-length.patch b/queue-6.16/media-iris-send-v4l2_buf_flag_error-for-capture-buffers-with-0-filled-length.patch new file mode 100644 index 0000000000..a88f71996e --- /dev/null +++ b/queue-6.16/media-iris-send-v4l2_buf_flag_error-for-capture-buffers-with-0-filled-length.patch @@ -0,0 +1,52 @@ +From 7adc11e6abf619d0bb0c05918d5da5b9d4bcb81e Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Fri, 9 May 2025 14:09:00 +0530 +Subject: media: iris: Send V4L2_BUF_FLAG_ERROR for capture buffers with 0 filled length + +From: Dikshita Agarwal + +commit 7adc11e6abf619d0bb0c05918d5da5b9d4bcb81e upstream. + +Firmware sends capture buffers with 0 filled length which are not to be +displayed and should be dropped by client. +To achieve the same, add V4L2_BUF_FLAG_ERROR to such buffers by making +sure: +- These 0 length buffers are not returned as result of flush. +- Its not a buffer with LAST flag enabled which will also have 0 filled + length. + +Cc: stable@vger.kernel.org +Fixes: d09100763bed ("media: iris: add support for drain sequence") +Acked-by: Vikash Garodia +Tested-by: Neil Armstrong # on SM8550-QRD +Tested-by: Neil Armstrong # on SM8550-HDK +Tested-by: Neil Armstrong # on SM8650-QRD +Tested-by: Neil Armstrong # on SM8650-HDK +Signed-off-by: Dikshita Agarwal +Tested-by: Vikash Garodia # on sa8775p-ride +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c b/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c +index 4488540d1d41..d2cede2fe1b5 100644 +--- a/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c ++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c +@@ -378,6 +378,11 @@ static int iris_hfi_gen2_handle_output_buffer(struct iris_inst *inst, + + buf->flags = iris_hfi_gen2_get_driver_buffer_flags(inst, hfi_buffer->flags); + ++ if (!buf->data_size && inst->state == IRIS_INST_STREAMING && ++ !(hfi_buffer->flags & HFI_BUF_FW_FLAG_LAST)) { ++ buf->flags |= V4L2_BUF_FLAG_ERROR; ++ } ++ + return 0; + } + +-- +2.50.1 + diff --git a/queue-6.16/media-iris-skip-destroying-internal-buffer-if-not-dequeued.patch b/queue-6.16/media-iris-skip-destroying-internal-buffer-if-not-dequeued.patch new file mode 100644 index 0000000000..23ccd397ad --- /dev/null +++ b/queue-6.16/media-iris-skip-destroying-internal-buffer-if-not-dequeued.patch @@ -0,0 +1,119 @@ +From 7c452ffda30c0460c568273993a3d3c611486467 Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Fri, 9 May 2025 14:08:47 +0530 +Subject: media: iris: Skip destroying internal buffer if not dequeued + +From: Dikshita Agarwal + +commit 7c452ffda30c0460c568273993a3d3c611486467 upstream. + +Firmware might hold the DPB buffers for reference in case of sequence +change, so skip destroying buffers for which QUEUED flag is not removed. + +Cc: stable@vger.kernel.org +Fixes: 73702f45db81 ("media: iris: allocate, initialize and queue internal buffers") +Reviewed-by: Vikash Garodia +Tested-by: Neil Armstrong # on SM8550-QRD +Tested-by: Neil Armstrong # on SM8550-HDK +Tested-by: Neil Armstrong # on SM8650-QRD +Tested-by: Neil Armstrong # on SM8650-HDK +Signed-off-by: Dikshita Agarwal +Tested-by: Vikash Garodia # on sa8775p-ride +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_buffer.c | 20 +++++++++++++++++++- + drivers/media/platform/qcom/iris/iris_buffer.h | 3 ++- + drivers/media/platform/qcom/iris/iris_vdec.c | 4 ++-- + drivers/media/platform/qcom/iris/iris_vidc.c | 4 ++-- + 4 files changed, 25 insertions(+), 6 deletions(-) + +--- a/drivers/media/platform/qcom/iris/iris_buffer.c ++++ b/drivers/media/platform/qcom/iris/iris_buffer.c +@@ -376,7 +376,7 @@ int iris_destroy_internal_buffer(struct + return 0; + } + +-int iris_destroy_internal_buffers(struct iris_inst *inst, u32 plane) ++static int iris_destroy_internal_buffers(struct iris_inst *inst, u32 plane, bool force) + { + const struct iris_platform_data *platform_data = inst->core->iris_platform_data; + struct iris_buffer *buf, *next; +@@ -396,6 +396,14 @@ int iris_destroy_internal_buffers(struct + for (i = 0; i < len; i++) { + buffers = &inst->buffers[internal_buf_type[i]]; + list_for_each_entry_safe(buf, next, &buffers->list, list) { ++ /* ++ * during stream on, skip destroying internal(DPB) buffer ++ * if firmware did not return it. ++ * during close, destroy all buffers irrespectively. ++ */ ++ if (!force && buf->attr & BUF_ATTR_QUEUED) ++ continue; ++ + ret = iris_destroy_internal_buffer(inst, buf); + if (ret) + return ret; +@@ -405,6 +413,16 @@ int iris_destroy_internal_buffers(struct + return 0; + } + ++int iris_destroy_all_internal_buffers(struct iris_inst *inst, u32 plane) ++{ ++ return iris_destroy_internal_buffers(inst, plane, true); ++} ++ ++int iris_destroy_dequeued_internal_buffers(struct iris_inst *inst, u32 plane) ++{ ++ return iris_destroy_internal_buffers(inst, plane, false); ++} ++ + static int iris_release_internal_buffers(struct iris_inst *inst, + enum iris_buffer_type buffer_type) + { +--- a/drivers/media/platform/qcom/iris/iris_buffer.h ++++ b/drivers/media/platform/qcom/iris/iris_buffer.h +@@ -106,7 +106,8 @@ void iris_get_internal_buffers(struct ir + int iris_create_internal_buffers(struct iris_inst *inst, u32 plane); + int iris_queue_internal_buffers(struct iris_inst *inst, u32 plane); + int iris_destroy_internal_buffer(struct iris_inst *inst, struct iris_buffer *buffer); +-int iris_destroy_internal_buffers(struct iris_inst *inst, u32 plane); ++int iris_destroy_all_internal_buffers(struct iris_inst *inst, u32 plane); ++int iris_destroy_dequeued_internal_buffers(struct iris_inst *inst, u32 plane); + int iris_alloc_and_queue_persist_bufs(struct iris_inst *inst); + int iris_alloc_and_queue_input_int_bufs(struct iris_inst *inst); + int iris_queue_buffer(struct iris_inst *inst, struct iris_buffer *buf); +--- a/drivers/media/platform/qcom/iris/iris_vdec.c ++++ b/drivers/media/platform/qcom/iris/iris_vdec.c +@@ -408,7 +408,7 @@ int iris_vdec_streamon_input(struct iris + + iris_get_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE); + +- ret = iris_destroy_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE); ++ ret = iris_destroy_dequeued_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE); + if (ret) + return ret; + +@@ -496,7 +496,7 @@ int iris_vdec_streamon_output(struct iri + + iris_get_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE); + +- ret = iris_destroy_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE); ++ ret = iris_destroy_dequeued_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE); + if (ret) + return ret; + +--- a/drivers/media/platform/qcom/iris/iris_vidc.c ++++ b/drivers/media/platform/qcom/iris/iris_vidc.c +@@ -233,8 +233,8 @@ int iris_close(struct file *filp) + iris_session_close(inst); + iris_inst_change_state(inst, IRIS_INST_DEINIT); + iris_v4l2_fh_deinit(inst); +- iris_destroy_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE); +- iris_destroy_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE); ++ iris_destroy_all_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE); ++ iris_destroy_all_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE); + iris_remove_session(inst); + mutex_unlock(&inst->lock); + mutex_destroy(&inst->ctx_q_lock); diff --git a/queue-6.16/media-iris-skip-flush-on-first-sequence-change.patch b/queue-6.16/media-iris-skip-flush-on-first-sequence-change.patch new file mode 100644 index 0000000000..4285076aac --- /dev/null +++ b/queue-6.16/media-iris-skip-flush-on-first-sequence-change.patch @@ -0,0 +1,45 @@ +From 1e27e9ffce59ac41cde71673d74eb368a533cdb2 Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Fri, 9 May 2025 14:09:01 +0530 +Subject: media: iris: Skip flush on first sequence change + +From: Dikshita Agarwal + +commit 1e27e9ffce59ac41cde71673d74eb368a533cdb2 upstream. + +Add a condition to skip the flush operation during the first sequence +change event. At this point, the capture queue is not streaming, making +the flush unnecessary. + +Cc: stable@vger.kernel.org +Fixes: 84e17adae3e3 ("media: iris: add support for dynamic resolution change") +Acked-by: Vikash Garodia +Tested-by: Neil Armstrong # on SM8550-QRD +Tested-by: Neil Armstrong # on SM8550-HDK +Tested-by: Neil Armstrong # on SM8650-QRD +Tested-by: Neil Armstrong # on SM8650-HDK +Signed-off-by: Dikshita Agarwal +Tested-by: Vikash Garodia # on sa8775p-ride +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c b/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c +index 271e14469223..aaad32a70b9e 100644 +--- a/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c ++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c +@@ -200,7 +200,7 @@ static void iris_hfi_gen1_event_seq_changed(struct iris_inst *inst, + + iris_hfi_gen1_read_changed_params(inst, pkt); + +- if (inst->state != IRIS_INST_ERROR) { ++ if (inst->state != IRIS_INST_ERROR && !(inst->sub_state & IRIS_INST_SUB_FIRST_IPSC)) { + reinit_completion(&inst->flush_completion); + + flush_pkt.shdr.hdr.size = sizeof(struct hfi_session_flush_pkt); +-- +2.50.1 + diff --git a/queue-6.16/media-iris-track-flush-responses-to-prevent-premature-completion.patch b/queue-6.16/media-iris-track-flush-responses-to-prevent-premature-completion.patch new file mode 100644 index 0000000000..9216127293 --- /dev/null +++ b/queue-6.16/media-iris-track-flush-responses-to-prevent-premature-completion.patch @@ -0,0 +1,120 @@ +From 9bf58db157139abcd60e425e5718c8e6a917f9dc Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Fri, 9 May 2025 14:08:58 +0530 +Subject: media: iris: Track flush responses to prevent premature completion + +From: Dikshita Agarwal + +commit 9bf58db157139abcd60e425e5718c8e6a917f9dc upstream. + +Currently, two types of flush commands are queued to the firmware, +the first flush queued as part of sequence change, does not wait for a +response, while the second flush queued as part of stop, expects a +completion response before proceeding further. + +Due to timing issue, the flush response corresponding to the first +command could arrive after the second flush is issued. This casuses the +driver to incorrectly assume that the second flush has completed, +leading to the premature signaling of flush_completion. + +To address this, introduce a counter to track the number of pending +flush responses and signal flush completion only when all expected +responses are received. + +Cc: stable@vger.kernel.org +Fixes: 11712ce70f8e ("media: iris: implement vb2 streaming ops") +Reviewed-by: Vikash Garodia +Tested-by: Neil Armstrong # on SM8550-QRD +Tested-by: Neil Armstrong # on SM8550-HDK +Tested-by: Neil Armstrong # on SM8650-QRD +Tested-by: Neil Armstrong # on SM8650-HDK +Signed-off-by: Dikshita Agarwal +Tested-by: Vikash Garodia # on sa8775p-ride +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c | 4 ++- + drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c | 17 +++++++++----- + drivers/media/platform/qcom/iris/iris_instance.h | 2 + + 3 files changed, 16 insertions(+), 7 deletions(-) + +--- a/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c ++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c +@@ -208,8 +208,10 @@ static int iris_hfi_gen1_session_stop(st + flush_pkt.flush_type = flush_type; + + ret = iris_hfi_queue_cmd_write(core, &flush_pkt, flush_pkt.shdr.hdr.size); +- if (!ret) ++ if (!ret) { ++ inst->flush_responses_pending++; + ret = iris_wait_for_session_response(inst, true); ++ } + } + + return ret; +--- a/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c ++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c +@@ -207,7 +207,8 @@ static void iris_hfi_gen1_event_seq_chan + flush_pkt.shdr.hdr.pkt_type = HFI_CMD_SESSION_FLUSH; + flush_pkt.shdr.session_id = inst->session_id; + flush_pkt.flush_type = HFI_FLUSH_OUTPUT; +- iris_hfi_queue_cmd_write(inst->core, &flush_pkt, flush_pkt.shdr.hdr.size); ++ if (!iris_hfi_queue_cmd_write(inst->core, &flush_pkt, flush_pkt.shdr.hdr.size)) ++ inst->flush_responses_pending++; + } + + iris_vdec_src_change(inst); +@@ -408,7 +409,9 @@ static void iris_hfi_gen1_session_ftb_do + flush_pkt.shdr.hdr.pkt_type = HFI_CMD_SESSION_FLUSH; + flush_pkt.shdr.session_id = inst->session_id; + flush_pkt.flush_type = HFI_FLUSH_OUTPUT; +- iris_hfi_queue_cmd_write(core, &flush_pkt, flush_pkt.shdr.hdr.size); ++ if (!iris_hfi_queue_cmd_write(core, &flush_pkt, flush_pkt.shdr.hdr.size)) ++ inst->flush_responses_pending++; ++ + iris_inst_sub_state_change_drain_last(inst); + + return; +@@ -564,7 +567,6 @@ static void iris_hfi_gen1_handle_respons + const struct iris_hfi_gen1_response_pkt_info *pkt_info; + struct device *dev = core->dev; + struct hfi_session_pkt *pkt; +- struct completion *done; + struct iris_inst *inst; + bool found = false; + u32 i; +@@ -625,9 +627,12 @@ static void iris_hfi_gen1_handle_respons + if (shdr->error_type != HFI_ERR_NONE) + iris_inst_change_state(inst, IRIS_INST_ERROR); + +- done = pkt_info->pkt == HFI_MSG_SESSION_FLUSH ? +- &inst->flush_completion : &inst->completion; +- complete(done); ++ if (pkt_info->pkt == HFI_MSG_SESSION_FLUSH) { ++ if (!(--inst->flush_responses_pending)) ++ complete(&inst->flush_completion); ++ } else { ++ complete(&inst->completion); ++ } + } + mutex_unlock(&inst->lock); + +--- a/drivers/media/platform/qcom/iris/iris_instance.h ++++ b/drivers/media/platform/qcom/iris/iris_instance.h +@@ -27,6 +27,7 @@ + * @crop: structure of crop info + * @completion: structure of signal completions + * @flush_completion: structure of signal completions for flush cmd ++ * @flush_responses_pending: counter to track number of pending flush responses + * @fw_caps: array of supported instance firmware capabilities + * @buffers: array of different iris buffers + * @fw_min_count: minimnum count of buffers needed by fw +@@ -57,6 +58,7 @@ struct iris_inst { + struct iris_hfi_rect_desc crop; + struct completion completion; + struct completion flush_completion; ++ u32 flush_responses_pending; + struct platform_inst_fw_cap fw_caps[INST_FW_CAP_MAX]; + struct iris_buffers buffers[BUF_TYPE_MAX]; + u32 fw_min_count; diff --git a/queue-6.16/media-iris-update-capture-format-info-based-on-output-format.patch b/queue-6.16/media-iris-update-capture-format-info-based-on-output-format.patch new file mode 100644 index 0000000000..1fde8bddc8 --- /dev/null +++ b/queue-6.16/media-iris-update-capture-format-info-based-on-output-format.patch @@ -0,0 +1,50 @@ +From 8aadfd445373b74de4a5cd36736843ae01856636 Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Fri, 9 May 2025 14:08:49 +0530 +Subject: media: iris: Update CAPTURE format info based on OUTPUT format + +From: Dikshita Agarwal + +commit 8aadfd445373b74de4a5cd36736843ae01856636 upstream. + +Update the width, height and buffer size of CAPTURE based on the +resolution set to OUTPUT via VIDIOC_S_FMT. This is required to set the +updated capture resolution to firmware when S_FMT is called only for +OUTPUT. + +Cc: stable@vger.kernel.org +Fixes: b530b95de22c ("media: iris: implement s_fmt, g_fmt and try_fmt ioctls") +Reviewed-by: Bryan O'Donoghue +Acked-by: Vikash Garodia +Tested-by: Neil Armstrong # on SM8550-QRD +Tested-by: Neil Armstrong # on SM8550-HDK +Tested-by: Neil Armstrong # on SM8650-QRD +Tested-by: Neil Armstrong # on SM8650-HDK +Signed-off-by: Dikshita Agarwal +Tested-by: Vikash Garodia # on sa8775p-ride +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_vdec.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/media/platform/qcom/iris/iris_vdec.c b/drivers/media/platform/qcom/iris/iris_vdec.c +index 9c049b9671cc..d342f733feb9 100644 +--- a/drivers/media/platform/qcom/iris/iris_vdec.c ++++ b/drivers/media/platform/qcom/iris/iris_vdec.c +@@ -171,6 +171,11 @@ int iris_vdec_s_fmt(struct iris_inst *inst, struct v4l2_format *f) + output_fmt->fmt.pix_mp.ycbcr_enc = f->fmt.pix_mp.ycbcr_enc; + output_fmt->fmt.pix_mp.quantization = f->fmt.pix_mp.quantization; + ++ /* Update capture format based on new ip w/h */ ++ output_fmt->fmt.pix_mp.width = ALIGN(f->fmt.pix_mp.width, 128); ++ output_fmt->fmt.pix_mp.height = ALIGN(f->fmt.pix_mp.height, 32); ++ inst->buffers[BUF_OUTPUT].size = iris_get_buffer_size(inst, BUF_OUTPUT); ++ + inst->crop.left = 0; + inst->crop.top = 0; + inst->crop.width = f->fmt.pix_mp.width; +-- +2.50.1 + diff --git a/queue-6.16/media-iris-verify-internal-buffer-release-on-close.patch b/queue-6.16/media-iris-verify-internal-buffer-release-on-close.patch new file mode 100644 index 0000000000..9fc7f10cc2 --- /dev/null +++ b/queue-6.16/media-iris-verify-internal-buffer-release-on-close.patch @@ -0,0 +1,78 @@ +From d2abb1ff5a3c13321d407ee19865d0d8d834c7c6 Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Fri, 9 May 2025 14:08:48 +0530 +Subject: media: iris: Verify internal buffer release on close + +From: Dikshita Agarwal + +commit d2abb1ff5a3c13321d407ee19865d0d8d834c7c6 upstream. + +Validate all internal buffers queued to firmware are released back to +driver on close. This helps ensure buffer lifecycle correctness and aids +in debugging any resporce leaks. + +Cc: stable@vger.kernel.org +Fixes: 73702f45db81 ("media: iris: allocate, initialize and queue internal buffers") +Tested-by: Neil Armstrong # on SM8550-QRD +Tested-by: Neil Armstrong # on SM8550-HDK +Tested-by: Neil Armstrong # on SM8650-QRD +Tested-by: Neil Armstrong # on SM8650-HDK +Signed-off-by: Dikshita Agarwal +Tested-by: Vikash Garodia # on sa8775p-ride +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_vidc.c | 29 ++++++++++++++++++++ + 1 file changed, 29 insertions(+) + +diff --git a/drivers/media/platform/qcom/iris/iris_vidc.c b/drivers/media/platform/qcom/iris/iris_vidc.c +index 663f5602b5ad..a8144595cc78 100644 +--- a/drivers/media/platform/qcom/iris/iris_vidc.c ++++ b/drivers/media/platform/qcom/iris/iris_vidc.c +@@ -221,6 +221,33 @@ static void iris_session_close(struct iris_inst *inst) + iris_wait_for_session_response(inst, false); + } + ++static void iris_check_num_queued_internal_buffers(struct iris_inst *inst, u32 plane) ++{ ++ const struct iris_platform_data *platform_data = inst->core->iris_platform_data; ++ struct iris_buffer *buf, *next; ++ struct iris_buffers *buffers; ++ const u32 *internal_buf_type; ++ u32 internal_buffer_count, i; ++ u32 count = 0; ++ ++ if (V4L2_TYPE_IS_OUTPUT(plane)) { ++ internal_buf_type = platform_data->dec_ip_int_buf_tbl; ++ internal_buffer_count = platform_data->dec_ip_int_buf_tbl_size; ++ } else { ++ internal_buf_type = platform_data->dec_op_int_buf_tbl; ++ internal_buffer_count = platform_data->dec_op_int_buf_tbl_size; ++ } ++ ++ for (i = 0; i < internal_buffer_count; i++) { ++ buffers = &inst->buffers[internal_buf_type[i]]; ++ list_for_each_entry_safe(buf, next, &buffers->list, list) ++ count++; ++ if (count) ++ dev_err(inst->core->dev, "%d buffer of type %d not released", ++ count, internal_buf_type[i]); ++ } ++} ++ + int iris_close(struct file *filp) + { + struct iris_inst *inst = iris_get_inst(filp, NULL); +@@ -235,6 +262,8 @@ int iris_close(struct file *filp) + iris_v4l2_fh_deinit(inst); + iris_destroy_all_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE); + iris_destroy_all_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE); ++ iris_check_num_queued_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE); ++ iris_check_num_queued_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE); + iris_remove_session(inst); + mutex_unlock(&inst->lock); + mutex_destroy(&inst->ctx_q_lock); +-- +2.50.1 + diff --git a/queue-6.16/media-qcom-camss-cleanup-media-device-allocated-resource-on-error-path.patch b/queue-6.16/media-qcom-camss-cleanup-media-device-allocated-resource-on-error-path.patch new file mode 100644 index 0000000000..238e12f414 --- /dev/null +++ b/queue-6.16/media-qcom-camss-cleanup-media-device-allocated-resource-on-error-path.patch @@ -0,0 +1,46 @@ +From 69080ec3d0daba8a894025476c98ab16b5a505a4 Mon Sep 17 00:00:00 2001 +From: Vladimir Zapolskiy +Date: Tue, 13 May 2025 17:23:45 +0300 +Subject: media: qcom: camss: cleanup media device allocated resource on error path + +From: Vladimir Zapolskiy + +commit 69080ec3d0daba8a894025476c98ab16b5a505a4 upstream. + +A call to media_device_init() requires media_device_cleanup() counterpart +to complete cleanup and release any allocated resources. + +This has been done in the driver .remove() right from the beginning, but +error paths on .probe() shall also be fixed. + +Fixes: a1d7c116fcf7 ("media: camms: Add core files") +Cc: stable@vger.kernel.org +Signed-off-by: Vladimir Zapolskiy +Reviewed-by: Bryan O'Donoghue +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/camss/camss.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/media/platform/qcom/camss/camss.c ++++ b/drivers/media/platform/qcom/camss/camss.c +@@ -3625,7 +3625,7 @@ static int camss_probe(struct platform_d + ret = v4l2_device_register(camss->dev, &camss->v4l2_dev); + if (ret < 0) { + dev_err(dev, "Failed to register V4L2 device: %d\n", ret); +- goto err_genpd_cleanup; ++ goto err_media_device_cleanup; + } + + v4l2_async_nf_init(&camss->notifier, &camss->v4l2_dev); +@@ -3680,6 +3680,8 @@ err_v4l2_device_unregister: + v4l2_device_unregister(&camss->v4l2_dev); + v4l2_async_nf_cleanup(&camss->notifier); + pm_runtime_disable(dev); ++err_media_device_cleanup: ++ media_device_cleanup(&camss->media_dev); + err_genpd_cleanup: + camss_genpd_cleanup(camss); + diff --git a/queue-6.16/media-qcom-camss-csiphy-3ph-fix-inadvertent-dropping-of-sdm660-sdm670-phy-init.patch b/queue-6.16/media-qcom-camss-csiphy-3ph-fix-inadvertent-dropping-of-sdm660-sdm670-phy-init.patch new file mode 100644 index 0000000000..62d0fe1078 --- /dev/null +++ b/queue-6.16/media-qcom-camss-csiphy-3ph-fix-inadvertent-dropping-of-sdm660-sdm670-phy-init.patch @@ -0,0 +1,42 @@ +From 868423c834a29981fe3a77d32caf645c6b91a4c5 Mon Sep 17 00:00:00 2001 +From: Bryan O'Donoghue +Date: Thu, 12 Jun 2025 09:07:15 +0100 +Subject: media: qcom: camss: csiphy-3ph: Fix inadvertent dropping of SDM660/SDM670 phy init + +From: Bryan O'Donoghue + +commit 868423c834a29981fe3a77d32caf645c6b91a4c5 upstream. + +The moving of init sequence hook from gen2() to subdev_init() doesn't +account for gen1 devices such as SDM660 and SDM670. The switch should find +the right offset for gen2 PHYs only, not reject gen1. Remove the default +error case to restore gen1 CSIPHY support. + +Cc: stable@vger.kernel.org +Fixes: fbce0ca24c3a ("media: qcom: camss: csiphy-3ph: Move CSIPHY variables to data field inside csiphy struct") +Signed-off-by: Bryan O'Donoghue +Reviewed-by: Vladimir Zapolskiy +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c b/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c +index f732a76de93e..88c0ba495c32 100644 +--- a/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c ++++ b/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c +@@ -849,8 +849,7 @@ static int csiphy_init(struct csiphy_device *csiphy) + regs->offset = 0x1000; + break; + default: +- WARN(1, "unknown csiphy version\n"); +- return -ENODEV; ++ break; + } + + return 0; +-- +2.50.1 + diff --git a/queue-6.16/media-qcom-camss-remove-extraneous-supply-postfix-on-supply-names.patch b/queue-6.16/media-qcom-camss-remove-extraneous-supply-postfix-on-supply-names.patch new file mode 100644 index 0000000000..7600fa4bf2 --- /dev/null +++ b/queue-6.16/media-qcom-camss-remove-extraneous-supply-postfix-on-supply-names.patch @@ -0,0 +1,74 @@ +From c26e8dcd9d4e86d788c5bf7a5dd0ea70a95ab067 Mon Sep 17 00:00:00 2001 +From: Bryan O'Donoghue +Date: Thu, 26 Jun 2025 02:24:33 +0100 +Subject: media: qcom: camss: Remove extraneous -supply postfix on supply names + +From: Bryan O'Donoghue + +commit c26e8dcd9d4e86d788c5bf7a5dd0ea70a95ab067 upstream. + +The -supply postfix is wrong but wasn't noticed on the CRD devices or +indeed the Dell devices, however on Lenovo devices the error comes up. + +Fixes: 1830cf0f56c3 ("media: qcom: camss: Add x1e80100 specific support") +Cc: stable@vger.kernel.org +Signed-off-by: Bryan O'Donoghue +[bod: reworded commit log per Konrad's feedback] +Reviewed-by: Konrad Dybcio +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/camss/camss.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c +index e1d64c8f42ae..e08e70b93824 100644 +--- a/drivers/media/platform/qcom/camss/camss.c ++++ b/drivers/media/platform/qcom/camss/camss.c +@@ -2486,8 +2486,8 @@ static const struct resources_icc icc_res_sm8550[] = { + static const struct camss_subdev_resources csiphy_res_x1e80100[] = { + /* CSIPHY0 */ + { +- .regulators = { "vdd-csiphy-0p8-supply", +- "vdd-csiphy-1p2-supply" }, ++ .regulators = { "vdd-csiphy-0p8", ++ "vdd-csiphy-1p2" }, + .clock = { "csiphy0", "csiphy0_timer" }, + .clock_rate = { { 300000000, 400000000, 480000000 }, + { 266666667, 400000000 } }, +@@ -2501,8 +2501,8 @@ static const struct camss_subdev_resources csiphy_res_x1e80100[] = { + }, + /* CSIPHY1 */ + { +- .regulators = { "vdd-csiphy-0p8-supply", +- "vdd-csiphy-1p2-supply" }, ++ .regulators = { "vdd-csiphy-0p8", ++ "vdd-csiphy-1p2" }, + .clock = { "csiphy1", "csiphy1_timer" }, + .clock_rate = { { 300000000, 400000000, 480000000 }, + { 266666667, 400000000 } }, +@@ -2516,8 +2516,8 @@ static const struct camss_subdev_resources csiphy_res_x1e80100[] = { + }, + /* CSIPHY2 */ + { +- .regulators = { "vdd-csiphy-0p8-supply", +- "vdd-csiphy-1p2-supply" }, ++ .regulators = { "vdd-csiphy-0p8", ++ "vdd-csiphy-1p2" }, + .clock = { "csiphy2", "csiphy2_timer" }, + .clock_rate = { { 300000000, 400000000, 480000000 }, + { 266666667, 400000000 } }, +@@ -2531,8 +2531,8 @@ static const struct camss_subdev_resources csiphy_res_x1e80100[] = { + }, + /* CSIPHY4 */ + { +- .regulators = { "vdd-csiphy-0p8-supply", +- "vdd-csiphy-1p2-supply" }, ++ .regulators = { "vdd-csiphy-0p8", ++ "vdd-csiphy-1p2" }, + .clock = { "csiphy4", "csiphy4_timer" }, + .clock_rate = { { 300000000, 400000000, 480000000 }, + { 266666667, 400000000 } }, +-- +2.50.1 + diff --git a/queue-6.16/media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch b/queue-6.16/media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch new file mode 100644 index 0000000000..d2f10a5dcf --- /dev/null +++ b/queue-6.16/media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch @@ -0,0 +1,47 @@ +From 49befc830daa743e051a65468c05c2ff9e8580e6 Mon Sep 17 00:00:00 2001 +From: Vedang Nagar +Date: Mon, 19 May 2025 12:42:21 +0530 +Subject: media: venus: Add a check for packet size after reading from shared memory + +From: Vedang Nagar + +commit 49befc830daa743e051a65468c05c2ff9e8580e6 upstream. + +Add a check to ensure that the packet size does not exceed the number of +available words after reading the packet header from shared memory. This +ensures that the size provided by the firmware is safe to process and +prevent potential out-of-bounds memory access. + +Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files") +Cc: stable@vger.kernel.org +Signed-off-by: Vedang Nagar +Co-developed-by: Dikshita Agarwal +Signed-off-by: Dikshita Agarwal +Reviewed-by: Bryan O'Donoghue +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/venus/hfi_venus.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/media/platform/qcom/venus/hfi_venus.c ++++ b/drivers/media/platform/qcom/venus/hfi_venus.c +@@ -239,6 +239,7 @@ static int venus_write_queue(struct venu + static int venus_read_queue(struct venus_hfi_device *hdev, + struct iface_queue *queue, void *pkt, u32 *tx_req) + { ++ struct hfi_pkt_hdr *pkt_hdr = NULL; + struct hfi_queue_header *qhdr; + u32 dwords, new_rd_idx; + u32 rd_idx, wr_idx, type, qsize; +@@ -304,6 +305,9 @@ static int venus_read_queue(struct venus + memcpy(pkt, rd_ptr, len); + memcpy(pkt + len, queue->qmem.kva, new_rd_idx << 2); + } ++ pkt_hdr = (struct hfi_pkt_hdr *)(pkt); ++ if ((pkt_hdr->size >> 2) != dwords) ++ return -EINVAL; + } else { + /* bad packet received, dropping */ + new_rd_idx = qhdr->write_idx; diff --git a/queue-6.16/media-venus-fix-msm8998-frequency-table.patch b/queue-6.16/media-venus-fix-msm8998-frequency-table.patch new file mode 100644 index 0000000000..316de485b3 --- /dev/null +++ b/queue-6.16/media-venus-fix-msm8998-frequency-table.patch @@ -0,0 +1,43 @@ +From ee3b94f22638e0f7a1893d95d87b08698b680052 Mon Sep 17 00:00:00 2001 +From: Konrad Dybcio +Date: Sat, 31 May 2025 14:22:00 +0200 +Subject: media: venus: Fix MSM8998 frequency table + +From: Konrad Dybcio + +commit ee3b94f22638e0f7a1893d95d87b08698b680052 upstream. + +Fill in the correct data for the production SKU. + +Fixes: 193b3dac29a4 ("media: venus: add msm8998 support") +Cc: stable@vger.kernel.org +Signed-off-by: Konrad Dybcio +Reviewed-by: Vikash Garodia +Reviewed-by: Bryan O'Donoghue +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/venus/core.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/media/platform/qcom/venus/core.c ++++ b/drivers/media/platform/qcom/venus/core.c +@@ -709,11 +709,11 @@ static const struct venus_resources msm8 + }; + + static const struct freq_tbl msm8998_freq_table[] = { +- { 1944000, 465000000 }, /* 4k UHD @ 60 (decode only) */ +- { 972000, 465000000 }, /* 4k UHD @ 30 */ +- { 489600, 360000000 }, /* 1080p @ 60 */ +- { 244800, 186000000 }, /* 1080p @ 30 */ +- { 108000, 100000000 }, /* 720p @ 30 */ ++ { 1728000, 533000000 }, /* 4k UHD @ 60 (decode only) */ ++ { 1036800, 444000000 }, /* 2k @ 120 */ ++ { 829440, 355200000 }, /* 4k @ 44 */ ++ { 489600, 269330000 },/* 4k @ 30 */ ++ { 108000, 200000000 }, /* 1080p @ 60 */ + }; + + static const struct reg_val msm8998_reg_preset[] = { diff --git a/queue-6.16/media-venus-hfi-explicitly-release-irq-during-teardown.patch b/queue-6.16/media-venus-hfi-explicitly-release-irq-during-teardown.patch new file mode 100644 index 0000000000..67348ce351 --- /dev/null +++ b/queue-6.16/media-venus-hfi-explicitly-release-irq-during-teardown.patch @@ -0,0 +1,38 @@ +From 640803003cd903cea73dc6a86bf6963e238e2b3f Mon Sep 17 00:00:00 2001 +From: Jorge Ramirez-Ortiz +Date: Thu, 19 Jun 2025 09:48:30 +0200 +Subject: media: venus: hfi: explicitly release IRQ during teardown + +From: Jorge Ramirez-Ortiz + +commit 640803003cd903cea73dc6a86bf6963e238e2b3f upstream. + +Ensure the IRQ is disabled - and all pending handlers completed - before +dismantling the interrupt routing and clearing related pointers. + +This prevents any possibility of the interrupt triggering after the +handler context has been invalidated. + +Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files") +Cc: stable@vger.kernel.org +Signed-off-by: Jorge Ramirez-Ortiz +Reviewed-by: Dikshita Agarwal +Tested-by: Dikshita Agarwal # RB5 +Reviewed-by: Bryan O'Donoghue +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/venus/hfi_venus.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/platform/qcom/venus/hfi_venus.c ++++ b/drivers/media/platform/qcom/venus/hfi_venus.c +@@ -1682,6 +1682,7 @@ void venus_hfi_destroy(struct venus_core + venus_interface_queues_release(hdev); + mutex_destroy(&hdev->lock); + kfree(hdev); ++ disable_irq(core->irq); + core->ops = NULL; + } + diff --git a/queue-6.16/media-venus-protect-against-spurious-interrupts-during-probe.patch b/queue-6.16/media-venus-protect-against-spurious-interrupts-during-probe.patch new file mode 100644 index 0000000000..781b8ba146 --- /dev/null +++ b/queue-6.16/media-venus-protect-against-spurious-interrupts-during-probe.patch @@ -0,0 +1,52 @@ +From 3200144a2fa4209dc084a19941b9b203b43580f0 Mon Sep 17 00:00:00 2001 +From: Jorge Ramirez-Ortiz +Date: Fri, 6 Jun 2025 17:25:22 +0200 +Subject: media: venus: protect against spurious interrupts during probe + +From: Jorge Ramirez-Ortiz + +commit 3200144a2fa4209dc084a19941b9b203b43580f0 upstream. + +Make sure the interrupt handler is initialized before the interrupt is +registered. + +If the IRQ is registered before hfi_create(), it's possible that an +interrupt fires before the handler setup is complete, leading to a NULL +dereference. + +This error condition has been observed during system boot on Rb3Gen2. + +Fixes: af2c3834c8ca ("[media] media: venus: adding core part and helper functions") +Cc: stable@vger.kernel.org +Signed-off-by: Jorge Ramirez-Ortiz +Reviewed-by: Bryan O'Donoghue +Reviewed-by: Vikash Garodia +Reviewed-by: Dikshita Agarwal +Tested-by: Dikshita Agarwal # RB5 +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/venus/core.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/media/platform/qcom/venus/core.c ++++ b/drivers/media/platform/qcom/venus/core.c +@@ -424,13 +424,13 @@ static int venus_probe(struct platform_d + INIT_DELAYED_WORK(&core->work, venus_sys_error_handler); + init_waitqueue_head(&core->sys_err_done); + +- ret = devm_request_threaded_irq(dev, core->irq, hfi_isr, venus_isr_thread, +- IRQF_TRIGGER_HIGH | IRQF_ONESHOT, +- "venus", core); ++ ret = hfi_create(core, &venus_core_ops); + if (ret) + goto err_core_put; + +- ret = hfi_create(core, &venus_core_ops); ++ ret = devm_request_threaded_irq(dev, core->irq, hfi_isr, venus_isr_thread, ++ IRQF_TRIGGER_HIGH | IRQF_ONESHOT, ++ "venus", core); + if (ret) + goto err_core_put; + diff --git a/queue-6.16/media-venus-vdec-clamp-param-smaller-than-1fps-and-bigger-than-240.patch b/queue-6.16/media-venus-vdec-clamp-param-smaller-than-1fps-and-bigger-than-240.patch new file mode 100644 index 0000000000..2ea3210a97 --- /dev/null +++ b/queue-6.16/media-venus-vdec-clamp-param-smaller-than-1fps-and-bigger-than-240.patch @@ -0,0 +1,59 @@ +From 377dc500d253f0b26732b2cb062e89668aef890a Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Mon, 16 Jun 2025 15:29:14 +0000 +Subject: media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. + +From: Ricardo Ribalda + +commit 377dc500d253f0b26732b2cb062e89668aef890a upstream. + +The driver uses "whole" fps in all its calculations (e.g. in +load_per_instance()). Those calculation expect an fps bigger than 1, and +not big enough to overflow. + +Clamp the value if the user provides a param that will result in an invalid +fps. + +Reported-by: Hans Verkuil +Closes: https://lore.kernel.org/linux-media/f11653a7-bc49-48cd-9cdb-1659147453e4@xs4all.nl/T/#m91cd962ac942834654f94c92206e2f85ff7d97f0 +Fixes: 7472c1c69138 ("[media] media: venus: vdec: add video decoder files") +Cc: stable@vger.kernel.org +Tested-by: Bryan O'Donoghue # qrb5615-rb5 +Reviewed-by: Bryan O'Donoghue +Signed-off-by: Ricardo Ribalda +[bod: Change "parm" to "param"] +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/venus/core.h | 2 ++ + drivers/media/platform/qcom/venus/vdec.c | 5 ++--- + 2 files changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/media/platform/qcom/venus/core.h ++++ b/drivers/media/platform/qcom/venus/core.h +@@ -28,6 +28,8 @@ + #define VIDC_RESETS_NUM_MAX 2 + #define VIDC_MAX_HIER_CODING_LAYER 6 + ++#define VENUS_MAX_FPS 240 ++ + extern int venus_fw_debug; + + struct freq_tbl { +--- a/drivers/media/platform/qcom/venus/vdec.c ++++ b/drivers/media/platform/qcom/venus/vdec.c +@@ -481,11 +481,10 @@ static int vdec_s_parm(struct file *file + us_per_frame = timeperframe->numerator * (u64)USEC_PER_SEC; + do_div(us_per_frame, timeperframe->denominator); + +- if (!us_per_frame) +- return -EINVAL; +- ++ us_per_frame = clamp(us_per_frame, 1, USEC_PER_SEC); + fps = (u64)USEC_PER_SEC; + do_div(fps, us_per_frame); ++ fps = min(VENUS_MAX_FPS, fps); + + inst->fps = fps; + inst->timeperframe = *timeperframe; diff --git a/queue-6.16/media-venus-venc-clamp-param-smaller-than-1fps-and-bigger-than-240.patch b/queue-6.16/media-venus-venc-clamp-param-smaller-than-1fps-and-bigger-than-240.patch new file mode 100644 index 0000000000..8518a5d587 --- /dev/null +++ b/queue-6.16/media-venus-venc-clamp-param-smaller-than-1fps-and-bigger-than-240.patch @@ -0,0 +1,45 @@ +From 417c01b92ec278a1118a05c6ad8a796eaa0c9c52 Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Mon, 16 Jun 2025 15:29:15 +0000 +Subject: media: venus: venc: Clamp param smaller than 1fps and bigger than 240 + +From: Ricardo Ribalda + +commit 417c01b92ec278a1118a05c6ad8a796eaa0c9c52 upstream. + +The driver uses "whole" fps in all its calculations (e.g. in +load_per_instance()). Those calculation expect an fps bigger than 1, and +not big enough to overflow. + +Clamp the param if the user provides a value that will result in an invalid +fps. + +Reported-by: Hans Verkuil +Closes: https://lore.kernel.org/linux-media/f11653a7-bc49-48cd-9cdb-1659147453e4@xs4all.nl/T/#m91cd962ac942834654f94c92206e2f85ff7d97f0 +Fixes: aaaa93eda64b ("[media] media: venus: venc: add video encoder files") +Cc: stable@vger.kernel.org +Signed-off-by: Ricardo Ribalda +[bod: Change "parm" to "param"] +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/venus/venc.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/media/platform/qcom/venus/venc.c ++++ b/drivers/media/platform/qcom/venus/venc.c +@@ -411,11 +411,10 @@ static int venc_s_parm(struct file *file + us_per_frame = timeperframe->numerator * (u64)USEC_PER_SEC; + do_div(us_per_frame, timeperframe->denominator); + +- if (!us_per_frame) +- return -EINVAL; +- ++ us_per_frame = clamp(us_per_frame, 1, USEC_PER_SEC); + fps = (u64)USEC_PER_SEC; + do_div(fps, us_per_frame); ++ fps = min(VENUS_MAX_FPS, fps); + + inst->timeperframe = *timeperframe; + inst->fps = fps; diff --git a/queue-6.16/series b/queue-6.16/series index 05e49e1752..181f2ef40a 100644 --- a/queue-6.16/series +++ b/queue-6.16/series @@ -140,3 +140,54 @@ media-pisp_be-fix-pm_runtime-underrun-in-probe.patch media-ov2659-fix-memory-leaks-in-ov2659_probe.patch media-mt9m114-fix-deadlock-in-get_frame_interval-set_frame_interval.patch media-ivsc-fix-crash-at-shutdown-due-to-missing-mei_cldev_disable-calls.patch +media-qcom-camss-csiphy-3ph-fix-inadvertent-dropping-of-sdm660-sdm670-phy-init.patch +media-qcom-camss-cleanup-media-device-allocated-resource-on-error-path.patch +media-qcom-camss-remove-extraneous-supply-postfix-on-supply-names.patch +media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch +media-venus-fix-msm8998-frequency-table.patch +media-venus-hfi-explicitly-release-irq-during-teardown.patch +media-venus-protect-against-spurious-interrupts-during-probe.patch +media-venus-vdec-clamp-param-smaller-than-1fps-and-bigger-than-240.patch +media-venus-venc-clamp-param-smaller-than-1fps-and-bigger-than-240.patch +media-iris-avoid-updating-frame-size-to-firmware-during-reconfig.patch +media-iris-drop-port-check-for-session-property-response.patch +media-iris-fix-buffer-preparation-failure-during-resolution-change.patch +media-iris-fix-missing-function-pointer-initialization.patch +media-iris-fix-null-pointer-dereference.patch +media-iris-fix-typo-in-depth-variable.patch +media-iris-prevent-hfi-queue-writes-when-core-is-in-deinit-state.patch +media-iris-remove-deprecated-property-setting-to-firmware.patch +media-iris-remove-error-check-for-non-zero-v4l2-controls.patch +media-iris-send-v4l2_buf_flag_error-for-capture-buffers-with-0-filled-length.patch +media-iris-skip-destroying-internal-buffer-if-not-dequeued.patch +media-iris-skip-flush-on-first-sequence-change.patch +media-iris-track-flush-responses-to-prevent-premature-completion.patch +media-iris-update-capture-format-info-based-on-output-format.patch +media-iris-verify-internal-buffer-release-on-close.patch +media-iris-remove-unnecessary-re-initialization-of-flush-completion.patch +drm-xe-bmg-add-one-additional-pci-id.patch +drm-xe-defer-buffer-object-shrinker-write-backs-and-gpu-waits.patch +drm-amd-amdgpu-fix-missing-lock-for-cper.ring-rptr-wptr-access.patch +drm-amdgpu-discovery-fix-fw-based-ip-discovery.patch +drm-amd-restore-cached-power-limit-during-resume.patch +drm-amdgpu-add-kicker-fws-loading-for-gfx12-smu14-psp14.patch +drm-amdgpu-add-missing-vram-lost-check-for-legacy-reset.patch +drm-amdgpu-avoid-extra-evict-restore-process.patch +drm-amdgpu-check-if-hubbub-is-null-in-debugfs-amdgpu_dm_capabilities.patch +drm-amdgpu-initialize-data-to-null-in-imu_v12_0_program_rlc_ram.patch +drm-amdgpu-retain-job-vm-in-amdgpu_job_prepare_job.patch +drm-amdgpu-track-whether-a-queue-is-a-kernel-queue-in-amdgpu_mqd_prop.patch +drm-amdgpu-update-external-revid-for-gc-v9.5.0.patch +drm-amdgpu-update-mmhub-3.0.1-client-id-mappings.patch +drm-amdgpu-update-mmhub-3.3-client-id-mappings.patch +drm-amdgpu-update-mmhub-4.1.0-client-id-mappings.patch +drm-amdgpu-update-supported-modes-for-gc-v9.5.0.patch +drm-amdkfd-destroy-kfd-debugfs-after-destroy-kfd-wq.patch +drm-amdkfd-fix-checkpoint-restore-on-multi-xcc.patch +drm-amd-display-add-primary-plane-to-commits-for-correct-vrr-handling.patch +drm-amd-display-fix-a-null-pointer-dereference-vulnerability.patch +drm-amd-display-fix-dce-6.0-and-6.4-pll-programming.patch +drm-amd-display-fix-initial-backlight-brightness-calculation.patch +drm-amd-display-pass-up-errors-for-reset-gpu-that-fails-to-init-hw.patch +drm-amd-display-revert-drm-amd-display-fix-amdgpu_max_bl_level-value.patch +drm-amd-display-don-t-overwrite-dce60_clk_mgr.patch