From: Greg Kroah-Hartman Date: Tue, 1 Apr 2025 10:48:17 +0000 (+0100) Subject: 6.6-stable patches X-Git-Tag: v6.1.133~36 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2c6a52015272a6a1ec0996b9293dc797d9372714;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: drm-amd-display-check-denominator-crb_pipes-before-used.patch drm-amd-display-don-t-write-dp_mstm_ctrl-after-lt.patch drm-dp_mst-add-a-helper-to-queue-a-topology-probe.patch drm-dp_mst-factor-out-function-to-queue-a-topology-probe-work.patch mm-page_alloc-fix-memory-accept-before-watermarks-gets-initialized.patch reset-starfive-jh71x0-fix-accessing-the-empty-member-on-jh7110-soc.patch scsi-ufs-qcom-only-free-platform-msis-when-esi-is-enabled.patch --- diff --git a/queue-6.6/drm-amd-display-check-denominator-crb_pipes-before-used.patch b/queue-6.6/drm-amd-display-check-denominator-crb_pipes-before-used.patch new file mode 100644 index 0000000000..857400101b --- /dev/null +++ b/queue-6.6/drm-amd-display-check-denominator-crb_pipes-before-used.patch @@ -0,0 +1,37 @@ +From ea79068d4073bf303f8203f2625af7d9185a1bc6 Mon Sep 17 00:00:00 2001 +From: Alex Hung +Date: Tue, 18 Jun 2024 16:19:48 -0600 +Subject: drm/amd/display: Check denominator crb_pipes before used + +From: Alex Hung + +commit ea79068d4073bf303f8203f2625af7d9185a1bc6 upstream. + +[WHAT & HOW] +A denominator cannot be 0, and is checked before used. + +This fixes 2 DIVIDE_BY_ZERO issues reported by Coverity. + +Reviewed-by: Harry Wentland +Signed-off-by: Jerry Zuo +Signed-off-by: Alex Hung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Cliff Liu +Signed-off-by: He Zhe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/dcn315/dcn315_resource.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/dc/dcn315/dcn315_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn315/dcn315_resource.c +@@ -1753,7 +1753,7 @@ static int dcn315_populate_dml_pipes_fro + bool split_required = pipe->stream->timing.pix_clk_100hz >= dcn_get_max_non_odm_pix_rate_100hz(&dc->dml.soc) + || (pipe->plane_state && pipe->plane_state->src_rect.width > 5120); + +- if (remaining_det_segs > MIN_RESERVED_DET_SEGS) ++ if (remaining_det_segs > MIN_RESERVED_DET_SEGS && crb_pipes != 0) + pipes[pipe_cnt].pipe.src.det_size_override += (remaining_det_segs - MIN_RESERVED_DET_SEGS) / crb_pipes + + (crb_idx < (remaining_det_segs - MIN_RESERVED_DET_SEGS) % crb_pipes ? 1 : 0); + if (pipes[pipe_cnt].pipe.src.det_size_override > 2 * DCN3_15_MAX_DET_SEGS) { diff --git a/queue-6.6/drm-amd-display-don-t-write-dp_mstm_ctrl-after-lt.patch b/queue-6.6/drm-amd-display-don-t-write-dp_mstm_ctrl-after-lt.patch new file mode 100644 index 0000000000..ba94352978 --- /dev/null +++ b/queue-6.6/drm-amd-display-don-t-write-dp_mstm_ctrl-after-lt.patch @@ -0,0 +1,71 @@ +From bc068194f548ef1f230d96c4398046bf59165992 Mon Sep 17 00:00:00 2001 +From: Wayne Lin +Date: Fri, 25 Oct 2024 12:27:26 +0800 +Subject: drm/amd/display: Don't write DP_MSTM_CTRL after LT + +From: Wayne Lin + +commit bc068194f548ef1f230d96c4398046bf59165992 upstream. + +[Why] +Observe after suspend/resme, we can't light up mst monitors under specific +mst hub. The reason is that driver still writes DPCD DP_MSTM_CTRL after LT. +It's forbidden even we write the same value for that dpcd register. + +[How] +We already resume the mst branch device dpcd settings during +resume_mst_branch_status(). Leverage drm_dp_mst_topology_queue_probe() to +only probe the topology, not calling drm_dp_mst_topology_mgr_resume() which +will set DP_MSTM_CTRL as well. + +Reviewed-by: Jerry Zuo +Signed-off-by: Wayne Lin +Signed-off-by: Zaeem Mohamed +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +[cascardo: adjust context in local declarations] +Signed-off-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 16 ++++------------ + 1 file changed, 4 insertions(+), 12 deletions(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -2825,8 +2825,7 @@ static int dm_resume(void *handle) + struct dm_atomic_state *dm_state = to_dm_atomic_state(dm->atomic_obj.state); + enum dc_connection_type new_connection_type = dc_connection_none; + struct dc_state *dc_state; +- int i, r, j, ret; +- bool need_hotplug = false; ++ int i, r, j; + + if (amdgpu_in_reset(adev)) { + dc_state = dm->cached_dc_state; +@@ -3003,23 +3002,16 @@ static int dm_resume(void *handle) + aconnector->mst_root) + continue; + +- ret = drm_dp_mst_topology_mgr_resume(&aconnector->mst_mgr, true); +- +- if (ret < 0) { +- dm_helpers_dp_mst_stop_top_mgr(aconnector->dc_link->ctx, +- aconnector->dc_link); +- need_hotplug = true; +- } ++ drm_dp_mst_topology_queue_probe(&aconnector->mst_mgr); + } + drm_connector_list_iter_end(&iter); + +- if (need_hotplug) +- drm_kms_helper_hotplug_event(ddev); +- + amdgpu_dm_irq_resume_late(adev); + + amdgpu_dm_smu_write_watermarks_table(adev); + ++ drm_kms_helper_hotplug_event(ddev); ++ + return 0; + } + diff --git a/queue-6.6/drm-dp_mst-add-a-helper-to-queue-a-topology-probe.patch b/queue-6.6/drm-dp_mst-add-a-helper-to-queue-a-topology-probe.patch new file mode 100644 index 0000000000..922e0a4231 --- /dev/null +++ b/queue-6.6/drm-dp_mst-add-a-helper-to-queue-a-topology-probe.patch @@ -0,0 +1,71 @@ +From dbaeef363ea54f4c18112874b77503c72ba60fec Mon Sep 17 00:00:00 2001 +From: Imre Deak +Date: Mon, 22 Jul 2024 19:54:51 +0300 +Subject: drm/dp_mst: Add a helper to queue a topology probe + +From: Imre Deak + +commit dbaeef363ea54f4c18112874b77503c72ba60fec upstream. + +A follow up i915 patch will need to reprobe the MST topology after the +initial probing, add a helper for this. + +Cc: Lyude Paul +Cc: dri-devel@lists.freedesktop.org +Reviewed-by: Lyude Paul +Signed-off-by: Imre Deak +Link: https://patchwork.freedesktop.org/patch/msgid/20240722165503.2084999-3-imre.deak@intel.com +Signed-off-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/display/drm_dp_mst_topology.c | 27 ++++++++++++++++++++++++++ + include/drm/display/drm_dp_mst_helper.h | 2 + + 2 files changed, 29 insertions(+) + +--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c +@@ -3686,6 +3686,33 @@ drm_dp_mst_topology_mgr_invalidate_mstb( + } + + /** ++ * drm_dp_mst_topology_queue_probe - Queue a topology probe ++ * @mgr: manager to probe ++ * ++ * Queue a work to probe the MST topology. Driver's should call this only to ++ * sync the topology's HW->SW state after the MST link's parameters have ++ * changed in a way the state could've become out-of-sync. This is the case ++ * for instance when the link rate between the source and first downstream ++ * branch device has switched between UHBR and non-UHBR rates. Except of those ++ * cases - for instance when a sink gets plugged/unplugged to a port - the SW ++ * state will get updated automatically via MST UP message notifications. ++ */ ++void drm_dp_mst_topology_queue_probe(struct drm_dp_mst_topology_mgr *mgr) ++{ ++ mutex_lock(&mgr->lock); ++ ++ if (drm_WARN_ON(mgr->dev, !mgr->mst_state || !mgr->mst_primary)) ++ goto out_unlock; ++ ++ drm_dp_mst_topology_mgr_invalidate_mstb(mgr->mst_primary); ++ drm_dp_mst_queue_probe_work(mgr); ++ ++out_unlock: ++ mutex_unlock(&mgr->lock); ++} ++EXPORT_SYMBOL(drm_dp_mst_topology_queue_probe); ++ ++/** + * drm_dp_mst_topology_mgr_suspend() - suspend the MST manager + * @mgr: manager to suspend + * +--- a/include/drm/display/drm_dp_mst_helper.h ++++ b/include/drm/display/drm_dp_mst_helper.h +@@ -859,6 +859,8 @@ int drm_dp_check_act_status(struct drm_d + void drm_dp_mst_dump_topology(struct seq_file *m, + struct drm_dp_mst_topology_mgr *mgr); + ++void drm_dp_mst_topology_queue_probe(struct drm_dp_mst_topology_mgr *mgr); ++ + void drm_dp_mst_topology_mgr_suspend(struct drm_dp_mst_topology_mgr *mgr); + int __must_check + drm_dp_mst_topology_mgr_resume(struct drm_dp_mst_topology_mgr *mgr, diff --git a/queue-6.6/drm-dp_mst-factor-out-function-to-queue-a-topology-probe-work.patch b/queue-6.6/drm-dp_mst-factor-out-function-to-queue-a-topology-probe-work.patch new file mode 100644 index 0000000000..8812030ee8 --- /dev/null +++ b/queue-6.6/drm-dp_mst-factor-out-function-to-queue-a-topology-probe-work.patch @@ -0,0 +1,55 @@ +From e9b36c5be2e7fdef2cc933c1dac50bd81881e9b8 Mon Sep 17 00:00:00 2001 +From: Imre Deak +Date: Mon, 22 Jul 2024 19:54:50 +0300 +Subject: drm/dp_mst: Factor out function to queue a topology probe work + +From: Imre Deak + +commit e9b36c5be2e7fdef2cc933c1dac50bd81881e9b8 upstream. + +Factor out a function to queue a work for probing the topology, also +used by the next patch. + +Cc: Lyude Paul +Cc: dri-devel@lists.freedesktop.org +Reviewed-by: Lyude Paul +Signed-off-by: Imre Deak +Link: https://patchwork.freedesktop.org/patch/msgid/20240722165503.2084999-2-imre.deak@intel.com +Signed-off-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/display/drm_dp_mst_topology.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c +@@ -2692,6 +2692,11 @@ static void drm_dp_mst_link_probe_work(s + drm_kms_helper_hotplug_event(dev); + } + ++static void drm_dp_mst_queue_probe_work(struct drm_dp_mst_topology_mgr *mgr) ++{ ++ queue_work(system_long_wq, &mgr->work); ++} ++ + static bool drm_dp_validate_guid(struct drm_dp_mst_topology_mgr *mgr, + u8 *guid) + { +@@ -3643,7 +3648,7 @@ int drm_dp_mst_topology_mgr_set_mst(stru + /* Write reset payload */ + drm_dp_dpcd_write_payload(mgr, 0, 0, 0x3f); + +- queue_work(system_long_wq, &mgr->work); ++ drm_dp_mst_queue_probe_work(mgr); + + ret = 0; + } else { +@@ -3766,7 +3771,7 @@ int drm_dp_mst_topology_mgr_resume(struc + * state of our in-memory topology back into sync with reality. So, + * restart the probing process as if we're probing a new hub + */ +- queue_work(system_long_wq, &mgr->work); ++ drm_dp_mst_queue_probe_work(mgr); + mutex_unlock(&mgr->lock); + + if (sync) { diff --git a/queue-6.6/mm-page_alloc-fix-memory-accept-before-watermarks-gets-initialized.patch b/queue-6.6/mm-page_alloc-fix-memory-accept-before-watermarks-gets-initialized.patch new file mode 100644 index 0000000000..66365ffafb --- /dev/null +++ b/queue-6.6/mm-page_alloc-fix-memory-accept-before-watermarks-gets-initialized.patch @@ -0,0 +1,69 @@ +From 800f1059c99e2b39899bdc67a7593a7bea6375d8 Mon Sep 17 00:00:00 2001 +From: "Kirill A. Shutemov" +Date: Mon, 10 Mar 2025 10:28:55 +0200 +Subject: mm/page_alloc: fix memory accept before watermarks gets initialized + +From: Kirill A. Shutemov + +commit 800f1059c99e2b39899bdc67a7593a7bea6375d8 upstream. + +Watermarks are initialized during the postcore initcall. Until then, all +watermarks are set to zero. This causes cond_accept_memory() to +incorrectly skip memory acceptance because a watermark of 0 is always met. + +This can lead to a premature OOM on boot. + +To ensure progress, accept one MAX_ORDER page if the watermark is zero. + +Link: https://lkml.kernel.org/r/20250310082855.2587122-1-kirill.shutemov@linux.intel.com +Fixes: dcdfdd40fa82 ("mm: Add support for unaccepted memory") +Signed-off-by: Kirill A. Shutemov +Tested-by: Farrah Chen +Reported-by: Farrah Chen +Acked-by: Vlastimil Babka +Reviewed-by: Pankaj Gupta +Cc: Ashish Kalra +Cc: David Hildenbrand +Cc: "Edgecombe, Rick P" +Cc: Mel Gorman +Cc: "Mike Rapoport (IBM)" +Cc: Thomas Lendacky +Cc: [6.5+] +Signed-off-by: Andrew Morton +Signed-off-by: Kirill A. Shutemov +Signed-off-by: Greg Kroah-Hartman +--- + mm/page_alloc.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -6653,7 +6653,7 @@ static bool try_to_accept_memory_one(str + + static bool cond_accept_memory(struct zone *zone, unsigned int order) + { +- long to_accept; ++ long to_accept, wmark; + bool ret = false; + + if (!has_unaccepted_memory()) +@@ -6662,8 +6662,18 @@ static bool cond_accept_memory(struct zo + if (list_empty(&zone->unaccepted_pages)) + return false; + ++ wmark = high_wmark_pages(zone); ++ ++ /* ++ * Watermarks have not been initialized yet. ++ * ++ * Accepting one MAX_ORDER page to ensure progress. ++ */ ++ if (!wmark) ++ return try_to_accept_memory_one(zone); ++ + /* How much to accept to get to high watermark? */ +- to_accept = high_wmark_pages(zone) - ++ to_accept = wmark - + (zone_page_state(zone, NR_FREE_PAGES) - + __zone_watermark_unusable_free(zone, order, 0) - + zone_page_state(zone, NR_UNACCEPTED)); diff --git a/queue-6.6/reset-starfive-jh71x0-fix-accessing-the-empty-member-on-jh7110-soc.patch b/queue-6.6/reset-starfive-jh71x0-fix-accessing-the-empty-member-on-jh7110-soc.patch new file mode 100644 index 0000000000..794b9beabf --- /dev/null +++ b/queue-6.6/reset-starfive-jh71x0-fix-accessing-the-empty-member-on-jh7110-soc.patch @@ -0,0 +1,39 @@ +From 2cf59663660799ce16f4dfbed97cdceac7a7fa11 Mon Sep 17 00:00:00 2001 +From: Changhuang Liang +Date: Wed, 25 Sep 2024 04:24:42 -0700 +Subject: reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC + +From: Changhuang Liang + +commit 2cf59663660799ce16f4dfbed97cdceac7a7fa11 upstream. + +data->asserted will be NULL on JH7110 SoC since commit 82327b127d41 +("reset: starfive: Add StarFive JH7110 reset driver") was added. Add +the judgment condition to avoid errors when calling reset_control_status +on JH7110 SoC. + +Fixes: 82327b127d41 ("reset: starfive: Add StarFive JH7110 reset driver") +Signed-off-by: Changhuang Liang +Acked-by: Hal Feng +Reviewed-by: Philipp Zabel +Link: https://lore.kernel.org/r/20240925112442.1732416-1-changhuang.liang@starfivetech.com +Signed-off-by: Philipp Zabel +Signed-off-by: Jianqi Ren +Signed-off-by: He Zhe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/reset/starfive/reset-starfive-jh71x0.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/reset/starfive/reset-starfive-jh71x0.c ++++ b/drivers/reset/starfive/reset-starfive-jh71x0.c +@@ -94,6 +94,9 @@ static int jh71x0_reset_status(struct re + void __iomem *reg_status = data->status + offset * sizeof(u32); + u32 value = readl(reg_status); + ++ if (!data->asserted) ++ return !(value & mask); ++ + return !((value ^ data->asserted[offset]) & mask); + } + diff --git a/queue-6.6/scsi-ufs-qcom-only-free-platform-msis-when-esi-is-enabled.patch b/queue-6.6/scsi-ufs-qcom-only-free-platform-msis-when-esi-is-enabled.patch new file mode 100644 index 0000000000..419a6161fd --- /dev/null +++ b/queue-6.6/scsi-ufs-qcom-only-free-platform-msis-when-esi-is-enabled.patch @@ -0,0 +1,62 @@ +From 64506b3d23a337e98a74b18dcb10c8619365f2bd Mon Sep 17 00:00:00 2001 +From: Manivannan Sadhasivam +Date: Mon, 11 Nov 2024 23:18:31 +0530 +Subject: scsi: ufs: qcom: Only free platform MSIs when ESI is enabled + +From: Manivannan Sadhasivam + +commit 64506b3d23a337e98a74b18dcb10c8619365f2bd upstream. + +Otherwise, it will result in a NULL pointer dereference as below: + +Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 +Call trace: + mutex_lock+0xc/0x54 + platform_device_msi_free_irqs_all+0x14/0x20 + ufs_qcom_remove+0x34/0x48 [ufs_qcom] + platform_remove+0x28/0x44 + device_remove+0x4c/0x80 + device_release_driver_internal+0xd8/0x178 + driver_detach+0x50/0x9c + bus_remove_driver+0x6c/0xbc + driver_unregister+0x30/0x60 + platform_driver_unregister+0x14/0x20 + ufs_qcom_pltform_exit+0x18/0xb94 [ufs_qcom] + __arm64_sys_delete_module+0x180/0x260 + invoke_syscall+0x44/0x100 + el0_svc_common.constprop.0+0xc0/0xe0 + do_el0_svc+0x1c/0x28 + el0_svc+0x34/0xdc + el0t_64_sync_handler+0xc0/0xc4 + el0t_64_sync+0x190/0x194 + +Cc: stable@vger.kernel.org # 6.3 +Fixes: 519b6274a777 ("scsi: ufs: qcom: Add MCQ ESI config vendor specific ops") +Signed-off-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20241111-ufs_bug_fix-v1-2-45ad8b62f02e@linaro.org +Reviewed-by: Bean Huo +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Jianqi Ren +Signed-off-by: He Zhe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ufs/host/ufs-qcom.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/ufs/host/ufs-qcom.c ++++ b/drivers/ufs/host/ufs-qcom.c +@@ -1918,10 +1918,12 @@ static int ufs_qcom_probe(struct platfor + static int ufs_qcom_remove(struct platform_device *pdev) + { + struct ufs_hba *hba = platform_get_drvdata(pdev); ++ struct ufs_qcom_host *host = ufshcd_get_variant(hba); + + pm_runtime_get_sync(&(pdev)->dev); + ufshcd_remove(hba); +- platform_msi_domain_free_irqs(hba->dev); ++ if (host->esi_enabled) ++ platform_msi_domain_free_irqs(hba->dev); + return 0; + } + diff --git a/queue-6.6/series b/queue-6.6/series index 8760f0ac6d..d14ceef550 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -4,3 +4,10 @@ atm-fix-null-pointer-dereference.patch arm-9350-1-fault-implement-copy_from_kernel_nofault_allowed.patch arm-9351-1-fault-add-cut-here-line-for-prefetch-aborts.patch arm-remove-address-checking-for-mmuless-devices.patch +drm-amd-display-check-denominator-crb_pipes-before-used.patch +drm-dp_mst-factor-out-function-to-queue-a-topology-probe-work.patch +drm-dp_mst-add-a-helper-to-queue-a-topology-probe.patch +drm-amd-display-don-t-write-dp_mstm_ctrl-after-lt.patch +mm-page_alloc-fix-memory-accept-before-watermarks-gets-initialized.patch +reset-starfive-jh71x0-fix-accessing-the-empty-member-on-jh7110-soc.patch +scsi-ufs-qcom-only-free-platform-msis-when-esi-is-enabled.patch