From: Sasha Levin Date: Sat, 21 Dec 2024 03:32:41 +0000 (-0500) Subject: Fixes for 6.12 X-Git-Tag: v6.1.122~35^2~7 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c4a9f9c5dda8590f52c08356be8047d5459e22f5;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.12 Signed-off-by: Sasha Levin --- diff --git a/queue-6.12/dma-buf-fix-__dma_buf_debugfs_list_del-argument-for-.patch b/queue-6.12/dma-buf-fix-__dma_buf_debugfs_list_del-argument-for-.patch new file mode 100644 index 00000000000..210e5ba855d --- /dev/null +++ b/queue-6.12/dma-buf-fix-__dma_buf_debugfs_list_del-argument-for-.patch @@ -0,0 +1,50 @@ +From f51e944182973509a1bb4cbc4554b83c5fe63ccd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Nov 2024 17:03:25 +0000 +Subject: dma-buf: Fix __dma_buf_debugfs_list_del argument for !CONFIG_DEBUG_FS +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: T.J. Mercier + +[ Upstream commit 0cff90dec63da908fb16d9ea2872ebbcd2d18e6a ] + +The arguments for __dma_buf_debugfs_list_del do not match for both the +CONFIG_DEBUG_FS case and the !CONFIG_DEBUG_FS case. The !CONFIG_DEBUG_FS +case should take a struct dma_buf *, but it's currently struct file *. +This can lead to the build error: + +error: passing argument 1 of ‘__dma_buf_debugfs_list_del’ from +incompatible pointer type [-Werror=incompatible-pointer-types] + +dma-buf.c:63:53: note: expected ‘struct file *’ but argument is of +type ‘struct dma_buf *’ + 63 | static void __dma_buf_debugfs_list_del(struct file *file) + +Fixes: bfc7bc539392 ("dma-buf: Do not build debugfs related code when !CONFIG_DEBUG_FS") +Signed-off-by: T.J. Mercier +Reviewed-by: Tvrtko Ursulin +Signed-off-by: Sumit Semwal +Link: https://patchwork.freedesktop.org/patch/msgid/20241117170326.1971113-1-tjmercier@google.com +Signed-off-by: Sasha Levin +--- + drivers/dma-buf/dma-buf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c +index 8892bc701a66..afb8c1c50107 100644 +--- a/drivers/dma-buf/dma-buf.c ++++ b/drivers/dma-buf/dma-buf.c +@@ -60,7 +60,7 @@ static void __dma_buf_debugfs_list_add(struct dma_buf *dmabuf) + { + } + +-static void __dma_buf_debugfs_list_del(struct file *file) ++static void __dma_buf_debugfs_list_del(struct dma_buf *dmabuf) + { + } + #endif +-- +2.39.5 + diff --git a/queue-6.12/drm-amdgpu-don-t-access-invalid-sched.patch b/queue-6.12/drm-amdgpu-don-t-access-invalid-sched.patch new file mode 100644 index 00000000000..82c82ddc286 --- /dev/null +++ b/queue-6.12/drm-amdgpu-don-t-access-invalid-sched.patch @@ -0,0 +1,62 @@ +From 35152126976cc9b26b44bbeca07ca21670ec8e59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 13:17:45 +0100 +Subject: drm/amdgpu: don't access invalid sched +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pierre-Eric Pelloux-Prayer + +[ Upstream commit a93b1020eb9386d7da11608477121b10079c076a ] + +Since 2320c9e6a768 ("drm/sched: memset() 'job' in drm_sched_job_init()") +accessing job->base.sched can produce unexpected results as the initialisation +of (*job)->base.sched done in amdgpu_job_alloc is overwritten by the +memset. + +This commit fixes an issue when a CS would fail validation and would +be rejected after job->num_ibs is incremented. In this case, +amdgpu_ib_free(ring->adev, ...) will be called, which would crash the +machine because the ring value is bogus. + +To fix this, pass a NULL pointer to amdgpu_ib_free(): we can do this +because the device is actually not used in this function. + +The next commit will remove the ring argument completely. + +Fixes: 2320c9e6a768 ("drm/sched: memset() 'job' in drm_sched_job_init()") +Signed-off-by: Pierre-Eric Pelloux-Prayer +Reviewed-by: Alex Deucher +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +(cherry picked from commit 2ae520cb12831d264ceb97c61f72c59d33c0dbd7) +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c +index 16f2605ac50b..1ce20a19be8b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c +@@ -253,7 +253,6 @@ void amdgpu_job_set_resources(struct amdgpu_job *job, struct amdgpu_bo *gds, + + void amdgpu_job_free_resources(struct amdgpu_job *job) + { +- struct amdgpu_ring *ring = to_amdgpu_ring(job->base.sched); + struct dma_fence *f; + unsigned i; + +@@ -266,7 +265,7 @@ void amdgpu_job_free_resources(struct amdgpu_job *job) + f = NULL; + + for (i = 0; i < job->num_ibs; ++i) +- amdgpu_ib_free(ring->adev, &job->ibs[i], f); ++ amdgpu_ib_free(NULL, &job->ibs[i], f); + } + + static void amdgpu_job_free_cb(struct drm_sched_job *s_job) +-- +2.39.5 + diff --git a/queue-6.12/drm-panel-himax-hx83102-add-a-check-to-prevent-null-.patch b/queue-6.12/drm-panel-himax-hx83102-add-a-check-to-prevent-null-.patch new file mode 100644 index 00000000000..8df80092d3e --- /dev/null +++ b/queue-6.12/drm-panel-himax-hx83102-add-a-check-to-prevent-null-.patch @@ -0,0 +1,41 @@ +From 43d6b0a3525f5334f0b715c7ae763fa30cc99374 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2024 15:34:08 +0800 +Subject: drm/panel: himax-hx83102: Add a check to prevent NULL pointer + dereference + +From: Zhang Zekun + +[ Upstream commit e1e1af9148dc4c866eda3fb59cd6ec3c7ea34b1d ] + +drm_mode_duplicate() could return NULL due to lack of memory, +which will then call NULL pointer dereference. Add a check to +prevent it. + +Fixes: 0ef94554dc40 ("drm/panel: himax-hx83102: Break out as separate driver") +Signed-off-by: Zhang Zekun +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20241025073408.27481-3-zhangzekun11@huawei.com +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20241025073408.27481-3-zhangzekun11@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-himax-hx83102.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/panel/panel-himax-hx83102.c b/drivers/gpu/drm/panel/panel-himax-hx83102.c +index 8b48bba18131..3644a7544b93 100644 +--- a/drivers/gpu/drm/panel/panel-himax-hx83102.c ++++ b/drivers/gpu/drm/panel/panel-himax-hx83102.c +@@ -565,6 +565,8 @@ static int hx83102_get_modes(struct drm_panel *panel, + struct drm_display_mode *mode; + + mode = drm_mode_duplicate(connector->dev, m); ++ if (!mode) ++ return -ENOMEM; + + mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED; + drm_mode_set_name(mode); +-- +2.39.5 + diff --git a/queue-6.12/drm-panel-novatek-nt35950-fix-return-value-check-in-.patch b/queue-6.12/drm-panel-novatek-nt35950-fix-return-value-check-in-.patch new file mode 100644 index 00000000000..e146835db39 --- /dev/null +++ b/queue-6.12/drm-panel-novatek-nt35950-fix-return-value-check-in-.patch @@ -0,0 +1,43 @@ +From 7bac252a732a582511222bdbc07425fa4da44b3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Oct 2024 20:39:57 +0800 +Subject: drm/panel: novatek-nt35950: fix return value check in nt35950_probe() + +From: Yang Yingliang + +[ Upstream commit f8fd0968eff52cf092c0d517d17507ea2f6e5ea5 ] + +mipi_dsi_device_register_full() never returns NULL pointer, it +will return ERR_PTR() when it fails, so replace the check with +IS_ERR(). + +Fixes: 623a3531e9cf ("drm/panel: Add driver for Novatek NT35950 DSI DriverIC panels") +Signed-off-by: Yang Yingliang +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20241029123957.1588-1-yangyingliang@huaweicloud.com +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20241029123957.1588-1-yangyingliang@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-novatek-nt35950.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35950.c b/drivers/gpu/drm/panel/panel-novatek-nt35950.c +index b036208f9356..08b22b592ab0 100644 +--- a/drivers/gpu/drm/panel/panel-novatek-nt35950.c ++++ b/drivers/gpu/drm/panel/panel-novatek-nt35950.c +@@ -481,9 +481,9 @@ static int nt35950_probe(struct mipi_dsi_device *dsi) + return dev_err_probe(dev, -EPROBE_DEFER, "Cannot get secondary DSI host\n"); + + nt->dsi[1] = mipi_dsi_device_register_full(dsi_r_host, info); +- if (!nt->dsi[1]) { ++ if (IS_ERR(nt->dsi[1])) { + dev_err(dev, "Cannot get secondary DSI node\n"); +- return -ENODEV; ++ return PTR_ERR(nt->dsi[1]); + } + num_dsis++; + } +-- +2.39.5 + diff --git a/queue-6.12/drm-panel-st7701-add-prepare_prev_first-flag-to-drm_.patch b/queue-6.12/drm-panel-st7701-add-prepare_prev_first-flag-to-drm_.patch new file mode 100644 index 00000000000..b8d183647fc --- /dev/null +++ b/queue-6.12/drm-panel-st7701-add-prepare_prev_first-flag-to-drm_.patch @@ -0,0 +1,40 @@ +From 075953e2fe55a6f66fb83d175e16ea09dc6717be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Nov 2024 23:48:07 +0100 +Subject: drm/panel: st7701: Add prepare_prev_first flag to drm_panel + +From: Marek Vasut + +[ Upstream commit 406dd4c7984a457567ca652455d5efad81983f02 ] + +The DSI host must be enabled for the panel to be initialized in +prepare(). Set the prepare_prev_first flag to guarantee this. +This fixes the panel operation on NXP i.MX8MP SoC / Samsung DSIM +DSI host. + +Fixes: 849b2e3ff969 ("drm/panel: Add Sitronix ST7701 panel driver") +Signed-off-by: Marek Vasut +Reviewed-by: Jessica Zhang +Link: https://lore.kernel.org/r/20241124224812.150263-1-marex@denx.de +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20241124224812.150263-1-marex@denx.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-sitronix-st7701.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/panel/panel-sitronix-st7701.c b/drivers/gpu/drm/panel/panel-sitronix-st7701.c +index eef03d04e0cd..1f72ef7ca74c 100644 +--- a/drivers/gpu/drm/panel/panel-sitronix-st7701.c ++++ b/drivers/gpu/drm/panel/panel-sitronix-st7701.c +@@ -1177,6 +1177,7 @@ static int st7701_probe(struct device *dev, int connector_type) + return dev_err_probe(dev, ret, "Failed to get orientation\n"); + + drm_panel_init(&st7701->panel, dev, &st7701_funcs, connector_type); ++ st7701->panel.prepare_prev_first = true; + + /** + * Once sleep out has been issued, ST7701 IC required to wait 120ms +-- +2.39.5 + diff --git a/queue-6.12/drm-panel-synaptics-r63353-fix-regulator-unbalance.patch b/queue-6.12/drm-panel-synaptics-r63353-fix-regulator-unbalance.patch new file mode 100644 index 00000000000..968100e24de --- /dev/null +++ b/queue-6.12/drm-panel-synaptics-r63353-fix-regulator-unbalance.patch @@ -0,0 +1,44 @@ +From 4fc73ad913c25fa263072c64fcd045219fd7252f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Dec 2024 17:29:58 +0100 +Subject: drm/panel: synaptics-r63353: Fix regulator unbalance + +From: Michael Trimarchi + +[ Upstream commit d2bd3fcb825725a59c8880070b1206b1710922bd ] + +The shutdown function can be called when the display is already +unprepared. For example during reboot this trigger a kernel +backlog. Calling the drm_panel_unprepare, allow us to avoid +to trigger the kernel warning. + +Fixes: 2e87bad7cd33 ("drm/panel: Add Synaptics R63353 panel driver") +Tested-by: Dario Binacchi +Signed-off-by: Michael Trimarchi +Signed-off-by: Dario Binacchi +Reviewed-by: Neil Armstrong +Reviewed-by: Jessica Zhang +Link: https://lore.kernel.org/r/20241205163002.1804784-1-dario.binacchi@amarulasolutions.com +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20241205163002.1804784-1-dario.binacchi@amarulasolutions.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-synaptics-r63353.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-synaptics-r63353.c b/drivers/gpu/drm/panel/panel-synaptics-r63353.c +index 169c629746c7..17349825543f 100644 +--- a/drivers/gpu/drm/panel/panel-synaptics-r63353.c ++++ b/drivers/gpu/drm/panel/panel-synaptics-r63353.c +@@ -325,7 +325,7 @@ static void r63353_panel_shutdown(struct mipi_dsi_device *dsi) + { + struct r63353_panel *rpanel = mipi_dsi_get_drvdata(dsi); + +- r63353_panel_unprepare(&rpanel->base); ++ drm_panel_unprepare(&rpanel->base); + } + + static const struct r63353_desc sharp_ls068b3sx02_data = { +-- +2.39.5 + diff --git a/queue-6.12/i915-guc-accumulate-active-runtime-on-gt-reset.patch b/queue-6.12/i915-guc-accumulate-active-runtime-on-gt-reset.patch new file mode 100644 index 00000000000..246bbfdadd3 --- /dev/null +++ b/queue-6.12/i915-guc-accumulate-active-runtime-on-gt-reset.patch @@ -0,0 +1,56 @@ +From 25e4c00aa37a44dc9003c8f7eb513fb6c6dd6287 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Nov 2024 09:40:06 -0800 +Subject: i915/guc: Accumulate active runtime on gt reset + +From: Umesh Nerlige Ramappa + +[ Upstream commit 1622ed27d26ab4c234476be746aa55bcd39159dd ] + +On gt reset, if a context is running, then accumulate it's active time +into the busyness counter since there will be no chance for the context +to switch out and update it's run time. + +v2: Move comment right above the if (John) + +Fixes: 77cdd054dd2c ("drm/i915/pmu: Connect engine busyness stats from GuC to pmu") +Signed-off-by: Umesh Nerlige Ramappa +Reviewed-by: John Harrison +Link: https://patchwork.freedesktop.org/patch/msgid/20241127174006.190128-4-umesh.nerlige.ramappa@intel.com +(cherry picked from commit 7ed047da59cfa1acb558b95169d347acc8d85da1) +Signed-off-by: Tvrtko Ursulin +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +index fbff9b9a067c..ee12ee0ed418 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +@@ -1449,8 +1449,21 @@ static void __reset_guc_busyness_stats(struct intel_guc *guc) + + guc_update_pm_timestamp(guc, &unused); + for_each_engine(engine, gt, id) { ++ struct intel_engine_guc_stats *stats = &engine->stats.guc; ++ + guc_update_engine_gt_clks(engine); +- engine->stats.guc.prev_total = 0; ++ ++ /* ++ * If resetting a running context, accumulate the active ++ * time as well since there will be no context switch. ++ */ ++ if (stats->running) { ++ u64 clk = guc->timestamp.gt_stamp - stats->start_gt_clk; ++ ++ stats->total_gt_clks += clk; ++ } ++ stats->prev_total = 0; ++ stats->running = 0; + } + + spin_unlock_irqrestore(&guc->timestamp.lock, flags); +-- +2.39.5 + diff --git a/queue-6.12/i915-guc-ensure-busyness-counter-increases-motonical.patch b/queue-6.12/i915-guc-ensure-busyness-counter-increases-motonical.patch new file mode 100644 index 00000000000..98296e9fd2d --- /dev/null +++ b/queue-6.12/i915-guc-ensure-busyness-counter-increases-motonical.patch @@ -0,0 +1,68 @@ +From 15433fee23cc4bf9d8f689730684e9aa6c9a298f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Nov 2024 09:40:05 -0800 +Subject: i915/guc: Ensure busyness counter increases motonically + +From: Umesh Nerlige Ramappa + +[ Upstream commit 59a0b46788d58fdcee8d2f6b4e619d264a1799bf ] + +Active busyness of an engine is calculated using gt timestamp and the +context switch in time. While capturing the gt timestamp, it's possible +that the context switches out. This race could result in an active +busyness value that is greater than the actual context runtime value by a +small amount. This leads to a negative delta and throws off busyness +calculations for the user. + +If a subsequent count is smaller than the previous one, just return the +previous one, since we expect the busyness to catch up. + +Fixes: 77cdd054dd2c ("drm/i915/pmu: Connect engine busyness stats from GuC to pmu") +Signed-off-by: Umesh Nerlige Ramappa +Reviewed-by: John Harrison +Link: https://patchwork.freedesktop.org/patch/msgid/20241127174006.190128-3-umesh.nerlige.ramappa@intel.com +(cherry picked from commit cf907f6d294217985e9dafd9985dce874e04ca37) +Signed-off-by: Tvrtko Ursulin +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/intel_engine_types.h | 5 +++++ + drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 5 ++++- + 2 files changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_engine_types.h b/drivers/gpu/drm/i915/gt/intel_engine_types.h +index ba55c059063d..fe1f85e5dda3 100644 +--- a/drivers/gpu/drm/i915/gt/intel_engine_types.h ++++ b/drivers/gpu/drm/i915/gt/intel_engine_types.h +@@ -343,6 +343,11 @@ struct intel_engine_guc_stats { + * @start_gt_clk: GT clock time of last idle to active transition. + */ + u64 start_gt_clk; ++ ++ /** ++ * @total: The last value of total returned ++ */ ++ u64 total; + }; + + union intel_engine_tlb_inv_reg { +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +index 4793759f4d4a..fbff9b9a067c 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +@@ -1378,9 +1378,12 @@ static ktime_t guc_engine_busyness(struct intel_engine_cs *engine, ktime_t *now) + total += intel_gt_clock_interval_to_ns(gt, clk); + } + ++ if (total > stats->total) ++ stats->total = total; ++ + spin_unlock_irqrestore(&guc->timestamp.lock, flags); + +- return ns_to_ktime(total); ++ return ns_to_ktime(stats->total); + } + + static void guc_enable_busyness_worker(struct intel_guc *guc) +-- +2.39.5 + diff --git a/queue-6.12/i915-guc-reset-engine-utilization-buffer-before-regi.patch b/queue-6.12/i915-guc-reset-engine-utilization-buffer-before-regi.patch new file mode 100644 index 00000000000..8824fbecf09 --- /dev/null +++ b/queue-6.12/i915-guc-reset-engine-utilization-buffer-before-regi.patch @@ -0,0 +1,77 @@ +From 3eb9a8e90e084ada12cd521e4b4fe9fbdd2eb000 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Nov 2024 09:40:04 -0800 +Subject: i915/guc: Reset engine utilization buffer before registration + +From: Umesh Nerlige Ramappa + +[ Upstream commit abcc2ddae5f82aa6cfca162e3db643dd33f0a2e8 ] + +On GT reset, we store total busyness counts for all engines and +re-register the utilization buffer with GuC. At that time we should +reset the buffer, so that we don't get spurious busyness counts on +subsequent queries. + +To repro this issue, run igt@perf_pmu@busy-hang followed by +igt@perf_pmu@most-busy-idle-check-all for a couple iterations. + +Fixes: 77cdd054dd2c ("drm/i915/pmu: Connect engine busyness stats from GuC to pmu") +Signed-off-by: Umesh Nerlige Ramappa +Reviewed-by: John Harrison +Link: https://patchwork.freedesktop.org/patch/msgid/20241127174006.190128-2-umesh.nerlige.ramappa@intel.com +(cherry picked from commit abd318237fa6556c1e5225529af145ef15d5ff0d) +Signed-off-by: Tvrtko Ursulin +Signed-off-by: Sasha Levin +--- + .../gpu/drm/i915/gt/uc/intel_guc_submission.c | 21 +++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +index ed979847187f..4793759f4d4a 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +@@ -1243,6 +1243,21 @@ static void __get_engine_usage_record(struct intel_engine_cs *engine, + } while (++i < 6); + } + ++static void __set_engine_usage_record(struct intel_engine_cs *engine, ++ u32 last_in, u32 id, u32 total) ++{ ++ struct iosys_map rec_map = intel_guc_engine_usage_record_map(engine); ++ ++#define record_write(map_, field_, val_) \ ++ iosys_map_wr_field(map_, 0, struct guc_engine_usage_record, field_, val_) ++ ++ record_write(&rec_map, last_switch_in_stamp, last_in); ++ record_write(&rec_map, current_context_index, id); ++ record_write(&rec_map, total_runtime, total); ++ ++#undef record_write ++} ++ + static void guc_update_engine_gt_clks(struct intel_engine_cs *engine) + { + struct intel_engine_guc_stats *stats = &engine->stats.guc; +@@ -1543,6 +1558,9 @@ static void guc_timestamp_ping(struct work_struct *wrk) + + static int guc_action_enable_usage_stats(struct intel_guc *guc) + { ++ struct intel_gt *gt = guc_to_gt(guc); ++ struct intel_engine_cs *engine; ++ enum intel_engine_id id; + u32 offset = intel_guc_engine_usage_offset(guc); + u32 action[] = { + INTEL_GUC_ACTION_SET_ENG_UTIL_BUFF, +@@ -1550,6 +1568,9 @@ static int guc_action_enable_usage_stats(struct intel_guc *guc) + 0, + }; + ++ for_each_engine(engine, gt, id) ++ __set_engine_usage_record(engine, 0, 0xffffffff, 0); ++ + return intel_guc_send(guc, action, ARRAY_SIZE(action)); + } + +-- +2.39.5 + diff --git a/queue-6.12/series b/queue-6.12/series index c44626bc568..fd4702eec64 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -60,3 +60,14 @@ net-dsa-restore-dsa_software_vlan_untag-ability-to-o.patch netdev-genl-avoid-empty-messages-in-queue-dump.patch psample-adjust-size-if-rate_as_probability-is-set.patch net-mdiobus-fix-an-of-node-reference-leak.patch +udmabuf-udmabuf_create-pin-folio-codestyle-cleanup.patch +udmabuf-fix-memory-leak-on-last-export_udmabuf-error.patch +dma-buf-fix-__dma_buf_debugfs_list_del-argument-for-.patch +drm-panel-himax-hx83102-add-a-check-to-prevent-null-.patch +drm-panel-novatek-nt35950-fix-return-value-check-in-.patch +drm-panel-st7701-add-prepare_prev_first-flag-to-drm_.patch +drm-panel-synaptics-r63353-fix-regulator-unbalance.patch +i915-guc-reset-engine-utilization-buffer-before-regi.patch +i915-guc-ensure-busyness-counter-increases-motonical.patch +i915-guc-accumulate-active-runtime-on-gt-reset.patch +drm-amdgpu-don-t-access-invalid-sched.patch diff --git a/queue-6.12/udmabuf-fix-memory-leak-on-last-export_udmabuf-error.patch b/queue-6.12/udmabuf-fix-memory-leak-on-last-export_udmabuf-error.patch new file mode 100644 index 00000000000..a4b2ec0bc9d --- /dev/null +++ b/queue-6.12/udmabuf-fix-memory-leak-on-last-export_udmabuf-error.patch @@ -0,0 +1,100 @@ +From 56ebc1b3fb2199fad2a698b4af71614f111e5c1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Dec 2024 17:26:21 +0100 +Subject: udmabuf: fix memory leak on last export_udmabuf() error path + +From: Jann Horn + +[ Upstream commit f49856f525acd5bef52ae28b7da2e001bbe7439e ] + +In export_udmabuf(), if dma_buf_fd() fails because the FD table is full, a +dma_buf owning the udmabuf has already been created; but the error handling +in udmabuf_create() will tear down the udmabuf without doing anything about +the containing dma_buf. + +This leaves a dma_buf in memory that contains a dangling pointer; though +that doesn't seem to lead to anything bad except a memory leak. + +Fix it by moving the dma_buf_fd() call out of export_udmabuf() so that we +can give it different error handling. + +Note that the shape of this code changed a lot in commit 5e72b2b41a21 +("udmabuf: convert udmabuf driver to use folios"); but the memory leak +seems to have existed since the introduction of udmabuf. + +Fixes: fbb0de795078 ("Add udmabuf misc device") +Acked-by: Vivek Kasireddy +Signed-off-by: Jann Horn +Signed-off-by: Vivek Kasireddy +Link: https://patchwork.freedesktop.org/patch/msgid/20241204-udmabuf-fixes-v2-3-23887289de1c@google.com +Signed-off-by: Sasha Levin +--- + drivers/dma-buf/udmabuf.c | 28 +++++++++++++++++----------- + 1 file changed, 17 insertions(+), 11 deletions(-) + +diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c +index 970e08a95dc0..614df433c451 100644 +--- a/drivers/dma-buf/udmabuf.c ++++ b/drivers/dma-buf/udmabuf.c +@@ -276,12 +276,10 @@ static int check_memfd_seals(struct file *memfd) + return 0; + } + +-static int export_udmabuf(struct udmabuf *ubuf, +- struct miscdevice *device, +- u32 flags) ++static struct dma_buf *export_udmabuf(struct udmabuf *ubuf, ++ struct miscdevice *device) + { + DEFINE_DMA_BUF_EXPORT_INFO(exp_info); +- struct dma_buf *buf; + + ubuf->device = device; + exp_info.ops = &udmabuf_ops; +@@ -289,11 +287,7 @@ static int export_udmabuf(struct udmabuf *ubuf, + exp_info.priv = ubuf; + exp_info.flags = O_RDWR; + +- buf = dma_buf_export(&exp_info); +- if (IS_ERR(buf)) +- return PTR_ERR(buf); +- +- return dma_buf_fd(buf, flags); ++ return dma_buf_export(&exp_info); + } + + static long udmabuf_pin_folios(struct udmabuf *ubuf, struct file *memfd, +@@ -356,6 +350,7 @@ static long udmabuf_create(struct miscdevice *device, + { + pgoff_t pgcnt = 0, pglimit; + struct udmabuf *ubuf; ++ struct dma_buf *dmabuf; + long ret = -EINVAL; + u32 i, flags; + +@@ -413,9 +408,20 @@ static long udmabuf_create(struct miscdevice *device, + } + + flags = head->flags & UDMABUF_FLAGS_CLOEXEC ? O_CLOEXEC : 0; +- ret = export_udmabuf(ubuf, device, flags); +- if (ret < 0) ++ dmabuf = export_udmabuf(ubuf, device); ++ if (IS_ERR(dmabuf)) { ++ ret = PTR_ERR(dmabuf); + goto err; ++ } ++ /* ++ * Ownership of ubuf is held by the dmabuf from here. ++ * If the following dma_buf_fd() fails, dma_buf_put() cleans up both the ++ * dmabuf and the ubuf (through udmabuf_ops.release). ++ */ ++ ++ ret = dma_buf_fd(dmabuf, flags); ++ if (ret < 0) ++ dma_buf_put(dmabuf); + + return ret; + +-- +2.39.5 + diff --git a/queue-6.12/udmabuf-udmabuf_create-pin-folio-codestyle-cleanup.patch b/queue-6.12/udmabuf-udmabuf_create-pin-folio-codestyle-cleanup.patch new file mode 100644 index 00000000000..348ce606d0a --- /dev/null +++ b/queue-6.12/udmabuf-udmabuf_create-pin-folio-codestyle-cleanup.patch @@ -0,0 +1,233 @@ +From 9bbd94e239ad8d4bee72eacef473282aa234e58a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Sep 2024 10:52:27 +0800 +Subject: udmabuf: udmabuf_create pin folio codestyle cleanup + +From: Huan Yang + +[ Upstream commit 164fd9efd46531fddfaa933d394569259896642b ] + +This patch aim to simplify the memfd folio pin during the udmabuf +create. No functional changes. + +This patch create a udmabuf_pin_folios function, in this, do the memfd +pin folio and then record each pinned folio, offset. + +This patch simplify the pinned folio record, iter by each pinned folio, +and then record each offset in it. + +Compare to iter by pgcnt, more readable. + +Suggested-by: Vivek Kasireddy +Signed-off-by: Huan Yang +Acked-by: Vivek Kasireddy +Signed-off-by: Vivek Kasireddy +Link: https://patchwork.freedesktop.org/patch/msgid/20240918025238.2957823-5-link@vivo.com +Stable-dep-of: f49856f525ac ("udmabuf: fix memory leak on last export_udmabuf() error path") +Signed-off-by: Sasha Levin +--- + drivers/dma-buf/udmabuf.c | 137 +++++++++++++++++++++----------------- + 1 file changed, 76 insertions(+), 61 deletions(-) + +diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c +index a3638ccc15f5..970e08a95dc0 100644 +--- a/drivers/dma-buf/udmabuf.c ++++ b/drivers/dma-buf/udmabuf.c +@@ -262,9 +262,6 @@ static int check_memfd_seals(struct file *memfd) + { + int seals; + +- if (!memfd) +- return -EBADFD; +- + if (!shmem_file(memfd) && !is_file_hugepages(memfd)) + return -EBADFD; + +@@ -299,17 +296,68 @@ static int export_udmabuf(struct udmabuf *ubuf, + return dma_buf_fd(buf, flags); + } + ++static long udmabuf_pin_folios(struct udmabuf *ubuf, struct file *memfd, ++ loff_t start, loff_t size) ++{ ++ pgoff_t pgoff, pgcnt, upgcnt = ubuf->pagecount; ++ struct folio **folios = NULL; ++ u32 cur_folio, cur_pgcnt; ++ long nr_folios; ++ long ret = 0; ++ loff_t end; ++ ++ pgcnt = size >> PAGE_SHIFT; ++ folios = kvmalloc_array(pgcnt, sizeof(*folios), GFP_KERNEL); ++ if (!folios) ++ return -ENOMEM; ++ ++ end = start + (pgcnt << PAGE_SHIFT) - 1; ++ nr_folios = memfd_pin_folios(memfd, start, end, folios, pgcnt, &pgoff); ++ if (nr_folios <= 0) { ++ ret = nr_folios ? nr_folios : -EINVAL; ++ goto end; ++ } ++ ++ cur_pgcnt = 0; ++ for (cur_folio = 0; cur_folio < nr_folios; ++cur_folio) { ++ pgoff_t subpgoff = pgoff; ++ size_t fsize = folio_size(folios[cur_folio]); ++ ++ ret = add_to_unpin_list(&ubuf->unpin_list, folios[cur_folio]); ++ if (ret < 0) ++ goto end; ++ ++ for (; subpgoff < fsize; subpgoff += PAGE_SIZE) { ++ ubuf->folios[upgcnt] = folios[cur_folio]; ++ ubuf->offsets[upgcnt] = subpgoff; ++ ++upgcnt; ++ ++ if (++cur_pgcnt >= pgcnt) ++ goto end; ++ } ++ ++ /** ++ * In a given range, only the first subpage of the first folio ++ * has an offset, that is returned by memfd_pin_folios(). ++ * The first subpages of other folios (in the range) have an ++ * offset of 0. ++ */ ++ pgoff = 0; ++ } ++end: ++ ubuf->pagecount = upgcnt; ++ kvfree(folios); ++ return ret; ++} ++ + static long udmabuf_create(struct miscdevice *device, + struct udmabuf_create_list *head, + struct udmabuf_create_item *list) + { +- pgoff_t pgoff, pgcnt, pglimit, pgbuf = 0; +- long nr_folios, ret = -EINVAL; +- struct file *memfd = NULL; +- struct folio **folios; ++ pgoff_t pgcnt = 0, pglimit; + struct udmabuf *ubuf; +- u32 i, j, k, flags; +- loff_t end; ++ long ret = -EINVAL; ++ u32 i, flags; + + ubuf = kzalloc(sizeof(*ubuf), GFP_KERNEL); + if (!ubuf) +@@ -318,81 +366,50 @@ static long udmabuf_create(struct miscdevice *device, + INIT_LIST_HEAD(&ubuf->unpin_list); + pglimit = (size_limit_mb * 1024 * 1024) >> PAGE_SHIFT; + for (i = 0; i < head->count; i++) { +- if (!IS_ALIGNED(list[i].offset, PAGE_SIZE)) ++ if (!PAGE_ALIGNED(list[i].offset)) + goto err; +- if (!IS_ALIGNED(list[i].size, PAGE_SIZE)) ++ if (!PAGE_ALIGNED(list[i].size)) + goto err; +- ubuf->pagecount += list[i].size >> PAGE_SHIFT; +- if (ubuf->pagecount > pglimit) ++ ++ pgcnt += list[i].size >> PAGE_SHIFT; ++ if (pgcnt > pglimit) + goto err; + } + +- if (!ubuf->pagecount) ++ if (!pgcnt) + goto err; + +- ubuf->folios = kvmalloc_array(ubuf->pagecount, sizeof(*ubuf->folios), +- GFP_KERNEL); ++ ubuf->folios = kvmalloc_array(pgcnt, sizeof(*ubuf->folios), GFP_KERNEL); + if (!ubuf->folios) { + ret = -ENOMEM; + goto err; + } +- ubuf->offsets = kvcalloc(ubuf->pagecount, sizeof(*ubuf->offsets), +- GFP_KERNEL); ++ ++ ubuf->offsets = kvcalloc(pgcnt, sizeof(*ubuf->offsets), GFP_KERNEL); + if (!ubuf->offsets) { + ret = -ENOMEM; + goto err; + } + +- pgbuf = 0; + for (i = 0; i < head->count; i++) { +- memfd = fget(list[i].memfd); +- ret = check_memfd_seals(memfd); +- if (ret < 0) +- goto err; ++ struct file *memfd = fget(list[i].memfd); + +- pgcnt = list[i].size >> PAGE_SHIFT; +- folios = kvmalloc_array(pgcnt, sizeof(*folios), GFP_KERNEL); +- if (!folios) { +- ret = -ENOMEM; ++ if (!memfd) { ++ ret = -EBADFD; + goto err; + } + +- end = list[i].offset + (pgcnt << PAGE_SHIFT) - 1; +- ret = memfd_pin_folios(memfd, list[i].offset, end, +- folios, pgcnt, &pgoff); +- if (ret <= 0) { +- kvfree(folios); +- if (!ret) +- ret = -EINVAL; ++ ret = check_memfd_seals(memfd); ++ if (ret < 0) { ++ fput(memfd); + goto err; + } + +- nr_folios = ret; +- pgoff >>= PAGE_SHIFT; +- for (j = 0, k = 0; j < pgcnt; j++) { +- ubuf->folios[pgbuf] = folios[k]; +- ubuf->offsets[pgbuf] = pgoff << PAGE_SHIFT; +- +- if (j == 0 || ubuf->folios[pgbuf-1] != folios[k]) { +- ret = add_to_unpin_list(&ubuf->unpin_list, +- folios[k]); +- if (ret < 0) { +- kfree(folios); +- goto err; +- } +- } +- +- pgbuf++; +- if (++pgoff == folio_nr_pages(folios[k])) { +- pgoff = 0; +- if (++k == nr_folios) +- break; +- } +- } +- +- kvfree(folios); ++ ret = udmabuf_pin_folios(ubuf, memfd, list[i].offset, ++ list[i].size); + fput(memfd); +- memfd = NULL; ++ if (ret) ++ goto err; + } + + flags = head->flags & UDMABUF_FLAGS_CLOEXEC ? O_CLOEXEC : 0; +@@ -403,8 +420,6 @@ static long udmabuf_create(struct miscdevice *device, + return ret; + + err: +- if (memfd) +- fput(memfd); + unpin_all_folios(&ubuf->unpin_list); + kvfree(ubuf->offsets); + kvfree(ubuf->folios); +-- +2.39.5 +