5.15-stable patches

added patches:
	drm-msm-a6xx-fix-out-of-bound-io-access-in-a6xx_get_gmu_registers.patch
	drm-nouveau-dispnv50-don-t-call-drm_atomic_get_crtc_state-in-prepare_fb.patch
	drm-ttm-avoid-null-pointer-deref-for-evicted-bos.patch

diff --git a/queue-5.15/drm-msm-a6xx-fix-out-of-bound-io-access-in-a6xx_get_gmu_registers.patch b/queue-5.15/drm-msm-a6xx-fix-out-of-bound-io-access-in-a6xx_get_gmu_registers.patch
new file mode 100644 (file)
index 0000000..859e1bc
--- /dev/null
+++ b/queue-5.15/drm-msm-a6xx-fix-out-of-bound-io-access-in-a6xx_get_gmu_registers.patch
@@ -0,0 +1,35 @@
+From 779b68a5bf2764c8ed3aa800e41ba0d5d007e1e7 Mon Sep 17 00:00:00 2001
+From: Akhil P Oommen <akhilpo@oss.qualcomm.com>
+Date: Tue, 18 Nov 2025 14:20:28 +0530
+Subject: drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers
+
+From: Akhil P Oommen <akhilpo@oss.qualcomm.com>
+
+commit 779b68a5bf2764c8ed3aa800e41ba0d5d007e1e7 upstream.
+
+REG_A6XX_GMU_AO_AHB_FENCE_CTRL register falls under GMU's register
+range. So, use gmu_write() routines to write to this register.
+
+Fixes: 1707add81551 ("drm/msm/a6xx: Add a6xx gpu state")
+Cc: stable@vger.kernel.org
+Signed-off-by: Akhil P Oommen <akhilpo@oss.qualcomm.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Patchwork: https://patchwork.freedesktop.org/patch/688993/
+Message-ID: <20251118-kaana-gpu-support-v4-1-86eeb8e93fb6@oss.qualcomm.com>
+Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c
+@@ -794,7 +794,7 @@ static void a6xx_get_gmu_registers(struc
+               return;
+ 
+       /* Set the fence to ALLOW mode so we can access the registers */
+-      gpu_write(gpu, REG_A6XX_GMU_AO_AHB_FENCE_CTRL, 0);
++      gmu_write(&a6xx_gpu->gmu, REG_A6XX_GMU_AO_AHB_FENCE_CTRL, 0);
+ 
+       _a6xx_get_gmu_registers(gpu, a6xx_state, &a6xx_gmu_reglist[2],
+               &a6xx_state->gmu_registers[2], false);

diff --git a/queue-5.15/drm-nouveau-dispnv50-don-t-call-drm_atomic_get_crtc_state-in-prepare_fb.patch b/queue-5.15/drm-nouveau-dispnv50-don-t-call-drm_atomic_get_crtc_state-in-prepare_fb.patch
new file mode 100644 (file)
index 0000000..3388b17
--- /dev/null
+++ b/queue-5.15/drm-nouveau-dispnv50-don-t-call-drm_atomic_get_crtc_state-in-prepare_fb.patch
@@ -0,0 +1,63 @@
+From 560271e10b2c86e95ea35afa9e79822e4847f07a Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Thu, 11 Dec 2025 14:02:54 -0500
+Subject: drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb
+
+From: Lyude Paul <lyude@redhat.com>
+
+commit 560271e10b2c86e95ea35afa9e79822e4847f07a upstream.
+
+Since we recently started warning about uses of this function after the
+atomic check phase completes, we've started getting warnings about this in
+nouveau. It appears a misplaced drm_atomic_get_crtc_state() call has been
+hiding in our .prepare_fb callback for a while.
+
+So, fix this by adding a new nv50_head_atom_get_new() function and use that
+in our .prepare_fb callback instead.
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Reviewed-by: Dave Airlie <airlied@redhat.com>
+Fixes: 1590700d94ac ("drm/nouveau/kms/nv50-: split each resource type into their own source files")
+Cc: <stable@vger.kernel.org> # v4.18+
+Link: https://patch.msgid.link/20251211190256.396742-1-lyude@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/nouveau/dispnv50/atom.h |   13 +++++++++++++
+ drivers/gpu/drm/nouveau/dispnv50/wndw.c |    2 +-
+ 2 files changed, 14 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/nouveau/dispnv50/atom.h
++++ b/drivers/gpu/drm/nouveau/dispnv50/atom.h
+@@ -152,8 +152,21 @@ static inline struct nv50_head_atom *
+ nv50_head_atom_get(struct drm_atomic_state *state, struct drm_crtc *crtc)
+ {
+       struct drm_crtc_state *statec = drm_atomic_get_crtc_state(state, crtc);
++
+       if (IS_ERR(statec))
+               return (void *)statec;
++
++      return nv50_head_atom(statec);
++}
++
++static inline struct nv50_head_atom *
++nv50_head_atom_get_new(struct drm_atomic_state *state, struct drm_crtc *crtc)
++{
++      struct drm_crtc_state *statec = drm_atomic_get_new_crtc_state(state, crtc);
++
++      if (!statec)
++              return NULL;
++
+       return nv50_head_atom(statec);
+ }
+ 
+--- a/drivers/gpu/drm/nouveau/dispnv50/wndw.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/wndw.c
+@@ -565,7 +565,7 @@ nv50_wndw_prepare_fb(struct drm_plane *p
+       asyw->image.offset[0] = nvbo->offset;
+ 
+       if (wndw->func->prepare) {
+-              asyh = nv50_head_atom_get(asyw->state.state, asyw->state.crtc);
++              asyh = nv50_head_atom_get_new(asyw->state.state, asyw->state.crtc);
+               if (IS_ERR(asyh))
+                       return PTR_ERR(asyh);
+ 

diff --git a/queue-5.15/drm-ttm-avoid-null-pointer-deref-for-evicted-bos.patch b/queue-5.15/drm-ttm-avoid-null-pointer-deref-for-evicted-bos.patch
new file mode 100644 (file)
index 0000000..c58c7ee
--- /dev/null
+++ b/queue-5.15/drm-ttm-avoid-null-pointer-deref-for-evicted-bos.patch
@@ -0,0 +1,56 @@
+From 491adc6a0f9903c32b05f284df1148de39e8e644 Mon Sep 17 00:00:00 2001
+From: Simon Richter <Simon.Richter@hogyros.de>
+Date: Tue, 14 Oct 2025 01:11:33 +0900
+Subject: drm/ttm: Avoid NULL pointer deref for evicted BOs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Simon Richter <Simon.Richter@hogyros.de>
+
+commit 491adc6a0f9903c32b05f284df1148de39e8e644 upstream.
+
+It is possible for a BO to exist that is not currently associated with a
+resource, e.g. because it has been evicted.
+
+When devcoredump tries to read the contents of all BOs for dumping, we need
+to expect this as well -- in this case, ENODATA is recorded instead of the
+buffer contents.
+
+Fixes: 7d08df5d0bd3 ("drm/ttm: Add ttm_bo_access")
+Fixes: 09ac4fcb3f25 ("drm/ttm: Implement vm_operations_struct.access v2")
+Cc: stable <stable@kernel.org>
+Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6271
+Signed-off-by: Simon Richter <Simon.Richter@hogyros.de>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Shuicheng Lin <shuicheng.lin@intel.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Link: https://patch.msgid.link/20251013161241.709916-1-Simon.Richter@hogyros.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/ttm/ttm_bo_vm.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
++++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
+@@ -427,6 +427,11 @@ int ttm_bo_vm_access(struct vm_area_stru
+       if (ret)
+               return ret;
+ 
++      if (!bo->resource) {
++              ret = -ENODATA;
++              goto unlock;
++      }
++
+       switch (bo->resource->mem_type) {
+       case TTM_PL_SYSTEM:
+               fallthrough;
+@@ -441,6 +446,7 @@ int ttm_bo_vm_access(struct vm_area_stru
+                       ret = -EIO;
+       }
+ 
++unlock:
+       ttm_bo_unreserve(bo);
+ 
+       return ret;

diff --git a/queue-5.15/series b/queue-5.15/series
index 0fa961aa43e193202670bc46bcae6692d23cc710..77a738d84910990227d767458780cc79c70470a6 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -407,3 +407,6 @@ nfsd-drop-the-client-reference-in-client_states_open.patch
 net-usb-sr9700-fix-incorrect-command-used-to-write-single-register.patch
 net-nfc-fix-deadlock-between-nfc_unregister_device-and-rfkill_fop_write.patch
 net-macb-relocate-mog_init_rings-callback-from-macb_mac_link_up-to-macb_open.patch
+drm-msm-a6xx-fix-out-of-bound-io-access-in-a6xx_get_gmu_registers.patch
+drm-ttm-avoid-null-pointer-deref-for-evicted-bos.patch
+drm-nouveau-dispnv50-don-t-call-drm_atomic_get_crtc_state-in-prepare_fb.patch