From: Greg Kroah-Hartman Date: Tue, 22 Apr 2025 06:20:49 +0000 (+0200) Subject: 6.6-stable patches X-Git-Tag: v6.1.135~120 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d4f93c4d2d48c0b792dec5e033834877ab0e220a;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: drm-amd-handle-being-compiled-without-si-or-cik-support-better.patch drm-amd-pm-powerplay-hwmgr-smu7_thermal-prevent-division-by-zero.patch drm-amd-pm-powerplay-hwmgr-vega20_thermal-prevent-division-by-zero.patch drm-amd-pm-powerplay-prevent-division-by-zero.patch drm-amd-pm-prevent-division-by-zero.patch drm-amd-pm-smu11-prevent-division-by-zero.patch drm-amd-pm-swsmu-smu13-smu_v13_0-prevent-division-by-zero.patch drm-msm-a6xx-fix-stale-rpmh-votes-from-gpu.patch drm-repaper-fix-integer-overflows-in-repeat-functions.patch --- diff --git a/queue-6.6/drm-amd-handle-being-compiled-without-si-or-cik-support-better.patch b/queue-6.6/drm-amd-handle-being-compiled-without-si-or-cik-support-better.patch new file mode 100644 index 0000000000..4aeeb24829 --- /dev/null +++ b/queue-6.6/drm-amd-handle-being-compiled-without-si-or-cik-support-better.patch @@ -0,0 +1,116 @@ +From 5f054ddead33c1622ea9c0c0aaf07c6843fc7ab0 Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Wed, 19 Mar 2025 11:58:31 -0500 +Subject: drm/amd: Handle being compiled without SI or CIK support better + +From: Mario Limonciello + +commit 5f054ddead33c1622ea9c0c0aaf07c6843fc7ab0 upstream. + +If compiled without SI or CIK support but amdgpu tries to load it +will run into failures with uninitialized callbacks. + +Show a nicer message in this case and fail probe instead. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4050 +Signed-off-by: Mario Limonciello +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 44 +++++++++++++++++--------------- + 1 file changed, 24 insertions(+), 20 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +@@ -1651,7 +1651,6 @@ static const u16 amdgpu_unsupported_pcii + }; + + static const struct pci_device_id pciidlist[] = { +-#ifdef CONFIG_DRM_AMDGPU_SI + {0x1002, 0x6780, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI}, + {0x1002, 0x6784, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI}, + {0x1002, 0x6788, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI}, +@@ -1724,8 +1723,6 @@ static const struct pci_device_id pciidl + {0x1002, 0x6665, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|AMD_IS_MOBILITY}, + {0x1002, 0x6667, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|AMD_IS_MOBILITY}, + {0x1002, 0x666F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|AMD_IS_MOBILITY}, +-#endif +-#ifdef CONFIG_DRM_AMDGPU_CIK + /* Kaveri */ + {0x1002, 0x1304, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KAVERI|AMD_IS_MOBILITY|AMD_IS_APU}, + {0x1002, 0x1305, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KAVERI|AMD_IS_APU}, +@@ -1808,7 +1805,6 @@ static const struct pci_device_id pciidl + {0x1002, 0x985D, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MULLINS|AMD_IS_MOBILITY|AMD_IS_APU}, + {0x1002, 0x985E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MULLINS|AMD_IS_MOBILITY|AMD_IS_APU}, + {0x1002, 0x985F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MULLINS|AMD_IS_MOBILITY|AMD_IS_APU}, +-#endif + /* topaz */ + {0x1002, 0x6900, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TOPAZ}, + {0x1002, 0x6901, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TOPAZ}, +@@ -2090,14 +2086,14 @@ static int amdgpu_pci_probe(struct pci_d + return -ENOTSUPP; + } + ++ switch (flags & AMD_ASIC_MASK) { ++ case CHIP_TAHITI: ++ case CHIP_PITCAIRN: ++ case CHIP_VERDE: ++ case CHIP_OLAND: ++ case CHIP_HAINAN: + #ifdef CONFIG_DRM_AMDGPU_SI +- if (!amdgpu_si_support) { +- switch (flags & AMD_ASIC_MASK) { +- case CHIP_TAHITI: +- case CHIP_PITCAIRN: +- case CHIP_VERDE: +- case CHIP_OLAND: +- case CHIP_HAINAN: ++ if (!amdgpu_si_support) { + dev_info(&pdev->dev, + "SI support provided by radeon.\n"); + dev_info(&pdev->dev, +@@ -2105,16 +2101,18 @@ static int amdgpu_pci_probe(struct pci_d + ); + return -ENODEV; + } +- } ++ break; ++#else ++ dev_info(&pdev->dev, "amdgpu is built without SI support.\n"); ++ return -ENODEV; + #endif ++ case CHIP_KAVERI: ++ case CHIP_BONAIRE: ++ case CHIP_HAWAII: ++ case CHIP_KABINI: ++ case CHIP_MULLINS: + #ifdef CONFIG_DRM_AMDGPU_CIK +- if (!amdgpu_cik_support) { +- switch (flags & AMD_ASIC_MASK) { +- case CHIP_KAVERI: +- case CHIP_BONAIRE: +- case CHIP_HAWAII: +- case CHIP_KABINI: +- case CHIP_MULLINS: ++ if (!amdgpu_cik_support) { + dev_info(&pdev->dev, + "CIK support provided by radeon.\n"); + dev_info(&pdev->dev, +@@ -2122,8 +2120,14 @@ static int amdgpu_pci_probe(struct pci_d + ); + return -ENODEV; + } +- } ++ break; ++#else ++ dev_info(&pdev->dev, "amdgpu is built without CIK support.\n"); ++ return -ENODEV; + #endif ++ default: ++ break; ++ } + + adev = devm_drm_dev_alloc(&pdev->dev, &amdgpu_kms_driver, typeof(*adev), ddev); + if (IS_ERR(adev)) diff --git a/queue-6.6/drm-amd-pm-powerplay-hwmgr-smu7_thermal-prevent-division-by-zero.patch b/queue-6.6/drm-amd-pm-powerplay-hwmgr-smu7_thermal-prevent-division-by-zero.patch new file mode 100644 index 0000000000..5d13073cb2 --- /dev/null +++ b/queue-6.6/drm-amd-pm-powerplay-hwmgr-smu7_thermal-prevent-division-by-zero.patch @@ -0,0 +1,38 @@ +From 7c246a05df51c52fe0852ce56ba10c41e6ed1f39 Mon Sep 17 00:00:00 2001 +From: Denis Arefev +Date: Fri, 21 Mar 2025 14:08:16 +0300 +Subject: drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero + +From: Denis Arefev + +commit 7c246a05df51c52fe0852ce56ba10c41e6ed1f39 upstream. + +The user can set any speed value. +If speed is greater than UINT_MAX/8, division by zero is possible. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: c52dcf49195d ("drm/amd/pp: Avoid divide-by-zero in fan_ctrl_set_fan_speed_rpm") +Signed-off-by: Denis Arefev +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c +@@ -267,10 +267,10 @@ int smu7_fan_ctrl_set_fan_speed_rpm(stru + if (hwmgr->thermal_controller.fanInfo.bNoFan || + (hwmgr->thermal_controller.fanInfo. + ucTachometerPulsesPerRevolution == 0) || +- speed == 0 || ++ (!speed || speed > UINT_MAX/8) || + (speed < hwmgr->thermal_controller.fanInfo.ulMinRPM) || + (speed > hwmgr->thermal_controller.fanInfo.ulMaxRPM)) +- return 0; ++ return -EINVAL; + + if (PP_CAP(PHM_PlatformCaps_MicrocodeFanControl)) + smu7_fan_ctrl_stop_smc_fan_control(hwmgr); diff --git a/queue-6.6/drm-amd-pm-powerplay-hwmgr-vega20_thermal-prevent-division-by-zero.patch b/queue-6.6/drm-amd-pm-powerplay-hwmgr-vega20_thermal-prevent-division-by-zero.patch new file mode 100644 index 0000000000..f1dcf63539 --- /dev/null +++ b/queue-6.6/drm-amd-pm-powerplay-hwmgr-vega20_thermal-prevent-division-by-zero.patch @@ -0,0 +1,34 @@ +From 4e3d9508c056d7e0a56b58d5c81253e2a0d22b6c Mon Sep 17 00:00:00 2001 +From: Denis Arefev +Date: Fri, 21 Mar 2025 13:52:33 +0300 +Subject: drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero + +From: Denis Arefev + +commit 4e3d9508c056d7e0a56b58d5c81253e2a0d22b6c upstream. + +The user can set any speed value. +If speed is greater than UINT_MAX/8, division by zero is possible. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 031db09017da ("drm/amd/powerplay/vega20: enable fan RPM and pwm settings V2") +Signed-off-by: Denis Arefev +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c +@@ -191,7 +191,7 @@ int vega20_fan_ctrl_set_fan_speed_rpm(st + uint32_t tach_period, crystal_clock_freq; + int result = 0; + +- if (!speed) ++ if (!speed || speed > UINT_MAX/8) + return -EINVAL; + + if (PP_CAP(PHM_PlatformCaps_MicrocodeFanControl)) { diff --git a/queue-6.6/drm-amd-pm-powerplay-prevent-division-by-zero.patch b/queue-6.6/drm-amd-pm-powerplay-prevent-division-by-zero.patch new file mode 100644 index 0000000000..700ae8669c --- /dev/null +++ b/queue-6.6/drm-amd-pm-powerplay-prevent-division-by-zero.patch @@ -0,0 +1,38 @@ +From 4b8c3c0d17c07f301011e2908fecd2ebdcfe3d1c Mon Sep 17 00:00:00 2001 +From: Denis Arefev +Date: Fri, 21 Mar 2025 14:08:15 +0300 +Subject: drm/amd/pm/powerplay: Prevent division by zero + +From: Denis Arefev + +commit 4b8c3c0d17c07f301011e2908fecd2ebdcfe3d1c upstream. + +The user can set any speed value. +If speed is greater than UINT_MAX/8, division by zero is possible. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: c52dcf49195d ("drm/amd/pp: Avoid divide-by-zero in fan_ctrl_set_fan_speed_rpm") +Signed-off-by: Denis Arefev +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_thermal.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_thermal.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_thermal.c +@@ -307,10 +307,10 @@ int vega10_fan_ctrl_set_fan_speed_rpm(st + int result = 0; + + if (hwmgr->thermal_controller.fanInfo.bNoFan || +- speed == 0 || ++ (!speed || speed > UINT_MAX/8) || + (speed < hwmgr->thermal_controller.fanInfo.ulMinRPM) || + (speed > hwmgr->thermal_controller.fanInfo.ulMaxRPM)) +- return -1; ++ return -EINVAL; + + if (PP_CAP(PHM_PlatformCaps_MicrocodeFanControl)) + result = vega10_fan_ctrl_stop_smc_fan_control(hwmgr); diff --git a/queue-6.6/drm-amd-pm-prevent-division-by-zero.patch b/queue-6.6/drm-amd-pm-prevent-division-by-zero.patch new file mode 100644 index 0000000000..01a7d221b6 --- /dev/null +++ b/queue-6.6/drm-amd-pm-prevent-division-by-zero.patch @@ -0,0 +1,35 @@ +From 7d641c2b83275d3b0424127b2e0d2d0f7dd82aef Mon Sep 17 00:00:00 2001 +From: Denis Arefev +Date: Fri, 21 Mar 2025 13:52:32 +0300 +Subject: drm/amd/pm: Prevent division by zero + +From: Denis Arefev + +commit 7d641c2b83275d3b0424127b2e0d2d0f7dd82aef upstream. + +The user can set any speed value. +If speed is greater than UINT_MAX/8, division by zero is possible. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: b64625a303de ("drm/amd/pm: correct the address of Arcturus fan related registers") +Signed-off-by: Denis Arefev +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c +@@ -1274,6 +1274,9 @@ static int arcturus_set_fan_speed_rpm(st + uint32_t crystal_clock_freq = 2500; + uint32_t tach_period; + ++ if (!speed || speed > UINT_MAX/8) ++ return -EINVAL; ++ + tach_period = 60 * crystal_clock_freq * 10000 / (8 * speed); + WREG32_SOC15(THM, 0, mmCG_TACH_CTRL_ARCT, + REG_SET_FIELD(RREG32_SOC15(THM, 0, mmCG_TACH_CTRL_ARCT), diff --git a/queue-6.6/drm-amd-pm-smu11-prevent-division-by-zero.patch b/queue-6.6/drm-amd-pm-smu11-prevent-division-by-zero.patch new file mode 100644 index 0000000000..123e5113ff --- /dev/null +++ b/queue-6.6/drm-amd-pm-smu11-prevent-division-by-zero.patch @@ -0,0 +1,35 @@ +From 7ba88b5cccc1a99c1afb96e31e7eedac9907704c Mon Sep 17 00:00:00 2001 +From: Denis Arefev +Date: Thu, 20 Mar 2025 12:35:02 +0300 +Subject: drm/amd/pm/smu11: Prevent division by zero + +From: Denis Arefev + +commit 7ba88b5cccc1a99c1afb96e31e7eedac9907704c upstream. + +The user can set any speed value. +If speed is greater than UINT_MAX/8, division by zero is possible. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 1e866f1fe528 ("drm/amd/pm: Prevent divide by zero") +Signed-off-by: Denis Arefev +Signed-off-by: Alex Deucher +(cherry picked from commit da7dc714a8f8e1c9fc33c57cd63583779a3bef71) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c +@@ -1202,7 +1202,7 @@ int smu_v11_0_set_fan_speed_rpm(struct s + uint32_t crystal_clock_freq = 2500; + uint32_t tach_period; + +- if (speed == 0) ++ if (!speed || speed > UINT_MAX/8) + return -EINVAL; + /* + * To prevent from possible overheat, some ASICs may have requirement diff --git a/queue-6.6/drm-amd-pm-swsmu-smu13-smu_v13_0-prevent-division-by-zero.patch b/queue-6.6/drm-amd-pm-swsmu-smu13-smu_v13_0-prevent-division-by-zero.patch new file mode 100644 index 0000000000..1a703470b2 --- /dev/null +++ b/queue-6.6/drm-amd-pm-swsmu-smu13-smu_v13_0-prevent-division-by-zero.patch @@ -0,0 +1,34 @@ +From f23e9116ebb71b63fe9cec0dcac792aa9af30b0c Mon Sep 17 00:00:00 2001 +From: Denis Arefev +Date: Fri, 21 Mar 2025 13:52:31 +0300 +Subject: drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero + +From: Denis Arefev + +commit f23e9116ebb71b63fe9cec0dcac792aa9af30b0c upstream. + +The user can set any speed value. +If speed is greater than UINT_MAX/8, division by zero is possible. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: c05d1c401572 ("drm/amd/swsmu: add aldebaran smu13 ip support (v3)") +Signed-off-by: Denis Arefev +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c +@@ -1227,7 +1227,7 @@ int smu_v13_0_set_fan_speed_rpm(struct s + uint32_t tach_period; + int ret; + +- if (!speed) ++ if (!speed || speed > UINT_MAX/8) + return -EINVAL; + + ret = smu_v13_0_auto_fan_control(smu, 0); diff --git a/queue-6.6/drm-msm-a6xx-fix-stale-rpmh-votes-from-gpu.patch b/queue-6.6/drm-msm-a6xx-fix-stale-rpmh-votes-from-gpu.patch new file mode 100644 index 0000000000..28dcfe79e0 --- /dev/null +++ b/queue-6.6/drm-msm-a6xx-fix-stale-rpmh-votes-from-gpu.patch @@ -0,0 +1,130 @@ +From f561db72a663f8a73c2250bf3244ce1ce221bed7 Mon Sep 17 00:00:00 2001 +From: Akhil P Oommen +Date: Wed, 26 Feb 2025 01:22:14 +0530 +Subject: drm/msm/a6xx: Fix stale rpmh votes from GPU + +From: Akhil P Oommen + +commit f561db72a663f8a73c2250bf3244ce1ce221bed7 upstream. + +It was observed on sc7180 (A618 gpu) that GPU votes for GX rail and CNOC +BCM nodes were not removed after GPU suspend. This was because we +skipped sending 'prepare-slumber' request to gmu during suspend sequence +in some cases. So, make sure we always call prepare-slumber hfi during +suspend. Also, calling prepare-slumber without a prior oob-gpu handshake +messes up gmu firmware's internal state. So, do that when required. + +Fixes: 4b565ca5a2cb ("drm/msm: Add A6XX device support") +Cc: stable@vger.kernel.org +Signed-off-by: Akhil P Oommen +Patchwork: https://patchwork.freedesktop.org/patch/639569/ +Signed-off-by: Rob Clark +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 82 ++++++++++++++++++---------------- + 1 file changed, 44 insertions(+), 38 deletions(-) + +--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c +@@ -1042,50 +1042,51 @@ static void a6xx_gmu_shutdown(struct a6x + struct a6xx_gpu *a6xx_gpu = container_of(gmu, struct a6xx_gpu, gmu); + struct adreno_gpu *adreno_gpu = &a6xx_gpu->base; + u32 val; ++ int ret; + + /* +- * The GMU may still be in slumber unless the GPU started so check and +- * skip putting it back into slumber if so ++ * GMU firmware's internal power state gets messed up if we send "prepare_slumber" hfi when ++ * oob_gpu handshake wasn't done after the last wake up. So do a dummy handshake here when ++ * required + */ +- val = gmu_read(gmu, REG_A6XX_GPU_GMU_CX_GMU_RPMH_POWER_STATE); ++ if (adreno_gpu->base.needs_hw_init) { ++ if (a6xx_gmu_set_oob(&a6xx_gpu->gmu, GMU_OOB_GPU_SET)) ++ goto force_off; + +- if (val != 0xf) { +- int ret = a6xx_gmu_wait_for_idle(gmu); +- +- /* If the GMU isn't responding assume it is hung */ +- if (ret) { +- a6xx_gmu_force_off(gmu); +- return; +- } +- +- a6xx_bus_clear_pending_transactions(adreno_gpu, a6xx_gpu->hung); +- +- /* tell the GMU we want to slumber */ +- ret = a6xx_gmu_notify_slumber(gmu); +- if (ret) { +- a6xx_gmu_force_off(gmu); +- return; +- } +- +- ret = gmu_poll_timeout(gmu, +- REG_A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS, val, +- !(val & A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS_GPUBUSYIGNAHB), +- 100, 10000); +- +- /* +- * Let the user know we failed to slumber but don't worry too +- * much because we are powering down anyway +- */ +- +- if (ret) +- DRM_DEV_ERROR(gmu->dev, +- "Unable to slumber GMU: status = 0%x/0%x\n", +- gmu_read(gmu, +- REG_A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS), +- gmu_read(gmu, +- REG_A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS2)); ++ a6xx_gmu_clear_oob(&a6xx_gpu->gmu, GMU_OOB_GPU_SET); + } + ++ ret = a6xx_gmu_wait_for_idle(gmu); ++ ++ /* If the GMU isn't responding assume it is hung */ ++ if (ret) ++ goto force_off; ++ ++ a6xx_bus_clear_pending_transactions(adreno_gpu, a6xx_gpu->hung); ++ ++ /* tell the GMU we want to slumber */ ++ ret = a6xx_gmu_notify_slumber(gmu); ++ if (ret) ++ goto force_off; ++ ++ ret = gmu_poll_timeout(gmu, ++ REG_A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS, val, ++ !(val & A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS_GPUBUSYIGNAHB), ++ 100, 10000); ++ ++ /* ++ * Let the user know we failed to slumber but don't worry too ++ * much because we are powering down anyway ++ */ ++ ++ if (ret) ++ DRM_DEV_ERROR(gmu->dev, ++ "Unable to slumber GMU: status = 0%x/0%x\n", ++ gmu_read(gmu, ++ REG_A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS), ++ gmu_read(gmu, ++ REG_A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS2)); ++ + /* Turn off HFI */ + a6xx_hfi_stop(gmu); + +@@ -1094,6 +1095,11 @@ static void a6xx_gmu_shutdown(struct a6x + + /* Tell RPMh to power off the GPU */ + a6xx_rpmh_stop(gmu); ++ ++ return; ++ ++force_off: ++ a6xx_gmu_force_off(gmu); + } + + diff --git a/queue-6.6/drm-repaper-fix-integer-overflows-in-repeat-functions.patch b/queue-6.6/drm-repaper-fix-integer-overflows-in-repeat-functions.patch new file mode 100644 index 0000000000..ad000f6890 --- /dev/null +++ b/queue-6.6/drm-repaper-fix-integer-overflows-in-repeat-functions.patch @@ -0,0 +1,53 @@ +From 4d098000ac193f359e6b8ca4801dbdbd6a27b41f Mon Sep 17 00:00:00 2001 +From: Nikita Zhandarovich +Date: Thu, 16 Jan 2025 05:48:01 -0800 +Subject: drm/repaper: fix integer overflows in repeat functions + +From: Nikita Zhandarovich + +commit 4d098000ac193f359e6b8ca4801dbdbd6a27b41f upstream. + +There are conditions, albeit somewhat unlikely, under which right hand +expressions, calculating the end of time period in functions like +repaper_frame_fixed_repeat(), may overflow. + +For instance, if 'factor10x' in repaper_get_temperature() is high +enough (170), as is 'epd->stage_time' in repaper_probe(), then the +resulting value of 'end' will not fit in unsigned int expression. + +Mitigate this by casting 'epd->factored_stage_time' to wider type before +any multiplication is done. + +Found by Linux Verification Center (linuxtesting.org) with static +analysis tool SVACE. + +Fixes: 3589211e9b03 ("drm/tinydrm: Add RePaper e-ink driver") +Cc: stable@vger.kernel.org +Signed-off-by: Nikita Zhandarovich +Signed-off-by: Alex Lanzano +Link: https://patchwork.freedesktop.org/patch/msgid/20250116134801.22067-1-n.zhandarovich@fintech.ru +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/tiny/repaper.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/tiny/repaper.c ++++ b/drivers/gpu/drm/tiny/repaper.c +@@ -455,7 +455,7 @@ static void repaper_frame_fixed_repeat(s + enum repaper_stage stage) + { + u64 start = local_clock(); +- u64 end = start + (epd->factored_stage_time * 1000 * 1000); ++ u64 end = start + ((u64)epd->factored_stage_time * 1000 * 1000); + + do { + repaper_frame_fixed(epd, fixed_value, stage); +@@ -466,7 +466,7 @@ static void repaper_frame_data_repeat(st + const u8 *mask, enum repaper_stage stage) + { + u64 start = local_clock(); +- u64 end = start + (epd->factored_stage_time * 1000 * 1000); ++ u64 end = start + ((u64)epd->factored_stage_time * 1000 * 1000); + + do { + repaper_frame_data(epd, image, mask, stage); diff --git a/queue-6.6/series b/queue-6.6/series index 677ced7984..0ebad8969e 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -343,3 +343,12 @@ perf-x86-intel-allow-to-update-user-space-gprs-from-pebs-records.patch perf-x86-intel-uncore-fix-the-scale-of-iio-free-running-counters-on-snr.patch perf-x86-intel-uncore-fix-the-scale-of-iio-free-running-counters-on-icx.patch perf-x86-intel-uncore-fix-the-scale-of-iio-free-running-counters-on-spr.patch +drm-repaper-fix-integer-overflows-in-repeat-functions.patch +drm-msm-a6xx-fix-stale-rpmh-votes-from-gpu.patch +drm-amd-handle-being-compiled-without-si-or-cik-support-better.patch +drm-amd-pm-prevent-division-by-zero.patch +drm-amd-pm-powerplay-prevent-division-by-zero.patch +drm-amd-pm-smu11-prevent-division-by-zero.patch +drm-amd-pm-powerplay-hwmgr-smu7_thermal-prevent-division-by-zero.patch +drm-amd-pm-swsmu-smu13-smu_v13_0-prevent-division-by-zero.patch +drm-amd-pm-powerplay-hwmgr-vega20_thermal-prevent-division-by-zero.patch