From: Greg Kroah-Hartman Date: Thu, 21 Aug 2025 14:42:39 +0000 (+0200) Subject: 6.12-stable patches X-Git-Tag: v6.16.3~76 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=932d1eb850f4968741a1fd9e3e0c5bbd4f15db89;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: drm-amd-display-add-primary-plane-to-commits-for-correct-vrr-handling.patch drm-amd-display-don-t-overwrite-dce60_clk_mgr.patch drm-amd-display-fix-a-null-pointer-dereference-vulnerability.patch drm-amd-restore-cached-power-limit-during-resume.patch drm-amdgpu-avoid-extra-evict-restore-process.patch drm-amdgpu-check-if-hubbub-is-null-in-debugfs-amdgpu_dm_capabilities.patch drm-amdgpu-discovery-fix-fw-based-ip-discovery.patch drm-amdgpu-initialize-data-to-null-in-imu_v12_0_program_rlc_ram.patch drm-amdgpu-update-external-revid-for-gc-v9.5.0.patch drm-amdgpu-update-mmhub-3.0.1-client-id-mappings.patch drm-amdgpu-update-mmhub-4.1.0-client-id-mappings.patch drm-amdkfd-destroy-kfd-debugfs-after-destroy-kfd-wq.patch media-qcom-camss-cleanup-media-device-allocated-resource-on-error-path.patch media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch media-venus-fix-msm8998-frequency-table.patch media-venus-hfi-explicitly-release-irq-during-teardown.patch media-venus-protect-against-spurious-interrupts-during-probe.patch media-venus-vdec-clamp-param-smaller-than-1fps-and-bigger-than-240.patch media-venus-venc-clamp-param-smaller-than-1fps-and-bigger-than-240.patch --- diff --git a/queue-6.12/drm-amd-display-add-primary-plane-to-commits-for-correct-vrr-handling.patch b/queue-6.12/drm-amd-display-add-primary-plane-to-commits-for-correct-vrr-handling.patch new file mode 100644 index 0000000000..b2c7c60aee --- /dev/null +++ b/queue-6.12/drm-amd-display-add-primary-plane-to-commits-for-correct-vrr-handling.patch @@ -0,0 +1,53 @@ +From 3477c1b0972dc1c8a46f78e8fb1fa6966095b5ec Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michel=20D=C3=A4nzer?= +Date: Wed, 30 Jul 2025 10:09:02 +0200 +Subject: drm/amd/display: Add primary plane to commits for correct VRR handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michel Dänzer + +commit 3477c1b0972dc1c8a46f78e8fb1fa6966095b5ec upstream. + +amdgpu_dm_commit_planes calls update_freesync_state_on_stream only for +the primary plane. If a commit affects a CRTC but not its primary plane, +it would previously not trigger a refresh cycle or affect LFC, violating +current UAPI semantics. + +Fixes e.g. atomic commits affecting only the cursor plane being limited +to the minimum refresh rate. + +Don't do this for the legacy cursor ioctls though, it would break the +UAPI semantics for those. + +Suggested-by: Xaver Hugl +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3034 +Signed-off-by: Michel Dänzer +Reviewed-by: Harry Wentland +Signed-off-by: Alex Deucher +(cherry picked from commit cc7bfba95966251b254cb970c21627124da3b7f4) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c +@@ -664,6 +664,15 @@ static int amdgpu_dm_crtc_helper_atomic_ + return -EINVAL; + } + ++ if (!state->legacy_cursor_update && amdgpu_dm_crtc_vrr_active(dm_crtc_state)) { ++ struct drm_plane_state *primary_state; ++ ++ /* Pull in primary plane for correct VRR handling */ ++ primary_state = drm_atomic_get_plane_state(state, crtc->primary); ++ if (IS_ERR(primary_state)) ++ return PTR_ERR(primary_state); ++ } ++ + /* In some use cases, like reset, no stream is attached */ + if (!dm_crtc_state->stream) + return 0; diff --git a/queue-6.12/drm-amd-display-don-t-overwrite-dce60_clk_mgr.patch b/queue-6.12/drm-amd-display-don-t-overwrite-dce60_clk_mgr.patch new file mode 100644 index 0000000000..137f9f722b --- /dev/null +++ b/queue-6.12/drm-amd-display-don-t-overwrite-dce60_clk_mgr.patch @@ -0,0 +1,38 @@ +From 4db9cd554883e051df1840d4d58d636043101034 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Timur=20Krist=C3=B3f?= +Date: Tue, 22 Jul 2025 17:58:29 +0200 +Subject: drm/amd/display: Don't overwrite dce60_clk_mgr +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +commit 4db9cd554883e051df1840d4d58d636043101034 upstream. + +dc_clk_mgr_create accidentally overwrites the dce60_clk_mgr +with the dce_clk_mgr, causing incorrect behaviour on DCE6. +Fix it by removing the extra dce_clk_mgr_construct. + +Fixes: 62eab49faae7 ("drm/amd/display: hide VGH asic specific structs") +Reviewed-by: Rodrigo Siqueira +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +(cherry picked from commit bbddcbe36a686af03e91341b9bbfcca94bd45fb6) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c +@@ -158,7 +158,6 @@ struct clk_mgr *dc_clk_mgr_create(struct + return NULL; + } + dce60_clk_mgr_construct(ctx, clk_mgr); +- dce_clk_mgr_construct(ctx, clk_mgr); + return &clk_mgr->base; + } + #endif diff --git a/queue-6.12/drm-amd-display-fix-a-null-pointer-dereference-vulnerability.patch b/queue-6.12/drm-amd-display-fix-a-null-pointer-dereference-vulnerability.patch new file mode 100644 index 0000000000..612a622d81 --- /dev/null +++ b/queue-6.12/drm-amd-display-fix-a-null-pointer-dereference-vulnerability.patch @@ -0,0 +1,67 @@ +From 1bcf63a44381691d6192872801f830ce3250e367 Mon Sep 17 00:00:00 2001 +From: Siyang Liu +Date: Fri, 4 Jul 2025 11:16:22 +0800 +Subject: drm/amd/display: fix a Null pointer dereference vulnerability + +From: Siyang Liu + +commit 1bcf63a44381691d6192872801f830ce3250e367 upstream. + +[Why] +A null pointer dereference vulnerability exists in the AMD display driver's +(DC module) cleanup function dc_destruct(). +When display control context (dc->ctx) construction fails +(due to memory allocation failure), this pointer remains NULL. +During subsequent error handling when dc_destruct() is called, +there's no NULL check before dereferencing the perf_trace member +(dc->ctx->perf_trace), causing a kernel null pointer dereference crash. + +[How] +Check if dc->ctx is non-NULL before dereferencing. + +Link: https://lore.kernel.org/r/tencent_54FF4252EDFB6533090A491A25EEF3EDBF06@qq.com +Co-developed-by: Mario Limonciello +Signed-off-by: Mario Limonciello +(Updated commit text and removed unnecessary error message) +Signed-off-by: Siyang Liu +Signed-off-by: Roman Li +Reviewed-by: Alex Hung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 9dd8e2ba268c636c240a918e0a31e6feaee19404) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/core/dc.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/core/dc.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c +@@ -890,17 +890,18 @@ static void dc_destruct(struct dc *dc) + if (dc->link_srv) + link_destroy_link_service(&dc->link_srv); + +- if (dc->ctx->gpio_service) +- dal_gpio_service_destroy(&dc->ctx->gpio_service); ++ if (dc->ctx) { ++ if (dc->ctx->gpio_service) ++ dal_gpio_service_destroy(&dc->ctx->gpio_service); + +- if (dc->ctx->created_bios) +- dal_bios_parser_destroy(&dc->ctx->dc_bios); ++ if (dc->ctx->created_bios) ++ dal_bios_parser_destroy(&dc->ctx->dc_bios); ++ kfree(dc->ctx->logger); ++ dc_perf_trace_destroy(&dc->ctx->perf_trace); + +- kfree(dc->ctx->logger); +- dc_perf_trace_destroy(&dc->ctx->perf_trace); +- +- kfree(dc->ctx); +- dc->ctx = NULL; ++ kfree(dc->ctx); ++ dc->ctx = NULL; ++ } + + kfree(dc->bw_vbios); + dc->bw_vbios = NULL; diff --git a/queue-6.12/drm-amd-restore-cached-power-limit-during-resume.patch b/queue-6.12/drm-amd-restore-cached-power-limit-during-resume.patch new file mode 100644 index 0000000000..b0e4139e9d --- /dev/null +++ b/queue-6.12/drm-amd-restore-cached-power-limit-during-resume.patch @@ -0,0 +1,40 @@ +From ed4efe426a49729952b3dc05d20e33b94409bdd1 Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Thu, 24 Jul 2025 22:12:21 -0500 +Subject: drm/amd: Restore cached power limit during resume + +From: Mario Limonciello + +commit ed4efe426a49729952b3dc05d20e33b94409bdd1 upstream. + +The power limit will be cached in smu->current_power_limit but +if the ASIC goes into S3 this value won't be restored. + +Restore the value during SMU resume. + +Acked-by: Alex Deucher +Link: https://lore.kernel.org/r/20250725031222.3015095-2-superm1@kernel.org +Signed-off-by: Mario Limonciello +Signed-off-by: Alex Deucher +(cherry picked from commit 26a609e053a6fc494403e95403bc6a2470383bec) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +@@ -2153,6 +2153,12 @@ static int smu_resume(void *handle) + + adev->pm.dpm_enabled = true; + ++ if (smu->current_power_limit) { ++ ret = smu_set_power_limit(smu, smu->current_power_limit); ++ if (ret && ret != -EOPNOTSUPP) ++ return ret; ++ } ++ + dev_info(adev->dev, "SMU is resumed successfully!\n"); + + return 0; diff --git a/queue-6.12/drm-amdgpu-avoid-extra-evict-restore-process.patch b/queue-6.12/drm-amdgpu-avoid-extra-evict-restore-process.patch new file mode 100644 index 0000000000..682c9e7625 --- /dev/null +++ b/queue-6.12/drm-amdgpu-avoid-extra-evict-restore-process.patch @@ -0,0 +1,62 @@ +From 1f02f2044bda1db1fd995bc35961ab075fa7b5a2 Mon Sep 17 00:00:00 2001 +From: Gang Ba +Date: Tue, 8 Jul 2025 14:36:13 -0400 +Subject: drm/amdgpu: Avoid extra evict-restore process. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Gang Ba + +commit 1f02f2044bda1db1fd995bc35961ab075fa7b5a2 upstream. + +If vm belongs to another process, this is fclose after fork, +wait may enable signaling KFD eviction fence and cause parent process queue evicted. + +[677852.634569] amdkfd_fence_enable_signaling+0x56/0x70 [amdgpu] +[677852.634814] __dma_fence_enable_signaling+0x3e/0xe0 +[677852.634820] dma_fence_wait_timeout+0x3a/0x140 +[677852.634825] amddma_resv_wait_timeout+0x7f/0xf0 [amdkcl] +[677852.634831] amdgpu_vm_wait_idle+0x2d/0x60 [amdgpu] +[677852.635026] amdgpu_flush+0x34/0x50 [amdgpu] +[677852.635208] filp_flush+0x38/0x90 +[677852.635213] filp_close+0x14/0x30 +[677852.635216] do_close_on_exec+0xdd/0x130 +[677852.635221] begin_new_exec+0x1da/0x490 +[677852.635225] load_elf_binary+0x307/0xea0 +[677852.635231] ? srso_alias_return_thunk+0x5/0xfbef5 +[677852.635235] ? ima_bprm_check+0xa2/0xd0 +[677852.635240] search_binary_handler+0xda/0x260 +[677852.635245] exec_binprm+0x58/0x1a0 +[677852.635249] bprm_execve.part.0+0x16f/0x210 +[677852.635254] bprm_execve+0x45/0x80 +[677852.635257] do_execveat_common.isra.0+0x190/0x200 + +Suggested-by: Christian König +Signed-off-by: Gang Ba +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +@@ -2292,13 +2292,11 @@ void amdgpu_vm_adjust_size(struct amdgpu + */ + long amdgpu_vm_wait_idle(struct amdgpu_vm *vm, long timeout) + { +- timeout = dma_resv_wait_timeout(vm->root.bo->tbo.base.resv, +- DMA_RESV_USAGE_BOOKKEEP, +- true, timeout); ++ timeout = drm_sched_entity_flush(&vm->immediate, timeout); + if (timeout <= 0) + return timeout; + +- return dma_fence_wait_timeout(vm->last_unlocked, true, timeout); ++ return drm_sched_entity_flush(&vm->delayed, timeout); + } + + static void amdgpu_vm_destroy_task_info(struct kref *kref) diff --git a/queue-6.12/drm-amdgpu-check-if-hubbub-is-null-in-debugfs-amdgpu_dm_capabilities.patch b/queue-6.12/drm-amdgpu-check-if-hubbub-is-null-in-debugfs-amdgpu_dm_capabilities.patch new file mode 100644 index 0000000000..5425dd88ce --- /dev/null +++ b/queue-6.12/drm-amdgpu-check-if-hubbub-is-null-in-debugfs-amdgpu_dm_capabilities.patch @@ -0,0 +1,32 @@ +From b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288 Mon Sep 17 00:00:00 2001 +From: Peter Shkenev +Date: Thu, 17 Jul 2025 23:48:17 +0300 +Subject: drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities + +From: Peter Shkenev + +commit b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288 upstream. + +HUBBUB structure is not initialized on DCE hardware, so check if it is NULL +to avoid null dereference while accessing amdgpu_dm_capabilities file in +debugfs. + +Signed-off-by: Peter Shkenev +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c +@@ -3932,7 +3932,7 @@ static int capabilities_show(struct seq_ + + struct hubbub *hubbub = dc->res_pool->hubbub; + +- if (hubbub->funcs->get_mall_en) ++ if (hubbub && hubbub->funcs->get_mall_en) + hubbub->funcs->get_mall_en(hubbub, &mall_in_use); + + if (dc->cap_funcs.get_subvp_en) diff --git a/queue-6.12/drm-amdgpu-discovery-fix-fw-based-ip-discovery.patch b/queue-6.12/drm-amdgpu-discovery-fix-fw-based-ip-discovery.patch new file mode 100644 index 0000000000..1c441463f0 --- /dev/null +++ b/queue-6.12/drm-amdgpu-discovery-fix-fw-based-ip-discovery.patch @@ -0,0 +1,171 @@ +From 514678da56da089b756b4d433efd964fa22b2079 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 30 Jul 2025 11:16:05 -0400 +Subject: drm/amdgpu/discovery: fix fw based ip discovery + +From: Alex Deucher + +commit 514678da56da089b756b4d433efd964fa22b2079 upstream. + +We only need the fw based discovery table for sysfs. No +need to parse it. Additionally parsing some of the board +specific tables may result in incorrect data on some boards. +just load the binary and don't parse it on those boards. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4441 +Fixes: 80a0e8282933 ("drm/amdgpu/discovery: optionally use fw based ip discovery") +Reviewed-by: Mario Limonciello (AMD) +Signed-off-by: Alex Deucher +(cherry picked from commit 62eedd150fa11aefc2d377fc746633fdb1baeb55) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 5 - + drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 72 ++++++++++++++------------ + 2 files changed, 41 insertions(+), 36 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -2387,9 +2387,6 @@ static int amdgpu_device_parse_gpu_info_ + + adev->firmware.gpu_info_fw = NULL; + +- if (adev->mman.discovery_bin) +- return 0; +- + switch (adev->asic_type) { + default: + return 0; +@@ -2411,6 +2408,8 @@ static int amdgpu_device_parse_gpu_info_ + chip_name = "arcturus"; + break; + case CHIP_NAVI12: ++ if (adev->mman.discovery_bin) ++ return 0; + chip_name = "navi12"; + break; + } +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +@@ -2455,40 +2455,11 @@ int amdgpu_discovery_set_ip_blocks(struc + + switch (adev->asic_type) { + case CHIP_VEGA10: +- case CHIP_VEGA12: +- case CHIP_RAVEN: +- case CHIP_VEGA20: +- case CHIP_ARCTURUS: +- case CHIP_ALDEBARAN: +- /* this is not fatal. We have a fallback below +- * if the new firmwares are not present. some of +- * this will be overridden below to keep things +- * consistent with the current behavior. ++ /* This is not fatal. We only need the discovery ++ * binary for sysfs. We don't need it for a ++ * functional system. + */ +- r = amdgpu_discovery_reg_base_init(adev); +- if (!r) { +- amdgpu_discovery_harvest_ip(adev); +- amdgpu_discovery_get_gfx_info(adev); +- amdgpu_discovery_get_mall_info(adev); +- amdgpu_discovery_get_vcn_info(adev); +- } +- break; +- default: +- r = amdgpu_discovery_reg_base_init(adev); +- if (r) { +- drm_err(&adev->ddev, "discovery failed: %d\n", r); +- return r; +- } +- +- amdgpu_discovery_harvest_ip(adev); +- amdgpu_discovery_get_gfx_info(adev); +- amdgpu_discovery_get_mall_info(adev); +- amdgpu_discovery_get_vcn_info(adev); +- break; +- } +- +- switch (adev->asic_type) { +- case CHIP_VEGA10: ++ amdgpu_discovery_init(adev); + vega10_reg_base_init(adev); + adev->sdma.num_instances = 2; + adev->gmc.num_umc = 4; +@@ -2511,6 +2482,11 @@ int amdgpu_discovery_set_ip_blocks(struc + adev->ip_versions[DCI_HWIP][0] = IP_VERSION(12, 0, 0); + break; + case CHIP_VEGA12: ++ /* This is not fatal. We only need the discovery ++ * binary for sysfs. We don't need it for a ++ * functional system. ++ */ ++ amdgpu_discovery_init(adev); + vega10_reg_base_init(adev); + adev->sdma.num_instances = 2; + adev->gmc.num_umc = 4; +@@ -2533,6 +2509,11 @@ int amdgpu_discovery_set_ip_blocks(struc + adev->ip_versions[DCI_HWIP][0] = IP_VERSION(12, 0, 1); + break; + case CHIP_RAVEN: ++ /* This is not fatal. We only need the discovery ++ * binary for sysfs. We don't need it for a ++ * functional system. ++ */ ++ amdgpu_discovery_init(adev); + vega10_reg_base_init(adev); + adev->sdma.num_instances = 1; + adev->vcn.num_vcn_inst = 1; +@@ -2572,6 +2553,11 @@ int amdgpu_discovery_set_ip_blocks(struc + } + break; + case CHIP_VEGA20: ++ /* This is not fatal. We only need the discovery ++ * binary for sysfs. We don't need it for a ++ * functional system. ++ */ ++ amdgpu_discovery_init(adev); + vega20_reg_base_init(adev); + adev->sdma.num_instances = 2; + adev->gmc.num_umc = 8; +@@ -2595,6 +2581,11 @@ int amdgpu_discovery_set_ip_blocks(struc + adev->ip_versions[DCI_HWIP][0] = IP_VERSION(12, 1, 0); + break; + case CHIP_ARCTURUS: ++ /* This is not fatal. We only need the discovery ++ * binary for sysfs. We don't need it for a ++ * functional system. ++ */ ++ amdgpu_discovery_init(adev); + arct_reg_base_init(adev); + adev->sdma.num_instances = 8; + adev->vcn.num_vcn_inst = 2; +@@ -2623,6 +2614,11 @@ int amdgpu_discovery_set_ip_blocks(struc + adev->ip_versions[UVD_HWIP][1] = IP_VERSION(2, 5, 0); + break; + case CHIP_ALDEBARAN: ++ /* This is not fatal. We only need the discovery ++ * binary for sysfs. We don't need it for a ++ * functional system. ++ */ ++ amdgpu_discovery_init(adev); + aldebaran_reg_base_init(adev); + adev->sdma.num_instances = 5; + adev->vcn.num_vcn_inst = 2; +@@ -2649,6 +2645,16 @@ int amdgpu_discovery_set_ip_blocks(struc + adev->ip_versions[XGMI_HWIP][0] = IP_VERSION(6, 1, 0); + break; + default: ++ r = amdgpu_discovery_reg_base_init(adev); ++ if (r) { ++ drm_err(&adev->ddev, "discovery failed: %d\n", r); ++ return r; ++ } ++ ++ amdgpu_discovery_harvest_ip(adev); ++ amdgpu_discovery_get_gfx_info(adev); ++ amdgpu_discovery_get_mall_info(adev); ++ amdgpu_discovery_get_vcn_info(adev); + break; + } + diff --git a/queue-6.12/drm-amdgpu-initialize-data-to-null-in-imu_v12_0_program_rlc_ram.patch b/queue-6.12/drm-amdgpu-initialize-data-to-null-in-imu_v12_0_program_rlc_ram.patch new file mode 100644 index 0000000000..265db9bcaa --- /dev/null +++ b/queue-6.12/drm-amdgpu-initialize-data-to-null-in-imu_v12_0_program_rlc_ram.patch @@ -0,0 +1,50 @@ +From c90f2e1172c51fa25492471dc9910e2d7c1444b9 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Tue, 15 Jul 2025 16:50:22 -0700 +Subject: drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() + +From: Nathan Chancellor + +commit c90f2e1172c51fa25492471dc9910e2d7c1444b9 upstream. + +After a recent change in clang to expose uninitialized warnings from +const variables and pointers [1], there is a warning in +imu_v12_0_program_rlc_ram() because data is passed uninitialized to +program_imu_rlc_ram(): + + drivers/gpu/drm/amd/amdgpu/imu_v12_0.c:374:30: error: variable 'data' is uninitialized when used here [-Werror,-Wuninitialized] + 374 | program_imu_rlc_ram(adev, data, (const u32)size); + | ^~~~ + +As this warning happens early in clang's frontend, it does not realize +that due to the assignment of r to -EINVAL, program_imu_rlc_ram() is +never actually called, and even if it were, data would not be +dereferenced because size is 0. + +Just initialize data to NULL to silence the warning, as the commit that +added program_imu_rlc_ram() mentioned it would eventually be used over +the old method, at which point data can be properly initialized and +used. + +Cc: stable@vger.kernel.org +Closes: https://github.com/ClangBuiltLinux/linux/issues/2107 +Fixes: 56159fffaab5 ("drm/amdgpu: use new method to program rlc ram") +Link: https://github.com/llvm/llvm-project/commit/2464313eef01c5b1edf0eccf57a32cdee01472c7 [1] +Signed-off-by: Nathan Chancellor +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/imu_v12_0.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/imu_v12_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/imu_v12_0.c +@@ -361,7 +361,7 @@ static void program_imu_rlc_ram(struct a + static void imu_v12_0_program_rlc_ram(struct amdgpu_device *adev) + { + u32 reg_data, size = 0; +- const u32 *data; ++ const u32 *data = NULL; + int r = -EINVAL; + + WREG32_SOC15(GC, 0, regGFX_IMU_RLC_RAM_INDEX, 0x2); diff --git a/queue-6.12/drm-amdgpu-update-external-revid-for-gc-v9.5.0.patch b/queue-6.12/drm-amdgpu-update-external-revid-for-gc-v9.5.0.patch new file mode 100644 index 0000000000..18257ca80f --- /dev/null +++ b/queue-6.12/drm-amdgpu-update-external-revid-for-gc-v9.5.0.patch @@ -0,0 +1,33 @@ +From 05c8b690511854ba31d8d1bff7139a13ec66b9e7 Mon Sep 17 00:00:00 2001 +From: Lijo Lazar +Date: Fri, 25 Jul 2025 10:21:10 +0530 +Subject: drm/amdgpu: Update external revid for GC v9.5.0 + +From: Lijo Lazar + +commit 05c8b690511854ba31d8d1bff7139a13ec66b9e7 upstream. + +Use different external revid for GC v9.5.0 SOCs. + +Signed-off-by: Lijo Lazar +Reviewed-by: Hawking Zhang +Reviewed-by: Asad Kamal +Signed-off-by: Alex Deucher +(cherry picked from commit 21c6764ed4bfaecad034bc4fd15dd64c5a436325) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/soc15.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/soc15.c ++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c +@@ -1183,6 +1183,8 @@ static int soc15_common_early_init(void + AMD_PG_SUPPORT_JPEG; + /*TODO: need a new external_rev_id for GC 9.4.4? */ + adev->external_rev_id = adev->rev_id + 0x46; ++ if (amdgpu_ip_version(adev, GC_HWIP, 0) == IP_VERSION(9, 5, 0)) ++ adev->external_rev_id = adev->rev_id + 0x50; + break; + default: + /* FIXME: not supported yet */ diff --git a/queue-6.12/drm-amdgpu-update-mmhub-3.0.1-client-id-mappings.patch b/queue-6.12/drm-amdgpu-update-mmhub-3.0.1-client-id-mappings.patch new file mode 100644 index 0000000000..2ea801b325 --- /dev/null +++ b/queue-6.12/drm-amdgpu-update-mmhub-3.0.1-client-id-mappings.patch @@ -0,0 +1,96 @@ +From 0bae62cc989fa99ac9cb564eb573aad916d1eb61 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Fri, 18 Jul 2025 15:52:04 -0400 +Subject: drm/amdgpu: update mmhub 3.0.1 client id mappings + +From: Alex Deucher + +commit 0bae62cc989fa99ac9cb564eb573aad916d1eb61 upstream. + +Update the client id mapping so the correct clients +get printed when there is a mmhub page fault. + +Reviewed-by: David (Ming Qiang) Wu +Signed-off-by: Alex Deucher +(cherry picked from commit 2a2681eda73b99a2c1ee8cdb006099ea5d0c2505) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c | 57 ++++++++++++++++-------------- + 1 file changed, 32 insertions(+), 25 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c ++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c +@@ -36,40 +36,47 @@ + + static const char *mmhub_client_ids_v3_0_1[][2] = { + [0][0] = "VMC", ++ [1][0] = "ISPXT", ++ [2][0] = "ISPIXT", + [4][0] = "DCEDMC", + [5][0] = "DCEVGA", + [6][0] = "MP0", + [7][0] = "MP1", +- [8][0] = "MPIO", +- [16][0] = "HDP", +- [17][0] = "LSDMA", +- [18][0] = "JPEG", +- [19][0] = "VCNU0", +- [21][0] = "VSCH", +- [22][0] = "VCNU1", +- [23][0] = "VCN1", +- [32+20][0] = "VCN0", +- [2][1] = "DBGUNBIO", ++ [8][0] = "MPM", ++ [12][0] = "ISPTNR", ++ [14][0] = "ISPCRD0", ++ [15][0] = "ISPCRD1", ++ [16][0] = "ISPCRD2", ++ [22][0] = "HDP", ++ [23][0] = "LSDMA", ++ [24][0] = "JPEG", ++ [27][0] = "VSCH", ++ [28][0] = "VCNU", ++ [29][0] = "VCN", ++ [1][1] = "ISPXT", ++ [2][1] = "ISPIXT", + [3][1] = "DCEDWB", + [4][1] = "DCEDMC", + [5][1] = "DCEVGA", + [6][1] = "MP0", + [7][1] = "MP1", +- [8][1] = "MPIO", +- [10][1] = "DBGU0", +- [11][1] = "DBGU1", +- [12][1] = "DBGU2", +- [13][1] = "DBGU3", +- [14][1] = "XDP", +- [15][1] = "OSSSYS", +- [16][1] = "HDP", +- [17][1] = "LSDMA", +- [18][1] = "JPEG", +- [19][1] = "VCNU0", +- [20][1] = "VCN0", +- [21][1] = "VSCH", +- [22][1] = "VCNU1", +- [23][1] = "VCN1", ++ [8][1] = "MPM", ++ [10][1] = "ISPMWR0", ++ [11][1] = "ISPMWR1", ++ [12][1] = "ISPTNR", ++ [13][1] = "ISPSWR", ++ [14][1] = "ISPCWR0", ++ [15][1] = "ISPCWR1", ++ [16][1] = "ISPCWR2", ++ [17][1] = "ISPCWR3", ++ [18][1] = "XDP", ++ [21][1] = "OSSSYS", ++ [22][1] = "HDP", ++ [23][1] = "LSDMA", ++ [24][1] = "JPEG", ++ [27][1] = "VSCH", ++ [28][1] = "VCNU", ++ [29][1] = "VCN", + }; + + static uint32_t mmhub_v3_0_1_get_invalidate_req(unsigned int vmid, diff --git a/queue-6.12/drm-amdgpu-update-mmhub-4.1.0-client-id-mappings.patch b/queue-6.12/drm-amdgpu-update-mmhub-4.1.0-client-id-mappings.patch new file mode 100644 index 0000000000..ec129d8fed --- /dev/null +++ b/queue-6.12/drm-amdgpu-update-mmhub-4.1.0-client-id-mappings.patch @@ -0,0 +1,76 @@ +From a0b34e4c8663b13e45c78267b4de3004b1a72490 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Fri, 18 Jul 2025 15:53:54 -0400 +Subject: drm/amdgpu: update mmhub 4.1.0 client id mappings + +From: Alex Deucher + +commit a0b34e4c8663b13e45c78267b4de3004b1a72490 upstream. + +Update the client id mapping so the correct clients +get printed when there is a mmhub page fault. + +Tested-by: David (Ming Qiang) Wu +Reviewed-by: David (Ming Qiang) Wu +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/mmhub_v4_1_0.c | 34 +++++++++++------------------- + 1 file changed, 13 insertions(+), 21 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v4_1_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v4_1_0.c +@@ -37,39 +37,31 @@ + static const char *mmhub_client_ids_v4_1_0[][2] = { + [0][0] = "VMC", + [4][0] = "DCEDMC", +- [5][0] = "DCEVGA", + [6][0] = "MP0", + [7][0] = "MP1", + [8][0] = "MPIO", +- [16][0] = "HDP", +- [17][0] = "LSDMA", +- [18][0] = "JPEG", +- [19][0] = "VCNU0", +- [21][0] = "VSCH", +- [22][0] = "VCNU1", +- [23][0] = "VCN1", +- [32+20][0] = "VCN0", +- [2][1] = "DBGUNBIO", ++ [16][0] = "LSDMA", ++ [17][0] = "JPEG", ++ [19][0] = "VCNU", ++ [22][0] = "VSCH", ++ [23][0] = "HDP", ++ [32+23][0] = "VCNRD", + [3][1] = "DCEDWB", + [4][1] = "DCEDMC", +- [5][1] = "DCEVGA", + [6][1] = "MP0", + [7][1] = "MP1", + [8][1] = "MPIO", + [10][1] = "DBGU0", + [11][1] = "DBGU1", +- [12][1] = "DBGU2", +- [13][1] = "DBGU3", ++ [12][1] = "DBGUNBIO", + [14][1] = "XDP", + [15][1] = "OSSSYS", +- [16][1] = "HDP", +- [17][1] = "LSDMA", +- [18][1] = "JPEG", +- [19][1] = "VCNU0", +- [20][1] = "VCN0", +- [21][1] = "VSCH", +- [22][1] = "VCNU1", +- [23][1] = "VCN1", ++ [16][1] = "LSDMA", ++ [17][1] = "JPEG", ++ [18][1] = "VCNWR", ++ [19][1] = "VCNU", ++ [22][1] = "VSCH", ++ [23][1] = "HDP", + }; + + static uint32_t mmhub_v4_1_0_get_invalidate_req(unsigned int vmid, diff --git a/queue-6.12/drm-amdkfd-destroy-kfd-debugfs-after-destroy-kfd-wq.patch b/queue-6.12/drm-amdkfd-destroy-kfd-debugfs-after-destroy-kfd-wq.patch new file mode 100644 index 0000000000..7731e393e5 --- /dev/null +++ b/queue-6.12/drm-amdkfd-destroy-kfd-debugfs-after-destroy-kfd-wq.patch @@ -0,0 +1,41 @@ +From 2e58401a24e7b2d4ec619104e1a76590c1284a4c Mon Sep 17 00:00:00 2001 +From: Amber Lin +Date: Thu, 31 Jul 2025 20:45:00 -0400 +Subject: drm/amdkfd: Destroy KFD debugfs after destroy KFD wq + +From: Amber Lin + +commit 2e58401a24e7b2d4ec619104e1a76590c1284a4c upstream. + +Since KFD proc content was moved to kernel debugfs, we can't destroy KFD +debugfs before kfd_process_destroy_wq. Move kfd_process_destroy_wq prior +to kfd_debugfs_fini to fix a kernel NULL pointer problem. It happens +when /sys/kernel/debug/kfd was already destroyed in kfd_debugfs_fini but +kfd_process_destroy_wq calls kfd_debugfs_remove_process. This line + debugfs_remove_recursive(entry->proc_dentry); +tries to remove /sys/kernel/debug/kfd/proc/ while +/sys/kernel/debug/kfd is already gone. It hangs the kernel by kernel +NULL pointer. + +Signed-off-by: Amber Lin +Reviewed-by: Eric Huang +Signed-off-by: Alex Deucher +(cherry picked from commit 0333052d90683d88531558dcfdbf2525cc37c233) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/kfd_module.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_module.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_module.c +@@ -78,8 +78,8 @@ err_ioctl: + static void kfd_exit(void) + { + kfd_cleanup_processes(); +- kfd_debugfs_fini(); + kfd_process_destroy_wq(); ++ kfd_debugfs_fini(); + kfd_procfs_shutdown(); + kfd_topology_shutdown(); + kfd_chardev_exit(); diff --git a/queue-6.12/media-qcom-camss-cleanup-media-device-allocated-resource-on-error-path.patch b/queue-6.12/media-qcom-camss-cleanup-media-device-allocated-resource-on-error-path.patch new file mode 100644 index 0000000000..cf869a67fb --- /dev/null +++ b/queue-6.12/media-qcom-camss-cleanup-media-device-allocated-resource-on-error-path.patch @@ -0,0 +1,46 @@ +From 69080ec3d0daba8a894025476c98ab16b5a505a4 Mon Sep 17 00:00:00 2001 +From: Vladimir Zapolskiy +Date: Tue, 13 May 2025 17:23:45 +0300 +Subject: media: qcom: camss: cleanup media device allocated resource on error path + +From: Vladimir Zapolskiy + +commit 69080ec3d0daba8a894025476c98ab16b5a505a4 upstream. + +A call to media_device_init() requires media_device_cleanup() counterpart +to complete cleanup and release any allocated resources. + +This has been done in the driver .remove() right from the beginning, but +error paths on .probe() shall also be fixed. + +Fixes: a1d7c116fcf7 ("media: camms: Add core files") +Cc: stable@vger.kernel.org +Signed-off-by: Vladimir Zapolskiy +Reviewed-by: Bryan O'Donoghue +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/camss/camss.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/media/platform/qcom/camss/camss.c ++++ b/drivers/media/platform/qcom/camss/camss.c +@@ -2275,7 +2275,7 @@ static int camss_probe(struct platform_d + ret = v4l2_device_register(camss->dev, &camss->v4l2_dev); + if (ret < 0) { + dev_err(dev, "Failed to register V4L2 device: %d\n", ret); +- goto err_genpd_cleanup; ++ goto err_media_device_cleanup; + } + + v4l2_async_nf_init(&camss->notifier, &camss->v4l2_dev); +@@ -2330,6 +2330,8 @@ err_v4l2_device_unregister: + v4l2_device_unregister(&camss->v4l2_dev); + v4l2_async_nf_cleanup(&camss->notifier); + pm_runtime_disable(dev); ++err_media_device_cleanup: ++ media_device_cleanup(&camss->media_dev); + err_genpd_cleanup: + camss_genpd_cleanup(camss); + diff --git a/queue-6.12/media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch b/queue-6.12/media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch new file mode 100644 index 0000000000..d2f10a5dcf --- /dev/null +++ b/queue-6.12/media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch @@ -0,0 +1,47 @@ +From 49befc830daa743e051a65468c05c2ff9e8580e6 Mon Sep 17 00:00:00 2001 +From: Vedang Nagar +Date: Mon, 19 May 2025 12:42:21 +0530 +Subject: media: venus: Add a check for packet size after reading from shared memory + +From: Vedang Nagar + +commit 49befc830daa743e051a65468c05c2ff9e8580e6 upstream. + +Add a check to ensure that the packet size does not exceed the number of +available words after reading the packet header from shared memory. This +ensures that the size provided by the firmware is safe to process and +prevent potential out-of-bounds memory access. + +Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files") +Cc: stable@vger.kernel.org +Signed-off-by: Vedang Nagar +Co-developed-by: Dikshita Agarwal +Signed-off-by: Dikshita Agarwal +Reviewed-by: Bryan O'Donoghue +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/venus/hfi_venus.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/media/platform/qcom/venus/hfi_venus.c ++++ b/drivers/media/platform/qcom/venus/hfi_venus.c +@@ -239,6 +239,7 @@ static int venus_write_queue(struct venu + static int venus_read_queue(struct venus_hfi_device *hdev, + struct iface_queue *queue, void *pkt, u32 *tx_req) + { ++ struct hfi_pkt_hdr *pkt_hdr = NULL; + struct hfi_queue_header *qhdr; + u32 dwords, new_rd_idx; + u32 rd_idx, wr_idx, type, qsize; +@@ -304,6 +305,9 @@ static int venus_read_queue(struct venus + memcpy(pkt, rd_ptr, len); + memcpy(pkt + len, queue->qmem.kva, new_rd_idx << 2); + } ++ pkt_hdr = (struct hfi_pkt_hdr *)(pkt); ++ if ((pkt_hdr->size >> 2) != dwords) ++ return -EINVAL; + } else { + /* bad packet received, dropping */ + new_rd_idx = qhdr->write_idx; diff --git a/queue-6.12/media-venus-fix-msm8998-frequency-table.patch b/queue-6.12/media-venus-fix-msm8998-frequency-table.patch new file mode 100644 index 0000000000..522f033db1 --- /dev/null +++ b/queue-6.12/media-venus-fix-msm8998-frequency-table.patch @@ -0,0 +1,43 @@ +From ee3b94f22638e0f7a1893d95d87b08698b680052 Mon Sep 17 00:00:00 2001 +From: Konrad Dybcio +Date: Sat, 31 May 2025 14:22:00 +0200 +Subject: media: venus: Fix MSM8998 frequency table + +From: Konrad Dybcio + +commit ee3b94f22638e0f7a1893d95d87b08698b680052 upstream. + +Fill in the correct data for the production SKU. + +Fixes: 193b3dac29a4 ("media: venus: add msm8998 support") +Cc: stable@vger.kernel.org +Signed-off-by: Konrad Dybcio +Reviewed-by: Vikash Garodia +Reviewed-by: Bryan O'Donoghue +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/venus/core.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/media/platform/qcom/venus/core.c ++++ b/drivers/media/platform/qcom/venus/core.c +@@ -593,11 +593,11 @@ static const struct venus_resources msm8 + }; + + static const struct freq_tbl msm8998_freq_table[] = { +- { 1944000, 465000000 }, /* 4k UHD @ 60 (decode only) */ +- { 972000, 465000000 }, /* 4k UHD @ 30 */ +- { 489600, 360000000 }, /* 1080p @ 60 */ +- { 244800, 186000000 }, /* 1080p @ 30 */ +- { 108000, 100000000 }, /* 720p @ 30 */ ++ { 1728000, 533000000 }, /* 4k UHD @ 60 (decode only) */ ++ { 1036800, 444000000 }, /* 2k @ 120 */ ++ { 829440, 355200000 }, /* 4k @ 44 */ ++ { 489600, 269330000 },/* 4k @ 30 */ ++ { 108000, 200000000 }, /* 1080p @ 60 */ + }; + + static const struct reg_val msm8998_reg_preset[] = { diff --git a/queue-6.12/media-venus-hfi-explicitly-release-irq-during-teardown.patch b/queue-6.12/media-venus-hfi-explicitly-release-irq-during-teardown.patch new file mode 100644 index 0000000000..87591dad60 --- /dev/null +++ b/queue-6.12/media-venus-hfi-explicitly-release-irq-during-teardown.patch @@ -0,0 +1,38 @@ +From 640803003cd903cea73dc6a86bf6963e238e2b3f Mon Sep 17 00:00:00 2001 +From: Jorge Ramirez-Ortiz +Date: Thu, 19 Jun 2025 09:48:30 +0200 +Subject: media: venus: hfi: explicitly release IRQ during teardown + +From: Jorge Ramirez-Ortiz + +commit 640803003cd903cea73dc6a86bf6963e238e2b3f upstream. + +Ensure the IRQ is disabled - and all pending handlers completed - before +dismantling the interrupt routing and clearing related pointers. + +This prevents any possibility of the interrupt triggering after the +handler context has been invalidated. + +Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files") +Cc: stable@vger.kernel.org +Signed-off-by: Jorge Ramirez-Ortiz +Reviewed-by: Dikshita Agarwal +Tested-by: Dikshita Agarwal # RB5 +Reviewed-by: Bryan O'Donoghue +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/venus/hfi_venus.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/platform/qcom/venus/hfi_venus.c ++++ b/drivers/media/platform/qcom/venus/hfi_venus.c +@@ -1693,6 +1693,7 @@ void venus_hfi_destroy(struct venus_core + venus_interface_queues_release(hdev); + mutex_destroy(&hdev->lock); + kfree(hdev); ++ disable_irq(core->irq); + core->ops = NULL; + } + diff --git a/queue-6.12/media-venus-protect-against-spurious-interrupts-during-probe.patch b/queue-6.12/media-venus-protect-against-spurious-interrupts-during-probe.patch new file mode 100644 index 0000000000..8d83c3ee68 --- /dev/null +++ b/queue-6.12/media-venus-protect-against-spurious-interrupts-during-probe.patch @@ -0,0 +1,52 @@ +From 3200144a2fa4209dc084a19941b9b203b43580f0 Mon Sep 17 00:00:00 2001 +From: Jorge Ramirez-Ortiz +Date: Fri, 6 Jun 2025 17:25:22 +0200 +Subject: media: venus: protect against spurious interrupts during probe + +From: Jorge Ramirez-Ortiz + +commit 3200144a2fa4209dc084a19941b9b203b43580f0 upstream. + +Make sure the interrupt handler is initialized before the interrupt is +registered. + +If the IRQ is registered before hfi_create(), it's possible that an +interrupt fires before the handler setup is complete, leading to a NULL +dereference. + +This error condition has been observed during system boot on Rb3Gen2. + +Fixes: af2c3834c8ca ("[media] media: venus: adding core part and helper functions") +Cc: stable@vger.kernel.org +Signed-off-by: Jorge Ramirez-Ortiz +Reviewed-by: Bryan O'Donoghue +Reviewed-by: Vikash Garodia +Reviewed-by: Dikshita Agarwal +Tested-by: Dikshita Agarwal # RB5 +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/venus/core.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/media/platform/qcom/venus/core.c ++++ b/drivers/media/platform/qcom/venus/core.c +@@ -340,13 +340,13 @@ static int venus_probe(struct platform_d + INIT_DELAYED_WORK(&core->work, venus_sys_error_handler); + init_waitqueue_head(&core->sys_err_done); + +- ret = devm_request_threaded_irq(dev, core->irq, hfi_isr, venus_isr_thread, +- IRQF_TRIGGER_HIGH | IRQF_ONESHOT, +- "venus", core); ++ ret = hfi_create(core, &venus_core_ops); + if (ret) + goto err_core_put; + +- ret = hfi_create(core, &venus_core_ops); ++ ret = devm_request_threaded_irq(dev, core->irq, hfi_isr, venus_isr_thread, ++ IRQF_TRIGGER_HIGH | IRQF_ONESHOT, ++ "venus", core); + if (ret) + goto err_core_put; + diff --git a/queue-6.12/media-venus-vdec-clamp-param-smaller-than-1fps-and-bigger-than-240.patch b/queue-6.12/media-venus-vdec-clamp-param-smaller-than-1fps-and-bigger-than-240.patch new file mode 100644 index 0000000000..4199b5f0e2 --- /dev/null +++ b/queue-6.12/media-venus-vdec-clamp-param-smaller-than-1fps-and-bigger-than-240.patch @@ -0,0 +1,59 @@ +From 377dc500d253f0b26732b2cb062e89668aef890a Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Mon, 16 Jun 2025 15:29:14 +0000 +Subject: media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. + +From: Ricardo Ribalda + +commit 377dc500d253f0b26732b2cb062e89668aef890a upstream. + +The driver uses "whole" fps in all its calculations (e.g. in +load_per_instance()). Those calculation expect an fps bigger than 1, and +not big enough to overflow. + +Clamp the value if the user provides a param that will result in an invalid +fps. + +Reported-by: Hans Verkuil +Closes: https://lore.kernel.org/linux-media/f11653a7-bc49-48cd-9cdb-1659147453e4@xs4all.nl/T/#m91cd962ac942834654f94c92206e2f85ff7d97f0 +Fixes: 7472c1c69138 ("[media] media: venus: vdec: add video decoder files") +Cc: stable@vger.kernel.org +Tested-by: Bryan O'Donoghue # qrb5615-rb5 +Reviewed-by: Bryan O'Donoghue +Signed-off-by: Ricardo Ribalda +[bod: Change "parm" to "param"] +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/venus/core.h | 2 ++ + drivers/media/platform/qcom/venus/vdec.c | 5 ++--- + 2 files changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/media/platform/qcom/venus/core.h ++++ b/drivers/media/platform/qcom/venus/core.h +@@ -27,6 +27,8 @@ + #define VIDC_VCODEC_CLKS_NUM_MAX 2 + #define VIDC_RESETS_NUM_MAX 2 + ++#define VENUS_MAX_FPS 240 ++ + extern int venus_fw_debug; + + struct freq_tbl { +--- a/drivers/media/platform/qcom/venus/vdec.c ++++ b/drivers/media/platform/qcom/venus/vdec.c +@@ -481,11 +481,10 @@ static int vdec_s_parm(struct file *file + us_per_frame = timeperframe->numerator * (u64)USEC_PER_SEC; + do_div(us_per_frame, timeperframe->denominator); + +- if (!us_per_frame) +- return -EINVAL; +- ++ us_per_frame = clamp(us_per_frame, 1, USEC_PER_SEC); + fps = (u64)USEC_PER_SEC; + do_div(fps, us_per_frame); ++ fps = min(VENUS_MAX_FPS, fps); + + inst->fps = fps; + inst->timeperframe = *timeperframe; diff --git a/queue-6.12/media-venus-venc-clamp-param-smaller-than-1fps-and-bigger-than-240.patch b/queue-6.12/media-venus-venc-clamp-param-smaller-than-1fps-and-bigger-than-240.patch new file mode 100644 index 0000000000..8518a5d587 --- /dev/null +++ b/queue-6.12/media-venus-venc-clamp-param-smaller-than-1fps-and-bigger-than-240.patch @@ -0,0 +1,45 @@ +From 417c01b92ec278a1118a05c6ad8a796eaa0c9c52 Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Mon, 16 Jun 2025 15:29:15 +0000 +Subject: media: venus: venc: Clamp param smaller than 1fps and bigger than 240 + +From: Ricardo Ribalda + +commit 417c01b92ec278a1118a05c6ad8a796eaa0c9c52 upstream. + +The driver uses "whole" fps in all its calculations (e.g. in +load_per_instance()). Those calculation expect an fps bigger than 1, and +not big enough to overflow. + +Clamp the param if the user provides a value that will result in an invalid +fps. + +Reported-by: Hans Verkuil +Closes: https://lore.kernel.org/linux-media/f11653a7-bc49-48cd-9cdb-1659147453e4@xs4all.nl/T/#m91cd962ac942834654f94c92206e2f85ff7d97f0 +Fixes: aaaa93eda64b ("[media] media: venus: venc: add video encoder files") +Cc: stable@vger.kernel.org +Signed-off-by: Ricardo Ribalda +[bod: Change "parm" to "param"] +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/venus/venc.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/media/platform/qcom/venus/venc.c ++++ b/drivers/media/platform/qcom/venus/venc.c +@@ -411,11 +411,10 @@ static int venc_s_parm(struct file *file + us_per_frame = timeperframe->numerator * (u64)USEC_PER_SEC; + do_div(us_per_frame, timeperframe->denominator); + +- if (!us_per_frame) +- return -EINVAL; +- ++ us_per_frame = clamp(us_per_frame, 1, USEC_PER_SEC); + fps = (u64)USEC_PER_SEC; + do_div(fps, us_per_frame); ++ fps = min(VENUS_MAX_FPS, fps); + + inst->timeperframe = *timeperframe; + inst->fps = fps; diff --git a/queue-6.12/series b/queue-6.12/series index 33412cf4b0..26da927456 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -108,3 +108,22 @@ media-pisp_be-fix-pm_runtime-underrun-in-probe.patch media-ov2659-fix-memory-leaks-in-ov2659_probe.patch media-mt9m114-fix-deadlock-in-get_frame_interval-set_frame_interval.patch media-ivsc-fix-crash-at-shutdown-due-to-missing-mei_cldev_disable-calls.patch +media-qcom-camss-cleanup-media-device-allocated-resource-on-error-path.patch +media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch +media-venus-fix-msm8998-frequency-table.patch +media-venus-hfi-explicitly-release-irq-during-teardown.patch +media-venus-protect-against-spurious-interrupts-during-probe.patch +media-venus-vdec-clamp-param-smaller-than-1fps-and-bigger-than-240.patch +media-venus-venc-clamp-param-smaller-than-1fps-and-bigger-than-240.patch +drm-amdgpu-discovery-fix-fw-based-ip-discovery.patch +drm-amd-restore-cached-power-limit-during-resume.patch +drm-amdgpu-avoid-extra-evict-restore-process.patch +drm-amdgpu-check-if-hubbub-is-null-in-debugfs-amdgpu_dm_capabilities.patch +drm-amdgpu-initialize-data-to-null-in-imu_v12_0_program_rlc_ram.patch +drm-amdgpu-update-external-revid-for-gc-v9.5.0.patch +drm-amdgpu-update-mmhub-3.0.1-client-id-mappings.patch +drm-amdgpu-update-mmhub-4.1.0-client-id-mappings.patch +drm-amdkfd-destroy-kfd-debugfs-after-destroy-kfd-wq.patch +drm-amd-display-add-primary-plane-to-commits-for-correct-vrr-handling.patch +drm-amd-display-fix-a-null-pointer-dereference-vulnerability.patch +drm-amd-display-don-t-overwrite-dce60_clk_mgr.patch