--- /dev/null
+From 95d0883ac8105717f59c2dcdc0d8b9150f13aa12 Mon Sep 17 00:00:00 2001
+From: Xin Wang <x.wang@intel.com>
+Date: Tue, 26 Aug 2025 17:06:33 -0700
+Subject: drm/xe: Ensure GT is in C0 during resumes
+
+From: Xin Wang <x.wang@intel.com>
+
+commit 95d0883ac8105717f59c2dcdc0d8b9150f13aa12 upstream.
+
+This patch ensures the gt will be awake for the entire duration
+of the resume sequences until GuCRC takes over and GT-C6 gets
+re-enabled.
+
+Before suspending GT-C6 is kept enabled, but upon resume, GuCRC
+is not yet alive to properly control the exits and some cases of
+instability and corruption related to GT-C6 can be observed.
+
+Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4037
+
+Suggested-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Xin Wang <x.wang@intel.com>
+Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4037
+Link: https://lore.kernel.org/r/20250827000633.1369890-3-x.wang@intel.com
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/xe_pm.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/xe/xe_pm.c
++++ b/drivers/gpu/drm/xe/xe_pm.c
+@@ -17,7 +17,7 @@
+ #include "xe_device_sysfs.h"
+ #include "xe_ggtt.h"
+ #include "xe_gt.h"
+-#include "xe_guc.h"
++#include "xe_gt_idle.h"
+ #include "xe_irq.h"
+ #include "xe_pcode.h"
+ #include "xe_trace.h"
+@@ -165,6 +165,9 @@ int xe_pm_resume(struct xe_device *xe)
+ drm_dbg(&xe->drm, "Resuming device\n");
+ trace_xe_pm_resume(xe, __builtin_return_address(0));
+
++ for_each_gt(gt, xe, id)
++ xe_gt_idle_disable_c6(gt);
++
+ for_each_tile(tile, xe, id)
+ xe_wa_apply_tile_workarounds(tile);
+
+@@ -451,6 +454,9 @@ int xe_pm_runtime_resume(struct xe_devic
+
+ xe_rpm_lockmap_acquire(xe);
+
++ for_each_gt(gt, xe, id)
++ xe_gt_idle_disable_c6(gt);
++
+ if (xe->d3cold.allowed) {
+ err = xe_pcode_ready(xe, true);
+ if (err)
--- /dev/null
+From 1313351e71181a4818afeb8dfe202e4162091ef6 Mon Sep 17 00:00:00 2001
+From: Xin Wang <x.wang@intel.com>
+Date: Tue, 26 Aug 2025 17:06:32 -0700
+Subject: drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally
+
+From: Xin Wang <x.wang@intel.com>
+
+commit 1313351e71181a4818afeb8dfe202e4162091ef6 upstream.
+
+Move forcewake_get() into xe_gt_idle_enable_c6() to streamline the
+code and make it easier to use.
+
+Suggested-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Xin Wang <x.wang@intel.com>
+Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Link: https://lore.kernel.org/r/20250827000633.1369890-2-x.wang@intel.com
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/xe_gt_idle.c | 20 +++++++++++++-------
+ drivers/gpu/drm/xe/xe_gt_idle.h | 2 +-
+ drivers/gpu/drm/xe/xe_guc_pc.c | 10 +---------
+ 3 files changed, 15 insertions(+), 17 deletions(-)
+
+--- a/drivers/gpu/drm/xe/xe_gt_idle.c
++++ b/drivers/gpu/drm/xe/xe_gt_idle.c
+@@ -204,11 +204,8 @@ static void gt_idle_fini(void *arg)
+
+ xe_gt_idle_disable_pg(gt);
+
+- if (gt_to_xe(gt)->info.skip_guc_pc) {
+- XE_WARN_ON(xe_force_wake_get(gt_to_fw(gt), XE_FW_GT));
++ if (gt_to_xe(gt)->info.skip_guc_pc)
+ xe_gt_idle_disable_c6(gt);
+- xe_force_wake_put(gt_to_fw(gt), XE_FW_GT);
+- }
+
+ sysfs_remove_files(kobj, gt_idle_attrs);
+ kobject_put(kobj);
+@@ -266,14 +263,23 @@ void xe_gt_idle_enable_c6(struct xe_gt *
+ RC_CTL_HW_ENABLE | RC_CTL_TO_MODE | RC_CTL_RC6_ENABLE);
+ }
+
+-void xe_gt_idle_disable_c6(struct xe_gt *gt)
++int xe_gt_idle_disable_c6(struct xe_gt *gt)
+ {
++ unsigned int fw_ref;
++
+ xe_device_assert_mem_access(gt_to_xe(gt));
+- xe_force_wake_assert_held(gt_to_fw(gt), XE_FW_GT);
+
+ if (IS_SRIOV_VF(gt_to_xe(gt)))
+- return;
++ return 0;
++
++ fw_ref = xe_force_wake_get(gt_to_fw(gt), XE_FW_GT);
++ if (!fw_ref)
++ return -ETIMEDOUT;
+
+ xe_mmio_write32(gt, RC_CONTROL, 0);
+ xe_mmio_write32(gt, RC_STATE, 0);
++
++ xe_force_wake_put(gt_to_fw(gt), fw_ref);
++
++ return 0;
+ }
+--- a/drivers/gpu/drm/xe/xe_gt_idle.h
++++ b/drivers/gpu/drm/xe/xe_gt_idle.h
+@@ -12,7 +12,7 @@ struct xe_gt;
+
+ int xe_gt_idle_init(struct xe_gt_idle *gtidle);
+ void xe_gt_idle_enable_c6(struct xe_gt *gt);
+-void xe_gt_idle_disable_c6(struct xe_gt *gt);
++int xe_gt_idle_disable_c6(struct xe_gt *gt);
+ void xe_gt_idle_enable_pg(struct xe_gt *gt);
+ void xe_gt_idle_disable_pg(struct xe_gt *gt);
+
+--- a/drivers/gpu/drm/xe/xe_guc_pc.c
++++ b/drivers/gpu/drm/xe/xe_guc_pc.c
+@@ -1008,15 +1008,7 @@ int xe_guc_pc_gucrc_disable(struct xe_gu
+ if (ret)
+ return ret;
+
+- ret = xe_force_wake_get(gt_to_fw(gt), XE_FORCEWAKE_ALL);
+- if (ret)
+- return ret;
+-
+- xe_gt_idle_disable_c6(gt);
+-
+- XE_WARN_ON(xe_force_wake_put(gt_to_fw(gt), XE_FORCEWAKE_ALL));
+-
+- return 0;
++ return xe_gt_idle_disable_c6(gt);
+ }
+
+ /**
libceph-return-the-handler-error-from-mon_handle_auth_done.patch
libceph-reset-sparse-read-state-in-osd_fault.patch
libceph-make-calc_target-set-t-paused-not-just-clear-it.patch
+tls-use-__sk_dst_get-and-dst_dev_rcu-in-get_netdev_for_sock.patch
+drm-xe-make-xe_gt_idle_disable_c6-handle-the-forcewake-internally.patch
+drm-xe-ensure-gt-is-in-c0-during-resumes.patch
--- /dev/null
+From c65f27b9c3be2269918e1cbad6d8884741f835c5 Mon Sep 17 00:00:00 2001
+From: Kuniyuki Iwashima <kuniyu@google.com>
+Date: Tue, 16 Sep 2025 21:47:23 +0000
+Subject: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+commit c65f27b9c3be2269918e1cbad6d8884741f835c5 upstream.
+
+get_netdev_for_sock() is called during setsockopt(),
+so not under RCU.
+
+Using sk_dst_get(sk)->dev could trigger UAF.
+
+Let's use __sk_dst_get() and dst_dev_rcu().
+
+Note that the only ->ndo_sk_get_lower_dev() user is
+bond_sk_get_lower_dev(), which uses RCU.
+
+Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure")
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/20250916214758.650211-6-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+[ Keerthana: Backport to v6.12.y ]
+Signed-off-by: Keerthana K <keerthana.kalyanasundaram@broadcom.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/tls/tls_device.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+--- a/net/tls/tls_device.c
++++ b/net/tls/tls_device.c
+@@ -123,17 +123,19 @@ static void tls_device_queue_ctx_destruc
+ /* We assume that the socket is already connected */
+ static struct net_device *get_netdev_for_sock(struct sock *sk)
+ {
+- struct dst_entry *dst = sk_dst_get(sk);
+- struct net_device *netdev = NULL;
++ struct net_device *dev, *lowest_dev = NULL;
++ struct dst_entry *dst;
+
+- if (likely(dst)) {
+- netdev = netdev_sk_get_lowest_dev(dst->dev, sk);
+- dev_hold(netdev);
++ rcu_read_lock();
++ dst = __sk_dst_get(sk);
++ dev = dst ? dst_dev_rcu(dst) : NULL;
++ if (likely(dev)) {
++ lowest_dev = netdev_sk_get_lowest_dev(dev, sk);
++ dev_hold(lowest_dev);
+ }
++ rcu_read_unlock();
+
+- dst_release(dst);
+-
+- return netdev;
++ return lowest_dev;
+ }
+
+ static void destroy_record(struct tls_record_info *record)
projects / thirdparty / kernel / stable-queue.git / commitdiff
