From: Sasha Levin Date: Thu, 11 Apr 2024 08:03:23 +0000 (-0400) Subject: Fixes for 6.8 X-Git-Tag: v4.19.312~33 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9caf86f6e448522f2b10b39ea9c5e9dc94a73286;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.8 Signed-off-by: Sasha Levin --- diff --git a/queue-6.8/media-mediatek-vcodec-adding-lock-to-protect-decoder.patch b/queue-6.8/media-mediatek-vcodec-adding-lock-to-protect-decoder.patch new file mode 100644 index 00000000000..33b6bc6ae2d --- /dev/null +++ b/queue-6.8/media-mediatek-vcodec-adding-lock-to-protect-decoder.patch @@ -0,0 +1,158 @@ +From 2fefaf8aeb2e5f0bd564195a2559298f589a4730 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 20:30:08 +0800 +Subject: media: mediatek: vcodec: adding lock to protect decoder context list + +From: Yunfei Dong + +[ Upstream commit 6467cda18c9f9b5f2f9a0aa1e2861c653e41f382 ] + +Add a lock for the ctx_list, to avoid accessing a NULL pointer +within the 'vpu_dec_ipi_handler' function when the ctx_list has +been deleted due to an unexpected behavior on the SCP IP block. + +Hardware name: Google juniper sku16 board (DT) +pstate: 20400005 (nzCv daif +PAN -UAO -TCO BTYPE=--) +pc : vpu_dec_ipi_handler+0x58/0x1f8 [mtk_vcodec_dec] +lr : scp_ipi_handler+0xd0/0x194 [mtk_scp] +sp : ffffffc0131dbbd0 +x29: ffffffc0131dbbd0 x28: 0000000000000000 +x27: ffffff9bb277f348 x26: ffffff9bb242ad00 +x25: ffffffd2d440d3b8 x24: ffffffd2a13ff1d4 +x23: ffffff9bb7fe85a0 x22: ffffffc0133fbdb0 +x21: 0000000000000010 x20: ffffff9b050ea328 +x19: ffffffc0131dbc08 x18: 0000000000001000 +x17: 0000000000000000 x16: ffffffd2d461c6e0 +x15: 0000000000000242 x14: 000000000000018f +x13: 000000000000004d x12: 0000000000000000 +x11: 0000000000000001 x10: fffffffffffffff0 +x9 : ffffff9bb6e793a8 x8 : 0000000000000000 +x7 : 0000000000000000 x6 : 000000000000003f +x5 : 0000000000000040 x4 : fffffffffffffff0 +x3 : 0000000000000020 x2 : ffffff9bb6e79080 +x1 : 0000000000000010 x0 : ffffffc0131dbc08 +Call trace: +vpu_dec_ipi_handler+0x58/0x1f8 [mtk_vcodec_dec (HASH:6c3f 2)] +scp_ipi_handler+0xd0/0x194 [mtk_scp (HASH:7046 3)] +mt8183_scp_irq_handler+0x44/0x88 [mtk_scp (HASH:7046 3)] +scp_irq_handler+0x48/0x90 [mtk_scp (HASH:7046 3)] +irq_thread_fn+0x38/0x94 +irq_thread+0x100/0x1c0 +kthread+0x140/0x1fc +ret_from_fork+0x10/0x30 +Code: 54000088 f94ca50a eb14015f 54000060 (f9400108) +---[ end trace ace43ce36cbd5c93 ]--- +Kernel panic - not syncing: Oops: Fatal exception +SMP: stopping secondary CPUs +Kernel Offset: 0x12c4000000 from 0xffffffc010000000 +PHYS_OFFSET: 0xffffffe580000000 +CPU features: 0x08240002,2188200c +Memory Limit: none + +Fixes: 655b86e52eac ("media: mediatek: vcodec: Fix possible invalid memory access for decoder") +Signed-off-by: Yunfei Dong +Reviewed-by: Nicolas Dufresne +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Sebastian Fricke +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + .../platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c | 4 ++-- + .../platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c | 5 +++++ + .../platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h | 2 ++ + drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c | 2 ++ + 4 files changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c +index 4c34344dc7dcb..62cafe25fed94 100644 +--- a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c ++++ b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c +@@ -50,12 +50,12 @@ static void mtk_vcodec_vpu_reset_dec_handler(void *priv) + + dev_err(&dev->plat_dev->dev, "Watchdog timeout!!"); + +- mutex_lock(&dev->dev_mutex); ++ mutex_lock(&dev->dev_ctx_lock); + list_for_each_entry(ctx, &dev->ctx_list, list) { + ctx->state = MTK_STATE_ABORT; + mtk_v4l2_vdec_dbg(0, ctx, "[%d] Change to state MTK_STATE_ABORT", ctx->id); + } +- mutex_unlock(&dev->dev_mutex); ++ mutex_unlock(&dev->dev_ctx_lock); + } + + static void mtk_vcodec_vpu_reset_enc_handler(void *priv) +diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c +index f47c98faf068b..2073781ccadb1 100644 +--- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c ++++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c +@@ -268,7 +268,9 @@ static int fops_vcodec_open(struct file *file) + + ctx->dev->vdec_pdata->init_vdec_params(ctx); + ++ mutex_lock(&dev->dev_ctx_lock); + list_add(&ctx->list, &dev->ctx_list); ++ mutex_unlock(&dev->dev_ctx_lock); + mtk_vcodec_dbgfs_create(ctx); + + mutex_unlock(&dev->dev_mutex); +@@ -311,7 +313,9 @@ static int fops_vcodec_release(struct file *file) + v4l2_ctrl_handler_free(&ctx->ctrl_hdl); + + mtk_vcodec_dbgfs_remove(dev, ctx->id); ++ mutex_lock(&dev->dev_ctx_lock); + list_del_init(&ctx->list); ++ mutex_unlock(&dev->dev_ctx_lock); + kfree(ctx); + mutex_unlock(&dev->dev_mutex); + return 0; +@@ -404,6 +408,7 @@ static int mtk_vcodec_probe(struct platform_device *pdev) + for (i = 0; i < MTK_VDEC_HW_MAX; i++) + mutex_init(&dev->dec_mutex[i]); + mutex_init(&dev->dev_mutex); ++ mutex_init(&dev->dev_ctx_lock); + spin_lock_init(&dev->irqlock); + + snprintf(dev->v4l2_dev.name, sizeof(dev->v4l2_dev.name), "%s", +diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h +index 849b89dd205c2..85b2c0d3d8bcd 100644 +--- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h ++++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h +@@ -241,6 +241,7 @@ struct mtk_vcodec_dec_ctx { + * + * @dec_mutex: decoder hardware lock + * @dev_mutex: video_device lock ++ * @dev_ctx_lock: the lock of context list + * @decode_workqueue: decode work queue + * + * @irqlock: protect data access by irq handler and work thread +@@ -282,6 +283,7 @@ struct mtk_vcodec_dec_dev { + /* decoder hardware mutex lock */ + struct mutex dec_mutex[MTK_VDEC_HW_MAX]; + struct mutex dev_mutex; ++ struct mutex dev_ctx_lock; + struct workqueue_struct *decode_workqueue; + + spinlock_t irqlock; +diff --git a/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c b/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c +index 82e57ae983d55..da6be556727bb 100644 +--- a/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c ++++ b/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c +@@ -77,12 +77,14 @@ static bool vpu_dec_check_ap_inst(struct mtk_vcodec_dec_dev *dec_dev, struct vde + struct mtk_vcodec_dec_ctx *ctx; + int ret = false; + ++ mutex_lock(&dec_dev->dev_ctx_lock); + list_for_each_entry(ctx, &dec_dev->ctx_list, list) { + if (!IS_ERR_OR_NULL(ctx) && ctx->vpu_inst == vpu) { + ret = true; + break; + } + } ++ mutex_unlock(&dec_dev->dev_ctx_lock); + + return ret; + } +-- +2.43.0 + diff --git a/queue-6.8/media-mediatek-vcodec-adding-lock-to-protect-encoder.patch b/queue-6.8/media-mediatek-vcodec-adding-lock-to-protect-encoder.patch new file mode 100644 index 00000000000..728a3a3180c --- /dev/null +++ b/queue-6.8/media-mediatek-vcodec-adding-lock-to-protect-encoder.patch @@ -0,0 +1,120 @@ +From d127d19b73d6164afd4a623b0bfd206794df273f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 20:30:09 +0800 +Subject: media: mediatek: vcodec: adding lock to protect encoder context list + +From: Yunfei Dong + +[ Upstream commit afaaf3a0f647a24a7bf6a2145d8ade37baaf75ad ] + +Add a lock for the ctx_list, to avoid accessing a NULL pointer +within the 'vpu_enc_ipi_handler' function when the ctx_list has +been deleted due to an unexpected behavior on the SCP IP block. + +Fixes: 1972e32431ed ("media: mediatek: vcodec: Fix possible invalid memory access for encoder") +Signed-off-by: Yunfei Dong +Reviewed-by: Nicolas Dufresne +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Sebastian Fricke +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + .../platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c | 4 ++-- + .../platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c | 5 +++++ + .../platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h | 2 ++ + drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c | 2 ++ + 4 files changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c +index 62cafe25fed94..d7027d600208f 100644 +--- a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c ++++ b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c +@@ -65,12 +65,12 @@ static void mtk_vcodec_vpu_reset_enc_handler(void *priv) + + dev_err(&dev->plat_dev->dev, "Watchdog timeout!!"); + +- mutex_lock(&dev->dev_mutex); ++ mutex_lock(&dev->dev_ctx_lock); + list_for_each_entry(ctx, &dev->ctx_list, list) { + ctx->state = MTK_STATE_ABORT; + mtk_v4l2_vdec_dbg(0, ctx, "[%d] Change to state MTK_STATE_ABORT", ctx->id); + } +- mutex_unlock(&dev->dev_mutex); ++ mutex_unlock(&dev->dev_ctx_lock); + } + + static const struct mtk_vcodec_fw_ops mtk_vcodec_vpu_msg = { +diff --git a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c +index 6319f24bc714b..3cb8a16222220 100644 +--- a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c ++++ b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c +@@ -177,7 +177,9 @@ static int fops_vcodec_open(struct file *file) + mtk_v4l2_venc_dbg(2, ctx, "Create instance [%d]@%p m2m_ctx=%p ", + ctx->id, ctx, ctx->m2m_ctx); + ++ mutex_lock(&dev->dev_ctx_lock); + list_add(&ctx->list, &dev->ctx_list); ++ mutex_unlock(&dev->dev_ctx_lock); + + mutex_unlock(&dev->dev_mutex); + mtk_v4l2_venc_dbg(0, ctx, "%s encoder [%d]", dev_name(&dev->plat_dev->dev), +@@ -212,7 +214,9 @@ static int fops_vcodec_release(struct file *file) + v4l2_fh_exit(&ctx->fh); + v4l2_ctrl_handler_free(&ctx->ctrl_hdl); + ++ mutex_lock(&dev->dev_ctx_lock); + list_del_init(&ctx->list); ++ mutex_unlock(&dev->dev_ctx_lock); + kfree(ctx); + mutex_unlock(&dev->dev_mutex); + return 0; +@@ -294,6 +298,7 @@ static int mtk_vcodec_probe(struct platform_device *pdev) + + mutex_init(&dev->enc_mutex); + mutex_init(&dev->dev_mutex); ++ mutex_init(&dev->dev_ctx_lock); + spin_lock_init(&dev->irqlock); + + snprintf(dev->v4l2_dev.name, sizeof(dev->v4l2_dev.name), "%s", +diff --git a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h +index a042f607ed8d1..0bd85d0fb379a 100644 +--- a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h ++++ b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h +@@ -178,6 +178,7 @@ struct mtk_vcodec_enc_ctx { + * + * @enc_mutex: encoder hardware lock. + * @dev_mutex: video_device lock ++ * @dev_ctx_lock: the lock of context list + * @encode_workqueue: encode work queue + * + * @enc_irq: h264 encoder irq resource +@@ -205,6 +206,7 @@ struct mtk_vcodec_enc_dev { + /* encoder hardware mutex lock */ + struct mutex enc_mutex; + struct mutex dev_mutex; ++ struct mutex dev_ctx_lock; + struct workqueue_struct *encode_workqueue; + + int enc_irq; +diff --git a/drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c b/drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c +index 84ad1cc6ad171..51bb7ee141b9e 100644 +--- a/drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c ++++ b/drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c +@@ -47,12 +47,14 @@ static bool vpu_enc_check_ap_inst(struct mtk_vcodec_enc_dev *enc_dev, struct ven + struct mtk_vcodec_enc_ctx *ctx; + int ret = false; + ++ mutex_lock(&enc_dev->dev_ctx_lock); + list_for_each_entry(ctx, &enc_dev->ctx_list, list) { + if (!IS_ERR_OR_NULL(ctx) && ctx->vpu_inst == vpu) { + ret = true; + break; + } + } ++ mutex_unlock(&enc_dev->dev_ctx_lock); + + return ret; + } +-- +2.43.0 + diff --git a/queue-6.8/media-mediatek-vcodec-fix-oops-when-hevc-init-fails.patch b/queue-6.8/media-mediatek-vcodec-fix-oops-when-hevc-init-fails.patch new file mode 100644 index 00000000000..8d511aa53ab --- /dev/null +++ b/queue-6.8/media-mediatek-vcodec-fix-oops-when-hevc-init-fails.patch @@ -0,0 +1,84 @@ +From 2e680d62bd7f997857d5b2d86767d1b35f7605d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Feb 2024 16:19:52 -0500 +Subject: media: mediatek: vcodec: Fix oops when HEVC init fails + +From: Nicolas Dufresne + +[ Upstream commit 97c75ee5de060d271d80109b0c47cb6008439e5b ] + +The stateless HEVC decoder saves the instance pointer in the context +regardless if the initialization worked or not. This caused a use after +free, when the pointer is freed in case of a failure in the deinit +function. +Only store the instance pointer when the initialization was successful, +to solve this issue. + + Hardware name: Acer Tomato (rev3 - 4) board (DT) + pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : vcodec_vpu_send_msg+0x4c/0x190 [mtk_vcodec_dec] + lr : vcodec_send_ap_ipi+0x78/0x170 [mtk_vcodec_dec] + sp : ffff80008750bc20 + x29: ffff80008750bc20 x28: ffff1299f6d70000 x27: 0000000000000000 + x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 + x23: ffff80008750bc98 x22: 000000000000a003 x21: ffffd45c4cfae000 + x20: 0000000000000010 x19: ffff1299fd668310 x18: 000000000000001a + x17: 000000040044ffff x16: ffffd45cb15dc648 x15: 0000000000000000 + x14: ffff1299c08da1c0 x13: ffffd45cb1f87a10 x12: ffffd45cb2f5fe80 + x11: 0000000000000001 x10: 0000000000001b30 x9 : ffffd45c4d12b488 + x8 : 1fffe25339380d81 x7 : 0000000000000001 x6 : ffff1299c9c06c00 + x5 : 0000000000000132 x4 : 0000000000000000 x3 : 0000000000000000 + x2 : 0000000000000010 x1 : ffff80008750bc98 x0 : 0000000000000000 + Call trace: + vcodec_vpu_send_msg+0x4c/0x190 [mtk_vcodec_dec] + vcodec_send_ap_ipi+0x78/0x170 [mtk_vcodec_dec] + vpu_dec_deinit+0x1c/0x30 [mtk_vcodec_dec] + vdec_hevc_slice_deinit+0x30/0x98 [mtk_vcodec_dec] + vdec_if_deinit+0x38/0x68 [mtk_vcodec_dec] + mtk_vcodec_dec_release+0x20/0x40 [mtk_vcodec_dec] + fops_vcodec_release+0x64/0x118 [mtk_vcodec_dec] + v4l2_release+0x7c/0x100 + __fput+0x80/0x2d8 + __fput_sync+0x58/0x70 + __arm64_sys_close+0x40/0x90 + invoke_syscall+0x50/0x128 + el0_svc_common.constprop.0+0x48/0xf0 + do_el0_svc+0x24/0x38 + el0_svc+0x38/0xd8 + el0t_64_sync_handler+0xc0/0xc8 + el0t_64_sync+0x1a8/0x1b0 + Code: d503201f f9401660 b900127f b900227f (f9400400) + +Signed-off-by: Nicolas Dufresne +Fixes: 2674486aac7d ("media: mediatek: vcodec: support stateless hevc decoder") +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Sebastian Fricke +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + .../mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c +index 06ed47df693bf..21836dd6ef85a 100644 +--- a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c ++++ b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c +@@ -869,7 +869,6 @@ static int vdec_hevc_slice_init(struct mtk_vcodec_dec_ctx *ctx) + inst->vpu.codec_type = ctx->current_codec; + inst->vpu.capture_type = ctx->capture_fourcc; + +- ctx->drv_handle = inst; + err = vpu_dec_init(&inst->vpu); + if (err) { + mtk_vdec_err(ctx, "vdec_hevc init err=%d", err); +@@ -898,6 +897,7 @@ static int vdec_hevc_slice_init(struct mtk_vcodec_dec_ctx *ctx) + mtk_vdec_debug(ctx, "lat hevc instance >> %p, codec_type = 0x%x", + inst, inst->vpu.codec_type); + ++ ctx->drv_handle = inst; + return 0; + error_free_inst: + kfree(inst); +-- +2.43.0 + diff --git a/queue-6.8/nouveau-fix-devinit-paths-to-only-handle-display-on-.patch b/queue-6.8/nouveau-fix-devinit-paths-to-only-handle-display-on-.patch new file mode 100644 index 00000000000..bd9b68fb3bb --- /dev/null +++ b/queue-6.8/nouveau-fix-devinit-paths-to-only-handle-display-on-.patch @@ -0,0 +1,74 @@ +From 0f7b66430032dfc3b05586fb97ff5da6121f7047 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2024 16:42:43 +1000 +Subject: nouveau: fix devinit paths to only handle display on GSP. + +From: Dave Airlie + +[ Upstream commit 718c4fb221dbeff9072810841b949413c5ffc345 ] + +This reverts: +nouveau/gsp: don't check devinit disable on GSP. +and applies a further fix. + +It turns out the open gpu driver, checks this register, +but only for display. + +Match that behaviour and in the turing path only disable +the display block. (ampere already only does displays). + +Fixes: 5d4e8ae6e57b ("nouveau/gsp: don't check devinit disable on GSP.") +Reviewed-by: Danilo Krummrich +Signed-off-by: Dave Airlie +Link: https://patchwork.freedesktop.org/patch/msgid/20240408064243.2219527-1-airlied@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm107.c | 12 ++++++++---- + drivers/gpu/drm/nouveau/nvkm/subdev/devinit/r535.c | 1 + + 2 files changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm107.c b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm107.c +index 7bcbc4895ec22..271bfa038f5bc 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm107.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm107.c +@@ -25,6 +25,7 @@ + + #include + #include ++#include + + void + gm107_devinit_disable(struct nvkm_devinit *init) +@@ -33,10 +34,13 @@ gm107_devinit_disable(struct nvkm_devinit *init) + u32 r021c00 = nvkm_rd32(device, 0x021c00); + u32 r021c04 = nvkm_rd32(device, 0x021c04); + +- if (r021c00 & 0x00000001) +- nvkm_subdev_disable(device, NVKM_ENGINE_CE, 0); +- if (r021c00 & 0x00000004) +- nvkm_subdev_disable(device, NVKM_ENGINE_CE, 2); ++ /* gsp only wants to enable/disable display */ ++ if (!nvkm_gsp_rm(device->gsp)) { ++ if (r021c00 & 0x00000001) ++ nvkm_subdev_disable(device, NVKM_ENGINE_CE, 0); ++ if (r021c00 & 0x00000004) ++ nvkm_subdev_disable(device, NVKM_ENGINE_CE, 2); ++ } + if (r021c04 & 0x00000001) + nvkm_subdev_disable(device, NVKM_ENGINE_DISP, 0); + } +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/r535.c b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/r535.c +index 11b4c9c274a1a..666eb93b1742c 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/r535.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/r535.c +@@ -41,6 +41,7 @@ r535_devinit_new(const struct nvkm_devinit_func *hw, + + rm->dtor = r535_devinit_dtor; + rm->post = hw->post; ++ rm->disable = hw->disable; + + ret = nv50_devinit_new_(rm, device, type, inst, pdevinit); + if (ret) +-- +2.43.0 + diff --git a/queue-6.8/platform-x86-intel-hid-don-t-wake-on-5-button-releas.patch b/queue-6.8/platform-x86-intel-hid-don-t-wake-on-5-button-releas.patch new file mode 100644 index 00000000000..34abf04f36e --- /dev/null +++ b/queue-6.8/platform-x86-intel-hid-don-t-wake-on-5-button-releas.patch @@ -0,0 +1,63 @@ +From 54aae6802f6cee97a0d2f2c0b41a01022eee3ef3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Apr 2024 08:41:45 -0300 +Subject: platform/x86/intel/hid: Don't wake on 5-button releases +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: David McFarland + +[ Upstream commit 5864e479ca4344f3a5df8074524da24c960f440b ] + +If, for example, the power button is configured to suspend, holding it +and releasing it after the machine has suspended, will wake the machine. + +Also on some machines, power button release events are sent during +hibernation, even if the button wasn't used to hibernate the machine. +This causes hibernation to be aborted. + +Fixes: 0c4cae1bc00d ("PM: hibernate: Avoid missing wakeup events during hibernation") +Signed-off-by: David McFarland +Tested-by: Enrik Berkhan +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/878r1tpd6u.fsf_-_@gmail.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/hid.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/intel/hid.c b/drivers/platform/x86/intel/hid.c +index 7457ca2b27a60..9ffbdc988fe50 100644 +--- a/drivers/platform/x86/intel/hid.c ++++ b/drivers/platform/x86/intel/hid.c +@@ -504,6 +504,7 @@ static void notify_handler(acpi_handle handle, u32 event, void *context) + struct platform_device *device = context; + struct intel_hid_priv *priv = dev_get_drvdata(&device->dev); + unsigned long long ev_index; ++ struct key_entry *ke; + int err; + + /* +@@ -545,11 +546,15 @@ static void notify_handler(acpi_handle handle, u32 event, void *context) + if (event == 0xc0 || !priv->array) + return; + +- if (!sparse_keymap_entry_from_scancode(priv->array, event)) { ++ ke = sparse_keymap_entry_from_scancode(priv->array, event); ++ if (!ke) { + dev_info(&device->dev, "unknown event 0x%x\n", event); + return; + } + ++ if (ke->type == KE_IGNORE) ++ return; ++ + wakeup: + pm_wakeup_hard_event(&device->dev); + +-- +2.43.0 + diff --git a/queue-6.8/platform-x86-intel-vbtn-update-tablet-mode-switch-at.patch b/queue-6.8/platform-x86-intel-vbtn-update-tablet-mode-switch-at.patch new file mode 100644 index 00000000000..f50bef45adc --- /dev/null +++ b/queue-6.8/platform-x86-intel-vbtn-update-tablet-mode-switch-at.patch @@ -0,0 +1,80 @@ +From 186a8f34fbbb4e32eeb02627cce5078f9703467a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Mar 2024 07:32:06 -0700 +Subject: platform/x86: intel-vbtn: Update tablet mode switch at end of probe +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Gwendal Grignou + +[ Upstream commit 434e5781d8cd2d0ed512d920c6cdeba4b33a2e81 ] + +ACER Vivobook Flip (TP401NAS) virtual intel switch is implemented as +follow: + + Device (VGBI) + { + Name (_HID, EisaId ("INT33D6") ... + Name (VBDS, Zero) + Method (_STA, 0, Serialized) // _STA: Status ... + Method (VBDL, 0, Serialized) + { + PB1E |= 0x20 + VBDS |= 0x40 + } + Method (VGBS, 0, Serialized) + { + Return (VBDS) /* \_SB_.PCI0.SBRG.EC0_.VGBI.VBDS */ + } + ... + } + +By default VBDS is set to 0. At boot it is set to clamshell (bit 6 set) +only after method VBDL is executed. + +Since VBDL is now evaluated in the probe routine later, after the device +is registered, the retrieved value of VBDS was still 0 ("tablet mode") +when setting up the virtual switch. + +Make sure to evaluate VGBS after VBDL, to ensure the +convertible boots in clamshell mode, the expected default. + +Fixes: 26173179fae1 ("platform/x86: intel-vbtn: Eval VBDL after registering our notifier") +Signed-off-by: Gwendal Grignou +Reviewed-by: Kuppuswamy Sathyanarayanan +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20240329143206.2977734-3-gwendal@chromium.org +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/vbtn.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/intel/vbtn.c b/drivers/platform/x86/intel/vbtn.c +index 084c355c86f5f..5d13452bb947a 100644 +--- a/drivers/platform/x86/intel/vbtn.c ++++ b/drivers/platform/x86/intel/vbtn.c +@@ -136,8 +136,6 @@ static int intel_vbtn_input_setup(struct platform_device *device) + priv->switches_dev->id.bustype = BUS_HOST; + + if (priv->has_switches) { +- detect_tablet_mode(&device->dev); +- + ret = input_register_device(priv->switches_dev); + if (ret) + return ret; +@@ -316,6 +314,9 @@ static int intel_vbtn_probe(struct platform_device *device) + if (ACPI_FAILURE(status)) + dev_err(&device->dev, "Error VBDL failed with ACPI status %d\n", status); + } ++ // Check switches after buttons since VBDL may have side effects. ++ if (has_switches) ++ detect_tablet_mode(&device->dev); + + device_init_wakeup(&device->dev, true); + /* +-- +2.43.0 + diff --git a/queue-6.8/randomize_kstack-improve-entropy-diffusion.patch b/queue-6.8/randomize_kstack-improve-entropy-diffusion.patch new file mode 100644 index 00000000000..6c001f712eb --- /dev/null +++ b/queue-6.8/randomize_kstack-improve-entropy-diffusion.patch @@ -0,0 +1,37 @@ +From 3d39c175b3d80760a0b27950e55d7f7a1e873251 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Mar 2024 12:24:48 -0800 +Subject: randomize_kstack: Improve entropy diffusion + +From: Kees Cook + +[ Upstream commit 9c573cd313433f6c1f7236fe64b9b743500c1628 ] + +The kstack_offset variable was really only ever using the low bits for +kernel stack offset entropy. Add a ror32() to increase bit diffusion. + +Suggested-by: Arnd Bergmann +Fixes: 39218ff4c625 ("stack: Optionally randomize kernel stack offset each syscall") +Link: https://lore.kernel.org/r/20240309202445.work.165-kees@kernel.org +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + include/linux/randomize_kstack.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/randomize_kstack.h b/include/linux/randomize_kstack.h +index 5d868505a94e4..6d92b68efbf6c 100644 +--- a/include/linux/randomize_kstack.h ++++ b/include/linux/randomize_kstack.h +@@ -80,7 +80,7 @@ DECLARE_PER_CPU(u32, kstack_offset); + if (static_branch_maybe(CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT, \ + &randomize_kstack_offset)) { \ + u32 offset = raw_cpu_read(kstack_offset); \ +- offset ^= (rand); \ ++ offset = ror32(offset, 5) ^ (rand); \ + raw_cpu_write(kstack_offset, offset); \ + } \ + } while (0) +-- +2.43.0 + diff --git a/queue-6.8/series b/queue-6.8/series index 789fedfb018..e8ac3928299 100644 --- a/queue-6.8/series +++ b/queue-6.8/series @@ -129,3 +129,10 @@ fbmon-prevent-division-by-zero-in-fb_videomode_from_.patch alsa-hda-realtek-add-quirks-for-some-clevo-laptops.patch drm-amdgpu-init-zone-device-and-drm-client-after-mod.patch gcc-plugins-stackleak-avoid-.head.text-section.patch +media-mediatek-vcodec-fix-oops-when-hevc-init-fails.patch +media-mediatek-vcodec-adding-lock-to-protect-decoder.patch +media-mediatek-vcodec-adding-lock-to-protect-encoder.patch +randomize_kstack-improve-entropy-diffusion.patch +platform-x86-intel-hid-don-t-wake-on-5-button-releas.patch +platform-x86-intel-vbtn-update-tablet-mode-switch-at.patch +nouveau-fix-devinit-paths-to-only-handle-display-on-.patch