From b90554dea9c3c618ce7fac128a029461b9b77b83 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 16 Oct 2025 11:34:26 +0200 Subject: [PATCH] 6.17-stable patches added patches: drm-amd-display-enable-dynamic-dtbclk-switch.patch drm-amd-display-fix-unsafe-uses-of-kernel-mode-fpu.patch drm-amd-display-incorrect-mirror-cositing.patch drm-exynos-exynos7_drm_decon-remove-ctx-suspended.patch drm-msm-a6xx-fix-pdc-sleep-sequence.patch drm-nouveau-fix-bad-ret-code-in-nouveau_bo_move_prep.patch drm-panthor-fix-memory-leak-in-panthor_ioctl_group_create.patch drm-rcar-du-dsi-fix-1-2-3-lane-support.patch drm-xe-uapi-loosen-used-tracking-restriction.patch --- ...display-enable-dynamic-dtbclk-switch.patch | 38 +++ ...y-fix-unsafe-uses-of-kernel-mode-fpu.patch | 222 ++++++++++++++++++ ...md-display-incorrect-mirror-cositing.patch | 53 +++++ ...ynos7_drm_decon-remove-ctx-suspended.patch | 162 +++++++++++++ .../drm-msm-a6xx-fix-pdc-sleep-sequence.patch | 128 ++++++++++ ...bad-ret-code-in-nouveau_bo_move_prep.patch | 34 +++ ...y-leak-in-panthor_ioctl_group_create.patch | 50 ++++ ...m-rcar-du-dsi-fix-1-2-3-lane-support.patch | 73 ++++++ ...api-loosen-used-tracking-restriction.patch | 74 ++++++ queue-6.17/series | 9 + 10 files changed, 843 insertions(+) create mode 100644 queue-6.17/drm-amd-display-enable-dynamic-dtbclk-switch.patch create mode 100644 queue-6.17/drm-amd-display-fix-unsafe-uses-of-kernel-mode-fpu.patch create mode 100644 queue-6.17/drm-amd-display-incorrect-mirror-cositing.patch create mode 100644 queue-6.17/drm-exynos-exynos7_drm_decon-remove-ctx-suspended.patch create mode 100644 queue-6.17/drm-msm-a6xx-fix-pdc-sleep-sequence.patch create mode 100644 queue-6.17/drm-nouveau-fix-bad-ret-code-in-nouveau_bo_move_prep.patch create mode 100644 queue-6.17/drm-panthor-fix-memory-leak-in-panthor_ioctl_group_create.patch create mode 100644 queue-6.17/drm-rcar-du-dsi-fix-1-2-3-lane-support.patch create mode 100644 queue-6.17/drm-xe-uapi-loosen-used-tracking-restriction.patch diff --git a/queue-6.17/drm-amd-display-enable-dynamic-dtbclk-switch.patch b/queue-6.17/drm-amd-display-enable-dynamic-dtbclk-switch.patch new file mode 100644 index 0000000000..79f933d395 --- /dev/null +++ b/queue-6.17/drm-amd-display-enable-dynamic-dtbclk-switch.patch @@ -0,0 +1,38 @@ +From 5949e7c4890c3cf65e783c83c355b95e21f10dba Mon Sep 17 00:00:00 2001 +From: Fangzhi Zuo +Date: Wed, 24 Sep 2025 14:37:01 -0400 +Subject: drm/amd/display: Enable Dynamic DTBCLK Switch + +From: Fangzhi Zuo + +commit 5949e7c4890c3cf65e783c83c355b95e21f10dba upstream. + +[WHAT] +Since dcn35, DTBCLK can be disabled when no DP2 sink connected for +power saving purpose. + +Cc: Mario Limonciello +Cc: Alex Deucher +Cc: stable@vger.kernel.org +Reviewed-by: Aurabindo Pillai +Signed-off-by: Fangzhi Zuo +Signed-off-by: Alex Hung +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -1956,6 +1956,10 @@ static int amdgpu_dm_init(struct amdgpu_ + + init_data.flags.disable_ips_in_vpb = 0; + ++ /* DCN35 and above supports dynamic DTBCLK switch */ ++ if (amdgpu_ip_version(adev, DCE_HWIP, 0) >= IP_VERSION(3, 5, 0)) ++ init_data.flags.allow_0_dtb_clk = true; ++ + /* Enable DWB for tested platforms only */ + if (amdgpu_ip_version(adev, DCE_HWIP, 0) >= IP_VERSION(3, 0, 0)) + init_data.num_virtual_links = 1; diff --git a/queue-6.17/drm-amd-display-fix-unsafe-uses-of-kernel-mode-fpu.patch b/queue-6.17/drm-amd-display-fix-unsafe-uses-of-kernel-mode-fpu.patch new file mode 100644 index 0000000000..c7780fe044 --- /dev/null +++ b/queue-6.17/drm-amd-display-fix-unsafe-uses-of-kernel-mode-fpu.patch @@ -0,0 +1,222 @@ +From ddbfac152830e38d488ff8e45ab7eaf5d72f8527 Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Thu, 2 Oct 2025 23:00:45 +0200 +Subject: drm/amd/display: Fix unsafe uses of kernel mode FPU +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ard Biesheuvel + +commit ddbfac152830e38d488ff8e45ab7eaf5d72f8527 upstream. + +The point of isolating code that uses kernel mode FPU in separate +compilation units is to ensure that even implicit uses of, e.g., SIMD +registers for spilling occur only in a context where this is permitted, +i.e., from inside a kernel_fpu_begin/end block. + +This is important on arm64, which uses -mgeneral-regs-only to build all +kernel code, with the exception of such compilation units where FP or +SIMD registers are expected to be used. Given that the compiler may +invent uses of FP/SIMD anywhere in such a unit, none of its code may be +accessible from outside a kernel_fpu_begin/end block. + +This means that all callers into such compilation units must use the +DC_FP start/end macros, which must not occur there themselves. For +robustness, all functions with external linkage that reside there should +call dc_assert_fp_enabled() to assert that the FPU context was set up +correctly. + +Fix this for the DCN35, DCN351 and DCN36 implementations. + +Cc: Austin Zheng +Cc: Jun Lei +Cc: Harry Wentland +Cc: Leo Li +Cc: Rodrigo Siqueira +Cc: Alex Deucher +Cc: "Christian König" +Cc: amd-gfx@lists.freedesktop.org +Cc: dri-devel@lists.freedesktop.org +Signed-off-by: Ard Biesheuvel +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/dml/dcn31/dcn31_fpu.c | 4 ++ + drivers/gpu/drm/amd/display/dc/dml/dcn35/dcn35_fpu.c | 6 ++- + drivers/gpu/drm/amd/display/dc/dml/dcn351/dcn351_fpu.c | 4 +- + drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c | 16 ++++++++- + drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c | 17 +++++++++- + drivers/gpu/drm/amd/display/dc/resource/dcn36/dcn36_resource.c | 16 ++++++++- + 6 files changed, 56 insertions(+), 7 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn31/dcn31_fpu.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn31/dcn31_fpu.c +@@ -808,6 +808,8 @@ void dcn316_update_bw_bounding_box(struc + + int dcn_get_max_non_odm_pix_rate_100hz(struct _vcs_dpi_soc_bounding_box_st *soc) + { ++ dc_assert_fp_enabled(); ++ + return soc->clock_limits[0].dispclk_mhz * 10000.0 / (1.0 + soc->dcn_downspread_percent / 100.0); + } + +@@ -815,6 +817,8 @@ int dcn_get_approx_det_segs_required_for + struct _vcs_dpi_soc_bounding_box_st *soc, + int pix_clk_100hz, int bpp, int seg_size_kb) + { ++ dc_assert_fp_enabled(); ++ + /* Roughly calculate required crb to hide latency. In practice there is slightly + * more buffer available for latency hiding + */ +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn35/dcn35_fpu.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn35/dcn35_fpu.c +@@ -445,6 +445,8 @@ int dcn35_populate_dml_pipes_from_contex + bool upscaled = false; + const unsigned int max_allowed_vblank_nom = 1023; + ++ dc_assert_fp_enabled(); ++ + dcn31_populate_dml_pipes_from_context(dc, context, pipes, + validate_mode); + +@@ -498,9 +500,7 @@ int dcn35_populate_dml_pipes_from_contex + + pipes[pipe_cnt].pipe.src.unbounded_req_mode = false; + +- DC_FP_START(); + dcn31_zero_pipe_dcc_fraction(pipes, pipe_cnt); +- DC_FP_END(); + + pipes[pipe_cnt].pipe.dest.vfront_porch = timing->v_front_porch; + pipes[pipe_cnt].pipe.src.dcc_rate = 3; +@@ -581,6 +581,8 @@ void dcn35_decide_zstate_support(struct + unsigned int i, plane_count = 0; + DC_LOGGER_INIT(dc->ctx->logger); + ++ dc_assert_fp_enabled(); ++ + for (i = 0; i < dc->res_pool->pipe_count; i++) { + if (context->res_ctx.pipe_ctx[i].plane_state) + plane_count++; +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn351/dcn351_fpu.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn351/dcn351_fpu.c +@@ -478,6 +478,8 @@ int dcn351_populate_dml_pipes_from_conte + bool upscaled = false; + const unsigned int max_allowed_vblank_nom = 1023; + ++ dc_assert_fp_enabled(); ++ + dcn31_populate_dml_pipes_from_context(dc, context, pipes, + validate_mode); + +@@ -531,9 +533,7 @@ int dcn351_populate_dml_pipes_from_conte + + pipes[pipe_cnt].pipe.src.unbounded_req_mode = false; + +- DC_FP_START(); + dcn31_zero_pipe_dcc_fraction(pipes, pipe_cnt); +- DC_FP_END(); + + pipes[pipe_cnt].pipe.dest.vfront_porch = timing->v_front_porch; + pipes[pipe_cnt].pipe.src.dcc_rate = 3; +--- a/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c +@@ -1760,6 +1760,20 @@ enum dc_status dcn35_patch_unknown_plane + } + + ++static int populate_dml_pipes_from_context_fpu(struct dc *dc, ++ struct dc_state *context, ++ display_e2e_pipe_params_st *pipes, ++ enum dc_validate_mode validate_mode) ++{ ++ int ret; ++ ++ DC_FP_START(); ++ ret = dcn35_populate_dml_pipes_from_context_fpu(dc, context, pipes, validate_mode); ++ DC_FP_END(); ++ ++ return ret; ++} ++ + static struct resource_funcs dcn35_res_pool_funcs = { + .destroy = dcn35_destroy_resource_pool, + .link_enc_create = dcn35_link_encoder_create, +@@ -1770,7 +1784,7 @@ static struct resource_funcs dcn35_res_p + .validate_bandwidth = dcn35_validate_bandwidth, + .calculate_wm_and_dlg = NULL, + .update_soc_for_wm_a = dcn31_update_soc_for_wm_a, +- .populate_dml_pipes = dcn35_populate_dml_pipes_from_context_fpu, ++ .populate_dml_pipes = populate_dml_pipes_from_context_fpu, + .acquire_free_pipe_as_secondary_dpp_pipe = dcn20_acquire_free_pipe_for_layer, + .release_pipe = dcn20_release_pipe, + .add_stream_to_ctx = dcn30_add_stream_to_ctx, +--- a/drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c +@@ -1732,6 +1732,21 @@ static enum dc_status dcn351_validate_ba + return out ? DC_OK : DC_FAIL_BANDWIDTH_VALIDATE; + } + ++static int populate_dml_pipes_from_context_fpu(struct dc *dc, ++ struct dc_state *context, ++ display_e2e_pipe_params_st *pipes, ++ enum dc_validate_mode validate_mode) ++{ ++ int ret; ++ ++ DC_FP_START(); ++ ret = dcn351_populate_dml_pipes_from_context_fpu(dc, context, pipes, validate_mode); ++ DC_FP_END(); ++ ++ return ret; ++ ++} ++ + static struct resource_funcs dcn351_res_pool_funcs = { + .destroy = dcn351_destroy_resource_pool, + .link_enc_create = dcn35_link_encoder_create, +@@ -1742,7 +1757,7 @@ static struct resource_funcs dcn351_res_ + .validate_bandwidth = dcn351_validate_bandwidth, + .calculate_wm_and_dlg = NULL, + .update_soc_for_wm_a = dcn31_update_soc_for_wm_a, +- .populate_dml_pipes = dcn351_populate_dml_pipes_from_context_fpu, ++ .populate_dml_pipes = populate_dml_pipes_from_context_fpu, + .acquire_free_pipe_as_secondary_dpp_pipe = dcn20_acquire_free_pipe_for_layer, + .release_pipe = dcn20_release_pipe, + .add_stream_to_ctx = dcn30_add_stream_to_ctx, +--- a/drivers/gpu/drm/amd/display/dc/resource/dcn36/dcn36_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn36/dcn36_resource.c +@@ -1734,6 +1734,20 @@ static enum dc_status dcn35_validate_ban + } + + ++static int populate_dml_pipes_from_context_fpu(struct dc *dc, ++ struct dc_state *context, ++ display_e2e_pipe_params_st *pipes, ++ enum dc_validate_mode validate_mode) ++{ ++ int ret; ++ ++ DC_FP_START(); ++ ret = dcn35_populate_dml_pipes_from_context_fpu(dc, context, pipes, validate_mode); ++ DC_FP_END(); ++ ++ return ret; ++} ++ + static struct resource_funcs dcn36_res_pool_funcs = { + .destroy = dcn36_destroy_resource_pool, + .link_enc_create = dcn35_link_encoder_create, +@@ -1744,7 +1758,7 @@ static struct resource_funcs dcn36_res_p + .validate_bandwidth = dcn35_validate_bandwidth, + .calculate_wm_and_dlg = NULL, + .update_soc_for_wm_a = dcn31_update_soc_for_wm_a, +- .populate_dml_pipes = dcn35_populate_dml_pipes_from_context_fpu, ++ .populate_dml_pipes = populate_dml_pipes_from_context_fpu, + .acquire_free_pipe_as_secondary_dpp_pipe = dcn20_acquire_free_pipe_for_layer, + .release_pipe = dcn20_release_pipe, + .add_stream_to_ctx = dcn30_add_stream_to_ctx, diff --git a/queue-6.17/drm-amd-display-incorrect-mirror-cositing.patch b/queue-6.17/drm-amd-display-incorrect-mirror-cositing.patch new file mode 100644 index 0000000000..65aa9fcef8 --- /dev/null +++ b/queue-6.17/drm-amd-display-incorrect-mirror-cositing.patch @@ -0,0 +1,53 @@ +From d07e142641417e67f3bfc9d8ba3da8a69c39cfcd Mon Sep 17 00:00:00 2001 +From: Jesse Agate +Date: Fri, 13 Jun 2025 14:20:53 -0400 +Subject: drm/amd/display: Incorrect Mirror Cositing + +From: Jesse Agate + +commit d07e142641417e67f3bfc9d8ba3da8a69c39cfcd upstream. + +[WHY] +hinit/vinit are incorrect in the case of mirroring. + +[HOW] +Cositing sign must be flipped when image is mirrored in the vertical +or horizontal direction. + +Cc: Mario Limonciello +Cc: Alex Deucher +Cc: stable@vger.kernel.org +Reviewed-by: Samson Tam +Signed-off-by: Jesse Agate +Signed-off-by: Brendan Leder +Signed-off-by: Alex Hung +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/sspl/dc_spl.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/sspl/dc_spl.c ++++ b/drivers/gpu/drm/amd/display/dc/sspl/dc_spl.c +@@ -641,16 +641,16 @@ static void spl_calculate_inits_and_view + /* this gives the direction of the cositing (negative will move + * left, right otherwise) + */ +- int sign = 1; ++ int h_sign = flip_horz_scan_dir ? -1 : 1; ++ int v_sign = flip_vert_scan_dir ? -1 : 1; + + switch (spl_in->basic_in.cositing) { +- + case CHROMA_COSITING_TOPLEFT: +- init_adj_h = spl_fixpt_from_fraction(sign, 4); +- init_adj_v = spl_fixpt_from_fraction(sign, 4); ++ init_adj_h = spl_fixpt_from_fraction(h_sign, 4); ++ init_adj_v = spl_fixpt_from_fraction(v_sign, 4); + break; + case CHROMA_COSITING_LEFT: +- init_adj_h = spl_fixpt_from_fraction(sign, 4); ++ init_adj_h = spl_fixpt_from_fraction(h_sign, 4); + init_adj_v = spl_fixpt_zero; + break; + case CHROMA_COSITING_NONE: diff --git a/queue-6.17/drm-exynos-exynos7_drm_decon-remove-ctx-suspended.patch b/queue-6.17/drm-exynos-exynos7_drm_decon-remove-ctx-suspended.patch new file mode 100644 index 0000000000..6d2f31f3d2 --- /dev/null +++ b/queue-6.17/drm-exynos-exynos7_drm_decon-remove-ctx-suspended.patch @@ -0,0 +1,162 @@ +From e1361a4f1be9cb69a662c6d7b5ce218007d6e82b Mon Sep 17 00:00:00 2001 +From: Kaustabh Chakraborty +Date: Sun, 6 Jul 2025 22:59:46 +0530 +Subject: drm/exynos: exynos7_drm_decon: remove ctx->suspended + +From: Kaustabh Chakraborty + +commit e1361a4f1be9cb69a662c6d7b5ce218007d6e82b upstream. + +Condition guards are found to be redundant, as the call flow is properly +managed now, as also observed in the Exynos5433 DECON driver. Since +state checking is no longer necessary, remove it. + +This also fixes an issue which prevented decon_commit() from +decon_atomic_enable() due to an incorrect state change setting. + +Fixes: 96976c3d9aff ("drm/exynos: Add DECON driver") +Cc: stable@vger.kernel.org +Suggested-by: Inki Dae +Signed-off-by: Kaustabh Chakraborty +Signed-off-by: Inki Dae +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/exynos/exynos7_drm_decon.c | 36 ----------------------------- + 1 file changed, 36 deletions(-) + +--- a/drivers/gpu/drm/exynos/exynos7_drm_decon.c ++++ b/drivers/gpu/drm/exynos/exynos7_drm_decon.c +@@ -69,7 +69,6 @@ struct decon_context { + void __iomem *regs; + unsigned long irq_flags; + bool i80_if; +- bool suspended; + wait_queue_head_t wait_vsync_queue; + atomic_t wait_vsync_event; + +@@ -132,9 +131,6 @@ static void decon_shadow_protect_win(str + + static void decon_wait_for_vblank(struct decon_context *ctx) + { +- if (ctx->suspended) +- return; +- + atomic_set(&ctx->wait_vsync_event, 1); + + /* +@@ -210,9 +206,6 @@ static void decon_commit(struct exynos_d + struct drm_display_mode *mode = &crtc->base.state->adjusted_mode; + u32 val, clkdiv; + +- if (ctx->suspended) +- return; +- + /* nothing to do if we haven't set the mode yet */ + if (mode->htotal == 0 || mode->vtotal == 0) + return; +@@ -274,9 +267,6 @@ static int decon_enable_vblank(struct ex + struct decon_context *ctx = crtc->ctx; + u32 val; + +- if (ctx->suspended) +- return -EPERM; +- + if (!test_and_set_bit(0, &ctx->irq_flags)) { + val = readl(ctx->regs + VIDINTCON0); + +@@ -299,9 +289,6 @@ static void decon_disable_vblank(struct + struct decon_context *ctx = crtc->ctx; + u32 val; + +- if (ctx->suspended) +- return; +- + if (test_and_clear_bit(0, &ctx->irq_flags)) { + val = readl(ctx->regs + VIDINTCON0); + +@@ -404,9 +391,6 @@ static void decon_atomic_begin(struct ex + struct decon_context *ctx = crtc->ctx; + int i; + +- if (ctx->suspended) +- return; +- + for (i = 0; i < WINDOWS_NR; i++) + decon_shadow_protect_win(ctx, i, true); + } +@@ -427,9 +411,6 @@ static void decon_update_plane(struct ex + unsigned int pitch = fb->pitches[0]; + unsigned int vidw_addr0_base = ctx->data->vidw_buf_start_base; + +- if (ctx->suspended) +- return; +- + /* + * SHADOWCON/PRTCON register is used for enabling timing. + * +@@ -517,9 +498,6 @@ static void decon_disable_plane(struct e + unsigned int win = plane->index; + u32 val; + +- if (ctx->suspended) +- return; +- + /* protect windows */ + decon_shadow_protect_win(ctx, win, true); + +@@ -538,9 +516,6 @@ static void decon_atomic_flush(struct ex + struct decon_context *ctx = crtc->ctx; + int i; + +- if (ctx->suspended) +- return; +- + for (i = 0; i < WINDOWS_NR; i++) + decon_shadow_protect_win(ctx, i, false); + exynos_crtc_handle_event(crtc); +@@ -568,9 +543,6 @@ static void decon_atomic_enable(struct e + struct decon_context *ctx = crtc->ctx; + int ret; + +- if (!ctx->suspended) +- return; +- + ret = pm_runtime_resume_and_get(ctx->dev); + if (ret < 0) { + DRM_DEV_ERROR(ctx->dev, "failed to enable DECON device.\n"); +@@ -584,8 +556,6 @@ static void decon_atomic_enable(struct e + decon_enable_vblank(ctx->crtc); + + decon_commit(ctx->crtc); +- +- ctx->suspended = false; + } + + static void decon_atomic_disable(struct exynos_drm_crtc *crtc) +@@ -593,9 +563,6 @@ static void decon_atomic_disable(struct + struct decon_context *ctx = crtc->ctx; + int i; + +- if (ctx->suspended) +- return; +- + /* + * We need to make sure that all windows are disabled before we + * suspend that connector. Otherwise we might try to scan from +@@ -605,8 +572,6 @@ static void decon_atomic_disable(struct + decon_disable_plane(crtc, &ctx->planes[i]); + + pm_runtime_put_sync(ctx->dev); +- +- ctx->suspended = true; + } + + static const struct exynos_drm_crtc_ops decon_crtc_ops = { +@@ -727,7 +692,6 @@ static int decon_probe(struct platform_d + return -ENOMEM; + + ctx->dev = dev; +- ctx->suspended = true; + ctx->data = of_device_get_match_data(dev); + + i80_if_timings = of_get_child_by_name(dev->of_node, "i80-if-timings"); diff --git a/queue-6.17/drm-msm-a6xx-fix-pdc-sleep-sequence.patch b/queue-6.17/drm-msm-a6xx-fix-pdc-sleep-sequence.patch new file mode 100644 index 0000000000..6ac67543ec --- /dev/null +++ b/queue-6.17/drm-msm-a6xx-fix-pdc-sleep-sequence.patch @@ -0,0 +1,128 @@ +From f248d5d5159a88ded55329f0b1b463d0f4094228 Mon Sep 17 00:00:00 2001 +From: Akhil P Oommen +Date: Mon, 8 Sep 2025 13:56:57 +0530 +Subject: drm/msm/a6xx: Fix PDC sleep sequence + +From: Akhil P Oommen + +commit f248d5d5159a88ded55329f0b1b463d0f4094228 upstream. + +Since the PDC resides out of the GPU subsystem and cannot be reset in +case it enters bad state, utmost care must be taken to trigger the PDC +wake/sleep routines in the correct order. + +The PDC wake sequence can be exercised only after a PDC sleep sequence. +Additionally, GMU firmware should initialize a few registers before the +KMD can trigger a PDC sleep sequence. So PDC sleep can't be done if the +GMU firmware has not initialized. Track these dependencies using a new +status variable and trigger PDC sleep/wake sequences appropriately. + +Cc: stable@vger.kernel.org +Fixes: 4b565ca5a2cb ("drm/msm: Add A6XX device support") +Signed-off-by: Akhil P Oommen +Patchwork: https://patchwork.freedesktop.org/patch/673362/ +Signed-off-by: Rob Clark +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 28 +++++++++++++++++----------- + drivers/gpu/drm/msm/adreno/a6xx_gmu.h | 6 ++++++ + 2 files changed, 23 insertions(+), 11 deletions(-) + +--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c +@@ -272,6 +272,8 @@ static int a6xx_gmu_start(struct a6xx_gm + if (ret) + DRM_DEV_ERROR(gmu->dev, "GMU firmware initialization timed out\n"); + ++ set_bit(GMU_STATUS_FW_START, &gmu->status); ++ + return ret; + } + +@@ -518,6 +520,9 @@ static int a6xx_rpmh_start(struct a6xx_g + int ret; + u32 val; + ++ if (!test_and_clear_bit(GMU_STATUS_PDC_SLEEP, &gmu->status)) ++ return 0; ++ + gmu_write(gmu, REG_A6XX_GMU_RSCC_CONTROL_REQ, BIT(1)); + + ret = gmu_poll_timeout(gmu, REG_A6XX_GMU_RSCC_CONTROL_ACK, val, +@@ -545,6 +550,9 @@ static void a6xx_rpmh_stop(struct a6xx_g + int ret; + u32 val; + ++ if (test_and_clear_bit(GMU_STATUS_FW_START, &gmu->status)) ++ return; ++ + gmu_write(gmu, REG_A6XX_GMU_RSCC_CONTROL_REQ, 1); + + ret = gmu_poll_timeout_rscc(gmu, REG_A6XX_GPU_RSCC_RSC_STATUS0_DRV0, +@@ -553,6 +561,8 @@ static void a6xx_rpmh_stop(struct a6xx_g + DRM_DEV_ERROR(gmu->dev, "Unable to power off the GPU RSC\n"); + + gmu_write(gmu, REG_A6XX_GMU_RSCC_CONTROL_REQ, 0); ++ ++ set_bit(GMU_STATUS_PDC_SLEEP, &gmu->status); + } + + static inline void pdc_write(void __iomem *ptr, u32 offset, u32 value) +@@ -681,8 +691,6 @@ setup_pdc: + /* ensure no writes happen before the uCode is fully written */ + wmb(); + +- a6xx_rpmh_stop(gmu); +- + err: + if (!IS_ERR_OR_NULL(pdcptr)) + iounmap(pdcptr); +@@ -842,19 +850,15 @@ static int a6xx_gmu_fw_start(struct a6xx + else + gmu_write(gmu, REG_A6XX_GMU_GENERAL_7, 1); + +- if (state == GMU_WARM_BOOT) { +- ret = a6xx_rpmh_start(gmu); +- if (ret) +- return ret; +- } else { ++ ret = a6xx_rpmh_start(gmu); ++ if (ret) ++ return ret; ++ ++ if (state == GMU_COLD_BOOT) { + if (WARN(!adreno_gpu->fw[ADRENO_FW_GMU], + "GMU firmware is not loaded\n")) + return -ENOENT; + +- ret = a6xx_rpmh_start(gmu); +- if (ret) +- return ret; +- + ret = a6xx_gmu_fw_load(gmu); + if (ret) + return ret; +@@ -1023,6 +1027,8 @@ static void a6xx_gmu_force_off(struct a6 + + /* Reset GPU core blocks */ + a6xx_gpu_sw_reset(gpu, true); ++ ++ a6xx_rpmh_stop(gmu); + } + + static void a6xx_gmu_set_initial_freq(struct msm_gpu *gpu, struct a6xx_gmu *gmu) +--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.h ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.h +@@ -117,6 +117,12 @@ struct a6xx_gmu { + + struct qmp *qmp; + struct a6xx_hfi_msg_bw_table *bw_table; ++ ++/* To check if we can trigger sleep seq at PDC. Cleared in a6xx_rpmh_stop() */ ++#define GMU_STATUS_FW_START 0 ++/* To track if PDC sleep seq was done */ ++#define GMU_STATUS_PDC_SLEEP 1 ++ unsigned long status; + }; + + static inline u32 gmu_read(struct a6xx_gmu *gmu, u32 offset) diff --git a/queue-6.17/drm-nouveau-fix-bad-ret-code-in-nouveau_bo_move_prep.patch b/queue-6.17/drm-nouveau-fix-bad-ret-code-in-nouveau_bo_move_prep.patch new file mode 100644 index 0000000000..79a4915d09 --- /dev/null +++ b/queue-6.17/drm-nouveau-fix-bad-ret-code-in-nouveau_bo_move_prep.patch @@ -0,0 +1,34 @@ +From e4bea919584ff292c9156cf7d641a2ab3cbe27b0 Mon Sep 17 00:00:00 2001 +From: Shuhao Fu +Date: Wed, 8 Oct 2025 00:17:09 +0800 +Subject: drm/nouveau: fix bad ret code in nouveau_bo_move_prep + +From: Shuhao Fu + +commit e4bea919584ff292c9156cf7d641a2ab3cbe27b0 upstream. + +In `nouveau_bo_move_prep`, if `nouveau_mem_map` fails, an error code +should be returned. Currently, it returns zero even if vmm addr is not +correctly mapped. + +Cc: stable@vger.kernel.org +Reviewed-by: Petr Vorel +Signed-off-by: Shuhao Fu +Fixes: 9ce523cc3bf2 ("drm/nouveau: separate buffer object backing memory from nvkm structures") +Signed-off-by: Danilo Krummrich +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/nouveau_bo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/nouveau/nouveau_bo.c ++++ b/drivers/gpu/drm/nouveau/nouveau_bo.c +@@ -929,7 +929,7 @@ done: + nvif_vmm_put(vmm, &old_mem->vma[1]); + nvif_vmm_put(vmm, &old_mem->vma[0]); + } +- return 0; ++ return ret; + } + + static int diff --git a/queue-6.17/drm-panthor-fix-memory-leak-in-panthor_ioctl_group_create.patch b/queue-6.17/drm-panthor-fix-memory-leak-in-panthor_ioctl_group_create.patch new file mode 100644 index 0000000000..5b193db14e --- /dev/null +++ b/queue-6.17/drm-panthor-fix-memory-leak-in-panthor_ioctl_group_create.patch @@ -0,0 +1,50 @@ +From ca2a6abdaee43808034cdb218428d2ed85fd3db8 Mon Sep 17 00:00:00 2001 +From: Jann Horn +Date: Wed, 13 Nov 2024 22:03:39 +0100 +Subject: drm/panthor: Fix memory leak in panthor_ioctl_group_create() + +From: Jann Horn + +commit ca2a6abdaee43808034cdb218428d2ed85fd3db8 upstream. + +When bailing out due to group_priority_permit() failure, the queue_args +need to be freed. Fix it by rearranging the function to use the +goto-on-error pattern, such that the success case flows straight without +indentation while error cases jump forward to cleanup. + +Cc: stable@vger.kernel.org +Fixes: 5f7762042f8a ("drm/panthor: Restrict high priorities on group_create") +Signed-off-by: Jann Horn +Reviewed-by: Boris Brezillon +Reviewed-by: Liviu Dudau +Reviewed-by: Steven Price +Signed-off-by: Steven Price +Link: https://lore.kernel.org/r/20241113-panthor-fix-gcq-bailout-v1-1-654307254d68@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/panthor/panthor_drv.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/panthor/panthor_drv.c ++++ b/drivers/gpu/drm/panthor/panthor_drv.c +@@ -1103,14 +1103,15 @@ static int panthor_ioctl_group_create(st + + ret = group_priority_permit(file, args->priority); + if (ret) +- return ret; ++ goto out; + + ret = panthor_group_create(pfile, args, queue_args); +- if (ret >= 0) { +- args->group_handle = ret; +- ret = 0; +- } ++ if (ret < 0) ++ goto out; ++ args->group_handle = ret; ++ ret = 0; + ++out: + kvfree(queue_args); + return ret; + } diff --git a/queue-6.17/drm-rcar-du-dsi-fix-1-2-3-lane-support.patch b/queue-6.17/drm-rcar-du-dsi-fix-1-2-3-lane-support.patch new file mode 100644 index 0000000000..5bae245264 --- /dev/null +++ b/queue-6.17/drm-rcar-du-dsi-fix-1-2-3-lane-support.patch @@ -0,0 +1,73 @@ +From d83f1d19c898ac1b54ae64d1c950f5beff801982 Mon Sep 17 00:00:00 2001 +From: Marek Vasut +Date: Wed, 13 Aug 2025 23:08:13 +0200 +Subject: drm/rcar-du: dsi: Fix 1/2/3 lane support + +From: Marek Vasut + +commit d83f1d19c898ac1b54ae64d1c950f5beff801982 upstream. + +Remove fixed PPI lane count setup. The R-Car DSI host is capable +of operating in 1..4 DSI lane mode. Remove the hard-coded 4-lane +configuration from PPI register settings and instead configure +the PPI lane count according to lane count information already +obtained by this driver instance. + +Configure TXSETR register to match PPI lane count. The R-Car V4H +Reference Manual R19UH0186EJ0121 Rev.1.21 section 67.2.2.3 Tx Set +Register (TXSETR), field LANECNT description indicates that the +TXSETR register LANECNT bitfield lane count must be configured +such, that it matches lane count configuration in PPISETR register +DLEN bitfield. Make sure the LANECNT and DLEN bitfields are +configured to match. + +Fixes: 155358310f01 ("drm: rcar-du: Add R-Car DSI driver") +Cc: stable@vger.kernel.org +Signed-off-by: Marek Vasut +Reviewed-by: Tomi Valkeinen +Link: https://lore.kernel.org/r/20250813210840.97621-1-marek.vasut+renesas@mailbox.org +Signed-off-by: Tomi Valkeinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c | 5 ++++- + drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h | 8 ++++---- + 2 files changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c ++++ b/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c +@@ -576,7 +576,10 @@ static int rcar_mipi_dsi_startup(struct + udelay(10); + rcar_mipi_dsi_clr(dsi, CLOCKSET1, CLOCKSET1_UPDATEPLL); + +- ppisetr = PPISETR_DLEN_3 | PPISETR_CLEN; ++ rcar_mipi_dsi_clr(dsi, TXSETR, TXSETR_LANECNT_MASK); ++ rcar_mipi_dsi_set(dsi, TXSETR, dsi->lanes - 1); ++ ++ ppisetr = ((BIT(dsi->lanes) - 1) & PPISETR_DLEN_MASK) | PPISETR_CLEN; + rcar_mipi_dsi_write(dsi, PPISETR, ppisetr); + + rcar_mipi_dsi_set(dsi, PHYSETUP, PHYSETUP_SHUTDOWNZ); +--- a/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h ++++ b/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h +@@ -12,6 +12,9 @@ + #define LINKSR_LPBUSY (1 << 1) + #define LINKSR_HSBUSY (1 << 0) + ++#define TXSETR 0x100 ++#define TXSETR_LANECNT_MASK (0x3 << 0) ++ + /* + * Video Mode Register + */ +@@ -80,10 +83,7 @@ + * PHY-Protocol Interface (PPI) Registers + */ + #define PPISETR 0x700 +-#define PPISETR_DLEN_0 (0x1 << 0) +-#define PPISETR_DLEN_1 (0x3 << 0) +-#define PPISETR_DLEN_2 (0x7 << 0) +-#define PPISETR_DLEN_3 (0xf << 0) ++#define PPISETR_DLEN_MASK (0xf << 0) + #define PPISETR_CLEN (1 << 8) + + #define PPICLCR 0x710 diff --git a/queue-6.17/drm-xe-uapi-loosen-used-tracking-restriction.patch b/queue-6.17/drm-xe-uapi-loosen-used-tracking-restriction.patch new file mode 100644 index 0000000000..abf4497053 --- /dev/null +++ b/queue-6.17/drm-xe-uapi-loosen-used-tracking-restriction.patch @@ -0,0 +1,74 @@ +From 2d1684a077d62fddfac074052c162ec6573a34e1 Mon Sep 17 00:00:00 2001 +From: Matthew Auld +Date: Fri, 19 Sep 2025 13:20:53 +0100 +Subject: drm/xe/uapi: loosen used tracking restriction +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Matthew Auld + +commit 2d1684a077d62fddfac074052c162ec6573a34e1 upstream. + +Currently this is hidden behind perfmon_capable() since this is +technically an info leak, given that this is a system wide metric. +However the granularity reported here is always PAGE_SIZE aligned, which +matches what the core kernel is already willing to expose to userspace +if querying how many free RAM pages there are on the system, and that +doesn't need any special privileges. In addition other drm drivers seem +happy to expose this. + +The motivation here if with oneAPI where they want to use the system +wide 'used' reporting here, so not the per-client fdinfo stats. This has +also come up with some perf overlay applications wanting this +information. + +Fixes: 1105ac15d2a1 ("drm/xe/uapi: restrict system wide accounting") +Signed-off-by: Matthew Auld +Cc: Thomas Hellström +Cc: Joshua Santosh +Cc: José Roberto de Souza +Cc: Matthew Brost +Cc: Rodrigo Vivi +Cc: # v6.8+ +Acked-by: Rodrigo Vivi +Reviewed-by: Lucas De Marchi +Link: https://lore.kernel.org/r/20250919122052.420979-2-matthew.auld@intel.com +(cherry picked from commit 4d0b035fd6dae8ee48e9c928b10f14877e595356) +Signed-off-by: Lucas De Marchi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_query.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +--- a/drivers/gpu/drm/xe/xe_query.c ++++ b/drivers/gpu/drm/xe/xe_query.c +@@ -274,8 +274,7 @@ static int query_mem_regions(struct xe_d + mem_regions->mem_regions[0].instance = 0; + mem_regions->mem_regions[0].min_page_size = PAGE_SIZE; + mem_regions->mem_regions[0].total_size = man->size << PAGE_SHIFT; +- if (perfmon_capable()) +- mem_regions->mem_regions[0].used = ttm_resource_manager_usage(man); ++ mem_regions->mem_regions[0].used = ttm_resource_manager_usage(man); + mem_regions->num_mem_regions = 1; + + for (i = XE_PL_VRAM0; i <= XE_PL_VRAM1; ++i) { +@@ -291,13 +290,11 @@ static int query_mem_regions(struct xe_d + mem_regions->mem_regions[mem_regions->num_mem_regions].total_size = + man->size; + +- if (perfmon_capable()) { +- xe_ttm_vram_get_used(man, +- &mem_regions->mem_regions +- [mem_regions->num_mem_regions].used, +- &mem_regions->mem_regions +- [mem_regions->num_mem_regions].cpu_visible_used); +- } ++ xe_ttm_vram_get_used(man, ++ &mem_regions->mem_regions ++ [mem_regions->num_mem_regions].used, ++ &mem_regions->mem_regions ++ [mem_regions->num_mem_regions].cpu_visible_used); + + mem_regions->mem_regions[mem_regions->num_mem_regions].cpu_visible_size = + xe_ttm_vram_get_cpu_visible_size(man); diff --git a/queue-6.17/series b/queue-6.17/series index ee1a641683..077ce84981 100644 --- a/queue-6.17/series +++ b/queue-6.17/series @@ -183,3 +183,12 @@ media-vsp1-export-missing-vsp1_isp_free_buffer-symbol.patch media-ti-j721e-csi2rx-use-devm_of_platform_populate.patch media-ti-j721e-csi2rx-fix-source-subdev-link-creation.patch media-lirc-fix-error-handling-in-lirc_register.patch +drm-exynos-exynos7_drm_decon-remove-ctx-suspended.patch +drm-panthor-fix-memory-leak-in-panthor_ioctl_group_create.patch +drm-msm-a6xx-fix-pdc-sleep-sequence.patch +drm-rcar-du-dsi-fix-1-2-3-lane-support.patch +drm-nouveau-fix-bad-ret-code-in-nouveau_bo_move_prep.patch +drm-xe-uapi-loosen-used-tracking-restriction.patch +drm-amd-display-incorrect-mirror-cositing.patch +drm-amd-display-enable-dynamic-dtbclk-switch.patch +drm-amd-display-fix-unsafe-uses-of-kernel-mode-fpu.patch -- 2.47.3