From: Sasha Levin Date: Thu, 13 Nov 2025 20:43:24 +0000 (-0500) Subject: Fixes for all trees X-Git-Tag: v6.6.117~49 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5394ab8a4aa5fcb6bec94bad0ee568f988ebeed8;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for all trees Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch b/queue-5.10/asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch new file mode 100644 index 0000000000..b5684a1224 --- /dev/null +++ b/queue-5.10/asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch @@ -0,0 +1,43 @@ +From b4f7c61c27902ea2c4d75823d184b97048480f12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Oct 2025 15:42:15 +0200 +Subject: ASoC: max98090/91: fixed max98091 ALSA widget powering up/down + +From: Sharique Mohammad + +[ Upstream commit 7a37291ed40a33a5f6c3d370fdde5ee0d8f7d0e4 ] + +The widgets DMIC3_ENA and DMIC4_ENA must be defined in the DAPM +suppy widget, just like DMICL_ENA and DMICR_ENA. Whenever they +are turned on or off, the required startup or shutdown sequences +must be taken care by the max98090_shdn_event. + +Signed-off-by: Sharique Mohammad +Link: https://patch.msgid.link/20251015134215.750001-1-sharq0406@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/max98090.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c +index 0c73979cad4a4..c7df685be4ea5 100644 +--- a/sound/soc/codecs/max98090.c ++++ b/sound/soc/codecs/max98090.c +@@ -1233,9 +1233,11 @@ static const struct snd_soc_dapm_widget max98091_dapm_widgets[] = { + SND_SOC_DAPM_INPUT("DMIC4"), + + SND_SOC_DAPM_SUPPLY("DMIC3_ENA", M98090_REG_DIGITAL_MIC_ENABLE, +- M98090_DIGMIC3_SHIFT, 0, NULL, 0), ++ M98090_DIGMIC3_SHIFT, 0, max98090_shdn_event, ++ SND_SOC_DAPM_POST_PMU), + SND_SOC_DAPM_SUPPLY("DMIC4_ENA", M98090_REG_DIGITAL_MIC_ENABLE, +- M98090_DIGMIC4_SHIFT, 0, NULL, 0), ++ M98090_DIGMIC4_SHIFT, 0, max98090_shdn_event, ++ SND_SOC_DAPM_POST_PMU), + }; + + static const struct snd_soc_dapm_route max98090_dapm_routes[] = { +-- +2.51.0 + diff --git a/queue-5.10/compiler_types-move-unused-static-inline-functions-w.patch b/queue-5.10/compiler_types-move-unused-static-inline-functions-w.patch new file mode 100644 index 0000000000..39e5a0b302 --- /dev/null +++ b/queue-5.10/compiler_types-move-unused-static-inline-functions-w.patch @@ -0,0 +1,57 @@ +From 4969e80c3136175ef7cbf3aeb6a1afa280ef465e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Nov 2025 11:50:00 +0100 +Subject: compiler_types: Move unused static inline functions warning to W=2 + +From: Peter Zijlstra + +[ Upstream commit 9818af18db4bfefd320d0fef41390a616365e6f7 ] + +Per Nathan, clang catches unused "static inline" functions in C files +since commit 6863f5643dd7 ("kbuild: allow Clang to find unused static +inline functions for W=1 build"). + +Linus said: + +> So I entirely ignore W=1 issues, because I think so many of the extra +> warnings are bogus. +> +> But if this one in particular is causing more problems than most - +> some teams do seem to use W=1 as part of their test builds - it's fine +> to send me a patch that just moves bad warnings to W=2. +> +> And if anybody uses W=2 for their test builds, that's THEIR problem.. + +Here is the change to bump the warning from W=1 to W=2. + +Fixes: 6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build") +Signed-off-by: Peter Zijlstra +Signed-off-by: Andy Shevchenko +Link: https://patch.msgid.link/20251106105000.2103276-1-andriy.shevchenko@linux.intel.com +[nathan: Adjust comment as well] +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + include/linux/compiler_types.h | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h +index eb2bda017ccb7..9cecd02c1280a 100644 +--- a/include/linux/compiler_types.h ++++ b/include/linux/compiler_types.h +@@ -158,10 +158,9 @@ struct ftrace_likely_data { + /* + * GCC does not warn about unused static inline functions for -Wunused-function. + * Suppress the warning in clang as well by using __maybe_unused, but enable it +- * for W=1 build. This will allow clang to find unused functions. Remove the +- * __inline_maybe_unused entirely after fixing most of -Wunused-function warnings. ++ * for W=2 build. This will allow clang to find unused functions. + */ +-#ifdef KBUILD_EXTRA_WARN1 ++#ifdef KBUILD_EXTRA_WARN2 + #define __inline_maybe_unused + #else + #define __inline_maybe_unused __maybe_unused +-- +2.51.0 + diff --git a/queue-5.10/hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch b/queue-5.10/hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch new file mode 100644 index 0000000000..d3a1a24d02 --- /dev/null +++ b/queue-5.10/hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch @@ -0,0 +1,54 @@ +From e98b0d1b8039e4a147651ac12bf76ed45c1c8c49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Sep 2025 18:25:43 +0200 +Subject: HID: quirks: avoid Cooler Master MM712 dongle wakeup bug + +From: Tristan Lobb + +[ Upstream commit 0be4253bf878d9aaa2b96031ac8683fceeb81480 ] + +The Cooler Master Mice Dongle includes a vendor defined HID interface +alongside its mouse interface. Not polling it will cause the mouse to +stop responding to polls on any interface once woken up again after +going into power saving mode. + +Add the HID_QUIRK_ALWAYS_POLL quirk alongside the Cooler Master VID and +the Dongle's PID. + +Signed-off-by: Tristan Lobb +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 3 +++ + drivers/hid/hid-quirks.c | 1 + + 2 files changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 8bfa90e37ea17..c213f1cc8aebc 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -298,6 +298,9 @@ + #define USB_DEVICE_ID_CODEMERCS_IOW_FIRST 0x1500 + #define USB_DEVICE_ID_CODEMERCS_IOW_LAST 0x15ff + ++#define USB_VENDOR_ID_COOLER_MASTER 0x2516 ++#define USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE 0x01b7 ++ + #define USB_VENDOR_ID_CORSAIR 0x1b1c + #define USB_DEVICE_ID_CORSAIR_K90 0x1b02 + +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 9c1c65612adb7..5fcd6f7b5f787 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -57,6 +57,7 @@ static const struct hid_device_id hid_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_THROTTLE), HID_QUIRK_NOGET }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_COOLER_MASTER, USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB), HID_QUIRK_NO_INIT_REPORTS }, + { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE), HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB), HID_QUIRK_NO_INIT_REPORTS }, +-- +2.51.0 + diff --git a/queue-5.10/nfs4-fix-state-renewals-missing-after-boot.patch b/queue-5.10/nfs4-fix-state-renewals-missing-after-boot.patch new file mode 100644 index 0000000000..218648b4c9 --- /dev/null +++ b/queue-5.10/nfs4-fix-state-renewals-missing-after-boot.patch @@ -0,0 +1,41 @@ +From fe5b7e76631bdcb7da917d8c908c08596126a905 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 15:48:04 -0600 +Subject: NFS4: Fix state renewals missing after boot + +From: Joshua Watt + +[ Upstream commit 9bb3baa9d1604cd20f49ae7dac9306b4037a0e7a ] + +Since the last renewal time was initialized to 0 and jiffies start +counting at -5 minutes, any clients connected in the first 5 minutes +after a reboot would have their renewal timer set to a very long +interval. If the connection was idle, this would result in the client +state timing out on the server and the next call to the server would +return NFS4ERR_BADSESSION. + +Fix this by initializing the last renewal time to the current jiffies +instead of 0. + +Signed-off-by: Joshua Watt +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4client.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c +index 89835457b7fda..5fd63df2db8b1 100644 +--- a/fs/nfs/nfs4client.c ++++ b/fs/nfs/nfs4client.c +@@ -221,6 +221,7 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init) + clp->cl_state = 1 << NFS4CLNT_LEASE_EXPIRED; + clp->cl_mvops = nfs_v4_minor_ops[cl_init->minorversion]; + clp->cl_mig_gen = 1; ++ clp->cl_last_renewal = jiffies; + #if IS_ENABLED(CONFIG_NFS_V4_1) + init_waitqueue_head(&clp->cl_lock_waitq); + #endif +-- +2.51.0 + diff --git a/queue-5.10/risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch b/queue-5.10/risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch new file mode 100644 index 0000000000..49b997f060 --- /dev/null +++ b/queue-5.10/risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch @@ -0,0 +1,49 @@ +From 7e32a9868d17b0b1a26fb2560a5abb664d56a4e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 16:28:46 +0300 +Subject: RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid + rfence errors + +From: Danil Skrebenkov + +[ Upstream commit ae9e9f3d67dcef7582a4524047b01e33c5185ddb ] + +openSBI v1.7 adds harts checks for ipi operations. Especially it +adds comparison between hmask passed as an argument from linux +and mask of online harts (from openSBI side). If they don't +fit each other the error occurs. + +When cpu is offline, cpu_online_mask is explicitly cleared in +__cpu_disable. However, there is no explicit clearing of +mm_cpumask. mm_cpumask is used for rfence operations that +call openSBI RFENCE extension which uses ipi to remote harts. +If hart is offline there may be error if mask of linux is not +as mask of online harts in openSBI. + +this patch adds explicit clearing of mm_cpumask for offline hart. + +Signed-off-by: Danil Skrebenkov +Reviewed-by: Andrew Jones +Link: https://lore.kernel.org/r/20250919132849.31676-1-danil.skrebenkov@cloudbear.ru +[pjw@kernel.org: rewrote subject line for clarity] +Signed-off-by: Paul Walmsley +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/cpu-hotplug.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/riscv/kernel/cpu-hotplug.c b/arch/riscv/kernel/cpu-hotplug.c +index 0e948e87bd813..6cd16a2af2ee0 100644 +--- a/arch/riscv/kernel/cpu-hotplug.c ++++ b/arch/riscv/kernel/cpu-hotplug.c +@@ -65,6 +65,7 @@ void __cpu_die(unsigned int cpu) + } + pr_notice("CPU%u: off\n", cpu); + ++ clear_tasks_mm_cpumask(cpu); + /* Verify from the firmware if the cpu is really stopped*/ + if (cpu_ops[cpu]->cpu_is_stopped) + ret = cpu_ops[cpu]->cpu_is_stopped(cpu); +-- +2.51.0 + diff --git a/queue-5.10/series b/queue-5.10/series index ad50f0fe9a..1a1ddf827d 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -170,3 +170,8 @@ net-usb-qmi_wwan-initialize-mac-header-offset-in-qmi.patch tracing-fix-memory-leaks-in-create_field_var.patch lib-crypto-curve25519-hacl64-fix-older-clang-kasan-workaround-for-gcc.patch extcon-adc-jack-cleanup-wakeup-source-only-if-it-was-enabled.patch +compiler_types-move-unused-static-inline-functions-w.patch +risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch +nfs4-fix-state-renewals-missing-after-boot.patch +hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch +asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch diff --git a/queue-5.15/asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch b/queue-5.15/asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch new file mode 100644 index 0000000000..ed51179478 --- /dev/null +++ b/queue-5.15/asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch @@ -0,0 +1,43 @@ +From 372e6bb577bb081f6b5f1ce7a4dff0528ef7b1fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Oct 2025 15:42:15 +0200 +Subject: ASoC: max98090/91: fixed max98091 ALSA widget powering up/down + +From: Sharique Mohammad + +[ Upstream commit 7a37291ed40a33a5f6c3d370fdde5ee0d8f7d0e4 ] + +The widgets DMIC3_ENA and DMIC4_ENA must be defined in the DAPM +suppy widget, just like DMICL_ENA and DMICR_ENA. Whenever they +are turned on or off, the required startup or shutdown sequences +must be taken care by the max98090_shdn_event. + +Signed-off-by: Sharique Mohammad +Link: https://patch.msgid.link/20251015134215.750001-1-sharq0406@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/max98090.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c +index 5513acd360b8f..3cf41870978da 100644 +--- a/sound/soc/codecs/max98090.c ++++ b/sound/soc/codecs/max98090.c +@@ -1233,9 +1233,11 @@ static const struct snd_soc_dapm_widget max98091_dapm_widgets[] = { + SND_SOC_DAPM_INPUT("DMIC4"), + + SND_SOC_DAPM_SUPPLY("DMIC3_ENA", M98090_REG_DIGITAL_MIC_ENABLE, +- M98090_DIGMIC3_SHIFT, 0, NULL, 0), ++ M98090_DIGMIC3_SHIFT, 0, max98090_shdn_event, ++ SND_SOC_DAPM_POST_PMU), + SND_SOC_DAPM_SUPPLY("DMIC4_ENA", M98090_REG_DIGITAL_MIC_ENABLE, +- M98090_DIGMIC4_SHIFT, 0, NULL, 0), ++ M98090_DIGMIC4_SHIFT, 0, max98090_shdn_event, ++ SND_SOC_DAPM_POST_PMU), + }; + + static const struct snd_soc_dapm_route max98090_dapm_routes[] = { +-- +2.51.0 + diff --git a/queue-5.15/compiler_types-move-unused-static-inline-functions-w.patch b/queue-5.15/compiler_types-move-unused-static-inline-functions-w.patch new file mode 100644 index 0000000000..87fd7a63da --- /dev/null +++ b/queue-5.15/compiler_types-move-unused-static-inline-functions-w.patch @@ -0,0 +1,57 @@ +From 46acbf27382d73b466b807a6d956acbcf16ad5e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Nov 2025 11:50:00 +0100 +Subject: compiler_types: Move unused static inline functions warning to W=2 + +From: Peter Zijlstra + +[ Upstream commit 9818af18db4bfefd320d0fef41390a616365e6f7 ] + +Per Nathan, clang catches unused "static inline" functions in C files +since commit 6863f5643dd7 ("kbuild: allow Clang to find unused static +inline functions for W=1 build"). + +Linus said: + +> So I entirely ignore W=1 issues, because I think so many of the extra +> warnings are bogus. +> +> But if this one in particular is causing more problems than most - +> some teams do seem to use W=1 as part of their test builds - it's fine +> to send me a patch that just moves bad warnings to W=2. +> +> And if anybody uses W=2 for their test builds, that's THEIR problem.. + +Here is the change to bump the warning from W=1 to W=2. + +Fixes: 6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build") +Signed-off-by: Peter Zijlstra +Signed-off-by: Andy Shevchenko +Link: https://patch.msgid.link/20251106105000.2103276-1-andriy.shevchenko@linux.intel.com +[nathan: Adjust comment as well] +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + include/linux/compiler_types.h | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h +index 4f2203c4a2574..ca9345e2934d3 100644 +--- a/include/linux/compiler_types.h ++++ b/include/linux/compiler_types.h +@@ -163,10 +163,9 @@ struct ftrace_likely_data { + /* + * GCC does not warn about unused static inline functions for -Wunused-function. + * Suppress the warning in clang as well by using __maybe_unused, but enable it +- * for W=1 build. This will allow clang to find unused functions. Remove the +- * __inline_maybe_unused entirely after fixing most of -Wunused-function warnings. ++ * for W=2 build. This will allow clang to find unused functions. + */ +-#ifdef KBUILD_EXTRA_WARN1 ++#ifdef KBUILD_EXTRA_WARN2 + #define __inline_maybe_unused + #else + #define __inline_maybe_unused __maybe_unused +-- +2.51.0 + diff --git a/queue-5.15/drm-i915-avoid-lock-inversion-when-pinning-to-ggtt-o.patch b/queue-5.15/drm-i915-avoid-lock-inversion-when-pinning-to-ggtt-o.patch new file mode 100644 index 0000000000..c8718af6b9 --- /dev/null +++ b/queue-5.15/drm-i915-avoid-lock-inversion-when-pinning-to-ggtt-o.patch @@ -0,0 +1,276 @@ +From c606352873b0607b1c3c2196df413d887e90d4b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Oct 2025 10:25:19 +0200 +Subject: drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD + +From: Janusz Krzysztofik + +[ Upstream commit 84bbe327a5cbb060f3321c9d9d4d53936fc1ef9b ] + +On completion of i915_vma_pin_ww(), a synchronous variant of +dma_fence_work_commit() is called. When pinning a VMA to GGTT address +space on a Cherry View family processor, or on a Broxton generation SoC +with VTD enabled, i.e., when stop_machine() is then called from +intel_ggtt_bind_vma(), that can potentially lead to lock inversion among +reservation_ww and cpu_hotplug locks. + +[86.861179] ====================================================== +[86.861193] WARNING: possible circular locking dependency detected +[86.861209] 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 Tainted: G U +[86.861226] ------------------------------------------------------ +[86.861238] i915_module_loa/1432 is trying to acquire lock: +[86.861252] ffffffff83489090 (cpu_hotplug_lock){++++}-{0:0}, at: stop_machine+0x1c/0x50 +[86.861290] +but task is already holding lock: +[86.861303] ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915] +[86.862233] +which lock already depends on the new lock. +[86.862251] +the existing dependency chain (in reverse order) is: +[86.862265] +-> #5 (reservation_ww_class_mutex){+.+.}-{3:3}: +[86.862292] dma_resv_lockdep+0x19a/0x390 +[86.862315] do_one_initcall+0x60/0x3f0 +[86.862334] kernel_init_freeable+0x3cd/0x680 +[86.862353] kernel_init+0x1b/0x200 +[86.862369] ret_from_fork+0x47/0x70 +[86.862383] ret_from_fork_asm+0x1a/0x30 +[86.862399] +-> #4 (reservation_ww_class_acquire){+.+.}-{0:0}: +[86.862425] dma_resv_lockdep+0x178/0x390 +[86.862440] do_one_initcall+0x60/0x3f0 +[86.862454] kernel_init_freeable+0x3cd/0x680 +[86.862470] kernel_init+0x1b/0x200 +[86.862482] ret_from_fork+0x47/0x70 +[86.862495] ret_from_fork_asm+0x1a/0x30 +[86.862509] +-> #3 (&mm->mmap_lock){++++}-{3:3}: +[86.862531] down_read_killable+0x46/0x1e0 +[86.862546] lock_mm_and_find_vma+0xa2/0x280 +[86.862561] do_user_addr_fault+0x266/0x8e0 +[86.862578] exc_page_fault+0x8a/0x2f0 +[86.862593] asm_exc_page_fault+0x27/0x30 +[86.862607] filldir64+0xeb/0x180 +[86.862620] kernfs_fop_readdir+0x118/0x480 +[86.862635] iterate_dir+0xcf/0x2b0 +[86.862648] __x64_sys_getdents64+0x84/0x140 +[86.862661] x64_sys_call+0x1058/0x2660 +[86.862675] do_syscall_64+0x91/0xe90 +[86.862689] entry_SYSCALL_64_after_hwframe+0x76/0x7e +[86.862703] +-> #2 (&root->kernfs_rwsem){++++}-{3:3}: +[86.862725] down_write+0x3e/0xf0 +[86.862738] kernfs_add_one+0x30/0x3c0 +[86.862751] kernfs_create_dir_ns+0x53/0xb0 +[86.862765] internal_create_group+0x134/0x4c0 +[86.862779] sysfs_create_group+0x13/0x20 +[86.862792] topology_add_dev+0x1d/0x30 +[86.862806] cpuhp_invoke_callback+0x4b5/0x850 +[86.862822] cpuhp_issue_call+0xbf/0x1f0 +[86.862836] __cpuhp_setup_state_cpuslocked+0x111/0x320 +[86.862852] __cpuhp_setup_state+0xb0/0x220 +[86.862866] topology_sysfs_init+0x30/0x50 +[86.862879] do_one_initcall+0x60/0x3f0 +[86.862893] kernel_init_freeable+0x3cd/0x680 +[86.862908] kernel_init+0x1b/0x200 +[86.862921] ret_from_fork+0x47/0x70 +[86.862934] ret_from_fork_asm+0x1a/0x30 +[86.862947] +-> #1 (cpuhp_state_mutex){+.+.}-{3:3}: +[86.862969] __mutex_lock+0xaa/0xed0 +[86.862982] mutex_lock_nested+0x1b/0x30 +[86.862995] __cpuhp_setup_state_cpuslocked+0x67/0x320 +[86.863012] __cpuhp_setup_state+0xb0/0x220 +[86.863026] page_alloc_init_cpuhp+0x2d/0x60 +[86.863041] mm_core_init+0x22/0x2d0 +[86.863054] start_kernel+0x576/0xbd0 +[86.863068] x86_64_start_reservations+0x18/0x30 +[86.863084] x86_64_start_kernel+0xbf/0x110 +[86.863098] common_startup_64+0x13e/0x141 +[86.863114] +-> #0 (cpu_hotplug_lock){++++}-{0:0}: +[86.863135] __lock_acquire+0x1635/0x2810 +[86.863152] lock_acquire+0xc4/0x2f0 +[86.863166] cpus_read_lock+0x41/0x100 +[86.863180] stop_machine+0x1c/0x50 +[86.863194] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915] +[86.863987] intel_ggtt_bind_vma+0x43/0x70 [i915] +[86.864735] __vma_bind+0x55/0x70 [i915] +[86.865510] fence_work+0x26/0xa0 [i915] +[86.866248] fence_notify+0xa1/0x140 [i915] +[86.866983] __i915_sw_fence_complete+0x8f/0x270 [i915] +[86.867719] i915_sw_fence_commit+0x39/0x60 [i915] +[86.868453] i915_vma_pin_ww+0x462/0x1360 [i915] +[86.869228] i915_vma_pin.constprop.0+0x133/0x1d0 [i915] +[86.870001] initial_plane_vma+0x307/0x840 [i915] +[86.870774] intel_initial_plane_config+0x33f/0x670 [i915] +[86.871546] intel_display_driver_probe_nogem+0x1c6/0x260 [i915] +[86.872330] i915_driver_probe+0x7fa/0xe80 [i915] +[86.873057] i915_pci_probe+0xe6/0x220 [i915] +[86.873782] local_pci_probe+0x47/0xb0 +[86.873802] pci_device_probe+0xf3/0x260 +[86.873817] really_probe+0xf1/0x3c0 +[86.873833] __driver_probe_device+0x8c/0x180 +[86.873848] driver_probe_device+0x24/0xd0 +[86.873862] __driver_attach+0x10f/0x220 +[86.873876] bus_for_each_dev+0x7f/0xe0 +[86.873892] driver_attach+0x1e/0x30 +[86.873904] bus_add_driver+0x151/0x290 +[86.873917] driver_register+0x5e/0x130 +[86.873931] __pci_register_driver+0x7d/0x90 +[86.873945] i915_pci_register_driver+0x23/0x30 [i915] +[86.874678] i915_init+0x37/0x120 [i915] +[86.875347] do_one_initcall+0x60/0x3f0 +[86.875369] do_init_module+0x97/0x2a0 +[86.875385] load_module+0x2c54/0x2d80 +[86.875398] init_module_from_file+0x96/0xe0 +[86.875413] idempotent_init_module+0x117/0x330 +[86.875426] __x64_sys_finit_module+0x77/0x100 +[86.875440] x64_sys_call+0x24de/0x2660 +[86.875454] do_syscall_64+0x91/0xe90 +[86.875470] entry_SYSCALL_64_after_hwframe+0x76/0x7e +[86.875486] +other info that might help us debug this: +[86.875502] Chain exists of: + cpu_hotplug_lock --> reservation_ww_class_acquire --> reservation_ww_class_mutex +[86.875539] Possible unsafe locking scenario: +[86.875552] CPU0 CPU1 +[86.875563] ---- ---- +[86.875573] lock(reservation_ww_class_mutex); +[86.875588] lock(reservation_ww_class_acquire); +[86.875606] lock(reservation_ww_class_mutex); +[86.875624] rlock(cpu_hotplug_lock); +[86.875637] + *** DEADLOCK *** +[86.875650] 3 locks held by i915_module_loa/1432: +[86.875663] #0: ffff888101f5c1b0 (&dev->mutex){....}-{3:3}, at: __driver_attach+0x104/0x220 +[86.875699] #1: ffffc90002e0b4a0 (reservation_ww_class_acquire){+.+.}-{0:0}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915] +[86.876512] #2: ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915] +[86.877305] +stack backtrace: +[86.877326] CPU: 0 UID: 0 PID: 1432 Comm: i915_module_loa Tainted: G U 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 PREEMPT(voluntary) +[86.877334] Tainted: [U]=USER +[86.877336] Hardware name: /NUC5CPYB, BIOS PYBSWCEL.86A.0079.2020.0420.1316 04/20/2020 +[86.877339] Call Trace: +[86.877344] +[86.877353] dump_stack_lvl+0x91/0xf0 +[86.877364] dump_stack+0x10/0x20 +[86.877369] print_circular_bug+0x285/0x360 +[86.877379] check_noncircular+0x135/0x150 +[86.877390] __lock_acquire+0x1635/0x2810 +[86.877403] lock_acquire+0xc4/0x2f0 +[86.877408] ? stop_machine+0x1c/0x50 +[86.877422] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915] +[86.878173] cpus_read_lock+0x41/0x100 +[86.878182] ? stop_machine+0x1c/0x50 +[86.878191] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915] +[86.878916] stop_machine+0x1c/0x50 +[86.878927] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915] +[86.879652] intel_ggtt_bind_vma+0x43/0x70 [i915] +[86.880375] __vma_bind+0x55/0x70 [i915] +[86.881133] fence_work+0x26/0xa0 [i915] +[86.881851] fence_notify+0xa1/0x140 [i915] +[86.882566] __i915_sw_fence_complete+0x8f/0x270 [i915] +[86.883286] i915_sw_fence_commit+0x39/0x60 [i915] +[86.884003] i915_vma_pin_ww+0x462/0x1360 [i915] +[86.884756] ? i915_vma_pin.constprop.0+0x6c/0x1d0 [i915] +[86.885513] i915_vma_pin.constprop.0+0x133/0x1d0 [i915] +[86.886281] initial_plane_vma+0x307/0x840 [i915] +[86.887049] intel_initial_plane_config+0x33f/0x670 [i915] +[86.887819] intel_display_driver_probe_nogem+0x1c6/0x260 [i915] +[86.888587] i915_driver_probe+0x7fa/0xe80 [i915] +[86.889293] ? mutex_unlock+0x12/0x20 +[86.889301] ? drm_privacy_screen_get+0x171/0x190 +[86.889308] ? acpi_dev_found+0x66/0x80 +[86.889321] i915_pci_probe+0xe6/0x220 [i915] +[86.890038] local_pci_probe+0x47/0xb0 +[86.890049] pci_device_probe+0xf3/0x260 +[86.890058] really_probe+0xf1/0x3c0 +[86.890067] __driver_probe_device+0x8c/0x180 +[86.890072] driver_probe_device+0x24/0xd0 +[86.890078] __driver_attach+0x10f/0x220 +[86.890083] ? __pfx___driver_attach+0x10/0x10 +[86.890088] bus_for_each_dev+0x7f/0xe0 +[86.890097] driver_attach+0x1e/0x30 +[86.890101] bus_add_driver+0x151/0x290 +[86.890107] driver_register+0x5e/0x130 +[86.890113] __pci_register_driver+0x7d/0x90 +[86.890119] i915_pci_register_driver+0x23/0x30 [i915] +[86.890833] i915_init+0x37/0x120 [i915] +[86.891482] ? __pfx_i915_init+0x10/0x10 [i915] +[86.892135] do_one_initcall+0x60/0x3f0 +[86.892145] ? __kmalloc_cache_noprof+0x33f/0x470 +[86.892157] do_init_module+0x97/0x2a0 +[86.892164] load_module+0x2c54/0x2d80 +[86.892168] ? __kernel_read+0x15c/0x300 +[86.892185] ? kernel_read_file+0x2b1/0x320 +[86.892195] init_module_from_file+0x96/0xe0 +[86.892199] ? init_module_from_file+0x96/0xe0 +[86.892211] idempotent_init_module+0x117/0x330 +[86.892224] __x64_sys_finit_module+0x77/0x100 +[86.892230] x64_sys_call+0x24de/0x2660 +[86.892236] do_syscall_64+0x91/0xe90 +[86.892243] ? irqentry_exit+0x77/0xb0 +[86.892249] ? sysvec_apic_timer_interrupt+0x57/0xc0 +[86.892256] entry_SYSCALL_64_after_hwframe+0x76/0x7e +[86.892261] RIP: 0033:0x7303e1b2725d +[86.892271] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8b bb 0d 00 f7 d8 64 89 01 48 +[86.892276] RSP: 002b:00007ffddd1fdb38 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 +[86.892281] RAX: ffffffffffffffda RBX: 00005d771d88fd90 RCX: 00007303e1b2725d +[86.892285] RDX: 0000000000000000 RSI: 00005d771d893aa0 RDI: 000000000000000c +[86.892287] RBP: 00007ffddd1fdbf0 R08: 0000000000000040 R09: 00007ffddd1fdb80 +[86.892289] R10: 00007303e1c03b20 R11: 0000000000000246 R12: 00005d771d893aa0 +[86.892292] R13: 0000000000000000 R14: 00005d771d88f0d0 R15: 00005d771d895710 +[86.892304] + +Call asynchronous variant of dma_fence_work_commit() in that case. + +v3: Provide more verbose in-line comment (Andi), + - mention target environments in commit message. + +Fixes: 7d1c2618eac59 ("drm/i915: Take reservation lock around i915_vma_pin.") +Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14985 +Cc: Andi Shyti +Signed-off-by: Janusz Krzysztofik +Reviewed-by: Sebastian Brzezinka +Reviewed-by: Krzysztof Karas +Acked-by: Andi Shyti +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20251023082925.351307-6-janusz.krzysztofik@linux.intel.com +(cherry picked from commit 648ef1324add1c2e2b6041cdf0b28d31fbca5f13) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/i915_vma.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c +index 3df304edabc79..d9ca42203517a 100644 +--- a/drivers/gpu/drm/i915/i915_vma.c ++++ b/drivers/gpu/drm/i915/i915_vma.c +@@ -1012,8 +1012,20 @@ int i915_vma_pin_ww(struct i915_vma *vma, struct i915_gem_ww_ctx *ww, + err_unlock: + mutex_unlock(&vma->vm->mutex); + err_fence: +- if (work) +- dma_fence_work_commit_imm(&work->base); ++ if (work) { ++ /* ++ * When pinning VMA to GGTT on CHV or BXT with VTD enabled, ++ * commit VMA binding asynchronously to avoid risk of lock ++ * inversion among reservation_ww locks held here and ++ * cpu_hotplug_lock acquired from stop_machine(), which we ++ * wrap around GGTT updates when running in those environments. ++ */ ++ if (i915_vma_is_ggtt(vma) && ++ intel_vm_no_concurrent_access_wa(vma->vm->i915)) ++ dma_fence_work_commit(&work->base); ++ else ++ dma_fence_work_commit_imm(&work->base); ++ } + err_rpm: + if (wakeref) + intel_runtime_pm_put(&vma->vm->i915->runtime_pm, wakeref); +-- +2.51.0 + diff --git a/queue-5.15/hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch b/queue-5.15/hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch new file mode 100644 index 0000000000..76d5777682 --- /dev/null +++ b/queue-5.15/hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch @@ -0,0 +1,54 @@ +From 06a60855d75e8e2c09f28d21d0e689bde4541599 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Sep 2025 18:25:43 +0200 +Subject: HID: quirks: avoid Cooler Master MM712 dongle wakeup bug + +From: Tristan Lobb + +[ Upstream commit 0be4253bf878d9aaa2b96031ac8683fceeb81480 ] + +The Cooler Master Mice Dongle includes a vendor defined HID interface +alongside its mouse interface. Not polling it will cause the mouse to +stop responding to polls on any interface once woken up again after +going into power saving mode. + +Add the HID_QUIRK_ALWAYS_POLL quirk alongside the Cooler Master VID and +the Dongle's PID. + +Signed-off-by: Tristan Lobb +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 3 +++ + drivers/hid/hid-quirks.c | 1 + + 2 files changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index bdad42f1e9f96..906e0c37a8e7e 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -304,6 +304,9 @@ + #define USB_DEVICE_ID_CODEMERCS_IOW_FIRST 0x1500 + #define USB_DEVICE_ID_CODEMERCS_IOW_LAST 0x15ff + ++#define USB_VENDOR_ID_COOLER_MASTER 0x2516 ++#define USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE 0x01b7 ++ + #define USB_VENDOR_ID_CORSAIR 0x1b1c + #define USB_DEVICE_ID_CORSAIR_K90 0x1b02 + #define USB_DEVICE_ID_CORSAIR_K70R 0x1b09 +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 72b7aebcc771f..3f83070349b82 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -57,6 +57,7 @@ static const struct hid_device_id hid_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_THROTTLE), HID_QUIRK_NOGET }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_COOLER_MASTER, USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB), HID_QUIRK_NO_INIT_REPORTS }, + { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE), HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB), HID_QUIRK_NO_INIT_REPORTS }, +-- +2.51.0 + diff --git a/queue-5.15/nfs-check-if-suid-sgid-was-cleared-after-a-write-as-.patch b/queue-5.15/nfs-check-if-suid-sgid-was-cleared-after-a-write-as-.patch new file mode 100644 index 0000000000..562fc866ab --- /dev/null +++ b/queue-5.15/nfs-check-if-suid-sgid-was-cleared-after-a-write-as-.patch @@ -0,0 +1,45 @@ +From e395ca66d41671314ab4dd7d78af75d0517487f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 16:42:12 -0400 +Subject: NFS: check if suid/sgid was cleared after a write as needed + +From: Scott Mayhew + +[ Upstream commit 9ff022f3820a31507cb93be6661bf5f3ca0609a4 ] + +I noticed xfstests generic/193 and generic/355 started failing against +knfsd after commit e7a8ebc305f2 ("NFSD: Offer write delegation for OPEN +with OPEN4_SHARE_ACCESS_WRITE"). + +I ran those same tests against ONTAP (which has had write delegation +support for a lot longer than knfsd) and they fail there too... so +while it's a new failure against knfsd, it isn't an entirely new +failure. + +Add the NFS_INO_REVAL_FORCED flag so that the presence of a delegation +doesn't keep the inode from being revalidated to fetch the updated mode. + +Signed-off-by: Scott Mayhew +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/write.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/nfs/write.c b/fs/nfs/write.c +index 9323631f4889c..914a2d7a09742 100644 +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -1619,7 +1619,8 @@ static int nfs_writeback_done(struct rpc_task *task, + /* Deal with the suid/sgid bit corner case */ + if (nfs_should_remove_suid(inode)) { + spin_lock(&inode->i_lock); +- nfs_set_cache_invalid(inode, NFS_INO_INVALID_MODE); ++ nfs_set_cache_invalid(inode, NFS_INO_INVALID_MODE ++ | NFS_INO_REVAL_FORCED); + spin_unlock(&inode->i_lock); + } + return 0; +-- +2.51.0 + diff --git a/queue-5.15/nfs4-fix-state-renewals-missing-after-boot.patch b/queue-5.15/nfs4-fix-state-renewals-missing-after-boot.patch new file mode 100644 index 0000000000..b36ce58f1e --- /dev/null +++ b/queue-5.15/nfs4-fix-state-renewals-missing-after-boot.patch @@ -0,0 +1,41 @@ +From 080b5abe85ca8cd5482117ec6184aef6ff5a06a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 15:48:04 -0600 +Subject: NFS4: Fix state renewals missing after boot + +From: Joshua Watt + +[ Upstream commit 9bb3baa9d1604cd20f49ae7dac9306b4037a0e7a ] + +Since the last renewal time was initialized to 0 and jiffies start +counting at -5 minutes, any clients connected in the first 5 minutes +after a reboot would have their renewal timer set to a very long +interval. If the connection was idle, this would result in the client +state timing out on the server and the next call to the server would +return NFS4ERR_BADSESSION. + +Fix this by initializing the last renewal time to the current jiffies +instead of 0. + +Signed-off-by: Joshua Watt +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4client.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c +index 7e4b126e3061e..02082580d34eb 100644 +--- a/fs/nfs/nfs4client.c ++++ b/fs/nfs/nfs4client.c +@@ -221,6 +221,7 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init) + clp->cl_state = 1 << NFS4CLNT_LEASE_EXPIRED; + clp->cl_mvops = nfs_v4_minor_ops[cl_init->minorversion]; + clp->cl_mig_gen = 1; ++ clp->cl_last_renewal = jiffies; + #if IS_ENABLED(CONFIG_NFS_V4_1) + init_waitqueue_head(&clp->cl_lock_waitq); + #endif +-- +2.51.0 + diff --git a/queue-5.15/risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch b/queue-5.15/risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch new file mode 100644 index 0000000000..5b78e69ca1 --- /dev/null +++ b/queue-5.15/risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch @@ -0,0 +1,49 @@ +From b3e304a44d35dc36ebd08bd74c131cb49b938279 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 16:28:46 +0300 +Subject: RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid + rfence errors + +From: Danil Skrebenkov + +[ Upstream commit ae9e9f3d67dcef7582a4524047b01e33c5185ddb ] + +openSBI v1.7 adds harts checks for ipi operations. Especially it +adds comparison between hmask passed as an argument from linux +and mask of online harts (from openSBI side). If they don't +fit each other the error occurs. + +When cpu is offline, cpu_online_mask is explicitly cleared in +__cpu_disable. However, there is no explicit clearing of +mm_cpumask. mm_cpumask is used for rfence operations that +call openSBI RFENCE extension which uses ipi to remote harts. +If hart is offline there may be error if mask of linux is not +as mask of online harts in openSBI. + +this patch adds explicit clearing of mm_cpumask for offline hart. + +Signed-off-by: Danil Skrebenkov +Reviewed-by: Andrew Jones +Link: https://lore.kernel.org/r/20250919132849.31676-1-danil.skrebenkov@cloudbear.ru +[pjw@kernel.org: rewrote subject line for clarity] +Signed-off-by: Paul Walmsley +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/cpu-hotplug.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/riscv/kernel/cpu-hotplug.c b/arch/riscv/kernel/cpu-hotplug.c +index 28a3fa6e67d79..25659db3b1a43 100644 +--- a/arch/riscv/kernel/cpu-hotplug.c ++++ b/arch/riscv/kernel/cpu-hotplug.c +@@ -67,6 +67,7 @@ void __cpu_die(unsigned int cpu) + } + pr_notice("CPU%u: off\n", cpu); + ++ clear_tasks_mm_cpumask(cpu); + /* Verify from the firmware if the cpu is really stopped*/ + if (cpu_ops[cpu]->cpu_is_stopped) + ret = cpu_ops[cpu]->cpu_is_stopped(cpu); +-- +2.51.0 + diff --git a/queue-5.15/series b/queue-5.15/series index fc35736ecc..f744700af6 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -228,3 +228,10 @@ rtc-rx8025-fix-incorrect-register-reference.patch lib-crypto-curve25519-hacl64-fix-older-clang-kasan-workaround-for-gcc.patch extcon-adc-jack-cleanup-wakeup-source-only-if-it-was-enabled.patch selftests-netdevsim-set-test-timeout-to-10-minutes.patch +drm-i915-avoid-lock-inversion-when-pinning-to-ggtt-o.patch +compiler_types-move-unused-static-inline-functions-w.patch +risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch +nfs4-fix-state-renewals-missing-after-boot.patch +hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch +nfs-check-if-suid-sgid-was-cleared-after-a-write-as-.patch +asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch diff --git a/queue-5.4/asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch b/queue-5.4/asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch new file mode 100644 index 0000000000..3d527fbd75 --- /dev/null +++ b/queue-5.4/asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch @@ -0,0 +1,43 @@ +From 27949746bdd1e0eb03b8fb2bd4ca901fcca1f361 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Oct 2025 15:42:15 +0200 +Subject: ASoC: max98090/91: fixed max98091 ALSA widget powering up/down + +From: Sharique Mohammad + +[ Upstream commit 7a37291ed40a33a5f6c3d370fdde5ee0d8f7d0e4 ] + +The widgets DMIC3_ENA and DMIC4_ENA must be defined in the DAPM +suppy widget, just like DMICL_ENA and DMICR_ENA. Whenever they +are turned on or off, the required startup or shutdown sequences +must be taken care by the max98090_shdn_event. + +Signed-off-by: Sharique Mohammad +Link: https://patch.msgid.link/20251015134215.750001-1-sharq0406@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/max98090.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c +index ce9f99dd3e87d..7955ba75255f1 100644 +--- a/sound/soc/codecs/max98090.c ++++ b/sound/soc/codecs/max98090.c +@@ -1231,9 +1231,11 @@ static const struct snd_soc_dapm_widget max98091_dapm_widgets[] = { + SND_SOC_DAPM_INPUT("DMIC4"), + + SND_SOC_DAPM_SUPPLY("DMIC3_ENA", M98090_REG_DIGITAL_MIC_ENABLE, +- M98090_DIGMIC3_SHIFT, 0, NULL, 0), ++ M98090_DIGMIC3_SHIFT, 0, max98090_shdn_event, ++ SND_SOC_DAPM_POST_PMU), + SND_SOC_DAPM_SUPPLY("DMIC4_ENA", M98090_REG_DIGITAL_MIC_ENABLE, +- M98090_DIGMIC4_SHIFT, 0, NULL, 0), ++ M98090_DIGMIC4_SHIFT, 0, max98090_shdn_event, ++ SND_SOC_DAPM_POST_PMU), + }; + + static const struct snd_soc_dapm_route max98090_dapm_routes[] = { +-- +2.51.0 + diff --git a/queue-5.4/compiler_types-move-unused-static-inline-functions-w.patch b/queue-5.4/compiler_types-move-unused-static-inline-functions-w.patch new file mode 100644 index 0000000000..8604dff15e --- /dev/null +++ b/queue-5.4/compiler_types-move-unused-static-inline-functions-w.patch @@ -0,0 +1,57 @@ +From 51d8d42dda656d55628b81aab5b3a81adb246620 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Nov 2025 11:50:00 +0100 +Subject: compiler_types: Move unused static inline functions warning to W=2 + +From: Peter Zijlstra + +[ Upstream commit 9818af18db4bfefd320d0fef41390a616365e6f7 ] + +Per Nathan, clang catches unused "static inline" functions in C files +since commit 6863f5643dd7 ("kbuild: allow Clang to find unused static +inline functions for W=1 build"). + +Linus said: + +> So I entirely ignore W=1 issues, because I think so many of the extra +> warnings are bogus. +> +> But if this one in particular is causing more problems than most - +> some teams do seem to use W=1 as part of their test builds - it's fine +> to send me a patch that just moves bad warnings to W=2. +> +> And if anybody uses W=2 for their test builds, that's THEIR problem.. + +Here is the change to bump the warning from W=1 to W=2. + +Fixes: 6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build") +Signed-off-by: Peter Zijlstra +Signed-off-by: Andy Shevchenko +Link: https://patch.msgid.link/20251106105000.2103276-1-andriy.shevchenko@linux.intel.com +[nathan: Adjust comment as well] +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + include/linux/compiler_types.h | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h +index b94d08d055ff5..a428104c5e777 100644 +--- a/include/linux/compiler_types.h ++++ b/include/linux/compiler_types.h +@@ -165,10 +165,9 @@ struct ftrace_likely_data { + /* + * GCC does not warn about unused static inline functions for -Wunused-function. + * Suppress the warning in clang as well by using __maybe_unused, but enable it +- * for W=1 build. This will allow clang to find unused functions. Remove the +- * __inline_maybe_unused entirely after fixing most of -Wunused-function warnings. ++ * for W=2 build. This will allow clang to find unused functions. + */ +-#ifdef KBUILD_EXTRA_WARN1 ++#ifdef KBUILD_EXTRA_WARN2 + #define __inline_maybe_unused + #else + #define __inline_maybe_unused __maybe_unused +-- +2.51.0 + diff --git a/queue-5.4/hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch b/queue-5.4/hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch new file mode 100644 index 0000000000..b26e86d961 --- /dev/null +++ b/queue-5.4/hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch @@ -0,0 +1,54 @@ +From 86ab2aad0e3e4d4d68b5aa359e3fef3e90a385fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Sep 2025 18:25:43 +0200 +Subject: HID: quirks: avoid Cooler Master MM712 dongle wakeup bug + +From: Tristan Lobb + +[ Upstream commit 0be4253bf878d9aaa2b96031ac8683fceeb81480 ] + +The Cooler Master Mice Dongle includes a vendor defined HID interface +alongside its mouse interface. Not polling it will cause the mouse to +stop responding to polls on any interface once woken up again after +going into power saving mode. + +Add the HID_QUIRK_ALWAYS_POLL quirk alongside the Cooler Master VID and +the Dongle's PID. + +Signed-off-by: Tristan Lobb +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 3 +++ + drivers/hid/hid-quirks.c | 1 + + 2 files changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index d2e355a9744a0..39b2602c41c7a 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -303,6 +303,9 @@ + #define USB_DEVICE_ID_CODEMERCS_IOW_FIRST 0x1500 + #define USB_DEVICE_ID_CODEMERCS_IOW_LAST 0x15ff + ++#define USB_VENDOR_ID_COOLER_MASTER 0x2516 ++#define USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE 0x01b7 ++ + #define USB_VENDOR_ID_CORSAIR 0x1b1c + #define USB_DEVICE_ID_CORSAIR_K90 0x1b02 + +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index d1cfd45f2585a..f81ea6c36040b 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -57,6 +57,7 @@ static const struct hid_device_id hid_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_THROTTLE), HID_QUIRK_NOGET }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_COOLER_MASTER, USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB), HID_QUIRK_NO_INIT_REPORTS }, + { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE), HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB), HID_QUIRK_NO_INIT_REPORTS }, +-- +2.51.0 + diff --git a/queue-5.4/nfs4-fix-state-renewals-missing-after-boot.patch b/queue-5.4/nfs4-fix-state-renewals-missing-after-boot.patch new file mode 100644 index 0000000000..33bad76b68 --- /dev/null +++ b/queue-5.4/nfs4-fix-state-renewals-missing-after-boot.patch @@ -0,0 +1,41 @@ +From 845f623adc7753f412b53ba12d60774a24581ced Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 15:48:04 -0600 +Subject: NFS4: Fix state renewals missing after boot + +From: Joshua Watt + +[ Upstream commit 9bb3baa9d1604cd20f49ae7dac9306b4037a0e7a ] + +Since the last renewal time was initialized to 0 and jiffies start +counting at -5 minutes, any clients connected in the first 5 minutes +after a reboot would have their renewal timer set to a very long +interval. If the connection was idle, this would result in the client +state timing out on the server and the next call to the server would +return NFS4ERR_BADSESSION. + +Fix this by initializing the last renewal time to the current jiffies +instead of 0. + +Signed-off-by: Joshua Watt +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4client.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c +index eeab44727a766..dcef5785c1528 100644 +--- a/fs/nfs/nfs4client.c ++++ b/fs/nfs/nfs4client.c +@@ -221,6 +221,7 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init) + clp->cl_state = 1 << NFS4CLNT_LEASE_EXPIRED; + clp->cl_mvops = nfs_v4_minor_ops[cl_init->minorversion]; + clp->cl_mig_gen = 1; ++ clp->cl_last_renewal = jiffies; + #if IS_ENABLED(CONFIG_NFS_V4_1) + init_waitqueue_head(&clp->cl_lock_waitq); + #endif +-- +2.51.0 + diff --git a/queue-5.4/series b/queue-5.4/series index 5080e48e8d..7fca1c3187 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -122,3 +122,7 @@ sctp-prevent-toctou-out-of-bounds-write.patch net-usb-qmi_wwan-initialize-mac-header-offset-in-qmi.patch tracing-fix-memory-leaks-in-create_field_var.patch extcon-adc-jack-cleanup-wakeup-source-only-if-it-was-enabled.patch +compiler_types-move-unused-static-inline-functions-w.patch +nfs4-fix-state-renewals-missing-after-boot.patch +hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch +asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch diff --git a/queue-6.1/asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch b/queue-6.1/asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch new file mode 100644 index 0000000000..dad22926bb --- /dev/null +++ b/queue-6.1/asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch @@ -0,0 +1,43 @@ +From d6f5048950be70198d84515ac91f7069eab0e32d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Oct 2025 15:42:15 +0200 +Subject: ASoC: max98090/91: fixed max98091 ALSA widget powering up/down + +From: Sharique Mohammad + +[ Upstream commit 7a37291ed40a33a5f6c3d370fdde5ee0d8f7d0e4 ] + +The widgets DMIC3_ENA and DMIC4_ENA must be defined in the DAPM +suppy widget, just like DMICL_ENA and DMICR_ENA. Whenever they +are turned on or off, the required startup or shutdown sequences +must be taken care by the max98090_shdn_event. + +Signed-off-by: Sharique Mohammad +Link: https://patch.msgid.link/20251015134215.750001-1-sharq0406@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/max98090.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c +index 06ed2a938108e..f5acf84ee20cc 100644 +--- a/sound/soc/codecs/max98090.c ++++ b/sound/soc/codecs/max98090.c +@@ -1235,9 +1235,11 @@ static const struct snd_soc_dapm_widget max98091_dapm_widgets[] = { + SND_SOC_DAPM_INPUT("DMIC4"), + + SND_SOC_DAPM_SUPPLY("DMIC3_ENA", M98090_REG_DIGITAL_MIC_ENABLE, +- M98090_DIGMIC3_SHIFT, 0, NULL, 0), ++ M98090_DIGMIC3_SHIFT, 0, max98090_shdn_event, ++ SND_SOC_DAPM_POST_PMU), + SND_SOC_DAPM_SUPPLY("DMIC4_ENA", M98090_REG_DIGITAL_MIC_ENABLE, +- M98090_DIGMIC4_SHIFT, 0, NULL, 0), ++ M98090_DIGMIC4_SHIFT, 0, max98090_shdn_event, ++ SND_SOC_DAPM_POST_PMU), + }; + + static const struct snd_soc_dapm_route max98090_dapm_routes[] = { +-- +2.51.0 + diff --git a/queue-6.1/compiler_types-move-unused-static-inline-functions-w.patch b/queue-6.1/compiler_types-move-unused-static-inline-functions-w.patch new file mode 100644 index 0000000000..bcdee19338 --- /dev/null +++ b/queue-6.1/compiler_types-move-unused-static-inline-functions-w.patch @@ -0,0 +1,57 @@ +From 16b0553e6a0c045f1317ea14dcc6c4203bafd77b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Nov 2025 11:50:00 +0100 +Subject: compiler_types: Move unused static inline functions warning to W=2 + +From: Peter Zijlstra + +[ Upstream commit 9818af18db4bfefd320d0fef41390a616365e6f7 ] + +Per Nathan, clang catches unused "static inline" functions in C files +since commit 6863f5643dd7 ("kbuild: allow Clang to find unused static +inline functions for W=1 build"). + +Linus said: + +> So I entirely ignore W=1 issues, because I think so many of the extra +> warnings are bogus. +> +> But if this one in particular is causing more problems than most - +> some teams do seem to use W=1 as part of their test builds - it's fine +> to send me a patch that just moves bad warnings to W=2. +> +> And if anybody uses W=2 for their test builds, that's THEIR problem.. + +Here is the change to bump the warning from W=1 to W=2. + +Fixes: 6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build") +Signed-off-by: Peter Zijlstra +Signed-off-by: Andy Shevchenko +Link: https://patch.msgid.link/20251106105000.2103276-1-andriy.shevchenko@linux.intel.com +[nathan: Adjust comment as well] +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + include/linux/compiler_types.h | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h +index 8f50c589ad5f4..44767d754dff6 100644 +--- a/include/linux/compiler_types.h ++++ b/include/linux/compiler_types.h +@@ -175,10 +175,9 @@ struct ftrace_likely_data { + /* + * GCC does not warn about unused static inline functions for -Wunused-function. + * Suppress the warning in clang as well by using __maybe_unused, but enable it +- * for W=1 build. This will allow clang to find unused functions. Remove the +- * __inline_maybe_unused entirely after fixing most of -Wunused-function warnings. ++ * for W=2 build. This will allow clang to find unused functions. + */ +-#ifdef KBUILD_EXTRA_WARN1 ++#ifdef KBUILD_EXTRA_WARN2 + #define __inline_maybe_unused + #else + #define __inline_maybe_unused __maybe_unused +-- +2.51.0 + diff --git a/queue-6.1/drm-amd-fix-suspend-failure-with-secure-display-ta.patch b/queue-6.1/drm-amd-fix-suspend-failure-with-secure-display-ta.patch new file mode 100644 index 0000000000..16683b1135 --- /dev/null +++ b/queue-6.1/drm-amd-fix-suspend-failure-with-secure-display-ta.patch @@ -0,0 +1,47 @@ +From 48336481f9576337c54fb2bbb434af73ab9f9ff8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Nov 2025 13:38:02 -0600 +Subject: drm/amd: Fix suspend failure with secure display TA + +From: Mario Limonciello + +[ Upstream commit b09cb2996cdf50cd1ab4020e002c95d742c81313 ] + +commit c760bcda83571 ("drm/amd: Check whether secure display TA loaded +successfully") attempted to fix extra messages, but failed to port the +cleanup that was in commit 5c6d52ff4b61e ("drm/amd: Don't try to enable +secure display TA multiple times") to prevent multiple tries. + +Add that to the failure handling path even on a quick failure. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4679 +Fixes: c760bcda8357 ("drm/amd: Check whether secure display TA loaded successfully") +Signed-off-by: Mario Limonciello +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +(cherry picked from commit 4104c0a454f6a4d1e0d14895d03c0e7bdd0c8240) +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index e22eaf9d450d3..9153459455910 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -1962,8 +1962,11 @@ static int psp_securedisplay_initialize(struct psp_context *psp) + if (!ret && !psp->securedisplay_context.context.resp_status) { + psp->securedisplay_context.context.initialized = true; + mutex_init(&psp->securedisplay_context.mutex); +- } else ++ } else { ++ /* don't try again */ ++ psp->securedisplay_context.context.bin_desc.size_bytes = 0; + return ret; ++ } + + psp_prep_securedisplay_cmd_buf(psp, &securedisplay_cmd, + TA_SECUREDISPLAY_COMMAND__QUERY_TA); +-- +2.51.0 + diff --git a/queue-6.1/drm-amd-pm-disable-mclk-switching-on-si-at-high-pixe.patch b/queue-6.1/drm-amd-pm-disable-mclk-switching-on-si-at-high-pixe.patch new file mode 100644 index 0000000000..c689ee32bf --- /dev/null +++ b/queue-6.1/drm-amd-pm-disable-mclk-switching-on-si-at-high-pixe.patch @@ -0,0 +1,43 @@ +From 859c1756ce2adb153e9d60cc9559ea490cf1362f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 20:26:12 +0200 +Subject: drm/amd/pm: Disable MCLK switching on SI at high pixel clocks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 5c05bcf6ae7732da1bd4dc1958d527b5f07f216a ] + +On various SI GPUs, a flickering can be observed near the bottom +edge of the screen when using a single 4K 60Hz monitor over DP. +Disabling MCLK switching works around this problem. + +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index 7a85c042a6db9..2395d0a831846 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -3485,6 +3485,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + * for these GPUs to calculate bandwidth requirements. + */ + if (high_pixelclock_count) { ++ /* Work around flickering lines at the bottom edge ++ * of the screen when using a single 4K 60Hz monitor. ++ */ ++ disable_mclk_switching = true; ++ + /* On Oland, we observe some flickering when two 4K 60Hz + * displays are connected, possibly because voltage is too low. + * Raise the voltage by requiring a higher SCLK. +-- +2.51.0 + diff --git a/queue-6.1/drm-amdgpu-fix-null-pointer-dereference-in-vram-logi.patch b/queue-6.1/drm-amdgpu-fix-null-pointer-dereference-in-vram-logi.patch new file mode 100644 index 0000000000..f17a61d581 --- /dev/null +++ b/queue-6.1/drm-amdgpu-fix-null-pointer-dereference-in-vram-logi.patch @@ -0,0 +1,113 @@ +From a0942be1cd9e5f37ff38307bfe7952a32009d0c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 13:46:12 +0800 +Subject: drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU + devices +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jesse.Zhang + +[ Upstream commit 883f309add55060233bf11c1ea6947140372920f ] + +Previously, APU platforms (and other scenarios with uninitialized VRAM managers) +triggered a NULL pointer dereference in `ttm_resource_manager_usage()`. The root +cause is not that the `struct ttm_resource_manager *man` pointer itself is NULL, +but that `man->bdev` (the backing device pointer within the manager) remains +uninitialized (NULL) on APUs—since APUs lack dedicated VRAM and do not fully +set up VRAM manager structures. When `ttm_resource_manager_usage()` attempts to +acquire `man->bdev->lru_lock`, it dereferences the NULL `man->bdev`, leading to +a kernel OOPS. + +1. **amdgpu_cs.c**: Extend the existing bandwidth control check in + `amdgpu_cs_get_threshold_for_moves()` to include a check for + `ttm_resource_manager_used()`. If the manager is not used (uninitialized + `bdev`), return 0 for migration thresholds immediately—skipping VRAM-specific + logic that would trigger the NULL dereference. + +2. **amdgpu_kms.c**: Update the `AMDGPU_INFO_VRAM_USAGE` ioctl and memory info + reporting to use a conditional: if the manager is used, return the real VRAM + usage; otherwise, return 0. This avoids accessing `man->bdev` when it is + NULL. + +3. **amdgpu_virt.c**: Modify the vf2pf (virtual function to physical function) + data write path. Use `ttm_resource_manager_used()` to check validity: if the + manager is usable, calculate `fb_usage` from VRAM usage; otherwise, set + `fb_usage` to 0 (APUs have no discrete framebuffer to report). + +This approach is more robust than APU-specific checks because it: +- Works for all scenarios where the VRAM manager is uninitialized (not just APUs), +- Aligns with TTM's design by using its native helper function, +- Preserves correct behavior for discrete GPUs (which have fully initialized + `man->bdev` and pass the `ttm_resource_manager_used()` check). + +v4: use ttm_resource_manager_used(&adev->mman.vram_mgr.manager) instead of checking the adev->gmc.is_app_apu flag (Christian) + +Reviewed-by: Christian König +Suggested-by: Lijo Lazar +Signed-off-by: Jesse Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- + drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 7 ++++--- + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 4 ++-- + 3 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +index 9ff6a9255c1b1..f83eff3c62e17 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +@@ -663,7 +663,7 @@ static void amdgpu_cs_get_threshold_for_moves(struct amdgpu_device *adev, + */ + const s64 us_upper_bound = 200000; + +- if (!adev->mm_stats.log2_max_MBps) { ++ if ((!adev->mm_stats.log2_max_MBps) || !ttm_resource_manager_used(&adev->mman.vram_mgr.manager)) { + *max_bytes = 0; + *max_vis_bytes = 0; + return; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +index 24b4bd6bb2771..345ccd721d745 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +@@ -647,7 +647,8 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) + ui64 = atomic64_read(&adev->num_vram_cpu_page_faults); + return copy_to_user(out, &ui64, min(size, 8u)) ? -EFAULT : 0; + case AMDGPU_INFO_VRAM_USAGE: +- ui64 = ttm_resource_manager_usage(&adev->mman.vram_mgr.manager); ++ ui64 = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ? ++ ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) : 0; + return copy_to_user(out, &ui64, min(size, 8u)) ? -EFAULT : 0; + case AMDGPU_INFO_VIS_VRAM_USAGE: + ui64 = amdgpu_vram_mgr_vis_usage(&adev->mman.vram_mgr); +@@ -693,8 +694,8 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) + mem.vram.usable_heap_size = adev->gmc.real_vram_size - + atomic64_read(&adev->vram_pin_size) - + AMDGPU_VM_RESERVED_VRAM; +- mem.vram.heap_usage = +- ttm_resource_manager_usage(vram_man); ++ mem.vram.heap_usage = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ? ++ ttm_resource_manager_usage(vram_man) : 0; + mem.vram.max_allocation = mem.vram.usable_heap_size * 3 / 4; + + mem.cpu_accessible_vram.total_heap_size = +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +index 6174bef0ecb88..c626ed88e6420 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +@@ -593,8 +593,8 @@ static int amdgpu_virt_write_vf2pf_data(struct amdgpu_device *adev) + vf2pf_info->driver_cert = 0; + vf2pf_info->os_info.all = 0; + +- vf2pf_info->fb_usage = +- ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) >> 20; ++ vf2pf_info->fb_usage = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ? ++ ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) >> 20 : 0; + vf2pf_info->fb_vis_usage = + amdgpu_vram_mgr_vis_usage(&adev->mman.vram_mgr) >> 20; + vf2pf_info->fb_size = adev->gmc.real_vram_size >> 20; +-- +2.51.0 + diff --git a/queue-6.1/drm-i915-avoid-lock-inversion-when-pinning-to-ggtt-o.patch b/queue-6.1/drm-i915-avoid-lock-inversion-when-pinning-to-ggtt-o.patch new file mode 100644 index 0000000000..ad5b9e50bb --- /dev/null +++ b/queue-6.1/drm-i915-avoid-lock-inversion-when-pinning-to-ggtt-o.patch @@ -0,0 +1,276 @@ +From ebac228b9b284bc32a7835cb3001c83dc94ffb06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Oct 2025 10:25:19 +0200 +Subject: drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD + +From: Janusz Krzysztofik + +[ Upstream commit 84bbe327a5cbb060f3321c9d9d4d53936fc1ef9b ] + +On completion of i915_vma_pin_ww(), a synchronous variant of +dma_fence_work_commit() is called. When pinning a VMA to GGTT address +space on a Cherry View family processor, or on a Broxton generation SoC +with VTD enabled, i.e., when stop_machine() is then called from +intel_ggtt_bind_vma(), that can potentially lead to lock inversion among +reservation_ww and cpu_hotplug locks. + +[86.861179] ====================================================== +[86.861193] WARNING: possible circular locking dependency detected +[86.861209] 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 Tainted: G U +[86.861226] ------------------------------------------------------ +[86.861238] i915_module_loa/1432 is trying to acquire lock: +[86.861252] ffffffff83489090 (cpu_hotplug_lock){++++}-{0:0}, at: stop_machine+0x1c/0x50 +[86.861290] +but task is already holding lock: +[86.861303] ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915] +[86.862233] +which lock already depends on the new lock. +[86.862251] +the existing dependency chain (in reverse order) is: +[86.862265] +-> #5 (reservation_ww_class_mutex){+.+.}-{3:3}: +[86.862292] dma_resv_lockdep+0x19a/0x390 +[86.862315] do_one_initcall+0x60/0x3f0 +[86.862334] kernel_init_freeable+0x3cd/0x680 +[86.862353] kernel_init+0x1b/0x200 +[86.862369] ret_from_fork+0x47/0x70 +[86.862383] ret_from_fork_asm+0x1a/0x30 +[86.862399] +-> #4 (reservation_ww_class_acquire){+.+.}-{0:0}: +[86.862425] dma_resv_lockdep+0x178/0x390 +[86.862440] do_one_initcall+0x60/0x3f0 +[86.862454] kernel_init_freeable+0x3cd/0x680 +[86.862470] kernel_init+0x1b/0x200 +[86.862482] ret_from_fork+0x47/0x70 +[86.862495] ret_from_fork_asm+0x1a/0x30 +[86.862509] +-> #3 (&mm->mmap_lock){++++}-{3:3}: +[86.862531] down_read_killable+0x46/0x1e0 +[86.862546] lock_mm_and_find_vma+0xa2/0x280 +[86.862561] do_user_addr_fault+0x266/0x8e0 +[86.862578] exc_page_fault+0x8a/0x2f0 +[86.862593] asm_exc_page_fault+0x27/0x30 +[86.862607] filldir64+0xeb/0x180 +[86.862620] kernfs_fop_readdir+0x118/0x480 +[86.862635] iterate_dir+0xcf/0x2b0 +[86.862648] __x64_sys_getdents64+0x84/0x140 +[86.862661] x64_sys_call+0x1058/0x2660 +[86.862675] do_syscall_64+0x91/0xe90 +[86.862689] entry_SYSCALL_64_after_hwframe+0x76/0x7e +[86.862703] +-> #2 (&root->kernfs_rwsem){++++}-{3:3}: +[86.862725] down_write+0x3e/0xf0 +[86.862738] kernfs_add_one+0x30/0x3c0 +[86.862751] kernfs_create_dir_ns+0x53/0xb0 +[86.862765] internal_create_group+0x134/0x4c0 +[86.862779] sysfs_create_group+0x13/0x20 +[86.862792] topology_add_dev+0x1d/0x30 +[86.862806] cpuhp_invoke_callback+0x4b5/0x850 +[86.862822] cpuhp_issue_call+0xbf/0x1f0 +[86.862836] __cpuhp_setup_state_cpuslocked+0x111/0x320 +[86.862852] __cpuhp_setup_state+0xb0/0x220 +[86.862866] topology_sysfs_init+0x30/0x50 +[86.862879] do_one_initcall+0x60/0x3f0 +[86.862893] kernel_init_freeable+0x3cd/0x680 +[86.862908] kernel_init+0x1b/0x200 +[86.862921] ret_from_fork+0x47/0x70 +[86.862934] ret_from_fork_asm+0x1a/0x30 +[86.862947] +-> #1 (cpuhp_state_mutex){+.+.}-{3:3}: +[86.862969] __mutex_lock+0xaa/0xed0 +[86.862982] mutex_lock_nested+0x1b/0x30 +[86.862995] __cpuhp_setup_state_cpuslocked+0x67/0x320 +[86.863012] __cpuhp_setup_state+0xb0/0x220 +[86.863026] page_alloc_init_cpuhp+0x2d/0x60 +[86.863041] mm_core_init+0x22/0x2d0 +[86.863054] start_kernel+0x576/0xbd0 +[86.863068] x86_64_start_reservations+0x18/0x30 +[86.863084] x86_64_start_kernel+0xbf/0x110 +[86.863098] common_startup_64+0x13e/0x141 +[86.863114] +-> #0 (cpu_hotplug_lock){++++}-{0:0}: +[86.863135] __lock_acquire+0x1635/0x2810 +[86.863152] lock_acquire+0xc4/0x2f0 +[86.863166] cpus_read_lock+0x41/0x100 +[86.863180] stop_machine+0x1c/0x50 +[86.863194] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915] +[86.863987] intel_ggtt_bind_vma+0x43/0x70 [i915] +[86.864735] __vma_bind+0x55/0x70 [i915] +[86.865510] fence_work+0x26/0xa0 [i915] +[86.866248] fence_notify+0xa1/0x140 [i915] +[86.866983] __i915_sw_fence_complete+0x8f/0x270 [i915] +[86.867719] i915_sw_fence_commit+0x39/0x60 [i915] +[86.868453] i915_vma_pin_ww+0x462/0x1360 [i915] +[86.869228] i915_vma_pin.constprop.0+0x133/0x1d0 [i915] +[86.870001] initial_plane_vma+0x307/0x840 [i915] +[86.870774] intel_initial_plane_config+0x33f/0x670 [i915] +[86.871546] intel_display_driver_probe_nogem+0x1c6/0x260 [i915] +[86.872330] i915_driver_probe+0x7fa/0xe80 [i915] +[86.873057] i915_pci_probe+0xe6/0x220 [i915] +[86.873782] local_pci_probe+0x47/0xb0 +[86.873802] pci_device_probe+0xf3/0x260 +[86.873817] really_probe+0xf1/0x3c0 +[86.873833] __driver_probe_device+0x8c/0x180 +[86.873848] driver_probe_device+0x24/0xd0 +[86.873862] __driver_attach+0x10f/0x220 +[86.873876] bus_for_each_dev+0x7f/0xe0 +[86.873892] driver_attach+0x1e/0x30 +[86.873904] bus_add_driver+0x151/0x290 +[86.873917] driver_register+0x5e/0x130 +[86.873931] __pci_register_driver+0x7d/0x90 +[86.873945] i915_pci_register_driver+0x23/0x30 [i915] +[86.874678] i915_init+0x37/0x120 [i915] +[86.875347] do_one_initcall+0x60/0x3f0 +[86.875369] do_init_module+0x97/0x2a0 +[86.875385] load_module+0x2c54/0x2d80 +[86.875398] init_module_from_file+0x96/0xe0 +[86.875413] idempotent_init_module+0x117/0x330 +[86.875426] __x64_sys_finit_module+0x77/0x100 +[86.875440] x64_sys_call+0x24de/0x2660 +[86.875454] do_syscall_64+0x91/0xe90 +[86.875470] entry_SYSCALL_64_after_hwframe+0x76/0x7e +[86.875486] +other info that might help us debug this: +[86.875502] Chain exists of: + cpu_hotplug_lock --> reservation_ww_class_acquire --> reservation_ww_class_mutex +[86.875539] Possible unsafe locking scenario: +[86.875552] CPU0 CPU1 +[86.875563] ---- ---- +[86.875573] lock(reservation_ww_class_mutex); +[86.875588] lock(reservation_ww_class_acquire); +[86.875606] lock(reservation_ww_class_mutex); +[86.875624] rlock(cpu_hotplug_lock); +[86.875637] + *** DEADLOCK *** +[86.875650] 3 locks held by i915_module_loa/1432: +[86.875663] #0: ffff888101f5c1b0 (&dev->mutex){....}-{3:3}, at: __driver_attach+0x104/0x220 +[86.875699] #1: ffffc90002e0b4a0 (reservation_ww_class_acquire){+.+.}-{0:0}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915] +[86.876512] #2: ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915] +[86.877305] +stack backtrace: +[86.877326] CPU: 0 UID: 0 PID: 1432 Comm: i915_module_loa Tainted: G U 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 PREEMPT(voluntary) +[86.877334] Tainted: [U]=USER +[86.877336] Hardware name: /NUC5CPYB, BIOS PYBSWCEL.86A.0079.2020.0420.1316 04/20/2020 +[86.877339] Call Trace: +[86.877344] +[86.877353] dump_stack_lvl+0x91/0xf0 +[86.877364] dump_stack+0x10/0x20 +[86.877369] print_circular_bug+0x285/0x360 +[86.877379] check_noncircular+0x135/0x150 +[86.877390] __lock_acquire+0x1635/0x2810 +[86.877403] lock_acquire+0xc4/0x2f0 +[86.877408] ? stop_machine+0x1c/0x50 +[86.877422] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915] +[86.878173] cpus_read_lock+0x41/0x100 +[86.878182] ? stop_machine+0x1c/0x50 +[86.878191] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915] +[86.878916] stop_machine+0x1c/0x50 +[86.878927] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915] +[86.879652] intel_ggtt_bind_vma+0x43/0x70 [i915] +[86.880375] __vma_bind+0x55/0x70 [i915] +[86.881133] fence_work+0x26/0xa0 [i915] +[86.881851] fence_notify+0xa1/0x140 [i915] +[86.882566] __i915_sw_fence_complete+0x8f/0x270 [i915] +[86.883286] i915_sw_fence_commit+0x39/0x60 [i915] +[86.884003] i915_vma_pin_ww+0x462/0x1360 [i915] +[86.884756] ? i915_vma_pin.constprop.0+0x6c/0x1d0 [i915] +[86.885513] i915_vma_pin.constprop.0+0x133/0x1d0 [i915] +[86.886281] initial_plane_vma+0x307/0x840 [i915] +[86.887049] intel_initial_plane_config+0x33f/0x670 [i915] +[86.887819] intel_display_driver_probe_nogem+0x1c6/0x260 [i915] +[86.888587] i915_driver_probe+0x7fa/0xe80 [i915] +[86.889293] ? mutex_unlock+0x12/0x20 +[86.889301] ? drm_privacy_screen_get+0x171/0x190 +[86.889308] ? acpi_dev_found+0x66/0x80 +[86.889321] i915_pci_probe+0xe6/0x220 [i915] +[86.890038] local_pci_probe+0x47/0xb0 +[86.890049] pci_device_probe+0xf3/0x260 +[86.890058] really_probe+0xf1/0x3c0 +[86.890067] __driver_probe_device+0x8c/0x180 +[86.890072] driver_probe_device+0x24/0xd0 +[86.890078] __driver_attach+0x10f/0x220 +[86.890083] ? __pfx___driver_attach+0x10/0x10 +[86.890088] bus_for_each_dev+0x7f/0xe0 +[86.890097] driver_attach+0x1e/0x30 +[86.890101] bus_add_driver+0x151/0x290 +[86.890107] driver_register+0x5e/0x130 +[86.890113] __pci_register_driver+0x7d/0x90 +[86.890119] i915_pci_register_driver+0x23/0x30 [i915] +[86.890833] i915_init+0x37/0x120 [i915] +[86.891482] ? __pfx_i915_init+0x10/0x10 [i915] +[86.892135] do_one_initcall+0x60/0x3f0 +[86.892145] ? __kmalloc_cache_noprof+0x33f/0x470 +[86.892157] do_init_module+0x97/0x2a0 +[86.892164] load_module+0x2c54/0x2d80 +[86.892168] ? __kernel_read+0x15c/0x300 +[86.892185] ? kernel_read_file+0x2b1/0x320 +[86.892195] init_module_from_file+0x96/0xe0 +[86.892199] ? init_module_from_file+0x96/0xe0 +[86.892211] idempotent_init_module+0x117/0x330 +[86.892224] __x64_sys_finit_module+0x77/0x100 +[86.892230] x64_sys_call+0x24de/0x2660 +[86.892236] do_syscall_64+0x91/0xe90 +[86.892243] ? irqentry_exit+0x77/0xb0 +[86.892249] ? sysvec_apic_timer_interrupt+0x57/0xc0 +[86.892256] entry_SYSCALL_64_after_hwframe+0x76/0x7e +[86.892261] RIP: 0033:0x7303e1b2725d +[86.892271] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8b bb 0d 00 f7 d8 64 89 01 48 +[86.892276] RSP: 002b:00007ffddd1fdb38 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 +[86.892281] RAX: ffffffffffffffda RBX: 00005d771d88fd90 RCX: 00007303e1b2725d +[86.892285] RDX: 0000000000000000 RSI: 00005d771d893aa0 RDI: 000000000000000c +[86.892287] RBP: 00007ffddd1fdbf0 R08: 0000000000000040 R09: 00007ffddd1fdb80 +[86.892289] R10: 00007303e1c03b20 R11: 0000000000000246 R12: 00005d771d893aa0 +[86.892292] R13: 0000000000000000 R14: 00005d771d88f0d0 R15: 00005d771d895710 +[86.892304] + +Call asynchronous variant of dma_fence_work_commit() in that case. + +v3: Provide more verbose in-line comment (Andi), + - mention target environments in commit message. + +Fixes: 7d1c2618eac59 ("drm/i915: Take reservation lock around i915_vma_pin.") +Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14985 +Cc: Andi Shyti +Signed-off-by: Janusz Krzysztofik +Reviewed-by: Sebastian Brzezinka +Reviewed-by: Krzysztof Karas +Acked-by: Andi Shyti +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20251023082925.351307-6-janusz.krzysztofik@linux.intel.com +(cherry picked from commit 648ef1324add1c2e2b6041cdf0b28d31fbca5f13) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/i915_vma.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c +index 58a03da16a10f..7601e74a96de4 100644 +--- a/drivers/gpu/drm/i915/i915_vma.c ++++ b/drivers/gpu/drm/i915/i915_vma.c +@@ -1548,8 +1548,20 @@ int i915_vma_pin_ww(struct i915_vma *vma, struct i915_gem_ww_ctx *ww, + err_vma_res: + i915_vma_resource_free(vma_res); + err_fence: +- if (work) +- dma_fence_work_commit_imm(&work->base); ++ if (work) { ++ /* ++ * When pinning VMA to GGTT on CHV or BXT with VTD enabled, ++ * commit VMA binding asynchronously to avoid risk of lock ++ * inversion among reservation_ww locks held here and ++ * cpu_hotplug_lock acquired from stop_machine(), which we ++ * wrap around GGTT updates when running in those environments. ++ */ ++ if (i915_vma_is_ggtt(vma) && ++ intel_vm_no_concurrent_access_wa(vma->vm->i915)) ++ dma_fence_work_commit(&work->base); ++ else ++ dma_fence_work_commit_imm(&work->base); ++ } + err_rpm: + intel_runtime_pm_put(&vma->vm->i915->runtime_pm, wakeref); + +-- +2.51.0 + diff --git a/queue-6.1/drm-i915-fix-conversion-between-clock-ticks-and-nano.patch b/queue-6.1/drm-i915-fix-conversion-between-clock-ticks-and-nano.patch new file mode 100644 index 0000000000..e6a7480103 --- /dev/null +++ b/queue-6.1/drm-i915-fix-conversion-between-clock-ticks-and-nano.patch @@ -0,0 +1,59 @@ +From 17bac66aef6423aa6cda383b683629bbdf3c41c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Oct 2025 17:03:51 -0700 +Subject: drm/i915: Fix conversion between clock ticks and nanoseconds + +From: Umesh Nerlige Ramappa + +[ Upstream commit 7d44ad6b43d0be43d080180413a1b6c24cfbd266 ] + +When tick values are large, the multiplication by NSEC_PER_SEC is larger +than 64 bits and results in bad conversions. + +The issue is seen in PMU busyness counters that look like they have +wrapped around due to bad conversion. i915 PMU implementation returns +monotonically increasing counters. If a count is lesser than previous +one, it will only return the larger value until the smaller value +catches up. The user will see this as zero delta between two +measurements even though the engines are busy. + +Fix it by using mul_u64_u32_div() + +Fixes: 77cdd054dd2c ("drm/i915/pmu: Connect engine busyness stats from GuC to pmu") +Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14955 +Signed-off-by: Umesh Nerlige Ramappa +Reviewed-by: Ashutosh Dixit +Link: https://lore.kernel.org/r/20251016000350.1152382-2-umesh.nerlige.ramappa@intel.com +(cherry picked from commit 2ada9cb1df3f5405a01d013b708b1b0914efccfe) +Signed-off-by: Rodrigo Vivi +[Rodrigo: Added the Fixes tag while cherry-picking to fixes] +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c b/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c +index 3f656d3dba9a8..8eebf41799781 100644 +--- a/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c ++++ b/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c +@@ -180,7 +180,7 @@ static u64 div_u64_roundup(u64 nom, u32 den) + + u64 intel_gt_clock_interval_to_ns(const struct intel_gt *gt, u64 count) + { +- return div_u64_roundup(count * NSEC_PER_SEC, gt->clock_frequency); ++ return mul_u64_u32_div(count, NSEC_PER_SEC, gt->clock_frequency); + } + + u64 intel_gt_pm_interval_to_ns(const struct intel_gt *gt, u64 count) +@@ -190,7 +190,7 @@ u64 intel_gt_pm_interval_to_ns(const struct intel_gt *gt, u64 count) + + u64 intel_gt_ns_to_clock_interval(const struct intel_gt *gt, u64 ns) + { +- return div_u64_roundup(gt->clock_frequency * ns, NSEC_PER_SEC); ++ return mul_u64_u32_div(ns, gt->clock_frequency, NSEC_PER_SEC); + } + + u64 intel_gt_ns_to_pm_interval(const struct intel_gt *gt, u64 ns) +-- +2.51.0 + diff --git a/queue-6.1/hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch b/queue-6.1/hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch new file mode 100644 index 0000000000..9cf77f4bc6 --- /dev/null +++ b/queue-6.1/hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch @@ -0,0 +1,54 @@ +From a1d5d4b735df06b86125a2505e32245975cec02f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Sep 2025 18:25:43 +0200 +Subject: HID: quirks: avoid Cooler Master MM712 dongle wakeup bug + +From: Tristan Lobb + +[ Upstream commit 0be4253bf878d9aaa2b96031ac8683fceeb81480 ] + +The Cooler Master Mice Dongle includes a vendor defined HID interface +alongside its mouse interface. Not polling it will cause the mouse to +stop responding to polls on any interface once woken up again after +going into power saving mode. + +Add the HID_QUIRK_ALWAYS_POLL quirk alongside the Cooler Master VID and +the Dongle's PID. + +Signed-off-by: Tristan Lobb +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 3 +++ + drivers/hid/hid-quirks.c | 1 + + 2 files changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 0bbba80d6c51c..307f921a98068 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -321,6 +321,9 @@ + #define USB_DEVICE_ID_CODEMERCS_IOW_FIRST 0x1500 + #define USB_DEVICE_ID_CODEMERCS_IOW_LAST 0x15ff + ++#define USB_VENDOR_ID_COOLER_MASTER 0x2516 ++#define USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE 0x01b7 ++ + #define USB_VENDOR_ID_CORSAIR 0x1b1c + #define USB_DEVICE_ID_CORSAIR_K90 0x1b02 + #define USB_DEVICE_ID_CORSAIR_K70R 0x1b09 +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index b37927f909412..b42aa9e22fcf0 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -57,6 +57,7 @@ static const struct hid_device_id hid_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_THROTTLE), HID_QUIRK_NOGET }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_COOLER_MASTER, USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB), HID_QUIRK_NO_INIT_REPORTS }, + { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE), HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB), HID_QUIRK_NO_INIT_REPORTS }, +-- +2.51.0 + diff --git a/queue-6.1/nfs-check-if-suid-sgid-was-cleared-after-a-write-as-.patch b/queue-6.1/nfs-check-if-suid-sgid-was-cleared-after-a-write-as-.patch new file mode 100644 index 0000000000..8d1b459744 --- /dev/null +++ b/queue-6.1/nfs-check-if-suid-sgid-was-cleared-after-a-write-as-.patch @@ -0,0 +1,45 @@ +From 3098c29cfc0b9726221ed20e26f5ddcd248fc5e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 16:42:12 -0400 +Subject: NFS: check if suid/sgid was cleared after a write as needed + +From: Scott Mayhew + +[ Upstream commit 9ff022f3820a31507cb93be6661bf5f3ca0609a4 ] + +I noticed xfstests generic/193 and generic/355 started failing against +knfsd after commit e7a8ebc305f2 ("NFSD: Offer write delegation for OPEN +with OPEN4_SHARE_ACCESS_WRITE"). + +I ran those same tests against ONTAP (which has had write delegation +support for a lot longer than knfsd) and they fail there too... so +while it's a new failure against knfsd, it isn't an entirely new +failure. + +Add the NFS_INO_REVAL_FORCED flag so that the presence of a delegation +doesn't keep the inode from being revalidated to fetch the updated mode. + +Signed-off-by: Scott Mayhew +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/write.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/nfs/write.c b/fs/nfs/write.c +index eb1fc33198be8..a20a381efc5df 100644 +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -1633,7 +1633,8 @@ static int nfs_writeback_done(struct rpc_task *task, + /* Deal with the suid/sgid bit corner case */ + if (nfs_should_remove_suid(inode)) { + spin_lock(&inode->i_lock); +- nfs_set_cache_invalid(inode, NFS_INO_INVALID_MODE); ++ nfs_set_cache_invalid(inode, NFS_INO_INVALID_MODE ++ | NFS_INO_REVAL_FORCED); + spin_unlock(&inode->i_lock); + } + return 0; +-- +2.51.0 + diff --git a/queue-6.1/nfs4-fix-state-renewals-missing-after-boot.patch b/queue-6.1/nfs4-fix-state-renewals-missing-after-boot.patch new file mode 100644 index 0000000000..c08d58661a --- /dev/null +++ b/queue-6.1/nfs4-fix-state-renewals-missing-after-boot.patch @@ -0,0 +1,41 @@ +From 116c7285df14efc0b9c0262f2d73d14acd17cd02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 15:48:04 -0600 +Subject: NFS4: Fix state renewals missing after boot + +From: Joshua Watt + +[ Upstream commit 9bb3baa9d1604cd20f49ae7dac9306b4037a0e7a ] + +Since the last renewal time was initialized to 0 and jiffies start +counting at -5 minutes, any clients connected in the first 5 minutes +after a reboot would have their renewal timer set to a very long +interval. If the connection was idle, this would result in the client +state timing out on the server and the next call to the server would +return NFS4ERR_BADSESSION. + +Fix this by initializing the last renewal time to the current jiffies +instead of 0. + +Signed-off-by: Joshua Watt +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4client.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c +index 6b14e4af25d37..4cb405e343b83 100644 +--- a/fs/nfs/nfs4client.c ++++ b/fs/nfs/nfs4client.c +@@ -221,6 +221,7 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init) + clp->cl_state = 1 << NFS4CLNT_LEASE_EXPIRED; + clp->cl_mvops = nfs_v4_minor_ops[cl_init->minorversion]; + clp->cl_mig_gen = 1; ++ clp->cl_last_renewal = jiffies; + #if IS_ENABLED(CONFIG_NFS_V4_1) + init_waitqueue_head(&clp->cl_lock_waitq); + #endif +-- +2.51.0 + diff --git a/queue-6.1/risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch b/queue-6.1/risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch new file mode 100644 index 0000000000..66e70e7dfc --- /dev/null +++ b/queue-6.1/risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch @@ -0,0 +1,49 @@ +From 99c893cc933af102aa4d897c1006d05bac589ce1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 16:28:46 +0300 +Subject: RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid + rfence errors + +From: Danil Skrebenkov + +[ Upstream commit ae9e9f3d67dcef7582a4524047b01e33c5185ddb ] + +openSBI v1.7 adds harts checks for ipi operations. Especially it +adds comparison between hmask passed as an argument from linux +and mask of online harts (from openSBI side). If they don't +fit each other the error occurs. + +When cpu is offline, cpu_online_mask is explicitly cleared in +__cpu_disable. However, there is no explicit clearing of +mm_cpumask. mm_cpumask is used for rfence operations that +call openSBI RFENCE extension which uses ipi to remote harts. +If hart is offline there may be error if mask of linux is not +as mask of online harts in openSBI. + +this patch adds explicit clearing of mm_cpumask for offline hart. + +Signed-off-by: Danil Skrebenkov +Reviewed-by: Andrew Jones +Link: https://lore.kernel.org/r/20250919132849.31676-1-danil.skrebenkov@cloudbear.ru +[pjw@kernel.org: rewrote subject line for clarity] +Signed-off-by: Paul Walmsley +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/cpu-hotplug.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/riscv/kernel/cpu-hotplug.c b/arch/riscv/kernel/cpu-hotplug.c +index 462b3631663f9..374f334df86de 100644 +--- a/arch/riscv/kernel/cpu-hotplug.c ++++ b/arch/riscv/kernel/cpu-hotplug.c +@@ -61,6 +61,7 @@ void __cpu_die(unsigned int cpu) + } + pr_notice("CPU%u: off\n", cpu); + ++ clear_tasks_mm_cpumask(cpu); + /* Verify from the firmware if the cpu is really stopped*/ + if (cpu_ops[cpu]->cpu_is_stopped) + ret = cpu_ops[cpu]->cpu_is_stopped(cpu); +-- +2.51.0 + diff --git a/queue-6.1/series b/queue-6.1/series index e4881f63db..a0ee287aff 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -331,3 +331,17 @@ scsi-ufs-ufs-pci-fix-s0ix-s3-for-intel-controllers.patch extcon-adc-jack-cleanup-wakeup-source-only-if-it-was-enabled.patch drm-amdgpu-fix-function-header-names-in-amdgpu_connectors.c.patch selftests-netdevsim-set-test-timeout-to-10-minutes.patch +drm-i915-avoid-lock-inversion-when-pinning-to-ggtt-o.patch +drm-i915-fix-conversion-between-clock-ticks-and-nano.patch +smb-client-fix-refcount-leak-in-smb2_set_path_attr.patch +drm-amd-fix-suspend-failure-with-secure-display-ta.patch +compiler_types-move-unused-static-inline-functions-w.patch +risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch +drm-amd-pm-disable-mclk-switching-on-si-at-high-pixe.patch +drm-amdgpu-fix-null-pointer-dereference-in-vram-logi.patch +nfs4-fix-state-renewals-missing-after-boot.patch +hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch +nfs-check-if-suid-sgid-was-cleared-after-a-write-as-.patch +smb-server-fix-possible-memory-leak-in-smb2_read.patch +smb-server-fix-possible-refcount-leak-in-smb2_sess_s.patch +asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch diff --git a/queue-6.1/smb-client-fix-refcount-leak-in-smb2_set_path_attr.patch b/queue-6.1/smb-client-fix-refcount-leak-in-smb2_set_path_attr.patch new file mode 100644 index 0000000000..a5fd990cbb --- /dev/null +++ b/queue-6.1/smb-client-fix-refcount-leak-in-smb2_set_path_attr.patch @@ -0,0 +1,42 @@ +From 13c0353f9793c4bde92777001f8985bf70bcbe70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Nov 2025 23:13:15 +0800 +Subject: smb: client: fix refcount leak in smb2_set_path_attr + +From: Shuhao Fu + +[ Upstream commit b540de9e3b4fab3b9e10f30714a6f5c1b2a50ec3 ] + +Fix refcount leak in `smb2_set_path_attr` when path conversion fails. + +Function `cifs_get_writable_path` returns `cfile` with its reference +counter `cfile->count` increased on success. Function `smb2_compound_op` +would decrease the reference counter for `cfile`, as stated in its +comment. By calling `smb2_rename_path`, the reference counter of `cfile` +would leak if `cifs_convert_path_to_utf16` fails in `smb2_set_path_attr`. + +Fixes: 8de9e86c67ba ("cifs: create a helper to find a writeable handle by path name") +Acked-by: Henrique Carvalho +Signed-off-by: Shuhao Fu +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2inode.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c +index 7d3685cd345fd..452a60e09cbed 100644 +--- a/fs/smb/client/smb2inode.c ++++ b/fs/smb/client/smb2inode.c +@@ -721,6 +721,8 @@ smb2_set_path_attr(const unsigned int xid, struct cifs_tcon *tcon, + smb2_to_name = cifs_convert_path_to_utf16(to_name, cifs_sb); + if (smb2_to_name == NULL) { + rc = -ENOMEM; ++ if (cfile) ++ cifsFileInfo_put(cfile); + goto smb2_rename_path; + } + rc = smb2_compound_op(xid, tcon, cifs_sb, from_name, access, +-- +2.51.0 + diff --git a/queue-6.1/smb-server-fix-possible-memory-leak-in-smb2_read.patch b/queue-6.1/smb-server-fix-possible-memory-leak-in-smb2_read.patch new file mode 100644 index 0000000000..1201b9a65c --- /dev/null +++ b/queue-6.1/smb-server-fix-possible-memory-leak-in-smb2_read.patch @@ -0,0 +1,37 @@ +From b605f26184e422a665bf149cbee5fff1b43b4f67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Oct 2025 00:47:59 +0800 +Subject: smb/server: fix possible memory leak in smb2_read() + +From: ZhangGuoDong + +[ Upstream commit 6fced056d2cc8d01b326e6fcfabaacb9850b71a4 ] + +Memory leak occurs when ksmbd_vfs_read() fails. +Fix this by adding the missing kvfree(). + +Co-developed-by: ChenXiaoSong +Signed-off-by: ChenXiaoSong +Signed-off-by: ZhangGuoDong +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/smb2pdu.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c +index d2dca5d2f17cb..173135f6f7dbf 100644 +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -6405,6 +6405,7 @@ int smb2_read(struct ksmbd_work *work) + + nbytes = ksmbd_vfs_read(work, fp, length, &offset, aux_payload_buf); + if (nbytes < 0) { ++ kvfree(aux_payload_buf); + err = nbytes; + goto out; + } +-- +2.51.0 + diff --git a/queue-6.1/smb-server-fix-possible-refcount-leak-in-smb2_sess_s.patch b/queue-6.1/smb-server-fix-possible-refcount-leak-in-smb2_sess_s.patch new file mode 100644 index 0000000000..ea6a29689b --- /dev/null +++ b/queue-6.1/smb-server-fix-possible-refcount-leak-in-smb2_sess_s.patch @@ -0,0 +1,37 @@ +From 59ff08f44d14878451b03e241e1f488feaa4c212 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Oct 2025 00:51:36 +0800 +Subject: smb/server: fix possible refcount leak in smb2_sess_setup() + +From: ZhangGuoDong + +[ Upstream commit 379510a815cb2e64eb0a379cb62295d6ade65df0 ] + +Reference count of ksmbd_session will leak when session need reconnect. +Fix this by adding the missing ksmbd_user_session_put(). + +Co-developed-by: ChenXiaoSong +Signed-off-by: ChenXiaoSong +Signed-off-by: ZhangGuoDong +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/smb2pdu.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c +index 173135f6f7dbf..e3ea06aab8c1b 100644 +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -1796,6 +1796,7 @@ int smb2_sess_setup(struct ksmbd_work *work) + + if (ksmbd_conn_need_reconnect(conn)) { + rc = -EFAULT; ++ ksmbd_user_session_put(sess); + sess = NULL; + goto out_err; + } +-- +2.51.0 + diff --git a/queue-6.12/arm64-kprobes-check-the-return-value-of-set_memory_r.patch b/queue-6.12/arm64-kprobes-check-the-return-value-of-set_memory_r.patch new file mode 100644 index 0000000000..4f0869d826 --- /dev/null +++ b/queue-6.12/arm64-kprobes-check-the-return-value-of-set_memory_r.patch @@ -0,0 +1,44 @@ +From e519734496a83cc33dca302ef8fb15eafca7f5c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Nov 2025 13:49:47 -0800 +Subject: arm64: kprobes: check the return value of set_memory_rox() + +From: Yang Shi + +[ Upstream commit 0ec364c0c95fc85bcbc88f1a9a06ebe83c88e18c ] + +Since commit a166563e7ec3 ("arm64: mm: support large block mapping when +rodata=full"), __change_memory_common has more chance to fail due to +memory allocation failure when splitting page table. So check the return +value of set_memory_rox(), then bail out if it fails otherwise we may have +RW memory mapping for kprobes insn page. + +Fixes: 195a1b7d8388 ("arm64: kprobes: call set_memory_rox() for kprobe page") +Reviewed-by: Ryan Roberts +Reviewed-by: Dev Jain +Signed-off-by: Yang Shi +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/probes/kprobes.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c +index 6e397d8dcd4c2..b0e0f0aed748a 100644 +--- a/arch/arm64/kernel/probes/kprobes.c ++++ b/arch/arm64/kernel/probes/kprobes.c +@@ -49,7 +49,10 @@ void *alloc_insn_page(void) + addr = execmem_alloc(EXECMEM_KPROBES, PAGE_SIZE); + if (!addr) + return NULL; +- set_memory_rox((unsigned long)addr, 1); ++ if (set_memory_rox((unsigned long)addr, 1)) { ++ execmem_free(addr); ++ return NULL; ++ } + return addr; + } + +-- +2.51.0 + diff --git a/queue-6.12/asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch b/queue-6.12/asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch new file mode 100644 index 0000000000..a1b50b065f --- /dev/null +++ b/queue-6.12/asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch @@ -0,0 +1,43 @@ +From 7d3586de07532f086b67e2f4510b25b9f985feed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Oct 2025 15:42:15 +0200 +Subject: ASoC: max98090/91: fixed max98091 ALSA widget powering up/down + +From: Sharique Mohammad + +[ Upstream commit 7a37291ed40a33a5f6c3d370fdde5ee0d8f7d0e4 ] + +The widgets DMIC3_ENA and DMIC4_ENA must be defined in the DAPM +suppy widget, just like DMICL_ENA and DMICR_ENA. Whenever they +are turned on or off, the required startup or shutdown sequences +must be taken care by the max98090_shdn_event. + +Signed-off-by: Sharique Mohammad +Link: https://patch.msgid.link/20251015134215.750001-1-sharq0406@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/max98090.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c +index 2adf744c65263..4023b88e7bc13 100644 +--- a/sound/soc/codecs/max98090.c ++++ b/sound/soc/codecs/max98090.c +@@ -1234,9 +1234,11 @@ static const struct snd_soc_dapm_widget max98091_dapm_widgets[] = { + SND_SOC_DAPM_INPUT("DMIC4"), + + SND_SOC_DAPM_SUPPLY("DMIC3_ENA", M98090_REG_DIGITAL_MIC_ENABLE, +- M98090_DIGMIC3_SHIFT, 0, NULL, 0), ++ M98090_DIGMIC3_SHIFT, 0, max98090_shdn_event, ++ SND_SOC_DAPM_POST_PMU), + SND_SOC_DAPM_SUPPLY("DMIC4_ENA", M98090_REG_DIGITAL_MIC_ENABLE, +- M98090_DIGMIC4_SHIFT, 0, NULL, 0), ++ M98090_DIGMIC4_SHIFT, 0, max98090_shdn_event, ++ SND_SOC_DAPM_POST_PMU), + }; + + static const struct snd_soc_dapm_route max98090_dapm_routes[] = { +-- +2.51.0 + diff --git a/queue-6.12/compiler_types-move-unused-static-inline-functions-w.patch b/queue-6.12/compiler_types-move-unused-static-inline-functions-w.patch new file mode 100644 index 0000000000..a296b1ee1d --- /dev/null +++ b/queue-6.12/compiler_types-move-unused-static-inline-functions-w.patch @@ -0,0 +1,57 @@ +From 0bad0638ccd944e2cef985e26b39b5c10e2a1f83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Nov 2025 11:50:00 +0100 +Subject: compiler_types: Move unused static inline functions warning to W=2 + +From: Peter Zijlstra + +[ Upstream commit 9818af18db4bfefd320d0fef41390a616365e6f7 ] + +Per Nathan, clang catches unused "static inline" functions in C files +since commit 6863f5643dd7 ("kbuild: allow Clang to find unused static +inline functions for W=1 build"). + +Linus said: + +> So I entirely ignore W=1 issues, because I think so many of the extra +> warnings are bogus. +> +> But if this one in particular is causing more problems than most - +> some teams do seem to use W=1 as part of their test builds - it's fine +> to send me a patch that just moves bad warnings to W=2. +> +> And if anybody uses W=2 for their test builds, that's THEIR problem.. + +Here is the change to bump the warning from W=1 to W=2. + +Fixes: 6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build") +Signed-off-by: Peter Zijlstra +Signed-off-by: Andy Shevchenko +Link: https://patch.msgid.link/20251106105000.2103276-1-andriy.shevchenko@linux.intel.com +[nathan: Adjust comment as well] +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + include/linux/compiler_types.h | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h +index 639be0f30b455..beb2a1e1bac53 100644 +--- a/include/linux/compiler_types.h ++++ b/include/linux/compiler_types.h +@@ -250,10 +250,9 @@ struct ftrace_likely_data { + /* + * GCC does not warn about unused static inline functions for -Wunused-function. + * Suppress the warning in clang as well by using __maybe_unused, but enable it +- * for W=1 build. This will allow clang to find unused functions. Remove the +- * __inline_maybe_unused entirely after fixing most of -Wunused-function warnings. ++ * for W=2 build. This will allow clang to find unused functions. + */ +-#ifdef KBUILD_EXTRA_WARN1 ++#ifdef KBUILD_EXTRA_WARN2 + #define __inline_maybe_unused + #else + #define __inline_maybe_unused __maybe_unused +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-fix-suspend-failure-with-secure-display-ta.patch b/queue-6.12/drm-amd-fix-suspend-failure-with-secure-display-ta.patch new file mode 100644 index 0000000000..6d514d880a --- /dev/null +++ b/queue-6.12/drm-amd-fix-suspend-failure-with-secure-display-ta.patch @@ -0,0 +1,47 @@ +From 704597e188c0821055c1abc2ba6254ecabb5ba40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Nov 2025 13:38:02 -0600 +Subject: drm/amd: Fix suspend failure with secure display TA + +From: Mario Limonciello + +[ Upstream commit b09cb2996cdf50cd1ab4020e002c95d742c81313 ] + +commit c760bcda83571 ("drm/amd: Check whether secure display TA loaded +successfully") attempted to fix extra messages, but failed to port the +cleanup that was in commit 5c6d52ff4b61e ("drm/amd: Don't try to enable +secure display TA multiple times") to prevent multiple tries. + +Add that to the failure handling path even on a quick failure. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4679 +Fixes: c760bcda8357 ("drm/amd: Check whether secure display TA loaded successfully") +Signed-off-by: Mario Limonciello +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +(cherry picked from commit 4104c0a454f6a4d1e0d14895d03c0e7bdd0c8240) +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index a8358d1d1acbc..fa84208eed18e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -2174,8 +2174,11 @@ static int psp_securedisplay_initialize(struct psp_context *psp) + if (!ret && !psp->securedisplay_context.context.resp_status) { + psp->securedisplay_context.context.initialized = true; + mutex_init(&psp->securedisplay_context.mutex); +- } else ++ } else { ++ /* don't try again */ ++ psp->securedisplay_context.context.bin_desc.size_bytes = 0; + return ret; ++ } + + mutex_lock(&psp->securedisplay_context.mutex); + +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-pm-disable-mclk-switching-on-si-at-high-pixe.patch b/queue-6.12/drm-amd-pm-disable-mclk-switching-on-si-at-high-pixe.patch new file mode 100644 index 0000000000..84e4928f5f --- /dev/null +++ b/queue-6.12/drm-amd-pm-disable-mclk-switching-on-si-at-high-pixe.patch @@ -0,0 +1,43 @@ +From 8dce35a56b65a6313306dbeb6c50ef49743ab1df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 20:26:12 +0200 +Subject: drm/amd/pm: Disable MCLK switching on SI at high pixel clocks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 5c05bcf6ae7732da1bd4dc1958d527b5f07f216a ] + +On various SI GPUs, a flickering can be observed near the bottom +edge of the screen when using a single 4K 60Hz monitor over DP. +Disabling MCLK switching works around this problem. + +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index 82167eca26683..f6ba54cf701e7 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -3485,6 +3485,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + * for these GPUs to calculate bandwidth requirements. + */ + if (high_pixelclock_count) { ++ /* Work around flickering lines at the bottom edge ++ * of the screen when using a single 4K 60Hz monitor. ++ */ ++ disable_mclk_switching = true; ++ + /* On Oland, we observe some flickering when two 4K 60Hz + * displays are connected, possibly because voltage is too low. + * Raise the voltage by requiring a higher SCLK. +-- +2.51.0 + diff --git a/queue-6.12/drm-amdgpu-fix-null-pointer-dereference-in-vram-logi.patch b/queue-6.12/drm-amdgpu-fix-null-pointer-dereference-in-vram-logi.patch new file mode 100644 index 0000000000..5eb7f110ca --- /dev/null +++ b/queue-6.12/drm-amdgpu-fix-null-pointer-dereference-in-vram-logi.patch @@ -0,0 +1,113 @@ +From 2b3a08244caf572de470b30391c97a0bcec7b919 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 13:46:12 +0800 +Subject: drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU + devices +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jesse.Zhang + +[ Upstream commit 883f309add55060233bf11c1ea6947140372920f ] + +Previously, APU platforms (and other scenarios with uninitialized VRAM managers) +triggered a NULL pointer dereference in `ttm_resource_manager_usage()`. The root +cause is not that the `struct ttm_resource_manager *man` pointer itself is NULL, +but that `man->bdev` (the backing device pointer within the manager) remains +uninitialized (NULL) on APUs—since APUs lack dedicated VRAM and do not fully +set up VRAM manager structures. When `ttm_resource_manager_usage()` attempts to +acquire `man->bdev->lru_lock`, it dereferences the NULL `man->bdev`, leading to +a kernel OOPS. + +1. **amdgpu_cs.c**: Extend the existing bandwidth control check in + `amdgpu_cs_get_threshold_for_moves()` to include a check for + `ttm_resource_manager_used()`. If the manager is not used (uninitialized + `bdev`), return 0 for migration thresholds immediately—skipping VRAM-specific + logic that would trigger the NULL dereference. + +2. **amdgpu_kms.c**: Update the `AMDGPU_INFO_VRAM_USAGE` ioctl and memory info + reporting to use a conditional: if the manager is used, return the real VRAM + usage; otherwise, return 0. This avoids accessing `man->bdev` when it is + NULL. + +3. **amdgpu_virt.c**: Modify the vf2pf (virtual function to physical function) + data write path. Use `ttm_resource_manager_used()` to check validity: if the + manager is usable, calculate `fb_usage` from VRAM usage; otherwise, set + `fb_usage` to 0 (APUs have no discrete framebuffer to report). + +This approach is more robust than APU-specific checks because it: +- Works for all scenarios where the VRAM manager is uninitialized (not just APUs), +- Aligns with TTM's design by using its native helper function, +- Preserves correct behavior for discrete GPUs (which have fully initialized + `man->bdev` and pass the `ttm_resource_manager_used()` check). + +v4: use ttm_resource_manager_used(&adev->mman.vram_mgr.manager) instead of checking the adev->gmc.is_app_apu flag (Christian) + +Reviewed-by: Christian König +Suggested-by: Lijo Lazar +Signed-off-by: Jesse Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- + drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 7 ++++--- + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 4 ++-- + 3 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +index 082fc12fe28dc..844e49d1499ed 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +@@ -691,7 +691,7 @@ static void amdgpu_cs_get_threshold_for_moves(struct amdgpu_device *adev, + */ + const s64 us_upper_bound = 200000; + +- if (!adev->mm_stats.log2_max_MBps) { ++ if ((!adev->mm_stats.log2_max_MBps) || !ttm_resource_manager_used(&adev->mman.vram_mgr.manager)) { + *max_bytes = 0; + *max_vis_bytes = 0; + return; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +index 016a6f6c4267b..1291ca57a1cb3 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +@@ -707,7 +707,8 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) + ui64 = atomic64_read(&adev->num_vram_cpu_page_faults); + return copy_to_user(out, &ui64, min(size, 8u)) ? -EFAULT : 0; + case AMDGPU_INFO_VRAM_USAGE: +- ui64 = ttm_resource_manager_usage(&adev->mman.vram_mgr.manager); ++ ui64 = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ? ++ ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) : 0; + return copy_to_user(out, &ui64, min(size, 8u)) ? -EFAULT : 0; + case AMDGPU_INFO_VIS_VRAM_USAGE: + ui64 = amdgpu_vram_mgr_vis_usage(&adev->mman.vram_mgr); +@@ -753,8 +754,8 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) + mem.vram.usable_heap_size = adev->gmc.real_vram_size - + atomic64_read(&adev->vram_pin_size) - + AMDGPU_VM_RESERVED_VRAM; +- mem.vram.heap_usage = +- ttm_resource_manager_usage(vram_man); ++ mem.vram.heap_usage = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ? ++ ttm_resource_manager_usage(vram_man) : 0; + mem.vram.max_allocation = mem.vram.usable_heap_size * 3 / 4; + + mem.cpu_accessible_vram.total_heap_size = +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +index 01dccd489a805..9247cd7b1868c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +@@ -595,8 +595,8 @@ static int amdgpu_virt_write_vf2pf_data(struct amdgpu_device *adev) + vf2pf_info->driver_cert = 0; + vf2pf_info->os_info.all = 0; + +- vf2pf_info->fb_usage = +- ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) >> 20; ++ vf2pf_info->fb_usage = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ? ++ ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) >> 20 : 0; + vf2pf_info->fb_vis_usage = + amdgpu_vram_mgr_vis_usage(&adev->mman.vram_mgr) >> 20; + vf2pf_info->fb_size = adev->gmc.real_vram_size >> 20; +-- +2.51.0 + diff --git a/queue-6.12/drm-amdgpu-hide-vram-sysfs-attributes-on-gpus-withou.patch b/queue-6.12/drm-amdgpu-hide-vram-sysfs-attributes-on-gpus-withou.patch new file mode 100644 index 0000000000..295ed6e5dd --- /dev/null +++ b/queue-6.12/drm-amdgpu-hide-vram-sysfs-attributes-on-gpus-withou.patch @@ -0,0 +1,41 @@ +From ad9e6986171c1b3bd4dc47853f4bd6abaa7e41db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 10:10:52 +0200 +Subject: drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian König + +[ Upstream commit 33cc891b56b93cad1a83263eaf2e417436f70c82 ] + +Otherwise accessing them can cause a crash. + +Signed-off-by: Christian König +Tested-by: Mangesh Gadre +Acked-by: Alex Deucher +Reviewed-by: Arunpravin Paneer Selvam +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c +index ea4df412decff..54f2e7b392796 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c +@@ -234,6 +234,9 @@ static umode_t amdgpu_vram_attrs_is_visible(struct kobject *kobj, + !adev->gmc.vram_vendor) + return 0; + ++ if (!ttm_resource_manager_used(&adev->mman.vram_mgr.manager)) ++ return 0; ++ + return attr->mode; + } + +-- +2.51.0 + diff --git a/queue-6.12/drm-amdgpu-remove-two-invalid-bug_on-s.patch b/queue-6.12/drm-amdgpu-remove-two-invalid-bug_on-s.patch new file mode 100644 index 0000000000..39d5ad1817 --- /dev/null +++ b/queue-6.12/drm-amdgpu-remove-two-invalid-bug_on-s.patch @@ -0,0 +1,53 @@ +From 48e7e22c63b51866f2f57128706af1683470a754 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 14:47:23 +0200 +Subject: drm/amdgpu: remove two invalid BUG_ON()s +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian König + +[ Upstream commit 5d55ed19d4190d2c210ac05ac7a53f800a8c6fe5 ] + +Those can be triggered trivially by userspace. + +Signed-off-by: Christian König +Reviewed-by: Alex Deucher +Acked-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 -- + drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 2 -- + 2 files changed, 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +index 96e5c520af316..c0a15d1920e28 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +@@ -5632,8 +5632,6 @@ static void gfx_v11_0_ring_emit_ib_gfx(struct amdgpu_ring *ring, + unsigned vmid = AMDGPU_JOB_GET_VMID(job); + u32 header, control = 0; + +- BUG_ON(ib->flags & AMDGPU_IB_FLAG_CE); +- + header = PACKET3(PACKET3_INDIRECT_BUFFER, 2); + + control |= ib->length_dw | (vmid << 24); +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c +index adcfcf594286f..0c8581dfbee6e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c +@@ -4330,8 +4330,6 @@ static void gfx_v12_0_ring_emit_ib_gfx(struct amdgpu_ring *ring, + unsigned vmid = AMDGPU_JOB_GET_VMID(job); + u32 header, control = 0; + +- BUG_ON(ib->flags & AMDGPU_IB_FLAG_CE); +- + header = PACKET3(PACKET3_INDIRECT_BUFFER, 2); + + control |= ib->length_dw | (vmid << 24); +-- +2.51.0 + diff --git a/queue-6.12/drm-i915-avoid-lock-inversion-when-pinning-to-ggtt-o.patch b/queue-6.12/drm-i915-avoid-lock-inversion-when-pinning-to-ggtt-o.patch new file mode 100644 index 0000000000..93af220a3a --- /dev/null +++ b/queue-6.12/drm-i915-avoid-lock-inversion-when-pinning-to-ggtt-o.patch @@ -0,0 +1,276 @@ +From 51ea09a48cba0f96b846e2d066ae21455ad26a3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Oct 2025 10:25:19 +0200 +Subject: drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD + +From: Janusz Krzysztofik + +[ Upstream commit 84bbe327a5cbb060f3321c9d9d4d53936fc1ef9b ] + +On completion of i915_vma_pin_ww(), a synchronous variant of +dma_fence_work_commit() is called. When pinning a VMA to GGTT address +space on a Cherry View family processor, or on a Broxton generation SoC +with VTD enabled, i.e., when stop_machine() is then called from +intel_ggtt_bind_vma(), that can potentially lead to lock inversion among +reservation_ww and cpu_hotplug locks. + +[86.861179] ====================================================== +[86.861193] WARNING: possible circular locking dependency detected +[86.861209] 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 Tainted: G U +[86.861226] ------------------------------------------------------ +[86.861238] i915_module_loa/1432 is trying to acquire lock: +[86.861252] ffffffff83489090 (cpu_hotplug_lock){++++}-{0:0}, at: stop_machine+0x1c/0x50 +[86.861290] +but task is already holding lock: +[86.861303] ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915] +[86.862233] +which lock already depends on the new lock. +[86.862251] +the existing dependency chain (in reverse order) is: +[86.862265] +-> #5 (reservation_ww_class_mutex){+.+.}-{3:3}: +[86.862292] dma_resv_lockdep+0x19a/0x390 +[86.862315] do_one_initcall+0x60/0x3f0 +[86.862334] kernel_init_freeable+0x3cd/0x680 +[86.862353] kernel_init+0x1b/0x200 +[86.862369] ret_from_fork+0x47/0x70 +[86.862383] ret_from_fork_asm+0x1a/0x30 +[86.862399] +-> #4 (reservation_ww_class_acquire){+.+.}-{0:0}: +[86.862425] dma_resv_lockdep+0x178/0x390 +[86.862440] do_one_initcall+0x60/0x3f0 +[86.862454] kernel_init_freeable+0x3cd/0x680 +[86.862470] kernel_init+0x1b/0x200 +[86.862482] ret_from_fork+0x47/0x70 +[86.862495] ret_from_fork_asm+0x1a/0x30 +[86.862509] +-> #3 (&mm->mmap_lock){++++}-{3:3}: +[86.862531] down_read_killable+0x46/0x1e0 +[86.862546] lock_mm_and_find_vma+0xa2/0x280 +[86.862561] do_user_addr_fault+0x266/0x8e0 +[86.862578] exc_page_fault+0x8a/0x2f0 +[86.862593] asm_exc_page_fault+0x27/0x30 +[86.862607] filldir64+0xeb/0x180 +[86.862620] kernfs_fop_readdir+0x118/0x480 +[86.862635] iterate_dir+0xcf/0x2b0 +[86.862648] __x64_sys_getdents64+0x84/0x140 +[86.862661] x64_sys_call+0x1058/0x2660 +[86.862675] do_syscall_64+0x91/0xe90 +[86.862689] entry_SYSCALL_64_after_hwframe+0x76/0x7e +[86.862703] +-> #2 (&root->kernfs_rwsem){++++}-{3:3}: +[86.862725] down_write+0x3e/0xf0 +[86.862738] kernfs_add_one+0x30/0x3c0 +[86.862751] kernfs_create_dir_ns+0x53/0xb0 +[86.862765] internal_create_group+0x134/0x4c0 +[86.862779] sysfs_create_group+0x13/0x20 +[86.862792] topology_add_dev+0x1d/0x30 +[86.862806] cpuhp_invoke_callback+0x4b5/0x850 +[86.862822] cpuhp_issue_call+0xbf/0x1f0 +[86.862836] __cpuhp_setup_state_cpuslocked+0x111/0x320 +[86.862852] __cpuhp_setup_state+0xb0/0x220 +[86.862866] topology_sysfs_init+0x30/0x50 +[86.862879] do_one_initcall+0x60/0x3f0 +[86.862893] kernel_init_freeable+0x3cd/0x680 +[86.862908] kernel_init+0x1b/0x200 +[86.862921] ret_from_fork+0x47/0x70 +[86.862934] ret_from_fork_asm+0x1a/0x30 +[86.862947] +-> #1 (cpuhp_state_mutex){+.+.}-{3:3}: +[86.862969] __mutex_lock+0xaa/0xed0 +[86.862982] mutex_lock_nested+0x1b/0x30 +[86.862995] __cpuhp_setup_state_cpuslocked+0x67/0x320 +[86.863012] __cpuhp_setup_state+0xb0/0x220 +[86.863026] page_alloc_init_cpuhp+0x2d/0x60 +[86.863041] mm_core_init+0x22/0x2d0 +[86.863054] start_kernel+0x576/0xbd0 +[86.863068] x86_64_start_reservations+0x18/0x30 +[86.863084] x86_64_start_kernel+0xbf/0x110 +[86.863098] common_startup_64+0x13e/0x141 +[86.863114] +-> #0 (cpu_hotplug_lock){++++}-{0:0}: +[86.863135] __lock_acquire+0x1635/0x2810 +[86.863152] lock_acquire+0xc4/0x2f0 +[86.863166] cpus_read_lock+0x41/0x100 +[86.863180] stop_machine+0x1c/0x50 +[86.863194] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915] +[86.863987] intel_ggtt_bind_vma+0x43/0x70 [i915] +[86.864735] __vma_bind+0x55/0x70 [i915] +[86.865510] fence_work+0x26/0xa0 [i915] +[86.866248] fence_notify+0xa1/0x140 [i915] +[86.866983] __i915_sw_fence_complete+0x8f/0x270 [i915] +[86.867719] i915_sw_fence_commit+0x39/0x60 [i915] +[86.868453] i915_vma_pin_ww+0x462/0x1360 [i915] +[86.869228] i915_vma_pin.constprop.0+0x133/0x1d0 [i915] +[86.870001] initial_plane_vma+0x307/0x840 [i915] +[86.870774] intel_initial_plane_config+0x33f/0x670 [i915] +[86.871546] intel_display_driver_probe_nogem+0x1c6/0x260 [i915] +[86.872330] i915_driver_probe+0x7fa/0xe80 [i915] +[86.873057] i915_pci_probe+0xe6/0x220 [i915] +[86.873782] local_pci_probe+0x47/0xb0 +[86.873802] pci_device_probe+0xf3/0x260 +[86.873817] really_probe+0xf1/0x3c0 +[86.873833] __driver_probe_device+0x8c/0x180 +[86.873848] driver_probe_device+0x24/0xd0 +[86.873862] __driver_attach+0x10f/0x220 +[86.873876] bus_for_each_dev+0x7f/0xe0 +[86.873892] driver_attach+0x1e/0x30 +[86.873904] bus_add_driver+0x151/0x290 +[86.873917] driver_register+0x5e/0x130 +[86.873931] __pci_register_driver+0x7d/0x90 +[86.873945] i915_pci_register_driver+0x23/0x30 [i915] +[86.874678] i915_init+0x37/0x120 [i915] +[86.875347] do_one_initcall+0x60/0x3f0 +[86.875369] do_init_module+0x97/0x2a0 +[86.875385] load_module+0x2c54/0x2d80 +[86.875398] init_module_from_file+0x96/0xe0 +[86.875413] idempotent_init_module+0x117/0x330 +[86.875426] __x64_sys_finit_module+0x77/0x100 +[86.875440] x64_sys_call+0x24de/0x2660 +[86.875454] do_syscall_64+0x91/0xe90 +[86.875470] entry_SYSCALL_64_after_hwframe+0x76/0x7e +[86.875486] +other info that might help us debug this: +[86.875502] Chain exists of: + cpu_hotplug_lock --> reservation_ww_class_acquire --> reservation_ww_class_mutex +[86.875539] Possible unsafe locking scenario: +[86.875552] CPU0 CPU1 +[86.875563] ---- ---- +[86.875573] lock(reservation_ww_class_mutex); +[86.875588] lock(reservation_ww_class_acquire); +[86.875606] lock(reservation_ww_class_mutex); +[86.875624] rlock(cpu_hotplug_lock); +[86.875637] + *** DEADLOCK *** +[86.875650] 3 locks held by i915_module_loa/1432: +[86.875663] #0: ffff888101f5c1b0 (&dev->mutex){....}-{3:3}, at: __driver_attach+0x104/0x220 +[86.875699] #1: ffffc90002e0b4a0 (reservation_ww_class_acquire){+.+.}-{0:0}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915] +[86.876512] #2: ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915] +[86.877305] +stack backtrace: +[86.877326] CPU: 0 UID: 0 PID: 1432 Comm: i915_module_loa Tainted: G U 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 PREEMPT(voluntary) +[86.877334] Tainted: [U]=USER +[86.877336] Hardware name: /NUC5CPYB, BIOS PYBSWCEL.86A.0079.2020.0420.1316 04/20/2020 +[86.877339] Call Trace: +[86.877344] +[86.877353] dump_stack_lvl+0x91/0xf0 +[86.877364] dump_stack+0x10/0x20 +[86.877369] print_circular_bug+0x285/0x360 +[86.877379] check_noncircular+0x135/0x150 +[86.877390] __lock_acquire+0x1635/0x2810 +[86.877403] lock_acquire+0xc4/0x2f0 +[86.877408] ? stop_machine+0x1c/0x50 +[86.877422] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915] +[86.878173] cpus_read_lock+0x41/0x100 +[86.878182] ? stop_machine+0x1c/0x50 +[86.878191] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915] +[86.878916] stop_machine+0x1c/0x50 +[86.878927] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915] +[86.879652] intel_ggtt_bind_vma+0x43/0x70 [i915] +[86.880375] __vma_bind+0x55/0x70 [i915] +[86.881133] fence_work+0x26/0xa0 [i915] +[86.881851] fence_notify+0xa1/0x140 [i915] +[86.882566] __i915_sw_fence_complete+0x8f/0x270 [i915] +[86.883286] i915_sw_fence_commit+0x39/0x60 [i915] +[86.884003] i915_vma_pin_ww+0x462/0x1360 [i915] +[86.884756] ? i915_vma_pin.constprop.0+0x6c/0x1d0 [i915] +[86.885513] i915_vma_pin.constprop.0+0x133/0x1d0 [i915] +[86.886281] initial_plane_vma+0x307/0x840 [i915] +[86.887049] intel_initial_plane_config+0x33f/0x670 [i915] +[86.887819] intel_display_driver_probe_nogem+0x1c6/0x260 [i915] +[86.888587] i915_driver_probe+0x7fa/0xe80 [i915] +[86.889293] ? mutex_unlock+0x12/0x20 +[86.889301] ? drm_privacy_screen_get+0x171/0x190 +[86.889308] ? acpi_dev_found+0x66/0x80 +[86.889321] i915_pci_probe+0xe6/0x220 [i915] +[86.890038] local_pci_probe+0x47/0xb0 +[86.890049] pci_device_probe+0xf3/0x260 +[86.890058] really_probe+0xf1/0x3c0 +[86.890067] __driver_probe_device+0x8c/0x180 +[86.890072] driver_probe_device+0x24/0xd0 +[86.890078] __driver_attach+0x10f/0x220 +[86.890083] ? __pfx___driver_attach+0x10/0x10 +[86.890088] bus_for_each_dev+0x7f/0xe0 +[86.890097] driver_attach+0x1e/0x30 +[86.890101] bus_add_driver+0x151/0x290 +[86.890107] driver_register+0x5e/0x130 +[86.890113] __pci_register_driver+0x7d/0x90 +[86.890119] i915_pci_register_driver+0x23/0x30 [i915] +[86.890833] i915_init+0x37/0x120 [i915] +[86.891482] ? __pfx_i915_init+0x10/0x10 [i915] +[86.892135] do_one_initcall+0x60/0x3f0 +[86.892145] ? __kmalloc_cache_noprof+0x33f/0x470 +[86.892157] do_init_module+0x97/0x2a0 +[86.892164] load_module+0x2c54/0x2d80 +[86.892168] ? __kernel_read+0x15c/0x300 +[86.892185] ? kernel_read_file+0x2b1/0x320 +[86.892195] init_module_from_file+0x96/0xe0 +[86.892199] ? init_module_from_file+0x96/0xe0 +[86.892211] idempotent_init_module+0x117/0x330 +[86.892224] __x64_sys_finit_module+0x77/0x100 +[86.892230] x64_sys_call+0x24de/0x2660 +[86.892236] do_syscall_64+0x91/0xe90 +[86.892243] ? irqentry_exit+0x77/0xb0 +[86.892249] ? sysvec_apic_timer_interrupt+0x57/0xc0 +[86.892256] entry_SYSCALL_64_after_hwframe+0x76/0x7e +[86.892261] RIP: 0033:0x7303e1b2725d +[86.892271] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8b bb 0d 00 f7 d8 64 89 01 48 +[86.892276] RSP: 002b:00007ffddd1fdb38 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 +[86.892281] RAX: ffffffffffffffda RBX: 00005d771d88fd90 RCX: 00007303e1b2725d +[86.892285] RDX: 0000000000000000 RSI: 00005d771d893aa0 RDI: 000000000000000c +[86.892287] RBP: 00007ffddd1fdbf0 R08: 0000000000000040 R09: 00007ffddd1fdb80 +[86.892289] R10: 00007303e1c03b20 R11: 0000000000000246 R12: 00005d771d893aa0 +[86.892292] R13: 0000000000000000 R14: 00005d771d88f0d0 R15: 00005d771d895710 +[86.892304] + +Call asynchronous variant of dma_fence_work_commit() in that case. + +v3: Provide more verbose in-line comment (Andi), + - mention target environments in commit message. + +Fixes: 7d1c2618eac59 ("drm/i915: Take reservation lock around i915_vma_pin.") +Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14985 +Cc: Andi Shyti +Signed-off-by: Janusz Krzysztofik +Reviewed-by: Sebastian Brzezinka +Reviewed-by: Krzysztof Karas +Acked-by: Andi Shyti +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20251023082925.351307-6-janusz.krzysztofik@linux.intel.com +(cherry picked from commit 648ef1324add1c2e2b6041cdf0b28d31fbca5f13) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/i915_vma.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c +index d2f064d2525cc..48f66d7f13678 100644 +--- a/drivers/gpu/drm/i915/i915_vma.c ++++ b/drivers/gpu/drm/i915/i915_vma.c +@@ -1595,8 +1595,20 @@ int i915_vma_pin_ww(struct i915_vma *vma, struct i915_gem_ww_ctx *ww, + err_vma_res: + i915_vma_resource_free(vma_res); + err_fence: +- if (work) +- dma_fence_work_commit_imm(&work->base); ++ if (work) { ++ /* ++ * When pinning VMA to GGTT on CHV or BXT with VTD enabled, ++ * commit VMA binding asynchronously to avoid risk of lock ++ * inversion among reservation_ww locks held here and ++ * cpu_hotplug_lock acquired from stop_machine(), which we ++ * wrap around GGTT updates when running in those environments. ++ */ ++ if (i915_vma_is_ggtt(vma) && ++ intel_vm_no_concurrent_access_wa(vma->vm->i915)) ++ dma_fence_work_commit(&work->base); ++ else ++ dma_fence_work_commit_imm(&work->base); ++ } + err_rpm: + intel_runtime_pm_put(&vma->vm->i915->runtime_pm, wakeref); + +-- +2.51.0 + diff --git a/queue-6.12/drm-i915-fix-conversion-between-clock-ticks-and-nano.patch b/queue-6.12/drm-i915-fix-conversion-between-clock-ticks-and-nano.patch new file mode 100644 index 0000000000..daa0a32fc9 --- /dev/null +++ b/queue-6.12/drm-i915-fix-conversion-between-clock-ticks-and-nano.patch @@ -0,0 +1,59 @@ +From 47b38e8834f9ff81733b0bf704cc6c44d7a79108 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Oct 2025 17:03:51 -0700 +Subject: drm/i915: Fix conversion between clock ticks and nanoseconds + +From: Umesh Nerlige Ramappa + +[ Upstream commit 7d44ad6b43d0be43d080180413a1b6c24cfbd266 ] + +When tick values are large, the multiplication by NSEC_PER_SEC is larger +than 64 bits and results in bad conversions. + +The issue is seen in PMU busyness counters that look like they have +wrapped around due to bad conversion. i915 PMU implementation returns +monotonically increasing counters. If a count is lesser than previous +one, it will only return the larger value until the smaller value +catches up. The user will see this as zero delta between two +measurements even though the engines are busy. + +Fix it by using mul_u64_u32_div() + +Fixes: 77cdd054dd2c ("drm/i915/pmu: Connect engine busyness stats from GuC to pmu") +Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14955 +Signed-off-by: Umesh Nerlige Ramappa +Reviewed-by: Ashutosh Dixit +Link: https://lore.kernel.org/r/20251016000350.1152382-2-umesh.nerlige.ramappa@intel.com +(cherry picked from commit 2ada9cb1df3f5405a01d013b708b1b0914efccfe) +Signed-off-by: Rodrigo Vivi +[Rodrigo: Added the Fixes tag while cherry-picking to fixes] +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c b/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c +index 6e63505fe4781..f01399c78c99d 100644 +--- a/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c ++++ b/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c +@@ -209,7 +209,7 @@ static u64 div_u64_roundup(u64 nom, u32 den) + + u64 intel_gt_clock_interval_to_ns(const struct intel_gt *gt, u64 count) + { +- return div_u64_roundup(count * NSEC_PER_SEC, gt->clock_frequency); ++ return mul_u64_u32_div(count, NSEC_PER_SEC, gt->clock_frequency); + } + + u64 intel_gt_pm_interval_to_ns(const struct intel_gt *gt, u64 count) +@@ -219,7 +219,7 @@ u64 intel_gt_pm_interval_to_ns(const struct intel_gt *gt, u64 count) + + u64 intel_gt_ns_to_clock_interval(const struct intel_gt *gt, u64 ns) + { +- return div_u64_roundup(gt->clock_frequency * ns, NSEC_PER_SEC); ++ return mul_u64_u32_div(ns, gt->clock_frequency, NSEC_PER_SEC); + } + + u64 intel_gt_ns_to_pm_interval(const struct intel_gt *gt, u64 ns) +-- +2.51.0 + diff --git a/queue-6.12/drm-mediatek-add-pm_runtime-support-for-gce-power-co.patch b/queue-6.12/drm-mediatek-add-pm_runtime-support-for-gce-power-co.patch new file mode 100644 index 0000000000..94a5f9b6e0 --- /dev/null +++ b/queue-6.12/drm-mediatek-add-pm_runtime-support-for-gce-power-co.patch @@ -0,0 +1,52 @@ +From 28c2efbb4351c133d27a332ccc123744b05df9ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 17:15:59 +0800 +Subject: drm/mediatek: Add pm_runtime support for GCE power control + +From: Jason-JH Lin + +[ Upstream commit afcfb6c8474d9e750880aaa77952cc588f859613 ] + +Call pm_runtime_resume_and_get() before accessing GCE hardware in +mbox_send_message(), and invoke pm_runtime_put_autosuspend() in the +cmdq callback to release the PM reference and start autosuspend for +GCE. This ensures correct power management for the GCE device. + +Fixes: 8afe816b0c99 ("mailbox: mtk-cmdq-mailbox: Implement Runtime PM with autosuspend") +Signed-off-by: Jason-JH Lin +Reviewed-by: CK Hu +Link: https://patchwork.kernel.org/project/dri-devel/patch/20250829091727.3745415-3-jason-jh.lin@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_crtc.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_crtc.c b/drivers/gpu/drm/mediatek/mtk_crtc.c +index bc7527542fdc6..c4c6d0249df56 100644 +--- a/drivers/gpu/drm/mediatek/mtk_crtc.c ++++ b/drivers/gpu/drm/mediatek/mtk_crtc.c +@@ -283,6 +283,10 @@ static void ddp_cmdq_cb(struct mbox_client *cl, void *mssg) + unsigned int i; + unsigned long flags; + ++ /* release GCE HW usage and start autosuspend */ ++ pm_runtime_mark_last_busy(cmdq_cl->chan->mbox->dev); ++ pm_runtime_put_autosuspend(cmdq_cl->chan->mbox->dev); ++ + if (data->sta < 0) + return; + +@@ -618,6 +622,9 @@ static void mtk_crtc_update_config(struct mtk_crtc *mtk_crtc, bool needs_vblank) + mtk_crtc->config_updating = false; + spin_unlock_irqrestore(&mtk_crtc->config_lock, flags); + ++ if (pm_runtime_resume_and_get(mtk_crtc->cmdq_client.chan->mbox->dev) < 0) ++ goto update_config_out; ++ + mbox_send_message(mtk_crtc->cmdq_client.chan, cmdq_handle); + mbox_client_txdone(mtk_crtc->cmdq_client.chan, 0); + goto update_config_out; +-- +2.51.0 + diff --git a/queue-6.12/drm-xe-do-clean-shutdown-also-when-using-flr.patch b/queue-6.12/drm-xe-do-clean-shutdown-also-when-using-flr.patch new file mode 100644 index 0000000000..44444c7d29 --- /dev/null +++ b/queue-6.12/drm-xe-do-clean-shutdown-also-when-using-flr.patch @@ -0,0 +1,69 @@ +From d8dac7ae5a90a4beb93a2c6fdfc2c2745e472e8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Oct 2025 14:23:11 +0200 +Subject: drm/xe: Do clean shutdown also when using flr +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jouni Högander + +[ Upstream commit b11a020d914c3b7628f56a9ea476a5b03679489b ] + +Currently Xe driver is triggering flr without any clean-up on +shutdown. This is causing random warnings from pending related works as the +underlying hardware is reset in the middle of their execution. + +Fix this by performing clean shutdown also when using flr. + +Fixes: 501d799a47e2 ("drm/xe: Wire up device shutdown handler") +Cc: Maarten Lankhorst +Signed-off-by: Jouni Högander +Reviewed-by: Maarten Lankhorst +Link: https://patch.msgid.link/20251031122312.1836534-1-jouni.hogander@intel.com +Signed-off-by: Maarten Lankhorst +(cherry picked from commit a4ff26b7c8ef38e4dd34f77cbcd73576fdde6dd4) +Signed-off-by: Lucas De Marchi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_device.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_device.c b/drivers/gpu/drm/xe/xe_device.c +index 3fab4e67ef8c1..161c73e676640 100644 +--- a/drivers/gpu/drm/xe/xe_device.c ++++ b/drivers/gpu/drm/xe/xe_device.c +@@ -809,21 +809,21 @@ void xe_device_remove(struct xe_device *xe) + + void xe_device_shutdown(struct xe_device *xe) + { ++ struct xe_gt *gt; ++ u8 id; ++ + drm_dbg(&xe->drm, "Shutting down device\n"); + +- if (xe_driver_flr_disabled(xe)) { +- struct xe_gt *gt; +- u8 id; ++ xe_display_pm_shutdown(xe); + +- xe_display_pm_shutdown(xe); ++ xe_irq_suspend(xe); + +- xe_irq_suspend(xe); ++ for_each_gt(gt, xe, id) ++ xe_gt_shutdown(gt); + +- for_each_gt(gt, xe, id) +- xe_gt_shutdown(gt); ++ xe_display_pm_shutdown_late(xe); + +- xe_display_pm_shutdown_late(xe); +- } else { ++ if (!xe_driver_flr_disabled(xe)) { + /* BOOM! */ + __xe_driver_flr(xe); + } +-- +2.51.0 + diff --git a/queue-6.12/drm-xe-guc-synchronize-dead-ct-worker-with-unbind.patch b/queue-6.12/drm-xe-guc-synchronize-dead-ct-worker-with-unbind.patch new file mode 100644 index 0000000000..af896a11bf --- /dev/null +++ b/queue-6.12/drm-xe-guc-synchronize-dead-ct-worker-with-unbind.patch @@ -0,0 +1,43 @@ +From 87845e0ed4d1bce6a5a2276503c8c2f28f8191a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Nov 2025 18:01:47 +0530 +Subject: drm/xe/guc: Synchronize Dead CT worker with unbind + +From: Balasubramani Vivekanandan + +[ Upstream commit 95af8f4fdce8349a5fe75264007f1af2aa1082ea ] + +Cancel and wait for any Dead CT worker to complete before continuing +with device unbinding. Else the worker will end up using resources freed +by the undind operation. + +Cc: Zhanjun Dong +Fixes: d2c5a5a926f4 ("drm/xe/guc: Dead CT helper") +Signed-off-by: Balasubramani Vivekanandan +Reviewed-by: Stuart Summers +Link: https://patch.msgid.link/20251103123144.3231829-6-balasubramani.vivekanandan@intel.com +Signed-off-by: Lucas De Marchi +(cherry picked from commit 492671339114e376aaa38626d637a2751cdef263) +Signed-off-by: Lucas De Marchi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_guc_ct.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/xe/xe_guc_ct.c b/drivers/gpu/drm/xe/xe_guc_ct.c +index d692e279d9fbf..7619b48dbfe43 100644 +--- a/drivers/gpu/drm/xe/xe_guc_ct.c ++++ b/drivers/gpu/drm/xe/xe_guc_ct.c +@@ -188,6 +188,9 @@ static void guc_ct_fini(struct drm_device *drm, void *arg) + { + struct xe_guc_ct *ct = arg; + ++#if IS_ENABLED(CONFIG_DRM_XE_DEBUG) ++ cancel_work_sync(&ct->dead.worker); ++#endif + ct_exit_safe_mode(ct); + destroy_workqueue(ct->g2h_wq); + xa_destroy(&ct->fence_lookup); +-- +2.51.0 + diff --git a/queue-6.12/drm-xe-move-declarations-under-conditional-branch.patch b/queue-6.12/drm-xe-move-declarations-under-conditional-branch.patch new file mode 100644 index 0000000000..e18c208ed2 --- /dev/null +++ b/queue-6.12/drm-xe-move-declarations-under-conditional-branch.patch @@ -0,0 +1,48 @@ +From 5e1f05af2b81c4d6366f8881323105abb2a538c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 15:32:08 +0530 +Subject: drm/xe: Move declarations under conditional branch + +From: Tejas Upadhyay + +[ Upstream commit 9cd27eec872f0b95dcdd811edc39d2d32e4158c8 ] + +The xe_device_shutdown() function was needing a few declarations +that were only required under a specific condition. This change +moves those declarations to be within that conditional branch +to avoid unnecessary declarations. + +Reviewed-by: Nitin Gote +Link: https://patchwork.freedesktop.org/patch/msgid/20251007100208.1407021-1-tejas.upadhyay@intel.com +Signed-off-by: Tejas Upadhyay +(cherry picked from commit 15b3036045188f4da4ca62b2ed01b0f160252e9b) +Signed-off-by: Lucas De Marchi +Stable-dep-of: b11a020d914c ("drm/xe: Do clean shutdown also when using flr") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_device.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_device.c b/drivers/gpu/drm/xe/xe_device.c +index 2e1d6d248d2e0..3fab4e67ef8c1 100644 +--- a/drivers/gpu/drm/xe/xe_device.c ++++ b/drivers/gpu/drm/xe/xe_device.c +@@ -809,12 +809,12 @@ void xe_device_remove(struct xe_device *xe) + + void xe_device_shutdown(struct xe_device *xe) + { +- struct xe_gt *gt; +- u8 id; +- + drm_dbg(&xe->drm, "Shutting down device\n"); + + if (xe_driver_flr_disabled(xe)) { ++ struct xe_gt *gt; ++ u8 id; ++ + xe_display_pm_shutdown(xe); + + xe_irq_suspend(xe); +-- +2.51.0 + diff --git a/queue-6.12/exfat-fix-improper-check-of-dentry.stream.valid_size.patch b/queue-6.12/exfat-fix-improper-check-of-dentry.stream.valid_size.patch new file mode 100644 index 0000000000..b6b678904f --- /dev/null +++ b/queue-6.12/exfat-fix-improper-check-of-dentry.stream.valid_size.patch @@ -0,0 +1,59 @@ +From 291981f3b4df105e936d15dd627f3d20e7383993 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 22:01:46 +0900 +Subject: exfat: fix improper check of dentry.stream.valid_size +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jaehun Gou + +[ Upstream commit 82ebecdc74ff555daf70b811d854b1f32a296bea ] + +We found an infinite loop bug in the exFAT file system that can lead to a +Denial-of-Service (DoS) condition. When a dentry in an exFAT filesystem is +malformed, the following system calls — SYS_openat, SYS_ftruncate, and +SYS_pwrite64 — can cause the kernel to hang. + +Root cause analysis shows that the size validation code in exfat_find() +does not check whether dentry.stream.valid_size is negative. As a result, +the system calls mentioned above can succeed and eventually trigger the DoS +issue. + +This patch adds a check for negative dentry.stream.valid_size to prevent +this vulnerability. + +Co-developed-by: Seunghun Han +Signed-off-by: Seunghun Han +Co-developed-by: Jihoon Kwon +Signed-off-by: Jihoon Kwon +Signed-off-by: Jaehun Gou +Signed-off-by: Namjae Jeon +Signed-off-by: Sasha Levin +--- + fs/exfat/namei.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/fs/exfat/namei.c b/fs/exfat/namei.c +index e9624eb61cbc9..f0fda34694044 100644 +--- a/fs/exfat/namei.c ++++ b/fs/exfat/namei.c +@@ -635,10 +635,14 @@ static int exfat_find(struct inode *dir, struct qstr *qname, + + info->type = exfat_get_entry_type(ep); + info->attr = le16_to_cpu(ep->dentry.file.attr); +- info->size = le64_to_cpu(ep2->dentry.stream.valid_size); + info->valid_size = le64_to_cpu(ep2->dentry.stream.valid_size); + info->size = le64_to_cpu(ep2->dentry.stream.size); + ++ if (info->valid_size < 0) { ++ exfat_fs_error(sb, "data valid size is invalid(%lld)", info->valid_size); ++ return -EIO; ++ } ++ + if (unlikely(EXFAT_B_TO_CLU_ROUND_UP(info->size, sbi) > sbi->used_clusters)) { + exfat_fs_error(sb, "data size is invalid(%lld)", info->size); + return -EIO; +-- +2.51.0 + diff --git a/queue-6.12/hid-logitech-hidpp-add-hidpp_quirk_reset_hi_res_scro.patch b/queue-6.12/hid-logitech-hidpp-add-hidpp_quirk_reset_hi_res_scro.patch new file mode 100644 index 0000000000..e3e7afe413 --- /dev/null +++ b/queue-6.12/hid-logitech-hidpp-add-hidpp_quirk_reset_hi_res_scro.patch @@ -0,0 +1,115 @@ +From 855c343a762359a49d80980f8d3241ff0f649f09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Oct 2025 02:05:49 +0100 +Subject: HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL + +From: Stuart Hayhurst + +[ Upstream commit ed80cc4667ac997b84546e6d35f0a0ae525d239c ] + +The Logitech G502 Hero Wireless's high resolution scrolling resets after +being unplugged without notifying the driver, causing extremely slow +scrolling. + +The only indication of this is a battery update packet, so add a quirk to +detect when the device is unplugged and re-enable the scrolling. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=218037 +Signed-off-by: Stuart Hayhurst +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-logitech-hidpp.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index 59f630962338d..2e72e8967e685 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -75,6 +75,7 @@ MODULE_PARM_DESC(disable_tap_to_click, + #define HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS BIT(27) + #define HIDPP_QUIRK_HI_RES_SCROLL_1P0 BIT(28) + #define HIDPP_QUIRK_WIRELESS_STATUS BIT(29) ++#define HIDPP_QUIRK_RESET_HI_RES_SCROLL BIT(30) + + /* These are just aliases for now */ + #define HIDPP_QUIRK_KBD_SCROLL_WHEEL HIDPP_QUIRK_HIDPP_WHEELS +@@ -193,6 +194,7 @@ struct hidpp_device { + void *private_data; + + struct work_struct work; ++ struct work_struct reset_hi_res_work; + struct kfifo delayed_work_fifo; + struct input_dev *delayed_input; + +@@ -3864,6 +3866,7 @@ static int hidpp_raw_hidpp_event(struct hidpp_device *hidpp, u8 *data, + struct hidpp_report *answer = hidpp->send_receive_buf; + struct hidpp_report *report = (struct hidpp_report *)data; + int ret; ++ int last_online; + + /* + * If the mutex is locked then we have a pending answer from a +@@ -3905,6 +3908,7 @@ static int hidpp_raw_hidpp_event(struct hidpp_device *hidpp, u8 *data, + "See: https://gitlab.freedesktop.org/jwrdegoede/logitech-27mhz-keyboard-encryption-setup/\n"); + } + ++ last_online = hidpp->battery.online; + if (hidpp->capabilities & HIDPP_CAPABILITY_HIDPP20_BATTERY) { + ret = hidpp20_battery_event_1000(hidpp, data, size); + if (ret != 0) +@@ -3929,6 +3933,11 @@ static int hidpp_raw_hidpp_event(struct hidpp_device *hidpp, u8 *data, + return ret; + } + ++ if (hidpp->quirks & HIDPP_QUIRK_RESET_HI_RES_SCROLL) { ++ if (last_online == 0 && hidpp->battery.online == 1) ++ schedule_work(&hidpp->reset_hi_res_work); ++ } ++ + if (hidpp->quirks & HIDPP_QUIRK_HIDPP_WHEELS) { + ret = hidpp10_wheel_raw_event(hidpp, data, size); + if (ret != 0) +@@ -4302,6 +4311,13 @@ static void hidpp_connect_event(struct work_struct *work) + hidpp->delayed_input = input; + } + ++static void hidpp_reset_hi_res_handler(struct work_struct *work) ++{ ++ struct hidpp_device *hidpp = container_of(work, struct hidpp_device, reset_hi_res_work); ++ ++ hi_res_scroll_enable(hidpp); ++} ++ + static DEVICE_ATTR(builtin_power_supply, 0000, NULL, NULL); + + static struct attribute *sysfs_attrs[] = { +@@ -4432,6 +4448,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) + } + + INIT_WORK(&hidpp->work, hidpp_connect_event); ++ INIT_WORK(&hidpp->reset_hi_res_work, hidpp_reset_hi_res_handler); + mutex_init(&hidpp->send_mutex); + init_waitqueue_head(&hidpp->wait); + +@@ -4527,6 +4544,7 @@ static void hidpp_remove(struct hid_device *hdev) + + hid_hw_stop(hdev); + cancel_work_sync(&hidpp->work); ++ cancel_work_sync(&hidpp->reset_hi_res_work); + mutex_destroy(&hidpp->send_mutex); + } + +@@ -4574,6 +4592,9 @@ static const struct hid_device_id hidpp_devices[] = { + { /* Keyboard MX5500 (Bluetooth-receiver in HID proxy mode) */ + LDJ_DEVICE(0xb30b), + .driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS }, ++ { /* Logitech G502 Lightspeed Wireless Gaming Mouse */ ++ LDJ_DEVICE(0x407f), ++ .driver_data = HIDPP_QUIRK_RESET_HI_RES_SCROLL }, + + { LDJ_DEVICE(HID_ANY_ID) }, + +-- +2.51.0 + diff --git a/queue-6.12/hid-nintendo-wait-longer-for-initial-probe.patch b/queue-6.12/hid-nintendo-wait-longer-for-initial-probe.patch new file mode 100644 index 0000000000..777cc47bc7 --- /dev/null +++ b/queue-6.12/hid-nintendo-wait-longer-for-initial-probe.patch @@ -0,0 +1,37 @@ +From 258cf4332c4b19066c893516b56c4eed7d18aef0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Oct 2025 18:05:32 -0700 +Subject: HID: nintendo: Wait longer for initial probe + +From: Vicki Pfau + +[ Upstream commit b73bc6a51f0c0066912c7e181acee41091c70fe6 ] + +Some third-party controllers, such as the PB Tails CHOC, won't always +respond quickly on startup. Since this packet is needed for probe, and only +once during probe, let's just wait an extra second, which makes connecting +consistent. + +Signed-off-by: Vicki Pfau +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-nintendo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-nintendo.c b/drivers/hid/hid-nintendo.c +index 2a3ae1068739d..6bdc9165f8226 100644 +--- a/drivers/hid/hid-nintendo.c ++++ b/drivers/hid/hid-nintendo.c +@@ -2424,7 +2424,7 @@ static int joycon_read_info(struct joycon_ctlr *ctlr) + struct joycon_input_report *report; + + req.subcmd_id = JC_SUBCMD_REQ_DEV_INFO; +- ret = joycon_send_subcmd(ctlr, &req, 0, HZ); ++ ret = joycon_send_subcmd(ctlr, &req, 0, 2 * HZ); + if (ret) { + hid_err(ctlr->hdev, "Failed to get joycon info; ret=%d\n", ret); + return ret; +-- +2.51.0 + diff --git a/queue-6.12/hid-quirks-add-always_poll-quirk-for-vrs-r295-steeri.patch b/queue-6.12/hid-quirks-add-always_poll-quirk-for-vrs-r295-steeri.patch new file mode 100644 index 0000000000..982f15bb19 --- /dev/null +++ b/queue-6.12/hid-quirks-add-always_poll-quirk-for-vrs-r295-steeri.patch @@ -0,0 +1,47 @@ +From 0da89cc93e09d70132de4c484cebe750864495c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 18:46:11 +0300 +Subject: HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel + +From: Oleg Makarenko + +[ Upstream commit 1141ed52348d3df82d3fd2316128b3fc6203a68c ] + +This patch adds ALWAYS_POLL quirk for the VRS R295 steering wheel joystick. +This device reboots itself every 8-10 seconds if it is not polled. + +Signed-off-by: Oleg Makarenko +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-quirks.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 63eb60effcaaf..4b85d9088a61b 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -1420,6 +1420,7 @@ + + #define USB_VENDOR_ID_VRS 0x0483 + #define USB_DEVICE_ID_VRS_DFP 0xa355 ++#define USB_DEVICE_ID_VRS_R295 0xa44c + + #define USB_VENDOR_ID_VTL 0x0306 + #define USB_DEVICE_ID_VTL_MULTITOUCH_FF3F 0xff3f +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 468a47de96b10..75480ec3c15a2 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -207,6 +207,7 @@ static const struct hid_device_id hid_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_KNA5), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_TWA60), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, USB_DEVICE_ID_UGTIZER_TABLET_WP5540), HID_QUIRK_MULTI_INPUT }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_VRS, USB_DEVICE_ID_VRS_R295), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_10_6_INCH), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_14_1_INCH), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SIRIUS_BATTERY_FREE_TABLET), HID_QUIRK_MULTI_INPUT }, +-- +2.51.0 + diff --git a/queue-6.12/hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch b/queue-6.12/hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch new file mode 100644 index 0000000000..5ed504e7b4 --- /dev/null +++ b/queue-6.12/hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch @@ -0,0 +1,54 @@ +From 95f65bfe15e8ec0ef6b5f3265b381ea5be98aa8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Sep 2025 18:25:43 +0200 +Subject: HID: quirks: avoid Cooler Master MM712 dongle wakeup bug + +From: Tristan Lobb + +[ Upstream commit 0be4253bf878d9aaa2b96031ac8683fceeb81480 ] + +The Cooler Master Mice Dongle includes a vendor defined HID interface +alongside its mouse interface. Not polling it will cause the mouse to +stop responding to polls on any interface once woken up again after +going into power saving mode. + +Add the HID_QUIRK_ALWAYS_POLL quirk alongside the Cooler Master VID and +the Dongle's PID. + +Signed-off-by: Tristan Lobb +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 3 +++ + drivers/hid/hid-quirks.c | 1 + + 2 files changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index d41a65362835d..63eb60effcaaf 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -338,6 +338,9 @@ + #define USB_DEVICE_ID_CODEMERCS_IOW_FIRST 0x1500 + #define USB_DEVICE_ID_CODEMERCS_IOW_LAST 0x15ff + ++#define USB_VENDOR_ID_COOLER_MASTER 0x2516 ++#define USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE 0x01b7 ++ + #define USB_VENDOR_ID_CORSAIR 0x1b1c + #define USB_DEVICE_ID_CORSAIR_K90 0x1b02 + #define USB_DEVICE_ID_CORSAIR_K70R 0x1b09 +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 64f9728018b88..468a47de96b10 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -57,6 +57,7 @@ static const struct hid_device_id hid_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_THROTTLE), HID_QUIRK_NOGET }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_COOLER_MASTER, USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB), HID_QUIRK_NO_INIT_REPORTS }, + { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE), HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB), HID_QUIRK_NO_INIT_REPORTS }, +-- +2.51.0 + diff --git a/queue-6.12/iommufd-make-vfio_compat-s-unmap-succeed-if-the-rang.patch b/queue-6.12/iommufd-make-vfio_compat-s-unmap-succeed-if-the-rang.patch new file mode 100644 index 0000000000..d095efcfe8 --- /dev/null +++ b/queue-6.12/iommufd-make-vfio_compat-s-unmap-succeed-if-the-rang.patch @@ -0,0 +1,96 @@ +From d3fb04207d0559a67566897f94be7c604fd3ead4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Nov 2025 14:11:49 -0400 +Subject: iommufd: Make vfio_compat's unmap succeed if the range is already + empty + +From: Jason Gunthorpe + +[ Upstream commit afb47765f9235181fddc61c8633b5a8cfae29fd2 ] + +iommufd returns ENOENT when attempting to unmap a range that is already +empty, while vfio type1 returns success. Fix vfio_compat to match. + +Fixes: d624d6652a65 ("iommufd: vfio container FD ioctl compatibility") +Link: https://patch.msgid.link/r/0-v1-76be45eff0be+5d-iommufd_unmap_compat_jgg@nvidia.com +Reviewed-by: Nicolin Chen +Reviewed-by: Alex Mastro +Reported-by: Alex Mastro +Closes: https://lore.kernel.org/r/aP0S5ZF9l3sWkJ1G@devgpu012.nha5.facebook.com +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/iommu/iommufd/io_pagetable.c | 12 +++--------- + drivers/iommu/iommufd/ioas.c | 4 ++++ + tools/testing/selftests/iommu/iommufd.c | 2 ++ + 3 files changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/iommu/iommufd/io_pagetable.c b/drivers/iommu/iommufd/io_pagetable.c +index 067222b238b7e..f0f094cc7e520 100644 +--- a/drivers/iommu/iommufd/io_pagetable.c ++++ b/drivers/iommu/iommufd/io_pagetable.c +@@ -660,7 +660,8 @@ static int iopt_unmap_iova_range(struct io_pagetable *iopt, unsigned long start, + struct iopt_area *area; + unsigned long unmapped_bytes = 0; + unsigned int tries = 0; +- int rc = -ENOENT; ++ /* If there are no mapped entries then success */ ++ int rc = 0; + + /* + * The domains_rwsem must be held in read mode any time any area->pages +@@ -724,8 +725,6 @@ static int iopt_unmap_iova_range(struct io_pagetable *iopt, unsigned long start, + + down_write(&iopt->iova_rwsem); + } +- if (unmapped_bytes) +- rc = 0; + + out_unlock_iova: + up_write(&iopt->iova_rwsem); +@@ -762,13 +761,8 @@ int iopt_unmap_iova(struct io_pagetable *iopt, unsigned long iova, + + int iopt_unmap_all(struct io_pagetable *iopt, unsigned long *unmapped) + { +- int rc; +- +- rc = iopt_unmap_iova_range(iopt, 0, ULONG_MAX, unmapped); + /* If the IOVAs are empty then unmap all succeeds */ +- if (rc == -ENOENT) +- return 0; +- return rc; ++ return iopt_unmap_iova_range(iopt, 0, ULONG_MAX, unmapped); + } + + /* The caller must always free all the nodes in the allowed_iova rb_root. */ +diff --git a/drivers/iommu/iommufd/ioas.c b/drivers/iommu/iommufd/ioas.c +index 2c4b2bb11e78c..4885293bd94f1 100644 +--- a/drivers/iommu/iommufd/ioas.c ++++ b/drivers/iommu/iommufd/ioas.c +@@ -317,6 +317,10 @@ int iommufd_ioas_unmap(struct iommufd_ucmd *ucmd) + &unmapped); + if (rc) + goto out_put; ++ if (!unmapped) { ++ rc = -ENOENT; ++ goto out_put; ++ } + } + + cmd->length = unmapped; +diff --git a/tools/testing/selftests/iommu/iommufd.c b/tools/testing/selftests/iommu/iommufd.c +index a81c22d520070..7a535c590245f 100644 +--- a/tools/testing/selftests/iommu/iommufd.c ++++ b/tools/testing/selftests/iommu/iommufd.c +@@ -2329,6 +2329,8 @@ TEST_F(vfio_compat_mock_domain, map) + ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_MAP_DMA, &map_cmd)); + ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_UNMAP_DMA, &unmap_cmd)); + ASSERT_EQ(BUFFER_SIZE, unmap_cmd.size); ++ /* Unmap of empty is success */ ++ ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_UNMAP_DMA, &unmap_cmd)); + + /* UNMAP_FLAG_ALL requires 0 iova/size */ + ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_MAP_DMA, &map_cmd)); +-- +2.51.0 + diff --git a/queue-6.12/nfs-check-if-suid-sgid-was-cleared-after-a-write-as-.patch b/queue-6.12/nfs-check-if-suid-sgid-was-cleared-after-a-write-as-.patch new file mode 100644 index 0000000000..9b3bb2c291 --- /dev/null +++ b/queue-6.12/nfs-check-if-suid-sgid-was-cleared-after-a-write-as-.patch @@ -0,0 +1,45 @@ +From d6fbc21e1ed620429c100eb12341420c79b0ecb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 16:42:12 -0400 +Subject: NFS: check if suid/sgid was cleared after a write as needed + +From: Scott Mayhew + +[ Upstream commit 9ff022f3820a31507cb93be6661bf5f3ca0609a4 ] + +I noticed xfstests generic/193 and generic/355 started failing against +knfsd after commit e7a8ebc305f2 ("NFSD: Offer write delegation for OPEN +with OPEN4_SHARE_ACCESS_WRITE"). + +I ran those same tests against ONTAP (which has had write delegation +support for a lot longer than knfsd) and they fail there too... so +while it's a new failure against knfsd, it isn't an entirely new +failure. + +Add the NFS_INO_REVAL_FORCED flag so that the presence of a delegation +doesn't keep the inode from being revalidated to fetch the updated mode. + +Signed-off-by: Scott Mayhew +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/write.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/nfs/write.c b/fs/nfs/write.c +index fd86546fafd3f..88d0e5168093a 100644 +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -1577,7 +1577,8 @@ static int nfs_writeback_done(struct rpc_task *task, + /* Deal with the suid/sgid bit corner case */ + if (nfs_should_remove_suid(inode)) { + spin_lock(&inode->i_lock); +- nfs_set_cache_invalid(inode, NFS_INO_INVALID_MODE); ++ nfs_set_cache_invalid(inode, NFS_INO_INVALID_MODE ++ | NFS_INO_REVAL_FORCED); + spin_unlock(&inode->i_lock); + } + return 0; +-- +2.51.0 + diff --git a/queue-6.12/nfs4-apply-delay_retrans-to-async-operations.patch b/queue-6.12/nfs4-apply-delay_retrans-to-async-operations.patch new file mode 100644 index 0000000000..9ebb39b47d --- /dev/null +++ b/queue-6.12/nfs4-apply-delay_retrans-to-async-operations.patch @@ -0,0 +1,146 @@ +From 944dd0aecfd6c2ea1c61b6fd4c8ad69c38ef3360 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 15:22:58 -0600 +Subject: NFS4: Apply delay_retrans to async operations + +From: Joshua Watt + +[ Upstream commit 7a84394f02ab1985ebbe0a8d6f6d69bd040de4b3 ] + +The setting of delay_retrans is applied to synchronous RPC operations +because the retransmit count is stored in same struct nfs4_exception +that is passed each time an error is checked. However, for asynchronous +operations (READ, WRITE, LOCKU, CLOSE, DELEGRETURN), a new struct +nfs4_exception is made on the stack each time the task callback is +invoked. This means that the retransmit count is always zero and thus +delay_retrans never takes effect. + +Apply delay_retrans to these operations by tracking and updating their +retransmit count. + +Change-Id: Ieb33e046c2b277cb979caa3faca7f52faf0568c9 +Signed-off-by: Joshua Watt +Reviewed-by: Benjamin Coddington +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 13 +++++++++++++ + include/linux/nfs_xdr.h | 1 + + 2 files changed, 14 insertions(+) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index b0ba9f2bef56b..a4531386c6485 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -3612,6 +3612,7 @@ struct nfs4_closedata { + } lr; + struct nfs_fattr fattr; + unsigned long timestamp; ++ unsigned short retrans; + }; + + static void nfs4_free_closedata(void *data) +@@ -3640,6 +3641,7 @@ static void nfs4_close_done(struct rpc_task *task, void *data) + .state = state, + .inode = calldata->inode, + .stateid = &calldata->arg.stateid, ++ .retrans = calldata->retrans, + }; + + if (!nfs4_sequence_done(task, &calldata->res.seq_res)) +@@ -3687,6 +3689,7 @@ static void nfs4_close_done(struct rpc_task *task, void *data) + default: + task->tk_status = nfs4_async_handle_exception(task, + server, task->tk_status, &exception); ++ calldata->retrans = exception.retrans; + if (exception.retry) + goto out_restart; + } +@@ -5546,9 +5549,11 @@ static int nfs4_read_done_cb(struct rpc_task *task, struct nfs_pgio_header *hdr) + .inode = hdr->inode, + .state = hdr->args.context->state, + .stateid = &hdr->args.stateid, ++ .retrans = hdr->retrans, + }; + task->tk_status = nfs4_async_handle_exception(task, + server, task->tk_status, &exception); ++ hdr->retrans = exception.retrans; + if (exception.retry) { + rpc_restart_call_prepare(task); + return -EAGAIN; +@@ -5662,10 +5667,12 @@ static int nfs4_write_done_cb(struct rpc_task *task, + .inode = hdr->inode, + .state = hdr->args.context->state, + .stateid = &hdr->args.stateid, ++ .retrans = hdr->retrans, + }; + task->tk_status = nfs4_async_handle_exception(task, + NFS_SERVER(inode), task->tk_status, + &exception); ++ hdr->retrans = exception.retrans; + if (exception.retry) { + rpc_restart_call_prepare(task); + return -EAGAIN; +@@ -6677,6 +6684,7 @@ struct nfs4_delegreturndata { + struct nfs_fh fh; + nfs4_stateid stateid; + unsigned long timestamp; ++ unsigned short retrans; + struct { + struct nfs4_layoutreturn_args arg; + struct nfs4_layoutreturn_res res; +@@ -6697,6 +6705,7 @@ static void nfs4_delegreturn_done(struct rpc_task *task, void *calldata) + .inode = data->inode, + .stateid = &data->stateid, + .task_is_privileged = data->args.seq_args.sa_privileged, ++ .retrans = data->retrans, + }; + + if (!nfs4_sequence_done(task, &data->res.seq_res)) +@@ -6768,6 +6777,7 @@ static void nfs4_delegreturn_done(struct rpc_task *task, void *calldata) + task->tk_status = nfs4_async_handle_exception(task, + data->res.server, task->tk_status, + &exception); ++ data->retrans = exception.retrans; + if (exception.retry) + goto out_restart; + } +@@ -7044,6 +7054,7 @@ struct nfs4_unlockdata { + struct file_lock fl; + struct nfs_server *server; + unsigned long timestamp; ++ unsigned short retrans; + }; + + static struct nfs4_unlockdata *nfs4_alloc_unlockdata(struct file_lock *fl, +@@ -7098,6 +7109,7 @@ static void nfs4_locku_done(struct rpc_task *task, void *data) + struct nfs4_exception exception = { + .inode = calldata->lsp->ls_state->inode, + .stateid = &calldata->arg.stateid, ++ .retrans = calldata->retrans, + }; + + if (!nfs4_sequence_done(task, &calldata->res.seq_res)) +@@ -7131,6 +7143,7 @@ static void nfs4_locku_done(struct rpc_task *task, void *data) + task->tk_status = nfs4_async_handle_exception(task, + calldata->server, task->tk_status, + &exception); ++ calldata->retrans = exception.retrans; + if (exception.retry) + rpc_restart_call_prepare(task); + } +diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h +index b48d94f099657..b7a08c875514f 100644 +--- a/include/linux/nfs_xdr.h ++++ b/include/linux/nfs_xdr.h +@@ -1660,6 +1660,7 @@ struct nfs_pgio_header { + void *netfs; + #endif + ++ unsigned short retrans; + int pnfs_error; + int error; /* merge with pnfs_error */ + unsigned int good_bytes; /* boundary of good data */ +-- +2.51.0 + diff --git a/queue-6.12/nfs4-fix-state-renewals-missing-after-boot.patch b/queue-6.12/nfs4-fix-state-renewals-missing-after-boot.patch new file mode 100644 index 0000000000..7c6ca5877d --- /dev/null +++ b/queue-6.12/nfs4-fix-state-renewals-missing-after-boot.patch @@ -0,0 +1,41 @@ +From 9970d946dff4a83cc49ff6afd792bf66bb788553 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 15:48:04 -0600 +Subject: NFS4: Fix state renewals missing after boot + +From: Joshua Watt + +[ Upstream commit 9bb3baa9d1604cd20f49ae7dac9306b4037a0e7a ] + +Since the last renewal time was initialized to 0 and jiffies start +counting at -5 minutes, any clients connected in the first 5 minutes +after a reboot would have their renewal timer set to a very long +interval. If the connection was idle, this would result in the client +state timing out on the server and the next call to the server would +return NFS4ERR_BADSESSION. + +Fix this by initializing the last renewal time to the current jiffies +instead of 0. + +Signed-off-by: Joshua Watt +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4client.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c +index 37c17f70cebe3..aaf723471228b 100644 +--- a/fs/nfs/nfs4client.c ++++ b/fs/nfs/nfs4client.c +@@ -222,6 +222,7 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init) + clp->cl_state = 1 << NFS4CLNT_LEASE_EXPIRED; + clp->cl_mvops = nfs_v4_minor_ops[cl_init->minorversion]; + clp->cl_mig_gen = 1; ++ clp->cl_last_renewal = jiffies; + #if IS_ENABLED(CONFIG_NFS_V4_1) + init_waitqueue_head(&clp->cl_lock_waitq); + #endif +-- +2.51.0 + diff --git a/queue-6.12/risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch b/queue-6.12/risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch new file mode 100644 index 0000000000..f9ed734e01 --- /dev/null +++ b/queue-6.12/risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch @@ -0,0 +1,49 @@ +From 79ba9babd139c87e4687a2030b09d15c4edab9fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 16:28:46 +0300 +Subject: RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid + rfence errors + +From: Danil Skrebenkov + +[ Upstream commit ae9e9f3d67dcef7582a4524047b01e33c5185ddb ] + +openSBI v1.7 adds harts checks for ipi operations. Especially it +adds comparison between hmask passed as an argument from linux +and mask of online harts (from openSBI side). If they don't +fit each other the error occurs. + +When cpu is offline, cpu_online_mask is explicitly cleared in +__cpu_disable. However, there is no explicit clearing of +mm_cpumask. mm_cpumask is used for rfence operations that +call openSBI RFENCE extension which uses ipi to remote harts. +If hart is offline there may be error if mask of linux is not +as mask of online harts in openSBI. + +this patch adds explicit clearing of mm_cpumask for offline hart. + +Signed-off-by: Danil Skrebenkov +Reviewed-by: Andrew Jones +Link: https://lore.kernel.org/r/20250919132849.31676-1-danil.skrebenkov@cloudbear.ru +[pjw@kernel.org: rewrote subject line for clarity] +Signed-off-by: Paul Walmsley +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/cpu-hotplug.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/riscv/kernel/cpu-hotplug.c b/arch/riscv/kernel/cpu-hotplug.c +index a1e38ecfc8be2..3f50d3dd76c6f 100644 +--- a/arch/riscv/kernel/cpu-hotplug.c ++++ b/arch/riscv/kernel/cpu-hotplug.c +@@ -54,6 +54,7 @@ void arch_cpuhp_cleanup_dead_cpu(unsigned int cpu) + + pr_notice("CPU%u: off\n", cpu); + ++ clear_tasks_mm_cpumask(cpu); + /* Verify from the firmware if the cpu is really stopped*/ + if (cpu_ops->cpu_is_stopped) + ret = cpu_ops->cpu_is_stopped(cpu); +-- +2.51.0 + diff --git a/queue-6.12/riscv-acpi-avoid-errors-caused-by-probing-dt-devices.patch b/queue-6.12/riscv-acpi-avoid-errors-caused-by-probing-dt-devices.patch new file mode 100644 index 0000000000..84b8071bd7 --- /dev/null +++ b/queue-6.12/riscv-acpi-avoid-errors-caused-by-probing-dt-devices.patch @@ -0,0 +1,48 @@ +From f0fe54457d8ab7515fb79daf3f396174258264f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 19:24:01 +0800 +Subject: riscv: acpi: avoid errors caused by probing DT devices when ACPI is + used + +From: Han Gao + +[ Upstream commit 69a8b62a7aa1e54ff7623064f6507fa29c1d0d4e ] + +Similar to the ARM64 commit 3505f30fb6a9s ("ARM64 / ACPI: If we chose +to boot from acpi then disable FDT"), let's not do DT hardware probing +if ACPI is enabled in early boot. This avoids errors caused by +repeated driver probing. + +Signed-off-by: Han Gao +Link: https://lore.kernel.org/r/20250910112401.552987-1-rabenda.cn@gmail.com +[pjw@kernel.org: cleaned up patch description and subject] +Signed-off-by: Paul Walmsley +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/setup.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c +index 194bda6d74ce7..4c430c9f017d8 100644 +--- a/arch/riscv/kernel/setup.c ++++ b/arch/riscv/kernel/setup.c +@@ -298,11 +298,14 @@ void __init setup_arch(char **cmdline_p) + /* Parse the ACPI tables for possible boot-time configuration */ + acpi_boot_table_init(); + ++ if (acpi_disabled) { + #if IS_ENABLED(CONFIG_BUILTIN_DTB) +- unflatten_and_copy_device_tree(); ++ unflatten_and_copy_device_tree(); + #else +- unflatten_device_tree(); ++ unflatten_device_tree(); + #endif ++ } ++ + misc_mem_init(); + + init_resources(); +-- +2.51.0 + diff --git a/queue-6.12/riscv-build-loader.bin-exclusively-for-canaan-k210.patch b/queue-6.12/riscv-build-loader.bin-exclusively-for-canaan-k210.patch new file mode 100644 index 0000000000..24ea1a4bcb --- /dev/null +++ b/queue-6.12/riscv-build-loader.bin-exclusively-for-canaan-k210.patch @@ -0,0 +1,40 @@ +From d3f83f9c00cde775fa8dc7c153e847bcd557b504 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Oct 2025 17:44:28 +0800 +Subject: riscv: Build loader.bin exclusively for Canaan K210 + +From: Feng Jiang + +[ Upstream commit 3ad1b71fdc5707d14332d9ae710a237de936be9b ] + +According to the explanation in commit ef10bdf9c3e6 ("riscv: +Kconfig.socs: Split ARCH_CANAAN and SOC_CANAAN_K210"), +loader.bin is a special feature of the Canaan K210 and +is not applicable to other SoCs. + +Fixes: e79dfcbfb902 ("riscv: make image compression configurable") +Signed-off-by: Feng Jiang +Reviewed-by: Emil Renner Berthing +Link: https://lore.kernel.org/r/20251029094429.553842-1-jiangfeng@kylinos.cn +Signed-off-by: Paul Walmsley +Signed-off-by: Sasha Levin +--- + arch/riscv/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile +index d469db9f46f42..3df2111673601 100644 +--- a/arch/riscv/Makefile ++++ b/arch/riscv/Makefile +@@ -161,7 +161,7 @@ boot-image-$(CONFIG_KERNEL_LZO) := Image.lzo + boot-image-$(CONFIG_KERNEL_ZSTD) := Image.zst + boot-image-$(CONFIG_KERNEL_XZ) := Image.xz + ifdef CONFIG_RISCV_M_MODE +-boot-image-$(CONFIG_ARCH_CANAAN) := loader.bin ++boot-image-$(CONFIG_SOC_CANAAN_K210) := loader.bin + endif + boot-image-$(CONFIG_EFI_ZBOOT) := vmlinuz.efi + boot-image-$(CONFIG_XIP_KERNEL) := xipImage +-- +2.51.0 + diff --git a/queue-6.12/series b/queue-6.12/series new file mode 100644 index 0000000000..e885a5bf4e --- /dev/null +++ b/queue-6.12/series @@ -0,0 +1,29 @@ +drm-mediatek-add-pm_runtime-support-for-gce-power-co.patch +drm-i915-avoid-lock-inversion-when-pinning-to-ggtt-o.patch +drm-i915-fix-conversion-between-clock-ticks-and-nano.patch +smb-client-fix-refcount-leak-in-smb2_set_path_attr.patch +iommufd-make-vfio_compat-s-unmap-succeed-if-the-rang.patch +drm-amd-fix-suspend-failure-with-secure-display-ta.patch +drm-xe-guc-synchronize-dead-ct-worker-with-unbind.patch +drm-xe-move-declarations-under-conditional-branch.patch +drm-xe-do-clean-shutdown-also-when-using-flr.patch +arm64-kprobes-check-the-return-value-of-set_memory_r.patch +compiler_types-move-unused-static-inline-functions-w.patch +riscv-build-loader.bin-exclusively-for-canaan-k210.patch +risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch +riscv-acpi-avoid-errors-caused-by-probing-dt-devices.patch +drm-amdgpu-remove-two-invalid-bug_on-s.patch +drm-amd-pm-disable-mclk-switching-on-si-at-high-pixe.patch +drm-amdgpu-hide-vram-sysfs-attributes-on-gpus-withou.patch +drm-amdgpu-fix-null-pointer-dereference-in-vram-logi.patch +nfs4-fix-state-renewals-missing-after-boot.patch +nfs4-apply-delay_retrans-to-async-operations.patch +hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch +hid-nintendo-wait-longer-for-initial-probe.patch +nfs-check-if-suid-sgid-was-cleared-after-a-write-as-.patch +hid-quirks-add-always_poll-quirk-for-vrs-r295-steeri.patch +exfat-fix-improper-check-of-dentry.stream.valid_size.patch +smb-server-fix-possible-memory-leak-in-smb2_read.patch +smb-server-fix-possible-refcount-leak-in-smb2_sess_s.patch +hid-logitech-hidpp-add-hidpp_quirk_reset_hi_res_scro.patch +asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch diff --git a/queue-6.12/smb-client-fix-refcount-leak-in-smb2_set_path_attr.patch b/queue-6.12/smb-client-fix-refcount-leak-in-smb2_set_path_attr.patch new file mode 100644 index 0000000000..fafe78ae97 --- /dev/null +++ b/queue-6.12/smb-client-fix-refcount-leak-in-smb2_set_path_attr.patch @@ -0,0 +1,42 @@ +From d9fa0ba392e32fe8bb1c3bcaa8405ec22900139a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Nov 2025 23:13:15 +0800 +Subject: smb: client: fix refcount leak in smb2_set_path_attr + +From: Shuhao Fu + +[ Upstream commit b540de9e3b4fab3b9e10f30714a6f5c1b2a50ec3 ] + +Fix refcount leak in `smb2_set_path_attr` when path conversion fails. + +Function `cifs_get_writable_path` returns `cfile` with its reference +counter `cfile->count` increased on success. Function `smb2_compound_op` +would decrease the reference counter for `cfile`, as stated in its +comment. By calling `smb2_rename_path`, the reference counter of `cfile` +would leak if `cifs_convert_path_to_utf16` fails in `smb2_set_path_attr`. + +Fixes: 8de9e86c67ba ("cifs: create a helper to find a writeable handle by path name") +Acked-by: Henrique Carvalho +Signed-off-by: Shuhao Fu +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2inode.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c +index cb049bc70e0cb..1c65787657ddc 100644 +--- a/fs/smb/client/smb2inode.c ++++ b/fs/smb/client/smb2inode.c +@@ -1132,6 +1132,8 @@ static int smb2_set_path_attr(const unsigned int xid, struct cifs_tcon *tcon, + smb2_to_name = cifs_convert_path_to_utf16(to_name, cifs_sb); + if (smb2_to_name == NULL) { + rc = -ENOMEM; ++ if (cfile) ++ cifsFileInfo_put(cfile); + goto smb2_rename_path; + } + in_iov.iov_base = smb2_to_name; +-- +2.51.0 + diff --git a/queue-6.12/smb-server-fix-possible-memory-leak-in-smb2_read.patch b/queue-6.12/smb-server-fix-possible-memory-leak-in-smb2_read.patch new file mode 100644 index 0000000000..cd48063293 --- /dev/null +++ b/queue-6.12/smb-server-fix-possible-memory-leak-in-smb2_read.patch @@ -0,0 +1,37 @@ +From 3d3bc013f29796ed6a795b982b98b9086c29eae3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Oct 2025 00:47:59 +0800 +Subject: smb/server: fix possible memory leak in smb2_read() + +From: ZhangGuoDong + +[ Upstream commit 6fced056d2cc8d01b326e6fcfabaacb9850b71a4 ] + +Memory leak occurs when ksmbd_vfs_read() fails. +Fix this by adding the missing kvfree(). + +Co-developed-by: ChenXiaoSong +Signed-off-by: ChenXiaoSong +Signed-off-by: ZhangGuoDong +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/smb2pdu.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c +index 796235cb95677..67021dc6dfd81 100644 +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -6782,6 +6782,7 @@ int smb2_read(struct ksmbd_work *work) + + nbytes = ksmbd_vfs_read(work, fp, length, &offset, aux_payload_buf); + if (nbytes < 0) { ++ kvfree(aux_payload_buf); + err = nbytes; + goto out; + } +-- +2.51.0 + diff --git a/queue-6.12/smb-server-fix-possible-refcount-leak-in-smb2_sess_s.patch b/queue-6.12/smb-server-fix-possible-refcount-leak-in-smb2_sess_s.patch new file mode 100644 index 0000000000..0deffe79ea --- /dev/null +++ b/queue-6.12/smb-server-fix-possible-refcount-leak-in-smb2_sess_s.patch @@ -0,0 +1,37 @@ +From de0ef483f71cdfadfa39c44bf59899e68ad2dc3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Oct 2025 00:51:36 +0800 +Subject: smb/server: fix possible refcount leak in smb2_sess_setup() + +From: ZhangGuoDong + +[ Upstream commit 379510a815cb2e64eb0a379cb62295d6ade65df0 ] + +Reference count of ksmbd_session will leak when session need reconnect. +Fix this by adding the missing ksmbd_user_session_put(). + +Co-developed-by: ChenXiaoSong +Signed-off-by: ChenXiaoSong +Signed-off-by: ZhangGuoDong +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/smb2pdu.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c +index 67021dc6dfd81..cd42d25812661 100644 +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -1798,6 +1798,7 @@ int smb2_sess_setup(struct ksmbd_work *work) + + if (ksmbd_conn_need_reconnect(conn)) { + rc = -EFAULT; ++ ksmbd_user_session_put(sess); + sess = NULL; + goto out_err; + } +-- +2.51.0 + diff --git a/queue-6.17/alsa-hda-realtek-fix-mute-led-for-hp-omen-17-cb0xxx.patch b/queue-6.17/alsa-hda-realtek-fix-mute-led-for-hp-omen-17-cb0xxx.patch new file mode 100644 index 0000000000..0df864b292 --- /dev/null +++ b/queue-6.17/alsa-hda-realtek-fix-mute-led-for-hp-omen-17-cb0xxx.patch @@ -0,0 +1,35 @@ +From 36a55cb93caf49deac03243fd33ce172741b02f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Oct 2025 15:42:06 -0300 +Subject: ALSA: hda/realtek: Fix mute led for HP Omen 17-cb0xxx + +From: Dawn Gardner + +[ Upstream commit 2a786348004b34c5f61235d51c40c1c718b1f8f9 ] + +This laptop uses the ALC285 codec, fixed by enabling +the ALC285_FIXUP_HP_MUTE_LED quirk + +Signed-off-by: Dawn Gardner +Link: https://patch.msgid.link/20251016184218.31508-3-dawn.auroali@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/codecs/realtek/alc269.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c +index 28297e936a96f..19604352317dd 100644 +--- a/sound/hda/codecs/realtek/alc269.c ++++ b/sound/hda/codecs/realtek/alc269.c +@@ -6399,6 +6399,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x854a, "HP EliteBook 830 G6", ALC285_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x85c6, "HP Pavilion x360 Convertible 14-dy1xxx", ALC295_FIXUP_HP_MUTE_LED_COEFBIT11), + SND_PCI_QUIRK(0x103c, 0x85de, "HP Envy x360 13-ar0xxx", ALC285_FIXUP_HP_ENVY_X360), ++ SND_PCI_QUIRK(0x103c, 0x8603, "HP Omen 17-cb0xxx", ALC285_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x860c, "HP ZBook 17 G6", ALC285_FIXUP_HP_GPIO_AMP_INIT), + SND_PCI_QUIRK(0x103c, 0x860f, "HP ZBook 15 G6", ALC285_FIXUP_HP_GPIO_AMP_INIT), + SND_PCI_QUIRK(0x103c, 0x861f, "HP Elite Dragonfly G1", ALC285_FIXUP_HP_GPIO_AMP_INIT), +-- +2.51.0 + diff --git a/queue-6.17/arm64-kprobes-check-the-return-value-of-set_memory_r.patch b/queue-6.17/arm64-kprobes-check-the-return-value-of-set_memory_r.patch new file mode 100644 index 0000000000..c3c6e46891 --- /dev/null +++ b/queue-6.17/arm64-kprobes-check-the-return-value-of-set_memory_r.patch @@ -0,0 +1,44 @@ +From 2014fc1517775d6f10ecbb61d99d3d72b0e4fc1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Nov 2025 13:49:47 -0800 +Subject: arm64: kprobes: check the return value of set_memory_rox() + +From: Yang Shi + +[ Upstream commit 0ec364c0c95fc85bcbc88f1a9a06ebe83c88e18c ] + +Since commit a166563e7ec3 ("arm64: mm: support large block mapping when +rodata=full"), __change_memory_common has more chance to fail due to +memory allocation failure when splitting page table. So check the return +value of set_memory_rox(), then bail out if it fails otherwise we may have +RW memory mapping for kprobes insn page. + +Fixes: 195a1b7d8388 ("arm64: kprobes: call set_memory_rox() for kprobe page") +Reviewed-by: Ryan Roberts +Reviewed-by: Dev Jain +Signed-off-by: Yang Shi +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/probes/kprobes.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c +index 8ab6104a4883d..43a0361a8bf04 100644 +--- a/arch/arm64/kernel/probes/kprobes.c ++++ b/arch/arm64/kernel/probes/kprobes.c +@@ -49,7 +49,10 @@ void *alloc_insn_page(void) + addr = execmem_alloc(EXECMEM_KPROBES, PAGE_SIZE); + if (!addr) + return NULL; +- set_memory_rox((unsigned long)addr, 1); ++ if (set_memory_rox((unsigned long)addr, 1)) { ++ execmem_free(addr); ++ return NULL; ++ } + return addr; + } + +-- +2.51.0 + diff --git a/queue-6.17/asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch b/queue-6.17/asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch new file mode 100644 index 0000000000..e7cafb6a85 --- /dev/null +++ b/queue-6.17/asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch @@ -0,0 +1,43 @@ +From e51d024dc7f7146409ac73989bcf240218c4c932 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Oct 2025 15:42:15 +0200 +Subject: ASoC: max98090/91: fixed max98091 ALSA widget powering up/down + +From: Sharique Mohammad + +[ Upstream commit 7a37291ed40a33a5f6c3d370fdde5ee0d8f7d0e4 ] + +The widgets DMIC3_ENA and DMIC4_ENA must be defined in the DAPM +suppy widget, just like DMICL_ENA and DMICR_ENA. Whenever they +are turned on or off, the required startup or shutdown sequences +must be taken care by the max98090_shdn_event. + +Signed-off-by: Sharique Mohammad +Link: https://patch.msgid.link/20251015134215.750001-1-sharq0406@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/max98090.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c +index 22177c1ce1602..cb1508fc99f89 100644 +--- a/sound/soc/codecs/max98090.c ++++ b/sound/soc/codecs/max98090.c +@@ -1234,9 +1234,11 @@ static const struct snd_soc_dapm_widget max98091_dapm_widgets[] = { + SND_SOC_DAPM_INPUT("DMIC4"), + + SND_SOC_DAPM_SUPPLY("DMIC3_ENA", M98090_REG_DIGITAL_MIC_ENABLE, +- M98090_DIGMIC3_SHIFT, 0, NULL, 0), ++ M98090_DIGMIC3_SHIFT, 0, max98090_shdn_event, ++ SND_SOC_DAPM_POST_PMU), + SND_SOC_DAPM_SUPPLY("DMIC4_ENA", M98090_REG_DIGITAL_MIC_ENABLE, +- M98090_DIGMIC4_SHIFT, 0, NULL, 0), ++ M98090_DIGMIC4_SHIFT, 0, max98090_shdn_event, ++ SND_SOC_DAPM_POST_PMU), + }; + + static const struct snd_soc_dapm_route max98090_dapm_routes[] = { +-- +2.51.0 + diff --git a/queue-6.17/asoc-nau8821-avoid-unnecessary-blocking-in-irq-handl.patch b/queue-6.17/asoc-nau8821-avoid-unnecessary-blocking-in-irq-handl.patch new file mode 100644 index 0000000000..ac58c7ce98 --- /dev/null +++ b/queue-6.17/asoc-nau8821-avoid-unnecessary-blocking-in-irq-handl.patch @@ -0,0 +1,120 @@ +From e4eea84421cbaa8904bfa898bca8760e42592066 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 21:03:27 +0300 +Subject: ASoC: nau8821: Avoid unnecessary blocking in IRQ handler + +From: Cristian Ciocaltea + +[ Upstream commit ee70bacef1c6050e4836409927294d744dbcfa72 ] + +The interrupt handler offloads the microphone detection logic to +nau8821_jdet_work(), which implies a sleep operation. However, before +being able to process any subsequent hotplug event, the interrupt +handler needs to wait for any prior scheduled work to complete. + +Move the sleep out of jdet_work by converting it to a delayed work. +This eliminates the undesired blocking in the interrupt handler when +attempting to cancel a recently scheduled work item and should help +reducing transient input reports that might confuse user-space. + +Signed-off-by: Cristian Ciocaltea +Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-5-f7b0e2543f09@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8821.c | 22 ++++++++++++---------- + sound/soc/codecs/nau8821.h | 2 +- + 2 files changed, 13 insertions(+), 11 deletions(-) + +diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c +index a8ff2ce70be9a..4fa9a785513e5 100644 +--- a/sound/soc/codecs/nau8821.c ++++ b/sound/soc/codecs/nau8821.c +@@ -1104,16 +1104,12 @@ static void nau8821_eject_jack(struct nau8821 *nau8821) + static void nau8821_jdet_work(struct work_struct *work) + { + struct nau8821 *nau8821 = +- container_of(work, struct nau8821, jdet_work); ++ container_of(work, struct nau8821, jdet_work.work); + struct snd_soc_dapm_context *dapm = nau8821->dapm; + struct snd_soc_component *component = snd_soc_dapm_to_component(dapm); + struct regmap *regmap = nau8821->regmap; + int jack_status_reg, mic_detected, event = 0, event_mask = 0; + +- snd_soc_component_force_enable_pin(component, "MICBIAS"); +- snd_soc_dapm_sync(dapm); +- msleep(20); +- + regmap_read(regmap, NAU8821_R58_I2C_DEVICE_ID, &jack_status_reg); + mic_detected = !(jack_status_reg & NAU8821_KEYDET); + if (mic_detected) { +@@ -1146,6 +1142,7 @@ static void nau8821_jdet_work(struct work_struct *work) + snd_soc_component_disable_pin(component, "MICBIAS"); + snd_soc_dapm_sync(dapm); + } ++ + event_mask |= SND_JACK_HEADSET; + snd_soc_jack_report(nau8821->jack, event, event_mask); + } +@@ -1194,6 +1191,7 @@ static irqreturn_t nau8821_interrupt(int irq, void *data) + { + struct nau8821 *nau8821 = (struct nau8821 *)data; + struct regmap *regmap = nau8821->regmap; ++ struct snd_soc_component *component; + int active_irq, event = 0, event_mask = 0; + + if (regmap_read(regmap, NAU8821_R10_IRQ_STATUS, &active_irq)) { +@@ -1205,7 +1203,7 @@ static irqreturn_t nau8821_interrupt(int irq, void *data) + + if ((active_irq & NAU8821_JACK_EJECT_IRQ_MASK) == + NAU8821_JACK_EJECT_DETECTED) { +- cancel_work_sync(&nau8821->jdet_work); ++ cancel_delayed_work_sync(&nau8821->jdet_work); + regmap_update_bits(regmap, NAU8821_R71_ANALOG_ADC_1, + NAU8821_MICDET_MASK, NAU8821_MICDET_DIS); + nau8821_eject_jack(nau8821); +@@ -1219,12 +1217,15 @@ static irqreturn_t nau8821_interrupt(int irq, void *data) + nau8821_irq_status_clear(regmap, NAU8821_KEY_RELEASE_IRQ); + } else if ((active_irq & NAU8821_JACK_INSERT_IRQ_MASK) == + NAU8821_JACK_INSERT_DETECTED) { +- cancel_work_sync(&nau8821->jdet_work); ++ cancel_delayed_work_sync(&nau8821->jdet_work); + regmap_update_bits(regmap, NAU8821_R71_ANALOG_ADC_1, + NAU8821_MICDET_MASK, NAU8821_MICDET_EN); + if (nau8821_is_jack_inserted(regmap)) { +- /* detect microphone and jack type */ +- schedule_work(&nau8821->jdet_work); ++ /* Detect microphone and jack type */ ++ component = snd_soc_dapm_to_component(nau8821->dapm); ++ snd_soc_component_force_enable_pin(component, "MICBIAS"); ++ snd_soc_dapm_sync(nau8821->dapm); ++ schedule_delayed_work(&nau8821->jdet_work, msecs_to_jiffies(20)); + /* Turn off insertion interruption at manual mode */ + nau8821_setup_inserted_irq(nau8821); + } else { +@@ -1661,7 +1662,8 @@ int nau8821_enable_jack_detect(struct snd_soc_component *component, + + nau8821->jack = jack; + /* Initiate jack detection work queue */ +- INIT_WORK(&nau8821->jdet_work, nau8821_jdet_work); ++ INIT_DELAYED_WORK(&nau8821->jdet_work, nau8821_jdet_work); ++ + ret = devm_request_threaded_irq(nau8821->dev, nau8821->irq, NULL, + nau8821_interrupt, IRQF_TRIGGER_LOW | IRQF_ONESHOT, + "nau8821", nau8821); +diff --git a/sound/soc/codecs/nau8821.h b/sound/soc/codecs/nau8821.h +index f0935ffafcbec..88602923780d8 100644 +--- a/sound/soc/codecs/nau8821.h ++++ b/sound/soc/codecs/nau8821.h +@@ -561,7 +561,7 @@ struct nau8821 { + struct regmap *regmap; + struct snd_soc_dapm_context *dapm; + struct snd_soc_jack *jack; +- struct work_struct jdet_work; ++ struct delayed_work jdet_work; + int irq; + int clk_id; + int micbias_voltage; +-- +2.51.0 + diff --git a/queue-6.17/compiler_types-move-unused-static-inline-functions-w.patch b/queue-6.17/compiler_types-move-unused-static-inline-functions-w.patch new file mode 100644 index 0000000000..cd369860d8 --- /dev/null +++ b/queue-6.17/compiler_types-move-unused-static-inline-functions-w.patch @@ -0,0 +1,57 @@ +From e2532b4cd925a4ac04b7a94d34b6d7b1fd85d202 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Nov 2025 11:50:00 +0100 +Subject: compiler_types: Move unused static inline functions warning to W=2 + +From: Peter Zijlstra + +[ Upstream commit 9818af18db4bfefd320d0fef41390a616365e6f7 ] + +Per Nathan, clang catches unused "static inline" functions in C files +since commit 6863f5643dd7 ("kbuild: allow Clang to find unused static +inline functions for W=1 build"). + +Linus said: + +> So I entirely ignore W=1 issues, because I think so many of the extra +> warnings are bogus. +> +> But if this one in particular is causing more problems than most - +> some teams do seem to use W=1 as part of their test builds - it's fine +> to send me a patch that just moves bad warnings to W=2. +> +> And if anybody uses W=2 for their test builds, that's THEIR problem.. + +Here is the change to bump the warning from W=1 to W=2. + +Fixes: 6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build") +Signed-off-by: Peter Zijlstra +Signed-off-by: Andy Shevchenko +Link: https://patch.msgid.link/20251106105000.2103276-1-andriy.shevchenko@linux.intel.com +[nathan: Adjust comment as well] +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + include/linux/compiler_types.h | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h +index 16755431fc11e..e768d2c693662 100644 +--- a/include/linux/compiler_types.h ++++ b/include/linux/compiler_types.h +@@ -250,10 +250,9 @@ struct ftrace_likely_data { + /* + * GCC does not warn about unused static inline functions for -Wunused-function. + * Suppress the warning in clang as well by using __maybe_unused, but enable it +- * for W=1 build. This will allow clang to find unused functions. Remove the +- * __inline_maybe_unused entirely after fixing most of -Wunused-function warnings. ++ * for W=2 build. This will allow clang to find unused functions. + */ +-#ifdef KBUILD_EXTRA_WARN1 ++#ifdef KBUILD_EXTRA_WARN2 + #define __inline_maybe_unused + #else + #define __inline_maybe_unused __maybe_unused +-- +2.51.0 + diff --git a/queue-6.17/drm-amd-disable-aspm-on-si.patch b/queue-6.17/drm-amd-disable-aspm-on-si.patch new file mode 100644 index 0000000000..22877dc0a9 --- /dev/null +++ b/queue-6.17/drm-amd-disable-aspm-on-si.patch @@ -0,0 +1,45 @@ +From 7460c79d3803d04832080f4a9adfacf3b33c5d22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 20:26:13 +0200 +Subject: drm/amd: Disable ASPM on SI +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 7bdd91abf0cb3ea78160e2e78fb58b12f6a38d55 ] + +Enabling ASPM causes randoms hangs on Tahiti and Oland on Zen4. +It's unclear if this is a platform-specific or GPU-specific issue. +Disable ASPM on SI for the time being. + +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index ddd0e7ab82be7..fdaf482c0c8a7 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -1880,6 +1880,13 @@ static bool amdgpu_device_pcie_dynamic_switching_supported(struct amdgpu_device + + static bool amdgpu_device_aspm_support_quirk(struct amdgpu_device *adev) + { ++ /* Enabling ASPM causes randoms hangs on Tahiti and Oland on Zen4. ++ * It's unclear if this is a platform-specific or GPU-specific issue. ++ * Disable ASPM on SI for the time being. ++ */ ++ if (adev->family == AMDGPU_FAMILY_SI) ++ return true; ++ + #if IS_ENABLED(CONFIG_X86) + struct cpuinfo_x86 *c = &cpu_data(0); + +-- +2.51.0 + diff --git a/queue-6.17/drm-amd-display-add-pixel_clock-to-amd_pp_display_co.patch b/queue-6.17/drm-amd-display-add-pixel_clock-to-amd_pp_display_co.patch new file mode 100644 index 0000000000..1290b82127 --- /dev/null +++ b/queue-6.17/drm-amd-display-add-pixel_clock-to-amd_pp_display_co.patch @@ -0,0 +1,87 @@ +From 3e27f8dffdeff138626c7700a70f7827b02b1d10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 16:17:50 +0200 +Subject: drm/amd/display: Add pixel_clock to amd_pp_display_configuration +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit b515dcb0dc4e85d8254f5459cfb32fce88dacbfb ] + +This commit adds the pixel_clock field to the display config +struct so that power management (DPM) can use it. + +We currently don't have a proper bandwidth calculation on old +GPUs with DCE 6-10 because dce_calcs only supports DCE 11+. +So the power management (DPM) on these GPUs may need to make +ad-hoc decisions for display based on the pixel clock. + +Also rename sym_clock to pixel_clock in dm_pp_single_disp_config +to avoid confusion with other code where the sym_clock refers to +the DisplayPort symbol clock. + +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c | 1 + + drivers/gpu/drm/amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c | 2 +- + drivers/gpu/drm/amd/display/dc/dm_services_types.h | 2 +- + drivers/gpu/drm/amd/include/dm_pp_interface.h | 1 + + 4 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c +index 848c5b4bb301a..016230896d0e1 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c +@@ -97,6 +97,7 @@ bool dm_pp_apply_display_requirements( + const struct dm_pp_single_disp_config *dc_cfg = + &pp_display_cfg->disp_configs[i]; + adev->pm.pm_display_cfg.displays[i].controller_id = dc_cfg->pipe_idx + 1; ++ adev->pm.pm_display_cfg.displays[i].pixel_clock = dc_cfg->pixel_clock; + } + + amdgpu_dpm_display_configuration_change(adev, &adev->pm.pm_display_cfg); +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c +index 13cf415e38e50..d50b9440210e4 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c +@@ -164,7 +164,7 @@ void dce110_fill_display_configs( + stream->link->cur_link_settings.link_rate; + cfg->link_settings.link_spread = + stream->link->cur_link_settings.link_spread; +- cfg->sym_clock = stream->phy_pix_clk; ++ cfg->pixel_clock = stream->phy_pix_clk; + /* Round v_refresh*/ + cfg->v_refresh = stream->timing.pix_clk_100hz * 100; + cfg->v_refresh /= stream->timing.h_total; +diff --git a/drivers/gpu/drm/amd/display/dc/dm_services_types.h b/drivers/gpu/drm/amd/display/dc/dm_services_types.h +index bf63da266a18c..3b093b8699abd 100644 +--- a/drivers/gpu/drm/amd/display/dc/dm_services_types.h ++++ b/drivers/gpu/drm/amd/display/dc/dm_services_types.h +@@ -127,7 +127,7 @@ struct dm_pp_single_disp_config { + uint32_t src_height; + uint32_t src_width; + uint32_t v_refresh; +- uint32_t sym_clock; /* HDMI only */ ++ uint32_t pixel_clock; /* Pixel clock in KHz (for HDMI only: normalized) */ + struct dc_link_settings link_settings; /* DP only */ + }; + +diff --git a/drivers/gpu/drm/amd/include/dm_pp_interface.h b/drivers/gpu/drm/amd/include/dm_pp_interface.h +index acd1cef61b7c5..349544504c93c 100644 +--- a/drivers/gpu/drm/amd/include/dm_pp_interface.h ++++ b/drivers/gpu/drm/amd/include/dm_pp_interface.h +@@ -65,6 +65,7 @@ struct single_display_configuration { + uint32_t view_resolution_cy; + enum amd_pp_display_config_type displayconfigtype; + uint32_t vertical_refresh; /* for active display */ ++ uint32_t pixel_clock; /* Pixel clock in KHz (for HDMI only: normalized) */ + }; + + #define MAX_NUM_DISPLAY 32 +-- +2.51.0 + diff --git a/queue-6.17/drm-amd-display-disable-fastboot-on-dce-6-too.patch b/queue-6.17/drm-amd-display-disable-fastboot-on-dce-6-too.patch new file mode 100644 index 0000000000..8bf7524235 --- /dev/null +++ b/queue-6.17/drm-amd-display-disable-fastboot-on-dce-6-too.patch @@ -0,0 +1,45 @@ +From cd8c65e09c93224b64e563fcdab4075ca08d4152 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 23:56:29 +0200 +Subject: drm/amd/display: Disable fastboot on DCE 6 too +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 7495962cbceb967e095233a5673ea71f3bcdee7e ] + +It already didn't work on DCE 8, +so there is no reason to assume it would on DCE 6. + +Signed-off-by: Timur Kristóf +Reviewed-by: Rodrigo Siqueira +Reviewed-by: Alex Deucher +Reviewed-by: Alex Hung +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +index 32fd6bdc18d73..537f538114607 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +@@ -1923,10 +1923,8 @@ void dce110_enable_accelerated_mode(struct dc *dc, struct dc_state *context) + + get_edp_streams(context, edp_streams, &edp_stream_num); + +- // Check fastboot support, disable on DCE8 because of blank screens +- if (edp_num && edp_stream_num && dc->ctx->dce_version != DCE_VERSION_8_0 && +- dc->ctx->dce_version != DCE_VERSION_8_1 && +- dc->ctx->dce_version != DCE_VERSION_8_3) { ++ /* Check fastboot support, disable on DCE 6-8 because of blank screens */ ++ if (edp_num && edp_stream_num && dc->ctx->dce_version < DCE_VERSION_10_0) { + for (i = 0; i < edp_num; i++) { + edp_link = edp_links[i]; + if (edp_link != edp_streams[0]->link) +-- +2.51.0 + diff --git a/queue-6.17/drm-amd-display-don-t-stretch-non-native-images-by-d.patch b/queue-6.17/drm-amd-display-don-t-stretch-non-native-images-by-d.patch new file mode 100644 index 0000000000..5e563800c1 --- /dev/null +++ b/queue-6.17/drm-amd-display-don-t-stretch-non-native-images-by-d.patch @@ -0,0 +1,49 @@ +From 1ea579120f1b79398f7077b775ece4f7d094d012 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Oct 2025 14:39:43 -0500 +Subject: drm/amd/display: Don't stretch non-native images by default in eDP + +From: Mario Limonciello (AMD) + +[ Upstream commit 3362692fea915ce56345366364a501c629c9ff17 ] + +commit 978fa2f6d0b12 ("drm/amd/display: Use scaling for non-native +resolutions on eDP") started using the GPU scaler hardware to scale +when a non-native resolution was picked on eDP. This scaling was done +to fill the screen instead of maintain aspect ratio. + +The idea was supposed to be that if a different scaling behavior is +preferred then the compositor would request it. The not following +aspect ratio behavior however isn't desirable, so adjust it to follow +aspect ratio and still try to fill screen. + +Note: This will lead to black bars in some cases for non-native +resolutions. Compositors can request the previous behavior if desired. + +Fixes: 978fa2f6d0b1 ("drm/amd/display: Use scaling for non-native resolutions on eDP") +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4538 +Signed-off-by: Mario Limonciello (AMD) +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +(cherry picked from commit 825df7ff4bb1a383ad4827545e09aec60d230770) +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index b997718f624f8..f06c918f5a33a 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -8003,7 +8003,7 @@ static int dm_encoder_helper_atomic_check(struct drm_encoder *encoder, + "mode %dx%d@%dHz is not native, enabling scaling\n", + adjusted_mode->hdisplay, adjusted_mode->vdisplay, + drm_mode_vrefresh(adjusted_mode)); +- dm_new_connector_state->scaling = RMX_FULL; ++ dm_new_connector_state->scaling = RMX_ASPECT; + } + return 0; + } +-- +2.51.0 + diff --git a/queue-6.17/drm-amd-fix-suspend-failure-with-secure-display-ta.patch b/queue-6.17/drm-amd-fix-suspend-failure-with-secure-display-ta.patch new file mode 100644 index 0000000000..50467fa0da --- /dev/null +++ b/queue-6.17/drm-amd-fix-suspend-failure-with-secure-display-ta.patch @@ -0,0 +1,47 @@ +From 27a8d6ba0379b5c6f558f801061a80cad5d9cdc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Nov 2025 13:38:02 -0600 +Subject: drm/amd: Fix suspend failure with secure display TA + +From: Mario Limonciello + +[ Upstream commit b09cb2996cdf50cd1ab4020e002c95d742c81313 ] + +commit c760bcda83571 ("drm/amd: Check whether secure display TA loaded +successfully") attempted to fix extra messages, but failed to port the +cleanup that was in commit 5c6d52ff4b61e ("drm/amd: Don't try to enable +secure display TA multiple times") to prevent multiple tries. + +Add that to the failure handling path even on a quick failure. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4679 +Fixes: c760bcda8357 ("drm/amd: Check whether secure display TA loaded successfully") +Signed-off-by: Mario Limonciello +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +(cherry picked from commit 4104c0a454f6a4d1e0d14895d03c0e7bdd0c8240) +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index d9d7fc4c33cba..2c2d264cf8f68 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -2353,8 +2353,11 @@ static int psp_securedisplay_initialize(struct psp_context *psp) + if (!ret && !psp->securedisplay_context.context.resp_status) { + psp->securedisplay_context.context.initialized = true; + mutex_init(&psp->securedisplay_context.mutex); +- } else ++ } else { ++ /* don't try again */ ++ psp->securedisplay_context.context.bin_desc.size_bytes = 0; + return ret; ++ } + + mutex_lock(&psp->securedisplay_context.mutex); + +-- +2.51.0 + diff --git a/queue-6.17/drm-amd-pm-disable-mclk-switching-on-si-at-high-pixe.patch b/queue-6.17/drm-amd-pm-disable-mclk-switching-on-si-at-high-pixe.patch new file mode 100644 index 0000000000..11a79d19f1 --- /dev/null +++ b/queue-6.17/drm-amd-pm-disable-mclk-switching-on-si-at-high-pixe.patch @@ -0,0 +1,43 @@ +From ea4d6df18f4ad37810e3555eb765ac73a84787de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 20:26:12 +0200 +Subject: drm/amd/pm: Disable MCLK switching on SI at high pixel clocks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 5c05bcf6ae7732da1bd4dc1958d527b5f07f216a ] + +On various SI GPUs, a flickering can be observed near the bottom +edge of the screen when using a single 4K 60Hz monitor over DP. +Disabling MCLK switching works around this problem. + +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index 70efa4dce3848..a2b411a93b0fe 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -3500,6 +3500,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + * for these GPUs to calculate bandwidth requirements. + */ + if (high_pixelclock_count) { ++ /* Work around flickering lines at the bottom edge ++ * of the screen when using a single 4K 60Hz monitor. ++ */ ++ disable_mclk_switching = true; ++ + /* On Oland, we observe some flickering when two 4K 60Hz + * displays are connected, possibly because voltage is too low. + * Raise the voltage by requiring a higher SCLK. +-- +2.51.0 + diff --git a/queue-6.17/drm-amd-pm-use-pm_display_cfg-in-legacy-dpm-v2.patch b/queue-6.17/drm-amd-pm-use-pm_display_cfg-in-legacy-dpm-v2.patch new file mode 100644 index 0000000000..541da721b0 --- /dev/null +++ b/queue-6.17/drm-amd-pm-use-pm_display_cfg-in-legacy-dpm-v2.patch @@ -0,0 +1,365 @@ +From 95c162d5365e678b91577afe811f848a8baabb07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 16:17:51 +0200 +Subject: drm/amd/pm: Use pm_display_cfg in legacy DPM (v2) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 9d73b107a61b73e7101d4b728ddac3d2c77db111 ] + +This commit is necessary for DC to function well with chips +that use the legacy power management code, ie. SI and KV. +Communicate display information from DC to the legacy PM code. + +Currently DC uses pm_display_cfg to communicate power management +requirements from the display code to the DPM code. +However, the legacy (non-DC) code path used different fields +and therefore could not take into account anything from DC. + +Change the legacy display code to fill the same pm_display_cfg +struct as DC and use the same in the legacy DPM code. + +To ease review and reduce churn, this commit does not yet +delete the now unneeded code, that is done in the next commit. + +v2: +Rebase. +Fix single_display in amdgpu_dpm_pick_power_state. + +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c | 67 +++++++++++++++++++ + .../gpu/drm/amd/pm/inc/amdgpu_dpm_internal.h | 2 + + drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | 4 +- + .../gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | 6 +- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 65 ++++++------------ + .../gpu/drm/amd/pm/powerplay/amd_powerplay.c | 11 +-- + 6 files changed, 97 insertions(+), 58 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c +index 2d2d2d5e67634..9ef965e4a92ed 100644 +--- a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c ++++ b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c +@@ -100,3 +100,70 @@ u32 amdgpu_dpm_get_vrefresh(struct amdgpu_device *adev) + + return vrefresh; + } ++ ++void amdgpu_dpm_get_display_cfg(struct amdgpu_device *adev) ++{ ++ struct drm_device *ddev = adev_to_drm(adev); ++ struct amd_pp_display_configuration *cfg = &adev->pm.pm_display_cfg; ++ struct single_display_configuration *display_cfg; ++ struct drm_crtc *crtc; ++ struct amdgpu_crtc *amdgpu_crtc; ++ struct amdgpu_connector *conn; ++ int num_crtcs = 0; ++ int vrefresh; ++ u32 vblank_in_pixels, vblank_time_us; ++ ++ cfg->min_vblank_time = 0xffffffff; /* if the displays are off, vblank time is max */ ++ ++ if (adev->mode_info.num_crtc && adev->mode_info.mode_config_initialized) { ++ list_for_each_entry(crtc, &ddev->mode_config.crtc_list, head) { ++ amdgpu_crtc = to_amdgpu_crtc(crtc); ++ ++ /* The array should only contain active displays. */ ++ if (!amdgpu_crtc->enabled) ++ continue; ++ ++ conn = to_amdgpu_connector(amdgpu_crtc->connector); ++ display_cfg = &adev->pm.pm_display_cfg.displays[num_crtcs++]; ++ ++ if (amdgpu_crtc->hw_mode.clock) { ++ vrefresh = drm_mode_vrefresh(&amdgpu_crtc->hw_mode); ++ ++ vblank_in_pixels = ++ amdgpu_crtc->hw_mode.crtc_htotal * ++ (amdgpu_crtc->hw_mode.crtc_vblank_end - ++ amdgpu_crtc->hw_mode.crtc_vdisplay + ++ (amdgpu_crtc->v_border * 2)); ++ ++ vblank_time_us = ++ vblank_in_pixels * 1000 / amdgpu_crtc->hw_mode.clock; ++ ++ /* The legacy (non-DC) code has issues with mclk switching ++ * with refresh rates over 120 Hz. Disable mclk switching. ++ */ ++ if (vrefresh > 120) ++ vblank_time_us = 0; ++ ++ /* Find minimum vblank time. */ ++ if (vblank_time_us < cfg->min_vblank_time) ++ cfg->min_vblank_time = vblank_time_us; ++ ++ /* Find vertical refresh rate of first active display. */ ++ if (!cfg->vrefresh) ++ cfg->vrefresh = vrefresh; ++ } ++ ++ if (amdgpu_crtc->crtc_id < cfg->crtc_index) { ++ /* Find first active CRTC and its line time. */ ++ cfg->crtc_index = amdgpu_crtc->crtc_id; ++ cfg->line_time_in_us = amdgpu_crtc->line_time; ++ } ++ ++ display_cfg->controller_id = amdgpu_crtc->crtc_id; ++ display_cfg->pixel_clock = conn->pixelclock_for_modeset; ++ } ++ } ++ ++ cfg->display_clk = adev->clock.default_dispclk; ++ cfg->num_display = num_crtcs; ++} +diff --git a/drivers/gpu/drm/amd/pm/inc/amdgpu_dpm_internal.h b/drivers/gpu/drm/amd/pm/inc/amdgpu_dpm_internal.h +index 5c2a89f0d5d5d..8be11510cd923 100644 +--- a/drivers/gpu/drm/amd/pm/inc/amdgpu_dpm_internal.h ++++ b/drivers/gpu/drm/amd/pm/inc/amdgpu_dpm_internal.h +@@ -29,4 +29,6 @@ u32 amdgpu_dpm_get_vblank_time(struct amdgpu_device *adev); + + u32 amdgpu_dpm_get_vrefresh(struct amdgpu_device *adev); + ++void amdgpu_dpm_get_display_cfg(struct amdgpu_device *adev); ++ + #endif +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c +index 307ebf7e32267..33eb85dd68e9c 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c +@@ -2299,7 +2299,7 @@ static void kv_apply_state_adjust_rules(struct amdgpu_device *adev, + + if (pi->sys_info.nb_dpm_enable) { + force_high = (mclk >= pi->sys_info.nbp_memory_clock[3]) || +- pi->video_start || (adev->pm.dpm.new_active_crtc_count >= 3) || ++ pi->video_start || (adev->pm.pm_display_cfg.num_display >= 3) || + pi->disable_nb_ps3_in_battery; + ps->dpm0_pg_nb_ps_lo = force_high ? 0x2 : 0x3; + ps->dpm0_pg_nb_ps_hi = 0x2; +@@ -2358,7 +2358,7 @@ static int kv_calculate_nbps_level_settings(struct amdgpu_device *adev) + return 0; + + force_high = ((mclk >= pi->sys_info.nbp_memory_clock[3]) || +- (adev->pm.dpm.new_active_crtc_count >= 3) || pi->video_start); ++ (adev->pm.pm_display_cfg.num_display >= 3) || pi->video_start); + + if (force_high) { + for (i = pi->lowest_valid; i <= pi->highest_valid; i++) +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c +index ea3ace882a10a..6ebe3d0f5b877 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c +@@ -771,8 +771,7 @@ static struct amdgpu_ps *amdgpu_dpm_pick_power_state(struct amdgpu_device *adev, + int i; + struct amdgpu_ps *ps; + u32 ui_class; +- bool single_display = (adev->pm.dpm.new_active_crtc_count < 2) ? +- true : false; ++ bool single_display = adev->pm.pm_display_cfg.num_display < 2; + + /* check if the vblank period is too short to adjust the mclk */ + if (single_display && adev->powerplay.pp_funcs->vblank_too_short) { +@@ -968,7 +967,8 @@ void amdgpu_legacy_dpm_compute_clocks(void *handle) + { + struct amdgpu_device *adev = (struct amdgpu_device *)handle; + +- amdgpu_dpm_get_active_displays(adev); ++ if (!adev->dc_enabled) ++ amdgpu_dpm_get_display_cfg(adev); + + amdgpu_dpm_change_power_state_locked(adev); + } +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index 4236700fc1ad1..70efa4dce3848 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -3081,7 +3081,7 @@ static int si_get_vce_clock_voltage(struct amdgpu_device *adev, + static bool si_dpm_vblank_too_short(void *handle) + { + struct amdgpu_device *adev = (struct amdgpu_device *)handle; +- u32 vblank_time = amdgpu_dpm_get_vblank_time(adev); ++ u32 vblank_time = adev->pm.pm_display_cfg.min_vblank_time; + /* we never hit the non-gddr5 limit so disable it */ + u32 switch_limit = adev->gmc.vram_type == AMDGPU_VRAM_TYPE_GDDR5 ? 450 : 0; + +@@ -3447,9 +3447,10 @@ static void rv770_get_engine_memory_ss(struct amdgpu_device *adev) + static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + struct amdgpu_ps *rps) + { ++ const struct amd_pp_display_configuration *display_cfg = ++ &adev->pm.pm_display_cfg; + struct si_ps *ps = si_get_ps(rps); + struct amdgpu_clock_and_voltage_limits *max_limits; +- struct amdgpu_connector *conn; + bool disable_mclk_switching = false; + bool disable_sclk_switching = false; + u32 mclk, sclk; +@@ -3488,14 +3489,9 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + * For example, 4K 60Hz and 1080p 144Hz fall into this category. + * Find number of such displays connected. + */ +- for (i = 0; i < adev->mode_info.num_crtc; i++) { +- if (!(adev->pm.dpm.new_active_crtcs & (1 << i)) || +- !adev->mode_info.crtcs[i]->enabled) +- continue; +- +- conn = to_amdgpu_connector(adev->mode_info.crtcs[i]->connector); +- +- if (conn->pixelclock_for_modeset > 297000) ++ for (i = 0; i < display_cfg->num_display; i++) { ++ /* The array only contains active displays. */ ++ if (display_cfg->displays[i].pixel_clock > 297000) + high_pixelclock_count++; + } + +@@ -3523,7 +3519,7 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + rps->ecclk = 0; + } + +- if ((adev->pm.dpm.new_active_crtc_count > 1) || ++ if ((adev->pm.pm_display_cfg.num_display > 1) || + si_dpm_vblank_too_short(adev)) + disable_mclk_switching = true; + +@@ -3671,7 +3667,7 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + ps->performance_levels[i].mclk, + max_limits->vddc, &ps->performance_levels[i].vddc); + btc_apply_voltage_dependency_rules(&adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk, +- adev->clock.current_dispclk, ++ display_cfg->display_clk, + max_limits->vddc, &ps->performance_levels[i].vddc); + } + +@@ -4196,16 +4192,16 @@ static void si_program_ds_registers(struct amdgpu_device *adev) + + static void si_program_display_gap(struct amdgpu_device *adev) + { ++ const struct amd_pp_display_configuration *cfg = &adev->pm.pm_display_cfg; + u32 tmp, pipe; +- int i; + + tmp = RREG32(mmCG_DISPLAY_GAP_CNTL) & ~(CG_DISPLAY_GAP_CNTL__DISP1_GAP_MASK | CG_DISPLAY_GAP_CNTL__DISP2_GAP_MASK); +- if (adev->pm.dpm.new_active_crtc_count > 0) ++ if (cfg->num_display > 0) + tmp |= R600_PM_DISPLAY_GAP_VBLANK_OR_WM << CG_DISPLAY_GAP_CNTL__DISP1_GAP__SHIFT; + else + tmp |= R600_PM_DISPLAY_GAP_IGNORE << CG_DISPLAY_GAP_CNTL__DISP1_GAP__SHIFT; + +- if (adev->pm.dpm.new_active_crtc_count > 1) ++ if (cfg->num_display > 1) + tmp |= R600_PM_DISPLAY_GAP_VBLANK_OR_WM << CG_DISPLAY_GAP_CNTL__DISP2_GAP__SHIFT; + else + tmp |= R600_PM_DISPLAY_GAP_IGNORE << CG_DISPLAY_GAP_CNTL__DISP2_GAP__SHIFT; +@@ -4215,17 +4211,8 @@ static void si_program_display_gap(struct amdgpu_device *adev) + tmp = RREG32(DCCG_DISP_SLOW_SELECT_REG); + pipe = (tmp & DCCG_DISP1_SLOW_SELECT_MASK) >> DCCG_DISP1_SLOW_SELECT_SHIFT; + +- if ((adev->pm.dpm.new_active_crtc_count > 0) && +- (!(adev->pm.dpm.new_active_crtcs & (1 << pipe)))) { +- /* find the first active crtc */ +- for (i = 0; i < adev->mode_info.num_crtc; i++) { +- if (adev->pm.dpm.new_active_crtcs & (1 << i)) +- break; +- } +- if (i == adev->mode_info.num_crtc) +- pipe = 0; +- else +- pipe = i; ++ if (cfg->num_display > 0 && pipe != cfg->crtc_index) { ++ pipe = cfg->crtc_index; + + tmp &= ~DCCG_DISP1_SLOW_SELECT_MASK; + tmp |= DCCG_DISP1_SLOW_SELECT(pipe); +@@ -4236,7 +4223,7 @@ static void si_program_display_gap(struct amdgpu_device *adev) + * This can be a problem on PowerXpress systems or if you want to use the card + * for offscreen rendering or compute if there are no crtcs enabled. + */ +- si_notify_smc_display_change(adev, adev->pm.dpm.new_active_crtc_count > 0); ++ si_notify_smc_display_change(adev, cfg->num_display > 0); + } + + static void si_enable_spread_spectrum(struct amdgpu_device *adev, bool enable) +@@ -5545,7 +5532,7 @@ static int si_convert_power_level_to_smc(struct amdgpu_device *adev, + (pl->mclk <= pi->mclk_stutter_mode_threshold) && + !eg_pi->uvd_enabled && + (RREG32(mmDPG_PIPE_STUTTER_CONTROL) & DPG_PIPE_STUTTER_CONTROL__STUTTER_ENABLE_MASK) && +- (adev->pm.dpm.new_active_crtc_count <= 2)) { ++ (adev->pm.pm_display_cfg.num_display <= 2)) { + level->mcFlags |= SISLANDS_SMC_MC_STUTTER_EN; + } + +@@ -5694,7 +5681,7 @@ static bool si_is_state_ulv_compatible(struct amdgpu_device *adev, + /* XXX validate against display requirements! */ + + for (i = 0; i < adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.count; i++) { +- if (adev->clock.current_dispclk <= ++ if (adev->pm.pm_display_cfg.display_clk <= + adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[i].clk) { + if (ulv->pl.vddc < + adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[i].v) +@@ -5848,30 +5835,22 @@ static int si_upload_ulv_state(struct amdgpu_device *adev) + + static int si_upload_smc_data(struct amdgpu_device *adev) + { +- struct amdgpu_crtc *amdgpu_crtc = NULL; +- int i; ++ const struct amd_pp_display_configuration *cfg = &adev->pm.pm_display_cfg; + u32 crtc_index = 0; + u32 mclk_change_block_cp_min = 0; + u32 mclk_change_block_cp_max = 0; + +- for (i = 0; i < adev->mode_info.num_crtc; i++) { +- if (adev->pm.dpm.new_active_crtcs & (1 << i)) { +- amdgpu_crtc = adev->mode_info.crtcs[i]; +- break; +- } +- } +- + /* When a display is plugged in, program these so that the SMC + * performs MCLK switching when it doesn't cause flickering. + * When no display is plugged in, there is no need to restrict + * MCLK switching, so program them to zero. + */ +- if (adev->pm.dpm.new_active_crtc_count && amdgpu_crtc) { +- crtc_index = amdgpu_crtc->crtc_id; ++ if (cfg->num_display) { ++ crtc_index = cfg->crtc_index; + +- if (amdgpu_crtc->line_time) { +- mclk_change_block_cp_min = 200 / amdgpu_crtc->line_time; +- mclk_change_block_cp_max = 100 / amdgpu_crtc->line_time; ++ if (cfg->line_time_in_us) { ++ mclk_change_block_cp_min = 200 / cfg->line_time_in_us; ++ mclk_change_block_cp_max = 100 / cfg->line_time_in_us; + } + } + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c b/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c +index b48a031cbba08..554492dfa3c00 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c +@@ -1554,16 +1554,7 @@ static void pp_pm_compute_clocks(void *handle) + struct amdgpu_device *adev = hwmgr->adev; + + if (!adev->dc_enabled) { +- amdgpu_dpm_get_active_displays(adev); +- adev->pm.pm_display_cfg.num_display = adev->pm.dpm.new_active_crtc_count; +- adev->pm.pm_display_cfg.vrefresh = amdgpu_dpm_get_vrefresh(adev); +- adev->pm.pm_display_cfg.min_vblank_time = amdgpu_dpm_get_vblank_time(adev); +- /* we have issues with mclk switching with +- * refresh rates over 120 hz on the non-DC code. +- */ +- if (adev->pm.pm_display_cfg.vrefresh > 120) +- adev->pm.pm_display_cfg.min_vblank_time = 0; +- ++ amdgpu_dpm_get_display_cfg(adev); + pp_display_configuration_change(handle, + &adev->pm.pm_display_cfg); + } +-- +2.51.0 + diff --git a/queue-6.17/drm-amdgpu-fix-null-pointer-dereference-in-vram-logi.patch b/queue-6.17/drm-amdgpu-fix-null-pointer-dereference-in-vram-logi.patch new file mode 100644 index 0000000000..f3fb7dd6ca --- /dev/null +++ b/queue-6.17/drm-amdgpu-fix-null-pointer-dereference-in-vram-logi.patch @@ -0,0 +1,113 @@ +From e8778ff9471ebd84847ba220f2215f3b6f118c16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 13:46:12 +0800 +Subject: drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU + devices +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jesse.Zhang + +[ Upstream commit 883f309add55060233bf11c1ea6947140372920f ] + +Previously, APU platforms (and other scenarios with uninitialized VRAM managers) +triggered a NULL pointer dereference in `ttm_resource_manager_usage()`. The root +cause is not that the `struct ttm_resource_manager *man` pointer itself is NULL, +but that `man->bdev` (the backing device pointer within the manager) remains +uninitialized (NULL) on APUs—since APUs lack dedicated VRAM and do not fully +set up VRAM manager structures. When `ttm_resource_manager_usage()` attempts to +acquire `man->bdev->lru_lock`, it dereferences the NULL `man->bdev`, leading to +a kernel OOPS. + +1. **amdgpu_cs.c**: Extend the existing bandwidth control check in + `amdgpu_cs_get_threshold_for_moves()` to include a check for + `ttm_resource_manager_used()`. If the manager is not used (uninitialized + `bdev`), return 0 for migration thresholds immediately—skipping VRAM-specific + logic that would trigger the NULL dereference. + +2. **amdgpu_kms.c**: Update the `AMDGPU_INFO_VRAM_USAGE` ioctl and memory info + reporting to use a conditional: if the manager is used, return the real VRAM + usage; otherwise, return 0. This avoids accessing `man->bdev` when it is + NULL. + +3. **amdgpu_virt.c**: Modify the vf2pf (virtual function to physical function) + data write path. Use `ttm_resource_manager_used()` to check validity: if the + manager is usable, calculate `fb_usage` from VRAM usage; otherwise, set + `fb_usage` to 0 (APUs have no discrete framebuffer to report). + +This approach is more robust than APU-specific checks because it: +- Works for all scenarios where the VRAM manager is uninitialized (not just APUs), +- Aligns with TTM's design by using its native helper function, +- Preserves correct behavior for discrete GPUs (which have fully initialized + `man->bdev` and pass the `ttm_resource_manager_used()` check). + +v4: use ttm_resource_manager_used(&adev->mman.vram_mgr.manager) instead of checking the adev->gmc.is_app_apu flag (Christian) + +Reviewed-by: Christian König +Suggested-by: Lijo Lazar +Signed-off-by: Jesse Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- + drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 7 ++++--- + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 4 ++-- + 3 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +index 1ce1fd0c87a57..338fe62e864e9 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +@@ -714,7 +714,7 @@ static void amdgpu_cs_get_threshold_for_moves(struct amdgpu_device *adev, + */ + const s64 us_upper_bound = 200000; + +- if (!adev->mm_stats.log2_max_MBps) { ++ if ((!adev->mm_stats.log2_max_MBps) || !ttm_resource_manager_used(&adev->mman.vram_mgr.manager)) { + *max_bytes = 0; + *max_vis_bytes = 0; + return; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +index 8a76960803c65..8162f7f625a86 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +@@ -758,7 +758,8 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) + ui64 = atomic64_read(&adev->num_vram_cpu_page_faults); + return copy_to_user(out, &ui64, min(size, 8u)) ? -EFAULT : 0; + case AMDGPU_INFO_VRAM_USAGE: +- ui64 = ttm_resource_manager_usage(&adev->mman.vram_mgr.manager); ++ ui64 = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ? ++ ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) : 0; + return copy_to_user(out, &ui64, min(size, 8u)) ? -EFAULT : 0; + case AMDGPU_INFO_VIS_VRAM_USAGE: + ui64 = amdgpu_vram_mgr_vis_usage(&adev->mman.vram_mgr); +@@ -804,8 +805,8 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) + mem.vram.usable_heap_size = adev->gmc.real_vram_size - + atomic64_read(&adev->vram_pin_size) - + AMDGPU_VM_RESERVED_VRAM; +- mem.vram.heap_usage = +- ttm_resource_manager_usage(vram_man); ++ mem.vram.heap_usage = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ? ++ ttm_resource_manager_usage(vram_man) : 0; + mem.vram.max_allocation = mem.vram.usable_heap_size * 3 / 4; + + mem.cpu_accessible_vram.total_heap_size = +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +index 13f0cdeb59c46..e13bf2345ef5c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +@@ -598,8 +598,8 @@ static int amdgpu_virt_write_vf2pf_data(struct amdgpu_device *adev) + vf2pf_info->driver_cert = 0; + vf2pf_info->os_info.all = 0; + +- vf2pf_info->fb_usage = +- ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) >> 20; ++ vf2pf_info->fb_usage = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ? ++ ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) >> 20 : 0; + vf2pf_info->fb_vis_usage = + amdgpu_vram_mgr_vis_usage(&adev->mman.vram_mgr) >> 20; + vf2pf_info->fb_size = adev->gmc.real_vram_size >> 20; +-- +2.51.0 + diff --git a/queue-6.17/drm-amdgpu-hide-vram-sysfs-attributes-on-gpus-withou.patch b/queue-6.17/drm-amdgpu-hide-vram-sysfs-attributes-on-gpus-withou.patch new file mode 100644 index 0000000000..4311a5ed79 --- /dev/null +++ b/queue-6.17/drm-amdgpu-hide-vram-sysfs-attributes-on-gpus-withou.patch @@ -0,0 +1,41 @@ +From 43d6dfa50cd299cad99b25f183e9253d8f149e65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 10:10:52 +0200 +Subject: drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian König + +[ Upstream commit 33cc891b56b93cad1a83263eaf2e417436f70c82 ] + +Otherwise accessing them can cause a crash. + +Signed-off-by: Christian König +Tested-by: Mangesh Gadre +Acked-by: Alex Deucher +Reviewed-by: Arunpravin Paneer Selvam +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c +index 78f9e86ccc099..832ab87eb3451 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c +@@ -234,6 +234,9 @@ static umode_t amdgpu_vram_attrs_is_visible(struct kobject *kobj, + !adev->gmc.vram_vendor) + return 0; + ++ if (!ttm_resource_manager_used(&adev->mman.vram_mgr.manager)) ++ return 0; ++ + return attr->mode; + } + +-- +2.51.0 + diff --git a/queue-6.17/drm-amdgpu-remove-two-invalid-bug_on-s.patch b/queue-6.17/drm-amdgpu-remove-two-invalid-bug_on-s.patch new file mode 100644 index 0000000000..2b4f3a5a58 --- /dev/null +++ b/queue-6.17/drm-amdgpu-remove-two-invalid-bug_on-s.patch @@ -0,0 +1,53 @@ +From 7bca22ff154e50afa0a75f7db43d0ebf44871545 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 14:47:23 +0200 +Subject: drm/amdgpu: remove two invalid BUG_ON()s +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian König + +[ Upstream commit 5d55ed19d4190d2c210ac05ac7a53f800a8c6fe5 ] + +Those can be triggered trivially by userspace. + +Signed-off-by: Christian König +Reviewed-by: Alex Deucher +Acked-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 -- + drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 2 -- + 2 files changed, 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +index c37527704d433..25a5f7fa5077d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +@@ -5864,8 +5864,6 @@ static void gfx_v11_0_ring_emit_ib_gfx(struct amdgpu_ring *ring, + unsigned vmid = AMDGPU_JOB_GET_VMID(job); + u32 header, control = 0; + +- BUG_ON(ib->flags & AMDGPU_IB_FLAG_CE); +- + header = PACKET3(PACKET3_INDIRECT_BUFFER, 2); + + control |= ib->length_dw | (vmid << 24); +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c +index fd44d5503e282..329632388b43e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c +@@ -4421,8 +4421,6 @@ static void gfx_v12_0_ring_emit_ib_gfx(struct amdgpu_ring *ring, + unsigned vmid = AMDGPU_JOB_GET_VMID(job); + u32 header, control = 0; + +- BUG_ON(ib->flags & AMDGPU_IB_FLAG_CE); +- + header = PACKET3(PACKET3_INDIRECT_BUFFER, 2); + + control |= ib->length_dw | (vmid << 24); +-- +2.51.0 + diff --git a/queue-6.17/drm-amdgpu-set-default-gfx-reset-masks-for-gfx6-8.patch b/queue-6.17/drm-amdgpu-set-default-gfx-reset-masks-for-gfx6-8.patch new file mode 100644 index 0000000000..8c3d4b3c27 --- /dev/null +++ b/queue-6.17/drm-amdgpu-set-default-gfx-reset-masks-for-gfx6-8.patch @@ -0,0 +1,74 @@ +From be8e244da108308ffa4d9e2b586813307f3ba299 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 16:45:17 -0400 +Subject: drm/amdgpu: set default gfx reset masks for gfx6-8 + +From: Alex Deucher + +[ Upstream commit 90b75e12a6e831c8516498f690058d4165d5a5d6 ] + +These were not set so soft recovery was inadvertantly +disabled. + +Fixes: 6ac55eab4fc4 ("drm/amdgpu: move reset support type checks into the caller") +Reviewed-by: Jesse Zhang +Signed-off-by: Alex Deucher +(cherry picked from commit 1972763505d728c604b537180727ec8132e619df) +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 5 +++++ + drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 5 +++++ + drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 5 +++++ + 3 files changed, 15 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c +index 70d7a1f434c4b..e2cf598f773a4 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c +@@ -3103,6 +3103,11 @@ static int gfx_v6_0_sw_init(struct amdgpu_ip_block *ip_block) + return r; + } + ++ adev->gfx.gfx_supported_reset = ++ amdgpu_get_soft_full_reset_mask(&adev->gfx.gfx_ring[0]); ++ adev->gfx.compute_supported_reset = ++ amdgpu_get_soft_full_reset_mask(&adev->gfx.compute_ring[0]); ++ + return r; + } + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c +index 2aa323dab34e3..df1993d137364 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c +@@ -4400,6 +4400,11 @@ static int gfx_v7_0_sw_init(struct amdgpu_ip_block *ip_block) + + gfx_v7_0_gpu_early_init(adev); + ++ adev->gfx.gfx_supported_reset = ++ amdgpu_get_soft_full_reset_mask(&adev->gfx.gfx_ring[0]); ++ adev->gfx.compute_supported_reset = ++ amdgpu_get_soft_full_reset_mask(&adev->gfx.compute_ring[0]); ++ + return r; + } + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +index 367449d8061b0..13e38b44540bd 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +@@ -2024,6 +2024,11 @@ static int gfx_v8_0_sw_init(struct amdgpu_ip_block *ip_block) + if (r) + return r; + ++ adev->gfx.gfx_supported_reset = ++ amdgpu_get_soft_full_reset_mask(&adev->gfx.gfx_ring[0]); ++ adev->gfx.compute_supported_reset = ++ amdgpu_get_soft_full_reset_mask(&adev->gfx.compute_ring[0]); ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.17/drm-amdkfd-fix-suspend-resume-all-calls-in-mes-based.patch b/queue-6.17/drm-amdkfd-fix-suspend-resume-all-calls-in-mes-based.patch new file mode 100644 index 0000000000..a3c4fe07d4 --- /dev/null +++ b/queue-6.17/drm-amdkfd-fix-suspend-resume-all-calls-in-mes-based.patch @@ -0,0 +1,141 @@ +From 23950cfd71285a2fb699e7ce2d465b7de43f0431 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jun 2025 10:31:15 -0400 +Subject: drm/amdkfd: fix suspend/resume all calls in mes based eviction path + +From: Jonathan Kim + +[ Upstream commit 079ae5118e1f0dcf5b1ab68ffdb5760b06ed79a2 ] + +Suspend/resume all gangs should be done with the device lock is held. + +Signed-off-by: Jonathan Kim +Acked-by: Alex Deucher +Reviewed-by: Harish Kasiviswanathan +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/amdkfd/kfd_device_queue_manager.c | 73 ++++++------------- + 1 file changed, 21 insertions(+), 52 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +index 6c5c7c1bf5eda..6e7bc983fc0b6 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +@@ -1209,6 +1209,15 @@ static int evict_process_queues_cpsch(struct device_queue_manager *dqm, + pr_debug_ratelimited("Evicting process pid %d queues\n", + pdd->process->lead_thread->pid); + ++ if (dqm->dev->kfd->shared_resources.enable_mes) { ++ pdd->last_evict_timestamp = get_jiffies_64(); ++ retval = suspend_all_queues_mes(dqm); ++ if (retval) { ++ dev_err(dev, "Suspending all queues failed"); ++ goto out; ++ } ++ } ++ + /* Mark all queues as evicted. Deactivate all active queues on + * the qpd. + */ +@@ -1221,23 +1230,27 @@ static int evict_process_queues_cpsch(struct device_queue_manager *dqm, + decrement_queue_count(dqm, qpd, q); + + if (dqm->dev->kfd->shared_resources.enable_mes) { +- int err; +- +- err = remove_queue_mes(dqm, q, qpd); +- if (err) { ++ retval = remove_queue_mes(dqm, q, qpd); ++ if (retval) { + dev_err(dev, "Failed to evict queue %d\n", + q->properties.queue_id); +- retval = err; ++ goto out; + } + } + } +- pdd->last_evict_timestamp = get_jiffies_64(); +- if (!dqm->dev->kfd->shared_resources.enable_mes) ++ ++ if (!dqm->dev->kfd->shared_resources.enable_mes) { ++ pdd->last_evict_timestamp = get_jiffies_64(); + retval = execute_queues_cpsch(dqm, + qpd->is_debug ? + KFD_UNMAP_QUEUES_FILTER_ALL_QUEUES : + KFD_UNMAP_QUEUES_FILTER_DYNAMIC_QUEUES, 0, + USE_DEFAULT_GRACE_PERIOD); ++ } else { ++ retval = resume_all_queues_mes(dqm); ++ if (retval) ++ dev_err(dev, "Resuming all queues failed"); ++ } + + out: + dqm_unlock(dqm); +@@ -3098,61 +3111,17 @@ int kfd_dqm_suspend_bad_queue_mes(struct kfd_node *knode, u32 pasid, u32 doorbel + return ret; + } + +-static int kfd_dqm_evict_pasid_mes(struct device_queue_manager *dqm, +- struct qcm_process_device *qpd) +-{ +- struct device *dev = dqm->dev->adev->dev; +- int ret = 0; +- +- /* Check if process is already evicted */ +- dqm_lock(dqm); +- if (qpd->evicted) { +- /* Increment the evicted count to make sure the +- * process stays evicted before its terminated. +- */ +- qpd->evicted++; +- dqm_unlock(dqm); +- goto out; +- } +- dqm_unlock(dqm); +- +- ret = suspend_all_queues_mes(dqm); +- if (ret) { +- dev_err(dev, "Suspending all queues failed"); +- goto out; +- } +- +- ret = dqm->ops.evict_process_queues(dqm, qpd); +- if (ret) { +- dev_err(dev, "Evicting process queues failed"); +- goto out; +- } +- +- ret = resume_all_queues_mes(dqm); +- if (ret) +- dev_err(dev, "Resuming all queues failed"); +- +-out: +- return ret; +-} +- + int kfd_evict_process_device(struct kfd_process_device *pdd) + { + struct device_queue_manager *dqm; + struct kfd_process *p; +- int ret = 0; + + p = pdd->process; + dqm = pdd->dev->dqm; + + WARN(debug_evictions, "Evicting pid %d", p->lead_thread->pid); + +- if (dqm->dev->kfd->shared_resources.enable_mes) +- ret = kfd_dqm_evict_pasid_mes(dqm, &pdd->qpd); +- else +- ret = dqm->ops.evict_process_queues(dqm, &pdd->qpd); +- +- return ret; ++ return dqm->ops.evict_process_queues(dqm, &pdd->qpd); + } + + int reserve_debug_trap_vmid(struct device_queue_manager *dqm, +-- +2.51.0 + diff --git a/queue-6.17/drm-i915-avoid-lock-inversion-when-pinning-to-ggtt-o.patch b/queue-6.17/drm-i915-avoid-lock-inversion-when-pinning-to-ggtt-o.patch new file mode 100644 index 0000000000..4555389a2f --- /dev/null +++ b/queue-6.17/drm-i915-avoid-lock-inversion-when-pinning-to-ggtt-o.patch @@ -0,0 +1,276 @@ +From ec6f87b3afeea37ae2fe696cbbe19560376a0c85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Oct 2025 10:25:19 +0200 +Subject: drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD + +From: Janusz Krzysztofik + +[ Upstream commit 84bbe327a5cbb060f3321c9d9d4d53936fc1ef9b ] + +On completion of i915_vma_pin_ww(), a synchronous variant of +dma_fence_work_commit() is called. When pinning a VMA to GGTT address +space on a Cherry View family processor, or on a Broxton generation SoC +with VTD enabled, i.e., when stop_machine() is then called from +intel_ggtt_bind_vma(), that can potentially lead to lock inversion among +reservation_ww and cpu_hotplug locks. + +[86.861179] ====================================================== +[86.861193] WARNING: possible circular locking dependency detected +[86.861209] 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 Tainted: G U +[86.861226] ------------------------------------------------------ +[86.861238] i915_module_loa/1432 is trying to acquire lock: +[86.861252] ffffffff83489090 (cpu_hotplug_lock){++++}-{0:0}, at: stop_machine+0x1c/0x50 +[86.861290] +but task is already holding lock: +[86.861303] ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915] +[86.862233] +which lock already depends on the new lock. +[86.862251] +the existing dependency chain (in reverse order) is: +[86.862265] +-> #5 (reservation_ww_class_mutex){+.+.}-{3:3}: +[86.862292] dma_resv_lockdep+0x19a/0x390 +[86.862315] do_one_initcall+0x60/0x3f0 +[86.862334] kernel_init_freeable+0x3cd/0x680 +[86.862353] kernel_init+0x1b/0x200 +[86.862369] ret_from_fork+0x47/0x70 +[86.862383] ret_from_fork_asm+0x1a/0x30 +[86.862399] +-> #4 (reservation_ww_class_acquire){+.+.}-{0:0}: +[86.862425] dma_resv_lockdep+0x178/0x390 +[86.862440] do_one_initcall+0x60/0x3f0 +[86.862454] kernel_init_freeable+0x3cd/0x680 +[86.862470] kernel_init+0x1b/0x200 +[86.862482] ret_from_fork+0x47/0x70 +[86.862495] ret_from_fork_asm+0x1a/0x30 +[86.862509] +-> #3 (&mm->mmap_lock){++++}-{3:3}: +[86.862531] down_read_killable+0x46/0x1e0 +[86.862546] lock_mm_and_find_vma+0xa2/0x280 +[86.862561] do_user_addr_fault+0x266/0x8e0 +[86.862578] exc_page_fault+0x8a/0x2f0 +[86.862593] asm_exc_page_fault+0x27/0x30 +[86.862607] filldir64+0xeb/0x180 +[86.862620] kernfs_fop_readdir+0x118/0x480 +[86.862635] iterate_dir+0xcf/0x2b0 +[86.862648] __x64_sys_getdents64+0x84/0x140 +[86.862661] x64_sys_call+0x1058/0x2660 +[86.862675] do_syscall_64+0x91/0xe90 +[86.862689] entry_SYSCALL_64_after_hwframe+0x76/0x7e +[86.862703] +-> #2 (&root->kernfs_rwsem){++++}-{3:3}: +[86.862725] down_write+0x3e/0xf0 +[86.862738] kernfs_add_one+0x30/0x3c0 +[86.862751] kernfs_create_dir_ns+0x53/0xb0 +[86.862765] internal_create_group+0x134/0x4c0 +[86.862779] sysfs_create_group+0x13/0x20 +[86.862792] topology_add_dev+0x1d/0x30 +[86.862806] cpuhp_invoke_callback+0x4b5/0x850 +[86.862822] cpuhp_issue_call+0xbf/0x1f0 +[86.862836] __cpuhp_setup_state_cpuslocked+0x111/0x320 +[86.862852] __cpuhp_setup_state+0xb0/0x220 +[86.862866] topology_sysfs_init+0x30/0x50 +[86.862879] do_one_initcall+0x60/0x3f0 +[86.862893] kernel_init_freeable+0x3cd/0x680 +[86.862908] kernel_init+0x1b/0x200 +[86.862921] ret_from_fork+0x47/0x70 +[86.862934] ret_from_fork_asm+0x1a/0x30 +[86.862947] +-> #1 (cpuhp_state_mutex){+.+.}-{3:3}: +[86.862969] __mutex_lock+0xaa/0xed0 +[86.862982] mutex_lock_nested+0x1b/0x30 +[86.862995] __cpuhp_setup_state_cpuslocked+0x67/0x320 +[86.863012] __cpuhp_setup_state+0xb0/0x220 +[86.863026] page_alloc_init_cpuhp+0x2d/0x60 +[86.863041] mm_core_init+0x22/0x2d0 +[86.863054] start_kernel+0x576/0xbd0 +[86.863068] x86_64_start_reservations+0x18/0x30 +[86.863084] x86_64_start_kernel+0xbf/0x110 +[86.863098] common_startup_64+0x13e/0x141 +[86.863114] +-> #0 (cpu_hotplug_lock){++++}-{0:0}: +[86.863135] __lock_acquire+0x1635/0x2810 +[86.863152] lock_acquire+0xc4/0x2f0 +[86.863166] cpus_read_lock+0x41/0x100 +[86.863180] stop_machine+0x1c/0x50 +[86.863194] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915] +[86.863987] intel_ggtt_bind_vma+0x43/0x70 [i915] +[86.864735] __vma_bind+0x55/0x70 [i915] +[86.865510] fence_work+0x26/0xa0 [i915] +[86.866248] fence_notify+0xa1/0x140 [i915] +[86.866983] __i915_sw_fence_complete+0x8f/0x270 [i915] +[86.867719] i915_sw_fence_commit+0x39/0x60 [i915] +[86.868453] i915_vma_pin_ww+0x462/0x1360 [i915] +[86.869228] i915_vma_pin.constprop.0+0x133/0x1d0 [i915] +[86.870001] initial_plane_vma+0x307/0x840 [i915] +[86.870774] intel_initial_plane_config+0x33f/0x670 [i915] +[86.871546] intel_display_driver_probe_nogem+0x1c6/0x260 [i915] +[86.872330] i915_driver_probe+0x7fa/0xe80 [i915] +[86.873057] i915_pci_probe+0xe6/0x220 [i915] +[86.873782] local_pci_probe+0x47/0xb0 +[86.873802] pci_device_probe+0xf3/0x260 +[86.873817] really_probe+0xf1/0x3c0 +[86.873833] __driver_probe_device+0x8c/0x180 +[86.873848] driver_probe_device+0x24/0xd0 +[86.873862] __driver_attach+0x10f/0x220 +[86.873876] bus_for_each_dev+0x7f/0xe0 +[86.873892] driver_attach+0x1e/0x30 +[86.873904] bus_add_driver+0x151/0x290 +[86.873917] driver_register+0x5e/0x130 +[86.873931] __pci_register_driver+0x7d/0x90 +[86.873945] i915_pci_register_driver+0x23/0x30 [i915] +[86.874678] i915_init+0x37/0x120 [i915] +[86.875347] do_one_initcall+0x60/0x3f0 +[86.875369] do_init_module+0x97/0x2a0 +[86.875385] load_module+0x2c54/0x2d80 +[86.875398] init_module_from_file+0x96/0xe0 +[86.875413] idempotent_init_module+0x117/0x330 +[86.875426] __x64_sys_finit_module+0x77/0x100 +[86.875440] x64_sys_call+0x24de/0x2660 +[86.875454] do_syscall_64+0x91/0xe90 +[86.875470] entry_SYSCALL_64_after_hwframe+0x76/0x7e +[86.875486] +other info that might help us debug this: +[86.875502] Chain exists of: + cpu_hotplug_lock --> reservation_ww_class_acquire --> reservation_ww_class_mutex +[86.875539] Possible unsafe locking scenario: +[86.875552] CPU0 CPU1 +[86.875563] ---- ---- +[86.875573] lock(reservation_ww_class_mutex); +[86.875588] lock(reservation_ww_class_acquire); +[86.875606] lock(reservation_ww_class_mutex); +[86.875624] rlock(cpu_hotplug_lock); +[86.875637] + *** DEADLOCK *** +[86.875650] 3 locks held by i915_module_loa/1432: +[86.875663] #0: ffff888101f5c1b0 (&dev->mutex){....}-{3:3}, at: __driver_attach+0x104/0x220 +[86.875699] #1: ffffc90002e0b4a0 (reservation_ww_class_acquire){+.+.}-{0:0}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915] +[86.876512] #2: ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915] +[86.877305] +stack backtrace: +[86.877326] CPU: 0 UID: 0 PID: 1432 Comm: i915_module_loa Tainted: G U 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 PREEMPT(voluntary) +[86.877334] Tainted: [U]=USER +[86.877336] Hardware name: /NUC5CPYB, BIOS PYBSWCEL.86A.0079.2020.0420.1316 04/20/2020 +[86.877339] Call Trace: +[86.877344] +[86.877353] dump_stack_lvl+0x91/0xf0 +[86.877364] dump_stack+0x10/0x20 +[86.877369] print_circular_bug+0x285/0x360 +[86.877379] check_noncircular+0x135/0x150 +[86.877390] __lock_acquire+0x1635/0x2810 +[86.877403] lock_acquire+0xc4/0x2f0 +[86.877408] ? stop_machine+0x1c/0x50 +[86.877422] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915] +[86.878173] cpus_read_lock+0x41/0x100 +[86.878182] ? stop_machine+0x1c/0x50 +[86.878191] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915] +[86.878916] stop_machine+0x1c/0x50 +[86.878927] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915] +[86.879652] intel_ggtt_bind_vma+0x43/0x70 [i915] +[86.880375] __vma_bind+0x55/0x70 [i915] +[86.881133] fence_work+0x26/0xa0 [i915] +[86.881851] fence_notify+0xa1/0x140 [i915] +[86.882566] __i915_sw_fence_complete+0x8f/0x270 [i915] +[86.883286] i915_sw_fence_commit+0x39/0x60 [i915] +[86.884003] i915_vma_pin_ww+0x462/0x1360 [i915] +[86.884756] ? i915_vma_pin.constprop.0+0x6c/0x1d0 [i915] +[86.885513] i915_vma_pin.constprop.0+0x133/0x1d0 [i915] +[86.886281] initial_plane_vma+0x307/0x840 [i915] +[86.887049] intel_initial_plane_config+0x33f/0x670 [i915] +[86.887819] intel_display_driver_probe_nogem+0x1c6/0x260 [i915] +[86.888587] i915_driver_probe+0x7fa/0xe80 [i915] +[86.889293] ? mutex_unlock+0x12/0x20 +[86.889301] ? drm_privacy_screen_get+0x171/0x190 +[86.889308] ? acpi_dev_found+0x66/0x80 +[86.889321] i915_pci_probe+0xe6/0x220 [i915] +[86.890038] local_pci_probe+0x47/0xb0 +[86.890049] pci_device_probe+0xf3/0x260 +[86.890058] really_probe+0xf1/0x3c0 +[86.890067] __driver_probe_device+0x8c/0x180 +[86.890072] driver_probe_device+0x24/0xd0 +[86.890078] __driver_attach+0x10f/0x220 +[86.890083] ? __pfx___driver_attach+0x10/0x10 +[86.890088] bus_for_each_dev+0x7f/0xe0 +[86.890097] driver_attach+0x1e/0x30 +[86.890101] bus_add_driver+0x151/0x290 +[86.890107] driver_register+0x5e/0x130 +[86.890113] __pci_register_driver+0x7d/0x90 +[86.890119] i915_pci_register_driver+0x23/0x30 [i915] +[86.890833] i915_init+0x37/0x120 [i915] +[86.891482] ? __pfx_i915_init+0x10/0x10 [i915] +[86.892135] do_one_initcall+0x60/0x3f0 +[86.892145] ? __kmalloc_cache_noprof+0x33f/0x470 +[86.892157] do_init_module+0x97/0x2a0 +[86.892164] load_module+0x2c54/0x2d80 +[86.892168] ? __kernel_read+0x15c/0x300 +[86.892185] ? kernel_read_file+0x2b1/0x320 +[86.892195] init_module_from_file+0x96/0xe0 +[86.892199] ? init_module_from_file+0x96/0xe0 +[86.892211] idempotent_init_module+0x117/0x330 +[86.892224] __x64_sys_finit_module+0x77/0x100 +[86.892230] x64_sys_call+0x24de/0x2660 +[86.892236] do_syscall_64+0x91/0xe90 +[86.892243] ? irqentry_exit+0x77/0xb0 +[86.892249] ? sysvec_apic_timer_interrupt+0x57/0xc0 +[86.892256] entry_SYSCALL_64_after_hwframe+0x76/0x7e +[86.892261] RIP: 0033:0x7303e1b2725d +[86.892271] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8b bb 0d 00 f7 d8 64 89 01 48 +[86.892276] RSP: 002b:00007ffddd1fdb38 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 +[86.892281] RAX: ffffffffffffffda RBX: 00005d771d88fd90 RCX: 00007303e1b2725d +[86.892285] RDX: 0000000000000000 RSI: 00005d771d893aa0 RDI: 000000000000000c +[86.892287] RBP: 00007ffddd1fdbf0 R08: 0000000000000040 R09: 00007ffddd1fdb80 +[86.892289] R10: 00007303e1c03b20 R11: 0000000000000246 R12: 00005d771d893aa0 +[86.892292] R13: 0000000000000000 R14: 00005d771d88f0d0 R15: 00005d771d895710 +[86.892304] + +Call asynchronous variant of dma_fence_work_commit() in that case. + +v3: Provide more verbose in-line comment (Andi), + - mention target environments in commit message. + +Fixes: 7d1c2618eac59 ("drm/i915: Take reservation lock around i915_vma_pin.") +Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14985 +Cc: Andi Shyti +Signed-off-by: Janusz Krzysztofik +Reviewed-by: Sebastian Brzezinka +Reviewed-by: Krzysztof Karas +Acked-by: Andi Shyti +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20251023082925.351307-6-janusz.krzysztofik@linux.intel.com +(cherry picked from commit 648ef1324add1c2e2b6041cdf0b28d31fbca5f13) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/i915_vma.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c +index 25e97031d76e4..30d5889fc809d 100644 +--- a/drivers/gpu/drm/i915/i915_vma.c ++++ b/drivers/gpu/drm/i915/i915_vma.c +@@ -1595,8 +1595,20 @@ int i915_vma_pin_ww(struct i915_vma *vma, struct i915_gem_ww_ctx *ww, + err_vma_res: + i915_vma_resource_free(vma_res); + err_fence: +- if (work) +- dma_fence_work_commit_imm(&work->base); ++ if (work) { ++ /* ++ * When pinning VMA to GGTT on CHV or BXT with VTD enabled, ++ * commit VMA binding asynchronously to avoid risk of lock ++ * inversion among reservation_ww locks held here and ++ * cpu_hotplug_lock acquired from stop_machine(), which we ++ * wrap around GGTT updates when running in those environments. ++ */ ++ if (i915_vma_is_ggtt(vma) && ++ intel_vm_no_concurrent_access_wa(vma->vm->i915)) ++ dma_fence_work_commit(&work->base); ++ else ++ dma_fence_work_commit_imm(&work->base); ++ } + err_rpm: + intel_runtime_pm_put(&vma->vm->i915->runtime_pm, wakeref); + +-- +2.51.0 + diff --git a/queue-6.17/drm-i915-fix-conversion-between-clock-ticks-and-nano.patch b/queue-6.17/drm-i915-fix-conversion-between-clock-ticks-and-nano.patch new file mode 100644 index 0000000000..6d419343a0 --- /dev/null +++ b/queue-6.17/drm-i915-fix-conversion-between-clock-ticks-and-nano.patch @@ -0,0 +1,59 @@ +From ca71b530397358ee19f633cda405cfee674c5275 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Oct 2025 17:03:51 -0700 +Subject: drm/i915: Fix conversion between clock ticks and nanoseconds + +From: Umesh Nerlige Ramappa + +[ Upstream commit 7d44ad6b43d0be43d080180413a1b6c24cfbd266 ] + +When tick values are large, the multiplication by NSEC_PER_SEC is larger +than 64 bits and results in bad conversions. + +The issue is seen in PMU busyness counters that look like they have +wrapped around due to bad conversion. i915 PMU implementation returns +monotonically increasing counters. If a count is lesser than previous +one, it will only return the larger value until the smaller value +catches up. The user will see this as zero delta between two +measurements even though the engines are busy. + +Fix it by using mul_u64_u32_div() + +Fixes: 77cdd054dd2c ("drm/i915/pmu: Connect engine busyness stats from GuC to pmu") +Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14955 +Signed-off-by: Umesh Nerlige Ramappa +Reviewed-by: Ashutosh Dixit +Link: https://lore.kernel.org/r/20251016000350.1152382-2-umesh.nerlige.ramappa@intel.com +(cherry picked from commit 2ada9cb1df3f5405a01d013b708b1b0914efccfe) +Signed-off-by: Rodrigo Vivi +[Rodrigo: Added the Fixes tag while cherry-picking to fixes] +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c b/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c +index 6c499692d61ef..3eb4206b371d2 100644 +--- a/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c ++++ b/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c +@@ -205,7 +205,7 @@ static u64 div_u64_roundup(u64 nom, u32 den) + + u64 intel_gt_clock_interval_to_ns(const struct intel_gt *gt, u64 count) + { +- return div_u64_roundup(count * NSEC_PER_SEC, gt->clock_frequency); ++ return mul_u64_u32_div(count, NSEC_PER_SEC, gt->clock_frequency); + } + + u64 intel_gt_pm_interval_to_ns(const struct intel_gt *gt, u64 count) +@@ -215,7 +215,7 @@ u64 intel_gt_pm_interval_to_ns(const struct intel_gt *gt, u64 count) + + u64 intel_gt_ns_to_clock_interval(const struct intel_gt *gt, u64 ns) + { +- return div_u64_roundup(gt->clock_frequency * ns, NSEC_PER_SEC); ++ return mul_u64_u32_div(ns, gt->clock_frequency, NSEC_PER_SEC); + } + + u64 intel_gt_ns_to_pm_interval(const struct intel_gt *gt, u64 ns) +-- +2.51.0 + diff --git a/queue-6.17/drm-mediatek-add-pm_runtime-support-for-gce-power-co.patch b/queue-6.17/drm-mediatek-add-pm_runtime-support-for-gce-power-co.patch new file mode 100644 index 0000000000..fa25b5dfb2 --- /dev/null +++ b/queue-6.17/drm-mediatek-add-pm_runtime-support-for-gce-power-co.patch @@ -0,0 +1,52 @@ +From 5dfe89f06c9be95f605de3fd55e497c72d237c33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 17:15:59 +0800 +Subject: drm/mediatek: Add pm_runtime support for GCE power control + +From: Jason-JH Lin + +[ Upstream commit afcfb6c8474d9e750880aaa77952cc588f859613 ] + +Call pm_runtime_resume_and_get() before accessing GCE hardware in +mbox_send_message(), and invoke pm_runtime_put_autosuspend() in the +cmdq callback to release the PM reference and start autosuspend for +GCE. This ensures correct power management for the GCE device. + +Fixes: 8afe816b0c99 ("mailbox: mtk-cmdq-mailbox: Implement Runtime PM with autosuspend") +Signed-off-by: Jason-JH Lin +Reviewed-by: CK Hu +Link: https://patchwork.kernel.org/project/dri-devel/patch/20250829091727.3745415-3-jason-jh.lin@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_crtc.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_crtc.c b/drivers/gpu/drm/mediatek/mtk_crtc.c +index bc7527542fdc6..c4c6d0249df56 100644 +--- a/drivers/gpu/drm/mediatek/mtk_crtc.c ++++ b/drivers/gpu/drm/mediatek/mtk_crtc.c +@@ -283,6 +283,10 @@ static void ddp_cmdq_cb(struct mbox_client *cl, void *mssg) + unsigned int i; + unsigned long flags; + ++ /* release GCE HW usage and start autosuspend */ ++ pm_runtime_mark_last_busy(cmdq_cl->chan->mbox->dev); ++ pm_runtime_put_autosuspend(cmdq_cl->chan->mbox->dev); ++ + if (data->sta < 0) + return; + +@@ -618,6 +622,9 @@ static void mtk_crtc_update_config(struct mtk_crtc *mtk_crtc, bool needs_vblank) + mtk_crtc->config_updating = false; + spin_unlock_irqrestore(&mtk_crtc->config_lock, flags); + ++ if (pm_runtime_resume_and_get(mtk_crtc->cmdq_client.chan->mbox->dev) < 0) ++ goto update_config_out; ++ + mbox_send_message(mtk_crtc->cmdq_client.chan, cmdq_handle); + mbox_client_txdone(mtk_crtc->cmdq_client.chan, 0); + goto update_config_out; +-- +2.51.0 + diff --git a/queue-6.17/drm-xe-do-clean-shutdown-also-when-using-flr.patch b/queue-6.17/drm-xe-do-clean-shutdown-also-when-using-flr.patch new file mode 100644 index 0000000000..b3a36a3203 --- /dev/null +++ b/queue-6.17/drm-xe-do-clean-shutdown-also-when-using-flr.patch @@ -0,0 +1,69 @@ +From b3e6d4c028c8f8c9c7b31ada67707b28acd26a10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Oct 2025 14:23:11 +0200 +Subject: drm/xe: Do clean shutdown also when using flr +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jouni Högander + +[ Upstream commit b11a020d914c3b7628f56a9ea476a5b03679489b ] + +Currently Xe driver is triggering flr without any clean-up on +shutdown. This is causing random warnings from pending related works as the +underlying hardware is reset in the middle of their execution. + +Fix this by performing clean shutdown also when using flr. + +Fixes: 501d799a47e2 ("drm/xe: Wire up device shutdown handler") +Cc: Maarten Lankhorst +Signed-off-by: Jouni Högander +Reviewed-by: Maarten Lankhorst +Link: https://patch.msgid.link/20251031122312.1836534-1-jouni.hogander@intel.com +Signed-off-by: Maarten Lankhorst +(cherry picked from commit a4ff26b7c8ef38e4dd34f77cbcd73576fdde6dd4) +Signed-off-by: Lucas De Marchi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_device.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_device.c b/drivers/gpu/drm/xe/xe_device.c +index 528e818edbd7f..107c1f48e87fc 100644 +--- a/drivers/gpu/drm/xe/xe_device.c ++++ b/drivers/gpu/drm/xe/xe_device.c +@@ -962,21 +962,21 @@ void xe_device_remove(struct xe_device *xe) + + void xe_device_shutdown(struct xe_device *xe) + { ++ struct xe_gt *gt; ++ u8 id; ++ + drm_dbg(&xe->drm, "Shutting down device\n"); + +- if (xe_driver_flr_disabled(xe)) { +- struct xe_gt *gt; +- u8 id; ++ xe_display_pm_shutdown(xe); + +- xe_display_pm_shutdown(xe); ++ xe_irq_suspend(xe); + +- xe_irq_suspend(xe); ++ for_each_gt(gt, xe, id) ++ xe_gt_shutdown(gt); + +- for_each_gt(gt, xe, id) +- xe_gt_shutdown(gt); ++ xe_display_pm_shutdown_late(xe); + +- xe_display_pm_shutdown_late(xe); +- } else { ++ if (!xe_driver_flr_disabled(xe)) { + /* BOOM! */ + __xe_driver_flr(xe); + } +-- +2.51.0 + diff --git a/queue-6.17/drm-xe-guc-synchronize-dead-ct-worker-with-unbind.patch b/queue-6.17/drm-xe-guc-synchronize-dead-ct-worker-with-unbind.patch new file mode 100644 index 0000000000..a1f877e980 --- /dev/null +++ b/queue-6.17/drm-xe-guc-synchronize-dead-ct-worker-with-unbind.patch @@ -0,0 +1,43 @@ +From c51df45c04f6fc2115483051acabf87452c27aa7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Nov 2025 18:01:47 +0530 +Subject: drm/xe/guc: Synchronize Dead CT worker with unbind + +From: Balasubramani Vivekanandan + +[ Upstream commit 95af8f4fdce8349a5fe75264007f1af2aa1082ea ] + +Cancel and wait for any Dead CT worker to complete before continuing +with device unbinding. Else the worker will end up using resources freed +by the undind operation. + +Cc: Zhanjun Dong +Fixes: d2c5a5a926f4 ("drm/xe/guc: Dead CT helper") +Signed-off-by: Balasubramani Vivekanandan +Reviewed-by: Stuart Summers +Link: https://patch.msgid.link/20251103123144.3231829-6-balasubramani.vivekanandan@intel.com +Signed-off-by: Lucas De Marchi +(cherry picked from commit 492671339114e376aaa38626d637a2751cdef263) +Signed-off-by: Lucas De Marchi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_guc_ct.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/xe/xe_guc_ct.c b/drivers/gpu/drm/xe/xe_guc_ct.c +index 22eff8476ad48..75ac0c424476e 100644 +--- a/drivers/gpu/drm/xe/xe_guc_ct.c ++++ b/drivers/gpu/drm/xe/xe_guc_ct.c +@@ -200,6 +200,9 @@ static void guc_ct_fini(struct drm_device *drm, void *arg) + { + struct xe_guc_ct *ct = arg; + ++#if IS_ENABLED(CONFIG_DRM_XE_DEBUG) ++ cancel_work_sync(&ct->dead.worker); ++#endif + ct_exit_safe_mode(ct); + destroy_workqueue(ct->g2h_wq); + xa_destroy(&ct->fence_lookup); +-- +2.51.0 + diff --git a/queue-6.17/drm-xe-move-declarations-under-conditional-branch.patch b/queue-6.17/drm-xe-move-declarations-under-conditional-branch.patch new file mode 100644 index 0000000000..46309071d6 --- /dev/null +++ b/queue-6.17/drm-xe-move-declarations-under-conditional-branch.patch @@ -0,0 +1,48 @@ +From f0bbaa16aff1f0249b92b7c4a5dae26b1fc72e20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 15:32:08 +0530 +Subject: drm/xe: Move declarations under conditional branch + +From: Tejas Upadhyay + +[ Upstream commit 9cd27eec872f0b95dcdd811edc39d2d32e4158c8 ] + +The xe_device_shutdown() function was needing a few declarations +that were only required under a specific condition. This change +moves those declarations to be within that conditional branch +to avoid unnecessary declarations. + +Reviewed-by: Nitin Gote +Link: https://patchwork.freedesktop.org/patch/msgid/20251007100208.1407021-1-tejas.upadhyay@intel.com +Signed-off-by: Tejas Upadhyay +(cherry picked from commit 15b3036045188f4da4ca62b2ed01b0f160252e9b) +Signed-off-by: Lucas De Marchi +Stable-dep-of: b11a020d914c ("drm/xe: Do clean shutdown also when using flr") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_device.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_device.c b/drivers/gpu/drm/xe/xe_device.c +index d399c2628fa33..528e818edbd7f 100644 +--- a/drivers/gpu/drm/xe/xe_device.c ++++ b/drivers/gpu/drm/xe/xe_device.c +@@ -962,12 +962,12 @@ void xe_device_remove(struct xe_device *xe) + + void xe_device_shutdown(struct xe_device *xe) + { +- struct xe_gt *gt; +- u8 id; +- + drm_dbg(&xe->drm, "Shutting down device\n"); + + if (xe_driver_flr_disabled(xe)) { ++ struct xe_gt *gt; ++ u8 id; ++ + xe_display_pm_shutdown(xe); + + xe_irq_suspend(xe); +-- +2.51.0 + diff --git a/queue-6.17/exfat-fix-improper-check-of-dentry.stream.valid_size.patch b/queue-6.17/exfat-fix-improper-check-of-dentry.stream.valid_size.patch new file mode 100644 index 0000000000..e833a9d54c --- /dev/null +++ b/queue-6.17/exfat-fix-improper-check-of-dentry.stream.valid_size.patch @@ -0,0 +1,59 @@ +From 5f95347d9937b554eb6c1016b374389b67d0f837 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 22:01:46 +0900 +Subject: exfat: fix improper check of dentry.stream.valid_size +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jaehun Gou + +[ Upstream commit 82ebecdc74ff555daf70b811d854b1f32a296bea ] + +We found an infinite loop bug in the exFAT file system that can lead to a +Denial-of-Service (DoS) condition. When a dentry in an exFAT filesystem is +malformed, the following system calls — SYS_openat, SYS_ftruncate, and +SYS_pwrite64 — can cause the kernel to hang. + +Root cause analysis shows that the size validation code in exfat_find() +does not check whether dentry.stream.valid_size is negative. As a result, +the system calls mentioned above can succeed and eventually trigger the DoS +issue. + +This patch adds a check for negative dentry.stream.valid_size to prevent +this vulnerability. + +Co-developed-by: Seunghun Han +Signed-off-by: Seunghun Han +Co-developed-by: Jihoon Kwon +Signed-off-by: Jihoon Kwon +Signed-off-by: Jaehun Gou +Signed-off-by: Namjae Jeon +Signed-off-by: Sasha Levin +--- + fs/exfat/namei.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/fs/exfat/namei.c b/fs/exfat/namei.c +index f5f1c4e8a29fd..d8964d7368142 100644 +--- a/fs/exfat/namei.c ++++ b/fs/exfat/namei.c +@@ -642,10 +642,14 @@ static int exfat_find(struct inode *dir, struct qstr *qname, + + info->type = exfat_get_entry_type(ep); + info->attr = le16_to_cpu(ep->dentry.file.attr); +- info->size = le64_to_cpu(ep2->dentry.stream.valid_size); + info->valid_size = le64_to_cpu(ep2->dentry.stream.valid_size); + info->size = le64_to_cpu(ep2->dentry.stream.size); + ++ if (info->valid_size < 0) { ++ exfat_fs_error(sb, "data valid size is invalid(%lld)", info->valid_size); ++ return -EIO; ++ } ++ + if (unlikely(EXFAT_B_TO_CLU_ROUND_UP(info->size, sbi) > sbi->used_clusters)) { + exfat_fs_error(sb, "data size is invalid(%lld)", info->size); + return -EIO; +-- +2.51.0 + diff --git a/queue-6.17/fs-return-eopnotsupp-from-file_setattr-file_getattr-.patch b/queue-6.17/fs-return-eopnotsupp-from-file_setattr-file_getattr-.patch new file mode 100644 index 0000000000..936d00f78e --- /dev/null +++ b/queue-6.17/fs-return-eopnotsupp-from-file_setattr-file_getattr-.patch @@ -0,0 +1,47 @@ +From ba2ca583dac790e402c0066589cf07ab80caf4f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 14:44:18 +0200 +Subject: fs: return EOPNOTSUPP from file_setattr/file_getattr syscalls + +From: Andrey Albershteyn + +[ Upstream commit d90ad28e8aa482e397150e22f3762173d918a724 ] + +These syscalls call to vfs_fileattr_get/set functions which return +ENOIOCTLCMD if filesystem doesn't support setting file attribute on an +inode. For syscalls EOPNOTSUPP would be more appropriate return error. + +Signed-off-by: Andrey Albershteyn +Reviewed-by: Jan Kara +Reviewed-by: Arnd Bergmann +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/file_attr.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/file_attr.c b/fs/file_attr.c +index 460b2dd21a852..1dcec88c06805 100644 +--- a/fs/file_attr.c ++++ b/fs/file_attr.c +@@ -416,6 +416,8 @@ SYSCALL_DEFINE5(file_getattr, int, dfd, const char __user *, filename, + } + + error = vfs_fileattr_get(filepath.dentry, &fa); ++ if (error == -ENOIOCTLCMD || error == -ENOTTY) ++ error = -EOPNOTSUPP; + if (error) + return error; + +@@ -483,6 +485,8 @@ SYSCALL_DEFINE5(file_setattr, int, dfd, const char __user *, filename, + if (!error) { + error = vfs_fileattr_set(mnt_idmap(filepath.mnt), + filepath.dentry, &fa); ++ if (error == -ENOIOCTLCMD || error == -ENOTTY) ++ error = -EOPNOTSUPP; + mnt_drop_write(filepath.mnt); + } + +-- +2.51.0 + diff --git a/queue-6.17/futex-optimize-per-cpu-reference-counting.patch b/queue-6.17/futex-optimize-per-cpu-reference-counting.patch new file mode 100644 index 0000000000..8fbe4d3446 --- /dev/null +++ b/queue-6.17/futex-optimize-per-cpu-reference-counting.patch @@ -0,0 +1,87 @@ +From ad4fb608493218389c5b8e19df02713234fda7c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Jul 2025 16:29:46 +0200 +Subject: futex: Optimize per-cpu reference counting + +From: Peter Zijlstra + +[ Upstream commit 4cb5ac2626b5704ed712ac1d46b9d89fdfc12c5d ] + +Shrikanth noted that the per-cpu reference counter was still some 10% +slower than the old immutable option (which removes the reference +counting entirely). + +Further optimize the per-cpu reference counter by: + + - switching from RCU to preempt; + - using __this_cpu_*() since we now have preempt disabled; + - switching from smp_load_acquire() to READ_ONCE(). + +This is all safe because disabling preemption inhibits the RCU grace +period exactly like rcu_read_lock(). + +Having preemption disabled allows using __this_cpu_*() provided the +only access to the variable is in task context -- which is the case +here. + +Furthermore, since we know changing fph->state to FR_ATOMIC demands a +full RCU grace period we can rely on the implied smp_mb() from that to +replace the acquire barrier(). + +This is very similar to the percpu_down_read_internal() fast-path. + +The reason this is significant for PowerPC is that it uses the generic +this_cpu_*() implementation which relies on local_irq_disable() (the +x86 implementation relies on it being a single memop instruction to be +IRQ-safe). Switching to preempt_disable() and __this_cpu*() avoids +this IRQ state swizzling. Also, PowerPC needs LWSYNC for the ACQUIRE +barrier, not having to use explicit barriers safes a bunch. + +Combined this reduces the performance gap by half, down to some 5%. + +Fixes: 760e6f7befba ("futex: Remove support for IMMUTABLE") +Reported-by: Shrikanth Hegde +Tested-by: Shrikanth Hegde +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Sebastian Andrzej Siewior +Link: https://patch.msgid.link/20251106092929.GR4067720@noisy.programming.kicks-ass.net +Signed-off-by: Sasha Levin +--- + kernel/futex/core.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/kernel/futex/core.c b/kernel/futex/core.c +index 125804fbb5cb1..2e77a6e5c8657 100644 +--- a/kernel/futex/core.c ++++ b/kernel/futex/core.c +@@ -1680,10 +1680,10 @@ static bool futex_ref_get(struct futex_private_hash *fph) + { + struct mm_struct *mm = fph->mm; + +- guard(rcu)(); ++ guard(preempt)(); + +- if (smp_load_acquire(&fph->state) == FR_PERCPU) { +- this_cpu_inc(*mm->futex_ref); ++ if (READ_ONCE(fph->state) == FR_PERCPU) { ++ __this_cpu_inc(*mm->futex_ref); + return true; + } + +@@ -1694,10 +1694,10 @@ static bool futex_ref_put(struct futex_private_hash *fph) + { + struct mm_struct *mm = fph->mm; + +- guard(rcu)(); ++ guard(preempt)(); + +- if (smp_load_acquire(&fph->state) == FR_PERCPU) { +- this_cpu_dec(*mm->futex_ref); ++ if (READ_ONCE(fph->state) == FR_PERCPU) { ++ __this_cpu_dec(*mm->futex_ref); + return false; + } + +-- +2.51.0 + diff --git a/queue-6.17/hid-intel-thc-hid-intel-quickspi-add-arl-pci-device-.patch b/queue-6.17/hid-intel-thc-hid-intel-quickspi-add-arl-pci-device-.patch new file mode 100644 index 0000000000..daf5010821 --- /dev/null +++ b/queue-6.17/hid-intel-thc-hid-intel-quickspi-add-arl-pci-device-.patch @@ -0,0 +1,63 @@ +From c7d70d25938df908d5bad03dc792870ad98450e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 10:07:20 +0530 +Subject: HID: intel-thc-hid: intel-quickspi: Add ARL PCI Device Id's + +From: Abhishek Tamboli + +[ Upstream commit 50f1f782f8d621a90108340c632bcb6ab4307d2e ] + +Add the missing PCI ID for the quickspi device used on +the Lenovo Yoga Pro 9i 16IAH10. + +Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=220567 + +Signed-off-by: Abhishek Tamboli +Reviewed-by: Even Xu +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c | 6 ++++++ + drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h | 2 ++ + 2 files changed, 8 insertions(+) + +diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c +index 84314989dc534..14cabd5dc6ddb 100644 +--- a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c ++++ b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c +@@ -33,6 +33,10 @@ struct quickspi_driver_data ptl = { + .max_packet_size_value = MAX_PACKET_SIZE_VALUE_LNL, + }; + ++struct quickspi_driver_data arl = { ++ .max_packet_size_value = MAX_PACKET_SIZE_VALUE_MTL, ++}; ++ + /* THC QuickSPI ACPI method to get device properties */ + /* HIDSPI Method: {6e2ac436-0fcf-41af-a265-b32a220dcfab} */ + static guid_t hidspi_guid = +@@ -978,6 +982,8 @@ static const struct pci_device_id quickspi_pci_tbl[] = { + {PCI_DEVICE_DATA(INTEL, THC_PTL_U_DEVICE_ID_SPI_PORT2, &ptl), }, + {PCI_DEVICE_DATA(INTEL, THC_WCL_DEVICE_ID_SPI_PORT1, &ptl), }, + {PCI_DEVICE_DATA(INTEL, THC_WCL_DEVICE_ID_SPI_PORT2, &ptl), }, ++ {PCI_DEVICE_DATA(INTEL, THC_ARL_DEVICE_ID_SPI_PORT1, &arl), }, ++ {PCI_DEVICE_DATA(INTEL, THC_ARL_DEVICE_ID_SPI_PORT2, &arl), }, + {} + }; + MODULE_DEVICE_TABLE(pci, quickspi_pci_tbl); +diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h +index f3532d866749c..c30e1a42eb098 100644 +--- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h ++++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h +@@ -21,6 +21,8 @@ + #define PCI_DEVICE_ID_INTEL_THC_PTL_U_DEVICE_ID_SPI_PORT2 0xE44B + #define PCI_DEVICE_ID_INTEL_THC_WCL_DEVICE_ID_SPI_PORT1 0x4D49 + #define PCI_DEVICE_ID_INTEL_THC_WCL_DEVICE_ID_SPI_PORT2 0x4D4B ++#define PCI_DEVICE_ID_INTEL_THC_ARL_DEVICE_ID_SPI_PORT1 0x7749 ++#define PCI_DEVICE_ID_INTEL_THC_ARL_DEVICE_ID_SPI_PORT2 0x774B + + /* HIDSPI special ACPI parameters DSM methods */ + #define ACPI_QUICKSPI_REVISION_NUM 2 +-- +2.51.0 + diff --git a/queue-6.17/hid-logitech-hidpp-add-hidpp_quirk_reset_hi_res_scro.patch b/queue-6.17/hid-logitech-hidpp-add-hidpp_quirk_reset_hi_res_scro.patch new file mode 100644 index 0000000000..0b5ff00985 --- /dev/null +++ b/queue-6.17/hid-logitech-hidpp-add-hidpp_quirk_reset_hi_res_scro.patch @@ -0,0 +1,115 @@ +From ed27cc0856051778d146f5f88c04d0c2a46874f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Oct 2025 02:05:49 +0100 +Subject: HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL + +From: Stuart Hayhurst + +[ Upstream commit ed80cc4667ac997b84546e6d35f0a0ae525d239c ] + +The Logitech G502 Hero Wireless's high resolution scrolling resets after +being unplugged without notifying the driver, causing extremely slow +scrolling. + +The only indication of this is a battery update packet, so add a quirk to +detect when the device is unplugged and re-enable the scrolling. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=218037 +Signed-off-by: Stuart Hayhurst +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-logitech-hidpp.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index aaef405a717ee..5e763de4b94fd 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -75,6 +75,7 @@ MODULE_PARM_DESC(disable_tap_to_click, + #define HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS BIT(27) + #define HIDPP_QUIRK_HI_RES_SCROLL_1P0 BIT(28) + #define HIDPP_QUIRK_WIRELESS_STATUS BIT(29) ++#define HIDPP_QUIRK_RESET_HI_RES_SCROLL BIT(30) + + /* These are just aliases for now */ + #define HIDPP_QUIRK_KBD_SCROLL_WHEEL HIDPP_QUIRK_HIDPP_WHEELS +@@ -193,6 +194,7 @@ struct hidpp_device { + void *private_data; + + struct work_struct work; ++ struct work_struct reset_hi_res_work; + struct kfifo delayed_work_fifo; + struct input_dev *delayed_input; + +@@ -3836,6 +3838,7 @@ static int hidpp_raw_hidpp_event(struct hidpp_device *hidpp, u8 *data, + struct hidpp_report *answer = hidpp->send_receive_buf; + struct hidpp_report *report = (struct hidpp_report *)data; + int ret; ++ int last_online; + + /* + * If the mutex is locked then we have a pending answer from a +@@ -3877,6 +3880,7 @@ static int hidpp_raw_hidpp_event(struct hidpp_device *hidpp, u8 *data, + "See: https://gitlab.freedesktop.org/jwrdegoede/logitech-27mhz-keyboard-encryption-setup/\n"); + } + ++ last_online = hidpp->battery.online; + if (hidpp->capabilities & HIDPP_CAPABILITY_HIDPP20_BATTERY) { + ret = hidpp20_battery_event_1000(hidpp, data, size); + if (ret != 0) +@@ -3901,6 +3905,11 @@ static int hidpp_raw_hidpp_event(struct hidpp_device *hidpp, u8 *data, + return ret; + } + ++ if (hidpp->quirks & HIDPP_QUIRK_RESET_HI_RES_SCROLL) { ++ if (last_online == 0 && hidpp->battery.online == 1) ++ schedule_work(&hidpp->reset_hi_res_work); ++ } ++ + if (hidpp->quirks & HIDPP_QUIRK_HIDPP_WHEELS) { + ret = hidpp10_wheel_raw_event(hidpp, data, size); + if (ret != 0) +@@ -4274,6 +4283,13 @@ static void hidpp_connect_event(struct work_struct *work) + hidpp->delayed_input = input; + } + ++static void hidpp_reset_hi_res_handler(struct work_struct *work) ++{ ++ struct hidpp_device *hidpp = container_of(work, struct hidpp_device, reset_hi_res_work); ++ ++ hi_res_scroll_enable(hidpp); ++} ++ + static DEVICE_ATTR(builtin_power_supply, 0000, NULL, NULL); + + static struct attribute *sysfs_attrs[] = { +@@ -4404,6 +4420,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) + } + + INIT_WORK(&hidpp->work, hidpp_connect_event); ++ INIT_WORK(&hidpp->reset_hi_res_work, hidpp_reset_hi_res_handler); + mutex_init(&hidpp->send_mutex); + init_waitqueue_head(&hidpp->wait); + +@@ -4499,6 +4516,7 @@ static void hidpp_remove(struct hid_device *hdev) + + hid_hw_stop(hdev); + cancel_work_sync(&hidpp->work); ++ cancel_work_sync(&hidpp->reset_hi_res_work); + mutex_destroy(&hidpp->send_mutex); + } + +@@ -4546,6 +4564,9 @@ static const struct hid_device_id hidpp_devices[] = { + { /* Keyboard MX5500 (Bluetooth-receiver in HID proxy mode) */ + LDJ_DEVICE(0xb30b), + .driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS }, ++ { /* Logitech G502 Lightspeed Wireless Gaming Mouse */ ++ LDJ_DEVICE(0x407f), ++ .driver_data = HIDPP_QUIRK_RESET_HI_RES_SCROLL }, + + { LDJ_DEVICE(HID_ANY_ID) }, + +-- +2.51.0 + diff --git a/queue-6.17/hid-nintendo-wait-longer-for-initial-probe.patch b/queue-6.17/hid-nintendo-wait-longer-for-initial-probe.patch new file mode 100644 index 0000000000..0e48d020e5 --- /dev/null +++ b/queue-6.17/hid-nintendo-wait-longer-for-initial-probe.patch @@ -0,0 +1,37 @@ +From 93d4e96d17370223865894dccc575c0dc402e4ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Oct 2025 18:05:32 -0700 +Subject: HID: nintendo: Wait longer for initial probe + +From: Vicki Pfau + +[ Upstream commit b73bc6a51f0c0066912c7e181acee41091c70fe6 ] + +Some third-party controllers, such as the PB Tails CHOC, won't always +respond quickly on startup. Since this packet is needed for probe, and only +once during probe, let's just wait an extra second, which makes connecting +consistent. + +Signed-off-by: Vicki Pfau +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-nintendo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-nintendo.c b/drivers/hid/hid-nintendo.c +index fb4985988615b..e3e54f1df44fa 100644 +--- a/drivers/hid/hid-nintendo.c ++++ b/drivers/hid/hid-nintendo.c +@@ -2420,7 +2420,7 @@ static int joycon_read_info(struct joycon_ctlr *ctlr) + struct joycon_input_report *report; + + req.subcmd_id = JC_SUBCMD_REQ_DEV_INFO; +- ret = joycon_send_subcmd(ctlr, &req, 0, HZ); ++ ret = joycon_send_subcmd(ctlr, &req, 0, 2 * HZ); + if (ret) { + hid_err(ctlr->hdev, "Failed to get joycon info; ret=%d\n", ret); + return ret; +-- +2.51.0 + diff --git a/queue-6.17/hid-quirks-add-always_poll-quirk-for-vrs-r295-steeri.patch b/queue-6.17/hid-quirks-add-always_poll-quirk-for-vrs-r295-steeri.patch new file mode 100644 index 0000000000..ef4c8ed597 --- /dev/null +++ b/queue-6.17/hid-quirks-add-always_poll-quirk-for-vrs-r295-steeri.patch @@ -0,0 +1,47 @@ +From a7988fd034b9e2337d50ccb91e3404e73f150313 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 18:46:11 +0300 +Subject: HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel + +From: Oleg Makarenko + +[ Upstream commit 1141ed52348d3df82d3fd2316128b3fc6203a68c ] + +This patch adds ALWAYS_POLL quirk for the VRS R295 steering wheel joystick. +This device reboots itself every 8-10 seconds if it is not polled. + +Signed-off-by: Oleg Makarenko +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-quirks.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index d05a62bbafffb..0723b4b1c9eca 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -1435,6 +1435,7 @@ + + #define USB_VENDOR_ID_VRS 0x0483 + #define USB_DEVICE_ID_VRS_DFP 0xa355 ++#define USB_DEVICE_ID_VRS_R295 0xa44c + + #define USB_VENDOR_ID_VTL 0x0306 + #define USB_DEVICE_ID_VTL_MULTITOUCH_FF3F 0xff3f +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index d7105a8395982..bcd4bccf1a7ce 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -207,6 +207,7 @@ static const struct hid_device_id hid_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_KNA5), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_TWA60), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, USB_DEVICE_ID_UGTIZER_TABLET_WP5540), HID_QUIRK_MULTI_INPUT }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_VRS, USB_DEVICE_ID_VRS_R295), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_10_6_INCH), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_14_1_INCH), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SIRIUS_BATTERY_FREE_TABLET), HID_QUIRK_MULTI_INPUT }, +-- +2.51.0 + diff --git a/queue-6.17/hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch b/queue-6.17/hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch new file mode 100644 index 0000000000..c7bc2ff13a --- /dev/null +++ b/queue-6.17/hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch @@ -0,0 +1,54 @@ +From 2dcf6130bbf2c3011a57cceb55722e695fa2bbb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Sep 2025 18:25:43 +0200 +Subject: HID: quirks: avoid Cooler Master MM712 dongle wakeup bug + +From: Tristan Lobb + +[ Upstream commit 0be4253bf878d9aaa2b96031ac8683fceeb81480 ] + +The Cooler Master Mice Dongle includes a vendor defined HID interface +alongside its mouse interface. Not polling it will cause the mouse to +stop responding to polls on any interface once woken up again after +going into power saving mode. + +Add the HID_QUIRK_ALWAYS_POLL quirk alongside the Cooler Master VID and +the Dongle's PID. + +Signed-off-by: Tristan Lobb +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 3 +++ + drivers/hid/hid-quirks.c | 1 + + 2 files changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 5721b8414bbdf..d05a62bbafffb 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -342,6 +342,9 @@ + #define USB_DEVICE_ID_CODEMERCS_IOW_FIRST 0x1500 + #define USB_DEVICE_ID_CODEMERCS_IOW_LAST 0x15ff + ++#define USB_VENDOR_ID_COOLER_MASTER 0x2516 ++#define USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE 0x01b7 ++ + #define USB_VENDOR_ID_CORSAIR 0x1b1c + #define USB_DEVICE_ID_CORSAIR_K90 0x1b02 + #define USB_DEVICE_ID_CORSAIR_K70R 0x1b09 +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index ffd034566e2e1..d7105a8395982 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -57,6 +57,7 @@ static const struct hid_device_id hid_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_THROTTLE), HID_QUIRK_NOGET }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_COOLER_MASTER, USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB), HID_QUIRK_NO_INIT_REPORTS }, + { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE), HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB), HID_QUIRK_NO_INIT_REPORTS }, +-- +2.51.0 + diff --git a/queue-6.17/io_uring-fix-unexpected-placement-on-same-size-resiz.patch b/queue-6.17/io_uring-fix-unexpected-placement-on-same-size-resiz.patch new file mode 100644 index 0000000000..0cb67a535e --- /dev/null +++ b/queue-6.17/io_uring-fix-unexpected-placement-on-same-size-resiz.patch @@ -0,0 +1,42 @@ +From 1cd191e1e68b4ee388d1fc2fb8b10c13d089f354 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Oct 2025 13:10:31 +0100 +Subject: io_uring: fix unexpected placement on same size resizing + +From: Pavel Begunkov + +[ Upstream commit 437c23357d897f5b5b7d297c477da44b56654d46 ] + +There might be many reasons why a user is resizing a ring, e.g. moving +to huge pages or for some memory compaction using IORING_SETUP_NO_MMAP. +Don't bypass resizing, the user will definitely be surprised seeing 0 +while the rings weren't actually moved to a new place. + +Signed-off-by: Pavel Begunkov +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/register.c | 7 ------- + 1 file changed, 7 deletions(-) + +diff --git a/io_uring/register.c b/io_uring/register.c +index b1772a470bf6e..dacbe8596b5c2 100644 +--- a/io_uring/register.c ++++ b/io_uring/register.c +@@ -426,13 +426,6 @@ static int io_register_resize_rings(struct io_ring_ctx *ctx, void __user *arg) + if (unlikely(ret)) + return ret; + +- /* nothing to do, but copy params back */ +- if (p.sq_entries == ctx->sq_entries && p.cq_entries == ctx->cq_entries) { +- if (copy_to_user(arg, &p, sizeof(p))) +- return -EFAULT; +- return 0; +- } +- + size = rings_size(p.flags, p.sq_entries, p.cq_entries, + &sq_array_offset); + if (size == SIZE_MAX) +-- +2.51.0 + diff --git a/queue-6.17/iommufd-make-vfio_compat-s-unmap-succeed-if-the-rang.patch b/queue-6.17/iommufd-make-vfio_compat-s-unmap-succeed-if-the-rang.patch new file mode 100644 index 0000000000..846275627c --- /dev/null +++ b/queue-6.17/iommufd-make-vfio_compat-s-unmap-succeed-if-the-rang.patch @@ -0,0 +1,96 @@ +From 54b7bd7b656edb0852aec59777940f2be8a85f2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Nov 2025 14:11:49 -0400 +Subject: iommufd: Make vfio_compat's unmap succeed if the range is already + empty + +From: Jason Gunthorpe + +[ Upstream commit afb47765f9235181fddc61c8633b5a8cfae29fd2 ] + +iommufd returns ENOENT when attempting to unmap a range that is already +empty, while vfio type1 returns success. Fix vfio_compat to match. + +Fixes: d624d6652a65 ("iommufd: vfio container FD ioctl compatibility") +Link: https://patch.msgid.link/r/0-v1-76be45eff0be+5d-iommufd_unmap_compat_jgg@nvidia.com +Reviewed-by: Nicolin Chen +Reviewed-by: Alex Mastro +Reported-by: Alex Mastro +Closes: https://lore.kernel.org/r/aP0S5ZF9l3sWkJ1G@devgpu012.nha5.facebook.com +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/iommu/iommufd/io_pagetable.c | 12 +++--------- + drivers/iommu/iommufd/ioas.c | 4 ++++ + tools/testing/selftests/iommu/iommufd.c | 2 ++ + 3 files changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/iommu/iommufd/io_pagetable.c b/drivers/iommu/iommufd/io_pagetable.c +index c0360c450880b..75d60f2ad9008 100644 +--- a/drivers/iommu/iommufd/io_pagetable.c ++++ b/drivers/iommu/iommufd/io_pagetable.c +@@ -707,7 +707,8 @@ static int iopt_unmap_iova_range(struct io_pagetable *iopt, unsigned long start, + struct iopt_area *area; + unsigned long unmapped_bytes = 0; + unsigned int tries = 0; +- int rc = -ENOENT; ++ /* If there are no mapped entries then success */ ++ int rc = 0; + + /* + * The domains_rwsem must be held in read mode any time any area->pages +@@ -777,8 +778,6 @@ static int iopt_unmap_iova_range(struct io_pagetable *iopt, unsigned long start, + + down_write(&iopt->iova_rwsem); + } +- if (unmapped_bytes) +- rc = 0; + + out_unlock_iova: + up_write(&iopt->iova_rwsem); +@@ -815,13 +814,8 @@ int iopt_unmap_iova(struct io_pagetable *iopt, unsigned long iova, + + int iopt_unmap_all(struct io_pagetable *iopt, unsigned long *unmapped) + { +- int rc; +- +- rc = iopt_unmap_iova_range(iopt, 0, ULONG_MAX, unmapped); + /* If the IOVAs are empty then unmap all succeeds */ +- if (rc == -ENOENT) +- return 0; +- return rc; ++ return iopt_unmap_iova_range(iopt, 0, ULONG_MAX, unmapped); + } + + /* The caller must always free all the nodes in the allowed_iova rb_root. */ +diff --git a/drivers/iommu/iommufd/ioas.c b/drivers/iommu/iommufd/ioas.c +index 1542c5fd10a85..459a7c5169154 100644 +--- a/drivers/iommu/iommufd/ioas.c ++++ b/drivers/iommu/iommufd/ioas.c +@@ -367,6 +367,10 @@ int iommufd_ioas_unmap(struct iommufd_ucmd *ucmd) + &unmapped); + if (rc) + goto out_put; ++ if (!unmapped) { ++ rc = -ENOENT; ++ goto out_put; ++ } + } + + cmd->length = unmapped; +diff --git a/tools/testing/selftests/iommu/iommufd.c b/tools/testing/selftests/iommu/iommufd.c +index 3eebf5e3b974f..bb4d33dde3c89 100644 +--- a/tools/testing/selftests/iommu/iommufd.c ++++ b/tools/testing/selftests/iommu/iommufd.c +@@ -2638,6 +2638,8 @@ TEST_F(vfio_compat_mock_domain, map) + ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_MAP_DMA, &map_cmd)); + ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_UNMAP_DMA, &unmap_cmd)); + ASSERT_EQ(BUFFER_SIZE, unmap_cmd.size); ++ /* Unmap of empty is success */ ++ ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_UNMAP_DMA, &unmap_cmd)); + + /* UNMAP_FLAG_ALL requires 0 iova/size */ + ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_MAP_DMA, &map_cmd)); +-- +2.51.0 + diff --git a/queue-6.17/iommufd-selftest-fix-ioctl-return-value-in-_test_cmd.patch b/queue-6.17/iommufd-selftest-fix-ioctl-return-value-in-_test_cmd.patch new file mode 100644 index 0000000000..5db3611cd5 --- /dev/null +++ b/queue-6.17/iommufd-selftest-fix-ioctl-return-value-in-_test_cmd.patch @@ -0,0 +1,42 @@ +From 14db657b771530a7b3aac67a559846a93609d957 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 14:48:46 -0700 +Subject: iommufd/selftest: Fix ioctl return value in + _test_cmd_trigger_vevents() + +From: Nicolin Chen + +[ Upstream commit b09ed52db1e688eb8205b1939ca1345179ecd515 ] + +The ioctl returns 0 upon success, so !0 returning -1 breaks the selftest. + +Drop the '!' to fix it. + +Fixes: 1d235d849425 ("iommu/selftest: prevent use of uninitialized variable") +Link: https://patch.msgid.link/r/20251014214847.1113759-1-nicolinc@nvidia.com +Signed-off-by: Nicolin Chen +Reviewed-by: Kevin Tian +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/iommu/iommufd_utils.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/iommu/iommufd_utils.h b/tools/testing/selftests/iommu/iommufd_utils.h +index 772ca1db6e597..9f472c20c1905 100644 +--- a/tools/testing/selftests/iommu/iommufd_utils.h ++++ b/tools/testing/selftests/iommu/iommufd_utils.h +@@ -1044,8 +1044,8 @@ static int _test_cmd_trigger_vevents(int fd, __u32 dev_id, __u32 nvevents) + }; + + while (nvevents--) { +- if (!ioctl(fd, _IOMMU_TEST_CMD(IOMMU_TEST_OP_TRIGGER_VEVENT), +- &trigger_vevent_cmd)) ++ if (ioctl(fd, _IOMMU_TEST_CMD(IOMMU_TEST_OP_TRIGGER_VEVENT), ++ &trigger_vevent_cmd)) + return -1; + } + return 0; +-- +2.51.0 + diff --git a/queue-6.17/ixgbe-handle-ixgbe_vf_features_negotiate-mbox-cmd.patch b/queue-6.17/ixgbe-handle-ixgbe_vf_features_negotiate-mbox-cmd.patch new file mode 100644 index 0000000000..d083942c98 --- /dev/null +++ b/queue-6.17/ixgbe-handle-ixgbe_vf_features_negotiate-mbox-cmd.patch @@ -0,0 +1,175 @@ +From aaa4fe7863f7c00456c53d957dd7d6e4b6fe98e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 17:03:50 -0700 +Subject: ixgbe: handle IXGBE_VF_FEATURES_NEGOTIATE mbox cmd + +From: Jedrzej Jagielski + +[ Upstream commit 823be089f9c8ab136ba382b516aedd3f7ac854bd ] + +Send to VF information about features supported by the PF driver. + +Increase API version to 1.7. + +Reviewed-by: Przemek Kitszel +Reviewed-by: Aleksandr Loktionov +Signed-off-by: Jedrzej Jagielski +Tested-by: Rafal Romanowski +Signed-off-by: Jacob Keller +Link: https://patch.msgid.link/20251009-jk-iwl-net-2025-10-01-v3-5-ef32a425b92a@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h | 10 +++++ + .../net/ethernet/intel/ixgbe/ixgbe_sriov.c | 37 +++++++++++++++++++ + 2 files changed, 47 insertions(+) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h +index f7256a339c99b..0334ed4b8fa39 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h +@@ -52,6 +52,7 @@ enum ixgbe_pfvf_api_rev { + ixgbe_mbox_api_14, /* API version 1.4, linux/freebsd VF driver */ + ixgbe_mbox_api_15, /* API version 1.5, linux/freebsd VF driver */ + ixgbe_mbox_api_16, /* API version 1.6, linux/freebsd VF driver */ ++ ixgbe_mbox_api_17, /* API version 1.7, linux/freebsd VF driver */ + /* This value should always be last */ + ixgbe_mbox_api_unknown, /* indicates that API version is not known */ + }; +@@ -91,6 +92,9 @@ enum ixgbe_pfvf_api_rev { + /* mailbox API, version 1.6 VF requests */ + #define IXGBE_VF_GET_PF_LINK_STATE 0x11 /* request PF to send link info */ + ++/* mailbox API, version 1.7 VF requests */ ++#define IXGBE_VF_FEATURES_NEGOTIATE 0x12 /* get features supported by PF */ ++ + /* length of permanent address message returned from PF */ + #define IXGBE_VF_PERMADDR_MSG_LEN 4 + /* word in permanent address message with the current multicast type */ +@@ -101,6 +105,12 @@ enum ixgbe_pfvf_api_rev { + #define IXGBE_VF_MBX_INIT_TIMEOUT 2000 /* number of retries on mailbox */ + #define IXGBE_VF_MBX_INIT_DELAY 500 /* microseconds between retries */ + ++/* features negotiated between PF/VF */ ++#define IXGBEVF_PF_SUP_IPSEC BIT(0) ++#define IXGBEVF_PF_SUP_ESX_MBX BIT(1) ++ ++#define IXGBE_SUPPORTED_FEATURES IXGBEVF_PF_SUP_IPSEC ++ + struct ixgbe_hw; + + int ixgbe_read_mbx(struct ixgbe_hw *, u32 *, u16, u16); +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c +index b09271d61a4ef..ee133d6749b37 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c +@@ -511,6 +511,7 @@ static int ixgbe_set_vf_lpe(struct ixgbe_adapter *adapter, u32 max_frame, u32 vf + case ixgbe_mbox_api_13: + case ixgbe_mbox_api_14: + case ixgbe_mbox_api_16: ++ case ixgbe_mbox_api_17: + /* Version 1.1 supports jumbo frames on VFs if PF has + * jumbo frames enabled which means legacy VFs are + * disabled +@@ -1048,6 +1049,7 @@ static int ixgbe_negotiate_vf_api(struct ixgbe_adapter *adapter, + case ixgbe_mbox_api_13: + case ixgbe_mbox_api_14: + case ixgbe_mbox_api_16: ++ case ixgbe_mbox_api_17: + adapter->vfinfo[vf].vf_api = api; + return 0; + default: +@@ -1075,6 +1077,7 @@ static int ixgbe_get_vf_queues(struct ixgbe_adapter *adapter, + case ixgbe_mbox_api_13: + case ixgbe_mbox_api_14: + case ixgbe_mbox_api_16: ++ case ixgbe_mbox_api_17: + break; + default: + return -1; +@@ -1115,6 +1118,7 @@ static int ixgbe_get_vf_reta(struct ixgbe_adapter *adapter, u32 *msgbuf, u32 vf) + + /* verify the PF is supporting the correct API */ + switch (adapter->vfinfo[vf].vf_api) { ++ case ixgbe_mbox_api_17: + case ixgbe_mbox_api_16: + case ixgbe_mbox_api_14: + case ixgbe_mbox_api_13: +@@ -1149,6 +1153,7 @@ static int ixgbe_get_vf_rss_key(struct ixgbe_adapter *adapter, + + /* verify the PF is supporting the correct API */ + switch (adapter->vfinfo[vf].vf_api) { ++ case ixgbe_mbox_api_17: + case ixgbe_mbox_api_16: + case ixgbe_mbox_api_14: + case ixgbe_mbox_api_13: +@@ -1180,6 +1185,7 @@ static int ixgbe_update_vf_xcast_mode(struct ixgbe_adapter *adapter, + case ixgbe_mbox_api_13: + case ixgbe_mbox_api_14: + case ixgbe_mbox_api_16: ++ case ixgbe_mbox_api_17: + break; + default: + return -EOPNOTSUPP; +@@ -1251,6 +1257,7 @@ static int ixgbe_get_vf_link_state(struct ixgbe_adapter *adapter, + case ixgbe_mbox_api_13: + case ixgbe_mbox_api_14: + case ixgbe_mbox_api_16: ++ case ixgbe_mbox_api_17: + break; + default: + return -EOPNOTSUPP; +@@ -1278,6 +1285,7 @@ static int ixgbe_send_vf_link_status(struct ixgbe_adapter *adapter, + + switch (adapter->vfinfo[vf].vf_api) { + case ixgbe_mbox_api_16: ++ case ixgbe_mbox_api_17: + if (hw->mac.type != ixgbe_mac_e610) + return -EOPNOTSUPP; + break; +@@ -1293,6 +1301,32 @@ static int ixgbe_send_vf_link_status(struct ixgbe_adapter *adapter, + return 0; + } + ++/** ++ * ixgbe_negotiate_vf_features - negotiate supported features with VF driver ++ * @adapter: pointer to adapter struct ++ * @msgbuf: pointer to message buffers ++ * @vf: VF identifier ++ * ++ * Return: 0 on success or -EOPNOTSUPP when operation is not supported. ++ */ ++static int ixgbe_negotiate_vf_features(struct ixgbe_adapter *adapter, ++ u32 *msgbuf, u32 vf) ++{ ++ u32 features = msgbuf[1]; ++ ++ switch (adapter->vfinfo[vf].vf_api) { ++ case ixgbe_mbox_api_17: ++ break; ++ default: ++ return -EOPNOTSUPP; ++ } ++ ++ features &= IXGBE_SUPPORTED_FEATURES; ++ msgbuf[1] = features; ++ ++ return 0; ++} ++ + static int ixgbe_rcv_msg_from_vf(struct ixgbe_adapter *adapter, u32 vf) + { + u32 mbx_size = IXGBE_VFMAILBOX_SIZE; +@@ -1370,6 +1404,9 @@ static int ixgbe_rcv_msg_from_vf(struct ixgbe_adapter *adapter, u32 vf) + case IXGBE_VF_GET_PF_LINK_STATE: + retval = ixgbe_send_vf_link_status(adapter, msgbuf, vf); + break; ++ case IXGBE_VF_FEATURES_NEGOTIATE: ++ retval = ixgbe_negotiate_vf_features(adapter, msgbuf, vf); ++ break; + default: + e_err(drv, "Unhandled Msg %8.8x\n", msgbuf[0]); + retval = -EIO; +-- +2.51.0 + diff --git a/queue-6.17/ixgbe-handle-ixgbe_vf_get_pf_link_state-mailbox-oper.patch b/queue-6.17/ixgbe-handle-ixgbe_vf_get_pf_link_state-mailbox-oper.patch new file mode 100644 index 0000000000..e4f549019c --- /dev/null +++ b/queue-6.17/ixgbe-handle-ixgbe_vf_get_pf_link_state-mailbox-oper.patch @@ -0,0 +1,162 @@ +From e1186c67763b4c84716b67cf2d8ca19a6c112e2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 17:03:48 -0700 +Subject: ixgbe: handle IXGBE_VF_GET_PF_LINK_STATE mailbox operation + +From: Jedrzej Jagielski + +[ Upstream commit f7f97cbc03a470ce405d48dedb7f135713caa0fa ] + +Update supported API version and provide handler for +IXGBE_VF_GET_PF_LINK_STATE cmd. +Simply put stored values of link speed and link_up from adapter context. + +Reviewed-by: Przemek Kitszel +Reviewed-by: Aleksandr Loktionov +Signed-off-by: Jedrzej Jagielski +Link: https://lore.kernel.org/stable/20250828095227.1857066-3-jedrzej.jagielski%40intel.com +Tested-by: Rafal Romanowski +Signed-off-by: Jacob Keller +Link: https://patch.msgid.link/20251009-jk-iwl-net-2025-10-01-v3-3-ef32a425b92a@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h | 5 +++ + .../net/ethernet/intel/ixgbe/ixgbe_sriov.c | 42 +++++++++++++++++++ + 2 files changed, 47 insertions(+) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h +index 4af149b63a39f..f7256a339c99b 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h +@@ -50,6 +50,8 @@ enum ixgbe_pfvf_api_rev { + ixgbe_mbox_api_12, /* API version 1.2, linux/freebsd VF driver */ + ixgbe_mbox_api_13, /* API version 1.3, linux/freebsd VF driver */ + ixgbe_mbox_api_14, /* API version 1.4, linux/freebsd VF driver */ ++ ixgbe_mbox_api_15, /* API version 1.5, linux/freebsd VF driver */ ++ ixgbe_mbox_api_16, /* API version 1.6, linux/freebsd VF driver */ + /* This value should always be last */ + ixgbe_mbox_api_unknown, /* indicates that API version is not known */ + }; +@@ -86,6 +88,9 @@ enum ixgbe_pfvf_api_rev { + + #define IXGBE_VF_GET_LINK_STATE 0x10 /* get vf link state */ + ++/* mailbox API, version 1.6 VF requests */ ++#define IXGBE_VF_GET_PF_LINK_STATE 0x11 /* request PF to send link info */ ++ + /* length of permanent address message returned from PF */ + #define IXGBE_VF_PERMADDR_MSG_LEN 4 + /* word in permanent address message with the current multicast type */ +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c +index 32ac1e020d915..b09271d61a4ef 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c +@@ -510,6 +510,7 @@ static int ixgbe_set_vf_lpe(struct ixgbe_adapter *adapter, u32 max_frame, u32 vf + case ixgbe_mbox_api_12: + case ixgbe_mbox_api_13: + case ixgbe_mbox_api_14: ++ case ixgbe_mbox_api_16: + /* Version 1.1 supports jumbo frames on VFs if PF has + * jumbo frames enabled which means legacy VFs are + * disabled +@@ -1046,6 +1047,7 @@ static int ixgbe_negotiate_vf_api(struct ixgbe_adapter *adapter, + case ixgbe_mbox_api_12: + case ixgbe_mbox_api_13: + case ixgbe_mbox_api_14: ++ case ixgbe_mbox_api_16: + adapter->vfinfo[vf].vf_api = api; + return 0; + default: +@@ -1072,6 +1074,7 @@ static int ixgbe_get_vf_queues(struct ixgbe_adapter *adapter, + case ixgbe_mbox_api_12: + case ixgbe_mbox_api_13: + case ixgbe_mbox_api_14: ++ case ixgbe_mbox_api_16: + break; + default: + return -1; +@@ -1112,6 +1115,7 @@ static int ixgbe_get_vf_reta(struct ixgbe_adapter *adapter, u32 *msgbuf, u32 vf) + + /* verify the PF is supporting the correct API */ + switch (adapter->vfinfo[vf].vf_api) { ++ case ixgbe_mbox_api_16: + case ixgbe_mbox_api_14: + case ixgbe_mbox_api_13: + case ixgbe_mbox_api_12: +@@ -1145,6 +1149,7 @@ static int ixgbe_get_vf_rss_key(struct ixgbe_adapter *adapter, + + /* verify the PF is supporting the correct API */ + switch (adapter->vfinfo[vf].vf_api) { ++ case ixgbe_mbox_api_16: + case ixgbe_mbox_api_14: + case ixgbe_mbox_api_13: + case ixgbe_mbox_api_12: +@@ -1174,6 +1179,7 @@ static int ixgbe_update_vf_xcast_mode(struct ixgbe_adapter *adapter, + fallthrough; + case ixgbe_mbox_api_13: + case ixgbe_mbox_api_14: ++ case ixgbe_mbox_api_16: + break; + default: + return -EOPNOTSUPP; +@@ -1244,6 +1250,7 @@ static int ixgbe_get_vf_link_state(struct ixgbe_adapter *adapter, + case ixgbe_mbox_api_12: + case ixgbe_mbox_api_13: + case ixgbe_mbox_api_14: ++ case ixgbe_mbox_api_16: + break; + default: + return -EOPNOTSUPP; +@@ -1254,6 +1261,38 @@ static int ixgbe_get_vf_link_state(struct ixgbe_adapter *adapter, + return 0; + } + ++/** ++ * ixgbe_send_vf_link_status - send link status data to VF ++ * @adapter: pointer to adapter struct ++ * @msgbuf: pointer to message buffers ++ * @vf: VF identifier ++ * ++ * Reply for IXGBE_VF_GET_PF_LINK_STATE mbox command sending link status data. ++ * ++ * Return: 0 on success or -EOPNOTSUPP when operation is not supported. ++ */ ++static int ixgbe_send_vf_link_status(struct ixgbe_adapter *adapter, ++ u32 *msgbuf, u32 vf) ++{ ++ struct ixgbe_hw *hw = &adapter->hw; ++ ++ switch (adapter->vfinfo[vf].vf_api) { ++ case ixgbe_mbox_api_16: ++ if (hw->mac.type != ixgbe_mac_e610) ++ return -EOPNOTSUPP; ++ break; ++ default: ++ return -EOPNOTSUPP; ++ } ++ /* Simply provide stored values as watchdog & link status events take ++ * care of its freshness. ++ */ ++ msgbuf[1] = adapter->link_speed; ++ msgbuf[2] = adapter->link_up; ++ ++ return 0; ++} ++ + static int ixgbe_rcv_msg_from_vf(struct ixgbe_adapter *adapter, u32 vf) + { + u32 mbx_size = IXGBE_VFMAILBOX_SIZE; +@@ -1328,6 +1367,9 @@ static int ixgbe_rcv_msg_from_vf(struct ixgbe_adapter *adapter, u32 vf) + case IXGBE_VF_IPSEC_DEL: + retval = ixgbe_ipsec_vf_del_sa(adapter, msgbuf, vf); + break; ++ case IXGBE_VF_GET_PF_LINK_STATE: ++ retval = ixgbe_send_vf_link_status(adapter, msgbuf, vf); ++ break; + default: + e_err(drv, "Unhandled Msg %8.8x\n", msgbuf[0]); + retval = -EIO; +-- +2.51.0 + diff --git a/queue-6.17/nfs-check-if-suid-sgid-was-cleared-after-a-write-as-.patch b/queue-6.17/nfs-check-if-suid-sgid-was-cleared-after-a-write-as-.patch new file mode 100644 index 0000000000..321e532b8f --- /dev/null +++ b/queue-6.17/nfs-check-if-suid-sgid-was-cleared-after-a-write-as-.patch @@ -0,0 +1,45 @@ +From 19fa4a6709afe41cdb540dba35bf017345f55fd2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 16:42:12 -0400 +Subject: NFS: check if suid/sgid was cleared after a write as needed + +From: Scott Mayhew + +[ Upstream commit 9ff022f3820a31507cb93be6661bf5f3ca0609a4 ] + +I noticed xfstests generic/193 and generic/355 started failing against +knfsd after commit e7a8ebc305f2 ("NFSD: Offer write delegation for OPEN +with OPEN4_SHARE_ACCESS_WRITE"). + +I ran those same tests against ONTAP (which has had write delegation +support for a lot longer than knfsd) and they fail there too... so +while it's a new failure against knfsd, it isn't an entirely new +failure. + +Add the NFS_INO_REVAL_FORCED flag so that the presence of a delegation +doesn't keep the inode from being revalidated to fetch the updated mode. + +Signed-off-by: Scott Mayhew +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/write.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/nfs/write.c b/fs/nfs/write.c +index 647c53d1418ae..d9edcc36b0b44 100644 +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -1521,7 +1521,8 @@ static int nfs_writeback_done(struct rpc_task *task, + /* Deal with the suid/sgid bit corner case */ + if (nfs_should_remove_suid(inode)) { + spin_lock(&inode->i_lock); +- nfs_set_cache_invalid(inode, NFS_INO_INVALID_MODE); ++ nfs_set_cache_invalid(inode, NFS_INO_INVALID_MODE ++ | NFS_INO_REVAL_FORCED); + spin_unlock(&inode->i_lock); + } + return 0; +-- +2.51.0 + diff --git a/queue-6.17/nfs4-apply-delay_retrans-to-async-operations.patch b/queue-6.17/nfs4-apply-delay_retrans-to-async-operations.patch new file mode 100644 index 0000000000..e55503a66a --- /dev/null +++ b/queue-6.17/nfs4-apply-delay_retrans-to-async-operations.patch @@ -0,0 +1,146 @@ +From 909386a42d14cf412aa95932a8a6a27b330a2418 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 15:22:58 -0600 +Subject: NFS4: Apply delay_retrans to async operations + +From: Joshua Watt + +[ Upstream commit 7a84394f02ab1985ebbe0a8d6f6d69bd040de4b3 ] + +The setting of delay_retrans is applied to synchronous RPC operations +because the retransmit count is stored in same struct nfs4_exception +that is passed each time an error is checked. However, for asynchronous +operations (READ, WRITE, LOCKU, CLOSE, DELEGRETURN), a new struct +nfs4_exception is made on the stack each time the task callback is +invoked. This means that the retransmit count is always zero and thus +delay_retrans never takes effect. + +Apply delay_retrans to these operations by tracking and updating their +retransmit count. + +Change-Id: Ieb33e046c2b277cb979caa3faca7f52faf0568c9 +Signed-off-by: Joshua Watt +Reviewed-by: Benjamin Coddington +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 13 +++++++++++++ + include/linux/nfs_xdr.h | 1 + + 2 files changed, 14 insertions(+) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index b76da06864e53..e5fa29dcdd114 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -3636,6 +3636,7 @@ struct nfs4_closedata { + } lr; + struct nfs_fattr fattr; + unsigned long timestamp; ++ unsigned short retrans; + }; + + static void nfs4_free_closedata(void *data) +@@ -3664,6 +3665,7 @@ static void nfs4_close_done(struct rpc_task *task, void *data) + .state = state, + .inode = calldata->inode, + .stateid = &calldata->arg.stateid, ++ .retrans = calldata->retrans, + }; + + if (!nfs4_sequence_done(task, &calldata->res.seq_res)) +@@ -3711,6 +3713,7 @@ static void nfs4_close_done(struct rpc_task *task, void *data) + default: + task->tk_status = nfs4_async_handle_exception(task, + server, task->tk_status, &exception); ++ calldata->retrans = exception.retrans; + if (exception.retry) + goto out_restart; + } +@@ -5593,9 +5596,11 @@ static int nfs4_read_done_cb(struct rpc_task *task, struct nfs_pgio_header *hdr) + .inode = hdr->inode, + .state = hdr->args.context->state, + .stateid = &hdr->args.stateid, ++ .retrans = hdr->retrans, + }; + task->tk_status = nfs4_async_handle_exception(task, + server, task->tk_status, &exception); ++ hdr->retrans = exception.retrans; + if (exception.retry) { + rpc_restart_call_prepare(task); + return -EAGAIN; +@@ -5709,10 +5714,12 @@ static int nfs4_write_done_cb(struct rpc_task *task, + .inode = hdr->inode, + .state = hdr->args.context->state, + .stateid = &hdr->args.stateid, ++ .retrans = hdr->retrans, + }; + task->tk_status = nfs4_async_handle_exception(task, + NFS_SERVER(inode), task->tk_status, + &exception); ++ hdr->retrans = exception.retrans; + if (exception.retry) { + rpc_restart_call_prepare(task); + return -EAGAIN; +@@ -6726,6 +6733,7 @@ struct nfs4_delegreturndata { + struct nfs_fh fh; + nfs4_stateid stateid; + unsigned long timestamp; ++ unsigned short retrans; + struct { + struct nfs4_layoutreturn_args arg; + struct nfs4_layoutreturn_res res; +@@ -6746,6 +6754,7 @@ static void nfs4_delegreturn_done(struct rpc_task *task, void *calldata) + .inode = data->inode, + .stateid = &data->stateid, + .task_is_privileged = data->args.seq_args.sa_privileged, ++ .retrans = data->retrans, + }; + + if (!nfs4_sequence_done(task, &data->res.seq_res)) +@@ -6817,6 +6826,7 @@ static void nfs4_delegreturn_done(struct rpc_task *task, void *calldata) + task->tk_status = nfs4_async_handle_exception(task, + data->res.server, task->tk_status, + &exception); ++ data->retrans = exception.retrans; + if (exception.retry) + goto out_restart; + } +@@ -7093,6 +7103,7 @@ struct nfs4_unlockdata { + struct file_lock fl; + struct nfs_server *server; + unsigned long timestamp; ++ unsigned short retrans; + }; + + static struct nfs4_unlockdata *nfs4_alloc_unlockdata(struct file_lock *fl, +@@ -7147,6 +7158,7 @@ static void nfs4_locku_done(struct rpc_task *task, void *data) + struct nfs4_exception exception = { + .inode = calldata->lsp->ls_state->inode, + .stateid = &calldata->arg.stateid, ++ .retrans = calldata->retrans, + }; + + if (!nfs4_sequence_done(task, &calldata->res.seq_res)) +@@ -7180,6 +7192,7 @@ static void nfs4_locku_done(struct rpc_task *task, void *data) + task->tk_status = nfs4_async_handle_exception(task, + calldata->server, task->tk_status, + &exception); ++ calldata->retrans = exception.retrans; + if (exception.retry) + rpc_restart_call_prepare(task); + } +diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h +index ac4bff6e99135..ea437e468a91c 100644 +--- a/include/linux/nfs_xdr.h ++++ b/include/linux/nfs_xdr.h +@@ -1659,6 +1659,7 @@ struct nfs_pgio_header { + void *netfs; + #endif + ++ unsigned short retrans; + int pnfs_error; + int error; /* merge with pnfs_error */ + unsigned int good_bytes; /* boundary of good data */ +-- +2.51.0 + diff --git a/queue-6.17/nfs4-fix-state-renewals-missing-after-boot.patch b/queue-6.17/nfs4-fix-state-renewals-missing-after-boot.patch new file mode 100644 index 0000000000..61893b6a69 --- /dev/null +++ b/queue-6.17/nfs4-fix-state-renewals-missing-after-boot.patch @@ -0,0 +1,41 @@ +From 79420cccebdc2146b3931351330861d2dc597f66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 15:48:04 -0600 +Subject: NFS4: Fix state renewals missing after boot + +From: Joshua Watt + +[ Upstream commit 9bb3baa9d1604cd20f49ae7dac9306b4037a0e7a ] + +Since the last renewal time was initialized to 0 and jiffies start +counting at -5 minutes, any clients connected in the first 5 minutes +after a reboot would have their renewal timer set to a very long +interval. If the connection was idle, this would result in the client +state timing out on the server and the next call to the server would +return NFS4ERR_BADSESSION. + +Fix this by initializing the last renewal time to the current jiffies +instead of 0. + +Signed-off-by: Joshua Watt +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4client.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c +index 6fddf43d729c8..5998d6bd8a4f4 100644 +--- a/fs/nfs/nfs4client.c ++++ b/fs/nfs/nfs4client.c +@@ -222,6 +222,7 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init) + clp->cl_state = 1 << NFS4CLNT_LEASE_EXPIRED; + clp->cl_mvops = nfs_v4_minor_ops[cl_init->minorversion]; + clp->cl_mig_gen = 1; ++ clp->cl_last_renewal = jiffies; + #if IS_ENABLED(CONFIG_NFS_V4_1) + init_waitqueue_head(&clp->cl_lock_waitq); + #endif +-- +2.51.0 + diff --git a/queue-6.17/risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch b/queue-6.17/risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch new file mode 100644 index 0000000000..cf50494d5f --- /dev/null +++ b/queue-6.17/risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch @@ -0,0 +1,49 @@ +From 91630554cdf7f4b4f4c26a4abad039bf0ee979fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 16:28:46 +0300 +Subject: RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid + rfence errors + +From: Danil Skrebenkov + +[ Upstream commit ae9e9f3d67dcef7582a4524047b01e33c5185ddb ] + +openSBI v1.7 adds harts checks for ipi operations. Especially it +adds comparison between hmask passed as an argument from linux +and mask of online harts (from openSBI side). If they don't +fit each other the error occurs. + +When cpu is offline, cpu_online_mask is explicitly cleared in +__cpu_disable. However, there is no explicit clearing of +mm_cpumask. mm_cpumask is used for rfence operations that +call openSBI RFENCE extension which uses ipi to remote harts. +If hart is offline there may be error if mask of linux is not +as mask of online harts in openSBI. + +this patch adds explicit clearing of mm_cpumask for offline hart. + +Signed-off-by: Danil Skrebenkov +Reviewed-by: Andrew Jones +Link: https://lore.kernel.org/r/20250919132849.31676-1-danil.skrebenkov@cloudbear.ru +[pjw@kernel.org: rewrote subject line for clarity] +Signed-off-by: Paul Walmsley +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/cpu-hotplug.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/riscv/kernel/cpu-hotplug.c b/arch/riscv/kernel/cpu-hotplug.c +index a1e38ecfc8be2..3f50d3dd76c6f 100644 +--- a/arch/riscv/kernel/cpu-hotplug.c ++++ b/arch/riscv/kernel/cpu-hotplug.c +@@ -54,6 +54,7 @@ void arch_cpuhp_cleanup_dead_cpu(unsigned int cpu) + + pr_notice("CPU%u: off\n", cpu); + ++ clear_tasks_mm_cpumask(cpu); + /* Verify from the firmware if the cpu is really stopped*/ + if (cpu_ops->cpu_is_stopped) + ret = cpu_ops->cpu_is_stopped(cpu); +-- +2.51.0 + diff --git a/queue-6.17/riscv-acpi-avoid-errors-caused-by-probing-dt-devices.patch b/queue-6.17/riscv-acpi-avoid-errors-caused-by-probing-dt-devices.patch new file mode 100644 index 0000000000..2f0ba32177 --- /dev/null +++ b/queue-6.17/riscv-acpi-avoid-errors-caused-by-probing-dt-devices.patch @@ -0,0 +1,48 @@ +From 5a0e8e3a78f6096d8739e2ca1a3d2ff8984a5a03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 19:24:01 +0800 +Subject: riscv: acpi: avoid errors caused by probing DT devices when ACPI is + used + +From: Han Gao + +[ Upstream commit 69a8b62a7aa1e54ff7623064f6507fa29c1d0d4e ] + +Similar to the ARM64 commit 3505f30fb6a9s ("ARM64 / ACPI: If we chose +to boot from acpi then disable FDT"), let's not do DT hardware probing +if ACPI is enabled in early boot. This avoids errors caused by +repeated driver probing. + +Signed-off-by: Han Gao +Link: https://lore.kernel.org/r/20250910112401.552987-1-rabenda.cn@gmail.com +[pjw@kernel.org: cleaned up patch description and subject] +Signed-off-by: Paul Walmsley +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/setup.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c +index f90cce7a3acea..d7ee62837aa4f 100644 +--- a/arch/riscv/kernel/setup.c ++++ b/arch/riscv/kernel/setup.c +@@ -330,11 +330,14 @@ void __init setup_arch(char **cmdline_p) + /* Parse the ACPI tables for possible boot-time configuration */ + acpi_boot_table_init(); + ++ if (acpi_disabled) { + #if IS_ENABLED(CONFIG_BUILTIN_DTB) +- unflatten_and_copy_device_tree(); ++ unflatten_and_copy_device_tree(); + #else +- unflatten_device_tree(); ++ unflatten_device_tree(); + #endif ++ } ++ + misc_mem_init(); + + init_resources(); +-- +2.51.0 + diff --git a/queue-6.17/riscv-build-loader.bin-exclusively-for-canaan-k210.patch b/queue-6.17/riscv-build-loader.bin-exclusively-for-canaan-k210.patch new file mode 100644 index 0000000000..b50b2f28be --- /dev/null +++ b/queue-6.17/riscv-build-loader.bin-exclusively-for-canaan-k210.patch @@ -0,0 +1,40 @@ +From 64be1444bca64fdf72643f82fb0bca3491c48932 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Oct 2025 17:44:28 +0800 +Subject: riscv: Build loader.bin exclusively for Canaan K210 + +From: Feng Jiang + +[ Upstream commit 3ad1b71fdc5707d14332d9ae710a237de936be9b ] + +According to the explanation in commit ef10bdf9c3e6 ("riscv: +Kconfig.socs: Split ARCH_CANAAN and SOC_CANAAN_K210"), +loader.bin is a special feature of the Canaan K210 and +is not applicable to other SoCs. + +Fixes: e79dfcbfb902 ("riscv: make image compression configurable") +Signed-off-by: Feng Jiang +Reviewed-by: Emil Renner Berthing +Link: https://lore.kernel.org/r/20251029094429.553842-1-jiangfeng@kylinos.cn +Signed-off-by: Paul Walmsley +Signed-off-by: Sasha Levin +--- + arch/riscv/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile +index df57654a615e0..c4e394ede6256 100644 +--- a/arch/riscv/Makefile ++++ b/arch/riscv/Makefile +@@ -166,7 +166,7 @@ boot-image-$(CONFIG_KERNEL_LZO) := Image.lzo + boot-image-$(CONFIG_KERNEL_ZSTD) := Image.zst + boot-image-$(CONFIG_KERNEL_XZ) := Image.xz + ifdef CONFIG_RISCV_M_MODE +-boot-image-$(CONFIG_ARCH_CANAAN) := loader.bin ++boot-image-$(CONFIG_SOC_CANAAN_K210) := loader.bin + endif + boot-image-$(CONFIG_EFI_ZBOOT) := vmlinuz.efi + boot-image-$(CONFIG_XIP_KERNEL) := xipImage +-- +2.51.0 + diff --git a/queue-6.17/series b/queue-6.17/series new file mode 100644 index 0000000000..a50b5a0191 --- /dev/null +++ b/queue-6.17/series @@ -0,0 +1,45 @@ +iommufd-selftest-fix-ioctl-return-value-in-_test_cmd.patch +drm-mediatek-add-pm_runtime-support-for-gce-power-co.patch +drm-i915-avoid-lock-inversion-when-pinning-to-ggtt-o.patch +drm-i915-fix-conversion-between-clock-ticks-and-nano.patch +drm-amdgpu-set-default-gfx-reset-masks-for-gfx6-8.patch +drm-amd-display-don-t-stretch-non-native-images-by-d.patch +smb-client-fix-refcount-leak-in-smb2_set_path_attr.patch +iommufd-make-vfio_compat-s-unmap-succeed-if-the-rang.patch +futex-optimize-per-cpu-reference-counting.patch +drm-amd-fix-suspend-failure-with-secure-display-ta.patch +drm-xe-guc-synchronize-dead-ct-worker-with-unbind.patch +drm-xe-move-declarations-under-conditional-branch.patch +drm-xe-do-clean-shutdown-also-when-using-flr.patch +drm-amd-display-add-pixel_clock-to-amd_pp_display_co.patch +drm-amd-pm-use-pm_display_cfg-in-legacy-dpm-v2.patch +drm-amd-display-disable-fastboot-on-dce-6-too.patch +drm-amd-pm-disable-mclk-switching-on-si-at-high-pixe.patch +drm-amd-disable-aspm-on-si.patch +arm64-kprobes-check-the-return-value-of-set_memory_r.patch +compiler_types-move-unused-static-inline-functions-w.patch +riscv-build-loader.bin-exclusively-for-canaan-k210.patch +risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch +riscv-acpi-avoid-errors-caused-by-probing-dt-devices.patch +fs-return-eopnotsupp-from-file_setattr-file_getattr-.patch +asoc-nau8821-avoid-unnecessary-blocking-in-irq-handl.patch +drm-amdgpu-remove-two-invalid-bug_on-s.patch +drm-amdgpu-hide-vram-sysfs-attributes-on-gpus-withou.patch +drm-amdgpu-fix-null-pointer-dereference-in-vram-logi.patch +nfs4-fix-state-renewals-missing-after-boot.patch +drm-amdkfd-fix-suspend-resume-all-calls-in-mes-based.patch +nfs4-apply-delay_retrans-to-async-operations.patch +hid-intel-thc-hid-intel-quickspi-add-arl-pci-device-.patch +hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch +ixgbe-handle-ixgbe_vf_get_pf_link_state-mailbox-oper.patch +hid-nintendo-wait-longer-for-initial-probe.patch +nfs-check-if-suid-sgid-was-cleared-after-a-write-as-.patch +hid-quirks-add-always_poll-quirk-for-vrs-r295-steeri.patch +exfat-fix-improper-check-of-dentry.stream.valid_size.patch +io_uring-fix-unexpected-placement-on-same-size-resiz.patch +smb-server-fix-possible-memory-leak-in-smb2_read.patch +smb-server-fix-possible-refcount-leak-in-smb2_sess_s.patch +hid-logitech-hidpp-add-hidpp_quirk_reset_hi_res_scro.patch +asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch +alsa-hda-realtek-fix-mute-led-for-hp-omen-17-cb0xxx.patch +ixgbe-handle-ixgbe_vf_features_negotiate-mbox-cmd.patch diff --git a/queue-6.17/smb-client-fix-refcount-leak-in-smb2_set_path_attr.patch b/queue-6.17/smb-client-fix-refcount-leak-in-smb2_set_path_attr.patch new file mode 100644 index 0000000000..249cddcf13 --- /dev/null +++ b/queue-6.17/smb-client-fix-refcount-leak-in-smb2_set_path_attr.patch @@ -0,0 +1,42 @@ +From 52a6cda5e1d15ae8144749ca549175cba5e700f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Nov 2025 23:13:15 +0800 +Subject: smb: client: fix refcount leak in smb2_set_path_attr + +From: Shuhao Fu + +[ Upstream commit b540de9e3b4fab3b9e10f30714a6f5c1b2a50ec3 ] + +Fix refcount leak in `smb2_set_path_attr` when path conversion fails. + +Function `cifs_get_writable_path` returns `cfile` with its reference +counter `cfile->count` increased on success. Function `smb2_compound_op` +would decrease the reference counter for `cfile`, as stated in its +comment. By calling `smb2_rename_path`, the reference counter of `cfile` +would leak if `cifs_convert_path_to_utf16` fails in `smb2_set_path_attr`. + +Fixes: 8de9e86c67ba ("cifs: create a helper to find a writeable handle by path name") +Acked-by: Henrique Carvalho +Signed-off-by: Shuhao Fu +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2inode.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c +index e441fa2e76897..ff9cb25327458 100644 +--- a/fs/smb/client/smb2inode.c ++++ b/fs/smb/client/smb2inode.c +@@ -1294,6 +1294,8 @@ static int smb2_set_path_attr(const unsigned int xid, struct cifs_tcon *tcon, + smb2_to_name = cifs_convert_path_to_utf16(to_name, cifs_sb); + if (smb2_to_name == NULL) { + rc = -ENOMEM; ++ if (cfile) ++ cifsFileInfo_put(cfile); + goto smb2_rename_path; + } + in_iov.iov_base = smb2_to_name; +-- +2.51.0 + diff --git a/queue-6.17/smb-server-fix-possible-memory-leak-in-smb2_read.patch b/queue-6.17/smb-server-fix-possible-memory-leak-in-smb2_read.patch new file mode 100644 index 0000000000..584625c113 --- /dev/null +++ b/queue-6.17/smb-server-fix-possible-memory-leak-in-smb2_read.patch @@ -0,0 +1,37 @@ +From 062646bb311f4c592c636ef1538ce825ed8dce46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Oct 2025 00:47:59 +0800 +Subject: smb/server: fix possible memory leak in smb2_read() + +From: ZhangGuoDong + +[ Upstream commit 6fced056d2cc8d01b326e6fcfabaacb9850b71a4 ] + +Memory leak occurs when ksmbd_vfs_read() fails. +Fix this by adding the missing kvfree(). + +Co-developed-by: ChenXiaoSong +Signed-off-by: ChenXiaoSong +Signed-off-by: ZhangGuoDong +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/smb2pdu.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c +index 287200d7c0764..409b85af82e1c 100644 +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -6826,6 +6826,7 @@ int smb2_read(struct ksmbd_work *work) + + nbytes = ksmbd_vfs_read(work, fp, length, &offset, aux_payload_buf); + if (nbytes < 0) { ++ kvfree(aux_payload_buf); + err = nbytes; + goto out; + } +-- +2.51.0 + diff --git a/queue-6.17/smb-server-fix-possible-refcount-leak-in-smb2_sess_s.patch b/queue-6.17/smb-server-fix-possible-refcount-leak-in-smb2_sess_s.patch new file mode 100644 index 0000000000..5eb646d3e8 --- /dev/null +++ b/queue-6.17/smb-server-fix-possible-refcount-leak-in-smb2_sess_s.patch @@ -0,0 +1,37 @@ +From 1d0b03aeb6ce2c61bc88687d67b1b19394ee5f7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Oct 2025 00:51:36 +0800 +Subject: smb/server: fix possible refcount leak in smb2_sess_setup() + +From: ZhangGuoDong + +[ Upstream commit 379510a815cb2e64eb0a379cb62295d6ade65df0 ] + +Reference count of ksmbd_session will leak when session need reconnect. +Fix this by adding the missing ksmbd_user_session_put(). + +Co-developed-by: ChenXiaoSong +Signed-off-by: ChenXiaoSong +Signed-off-by: ZhangGuoDong +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/smb2pdu.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c +index 409b85af82e1c..acb06d7118571 100644 +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -1805,6 +1805,7 @@ int smb2_sess_setup(struct ksmbd_work *work) + + if (ksmbd_conn_need_reconnect(conn)) { + rc = -EFAULT; ++ ksmbd_user_session_put(sess); + sess = NULL; + goto out_err; + } +-- +2.51.0 + diff --git a/queue-6.6/asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch b/queue-6.6/asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch new file mode 100644 index 0000000000..a4dd00182b --- /dev/null +++ b/queue-6.6/asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch @@ -0,0 +1,43 @@ +From c3a6200ba43713d30781029fac122e05beb1d570 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Oct 2025 15:42:15 +0200 +Subject: ASoC: max98090/91: fixed max98091 ALSA widget powering up/down + +From: Sharique Mohammad + +[ Upstream commit 7a37291ed40a33a5f6c3d370fdde5ee0d8f7d0e4 ] + +The widgets DMIC3_ENA and DMIC4_ENA must be defined in the DAPM +suppy widget, just like DMICL_ENA and DMICR_ENA. Whenever they +are turned on or off, the required startup or shutdown sequences +must be taken care by the max98090_shdn_event. + +Signed-off-by: Sharique Mohammad +Link: https://patch.msgid.link/20251015134215.750001-1-sharq0406@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/max98090.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c +index 2adf744c65263..4023b88e7bc13 100644 +--- a/sound/soc/codecs/max98090.c ++++ b/sound/soc/codecs/max98090.c +@@ -1234,9 +1234,11 @@ static const struct snd_soc_dapm_widget max98091_dapm_widgets[] = { + SND_SOC_DAPM_INPUT("DMIC4"), + + SND_SOC_DAPM_SUPPLY("DMIC3_ENA", M98090_REG_DIGITAL_MIC_ENABLE, +- M98090_DIGMIC3_SHIFT, 0, NULL, 0), ++ M98090_DIGMIC3_SHIFT, 0, max98090_shdn_event, ++ SND_SOC_DAPM_POST_PMU), + SND_SOC_DAPM_SUPPLY("DMIC4_ENA", M98090_REG_DIGITAL_MIC_ENABLE, +- M98090_DIGMIC4_SHIFT, 0, NULL, 0), ++ M98090_DIGMIC4_SHIFT, 0, max98090_shdn_event, ++ SND_SOC_DAPM_POST_PMU), + }; + + static const struct snd_soc_dapm_route max98090_dapm_routes[] = { +-- +2.51.0 + diff --git a/queue-6.6/compiler_types-move-unused-static-inline-functions-w.patch b/queue-6.6/compiler_types-move-unused-static-inline-functions-w.patch new file mode 100644 index 0000000000..12851bd1c8 --- /dev/null +++ b/queue-6.6/compiler_types-move-unused-static-inline-functions-w.patch @@ -0,0 +1,57 @@ +From 443e85c1c021e3179aa6bde1592181980ad4bd45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Nov 2025 11:50:00 +0100 +Subject: compiler_types: Move unused static inline functions warning to W=2 + +From: Peter Zijlstra + +[ Upstream commit 9818af18db4bfefd320d0fef41390a616365e6f7 ] + +Per Nathan, clang catches unused "static inline" functions in C files +since commit 6863f5643dd7 ("kbuild: allow Clang to find unused static +inline functions for W=1 build"). + +Linus said: + +> So I entirely ignore W=1 issues, because I think so many of the extra +> warnings are bogus. +> +> But if this one in particular is causing more problems than most - +> some teams do seem to use W=1 as part of their test builds - it's fine +> to send me a patch that just moves bad warnings to W=2. +> +> And if anybody uses W=2 for their test builds, that's THEIR problem.. + +Here is the change to bump the warning from W=1 to W=2. + +Fixes: 6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build") +Signed-off-by: Peter Zijlstra +Signed-off-by: Andy Shevchenko +Link: https://patch.msgid.link/20251106105000.2103276-1-andriy.shevchenko@linux.intel.com +[nathan: Adjust comment as well] +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + include/linux/compiler_types.h | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h +index 02f616dfb15f4..5c8aca9c34566 100644 +--- a/include/linux/compiler_types.h ++++ b/include/linux/compiler_types.h +@@ -229,10 +229,9 @@ struct ftrace_likely_data { + /* + * GCC does not warn about unused static inline functions for -Wunused-function. + * Suppress the warning in clang as well by using __maybe_unused, but enable it +- * for W=1 build. This will allow clang to find unused functions. Remove the +- * __inline_maybe_unused entirely after fixing most of -Wunused-function warnings. ++ * for W=2 build. This will allow clang to find unused functions. + */ +-#ifdef KBUILD_EXTRA_WARN1 ++#ifdef KBUILD_EXTRA_WARN2 + #define __inline_maybe_unused + #else + #define __inline_maybe_unused __maybe_unused +-- +2.51.0 + diff --git a/queue-6.6/drm-amd-fix-suspend-failure-with-secure-display-ta.patch b/queue-6.6/drm-amd-fix-suspend-failure-with-secure-display-ta.patch new file mode 100644 index 0000000000..644c143136 --- /dev/null +++ b/queue-6.6/drm-amd-fix-suspend-failure-with-secure-display-ta.patch @@ -0,0 +1,47 @@ +From 1cd16b9824d39472901a05de5f5d888771f885dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Nov 2025 13:38:02 -0600 +Subject: drm/amd: Fix suspend failure with secure display TA + +From: Mario Limonciello + +[ Upstream commit b09cb2996cdf50cd1ab4020e002c95d742c81313 ] + +commit c760bcda83571 ("drm/amd: Check whether secure display TA loaded +successfully") attempted to fix extra messages, but failed to port the +cleanup that was in commit 5c6d52ff4b61e ("drm/amd: Don't try to enable +secure display TA multiple times") to prevent multiple tries. + +Add that to the failure handling path even on a quick failure. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4679 +Fixes: c760bcda8357 ("drm/amd: Check whether secure display TA loaded successfully") +Signed-off-by: Mario Limonciello +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +(cherry picked from commit 4104c0a454f6a4d1e0d14895d03c0e7bdd0c8240) +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index d358a08b5e006..08886e0ee6428 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -2015,8 +2015,11 @@ static int psp_securedisplay_initialize(struct psp_context *psp) + if (!ret && !psp->securedisplay_context.context.resp_status) { + psp->securedisplay_context.context.initialized = true; + mutex_init(&psp->securedisplay_context.mutex); +- } else ++ } else { ++ /* don't try again */ ++ psp->securedisplay_context.context.bin_desc.size_bytes = 0; + return ret; ++ } + + mutex_lock(&psp->securedisplay_context.mutex); + +-- +2.51.0 + diff --git a/queue-6.6/drm-amd-pm-disable-mclk-switching-on-si-at-high-pixe.patch b/queue-6.6/drm-amd-pm-disable-mclk-switching-on-si-at-high-pixe.patch new file mode 100644 index 0000000000..b76691c1b0 --- /dev/null +++ b/queue-6.6/drm-amd-pm-disable-mclk-switching-on-si-at-high-pixe.patch @@ -0,0 +1,43 @@ +From a8862333bc805b8036eba324e7d9cec0f12e6e70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 20:26:12 +0200 +Subject: drm/amd/pm: Disable MCLK switching on SI at high pixel clocks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 5c05bcf6ae7732da1bd4dc1958d527b5f07f216a ] + +On various SI GPUs, a flickering can be observed near the bottom +edge of the screen when using a single 4K 60Hz monitor over DP. +Disabling MCLK switching works around this problem. + +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index 2863dc65ffc6f..e5f68b2b8def3 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -3485,6 +3485,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + * for these GPUs to calculate bandwidth requirements. + */ + if (high_pixelclock_count) { ++ /* Work around flickering lines at the bottom edge ++ * of the screen when using a single 4K 60Hz monitor. ++ */ ++ disable_mclk_switching = true; ++ + /* On Oland, we observe some flickering when two 4K 60Hz + * displays are connected, possibly because voltage is too low. + * Raise the voltage by requiring a higher SCLK. +-- +2.51.0 + diff --git a/queue-6.6/drm-amdgpu-fix-null-pointer-dereference-in-vram-logi.patch b/queue-6.6/drm-amdgpu-fix-null-pointer-dereference-in-vram-logi.patch new file mode 100644 index 0000000000..eb7f41f238 --- /dev/null +++ b/queue-6.6/drm-amdgpu-fix-null-pointer-dereference-in-vram-logi.patch @@ -0,0 +1,113 @@ +From 9a5f78a69e9814f135de462b71c0595422dbf0bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 13:46:12 +0800 +Subject: drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU + devices +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jesse.Zhang + +[ Upstream commit 883f309add55060233bf11c1ea6947140372920f ] + +Previously, APU platforms (and other scenarios with uninitialized VRAM managers) +triggered a NULL pointer dereference in `ttm_resource_manager_usage()`. The root +cause is not that the `struct ttm_resource_manager *man` pointer itself is NULL, +but that `man->bdev` (the backing device pointer within the manager) remains +uninitialized (NULL) on APUs—since APUs lack dedicated VRAM and do not fully +set up VRAM manager structures. When `ttm_resource_manager_usage()` attempts to +acquire `man->bdev->lru_lock`, it dereferences the NULL `man->bdev`, leading to +a kernel OOPS. + +1. **amdgpu_cs.c**: Extend the existing bandwidth control check in + `amdgpu_cs_get_threshold_for_moves()` to include a check for + `ttm_resource_manager_used()`. If the manager is not used (uninitialized + `bdev`), return 0 for migration thresholds immediately—skipping VRAM-specific + logic that would trigger the NULL dereference. + +2. **amdgpu_kms.c**: Update the `AMDGPU_INFO_VRAM_USAGE` ioctl and memory info + reporting to use a conditional: if the manager is used, return the real VRAM + usage; otherwise, return 0. This avoids accessing `man->bdev` when it is + NULL. + +3. **amdgpu_virt.c**: Modify the vf2pf (virtual function to physical function) + data write path. Use `ttm_resource_manager_used()` to check validity: if the + manager is usable, calculate `fb_usage` from VRAM usage; otherwise, set + `fb_usage` to 0 (APUs have no discrete framebuffer to report). + +This approach is more robust than APU-specific checks because it: +- Works for all scenarios where the VRAM manager is uninitialized (not just APUs), +- Aligns with TTM's design by using its native helper function, +- Preserves correct behavior for discrete GPUs (which have fully initialized + `man->bdev` and pass the `ttm_resource_manager_used()` check). + +v4: use ttm_resource_manager_used(&adev->mman.vram_mgr.manager) instead of checking the adev->gmc.is_app_apu flag (Christian) + +Reviewed-by: Christian König +Suggested-by: Lijo Lazar +Signed-off-by: Jesse Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- + drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 7 ++++--- + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 4 ++-- + 3 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +index 5b4d7fe148586..05712d322024a 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +@@ -690,7 +690,7 @@ static void amdgpu_cs_get_threshold_for_moves(struct amdgpu_device *adev, + */ + const s64 us_upper_bound = 200000; + +- if (!adev->mm_stats.log2_max_MBps) { ++ if ((!adev->mm_stats.log2_max_MBps) || !ttm_resource_manager_used(&adev->mman.vram_mgr.manager)) { + *max_bytes = 0; + *max_vis_bytes = 0; + return; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +index 5797055b1148f..1f0de6e717112 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +@@ -651,7 +651,8 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) + ui64 = atomic64_read(&adev->num_vram_cpu_page_faults); + return copy_to_user(out, &ui64, min(size, 8u)) ? -EFAULT : 0; + case AMDGPU_INFO_VRAM_USAGE: +- ui64 = ttm_resource_manager_usage(&adev->mman.vram_mgr.manager); ++ ui64 = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ? ++ ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) : 0; + return copy_to_user(out, &ui64, min(size, 8u)) ? -EFAULT : 0; + case AMDGPU_INFO_VIS_VRAM_USAGE: + ui64 = amdgpu_vram_mgr_vis_usage(&adev->mman.vram_mgr); +@@ -697,8 +698,8 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) + mem.vram.usable_heap_size = adev->gmc.real_vram_size - + atomic64_read(&adev->vram_pin_size) - + AMDGPU_VM_RESERVED_VRAM; +- mem.vram.heap_usage = +- ttm_resource_manager_usage(vram_man); ++ mem.vram.heap_usage = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ? ++ ttm_resource_manager_usage(vram_man) : 0; + mem.vram.max_allocation = mem.vram.usable_heap_size * 3 / 4; + + mem.cpu_accessible_vram.total_heap_size = +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +index 7cb4b4118335a..5a4b1b625f037 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +@@ -604,8 +604,8 @@ static int amdgpu_virt_write_vf2pf_data(struct amdgpu_device *adev) + vf2pf_info->driver_cert = 0; + vf2pf_info->os_info.all = 0; + +- vf2pf_info->fb_usage = +- ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) >> 20; ++ vf2pf_info->fb_usage = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ? ++ ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) >> 20 : 0; + vf2pf_info->fb_vis_usage = + amdgpu_vram_mgr_vis_usage(&adev->mman.vram_mgr) >> 20; + vf2pf_info->fb_size = adev->gmc.real_vram_size >> 20; +-- +2.51.0 + diff --git a/queue-6.6/drm-i915-avoid-lock-inversion-when-pinning-to-ggtt-o.patch b/queue-6.6/drm-i915-avoid-lock-inversion-when-pinning-to-ggtt-o.patch new file mode 100644 index 0000000000..15eadbdc0f --- /dev/null +++ b/queue-6.6/drm-i915-avoid-lock-inversion-when-pinning-to-ggtt-o.patch @@ -0,0 +1,276 @@ +From 42b75a9aeeb2e612a6fc7b2c7ba7fe8ad2b534d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Oct 2025 10:25:19 +0200 +Subject: drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD + +From: Janusz Krzysztofik + +[ Upstream commit 84bbe327a5cbb060f3321c9d9d4d53936fc1ef9b ] + +On completion of i915_vma_pin_ww(), a synchronous variant of +dma_fence_work_commit() is called. When pinning a VMA to GGTT address +space on a Cherry View family processor, or on a Broxton generation SoC +with VTD enabled, i.e., when stop_machine() is then called from +intel_ggtt_bind_vma(), that can potentially lead to lock inversion among +reservation_ww and cpu_hotplug locks. + +[86.861179] ====================================================== +[86.861193] WARNING: possible circular locking dependency detected +[86.861209] 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 Tainted: G U +[86.861226] ------------------------------------------------------ +[86.861238] i915_module_loa/1432 is trying to acquire lock: +[86.861252] ffffffff83489090 (cpu_hotplug_lock){++++}-{0:0}, at: stop_machine+0x1c/0x50 +[86.861290] +but task is already holding lock: +[86.861303] ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915] +[86.862233] +which lock already depends on the new lock. +[86.862251] +the existing dependency chain (in reverse order) is: +[86.862265] +-> #5 (reservation_ww_class_mutex){+.+.}-{3:3}: +[86.862292] dma_resv_lockdep+0x19a/0x390 +[86.862315] do_one_initcall+0x60/0x3f0 +[86.862334] kernel_init_freeable+0x3cd/0x680 +[86.862353] kernel_init+0x1b/0x200 +[86.862369] ret_from_fork+0x47/0x70 +[86.862383] ret_from_fork_asm+0x1a/0x30 +[86.862399] +-> #4 (reservation_ww_class_acquire){+.+.}-{0:0}: +[86.862425] dma_resv_lockdep+0x178/0x390 +[86.862440] do_one_initcall+0x60/0x3f0 +[86.862454] kernel_init_freeable+0x3cd/0x680 +[86.862470] kernel_init+0x1b/0x200 +[86.862482] ret_from_fork+0x47/0x70 +[86.862495] ret_from_fork_asm+0x1a/0x30 +[86.862509] +-> #3 (&mm->mmap_lock){++++}-{3:3}: +[86.862531] down_read_killable+0x46/0x1e0 +[86.862546] lock_mm_and_find_vma+0xa2/0x280 +[86.862561] do_user_addr_fault+0x266/0x8e0 +[86.862578] exc_page_fault+0x8a/0x2f0 +[86.862593] asm_exc_page_fault+0x27/0x30 +[86.862607] filldir64+0xeb/0x180 +[86.862620] kernfs_fop_readdir+0x118/0x480 +[86.862635] iterate_dir+0xcf/0x2b0 +[86.862648] __x64_sys_getdents64+0x84/0x140 +[86.862661] x64_sys_call+0x1058/0x2660 +[86.862675] do_syscall_64+0x91/0xe90 +[86.862689] entry_SYSCALL_64_after_hwframe+0x76/0x7e +[86.862703] +-> #2 (&root->kernfs_rwsem){++++}-{3:3}: +[86.862725] down_write+0x3e/0xf0 +[86.862738] kernfs_add_one+0x30/0x3c0 +[86.862751] kernfs_create_dir_ns+0x53/0xb0 +[86.862765] internal_create_group+0x134/0x4c0 +[86.862779] sysfs_create_group+0x13/0x20 +[86.862792] topology_add_dev+0x1d/0x30 +[86.862806] cpuhp_invoke_callback+0x4b5/0x850 +[86.862822] cpuhp_issue_call+0xbf/0x1f0 +[86.862836] __cpuhp_setup_state_cpuslocked+0x111/0x320 +[86.862852] __cpuhp_setup_state+0xb0/0x220 +[86.862866] topology_sysfs_init+0x30/0x50 +[86.862879] do_one_initcall+0x60/0x3f0 +[86.862893] kernel_init_freeable+0x3cd/0x680 +[86.862908] kernel_init+0x1b/0x200 +[86.862921] ret_from_fork+0x47/0x70 +[86.862934] ret_from_fork_asm+0x1a/0x30 +[86.862947] +-> #1 (cpuhp_state_mutex){+.+.}-{3:3}: +[86.862969] __mutex_lock+0xaa/0xed0 +[86.862982] mutex_lock_nested+0x1b/0x30 +[86.862995] __cpuhp_setup_state_cpuslocked+0x67/0x320 +[86.863012] __cpuhp_setup_state+0xb0/0x220 +[86.863026] page_alloc_init_cpuhp+0x2d/0x60 +[86.863041] mm_core_init+0x22/0x2d0 +[86.863054] start_kernel+0x576/0xbd0 +[86.863068] x86_64_start_reservations+0x18/0x30 +[86.863084] x86_64_start_kernel+0xbf/0x110 +[86.863098] common_startup_64+0x13e/0x141 +[86.863114] +-> #0 (cpu_hotplug_lock){++++}-{0:0}: +[86.863135] __lock_acquire+0x1635/0x2810 +[86.863152] lock_acquire+0xc4/0x2f0 +[86.863166] cpus_read_lock+0x41/0x100 +[86.863180] stop_machine+0x1c/0x50 +[86.863194] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915] +[86.863987] intel_ggtt_bind_vma+0x43/0x70 [i915] +[86.864735] __vma_bind+0x55/0x70 [i915] +[86.865510] fence_work+0x26/0xa0 [i915] +[86.866248] fence_notify+0xa1/0x140 [i915] +[86.866983] __i915_sw_fence_complete+0x8f/0x270 [i915] +[86.867719] i915_sw_fence_commit+0x39/0x60 [i915] +[86.868453] i915_vma_pin_ww+0x462/0x1360 [i915] +[86.869228] i915_vma_pin.constprop.0+0x133/0x1d0 [i915] +[86.870001] initial_plane_vma+0x307/0x840 [i915] +[86.870774] intel_initial_plane_config+0x33f/0x670 [i915] +[86.871546] intel_display_driver_probe_nogem+0x1c6/0x260 [i915] +[86.872330] i915_driver_probe+0x7fa/0xe80 [i915] +[86.873057] i915_pci_probe+0xe6/0x220 [i915] +[86.873782] local_pci_probe+0x47/0xb0 +[86.873802] pci_device_probe+0xf3/0x260 +[86.873817] really_probe+0xf1/0x3c0 +[86.873833] __driver_probe_device+0x8c/0x180 +[86.873848] driver_probe_device+0x24/0xd0 +[86.873862] __driver_attach+0x10f/0x220 +[86.873876] bus_for_each_dev+0x7f/0xe0 +[86.873892] driver_attach+0x1e/0x30 +[86.873904] bus_add_driver+0x151/0x290 +[86.873917] driver_register+0x5e/0x130 +[86.873931] __pci_register_driver+0x7d/0x90 +[86.873945] i915_pci_register_driver+0x23/0x30 [i915] +[86.874678] i915_init+0x37/0x120 [i915] +[86.875347] do_one_initcall+0x60/0x3f0 +[86.875369] do_init_module+0x97/0x2a0 +[86.875385] load_module+0x2c54/0x2d80 +[86.875398] init_module_from_file+0x96/0xe0 +[86.875413] idempotent_init_module+0x117/0x330 +[86.875426] __x64_sys_finit_module+0x77/0x100 +[86.875440] x64_sys_call+0x24de/0x2660 +[86.875454] do_syscall_64+0x91/0xe90 +[86.875470] entry_SYSCALL_64_after_hwframe+0x76/0x7e +[86.875486] +other info that might help us debug this: +[86.875502] Chain exists of: + cpu_hotplug_lock --> reservation_ww_class_acquire --> reservation_ww_class_mutex +[86.875539] Possible unsafe locking scenario: +[86.875552] CPU0 CPU1 +[86.875563] ---- ---- +[86.875573] lock(reservation_ww_class_mutex); +[86.875588] lock(reservation_ww_class_acquire); +[86.875606] lock(reservation_ww_class_mutex); +[86.875624] rlock(cpu_hotplug_lock); +[86.875637] + *** DEADLOCK *** +[86.875650] 3 locks held by i915_module_loa/1432: +[86.875663] #0: ffff888101f5c1b0 (&dev->mutex){....}-{3:3}, at: __driver_attach+0x104/0x220 +[86.875699] #1: ffffc90002e0b4a0 (reservation_ww_class_acquire){+.+.}-{0:0}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915] +[86.876512] #2: ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915] +[86.877305] +stack backtrace: +[86.877326] CPU: 0 UID: 0 PID: 1432 Comm: i915_module_loa Tainted: G U 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 PREEMPT(voluntary) +[86.877334] Tainted: [U]=USER +[86.877336] Hardware name: /NUC5CPYB, BIOS PYBSWCEL.86A.0079.2020.0420.1316 04/20/2020 +[86.877339] Call Trace: +[86.877344] +[86.877353] dump_stack_lvl+0x91/0xf0 +[86.877364] dump_stack+0x10/0x20 +[86.877369] print_circular_bug+0x285/0x360 +[86.877379] check_noncircular+0x135/0x150 +[86.877390] __lock_acquire+0x1635/0x2810 +[86.877403] lock_acquire+0xc4/0x2f0 +[86.877408] ? stop_machine+0x1c/0x50 +[86.877422] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915] +[86.878173] cpus_read_lock+0x41/0x100 +[86.878182] ? stop_machine+0x1c/0x50 +[86.878191] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915] +[86.878916] stop_machine+0x1c/0x50 +[86.878927] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915] +[86.879652] intel_ggtt_bind_vma+0x43/0x70 [i915] +[86.880375] __vma_bind+0x55/0x70 [i915] +[86.881133] fence_work+0x26/0xa0 [i915] +[86.881851] fence_notify+0xa1/0x140 [i915] +[86.882566] __i915_sw_fence_complete+0x8f/0x270 [i915] +[86.883286] i915_sw_fence_commit+0x39/0x60 [i915] +[86.884003] i915_vma_pin_ww+0x462/0x1360 [i915] +[86.884756] ? i915_vma_pin.constprop.0+0x6c/0x1d0 [i915] +[86.885513] i915_vma_pin.constprop.0+0x133/0x1d0 [i915] +[86.886281] initial_plane_vma+0x307/0x840 [i915] +[86.887049] intel_initial_plane_config+0x33f/0x670 [i915] +[86.887819] intel_display_driver_probe_nogem+0x1c6/0x260 [i915] +[86.888587] i915_driver_probe+0x7fa/0xe80 [i915] +[86.889293] ? mutex_unlock+0x12/0x20 +[86.889301] ? drm_privacy_screen_get+0x171/0x190 +[86.889308] ? acpi_dev_found+0x66/0x80 +[86.889321] i915_pci_probe+0xe6/0x220 [i915] +[86.890038] local_pci_probe+0x47/0xb0 +[86.890049] pci_device_probe+0xf3/0x260 +[86.890058] really_probe+0xf1/0x3c0 +[86.890067] __driver_probe_device+0x8c/0x180 +[86.890072] driver_probe_device+0x24/0xd0 +[86.890078] __driver_attach+0x10f/0x220 +[86.890083] ? __pfx___driver_attach+0x10/0x10 +[86.890088] bus_for_each_dev+0x7f/0xe0 +[86.890097] driver_attach+0x1e/0x30 +[86.890101] bus_add_driver+0x151/0x290 +[86.890107] driver_register+0x5e/0x130 +[86.890113] __pci_register_driver+0x7d/0x90 +[86.890119] i915_pci_register_driver+0x23/0x30 [i915] +[86.890833] i915_init+0x37/0x120 [i915] +[86.891482] ? __pfx_i915_init+0x10/0x10 [i915] +[86.892135] do_one_initcall+0x60/0x3f0 +[86.892145] ? __kmalloc_cache_noprof+0x33f/0x470 +[86.892157] do_init_module+0x97/0x2a0 +[86.892164] load_module+0x2c54/0x2d80 +[86.892168] ? __kernel_read+0x15c/0x300 +[86.892185] ? kernel_read_file+0x2b1/0x320 +[86.892195] init_module_from_file+0x96/0xe0 +[86.892199] ? init_module_from_file+0x96/0xe0 +[86.892211] idempotent_init_module+0x117/0x330 +[86.892224] __x64_sys_finit_module+0x77/0x100 +[86.892230] x64_sys_call+0x24de/0x2660 +[86.892236] do_syscall_64+0x91/0xe90 +[86.892243] ? irqentry_exit+0x77/0xb0 +[86.892249] ? sysvec_apic_timer_interrupt+0x57/0xc0 +[86.892256] entry_SYSCALL_64_after_hwframe+0x76/0x7e +[86.892261] RIP: 0033:0x7303e1b2725d +[86.892271] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8b bb 0d 00 f7 d8 64 89 01 48 +[86.892276] RSP: 002b:00007ffddd1fdb38 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 +[86.892281] RAX: ffffffffffffffda RBX: 00005d771d88fd90 RCX: 00007303e1b2725d +[86.892285] RDX: 0000000000000000 RSI: 00005d771d893aa0 RDI: 000000000000000c +[86.892287] RBP: 00007ffddd1fdbf0 R08: 0000000000000040 R09: 00007ffddd1fdb80 +[86.892289] R10: 00007303e1c03b20 R11: 0000000000000246 R12: 00005d771d893aa0 +[86.892292] R13: 0000000000000000 R14: 00005d771d88f0d0 R15: 00005d771d895710 +[86.892304] + +Call asynchronous variant of dma_fence_work_commit() in that case. + +v3: Provide more verbose in-line comment (Andi), + - mention target environments in commit message. + +Fixes: 7d1c2618eac59 ("drm/i915: Take reservation lock around i915_vma_pin.") +Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14985 +Cc: Andi Shyti +Signed-off-by: Janusz Krzysztofik +Reviewed-by: Sebastian Brzezinka +Reviewed-by: Krzysztof Karas +Acked-by: Andi Shyti +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20251023082925.351307-6-janusz.krzysztofik@linux.intel.com +(cherry picked from commit 648ef1324add1c2e2b6041cdf0b28d31fbca5f13) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/i915_vma.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c +index 46e4a45e3c72a..772594360d57e 100644 +--- a/drivers/gpu/drm/i915/i915_vma.c ++++ b/drivers/gpu/drm/i915/i915_vma.c +@@ -1586,8 +1586,20 @@ int i915_vma_pin_ww(struct i915_vma *vma, struct i915_gem_ww_ctx *ww, + err_vma_res: + i915_vma_resource_free(vma_res); + err_fence: +- if (work) +- dma_fence_work_commit_imm(&work->base); ++ if (work) { ++ /* ++ * When pinning VMA to GGTT on CHV or BXT with VTD enabled, ++ * commit VMA binding asynchronously to avoid risk of lock ++ * inversion among reservation_ww locks held here and ++ * cpu_hotplug_lock acquired from stop_machine(), which we ++ * wrap around GGTT updates when running in those environments. ++ */ ++ if (i915_vma_is_ggtt(vma) && ++ intel_vm_no_concurrent_access_wa(vma->vm->i915)) ++ dma_fence_work_commit(&work->base); ++ else ++ dma_fence_work_commit_imm(&work->base); ++ } + err_rpm: + intel_runtime_pm_put(&vma->vm->i915->runtime_pm, wakeref); + +-- +2.51.0 + diff --git a/queue-6.6/drm-i915-fix-conversion-between-clock-ticks-and-nano.patch b/queue-6.6/drm-i915-fix-conversion-between-clock-ticks-and-nano.patch new file mode 100644 index 0000000000..9470839c77 --- /dev/null +++ b/queue-6.6/drm-i915-fix-conversion-between-clock-ticks-and-nano.patch @@ -0,0 +1,59 @@ +From 447d8fe9f9580acb190488087ac8fef46e41df83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Oct 2025 17:03:51 -0700 +Subject: drm/i915: Fix conversion between clock ticks and nanoseconds + +From: Umesh Nerlige Ramappa + +[ Upstream commit 7d44ad6b43d0be43d080180413a1b6c24cfbd266 ] + +When tick values are large, the multiplication by NSEC_PER_SEC is larger +than 64 bits and results in bad conversions. + +The issue is seen in PMU busyness counters that look like they have +wrapped around due to bad conversion. i915 PMU implementation returns +monotonically increasing counters. If a count is lesser than previous +one, it will only return the larger value until the smaller value +catches up. The user will see this as zero delta between two +measurements even though the engines are busy. + +Fix it by using mul_u64_u32_div() + +Fixes: 77cdd054dd2c ("drm/i915/pmu: Connect engine busyness stats from GuC to pmu") +Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14955 +Signed-off-by: Umesh Nerlige Ramappa +Reviewed-by: Ashutosh Dixit +Link: https://lore.kernel.org/r/20251016000350.1152382-2-umesh.nerlige.ramappa@intel.com +(cherry picked from commit 2ada9cb1df3f5405a01d013b708b1b0914efccfe) +Signed-off-by: Rodrigo Vivi +[Rodrigo: Added the Fixes tag while cherry-picking to fixes] +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c b/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c +index 7c9be4fd1c8c4..7a950c1502b6e 100644 +--- a/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c ++++ b/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c +@@ -208,7 +208,7 @@ static u64 div_u64_roundup(u64 nom, u32 den) + + u64 intel_gt_clock_interval_to_ns(const struct intel_gt *gt, u64 count) + { +- return div_u64_roundup(count * NSEC_PER_SEC, gt->clock_frequency); ++ return mul_u64_u32_div(count, NSEC_PER_SEC, gt->clock_frequency); + } + + u64 intel_gt_pm_interval_to_ns(const struct intel_gt *gt, u64 count) +@@ -218,7 +218,7 @@ u64 intel_gt_pm_interval_to_ns(const struct intel_gt *gt, u64 count) + + u64 intel_gt_ns_to_clock_interval(const struct intel_gt *gt, u64 ns) + { +- return div_u64_roundup(gt->clock_frequency * ns, NSEC_PER_SEC); ++ return mul_u64_u32_div(ns, gt->clock_frequency, NSEC_PER_SEC); + } + + u64 intel_gt_ns_to_pm_interval(const struct intel_gt *gt, u64 ns) +-- +2.51.0 + diff --git a/queue-6.6/hid-quirks-add-always_poll-quirk-for-vrs-r295-steeri.patch b/queue-6.6/hid-quirks-add-always_poll-quirk-for-vrs-r295-steeri.patch new file mode 100644 index 0000000000..f4e4230b1a --- /dev/null +++ b/queue-6.6/hid-quirks-add-always_poll-quirk-for-vrs-r295-steeri.patch @@ -0,0 +1,47 @@ +From 04bf0e3e6646f543eb791185025f6748158a265f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 18:46:11 +0300 +Subject: HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel + +From: Oleg Makarenko + +[ Upstream commit 1141ed52348d3df82d3fd2316128b3fc6203a68c ] + +This patch adds ALWAYS_POLL quirk for the VRS R295 steering wheel joystick. +This device reboots itself every 8-10 seconds if it is not polled. + +Signed-off-by: Oleg Makarenko +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-quirks.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index be24029782b10..fbbab353f040a 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -1403,6 +1403,7 @@ + + #define USB_VENDOR_ID_VRS 0x0483 + #define USB_DEVICE_ID_VRS_DFP 0xa355 ++#define USB_DEVICE_ID_VRS_R295 0xa44c + + #define USB_VENDOR_ID_VTL 0x0306 + #define USB_DEVICE_ID_VTL_MULTITOUCH_FF3F 0xff3f +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 468a47de96b10..75480ec3c15a2 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -207,6 +207,7 @@ static const struct hid_device_id hid_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_KNA5), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_TWA60), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, USB_DEVICE_ID_UGTIZER_TABLET_WP5540), HID_QUIRK_MULTI_INPUT }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_VRS, USB_DEVICE_ID_VRS_R295), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_10_6_INCH), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_14_1_INCH), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SIRIUS_BATTERY_FREE_TABLET), HID_QUIRK_MULTI_INPUT }, +-- +2.51.0 + diff --git a/queue-6.6/hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch b/queue-6.6/hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch new file mode 100644 index 0000000000..4a4f1a9676 --- /dev/null +++ b/queue-6.6/hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch @@ -0,0 +1,54 @@ +From f25c8ac11c0d2c26218fc31649422ee3dc6f036a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Sep 2025 18:25:43 +0200 +Subject: HID: quirks: avoid Cooler Master MM712 dongle wakeup bug + +From: Tristan Lobb + +[ Upstream commit 0be4253bf878d9aaa2b96031ac8683fceeb81480 ] + +The Cooler Master Mice Dongle includes a vendor defined HID interface +alongside its mouse interface. Not polling it will cause the mouse to +stop responding to polls on any interface once woken up again after +going into power saving mode. + +Add the HID_QUIRK_ALWAYS_POLL quirk alongside the Cooler Master VID and +the Dongle's PID. + +Signed-off-by: Tristan Lobb +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 3 +++ + drivers/hid/hid-quirks.c | 1 + + 2 files changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 8de59d8a54580..be24029782b10 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -332,6 +332,9 @@ + #define USB_DEVICE_ID_CODEMERCS_IOW_FIRST 0x1500 + #define USB_DEVICE_ID_CODEMERCS_IOW_LAST 0x15ff + ++#define USB_VENDOR_ID_COOLER_MASTER 0x2516 ++#define USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE 0x01b7 ++ + #define USB_VENDOR_ID_CORSAIR 0x1b1c + #define USB_DEVICE_ID_CORSAIR_K90 0x1b02 + #define USB_DEVICE_ID_CORSAIR_K70R 0x1b09 +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 64f9728018b88..468a47de96b10 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -57,6 +57,7 @@ static const struct hid_device_id hid_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_THROTTLE), HID_QUIRK_NOGET }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_COOLER_MASTER, USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB), HID_QUIRK_NO_INIT_REPORTS }, + { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE), HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB), HID_QUIRK_NO_INIT_REPORTS }, +-- +2.51.0 + diff --git a/queue-6.6/iommufd-make-vfio_compat-s-unmap-succeed-if-the-rang.patch b/queue-6.6/iommufd-make-vfio_compat-s-unmap-succeed-if-the-rang.patch new file mode 100644 index 0000000000..73c88e76e8 --- /dev/null +++ b/queue-6.6/iommufd-make-vfio_compat-s-unmap-succeed-if-the-rang.patch @@ -0,0 +1,96 @@ +From 45abd7fb449768a9c55461e040be568004ed73fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Nov 2025 14:11:49 -0400 +Subject: iommufd: Make vfio_compat's unmap succeed if the range is already + empty + +From: Jason Gunthorpe + +[ Upstream commit afb47765f9235181fddc61c8633b5a8cfae29fd2 ] + +iommufd returns ENOENT when attempting to unmap a range that is already +empty, while vfio type1 returns success. Fix vfio_compat to match. + +Fixes: d624d6652a65 ("iommufd: vfio container FD ioctl compatibility") +Link: https://patch.msgid.link/r/0-v1-76be45eff0be+5d-iommufd_unmap_compat_jgg@nvidia.com +Reviewed-by: Nicolin Chen +Reviewed-by: Alex Mastro +Reported-by: Alex Mastro +Closes: https://lore.kernel.org/r/aP0S5ZF9l3sWkJ1G@devgpu012.nha5.facebook.com +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/iommu/iommufd/io_pagetable.c | 12 +++--------- + drivers/iommu/iommufd/ioas.c | 4 ++++ + tools/testing/selftests/iommu/iommufd.c | 2 ++ + 3 files changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/iommu/iommufd/io_pagetable.c b/drivers/iommu/iommufd/io_pagetable.c +index f058405c5fbb6..6bd37343061e0 100644 +--- a/drivers/iommu/iommufd/io_pagetable.c ++++ b/drivers/iommu/iommufd/io_pagetable.c +@@ -488,7 +488,8 @@ static int iopt_unmap_iova_range(struct io_pagetable *iopt, unsigned long start, + struct iopt_area *area; + unsigned long unmapped_bytes = 0; + unsigned int tries = 0; +- int rc = -ENOENT; ++ /* If there are no mapped entries then success */ ++ int rc = 0; + + /* + * The domains_rwsem must be held in read mode any time any area->pages +@@ -552,8 +553,6 @@ static int iopt_unmap_iova_range(struct io_pagetable *iopt, unsigned long start, + + down_write(&iopt->iova_rwsem); + } +- if (unmapped_bytes) +- rc = 0; + + out_unlock_iova: + up_write(&iopt->iova_rwsem); +@@ -590,13 +589,8 @@ int iopt_unmap_iova(struct io_pagetable *iopt, unsigned long iova, + + int iopt_unmap_all(struct io_pagetable *iopt, unsigned long *unmapped) + { +- int rc; +- +- rc = iopt_unmap_iova_range(iopt, 0, ULONG_MAX, unmapped); + /* If the IOVAs are empty then unmap all succeeds */ +- if (rc == -ENOENT) +- return 0; +- return rc; ++ return iopt_unmap_iova_range(iopt, 0, ULONG_MAX, unmapped); + } + + /* The caller must always free all the nodes in the allowed_iova rb_root. */ +diff --git a/drivers/iommu/iommufd/ioas.c b/drivers/iommu/iommufd/ioas.c +index 0407e2b758ef4..18bbbeef5cccd 100644 +--- a/drivers/iommu/iommufd/ioas.c ++++ b/drivers/iommu/iommufd/ioas.c +@@ -317,6 +317,10 @@ int iommufd_ioas_unmap(struct iommufd_ucmd *ucmd) + &unmapped); + if (rc) + goto out_put; ++ if (!unmapped) { ++ rc = -ENOENT; ++ goto out_put; ++ } + } + + cmd->length = unmapped; +diff --git a/tools/testing/selftests/iommu/iommufd.c b/tools/testing/selftests/iommu/iommufd.c +index 890a81f4ff618..67fcc99fbd6d3 100644 +--- a/tools/testing/selftests/iommu/iommufd.c ++++ b/tools/testing/selftests/iommu/iommufd.c +@@ -1728,6 +1728,8 @@ TEST_F(vfio_compat_mock_domain, map) + ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_MAP_DMA, &map_cmd)); + ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_UNMAP_DMA, &unmap_cmd)); + ASSERT_EQ(BUFFER_SIZE, unmap_cmd.size); ++ /* Unmap of empty is success */ ++ ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_UNMAP_DMA, &unmap_cmd)); + + /* UNMAP_FLAG_ALL requres 0 iova/size */ + ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_MAP_DMA, &map_cmd)); +-- +2.51.0 + diff --git a/queue-6.6/nfs-check-if-suid-sgid-was-cleared-after-a-write-as-.patch b/queue-6.6/nfs-check-if-suid-sgid-was-cleared-after-a-write-as-.patch new file mode 100644 index 0000000000..e0508475e0 --- /dev/null +++ b/queue-6.6/nfs-check-if-suid-sgid-was-cleared-after-a-write-as-.patch @@ -0,0 +1,45 @@ +From 613a374be8d7b761579343c374f7e0060521e10d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 16:42:12 -0400 +Subject: NFS: check if suid/sgid was cleared after a write as needed + +From: Scott Mayhew + +[ Upstream commit 9ff022f3820a31507cb93be6661bf5f3ca0609a4 ] + +I noticed xfstests generic/193 and generic/355 started failing against +knfsd after commit e7a8ebc305f2 ("NFSD: Offer write delegation for OPEN +with OPEN4_SHARE_ACCESS_WRITE"). + +I ran those same tests against ONTAP (which has had write delegation +support for a lot longer than knfsd) and they fail there too... so +while it's a new failure against knfsd, it isn't an entirely new +failure. + +Add the NFS_INO_REVAL_FORCED flag so that the presence of a delegation +doesn't keep the inode from being revalidated to fetch the updated mode. + +Signed-off-by: Scott Mayhew +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/write.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/nfs/write.c b/fs/nfs/write.c +index cb1e9996fcc8e..ef69b15aa72e5 100644 +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -1638,7 +1638,8 @@ static int nfs_writeback_done(struct rpc_task *task, + /* Deal with the suid/sgid bit corner case */ + if (nfs_should_remove_suid(inode)) { + spin_lock(&inode->i_lock); +- nfs_set_cache_invalid(inode, NFS_INO_INVALID_MODE); ++ nfs_set_cache_invalid(inode, NFS_INO_INVALID_MODE ++ | NFS_INO_REVAL_FORCED); + spin_unlock(&inode->i_lock); + } + return 0; +-- +2.51.0 + diff --git a/queue-6.6/nfs4-fix-state-renewals-missing-after-boot.patch b/queue-6.6/nfs4-fix-state-renewals-missing-after-boot.patch new file mode 100644 index 0000000000..21e55a7e27 --- /dev/null +++ b/queue-6.6/nfs4-fix-state-renewals-missing-after-boot.patch @@ -0,0 +1,41 @@ +From 54792719ff637e6b15d93bcbceb31008a9e4bc46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 15:48:04 -0600 +Subject: NFS4: Fix state renewals missing after boot + +From: Joshua Watt + +[ Upstream commit 9bb3baa9d1604cd20f49ae7dac9306b4037a0e7a ] + +Since the last renewal time was initialized to 0 and jiffies start +counting at -5 minutes, any clients connected in the first 5 minutes +after a reboot would have their renewal timer set to a very long +interval. If the connection was idle, this would result in the client +state timing out on the server and the next call to the server would +return NFS4ERR_BADSESSION. + +Fix this by initializing the last renewal time to the current jiffies +instead of 0. + +Signed-off-by: Joshua Watt +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4client.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c +index f6dc42de48f03..32b1147fcafc4 100644 +--- a/fs/nfs/nfs4client.c ++++ b/fs/nfs/nfs4client.c +@@ -222,6 +222,7 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init) + clp->cl_state = 1 << NFS4CLNT_LEASE_EXPIRED; + clp->cl_mvops = nfs_v4_minor_ops[cl_init->minorversion]; + clp->cl_mig_gen = 1; ++ clp->cl_last_renewal = jiffies; + #if IS_ENABLED(CONFIG_NFS_V4_1) + init_waitqueue_head(&clp->cl_lock_waitq); + #endif +-- +2.51.0 + diff --git a/queue-6.6/risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch b/queue-6.6/risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch new file mode 100644 index 0000000000..dbb327b066 --- /dev/null +++ b/queue-6.6/risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch @@ -0,0 +1,49 @@ +From 069ccfa1e21074b4f6f7c1269f6871f59b3e5946 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 16:28:46 +0300 +Subject: RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid + rfence errors + +From: Danil Skrebenkov + +[ Upstream commit ae9e9f3d67dcef7582a4524047b01e33c5185ddb ] + +openSBI v1.7 adds harts checks for ipi operations. Especially it +adds comparison between hmask passed as an argument from linux +and mask of online harts (from openSBI side). If they don't +fit each other the error occurs. + +When cpu is offline, cpu_online_mask is explicitly cleared in +__cpu_disable. However, there is no explicit clearing of +mm_cpumask. mm_cpumask is used for rfence operations that +call openSBI RFENCE extension which uses ipi to remote harts. +If hart is offline there may be error if mask of linux is not +as mask of online harts in openSBI. + +this patch adds explicit clearing of mm_cpumask for offline hart. + +Signed-off-by: Danil Skrebenkov +Reviewed-by: Andrew Jones +Link: https://lore.kernel.org/r/20250919132849.31676-1-danil.skrebenkov@cloudbear.ru +[pjw@kernel.org: rewrote subject line for clarity] +Signed-off-by: Paul Walmsley +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/cpu-hotplug.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/riscv/kernel/cpu-hotplug.c b/arch/riscv/kernel/cpu-hotplug.c +index 6b710ef9d9aef..2114903ee3ad4 100644 +--- a/arch/riscv/kernel/cpu-hotplug.c ++++ b/arch/riscv/kernel/cpu-hotplug.c +@@ -61,6 +61,7 @@ void arch_cpuhp_cleanup_dead_cpu(unsigned int cpu) + + pr_notice("CPU%u: off\n", cpu); + ++ clear_tasks_mm_cpumask(cpu); + /* Verify from the firmware if the cpu is really stopped*/ + if (cpu_ops[cpu]->cpu_is_stopped) + ret = cpu_ops[cpu]->cpu_is_stopped(cpu); +-- +2.51.0 + diff --git a/queue-6.6/riscv-acpi-avoid-errors-caused-by-probing-dt-devices.patch b/queue-6.6/riscv-acpi-avoid-errors-caused-by-probing-dt-devices.patch new file mode 100644 index 0000000000..218fc0ad4e --- /dev/null +++ b/queue-6.6/riscv-acpi-avoid-errors-caused-by-probing-dt-devices.patch @@ -0,0 +1,48 @@ +From 11af88a91ecbb71df798aa7c006e86e0a6683aa5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 19:24:01 +0800 +Subject: riscv: acpi: avoid errors caused by probing DT devices when ACPI is + used + +From: Han Gao + +[ Upstream commit 69a8b62a7aa1e54ff7623064f6507fa29c1d0d4e ] + +Similar to the ARM64 commit 3505f30fb6a9s ("ARM64 / ACPI: If we chose +to boot from acpi then disable FDT"), let's not do DT hardware probing +if ACPI is enabled in early boot. This avoids errors caused by +repeated driver probing. + +Signed-off-by: Han Gao +Link: https://lore.kernel.org/r/20250910112401.552987-1-rabenda.cn@gmail.com +[pjw@kernel.org: cleaned up patch description and subject] +Signed-off-by: Paul Walmsley +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/setup.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c +index f598e0eb3b0a0..ee269b1c99a19 100644 +--- a/arch/riscv/kernel/setup.c ++++ b/arch/riscv/kernel/setup.c +@@ -318,11 +318,14 @@ void __init setup_arch(char **cmdline_p) + /* Parse the ACPI tables for possible boot-time configuration */ + acpi_boot_table_init(); + ++ if (acpi_disabled) { + #if IS_ENABLED(CONFIG_BUILTIN_DTB) +- unflatten_and_copy_device_tree(); ++ unflatten_and_copy_device_tree(); + #else +- unflatten_device_tree(); ++ unflatten_device_tree(); + #endif ++ } ++ + misc_mem_init(); + + init_resources(); +-- +2.51.0 + diff --git a/queue-6.6/series b/queue-6.6/series index 5bf14e0028..3fbc1596ea 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -374,3 +374,20 @@ drm-amdgpu-fix-function-header-names-in-amdgpu_connectors.c.patch drm-amd-display-fix-black-screen-with-hdmi-outputs.patch riscv-stacktrace-fix-backtracing-through-exceptions.patch selftests-netdevsim-set-test-timeout-to-10-minutes.patch +drm-i915-avoid-lock-inversion-when-pinning-to-ggtt-o.patch +drm-i915-fix-conversion-between-clock-ticks-and-nano.patch +smb-client-fix-refcount-leak-in-smb2_set_path_attr.patch +iommufd-make-vfio_compat-s-unmap-succeed-if-the-rang.patch +drm-amd-fix-suspend-failure-with-secure-display-ta.patch +compiler_types-move-unused-static-inline-functions-w.patch +risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch +riscv-acpi-avoid-errors-caused-by-probing-dt-devices.patch +drm-amd-pm-disable-mclk-switching-on-si-at-high-pixe.patch +drm-amdgpu-fix-null-pointer-dereference-in-vram-logi.patch +nfs4-fix-state-renewals-missing-after-boot.patch +hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch +nfs-check-if-suid-sgid-was-cleared-after-a-write-as-.patch +hid-quirks-add-always_poll-quirk-for-vrs-r295-steeri.patch +smb-server-fix-possible-memory-leak-in-smb2_read.patch +smb-server-fix-possible-refcount-leak-in-smb2_sess_s.patch +asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch diff --git a/queue-6.6/smb-client-fix-refcount-leak-in-smb2_set_path_attr.patch b/queue-6.6/smb-client-fix-refcount-leak-in-smb2_set_path_attr.patch new file mode 100644 index 0000000000..930415d753 --- /dev/null +++ b/queue-6.6/smb-client-fix-refcount-leak-in-smb2_set_path_attr.patch @@ -0,0 +1,42 @@ +From 0f3faf76d4bdf93ac33209da53862afeb61e73aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Nov 2025 23:13:15 +0800 +Subject: smb: client: fix refcount leak in smb2_set_path_attr + +From: Shuhao Fu + +[ Upstream commit b540de9e3b4fab3b9e10f30714a6f5c1b2a50ec3 ] + +Fix refcount leak in `smb2_set_path_attr` when path conversion fails. + +Function `cifs_get_writable_path` returns `cfile` with its reference +counter `cfile->count` increased on success. Function `smb2_compound_op` +would decrease the reference counter for `cfile`, as stated in its +comment. By calling `smb2_rename_path`, the reference counter of `cfile` +would leak if `cifs_convert_path_to_utf16` fails in `smb2_set_path_attr`. + +Fixes: 8de9e86c67ba ("cifs: create a helper to find a writeable handle by path name") +Acked-by: Henrique Carvalho +Signed-off-by: Shuhao Fu +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2inode.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c +index 232a3c2890556..d6086394d0b84 100644 +--- a/fs/smb/client/smb2inode.c ++++ b/fs/smb/client/smb2inode.c +@@ -1128,6 +1128,8 @@ static int smb2_set_path_attr(const unsigned int xid, struct cifs_tcon *tcon, + smb2_to_name = cifs_convert_path_to_utf16(to_name, cifs_sb); + if (smb2_to_name == NULL) { + rc = -ENOMEM; ++ if (cfile) ++ cifsFileInfo_put(cfile); + goto smb2_rename_path; + } + in_iov.iov_base = smb2_to_name; +-- +2.51.0 + diff --git a/queue-6.6/smb-server-fix-possible-memory-leak-in-smb2_read.patch b/queue-6.6/smb-server-fix-possible-memory-leak-in-smb2_read.patch new file mode 100644 index 0000000000..8e88cae766 --- /dev/null +++ b/queue-6.6/smb-server-fix-possible-memory-leak-in-smb2_read.patch @@ -0,0 +1,37 @@ +From 95c9045e79f33fc5b2532cb50ee6f26f2bb09ad6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Oct 2025 00:47:59 +0800 +Subject: smb/server: fix possible memory leak in smb2_read() + +From: ZhangGuoDong + +[ Upstream commit 6fced056d2cc8d01b326e6fcfabaacb9850b71a4 ] + +Memory leak occurs when ksmbd_vfs_read() fails. +Fix this by adding the missing kvfree(). + +Co-developed-by: ChenXiaoSong +Signed-off-by: ChenXiaoSong +Signed-off-by: ZhangGuoDong +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/smb2pdu.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c +index 9a58c5a6f9866..b3fa983a522fb 100644 +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -6772,6 +6772,7 @@ int smb2_read(struct ksmbd_work *work) + + nbytes = ksmbd_vfs_read(work, fp, length, &offset, aux_payload_buf); + if (nbytes < 0) { ++ kvfree(aux_payload_buf); + err = nbytes; + goto out; + } +-- +2.51.0 + diff --git a/queue-6.6/smb-server-fix-possible-refcount-leak-in-smb2_sess_s.patch b/queue-6.6/smb-server-fix-possible-refcount-leak-in-smb2_sess_s.patch new file mode 100644 index 0000000000..77d19069cd --- /dev/null +++ b/queue-6.6/smb-server-fix-possible-refcount-leak-in-smb2_sess_s.patch @@ -0,0 +1,37 @@ +From 267d3411256802046d8f8553b47d04dc0d20d7ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Oct 2025 00:51:36 +0800 +Subject: smb/server: fix possible refcount leak in smb2_sess_setup() + +From: ZhangGuoDong + +[ Upstream commit 379510a815cb2e64eb0a379cb62295d6ade65df0 ] + +Reference count of ksmbd_session will leak when session need reconnect. +Fix this by adding the missing ksmbd_user_session_put(). + +Co-developed-by: ChenXiaoSong +Signed-off-by: ChenXiaoSong +Signed-off-by: ZhangGuoDong +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/smb2pdu.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c +index b3fa983a522fb..9f64808c7917c 100644 +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -1793,6 +1793,7 @@ int smb2_sess_setup(struct ksmbd_work *work) + + if (ksmbd_conn_need_reconnect(conn)) { + rc = -EFAULT; ++ ksmbd_user_session_put(sess); + sess = NULL; + goto out_err; + } +-- +2.51.0 +