--- /dev/null
+From 29891842154d7ebca97a94b0d5aaae94e560f61c Mon Sep 17 00:00:00 2001
+From: "Jesse.zhang@amd.com" <Jesse.zhang@amd.com>
+Date: Fri, 11 Apr 2025 13:01:19 +0800
+Subject: drm/amdgpu: Add the new sdma function pointers for amdgpu_sdma.h
+
+From: Jesse.zhang@amd.com <Jesse.zhang@amd.com>
+
+commit 29891842154d7ebca97a94b0d5aaae94e560f61c upstream.
+
+This patch introduces new function pointers in the amdgpu_sdma structure
+to handle queue stop, start and soft reset operations. These will replace
+the older callback mechanism.
+
+The new functions are:
+- stop_kernel_queue: Stops a specific SDMA queue
+- start_kernel_queue: Starts/Restores a specific SDMA queue
+- soft_reset_kernel_queue: Performs soft reset on a specific SDMA queue
+
+v2: Update stop_queue/start_queue function paramters to use ring pointer instead of device/instance(Chritian)
+v3: move stop_queue/start_queue to struct amdgpu_sdma_instance and rename them. (Alex)
+v4: rework the ordering a bit (Alex)
+
+Suggested-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: 09b585592fa4 ("drm/amdgpu: Fix SDMA engine reset with logical instance ID")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.h | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.h
+@@ -50,6 +50,12 @@ enum amdgpu_sdma_irq {
+
+ #define NUM_SDMA(x) hweight32(x)
+
++struct amdgpu_sdma_funcs {
++ int (*stop_kernel_queue)(struct amdgpu_ring *ring);
++ int (*start_kernel_queue)(struct amdgpu_ring *ring);
++ int (*soft_reset_kernel_queue)(struct amdgpu_device *adev, u32 instance_id);
++};
++
+ struct amdgpu_sdma_instance {
+ /* SDMA firmware */
+ const struct firmware *fw;
+@@ -68,7 +74,7 @@ struct amdgpu_sdma_instance {
+ /* track guilty state of GFX and PAGE queues */
+ bool gfx_guilty;
+ bool page_guilty;
+-
++ const struct amdgpu_sdma_funcs *funcs;
+ };
+
+ enum amdgpu_sdma_ras_memory_id {
--- /dev/null
+From 09b585592fa481384597c81388733aed4a04dd05 Mon Sep 17 00:00:00 2001
+From: Jesse Zhang <jesse.zhang@amd.com>
+Date: Wed, 11 Jun 2025 15:02:09 +0800
+Subject: drm/amdgpu: Fix SDMA engine reset with logical instance ID
+
+From: Jesse Zhang <jesse.zhang@amd.com>
+
+commit 09b585592fa481384597c81388733aed4a04dd05 upstream.
+
+This commit makes the following improvements to SDMA engine reset handling:
+
+1. Clarifies in the function documentation that instance_id refers to a logical ID
+2. Adds conversion from logical to physical instance ID before performing reset
+ using GET_INST(SDMA0, instance_id) macro
+3. Improves error messaging to indicate when a logical instance reset fails
+4. Adds better code organization with blank lines for readability
+
+The change ensures proper SDMA engine reset by using the correct physical
+instance ID while maintaining the logical ID interface for callers.
+
+V2: Remove harvest_config check and convert directly to physical instance (Lijo)
+
+Suggested-by: Jonathan Kim <jonathan.kim@amd.com>
+Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 5efa6217c239ed1ceec0f0414f9b6f6927387dfc)
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c
+@@ -572,8 +572,10 @@ static int amdgpu_sdma_soft_reset(struct
+ case IP_VERSION(4, 4, 2):
+ case IP_VERSION(4, 4, 4):
+ case IP_VERSION(4, 4, 5):
+- /* For SDMA 4.x, use the existing DPM interface for backward compatibility */
+- r = amdgpu_dpm_reset_sdma(adev, 1 << instance_id);
++ /* For SDMA 4.x, use the existing DPM interface for backward compatibility,
++ * we need to convert the logical instance ID to physical instance ID before reset.
++ */
++ r = amdgpu_dpm_reset_sdma(adev, 1 << GET_INST(SDMA0, instance_id));
+ break;
+ case IP_VERSION(5, 0, 0):
+ case IP_VERSION(5, 0, 1):
+@@ -600,7 +602,7 @@ static int amdgpu_sdma_soft_reset(struct
+ /**
+ * amdgpu_sdma_reset_engine - Reset a specific SDMA engine
+ * @adev: Pointer to the AMDGPU device
+- * @instance_id: ID of the SDMA engine instance to reset
++ * @instance_id: Logical ID of the SDMA engine instance to reset
+ *
+ * This function performs the following steps:
+ * 1. Calls all registered pre_reset callbacks to allow KFD and AMDGPU to save their state.
+@@ -649,7 +651,7 @@ int amdgpu_sdma_reset_engine(struct amdg
+ /* Perform the SDMA reset for the specified instance */
+ ret = amdgpu_sdma_soft_reset(adev, instance_id);
+ if (ret) {
+- dev_err(adev->dev, "Failed to reset SDMA instance %u\n", instance_id);
++ dev_err(adev->dev, "Failed to reset SDMA logical instance %u\n", instance_id);
+ goto exit;
+ }
+
--- /dev/null
+From 5c3e7c49538e2ddad10296a318c225bbb3d37d20 Mon Sep 17 00:00:00 2001
+From: "Jesse.zhang@amd.com" <Jesse.zhang@amd.com>
+Date: Fri, 11 Apr 2025 15:26:18 +0800
+Subject: drm/amdgpu: Implement SDMA soft reset directly for v5.x
+
+From: Jesse.zhang@amd.com <Jesse.zhang@amd.com>
+
+commit 5c3e7c49538e2ddad10296a318c225bbb3d37d20 upstream.
+
+This patch introduces a new function `amdgpu_sdma_soft_reset` to handle SDMA soft resets directly,
+rather than relying on the DPM interface.
+
+1. **New `amdgpu_sdma_soft_reset` Function**:
+ - Implements a soft reset for SDMA engines by directly writing to the hardware registers.
+ - Handles SDMA versions 4.x and 5.x separately:
+ - For SDMA 4.x, the existing `amdgpu_dpm_reset_sdma` function is used for backward compatibility.
+ - For SDMA 5.x, the driver directly manipulates the `GRBM_SOFT_RESET` register to reset the specified SDMA instance.
+
+2. **Integration into `amdgpu_sdma_reset_engine`**:
+ - The `amdgpu_sdma_soft_reset` function is called during the SDMA reset process, replacing the previous call to `amdgpu_dpm_reset_sdma`.
+
+v2: r should default to an error (Alex)
+
+Suggested-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Jesse Zhang <jesse.zhang@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: 09b585592fa4 ("drm/amdgpu: Fix SDMA engine reset with logical instance ID")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c | 38 ++++++++++++++++++++++++++++++-
+ 1 file changed, 37 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c
+@@ -26,6 +26,8 @@
+ #include "amdgpu_sdma.h"
+ #include "amdgpu_ras.h"
+ #include "amdgpu_reset.h"
++#include "gc/gc_10_1_0_offset.h"
++#include "gc/gc_10_3_0_sh_mask.h"
+
+ #define AMDGPU_CSA_SDMA_SIZE 64
+ /* SDMA CSA reside in the 3rd page of CSA */
+@@ -561,6 +563,40 @@ void amdgpu_sdma_register_on_reset_callb
+ list_add_tail(&funcs->list, &adev->sdma.reset_callback_list);
+ }
+
++static int amdgpu_sdma_soft_reset(struct amdgpu_device *adev, u32 instance_id)
++{
++ struct amdgpu_sdma_instance *sdma_instance = &adev->sdma.instance[instance_id];
++ int r = -EOPNOTSUPP;
++
++ switch (amdgpu_ip_version(adev, SDMA0_HWIP, 0)) {
++ case IP_VERSION(4, 4, 2):
++ case IP_VERSION(4, 4, 4):
++ case IP_VERSION(4, 4, 5):
++ /* For SDMA 4.x, use the existing DPM interface for backward compatibility */
++ r = amdgpu_dpm_reset_sdma(adev, 1 << instance_id);
++ break;
++ case IP_VERSION(5, 0, 0):
++ case IP_VERSION(5, 0, 1):
++ case IP_VERSION(5, 0, 2):
++ case IP_VERSION(5, 0, 5):
++ case IP_VERSION(5, 2, 0):
++ case IP_VERSION(5, 2, 2):
++ case IP_VERSION(5, 2, 4):
++ case IP_VERSION(5, 2, 5):
++ case IP_VERSION(5, 2, 6):
++ case IP_VERSION(5, 2, 3):
++ case IP_VERSION(5, 2, 1):
++ case IP_VERSION(5, 2, 7):
++ if (sdma_instance->funcs->soft_reset_kernel_queue)
++ r = sdma_instance->funcs->soft_reset_kernel_queue(adev, instance_id);
++ break;
++ default:
++ break;
++ }
++
++ return r;
++}
++
+ /**
+ * amdgpu_sdma_reset_engine - Reset a specific SDMA engine
+ * @adev: Pointer to the AMDGPU device
+@@ -611,7 +647,7 @@ int amdgpu_sdma_reset_engine(struct amdg
+ }
+
+ /* Perform the SDMA reset for the specified instance */
+- ret = amdgpu_dpm_reset_sdma(adev, 1 << instance_id);
++ ret = amdgpu_sdma_soft_reset(adev, instance_id);
+ if (ret) {
+ dev_err(adev->dev, "Failed to reset SDMA instance %u\n", instance_id);
+ goto exit;
--- /dev/null
+From eab10538073c3ff9e21c857bd462f79f2f6f7e00 Mon Sep 17 00:00:00 2001
+From: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Date: Sun, 23 Mar 2025 00:26:04 +0300
+Subject: drm/shmem-helper: Remove obsoleted is_iomem test
+
+From: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+
+commit eab10538073c3ff9e21c857bd462f79f2f6f7e00 upstream.
+
+Everything that uses the mapped buffer should be agnostic to is_iomem.
+The only reason for the is_iomem test is that we're setting shmem->vaddr
+to the returned map->vaddr. Now that the shmem->vaddr code is gone, remove
+the obsoleted is_iomem test to clean up the code.
+
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Suggested-by: Thomas Zimmermann <tzimmermann@suse.de>
+Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.d>
+Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250322212608.40511-7-dmitry.osipenko@collabora.com
+Stable-dep-of: 6d496e956998 ("Revert "drm/gem-shmem: Use dma_buf from GEM object instance"")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_gem_shmem_helper.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+--- a/drivers/gpu/drm/drm_gem_shmem_helper.c
++++ b/drivers/gpu/drm/drm_gem_shmem_helper.c
+@@ -340,12 +340,6 @@ int drm_gem_shmem_vmap(struct drm_gem_sh
+
+ if (drm_gem_is_imported(obj)) {
+ ret = dma_buf_vmap(obj->dma_buf, map);
+- if (!ret) {
+- if (drm_WARN_ON(obj->dev, map->is_iomem)) {
+- dma_buf_vunmap(obj->dma_buf, map);
+- return -EIO;
+- }
+- }
+ } else {
+ pgprot_t prot = PAGE_KERNEL;
+
--- /dev/null
+From afcad92411772a1f361339f22c49f855c6cc7d0f Mon Sep 17 00:00:00 2001
+From: Matthew Brost <matthew.brost@intel.com>
+Date: Wed, 11 Jun 2025 20:19:25 -0700
+Subject: drm/xe: Make WA BB part of LRC BO
+
+From: Matthew Brost <matthew.brost@intel.com>
+
+commit afcad92411772a1f361339f22c49f855c6cc7d0f upstream.
+
+No idea why, but without this GuC context switches randomly fail when
+running IGTs in a loop. Need to follow up why this fixes the
+aforementioned issue but can live with a stable driver for now.
+
+Fixes: 617d824c5323 ("drm/xe: Add WA BB to capture active context utilization")
+Cc: stable@vger.kernel.org
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Tested-by: Shuicheng Lin <shuicheng.lin@intel.com>
+Link: https://lore.kernel.org/r/20250612031925.4009701-1-matthew.brost@intel.com
+(cherry picked from commit 3a1edef8f4b58b0ba826bc68bf4bce4bdf59ecf3)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+[ adapted xe_bo_create_pin_map() call ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/xe_lrc.c | 37 +++++++++++++++++++------------------
+ drivers/gpu/drm/xe/xe_lrc_types.h | 3 ---
+ 2 files changed, 19 insertions(+), 21 deletions(-)
+
+--- a/drivers/gpu/drm/xe/xe_lrc.c
++++ b/drivers/gpu/drm/xe/xe_lrc.c
+@@ -39,6 +39,7 @@
+ #define LRC_ENGINE_INSTANCE GENMASK_ULL(53, 48)
+
+ #define LRC_INDIRECT_RING_STATE_SIZE SZ_4K
++#define LRC_WA_BB_SIZE SZ_4K
+
+ static struct xe_device *
+ lrc_to_xe(struct xe_lrc *lrc)
+@@ -910,7 +911,11 @@ static void xe_lrc_finish(struct xe_lrc
+ xe_bo_unpin(lrc->bo);
+ xe_bo_unlock(lrc->bo);
+ xe_bo_put(lrc->bo);
+- xe_bo_unpin_map_no_vm(lrc->bb_per_ctx_bo);
++}
++
++static size_t wa_bb_offset(struct xe_lrc *lrc)
++{
++ return lrc->bo->size - LRC_WA_BB_SIZE;
+ }
+
+ /*
+@@ -943,15 +948,16 @@ static void xe_lrc_finish(struct xe_lrc
+ #define CONTEXT_ACTIVE 1ULL
+ static int xe_lrc_setup_utilization(struct xe_lrc *lrc)
+ {
++ const size_t max_size = LRC_WA_BB_SIZE;
+ u32 *cmd, *buf = NULL;
+
+- if (lrc->bb_per_ctx_bo->vmap.is_iomem) {
+- buf = kmalloc(lrc->bb_per_ctx_bo->size, GFP_KERNEL);
++ if (lrc->bo->vmap.is_iomem) {
++ buf = kmalloc(max_size, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+ cmd = buf;
+ } else {
+- cmd = lrc->bb_per_ctx_bo->vmap.vaddr;
++ cmd = lrc->bo->vmap.vaddr + wa_bb_offset(lrc);
+ }
+
+ *cmd++ = MI_STORE_REGISTER_MEM | MI_SRM_USE_GGTT | MI_SRM_ADD_CS_OFFSET;
+@@ -974,13 +980,14 @@ static int xe_lrc_setup_utilization(stru
+ *cmd++ = MI_BATCH_BUFFER_END;
+
+ if (buf) {
+- xe_map_memcpy_to(gt_to_xe(lrc->gt), &lrc->bb_per_ctx_bo->vmap, 0,
+- buf, (cmd - buf) * sizeof(*cmd));
++ xe_map_memcpy_to(gt_to_xe(lrc->gt), &lrc->bo->vmap,
++ wa_bb_offset(lrc), buf,
++ (cmd - buf) * sizeof(*cmd));
+ kfree(buf);
+ }
+
+- xe_lrc_write_ctx_reg(lrc, CTX_BB_PER_CTX_PTR,
+- xe_bo_ggtt_addr(lrc->bb_per_ctx_bo) | 1);
++ xe_lrc_write_ctx_reg(lrc, CTX_BB_PER_CTX_PTR, xe_bo_ggtt_addr(lrc->bo) +
++ wa_bb_offset(lrc) + 1);
+
+ return 0;
+ }
+@@ -1016,20 +1023,13 @@ static int xe_lrc_init(struct xe_lrc *lr
+ * FIXME: Perma-pinning LRC as we don't yet support moving GGTT address
+ * via VM bind calls.
+ */
+- lrc->bo = xe_bo_create_pin_map(xe, tile, vm, lrc_size,
++ lrc->bo = xe_bo_create_pin_map(xe, tile, vm,
++ lrc_size + LRC_WA_BB_SIZE,
+ ttm_bo_type_kernel,
+ bo_flags);
+ if (IS_ERR(lrc->bo))
+ return PTR_ERR(lrc->bo);
+
+- lrc->bb_per_ctx_bo = xe_bo_create_pin_map(xe, tile, NULL, SZ_4K,
+- ttm_bo_type_kernel,
+- bo_flags);
+- if (IS_ERR(lrc->bb_per_ctx_bo)) {
+- err = PTR_ERR(lrc->bb_per_ctx_bo);
+- goto err_lrc_finish;
+- }
+-
+ lrc->size = lrc_size;
+ lrc->ring.size = ring_size;
+ lrc->ring.tail = 0;
+@@ -1819,7 +1819,8 @@ struct xe_lrc_snapshot *xe_lrc_snapshot_
+ snapshot->seqno = xe_lrc_seqno(lrc);
+ snapshot->lrc_bo = xe_bo_get(lrc->bo);
+ snapshot->lrc_offset = xe_lrc_pphwsp_offset(lrc);
+- snapshot->lrc_size = lrc->bo->size - snapshot->lrc_offset;
++ snapshot->lrc_size = lrc->bo->size - snapshot->lrc_offset -
++ LRC_WA_BB_SIZE;
+ snapshot->lrc_snapshot = NULL;
+ snapshot->ctx_timestamp = lower_32_bits(xe_lrc_ctx_timestamp(lrc));
+ snapshot->ctx_job_timestamp = xe_lrc_ctx_job_timestamp(lrc);
+--- a/drivers/gpu/drm/xe/xe_lrc_types.h
++++ b/drivers/gpu/drm/xe/xe_lrc_types.h
+@@ -53,9 +53,6 @@ struct xe_lrc {
+
+ /** @ctx_timestamp: readout value of CTX_TIMESTAMP on last update */
+ u64 ctx_timestamp;
+-
+- /** @bb_per_ctx_bo: buffer object for per context batch wa buffer */
+- struct xe_bo *bb_per_ctx_bo;
+ };
+
+ struct xe_lrc_snapshot;
--- /dev/null
+From 6d496e9569983a0d7a05be6661126d0702cf94f7 Mon Sep 17 00:00:00 2001
+From: Thomas Zimmermann <tzimmermann@suse.de>
+Date: Tue, 15 Jul 2025 17:58:16 +0200
+Subject: Revert "drm/gem-shmem: Use dma_buf from GEM object instance"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+commit 6d496e9569983a0d7a05be6661126d0702cf94f7 upstream.
+
+This reverts commit 1a148af06000e545e714fe3210af3d77ff903c11.
+
+The dma_buf field in struct drm_gem_object is not stable over the
+object instance's lifetime. The field becomes NULL when user space
+releases the final GEM handle on the buffer object. This resulted
+in a NULL-pointer deref.
+
+Workarounds in commit 5307dce878d4 ("drm/gem: Acquire references on
+GEM handles for framebuffers") and commit f6bfc9afc751 ("drm/framebuffer:
+Acquire internal references on GEM handles") only solved the problem
+partially. They especially don't work for buffer objects without a DRM
+framebuffer associated.
+
+Hence, this revert to going back to using .import_attach->dmabuf.
+
+v3:
+- cc stable
+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Reviewed-by: Simona Vetter <simona.vetter@ffwll.ch>
+Acked-by: Christian König <christian.koenig@amd.com>
+Acked-by: Zack Rusin <zack.rusin@broadcom.com>
+Cc: <stable@vger.kernel.org> # v6.15+
+Link: https://lore.kernel.org/r/20250715155934.150656-7-tzimmermann@suse.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_gem_shmem_helper.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/drm_gem_shmem_helper.c
++++ b/drivers/gpu/drm/drm_gem_shmem_helper.c
+@@ -339,7 +339,7 @@ int drm_gem_shmem_vmap(struct drm_gem_sh
+ int ret = 0;
+
+ if (drm_gem_is_imported(obj)) {
+- ret = dma_buf_vmap(obj->dma_buf, map);
++ ret = dma_buf_vmap(obj->import_attach->dmabuf, map);
+ } else {
+ pgprot_t prot = PAGE_KERNEL;
+
+@@ -399,7 +399,7 @@ void drm_gem_shmem_vunmap(struct drm_gem
+ struct drm_gem_object *obj = &shmem->base;
+
+ if (drm_gem_is_imported(obj)) {
+- dma_buf_vunmap(obj->dma_buf, map);
++ dma_buf_vunmap(obj->import_attach->dmabuf, map);
+ } else {
+ dma_resv_assert_held(shmem->base.resv);
+
--- /dev/null
+From 5ffb537e416ee22dbfb3d552102e50da33fec7f6 Mon Sep 17 00:00:00 2001
+From: Yonghong Song <yonghong.song@linux.dev>
+Date: Fri, 23 May 2025 21:13:40 -0700
+Subject: selftests/bpf: Add tests with stack ptr register in conditional jmp
+
+From: Yonghong Song <yonghong.song@linux.dev>
+
+commit 5ffb537e416ee22dbfb3d552102e50da33fec7f6 upstream.
+
+Add two tests:
+ - one test has 'rX <op> r10' where rX is not r10, and
+ - another test has 'rX <op> rY' where rX and rY are not r10
+ but there is an early insn 'rX = r10'.
+
+Without previous verifier change, both tests will fail.
+
+Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250524041340.4046304-1-yonghong.song@linux.dev
+[ shung-hsi.yu: contains additional hunks for kernel/bpf/verifier.c that
+ should be part of the previous patch in the series, commit
+ e2d2115e56c4 "bpf: Do not include stack ptr register in precision
+ backtracking bookkeeping", which already incorporated. ]
+Link: https://lore.kernel.org/all/9b41f9f5-396f-47e0-9a12-46c52087df6c@linux.dev/
+Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+Verified that newly added test passes in 6.15.y[1] as well as 6.12.y[2]
+
+1: https://github.com/shunghsiyu/libbpf/actions/runs/16561115937/job/46830912531
+2: https://github.com/shunghsiyu/libbpf/actions/runs/16561115937/job/46830912533
+---
+ kernel/bpf/verifier.c | 7 +-
+ tools/testing/selftests/bpf/progs/verifier_precision.c | 53 +++++++++++++++++
+ 2 files changed, 58 insertions(+), 2 deletions(-)
+
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -16441,6 +16441,8 @@ static int check_cond_jmp_op(struct bpf_
+
+ if (src_reg->type == PTR_TO_STACK)
+ insn_flags |= INSN_F_SRC_REG_STACK;
++ if (dst_reg->type == PTR_TO_STACK)
++ insn_flags |= INSN_F_DST_REG_STACK;
+ } else {
+ if (insn->src_reg != BPF_REG_0) {
+ verbose(env, "BPF_JMP/JMP32 uses reserved fields\n");
+@@ -16450,10 +16452,11 @@ static int check_cond_jmp_op(struct bpf_
+ memset(src_reg, 0, sizeof(*src_reg));
+ src_reg->type = SCALAR_VALUE;
+ __mark_reg_known(src_reg, insn->imm);
++
++ if (dst_reg->type == PTR_TO_STACK)
++ insn_flags |= INSN_F_DST_REG_STACK;
+ }
+
+- if (dst_reg->type == PTR_TO_STACK)
+- insn_flags |= INSN_F_DST_REG_STACK;
+ if (insn_flags) {
+ err = push_insn_history(env, this_branch, insn_flags, 0);
+ if (err)
+--- a/tools/testing/selftests/bpf/progs/verifier_precision.c
++++ b/tools/testing/selftests/bpf/progs/verifier_precision.c
+@@ -179,4 +179,57 @@ __naked int state_loop_first_last_equal(
+ );
+ }
+
++__used __naked static void __bpf_cond_op_r10(void)
++{
++ asm volatile (
++ "r2 = 2314885393468386424 ll;"
++ "goto +0;"
++ "if r2 <= r10 goto +3;"
++ "if r1 >= -1835016 goto +0;"
++ "if r2 <= 8 goto +0;"
++ "if r3 <= 0 goto +0;"
++ "exit;"
++ ::: __clobber_all);
++}
++
++SEC("?raw_tp")
++__success __log_level(2)
++__msg("8: (bd) if r2 <= r10 goto pc+3")
++__msg("9: (35) if r1 >= 0xffe3fff8 goto pc+0")
++__msg("10: (b5) if r2 <= 0x8 goto pc+0")
++__msg("mark_precise: frame1: last_idx 10 first_idx 0 subseq_idx -1")
++__msg("mark_precise: frame1: regs=r2 stack= before 9: (35) if r1 >= 0xffe3fff8 goto pc+0")
++__msg("mark_precise: frame1: regs=r2 stack= before 8: (bd) if r2 <= r10 goto pc+3")
++__msg("mark_precise: frame1: regs=r2 stack= before 7: (05) goto pc+0")
++__naked void bpf_cond_op_r10(void)
++{
++ asm volatile (
++ "r3 = 0 ll;"
++ "call __bpf_cond_op_r10;"
++ "r0 = 0;"
++ "exit;"
++ ::: __clobber_all);
++}
++
++SEC("?raw_tp")
++__success __log_level(2)
++__msg("3: (bf) r3 = r10")
++__msg("4: (bd) if r3 <= r2 goto pc+1")
++__msg("5: (b5) if r2 <= 0x8 goto pc+2")
++__msg("mark_precise: frame0: last_idx 5 first_idx 0 subseq_idx -1")
++__msg("mark_precise: frame0: regs=r2 stack= before 4: (bd) if r3 <= r2 goto pc+1")
++__msg("mark_precise: frame0: regs=r2 stack= before 3: (bf) r3 = r10")
++__naked void bpf_cond_op_not_r10(void)
++{
++ asm volatile (
++ "r0 = 0;"
++ "r2 = 2314885393468386424 ll;"
++ "r3 = r10;"
++ "if r3 <= r2 goto +1;"
++ "if r2 <= 8 goto +2;"
++ "r0 = 2 ll;"
++ "exit;"
++ ::: __clobber_all);
++}
++
+ char _license[] SEC("license") = "GPL";
selftests-mm-fix-split_huge_page_test-for-folio_split-tests.patch
mm-vmscan-fix-hwpoisoned-large-folio-handling-in-shrink_folio_list.patch
mm-zsmalloc-do-not-pass-__gfp_movable-if-config_compaction-n.patch
+selftests-bpf-add-tests-with-stack-ptr-register-in-conditional-jmp.patch
+drm-xe-make-wa-bb-part-of-lrc-bo.patch
+drm-amdgpu-add-the-new-sdma-function-pointers-for-amdgpu_sdma.h.patch
+drm-amdgpu-implement-sdma-soft-reset-directly-for-v5.x.patch
+drm-amdgpu-fix-sdma-engine-reset-with-logical-instance-id.patch
+drm-shmem-helper-remove-obsoleted-is_iomem-test.patch
+revert-drm-gem-shmem-use-dma_buf-from-gem-object-instance.patch
+usb-typec-tcpm-allow-to-use-sink-in-accessory-mode.patch
+usb-typec-tcpm-allow-switching-to-mode-accessory-to-mux-properly.patch
+usb-typec-tcpm-apply-vbus-before-data-bringup-in-tcpm_src_attach.patch
--- /dev/null
+From 8a50da849151e7e12b43c1d8fe7ad302223aef6b Mon Sep 17 00:00:00 2001
+From: Michael Grzeschik <m.grzeschik@pengutronix.de>
+Date: Fri, 4 Apr 2025 00:43:06 +0200
+Subject: usb: typec: tcpm: allow switching to mode accessory to mux properly
+
+From: Michael Grzeschik <m.grzeschik@pengutronix.de>
+
+commit 8a50da849151e7e12b43c1d8fe7ad302223aef6b upstream.
+
+The funciton tcpm_acc_attach is not setting the proper state when
+calling tcpm_set_role. The function tcpm_set_role is currently only
+handling TYPEC_STATE_USB. For the tcpm_acc_attach to switch into other
+modal states tcpm_set_role needs to be extended by an extra state
+parameter. This patch is handling the proper state change when calling
+tcpm_acc_attach.
+
+Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20250404-ml-topic-tcpm-v1-3-b99f44badce8@pengutronix.de
+Stable-dep-of: bec15191d523 ("usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/tcpm/tcpm.c | 27 ++++++++++++++++++---------
+ 1 file changed, 18 insertions(+), 9 deletions(-)
+
+--- a/drivers/usb/typec/tcpm/tcpm.c
++++ b/drivers/usb/typec/tcpm/tcpm.c
+@@ -1160,7 +1160,7 @@ static int tcpm_set_attached_state(struc
+ port->data_role);
+ }
+
+-static int tcpm_set_roles(struct tcpm_port *port, bool attached,
++static int tcpm_set_roles(struct tcpm_port *port, bool attached, int state,
+ enum typec_role role, enum typec_data_role data)
+ {
+ enum typec_orientation orientation;
+@@ -1197,7 +1197,7 @@ static int tcpm_set_roles(struct tcpm_po
+ }
+ }
+
+- ret = tcpm_mux_set(port, TYPEC_STATE_USB, usb_role, orientation);
++ ret = tcpm_mux_set(port, state, usb_role, orientation);
+ if (ret < 0)
+ return ret;
+
+@@ -4404,7 +4404,8 @@ static int tcpm_src_attach(struct tcpm_p
+
+ tcpm_enable_auto_vbus_discharge(port, true);
+
+- ret = tcpm_set_roles(port, true, TYPEC_SOURCE, tcpm_data_role_for_source(port));
++ ret = tcpm_set_roles(port, true, TYPEC_STATE_USB,
++ TYPEC_SOURCE, tcpm_data_role_for_source(port));
+ if (ret < 0)
+ return ret;
+
+@@ -4579,7 +4580,8 @@ static int tcpm_snk_attach(struct tcpm_p
+
+ tcpm_enable_auto_vbus_discharge(port, true);
+
+- ret = tcpm_set_roles(port, true, TYPEC_SINK, tcpm_data_role_for_sink(port));
++ ret = tcpm_set_roles(port, true, TYPEC_STATE_USB,
++ TYPEC_SINK, tcpm_data_role_for_sink(port));
+ if (ret < 0)
+ return ret;
+
+@@ -4604,6 +4606,7 @@ static int tcpm_acc_attach(struct tcpm_p
+ int ret;
+ enum typec_role role;
+ enum typec_data_role data;
++ int state = TYPEC_STATE_USB;
+
+ if (port->attached)
+ return 0;
+@@ -4612,7 +4615,13 @@ static int tcpm_acc_attach(struct tcpm_p
+ data = tcpm_port_is_sink(port) ? tcpm_data_role_for_sink(port)
+ : tcpm_data_role_for_source(port);
+
+- ret = tcpm_set_roles(port, true, role, data);
++ if (tcpm_port_is_audio(port))
++ state = TYPEC_MODE_AUDIO;
++
++ if (tcpm_port_is_debug(port))
++ state = TYPEC_MODE_DEBUG;
++
++ ret = tcpm_set_roles(port, true, state, role, data);
+ if (ret < 0)
+ return ret;
+
+@@ -5382,7 +5391,7 @@ static void run_state_machine(struct tcp
+ */
+ tcpm_set_vconn(port, false);
+ tcpm_set_vbus(port, false);
+- tcpm_set_roles(port, port->self_powered, TYPEC_SOURCE,
++ tcpm_set_roles(port, port->self_powered, TYPEC_STATE_USB, TYPEC_SOURCE,
+ tcpm_data_role_for_source(port));
+ /*
+ * If tcpc fails to notify vbus off, TCPM will wait for PD_T_SAFE_0V +
+@@ -5414,7 +5423,7 @@ static void run_state_machine(struct tcp
+ tcpm_set_vconn(port, false);
+ if (port->pd_capable)
+ tcpm_set_charge(port, false);
+- tcpm_set_roles(port, port->self_powered, TYPEC_SINK,
++ tcpm_set_roles(port, port->self_powered, TYPEC_STATE_USB, TYPEC_SINK,
+ tcpm_data_role_for_sink(port));
+ /*
+ * VBUS may or may not toggle, depending on the adapter.
+@@ -5538,10 +5547,10 @@ static void run_state_machine(struct tcp
+ case DR_SWAP_CHANGE_DR:
+ tcpm_unregister_altmodes(port);
+ if (port->data_role == TYPEC_HOST)
+- tcpm_set_roles(port, true, port->pwr_role,
++ tcpm_set_roles(port, true, TYPEC_STATE_USB, port->pwr_role,
+ TYPEC_DEVICE);
+ else
+- tcpm_set_roles(port, true, port->pwr_role,
++ tcpm_set_roles(port, true, TYPEC_STATE_USB, port->pwr_role,
+ TYPEC_HOST);
+ tcpm_ams_finish(port);
+ tcpm_set_state(port, ready_state(port), 0);
--- /dev/null
+From 64843d0ba96d3eae297025562111d57585273366 Mon Sep 17 00:00:00 2001
+From: Michael Grzeschik <m.grzeschik@pengutronix.de>
+Date: Fri, 4 Apr 2025 00:43:04 +0200
+Subject: usb: typec: tcpm: allow to use sink in accessory mode
+
+From: Michael Grzeschik <m.grzeschik@pengutronix.de>
+
+commit 64843d0ba96d3eae297025562111d57585273366 upstream.
+
+Since the function tcpm_acc_attach is not setting the data and role for
+for the sink case we extend it to check for it first.
+
+Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20250404-ml-topic-tcpm-v1-1-b99f44badce8@pengutronix.de
+Stable-dep-of: bec15191d523 ("usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/tcpm/tcpm.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/typec/tcpm/tcpm.c
++++ b/drivers/usb/typec/tcpm/tcpm.c
+@@ -4602,12 +4602,17 @@ static void tcpm_snk_detach(struct tcpm_
+ static int tcpm_acc_attach(struct tcpm_port *port)
+ {
+ int ret;
++ enum typec_role role;
++ enum typec_data_role data;
+
+ if (port->attached)
+ return 0;
+
+- ret = tcpm_set_roles(port, true, TYPEC_SOURCE,
+- tcpm_data_role_for_source(port));
++ role = tcpm_port_is_sink(port) ? TYPEC_SINK : TYPEC_SOURCE;
++ data = tcpm_port_is_sink(port) ? tcpm_data_role_for_sink(port)
++ : tcpm_data_role_for_source(port);
++
++ ret = tcpm_set_roles(port, true, role, data);
+ if (ret < 0)
+ return ret;
+
--- /dev/null
+From bec15191d52300defa282e3fd83820f69e447116 Mon Sep 17 00:00:00 2001
+From: RD Babiera <rdbabiera@google.com>
+Date: Wed, 18 Jun 2025 23:06:04 +0000
+Subject: usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach
+
+From: RD Babiera <rdbabiera@google.com>
+
+commit bec15191d52300defa282e3fd83820f69e447116 upstream.
+
+This patch fixes Type-C compliance test TD 4.7.6 - Try.SNK DRP Connect
+SNKAS.
+
+tVbusON has a limit of 275ms when entering SRC_ATTACHED. Compliance
+testers can interpret the TryWait.Src to Attached.Src transition after
+Try.Snk as being in Attached.Src the entire time, so ~170ms is lost
+to the debounce timer.
+
+Setting the data role can be a costly operation in host mode, and when
+completed after 100ms can cause Type-C compliance test check TD 4.7.5.V.4
+to fail.
+
+Turn VBUS on before tcpm_set_roles to meet timing requirement.
+
+Fixes: f0690a25a140 ("staging: typec: USB Type-C Port Manager (tcpm)")
+Cc: stable <stable@kernel.org>
+Signed-off-by: RD Babiera <rdbabiera@google.com>
+Reviewed-by: Badhri Jagan Sridharan <badhri@google.com>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20250618230606.3272497-2-rdbabiera@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/tcpm/tcpm.c | 34 +++++++++++++++++-----------------
+ 1 file changed, 17 insertions(+), 17 deletions(-)
+
+--- a/drivers/usb/typec/tcpm/tcpm.c
++++ b/drivers/usb/typec/tcpm/tcpm.c
+@@ -4404,17 +4404,6 @@ static int tcpm_src_attach(struct tcpm_p
+
+ tcpm_enable_auto_vbus_discharge(port, true);
+
+- ret = tcpm_set_roles(port, true, TYPEC_STATE_USB,
+- TYPEC_SOURCE, tcpm_data_role_for_source(port));
+- if (ret < 0)
+- return ret;
+-
+- if (port->pd_supported) {
+- ret = port->tcpc->set_pd_rx(port->tcpc, true);
+- if (ret < 0)
+- goto out_disable_mux;
+- }
+-
+ /*
+ * USB Type-C specification, version 1.2,
+ * chapter 4.5.2.2.8.1 (Attached.SRC Requirements)
+@@ -4424,13 +4413,24 @@ static int tcpm_src_attach(struct tcpm_p
+ (polarity == TYPEC_POLARITY_CC2 && port->cc1 == TYPEC_CC_RA)) {
+ ret = tcpm_set_vconn(port, true);
+ if (ret < 0)
+- goto out_disable_pd;
++ return ret;
+ }
+
+ ret = tcpm_set_vbus(port, true);
+ if (ret < 0)
+ goto out_disable_vconn;
+
++ ret = tcpm_set_roles(port, true, TYPEC_STATE_USB, TYPEC_SOURCE,
++ tcpm_data_role_for_source(port));
++ if (ret < 0)
++ goto out_disable_vbus;
++
++ if (port->pd_supported) {
++ ret = port->tcpc->set_pd_rx(port->tcpc, true);
++ if (ret < 0)
++ goto out_disable_mux;
++ }
++
+ port->pd_capable = false;
+
+ port->partner = NULL;
+@@ -4441,14 +4441,14 @@ static int tcpm_src_attach(struct tcpm_p
+
+ return 0;
+
+-out_disable_vconn:
+- tcpm_set_vconn(port, false);
+-out_disable_pd:
+- if (port->pd_supported)
+- port->tcpc->set_pd_rx(port->tcpc, false);
+ out_disable_mux:
+ tcpm_mux_set(port, TYPEC_STATE_SAFE, USB_ROLE_NONE,
+ TYPEC_ORIENTATION_NONE);
++out_disable_vbus:
++ tcpm_set_vbus(port, false);
++out_disable_vconn:
++ tcpm_set_vconn(port, false);
++
+ return ret;
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
