From 154befc4feb2d4388a40345bf41f330cfa9406a4 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Wed, 7 May 2025 11:36:15 -0400 Subject: [PATCH] Fixes for 6.12 Signed-off-by: Sasha Levin --- ...s-opos6ul-add-ksz8081-phy-properties.patch | 44 ++++ ...correct-the-range-of-pcie-app-reg-re.patch | 64 ++++++ ...ust-interrupt-controller-for-stm32mp.patch | 39 ++++ ...-128kb-size-for-aliased-gic400-regis.patch | 48 ++++ ...-base-handle-module_kobject-creation.patch | 65 ++++++ ...add-scoped-mutexes-for-amdgpu_dm_dhc.patch | 205 ++++++++++++++++++ ...play-fix-slab-use-after-free-in-hdcp.patch | 177 +++++++++++++++ ...-skip-rx-buffer-ownership-release-if.patch | 52 +++++ ...i-balance-device-refcount-when-destr.patch | 86 ++++++++ ...lize-lookup_or_create_module_kobject.patch | 55 +++++ ...l-param-rename-locate_module_kobject.patch | 62 ++++++ ...-vclk-fix-calculation-of-59.94-fract.patch | 61 ++++++ queue-6.12/series | 12 + 13 files changed, 970 insertions(+) create mode 100644 queue-6.12/arm-dts-opos6ul-add-ksz8081-phy-properties.patch create mode 100644 queue-6.12/arm64-dts-imx95-correct-the-range-of-pcie-app-reg-re.patch create mode 100644 queue-6.12/arm64-dts-st-adjust-interrupt-controller-for-stm32mp.patch create mode 100644 queue-6.12/arm64-dts-st-use-128kb-size-for-aliased-gic400-regis.patch create mode 100644 queue-6.12/drivers-base-handle-module_kobject-creation.patch create mode 100644 queue-6.12/drm-amd-display-add-scoped-mutexes-for-amdgpu_dm_dhc.patch create mode 100644 queue-6.12/drm-amd-display-fix-slab-use-after-free-in-hdcp.patch create mode 100644 queue-6.12/firmware-arm_ffa-skip-rx-buffer-ownership-release-if.patch create mode 100644 queue-6.12/firmware-arm_scmi-balance-device-refcount-when-destr.patch create mode 100644 queue-6.12/kernel-globalize-lookup_or_create_module_kobject.patch create mode 100644 queue-6.12/kernel-param-rename-locate_module_kobject.patch create mode 100644 queue-6.12/revert-drm-meson-vclk-fix-calculation-of-59.94-fract.patch diff --git a/queue-6.12/arm-dts-opos6ul-add-ksz8081-phy-properties.patch b/queue-6.12/arm-dts-opos6ul-add-ksz8081-phy-properties.patch new file mode 100644 index 0000000000..e55f758058 --- /dev/null +++ b/queue-6.12/arm-dts-opos6ul-add-ksz8081-phy-properties.patch @@ -0,0 +1,44 @@ +From 1b05d01bbca9fffae4ab5316d482ca476b6200fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Mar 2025 17:20:38 +0100 +Subject: ARM: dts: opos6ul: add ksz8081 phy properties +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sébastien Szymanski + +[ Upstream commit 6e1a7bc8382b0d4208258f7d2a4474fae788dd90 ] + +Commit c7e73b5051d6 ("ARM: imx: mach-imx6ul: remove 14x14 EVK specific +PHY fixup") removed a PHY fixup that setted the clock mode and the LED +mode. +Make the Ethernet interface work again by doing as advised in the +commit's log, set clock mode and the LED mode in the device tree. + +Fixes: c7e73b5051d6 ("ARM: imx: mach-imx6ul: remove 14x14 EVK specific PHY fixup") +Signed-off-by: Sébastien Szymanski +Reviewed-by: Oleksij Rempel +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/nxp/imx/imx6ul-imx6ull-opos6ul.dtsi | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm/boot/dts/nxp/imx/imx6ul-imx6ull-opos6ul.dtsi b/arch/arm/boot/dts/nxp/imx/imx6ul-imx6ull-opos6ul.dtsi +index f2386dcb9ff2c..dda4fa91b2f2c 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6ul-imx6ull-opos6ul.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx6ul-imx6ull-opos6ul.dtsi +@@ -40,6 +40,9 @@ + reg = <1>; + interrupt-parent = <&gpio4>; + interrupts = <16 IRQ_TYPE_LEVEL_LOW>; ++ micrel,led-mode = <1>; ++ clocks = <&clks IMX6UL_CLK_ENET_REF>; ++ clock-names = "rmii-ref"; + status = "okay"; + }; + }; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-imx95-correct-the-range-of-pcie-app-reg-re.patch b/queue-6.12/arm64-dts-imx95-correct-the-range-of-pcie-app-reg-re.patch new file mode 100644 index 0000000000..cb38ee0302 --- /dev/null +++ b/queue-6.12/arm64-dts-imx95-correct-the-range-of-pcie-app-reg-re.patch @@ -0,0 +1,64 @@ +From 66f1b002c578736d1f1c0f743e2077d67dbebec5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Mar 2025 14:01:04 +0800 +Subject: arm64: dts: imx95: Correct the range of PCIe app-reg region + +From: Richard Zhu + +[ Upstream commit 02e4232998db357bb8199778722d81ffcff0cb98 ] + +Correct the range of PCIe app-reg region from 0x2000 to 0x4000 refer to +SerDes_SS memory map of i.MX95 Rerference Manual. + +Fixes: 3b1d5deb29ff ("arm64: dts: imx95: add pcie[0,1] and pcie-ep[0,1] support") +Signed-off-by: Richard Zhu +Reviewed-by: Frank Li +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx95.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx95.dtsi b/arch/arm64/boot/dts/freescale/imx95.dtsi +index 40cbb071f265c..f904d6b1c84bf 100644 +--- a/arch/arm64/boot/dts/freescale/imx95.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx95.dtsi +@@ -1478,7 +1478,7 @@ + reg = <0 0x4c300000 0 0x10000>, + <0 0x60100000 0 0xfe00000>, + <0 0x4c360000 0 0x10000>, +- <0 0x4c340000 0 0x2000>; ++ <0 0x4c340000 0 0x4000>; + reg-names = "dbi", "config", "atu", "app"; + ranges = <0x81000000 0x0 0x00000000 0x0 0x6ff00000 0 0x00100000>, + <0x82000000 0x0 0x10000000 0x9 0x10000000 0 0x10000000>; +@@ -1518,7 +1518,7 @@ + reg = <0 0x4c300000 0 0x10000>, + <0 0x4c360000 0 0x1000>, + <0 0x4c320000 0 0x1000>, +- <0 0x4c340000 0 0x2000>, ++ <0 0x4c340000 0 0x4000>, + <0 0x4c370000 0 0x10000>, + <0x9 0 1 0>; + reg-names = "dbi","atu", "dbi2", "app", "dma", "addr_space"; +@@ -1545,7 +1545,7 @@ + reg = <0 0x4c380000 0 0x10000>, + <8 0x80100000 0 0xfe00000>, + <0 0x4c3e0000 0 0x10000>, +- <0 0x4c3c0000 0 0x2000>; ++ <0 0x4c3c0000 0 0x4000>; + reg-names = "dbi", "config", "atu", "app"; + ranges = <0x81000000 0 0x00000000 0x8 0x8ff00000 0 0x00100000>, + <0x82000000 0 0x10000000 0xa 0x10000000 0 0x10000000>; +@@ -1585,7 +1585,7 @@ + reg = <0 0x4c380000 0 0x10000>, + <0 0x4c3e0000 0 0x1000>, + <0 0x4c3a0000 0 0x1000>, +- <0 0x4c3c0000 0 0x2000>, ++ <0 0x4c3c0000 0 0x4000>, + <0 0x4c3f0000 0 0x10000>, + <0xa 0 1 0>; + reg-names = "dbi", "atu", "dbi2", "app", "dma", "addr_space"; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-st-adjust-interrupt-controller-for-stm32mp.patch b/queue-6.12/arm64-dts-st-adjust-interrupt-controller-for-stm32mp.patch new file mode 100644 index 0000000000..181e2ec15c --- /dev/null +++ b/queue-6.12/arm64-dts-st-adjust-interrupt-controller-for-stm32mp.patch @@ -0,0 +1,39 @@ +From 7b8f92550e4f38c9b5024d34cd6d4635949db4e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Apr 2025 14:06:58 +0200 +Subject: arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs + +From: Christian Bruel + +[ Upstream commit de2b2107d5a41a91ab603e135fb6e408abbee28e ] + +Use gic-400 compatible and remove address-cells = <1> on aarch64 + +Fixes: 5d30d03aaf785 ("arm64: dts: st: introduce stm32mp25 SoCs family") +Signed-off-by: Christian Bruel +Link: https://lore.kernel.org/r/20250415111654.2103767-2-christian.bruel@foss.st.com +Signed-off-by: Alexandre Torgue +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/st/stm32mp251.dtsi | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/st/stm32mp251.dtsi b/arch/arm64/boot/dts/st/stm32mp251.dtsi +index 1167cf63d7e87..896d92032284b 100644 +--- a/arch/arm64/boot/dts/st/stm32mp251.dtsi ++++ b/arch/arm64/boot/dts/st/stm32mp251.dtsi +@@ -114,9 +114,8 @@ + }; + + intc: interrupt-controller@4ac00000 { +- compatible = "arm,cortex-a7-gic"; ++ compatible = "arm,gic-400"; + #interrupt-cells = <3>; +- #address-cells = <1>; + interrupt-controller; + reg = <0x0 0x4ac10000 0x0 0x1000>, + <0x0 0x4ac20000 0x0 0x2000>, +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-st-use-128kb-size-for-aliased-gic400-regis.patch b/queue-6.12/arm64-dts-st-use-128kb-size-for-aliased-gic400-regis.patch new file mode 100644 index 0000000000..25ea257a42 --- /dev/null +++ b/queue-6.12/arm64-dts-st-use-128kb-size-for-aliased-gic400-regis.patch @@ -0,0 +1,48 @@ +From 7b18c11b763a076be93aa5ad59b4d1b23db7ec3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Apr 2025 14:06:59 +0200 +Subject: arm64: dts: st: Use 128kB size for aliased GIC400 register access on + stm32mp25 SoCs + +From: Christian Bruel + +[ Upstream commit 06c231fe953a26f4bc9d7a37ba1b9b288a59c7c2 ] + +Adjust the size of 8kB GIC regions to 128kB so that each 4kB is mapped 16 +times over a 64kB region. +The offset is then adjusted in the irq-gic driver. + +see commit 12e14066f4835 ("irqchip/GIC: Add workaround for aliased GIC400") + +Fixes: 5d30d03aaf785 ("arm64: dts: st: introduce stm32mp25 SoCs family") +Suggested-by: Marc Zyngier +Signed-off-by: Christian Bruel +Acked-by: Marc Zyngier +Link: https://lore.kernel.org/r/20250415111654.2103767-3-christian.bruel@foss.st.com +Signed-off-by: Alexandre Torgue +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/st/stm32mp251.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/st/stm32mp251.dtsi b/arch/arm64/boot/dts/st/stm32mp251.dtsi +index 896d92032284b..cd9b92144a42c 100644 +--- a/arch/arm64/boot/dts/st/stm32mp251.dtsi ++++ b/arch/arm64/boot/dts/st/stm32mp251.dtsi +@@ -118,9 +118,9 @@ + #interrupt-cells = <3>; + interrupt-controller; + reg = <0x0 0x4ac10000 0x0 0x1000>, +- <0x0 0x4ac20000 0x0 0x2000>, +- <0x0 0x4ac40000 0x0 0x2000>, +- <0x0 0x4ac60000 0x0 0x2000>; ++ <0x0 0x4ac20000 0x0 0x20000>, ++ <0x0 0x4ac40000 0x0 0x20000>, ++ <0x0 0x4ac60000 0x0 0x20000>; + }; + + psci { +-- +2.39.5 + diff --git a/queue-6.12/drivers-base-handle-module_kobject-creation.patch b/queue-6.12/drivers-base-handle-module_kobject-creation.patch new file mode 100644 index 0000000000..a51989e14a --- /dev/null +++ b/queue-6.12/drivers-base-handle-module_kobject-creation.patch @@ -0,0 +1,65 @@ +From e053be066600cd3b4bc1b903905c09c9cd0760ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Feb 2025 10:49:30 -0800 +Subject: drivers: base: handle module_kobject creation + +From: Shyam Saini + +[ Upstream commit f95bbfe18512c5c018720468959edac056a17196 ] + +module_add_driver() relies on module_kset list for +/sys/module//drivers directory creation. + +Since, +commit 96a1a2412acba ("kernel/params.c: defer most of param_sysfs_init() to late_initcall time") +drivers which are initialized from subsys_initcall() or any other +higher precedence initcall couldn't find the related kobject entry +in the module_kset list because module_kset is not fully populated +by the time module_add_driver() refers it. As a consequence, +module_add_driver() returns early without calling make_driver_name(). +Therefore, /sys/module//drivers is never created. + +Fix this issue by letting module_add_driver() handle module_kobject +creation itself. + +Fixes: 96a1a2412acb ("kernel/params.c: defer most of param_sysfs_init() to late_initcall time") +Cc: stable@vger.kernel.org # requires all other patches from the series +Suggested-by: Rasmus Villemoes +Signed-off-by: Shyam Saini +Acked-by: Greg Kroah-Hartman +Link: https://lore.kernel.org/r/20250227184930.34163-5-shyamsaini@linux.microsoft.com +Signed-off-by: Petr Pavlu +Signed-off-by: Sasha Levin +--- + drivers/base/module.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/drivers/base/module.c b/drivers/base/module.c +index 5bc71bea883a0..218aaa0964552 100644 +--- a/drivers/base/module.c ++++ b/drivers/base/module.c +@@ -42,16 +42,13 @@ int module_add_driver(struct module *mod, const struct device_driver *drv) + if (mod) + mk = &mod->mkobj; + else if (drv->mod_name) { +- struct kobject *mkobj; +- +- /* Lookup built-in module entry in /sys/modules */ +- mkobj = kset_find_obj(module_kset, drv->mod_name); +- if (mkobj) { +- mk = container_of(mkobj, struct module_kobject, kobj); ++ /* Lookup or create built-in module entry in /sys/modules */ ++ mk = lookup_or_create_module_kobject(drv->mod_name); ++ if (mk) { + /* remember our module structure */ + drv->p->mkobj = mk; +- /* kset_find_obj took a reference */ +- kobject_put(mkobj); ++ /* lookup_or_create_module_kobject took a reference */ ++ kobject_put(&mk->kobj); + } + } + +-- +2.39.5 + diff --git a/queue-6.12/drm-amd-display-add-scoped-mutexes-for-amdgpu_dm_dhc.patch b/queue-6.12/drm-amd-display-add-scoped-mutexes-for-amdgpu_dm_dhc.patch new file mode 100644 index 0000000000..1ecc80088b --- /dev/null +++ b/queue-6.12/drm-amd-display-add-scoped-mutexes-for-amdgpu_dm_dhc.patch @@ -0,0 +1,205 @@ +From 1c7c0e7711e1f076810bebe48bed955fd9ba6ed8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Feb 2025 13:30:01 -0600 +Subject: drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp + +From: Mario Limonciello + +[ Upstream commit 6b675ab8efbf2bcee25be29e865455c56e246401 ] + +[Why] +Guards automatically release mutex when it goes out of scope making +code easier to follow. + +[How] +Replace all use of mutex_lock()/mutex_unlock() with guard(mutex). + +Reviewed-by: Alex Hung +Signed-off-by: Mario Limonciello +Signed-off-by: Tom Chung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Stable-dep-of: be593d9d91c5 ("drm/amd/display: Fix slab-use-after-free in hdcp") +Signed-off-by: Sasha Levin +--- + .../amd/display/amdgpu_dm/amdgpu_dm_hdcp.c | 37 +++++-------------- + 1 file changed, 10 insertions(+), 27 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c +index c0dc232440490..53796a74b7a65 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c +@@ -172,7 +172,7 @@ void hdcp_update_display(struct hdcp_workqueue *hdcp_work, + struct mod_hdcp_display_adjustment display_adjust; + unsigned int conn_index = aconnector->base.index; + +- mutex_lock(&hdcp_w->mutex); ++ guard(mutex)(&hdcp_w->mutex); + hdcp_w->aconnector[conn_index] = aconnector; + + memset(&link_adjust, 0, sizeof(link_adjust)); +@@ -209,7 +209,6 @@ void hdcp_update_display(struct hdcp_workqueue *hdcp_work, + mod_hdcp_update_display(&hdcp_w->hdcp, conn_index, &link_adjust, &display_adjust, &hdcp_w->output); + + process_output(hdcp_w); +- mutex_unlock(&hdcp_w->mutex); + } + + static void hdcp_remove_display(struct hdcp_workqueue *hdcp_work, +@@ -220,7 +219,7 @@ static void hdcp_remove_display(struct hdcp_workqueue *hdcp_work, + struct drm_connector_state *conn_state = aconnector->base.state; + unsigned int conn_index = aconnector->base.index; + +- mutex_lock(&hdcp_w->mutex); ++ guard(mutex)(&hdcp_w->mutex); + hdcp_w->aconnector[conn_index] = aconnector; + + /* the removal of display will invoke auth reset -> hdcp destroy and +@@ -239,7 +238,6 @@ static void hdcp_remove_display(struct hdcp_workqueue *hdcp_work, + mod_hdcp_remove_display(&hdcp_w->hdcp, aconnector->base.index, &hdcp_w->output); + + process_output(hdcp_w); +- mutex_unlock(&hdcp_w->mutex); + } + + void hdcp_reset_display(struct hdcp_workqueue *hdcp_work, unsigned int link_index) +@@ -247,7 +245,7 @@ void hdcp_reset_display(struct hdcp_workqueue *hdcp_work, unsigned int link_inde + struct hdcp_workqueue *hdcp_w = &hdcp_work[link_index]; + unsigned int conn_index; + +- mutex_lock(&hdcp_w->mutex); ++ guard(mutex)(&hdcp_w->mutex); + + mod_hdcp_reset_connection(&hdcp_w->hdcp, &hdcp_w->output); + +@@ -259,8 +257,6 @@ void hdcp_reset_display(struct hdcp_workqueue *hdcp_work, unsigned int link_inde + } + + process_output(hdcp_w); +- +- mutex_unlock(&hdcp_w->mutex); + } + + void hdcp_handle_cpirq(struct hdcp_workqueue *hdcp_work, unsigned int link_index) +@@ -277,7 +273,7 @@ static void event_callback(struct work_struct *work) + hdcp_work = container_of(to_delayed_work(work), struct hdcp_workqueue, + callback_dwork); + +- mutex_lock(&hdcp_work->mutex); ++ guard(mutex)(&hdcp_work->mutex); + + cancel_delayed_work(&hdcp_work->callback_dwork); + +@@ -285,8 +281,6 @@ static void event_callback(struct work_struct *work) + &hdcp_work->output); + + process_output(hdcp_work); +- +- mutex_unlock(&hdcp_work->mutex); + } + + static void event_property_update(struct work_struct *work) +@@ -323,7 +317,7 @@ static void event_property_update(struct work_struct *work) + continue; + + drm_modeset_lock(&dev->mode_config.connection_mutex, NULL); +- mutex_lock(&hdcp_work->mutex); ++ guard(mutex)(&hdcp_work->mutex); + + if (conn_state->commit) { + ret = wait_for_completion_interruptible_timeout(&conn_state->commit->hw_done, +@@ -355,7 +349,6 @@ static void event_property_update(struct work_struct *work) + drm_hdcp_update_content_protection(connector, + DRM_MODE_CONTENT_PROTECTION_DESIRED); + } +- mutex_unlock(&hdcp_work->mutex); + drm_modeset_unlock(&dev->mode_config.connection_mutex); + } + } +@@ -368,7 +361,7 @@ static void event_property_validate(struct work_struct *work) + struct amdgpu_dm_connector *aconnector; + unsigned int conn_index; + +- mutex_lock(&hdcp_work->mutex); ++ guard(mutex)(&hdcp_work->mutex); + + for (conn_index = 0; conn_index < AMDGPU_DM_MAX_DISPLAY_INDEX; + conn_index++) { +@@ -408,8 +401,6 @@ static void event_property_validate(struct work_struct *work) + schedule_work(&hdcp_work->property_update_work); + } + } +- +- mutex_unlock(&hdcp_work->mutex); + } + + static void event_watchdog_timer(struct work_struct *work) +@@ -420,7 +411,7 @@ static void event_watchdog_timer(struct work_struct *work) + struct hdcp_workqueue, + watchdog_timer_dwork); + +- mutex_lock(&hdcp_work->mutex); ++ guard(mutex)(&hdcp_work->mutex); + + cancel_delayed_work(&hdcp_work->watchdog_timer_dwork); + +@@ -429,8 +420,6 @@ static void event_watchdog_timer(struct work_struct *work) + &hdcp_work->output); + + process_output(hdcp_work); +- +- mutex_unlock(&hdcp_work->mutex); + } + + static void event_cpirq(struct work_struct *work) +@@ -439,13 +428,11 @@ static void event_cpirq(struct work_struct *work) + + hdcp_work = container_of(work, struct hdcp_workqueue, cpirq_work); + +- mutex_lock(&hdcp_work->mutex); ++ guard(mutex)(&hdcp_work->mutex); + + mod_hdcp_process_event(&hdcp_work->hdcp, MOD_HDCP_EVENT_CPIRQ, &hdcp_work->output); + + process_output(hdcp_work); +- +- mutex_unlock(&hdcp_work->mutex); + } + + void hdcp_destroy(struct kobject *kobj, struct hdcp_workqueue *hdcp_work) +@@ -479,7 +466,7 @@ static bool enable_assr(void *handle, struct dc_link *link) + + dtm_cmd = (struct ta_dtm_shared_memory *)psp->dtm_context.context.mem_context.shared_buf; + +- mutex_lock(&psp->dtm_context.mutex); ++ guard(mutex)(&psp->dtm_context.mutex); + memset(dtm_cmd, 0, sizeof(struct ta_dtm_shared_memory)); + + dtm_cmd->cmd_id = TA_DTM_COMMAND__TOPOLOGY_ASSR_ENABLE; +@@ -494,8 +481,6 @@ static bool enable_assr(void *handle, struct dc_link *link) + res = false; + } + +- mutex_unlock(&psp->dtm_context.mutex); +- + return res; + } + +@@ -557,13 +542,11 @@ static void update_config(void *handle, struct cp_psp_stream_config *config) + (!!aconnector->base.state) ? + aconnector->base.state->hdcp_content_type : -1); + +- mutex_lock(&hdcp_w->mutex); ++ guard(mutex)(&hdcp_w->mutex); + + mod_hdcp_add_display(&hdcp_w->hdcp, link, display, &hdcp_w->output); + + process_output(hdcp_w); +- mutex_unlock(&hdcp_w->mutex); +- + } + + /** +-- +2.39.5 + diff --git a/queue-6.12/drm-amd-display-fix-slab-use-after-free-in-hdcp.patch b/queue-6.12/drm-amd-display-fix-slab-use-after-free-in-hdcp.patch new file mode 100644 index 0000000000..32840fdc9e --- /dev/null +++ b/queue-6.12/drm-amd-display-fix-slab-use-after-free-in-hdcp.patch @@ -0,0 +1,177 @@ +From 09005cf722ecfa5c74d1ed9f1d7ac34a466cb950 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Apr 2025 16:50:05 -0500 +Subject: drm/amd/display: Fix slab-use-after-free in hdcp + +From: Chris Bainbridge + +[ Upstream commit be593d9d91c5a3a363d456b9aceb71029aeb3f1d ] + +The HDCP code in amdgpu_dm_hdcp.c copies pointers to amdgpu_dm_connector +objects without incrementing the kref reference counts. When using a +USB-C dock, and the dock is unplugged, the corresponding +amdgpu_dm_connector objects are freed, creating dangling pointers in the +HDCP code. When the dock is plugged back, the dangling pointers are +dereferenced, resulting in a slab-use-after-free: + +[ 66.775837] BUG: KASAN: slab-use-after-free in event_property_validate+0x42f/0x6c0 [amdgpu] +[ 66.776171] Read of size 4 at addr ffff888127804120 by task kworker/0:1/10 + +[ 66.776179] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.14.0-rc7-00180-g54505f727a38-dirty #233 +[ 66.776183] Hardware name: HP HP Pavilion Aero Laptop 13-be0xxx/8916, BIOS F.17 12/18/2024 +[ 66.776186] Workqueue: events event_property_validate [amdgpu] +[ 66.776494] Call Trace: +[ 66.776496] +[ 66.776497] dump_stack_lvl+0x70/0xa0 +[ 66.776504] print_report+0x175/0x555 +[ 66.776507] ? __virt_addr_valid+0x243/0x450 +[ 66.776510] ? kasan_complete_mode_report_info+0x66/0x1c0 +[ 66.776515] kasan_report+0xeb/0x1c0 +[ 66.776518] ? event_property_validate+0x42f/0x6c0 [amdgpu] +[ 66.776819] ? event_property_validate+0x42f/0x6c0 [amdgpu] +[ 66.777121] __asan_report_load4_noabort+0x14/0x20 +[ 66.777124] event_property_validate+0x42f/0x6c0 [amdgpu] +[ 66.777342] ? __lock_acquire+0x6b40/0x6b40 +[ 66.777347] ? enable_assr+0x250/0x250 [amdgpu] +[ 66.777571] process_one_work+0x86b/0x1510 +[ 66.777575] ? pwq_dec_nr_in_flight+0xcf0/0xcf0 +[ 66.777578] ? assign_work+0x16b/0x280 +[ 66.777580] ? lock_is_held_type+0xa3/0x130 +[ 66.777583] worker_thread+0x5c0/0xfa0 +[ 66.777587] ? process_one_work+0x1510/0x1510 +[ 66.777588] kthread+0x3a2/0x840 +[ 66.777591] ? kthread_is_per_cpu+0xd0/0xd0 +[ 66.777594] ? trace_hardirqs_on+0x4f/0x60 +[ 66.777597] ? _raw_spin_unlock_irq+0x27/0x60 +[ 66.777599] ? calculate_sigpending+0x77/0xa0 +[ 66.777602] ? kthread_is_per_cpu+0xd0/0xd0 +[ 66.777605] ret_from_fork+0x40/0x90 +[ 66.777607] ? kthread_is_per_cpu+0xd0/0xd0 +[ 66.777609] ret_from_fork_asm+0x11/0x20 +[ 66.777614] + +[ 66.777643] Allocated by task 10: +[ 66.777646] kasan_save_stack+0x39/0x60 +[ 66.777649] kasan_save_track+0x14/0x40 +[ 66.777652] kasan_save_alloc_info+0x37/0x50 +[ 66.777655] __kasan_kmalloc+0xbb/0xc0 +[ 66.777658] __kmalloc_cache_noprof+0x1c8/0x4b0 +[ 66.777661] dm_dp_add_mst_connector+0xdd/0x5c0 [amdgpu] +[ 66.777880] drm_dp_mst_port_add_connector+0x47e/0x770 [drm_display_helper] +[ 66.777892] drm_dp_send_link_address+0x1554/0x2bf0 [drm_display_helper] +[ 66.777901] drm_dp_check_and_send_link_address+0x187/0x1f0 [drm_display_helper] +[ 66.777909] drm_dp_mst_link_probe_work+0x2b8/0x410 [drm_display_helper] +[ 66.777917] process_one_work+0x86b/0x1510 +[ 66.777919] worker_thread+0x5c0/0xfa0 +[ 66.777922] kthread+0x3a2/0x840 +[ 66.777925] ret_from_fork+0x40/0x90 +[ 66.777927] ret_from_fork_asm+0x11/0x20 + +[ 66.777932] Freed by task 1713: +[ 66.777935] kasan_save_stack+0x39/0x60 +[ 66.777938] kasan_save_track+0x14/0x40 +[ 66.777940] kasan_save_free_info+0x3b/0x60 +[ 66.777944] __kasan_slab_free+0x52/0x70 +[ 66.777946] kfree+0x13f/0x4b0 +[ 66.777949] dm_dp_mst_connector_destroy+0xfa/0x150 [amdgpu] +[ 66.778179] drm_connector_free+0x7d/0xb0 +[ 66.778184] drm_mode_object_put.part.0+0xee/0x160 +[ 66.778188] drm_mode_object_put+0x37/0x50 +[ 66.778191] drm_atomic_state_default_clear+0x220/0xd60 +[ 66.778194] __drm_atomic_state_free+0x16e/0x2a0 +[ 66.778197] drm_mode_atomic_ioctl+0x15ed/0x2ba0 +[ 66.778200] drm_ioctl_kernel+0x17a/0x310 +[ 66.778203] drm_ioctl+0x584/0xd10 +[ 66.778206] amdgpu_drm_ioctl+0xd2/0x1c0 [amdgpu] +[ 66.778375] __x64_sys_ioctl+0x139/0x1a0 +[ 66.778378] x64_sys_call+0xee7/0xfb0 +[ 66.778381] do_syscall_64+0x87/0x140 +[ 66.778385] entry_SYSCALL_64_after_hwframe+0x4b/0x53 + +Fix this by properly incrementing and decrementing the reference counts +when making and deleting copies of the amdgpu_dm_connector pointers. + +(Mario: rebase on current code and update fixes tag) + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4006 +Signed-off-by: Chris Bainbridge +Fixes: da3fd7ac0bcf3 ("drm/amd/display: Update CP property based on HW query") +Reviewed-by: Alex Hung +Link: https://lore.kernel.org/r/20250417215005.37964-1-mario.limonciello@amd.com +Signed-off-by: Mario Limonciello +Signed-off-by: Alex Deucher +(cherry picked from commit d4673f3c3b3dcb74e36e53cdfc880baa7a87b330) +Cc: stable@vger.kernel.org +Signed-off-by: Sasha Levin +--- + .../amd/display/amdgpu_dm/amdgpu_dm_hdcp.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c +index 53796a74b7a65..10ba4d7bf6325 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c +@@ -173,6 +173,9 @@ void hdcp_update_display(struct hdcp_workqueue *hdcp_work, + unsigned int conn_index = aconnector->base.index; + + guard(mutex)(&hdcp_w->mutex); ++ drm_connector_get(&aconnector->base); ++ if (hdcp_w->aconnector[conn_index]) ++ drm_connector_put(&hdcp_w->aconnector[conn_index]->base); + hdcp_w->aconnector[conn_index] = aconnector; + + memset(&link_adjust, 0, sizeof(link_adjust)); +@@ -220,7 +223,6 @@ static void hdcp_remove_display(struct hdcp_workqueue *hdcp_work, + unsigned int conn_index = aconnector->base.index; + + guard(mutex)(&hdcp_w->mutex); +- hdcp_w->aconnector[conn_index] = aconnector; + + /* the removal of display will invoke auth reset -> hdcp destroy and + * we'd expect the Content Protection (CP) property changed back to +@@ -236,7 +238,10 @@ static void hdcp_remove_display(struct hdcp_workqueue *hdcp_work, + } + + mod_hdcp_remove_display(&hdcp_w->hdcp, aconnector->base.index, &hdcp_w->output); +- ++ if (hdcp_w->aconnector[conn_index]) { ++ drm_connector_put(&hdcp_w->aconnector[conn_index]->base); ++ hdcp_w->aconnector[conn_index] = NULL; ++ } + process_output(hdcp_w); + } + +@@ -254,6 +259,10 @@ void hdcp_reset_display(struct hdcp_workqueue *hdcp_work, unsigned int link_inde + for (conn_index = 0; conn_index < AMDGPU_DM_MAX_DISPLAY_INDEX; conn_index++) { + hdcp_w->encryption_status[conn_index] = + MOD_HDCP_ENCRYPTION_STATUS_HDCP_OFF; ++ if (hdcp_w->aconnector[conn_index]) { ++ drm_connector_put(&hdcp_w->aconnector[conn_index]->base); ++ hdcp_w->aconnector[conn_index] = NULL; ++ } + } + + process_output(hdcp_w); +@@ -489,6 +498,7 @@ static void update_config(void *handle, struct cp_psp_stream_config *config) + struct hdcp_workqueue *hdcp_work = handle; + struct amdgpu_dm_connector *aconnector = config->dm_stream_ctx; + int link_index = aconnector->dc_link->link_index; ++ unsigned int conn_index = aconnector->base.index; + struct mod_hdcp_display *display = &hdcp_work[link_index].display; + struct mod_hdcp_link *link = &hdcp_work[link_index].link; + struct hdcp_workqueue *hdcp_w = &hdcp_work[link_index]; +@@ -545,7 +555,10 @@ static void update_config(void *handle, struct cp_psp_stream_config *config) + guard(mutex)(&hdcp_w->mutex); + + mod_hdcp_add_display(&hdcp_w->hdcp, link, display, &hdcp_w->output); +- ++ drm_connector_get(&aconnector->base); ++ if (hdcp_w->aconnector[conn_index]) ++ drm_connector_put(&hdcp_w->aconnector[conn_index]->base); ++ hdcp_w->aconnector[conn_index] = aconnector; + process_output(hdcp_w); + } + +-- +2.39.5 + diff --git a/queue-6.12/firmware-arm_ffa-skip-rx-buffer-ownership-release-if.patch b/queue-6.12/firmware-arm_ffa-skip-rx-buffer-ownership-release-if.patch new file mode 100644 index 0000000000..4dde12a646 --- /dev/null +++ b/queue-6.12/firmware-arm_ffa-skip-rx-buffer-ownership-release-if.patch @@ -0,0 +1,52 @@ +From 6fc4e698f0fc904a79837ac42a5e483e65be3a05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Mar 2025 11:57:00 +0000 +Subject: firmware: arm_ffa: Skip Rx buffer ownership release if not acquired +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sudeep Holla + +[ Upstream commit 4567bdaaaaa1744da3d7da07d9aca2f941f5b4e5 ] + +Completion of the FFA_PARTITION_INFO_GET ABI transfers the ownership of +the caller’s Rx buffer from the producer(typically partition mnager) to +the consumer(this driver/OS). FFA_RX_RELEASE transfers the ownership +from the consumer back to the producer. + +However, when we set the flag to just return the count of partitions +deployed in the system corresponding to the specified UUID while +invoking FFA_PARTITION_INFO_GET, the Rx buffer ownership shouldn't be +transferred to this driver. We must be able to skip transferring back +the ownership to the partition manager when we request just to get the +count of the partitions as the buffers are not acquired in this case. + +Firmware may return FFA_RET_DENIED or other error for the ffa_rx_release() +in such cases. + +Fixes: bb1be7498500 ("firmware: arm_ffa: Add v1.1 get_partition_info support") +Message-Id: <20250321115700.3525197-1-sudeep.holla@arm.com> +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_ffa/driver.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c +index 2c2ec3c35f156..dce448687e28e 100644 +--- a/drivers/firmware/arm_ffa/driver.c ++++ b/drivers/firmware/arm_ffa/driver.c +@@ -280,7 +280,8 @@ __ffa_partition_info_get(u32 uuid0, u32 uuid1, u32 uuid2, u32 uuid3, + memcpy(buffer + idx, drv_info->rx_buffer + idx * sz, + buf_sz); + +- ffa_rx_release(); ++ if (!(flags & PARTITION_INFO_GET_RETURN_COUNT_ONLY)) ++ ffa_rx_release(); + + mutex_unlock(&drv_info->rx_lock); + +-- +2.39.5 + diff --git a/queue-6.12/firmware-arm_scmi-balance-device-refcount-when-destr.patch b/queue-6.12/firmware-arm_scmi-balance-device-refcount-when-destr.patch new file mode 100644 index 0000000000..da3057e1cd --- /dev/null +++ b/queue-6.12/firmware-arm_scmi-balance-device-refcount-when-destr.patch @@ -0,0 +1,86 @@ +From 050fd4c869774c5faebc72adbb5ed11c2d071dec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Mar 2025 18:54:47 +0000 +Subject: firmware: arm_scmi: Balance device refcount when destroying devices + +From: Cristian Marussi + +[ Upstream commit 9ca67840c0ddf3f39407339624cef824a4f27599 ] + +Using device_find_child() to lookup the proper SCMI device to destroy +causes an unbalance in device refcount, since device_find_child() calls an +implicit get_device(): this, in turns, inhibits the call of the provided +release methods upon devices destruction. + +As a consequence, one of the structures that is not freed properly upon +destruction is the internal struct device_private dev->p populated by the +drivers subsystem core. + +KMemleak detects this situation since loading/unloding some SCMI driver +causes related devices to be created/destroyed without calling any +device_release method. + +unreferenced object 0xffff00000f583800 (size 512): + comm "insmod", pid 227, jiffies 4294912190 + hex dump (first 32 bytes): + 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... + ff ff ff ff ff ff ff ff 60 36 1d 8a 00 80 ff ff ........`6...... + backtrace (crc 114e2eed): + kmemleak_alloc+0xbc/0xd8 + __kmalloc_cache_noprof+0x2dc/0x398 + device_add+0x954/0x12d0 + device_register+0x28/0x40 + __scmi_device_create.part.0+0x1bc/0x380 + scmi_device_create+0x2d0/0x390 + scmi_create_protocol_devices+0x74/0xf8 + scmi_device_request_notifier+0x1f8/0x2a8 + notifier_call_chain+0x110/0x3b0 + blocking_notifier_call_chain+0x70/0xb0 + scmi_driver_register+0x350/0x7f0 + 0xffff80000a3b3038 + do_one_initcall+0x12c/0x730 + do_init_module+0x1dc/0x640 + load_module+0x4b20/0x5b70 + init_module_from_file+0xec/0x158 + +$ ./scripts/faddr2line ./vmlinux device_add+0x954/0x12d0 +device_add+0x954/0x12d0: +kmalloc_noprof at include/linux/slab.h:901 +(inlined by) kzalloc_noprof at include/linux/slab.h:1037 +(inlined by) device_private_init at drivers/base/core.c:3510 +(inlined by) device_add at drivers/base/core.c:3561 + +Balance device refcount by issuing a put_device() on devices found via +device_find_child(). + +Reported-by: Alice Ryhl +Closes: https://lore.kernel.org/linux-arm-kernel/Z8nK3uFkspy61yjP@arm.com/T/#mc1f73a0ea5e41014fa145147b7b839fc988ada8f +CC: Sudeep Holla +CC: Catalin Marinas +Fixes: d4f9dddd21f3 ("firmware: arm_scmi: Add dynamic scmi devices creation") +Signed-off-by: Cristian Marussi +Tested-by: Alice Ryhl +Message-Id: <20250306185447.2039336-1-cristian.marussi@arm.com> +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/bus.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/firmware/arm_scmi/bus.c b/drivers/firmware/arm_scmi/bus.c +index 157172a5f2b57..782c9bec8361c 100644 +--- a/drivers/firmware/arm_scmi/bus.c ++++ b/drivers/firmware/arm_scmi/bus.c +@@ -260,6 +260,9 @@ static struct scmi_device *scmi_child_dev_find(struct device *parent, + if (!dev) + return NULL; + ++ /* Drop the refcnt bumped implicitly by device_find_child */ ++ put_device(dev); ++ + return to_scmi_dev(dev); + } + +-- +2.39.5 + diff --git a/queue-6.12/kernel-globalize-lookup_or_create_module_kobject.patch b/queue-6.12/kernel-globalize-lookup_or_create_module_kobject.patch new file mode 100644 index 0000000000..83382d306a --- /dev/null +++ b/queue-6.12/kernel-globalize-lookup_or_create_module_kobject.patch @@ -0,0 +1,55 @@ +From fa6b589d9f6eabb087f0304d379922e6439306f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Feb 2025 10:49:29 -0800 +Subject: kernel: globalize lookup_or_create_module_kobject() + +From: Shyam Saini + +[ Upstream commit 7c76c813cfc42a7376378a0c4b7250db2eebab81 ] + +lookup_or_create_module_kobject() is marked as static and __init, +to make it global drop static keyword. +Since this function can be called from non-init code, use __modinit +instead of __init, __modinit marker will make it __init if +CONFIG_MODULES is not defined. + +Suggested-by: Rasmus Villemoes +Signed-off-by: Shyam Saini +Link: https://lore.kernel.org/r/20250227184930.34163-4-shyamsaini@linux.microsoft.com +Signed-off-by: Petr Pavlu +Stable-dep-of: f95bbfe18512 ("drivers: base: handle module_kobject creation") +Signed-off-by: Sasha Levin +--- + include/linux/module.h | 2 ++ + kernel/params.c | 2 +- + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/include/linux/module.h b/include/linux/module.h +index 88ecc5e9f5230..82a9527d43c76 100644 +--- a/include/linux/module.h ++++ b/include/linux/module.h +@@ -162,6 +162,8 @@ extern void cleanup_module(void); + #define __INITRODATA_OR_MODULE __INITRODATA + #endif /*CONFIG_MODULES*/ + ++struct module_kobject *lookup_or_create_module_kobject(const char *name); ++ + /* Generic info of form tag = "info" */ + #define MODULE_INFO(tag, info) __MODULE_INFO(tag, tag, info) + +diff --git a/kernel/params.c b/kernel/params.c +index d62a116918cd0..33b2985b31c7f 100644 +--- a/kernel/params.c ++++ b/kernel/params.c +@@ -763,7 +763,7 @@ void destroy_params(const struct kernel_param *params, unsigned num) + params[i].ops->free(params[i].arg); + } + +-static struct module_kobject * __init lookup_or_create_module_kobject(const char *name) ++struct module_kobject __modinit * lookup_or_create_module_kobject(const char *name) + { + struct module_kobject *mk; + struct kobject *kobj; +-- +2.39.5 + diff --git a/queue-6.12/kernel-param-rename-locate_module_kobject.patch b/queue-6.12/kernel-param-rename-locate_module_kobject.patch new file mode 100644 index 0000000000..8a2e24ba3a --- /dev/null +++ b/queue-6.12/kernel-param-rename-locate_module_kobject.patch @@ -0,0 +1,62 @@ +From f65b643454e7dd9d3c6e772b56243eb9715a473f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Feb 2025 10:49:27 -0800 +Subject: kernel: param: rename locate_module_kobject + +From: Shyam Saini + +[ Upstream commit bbc9462f0cb0c8917a4908e856731708f0cee910 ] + +The locate_module_kobject() function looks up an existing +module_kobject for a given module name. If it cannot find the +corresponding module_kobject, it creates one for the given name. + +This commit renames locate_module_kobject() to +lookup_or_create_module_kobject() to better describe its operations. + +This doesn't change anything functionality wise. + +Suggested-by: Rasmus Villemoes +Signed-off-by: Shyam Saini +Link: https://lore.kernel.org/r/20250227184930.34163-2-shyamsaini@linux.microsoft.com +Signed-off-by: Petr Pavlu +Stable-dep-of: f95bbfe18512 ("drivers: base: handle module_kobject creation") +Signed-off-by: Sasha Levin +--- + kernel/params.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/kernel/params.c b/kernel/params.c +index 2e447f8ae183e..d62a116918cd0 100644 +--- a/kernel/params.c ++++ b/kernel/params.c +@@ -763,7 +763,7 @@ void destroy_params(const struct kernel_param *params, unsigned num) + params[i].ops->free(params[i].arg); + } + +-static struct module_kobject * __init locate_module_kobject(const char *name) ++static struct module_kobject * __init lookup_or_create_module_kobject(const char *name) + { + struct module_kobject *mk; + struct kobject *kobj; +@@ -805,7 +805,7 @@ static void __init kernel_add_sysfs_param(const char *name, + struct module_kobject *mk; + int err; + +- mk = locate_module_kobject(name); ++ mk = lookup_or_create_module_kobject(name); + if (!mk) + return; + +@@ -876,7 +876,7 @@ static void __init version_sysfs_builtin(void) + int err; + + for (vattr = __start___modver; vattr < __stop___modver; vattr++) { +- mk = locate_module_kobject(vattr->module_name); ++ mk = lookup_or_create_module_kobject(vattr->module_name); + if (mk) { + err = sysfs_create_file(&mk->kobj, &vattr->mattr.attr); + WARN_ON_ONCE(err); +-- +2.39.5 + diff --git a/queue-6.12/revert-drm-meson-vclk-fix-calculation-of-59.94-fract.patch b/queue-6.12/revert-drm-meson-vclk-fix-calculation-of-59.94-fract.patch new file mode 100644 index 0000000000..4a00b3fb8e --- /dev/null +++ b/queue-6.12/revert-drm-meson-vclk-fix-calculation-of-59.94-fract.patch @@ -0,0 +1,61 @@ +From dbf2808610fb8d705718d7a473c4fec07d7b64fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Apr 2025 22:12:59 +0200 +Subject: Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" + +From: Christian Hewitt + +[ Upstream commit f37bb5486ea536c1d61df89feeaeff3f84f0b560 ] + +This reverts commit bfbc68e. + +The patch does permit the offending YUV420 @ 59.94 phy_freq and +vclk_freq mode to match in calculations. It also results in all +fractional rates being unavailable for use. This was unintended +and requires the patch to be reverted. + +Fixes: bfbc68e4d869 ("drm/meson: vclk: fix calculation of 59.94 fractional rates") +Cc: stable@vger.kernel.org +Signed-off-by: Christian Hewitt +Signed-off-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20250421201300.778955-2-martin.blumenstingl@googlemail.com +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20250421201300.778955-2-martin.blumenstingl@googlemail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/meson/meson_vclk.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/meson/meson_vclk.c b/drivers/gpu/drm/meson/meson_vclk.c +index 2a942dc6a6dc2..2a82119eb58ed 100644 +--- a/drivers/gpu/drm/meson/meson_vclk.c ++++ b/drivers/gpu/drm/meson/meson_vclk.c +@@ -790,13 +790,13 @@ meson_vclk_vic_supported_freq(struct meson_drm *priv, unsigned int phy_freq, + FREQ_1000_1001(params[i].pixel_freq)); + DRM_DEBUG_DRIVER("i = %d phy_freq = %d alt = %d\n", + i, params[i].phy_freq, +- FREQ_1000_1001(params[i].phy_freq/1000)*1000); ++ FREQ_1000_1001(params[i].phy_freq/10)*10); + /* Match strict frequency */ + if (phy_freq == params[i].phy_freq && + vclk_freq == params[i].vclk_freq) + return MODE_OK; + /* Match 1000/1001 variant */ +- if (phy_freq == (FREQ_1000_1001(params[i].phy_freq/1000)*1000) && ++ if (phy_freq == (FREQ_1000_1001(params[i].phy_freq/10)*10) && + vclk_freq == FREQ_1000_1001(params[i].vclk_freq)) + return MODE_OK; + } +@@ -1070,7 +1070,7 @@ void meson_vclk_setup(struct meson_drm *priv, unsigned int target, + + for (freq = 0 ; params[freq].pixel_freq ; ++freq) { + if ((phy_freq == params[freq].phy_freq || +- phy_freq == FREQ_1000_1001(params[freq].phy_freq/1000)*1000) && ++ phy_freq == FREQ_1000_1001(params[freq].phy_freq/10)*10) && + (vclk_freq == params[freq].vclk_freq || + vclk_freq == FREQ_1000_1001(params[freq].vclk_freq))) { + if (vclk_freq != params[freq].vclk_freq) +-- +2.39.5 + diff --git a/queue-6.12/series b/queue-6.12/series index 4241a8d830..26fd96065e 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -150,3 +150,15 @@ sch_hfsc-make-hfsc_qlen_notify-idempotent.patch sch_qfq-make-qfq_qlen_notify-idempotent.patch sch_ets-make-est_qlen_notify-idempotent.patch drm-xe-ensure-fixed_slice_mode-gets-set-after-ccs_mode-change.patch +firmware-arm_scmi-balance-device-refcount-when-destr.patch +firmware-arm_ffa-skip-rx-buffer-ownership-release-if.patch +arm64-dts-imx95-correct-the-range-of-pcie-app-reg-re.patch +arm-dts-opos6ul-add-ksz8081-phy-properties.patch +arm64-dts-st-adjust-interrupt-controller-for-stm32mp.patch +arm64-dts-st-use-128kb-size-for-aliased-gic400-regis.patch +revert-drm-meson-vclk-fix-calculation-of-59.94-fract.patch +kernel-param-rename-locate_module_kobject.patch +kernel-globalize-lookup_or_create_module_kobject.patch +drivers-base-handle-module_kobject-creation.patch +drm-amd-display-add-scoped-mutexes-for-amdgpu_dm_dhc.patch +drm-amd-display-fix-slab-use-after-free-in-hdcp.patch -- 2.47.3