From bb5c64f10061fdc447d96ad2de5a6383ce8643a5 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 28 Jul 2025 18:15:23 +0200 Subject: [PATCH] 6.15-stable patches added patches: drm-amdgpu-add-the-new-sdma-function-pointers-for-amdgpu_sdma.h.patch drm-amdgpu-fix-sdma-engine-reset-with-logical-instance-id.patch drm-amdgpu-implement-sdma-soft-reset-directly-for-v5.x.patch drm-shmem-helper-remove-obsoleted-is_iomem-test.patch drm-xe-make-wa-bb-part-of-lrc-bo.patch revert-drm-gem-shmem-use-dma_buf-from-gem-object-instance.patch selftests-bpf-add-tests-with-stack-ptr-register-in-conditional-jmp.patch usb-typec-tcpm-allow-switching-to-mode-accessory-to-mux-properly.patch usb-typec-tcpm-allow-to-use-sink-in-accessory-mode.patch usb-typec-tcpm-apply-vbus-before-data-bringup-in-tcpm_src_attach.patch --- ...-function-pointers-for-amdgpu_sdma.h.patch | 57 ++++++++ ...ngine-reset-with-logical-instance-id.patch | 67 +++++++++ ...nt-sdma-soft-reset-directly-for-v5.x.patch | 95 ++++++++++++ ...elper-remove-obsoleted-is_iomem-test.patch | 42 ++++++ .../drm-xe-make-wa-bb-part-of-lrc-bo.patch | 136 ++++++++++++++++++ ...use-dma_buf-from-gem-object-instance.patch | 62 ++++++++ ...tack-ptr-register-in-conditional-jmp.patch | 121 ++++++++++++++++ queue-6.15/series | 10 ++ ...ng-to-mode-accessory-to-mux-properly.patch | 120 ++++++++++++++++ ...-allow-to-use-sink-in-accessory-mode.patch | 44 ++++++ ...fore-data-bringup-in-tcpm_src_attach.patch | 101 +++++++++++++ 11 files changed, 855 insertions(+) create mode 100644 queue-6.15/drm-amdgpu-add-the-new-sdma-function-pointers-for-amdgpu_sdma.h.patch create mode 100644 queue-6.15/drm-amdgpu-fix-sdma-engine-reset-with-logical-instance-id.patch create mode 100644 queue-6.15/drm-amdgpu-implement-sdma-soft-reset-directly-for-v5.x.patch create mode 100644 queue-6.15/drm-shmem-helper-remove-obsoleted-is_iomem-test.patch create mode 100644 queue-6.15/drm-xe-make-wa-bb-part-of-lrc-bo.patch create mode 100644 queue-6.15/revert-drm-gem-shmem-use-dma_buf-from-gem-object-instance.patch create mode 100644 queue-6.15/selftests-bpf-add-tests-with-stack-ptr-register-in-conditional-jmp.patch create mode 100644 queue-6.15/usb-typec-tcpm-allow-switching-to-mode-accessory-to-mux-properly.patch create mode 100644 queue-6.15/usb-typec-tcpm-allow-to-use-sink-in-accessory-mode.patch create mode 100644 queue-6.15/usb-typec-tcpm-apply-vbus-before-data-bringup-in-tcpm_src_attach.patch diff --git a/queue-6.15/drm-amdgpu-add-the-new-sdma-function-pointers-for-amdgpu_sdma.h.patch b/queue-6.15/drm-amdgpu-add-the-new-sdma-function-pointers-for-amdgpu_sdma.h.patch new file mode 100644 index 0000000000..19fe9575d3 --- /dev/null +++ b/queue-6.15/drm-amdgpu-add-the-new-sdma-function-pointers-for-amdgpu_sdma.h.patch @@ -0,0 +1,57 @@ +From 29891842154d7ebca97a94b0d5aaae94e560f61c Mon Sep 17 00:00:00 2001 +From: "Jesse.zhang@amd.com" +Date: Fri, 11 Apr 2025 13:01:19 +0800 +Subject: drm/amdgpu: Add the new sdma function pointers for amdgpu_sdma.h + +From: Jesse.zhang@amd.com + +commit 29891842154d7ebca97a94b0d5aaae94e560f61c upstream. + +This patch introduces new function pointers in the amdgpu_sdma structure +to handle queue stop, start and soft reset operations. These will replace +the older callback mechanism. + +The new functions are: +- stop_kernel_queue: Stops a specific SDMA queue +- start_kernel_queue: Starts/Restores a specific SDMA queue +- soft_reset_kernel_queue: Performs soft reset on a specific SDMA queue + +v2: Update stop_queue/start_queue function paramters to use ring pointer instead of device/instance(Chritian) +v3: move stop_queue/start_queue to struct amdgpu_sdma_instance and rename them. (Alex) +v4: rework the ordering a bit (Alex) + +Suggested-by: Alex Deucher +Signed-off-by: Jesse Zhang +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Stable-dep-of: 09b585592fa4 ("drm/amdgpu: Fix SDMA engine reset with logical instance ID") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.h | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.h +@@ -50,6 +50,12 @@ enum amdgpu_sdma_irq { + + #define NUM_SDMA(x) hweight32(x) + ++struct amdgpu_sdma_funcs { ++ int (*stop_kernel_queue)(struct amdgpu_ring *ring); ++ int (*start_kernel_queue)(struct amdgpu_ring *ring); ++ int (*soft_reset_kernel_queue)(struct amdgpu_device *adev, u32 instance_id); ++}; ++ + struct amdgpu_sdma_instance { + /* SDMA firmware */ + const struct firmware *fw; +@@ -68,7 +74,7 @@ struct amdgpu_sdma_instance { + /* track guilty state of GFX and PAGE queues */ + bool gfx_guilty; + bool page_guilty; +- ++ const struct amdgpu_sdma_funcs *funcs; + }; + + enum amdgpu_sdma_ras_memory_id { diff --git a/queue-6.15/drm-amdgpu-fix-sdma-engine-reset-with-logical-instance-id.patch b/queue-6.15/drm-amdgpu-fix-sdma-engine-reset-with-logical-instance-id.patch new file mode 100644 index 0000000000..340c5e198a --- /dev/null +++ b/queue-6.15/drm-amdgpu-fix-sdma-engine-reset-with-logical-instance-id.patch @@ -0,0 +1,67 @@ +From 09b585592fa481384597c81388733aed4a04dd05 Mon Sep 17 00:00:00 2001 +From: Jesse Zhang +Date: Wed, 11 Jun 2025 15:02:09 +0800 +Subject: drm/amdgpu: Fix SDMA engine reset with logical instance ID + +From: Jesse Zhang + +commit 09b585592fa481384597c81388733aed4a04dd05 upstream. + +This commit makes the following improvements to SDMA engine reset handling: + +1. Clarifies in the function documentation that instance_id refers to a logical ID +2. Adds conversion from logical to physical instance ID before performing reset + using GET_INST(SDMA0, instance_id) macro +3. Improves error messaging to indicate when a logical instance reset fails +4. Adds better code organization with blank lines for readability + +The change ensures proper SDMA engine reset by using the correct physical +instance ID while maintaining the logical ID interface for callers. + +V2: Remove harvest_config check and convert directly to physical instance (Lijo) + +Suggested-by: Jonathan Kim +Signed-off-by: Jesse Zhang +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +(cherry picked from commit 5efa6217c239ed1ceec0f0414f9b6f6927387dfc) +Cc: stable@vger.kernel.org +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c +@@ -572,8 +572,10 @@ static int amdgpu_sdma_soft_reset(struct + case IP_VERSION(4, 4, 2): + case IP_VERSION(4, 4, 4): + case IP_VERSION(4, 4, 5): +- /* For SDMA 4.x, use the existing DPM interface for backward compatibility */ +- r = amdgpu_dpm_reset_sdma(adev, 1 << instance_id); ++ /* For SDMA 4.x, use the existing DPM interface for backward compatibility, ++ * we need to convert the logical instance ID to physical instance ID before reset. ++ */ ++ r = amdgpu_dpm_reset_sdma(adev, 1 << GET_INST(SDMA0, instance_id)); + break; + case IP_VERSION(5, 0, 0): + case IP_VERSION(5, 0, 1): +@@ -600,7 +602,7 @@ static int amdgpu_sdma_soft_reset(struct + /** + * amdgpu_sdma_reset_engine - Reset a specific SDMA engine + * @adev: Pointer to the AMDGPU device +- * @instance_id: ID of the SDMA engine instance to reset ++ * @instance_id: Logical ID of the SDMA engine instance to reset + * + * This function performs the following steps: + * 1. Calls all registered pre_reset callbacks to allow KFD and AMDGPU to save their state. +@@ -649,7 +651,7 @@ int amdgpu_sdma_reset_engine(struct amdg + /* Perform the SDMA reset for the specified instance */ + ret = amdgpu_sdma_soft_reset(adev, instance_id); + if (ret) { +- dev_err(adev->dev, "Failed to reset SDMA instance %u\n", instance_id); ++ dev_err(adev->dev, "Failed to reset SDMA logical instance %u\n", instance_id); + goto exit; + } + diff --git a/queue-6.15/drm-amdgpu-implement-sdma-soft-reset-directly-for-v5.x.patch b/queue-6.15/drm-amdgpu-implement-sdma-soft-reset-directly-for-v5.x.patch new file mode 100644 index 0000000000..a4c1742950 --- /dev/null +++ b/queue-6.15/drm-amdgpu-implement-sdma-soft-reset-directly-for-v5.x.patch @@ -0,0 +1,95 @@ +From 5c3e7c49538e2ddad10296a318c225bbb3d37d20 Mon Sep 17 00:00:00 2001 +From: "Jesse.zhang@amd.com" +Date: Fri, 11 Apr 2025 15:26:18 +0800 +Subject: drm/amdgpu: Implement SDMA soft reset directly for v5.x + +From: Jesse.zhang@amd.com + +commit 5c3e7c49538e2ddad10296a318c225bbb3d37d20 upstream. + +This patch introduces a new function `amdgpu_sdma_soft_reset` to handle SDMA soft resets directly, +rather than relying on the DPM interface. + +1. **New `amdgpu_sdma_soft_reset` Function**: + - Implements a soft reset for SDMA engines by directly writing to the hardware registers. + - Handles SDMA versions 4.x and 5.x separately: + - For SDMA 4.x, the existing `amdgpu_dpm_reset_sdma` function is used for backward compatibility. + - For SDMA 5.x, the driver directly manipulates the `GRBM_SOFT_RESET` register to reset the specified SDMA instance. + +2. **Integration into `amdgpu_sdma_reset_engine`**: + - The `amdgpu_sdma_soft_reset` function is called during the SDMA reset process, replacing the previous call to `amdgpu_dpm_reset_sdma`. + +v2: r should default to an error (Alex) + +Suggested-by: Alex Deucher +Signed-off-by: Jesse Zhang +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Stable-dep-of: 09b585592fa4 ("drm/amdgpu: Fix SDMA engine reset with logical instance ID") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c | 38 ++++++++++++++++++++++++++++++- + 1 file changed, 37 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c +@@ -26,6 +26,8 @@ + #include "amdgpu_sdma.h" + #include "amdgpu_ras.h" + #include "amdgpu_reset.h" ++#include "gc/gc_10_1_0_offset.h" ++#include "gc/gc_10_3_0_sh_mask.h" + + #define AMDGPU_CSA_SDMA_SIZE 64 + /* SDMA CSA reside in the 3rd page of CSA */ +@@ -561,6 +563,40 @@ void amdgpu_sdma_register_on_reset_callb + list_add_tail(&funcs->list, &adev->sdma.reset_callback_list); + } + ++static int amdgpu_sdma_soft_reset(struct amdgpu_device *adev, u32 instance_id) ++{ ++ struct amdgpu_sdma_instance *sdma_instance = &adev->sdma.instance[instance_id]; ++ int r = -EOPNOTSUPP; ++ ++ switch (amdgpu_ip_version(adev, SDMA0_HWIP, 0)) { ++ case IP_VERSION(4, 4, 2): ++ case IP_VERSION(4, 4, 4): ++ case IP_VERSION(4, 4, 5): ++ /* For SDMA 4.x, use the existing DPM interface for backward compatibility */ ++ r = amdgpu_dpm_reset_sdma(adev, 1 << instance_id); ++ break; ++ case IP_VERSION(5, 0, 0): ++ case IP_VERSION(5, 0, 1): ++ case IP_VERSION(5, 0, 2): ++ case IP_VERSION(5, 0, 5): ++ case IP_VERSION(5, 2, 0): ++ case IP_VERSION(5, 2, 2): ++ case IP_VERSION(5, 2, 4): ++ case IP_VERSION(5, 2, 5): ++ case IP_VERSION(5, 2, 6): ++ case IP_VERSION(5, 2, 3): ++ case IP_VERSION(5, 2, 1): ++ case IP_VERSION(5, 2, 7): ++ if (sdma_instance->funcs->soft_reset_kernel_queue) ++ r = sdma_instance->funcs->soft_reset_kernel_queue(adev, instance_id); ++ break; ++ default: ++ break; ++ } ++ ++ return r; ++} ++ + /** + * amdgpu_sdma_reset_engine - Reset a specific SDMA engine + * @adev: Pointer to the AMDGPU device +@@ -611,7 +647,7 @@ int amdgpu_sdma_reset_engine(struct amdg + } + + /* Perform the SDMA reset for the specified instance */ +- ret = amdgpu_dpm_reset_sdma(adev, 1 << instance_id); ++ ret = amdgpu_sdma_soft_reset(adev, instance_id); + if (ret) { + dev_err(adev->dev, "Failed to reset SDMA instance %u\n", instance_id); + goto exit; diff --git a/queue-6.15/drm-shmem-helper-remove-obsoleted-is_iomem-test.patch b/queue-6.15/drm-shmem-helper-remove-obsoleted-is_iomem-test.patch new file mode 100644 index 0000000000..c32b7ff60d --- /dev/null +++ b/queue-6.15/drm-shmem-helper-remove-obsoleted-is_iomem-test.patch @@ -0,0 +1,42 @@ +From eab10538073c3ff9e21c857bd462f79f2f6f7e00 Mon Sep 17 00:00:00 2001 +From: Dmitry Osipenko +Date: Sun, 23 Mar 2025 00:26:04 +0300 +Subject: drm/shmem-helper: Remove obsoleted is_iomem test + +From: Dmitry Osipenko + +commit eab10538073c3ff9e21c857bd462f79f2f6f7e00 upstream. + +Everything that uses the mapped buffer should be agnostic to is_iomem. +The only reason for the is_iomem test is that we're setting shmem->vaddr +to the returned map->vaddr. Now that the shmem->vaddr code is gone, remove +the obsoleted is_iomem test to clean up the code. + +Acked-by: Maxime Ripard +Suggested-by: Thomas Zimmermann +Reviewed-by: Boris Brezillon +Acked-by: Thomas Zimmermann +Signed-off-by: Dmitry Osipenko +Link: https://patchwork.freedesktop.org/patch/msgid/20250322212608.40511-7-dmitry.osipenko@collabora.com +Stable-dep-of: 6d496e956998 ("Revert "drm/gem-shmem: Use dma_buf from GEM object instance"") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_gem_shmem_helper.c | 6 ------ + 1 file changed, 6 deletions(-) + +--- a/drivers/gpu/drm/drm_gem_shmem_helper.c ++++ b/drivers/gpu/drm/drm_gem_shmem_helper.c +@@ -340,12 +340,6 @@ int drm_gem_shmem_vmap(struct drm_gem_sh + + if (drm_gem_is_imported(obj)) { + ret = dma_buf_vmap(obj->dma_buf, map); +- if (!ret) { +- if (drm_WARN_ON(obj->dev, map->is_iomem)) { +- dma_buf_vunmap(obj->dma_buf, map); +- return -EIO; +- } +- } + } else { + pgprot_t prot = PAGE_KERNEL; + diff --git a/queue-6.15/drm-xe-make-wa-bb-part-of-lrc-bo.patch b/queue-6.15/drm-xe-make-wa-bb-part-of-lrc-bo.patch new file mode 100644 index 0000000000..82da3f2869 --- /dev/null +++ b/queue-6.15/drm-xe-make-wa-bb-part-of-lrc-bo.patch @@ -0,0 +1,136 @@ +From afcad92411772a1f361339f22c49f855c6cc7d0f Mon Sep 17 00:00:00 2001 +From: Matthew Brost +Date: Wed, 11 Jun 2025 20:19:25 -0700 +Subject: drm/xe: Make WA BB part of LRC BO + +From: Matthew Brost + +commit afcad92411772a1f361339f22c49f855c6cc7d0f upstream. + +No idea why, but without this GuC context switches randomly fail when +running IGTs in a loop. Need to follow up why this fixes the +aforementioned issue but can live with a stable driver for now. + +Fixes: 617d824c5323 ("drm/xe: Add WA BB to capture active context utilization") +Cc: stable@vger.kernel.org +Signed-off-by: Matthew Brost +Reviewed-by: Lucas De Marchi +Tested-by: Shuicheng Lin +Link: https://lore.kernel.org/r/20250612031925.4009701-1-matthew.brost@intel.com +(cherry picked from commit 3a1edef8f4b58b0ba826bc68bf4bce4bdf59ecf3) +Signed-off-by: Lucas De Marchi +[ adapted xe_bo_create_pin_map() call ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_lrc.c | 37 +++++++++++++++++++------------------ + drivers/gpu/drm/xe/xe_lrc_types.h | 3 --- + 2 files changed, 19 insertions(+), 21 deletions(-) + +--- a/drivers/gpu/drm/xe/xe_lrc.c ++++ b/drivers/gpu/drm/xe/xe_lrc.c +@@ -39,6 +39,7 @@ + #define LRC_ENGINE_INSTANCE GENMASK_ULL(53, 48) + + #define LRC_INDIRECT_RING_STATE_SIZE SZ_4K ++#define LRC_WA_BB_SIZE SZ_4K + + static struct xe_device * + lrc_to_xe(struct xe_lrc *lrc) +@@ -910,7 +911,11 @@ static void xe_lrc_finish(struct xe_lrc + xe_bo_unpin(lrc->bo); + xe_bo_unlock(lrc->bo); + xe_bo_put(lrc->bo); +- xe_bo_unpin_map_no_vm(lrc->bb_per_ctx_bo); ++} ++ ++static size_t wa_bb_offset(struct xe_lrc *lrc) ++{ ++ return lrc->bo->size - LRC_WA_BB_SIZE; + } + + /* +@@ -943,15 +948,16 @@ static void xe_lrc_finish(struct xe_lrc + #define CONTEXT_ACTIVE 1ULL + static int xe_lrc_setup_utilization(struct xe_lrc *lrc) + { ++ const size_t max_size = LRC_WA_BB_SIZE; + u32 *cmd, *buf = NULL; + +- if (lrc->bb_per_ctx_bo->vmap.is_iomem) { +- buf = kmalloc(lrc->bb_per_ctx_bo->size, GFP_KERNEL); ++ if (lrc->bo->vmap.is_iomem) { ++ buf = kmalloc(max_size, GFP_KERNEL); + if (!buf) + return -ENOMEM; + cmd = buf; + } else { +- cmd = lrc->bb_per_ctx_bo->vmap.vaddr; ++ cmd = lrc->bo->vmap.vaddr + wa_bb_offset(lrc); + } + + *cmd++ = MI_STORE_REGISTER_MEM | MI_SRM_USE_GGTT | MI_SRM_ADD_CS_OFFSET; +@@ -974,13 +980,14 @@ static int xe_lrc_setup_utilization(stru + *cmd++ = MI_BATCH_BUFFER_END; + + if (buf) { +- xe_map_memcpy_to(gt_to_xe(lrc->gt), &lrc->bb_per_ctx_bo->vmap, 0, +- buf, (cmd - buf) * sizeof(*cmd)); ++ xe_map_memcpy_to(gt_to_xe(lrc->gt), &lrc->bo->vmap, ++ wa_bb_offset(lrc), buf, ++ (cmd - buf) * sizeof(*cmd)); + kfree(buf); + } + +- xe_lrc_write_ctx_reg(lrc, CTX_BB_PER_CTX_PTR, +- xe_bo_ggtt_addr(lrc->bb_per_ctx_bo) | 1); ++ xe_lrc_write_ctx_reg(lrc, CTX_BB_PER_CTX_PTR, xe_bo_ggtt_addr(lrc->bo) + ++ wa_bb_offset(lrc) + 1); + + return 0; + } +@@ -1016,20 +1023,13 @@ static int xe_lrc_init(struct xe_lrc *lr + * FIXME: Perma-pinning LRC as we don't yet support moving GGTT address + * via VM bind calls. + */ +- lrc->bo = xe_bo_create_pin_map(xe, tile, vm, lrc_size, ++ lrc->bo = xe_bo_create_pin_map(xe, tile, vm, ++ lrc_size + LRC_WA_BB_SIZE, + ttm_bo_type_kernel, + bo_flags); + if (IS_ERR(lrc->bo)) + return PTR_ERR(lrc->bo); + +- lrc->bb_per_ctx_bo = xe_bo_create_pin_map(xe, tile, NULL, SZ_4K, +- ttm_bo_type_kernel, +- bo_flags); +- if (IS_ERR(lrc->bb_per_ctx_bo)) { +- err = PTR_ERR(lrc->bb_per_ctx_bo); +- goto err_lrc_finish; +- } +- + lrc->size = lrc_size; + lrc->ring.size = ring_size; + lrc->ring.tail = 0; +@@ -1819,7 +1819,8 @@ struct xe_lrc_snapshot *xe_lrc_snapshot_ + snapshot->seqno = xe_lrc_seqno(lrc); + snapshot->lrc_bo = xe_bo_get(lrc->bo); + snapshot->lrc_offset = xe_lrc_pphwsp_offset(lrc); +- snapshot->lrc_size = lrc->bo->size - snapshot->lrc_offset; ++ snapshot->lrc_size = lrc->bo->size - snapshot->lrc_offset - ++ LRC_WA_BB_SIZE; + snapshot->lrc_snapshot = NULL; + snapshot->ctx_timestamp = lower_32_bits(xe_lrc_ctx_timestamp(lrc)); + snapshot->ctx_job_timestamp = xe_lrc_ctx_job_timestamp(lrc); +--- a/drivers/gpu/drm/xe/xe_lrc_types.h ++++ b/drivers/gpu/drm/xe/xe_lrc_types.h +@@ -53,9 +53,6 @@ struct xe_lrc { + + /** @ctx_timestamp: readout value of CTX_TIMESTAMP on last update */ + u64 ctx_timestamp; +- +- /** @bb_per_ctx_bo: buffer object for per context batch wa buffer */ +- struct xe_bo *bb_per_ctx_bo; + }; + + struct xe_lrc_snapshot; diff --git a/queue-6.15/revert-drm-gem-shmem-use-dma_buf-from-gem-object-instance.patch b/queue-6.15/revert-drm-gem-shmem-use-dma_buf-from-gem-object-instance.patch new file mode 100644 index 0000000000..e692f6f09d --- /dev/null +++ b/queue-6.15/revert-drm-gem-shmem-use-dma_buf-from-gem-object-instance.patch @@ -0,0 +1,62 @@ +From 6d496e9569983a0d7a05be6661126d0702cf94f7 Mon Sep 17 00:00:00 2001 +From: Thomas Zimmermann +Date: Tue, 15 Jul 2025 17:58:16 +0200 +Subject: Revert "drm/gem-shmem: Use dma_buf from GEM object instance" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Zimmermann + +commit 6d496e9569983a0d7a05be6661126d0702cf94f7 upstream. + +This reverts commit 1a148af06000e545e714fe3210af3d77ff903c11. + +The dma_buf field in struct drm_gem_object is not stable over the +object instance's lifetime. The field becomes NULL when user space +releases the final GEM handle on the buffer object. This resulted +in a NULL-pointer deref. + +Workarounds in commit 5307dce878d4 ("drm/gem: Acquire references on +GEM handles for framebuffers") and commit f6bfc9afc751 ("drm/framebuffer: +Acquire internal references on GEM handles") only solved the problem +partially. They especially don't work for buffer objects without a DRM +framebuffer associated. + +Hence, this revert to going back to using .import_attach->dmabuf. + +v3: +- cc stable + +Signed-off-by: Thomas Zimmermann +Reviewed-by: Simona Vetter +Acked-by: Christian König +Acked-by: Zack Rusin +Cc: # v6.15+ +Link: https://lore.kernel.org/r/20250715155934.150656-7-tzimmermann@suse.de +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_gem_shmem_helper.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/drm_gem_shmem_helper.c ++++ b/drivers/gpu/drm/drm_gem_shmem_helper.c +@@ -339,7 +339,7 @@ int drm_gem_shmem_vmap(struct drm_gem_sh + int ret = 0; + + if (drm_gem_is_imported(obj)) { +- ret = dma_buf_vmap(obj->dma_buf, map); ++ ret = dma_buf_vmap(obj->import_attach->dmabuf, map); + } else { + pgprot_t prot = PAGE_KERNEL; + +@@ -399,7 +399,7 @@ void drm_gem_shmem_vunmap(struct drm_gem + struct drm_gem_object *obj = &shmem->base; + + if (drm_gem_is_imported(obj)) { +- dma_buf_vunmap(obj->dma_buf, map); ++ dma_buf_vunmap(obj->import_attach->dmabuf, map); + } else { + dma_resv_assert_held(shmem->base.resv); + diff --git a/queue-6.15/selftests-bpf-add-tests-with-stack-ptr-register-in-conditional-jmp.patch b/queue-6.15/selftests-bpf-add-tests-with-stack-ptr-register-in-conditional-jmp.patch new file mode 100644 index 0000000000..10f3c0a5f7 --- /dev/null +++ b/queue-6.15/selftests-bpf-add-tests-with-stack-ptr-register-in-conditional-jmp.patch @@ -0,0 +1,121 @@ +From 5ffb537e416ee22dbfb3d552102e50da33fec7f6 Mon Sep 17 00:00:00 2001 +From: Yonghong Song +Date: Fri, 23 May 2025 21:13:40 -0700 +Subject: selftests/bpf: Add tests with stack ptr register in conditional jmp + +From: Yonghong Song + +commit 5ffb537e416ee22dbfb3d552102e50da33fec7f6 upstream. + +Add two tests: + - one test has 'rX r10' where rX is not r10, and + - another test has 'rX rY' where rX and rY are not r10 + but there is an early insn 'rX = r10'. + +Without previous verifier change, both tests will fail. + +Signed-off-by: Yonghong Song +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250524041340.4046304-1-yonghong.song@linux.dev +[ shung-hsi.yu: contains additional hunks for kernel/bpf/verifier.c that + should be part of the previous patch in the series, commit + e2d2115e56c4 "bpf: Do not include stack ptr register in precision + backtracking bookkeeping", which already incorporated. ] +Link: https://lore.kernel.org/all/9b41f9f5-396f-47e0-9a12-46c52087df6c@linux.dev/ +Signed-off-by: Shung-Hsi Yu +Signed-off-by: Greg Kroah-Hartman +--- +Verified that newly added test passes in 6.15.y[1] as well as 6.12.y[2] + +1: https://github.com/shunghsiyu/libbpf/actions/runs/16561115937/job/46830912531 +2: https://github.com/shunghsiyu/libbpf/actions/runs/16561115937/job/46830912533 +--- + kernel/bpf/verifier.c | 7 +- + tools/testing/selftests/bpf/progs/verifier_precision.c | 53 +++++++++++++++++ + 2 files changed, 58 insertions(+), 2 deletions(-) + +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -16441,6 +16441,8 @@ static int check_cond_jmp_op(struct bpf_ + + if (src_reg->type == PTR_TO_STACK) + insn_flags |= INSN_F_SRC_REG_STACK; ++ if (dst_reg->type == PTR_TO_STACK) ++ insn_flags |= INSN_F_DST_REG_STACK; + } else { + if (insn->src_reg != BPF_REG_0) { + verbose(env, "BPF_JMP/JMP32 uses reserved fields\n"); +@@ -16450,10 +16452,11 @@ static int check_cond_jmp_op(struct bpf_ + memset(src_reg, 0, sizeof(*src_reg)); + src_reg->type = SCALAR_VALUE; + __mark_reg_known(src_reg, insn->imm); ++ ++ if (dst_reg->type == PTR_TO_STACK) ++ insn_flags |= INSN_F_DST_REG_STACK; + } + +- if (dst_reg->type == PTR_TO_STACK) +- insn_flags |= INSN_F_DST_REG_STACK; + if (insn_flags) { + err = push_insn_history(env, this_branch, insn_flags, 0); + if (err) +--- a/tools/testing/selftests/bpf/progs/verifier_precision.c ++++ b/tools/testing/selftests/bpf/progs/verifier_precision.c +@@ -179,4 +179,57 @@ __naked int state_loop_first_last_equal( + ); + } + ++__used __naked static void __bpf_cond_op_r10(void) ++{ ++ asm volatile ( ++ "r2 = 2314885393468386424 ll;" ++ "goto +0;" ++ "if r2 <= r10 goto +3;" ++ "if r1 >= -1835016 goto +0;" ++ "if r2 <= 8 goto +0;" ++ "if r3 <= 0 goto +0;" ++ "exit;" ++ ::: __clobber_all); ++} ++ ++SEC("?raw_tp") ++__success __log_level(2) ++__msg("8: (bd) if r2 <= r10 goto pc+3") ++__msg("9: (35) if r1 >= 0xffe3fff8 goto pc+0") ++__msg("10: (b5) if r2 <= 0x8 goto pc+0") ++__msg("mark_precise: frame1: last_idx 10 first_idx 0 subseq_idx -1") ++__msg("mark_precise: frame1: regs=r2 stack= before 9: (35) if r1 >= 0xffe3fff8 goto pc+0") ++__msg("mark_precise: frame1: regs=r2 stack= before 8: (bd) if r2 <= r10 goto pc+3") ++__msg("mark_precise: frame1: regs=r2 stack= before 7: (05) goto pc+0") ++__naked void bpf_cond_op_r10(void) ++{ ++ asm volatile ( ++ "r3 = 0 ll;" ++ "call __bpf_cond_op_r10;" ++ "r0 = 0;" ++ "exit;" ++ ::: __clobber_all); ++} ++ ++SEC("?raw_tp") ++__success __log_level(2) ++__msg("3: (bf) r3 = r10") ++__msg("4: (bd) if r3 <= r2 goto pc+1") ++__msg("5: (b5) if r2 <= 0x8 goto pc+2") ++__msg("mark_precise: frame0: last_idx 5 first_idx 0 subseq_idx -1") ++__msg("mark_precise: frame0: regs=r2 stack= before 4: (bd) if r3 <= r2 goto pc+1") ++__msg("mark_precise: frame0: regs=r2 stack= before 3: (bf) r3 = r10") ++__naked void bpf_cond_op_not_r10(void) ++{ ++ asm volatile ( ++ "r0 = 0;" ++ "r2 = 2314885393468386424 ll;" ++ "r3 = r10;" ++ "if r3 <= r2 goto +1;" ++ "if r2 <= 8 goto +2;" ++ "r0 = 2 ll;" ++ "exit;" ++ ::: __clobber_all); ++} ++ + char _license[] SEC("license") = "GPL"; diff --git a/queue-6.15/series b/queue-6.15/series index 0c413f9510..d5f572414e 100644 --- a/queue-6.15/series +++ b/queue-6.15/series @@ -78,3 +78,13 @@ selftests-mptcp-connect-also-cover-checksum.patch selftests-mm-fix-split_huge_page_test-for-folio_split-tests.patch mm-vmscan-fix-hwpoisoned-large-folio-handling-in-shrink_folio_list.patch mm-zsmalloc-do-not-pass-__gfp_movable-if-config_compaction-n.patch +selftests-bpf-add-tests-with-stack-ptr-register-in-conditional-jmp.patch +drm-xe-make-wa-bb-part-of-lrc-bo.patch +drm-amdgpu-add-the-new-sdma-function-pointers-for-amdgpu_sdma.h.patch +drm-amdgpu-implement-sdma-soft-reset-directly-for-v5.x.patch +drm-amdgpu-fix-sdma-engine-reset-with-logical-instance-id.patch +drm-shmem-helper-remove-obsoleted-is_iomem-test.patch +revert-drm-gem-shmem-use-dma_buf-from-gem-object-instance.patch +usb-typec-tcpm-allow-to-use-sink-in-accessory-mode.patch +usb-typec-tcpm-allow-switching-to-mode-accessory-to-mux-properly.patch +usb-typec-tcpm-apply-vbus-before-data-bringup-in-tcpm_src_attach.patch diff --git a/queue-6.15/usb-typec-tcpm-allow-switching-to-mode-accessory-to-mux-properly.patch b/queue-6.15/usb-typec-tcpm-allow-switching-to-mode-accessory-to-mux-properly.patch new file mode 100644 index 0000000000..9179c957b6 --- /dev/null +++ b/queue-6.15/usb-typec-tcpm-allow-switching-to-mode-accessory-to-mux-properly.patch @@ -0,0 +1,120 @@ +From 8a50da849151e7e12b43c1d8fe7ad302223aef6b Mon Sep 17 00:00:00 2001 +From: Michael Grzeschik +Date: Fri, 4 Apr 2025 00:43:06 +0200 +Subject: usb: typec: tcpm: allow switching to mode accessory to mux properly + +From: Michael Grzeschik + +commit 8a50da849151e7e12b43c1d8fe7ad302223aef6b upstream. + +The funciton tcpm_acc_attach is not setting the proper state when +calling tcpm_set_role. The function tcpm_set_role is currently only +handling TYPEC_STATE_USB. For the tcpm_acc_attach to switch into other +modal states tcpm_set_role needs to be extended by an extra state +parameter. This patch is handling the proper state change when calling +tcpm_acc_attach. + +Signed-off-by: Michael Grzeschik +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20250404-ml-topic-tcpm-v1-3-b99f44badce8@pengutronix.de +Stable-dep-of: bec15191d523 ("usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/tcpm/tcpm.c | 27 ++++++++++++++++++--------- + 1 file changed, 18 insertions(+), 9 deletions(-) + +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -1160,7 +1160,7 @@ static int tcpm_set_attached_state(struc + port->data_role); + } + +-static int tcpm_set_roles(struct tcpm_port *port, bool attached, ++static int tcpm_set_roles(struct tcpm_port *port, bool attached, int state, + enum typec_role role, enum typec_data_role data) + { + enum typec_orientation orientation; +@@ -1197,7 +1197,7 @@ static int tcpm_set_roles(struct tcpm_po + } + } + +- ret = tcpm_mux_set(port, TYPEC_STATE_USB, usb_role, orientation); ++ ret = tcpm_mux_set(port, state, usb_role, orientation); + if (ret < 0) + return ret; + +@@ -4404,7 +4404,8 @@ static int tcpm_src_attach(struct tcpm_p + + tcpm_enable_auto_vbus_discharge(port, true); + +- ret = tcpm_set_roles(port, true, TYPEC_SOURCE, tcpm_data_role_for_source(port)); ++ ret = tcpm_set_roles(port, true, TYPEC_STATE_USB, ++ TYPEC_SOURCE, tcpm_data_role_for_source(port)); + if (ret < 0) + return ret; + +@@ -4579,7 +4580,8 @@ static int tcpm_snk_attach(struct tcpm_p + + tcpm_enable_auto_vbus_discharge(port, true); + +- ret = tcpm_set_roles(port, true, TYPEC_SINK, tcpm_data_role_for_sink(port)); ++ ret = tcpm_set_roles(port, true, TYPEC_STATE_USB, ++ TYPEC_SINK, tcpm_data_role_for_sink(port)); + if (ret < 0) + return ret; + +@@ -4604,6 +4606,7 @@ static int tcpm_acc_attach(struct tcpm_p + int ret; + enum typec_role role; + enum typec_data_role data; ++ int state = TYPEC_STATE_USB; + + if (port->attached) + return 0; +@@ -4612,7 +4615,13 @@ static int tcpm_acc_attach(struct tcpm_p + data = tcpm_port_is_sink(port) ? tcpm_data_role_for_sink(port) + : tcpm_data_role_for_source(port); + +- ret = tcpm_set_roles(port, true, role, data); ++ if (tcpm_port_is_audio(port)) ++ state = TYPEC_MODE_AUDIO; ++ ++ if (tcpm_port_is_debug(port)) ++ state = TYPEC_MODE_DEBUG; ++ ++ ret = tcpm_set_roles(port, true, state, role, data); + if (ret < 0) + return ret; + +@@ -5382,7 +5391,7 @@ static void run_state_machine(struct tcp + */ + tcpm_set_vconn(port, false); + tcpm_set_vbus(port, false); +- tcpm_set_roles(port, port->self_powered, TYPEC_SOURCE, ++ tcpm_set_roles(port, port->self_powered, TYPEC_STATE_USB, TYPEC_SOURCE, + tcpm_data_role_for_source(port)); + /* + * If tcpc fails to notify vbus off, TCPM will wait for PD_T_SAFE_0V + +@@ -5414,7 +5423,7 @@ static void run_state_machine(struct tcp + tcpm_set_vconn(port, false); + if (port->pd_capable) + tcpm_set_charge(port, false); +- tcpm_set_roles(port, port->self_powered, TYPEC_SINK, ++ tcpm_set_roles(port, port->self_powered, TYPEC_STATE_USB, TYPEC_SINK, + tcpm_data_role_for_sink(port)); + /* + * VBUS may or may not toggle, depending on the adapter. +@@ -5538,10 +5547,10 @@ static void run_state_machine(struct tcp + case DR_SWAP_CHANGE_DR: + tcpm_unregister_altmodes(port); + if (port->data_role == TYPEC_HOST) +- tcpm_set_roles(port, true, port->pwr_role, ++ tcpm_set_roles(port, true, TYPEC_STATE_USB, port->pwr_role, + TYPEC_DEVICE); + else +- tcpm_set_roles(port, true, port->pwr_role, ++ tcpm_set_roles(port, true, TYPEC_STATE_USB, port->pwr_role, + TYPEC_HOST); + tcpm_ams_finish(port); + tcpm_set_state(port, ready_state(port), 0); diff --git a/queue-6.15/usb-typec-tcpm-allow-to-use-sink-in-accessory-mode.patch b/queue-6.15/usb-typec-tcpm-allow-to-use-sink-in-accessory-mode.patch new file mode 100644 index 0000000000..99b1e32144 --- /dev/null +++ b/queue-6.15/usb-typec-tcpm-allow-to-use-sink-in-accessory-mode.patch @@ -0,0 +1,44 @@ +From 64843d0ba96d3eae297025562111d57585273366 Mon Sep 17 00:00:00 2001 +From: Michael Grzeschik +Date: Fri, 4 Apr 2025 00:43:04 +0200 +Subject: usb: typec: tcpm: allow to use sink in accessory mode + +From: Michael Grzeschik + +commit 64843d0ba96d3eae297025562111d57585273366 upstream. + +Since the function tcpm_acc_attach is not setting the data and role for +for the sink case we extend it to check for it first. + +Signed-off-by: Michael Grzeschik +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20250404-ml-topic-tcpm-v1-1-b99f44badce8@pengutronix.de +Stable-dep-of: bec15191d523 ("usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/tcpm/tcpm.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -4602,12 +4602,17 @@ static void tcpm_snk_detach(struct tcpm_ + static int tcpm_acc_attach(struct tcpm_port *port) + { + int ret; ++ enum typec_role role; ++ enum typec_data_role data; + + if (port->attached) + return 0; + +- ret = tcpm_set_roles(port, true, TYPEC_SOURCE, +- tcpm_data_role_for_source(port)); ++ role = tcpm_port_is_sink(port) ? TYPEC_SINK : TYPEC_SOURCE; ++ data = tcpm_port_is_sink(port) ? tcpm_data_role_for_sink(port) ++ : tcpm_data_role_for_source(port); ++ ++ ret = tcpm_set_roles(port, true, role, data); + if (ret < 0) + return ret; + diff --git a/queue-6.15/usb-typec-tcpm-apply-vbus-before-data-bringup-in-tcpm_src_attach.patch b/queue-6.15/usb-typec-tcpm-apply-vbus-before-data-bringup-in-tcpm_src_attach.patch new file mode 100644 index 0000000000..13ac2da51d --- /dev/null +++ b/queue-6.15/usb-typec-tcpm-apply-vbus-before-data-bringup-in-tcpm_src_attach.patch @@ -0,0 +1,101 @@ +From bec15191d52300defa282e3fd83820f69e447116 Mon Sep 17 00:00:00 2001 +From: RD Babiera +Date: Wed, 18 Jun 2025 23:06:04 +0000 +Subject: usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach + +From: RD Babiera + +commit bec15191d52300defa282e3fd83820f69e447116 upstream. + +This patch fixes Type-C compliance test TD 4.7.6 - Try.SNK DRP Connect +SNKAS. + +tVbusON has a limit of 275ms when entering SRC_ATTACHED. Compliance +testers can interpret the TryWait.Src to Attached.Src transition after +Try.Snk as being in Attached.Src the entire time, so ~170ms is lost +to the debounce timer. + +Setting the data role can be a costly operation in host mode, and when +completed after 100ms can cause Type-C compliance test check TD 4.7.5.V.4 +to fail. + +Turn VBUS on before tcpm_set_roles to meet timing requirement. + +Fixes: f0690a25a140 ("staging: typec: USB Type-C Port Manager (tcpm)") +Cc: stable +Signed-off-by: RD Babiera +Reviewed-by: Badhri Jagan Sridharan +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20250618230606.3272497-2-rdbabiera@google.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/tcpm/tcpm.c | 34 +++++++++++++++++----------------- + 1 file changed, 17 insertions(+), 17 deletions(-) + +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -4404,17 +4404,6 @@ static int tcpm_src_attach(struct tcpm_p + + tcpm_enable_auto_vbus_discharge(port, true); + +- ret = tcpm_set_roles(port, true, TYPEC_STATE_USB, +- TYPEC_SOURCE, tcpm_data_role_for_source(port)); +- if (ret < 0) +- return ret; +- +- if (port->pd_supported) { +- ret = port->tcpc->set_pd_rx(port->tcpc, true); +- if (ret < 0) +- goto out_disable_mux; +- } +- + /* + * USB Type-C specification, version 1.2, + * chapter 4.5.2.2.8.1 (Attached.SRC Requirements) +@@ -4424,13 +4413,24 @@ static int tcpm_src_attach(struct tcpm_p + (polarity == TYPEC_POLARITY_CC2 && port->cc1 == TYPEC_CC_RA)) { + ret = tcpm_set_vconn(port, true); + if (ret < 0) +- goto out_disable_pd; ++ return ret; + } + + ret = tcpm_set_vbus(port, true); + if (ret < 0) + goto out_disable_vconn; + ++ ret = tcpm_set_roles(port, true, TYPEC_STATE_USB, TYPEC_SOURCE, ++ tcpm_data_role_for_source(port)); ++ if (ret < 0) ++ goto out_disable_vbus; ++ ++ if (port->pd_supported) { ++ ret = port->tcpc->set_pd_rx(port->tcpc, true); ++ if (ret < 0) ++ goto out_disable_mux; ++ } ++ + port->pd_capable = false; + + port->partner = NULL; +@@ -4441,14 +4441,14 @@ static int tcpm_src_attach(struct tcpm_p + + return 0; + +-out_disable_vconn: +- tcpm_set_vconn(port, false); +-out_disable_pd: +- if (port->pd_supported) +- port->tcpc->set_pd_rx(port->tcpc, false); + out_disable_mux: + tcpm_mux_set(port, TYPEC_STATE_SAFE, USB_ROLE_NONE, + TYPEC_ORIENTATION_NONE); ++out_disable_vbus: ++ tcpm_set_vbus(port, false); ++out_disable_vconn: ++ tcpm_set_vconn(port, false); ++ + return ret; + } + -- 2.47.2