From 2f5f72b52b0fd08c060d308b594799ce08fd16b2 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 3 Feb 2026 15:29:55 +0100 Subject: [PATCH] 6.12-stable patches added patches: drm-amdgpu-fix-cond_exec-handling-in-amdgpu_ib_schedule.patch drm-amdgpu-fix-null-pointer-dereference-in-amdgpu_gmc_filter_faults_remove.patch drm-amdgpu-gfx10-fix-wptr-reset-in-kgq-init.patch drm-amdgpu-gfx11-fix-wptr-reset-in-kgq-init.patch drm-amdgpu-gfx12-fix-wptr-reset-in-kgq-init.patch drm-amdgpu-soc21-fix-xclk-for-apus.patch drm-imx-tve-fix-probe-device-leak.patch drm-msm-a6xx-fix-bogus-hwcg-register-updates.patch gpiolib-acpi-fix-potential-out-of-boundary-left-shift.patch scripts-generate_rust_analyzer-add-compiler_builtins-core-dep.patch scripts-generate_rust_analyzer-compile-sysroot-with-correct-edition.patch scripts-generate_rust_analyzer-remove-sysroot-assertion.patch --- ..._exec-handling-in-amdgpu_ib_schedule.patch | 46 +++++++++++ ...e-in-amdgpu_gmc_filter_faults_remove.patch | 78 +++++++++++++++++++ ...gpu-gfx10-fix-wptr-reset-in-kgq-init.patch | 37 +++++++++ ...gpu-gfx11-fix-wptr-reset-in-kgq-init.patch | 37 +++++++++ ...gpu-gfx12-fix-wptr-reset-in-kgq-init.patch | 37 +++++++++ .../drm-amdgpu-soc21-fix-xclk-for-apus.patch | 39 ++++++++++ .../drm-imx-tve-fix-probe-device-leak.patch | 53 +++++++++++++ ...a6xx-fix-bogus-hwcg-register-updates.patch | 51 ++++++++++++ ...potential-out-of-boundary-left-shift.patch | 72 +++++++++++++++++ ...lyzer-add-compiler_builtins-core-dep.patch | 37 +++++++++ ...compile-sysroot-with-correct-edition.patch | 73 +++++++++++++++++ ...st_analyzer-remove-sysroot-assertion.patch | 44 +++++++++++ queue-6.12/series | 12 +++ 13 files changed, 616 insertions(+) create mode 100644 queue-6.12/drm-amdgpu-fix-cond_exec-handling-in-amdgpu_ib_schedule.patch create mode 100644 queue-6.12/drm-amdgpu-fix-null-pointer-dereference-in-amdgpu_gmc_filter_faults_remove.patch create mode 100644 queue-6.12/drm-amdgpu-gfx10-fix-wptr-reset-in-kgq-init.patch create mode 100644 queue-6.12/drm-amdgpu-gfx11-fix-wptr-reset-in-kgq-init.patch create mode 100644 queue-6.12/drm-amdgpu-gfx12-fix-wptr-reset-in-kgq-init.patch create mode 100644 queue-6.12/drm-amdgpu-soc21-fix-xclk-for-apus.patch create mode 100644 queue-6.12/drm-imx-tve-fix-probe-device-leak.patch create mode 100644 queue-6.12/drm-msm-a6xx-fix-bogus-hwcg-register-updates.patch create mode 100644 queue-6.12/gpiolib-acpi-fix-potential-out-of-boundary-left-shift.patch create mode 100644 queue-6.12/scripts-generate_rust_analyzer-add-compiler_builtins-core-dep.patch create mode 100644 queue-6.12/scripts-generate_rust_analyzer-compile-sysroot-with-correct-edition.patch create mode 100644 queue-6.12/scripts-generate_rust_analyzer-remove-sysroot-assertion.patch diff --git a/queue-6.12/drm-amdgpu-fix-cond_exec-handling-in-amdgpu_ib_schedule.patch b/queue-6.12/drm-amdgpu-fix-cond_exec-handling-in-amdgpu_ib_schedule.patch new file mode 100644 index 0000000000..c9a77b1035 --- /dev/null +++ b/queue-6.12/drm-amdgpu-fix-cond_exec-handling-in-amdgpu_ib_schedule.patch @@ -0,0 +1,46 @@ +From b1defcdc4457649db236415ee618a7151e28788c Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 26 Jan 2026 23:44:45 -0500 +Subject: drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() + +From: Alex Deucher + +commit b1defcdc4457649db236415ee618a7151e28788c upstream. + +The EXEC_COUNT field must be > 0. In the gfx shadow +handling we always emit a cond_exec packet after the gfx_shadow +packet, but the EXEC_COUNT never gets patched. This leads +to a hang when we try and reset queues on gfx11 APUs. + +Fixes: c68cbbfd54c6 ("drm/amdgpu: cleanup conditional execution") +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4789 +Reviewed-by: Jesse Zhang +Signed-off-by: Alex Deucher +(cherry picked from commit ba205ac3d6e83f56c4f824f23f1b4522cb844ff3) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c +@@ -223,7 +223,7 @@ int amdgpu_ib_schedule(struct amdgpu_rin + + amdgpu_ring_ib_begin(ring); + +- if (ring->funcs->emit_gfx_shadow) ++ if (ring->funcs->emit_gfx_shadow && adev->gfx.cp_gfx_shadow) + amdgpu_ring_emit_gfx_shadow(ring, shadow_va, csa_va, gds_va, + init_shadow, vmid); + +@@ -279,7 +279,8 @@ int amdgpu_ib_schedule(struct amdgpu_rin + fence_flags | AMDGPU_FENCE_FLAG_64BIT); + } + +- if (ring->funcs->emit_gfx_shadow && ring->funcs->init_cond_exec) { ++ if (ring->funcs->emit_gfx_shadow && ring->funcs->init_cond_exec && ++ adev->gfx.cp_gfx_shadow) { + amdgpu_ring_emit_gfx_shadow(ring, 0, 0, 0, false, 0); + amdgpu_ring_init_cond_exec(ring, ring->cond_exe_gpu_addr); + } diff --git a/queue-6.12/drm-amdgpu-fix-null-pointer-dereference-in-amdgpu_gmc_filter_faults_remove.patch b/queue-6.12/drm-amdgpu-fix-null-pointer-dereference-in-amdgpu_gmc_filter_faults_remove.patch new file mode 100644 index 0000000000..8bee1e537b --- /dev/null +++ b/queue-6.12/drm-amdgpu-fix-null-pointer-dereference-in-amdgpu_gmc_filter_faults_remove.patch @@ -0,0 +1,78 @@ +From 8b1ecc9377bc641533cd9e76dfa3aee3cd04a007 Mon Sep 17 00:00:00 2001 +From: Jon Doron +Date: Sat, 20 Dec 2025 15:04:40 +0200 +Subject: drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jon Doron + +commit 8b1ecc9377bc641533cd9e76dfa3aee3cd04a007 upstream. + +On APUs such as Raven and Renoir (GC 9.1.0, 9.2.2, 9.3.0), the ih1 and +ih2 interrupt ring buffers are not initialized. This is by design, as +these secondary IH rings are only available on discrete GPUs. See +vega10_ih_sw_init() which explicitly skips ih1/ih2 initialization when +AMD_IS_APU is set. + +However, amdgpu_gmc_filter_faults_remove() unconditionally uses ih1 to +get the timestamp of the last interrupt entry. When retry faults are +enabled on APUs (noretry=0), this function is called from the SVM page +fault recovery path, resulting in a NULL pointer dereference when +amdgpu_ih_decode_iv_ts_helper() attempts to access ih->ring[]. + +The crash manifests as: + + BUG: kernel NULL pointer dereference, address: 0000000000000004 + RIP: 0010:amdgpu_ih_decode_iv_ts_helper+0x22/0x40 [amdgpu] + Call Trace: + amdgpu_gmc_filter_faults_remove+0x60/0x130 [amdgpu] + svm_range_restore_pages+0xae5/0x11c0 [amdgpu] + amdgpu_vm_handle_fault+0xc8/0x340 [amdgpu] + gmc_v9_0_process_interrupt+0x191/0x220 [amdgpu] + amdgpu_irq_dispatch+0xed/0x2c0 [amdgpu] + amdgpu_ih_process+0x84/0x100 [amdgpu] + +This issue was exposed by commit 1446226d32a4 ("drm/amdgpu: Remove GC HW +IP 9.3.0 from noretry=1") which changed the default for Renoir APU from +noretry=1 to noretry=0, enabling retry fault handling and thus +exercising the buggy code path. + +Fix this by adding a check for ih1.ring_size before attempting to use +it. Also restore the soft_ih support from commit dd299441654f ("drm/amdgpu: +Rework retry fault removal"). This is needed if the hardware doesn't +support secondary HW IH rings. + +v2: additional updates (Alex) + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3814 +Fixes: dd299441654f ("drm/amdgpu: Rework retry fault removal") +Reviewed-by: Timur Kristóf +Reviewed-by: Philip Yang +Signed-off-by: Jon Doron +Signed-off-by: Alex Deucher +(cherry picked from commit 6ce8d536c80aa1f059e82184f0d1994436b1d526) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c +@@ -482,8 +482,13 @@ void amdgpu_gmc_filter_faults_remove(str + + if (adev->irq.retry_cam_enabled) + return; ++ else if (adev->irq.ih1.ring_size) ++ ih = &adev->irq.ih1; ++ else if (adev->irq.ih_soft.enabled) ++ ih = &adev->irq.ih_soft; ++ else ++ return; + +- ih = &adev->irq.ih1; + /* Get the WPTR of the last entry in IH ring */ + last_wptr = amdgpu_ih_get_wptr(adev, ih); + /* Order wptr with ring data. */ diff --git a/queue-6.12/drm-amdgpu-gfx10-fix-wptr-reset-in-kgq-init.patch b/queue-6.12/drm-amdgpu-gfx10-fix-wptr-reset-in-kgq-init.patch new file mode 100644 index 0000000000..952a07b774 --- /dev/null +++ b/queue-6.12/drm-amdgpu-gfx10-fix-wptr-reset-in-kgq-init.patch @@ -0,0 +1,37 @@ +From cc4f433b14e05eaa4a98fd677b836e9229422387 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 28 Jan 2026 20:51:08 -0500 +Subject: drm/amdgpu/gfx10: fix wptr reset in KGQ init +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +commit cc4f433b14e05eaa4a98fd677b836e9229422387 upstream. + +wptr is a 64 bit value and we need to update the +full value, not just 32 bits. Align with what we +already do for KCQs. + +Reviewed-by: Timur Kristóf +Reviewed-by: Jesse Zhang +Signed-off-by: Alex Deucher +(cherry picked from commit e80b1d1aa1073230b6c25a1a72e88f37e425ccda) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +@@ -6729,7 +6729,7 @@ static int gfx_v10_0_kgq_init_queue(stru + memcpy_toio(mqd, adev->gfx.me.mqd_backup[mqd_idx], sizeof(*mqd)); + /* reset the ring */ + ring->wptr = 0; +- *ring->wptr_cpu_addr = 0; ++ atomic64_set((atomic64_t *)ring->wptr_cpu_addr, 0); + amdgpu_ring_clear_ring(ring); + } + diff --git a/queue-6.12/drm-amdgpu-gfx11-fix-wptr-reset-in-kgq-init.patch b/queue-6.12/drm-amdgpu-gfx11-fix-wptr-reset-in-kgq-init.patch new file mode 100644 index 0000000000..5610d623f2 --- /dev/null +++ b/queue-6.12/drm-amdgpu-gfx11-fix-wptr-reset-in-kgq-init.patch @@ -0,0 +1,37 @@ +From b1f810471c6a6bd349f7f9f2f2fed96082056d46 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 28 Jan 2026 18:09:03 -0500 +Subject: drm/amdgpu/gfx11: fix wptr reset in KGQ init +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +commit b1f810471c6a6bd349f7f9f2f2fed96082056d46 upstream. + +wptr is a 64 bit value and we need to update the +full value, not just 32 bits. Align with what we +already do for KCQs. + +Reviewed-by: Timur Kristóf +Reviewed-by: Jesse Zhang +Signed-off-by: Alex Deucher +(cherry picked from commit 1f16866bdb1daed7a80ca79ae2837a9832a74fbc) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +@@ -4026,7 +4026,7 @@ static int gfx_v11_0_kgq_init_queue(stru + memcpy_toio(mqd, adev->gfx.me.mqd_backup[mqd_idx], sizeof(*mqd)); + /* reset the ring */ + ring->wptr = 0; +- *ring->wptr_cpu_addr = 0; ++ atomic64_set((atomic64_t *)ring->wptr_cpu_addr, 0); + amdgpu_ring_clear_ring(ring); + } + diff --git a/queue-6.12/drm-amdgpu-gfx12-fix-wptr-reset-in-kgq-init.patch b/queue-6.12/drm-amdgpu-gfx12-fix-wptr-reset-in-kgq-init.patch new file mode 100644 index 0000000000..c9b9b1f5ce --- /dev/null +++ b/queue-6.12/drm-amdgpu-gfx12-fix-wptr-reset-in-kgq-init.patch @@ -0,0 +1,37 @@ +From 9077d32a4b570fa20500aa26e149981c366c965d Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 28 Jan 2026 18:13:16 -0500 +Subject: drm/amdgpu/gfx12: fix wptr reset in KGQ init +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +commit 9077d32a4b570fa20500aa26e149981c366c965d upstream. + +wptr is a 64 bit value and we need to update the +full value, not just 32 bits. Align with what we +already do for KCQs. + +Reviewed-by: Timur Kristóf +Reviewed-by: Jesse Zhang +Signed-off-by: Alex Deucher +(cherry picked from commit a2918f958d3f677ea93c0ac257cb6ba69b7abb7c) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c +@@ -2958,7 +2958,7 @@ static int gfx_v12_0_kgq_init_queue(stru + memcpy_toio(mqd, adev->gfx.me.mqd_backup[mqd_idx], sizeof(*mqd)); + /* reset the ring */ + ring->wptr = 0; +- *ring->wptr_cpu_addr = 0; ++ atomic64_set((atomic64_t *)ring->wptr_cpu_addr, 0); + amdgpu_ring_clear_ring(ring); + } + diff --git a/queue-6.12/drm-amdgpu-soc21-fix-xclk-for-apus.patch b/queue-6.12/drm-amdgpu-soc21-fix-xclk-for-apus.patch new file mode 100644 index 0000000000..023ae49063 --- /dev/null +++ b/queue-6.12/drm-amdgpu-soc21-fix-xclk-for-apus.patch @@ -0,0 +1,39 @@ +From e7fbff9e7622a00c2b53cb14df481916f0019742 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Fri, 16 Jan 2026 17:33:05 -0500 +Subject: drm/amdgpu/soc21: fix xclk for APUs + +From: Alex Deucher + +commit e7fbff9e7622a00c2b53cb14df481916f0019742 upstream. + +The reference clock is supposed to be 100Mhz, but it +appears to actually be slightly lower (99.81Mhz). + +Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/14451 +Reviewed-by: Jesse Zhang +Signed-off-by: Alex Deucher +(cherry picked from commit 637fee3954d4bd509ea9d95ad1780fc174489860) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/soc21.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/soc21.c ++++ b/drivers/gpu/drm/amd/amdgpu/soc21.c +@@ -225,7 +225,13 @@ static u32 soc21_get_config_memsize(stru + + static u32 soc21_get_xclk(struct amdgpu_device *adev) + { +- return adev->clock.spll.reference_freq; ++ u32 reference_clock = adev->clock.spll.reference_freq; ++ ++ /* reference clock is actually 99.81 Mhz rather than 100 Mhz */ ++ if ((adev->flags & AMD_IS_APU) && reference_clock == 10000) ++ return 9981; ++ ++ return reference_clock; + } + + diff --git a/queue-6.12/drm-imx-tve-fix-probe-device-leak.patch b/queue-6.12/drm-imx-tve-fix-probe-device-leak.patch new file mode 100644 index 0000000000..c178a7a206 --- /dev/null +++ b/queue-6.12/drm-imx-tve-fix-probe-device-leak.patch @@ -0,0 +1,53 @@ +From e535c23513c63f02f67e3e09e0787907029efeaf Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 30 Oct 2025 17:34:56 +0100 +Subject: drm/imx/tve: fix probe device leak + +From: Johan Hovold + +commit e535c23513c63f02f67e3e09e0787907029efeaf upstream. + +Make sure to drop the reference taken to the DDC device during probe on +probe failure (e.g. probe deferral) and on driver unbind. + +Fixes: fcbc51e54d2a ("staging: drm/imx: Add support for Television Encoder (TVEv2)") +Cc: stable@vger.kernel.org # 3.10 +Cc: Philipp Zabel +Reviewed-by: Frank Li +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20251030163456.15807-1-johan@kernel.org +Signed-off-by: Maxime Ripard +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/imx/ipuv3/imx-tve.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/drivers/gpu/drm/imx/ipuv3/imx-tve.c ++++ b/drivers/gpu/drm/imx/ipuv3/imx-tve.c +@@ -519,6 +519,13 @@ static const struct component_ops imx_tv + .bind = imx_tve_bind, + }; + ++static void imx_tve_put_device(void *_dev) ++{ ++ struct device *dev = _dev; ++ ++ put_device(dev); ++} ++ + static int imx_tve_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; +@@ -540,6 +547,12 @@ static int imx_tve_probe(struct platform + if (ddc_node) { + tve->ddc = of_find_i2c_adapter_by_node(ddc_node); + of_node_put(ddc_node); ++ if (tve->ddc) { ++ ret = devm_add_action_or_reset(dev, imx_tve_put_device, ++ &tve->ddc->dev); ++ if (ret) ++ return ret; ++ } + } + + tve->mode = of_get_tve_mode(np); diff --git a/queue-6.12/drm-msm-a6xx-fix-bogus-hwcg-register-updates.patch b/queue-6.12/drm-msm-a6xx-fix-bogus-hwcg-register-updates.patch new file mode 100644 index 0000000000..65663c7196 --- /dev/null +++ b/queue-6.12/drm-msm-a6xx-fix-bogus-hwcg-register-updates.patch @@ -0,0 +1,51 @@ +From dedb897f11c5d7e32c0e0a0eff7cec23a8047167 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Sun, 21 Dec 2025 17:45:52 +0100 +Subject: drm/msm/a6xx: fix bogus hwcg register updates + +From: Johan Hovold + +commit dedb897f11c5d7e32c0e0a0eff7cec23a8047167 upstream. + +The hw clock gating register sequence consists of register value pairs +that are written to the GPU during initialisation. + +The a690 hwcg sequence has two GMU registers in it that used to amount +to random writes in the GPU mapping, but since commit 188db3d7fe66 +("drm/msm/a6xx: Rebase GMU register offsets") they trigger a fault as +the updated offsets now lie outside the mapping. This in turn breaks +boot of machines like the Lenovo ThinkPad X13s. + +Note that the updates of these GMU registers is already taken care of +properly since commit 40c297eb245b ("drm/msm/a6xx: Set GMU CGC +properties on a6xx too"), but for some reason these two entries were +left in the table. + +Fixes: 5e7665b5e484 ("drm/msm/adreno: Add Adreno A690 support") +Cc: stable@vger.kernel.org # 6.5 +Cc: Bjorn Andersson +Cc: Konrad Dybcio +Signed-off-by: Johan Hovold +Reviewed-by: Konrad Dybcio +Reviewed-by: Akhil P Oommen +Fixes: 188db3d7fe66 ("drm/msm/a6xx: Rebase GMU register offsets") +Patchwork: https://patchwork.freedesktop.org/patch/695778/ +Message-ID: <20251221164552.19990-1-johan@kernel.org> +Signed-off-by: Rob Clark +(cherry picked from commit dcbd2f8280eea2c965453ed8c3c69d6f121e950b) +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/adreno/a6xx_catalog.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/gpu/drm/msm/adreno/a6xx_catalog.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_catalog.c +@@ -501,8 +501,6 @@ static const struct adreno_reglist a690_ + {REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222}, + {REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111}, + {REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555}, +- {REG_A6XX_GPU_GMU_AO_GMU_CGC_DELAY_CNTL, 0x10111}, +- {REG_A6XX_GPU_GMU_AO_GMU_CGC_HYST_CNTL, 0x5555}, + {} + }; + diff --git a/queue-6.12/gpiolib-acpi-fix-potential-out-of-boundary-left-shift.patch b/queue-6.12/gpiolib-acpi-fix-potential-out-of-boundary-left-shift.patch new file mode 100644 index 0000000000..a3d6f827a7 --- /dev/null +++ b/queue-6.12/gpiolib-acpi-fix-potential-out-of-boundary-left-shift.patch @@ -0,0 +1,72 @@ +From e64d1cb21a1c6ecd51bc1c94c83f6fc656f7c94d Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Wed, 28 Jan 2026 10:58:54 +0100 +Subject: gpiolib: acpi: Fix potential out-of-boundary left shift + +From: Andy Shevchenko + +commit e64d1cb21a1c6ecd51bc1c94c83f6fc656f7c94d upstream. + +GPIO Address Space handler gets a pointer to the in or out value. +This value is supposed to be at least 64-bit, but it's not limited +to be exactly 64-bit. When ACPI tables are being parsed, for +the bigger Connection():s ACPICA creates a Buffer instead of regular +Integer object. The Buffer exists as long as Namespace holds +the certain Connection(). Hence we can access the necessary bits +without worrying. On the other hand, the left shift, used in +the code, is limited by 31 (on 32-bit platforms) and otherwise +considered to be Undefined Behaviour. Also the code uses only +the first 64-bit word for the value, and anything bigger than 63 +will be also subject to UB. Fix all this by modifying the code +to correctly set or clear the respective bit in the bitmap constructed +of 64-bit words. + +Fixes: 59084c564c41 ("gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler") +Fixes: 2c4d00cb8fc5 ("gpiolib: acpi: Use BIT() macro to increase readability") +Cc: stable@vger.kernel.org +Reviewed-by: Mika Westerberg +Signed-off-by: Andy Shevchenko +Link: https://patch.msgid.link/20260128095918.4157491-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpiolib-acpi-core.c | 21 +++++++++++++++++---- + 1 file changed, 17 insertions(+), 4 deletions(-) + +--- a/drivers/gpio/gpiolib-acpi-core.c ++++ b/drivers/gpio/gpiolib-acpi-core.c +@@ -1094,6 +1094,7 @@ acpi_gpio_adr_space_handler(u32 function + unsigned int pin = agpio->pin_table[i]; + struct acpi_gpio_connection *conn; + struct gpio_desc *desc; ++ u16 word, shift; + bool found; + + mutex_lock(&achip->conn_lock); +@@ -1148,10 +1149,22 @@ acpi_gpio_adr_space_handler(u32 function + + mutex_unlock(&achip->conn_lock); + +- if (function == ACPI_WRITE) +- gpiod_set_raw_value_cansleep(desc, !!(*value & BIT_ULL(i))); +- else +- *value |= (u64)gpiod_get_raw_value_cansleep(desc) << i; ++ /* ++ * For the cases when OperationRegion() consists of more than ++ * 64 bits calculate the word and bit shift to use that one to ++ * access the value. ++ */ ++ word = i / 64; ++ shift = i % 64; ++ ++ if (function == ACPI_WRITE) { ++ gpiod_set_raw_value_cansleep(desc, value[word] & BIT_ULL(shift)); ++ } else { ++ if (gpiod_get_raw_value_cansleep(desc)) ++ value[word] |= BIT_ULL(shift); ++ else ++ value[word] &= ~BIT_ULL(shift); ++ } + } + + out: diff --git a/queue-6.12/scripts-generate_rust_analyzer-add-compiler_builtins-core-dep.patch b/queue-6.12/scripts-generate_rust_analyzer-add-compiler_builtins-core-dep.patch new file mode 100644 index 0000000000..31b1e4ce40 --- /dev/null +++ b/queue-6.12/scripts-generate_rust_analyzer-add-compiler_builtins-core-dep.patch @@ -0,0 +1,37 @@ +From 5157c328edb35bac05ce77da473c3209d20e0bbb Mon Sep 17 00:00:00 2001 +From: Tamir Duberstein +Date: Wed, 23 Jul 2025 11:39:40 -0400 +Subject: scripts: generate_rust_analyzer: Add compiler_builtins -> core dep + +From: Tamir Duberstein + +commit 5157c328edb35bac05ce77da473c3209d20e0bbb upstream. + +Add a dependency edge from `compiler_builtins` to `core` to +`scripts/generate_rust_analyzer.py` to match `rust/Makefile`. This has +been incorrect since commit 8c4555ccc55c ("scripts: add +`generate_rust_analyzer.py`") + +Signed-off-by: Tamir Duberstein +Reviewed-by: Jesung Yang +Acked-by: Benno Lossin +Fixes: 8c4555ccc55c ("scripts: add `generate_rust_analyzer.py`") +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20250723-rust-analyzer-pin-init-v1-1-3c6956173c78@kernel.org +Signed-off-by: Miguel Ojeda +Signed-off-by: Greg Kroah-Hartman +--- + scripts/generate_rust_analyzer.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/scripts/generate_rust_analyzer.py ++++ b/scripts/generate_rust_analyzer.py +@@ -98,7 +98,7 @@ def generate_crates(srctree, objtree, sy + append_crate( + "compiler_builtins", + srctree / "rust" / "compiler_builtins.rs", +- [], ++ ["core"], + ) + + append_crate( diff --git a/queue-6.12/scripts-generate_rust_analyzer-compile-sysroot-with-correct-edition.patch b/queue-6.12/scripts-generate_rust_analyzer-compile-sysroot-with-correct-edition.patch new file mode 100644 index 0000000000..875e7aec7b --- /dev/null +++ b/queue-6.12/scripts-generate_rust_analyzer-compile-sysroot-with-correct-edition.patch @@ -0,0 +1,73 @@ +From ac3c50b9a24e9ebeb585679078d6c47922034bb6 Mon Sep 17 00:00:00 2001 +From: Tamir Duberstein +Date: Fri, 16 Jan 2026 15:46:04 -0500 +Subject: scripts: generate_rust_analyzer: compile sysroot with correct edition + +From: Tamir Duberstein + +commit ac3c50b9a24e9ebeb585679078d6c47922034bb6 upstream. + +Use `core_edition` for all sysroot crates rather than just core as all +were updated to edition 2024 in Rust 1.87. + +Fixes: f4daa80d6be7 ("rust: compile libcore with edition 2024 for 1.87+") +Signed-off-by: Tamir Duberstein +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20260116-rust-analyzer-sysroot-v2-1-094aedc33208@kernel.org +[ Added `>`s to make the quote a single block. - Miguel ] +Signed-off-by: Miguel Ojeda +Signed-off-by: Greg Kroah-Hartman +--- + scripts/generate_rust_analyzer.py | 29 ++++++++++++++++++++++++++--- + 1 file changed, 26 insertions(+), 3 deletions(-) + +--- a/scripts/generate_rust_analyzer.py ++++ b/scripts/generate_rust_analyzer.py +@@ -53,7 +53,6 @@ def generate_crates(srctree, objtree, sy + display_name, + deps, + cfg=[], +- edition="2021", + ): + append_crate( + display_name, +@@ -61,13 +60,37 @@ def generate_crates(srctree, objtree, sy + deps, + cfg, + is_workspace_member=False, +- edition=edition, ++ # Miguel Ojeda writes: ++ # ++ # > ... in principle even the sysroot crates may have different ++ # > editions. ++ # > ++ # > For instance, in the move to 2024, it seems all happened at once ++ # > in 1.87.0 in these upstream commits: ++ # > ++ # > 0e071c2c6a58 ("Migrate core to Rust 2024") ++ # > f505d4e8e380 ("Migrate alloc to Rust 2024") ++ # > 0b2489c226c3 ("Migrate proc_macro to Rust 2024") ++ # > 993359e70112 ("Migrate std to Rust 2024") ++ # > ++ # > But in the previous move to 2021, `std` moved in 1.59.0, while ++ # > the others in 1.60.0: ++ # > ++ # > b656384d8398 ("Update stdlib to the 2021 edition") ++ # > 06a1c14d52a8 ("Switch all libraries to the 2021 edition") ++ # ++ # Link: https://lore.kernel.org/all/CANiq72kd9bHdKaAm=8xCUhSHMy2csyVed69bOc4dXyFAW4sfuw@mail.gmail.com/ ++ # ++ # At the time of writing all rust versions we support build the ++ # sysroot crates with the same edition. We may need to relax this ++ # assumption if future edition moves span multiple rust versions. ++ edition=core_edition, + ) + + # NB: sysroot crates reexport items from one another so setting up our transitive dependencies + # here is important for ensuring that rust-analyzer can resolve symbols. The sources of truth + # for this dependency graph are `(sysroot_src / crate / "Cargo.toml" for crate in crates)`. +- append_sysroot_crate("core", [], cfg=crates_cfgs.get("core", []), edition=core_edition) ++ append_sysroot_crate("core", [], cfg=crates_cfgs.get("core", [])) + append_sysroot_crate("alloc", ["core"]) + append_sysroot_crate("std", ["alloc", "core"]) + append_sysroot_crate("proc_macro", ["core", "std"]) diff --git a/queue-6.12/scripts-generate_rust_analyzer-remove-sysroot-assertion.patch b/queue-6.12/scripts-generate_rust_analyzer-remove-sysroot-assertion.patch new file mode 100644 index 0000000000..45dd0fd2cc --- /dev/null +++ b/queue-6.12/scripts-generate_rust_analyzer-remove-sysroot-assertion.patch @@ -0,0 +1,44 @@ +From 1b83ef9f7ad4635c913b80ef5e718f95f48e85af Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Onur=20=C3=96zkan?= +Date: Wed, 24 Dec 2025 16:53:43 +0300 +Subject: scripts: generate_rust_analyzer: remove sysroot assertion +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Onur Özkan + +commit 1b83ef9f7ad4635c913b80ef5e718f95f48e85af upstream. + +With nixpkgs's rustc, rust-src component is not bundled +with the compiler by default and is instead provided from +a separate store path, so this assumption does not hold. + +The assertion assumes these paths are in the same location +which causes `make LLVM=1 rust-analyzer` to fail on NixOS. + +Link: https://rust-for-linux.zulipchat.com/#narrow/stream/x/topic/x/near/565284250 +Signed-off-by: Onur Özkan +Reviewed-by: Gary Guo +Fixes: fe992163575b ("rust: Support latest version of `rust-analyzer`") +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20251224135343.32476-1-work@onurozkan.dev +[ Reworded title. - Miguel ] +Signed-off-by: Miguel Ojeda +Signed-off-by: Greg Kroah-Hartman +--- + scripts/generate_rust_analyzer.py | 3 --- + 1 file changed, 3 deletions(-) + +--- a/scripts/generate_rust_analyzer.py ++++ b/scripts/generate_rust_analyzer.py +@@ -170,9 +170,6 @@ def main(): + level=logging.INFO if args.verbose else logging.WARNING + ) + +- # Making sure that the `sysroot` and `sysroot_src` belong to the same toolchain. +- assert args.sysroot in args.sysroot_src.parents +- + rust_project = { + "crates": generate_crates(args.srctree, args.objtree, args.sysroot_src, args.exttree, args.cfgs, args.core_edition), + "sysroot": str(args.sysroot), diff --git a/queue-6.12/series b/queue-6.12/series index 231d742083..fe7bdc4afa 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -53,3 +53,15 @@ mm-memory-failure-fix-missing-mf_stats-count-in-hugetlb-poison.patch mm-memory-failure-teach-kill_accessing_process-to-accept-hugetlb-tail-page-pfn.patch mm-shmem-swap-fix-race-of-truncate-and-swap-entry-split.patch net-fix-segmentation-of-forwarding-fraglist-gro.patch +scripts-generate_rust_analyzer-remove-sysroot-assertion.patch +scripts-generate_rust_analyzer-compile-sysroot-with-correct-edition.patch +scripts-generate_rust_analyzer-add-compiler_builtins-core-dep.patch +drm-msm-a6xx-fix-bogus-hwcg-register-updates.patch +drm-imx-tve-fix-probe-device-leak.patch +drm-amdgpu-soc21-fix-xclk-for-apus.patch +drm-amdgpu-gfx10-fix-wptr-reset-in-kgq-init.patch +drm-amdgpu-gfx11-fix-wptr-reset-in-kgq-init.patch +drm-amdgpu-gfx12-fix-wptr-reset-in-kgq-init.patch +drm-amdgpu-fix-null-pointer-dereference-in-amdgpu_gmc_filter_faults_remove.patch +drm-amdgpu-fix-cond_exec-handling-in-amdgpu_ib_schedule.patch +gpiolib-acpi-fix-potential-out-of-boundary-left-shift.patch -- 2.47.3