From: Greg Kroah-Hartman Date: Mon, 24 Mar 2025 16:13:43 +0000 (-0700) Subject: 6.13-stable patches X-Git-Tag: v6.1.132~29 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=bdd9d5d5c3197d4a2a49df077b9e857f01351704;p=thirdparty%2Fkernel%2Fstable-queue.git 6.13-stable patches added patches: accel-qaic-fix-integer-overflow-in-qaic_validate_req.patch arm-dts-imx6qdl-apalis-fix-poweroff-on-apalis-imx6.patch arm-shmobile-smp-enforce-shmobile_smp_-alignment.patch arm64-dts-freescale-imx8mm-verdin-dahlia-add-microphone-jack-to-sound-card.patch arm64-dts-freescale-imx8mp-verdin-dahlia-add-microphone-jack-to-sound-card.patch arm64-dts-rockchip-add-avdd-hdmi-supplies-to-rockpro64-board-dtsi.patch arm64-dts-rockchip-add-missing-pcie-supplies-to-rockpro64-board-dtsi.patch arm64-dts-rockchip-fix-pinmux-of-uart0-for-px30-ringneck-on-haikou.patch arm64-dts-rockchip-fix-pinmux-of-uart5-for-px30-ringneck-on-haikou.patch arm64-dts-rockchip-fix-u2phy1_host-status-for-nanopi-r4s.patch batman-adv-ignore-own-maximum-aggregation-size-during-rx.patch can-flexcan-disable-transceiver-during-system-pm.patch can-flexcan-only-change-can-state-when-link-up-in-system-pm.patch can-rcar_canfd-fix-page-entries-in-the-afl-list.patch can-ucan-fix-out-of-bound-read-in-strscpy-source.patch drm-amd-display-fix-message-for-support_edp0_on_dp1.patch drm-amd-display-use-hw-lock-mgr-for-psr1-when-only-one-edp.patch drm-amd-pm-add-unique_id-for-gfx12.patch drm-amdgpu-fix-jpeg-video-caps-max-size-for-navi1x-and-raven.patch drm-amdgpu-fix-mpeg2-mpeg4-and-vc1-video-caps-max-size.patch drm-amdgpu-gfx12-correct-cleanup-of-me-field-with-gfx_v12_0_me_fini.patch drm-amdgpu-pm-handle-sclk-offset-correctly-in-overdrive-for-smu-14.0.2.patch drm-amdgpu-pm-wire-up-hwmon-fan-speed-for-smu-14.0.2.patch drm-amdgpu-remove-jpeg-from-vega-and-carrizo-video-caps.patch drm-amdgpu-restore-uncached-behaviour-on-gfx12.patch drm-amdkfd-fix-instruction-hazard-in-gfx12-trap-handler.patch drm-amdkfd-fix-user-queue-validation-on-gfx7-8.patch drm-radeon-fix-uninitialized-size-issue-in-radeon_vce_cs_parse.patch drm-sched-fix-fence-reference-count-leak.patch drm-v3d-don-t-run-jobs-that-have-errors-flagged-in-its-fence.patch drm-xe-fix-exporting-xe-buffers-multiple-times.patch dt-bindings-can-renesas-rcar-canfd-fix-typo-in-pattern-properties-for-r-car-v4m.patch efi-libstub-avoid-physical-address-0x0-when-doing-random-allocation.patch firmware-qcom-uefisecapp-fix-efivars-registration-race.patch i2c-omap-fix-irq-storms.patch io_uring-net-don-t-clear-req_f_need_cleanup-unconditionally.patch keys-fix-uaf-in-key_put.patch media-rtl2832_sdr-assign-vb2-lock-before-vb2_queue_init.patch memcg-drain-obj-stock-on-cpu-hotplug-teardown.patch mm-fix-error-handling-in-__filemap_get_folio-with-fgp_nowait.patch mm-huge_memory-drop-beyond-eof-folios-with-the-right-number-of-refs.patch mm-migrate-fix-shmem-xarray-update-during-migration.patch mm-page_alloc-fix-memory-accept-before-watermarks-gets-initialized.patch mmc-atmel-mci-add-missing-clk_disable_unprepare.patch mmc-sdhci-brcmstb-add-cqhci-suspend-resume-to-pm-ops.patch net-mana-support-holes-in-device-list-reply-msg.patch netfs-call-invalidate_cache-only-if-implemented.patch pmdomain-amlogic-fix-t7-isp-secpower.patch proc-fix-uaf-in-proc_get_inode.patch regulator-check-that-dummy-regulator-has-been-probed-before-using-it.patch regulator-dummy-force-synchronous-probing.patch riscv-dts-starfive-fix-a-typo-in-starfive-jh7110-pin-function-definitions.patch selftests-mm-run_vmtests.sh-fix-half_ufd_size_mb-calculation.patch soc-qcom-pdr-fix-the-potential-deadlock.patch tracing-tprobe-events-fix-leakage-of-module-refcount.patch xsk-fix-an-integer-overflow-in-xp_create_and_assign_umem.patch --- diff --git a/queue-6.13/accel-qaic-fix-integer-overflow-in-qaic_validate_req.patch b/queue-6.13/accel-qaic-fix-integer-overflow-in-qaic_validate_req.patch new file mode 100644 index 0000000000..ccc20e6a9a --- /dev/null +++ b/queue-6.13/accel-qaic-fix-integer-overflow-in-qaic_validate_req.patch @@ -0,0 +1,44 @@ +From 67d15c7aa0864dfd82325c7e7e7d8548b5224c7b Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 7 Mar 2025 11:41:48 +0300 +Subject: accel/qaic: Fix integer overflow in qaic_validate_req() + +From: Dan Carpenter + +commit 67d15c7aa0864dfd82325c7e7e7d8548b5224c7b upstream. + +These are u64 variables that come from the user via +qaic_attach_slice_bo_ioctl(). Use check_add_overflow() to ensure that +the math doesn't have an integer wrapping bug. + +Cc: stable@vger.kernel.org +Fixes: ff13be830333 ("accel/qaic: Add datapath") +Signed-off-by: Dan Carpenter +Reviewed-by: Jeff Hugo +Signed-off-by: Jeff Hugo +Link: https://patchwork.freedesktop.org/patch/msgid/176388fa-40fe-4cb4-9aeb-2c91c22130bd@stanley.mountain +Signed-off-by: Greg Kroah-Hartman +--- + drivers/accel/qaic/qaic_data.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/accel/qaic/qaic_data.c ++++ b/drivers/accel/qaic/qaic_data.c +@@ -557,6 +557,7 @@ static bool invalid_sem(struct qaic_sem + static int qaic_validate_req(struct qaic_device *qdev, struct qaic_attach_slice_entry *slice_ent, + u32 count, u64 total_size) + { ++ u64 total; + int i; + + for (i = 0; i < count; i++) { +@@ -566,7 +567,8 @@ static int qaic_validate_req(struct qaic + invalid_sem(&slice_ent[i].sem2) || invalid_sem(&slice_ent[i].sem3)) + return -EINVAL; + +- if (slice_ent[i].offset + slice_ent[i].size > total_size) ++ if (check_add_overflow(slice_ent[i].offset, slice_ent[i].size, &total) || ++ total > total_size) + return -EINVAL; + } + diff --git a/queue-6.13/arm-dts-imx6qdl-apalis-fix-poweroff-on-apalis-imx6.patch b/queue-6.13/arm-dts-imx6qdl-apalis-fix-poweroff-on-apalis-imx6.patch new file mode 100644 index 0000000000..460ba80b04 --- /dev/null +++ b/queue-6.13/arm-dts-imx6qdl-apalis-fix-poweroff-on-apalis-imx6.patch @@ -0,0 +1,60 @@ +From 83964a29379cb08929a39172780a4c2992bc7c93 Mon Sep 17 00:00:00 2001 +From: Stefan Eichenberger +Date: Fri, 10 Jan 2025 16:18:29 +0100 +Subject: ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6 + +From: Stefan Eichenberger + +commit 83964a29379cb08929a39172780a4c2992bc7c93 upstream. + +The current solution for powering off the Apalis iMX6 is not functioning +as intended. To resolve this, it is necessary to power off the +vgen2_reg, which will also set the POWER_ENABLE_MOCI signal to a low +state. This ensures the carrier board is properly informed to initiate +its power-off sequence. + +The new solution uses the regulator-poweroff driver, which will power +off the regulator during a system shutdown. + +Cc: +Fixes: 4eb56e26f92e ("ARM: dts: imx6q-apalis: Command pmic to standby for poweroff") +Signed-off-by: Stefan Eichenberger +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi +@@ -108,6 +108,11 @@ + }; + }; + ++ poweroff { ++ compatible = "regulator-poweroff"; ++ cpu-supply = <&vgen2_reg>; ++ }; ++ + reg_module_3v3: regulator-module-3v3 { + compatible = "regulator-fixed"; + regulator-always-on; +@@ -236,10 +241,6 @@ + status = "disabled"; + }; + +-&clks { +- fsl,pmic-stby-poweroff; +-}; +- + /* Apalis SPI1 */ + &ecspi1 { + cs-gpios = <&gpio5 25 GPIO_ACTIVE_LOW>; +@@ -527,7 +528,6 @@ + + pmic: pmic@8 { + compatible = "fsl,pfuze100"; +- fsl,pmic-stby-poweroff; + reg = <0x08>; + + regulators { diff --git a/queue-6.13/arm-shmobile-smp-enforce-shmobile_smp_-alignment.patch b/queue-6.13/arm-shmobile-smp-enforce-shmobile_smp_-alignment.patch new file mode 100644 index 0000000000..b8298def33 --- /dev/null +++ b/queue-6.13/arm-shmobile-smp-enforce-shmobile_smp_-alignment.patch @@ -0,0 +1,42 @@ +From 379c590113ce46f605439d4887996c60ab8820cc Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Mon, 10 Mar 2025 14:12:20 +0100 +Subject: ARM: shmobile: smp: Enforce shmobile_smp_* alignment + +From: Geert Uytterhoeven + +commit 379c590113ce46f605439d4887996c60ab8820cc upstream. + +When the addresses of the shmobile_smp_mpidr, shmobile_smp_fn, and +shmobile_smp_arg variables are not multiples of 4 bytes, secondary CPU +bring-up fails: + + smp: Bringing up secondary CPUs ... + CPU1: failed to come online + CPU2: failed to come online + CPU3: failed to come online + smp: Brought up 1 node, 1 CPU + +Fix this by adding the missing alignment directive. + +Fixes: 4e960f52fce16a3b ("ARM: shmobile: Move shmobile_smp_{mpidr, fn, arg}[] from .text to .bss") +Closes: https://lore.kernel.org/r/CAMuHMdU=QR-JLgEHKWpsr6SbaZRc-Hz9r91JfpP8c3n2G-OjqA@mail.gmail.com +Signed-off-by: Geert Uytterhoeven +Tested-by: Lad Prabhakar +Link: https://lore.kernel.org/c499234d559a0d95ad9472883e46077311051cd8.1741612208.git.geert+renesas@glider.be +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/mach-shmobile/headsmp.S | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm/mach-shmobile/headsmp.S ++++ b/arch/arm/mach-shmobile/headsmp.S +@@ -136,6 +136,7 @@ ENDPROC(shmobile_smp_sleep) + .long shmobile_smp_arg - 1b + + .bss ++ .align 2 + .globl shmobile_smp_mpidr + shmobile_smp_mpidr: + .space NR_CPUS * 4 diff --git a/queue-6.13/arm64-dts-freescale-imx8mm-verdin-dahlia-add-microphone-jack-to-sound-card.patch b/queue-6.13/arm64-dts-freescale-imx8mm-verdin-dahlia-add-microphone-jack-to-sound-card.patch new file mode 100644 index 0000000000..dd87c3ced7 --- /dev/null +++ b/queue-6.13/arm64-dts-freescale-imx8mm-verdin-dahlia-add-microphone-jack-to-sound-card.patch @@ -0,0 +1,44 @@ +From 2c1092823eb03f8508d6769e2f38eef7e1fe62a0 Mon Sep 17 00:00:00 2001 +From: Stefan Eichenberger +Date: Mon, 17 Feb 2025 15:56:41 +0100 +Subject: arm64: dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound card + +From: Stefan Eichenberger + +commit 2c1092823eb03f8508d6769e2f38eef7e1fe62a0 upstream. + +The simple-audio-card's microphone widget currently connects to the +headphone jack. Routing the microphone input to the microphone jack +allows for independent operation of the microphone and headphones. + +This resolves the following boot-time kernel log message, which +indicated a conflict when the microphone and headphone functions were +not separated: + debugfs: File 'Headphone Jack' in directory 'dapm' already present! + +Fixes: 6a57f224f734 ("arm64: dts: freescale: add initial support for verdin imx8m mini") +Signed-off-by: Stefan Eichenberger +Reviewed-by: Francesco Dolcini +Cc: +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/freescale/imx8mm-verdin-dahlia.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/arm64/boot/dts/freescale/imx8mm-verdin-dahlia.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm-verdin-dahlia.dtsi +@@ -16,10 +16,10 @@ + "Headphone Jack", "HPOUTR", + "IN2L", "Line In Jack", + "IN2R", "Line In Jack", +- "Headphone Jack", "MICBIAS", +- "IN1L", "Headphone Jack"; ++ "Microphone Jack", "MICBIAS", ++ "IN1L", "Microphone Jack"; + simple-audio-card,widgets = +- "Microphone", "Headphone Jack", ++ "Microphone", "Microphone Jack", + "Headphone", "Headphone Jack", + "Line", "Line In Jack"; + diff --git a/queue-6.13/arm64-dts-freescale-imx8mp-verdin-dahlia-add-microphone-jack-to-sound-card.patch b/queue-6.13/arm64-dts-freescale-imx8mp-verdin-dahlia-add-microphone-jack-to-sound-card.patch new file mode 100644 index 0000000000..f8ca94ca26 --- /dev/null +++ b/queue-6.13/arm64-dts-freescale-imx8mp-verdin-dahlia-add-microphone-jack-to-sound-card.patch @@ -0,0 +1,44 @@ +From b0612fdba9afdce261bfb8684e0cece6f2e2b0bb Mon Sep 17 00:00:00 2001 +From: Stefan Eichenberger +Date: Mon, 17 Feb 2025 15:56:40 +0100 +Subject: arm64: dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound card + +From: Stefan Eichenberger + +commit b0612fdba9afdce261bfb8684e0cece6f2e2b0bb upstream. + +The simple-audio-card's microphone widget currently connects to the +headphone jack. Routing the microphone input to the microphone jack +allows for independent operation of the microphone and headphones. + +This resolves the following boot-time kernel log message, which +indicated a conflict when the microphone and headphone functions were +not separated: + debugfs: File 'Headphone Jack' in directory 'dapm' already present! + +Fixes: 874958916844 ("arm64: dts: freescale: verdin-imx8mp: dahlia: add sound card") +Signed-off-by: Stefan Eichenberger +Reviewed-by: Francesco Dolcini +Cc: +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/freescale/imx8mp-verdin-dahlia.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/arm64/boot/dts/freescale/imx8mp-verdin-dahlia.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp-verdin-dahlia.dtsi +@@ -28,10 +28,10 @@ + "Headphone Jack", "HPOUTR", + "IN2L", "Line In Jack", + "IN2R", "Line In Jack", +- "Headphone Jack", "MICBIAS", +- "IN1L", "Headphone Jack"; ++ "Microphone Jack", "MICBIAS", ++ "IN1L", "Microphone Jack"; + simple-audio-card,widgets = +- "Microphone", "Headphone Jack", ++ "Microphone", "Microphone Jack", + "Headphone", "Headphone Jack", + "Line", "Line In Jack"; + diff --git a/queue-6.13/arm64-dts-rockchip-add-avdd-hdmi-supplies-to-rockpro64-board-dtsi.patch b/queue-6.13/arm64-dts-rockchip-add-avdd-hdmi-supplies-to-rockpro64-board-dtsi.patch new file mode 100644 index 0000000000..e3d572cce5 --- /dev/null +++ b/queue-6.13/arm64-dts-rockchip-add-avdd-hdmi-supplies-to-rockpro64-board-dtsi.patch @@ -0,0 +1,69 @@ +From bd1c959f37f384b477f51572331b0dc828bd009a Mon Sep 17 00:00:00 2001 +From: Dragan Simic +Date: Sun, 2 Mar 2025 19:48:03 +0100 +Subject: arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi + +From: Dragan Simic + +commit bd1c959f37f384b477f51572331b0dc828bd009a upstream. + +Add missing "avdd-0v9-supply" and "avdd-1v8-supply" properties to the "hdmi" +node in the Pine64 RockPro64 board dtsi file. To achieve this, also add the +associated "vcca_0v9" regulator that produces the 0.9 V supply, [1][2] which +hasn't been defined previously in the board dtsi file. + +This also eliminates the following warnings from the kernel log: + + dwhdmi-rockchip ff940000.hdmi: supply avdd-0v9 not found, using dummy regulator + dwhdmi-rockchip ff940000.hdmi: supply avdd-1v8 not found, using dummy regulator + +There are no functional changes to the way board works with these additions, +because the "vcc1v8_dvp" and "vcca_0v9" regulators are always enabled, [1][2] +but these additions improve the accuracy of hardware description. + +These changes apply to the both supported hardware revisions of the Pine64 +RockPro64, i.e. to the production-run revisions 2.0 and 2.1. [1][2] + +[1] https://files.pine64.org/doc/rockpro64/rockpro64_v21-SCH.pdf +[2] https://files.pine64.org/doc/rockpro64/rockpro64_v20-SCH.pdf + +Fixes: e4f3fb490967 ("arm64: dts: rockchip: add initial dts support for Rockpro64") +Cc: stable@vger.kernel.org +Suggested-by: Diederik de Haas +Signed-off-by: Dragan Simic +Tested-by: Diederik de Haas +Link: https://lore.kernel.org/r/df3d7e8fe74ed5e727e085b18c395260537bb5ac.1740941097.git.dsimic@manjaro.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dtsi | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dtsi +@@ -227,6 +227,16 @@ + vin-supply = <&vcc12v_dcin>; + }; + ++ vcca_0v9: regulator-vcca-0v9 { ++ compatible = "regulator-fixed"; ++ regulator-name = "vcca_0v9"; ++ regulator-always-on; ++ regulator-boot-on; ++ regulator-min-microvolt = <900000>; ++ regulator-max-microvolt = <900000>; ++ vin-supply = <&vcc3v3_sys>; ++ }; ++ + vdd_log: regulator-vdd-log { + compatible = "pwm-regulator"; + pwms = <&pwm2 0 25000 1>; +@@ -312,6 +322,8 @@ + }; + + &hdmi { ++ avdd-0v9-supply = <&vcca_0v9>; ++ avdd-1v8-supply = <&vcc1v8_dvp>; + ddc-i2c-bus = <&i2c3>; + pinctrl-names = "default"; + pinctrl-0 = <&hdmi_cec>; diff --git a/queue-6.13/arm64-dts-rockchip-add-missing-pcie-supplies-to-rockpro64-board-dtsi.patch b/queue-6.13/arm64-dts-rockchip-add-missing-pcie-supplies-to-rockpro64-board-dtsi.patch new file mode 100644 index 0000000000..d7394b5f40 --- /dev/null +++ b/queue-6.13/arm64-dts-rockchip-add-missing-pcie-supplies-to-rockpro64-board-dtsi.patch @@ -0,0 +1,85 @@ +From ffcef3df680c437ca33ff434be18ec24d72907c2 Mon Sep 17 00:00:00 2001 +From: Dragan Simic +Date: Sun, 2 Mar 2025 19:48:04 +0100 +Subject: arm64: dts: rockchip: Add missing PCIe supplies to RockPro64 board dtsi + +From: Dragan Simic + +commit ffcef3df680c437ca33ff434be18ec24d72907c2 upstream. + +Add missing "vpcie0v9-supply" and "vpcie1v8-supply" properties to the "pcie0" +node in the Pine64 RockPro64 board dtsi file. This eliminates the following +warnings from the kernel log: + + rockchip-pcie f8000000.pcie: supply vpcie1v8 not found, using dummy regulator + rockchip-pcie f8000000.pcie: supply vpcie0v9 not found, using dummy regulator + +These additions improve the accuracy of hardware description of the RockPro64 +and, in theory, they should result in no functional changes to the way board +works after the changes, because the "vcca_0v9" and "vcca_1v8" regulators are +always enabled. [1][2] However, extended reliability testing, performed by +Chris, [3] has proven that the age-old issues with some PCI Express cards, +when used with a Pine64 RockPro64, are also resolved. + +Those issues were already mentioned in the commit 43853e843aa6 (arm64: dts: +rockchip: Remove unsupported node from the Pinebook Pro dts, 2024-04-01), +together with a brief description of the out-of-tree enumeration delay patch +that reportedly resolves those issues. In a nutshell, booting a RockPro64 +with some PCI Express cards attached to it caused a kernel oops. [4] + +Symptomatically enough, to the commit author's best knowledge, only the Pine64 +RockPro64, out of all RK3399-based boards and devices supported upstream, has +been reported to suffer from those PCI Express issues, and only the RockPro64 +had some of the PCI Express supplies missing in its DT. Thus, perhaps some +weird timing issues exist that caused the "vcca_1v8" always-on regulator, +which is part of the RK808 PMIC, to actually not be enabled before the PCI +Express is initialized and enumerated on the RockPro64, causing oopses with +some PCIe cards, and the aforementioned enumeration delay patch [4] probably +acted as just a workaround for the underlying timing issue. + +Admittedly, the Pine64 RockPro64 is a bit specific board by having a standard +PCI Express slot, allowing use of various standard cards, but pretty much +standard PCI Express cards have been attached to other RK3399 boards as well, +and the commit author is unaware ot such issues reported for them. + +It's quite hard to be sure that the PCI Express issues are fully resolved by +these additions to the DT, without some really extensive and time-consuming +testing. However, these additions to the DT can result in good things and +improvements anyway, making them perfectly safe from the standpoint of being +unable to do any harm or cause some unforeseen regressions. + +These changes apply to the both supported hardware revisions of the Pine64 +RockPro64, i.e. to the production-run revisions 2.0 and 2.1. [1][2] + +[1] https://files.pine64.org/doc/rockpro64/rockpro64_v21-SCH.pdf +[2] https://files.pine64.org/doc/rockpro64/rockpro64_v20-SCH.pdf +[3] https://z9.de/hedgedoc/s/nF4d5G7rg#reboot-tests-for-PCIe-improvements +[4] https://lore.kernel.org/lkml/20230509153912.515218-1-vincenzopalazzodev@gmail.com/T/#u + +Fixes: bba821f5479e ("arm64: dts: rockchip: add PCIe nodes on rk3399-rockpro64") +Cc: stable@vger.kernel.org +Cc: Vincenzo Palazzo +Cc: Peter Geis +Cc: Bjorn Helgaas +Reported-by: Diederik de Haas +Tested-by: Chris Vogel +Signed-off-by: Dragan Simic +Tested-by: Diederik de Haas +Link: https://lore.kernel.org/r/b39cfd7490d8194f053bf3971f13a43472d1769e.1740941097.git.dsimic@manjaro.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dtsi +@@ -673,6 +673,8 @@ + num-lanes = <4>; + pinctrl-names = "default"; + pinctrl-0 = <&pcie_perst>; ++ vpcie0v9-supply = <&vcca_0v9>; ++ vpcie1v8-supply = <&vcca_1v8>; + vpcie12v-supply = <&vcc12v_dcin>; + vpcie3v3-supply = <&vcc3v3_pcie>; + status = "okay"; diff --git a/queue-6.13/arm64-dts-rockchip-fix-pinmux-of-uart0-for-px30-ringneck-on-haikou.patch b/queue-6.13/arm64-dts-rockchip-fix-pinmux-of-uart0-for-px30-ringneck-on-haikou.patch new file mode 100644 index 0000000000..4d460455ed --- /dev/null +++ b/queue-6.13/arm64-dts-rockchip-fix-pinmux-of-uart0-for-px30-ringneck-on-haikou.patch @@ -0,0 +1,40 @@ +From 2db7d29c7b1629ced3cbab3de242511eb3c22066 Mon Sep 17 00:00:00 2001 +From: Quentin Schulz +Date: Tue, 25 Feb 2025 12:53:29 +0100 +Subject: arm64: dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Quentin Schulz + +commit 2db7d29c7b1629ced3cbab3de242511eb3c22066 upstream. + +UART0 pinmux by default configures GPIO0_B5 in its UART RTS function for +UART0. However, by default on Haikou, it is used as GPIO as UART RTS for +UART5. + +Therefore, let's update UART0 pinmux to not configure the pin in that +mode, a later commit will make UART5 request the GPIO pinmux. + +Fixes: c484cf93f61b ("arm64: dts: rockchip: add PX30-µQ7 (Ringneck) SoM with Haikou baseboard") +Cc: stable@vger.kernel.org +Signed-off-by: Quentin Schulz +Link: https://lore.kernel.org/r/20250225-ringneck-dtbos-v3-1-853a9a6dd597@cherry.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/rockchip/px30-ringneck-haikou.dts | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm64/boot/dts/rockchip/px30-ringneck-haikou.dts ++++ b/arch/arm64/boot/dts/rockchip/px30-ringneck-haikou.dts +@@ -222,6 +222,8 @@ + }; + + &uart0 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&uart0_xfer>; + status = "okay"; + }; + diff --git a/queue-6.13/arm64-dts-rockchip-fix-pinmux-of-uart5-for-px30-ringneck-on-haikou.patch b/queue-6.13/arm64-dts-rockchip-fix-pinmux-of-uart5-for-px30-ringneck-on-haikou.patch new file mode 100644 index 0000000000..fbf613a1b5 --- /dev/null +++ b/queue-6.13/arm64-dts-rockchip-fix-pinmux-of-uart5-for-px30-ringneck-on-haikou.patch @@ -0,0 +1,49 @@ +From 55de171bba1b8c0e3dd18b800955ac4b46a63d4b Mon Sep 17 00:00:00 2001 +From: Quentin Schulz +Date: Tue, 25 Feb 2025 12:53:30 +0100 +Subject: arm64: dts: rockchip: fix pinmux of UART5 for PX30 Ringneck on Haikou + +From: Quentin Schulz + +commit 55de171bba1b8c0e3dd18b800955ac4b46a63d4b upstream. + +UART5 uses GPIO0_B5 as UART RTS but muxed in its GPIO function, +therefore UART5 must request this pin to be muxed in that function, so +let's do that. + +Fixes: 5963d97aa780 ("arm64: dts: rockchip: add rs485 support on uart5 of px30-ringneck-haikou") +Cc: stable@vger.kernel.org +Signed-off-by: Quentin Schulz +Link: https://lore.kernel.org/r/20250225-ringneck-dtbos-v3-2-853a9a6dd597@cherry.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/rockchip/px30-ringneck-haikou.dts | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/arch/arm64/boot/dts/rockchip/px30-ringneck-haikou.dts ++++ b/arch/arm64/boot/dts/rockchip/px30-ringneck-haikou.dts +@@ -194,6 +194,13 @@ + <3 RK_PB3 RK_FUNC_GPIO &pcfg_pull_none>; + }; + }; ++ ++ uart { ++ uart5_rts_pin: uart5-rts-pin { ++ rockchip,pins = ++ <0 RK_PB5 RK_FUNC_GPIO &pcfg_pull_none>; ++ }; ++ }; + }; + + &pwm0 { +@@ -228,6 +235,9 @@ + }; + + &uart5 { ++ /* Add pinmux for rts-gpios (uart5_rts_pin) */ ++ pinctrl-names = "default"; ++ pinctrl-0 = <&uart5_xfer &uart5_rts_pin>; + rts-gpios = <&gpio0 RK_PB5 GPIO_ACTIVE_HIGH>; + status = "okay"; + }; diff --git a/queue-6.13/arm64-dts-rockchip-fix-u2phy1_host-status-for-nanopi-r4s.patch b/queue-6.13/arm64-dts-rockchip-fix-u2phy1_host-status-for-nanopi-r4s.patch new file mode 100644 index 0000000000..eeaee2c34f --- /dev/null +++ b/queue-6.13/arm64-dts-rockchip-fix-u2phy1_host-status-for-nanopi-r4s.patch @@ -0,0 +1,38 @@ +From 38f4aa34a5f737ea8588dac320d884cc2e762c03 Mon Sep 17 00:00:00 2001 +From: Justin Klaassen +Date: Tue, 25 Feb 2025 17:03:58 +0000 +Subject: arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S + +From: Justin Klaassen + +commit 38f4aa34a5f737ea8588dac320d884cc2e762c03 upstream. + +The u2phy1_host should always have the same status as usb_host1_ehci +and usb_host1_ohci, otherwise the EHCI and OHCI drivers may be +initialized for a disabled usb port. + +Per the NanoPi R4S schematic, the phy-supply for u2phy1_host is set to +the vdd_5v regulator. + +Fixes: db792e9adbf8 ("rockchip: rk3399: Add support for FriendlyARM NanoPi R4S") +Cc: stable@vger.kernel.org +Signed-off-by: Justin Klaassen +Reviewed-by: Dragan Simic +Link: https://lore.kernel.org/r/20250225170420.3898-1-justin@tidylabs.net +Signed-off-by: Heiko Stuebner +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dtsi +@@ -115,7 +115,7 @@ + }; + + &u2phy1_host { +- status = "disabled"; ++ phy-supply = <&vdd_5v>; + }; + + &uart0 { diff --git a/queue-6.13/batman-adv-ignore-own-maximum-aggregation-size-during-rx.patch b/queue-6.13/batman-adv-ignore-own-maximum-aggregation-size-during-rx.patch new file mode 100644 index 0000000000..4cc0f20f12 --- /dev/null +++ b/queue-6.13/batman-adv-ignore-own-maximum-aggregation-size-during-rx.patch @@ -0,0 +1,56 @@ +From 548b0c5de7619ef53bbde5590700693f2f6d2a56 Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Sun, 2 Feb 2025 17:04:13 +0100 +Subject: batman-adv: Ignore own maximum aggregation size during RX + +From: Sven Eckelmann + +commit 548b0c5de7619ef53bbde5590700693f2f6d2a56 upstream. + +An OGMv1 and OGMv2 packet receive processing were not only limited by the +number of bytes in the received packet but also by the nodes maximum +aggregation packet size limit. But this limit is relevant for TX and not +for RX. It must not be enforced by batadv_(i)v_ogm_aggr_packet to avoid +loss of information in case of a different limit for sender and receiver. + +This has a minor side effect for B.A.T.M.A.N. IV because the +batadv_iv_ogm_aggr_packet is also used for the preprocessing for the TX. +But since the aggregation code itself will not allow more than +BATADV_MAX_AGGREGATION_BYTES bytes, this check was never triggering (in +this context) prior of removing it. + +Cc: stable@vger.kernel.org +Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") +Fixes: 9323158ef9f4 ("batman-adv: OGMv2 - implement originators logic") +Signed-off-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/bat_iv_ogm.c | 3 +-- + net/batman-adv/bat_v_ogm.c | 3 +-- + 2 files changed, 2 insertions(+), 4 deletions(-) + +--- a/net/batman-adv/bat_iv_ogm.c ++++ b/net/batman-adv/bat_iv_ogm.c +@@ -325,8 +325,7 @@ batadv_iv_ogm_aggr_packet(int buff_pos, + /* check if there is enough space for the optional TVLV */ + next_buff_pos += ntohs(ogm_packet->tvlv_len); + +- return (next_buff_pos <= packet_len) && +- (next_buff_pos <= BATADV_MAX_AGGREGATION_BYTES); ++ return next_buff_pos <= packet_len; + } + + /* send a batman ogm to a given interface */ +--- a/net/batman-adv/bat_v_ogm.c ++++ b/net/batman-adv/bat_v_ogm.c +@@ -839,8 +839,7 @@ batadv_v_ogm_aggr_packet(int buff_pos, i + /* check if there is enough space for the optional TVLV */ + next_buff_pos += ntohs(ogm2_packet->tvlv_len); + +- return (next_buff_pos <= packet_len) && +- (next_buff_pos <= BATADV_MAX_AGGREGATION_BYTES); ++ return next_buff_pos <= packet_len; + } + + /** diff --git a/queue-6.13/can-flexcan-disable-transceiver-during-system-pm.patch b/queue-6.13/can-flexcan-disable-transceiver-during-system-pm.patch new file mode 100644 index 0000000000..5cb9fb739c --- /dev/null +++ b/queue-6.13/can-flexcan-disable-transceiver-during-system-pm.patch @@ -0,0 +1,55 @@ +From 5a19143124be42900b3fbc9ada3c919632eb45eb Mon Sep 17 00:00:00 2001 +From: Haibo Chen +Date: Fri, 14 Mar 2025 19:01:45 +0800 +Subject: can: flexcan: disable transceiver during system PM + +From: Haibo Chen + +commit 5a19143124be42900b3fbc9ada3c919632eb45eb upstream. + +During system PM, if no wakeup requirement, disable transceiver to +save power. + +Fixes: 4de349e786a3 ("can: flexcan: fix resume function") +Cc: stable@vger.kernel.org +Reviewed-by: Frank Li +Signed-off-by: Haibo Chen +Link: https://patch.msgid.link/20250314110145.899179-2-haibo.chen@nxp.com +[mkl: add newlines] +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/flexcan/flexcan-core.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/net/can/flexcan/flexcan-core.c ++++ b/drivers/net/can/flexcan/flexcan-core.c +@@ -2260,6 +2260,10 @@ static int __maybe_unused flexcan_suspen + + flexcan_chip_interrupts_disable(dev); + ++ err = flexcan_transceiver_disable(priv); ++ if (err) ++ return err; ++ + err = pinctrl_pm_select_sleep_state(device); + if (err) + return err; +@@ -2292,10 +2296,16 @@ static int __maybe_unused flexcan_resume + if (err) + return err; + +- err = flexcan_chip_start(dev); ++ err = flexcan_transceiver_enable(priv); + if (err) + return err; + ++ err = flexcan_chip_start(dev); ++ if (err) { ++ flexcan_transceiver_disable(priv); ++ return err; ++ } ++ + flexcan_chip_interrupts_enable(dev); + } + diff --git a/queue-6.13/can-flexcan-only-change-can-state-when-link-up-in-system-pm.patch b/queue-6.13/can-flexcan-only-change-can-state-when-link-up-in-system-pm.patch new file mode 100644 index 0000000000..27b0820f3a --- /dev/null +++ b/queue-6.13/can-flexcan-only-change-can-state-when-link-up-in-system-pm.patch @@ -0,0 +1,70 @@ +From fd99d6ed20234b83d65b9c5417794343577cf3e5 Mon Sep 17 00:00:00 2001 +From: Haibo Chen +Date: Fri, 14 Mar 2025 19:01:44 +0800 +Subject: can: flexcan: only change CAN state when link up in system PM + +From: Haibo Chen + +commit fd99d6ed20234b83d65b9c5417794343577cf3e5 upstream. + +After a suspend/resume cycle on a down interface, it will come up as +ERROR-ACTIVE. + +$ ip -details -s -s a s dev flexcan0 +3: flexcan0: mtu 16 qdisc pfifo_fast state DOWN group default qlen 10 + link/can promiscuity 0 allmulti 0 minmtu 0 maxmtu 0 + can state STOPPED (berr-counter tx 0 rx 0) restart-ms 1000 + +$ sudo systemctl suspend + +$ ip -details -s -s a s dev flexcan0 +3: flexcan0: mtu 16 qdisc pfifo_fast state DOWN group default qlen 10 + link/can promiscuity 0 allmulti 0 minmtu 0 maxmtu 0 + can state ERROR-ACTIVE (berr-counter tx 0 rx 0) restart-ms 1000 + +And only set CAN state to CAN_STATE_ERROR_ACTIVE when resume process +has no issue, otherwise keep in CAN_STATE_SLEEPING as suspend did. + +Fixes: 4de349e786a3 ("can: flexcan: fix resume function") +Cc: stable@vger.kernel.org +Signed-off-by: Haibo Chen +Link: https://patch.msgid.link/20250314110145.899179-1-haibo.chen@nxp.com +Reported-by: Marc Kleine-Budde +Closes: https://lore.kernel.org/all/20250314-married-polar-elephant-b15594-mkl@pengutronix.de +[mkl: add newlines] +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/flexcan/flexcan-core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/can/flexcan/flexcan-core.c ++++ b/drivers/net/can/flexcan/flexcan-core.c +@@ -2266,8 +2266,9 @@ static int __maybe_unused flexcan_suspen + } + netif_stop_queue(dev); + netif_device_detach(dev); ++ ++ priv->can.state = CAN_STATE_SLEEPING; + } +- priv->can.state = CAN_STATE_SLEEPING; + + return 0; + } +@@ -2278,7 +2279,6 @@ static int __maybe_unused flexcan_resume + struct flexcan_priv *priv = netdev_priv(dev); + int err; + +- priv->can.state = CAN_STATE_ERROR_ACTIVE; + if (netif_running(dev)) { + netif_device_attach(dev); + netif_start_queue(dev); +@@ -2298,6 +2298,8 @@ static int __maybe_unused flexcan_resume + + flexcan_chip_interrupts_enable(dev); + } ++ ++ priv->can.state = CAN_STATE_ERROR_ACTIVE; + } + + return 0; diff --git a/queue-6.13/can-rcar_canfd-fix-page-entries-in-the-afl-list.patch b/queue-6.13/can-rcar_canfd-fix-page-entries-in-the-afl-list.patch new file mode 100644 index 0000000000..cc5b7aa5aa --- /dev/null +++ b/queue-6.13/can-rcar_canfd-fix-page-entries-in-the-afl-list.patch @@ -0,0 +1,96 @@ +From 1dba0a37644ed3022558165bbb5cb9bda540eaf7 Mon Sep 17 00:00:00 2001 +From: Biju Das +Date: Fri, 7 Mar 2025 17:03:27 +0000 +Subject: can: rcar_canfd: Fix page entries in the AFL list + +From: Biju Das + +commit 1dba0a37644ed3022558165bbb5cb9bda540eaf7 upstream. + +There are a total of 96 AFL pages and each page has 16 entries with +registers CFDGAFLIDr, CFDGAFLMr, CFDGAFLP0r, CFDGAFLP1r holding +the rule entries (r = 0..15). + +Currently, RCANFD_GAFL* macros use a start variable to find AFL entries, +which is incorrect as the testing on RZ/G3E shows ch1 and ch4 +gets a start value of 0 and the register contents are overwritten. + +Fix this issue by using rule_entry corresponding to the channel +to find the page entries in the AFL list. + +Fixes: dd3bd23eb438 ("can: rcar_canfd: Add Renesas R-Car CAN FD driver") +Cc: stable@vger.kernel.org +Signed-off-by: Biju Das +Tested-by: Geert Uytterhoeven +Link: https://patch.msgid.link/20250307170330.173425-3-biju.das.jz@bp.renesas.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/rcar/rcar_canfd.c | 28 +++++++++++----------------- + 1 file changed, 11 insertions(+), 17 deletions(-) + +--- a/drivers/net/can/rcar/rcar_canfd.c ++++ b/drivers/net/can/rcar/rcar_canfd.c +@@ -787,22 +787,14 @@ static void rcar_canfd_configure_control + } + + static void rcar_canfd_configure_afl_rules(struct rcar_canfd_global *gpriv, +- u32 ch) ++ u32 ch, u32 rule_entry) + { +- u32 cfg; +- int offset, start, page, num_rules = RCANFD_CHANNEL_NUMRULES; ++ int offset, page, num_rules = RCANFD_CHANNEL_NUMRULES; ++ u32 rule_entry_index = rule_entry % 16; + u32 ridx = ch + RCANFD_RFFIFO_IDX; + +- if (ch == 0) { +- start = 0; /* Channel 0 always starts from 0th rule */ +- } else { +- /* Get number of Channel 0 rules and adjust */ +- cfg = rcar_canfd_read(gpriv->base, RCANFD_GAFLCFG(ch)); +- start = RCANFD_GAFLCFG_GETRNC(gpriv, 0, cfg); +- } +- + /* Enable write access to entry */ +- page = RCANFD_GAFL_PAGENUM(start); ++ page = RCANFD_GAFL_PAGENUM(rule_entry); + rcar_canfd_set_bit(gpriv->base, RCANFD_GAFLECTR, + (RCANFD_GAFLECTR_AFLPN(gpriv, page) | + RCANFD_GAFLECTR_AFLDAE)); +@@ -818,13 +810,13 @@ static void rcar_canfd_configure_afl_rul + offset = RCANFD_C_GAFL_OFFSET; + + /* Accept all IDs */ +- rcar_canfd_write(gpriv->base, RCANFD_GAFLID(offset, start), 0); ++ rcar_canfd_write(gpriv->base, RCANFD_GAFLID(offset, rule_entry_index), 0); + /* IDE or RTR is not considered for matching */ +- rcar_canfd_write(gpriv->base, RCANFD_GAFLM(offset, start), 0); ++ rcar_canfd_write(gpriv->base, RCANFD_GAFLM(offset, rule_entry_index), 0); + /* Any data length accepted */ +- rcar_canfd_write(gpriv->base, RCANFD_GAFLP0(offset, start), 0); ++ rcar_canfd_write(gpriv->base, RCANFD_GAFLP0(offset, rule_entry_index), 0); + /* Place the msg in corresponding Rx FIFO entry */ +- rcar_canfd_set_bit(gpriv->base, RCANFD_GAFLP1(offset, start), ++ rcar_canfd_set_bit(gpriv->base, RCANFD_GAFLP1(offset, rule_entry_index), + RCANFD_GAFLP1_GAFLFDP(ridx)); + + /* Disable write access to page */ +@@ -1851,6 +1843,7 @@ static int rcar_canfd_probe(struct platf + unsigned long channels_mask = 0; + int err, ch_irq, g_irq; + int g_err_irq, g_recc_irq; ++ u32 rule_entry = 0; + bool fdmode = true; /* CAN FD only mode - default */ + char name[9] = "channelX"; + int i; +@@ -2023,7 +2016,8 @@ static int rcar_canfd_probe(struct platf + rcar_canfd_configure_tx(gpriv, ch); + + /* Configure receive rules */ +- rcar_canfd_configure_afl_rules(gpriv, ch); ++ rcar_canfd_configure_afl_rules(gpriv, ch, rule_entry); ++ rule_entry += RCANFD_CHANNEL_NUMRULES; + } + + /* Configure common interrupts */ diff --git a/queue-6.13/can-ucan-fix-out-of-bound-read-in-strscpy-source.patch b/queue-6.13/can-ucan-fix-out-of-bound-read-in-strscpy-source.patch new file mode 100644 index 0000000000..633745cb3e --- /dev/null +++ b/queue-6.13/can-ucan-fix-out-of-bound-read-in-strscpy-source.patch @@ -0,0 +1,145 @@ +From 1d22a122ffb116c3cf78053e812b8b21f8852ee9 Mon Sep 17 00:00:00 2001 +From: Vincent Mailhol +Date: Tue, 18 Feb 2025 23:32:28 +0900 +Subject: can: ucan: fix out of bound read in strscpy() source + +From: Vincent Mailhol + +commit 1d22a122ffb116c3cf78053e812b8b21f8852ee9 upstream. + +Commit 7fdaf8966aae ("can: ucan: use strscpy() to instead of strncpy()") +unintentionally introduced a one byte out of bound read on strscpy()'s +source argument (which is kind of ironic knowing that strscpy() is meant +to be a more secure alternative :)). + +Let's consider below buffers: + + dest[len + 1]; /* will be NUL terminated */ + src[len]; /* may not be NUL terminated */ + +When doing: + + strncpy(dest, src, len); + dest[len] = '\0'; + +strncpy() will read up to len bytes from src. + +On the other hand: + + strscpy(dest, src, len + 1); + +will read up to len + 1 bytes from src, that is to say, an out of bound +read of one byte will occur on src if it is not NUL terminated. Note +that the src[len] byte is never copied, but strscpy() still needs to +read it to check whether a truncation occurred or not. + +This exact pattern happened in ucan. + +The root cause is that the source is not NUL terminated. Instead of +doing a copy in a local buffer, directly NUL terminate it as soon as +usb_control_msg() returns. With this, the local firmware_str[] variable +can be removed. + +On top of this do a couple refactors: + + - ucan_ctl_payload->raw is only used for the firmware string, so + rename it to ucan_ctl_payload->fw_str and change its type from u8 to + char. + + - ucan_device_request_in() is only used to retrieve the firmware + string, so rename it to ucan_get_fw_str() and refactor it to make it + directly handle all the string termination logic. + +Reported-by: syzbot+d7d8c418e8317899e88c@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/linux-can/67b323a4.050a0220.173698.002b.GAE@google.com/ +Fixes: 7fdaf8966aae ("can: ucan: use strscpy() to instead of strncpy()") +Signed-off-by: Vincent Mailhol +Link: https://patch.msgid.link/20250218143515.627682-2-mailhol.vincent@wanadoo.fr +Cc: stable@vger.kernel.org +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/usb/ucan.c | 43 ++++++++++++++++++------------------------- + 1 file changed, 18 insertions(+), 25 deletions(-) + +--- a/drivers/net/can/usb/ucan.c ++++ b/drivers/net/can/usb/ucan.c +@@ -186,7 +186,7 @@ union ucan_ctl_payload { + */ + struct ucan_ctl_cmd_get_protocol_version cmd_get_protocol_version; + +- u8 raw[128]; ++ u8 fw_str[128]; + } __packed; + + enum { +@@ -424,18 +424,20 @@ static int ucan_ctrl_command_out(struct + UCAN_USB_CTL_PIPE_TIMEOUT); + } + +-static int ucan_device_request_in(struct ucan_priv *up, +- u8 cmd, u16 subcmd, u16 datalen) ++static void ucan_get_fw_str(struct ucan_priv *up, char *fw_str, size_t size) + { +- return usb_control_msg(up->udev, +- usb_rcvctrlpipe(up->udev, 0), +- cmd, +- USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, +- subcmd, +- 0, +- up->ctl_msg_buffer, +- datalen, +- UCAN_USB_CTL_PIPE_TIMEOUT); ++ int ret; ++ ++ ret = usb_control_msg(up->udev, usb_rcvctrlpipe(up->udev, 0), ++ UCAN_DEVICE_GET_FW_STRING, ++ USB_DIR_IN | USB_TYPE_VENDOR | ++ USB_RECIP_DEVICE, ++ 0, 0, fw_str, size - 1, ++ UCAN_USB_CTL_PIPE_TIMEOUT); ++ if (ret > 0) ++ fw_str[ret] = '\0'; ++ else ++ strscpy(fw_str, "unknown", size); + } + + /* Parse the device information structure reported by the device and +@@ -1314,7 +1316,6 @@ static int ucan_probe(struct usb_interfa + u8 in_ep_addr; + u8 out_ep_addr; + union ucan_ctl_payload *ctl_msg_buffer; +- char firmware_str[sizeof(union ucan_ctl_payload) + 1]; + + udev = interface_to_usbdev(intf); + +@@ -1527,17 +1528,6 @@ static int ucan_probe(struct usb_interfa + */ + ucan_parse_device_info(up, &ctl_msg_buffer->cmd_get_device_info); + +- /* just print some device information - if available */ +- ret = ucan_device_request_in(up, UCAN_DEVICE_GET_FW_STRING, 0, +- sizeof(union ucan_ctl_payload)); +- if (ret > 0) { +- /* copy string while ensuring zero termination */ +- strscpy(firmware_str, up->ctl_msg_buffer->raw, +- sizeof(union ucan_ctl_payload) + 1); +- } else { +- strcpy(firmware_str, "unknown"); +- } +- + /* device is compatible, reset it */ + ret = ucan_ctrl_command_out(up, UCAN_COMMAND_RESET, 0, 0); + if (ret < 0) +@@ -1555,7 +1545,10 @@ static int ucan_probe(struct usb_interfa + + /* initialisation complete, log device info */ + netdev_info(up->netdev, "registered device\n"); +- netdev_info(up->netdev, "firmware string: %s\n", firmware_str); ++ ucan_get_fw_str(up, up->ctl_msg_buffer->fw_str, ++ sizeof(up->ctl_msg_buffer->fw_str)); ++ netdev_info(up->netdev, "firmware string: %s\n", ++ up->ctl_msg_buffer->fw_str); + + /* success */ + return 0; diff --git a/queue-6.13/drm-amd-display-fix-message-for-support_edp0_on_dp1.patch b/queue-6.13/drm-amd-display-fix-message-for-support_edp0_on_dp1.patch new file mode 100644 index 0000000000..e3586097be --- /dev/null +++ b/queue-6.13/drm-amd-display-fix-message-for-support_edp0_on_dp1.patch @@ -0,0 +1,39 @@ +From 35f0f9f421390f66cb062f4d79f4924af5f55b04 Mon Sep 17 00:00:00 2001 +From: Yilin Chen +Date: Wed, 5 Mar 2025 12:19:49 -0500 +Subject: drm/amd/display: Fix message for support_edp0_on_dp1 + +From: Yilin Chen + +commit 35f0f9f421390f66cb062f4d79f4924af5f55b04 upstream. + +[WHY] +The info message was wrong when support_edp0_on_dp1 is enabled + +[HOW] +Use correct info message for support_edp0_on_dp1 + +Fixes: f6d17270d18a ("drm/amd/display: add a quirk to enable eDP0 on DP1") +Reviewed-by: Aurabindo Pillai +Signed-off-by: Yilin Chen +Signed-off-by: Alex Hung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 79538e6365c99d7b1c3e560d1ea8d11ef8313465) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -1744,7 +1744,7 @@ static void retrieve_dmi_info(struct amd + } + if (quirk_entries.support_edp0_on_dp1) { + init_data->flags.support_edp0_on_dp1 = true; +- drm_info(dev, "aux_hpd_discon_quirk attached\n"); ++ drm_info(dev, "support_edp0_on_dp1 attached\n"); + } + } + diff --git a/queue-6.13/drm-amd-display-use-hw-lock-mgr-for-psr1-when-only-one-edp.patch b/queue-6.13/drm-amd-display-use-hw-lock-mgr-for-psr1-when-only-one-edp.patch new file mode 100644 index 0000000000..09fac47b5d --- /dev/null +++ b/queue-6.13/drm-amd-display-use-hw-lock-mgr-for-psr1-when-only-one-edp.patch @@ -0,0 +1,53 @@ +From acbf16a6ae775b4db86f537448cc466288aa307e Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Fri, 7 Mar 2025 15:55:20 -0600 +Subject: drm/amd/display: Use HW lock mgr for PSR1 when only one eDP + +From: Mario Limonciello + +commit acbf16a6ae775b4db86f537448cc466288aa307e upstream. + +[WHY] +DMUB locking is important to make sure that registers aren't accessed +while in PSR. Previously it was enabled but caused a deadlock in +situations with multiple eDP panels. + +[HOW] +Detect if multiple eDP panels are in use to decide whether to use +lock. Refactor the function so that the first check is for PSR-SU +and then replay is in use to prevent having to look up number +of eDP panels for those configurations. + +Fixes: f245b400a223 ("Revert "drm/amd/display: Use HW lock mgr for PSR1"") +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3965 +Reviewed-by: ChiaHsuan Chung +Signed-off-by: Mario Limonciello +Signed-off-by: Alex Hung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit ed569e1279a3045d6b974226c814e071fa0193a6) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c +@@ -69,5 +69,16 @@ bool should_use_dmub_lock(struct dc_link + if (link->replay_settings.replay_feature_enabled) + return true; + ++ /* only use HW lock for PSR1 on single eDP */ ++ if (link->psr_settings.psr_version == DC_PSR_VERSION_1) { ++ struct dc_link *edp_links[MAX_NUM_EDP]; ++ int edp_num; ++ ++ dc_get_edp_links(link->dc, edp_links, &edp_num); ++ ++ if (edp_num == 1) ++ return true; ++ } ++ + return false; + } diff --git a/queue-6.13/drm-amd-pm-add-unique_id-for-gfx12.patch b/queue-6.13/drm-amd-pm-add-unique_id-for-gfx12.patch new file mode 100644 index 0000000000..216011d5cd --- /dev/null +++ b/queue-6.13/drm-amd-pm-add-unique_id-for-gfx12.patch @@ -0,0 +1,32 @@ +From 19b53f96856b5316ee1fd6ca485af0889e001677 Mon Sep 17 00:00:00 2001 +From: Harish Kasiviswanathan +Date: Tue, 11 Mar 2025 14:15:18 -0400 +Subject: drm/amd/pm: add unique_id for gfx12 + +From: Harish Kasiviswanathan + +commit 19b53f96856b5316ee1fd6ca485af0889e001677 upstream. + +Expose unique_id for gfx12 + +Signed-off-by: Harish Kasiviswanathan +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +(cherry picked from commit 16fbc18cb07470cd33fb5f37ad181b51583e6dc0) +Cc: stable@vger.kernel.org # 6.12.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/amdgpu_pm.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c ++++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c +@@ -2421,6 +2421,8 @@ static int default_attr_update(struct am + case IP_VERSION(11, 0, 1): + case IP_VERSION(11, 0, 2): + case IP_VERSION(11, 0, 3): ++ case IP_VERSION(12, 0, 0): ++ case IP_VERSION(12, 0, 1): + *states = ATTR_STATE_SUPPORTED; + break; + default: diff --git a/queue-6.13/drm-amdgpu-fix-jpeg-video-caps-max-size-for-navi1x-and-raven.patch b/queue-6.13/drm-amdgpu-fix-jpeg-video-caps-max-size-for-navi1x-and-raven.patch new file mode 100644 index 0000000000..a2f87efae3 --- /dev/null +++ b/queue-6.13/drm-amdgpu-fix-jpeg-video-caps-max-size-for-navi1x-and-raven.patch @@ -0,0 +1,45 @@ +From ec33964d9d88488fa954a03d476a8b811efc6e85 Mon Sep 17 00:00:00 2001 +From: David Rosca +Date: Fri, 28 Feb 2025 13:34:49 +0100 +Subject: drm/amdgpu: Fix JPEG video caps max size for navi1x and raven + +From: David Rosca + +commit ec33964d9d88488fa954a03d476a8b811efc6e85 upstream. + +8192x8192 is the maximum supported resolution. + +Signed-off-by: David Rosca +Acked-by: Alex Deucher +Reviewed-by: Ruijing Dong +Signed-off-by: Alex Deucher +(cherry picked from commit 6e0d2fde3ae8fdb5b47e10389f23ed2cb4daec5d) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/nv.c | 2 +- + drivers/gpu/drm/amd/amdgpu/soc15.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/nv.c ++++ b/drivers/gpu/drm/amd/amdgpu/nv.c +@@ -83,7 +83,7 @@ static const struct amdgpu_video_codec_i + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 1920, 1088, 4)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 186)}, +- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 8192, 8192, 0)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 8192, 4352, 0)}, + }; + +--- a/drivers/gpu/drm/amd/amdgpu/soc15.c ++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c +@@ -124,7 +124,7 @@ static const struct amdgpu_video_codec_i + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 1920, 1088, 4)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 4096, 4096, 186)}, +- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 8192, 8192, 0)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 4096, 4096, 0)}, + }; + diff --git a/queue-6.13/drm-amdgpu-fix-mpeg2-mpeg4-and-vc1-video-caps-max-size.patch b/queue-6.13/drm-amdgpu-fix-mpeg2-mpeg4-and-vc1-video-caps-max-size.patch new file mode 100644 index 0000000000..109521ba9d --- /dev/null +++ b/queue-6.13/drm-amdgpu-fix-mpeg2-mpeg4-and-vc1-video-caps-max-size.patch @@ -0,0 +1,186 @@ +From f0105e173103c9d30a2bb959f7399437d536c848 Mon Sep 17 00:00:00 2001 +From: David Rosca +Date: Fri, 28 Feb 2025 13:32:46 +0100 +Subject: drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size + +From: David Rosca + +commit f0105e173103c9d30a2bb959f7399437d536c848 upstream. + +1920x1088 is the maximum supported resolution. + +Signed-off-by: David Rosca +Acked-by: Alex Deucher +Reviewed-by: Ruijing Dong +Signed-off-by: Alex Deucher +(cherry picked from commit 1a0807feb97082bff2b1342dbbe55a2a9a8bdb88) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/nv.c | 18 +++++++++--------- + drivers/gpu/drm/amd/amdgpu/soc15.c | 18 +++++++++--------- + drivers/gpu/drm/amd/amdgpu/vi.c | 36 ++++++++++++++++++------------------ + 3 files changed, 36 insertions(+), 36 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/nv.c ++++ b/drivers/gpu/drm/amd/amdgpu/nv.c +@@ -78,10 +78,10 @@ static const struct amdgpu_video_codecs + + /* Navi1x */ + static const struct amdgpu_video_codec_info nv_video_codecs_decode_array[] = { +- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)}, +- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 1920, 1088, 3)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 1920, 1088, 5)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)}, +- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 1920, 1088, 4)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 186)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 8192, 4352, 0)}, +@@ -104,10 +104,10 @@ static const struct amdgpu_video_codecs + }; + + static const struct amdgpu_video_codec_info sc_video_codecs_decode_array_vcn0[] = { +- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)}, +- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 1920, 1088, 3)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 1920, 1088, 5)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)}, +- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 1920, 1088, 4)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 186)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 16384, 16384, 0)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 8192, 4352, 0)}, +@@ -115,10 +115,10 @@ static const struct amdgpu_video_codec_i + }; + + static const struct amdgpu_video_codec_info sc_video_codecs_decode_array_vcn1[] = { +- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)}, +- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 1920, 1088, 3)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 1920, 1088, 5)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)}, +- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 1920, 1088, 4)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 186)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 16384, 16384, 0)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 8192, 4352, 0)}, +--- a/drivers/gpu/drm/amd/amdgpu/soc15.c ++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c +@@ -103,10 +103,10 @@ static const struct amdgpu_video_codecs + /* Vega */ + static const struct amdgpu_video_codec_info vega_video_codecs_decode_array[] = + { +- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)}, +- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 1920, 1088, 3)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 1920, 1088, 5)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)}, +- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 1920, 1088, 4)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 4096, 4096, 186)}, + }; + +@@ -119,10 +119,10 @@ static const struct amdgpu_video_codecs + /* Raven */ + static const struct amdgpu_video_codec_info rv_video_codecs_decode_array[] = + { +- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)}, +- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 1920, 1088, 3)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 1920, 1088, 5)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)}, +- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 1920, 1088, 4)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 4096, 4096, 186)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 4096, 4096, 0)}, +@@ -137,10 +137,10 @@ static const struct amdgpu_video_codecs + /* Renoir, Arcturus */ + static const struct amdgpu_video_codec_info rn_video_codecs_decode_array[] = + { +- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)}, +- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 1920, 1088, 3)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 1920, 1088, 5)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)}, +- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 1920, 1088, 4)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 186)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 16384, 16384, 0)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 8192, 4352, 0)}, +--- a/drivers/gpu/drm/amd/amdgpu/vi.c ++++ b/drivers/gpu/drm/amd/amdgpu/vi.c +@@ -167,16 +167,16 @@ static const struct amdgpu_video_codec_i + { + { + .codec_type = AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, +- .max_width = 4096, +- .max_height = 4096, +- .max_pixels_per_frame = 4096 * 4096, ++ .max_width = 1920, ++ .max_height = 1088, ++ .max_pixels_per_frame = 1920 * 1088, + .max_level = 3, + }, + { + .codec_type = AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, +- .max_width = 4096, +- .max_height = 4096, +- .max_pixels_per_frame = 4096 * 4096, ++ .max_width = 1920, ++ .max_height = 1088, ++ .max_pixels_per_frame = 1920 * 1088, + .max_level = 5, + }, + { +@@ -188,9 +188,9 @@ static const struct amdgpu_video_codec_i + }, + { + .codec_type = AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, +- .max_width = 4096, +- .max_height = 4096, +- .max_pixels_per_frame = 4096 * 4096, ++ .max_width = 1920, ++ .max_height = 1088, ++ .max_pixels_per_frame = 1920 * 1088, + .max_level = 4, + }, + }; +@@ -206,16 +206,16 @@ static const struct amdgpu_video_codec_i + { + { + .codec_type = AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, +- .max_width = 4096, +- .max_height = 4096, +- .max_pixels_per_frame = 4096 * 4096, ++ .max_width = 1920, ++ .max_height = 1088, ++ .max_pixels_per_frame = 1920 * 1088, + .max_level = 3, + }, + { + .codec_type = AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, +- .max_width = 4096, +- .max_height = 4096, +- .max_pixels_per_frame = 4096 * 4096, ++ .max_width = 1920, ++ .max_height = 1088, ++ .max_pixels_per_frame = 1920 * 1088, + .max_level = 5, + }, + { +@@ -227,9 +227,9 @@ static const struct amdgpu_video_codec_i + }, + { + .codec_type = AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, +- .max_width = 4096, +- .max_height = 4096, +- .max_pixels_per_frame = 4096 * 4096, ++ .max_width = 1920, ++ .max_height = 1088, ++ .max_pixels_per_frame = 1920 * 1088, + .max_level = 4, + }, + { diff --git a/queue-6.13/drm-amdgpu-gfx12-correct-cleanup-of-me-field-with-gfx_v12_0_me_fini.patch b/queue-6.13/drm-amdgpu-gfx12-correct-cleanup-of-me-field-with-gfx_v12_0_me_fini.patch new file mode 100644 index 0000000000..bc9fd93f2e --- /dev/null +++ b/queue-6.13/drm-amdgpu-gfx12-correct-cleanup-of-me-field-with-gfx_v12_0_me_fini.patch @@ -0,0 +1,35 @@ +From 86730b5261d4d8dae3f5b97709d40d694ecf1ddf Mon Sep 17 00:00:00 2001 +From: Wentao Liang +Date: Wed, 12 Mar 2025 14:31:06 +0800 +Subject: drm/amdgpu/gfx12: correct cleanup of 'me' field with gfx_v12_0_me_fini() + +From: Wentao Liang + +commit 86730b5261d4d8dae3f5b97709d40d694ecf1ddf upstream. + +In gfx_v12_0_cp_gfx_load_me_microcode_rs64(), gfx_v12_0_pfp_fini() is +incorrectly used to free 'me' field of 'gfx', since gfx_v12_0_pfp_fini() +can only release 'pfp' field of 'gfx'. The release function of 'me' field +should be gfx_v12_0_me_fini(). + +Fixes: 52cb80c12e8a ("drm/amdgpu: Add gfx v12_0 ip block support (v6)") +Signed-off-by: Wentao Liang +Signed-off-by: Alex Deucher +(cherry picked from commit ebdc52607a46cda08972888178c6aa9cd6965141) +Cc: stable@vger.kernel.org # 6.12.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c +@@ -2413,7 +2413,7 @@ static int gfx_v12_0_cp_gfx_load_me_micr + (void **)&adev->gfx.me.me_fw_data_ptr); + if (r) { + dev_err(adev->dev, "(%d) failed to create me data bo\n", r); +- gfx_v12_0_pfp_fini(adev); ++ gfx_v12_0_me_fini(adev); + return r; + } + diff --git a/queue-6.13/drm-amdgpu-pm-handle-sclk-offset-correctly-in-overdrive-for-smu-14.0.2.patch b/queue-6.13/drm-amdgpu-pm-handle-sclk-offset-correctly-in-overdrive-for-smu-14.0.2.patch new file mode 100644 index 0000000000..84063214bb --- /dev/null +++ b/queue-6.13/drm-amdgpu-pm-handle-sclk-offset-correctly-in-overdrive-for-smu-14.0.2.patch @@ -0,0 +1,154 @@ +From d9d4cb224e4140f51847642aa5a4a5c3eb998af0 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tomasz=20Paku=C5=82a?= +Date: Tue, 11 Mar 2025 22:38:33 +0100 +Subject: drm/amdgpu/pm: Handle SCLK offset correctly in overdrive for smu 14.0.2 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tomasz Pakuła + +commit d9d4cb224e4140f51847642aa5a4a5c3eb998af0 upstream. + +Currently, it seems like the code was carried over from RDNA3 because +it assumes two possible values to set. RDNA4, instead of having: +0: min SCLK +1: max SCLK +only has +0: SCLK offset + +This change makes it so it only reports current offset value instead of +showing possible min/max values and their indices. Moreover, it now only +accepts the offset as a value, without the indice index. + +Additionally, the lower bound was printed as %u by mistake. + +Old: +OD_SCLK_OFFSET: +0: -500Mhz +1: 1000Mhz +OD_MCLK: +0: 97Mhz +1: 1259MHz +OD_VDDGFX_OFFSET: +0mV +OD_RANGE: +SCLK_OFFSET: -500Mhz 1000Mhz +MCLK: 97Mhz 1500Mhz +VDDGFX_OFFSET: -200mv 0mv + +New: +OD_SCLK_OFFSET: +0Mhz +OD_MCLK: +0: 97Mhz +1: 1259MHz +OD_VDDGFX_OFFSET: +0mV +OD_RANGE: +SCLK_OFFSET: -500Mhz 1000Mhz +MCLK: 97Mhz 1500Mhz +VDDGFX_OFFSET: -200mv 0mv + +Setting this offset: +Old: "s 1 " +New: "s " + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4036 +Reviewed-by: Yang Wang +Signed-off-by: Tomasz Pakuła +Signed-off-by: Alex Deucher +(cherry picked from commit 1cfeb60e6e8837b1de5eb4e17df7cf31f4442144) +Cc: stable@vger.kernel.org # 6.12.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 59 +++++-------------- + 1 file changed, 18 insertions(+), 41 deletions(-) + +--- a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c +@@ -1193,16 +1193,9 @@ static int smu_v14_0_2_print_clk_levels( + PP_OD_FEATURE_GFXCLK_BIT)) + break; + +- PPTable_t *pptable = smu->smu_table.driver_pptable; +- const OverDriveLimits_t * const overdrive_upperlimits = +- &pptable->SkuTable.OverDriveLimitsBasicMax; +- const OverDriveLimits_t * const overdrive_lowerlimits = +- &pptable->SkuTable.OverDriveLimitsBasicMin; +- + size += sysfs_emit_at(buf, size, "OD_SCLK_OFFSET:\n"); +- size += sysfs_emit_at(buf, size, "0: %dMhz\n1: %uMhz\n", +- overdrive_lowerlimits->GfxclkFoffset, +- overdrive_upperlimits->GfxclkFoffset); ++ size += sysfs_emit_at(buf, size, "%dMhz\n", ++ od_table->OverDriveTable.GfxclkFoffset); + break; + + case SMU_OD_MCLK: +@@ -1337,12 +1330,8 @@ static int smu_v14_0_2_print_clk_levels( + + if (smu_v14_0_2_is_od_feature_supported(smu, PP_OD_FEATURE_GFXCLK_BIT)) { + smu_v14_0_2_get_od_setting_limits(smu, +- PP_OD_FEATURE_GFXCLK_FMIN, +- &min_value, +- NULL); +- smu_v14_0_2_get_od_setting_limits(smu, + PP_OD_FEATURE_GFXCLK_FMAX, +- NULL, ++ &min_value, + &max_value); + size += sysfs_emit_at(buf, size, "SCLK_OFFSET: %7dMhz %10uMhz\n", + min_value, max_value); +@@ -2417,36 +2406,24 @@ static int smu_v14_0_2_od_edit_dpm_table + return -ENOTSUPP; + } + +- for (i = 0; i < size; i += 2) { +- if (i + 2 > size) { +- dev_info(adev->dev, "invalid number of input parameters %d\n", size); +- return -EINVAL; +- } ++ if (size != 1) { ++ dev_info(adev->dev, "invalid number of input parameters %d\n", size); ++ return -EINVAL; ++ } + +- switch (input[i]) { +- case 1: +- smu_v14_0_2_get_od_setting_limits(smu, +- PP_OD_FEATURE_GFXCLK_FMAX, +- &minimum, +- &maximum); +- if (input[i + 1] < minimum || +- input[i + 1] > maximum) { +- dev_info(adev->dev, "GfxclkFmax (%ld) must be within [%u, %u]!\n", +- input[i + 1], minimum, maximum); +- return -EINVAL; +- } +- +- od_table->OverDriveTable.GfxclkFoffset = input[i + 1]; +- od_table->OverDriveTable.FeatureCtrlMask |= 1U << PP_OD_FEATURE_GFXCLK_BIT; +- break; +- +- default: +- dev_info(adev->dev, "Invalid SCLK_VDDC_TABLE index: %ld\n", input[i]); +- dev_info(adev->dev, "Supported indices: [0:min,1:max]\n"); +- return -EINVAL; +- } ++ smu_v14_0_2_get_od_setting_limits(smu, ++ PP_OD_FEATURE_GFXCLK_FMAX, ++ &minimum, ++ &maximum); ++ if (input[0] < minimum || ++ input[0] > maximum) { ++ dev_info(adev->dev, "GfxclkFoffset must be within [%d, %u]!\n", ++ minimum, maximum); ++ return -EINVAL; + } + ++ od_table->OverDriveTable.GfxclkFoffset = input[0]; ++ od_table->OverDriveTable.FeatureCtrlMask |= 1U << PP_OD_FEATURE_GFXCLK_BIT; + break; + + case PP_OD_EDIT_MCLK_VDDC_TABLE: diff --git a/queue-6.13/drm-amdgpu-pm-wire-up-hwmon-fan-speed-for-smu-14.0.2.patch b/queue-6.13/drm-amdgpu-pm-wire-up-hwmon-fan-speed-for-smu-14.0.2.patch new file mode 100644 index 0000000000..62f7107abc --- /dev/null +++ b/queue-6.13/drm-amdgpu-pm-wire-up-hwmon-fan-speed-for-smu-14.0.2.patch @@ -0,0 +1,72 @@ +From 5ca0040ecfe8ba0dee9df1f559e8d7587f12bf89 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Tue, 11 Mar 2025 10:34:36 -0400 +Subject: drm/amdgpu/pm: wire up hwmon fan speed for smu 14.0.2 + +From: Alex Deucher + +commit 5ca0040ecfe8ba0dee9df1f559e8d7587f12bf89 upstream. + +Add callbacks for fan speed fetching. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4034 +Reviewed-by: Kenneth Feng +Signed-off-by: Alex Deucher +(cherry picked from commit 90df6db62fa78a8ab0b705ec38db99c7973b95d6) +Cc: stable@vger.kernel.org # 6.12.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 35 +++++++++++++++++++ + 1 file changed, 35 insertions(+) + +--- a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c +@@ -1616,6 +1616,39 @@ out: + adev->unique_id = ((uint64_t)upper32 << 32) | lower32; + } + ++static int smu_v14_0_2_get_fan_speed_pwm(struct smu_context *smu, ++ uint32_t *speed) ++{ ++ int ret; ++ ++ if (!speed) ++ return -EINVAL; ++ ++ ret = smu_v14_0_2_get_smu_metrics_data(smu, ++ METRICS_CURR_FANPWM, ++ speed); ++ if (ret) { ++ dev_err(smu->adev->dev, "Failed to get fan speed(PWM)!"); ++ return ret; ++ } ++ ++ /* Convert the PMFW output which is in percent to pwm(255) based */ ++ *speed = min(*speed * 255 / 100, (uint32_t)255); ++ ++ return 0; ++} ++ ++static int smu_v14_0_2_get_fan_speed_rpm(struct smu_context *smu, ++ uint32_t *speed) ++{ ++ if (!speed) ++ return -EINVAL; ++ ++ return smu_v14_0_2_get_smu_metrics_data(smu, ++ METRICS_CURR_FANSPEED, ++ speed); ++} ++ + static int smu_v14_0_2_get_power_limit(struct smu_context *smu, + uint32_t *current_power_limit, + uint32_t *default_power_limit, +@@ -2781,6 +2814,8 @@ static const struct pptable_funcs smu_v1 + .set_performance_level = smu_v14_0_set_performance_level, + .gfx_off_control = smu_v14_0_gfx_off_control, + .get_unique_id = smu_v14_0_2_get_unique_id, ++ .get_fan_speed_pwm = smu_v14_0_2_get_fan_speed_pwm, ++ .get_fan_speed_rpm = smu_v14_0_2_get_fan_speed_rpm, + .get_power_limit = smu_v14_0_2_get_power_limit, + .set_power_limit = smu_v14_0_2_set_power_limit, + .get_power_profile_mode = smu_v14_0_2_get_power_profile_mode, diff --git a/queue-6.13/drm-amdgpu-remove-jpeg-from-vega-and-carrizo-video-caps.patch b/queue-6.13/drm-amdgpu-remove-jpeg-from-vega-and-carrizo-video-caps.patch new file mode 100644 index 0000000000..efbdd1bfd1 --- /dev/null +++ b/queue-6.13/drm-amdgpu-remove-jpeg-from-vega-and-carrizo-video-caps.patch @@ -0,0 +1,49 @@ +From 7fc0765208502e53297ce72c49ca43729f9d6ff3 Mon Sep 17 00:00:00 2001 +From: David Rosca +Date: Fri, 28 Feb 2025 14:12:10 +0100 +Subject: drm/amdgpu: Remove JPEG from vega and carrizo video caps + +From: David Rosca + +commit 7fc0765208502e53297ce72c49ca43729f9d6ff3 upstream. + +JPEG is only supported for VCN1+. + +Signed-off-by: David Rosca +Acked-by: Alex Deucher +Reviewed-by: Ruijing Dong +Signed-off-by: Alex Deucher +(cherry picked from commit 0a6e7b06bdbead2e43d56a2274b7e0c9c86d536e) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/soc15.c | 1 - + drivers/gpu/drm/amd/amdgpu/vi.c | 7 ------- + 2 files changed, 8 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/soc15.c ++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c +@@ -108,7 +108,6 @@ static const struct amdgpu_video_codec_i + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 4096, 4096, 186)}, +- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)}, + }; + + static const struct amdgpu_video_codecs vega_video_codecs_decode = +--- a/drivers/gpu/drm/amd/amdgpu/vi.c ++++ b/drivers/gpu/drm/amd/amdgpu/vi.c +@@ -239,13 +239,6 @@ static const struct amdgpu_video_codec_i + .max_pixels_per_frame = 4096 * 4096, + .max_level = 186, + }, +- { +- .codec_type = AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, +- .max_width = 4096, +- .max_height = 4096, +- .max_pixels_per_frame = 4096 * 4096, +- .max_level = 0, +- }, + }; + + static const struct amdgpu_video_codecs cz_video_codecs_decode = diff --git a/queue-6.13/drm-amdgpu-restore-uncached-behaviour-on-gfx12.patch b/queue-6.13/drm-amdgpu-restore-uncached-behaviour-on-gfx12.patch new file mode 100644 index 0000000000..68d2d8186c --- /dev/null +++ b/queue-6.13/drm-amdgpu-restore-uncached-behaviour-on-gfx12.patch @@ -0,0 +1,86 @@ +From 35b6162bb790555ad56b7f0d120e307b8334d778 Mon Sep 17 00:00:00 2001 +From: David Belanger +Date: Tue, 2 Jul 2024 17:56:41 -0400 +Subject: drm/amdgpu: Restore uncached behaviour on GFX12 + +From: David Belanger + +commit 35b6162bb790555ad56b7f0d120e307b8334d778 upstream. + +Always use MTYPE_UC if UNCACHED flag is specified. + +This makes kernarg region uncached and it restores +usermode cache disable debug flag functionality. + +Do not set MTYPE_UC for COHERENT flag, on GFX12 coherence is handled by +shader code. + +Signed-off-by: David Belanger +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +(cherry picked from commit eb6cdfb807d038d9b9986b5c87188f28a4071eae) +Cc: stable@vger.kernel.org # 6.12.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/gmc_v12_0.c | 22 ++-------------------- + drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 8 +------- + 2 files changed, 3 insertions(+), 27 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/gmc_v12_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v12_0.c +@@ -501,9 +501,6 @@ static void gmc_v12_0_get_vm_pte(struct + uint64_t *flags) + { + struct amdgpu_bo *bo = mapping->bo_va->base.bo; +- struct amdgpu_device *bo_adev; +- bool coherent, is_system; +- + + *flags &= ~AMDGPU_PTE_EXECUTABLE; + *flags |= mapping->flags & AMDGPU_PTE_EXECUTABLE; +@@ -519,26 +516,11 @@ static void gmc_v12_0_get_vm_pte(struct + *flags &= ~AMDGPU_PTE_VALID; + } + +- if (!bo) +- return; +- +- if (bo->flags & (AMDGPU_GEM_CREATE_COHERENT | +- AMDGPU_GEM_CREATE_UNCACHED)) +- *flags = AMDGPU_PTE_MTYPE_GFX12(*flags, MTYPE_UC); +- +- bo_adev = amdgpu_ttm_adev(bo->tbo.bdev); +- coherent = bo->flags & AMDGPU_GEM_CREATE_COHERENT; +- is_system = bo->tbo.resource && +- (bo->tbo.resource->mem_type == TTM_PL_TT || +- bo->tbo.resource->mem_type == AMDGPU_PL_PREEMPT); +- + if (bo && bo->flags & AMDGPU_GEM_CREATE_GFX12_DCC) + *flags |= AMDGPU_PTE_DCC; + +- /* WA for HW bug */ +- if (is_system || ((bo_adev != adev) && coherent)) +- *flags = AMDGPU_PTE_MTYPE_GFX12(*flags, MTYPE_NC); +- ++ if (bo && bo->flags & AMDGPU_GEM_CREATE_UNCACHED) ++ *flags = AMDGPU_PTE_MTYPE_GFX12(*flags, MTYPE_UC); + } + + static unsigned gmc_v12_0_get_vbios_fb_size(struct amdgpu_device *adev) +--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +@@ -1276,13 +1276,7 @@ svm_range_get_pte_flags(struct kfd_node + break; + case IP_VERSION(12, 0, 0): + case IP_VERSION(12, 0, 1): +- if (domain == SVM_RANGE_VRAM_DOMAIN) { +- if (bo_node != node) +- mapping_flags |= AMDGPU_VM_MTYPE_NC; +- } else { +- mapping_flags |= coherent ? +- AMDGPU_VM_MTYPE_UC : AMDGPU_VM_MTYPE_NC; +- } ++ mapping_flags |= AMDGPU_VM_MTYPE_NC; + break; + default: + mapping_flags |= coherent ? diff --git a/queue-6.13/drm-amdkfd-fix-instruction-hazard-in-gfx12-trap-handler.patch b/queue-6.13/drm-amdkfd-fix-instruction-hazard-in-gfx12-trap-handler.patch new file mode 100644 index 0000000000..e0134ffa9d --- /dev/null +++ b/queue-6.13/drm-amdkfd-fix-instruction-hazard-in-gfx12-trap-handler.patch @@ -0,0 +1,925 @@ +From 424648c3838133f93a34fdfe4f9d5597551e7b3b Mon Sep 17 00:00:00 2001 +From: Jay Cornwall +Date: Fri, 7 Feb 2025 16:40:34 -0500 +Subject: drm/amdkfd: Fix instruction hazard in gfx12 trap handler + +From: Jay Cornwall + +commit 424648c3838133f93a34fdfe4f9d5597551e7b3b upstream. + +VALU instructions with SGPR source need wait states to avoid hazard +with SALU using different SGPR. + +v2: Eliminate some hazards to reduce code explosion + +Signed-off-by: Jay Cornwall +Reviewed-by: Lancelot Six +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +(cherry picked from commit 7e0459d453b911435673edd7a86eadc600c63238) +Cc: stable@vger.kernel.org # 6.12.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/cwsr_trap_handler.h | 677 +++++++++-------- + drivers/gpu/drm/amd/amdkfd/cwsr_trap_handler_gfx12.asm | 82 +- + 2 files changed, 404 insertions(+), 355 deletions(-) + +--- a/drivers/gpu/drm/amd/amdkfd/cwsr_trap_handler.h ++++ b/drivers/gpu/drm/amd/amdkfd/cwsr_trap_handler.h +@@ -3640,7 +3640,7 @@ static const uint32_t cwsr_trap_gfx9_4_3 + }; + + static const uint32_t cwsr_trap_gfx12_hex[] = { +- 0xbfa00001, 0xbfa0024b, ++ 0xbfa00001, 0xbfa002a2, + 0xb0804009, 0xb8f8f804, + 0x9178ff78, 0x00008c00, + 0xb8fbf811, 0x8b6eff78, +@@ -3714,7 +3714,15 @@ static const uint32_t cwsr_trap_gfx12_he + 0x00011677, 0xd7610000, + 0x00011a79, 0xd7610000, + 0x00011c7e, 0xd7610000, +- 0x00011e7f, 0xbefe00ff, ++ 0x00011e7f, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xbefe00ff, + 0x00003fff, 0xbeff0080, + 0xee0a407a, 0x000c0000, + 0x00004000, 0xd760007a, +@@ -3751,38 +3759,46 @@ static const uint32_t cwsr_trap_gfx12_he + 0x00000200, 0xbef600ff, + 0x01000000, 0x7e000280, + 0x7e020280, 0x7e040280, +- 0xbefd0080, 0xbe804ec2, +- 0xbf94fffe, 0xb8faf804, +- 0x8b7a847a, 0x91788478, +- 0x8c787a78, 0xd7610002, +- 0x0000fa71, 0x807d817d, +- 0xd7610002, 0x0000fa6c, +- 0x807d817d, 0x917aff6d, +- 0x80000000, 0xd7610002, +- 0x0000fa7a, 0x807d817d, +- 0xd7610002, 0x0000fa6e, +- 0x807d817d, 0xd7610002, +- 0x0000fa6f, 0x807d817d, +- 0xd7610002, 0x0000fa78, +- 0x807d817d, 0xb8faf811, +- 0xd7610002, 0x0000fa7a, +- 0x807d817d, 0xd7610002, +- 0x0000fa7b, 0x807d817d, +- 0xb8f1f801, 0xd7610002, +- 0x0000fa71, 0x807d817d, +- 0xb8f1f814, 0xd7610002, +- 0x0000fa71, 0x807d817d, +- 0xb8f1f815, 0xd7610002, +- 0x0000fa71, 0x807d817d, +- 0xb8f1f812, 0xd7610002, +- 0x0000fa71, 0x807d817d, +- 0xb8f1f813, 0xd7610002, +- 0x0000fa71, 0x807d817d, ++ 0xbe804ec2, 0xbf94fffe, ++ 0xb8faf804, 0x8b7a847a, ++ 0x91788478, 0x8c787a78, ++ 0x917aff6d, 0x80000000, ++ 0xd7610002, 0x00010071, ++ 0xd7610002, 0x0001026c, ++ 0xd7610002, 0x0001047a, ++ 0xd7610002, 0x0001066e, ++ 0xd7610002, 0x0001086f, ++ 0xd7610002, 0x00010a78, ++ 0xd7610002, 0x00010e7b, ++ 0xd8500000, 0x00000000, ++ 0xd8500000, 0x00000000, ++ 0xd8500000, 0x00000000, ++ 0xd8500000, 0x00000000, ++ 0xd8500000, 0x00000000, ++ 0xd8500000, 0x00000000, ++ 0xd8500000, 0x00000000, ++ 0xd8500000, 0x00000000, ++ 0xb8faf811, 0xd7610002, ++ 0x00010c7a, 0xb8faf801, ++ 0xd7610002, 0x0001107a, ++ 0xb8faf814, 0xd7610002, ++ 0x0001127a, 0xb8faf815, ++ 0xd7610002, 0x0001147a, ++ 0xb8faf812, 0xd7610002, ++ 0x0001167a, 0xb8faf813, ++ 0xd7610002, 0x0001187a, + 0xb8faf802, 0xd7610002, +- 0x0000fa7a, 0x807d817d, +- 0xbefa50c1, 0xbfc70000, +- 0xd7610002, 0x0000fa7a, +- 0x807d817d, 0xbefe00ff, ++ 0x00011a7a, 0xbefa50c1, ++ 0xbfc70000, 0xd7610002, ++ 0x00011c7a, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xbefe00ff, + 0x0000ffff, 0xbeff0080, + 0xc4068070, 0x008ce802, + 0x00000000, 0xbefe00c1, +@@ -3797,329 +3813,356 @@ static const uint32_t cwsr_trap_gfx12_he + 0xbe824102, 0xbe844104, + 0xbe864106, 0xbe884108, + 0xbe8a410a, 0xbe8c410c, +- 0xbe8e410e, 0xd7610002, +- 0x0000f200, 0x80798179, +- 0xd7610002, 0x0000f201, +- 0x80798179, 0xd7610002, +- 0x0000f202, 0x80798179, +- 0xd7610002, 0x0000f203, +- 0x80798179, 0xd7610002, +- 0x0000f204, 0x80798179, +- 0xd7610002, 0x0000f205, +- 0x80798179, 0xd7610002, +- 0x0000f206, 0x80798179, +- 0xd7610002, 0x0000f207, +- 0x80798179, 0xd7610002, +- 0x0000f208, 0x80798179, +- 0xd7610002, 0x0000f209, +- 0x80798179, 0xd7610002, +- 0x0000f20a, 0x80798179, +- 0xd7610002, 0x0000f20b, +- 0x80798179, 0xd7610002, +- 0x0000f20c, 0x80798179, +- 0xd7610002, 0x0000f20d, +- 0x80798179, 0xd7610002, +- 0x0000f20e, 0x80798179, +- 0xd7610002, 0x0000f20f, +- 0x80798179, 0xbf06a079, +- 0xbfa10007, 0xc4068070, ++ 0xbe8e410e, 0xbf068079, ++ 0xbfa10032, 0xd7610002, ++ 0x00010000, 0xd7610002, ++ 0x00010201, 0xd7610002, ++ 0x00010402, 0xd7610002, ++ 0x00010603, 0xd7610002, ++ 0x00010804, 0xd7610002, ++ 0x00010a05, 0xd7610002, ++ 0x00010c06, 0xd7610002, ++ 0x00010e07, 0xd7610002, ++ 0x00011008, 0xd7610002, ++ 0x00011209, 0xd7610002, ++ 0x0001140a, 0xd7610002, ++ 0x0001160b, 0xd7610002, ++ 0x0001180c, 0xd7610002, ++ 0x00011a0d, 0xd7610002, ++ 0x00011c0e, 0xd7610002, ++ 0x00011e0f, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0x80799079, ++ 0xbfa00038, 0xd7610002, ++ 0x00012000, 0xd7610002, ++ 0x00012201, 0xd7610002, ++ 0x00012402, 0xd7610002, ++ 0x00012603, 0xd7610002, ++ 0x00012804, 0xd7610002, ++ 0x00012a05, 0xd7610002, ++ 0x00012c06, 0xd7610002, ++ 0x00012e07, 0xd7610002, ++ 0x00013008, 0xd7610002, ++ 0x00013209, 0xd7610002, ++ 0x0001340a, 0xd7610002, ++ 0x0001360b, 0xd7610002, ++ 0x0001380c, 0xd7610002, ++ 0x00013a0d, 0xd7610002, ++ 0x00013c0e, 0xd7610002, ++ 0x00013e0f, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0x80799079, ++ 0xc4068070, 0x008ce802, ++ 0x00000000, 0x8070ff70, ++ 0x00000080, 0xbef90080, ++ 0x7e040280, 0x807d907d, ++ 0xbf0aff7d, 0x00000060, ++ 0xbfa2ff88, 0xbe804100, ++ 0xbe824102, 0xbe844104, ++ 0xbe864106, 0xbe884108, ++ 0xbe8a410a, 0xd7610002, ++ 0x00010000, 0xd7610002, ++ 0x00010201, 0xd7610002, ++ 0x00010402, 0xd7610002, ++ 0x00010603, 0xd7610002, ++ 0x00010804, 0xd7610002, ++ 0x00010a05, 0xd7610002, ++ 0x00010c06, 0xd7610002, ++ 0x00010e07, 0xd7610002, ++ 0x00011008, 0xd7610002, ++ 0x00011209, 0xd7610002, ++ 0x0001140a, 0xd7610002, ++ 0x0001160b, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xd8500000, ++ 0x00000000, 0xc4068070, + 0x008ce802, 0x00000000, ++ 0xbefe00c1, 0x857d9973, ++ 0x8b7d817d, 0xbf06817d, ++ 0xbfa20002, 0xbeff0080, ++ 0xbfa00001, 0xbeff00c1, ++ 0xb8fb4306, 0x8b7bc17b, ++ 0xbfa10044, 0x8b7aff6d, ++ 0x80000000, 0xbfa10041, ++ 0x847b897b, 0xbef6007b, ++ 0xb8f03b05, 0x80708170, ++ 0xbf0d9973, 0xbfa20002, ++ 0x84708970, 0xbfa00001, ++ 0x84708a70, 0xb8fa1e06, ++ 0x847a8a7a, 0x80707a70, ++ 0x8070ff70, 0x00000200, + 0x8070ff70, 0x00000080, +- 0xbef90080, 0x7e040280, +- 0x807d907d, 0xbf0aff7d, +- 0x00000060, 0xbfa2ffbb, +- 0xbe804100, 0xbe824102, +- 0xbe844104, 0xbe864106, +- 0xbe884108, 0xbe8a410a, +- 0xd7610002, 0x0000f200, +- 0x80798179, 0xd7610002, +- 0x0000f201, 0x80798179, +- 0xd7610002, 0x0000f202, +- 0x80798179, 0xd7610002, +- 0x0000f203, 0x80798179, +- 0xd7610002, 0x0000f204, +- 0x80798179, 0xd7610002, +- 0x0000f205, 0x80798179, +- 0xd7610002, 0x0000f206, +- 0x80798179, 0xd7610002, +- 0x0000f207, 0x80798179, +- 0xd7610002, 0x0000f208, +- 0x80798179, 0xd7610002, +- 0x0000f209, 0x80798179, +- 0xd7610002, 0x0000f20a, +- 0x80798179, 0xd7610002, +- 0x0000f20b, 0x80798179, +- 0xc4068070, 0x008ce802, +- 0x00000000, 0xbefe00c1, +- 0x857d9973, 0x8b7d817d, +- 0xbf06817d, 0xbfa20002, +- 0xbeff0080, 0xbfa00001, +- 0xbeff00c1, 0xb8fb4306, +- 0x8b7bc17b, 0xbfa10044, +- 0x8b7aff6d, 0x80000000, +- 0xbfa10041, 0x847b897b, +- 0xbef6007b, 0xb8f03b05, +- 0x80708170, 0xbf0d9973, +- 0xbfa20002, 0x84708970, +- 0xbfa00001, 0x84708a70, +- 0xb8fa1e06, 0x847a8a7a, +- 0x80707a70, 0x8070ff70, +- 0x00000200, 0x8070ff70, +- 0x00000080, 0xbef600ff, +- 0x01000000, 0xd71f0000, +- 0x000100c1, 0xd7200000, +- 0x000200c1, 0x16000084, +- 0x857d9973, 0x8b7d817d, +- 0xbf06817d, 0xbefd0080, +- 0xbfa20013, 0xbe8300ff, +- 0x00000080, 0xbf800000, +- 0xbf800000, 0xbf800000, +- 0xd8d80000, 0x01000000, +- 0xbf8a0000, 0xc4068070, +- 0x008ce801, 0x00000000, +- 0x807d037d, 0x80700370, +- 0xd5250000, 0x0001ff00, +- 0x00000080, 0xbf0a7b7d, +- 0xbfa2fff3, 0xbfa00012, +- 0xbe8300ff, 0x00000100, ++ 0xbef600ff, 0x01000000, ++ 0xd71f0000, 0x000100c1, ++ 0xd7200000, 0x000200c1, ++ 0x16000084, 0x857d9973, ++ 0x8b7d817d, 0xbf06817d, ++ 0xbefd0080, 0xbfa20013, ++ 0xbe8300ff, 0x00000080, + 0xbf800000, 0xbf800000, + 0xbf800000, 0xd8d80000, + 0x01000000, 0xbf8a0000, + 0xc4068070, 0x008ce801, + 0x00000000, 0x807d037d, + 0x80700370, 0xd5250000, +- 0x0001ff00, 0x00000100, ++ 0x0001ff00, 0x00000080, + 0xbf0a7b7d, 0xbfa2fff3, +- 0xbefe00c1, 0x857d9973, +- 0x8b7d817d, 0xbf06817d, +- 0xbfa20004, 0xbef000ff, +- 0x00000200, 0xbeff0080, +- 0xbfa00003, 0xbef000ff, +- 0x00000400, 0xbeff00c1, +- 0xb8fb3b05, 0x807b817b, +- 0x847b827b, 0x857d9973, +- 0x8b7d817d, 0xbf06817d, +- 0xbfa2001b, 0xbef600ff, +- 0x01000000, 0xbefd0084, +- 0xbf0a7b7d, 0xbfa10040, +- 0x7e008700, 0x7e028701, +- 0x7e048702, 0x7e068703, +- 0xc4068070, 0x008ce800, +- 0x00000000, 0xc4068070, +- 0x008ce801, 0x00008000, +- 0xc4068070, 0x008ce802, +- 0x00010000, 0xc4068070, +- 0x008ce803, 0x00018000, +- 0x807d847d, 0x8070ff70, +- 0x00000200, 0xbf0a7b7d, +- 0xbfa2ffeb, 0xbfa0002a, ++ 0xbfa00012, 0xbe8300ff, ++ 0x00000100, 0xbf800000, ++ 0xbf800000, 0xbf800000, ++ 0xd8d80000, 0x01000000, ++ 0xbf8a0000, 0xc4068070, ++ 0x008ce801, 0x00000000, ++ 0x807d037d, 0x80700370, ++ 0xd5250000, 0x0001ff00, ++ 0x00000100, 0xbf0a7b7d, ++ 0xbfa2fff3, 0xbefe00c1, ++ 0x857d9973, 0x8b7d817d, ++ 0xbf06817d, 0xbfa20004, ++ 0xbef000ff, 0x00000200, ++ 0xbeff0080, 0xbfa00003, ++ 0xbef000ff, 0x00000400, ++ 0xbeff00c1, 0xb8fb3b05, ++ 0x807b817b, 0x847b827b, ++ 0x857d9973, 0x8b7d817d, ++ 0xbf06817d, 0xbfa2001b, + 0xbef600ff, 0x01000000, + 0xbefd0084, 0xbf0a7b7d, +- 0xbfa10015, 0x7e008700, ++ 0xbfa10040, 0x7e008700, + 0x7e028701, 0x7e048702, + 0x7e068703, 0xc4068070, + 0x008ce800, 0x00000000, + 0xc4068070, 0x008ce801, +- 0x00010000, 0xc4068070, +- 0x008ce802, 0x00020000, ++ 0x00008000, 0xc4068070, ++ 0x008ce802, 0x00010000, + 0xc4068070, 0x008ce803, +- 0x00030000, 0x807d847d, +- 0x8070ff70, 0x00000400, ++ 0x00018000, 0x807d847d, ++ 0x8070ff70, 0x00000200, + 0xbf0a7b7d, 0xbfa2ffeb, +- 0xb8fb1e06, 0x8b7bc17b, +- 0xbfa1000d, 0x847b837b, +- 0x807b7d7b, 0xbefe00c1, +- 0xbeff0080, 0x7e008700, ++ 0xbfa0002a, 0xbef600ff, ++ 0x01000000, 0xbefd0084, ++ 0xbf0a7b7d, 0xbfa10015, ++ 0x7e008700, 0x7e028701, ++ 0x7e048702, 0x7e068703, + 0xc4068070, 0x008ce800, +- 0x00000000, 0x807d817d, +- 0x8070ff70, 0x00000080, +- 0xbf0a7b7d, 0xbfa2fff7, +- 0xbfa0016e, 0xbef4007e, +- 0x8b75ff7f, 0x0000ffff, +- 0x8c75ff75, 0x00040000, +- 0xbef60080, 0xbef700ff, +- 0x10807fac, 0xbef1007f, +- 0xb8f20742, 0x84729972, +- 0x8b6eff7f, 0x04000000, +- 0xbfa1003b, 0xbefe00c1, +- 0x857d9972, 0x8b7d817d, +- 0xbf06817d, 0xbfa20002, +- 0xbeff0080, 0xbfa00001, +- 0xbeff00c1, 0xb8ef4306, +- 0x8b6fc16f, 0xbfa10030, +- 0x846f896f, 0xbef6006f, ++ 0x00000000, 0xc4068070, ++ 0x008ce801, 0x00010000, ++ 0xc4068070, 0x008ce802, ++ 0x00020000, 0xc4068070, ++ 0x008ce803, 0x00030000, ++ 0x807d847d, 0x8070ff70, ++ 0x00000400, 0xbf0a7b7d, ++ 0xbfa2ffeb, 0xb8fb1e06, ++ 0x8b7bc17b, 0xbfa1000d, ++ 0x847b837b, 0x807b7d7b, ++ 0xbefe00c1, 0xbeff0080, ++ 0x7e008700, 0xc4068070, ++ 0x008ce800, 0x00000000, ++ 0x807d817d, 0x8070ff70, ++ 0x00000080, 0xbf0a7b7d, ++ 0xbfa2fff7, 0xbfa0016e, ++ 0xbef4007e, 0x8b75ff7f, ++ 0x0000ffff, 0x8c75ff75, ++ 0x00040000, 0xbef60080, ++ 0xbef700ff, 0x10807fac, ++ 0xbef1007f, 0xb8f20742, ++ 0x84729972, 0x8b6eff7f, ++ 0x04000000, 0xbfa1003b, ++ 0xbefe00c1, 0x857d9972, ++ 0x8b7d817d, 0xbf06817d, ++ 0xbfa20002, 0xbeff0080, ++ 0xbfa00001, 0xbeff00c1, ++ 0xb8ef4306, 0x8b6fc16f, ++ 0xbfa10030, 0x846f896f, ++ 0xbef6006f, 0xb8f83b05, ++ 0x80788178, 0xbf0d9972, ++ 0xbfa20002, 0x84788978, ++ 0xbfa00001, 0x84788a78, ++ 0xb8ee1e06, 0x846e8a6e, ++ 0x80786e78, 0x8078ff78, ++ 0x00000200, 0x8078ff78, ++ 0x00000080, 0xbef600ff, ++ 0x01000000, 0x857d9972, ++ 0x8b7d817d, 0xbf06817d, ++ 0xbefd0080, 0xbfa2000d, ++ 0xc4050078, 0x0080e800, ++ 0x00000000, 0xbf8a0000, ++ 0xdac00000, 0x00000000, ++ 0x807dff7d, 0x00000080, ++ 0x8078ff78, 0x00000080, ++ 0xbf0a6f7d, 0xbfa2fff4, ++ 0xbfa0000c, 0xc4050078, ++ 0x0080e800, 0x00000000, ++ 0xbf8a0000, 0xdac00000, ++ 0x00000000, 0x807dff7d, ++ 0x00000100, 0x8078ff78, ++ 0x00000100, 0xbf0a6f7d, ++ 0xbfa2fff4, 0xbef80080, ++ 0xbefe00c1, 0x857d9972, ++ 0x8b7d817d, 0xbf06817d, ++ 0xbfa20002, 0xbeff0080, ++ 0xbfa00001, 0xbeff00c1, ++ 0xb8ef3b05, 0x806f816f, ++ 0x846f826f, 0x857d9972, ++ 0x8b7d817d, 0xbf06817d, ++ 0xbfa2002c, 0xbef600ff, ++ 0x01000000, 0xbeee0078, ++ 0x8078ff78, 0x00000200, ++ 0xbefd0084, 0xbf0a6f7d, ++ 0xbfa10061, 0xc4050078, ++ 0x008ce800, 0x00000000, ++ 0xc4050078, 0x008ce801, ++ 0x00008000, 0xc4050078, ++ 0x008ce802, 0x00010000, ++ 0xc4050078, 0x008ce803, ++ 0x00018000, 0xbf8a0000, ++ 0x7e008500, 0x7e028501, ++ 0x7e048502, 0x7e068503, ++ 0x807d847d, 0x8078ff78, ++ 0x00000200, 0xbf0a6f7d, ++ 0xbfa2ffea, 0xc405006e, ++ 0x008ce800, 0x00000000, ++ 0xc405006e, 0x008ce801, ++ 0x00008000, 0xc405006e, ++ 0x008ce802, 0x00010000, ++ 0xc405006e, 0x008ce803, ++ 0x00018000, 0xbf8a0000, ++ 0xbfa0003d, 0xbef600ff, ++ 0x01000000, 0xbeee0078, ++ 0x8078ff78, 0x00000400, ++ 0xbefd0084, 0xbf0a6f7d, ++ 0xbfa10016, 0xc4050078, ++ 0x008ce800, 0x00000000, ++ 0xc4050078, 0x008ce801, ++ 0x00010000, 0xc4050078, ++ 0x008ce802, 0x00020000, ++ 0xc4050078, 0x008ce803, ++ 0x00030000, 0xbf8a0000, ++ 0x7e008500, 0x7e028501, ++ 0x7e048502, 0x7e068503, ++ 0x807d847d, 0x8078ff78, ++ 0x00000400, 0xbf0a6f7d, ++ 0xbfa2ffea, 0xb8ef1e06, ++ 0x8b6fc16f, 0xbfa1000f, ++ 0x846f836f, 0x806f7d6f, ++ 0xbefe00c1, 0xbeff0080, ++ 0xc4050078, 0x008ce800, ++ 0x00000000, 0xbf8a0000, ++ 0x7e008500, 0x807d817d, ++ 0x8078ff78, 0x00000080, ++ 0xbf0a6f7d, 0xbfa2fff6, ++ 0xbeff00c1, 0xc405006e, ++ 0x008ce800, 0x00000000, ++ 0xc405006e, 0x008ce801, ++ 0x00010000, 0xc405006e, ++ 0x008ce802, 0x00020000, ++ 0xc405006e, 0x008ce803, ++ 0x00030000, 0xbf8a0000, + 0xb8f83b05, 0x80788178, + 0xbf0d9972, 0xbfa20002, + 0x84788978, 0xbfa00001, + 0x84788a78, 0xb8ee1e06, + 0x846e8a6e, 0x80786e78, + 0x8078ff78, 0x00000200, +- 0x8078ff78, 0x00000080, ++ 0x80f8ff78, 0x00000050, + 0xbef600ff, 0x01000000, +- 0x857d9972, 0x8b7d817d, +- 0xbf06817d, 0xbefd0080, +- 0xbfa2000d, 0xc4050078, +- 0x0080e800, 0x00000000, +- 0xbf8a0000, 0xdac00000, +- 0x00000000, 0x807dff7d, +- 0x00000080, 0x8078ff78, +- 0x00000080, 0xbf0a6f7d, +- 0xbfa2fff4, 0xbfa0000c, +- 0xc4050078, 0x0080e800, +- 0x00000000, 0xbf8a0000, +- 0xdac00000, 0x00000000, +- 0x807dff7d, 0x00000100, +- 0x8078ff78, 0x00000100, +- 0xbf0a6f7d, 0xbfa2fff4, +- 0xbef80080, 0xbefe00c1, +- 0x857d9972, 0x8b7d817d, +- 0xbf06817d, 0xbfa20002, +- 0xbeff0080, 0xbfa00001, +- 0xbeff00c1, 0xb8ef3b05, +- 0x806f816f, 0x846f826f, +- 0x857d9972, 0x8b7d817d, +- 0xbf06817d, 0xbfa2002c, +- 0xbef600ff, 0x01000000, +- 0xbeee0078, 0x8078ff78, +- 0x00000200, 0xbefd0084, +- 0xbf0a6f7d, 0xbfa10061, +- 0xc4050078, 0x008ce800, +- 0x00000000, 0xc4050078, +- 0x008ce801, 0x00008000, +- 0xc4050078, 0x008ce802, +- 0x00010000, 0xc4050078, +- 0x008ce803, 0x00018000, +- 0xbf8a0000, 0x7e008500, +- 0x7e028501, 0x7e048502, +- 0x7e068503, 0x807d847d, ++ 0xbefd00ff, 0x0000006c, ++ 0x80f89078, 0xf462403a, ++ 0xf0000000, 0xbf8a0000, ++ 0x80fd847d, 0xbf800000, ++ 0xbe804300, 0xbe824302, ++ 0x80f8a078, 0xf462603a, ++ 0xf0000000, 0xbf8a0000, ++ 0x80fd887d, 0xbf800000, ++ 0xbe804300, 0xbe824302, ++ 0xbe844304, 0xbe864306, ++ 0x80f8c078, 0xf462803a, ++ 0xf0000000, 0xbf8a0000, ++ 0x80fd907d, 0xbf800000, ++ 0xbe804300, 0xbe824302, ++ 0xbe844304, 0xbe864306, ++ 0xbe884308, 0xbe8a430a, ++ 0xbe8c430c, 0xbe8e430e, ++ 0xbf06807d, 0xbfa1fff0, ++ 0xb980f801, 0x00000000, ++ 0xb8f83b05, 0x80788178, ++ 0xbf0d9972, 0xbfa20002, ++ 0x84788978, 0xbfa00001, ++ 0x84788a78, 0xb8ee1e06, ++ 0x846e8a6e, 0x80786e78, + 0x8078ff78, 0x00000200, +- 0xbf0a6f7d, 0xbfa2ffea, +- 0xc405006e, 0x008ce800, +- 0x00000000, 0xc405006e, +- 0x008ce801, 0x00008000, +- 0xc405006e, 0x008ce802, +- 0x00010000, 0xc405006e, +- 0x008ce803, 0x00018000, +- 0xbf8a0000, 0xbfa0003d, + 0xbef600ff, 0x01000000, +- 0xbeee0078, 0x8078ff78, +- 0x00000400, 0xbefd0084, +- 0xbf0a6f7d, 0xbfa10016, +- 0xc4050078, 0x008ce800, +- 0x00000000, 0xc4050078, +- 0x008ce801, 0x00010000, +- 0xc4050078, 0x008ce802, +- 0x00020000, 0xc4050078, +- 0x008ce803, 0x00030000, +- 0xbf8a0000, 0x7e008500, +- 0x7e028501, 0x7e048502, +- 0x7e068503, 0x807d847d, +- 0x8078ff78, 0x00000400, +- 0xbf0a6f7d, 0xbfa2ffea, +- 0xb8ef1e06, 0x8b6fc16f, +- 0xbfa1000f, 0x846f836f, +- 0x806f7d6f, 0xbefe00c1, +- 0xbeff0080, 0xc4050078, +- 0x008ce800, 0x00000000, +- 0xbf8a0000, 0x7e008500, +- 0x807d817d, 0x8078ff78, +- 0x00000080, 0xbf0a6f7d, +- 0xbfa2fff6, 0xbeff00c1, +- 0xc405006e, 0x008ce800, +- 0x00000000, 0xc405006e, +- 0x008ce801, 0x00010000, +- 0xc405006e, 0x008ce802, +- 0x00020000, 0xc405006e, +- 0x008ce803, 0x00030000, +- 0xbf8a0000, 0xb8f83b05, +- 0x80788178, 0xbf0d9972, +- 0xbfa20002, 0x84788978, +- 0xbfa00001, 0x84788a78, +- 0xb8ee1e06, 0x846e8a6e, +- 0x80786e78, 0x8078ff78, +- 0x00000200, 0x80f8ff78, +- 0x00000050, 0xbef600ff, +- 0x01000000, 0xbefd00ff, +- 0x0000006c, 0x80f89078, +- 0xf462403a, 0xf0000000, +- 0xbf8a0000, 0x80fd847d, +- 0xbf800000, 0xbe804300, +- 0xbe824302, 0x80f8a078, +- 0xf462603a, 0xf0000000, +- 0xbf8a0000, 0x80fd887d, +- 0xbf800000, 0xbe804300, +- 0xbe824302, 0xbe844304, +- 0xbe864306, 0x80f8c078, +- 0xf462803a, 0xf0000000, +- 0xbf8a0000, 0x80fd907d, +- 0xbf800000, 0xbe804300, +- 0xbe824302, 0xbe844304, +- 0xbe864306, 0xbe884308, +- 0xbe8a430a, 0xbe8c430c, +- 0xbe8e430e, 0xbf06807d, +- 0xbfa1fff0, 0xb980f801, +- 0x00000000, 0xb8f83b05, +- 0x80788178, 0xbf0d9972, +- 0xbfa20002, 0x84788978, +- 0xbfa00001, 0x84788a78, +- 0xb8ee1e06, 0x846e8a6e, +- 0x80786e78, 0x8078ff78, +- 0x00000200, 0xbef600ff, +- 0x01000000, 0xbeff0071, +- 0xf4621bfa, 0xf0000000, +- 0x80788478, 0xf4621b3a, ++ 0xbeff0071, 0xf4621bfa, + 0xf0000000, 0x80788478, +- 0xf4621b7a, 0xf0000000, +- 0x80788478, 0xf4621c3a, ++ 0xf4621b3a, 0xf0000000, ++ 0x80788478, 0xf4621b7a, + 0xf0000000, 0x80788478, +- 0xf4621c7a, 0xf0000000, +- 0x80788478, 0xf4621eba, ++ 0xf4621c3a, 0xf0000000, ++ 0x80788478, 0xf4621c7a, + 0xf0000000, 0x80788478, +- 0xf4621efa, 0xf0000000, +- 0x80788478, 0xf4621e7a, ++ 0xf4621eba, 0xf0000000, ++ 0x80788478, 0xf4621efa, + 0xf0000000, 0x80788478, +- 0xf4621cfa, 0xf0000000, +- 0x80788478, 0xf4621bba, ++ 0xf4621e7a, 0xf0000000, ++ 0x80788478, 0xf4621cfa, + 0xf0000000, 0x80788478, +- 0xbf8a0000, 0xb96ef814, + 0xf4621bba, 0xf0000000, + 0x80788478, 0xbf8a0000, +- 0xb96ef815, 0xf4621bba, ++ 0xb96ef814, 0xf4621bba, + 0xf0000000, 0x80788478, +- 0xbf8a0000, 0xb96ef812, ++ 0xbf8a0000, 0xb96ef815, + 0xf4621bba, 0xf0000000, + 0x80788478, 0xbf8a0000, +- 0xb96ef813, 0x8b6eff7f, +- 0x04000000, 0xbfa1000d, +- 0x80788478, 0xf4621bba, ++ 0xb96ef812, 0xf4621bba, + 0xf0000000, 0x80788478, +- 0xbf8a0000, 0xbf0d806e, +- 0xbfa10006, 0x856e906e, +- 0x8b6e6e6e, 0xbfa10003, +- 0xbe804ec1, 0x816ec16e, +- 0xbfa0fffb, 0xbefd006f, +- 0xbefe0070, 0xbeff0071, +- 0xb97b2011, 0x857b867b, +- 0xb97b0191, 0x857b827b, +- 0xb97bba11, 0xb973f801, +- 0xb8ee3b05, 0x806e816e, +- 0xbf0d9972, 0xbfa20002, +- 0x846e896e, 0xbfa00001, +- 0x846e8a6e, 0xb8ef1e06, +- 0x846f8a6f, 0x806e6f6e, +- 0x806eff6e, 0x00000200, +- 0x806e746e, 0x826f8075, +- 0x8b6fff6f, 0x0000ffff, +- 0xf4605c37, 0xf8000050, +- 0xf4605d37, 0xf8000060, +- 0xf4601e77, 0xf8000074, +- 0xbf8a0000, 0x8b6dff6d, +- 0x0000ffff, 0x8bfe7e7e, +- 0x8bea6a6a, 0xb97af804, ++ 0xbf8a0000, 0xb96ef813, ++ 0x8b6eff7f, 0x04000000, ++ 0xbfa1000d, 0x80788478, ++ 0xf4621bba, 0xf0000000, ++ 0x80788478, 0xbf8a0000, ++ 0xbf0d806e, 0xbfa10006, ++ 0x856e906e, 0x8b6e6e6e, ++ 0xbfa10003, 0xbe804ec1, ++ 0x816ec16e, 0xbfa0fffb, ++ 0xbefd006f, 0xbefe0070, ++ 0xbeff0071, 0xb97b2011, ++ 0x857b867b, 0xb97b0191, ++ 0x857b827b, 0xb97bba11, ++ 0xb973f801, 0xb8ee3b05, ++ 0x806e816e, 0xbf0d9972, ++ 0xbfa20002, 0x846e896e, ++ 0xbfa00001, 0x846e8a6e, ++ 0xb8ef1e06, 0x846f8a6f, ++ 0x806e6f6e, 0x806eff6e, ++ 0x00000200, 0x806e746e, ++ 0x826f8075, 0x8b6fff6f, ++ 0x0000ffff, 0xf4605c37, ++ 0xf8000050, 0xf4605d37, ++ 0xf8000060, 0xf4601e77, ++ 0xf8000074, 0xbf8a0000, ++ 0x8b6dff6d, 0x0000ffff, ++ 0x8bfe7e7e, 0x8bea6a6a, ++ 0xb97af804, 0xbe804ec2, ++ 0xbf94fffe, 0xbe804a6c, + 0xbe804ec2, 0xbf94fffe, +- 0xbe804a6c, 0xbe804ec2, +- 0xbf94fffe, 0xbfb10000, ++ 0xbfb10000, 0xbf9f0000, + 0xbf9f0000, 0xbf9f0000, + 0xbf9f0000, 0xbf9f0000, +- 0xbf9f0000, 0x00000000, + }; +--- a/drivers/gpu/drm/amd/amdkfd/cwsr_trap_handler_gfx12.asm ++++ b/drivers/gpu/drm/amd/amdkfd/cwsr_trap_handler_gfx12.asm +@@ -30,6 +30,7 @@ + #define CHIP_GFX12 37 + + #define SINGLE_STEP_MISSED_WORKAROUND 1 //workaround for lost TRAP_AFTER_INST exception when SAVECTX raised ++#define HAVE_VALU_SGPR_HAZARD (ASIC_FAMILY == CHIP_GFX12) + + var SQ_WAVE_STATE_PRIV_BARRIER_COMPLETE_MASK = 0x4 + var SQ_WAVE_STATE_PRIV_SCC_SHIFT = 9 +@@ -351,6 +352,7 @@ L_HAVE_VGPRS: + v_writelane_b32 v0, ttmp13, 0xD + v_writelane_b32 v0, exec_lo, 0xE + v_writelane_b32 v0, exec_hi, 0xF ++ valu_sgpr_hazard() + + s_mov_b32 exec_lo, 0x3FFF + s_mov_b32 exec_hi, 0x0 +@@ -417,7 +419,6 @@ L_SAVE_HWREG: + v_mov_b32 v0, 0x0 //Offset[31:0] from buffer resource + v_mov_b32 v1, 0x0 //Offset[63:32] from buffer resource + v_mov_b32 v2, 0x0 //Set of SGPRs for TCP store +- s_mov_b32 m0, 0x0 //Next lane of v2 to write to + + // Ensure no further changes to barrier or LDS state. + // STATE_PRIV.BARRIER_COMPLETE may change up to this point. +@@ -430,40 +431,41 @@ L_SAVE_HWREG: + s_andn2_b32 s_save_state_priv, s_save_state_priv, SQ_WAVE_STATE_PRIV_BARRIER_COMPLETE_MASK + s_or_b32 s_save_state_priv, s_save_state_priv, s_save_tmp + +- write_hwreg_to_v2(s_save_m0) +- write_hwreg_to_v2(s_save_pc_lo) + s_andn2_b32 s_save_tmp, s_save_pc_hi, S_SAVE_PC_HI_FIRST_WAVE_MASK +- write_hwreg_to_v2(s_save_tmp) +- write_hwreg_to_v2(s_save_exec_lo) +- write_hwreg_to_v2(s_save_exec_hi) +- write_hwreg_to_v2(s_save_state_priv) ++ v_writelane_b32 v2, s_save_m0, 0x0 ++ v_writelane_b32 v2, s_save_pc_lo, 0x1 ++ v_writelane_b32 v2, s_save_tmp, 0x2 ++ v_writelane_b32 v2, s_save_exec_lo, 0x3 ++ v_writelane_b32 v2, s_save_exec_hi, 0x4 ++ v_writelane_b32 v2, s_save_state_priv, 0x5 ++ v_writelane_b32 v2, s_save_xnack_mask, 0x7 ++ valu_sgpr_hazard() + + s_getreg_b32 s_save_tmp, hwreg(HW_REG_WAVE_EXCP_FLAG_PRIV) +- write_hwreg_to_v2(s_save_tmp) ++ v_writelane_b32 v2, s_save_tmp, 0x6 + +- write_hwreg_to_v2(s_save_xnack_mask) ++ s_getreg_b32 s_save_tmp, hwreg(HW_REG_WAVE_MODE) ++ v_writelane_b32 v2, s_save_tmp, 0x8 + +- s_getreg_b32 s_save_m0, hwreg(HW_REG_WAVE_MODE) +- write_hwreg_to_v2(s_save_m0) ++ s_getreg_b32 s_save_tmp, hwreg(HW_REG_WAVE_SCRATCH_BASE_LO) ++ v_writelane_b32 v2, s_save_tmp, 0x9 + +- s_getreg_b32 s_save_m0, hwreg(HW_REG_WAVE_SCRATCH_BASE_LO) +- write_hwreg_to_v2(s_save_m0) ++ s_getreg_b32 s_save_tmp, hwreg(HW_REG_WAVE_SCRATCH_BASE_HI) ++ v_writelane_b32 v2, s_save_tmp, 0xA + +- s_getreg_b32 s_save_m0, hwreg(HW_REG_WAVE_SCRATCH_BASE_HI) +- write_hwreg_to_v2(s_save_m0) ++ s_getreg_b32 s_save_tmp, hwreg(HW_REG_WAVE_EXCP_FLAG_USER) ++ v_writelane_b32 v2, s_save_tmp, 0xB + +- s_getreg_b32 s_save_m0, hwreg(HW_REG_WAVE_EXCP_FLAG_USER) +- write_hwreg_to_v2(s_save_m0) +- +- s_getreg_b32 s_save_m0, hwreg(HW_REG_WAVE_TRAP_CTRL) +- write_hwreg_to_v2(s_save_m0) ++ s_getreg_b32 s_save_tmp, hwreg(HW_REG_WAVE_TRAP_CTRL) ++ v_writelane_b32 v2, s_save_tmp, 0xC + + s_getreg_b32 s_save_tmp, hwreg(HW_REG_WAVE_STATUS) +- write_hwreg_to_v2(s_save_tmp) ++ v_writelane_b32 v2, s_save_tmp, 0xD + + s_get_barrier_state s_save_tmp, -1 + s_wait_kmcnt (0) +- write_hwreg_to_v2(s_save_tmp) ++ v_writelane_b32 v2, s_save_tmp, 0xE ++ valu_sgpr_hazard() + + // Write HWREGs with 16 VGPR lanes. TTMPs occupy space after this. + s_mov_b32 exec_lo, 0xFFFF +@@ -497,10 +499,12 @@ L_SAVE_SGPR_LOOP: + s_movrels_b64 s12, s12 //s12 = s[12+m0], s13 = s[13+m0] + s_movrels_b64 s14, s14 //s14 = s[14+m0], s15 = s[15+m0] + +- write_16sgpr_to_v2(s0) +- +- s_cmp_eq_u32 ttmp13, 0x20 //have 32 VGPR lanes filled? +- s_cbranch_scc0 L_SAVE_SGPR_SKIP_TCP_STORE ++ s_cmp_eq_u32 ttmp13, 0x0 ++ s_cbranch_scc0 L_WRITE_V2_SECOND_HALF ++ write_16sgpr_to_v2(s0, 0x0) ++ s_branch L_SAVE_SGPR_SKIP_TCP_STORE ++L_WRITE_V2_SECOND_HALF: ++ write_16sgpr_to_v2(s0, 0x10) + + buffer_store_dword v2, v0, s_save_buf_rsrc0, s_save_mem_offset scope:SCOPE_SYS + s_add_u32 s_save_mem_offset, s_save_mem_offset, 0x80 +@@ -1056,27 +1060,21 @@ L_END_PGM: + s_endpgm_saved + end + +-function write_hwreg_to_v2(s) +- // Copy into VGPR for later TCP store. +- v_writelane_b32 v2, s, m0 +- s_add_u32 m0, m0, 0x1 +-end +- +- +-function write_16sgpr_to_v2(s) ++function write_16sgpr_to_v2(s, lane_offset) + // Copy into VGPR for later TCP store. + for var sgpr_idx = 0; sgpr_idx < 16; sgpr_idx ++ +- v_writelane_b32 v2, s[sgpr_idx], ttmp13 +- s_add_u32 ttmp13, ttmp13, 0x1 ++ v_writelane_b32 v2, s[sgpr_idx], sgpr_idx + lane_offset + end ++ valu_sgpr_hazard() ++ s_add_u32 ttmp13, ttmp13, 0x10 + end + + function write_12sgpr_to_v2(s) + // Copy into VGPR for later TCP store. + for var sgpr_idx = 0; sgpr_idx < 12; sgpr_idx ++ +- v_writelane_b32 v2, s[sgpr_idx], ttmp13 +- s_add_u32 ttmp13, ttmp13, 0x1 ++ v_writelane_b32 v2, s[sgpr_idx], sgpr_idx + end ++ valu_sgpr_hazard() + end + + function read_hwreg_from_mem(s, s_rsrc, s_mem_offset) +@@ -1128,3 +1126,11 @@ function get_wave_size2(s_reg) + s_getreg_b32 s_reg, hwreg(HW_REG_WAVE_STATUS,SQ_WAVE_STATUS_WAVE64_SHIFT,SQ_WAVE_STATUS_WAVE64_SIZE) + s_lshl_b32 s_reg, s_reg, S_WAVE_SIZE + end ++ ++function valu_sgpr_hazard ++#if HAVE_VALU_SGPR_HAZARD ++ for var rep = 0; rep < 8; rep ++ ++ ds_nop ++ end ++#endif ++end diff --git a/queue-6.13/drm-amdkfd-fix-user-queue-validation-on-gfx7-8.patch b/queue-6.13/drm-amdkfd-fix-user-queue-validation-on-gfx7-8.patch new file mode 100644 index 0000000000..4e6cd6ecc1 --- /dev/null +++ b/queue-6.13/drm-amdkfd-fix-user-queue-validation-on-gfx7-8.patch @@ -0,0 +1,67 @@ +From 542c3bb836733a1325874310d54d25b4907ed10e Mon Sep 17 00:00:00 2001 +From: Philip Yang +Date: Wed, 29 Jan 2025 12:37:30 -0500 +Subject: drm/amdkfd: Fix user queue validation on Gfx7/8 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Philip Yang + +commit 542c3bb836733a1325874310d54d25b4907ed10e upstream. + +To workaround queue full h/w issue on Gfx7/8, when application create +AQL queue, the ring buffer bo allocate size is queue_size/2 and +map queue_size ring buffer to GPU in 2 pieces using 2 attachments, each +attachment map size is queue_size/2, with same ring_bo backing memory. + +For Gfx7/8, user queue buffer validation should use queue_size/2 to +verify ring_bo allocation and mapping size. + +Fixes: 68e599db7a54 ("drm/amdkfd: Validate user queue buffers") +Suggested-by: Tomáš Trnka +Signed-off-by: Philip Yang +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +(cherry picked from commit e7a477735f1771b9a9346a5fbd09d7ff0641723a) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c +@@ -233,6 +233,7 @@ void kfd_queue_buffer_put(struct amdgpu_ + int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_properties *properties) + { + struct kfd_topology_device *topo_dev; ++ u64 expected_queue_size; + struct amdgpu_vm *vm; + u32 total_cwsr_size; + int err; +@@ -241,6 +242,15 @@ int kfd_queue_acquire_buffers(struct kfd + if (!topo_dev) + return -EINVAL; + ++ /* AQL queues on GFX7 and GFX8 appear twice their actual size */ ++ if (properties->type == KFD_QUEUE_TYPE_COMPUTE && ++ properties->format == KFD_QUEUE_FORMAT_AQL && ++ topo_dev->node_props.gfx_target_version >= 70000 && ++ topo_dev->node_props.gfx_target_version < 90000) ++ expected_queue_size = properties->queue_size / 2; ++ else ++ expected_queue_size = properties->queue_size; ++ + vm = drm_priv_to_vm(pdd->drm_priv); + err = amdgpu_bo_reserve(vm->root.bo, false); + if (err) +@@ -255,7 +265,7 @@ int kfd_queue_acquire_buffers(struct kfd + goto out_err_unreserve; + + err = kfd_queue_buffer_get(vm, (void *)properties->queue_address, +- &properties->ring_bo, properties->queue_size); ++ &properties->ring_bo, expected_queue_size); + if (err) + goto out_err_unreserve; + diff --git a/queue-6.13/drm-radeon-fix-uninitialized-size-issue-in-radeon_vce_cs_parse.patch b/queue-6.13/drm-radeon-fix-uninitialized-size-issue-in-radeon_vce_cs_parse.patch new file mode 100644 index 0000000000..061825d024 --- /dev/null +++ b/queue-6.13/drm-radeon-fix-uninitialized-size-issue-in-radeon_vce_cs_parse.patch @@ -0,0 +1,44 @@ +From dd8689b52a24807c2d5ce0a17cb26dc87f75235c Mon Sep 17 00:00:00 2001 +From: Nikita Zhandarovich +Date: Tue, 11 Mar 2025 14:14:59 +0300 +Subject: drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() + +From: Nikita Zhandarovich + +commit dd8689b52a24807c2d5ce0a17cb26dc87f75235c upstream. + +On the off chance that command stream passed from userspace via +ioctl() call to radeon_vce_cs_parse() is weirdly crafted and +first command to execute is to encode (case 0x03000001), the function +in question will attempt to call radeon_vce_cs_reloc() with size +argument that has not been properly initialized. Specifically, 'size' +will point to 'tmp' variable before the latter had a chance to be +assigned any value. + +Play it safe and init 'tmp' with 0, thus ensuring that +radeon_vce_cs_reloc() will catch an early error in cases like these. + +Found by Linux Verification Center (linuxtesting.org) with static +analysis tool SVACE. + +Fixes: 2fc5703abda2 ("drm/radeon: check VCE relocation buffer range v3") +Signed-off-by: Nikita Zhandarovich +Signed-off-by: Alex Deucher +(cherry picked from commit 2d52de55f9ee7aaee0e09ac443f77855989c6b68) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/radeon/radeon_vce.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/radeon_vce.c ++++ b/drivers/gpu/drm/radeon/radeon_vce.c +@@ -557,7 +557,7 @@ int radeon_vce_cs_parse(struct radeon_cs + { + int session_idx = -1; + bool destroyed = false, created = false, allocated = false; +- uint32_t tmp, handle = 0; ++ uint32_t tmp = 0, handle = 0; + uint32_t *size = &tmp; + int i, r = 0; + diff --git a/queue-6.13/drm-sched-fix-fence-reference-count-leak.patch b/queue-6.13/drm-sched-fix-fence-reference-count-leak.patch new file mode 100644 index 0000000000..8d89e502b8 --- /dev/null +++ b/queue-6.13/drm-sched-fix-fence-reference-count-leak.patch @@ -0,0 +1,47 @@ +From a952f1ab696873be124e31ce5ef964d36bce817f Mon Sep 17 00:00:00 2001 +From: qianyi liu +Date: Tue, 11 Mar 2025 14:02:51 +0800 +Subject: drm/sched: Fix fence reference count leak + +From: qianyi liu + +commit a952f1ab696873be124e31ce5ef964d36bce817f upstream. + +The last_scheduled fence leaks when an entity is being killed and adding +the cleanup callback fails. + +Decrement the reference count of prev when dma_fence_add_callback() +fails, ensuring proper balance. + +Cc: stable@vger.kernel.org # v6.2+ +[phasta: add git tag info for stable kernel] +Fixes: 2fdb8a8f07c2 ("drm/scheduler: rework entity flush, kill and fini") +Signed-off-by: qianyi liu +Signed-off-by: Philipp Stanner +Link: https://patchwork.freedesktop.org/patch/msgid/20250311060251.4041101-1-liuqianyi125@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/scheduler/sched_entity.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/scheduler/sched_entity.c ++++ b/drivers/gpu/drm/scheduler/sched_entity.c +@@ -259,9 +259,16 @@ static void drm_sched_entity_kill(struct + struct drm_sched_fence *s_fence = job->s_fence; + + dma_fence_get(&s_fence->finished); +- if (!prev || dma_fence_add_callback(prev, &job->finish_cb, +- drm_sched_entity_kill_jobs_cb)) ++ if (!prev || ++ dma_fence_add_callback(prev, &job->finish_cb, ++ drm_sched_entity_kill_jobs_cb)) { ++ /* ++ * Adding callback above failed. ++ * dma_fence_put() checks for NULL. ++ */ ++ dma_fence_put(prev); + drm_sched_entity_kill_jobs_cb(NULL, &job->finish_cb); ++ } + + prev = &s_fence->finished; + } diff --git a/queue-6.13/drm-v3d-don-t-run-jobs-that-have-errors-flagged-in-its-fence.patch b/queue-6.13/drm-v3d-don-t-run-jobs-that-have-errors-flagged-in-its-fence.patch new file mode 100644 index 0000000000..288a80c592 --- /dev/null +++ b/queue-6.13/drm-v3d-don-t-run-jobs-that-have-errors-flagged-in-its-fence.patch @@ -0,0 +1,68 @@ +From 80cbee810e4e13cdbd3ae9654e9ecddf17f3e828 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ma=C3=ADra=20Canal?= +Date: Thu, 13 Mar 2025 11:43:26 -0300 +Subject: drm/v3d: Don't run jobs that have errors flagged in its fence +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maíra Canal + +commit 80cbee810e4e13cdbd3ae9654e9ecddf17f3e828 upstream. + +The V3D driver still relies on `drm_sched_increase_karma()` and +`drm_sched_resubmit_jobs()` for resubmissions when a timeout occurs. +The function `drm_sched_increase_karma()` marks the job as guilty, while +`drm_sched_resubmit_jobs()` sets an error (-ECANCELED) in the DMA fence of +that guilty job. + +Because of this, we must check whether the job’s DMA fence has been +flagged with an error before executing the job. Otherwise, the same guilty +job may be resubmitted indefinitely, causing repeated GPU resets. + +This patch adds a check for an error on the job's fence to prevent running +a guilty job that was previously flagged when the GPU timed out. + +Note that the CPU and CACHE_CLEAN queues do not require this check, as +their jobs are executed synchronously once the DRM scheduler starts them. + +Cc: stable@vger.kernel.org +Fixes: d223f98f0209 ("drm/v3d: Add support for compute shader dispatch.") +Fixes: 1584f16ca96e ("drm/v3d: Add support for submitting jobs to the TFU.") +Reviewed-by: Iago Toral Quiroga +Signed-off-by: Maíra Canal +Link: https://patchwork.freedesktop.org/patch/msgid/20250313-v3d-gpu-reset-fixes-v4-1-c1e780d8e096@igalia.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/v3d/v3d_sched.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/v3d/v3d_sched.c ++++ b/drivers/gpu/drm/v3d/v3d_sched.c +@@ -319,11 +319,15 @@ v3d_tfu_job_run(struct drm_sched_job *sc + struct drm_device *dev = &v3d->drm; + struct dma_fence *fence; + ++ if (unlikely(job->base.base.s_fence->finished.error)) ++ return NULL; ++ ++ v3d->tfu_job = job; ++ + fence = v3d_fence_create(v3d, V3D_TFU); + if (IS_ERR(fence)) + return NULL; + +- v3d->tfu_job = job; + if (job->base.irq_fence) + dma_fence_put(job->base.irq_fence); + job->base.irq_fence = dma_fence_get(fence); +@@ -361,6 +365,9 @@ v3d_csd_job_run(struct drm_sched_job *sc + struct dma_fence *fence; + int i, csd_cfg0_reg; + ++ if (unlikely(job->base.base.s_fence->finished.error)) ++ return NULL; ++ + v3d->csd_job = job; + + v3d_invalidate_caches(v3d); diff --git a/queue-6.13/drm-xe-fix-exporting-xe-buffers-multiple-times.patch b/queue-6.13/drm-xe-fix-exporting-xe-buffers-multiple-times.patch new file mode 100644 index 0000000000..f26ab40f74 --- /dev/null +++ b/queue-6.13/drm-xe-fix-exporting-xe-buffers-multiple-times.patch @@ -0,0 +1,68 @@ +From 50af7cab7520e46680cf4633bba6801443b75856 Mon Sep 17 00:00:00 2001 +From: Tomasz Rusinowicz +Date: Tue, 18 Feb 2025 11:03:53 +0100 +Subject: drm/xe: Fix exporting xe buffers multiple times +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tomasz Rusinowicz + +commit 50af7cab7520e46680cf4633bba6801443b75856 upstream. + +The `struct ttm_resource->placement` contains TTM_PL_FLAG_* flags, but +it was incorrectly tested for XE_PL_* flags. +This caused xe_dma_buf_pin() to always fail when invoked for +the second time. Fix this by checking the `mem_type` field instead. + +Fixes: 7764222d54b7 ("drm/xe: Disallow pinning dma-bufs in VRAM") +Cc: Thomas Hellström +Cc: Rodrigo Vivi +Cc: Lucas De Marchi +Cc: "Thomas Hellström" +Cc: Michal Wajdeczko +Cc: Matthew Brost +Cc: Matthew Auld +Cc: Nirmoy Das +Cc: Jani Nikula +Cc: intel-xe@lists.freedesktop.org +Cc: # v6.8+ +Signed-off-by: Tomasz Rusinowicz +Signed-off-by: Jacek Lawrynowicz +Reviewed-by: Matthew Brost +Link: https://patchwork.freedesktop.org/patch/msgid/20250218100353.2137964-1-jacek.lawrynowicz@linux.intel.com +Signed-off-by: Thomas Hellström +(cherry picked from commit b96dabdba9b95f71ded50a1c094ee244408b2a8e) +Signed-off-by: Thomas Hellström +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_bo.h | 2 -- + drivers/gpu/drm/xe/xe_dma_buf.c | 2 +- + 2 files changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/gpu/drm/xe/xe_bo.h ++++ b/drivers/gpu/drm/xe/xe_bo.h +@@ -318,7 +318,6 @@ static inline unsigned int xe_sg_segment + return round_down(max / 2, PAGE_SIZE); + } + +-#if IS_ENABLED(CONFIG_DRM_XE_KUNIT_TEST) + /** + * xe_bo_is_mem_type - Whether the bo currently resides in the given + * TTM memory type +@@ -333,4 +332,3 @@ static inline bool xe_bo_is_mem_type(str + return bo->ttm.resource->mem_type == mem_type; + } + #endif +-#endif +--- a/drivers/gpu/drm/xe/xe_dma_buf.c ++++ b/drivers/gpu/drm/xe/xe_dma_buf.c +@@ -58,7 +58,7 @@ static int xe_dma_buf_pin(struct dma_buf + * 1) Avoid pinning in a placement not accessible to some importers. + * 2) Pinning in VRAM requires PIN accounting which is a to-do. + */ +- if (xe_bo_is_pinned(bo) && bo->ttm.resource->placement != XE_PL_TT) { ++ if (xe_bo_is_pinned(bo) && !xe_bo_is_mem_type(bo, XE_PL_TT)) { + drm_dbg(&xe->drm, "Can't migrate pinned bo for dma-buf pin.\n"); + return -EINVAL; + } diff --git a/queue-6.13/dt-bindings-can-renesas-rcar-canfd-fix-typo-in-pattern-properties-for-r-car-v4m.patch b/queue-6.13/dt-bindings-can-renesas-rcar-canfd-fix-typo-in-pattern-properties-for-r-car-v4m.patch new file mode 100644 index 0000000000..2e138acdf5 --- /dev/null +++ b/queue-6.13/dt-bindings-can-renesas-rcar-canfd-fix-typo-in-pattern-properties-for-r-car-v4m.patch @@ -0,0 +1,35 @@ +From 51f6fc9eb1d77ae5cacc796fc043dedc1f0f0073 Mon Sep 17 00:00:00 2001 +From: Biju Das +Date: Fri, 7 Mar 2025 17:03:26 +0000 +Subject: dt-bindings: can: renesas,rcar-canfd: Fix typo in pattern properties for R-Car V4M + +From: Biju Das + +commit 51f6fc9eb1d77ae5cacc796fc043dedc1f0f0073 upstream. + +The Renesas R-Car V4M(R8A779H0) SoC, supports up to four channels. +Fix the typo 5->4 in pattern properties. + +Fixes: ced52c6ed257 ("dt-bindings: can: renesas,rcar-canfd: Document R-Car V4M support") +Cc: stable@vger.kernel.org +Reviewed-by: Geert Uytterhoeven +Acked-by: "Rob Herring (Arm)" +Signed-off-by: Biju Das +Link: https://patch.msgid.link/20250307170330.173425-2-biju.das.jz@bp.renesas.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/net/can/renesas,rcar-canfd.yaml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/Documentation/devicetree/bindings/net/can/renesas,rcar-canfd.yaml ++++ b/Documentation/devicetree/bindings/net/can/renesas,rcar-canfd.yaml +@@ -170,7 +170,7 @@ allOf: + const: renesas,r8a779h0-canfd + then: + patternProperties: +- "^channel[5-7]$": false ++ "^channel[4-7]$": false + else: + if: + not: diff --git a/queue-6.13/efi-libstub-avoid-physical-address-0x0-when-doing-random-allocation.patch b/queue-6.13/efi-libstub-avoid-physical-address-0x0-when-doing-random-allocation.patch new file mode 100644 index 0000000000..59131b673b --- /dev/null +++ b/queue-6.13/efi-libstub-avoid-physical-address-0x0-when-doing-random-allocation.patch @@ -0,0 +1,45 @@ +From cb16dfed0093217a68c0faa9394fa5823927e04c Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Fri, 14 Mar 2025 12:03:33 +0100 +Subject: efi/libstub: Avoid physical address 0x0 when doing random allocation + +From: Ard Biesheuvel + +commit cb16dfed0093217a68c0faa9394fa5823927e04c upstream. + +Ben reports spurious EFI zboot failures on a system where physical RAM +starts at 0x0. When doing random memory allocation from the EFI stub on +such a platform, a random seed of 0x0 (which means no entropy source is +available) will result in the allocation to be placed at address 0x0 if +sufficient space is available. + +When this allocation is subsequently passed on to the decompression +code, the 0x0 address is mistaken for NULL and the code complains and +gives up. + +So avoid address 0x0 when doing random allocation, and set the minimum +address to the minimum alignment. + +Cc: +Reported-by: Ben Schneider +Tested-by: Ben Schneider +Reviewed-by: Ilias Apalodimas +Signed-off-by: Ard Biesheuvel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/firmware/efi/libstub/randomalloc.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/firmware/efi/libstub/randomalloc.c ++++ b/drivers/firmware/efi/libstub/randomalloc.c +@@ -75,6 +75,10 @@ efi_status_t efi_random_alloc(unsigned l + if (align < EFI_ALLOC_ALIGN) + align = EFI_ALLOC_ALIGN; + ++ /* Avoid address 0x0, as it can be mistaken for NULL */ ++ if (alloc_min == 0) ++ alloc_min = align; ++ + size = round_up(size, EFI_ALLOC_ALIGN); + + /* count the suitable slots in each memory map entry */ diff --git a/queue-6.13/firmware-qcom-uefisecapp-fix-efivars-registration-race.patch b/queue-6.13/firmware-qcom-uefisecapp-fix-efivars-registration-race.patch new file mode 100644 index 0000000000..6ff1e28b98 --- /dev/null +++ b/queue-6.13/firmware-qcom-uefisecapp-fix-efivars-registration-race.patch @@ -0,0 +1,65 @@ +From da8d493a80993972c427002684d0742560f3be4a Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 20 Jan 2025 16:10:00 +0100 +Subject: firmware: qcom: uefisecapp: fix efivars registration race + +From: Johan Hovold + +commit da8d493a80993972c427002684d0742560f3be4a upstream. + +Since the conversion to using the TZ allocator, the efivars service is +registered before the memory pool has been allocated, something which +can lead to a NULL-pointer dereference in case of a racing EFI variable +access. + +Make sure that all resources have been set up before registering the +efivars. + +Fixes: 6612103ec35a ("firmware: qcom: qseecom: convert to using the TZ allocator") +Cc: stable@vger.kernel.org # 6.11 +Cc: Bartosz Golaszewski +Signed-off-by: Johan Hovold +Reviewed-by: Konrad Dybcio +Reviewed-by: Maximilian Luz +Reviewed-by: Bartosz Golaszewski +Link: https://lore.kernel.org/r/20250120151000.13870-1-johan+linaro@kernel.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/firmware/qcom/qcom_qseecom_uefisecapp.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +--- a/drivers/firmware/qcom/qcom_qseecom_uefisecapp.c ++++ b/drivers/firmware/qcom/qcom_qseecom_uefisecapp.c +@@ -814,15 +814,6 @@ static int qcom_uefisecapp_probe(struct + + qcuefi->client = container_of(aux_dev, struct qseecom_client, aux_dev); + +- auxiliary_set_drvdata(aux_dev, qcuefi); +- status = qcuefi_set_reference(qcuefi); +- if (status) +- return status; +- +- status = efivars_register(&qcuefi->efivars, &qcom_efivar_ops); +- if (status) +- qcuefi_set_reference(NULL); +- + memset(&pool_config, 0, sizeof(pool_config)); + pool_config.initial_size = SZ_4K; + pool_config.policy = QCOM_TZMEM_POLICY_MULTIPLIER; +@@ -833,6 +824,15 @@ static int qcom_uefisecapp_probe(struct + if (IS_ERR(qcuefi->mempool)) + return PTR_ERR(qcuefi->mempool); + ++ auxiliary_set_drvdata(aux_dev, qcuefi); ++ status = qcuefi_set_reference(qcuefi); ++ if (status) ++ return status; ++ ++ status = efivars_register(&qcuefi->efivars, &qcom_efivar_ops); ++ if (status) ++ qcuefi_set_reference(NULL); ++ + return status; + } + diff --git a/queue-6.13/i2c-omap-fix-irq-storms.patch b/queue-6.13/i2c-omap-fix-irq-storms.patch new file mode 100644 index 0000000000..72ddcc8fea --- /dev/null +++ b/queue-6.13/i2c-omap-fix-irq-storms.patch @@ -0,0 +1,112 @@ +From 285df995f90e3d61d97f327d34b9659d92313314 Mon Sep 17 00:00:00 2001 +From: Andreas Kemnade +Date: Fri, 28 Feb 2025 15:04:20 +0100 +Subject: i2c: omap: fix IRQ storms + +From: Andreas Kemnade + +commit 285df995f90e3d61d97f327d34b9659d92313314 upstream. + +On the GTA04A5 writing a reset command to the gyroscope causes IRQ +storms because NACK IRQs are enabled and therefore triggered but not +acked. + +Sending a reset command to the gyroscope by +i2cset 1 0x69 0x14 0xb6 +with an additional debug print in the ISR (not the thread) itself +causes + +[ 363.353515] i2c i2c-1: ioctl, cmd=0x720, arg=0xbe801b00 +[ 363.359039] omap_i2c 48072000.i2c: addr: 0x0069, len: 2, flags: 0x0, stop: 1 +[ 363.366180] omap_i2c 48072000.i2c: IRQ LL (ISR = 0x1110) +[ 363.371673] omap_i2c 48072000.i2c: IRQ (ISR = 0x0010) +[ 363.376892] omap_i2c 48072000.i2c: IRQ LL (ISR = 0x0102) +[ 363.382263] omap_i2c 48072000.i2c: IRQ LL (ISR = 0x0102) +[ 363.387664] omap_i2c 48072000.i2c: IRQ LL (ISR = 0x0102) +repeating till infinity +[...] +(0x2 = NACK, 0x100 = Bus free, which is not enabled) +Apparently no other IRQ bit gets set, so this stalls. + +Do not ignore enabled interrupts and make sure they are acked. +If the NACK IRQ is not needed, it should simply not enabled, but +according to the above log, caring about it is necessary unless +the Bus free IRQ is enabled and handled. The assumption that is +will always come with a ARDY IRQ, which was the idea behind +ignoring it, proves wrong. +It is true for simple reads from an unused address. + +To still avoid the i2cdetect trouble which is the reason for +commit c770657bd261 ("i2c: omap: Fix standard mode false ACK readings"), +avoid doing much about NACK in omap_i2c_xfer_data() which is used +by both IRQ mode and polling mode, so also the false detection fix +is extended to polling usage and IRQ storms are avoided. + +By changing this, the hardirq handler is not needed anymore to filter +stuff. + +The mentioned gyro reset now just causes a -ETIMEDOUT instead of +hanging the system. + +Fixes: c770657bd261 ("i2c: omap: Fix standard mode false ACK readings"). +CC: stable@kernel.org +Signed-off-by: Andreas Kemnade +Tested-by: Nishanth Menon +Reviewed-by: Aniket Limaye +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20250228140420.379498-1-andreas@kemnade.info +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-omap.c | 26 +++++++------------------- + 1 file changed, 7 insertions(+), 19 deletions(-) + +--- a/drivers/i2c/busses/i2c-omap.c ++++ b/drivers/i2c/busses/i2c-omap.c +@@ -1048,23 +1048,6 @@ static int omap_i2c_transmit_data(struct + return 0; + } + +-static irqreturn_t +-omap_i2c_isr(int irq, void *dev_id) +-{ +- struct omap_i2c_dev *omap = dev_id; +- irqreturn_t ret = IRQ_HANDLED; +- u16 mask; +- u16 stat; +- +- stat = omap_i2c_read_reg(omap, OMAP_I2C_STAT_REG); +- mask = omap_i2c_read_reg(omap, OMAP_I2C_IE_REG) & ~OMAP_I2C_STAT_NACK; +- +- if (stat & mask) +- ret = IRQ_WAKE_THREAD; +- +- return ret; +-} +- + static int omap_i2c_xfer_data(struct omap_i2c_dev *omap) + { + u16 bits; +@@ -1095,8 +1078,13 @@ static int omap_i2c_xfer_data(struct oma + } + + if (stat & OMAP_I2C_STAT_NACK) { +- err |= OMAP_I2C_STAT_NACK; ++ omap->cmd_err |= OMAP_I2C_STAT_NACK; + omap_i2c_ack_stat(omap, OMAP_I2C_STAT_NACK); ++ ++ if (!(stat & ~OMAP_I2C_STAT_NACK)) { ++ err = -EAGAIN; ++ break; ++ } + } + + if (stat & OMAP_I2C_STAT_AL) { +@@ -1472,7 +1460,7 @@ omap_i2c_probe(struct platform_device *p + IRQF_NO_SUSPEND, pdev->name, omap); + else + r = devm_request_threaded_irq(&pdev->dev, omap->irq, +- omap_i2c_isr, omap_i2c_isr_thread, ++ NULL, omap_i2c_isr_thread, + IRQF_NO_SUSPEND | IRQF_ONESHOT, + pdev->name, omap); + diff --git a/queue-6.13/io_uring-net-don-t-clear-req_f_need_cleanup-unconditionally.patch b/queue-6.13/io_uring-net-don-t-clear-req_f_need_cleanup-unconditionally.patch new file mode 100644 index 0000000000..f51518ab8d --- /dev/null +++ b/queue-6.13/io_uring-net-don-t-clear-req_f_need_cleanup-unconditionally.patch @@ -0,0 +1,43 @@ +From cc34d8330e036b6bffa88db9ea537bae6b03948f Mon Sep 17 00:00:00 2001 +From: Jens Axboe +Date: Thu, 20 Mar 2025 12:25:12 -0600 +Subject: io_uring/net: don't clear REQ_F_NEED_CLEANUP unconditionally + +From: Jens Axboe + +commit cc34d8330e036b6bffa88db9ea537bae6b03948f upstream. + +io_req_msg_cleanup() relies on the fact that io_netmsg_recycle() will +always fully recycle, but that may not be the case if the msg cache +was already full. To ensure that normal cleanup always gets run, +let io_netmsg_recycle() deal with clearing the relevant cleanup flags, +as it knows exactly when that should be done. + +Cc: stable@vger.kernel.org +Reported-by: David Wei +Fixes: 75191341785e ("io_uring/net: add iovec recycling") +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + io_uring/net.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/io_uring/net.c ++++ b/io_uring/net.c +@@ -151,7 +151,7 @@ static void io_netmsg_recycle(struct io_ + if (iov) + kasan_mempool_poison_object(iov); + req->async_data = NULL; +- req->flags &= ~REQ_F_ASYNC_DATA; ++ req->flags &= ~(REQ_F_ASYNC_DATA|REQ_F_NEED_CLEANUP); + } + } + +@@ -453,7 +453,6 @@ int io_sendmsg_prep(struct io_kiocb *req + static void io_req_msg_cleanup(struct io_kiocb *req, + unsigned int issue_flags) + { +- req->flags &= ~REQ_F_NEED_CLEANUP; + io_netmsg_recycle(req, issue_flags); + } + diff --git a/queue-6.13/keys-fix-uaf-in-key_put.patch b/queue-6.13/keys-fix-uaf-in-key_put.patch new file mode 100644 index 0000000000..c7f9c19424 --- /dev/null +++ b/queue-6.13/keys-fix-uaf-in-key_put.patch @@ -0,0 +1,70 @@ +From 75845c6c1a64483e9985302793dbf0dfa5f71e32 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Wed, 19 Mar 2025 15:57:46 +0000 +Subject: keys: Fix UAF in key_put() + +From: David Howells + +commit 75845c6c1a64483e9985302793dbf0dfa5f71e32 upstream. + +Once a key's reference count has been reduced to 0, the garbage collector +thread may destroy it at any time and so key_put() is not allowed to touch +the key after that point. The most key_put() is normally allowed to do is +to touch key_gc_work as that's a static global variable. + +However, in an effort to speed up the reclamation of quota, this is now +done in key_put() once the key's usage is reduced to 0 - but now the code +is looking at the key after the deadline, which is forbidden. + +Fix this by using a flag to indicate that a key can be gc'd now rather than +looking at the key's refcount in the garbage collector. + +Fixes: 9578e327b2b4 ("keys: update key quotas in key_put()") +Reported-by: syzbot+6105ffc1ded71d194d6d@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/all/673b6aec.050a0220.87769.004a.GAE@google.com/ +Signed-off-by: David Howells +Tested-by: syzbot+6105ffc1ded71d194d6d@syzkaller.appspotmail.com +Reviewed-by: Oleg Nesterov +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/key.h | 1 + + security/keys/gc.c | 4 +++- + security/keys/key.c | 2 ++ + 3 files changed, 6 insertions(+), 1 deletion(-) + +--- a/include/linux/key.h ++++ b/include/linux/key.h +@@ -236,6 +236,7 @@ struct key { + #define KEY_FLAG_ROOT_CAN_INVAL 7 /* set if key can be invalidated by root without permission */ + #define KEY_FLAG_KEEP 8 /* set if key should not be removed */ + #define KEY_FLAG_UID_KEYRING 9 /* set if key is a user or user session keyring */ ++#define KEY_FLAG_FINAL_PUT 10 /* set if final put has happened on key */ + + /* the key type and key description string + * - the desc is used to match a key against search criteria +--- a/security/keys/gc.c ++++ b/security/keys/gc.c +@@ -218,8 +218,10 @@ continue_scanning: + key = rb_entry(cursor, struct key, serial_node); + cursor = rb_next(cursor); + +- if (refcount_read(&key->usage) == 0) ++ if (test_bit(KEY_FLAG_FINAL_PUT, &key->flags)) { ++ smp_mb(); /* Clobber key->user after FINAL_PUT seen. */ + goto found_unreferenced_key; ++ } + + if (unlikely(gc_state & KEY_GC_REAPING_DEAD_1)) { + if (key->type == key_gc_dead_keytype) { +--- a/security/keys/key.c ++++ b/security/keys/key.c +@@ -658,6 +658,8 @@ void key_put(struct key *key) + key->user->qnbytes -= key->quotalen; + spin_unlock_irqrestore(&key->user->lock, flags); + } ++ smp_mb(); /* key->user before FINAL_PUT set. */ ++ set_bit(KEY_FLAG_FINAL_PUT, &key->flags); + schedule_work(&key_gc_work); + } + } diff --git a/queue-6.13/media-rtl2832_sdr-assign-vb2-lock-before-vb2_queue_init.patch b/queue-6.13/media-rtl2832_sdr-assign-vb2-lock-before-vb2_queue_init.patch new file mode 100644 index 0000000000..68dcf9337b --- /dev/null +++ b/queue-6.13/media-rtl2832_sdr-assign-vb2-lock-before-vb2_queue_init.patch @@ -0,0 +1,47 @@ +From d9e7c172a7f247f7ef0b151fa8c8f044b6a2a070 Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Mon, 24 Feb 2025 15:40:58 +0100 +Subject: media: rtl2832_sdr: assign vb2 lock before vb2_queue_init + +From: Hans Verkuil + +commit d9e7c172a7f247f7ef0b151fa8c8f044b6a2a070 upstream. + +Commit c780d01cf1a6 ("media: vb2: vb2_core_queue_init(): sanity check lock +and wait_prepare/finish") added a sanity check to ensure that if there are +no wait_prepare/finish callbacks set by the driver, then the vb2_queue lock +must be set, since otherwise the vb2 core cannot do correct locking. + +The rtl2832_sdr.c triggered this warning: it turns out that while the +driver does set this lock, it sets it too late. So move it up to before +the vb2_queue_init() call. + +Reported-by: Arthur Marsh +Closes: https://lore.kernel.org/linux-media/20241211042355.8479-1-user@am64/ +Fixes: 8fcd2795d22a ("media: rtl2832_sdr: drop vb2_ops_wait_prepare/finish") +Cc: stable@vger.kernel.org +Reviewed-by: Mauro Carvalho Chehab +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/dvb-frontends/rtl2832_sdr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/dvb-frontends/rtl2832_sdr.c ++++ b/drivers/media/dvb-frontends/rtl2832_sdr.c +@@ -1363,6 +1363,7 @@ static int rtl2832_sdr_probe(struct plat + dev->vb_queue.ops = &rtl2832_sdr_vb2_ops; + dev->vb_queue.mem_ops = &vb2_vmalloc_memops; + dev->vb_queue.timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC; ++ dev->vb_queue.lock = &dev->vb_queue_lock; + ret = vb2_queue_init(&dev->vb_queue); + if (ret) { + dev_err(&pdev->dev, "Could not initialize vb2 queue\n"); +@@ -1421,7 +1422,6 @@ static int rtl2832_sdr_probe(struct plat + /* Init video_device structure */ + dev->vdev = rtl2832_sdr_template; + dev->vdev.queue = &dev->vb_queue; +- dev->vdev.queue->lock = &dev->vb_queue_lock; + video_set_drvdata(&dev->vdev, dev); + + /* Register the v4l2_device structure */ diff --git a/queue-6.13/memcg-drain-obj-stock-on-cpu-hotplug-teardown.patch b/queue-6.13/memcg-drain-obj-stock-on-cpu-hotplug-teardown.patch new file mode 100644 index 0000000000..dcb9b6ee1f --- /dev/null +++ b/queue-6.13/memcg-drain-obj-stock-on-cpu-hotplug-teardown.patch @@ -0,0 +1,50 @@ +From 9f01b4954490d4ccdbcc2b9be34a9921ceee9cbb Mon Sep 17 00:00:00 2001 +From: Shakeel Butt +Date: Mon, 10 Mar 2025 16:09:34 -0700 +Subject: memcg: drain obj stock on cpu hotplug teardown + +From: Shakeel Butt + +commit 9f01b4954490d4ccdbcc2b9be34a9921ceee9cbb upstream. + +Currently on cpu hotplug teardown, only memcg stock is drained but we +need to drain the obj stock as well otherwise we will miss the stats +accumulated on the target cpu as well as the nr_bytes cached. The stats +include MEMCG_KMEM, NR_SLAB_RECLAIMABLE_B & NR_SLAB_UNRECLAIMABLE_B. In +addition we are leaking reference to struct obj_cgroup object. + +Link: https://lkml.kernel.org/r/20250310230934.2913113-1-shakeel.butt@linux.dev +Fixes: bf4f059954dc ("mm: memcg/slab: obj_cgroup API") +Signed-off-by: Shakeel Butt +Reviewed-by: Roman Gushchin +Acked-by: Johannes Weiner +Cc: Michal Hocko +Cc: Muchun Song +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/memcontrol.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -1909,9 +1909,18 @@ void drain_all_stock(struct mem_cgroup * + static int memcg_hotplug_cpu_dead(unsigned int cpu) + { + struct memcg_stock_pcp *stock; ++ struct obj_cgroup *old; ++ unsigned long flags; + + stock = &per_cpu(memcg_stock, cpu); ++ ++ /* drain_obj_stock requires stock_lock */ ++ local_lock_irqsave(&memcg_stock.stock_lock, flags); ++ old = drain_obj_stock(stock); ++ local_unlock_irqrestore(&memcg_stock.stock_lock, flags); ++ + drain_stock(stock); ++ obj_cgroup_put(old); + + return 0; + } diff --git a/queue-6.13/mm-fix-error-handling-in-__filemap_get_folio-with-fgp_nowait.patch b/queue-6.13/mm-fix-error-handling-in-__filemap_get_folio-with-fgp_nowait.patch new file mode 100644 index 0000000000..2f97f38de7 --- /dev/null +++ b/queue-6.13/mm-fix-error-handling-in-__filemap_get_folio-with-fgp_nowait.patch @@ -0,0 +1,91 @@ +From 182db972c9568dc530b2f586a2f82dfd039d9f2a Mon Sep 17 00:00:00 2001 +From: "Raphael S. Carvalho" +Date: Mon, 24 Feb 2025 11:37:00 -0300 +Subject: mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Raphael S. Carvalho + +commit 182db972c9568dc530b2f586a2f82dfd039d9f2a upstream. + +original report: +https://lore.kernel.org/all/CAKhLTr1UL3ePTpYjXOx2AJfNk8Ku2EdcEfu+CH1sf3Asr=B-Dw@mail.gmail.com/T/ + +When doing buffered writes with FGP_NOWAIT, under memory pressure, the +system returned ENOMEM despite there being plenty of available memory, to +be reclaimed from page cache. The user space used io_uring interface, +which in turn submits I/O with FGP_NOWAIT (the fast path). + +retsnoop pointed to iomap_get_folio: + +00:34:16.180612 -> 00:34:16.180651 TID/PID 253786/253721 +(reactor-1/combined_tests): + + entry_SYSCALL_64_after_hwframe+0x76 + do_syscall_64+0x82 + __do_sys_io_uring_enter+0x265 + io_submit_sqes+0x209 + io_issue_sqe+0x5b + io_write+0xdd + xfs_file_buffered_write+0x84 + iomap_file_buffered_write+0x1a6 + 32us [-ENOMEM] iomap_write_begin+0x408 +iter=&{.inode=0xffff8c67aa031138,.len=4096,.flags=33,.iomap={.addr=0xffffffffffffffff,.length=4096,.type=1,.flags=3,.bdev=0x… +pos=0 len=4096 foliop=0xffffb32c296b7b80 +! 4us [-ENOMEM] iomap_get_folio +iter=&{.inode=0xffff8c67aa031138,.len=4096,.flags=33,.iomap={.addr=0xffffffffffffffff,.length=4096,.type=1,.flags=3,.bdev=0x… +pos=0 len=4096 + +This is likely a regression caused by 66dabbb65d67 ("mm: return an ERR_PTR +from __filemap_get_folio"), which moved error handling from +io_map_get_folio() to __filemap_get_folio(), but broke FGP_NOWAIT +handling, so ENOMEM is being escaped to user space. Had it correctly +returned -EAGAIN with NOWAIT, either io_uring or user space itself would +be able to retry the request. + +It's not enough to patch io_uring since the iomap interface is the one +responsible for it, and pwritev2(RWF_NOWAIT) and AIO interfaces must +return the proper error too. + +The patch was tested with scylladb test suite (its original reproducer), +and the tests all pass now when memory is pressured. + +Link: https://lkml.kernel.org/r/20250224143700.23035-1-raphaelsc@scylladb.com +Fixes: 66dabbb65d67 ("mm: return an ERR_PTR from __filemap_get_folio") +Signed-off-by: Raphael S. Carvalho +Reviewed-by: Christoph Hellwig +Reviewed-by: Dave Chinner +Cc: "Darrick J. Wong" +Cc: Matthew Wilcow (Oracle) +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/filemap.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +--- a/mm/filemap.c ++++ b/mm/filemap.c +@@ -1956,8 +1956,19 @@ no_page: + + if (err == -EEXIST) + goto repeat; +- if (err) ++ if (err) { ++ /* ++ * When NOWAIT I/O fails to allocate folios this could ++ * be due to a nonblocking memory allocation and not ++ * because the system actually is out of memory. ++ * Return -EAGAIN so that there caller retries in a ++ * blocking fashion instead of propagating -ENOMEM ++ * to the application. ++ */ ++ if ((fgp_flags & FGP_NOWAIT) && err == -ENOMEM) ++ err = -EAGAIN; + return ERR_PTR(err); ++ } + /* + * filemap_add_folio locks the page, and for mmap + * we expect an unlocked page. diff --git a/queue-6.13/mm-huge_memory-drop-beyond-eof-folios-with-the-right-number-of-refs.patch b/queue-6.13/mm-huge_memory-drop-beyond-eof-folios-with-the-right-number-of-refs.patch new file mode 100644 index 0000000000..8316f2221f --- /dev/null +++ b/queue-6.13/mm-huge_memory-drop-beyond-eof-folios-with-the-right-number-of-refs.patch @@ -0,0 +1,53 @@ +From 14efb4793519d73fb2902bb0ece319b886e4b4b9 Mon Sep 17 00:00:00 2001 +From: Zi Yan +Date: Mon, 10 Mar 2025 11:57:27 -0400 +Subject: mm/huge_memory: drop beyond-EOF folios with the right number of refs + +From: Zi Yan + +commit 14efb4793519d73fb2902bb0ece319b886e4b4b9 upstream. + +When an after-split folio is large and needs to be dropped due to EOF, +folio_put_refs(folio, folio_nr_pages(folio)) should be used to drop all +page cache refs. Otherwise, the folio will not be freed, causing memory +leak. + +This leak would happen on a filesystem with blocksize > page_size and a +truncate is performed, where the blocksize makes folios split to >0 order +ones, causing truncated folios not being freed. + +Link: https://lkml.kernel.org/r/20250310155727.472846-1-ziy@nvidia.com +Fixes: c010d47f107f ("mm: thp: split huge page to any lower order pages") +Signed-off-by: Zi Yan +Reported-by: Hugh Dickins +Closes: https://lore.kernel.org/all/fcbadb7f-dd3e-21df-f9a7-2853b53183c4@google.com/ +Cc: Baolin Wang +Cc: David Hildenbrand +Cc: John Hubbard +Cc: Kefeng Wang +Cc: Kirill A. Shuemov +Cc: Luis Chamberalin +Cc: Matthew Wilcow (Oracle) +Cc: Miaohe Lin +Cc: Pankaj Raghav +Cc: Ryan Roberts +Cc: Yang Shi +Cc: Yu Zhao +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/huge_memory.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -3298,7 +3298,7 @@ static void __split_huge_page(struct pag + folio_account_cleaned(tail, + inode_to_wb(folio->mapping->host)); + __filemap_remove_folio(tail, NULL); +- folio_put(tail); ++ folio_put_refs(tail, folio_nr_pages(tail)); + } else if (!folio_test_anon(folio)) { + __xa_store(&folio->mapping->i_pages, tail->index, + tail, 0); diff --git a/queue-6.13/mm-migrate-fix-shmem-xarray-update-during-migration.patch b/queue-6.13/mm-migrate-fix-shmem-xarray-update-during-migration.patch new file mode 100644 index 0000000000..4bea4a73e8 --- /dev/null +++ b/queue-6.13/mm-migrate-fix-shmem-xarray-update-during-migration.patch @@ -0,0 +1,76 @@ +From 60cf233b585cdf1f3c5e52d1225606b86acd08b0 Mon Sep 17 00:00:00 2001 +From: Zi Yan +Date: Wed, 5 Mar 2025 15:04:03 -0500 +Subject: mm/migrate: fix shmem xarray update during migration + +From: Zi Yan + +commit 60cf233b585cdf1f3c5e52d1225606b86acd08b0 upstream. + +A shmem folio can be either in page cache or in swap cache, but not at the +same time. Namely, once it is in swap cache, folio->mapping should be +NULL, and the folio is no longer in a shmem mapping. + +In __folio_migrate_mapping(), to determine the number of xarray entries to +update, folio_test_swapbacked() is used, but that conflates shmem in page +cache case and shmem in swap cache case. It leads to xarray multi-index +entry corruption, since it turns a sibling entry to a normal entry during +xas_store() (see [1] for a userspace reproduction). Fix it by only using +folio_test_swapcache() to determine whether xarray is storing swap cache +entries or not to choose the right number of xarray entries to update. + +[1] https://lore.kernel.org/linux-mm/Z8idPCkaJW1IChjT@casper.infradead.org/ + +Note: +In __split_huge_page(), folio_test_anon() && folio_test_swapcache() is +used to get swap_cache address space, but that ignores the shmem folio in +swap cache case. It could lead to NULL pointer dereferencing when a +in-swap-cache shmem folio is split at __xa_store(), since +!folio_test_anon() is true and folio->mapping is NULL. But fortunately, +its caller split_huge_page_to_list_to_order() bails out early with EBUSY +when folio->mapping is NULL. So no need to take care of it here. + +Link: https://lkml.kernel.org/r/20250305200403.2822855-1-ziy@nvidia.com +Fixes: fc346d0a70a1 ("mm: migrate high-order folios in swap cache correctly") +Signed-off-by: Zi Yan +Reported-by: Liu Shixin +Closes: https://lore.kernel.org/all/28546fb4-5210-bf75-16d6-43e1f8646080@huawei.com/ +Suggested-by: Hugh Dickins +Reviewed-by: Matthew Wilcox (Oracle) +Reviewed-by: Baolin Wang +Cc: Barry Song +Cc: Charan Teja Kalla +Cc: David Hildenbrand +Cc: Hugh Dickins +Cc: Kefeng Wang +Cc: Lance Yang +Cc: Ryan Roberts +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/migrate.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +--- a/mm/migrate.c ++++ b/mm/migrate.c +@@ -526,15 +526,13 @@ static int __folio_migrate_mapping(struc + if (folio_test_anon(folio) && folio_test_large(folio)) + mod_mthp_stat(folio_order(folio), MTHP_STAT_NR_ANON, 1); + folio_ref_add(newfolio, nr); /* add cache reference */ +- if (folio_test_swapbacked(folio)) { ++ if (folio_test_swapbacked(folio)) + __folio_set_swapbacked(newfolio); +- if (folio_test_swapcache(folio)) { +- folio_set_swapcache(newfolio); +- newfolio->private = folio_get_private(folio); +- } ++ if (folio_test_swapcache(folio)) { ++ folio_set_swapcache(newfolio); ++ newfolio->private = folio_get_private(folio); + entries = nr; + } else { +- VM_BUG_ON_FOLIO(folio_test_swapcache(folio), folio); + entries = 1; + } + diff --git a/queue-6.13/mm-page_alloc-fix-memory-accept-before-watermarks-gets-initialized.patch b/queue-6.13/mm-page_alloc-fix-memory-accept-before-watermarks-gets-initialized.patch new file mode 100644 index 0000000000..c84f9d274a --- /dev/null +++ b/queue-6.13/mm-page_alloc-fix-memory-accept-before-watermarks-gets-initialized.patch @@ -0,0 +1,68 @@ +From 800f1059c99e2b39899bdc67a7593a7bea6375d8 Mon Sep 17 00:00:00 2001 +From: "Kirill A. Shutemov" +Date: Mon, 10 Mar 2025 10:28:55 +0200 +Subject: mm/page_alloc: fix memory accept before watermarks gets initialized + +From: Kirill A. Shutemov + +commit 800f1059c99e2b39899bdc67a7593a7bea6375d8 upstream. + +Watermarks are initialized during the postcore initcall. Until then, all +watermarks are set to zero. This causes cond_accept_memory() to +incorrectly skip memory acceptance because a watermark of 0 is always met. + +This can lead to a premature OOM on boot. + +To ensure progress, accept one MAX_ORDER page if the watermark is zero. + +Link: https://lkml.kernel.org/r/20250310082855.2587122-1-kirill.shutemov@linux.intel.com +Fixes: dcdfdd40fa82 ("mm: Add support for unaccepted memory") +Signed-off-by: Kirill A. Shutemov +Tested-by: Farrah Chen +Reported-by: Farrah Chen +Acked-by: Vlastimil Babka +Reviewed-by: Pankaj Gupta +Cc: Ashish Kalra +Cc: David Hildenbrand +Cc: "Edgecombe, Rick P" +Cc: Mel Gorman +Cc: "Mike Rapoport (IBM)" +Cc: Thomas Lendacky +Cc: [6.5+] +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/page_alloc.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -6961,7 +6961,7 @@ static inline bool has_unaccepted_memory + + static bool cond_accept_memory(struct zone *zone, unsigned int order) + { +- long to_accept; ++ long to_accept, wmark; + bool ret = false; + + if (!has_unaccepted_memory()) +@@ -6970,8 +6970,18 @@ static bool cond_accept_memory(struct zo + if (list_empty(&zone->unaccepted_pages)) + return false; + ++ wmark = promo_wmark_pages(zone); ++ ++ /* ++ * Watermarks have not been initialized yet. ++ * ++ * Accepting one MAX_ORDER page to ensure progress. ++ */ ++ if (!wmark) ++ return try_to_accept_memory_one(zone); ++ + /* How much to accept to get to promo watermark? */ +- to_accept = promo_wmark_pages(zone) - ++ to_accept = wmark - + (zone_page_state(zone, NR_FREE_PAGES) - + __zone_watermark_unusable_free(zone, order, 0) - + zone_page_state(zone, NR_UNACCEPTED)); diff --git a/queue-6.13/mmc-atmel-mci-add-missing-clk_disable_unprepare.patch b/queue-6.13/mmc-atmel-mci-add-missing-clk_disable_unprepare.patch new file mode 100644 index 0000000000..997a38fedc --- /dev/null +++ b/queue-6.13/mmc-atmel-mci-add-missing-clk_disable_unprepare.patch @@ -0,0 +1,39 @@ +From e51a349d2dcf1df8422dabb90b2f691dc7df6f92 Mon Sep 17 00:00:00 2001 +From: Gu Bowen +Date: Tue, 25 Feb 2025 10:28:56 +0800 +Subject: mmc: atmel-mci: Add missing clk_disable_unprepare() + +From: Gu Bowen + +commit e51a349d2dcf1df8422dabb90b2f691dc7df6f92 upstream. + +The error path when atmci_configure_dma() set dma fails in atmci driver +does not correctly disable the clock. +Add the missing clk_disable_unprepare() to the error path for pair with +clk_prepare_enable(). + +Fixes: 467e081d23e6 ("mmc: atmel-mci: use probe deferring if dma controller is not ready yet") +Signed-off-by: Gu Bowen +Acked-by: Aubin Constans +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20250225022856.3452240-1-gubowen5@huawei.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/atmel-mci.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/mmc/host/atmel-mci.c ++++ b/drivers/mmc/host/atmel-mci.c +@@ -2499,8 +2499,10 @@ static int atmci_probe(struct platform_d + /* Get MCI capabilities and set operations according to it */ + atmci_get_cap(host); + ret = atmci_configure_dma(host); +- if (ret == -EPROBE_DEFER) ++ if (ret == -EPROBE_DEFER) { ++ clk_disable_unprepare(host->mck); + goto err_dma_probe_defer; ++ } + if (ret == 0) { + host->prepare_data = &atmci_prepare_data_dma; + host->submit_data = &atmci_submit_data_dma; diff --git a/queue-6.13/mmc-sdhci-brcmstb-add-cqhci-suspend-resume-to-pm-ops.patch b/queue-6.13/mmc-sdhci-brcmstb-add-cqhci-suspend-resume-to-pm-ops.patch new file mode 100644 index 0000000000..0a8d383c4f --- /dev/null +++ b/queue-6.13/mmc-sdhci-brcmstb-add-cqhci-suspend-resume-to-pm-ops.patch @@ -0,0 +1,57 @@ +From 723ef0e20dbb2aa1b5406d2bb75374fc48187daa Mon Sep 17 00:00:00 2001 +From: Kamal Dasu +Date: Tue, 11 Mar 2025 12:59:35 -0400 +Subject: mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops + +From: Kamal Dasu + +commit 723ef0e20dbb2aa1b5406d2bb75374fc48187daa upstream. + +cqhci timeouts observed on brcmstb platforms during suspend: + ... + [ 164.832853] mmc0: cqhci: timeout for tag 18 + ... + +Adding cqhci_suspend()/resume() calls to disable cqe +in sdhci_brcmstb_suspend()/resume() respectively to fix +CQE timeouts seen on PM suspend. + +Fixes: d46ba2d17f90 ("mmc: sdhci-brcmstb: Add support for Command Queuing (CQE)") +Cc: stable@vger.kernel.org +Signed-off-by: Kamal Dasu +Reviewed-by: Florian Fainelli +Link: https://lore.kernel.org/r/20250311165946.28190-1-kamal.dasu@broadcom.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci-brcmstb.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/mmc/host/sdhci-brcmstb.c ++++ b/drivers/mmc/host/sdhci-brcmstb.c +@@ -503,8 +503,15 @@ static int sdhci_brcmstb_suspend(struct + struct sdhci_host *host = dev_get_drvdata(dev); + struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); + struct sdhci_brcmstb_priv *priv = sdhci_pltfm_priv(pltfm_host); ++ int ret; + + clk_disable_unprepare(priv->base_clk); ++ if (host->mmc->caps2 & MMC_CAP2_CQE) { ++ ret = cqhci_suspend(host->mmc); ++ if (ret) ++ return ret; ++ } ++ + return sdhci_pltfm_suspend(dev); + } + +@@ -529,6 +536,9 @@ static int sdhci_brcmstb_resume(struct d + ret = clk_set_rate(priv->base_clk, priv->base_freq_hz); + } + ++ if (host->mmc->caps2 & MMC_CAP2_CQE) ++ ret = cqhci_resume(host->mmc); ++ + return ret; + } + #endif diff --git a/queue-6.13/net-mana-support-holes-in-device-list-reply-msg.patch b/queue-6.13/net-mana-support-holes-in-device-list-reply-msg.patch new file mode 100644 index 0000000000..3212aacdd3 --- /dev/null +++ b/queue-6.13/net-mana-support-holes-in-device-list-reply-msg.patch @@ -0,0 +1,107 @@ +From 2fc8a346625eb1abfe202062c7e6a13d76cde5ea Mon Sep 17 00:00:00 2001 +From: Haiyang Zhang +Date: Tue, 11 Mar 2025 13:12:54 -0700 +Subject: net: mana: Support holes in device list reply msg + +From: Haiyang Zhang + +commit 2fc8a346625eb1abfe202062c7e6a13d76cde5ea upstream. + +According to GDMA protocol, holes (zeros) are allowed at the beginning +or middle of the gdma_list_devices_resp message. The existing code +cannot properly handle this, and may miss some devices in the list. + +To fix, scan the entire list until the num_of_devs are found, or until +the end of the list. + +Cc: stable@vger.kernel.org +Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)") +Signed-off-by: Haiyang Zhang +Reviewed-by: Long Li +Reviewed-by: Shradha Gupta +Reviewed-by: Michal Swiatkowski +Link: https://patch.msgid.link/1741723974-1534-1-git-send-email-haiyangz@microsoft.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/microsoft/mana/gdma_main.c | 14 ++++++++++---- + include/net/mana/gdma.h | 11 +++++++---- + 2 files changed, 17 insertions(+), 8 deletions(-) + +--- a/drivers/net/ethernet/microsoft/mana/gdma_main.c ++++ b/drivers/net/ethernet/microsoft/mana/gdma_main.c +@@ -134,9 +134,10 @@ static int mana_gd_detect_devices(struct + struct gdma_list_devices_resp resp = {}; + struct gdma_general_req req = {}; + struct gdma_dev_id dev; +- u32 i, max_num_devs; ++ int found_dev = 0; + u16 dev_type; + int err; ++ u32 i; + + mana_gd_init_req_hdr(&req.hdr, GDMA_LIST_DEVICES, sizeof(req), + sizeof(resp)); +@@ -148,12 +149,17 @@ static int mana_gd_detect_devices(struct + return err ? err : -EPROTO; + } + +- max_num_devs = min_t(u32, MAX_NUM_GDMA_DEVICES, resp.num_of_devs); +- +- for (i = 0; i < max_num_devs; i++) { ++ for (i = 0; i < GDMA_DEV_LIST_SIZE && ++ found_dev < resp.num_of_devs; i++) { + dev = resp.devs[i]; + dev_type = dev.type; + ++ /* Skip empty devices */ ++ if (dev.as_uint32 == 0) ++ continue; ++ ++ found_dev++; ++ + /* HWC is already detected in mana_hwc_create_channel(). */ + if (dev_type == GDMA_DEVICE_HWC) + continue; +--- a/include/net/mana/gdma.h ++++ b/include/net/mana/gdma.h +@@ -408,8 +408,6 @@ struct gdma_context { + struct gdma_dev mana_ib; + }; + +-#define MAX_NUM_GDMA_DEVICES 4 +- + static inline bool mana_gd_is_mana(struct gdma_dev *gd) + { + return gd->dev_id.type == GDMA_DEVICE_MANA; +@@ -556,11 +554,15 @@ enum { + #define GDMA_DRV_CAP_FLAG_1_HWC_TIMEOUT_RECONFIG BIT(3) + #define GDMA_DRV_CAP_FLAG_1_VARIABLE_INDIRECTION_TABLE_SUPPORT BIT(5) + ++/* Driver can handle holes (zeros) in the device list */ ++#define GDMA_DRV_CAP_FLAG_1_DEV_LIST_HOLES_SUP BIT(11) ++ + #define GDMA_DRV_CAP_FLAGS1 \ + (GDMA_DRV_CAP_FLAG_1_EQ_SHARING_MULTI_VPORT | \ + GDMA_DRV_CAP_FLAG_1_NAPI_WKDONE_FIX | \ + GDMA_DRV_CAP_FLAG_1_HWC_TIMEOUT_RECONFIG | \ +- GDMA_DRV_CAP_FLAG_1_VARIABLE_INDIRECTION_TABLE_SUPPORT) ++ GDMA_DRV_CAP_FLAG_1_VARIABLE_INDIRECTION_TABLE_SUPPORT | \ ++ GDMA_DRV_CAP_FLAG_1_DEV_LIST_HOLES_SUP) + + #define GDMA_DRV_CAP_FLAGS2 0 + +@@ -621,11 +623,12 @@ struct gdma_query_max_resources_resp { + }; /* HW DATA */ + + /* GDMA_LIST_DEVICES */ ++#define GDMA_DEV_LIST_SIZE 64 + struct gdma_list_devices_resp { + struct gdma_resp_hdr hdr; + u32 num_of_devs; + u32 reserved; +- struct gdma_dev_id devs[64]; ++ struct gdma_dev_id devs[GDMA_DEV_LIST_SIZE]; + }; /* HW DATA */ + + /* GDMA_REGISTER_DEVICE */ diff --git a/queue-6.13/netfs-call-invalidate_cache-only-if-implemented.patch b/queue-6.13/netfs-call-invalidate_cache-only-if-implemented.patch new file mode 100644 index 0000000000..7badfe1706 --- /dev/null +++ b/queue-6.13/netfs-call-invalidate_cache-only-if-implemented.patch @@ -0,0 +1,85 @@ +From 344b7ef248f420ed4ba3a3539cb0a0fc18df9a6c Mon Sep 17 00:00:00 2001 +From: Max Kellermann +Date: Fri, 14 Mar 2025 16:41:57 +0000 +Subject: netfs: Call `invalidate_cache` only if implemented + +From: Max Kellermann + +commit 344b7ef248f420ed4ba3a3539cb0a0fc18df9a6c upstream. + +Many filesystems such as NFS and Ceph do not implement the +`invalidate_cache` method. On those filesystems, if writing to the +cache (`NETFS_WRITE_TO_CACHE`) fails for some reason, the kernel +crashes like this: + + BUG: kernel NULL pointer dereference, address: 0000000000000000 + #PF: supervisor instruction fetch in kernel mode + #PF: error_code(0x0010) - not-present page + PGD 0 P4D 0 + Oops: Oops: 0010 [#1] SMP PTI + CPU: 9 UID: 0 PID: 3380 Comm: kworker/u193:11 Not tainted 6.13.3-cm4all1-hp #437 + Hardware name: HP ProLiant DL380 Gen9/ProLiant DL380 Gen9, BIOS P89 10/17/2018 + Workqueue: events_unbound netfs_write_collection_worker + RIP: 0010:0x0 + Code: Unable to access opcode bytes at 0xffffffffffffffd6. + RSP: 0018:ffff9b86e2ca7dc0 EFLAGS: 00010202 + RAX: 0000000000000000 RBX: 0000000000000000 RCX: 7fffffffffffffff + RDX: 0000000000000001 RSI: ffff89259d576a18 RDI: ffff89259d576900 + RBP: ffff89259d5769b0 R08: ffff9b86e2ca7d28 R09: 0000000000000002 + R10: ffff89258ceaca80 R11: 0000000000000001 R12: 0000000000000020 + R13: ffff893d158b9338 R14: ffff89259d576900 R15: ffff89259d5769b0 + FS: 0000000000000000(0000) GS:ffff893c9fa40000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: ffffffffffffffd6 CR3: 000000054442e003 CR4: 00000000001706f0 + Call Trace: + + ? __die+0x1f/0x60 + ? page_fault_oops+0x15c/0x460 + ? try_to_wake_up+0x2d2/0x530 + ? exc_page_fault+0x5e/0x100 + ? asm_exc_page_fault+0x22/0x30 + netfs_write_collection_worker+0xe9f/0x12b0 + ? xs_poll_check_readable+0x3f/0x80 + ? xs_stream_data_receive_workfn+0x8d/0x110 + process_one_work+0x134/0x2d0 + worker_thread+0x299/0x3a0 + ? __pfx_worker_thread+0x10/0x10 + kthread+0xba/0xe0 + ? __pfx_kthread+0x10/0x10 + ret_from_fork+0x30/0x50 + ? __pfx_kthread+0x10/0x10 + ret_from_fork_asm+0x1a/0x30 + + Modules linked in: + CR2: 0000000000000000 + +This patch adds the missing `NULL` check. + +Fixes: 0e0f2dfe880f ("netfs: Dispatch write requests to process a writeback slice") +Fixes: 288ace2f57c9 ("netfs: New writeback implementation") +Signed-off-by: Max Kellermann +Signed-off-by: David Howells +Link: https://lore.kernel.org/r/20250314164201.1993231-3-dhowells@redhat.com +Acked-by: "Paulo Alcantara (Red Hat)" +cc: netfs@lists.linux.dev +cc: linux-cifs@vger.kernel.org +cc: linux-fsdevel@vger.kernel.org +cc: stable@vger.kernel.org +Signed-off-by: Christian Brauner +Signed-off-by: Greg Kroah-Hartman +--- + fs/netfs/write_collect.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/netfs/write_collect.c ++++ b/fs/netfs/write_collect.c +@@ -575,7 +575,8 @@ void netfs_write_collection_worker(struc + trace_netfs_rreq(wreq, netfs_rreq_trace_write_done); + + if (wreq->io_streams[1].active && +- wreq->io_streams[1].failed) { ++ wreq->io_streams[1].failed && ++ ictx->ops->invalidate_cache) { + /* Cache write failure doesn't prevent writeback completion + * unless we're in disconnected mode. + */ diff --git a/queue-6.13/pmdomain-amlogic-fix-t7-isp-secpower.patch b/queue-6.13/pmdomain-amlogic-fix-t7-isp-secpower.patch new file mode 100644 index 0000000000..93c37d7582 --- /dev/null +++ b/queue-6.13/pmdomain-amlogic-fix-t7-isp-secpower.patch @@ -0,0 +1,34 @@ +From ef17b519088ee0c167cf507820609732ec8bad1a Mon Sep 17 00:00:00 2001 +From: Xianwei Zhao +Date: Mon, 3 Mar 2025 17:06:05 +0800 +Subject: pmdomain: amlogic: fix T7 ISP secpower + +From: Xianwei Zhao + +commit ef17b519088ee0c167cf507820609732ec8bad1a upstream. + +ISP and MIPI_ISP, these two have a parent-child relationship, +ISP depends on MIPI_ISP. + +Fixes: ca75e4b214c6 ("pmdomain: amlogic: Add support for T7 power domains controller") +Signed-off-by: Xianwei Zhao +Reviewed-by: Neil Armstrong +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20250303-fix-t7-pwrc-v1-1-b563612bcd86@amlogic.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pmdomain/amlogic/meson-secure-pwrc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pmdomain/amlogic/meson-secure-pwrc.c ++++ b/drivers/pmdomain/amlogic/meson-secure-pwrc.c +@@ -221,7 +221,7 @@ static const struct meson_secure_pwrc_do + SEC_PD(T7_VI_CLK2, 0), + /* ETH is for ethernet online wakeup, and should be always on */ + SEC_PD(T7_ETH, GENPD_FLAG_ALWAYS_ON), +- SEC_PD(T7_ISP, 0), ++ TOP_PD(T7_ISP, 0, PWRC_T7_MIPI_ISP_ID), + SEC_PD(T7_MIPI_ISP, 0), + TOP_PD(T7_GDC, 0, PWRC_T7_NIC3_ID), + TOP_PD(T7_DEWARP, 0, PWRC_T7_NIC3_ID), diff --git a/queue-6.13/proc-fix-uaf-in-proc_get_inode.patch b/queue-6.13/proc-fix-uaf-in-proc_get_inode.patch new file mode 100644 index 0000000000..a939b4b7d5 --- /dev/null +++ b/queue-6.13/proc-fix-uaf-in-proc_get_inode.patch @@ -0,0 +1,177 @@ +From 654b33ada4ab5e926cd9c570196fefa7bec7c1df Mon Sep 17 00:00:00 2001 +From: Ye Bin +Date: Sat, 1 Mar 2025 15:06:24 +0300 +Subject: proc: fix UAF in proc_get_inode() + +From: Ye Bin + +commit 654b33ada4ab5e926cd9c570196fefa7bec7c1df upstream. + +Fix race between rmmod and /proc/XXX's inode instantiation. + +The bug is that pde->proc_ops don't belong to /proc, it belongs to a +module, therefore dereferencing it after /proc entry has been registered +is a bug unless use_pde/unuse_pde() pair has been used. + +use_pde/unuse_pde can be avoided (2 atomic ops!) because pde->proc_ops +never changes so information necessary for inode instantiation can be +saved _before_ proc_register() in PDE itself and used later, avoiding +pde->proc_ops->... dereference. + + rmmod lookup +sys_delete_module + proc_lookup_de + pde_get(de); + proc_get_inode(dir->i_sb, de); + mod->exit() + proc_remove + remove_proc_subtree + proc_entry_rundown(de); + free_module(mod); + + if (S_ISREG(inode->i_mode)) + if (de->proc_ops->proc_read_iter) + --> As module is already freed, will trigger UAF + +BUG: unable to handle page fault for address: fffffbfff80a702b +PGD 817fc4067 P4D 817fc4067 PUD 817fc0067 PMD 102ef4067 PTE 0 +Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI +CPU: 26 UID: 0 PID: 2667 Comm: ls Tainted: G +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) +RIP: 0010:proc_get_inode+0x302/0x6e0 +RSP: 0018:ffff88811c837998 EFLAGS: 00010a06 +RAX: dffffc0000000000 RBX: ffffffffc0538140 RCX: 0000000000000007 +RDX: 1ffffffff80a702b RSI: 0000000000000001 RDI: ffffffffc0538158 +RBP: ffff8881299a6000 R08: 0000000067bbe1e5 R09: 1ffff11023906f20 +R10: ffffffffb560ca07 R11: ffffffffb2b43a58 R12: ffff888105bb78f0 +R13: ffff888100518048 R14: ffff8881299a6004 R15: 0000000000000001 +FS: 00007f95b9686840(0000) GS:ffff8883af100000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: fffffbfff80a702b CR3: 0000000117dd2000 CR4: 00000000000006f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + proc_lookup_de+0x11f/0x2e0 + __lookup_slow+0x188/0x350 + walk_component+0x2ab/0x4f0 + path_lookupat+0x120/0x660 + filename_lookup+0x1ce/0x560 + vfs_statx+0xac/0x150 + __do_sys_newstat+0x96/0x110 + do_syscall_64+0x5f/0x170 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + +[adobriyan@gmail.com: don't do 2 atomic ops on the common path] +Link: https://lkml.kernel.org/r/3d25ded0-1739-447e-812b-e34da7990dcf@p183 +Fixes: 778f3dd5a13c ("Fix procfs compat_ioctl regression") +Signed-off-by: Ye Bin +Signed-off-by: Alexey Dobriyan +Cc: Al Viro +Cc: David S. Miller +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + fs/proc/generic.c | 10 +++++++++- + fs/proc/inode.c | 6 +++--- + fs/proc/internal.h | 14 ++++++++++++++ + include/linux/proc_fs.h | 7 +++++-- + 4 files changed, 31 insertions(+), 6 deletions(-) + +--- a/fs/proc/generic.c ++++ b/fs/proc/generic.c +@@ -557,10 +557,16 @@ struct proc_dir_entry *proc_create_reg(c + return p; + } + +-static inline void pde_set_flags(struct proc_dir_entry *pde) ++static void pde_set_flags(struct proc_dir_entry *pde) + { + if (pde->proc_ops->proc_flags & PROC_ENTRY_PERMANENT) + pde->flags |= PROC_ENTRY_PERMANENT; ++ if (pde->proc_ops->proc_read_iter) ++ pde->flags |= PROC_ENTRY_proc_read_iter; ++#ifdef CONFIG_COMPAT ++ if (pde->proc_ops->proc_compat_ioctl) ++ pde->flags |= PROC_ENTRY_proc_compat_ioctl; ++#endif + } + + struct proc_dir_entry *proc_create_data(const char *name, umode_t mode, +@@ -624,6 +630,7 @@ struct proc_dir_entry *proc_create_seq_p + p->proc_ops = &proc_seq_ops; + p->seq_ops = ops; + p->state_size = state_size; ++ pde_set_flags(p); + return proc_register(parent, p); + } + EXPORT_SYMBOL(proc_create_seq_private); +@@ -654,6 +661,7 @@ struct proc_dir_entry *proc_create_singl + return NULL; + p->proc_ops = &proc_single_ops; + p->single_show = show; ++ pde_set_flags(p); + return proc_register(parent, p); + } + EXPORT_SYMBOL(proc_create_single_data); +--- a/fs/proc/inode.c ++++ b/fs/proc/inode.c +@@ -656,13 +656,13 @@ struct inode *proc_get_inode(struct supe + + if (S_ISREG(inode->i_mode)) { + inode->i_op = de->proc_iops; +- if (de->proc_ops->proc_read_iter) ++ if (pde_has_proc_read_iter(de)) + inode->i_fop = &proc_iter_file_ops; + else + inode->i_fop = &proc_reg_file_ops; + #ifdef CONFIG_COMPAT +- if (de->proc_ops->proc_compat_ioctl) { +- if (de->proc_ops->proc_read_iter) ++ if (pde_has_proc_compat_ioctl(de)) { ++ if (pde_has_proc_read_iter(de)) + inode->i_fop = &proc_iter_file_ops_compat; + else + inode->i_fop = &proc_reg_file_ops_compat; +--- a/fs/proc/internal.h ++++ b/fs/proc/internal.h +@@ -85,6 +85,20 @@ static inline void pde_make_permanent(st + pde->flags |= PROC_ENTRY_PERMANENT; + } + ++static inline bool pde_has_proc_read_iter(const struct proc_dir_entry *pde) ++{ ++ return pde->flags & PROC_ENTRY_proc_read_iter; ++} ++ ++static inline bool pde_has_proc_compat_ioctl(const struct proc_dir_entry *pde) ++{ ++#ifdef CONFIG_COMPAT ++ return pde->flags & PROC_ENTRY_proc_compat_ioctl; ++#else ++ return false; ++#endif ++} ++ + extern struct kmem_cache *proc_dir_entry_cache; + void pde_free(struct proc_dir_entry *pde); + +--- a/include/linux/proc_fs.h ++++ b/include/linux/proc_fs.h +@@ -20,10 +20,13 @@ enum { + * If in doubt, ignore this flag. + */ + #ifdef MODULE +- PROC_ENTRY_PERMANENT = 0U, ++ PROC_ENTRY_PERMANENT = 0U, + #else +- PROC_ENTRY_PERMANENT = 1U << 0, ++ PROC_ENTRY_PERMANENT = 1U << 0, + #endif ++ ++ PROC_ENTRY_proc_read_iter = 1U << 1, ++ PROC_ENTRY_proc_compat_ioctl = 1U << 2, + }; + + struct proc_ops { diff --git a/queue-6.13/regulator-check-that-dummy-regulator-has-been-probed-before-using-it.patch b/queue-6.13/regulator-check-that-dummy-regulator-has-been-probed-before-using-it.patch new file mode 100644 index 0000000000..518db9f7f7 --- /dev/null +++ b/queue-6.13/regulator-check-that-dummy-regulator-has-been-probed-before-using-it.patch @@ -0,0 +1,57 @@ +From 2c7a50bec4958f1d1c84d19cde518d0e96a676fd Mon Sep 17 00:00:00 2001 +From: Christian Eggers +Date: Thu, 13 Mar 2025 11:27:39 +0100 +Subject: regulator: check that dummy regulator has been probed before using it + +From: Christian Eggers + +commit 2c7a50bec4958f1d1c84d19cde518d0e96a676fd upstream. + +Due to asynchronous driver probing there is a chance that the dummy +regulator hasn't already been probed when first accessing it. + +Cc: stable@vger.kernel.org +Signed-off-by: Christian Eggers +Link: https://patch.msgid.link/20250313103051.32430-3-ceggers@arri.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/core.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -2025,6 +2025,10 @@ static int regulator_resolve_supply(stru + + if (have_full_constraints()) { + r = dummy_regulator_rdev; ++ if (!r) { ++ ret = -EPROBE_DEFER; ++ goto out; ++ } + get_device(&r->dev); + } else { + dev_err(dev, "Failed to resolve %s-supply for %s\n", +@@ -2042,6 +2046,10 @@ static int regulator_resolve_supply(stru + goto out; + } + r = dummy_regulator_rdev; ++ if (!r) { ++ ret = -EPROBE_DEFER; ++ goto out; ++ } + get_device(&r->dev); + } + +@@ -2167,8 +2175,10 @@ struct regulator *_regulator_get_common( + * enabled, even if it isn't hooked up, and just + * provide a dummy. + */ +- dev_warn(dev, "supply %s not found, using dummy regulator\n", id); + rdev = dummy_regulator_rdev; ++ if (!rdev) ++ return ERR_PTR(-EPROBE_DEFER); ++ dev_warn(dev, "supply %s not found, using dummy regulator\n", id); + get_device(&rdev->dev); + break; + diff --git a/queue-6.13/regulator-dummy-force-synchronous-probing.patch b/queue-6.13/regulator-dummy-force-synchronous-probing.patch new file mode 100644 index 0000000000..a3ef246b8b --- /dev/null +++ b/queue-6.13/regulator-dummy-force-synchronous-probing.patch @@ -0,0 +1,50 @@ +From 8619909b38eeebd3e60910158d7d68441fc954e9 Mon Sep 17 00:00:00 2001 +From: Christian Eggers +Date: Tue, 11 Mar 2025 10:18:02 +0100 +Subject: regulator: dummy: force synchronous probing + +From: Christian Eggers + +commit 8619909b38eeebd3e60910158d7d68441fc954e9 upstream. + +Sometimes I get a NULL pointer dereference at boot time in kobject_get() +with the following call stack: + +anatop_regulator_probe() + devm_regulator_register() + regulator_register() + regulator_resolve_supply() + kobject_get() + +By placing some extra BUG_ON() statements I could verify that this is +raised because probing of the 'dummy' regulator driver is not completed +('dummy_regulator_rdev' is still NULL). + +In the JTAG debugger I can see that dummy_regulator_probe() and +anatop_regulator_probe() can be run by different kernel threads +(kworker/u4:*). I haven't further investigated whether this can be +changed or if there are other possibilities to force synchronization +between these two probe routines. On the other hand I don't expect much +boot time penalty by probing the 'dummy' regulator synchronously. + +Cc: stable@vger.kernel.org +Fixes: 259b93b21a9f ("regulator: Set PROBE_PREFER_ASYNCHRONOUS for drivers that existed in 4.14") +Signed-off-by: Christian Eggers +Link: https://patch.msgid.link/20250311091803.31026-1-ceggers@arri.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/dummy.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/regulator/dummy.c ++++ b/drivers/regulator/dummy.c +@@ -60,7 +60,7 @@ static struct platform_driver dummy_regu + .probe = dummy_regulator_probe, + .driver = { + .name = "reg-dummy", +- .probe_type = PROBE_PREFER_ASYNCHRONOUS, ++ .probe_type = PROBE_FORCE_SYNCHRONOUS, + }, + }; + diff --git a/queue-6.13/riscv-dts-starfive-fix-a-typo-in-starfive-jh7110-pin-function-definitions.patch b/queue-6.13/riscv-dts-starfive-fix-a-typo-in-starfive-jh7110-pin-function-definitions.patch new file mode 100644 index 0000000000..375f083fa8 --- /dev/null +++ b/queue-6.13/riscv-dts-starfive-fix-a-typo-in-starfive-jh7110-pin-function-definitions.patch @@ -0,0 +1,32 @@ +From 1b133129ad6b28186214259af3bd5fc651a85509 Mon Sep 17 00:00:00 2001 +From: E Shattow +Date: Mon, 9 Dec 2024 20:19:56 -0800 +Subject: riscv: dts: starfive: Fix a typo in StarFive JH7110 pin function definitions + +From: E Shattow + +commit 1b133129ad6b28186214259af3bd5fc651a85509 upstream. + +Fix a typo in StarFive JH7110 pin function definitions for GPOUT_SYS_SDIO1_DATA4 + +Fixes: e22f09e598d12 ("riscv: dts: starfive: Add StarFive JH7110 pin function definitions") +Signed-off-by: E Shattow +Acked-by: Hal Feng +CC: stable@vger.kernel.org +Signed-off-by: Conor Dooley +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/boot/dts/starfive/jh7110-pinfunc.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/riscv/boot/dts/starfive/jh7110-pinfunc.h ++++ b/arch/riscv/boot/dts/starfive/jh7110-pinfunc.h +@@ -89,7 +89,7 @@ + #define GPOUT_SYS_SDIO1_DATA1 59 + #define GPOUT_SYS_SDIO1_DATA2 60 + #define GPOUT_SYS_SDIO1_DATA3 61 +-#define GPOUT_SYS_SDIO1_DATA4 63 ++#define GPOUT_SYS_SDIO1_DATA4 62 + #define GPOUT_SYS_SDIO1_DATA5 63 + #define GPOUT_SYS_SDIO1_DATA6 64 + #define GPOUT_SYS_SDIO1_DATA7 65 diff --git a/queue-6.13/selftests-mm-run_vmtests.sh-fix-half_ufd_size_mb-calculation.patch b/queue-6.13/selftests-mm-run_vmtests.sh-fix-half_ufd_size_mb-calculation.patch new file mode 100644 index 0000000000..e01476e041 --- /dev/null +++ b/queue-6.13/selftests-mm-run_vmtests.sh-fix-half_ufd_size_mb-calculation.patch @@ -0,0 +1,61 @@ +From 67a2f86846f244d81601cf2e1552c4656b8556d6 Mon Sep 17 00:00:00 2001 +From: Rafael Aquini +Date: Tue, 18 Feb 2025 14:22:51 -0500 +Subject: selftests/mm: run_vmtests.sh: fix half_ufd_size_MB calculation + +From: Rafael Aquini + +commit 67a2f86846f244d81601cf2e1552c4656b8556d6 upstream. + +We noticed that uffd-stress test was always failing to run when invoked +for the hugetlb profiles on x86_64 systems with a processor count of 64 or +bigger: + + ... + # ------------------------------------ + # running ./uffd-stress hugetlb 128 32 + # ------------------------------------ + # ERROR: invalid MiB (errno=9, @uffd-stress.c:459) + ... + # [FAIL] + not ok 3 uffd-stress hugetlb 128 32 # exit=1 + ... + +The problem boils down to how run_vmtests.sh (mis)calculates the size of +the region it feeds to uffd-stress. The latter expects to see an amount +of MiB while the former is just giving out the number of free hugepages +halved down. This measurement discrepancy ends up violating uffd-stress' +assertion on number of hugetlb pages allocated per CPU, causing it to bail +out with the error above. + +This commit fixes that issue by adjusting run_vmtests.sh's +half_ufd_size_MB calculation so it properly renders the region size in +MiB, as expected, while maintaining all of its original constraints in +place. + +Link: https://lkml.kernel.org/r/20250218192251.53243-1-aquini@redhat.com +Fixes: 2e47a445d7b3 ("selftests/mm: run_vmtests.sh: fix hugetlb mem size calculation") +Signed-off-by: Rafael Aquini +Reviewed-by: David Hildenbrand +Reviewed-by: Peter Xu +Cc: Shuah Khan +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/mm/run_vmtests.sh | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/tools/testing/selftests/mm/run_vmtests.sh ++++ b/tools/testing/selftests/mm/run_vmtests.sh +@@ -302,7 +302,9 @@ uffd_stress_bin=./uffd-stress + CATEGORY="userfaultfd" run_test ${uffd_stress_bin} anon 20 16 + # Hugetlb tests require source and destination huge pages. Pass in half + # the size of the free pages we have, which is used for *each*. +-half_ufd_size_MB=$((freepgs / 2)) ++# uffd-stress expects a region expressed in MiB, so we adjust ++# half_ufd_size_MB accordingly. ++half_ufd_size_MB=$(((freepgs * hpgsize_KB) / 1024 / 2)) + CATEGORY="userfaultfd" run_test ${uffd_stress_bin} hugetlb "$half_ufd_size_MB" 32 + CATEGORY="userfaultfd" run_test ${uffd_stress_bin} hugetlb-private "$half_ufd_size_MB" 32 + CATEGORY="userfaultfd" run_test ${uffd_stress_bin} shmem 20 16 diff --git a/queue-6.13/series b/queue-6.13/series index aaf9ef6ef4..e51c311172 100644 --- a/queue-6.13/series +++ b/queue-6.13/series @@ -49,3 +49,59 @@ net-ipv6-ioam6-fix-lwtunnel_output-loop.patch libfs-fix-duplicate-directory-entry-in-offset_dir_lo.patch net-neighbor-add-missing-policy-for-ndtpa_queue_lenb.patch revert-gre-fix-ipv6-link-local-address-generation.patch +media-rtl2832_sdr-assign-vb2-lock-before-vb2_queue_init.patch +tracing-tprobe-events-fix-leakage-of-module-refcount.patch +i2c-omap-fix-irq-storms.patch +net-mana-support-holes-in-device-list-reply-msg.patch +dt-bindings-can-renesas-rcar-canfd-fix-typo-in-pattern-properties-for-r-car-v4m.patch +can-rcar_canfd-fix-page-entries-in-the-afl-list.patch +can-ucan-fix-out-of-bound-read-in-strscpy-source.patch +can-flexcan-only-change-can-state-when-link-up-in-system-pm.patch +can-flexcan-disable-transceiver-during-system-pm.patch +drm-xe-fix-exporting-xe-buffers-multiple-times.patch +drm-v3d-don-t-run-jobs-that-have-errors-flagged-in-its-fence.patch +io_uring-net-don-t-clear-req_f_need_cleanup-unconditionally.patch +riscv-dts-starfive-fix-a-typo-in-starfive-jh7110-pin-function-definitions.patch +netfs-call-invalidate_cache-only-if-implemented.patch +regulator-dummy-force-synchronous-probing.patch +regulator-check-that-dummy-regulator-has-been-probed-before-using-it.patch +accel-qaic-fix-integer-overflow-in-qaic_validate_req.patch +arm64-dts-freescale-imx8mp-verdin-dahlia-add-microphone-jack-to-sound-card.patch +arm64-dts-freescale-imx8mm-verdin-dahlia-add-microphone-jack-to-sound-card.patch +arm64-dts-rockchip-fix-pinmux-of-uart0-for-px30-ringneck-on-haikou.patch +arm64-dts-rockchip-fix-pinmux-of-uart5-for-px30-ringneck-on-haikou.patch +arm64-dts-rockchip-fix-u2phy1_host-status-for-nanopi-r4s.patch +arm64-dts-rockchip-add-avdd-hdmi-supplies-to-rockpro64-board-dtsi.patch +arm64-dts-rockchip-add-missing-pcie-supplies-to-rockpro64-board-dtsi.patch +mmc-sdhci-brcmstb-add-cqhci-suspend-resume-to-pm-ops.patch +mmc-atmel-mci-add-missing-clk_disable_unprepare.patch +selftests-mm-run_vmtests.sh-fix-half_ufd_size_mb-calculation.patch +mm-fix-error-handling-in-__filemap_get_folio-with-fgp_nowait.patch +mm-migrate-fix-shmem-xarray-update-during-migration.patch +mm-page_alloc-fix-memory-accept-before-watermarks-gets-initialized.patch +mm-huge_memory-drop-beyond-eof-folios-with-the-right-number-of-refs.patch +proc-fix-uaf-in-proc_get_inode.patch +memcg-drain-obj-stock-on-cpu-hotplug-teardown.patch +arm-dts-imx6qdl-apalis-fix-poweroff-on-apalis-imx6.patch +arm-shmobile-smp-enforce-shmobile_smp_-alignment.patch +firmware-qcom-uefisecapp-fix-efivars-registration-race.patch +efi-libstub-avoid-physical-address-0x0-when-doing-random-allocation.patch +keys-fix-uaf-in-key_put.patch +xsk-fix-an-integer-overflow-in-xp_create_and_assign_umem.patch +batman-adv-ignore-own-maximum-aggregation-size-during-rx.patch +soc-qcom-pdr-fix-the-potential-deadlock.patch +pmdomain-amlogic-fix-t7-isp-secpower.patch +drm-radeon-fix-uninitialized-size-issue-in-radeon_vce_cs_parse.patch +drm-sched-fix-fence-reference-count-leak.patch +drm-amdgpu-gfx12-correct-cleanup-of-me-field-with-gfx_v12_0_me_fini.patch +drm-amd-display-fix-message-for-support_edp0_on_dp1.patch +drm-amd-display-use-hw-lock-mgr-for-psr1-when-only-one-edp.patch +drm-amd-pm-add-unique_id-for-gfx12.patch +drm-amdgpu-restore-uncached-behaviour-on-gfx12.patch +drm-amdgpu-pm-handle-sclk-offset-correctly-in-overdrive-for-smu-14.0.2.patch +drm-amdgpu-pm-wire-up-hwmon-fan-speed-for-smu-14.0.2.patch +drm-amdgpu-remove-jpeg-from-vega-and-carrizo-video-caps.patch +drm-amdgpu-fix-mpeg2-mpeg4-and-vc1-video-caps-max-size.patch +drm-amdgpu-fix-jpeg-video-caps-max-size-for-navi1x-and-raven.patch +drm-amdkfd-fix-user-queue-validation-on-gfx7-8.patch +drm-amdkfd-fix-instruction-hazard-in-gfx12-trap-handler.patch diff --git a/queue-6.13/soc-qcom-pdr-fix-the-potential-deadlock.patch b/queue-6.13/soc-qcom-pdr-fix-the-potential-deadlock.patch new file mode 100644 index 0000000000..0389f03e10 --- /dev/null +++ b/queue-6.13/soc-qcom-pdr-fix-the-potential-deadlock.patch @@ -0,0 +1,90 @@ +From 2eeb03ad9f42dfece63051be2400af487ddb96d2 Mon Sep 17 00:00:00 2001 +From: Saranya R +Date: Wed, 12 Feb 2025 22:07:20 +0530 +Subject: soc: qcom: pdr: Fix the potential deadlock + +From: Saranya R + +commit 2eeb03ad9f42dfece63051be2400af487ddb96d2 upstream. + +When some client process A call pdr_add_lookup() to add the look up for +the service and does schedule locator work, later a process B got a new +server packet indicating locator is up and call pdr_locator_new_server() +which eventually sets pdr->locator_init_complete to true which process A +sees and takes list lock and queries domain list but it will timeout due +to deadlock as the response will queued to the same qmi->wq and it is +ordered workqueue and process B is not able to complete new server +request work due to deadlock on list lock. + +Fix it by removing the unnecessary list iteration as the list iteration +is already being done inside locator work, so avoid it here and just +call schedule_work() here. + + Process A Process B + + process_scheduled_works() +pdr_add_lookup() qmi_data_ready_work() + process_scheduled_works() pdr_locator_new_server() + pdr->locator_init_complete=true; + pdr_locator_work() + mutex_lock(&pdr->list_lock); + + pdr_locate_service() mutex_lock(&pdr->list_lock); + + pdr_get_domain_list() + pr_err("PDR: %s get domain list + txn wait failed: %d\n", + req->service_name, + ret); + +Timeout error log due to deadlock: + +" + PDR: tms/servreg get domain list txn wait failed: -110 + PDR: service lookup for msm/adsp/sensor_pd:tms/servreg failed: -110 +" + +Thanks to Bjorn and Johan for letting me know that this commit also fixes +an audio regression when using the in-kernel pd-mapper as that makes it +easier to hit this race. [1] + +Link: https://lore.kernel.org/lkml/Zqet8iInnDhnxkT9@hovoldconsulting.com/ # [1] +Fixes: fbe639b44a82 ("soc: qcom: Introduce Protection Domain Restart helpers") +CC: stable@vger.kernel.org +Reviewed-by: Bjorn Andersson +Tested-by: Bjorn Andersson +Tested-by: Johan Hovold +Signed-off-by: Saranya R +Co-developed-by: Mukesh Ojha +Signed-off-by: Mukesh Ojha +Link: https://lore.kernel.org/r/20250212163720.1577876-1-mukesh.ojha@oss.qualcomm.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/qcom/pdr_interface.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +--- a/drivers/soc/qcom/pdr_interface.c ++++ b/drivers/soc/qcom/pdr_interface.c +@@ -75,7 +75,6 @@ static int pdr_locator_new_server(struct + { + struct pdr_handle *pdr = container_of(qmi, struct pdr_handle, + locator_hdl); +- struct pdr_service *pds; + + mutex_lock(&pdr->lock); + /* Create a local client port for QMI communication */ +@@ -87,12 +86,7 @@ static int pdr_locator_new_server(struct + mutex_unlock(&pdr->lock); + + /* Service pending lookup requests */ +- mutex_lock(&pdr->list_lock); +- list_for_each_entry(pds, &pdr->lookups, node) { +- if (pds->need_locator_lookup) +- schedule_work(&pdr->locator_work); +- } +- mutex_unlock(&pdr->list_lock); ++ schedule_work(&pdr->locator_work); + + return 0; + } diff --git a/queue-6.13/tracing-tprobe-events-fix-leakage-of-module-refcount.patch b/queue-6.13/tracing-tprobe-events-fix-leakage-of-module-refcount.patch new file mode 100644 index 0000000000..41fbf6117d --- /dev/null +++ b/queue-6.13/tracing-tprobe-events-fix-leakage-of-module-refcount.patch @@ -0,0 +1,80 @@ +From ac91052f0ae5be9e46211ba92cc31c0e3b0a933a Mon Sep 17 00:00:00 2001 +From: "Masami Hiramatsu (Google)" +Date: Thu, 13 Mar 2025 10:00:10 +0900 +Subject: tracing: tprobe-events: Fix leakage of module refcount + +From: Masami Hiramatsu (Google) + +commit ac91052f0ae5be9e46211ba92cc31c0e3b0a933a upstream. + +When enabling the tracepoint at loading module, the target module +refcount is incremented by find_tracepoint_in_module(). But it is +unnecessary because the module is not unloaded while processing +module loading callbacks. +Moreover, the refcount is not decremented in that function. +To be clear the module refcount handling, move the try_module_get() +callsite to trace_fprobe_create_internal(), where it is actually +required. + +Link: https://lore.kernel.org/all/174182761071.83274.18334217580449925882.stgit@devnote2/ + +Fixes: 57a7e6de9e30 ("tracing/fprobe: Support raw tracepoints on future loaded modules") +Signed-off-by: Masami Hiramatsu (Google) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace_fprobe.c | 21 ++++++++------------- + 1 file changed, 8 insertions(+), 13 deletions(-) + +--- a/kernel/trace/trace_fprobe.c ++++ b/kernel/trace/trace_fprobe.c +@@ -889,13 +889,8 @@ static void __find_tracepoint_module_cb( + + if (!data->tpoint && !strcmp(data->tp_name, tp->name)) { + data->tpoint = tp; +- if (!data->mod) { ++ if (!data->mod) + data->mod = mod; +- if (!try_module_get(data->mod)) { +- data->tpoint = NULL; +- data->mod = NULL; +- } +- } + } + } + +@@ -907,13 +902,7 @@ static void __find_tracepoint_cb(struct + data->tpoint = tp; + } + +-/* +- * Find a tracepoint from kernel and module. If the tracepoint is in a module, +- * this increments the module refcount to prevent unloading until the +- * trace_fprobe is registered to the list. After registering the trace_fprobe +- * on the trace_fprobe list, the module refcount is decremented because +- * tracepoint_probe_module_cb will handle it. +- */ ++/* Find a tracepoint from kernel and module. */ + static struct tracepoint *find_tracepoint(const char *tp_name, + struct module **tp_mod) + { +@@ -942,6 +931,7 @@ static void reenable_trace_fprobe(struct + } + } + ++/* Find a tracepoint from specified module. */ + static struct tracepoint *find_tracepoint_in_module(struct module *mod, + const char *tp_name) + { +@@ -1177,6 +1167,11 @@ static int __trace_fprobe_create(int arg + if (is_tracepoint) { + ctx.flags |= TPARG_FL_TPOINT; + tpoint = find_tracepoint(symbol, &tp_mod); ++ /* lock module until register this tprobe. */ ++ if (tp_mod && !try_module_get(tp_mod)) { ++ tpoint = NULL; ++ tp_mod = NULL; ++ } + if (tpoint) { + ctx.funcname = kallsyms_lookup( + (unsigned long)tpoint->probestub, diff --git a/queue-6.13/xsk-fix-an-integer-overflow-in-xp_create_and_assign_umem.patch b/queue-6.13/xsk-fix-an-integer-overflow-in-xp_create_and_assign_umem.patch new file mode 100644 index 0000000000..24e02ec152 --- /dev/null +++ b/queue-6.13/xsk-fix-an-integer-overflow-in-xp_create_and_assign_umem.patch @@ -0,0 +1,38 @@ +From 559847f56769037e5b2e0474d3dbff985b98083d Mon Sep 17 00:00:00 2001 +From: Gavrilov Ilia +Date: Thu, 13 Mar 2025 08:50:08 +0000 +Subject: xsk: fix an integer overflow in xp_create_and_assign_umem() + +From: Gavrilov Ilia + +commit 559847f56769037e5b2e0474d3dbff985b98083d upstream. + +Since the i and pool->chunk_size variables are of type 'u32', +their product can wrap around and then be cast to 'u64'. +This can lead to two different XDP buffers pointing to the same +memory area. + +Found by InfoTeCS on behalf of Linux Verification Center +(linuxtesting.org) with SVACE. + +Fixes: 94033cd8e73b ("xsk: Optimize for aligned case") +Cc: stable@vger.kernel.org +Signed-off-by: Ilia Gavrilov +Link: https://patch.msgid.link/20250313085007.3116044-1-Ilia.Gavrilov@infotecs.ru +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/xdp/xsk_buff_pool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/xdp/xsk_buff_pool.c ++++ b/net/xdp/xsk_buff_pool.c +@@ -105,7 +105,7 @@ struct xsk_buff_pool *xp_create_and_assi + if (pool->unaligned) + pool->free_heads[i] = xskb; + else +- xp_init_xskb_addr(xskb, pool, i * pool->chunk_size); ++ xp_init_xskb_addr(xskb, pool, (u64)i * pool->chunk_size); + } + + return pool;