5.10-stable patches

added patches:
	drm-msm-a6xx-fix-out-of-bound-io-access-in-a6xx_get_gmu_registers.patch
	drm-nouveau-dispnv50-don-t-call-drm_atomic_get_crtc_state-in-prepare_fb.patch

diff --git a/queue-5.10/drm-msm-a6xx-fix-out-of-bound-io-access-in-a6xx_get_gmu_registers.patch b/queue-5.10/drm-msm-a6xx-fix-out-of-bound-io-access-in-a6xx_get_gmu_registers.patch
new file mode 100644 (file)
index 0000000..859e1bc
--- /dev/null
+++ b/queue-5.10/drm-msm-a6xx-fix-out-of-bound-io-access-in-a6xx_get_gmu_registers.patch
@@ -0,0 +1,35 @@
+From 779b68a5bf2764c8ed3aa800e41ba0d5d007e1e7 Mon Sep 17 00:00:00 2001
+From: Akhil P Oommen <akhilpo@oss.qualcomm.com>
+Date: Tue, 18 Nov 2025 14:20:28 +0530
+Subject: drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers
+
+From: Akhil P Oommen <akhilpo@oss.qualcomm.com>
+
+commit 779b68a5bf2764c8ed3aa800e41ba0d5d007e1e7 upstream.
+
+REG_A6XX_GMU_AO_AHB_FENCE_CTRL register falls under GMU's register
+range. So, use gmu_write() routines to write to this register.
+
+Fixes: 1707add81551 ("drm/msm/a6xx: Add a6xx gpu state")
+Cc: stable@vger.kernel.org
+Signed-off-by: Akhil P Oommen <akhilpo@oss.qualcomm.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Patchwork: https://patchwork.freedesktop.org/patch/688993/
+Message-ID: <20251118-kaana-gpu-support-v4-1-86eeb8e93fb6@oss.qualcomm.com>
+Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c
+@@ -794,7 +794,7 @@ static void a6xx_get_gmu_registers(struc
+               return;
+ 
+       /* Set the fence to ALLOW mode so we can access the registers */
+-      gpu_write(gpu, REG_A6XX_GMU_AO_AHB_FENCE_CTRL, 0);
++      gmu_write(&a6xx_gpu->gmu, REG_A6XX_GMU_AO_AHB_FENCE_CTRL, 0);
+ 
+       _a6xx_get_gmu_registers(gpu, a6xx_state, &a6xx_gmu_reglist[2],
+               &a6xx_state->gmu_registers[2], false);

diff --git a/queue-5.10/drm-nouveau-dispnv50-don-t-call-drm_atomic_get_crtc_state-in-prepare_fb.patch b/queue-5.10/drm-nouveau-dispnv50-don-t-call-drm_atomic_get_crtc_state-in-prepare_fb.patch
new file mode 100644 (file)
index 0000000..42b6afc
--- /dev/null
+++ b/queue-5.10/drm-nouveau-dispnv50-don-t-call-drm_atomic_get_crtc_state-in-prepare_fb.patch
@@ -0,0 +1,63 @@
+From 560271e10b2c86e95ea35afa9e79822e4847f07a Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Thu, 11 Dec 2025 14:02:54 -0500
+Subject: drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb
+
+From: Lyude Paul <lyude@redhat.com>
+
+commit 560271e10b2c86e95ea35afa9e79822e4847f07a upstream.
+
+Since we recently started warning about uses of this function after the
+atomic check phase completes, we've started getting warnings about this in
+nouveau. It appears a misplaced drm_atomic_get_crtc_state() call has been
+hiding in our .prepare_fb callback for a while.
+
+So, fix this by adding a new nv50_head_atom_get_new() function and use that
+in our .prepare_fb callback instead.
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Reviewed-by: Dave Airlie <airlied@redhat.com>
+Fixes: 1590700d94ac ("drm/nouveau/kms/nv50-: split each resource type into their own source files")
+Cc: <stable@vger.kernel.org> # v4.18+
+Link: https://patch.msgid.link/20251211190256.396742-1-lyude@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/nouveau/dispnv50/atom.h |   13 +++++++++++++
+ drivers/gpu/drm/nouveau/dispnv50/wndw.c |    2 +-
+ 2 files changed, 14 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/nouveau/dispnv50/atom.h
++++ b/drivers/gpu/drm/nouveau/dispnv50/atom.h
+@@ -152,8 +152,21 @@ static inline struct nv50_head_atom *
+ nv50_head_atom_get(struct drm_atomic_state *state, struct drm_crtc *crtc)
+ {
+       struct drm_crtc_state *statec = drm_atomic_get_crtc_state(state, crtc);
++
+       if (IS_ERR(statec))
+               return (void *)statec;
++
++      return nv50_head_atom(statec);
++}
++
++static inline struct nv50_head_atom *
++nv50_head_atom_get_new(struct drm_atomic_state *state, struct drm_crtc *crtc)
++{
++      struct drm_crtc_state *statec = drm_atomic_get_new_crtc_state(state, crtc);
++
++      if (!statec)
++              return NULL;
++
+       return nv50_head_atom(statec);
+ }
+ 
+--- a/drivers/gpu/drm/nouveau/dispnv50/wndw.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/wndw.c
+@@ -561,7 +561,7 @@ nv50_wndw_prepare_fb(struct drm_plane *p
+       asyw->image.offset[0] = nvbo->offset;
+ 
+       if (wndw->func->prepare) {
+-              asyh = nv50_head_atom_get(asyw->state.state, asyw->state.crtc);
++              asyh = nv50_head_atom_get_new(asyw->state.state, asyw->state.crtc);
+               if (IS_ERR(asyh))
+                       return PTR_ERR(asyh);
+ 

diff --git a/queue-5.10/series b/queue-5.10/series
index 164472b1ff88e7cce7c6f6545434a17db093cd69..f2e7a8373989df53778cd75e5f914dd1a64c798f 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -334,3 +334,5 @@ nfsd-drop-the-client-reference-in-client_states_open.patch
 net-usb-sr9700-fix-incorrect-command-used-to-write-single-register.patch
 net-nfc-fix-deadlock-between-nfc_unregister_device-and-rfkill_fop_write.patch
 net-macb-relocate-mog_init_rings-callback-from-macb_mac_link_up-to-macb_open.patch
+drm-msm-a6xx-fix-out-of-bound-io-access-in-a6xx_get_gmu_registers.patch
+drm-nouveau-dispnv50-don-t-call-drm_atomic_get_crtc_state-in-prepare_fb.patch