From 3058401ef67aa3b461346c6e743df9ef7325db3e Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Wed, 4 Sep 2024 13:42:40 -0400 Subject: [PATCH] Fixes for 6.10 Signed-off-by: Sasha Levin --- ...ix-possible-null-pointer-dereference.patch | 107 ++++++++ ...-blk_flush_integrity-call-in-blk_int.patch | 44 ++++ ...id-overflow-of-target_freq-in-fast-s.patch | 41 +++ ...ff-by-one-missing-to-clear-most-sign.patch | 43 ++++ ...-cryp-call-finalize-with-bh-disabled.patch | 51 ++++ ...-msgdma-properly-free-descriptor-in-.patch | 55 ++++ ...-msgdma-use-irq-variant-of-spin_lock.patch | 51 ++++ ...issing-checks-on-iio_info-s-callback.patch | 174 +++++++++++++ ...md-amdgpu-check-tbo-resource-pointer.patch | 40 +++ ...add-array-index-check-for-hdcp-ddc-a.patch | 95 +++++++ ...add-missing-null-pointer-check-withi.patch | 39 +++ ...add-otg_master-null-check-within-res.patch | 43 ++++ ...added-null-check-at-start-of-dc_vali.patch | 43 ++++ ...assign-linear_pitch_alignment-even-f.patch | 38 +++ ...avoid-overflow-from-uint32_t-to-uint.patch | 55 ++++ ...-check-bios-images-before-it-is-used.patch | 86 +++++++ ...check-gpio_id-before-used-as-array-i.patch | 80 ++++++ ...check-index-for-aux_rd_interval-befo.patch | 43 ++++ ...check-link_index-before-accessing-dc.patch | 42 ++++ ...check-msg_id-before-processing-trans.patch | 68 +++++ ...check-num_valid_sets-before-accessin.patch | 43 ++++ ...correct-the-defined-value-for-amdgpu.patch | 41 +++ ...play-disable-dmcub-timeout-for-dcn35.patch | 51 ++++ ...don-t-use-fsleep-for-psr-exit-waits-.patch | 42 ++++ ...ensure-array-index-tg_inst-won-t-be-.patch | 41 +++ ...ensure-index-calculation-will-not-ov.patch | 46 ++++ ...fix-coverity-integer_overflow-within.patch | 52 ++++ ...verity-integer_overflow-within.patch-32439 | 50 ++++ ...fix-coverity-interger_overflow-withi.patch | 65 +++++ ...fix-incorrect-size-calculation-for-l.patch | 44 ++++ ...fix-index-may-exceed-array-range-wit.patch | 117 +++++++++ ...fix-pipe-addition-logic-in-calc_bloc.patch | 52 ++++ ...fix-writeback-job-lock-evasion-withi.patch | 63 +++++ ...handle-the-case-which-quad_part-is-e.patch | 39 +++ ...release-clck_src-memory-if-clk_src_c.patch | 106 ++++++++ ...release-state-memory-if-amdgpu_dm_cr.patch | 48 ++++ ...remove-register-from-dcn35-dmcub-dia.patch | 54 ++++ ...skip-inactive-planes-within-modesupp.patch | 48 ++++ ...skip-wbscl_set_scaler_filter-if-filt.patch | 41 +++ ...isplay-spinlock-before-reading-event.patch | 54 ++++ ...stop-amdgpu_dm-initialize-when-link-.patch | 60 +++++ ...stop-amdgpu_dm-initialize-when-strea.patch | 46 ++++ ...use-preferred-link-settings-for-dp-s.patch | 63 +++++ ...eck-negtive-return-for-table-entries.patch | 61 +++++ ...m-check-specific-index-for-aldebaran.patch | 37 +++ ...md-pm-check-specific-index-for-smu13.patch | 37 +++ ...amd-pm-fix-negative-array-index-read.patch | 94 +++++++ ...m-fix-the-out-of-bounds-read-warning.patch | 39 +++ ...ninitialized-variable-warning-for-sm.patch | 87 +++++++ ...alized-variable-warning-for-sm.patch-18788 | 238 ++++++++++++++++++ ...m-fix-uninitialized-variable-warning.patch | 37 +++ ...ninitialized-variable-warnings-for-v.patch | 180 +++++++++++++ ...alized-variable-warnings-for-v.patch-20400 | 56 +++++ ...arning-using-uninitialized-value-of-.patch | 41 +++ ...d-lock-in-amdgpu_gart_invalidate_tlb.patch | 51 ++++ ...ock-in-kfd_process_dequeue_from_devi.patch | 52 ++++ ...-add-skip_hw_access-checks-for-sriov.patch | 60 +++++ ...void-reading-vf2pf-info-size-from-fb.patch | 37 +++ ...ompiler-side-effect-check-issue-for-.patch | 80 ++++++ ...gpu-fix-dereference-after-null-check.patch | 35 +++ ...x-mc_data-out-of-bounds-read-warning.patch | 35 +++ ...ut-of-bounds-read-of-df_v1_7_channel.patch | 36 +++ ...dgpu-fix-out-of-bounds-write-warning.patch | 40 +++ ...-overflowed-array-index-read-warning.patch | 41 +++ ...verflowed-constant-warning-in-mmhub_.patch | 82 ++++++ ...x-the-uninitialized-variable-warning.patch | 38 +++ ...pu-fix-the-waring-dereferencing-hive.patch | 36 +++ ...he-warning-bad-bit-shift-operation-f.patch | 36 +++ ...he-warning-division-or-modulo-by-zer.patch | 40 +++ ...fix-ucode-out-of-bounds-read-warning.patch | 36 +++ ...ninitialized-scalar-variable-warning.patch | 36 +++ ...ninitialized-variable-warning-for-am.patch | 36 +++ ...ninitialized-variable-warning-for-jp.patch | 35 +++ ...ninitialized-variable-warning-in-amd.patch | 35 +++ ...alized-variable-warning-in-amd.patch-11331 | 62 +++++ ...e-sg-size-limit-for-contiguous-alloc.patch | 83 ++++++ ...eck-input-value-for-custom-profile-m.patch | 65 +++++ ...eck-input-value-for-power-profile-se.patch | 164 ++++++++++++ ...eck-the-return-value-of-smum_send_ms.patch | 49 ++++ ...x-uninitialized-variable-agc_btc_res.patch | 50 ++++ ...x-uninitialized-variable-warning-for.patch | 185 ++++++++++++++ ...u-queue-kfd-reset-workitem-in-vf-fed.patch | 41 +++ ...pu-set-ras-fed-status-for-more-cases.patch | 47 ++++ ...arning-dereferencing-obj-for-nbio_v7.patch | 36 +++ ...e-type-of-buf-size-to-u32-for-eeprom.patch | 71 ++++++ ...emove-irq-disabling-in-vcn-5-suspend.patch | 71 ++++++ ...intentional-integer-overflow-for-mal.patch | 39 +++ ...-debug-trap-enable-before-write-dbg_.patch | 47 ++++ ...cile-the-definition-and-use-of-oem_i.patch | 71 ++++++ ...ode1-reset-for-ras-poison-consumptio.patch | 44 ++++ ...767-check-if-fully-initialized-befor.patch | 39 +++ ...rop-conditionals-around-of_node-poin.patch | 47 ++++ ...pinned-buffer-handling-at-kfd-restor.patch | 59 +++++ .../drm-meson-plane-add-error-handling.patch | 63 +++++ ...tate-asserts-to-deregister_exec_queu.patch | 38 +++ ...id-domain-is-passed-in-xe_force_wake.patch | 46 ++++ ...e-demote-ccs_mode-info-to-debug-only.patch | 40 +++ ...-don-t-overmap-identity-vram-mapping.patch | 146 +++++++++++ ...ller-uses-sole-domain-for-xe_force_w.patch | 62 +++++ .../drm-xe-fix-the-warning-conditions.patch | 67 +++++ ...ix-assert-in-l3-bank-mask-generation.patch | 52 ++++ ...ove-unwanted-write-permission-for-cu.patch | 48 ++++ ...e-missing-lock-in-relay_needs_worker.patch | 43 ++++ ...anity-check-on-blocks-for-inline_dat.patch | 86 +++++++ ...fy-clear-parent_watched-flags-lazily.patch | 208 +++++++++++++++ .../gfs2-revert-add-quota_change-type.patch | 115 +++++++++ ...p-check-return-value-of-amd_smn_read.patch | 123 +++++++++ ...wspinlock-introduce-hwspin_lock_bust.patch | 137 ++++++++++ ...ic-fix-potential-irq-name-truncation.patch | 38 +++ ...nforce-alignment-of-frame-and-interv.patch | 68 +++++ .../media-v4l2-cci-always-assign-val.patch | 46 ++++ ...5e-shampo-fix-incorrect-page-release.patch | 47 ++++ ...pointer-net-parameter-in-ip_metrics_.patch | 183 ++++++++++++++ ...dccp-prepare-for-tw_timer-un-pinning.patch | 217 ++++++++++++++++ ...oresource_bus-existence-during-probe.patch | 85 +++++++ ...et-gpio_device-in-loop-in-pinctrl_pi.patch | 45 ++++ ...rzg2l-validate-power-registers-for-s.patch | 57 +++++ ...cros_ec_lpc-mec-access-can-use-an-am.patch | 178 +++++++++++++ ...32-overflow-issue-in-32-bit-width-pw.patch | 59 +++++ ...date-address-map-when-information-is.patch | 205 +++++++++++++++ ...buggy-bypass-lock-contention-mitigat.patch | 140 +++++++++++ ...rly-handle-unexpected-aq-completions.patch | 112 +++++++++ ...otential-off-by-one-when-calculating.patch | 47 ++++ ...tek-zero-out-only-remaining-bytes-of.patch | 38 +++ ...q6v5_pas-add-hwspinlock-bust-on-stop.patch | 113 +++++++++ ...isplay-fix-incorrect-pointer-assignm.patch | 59 +++++ queue-6.10/series | 141 +++++++++++ ...mack-tcp-ipv4-fix-incorrect-labeling.patch | 69 +++++ ...d-qcom_smem_bust_hwspin_lock_by_host.patch | 76 ++++++ ...a-races-around-tw-tw_ts_recent-and-t.patch | 149 +++++++++++ ...-read_once-for-lockless-access-to-tr.patch | 70 ++++++ ...ix-null-pointer-dereference-in-trace.patch | 44 ++++ ...-don-t-submit-special-requests-twice.patch | 183 ++++++++++++++ ...ialize-ret-in-ath11k_qmi_load_file_t.patch | 45 ++++ ...ialize-ret-in-ath12k_dp_rxdma_ring_s.patch | 46 ++++ ...ialize-ret-in-ath12k_qmi_load_file_t.patch | 45 ++++ ...ke-hash-table-duplicates-more-surviv.patch | 130 ++++++++++ ...strict-operation-during-radar-detect.patch | 122 +++++++++ ...-use-only-beacon-bss-load-for-active.patch | 72 ++++++ .../wifi-iwlwifi-remove-fw_running-op.patch | 80 ++++++ ...eck-ieee80211_bss_info_change_notify.patch | 45 ++++ ...er-avoid-multiple-deinit-on-same-cam.patch | 44 ++++ 142 files changed, 9930 insertions(+) create mode 100644 queue-6.10/apparmor-fix-possible-null-pointer-dereference.patch create mode 100644 queue-6.10/block-remove-the-blk_flush_integrity-call-in-blk_int.patch create mode 100644 queue-6.10/cpufreq-scmi-avoid-overflow-of-target_freq-in-fast-s.patch create mode 100644 queue-6.10/crypto-ecc-fix-off-by-one-missing-to-clear-most-sign.patch create mode 100644 queue-6.10/crypto-stm32-cryp-call-finalize-with-bh-disabled.patch create mode 100644 queue-6.10/dmaengine-altera-msgdma-properly-free-descriptor-in-.patch create mode 100644 queue-6.10/dmaengine-altera-msgdma-use-irq-variant-of-spin_lock.patch create mode 100644 queue-6.10/driver-iio-add-missing-checks-on-iio_info-s-callback.patch create mode 100644 queue-6.10/drm-amd-amdgpu-check-tbo-resource-pointer.patch create mode 100644 queue-6.10/drm-amd-display-add-array-index-check-for-hdcp-ddc-a.patch create mode 100644 queue-6.10/drm-amd-display-add-missing-null-pointer-check-withi.patch create mode 100644 queue-6.10/drm-amd-display-add-otg_master-null-check-within-res.patch create mode 100644 queue-6.10/drm-amd-display-added-null-check-at-start-of-dc_vali.patch create mode 100644 queue-6.10/drm-amd-display-assign-linear_pitch_alignment-even-f.patch create mode 100644 queue-6.10/drm-amd-display-avoid-overflow-from-uint32_t-to-uint.patch create mode 100644 queue-6.10/drm-amd-display-check-bios-images-before-it-is-used.patch create mode 100644 queue-6.10/drm-amd-display-check-gpio_id-before-used-as-array-i.patch create mode 100644 queue-6.10/drm-amd-display-check-index-for-aux_rd_interval-befo.patch create mode 100644 queue-6.10/drm-amd-display-check-link_index-before-accessing-dc.patch create mode 100644 queue-6.10/drm-amd-display-check-msg_id-before-processing-trans.patch create mode 100644 queue-6.10/drm-amd-display-check-num_valid_sets-before-accessin.patch create mode 100644 queue-6.10/drm-amd-display-correct-the-defined-value-for-amdgpu.patch create mode 100644 queue-6.10/drm-amd-display-disable-dmcub-timeout-for-dcn35.patch create mode 100644 queue-6.10/drm-amd-display-don-t-use-fsleep-for-psr-exit-waits-.patch create mode 100644 queue-6.10/drm-amd-display-ensure-array-index-tg_inst-won-t-be-.patch create mode 100644 queue-6.10/drm-amd-display-ensure-index-calculation-will-not-ov.patch create mode 100644 queue-6.10/drm-amd-display-fix-coverity-integer_overflow-within.patch create mode 100644 queue-6.10/drm-amd-display-fix-coverity-integer_overflow-within.patch-32439 create mode 100644 queue-6.10/drm-amd-display-fix-coverity-interger_overflow-withi.patch create mode 100644 queue-6.10/drm-amd-display-fix-incorrect-size-calculation-for-l.patch create mode 100644 queue-6.10/drm-amd-display-fix-index-may-exceed-array-range-wit.patch create mode 100644 queue-6.10/drm-amd-display-fix-pipe-addition-logic-in-calc_bloc.patch create mode 100644 queue-6.10/drm-amd-display-fix-writeback-job-lock-evasion-withi.patch create mode 100644 queue-6.10/drm-amd-display-handle-the-case-which-quad_part-is-e.patch create mode 100644 queue-6.10/drm-amd-display-release-clck_src-memory-if-clk_src_c.patch create mode 100644 queue-6.10/drm-amd-display-release-state-memory-if-amdgpu_dm_cr.patch create mode 100644 queue-6.10/drm-amd-display-remove-register-from-dcn35-dmcub-dia.patch create mode 100644 queue-6.10/drm-amd-display-skip-inactive-planes-within-modesupp.patch create mode 100644 queue-6.10/drm-amd-display-skip-wbscl_set_scaler_filter-if-filt.patch create mode 100644 queue-6.10/drm-amd-display-spinlock-before-reading-event.patch create mode 100644 queue-6.10/drm-amd-display-stop-amdgpu_dm-initialize-when-link-.patch create mode 100644 queue-6.10/drm-amd-display-stop-amdgpu_dm-initialize-when-strea.patch create mode 100644 queue-6.10/drm-amd-display-use-preferred-link-settings-for-dp-s.patch create mode 100644 queue-6.10/drm-amd-pm-check-negtive-return-for-table-entries.patch create mode 100644 queue-6.10/drm-amd-pm-check-specific-index-for-aldebaran.patch create mode 100644 queue-6.10/drm-amd-pm-check-specific-index-for-smu13.patch create mode 100644 queue-6.10/drm-amd-pm-fix-negative-array-index-read.patch create mode 100644 queue-6.10/drm-amd-pm-fix-the-out-of-bounds-read-warning.patch create mode 100644 queue-6.10/drm-amd-pm-fix-uninitialized-variable-warning-for-sm.patch create mode 100644 queue-6.10/drm-amd-pm-fix-uninitialized-variable-warning-for-sm.patch-18788 create mode 100644 queue-6.10/drm-amd-pm-fix-uninitialized-variable-warning.patch create mode 100644 queue-6.10/drm-amd-pm-fix-uninitialized-variable-warnings-for-v.patch create mode 100644 queue-6.10/drm-amd-pm-fix-uninitialized-variable-warnings-for-v.patch-20400 create mode 100644 queue-6.10/drm-amd-pm-fix-warning-using-uninitialized-value-of-.patch create mode 100644 queue-6.10/drm-amdgpu-add-lock-in-amdgpu_gart_invalidate_tlb.patch create mode 100644 queue-6.10/drm-amdgpu-add-lock-in-kfd_process_dequeue_from_devi.patch create mode 100644 queue-6.10/drm-amdgpu-add-skip_hw_access-checks-for-sriov.patch create mode 100644 queue-6.10/drm-amdgpu-avoid-reading-vf2pf-info-size-from-fb.patch create mode 100644 queue-6.10/drm-amdgpu-fix-compiler-side-effect-check-issue-for-.patch create mode 100644 queue-6.10/drm-amdgpu-fix-dereference-after-null-check.patch create mode 100644 queue-6.10/drm-amdgpu-fix-mc_data-out-of-bounds-read-warning.patch create mode 100644 queue-6.10/drm-amdgpu-fix-out-of-bounds-read-of-df_v1_7_channel.patch create mode 100644 queue-6.10/drm-amdgpu-fix-out-of-bounds-write-warning.patch create mode 100644 queue-6.10/drm-amdgpu-fix-overflowed-array-index-read-warning.patch create mode 100644 queue-6.10/drm-amdgpu-fix-overflowed-constant-warning-in-mmhub_.patch create mode 100644 queue-6.10/drm-amdgpu-fix-the-uninitialized-variable-warning.patch create mode 100644 queue-6.10/drm-amdgpu-fix-the-waring-dereferencing-hive.patch create mode 100644 queue-6.10/drm-amdgpu-fix-the-warning-bad-bit-shift-operation-f.patch create mode 100644 queue-6.10/drm-amdgpu-fix-the-warning-division-or-modulo-by-zer.patch create mode 100644 queue-6.10/drm-amdgpu-fix-ucode-out-of-bounds-read-warning.patch create mode 100644 queue-6.10/drm-amdgpu-fix-uninitialized-scalar-variable-warning.patch create mode 100644 queue-6.10/drm-amdgpu-fix-uninitialized-variable-warning-for-am.patch create mode 100644 queue-6.10/drm-amdgpu-fix-uninitialized-variable-warning-for-jp.patch create mode 100644 queue-6.10/drm-amdgpu-fix-uninitialized-variable-warning-in-amd.patch create mode 100644 queue-6.10/drm-amdgpu-fix-uninitialized-variable-warning-in-amd.patch-11331 create mode 100644 queue-6.10/drm-amdgpu-handle-sg-size-limit-for-contiguous-alloc.patch create mode 100644 queue-6.10/drm-amdgpu-pm-check-input-value-for-custom-profile-m.patch create mode 100644 queue-6.10/drm-amdgpu-pm-check-input-value-for-power-profile-se.patch create mode 100644 queue-6.10/drm-amdgpu-pm-check-the-return-value-of-smum_send_ms.patch create mode 100644 queue-6.10/drm-amdgpu-pm-fix-uninitialized-variable-agc_btc_res.patch create mode 100644 queue-6.10/drm-amdgpu-pm-fix-uninitialized-variable-warning-for.patch create mode 100644 queue-6.10/drm-amdgpu-queue-kfd-reset-workitem-in-vf-fed.patch create mode 100644 queue-6.10/drm-amdgpu-set-ras-fed-status-for-more-cases.patch create mode 100644 queue-6.10/drm-amdgpu-the-warning-dereferencing-obj-for-nbio_v7.patch create mode 100644 queue-6.10/drm-amdgpu-update-type-of-buf-size-to-u32-for-eeprom.patch create mode 100644 queue-6.10/drm-amdgpu-vcn-remove-irq-disabling-in-vcn-5-suspend.patch create mode 100644 queue-6.10/drm-amdgu-fix-unintentional-integer-overflow-for-mal.patch create mode 100644 queue-6.10/drm-amdkfd-check-debug-trap-enable-before-write-dbg_.patch create mode 100644 queue-6.10/drm-amdkfd-reconcile-the-definition-and-use-of-oem_i.patch create mode 100644 queue-6.10/drm-amdkfd-use-mode1-reset-for-ras-poison-consumptio.patch create mode 100644 queue-6.10/drm-bridge-tc358767-check-if-fully-initialized-befor.patch create mode 100644 queue-6.10/drm-drm-bridge-drop-conditionals-around-of_node-poin.patch create mode 100644 queue-6.10/drm-kfd-correct-pinned-buffer-handling-at-kfd-restor.patch create mode 100644 queue-6.10/drm-meson-plane-add-error-handling.patch create mode 100644 queue-6.10/drm-xe-add-guc-state-asserts-to-deregister_exec_queu.patch create mode 100644 queue-6.10/drm-xe-check-valid-domain-is-passed-in-xe_force_wake.patch create mode 100644 queue-6.10/drm-xe-demote-ccs_mode-info-to-debug-only.patch create mode 100644 queue-6.10/drm-xe-don-t-overmap-identity-vram-mapping.patch create mode 100644 queue-6.10/drm-xe-ensure-caller-uses-sole-domain-for-xe_force_w.patch create mode 100644 queue-6.10/drm-xe-fix-the-warning-conditions.patch create mode 100644 queue-6.10/drm-xe-gt-fix-assert-in-l3-bank-mask-generation.patch create mode 100644 queue-6.10/drm-xe-hwmon-remove-unwanted-write-permission-for-cu.patch create mode 100644 queue-6.10/drm-xe-use-missing-lock-in-relay_needs_worker.patch create mode 100644 queue-6.10/f2fs-fix-to-do-sanity-check-on-blocks-for-inline_dat.patch create mode 100644 queue-6.10/fsnotify-clear-parent_watched-flags-lazily.patch create mode 100644 queue-6.10/gfs2-revert-add-quota_change-type.patch create mode 100644 queue-6.10/hwmon-k10temp-check-return-value-of-amd_smn_read.patch create mode 100644 queue-6.10/hwspinlock-introduce-hwspin_lock_bust.patch create mode 100644 queue-6.10/ionic-fix-potential-irq-name-truncation.patch create mode 100644 queue-6.10/media-uvcvideo-enforce-alignment-of-frame-and-interv.patch create mode 100644 queue-6.10/media-v4l2-cci-always-assign-val.patch create mode 100644 queue-6.10/net-mlx5e-shampo-fix-incorrect-page-release.patch create mode 100644 queue-6.10/net-remove-null-pointer-net-parameter-in-ip_metrics_.patch create mode 100644 queue-6.10/net-tcp-dccp-prepare-for-tw_timer-un-pinning.patch create mode 100644 queue-6.10/pci-al-check-ioresource_bus-existence-during-probe.patch create mode 100644 queue-6.10/pinctrl-core-reset-gpio_device-in-loop-in-pinctrl_pi.patch create mode 100644 queue-6.10/pinctrl-renesas-rzg2l-validate-power-registers-for-s.patch create mode 100644 queue-6.10/platform-chrome-cros_ec_lpc-mec-access-can-use-an-am.patch create mode 100644 queue-6.10/pwm-xilinx-fix-u32-overflow-issue-in-32-bit-width-pw.patch create mode 100644 queue-6.10/ras-amd-atl-validate-address-map-when-information-is.patch create mode 100644 queue-6.10/rcu-nocb-remove-buggy-bypass-lock-contention-mitigat.patch create mode 100644 queue-6.10/rdma-efa-properly-handle-unexpected-aq-completions.patch create mode 100644 queue-6.10/regmap-spi-fix-potential-off-by-one-when-calculating.patch create mode 100644 queue-6.10/remoteproc-mediatek-zero-out-only-remaining-bytes-of.patch create mode 100644 queue-6.10/remoteproc-qcom_q6v5_pas-add-hwspinlock-bust-on-stop.patch create mode 100644 queue-6.10/revert-drm-amd-display-fix-incorrect-pointer-assignm.patch create mode 100644 queue-6.10/smack-tcp-ipv4-fix-incorrect-labeling.patch create mode 100644 queue-6.10/soc-qcom-smem-add-qcom_smem_bust_hwspin_lock_by_host.patch create mode 100644 queue-6.10/tcp-annotate-data-races-around-tw-tw_ts_recent-and-t.patch create mode 100644 queue-6.10/thermal-trip-use-read_once-for-lockless-access-to-tr.patch create mode 100644 queue-6.10/usb-typec-ucsi-fix-null-pointer-dereference-in-trace.patch create mode 100644 queue-6.10/usbip-don-t-submit-special-requests-twice.patch create mode 100644 queue-6.10/wifi-ath11k-initialize-ret-in-ath11k_qmi_load_file_t.patch create mode 100644 queue-6.10/wifi-ath12k-initialize-ret-in-ath12k_dp_rxdma_ring_s.patch create mode 100644 queue-6.10/wifi-ath12k-initialize-ret-in-ath12k_qmi_load_file_t.patch create mode 100644 queue-6.10/wifi-cfg80211-make-hash-table-duplicates-more-surviv.patch create mode 100644 queue-6.10/wifi-cfg80211-restrict-operation-during-radar-detect.patch create mode 100644 queue-6.10/wifi-iwlwifi-mvm-use-only-beacon-bss-load-for-active.patch create mode 100644 queue-6.10/wifi-iwlwifi-remove-fw_running-op.patch create mode 100644 queue-6.10/wifi-mac80211-check-ieee80211_bss_info_change_notify.patch create mode 100644 queue-6.10/wifi-rtw89-ser-avoid-multiple-deinit-on-same-cam.patch diff --git a/queue-6.10/apparmor-fix-possible-null-pointer-dereference.patch b/queue-6.10/apparmor-fix-possible-null-pointer-dereference.patch new file mode 100644 index 00000000000..0c8eb14ff57 --- /dev/null +++ b/queue-6.10/apparmor-fix-possible-null-pointer-dereference.patch @@ -0,0 +1,107 @@ +From 704173f3756bff53bb9f77fa89a4960e6964332a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 May 2024 01:12:29 +0900 +Subject: apparmor: fix possible NULL pointer dereference + +From: Leesoo Ahn + +[ Upstream commit 3dd384108d53834002be5630132ad5c3f32166ad ] + +profile->parent->dents[AAFS_PROF_DIR] could be NULL only if its parent is made +from __create_missing_ancestors(..) and 'ent->old' is NULL in +aa_replace_profiles(..). +In that case, it must return an error code and the code, -ENOENT represents +its state that the path of its parent is not existed yet. + +BUG: kernel NULL pointer dereference, address: 0000000000000030 +PGD 0 P4D 0 +PREEMPT SMP PTI +CPU: 4 PID: 3362 Comm: apparmor_parser Not tainted 6.8.0-24-generic #24 +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 +RIP: 0010:aafs_create.constprop.0+0x7f/0x130 +Code: 4c 63 e0 48 83 c4 18 4c 89 e0 5b 41 5c 41 5d 41 5e 41 5f 5d 31 d2 31 c9 31 f6 31 ff 45 31 c0 45 31 c9 45 31 d2 c3 cc cc cc cc <4d> 8b 55 30 4d 8d ba a0 00 00 00 4c 89 55 c0 4c 89 ff e8 7a 6a ae +RSP: 0018:ffffc9000b2c7c98 EFLAGS: 00010246 +RAX: 0000000000000000 RBX: 00000000000041ed RCX: 0000000000000000 +RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 +RBP: ffffc9000b2c7cd8 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff82baac10 +R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 +FS: 00007be9f22cf740(0000) GS:ffff88817bc00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000000000000030 CR3: 0000000134b08000 CR4: 00000000000006f0 +Call Trace: + + ? show_regs+0x6d/0x80 + ? __die+0x24/0x80 + ? page_fault_oops+0x99/0x1b0 + ? kernelmode_fixup_or_oops+0xb2/0x140 + ? __bad_area_nosemaphore+0x1a5/0x2c0 + ? find_vma+0x34/0x60 + ? bad_area_nosemaphore+0x16/0x30 + ? do_user_addr_fault+0x2a2/0x6b0 + ? exc_page_fault+0x83/0x1b0 + ? asm_exc_page_fault+0x27/0x30 + ? aafs_create.constprop.0+0x7f/0x130 + ? aafs_create.constprop.0+0x51/0x130 + __aafs_profile_mkdir+0x3d6/0x480 + aa_replace_profiles+0x83f/0x1270 + policy_update+0xe3/0x180 + profile_load+0xbc/0x150 + ? rw_verify_area+0x47/0x140 + vfs_write+0x100/0x480 + ? __x64_sys_openat+0x55/0xa0 + ? syscall_exit_to_user_mode+0x86/0x260 + ksys_write+0x73/0x100 + __x64_sys_write+0x19/0x30 + x64_sys_call+0x7e/0x25c0 + do_syscall_64+0x7f/0x180 + entry_SYSCALL_64_after_hwframe+0x78/0x80 +RIP: 0033:0x7be9f211c574 +Code: c7 00 16 00 00 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 80 3d d5 ea 0e 00 00 74 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 55 48 89 e5 48 83 ec 20 48 89 +RSP: 002b:00007ffd26f2b8c8 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 +RAX: ffffffffffffffda RBX: 00005d504415e200 RCX: 00007be9f211c574 +RDX: 0000000000001fc1 RSI: 00005d504418bc80 RDI: 0000000000000004 +RBP: 0000000000001fc1 R08: 0000000000001fc1 R09: 0000000080000000 +R10: 0000000000000000 R11: 0000000000000202 R12: 00005d504418bc80 +R13: 0000000000000004 R14: 00007ffd26f2b9b0 R15: 00007ffd26f2ba30 + +Modules linked in: snd_seq_dummy snd_hrtimer qrtr snd_hda_codec_generic snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hda_core snd_hwdep snd_pcm snd_seq_midi snd_seq_midi_event snd_rawmidi snd_seq snd_seq_device i2c_i801 snd_timer i2c_smbus qxl snd soundcore drm_ttm_helper lpc_ich ttm joydev input_leds serio_raw mac_hid binfmt_misc msr parport_pc ppdev lp parport efi_pstore nfnetlink dmi_sysfs qemu_fw_cfg ip_tables x_tables autofs4 hid_generic usbhid hid ahci libahci psmouse virtio_rng xhci_pci xhci_pci_renesas +CR2: 0000000000000030 +---[ end trace 0000000000000000 ]--- +RIP: 0010:aafs_create.constprop.0+0x7f/0x130 +Code: 4c 63 e0 48 83 c4 18 4c 89 e0 5b 41 5c 41 5d 41 5e 41 5f 5d 31 d2 31 c9 31 f6 31 ff 45 31 c0 45 31 c9 45 31 d2 c3 cc cc cc cc <4d> 8b 55 30 4d 8d ba a0 00 00 00 4c 89 55 c0 4c 89 ff e8 7a 6a ae +RSP: 0018:ffffc9000b2c7c98 EFLAGS: 00010246 +RAX: 0000000000000000 RBX: 00000000000041ed RCX: 0000000000000000 +RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 +RBP: ffffc9000b2c7cd8 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff82baac10 +R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 +FS: 00007be9f22cf740(0000) GS:ffff88817bc00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000000000000030 CR3: 0000000134b08000 CR4: 00000000000006f0 + +Signed-off-by: Leesoo Ahn +Signed-off-by: John Johansen +Signed-off-by: Sasha Levin +--- + security/apparmor/apparmorfs.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c +index bcfea073e3f2..01b923d97a44 100644 +--- a/security/apparmor/apparmorfs.c ++++ b/security/apparmor/apparmorfs.c +@@ -1692,6 +1692,10 @@ int __aafs_profile_mkdir(struct aa_profile *profile, struct dentry *parent) + struct aa_profile *p; + p = aa_deref_parent(profile); + dent = prof_dir(p); ++ if (!dent) { ++ error = -ENOENT; ++ goto fail2; ++ } + /* adding to parent that previously didn't have children */ + dent = aafs_create_dir("profiles", dent); + if (IS_ERR(dent)) +-- +2.43.0 + diff --git a/queue-6.10/block-remove-the-blk_flush_integrity-call-in-blk_int.patch b/queue-6.10/block-remove-the-blk_flush_integrity-call-in-blk_int.patch new file mode 100644 index 00000000000..1c310bf51b2 --- /dev/null +++ b/queue-6.10/block-remove-the-blk_flush_integrity-call-in-blk_int.patch @@ -0,0 +1,44 @@ +From 8a2f77d55e4e81f22f45fd73bc3cfd6fce1c298b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jun 2024 10:48:16 +0200 +Subject: block: remove the blk_flush_integrity call in + blk_integrity_unregister + +From: Christoph Hellwig + +[ Upstream commit e8bc14d116aeac8f0f133ec8d249acf4e0658da7 ] + +Now that there are no indirect calls for PI processing there is no +way to dereference a NULL pointer here. Additionally drivers now always +freeze the queue (or in case of stacking drivers use their internal +equivalent) around changing the integrity profile. + +This is effectively a revert of commit 3df49967f6f1 ("block: flush the +integrity workqueue in blk_integrity_unregister"). + +Signed-off-by: Christoph Hellwig +Reviewed-by: Martin K. Petersen +Reviewed-by: Hannes Reinecke +Link: https://lore.kernel.org/r/20240613084839.1044015-7-hch@lst.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-integrity.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/block/blk-integrity.c b/block/blk-integrity.c +index ccbeb6dfa87a..8dd8a0126274 100644 +--- a/block/blk-integrity.c ++++ b/block/blk-integrity.c +@@ -397,8 +397,6 @@ void blk_integrity_unregister(struct gendisk *disk) + if (!bi->profile) + return; + +- /* ensure all bios are off the integrity workqueue */ +- blk_flush_integrity(); + blk_queue_flag_clear(QUEUE_FLAG_STABLE_WRITES, disk->queue); + memset(bi, 0, sizeof(*bi)); + } +-- +2.43.0 + diff --git a/queue-6.10/cpufreq-scmi-avoid-overflow-of-target_freq-in-fast-s.patch b/queue-6.10/cpufreq-scmi-avoid-overflow-of-target_freq-in-fast-s.patch new file mode 100644 index 00000000000..dea33923cca --- /dev/null +++ b/queue-6.10/cpufreq-scmi-avoid-overflow-of-target_freq-in-fast-s.patch @@ -0,0 +1,41 @@ +From 4e7a517f95e381d18ce53c82f8d22440fb31a04c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 May 2024 12:07:32 +0530 +Subject: cpufreq: scmi: Avoid overflow of target_freq in fast switch + +From: Jagadeesh Kona + +[ Upstream commit 074cffb5020ddcaa5fafcc55655e5da6ebe8c831 ] + +Conversion of target_freq to HZ in scmi_cpufreq_fast_switch() +can lead to overflow if the multiplied result is greater than +UINT_MAX, since type of target_freq is unsigned int. Avoid this +overflow by assigning target_freq to unsigned long variable for +converting it to HZ. + +Signed-off-by: Jagadeesh Kona +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/scmi-cpufreq.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c +index 3b4f6bfb2f4c..b87fd127aa43 100644 +--- a/drivers/cpufreq/scmi-cpufreq.c ++++ b/drivers/cpufreq/scmi-cpufreq.c +@@ -63,9 +63,9 @@ static unsigned int scmi_cpufreq_fast_switch(struct cpufreq_policy *policy, + unsigned int target_freq) + { + struct scmi_data *priv = policy->driver_data; ++ unsigned long freq = target_freq; + +- if (!perf_ops->freq_set(ph, priv->domain_id, +- target_freq * 1000, true)) ++ if (!perf_ops->freq_set(ph, priv->domain_id, freq * 1000, true)) + return target_freq; + + return 0; +-- +2.43.0 + diff --git a/queue-6.10/crypto-ecc-fix-off-by-one-missing-to-clear-most-sign.patch b/queue-6.10/crypto-ecc-fix-off-by-one-missing-to-clear-most-sign.patch new file mode 100644 index 00000000000..78c4511de8f --- /dev/null +++ b/queue-6.10/crypto-ecc-fix-off-by-one-missing-to-clear-most-sign.patch @@ -0,0 +1,43 @@ +From 26727b72c076b28ee9ea8d77952bcf92a49033b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jun 2024 17:38:20 -0400 +Subject: crypto: ecc - Fix off-by-one missing to clear most significant digit + +From: Stefan Berger + +[ Upstream commit 1dcf865d3bf5bff45e93cb2410911b3428dacb78 ] + +Fix an off-by-one error where the most significant digit was not +initialized leading to signature verification failures by the testmgr. + +Example: If a curve requires ndigits (=9) and diff (=2) indicates that +2 digits need to be set to zero then start with digit 'ndigits - diff' (=7) +and clear 'diff' digits starting from there, so 7 and 8. + +Reported-by: Venkat Rao Bagalkote +Closes: https://lore.kernel.org/linux-crypto/619bc2de-b18a-4939-a652-9ca886bf6349@linux.ibm.com/T/#m045d8812409ce233c17fcdb8b88b6629c671f9f4 +Fixes: 2fd2a82ccbfc ("crypto: ecdsa - Use ecc_digits_from_bytes to create hash digits array") +Signed-off-by: Stefan Berger +Tested-by: Venkat Rao Bagalkote +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/ecc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/crypto/ecc.c b/crypto/ecc.c +index fe761256e335..dd48d9928a21 100644 +--- a/crypto/ecc.c ++++ b/crypto/ecc.c +@@ -78,7 +78,7 @@ void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes, + /* diff > 0: not enough input bytes: set most significant digits to 0 */ + if (diff > 0) { + ndigits -= diff; +- memset(&out[ndigits - 1], 0, diff * sizeof(u64)); ++ memset(&out[ndigits], 0, diff * sizeof(u64)); + } + + if (o) { +-- +2.43.0 + diff --git a/queue-6.10/crypto-stm32-cryp-call-finalize-with-bh-disabled.patch b/queue-6.10/crypto-stm32-cryp-call-finalize-with-bh-disabled.patch new file mode 100644 index 00000000000..b0646ca7795 --- /dev/null +++ b/queue-6.10/crypto-stm32-cryp-call-finalize-with-bh-disabled.patch @@ -0,0 +1,51 @@ +From 86a9d3d66639c919bec669718b53c8c3b0ec02b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 May 2024 16:05:48 +0200 +Subject: crypto: stm32/cryp - call finalize with bh disabled +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maxime Méré + +[ Upstream commit 56ddb9aa3b324c2d9645b5a7343e46010cf3f6ce ] + +The finalize operation in interrupt mode produce a produces a spinlock +recursion warning. The reason is the fact that BH must be disabled +during this process. + +Signed-off-by: Maxime Méré +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/stm32/stm32-cryp.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/stm32/stm32-cryp.c b/drivers/crypto/stm32/stm32-cryp.c +index 11ad4ffdce0d..84f5f30d5ddd 100644 +--- a/drivers/crypto/stm32/stm32-cryp.c ++++ b/drivers/crypto/stm32/stm32-cryp.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -1665,8 +1666,11 @@ static irqreturn_t stm32_cryp_irq_thread(int irq, void *arg) + it_mask &= ~IMSCR_OUT; + stm32_cryp_write(cryp, cryp->caps->imsc, it_mask); + +- if (!cryp->payload_in && !cryp->header_in && !cryp->payload_out) ++ if (!cryp->payload_in && !cryp->header_in && !cryp->payload_out) { ++ local_bh_disable(); + stm32_cryp_finish_req(cryp, 0); ++ local_bh_enable(); ++ } + + return IRQ_HANDLED; + } +-- +2.43.0 + diff --git a/queue-6.10/dmaengine-altera-msgdma-properly-free-descriptor-in-.patch b/queue-6.10/dmaengine-altera-msgdma-properly-free-descriptor-in-.patch new file mode 100644 index 00000000000..1e472a955a7 --- /dev/null +++ b/queue-6.10/dmaengine-altera-msgdma-properly-free-descriptor-in-.patch @@ -0,0 +1,55 @@ +From 2a734922d83617714ae795965752c4595da2eb2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Jun 2024 23:31:48 +0200 +Subject: dmaengine: altera-msgdma: properly free descriptor in + msgdma_free_descriptor + +From: Olivier Dautricourt + +[ Upstream commit 54e4ada1a4206f878e345ae01cf37347d803d1b1 ] + +Remove list_del call in msgdma_chan_desc_cleanup, this should be the role +of msgdma_free_descriptor. In consequence replace list_add_tail with +list_move_tail in msgdma_free_descriptor. + +This fixes the path: + msgdma_free_chan_resources -> msgdma_free_descriptors -> + msgdma_free_desc_list -> msgdma_free_descriptor + +which does not correctly free the descriptors as first nodes were not +removed from the list. + +Signed-off-by: Olivier Dautricourt +Tested-by: Olivier Dautricourt +Link: https://lore.kernel.org/r/20240608213216.25087-3-olivierdautricourt@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/altera-msgdma.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/dma/altera-msgdma.c b/drivers/dma/altera-msgdma.c +index 160a465b06dd..041f549c8c99 100644 +--- a/drivers/dma/altera-msgdma.c ++++ b/drivers/dma/altera-msgdma.c +@@ -233,7 +233,7 @@ static void msgdma_free_descriptor(struct msgdma_device *mdev, + struct msgdma_sw_desc *child, *next; + + mdev->desc_free_cnt++; +- list_add_tail(&desc->node, &mdev->free_list); ++ list_move_tail(&desc->node, &mdev->free_list); + list_for_each_entry_safe(child, next, &desc->tx_list, node) { + mdev->desc_free_cnt++; + list_move_tail(&child->node, &mdev->free_list); +@@ -588,8 +588,6 @@ static void msgdma_chan_desc_cleanup(struct msgdma_device *mdev) + list_for_each_entry_safe(desc, next, &mdev->done_list, node) { + struct dmaengine_desc_callback cb; + +- list_del(&desc->node); +- + dmaengine_desc_get_callback(&desc->async_tx, &cb); + if (dmaengine_desc_callback_valid(&cb)) { + spin_unlock_irqrestore(&mdev->lock, irqflags); +-- +2.43.0 + diff --git a/queue-6.10/dmaengine-altera-msgdma-use-irq-variant-of-spin_lock.patch b/queue-6.10/dmaengine-altera-msgdma-use-irq-variant-of-spin_lock.patch new file mode 100644 index 00000000000..fa69aeaff17 --- /dev/null +++ b/queue-6.10/dmaengine-altera-msgdma-use-irq-variant-of-spin_lock.patch @@ -0,0 +1,51 @@ +From 62c376c1bdcb28552859775bb53e9d8d665ee454 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Jun 2024 23:31:46 +0200 +Subject: dmaengine: altera-msgdma: use irq variant of spin_lock/unlock while + invoking callbacks + +From: Olivier Dautricourt + +[ Upstream commit 261d3a85d959841821ca0d69f9d7b0d4087661c4 ] + +As we first take the lock with spin_lock_irqsave in msgdma_tasklet, Lockdep +might complain about this. Inspired by commit 9558cf4ad07e +("dmaengine: zynqmp_dma: fix lockdep warning in tasklet") + +Signed-off-by: Olivier Dautricourt +Tested-by: Olivier Dautricourt +Suggested-by: Eric Schwarz +Link: https://lore.kernel.org/r/20240608213216.25087-1-olivierdautricourt@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/altera-msgdma.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/altera-msgdma.c b/drivers/dma/altera-msgdma.c +index a8e3615235b8..160a465b06dd 100644 +--- a/drivers/dma/altera-msgdma.c ++++ b/drivers/dma/altera-msgdma.c +@@ -583,6 +583,7 @@ static void msgdma_issue_pending(struct dma_chan *chan) + static void msgdma_chan_desc_cleanup(struct msgdma_device *mdev) + { + struct msgdma_sw_desc *desc, *next; ++ unsigned long irqflags; + + list_for_each_entry_safe(desc, next, &mdev->done_list, node) { + struct dmaengine_desc_callback cb; +@@ -591,9 +592,9 @@ static void msgdma_chan_desc_cleanup(struct msgdma_device *mdev) + + dmaengine_desc_get_callback(&desc->async_tx, &cb); + if (dmaengine_desc_callback_valid(&cb)) { +- spin_unlock(&mdev->lock); ++ spin_unlock_irqrestore(&mdev->lock, irqflags); + dmaengine_desc_callback_invoke(&cb, NULL); +- spin_lock(&mdev->lock); ++ spin_lock_irqsave(&mdev->lock, irqflags); + } + + /* Run any dependencies, then free the descriptor */ +-- +2.43.0 + diff --git a/queue-6.10/driver-iio-add-missing-checks-on-iio_info-s-callback.patch b/queue-6.10/driver-iio-add-missing-checks-on-iio_info-s-callback.patch new file mode 100644 index 00000000000..41a71da1bb8 --- /dev/null +++ b/queue-6.10/driver-iio-add-missing-checks-on-iio_info-s-callback.patch @@ -0,0 +1,174 @@ +From d8394bdd8cc0b97c2eab777e8d8421b5105e2eda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 May 2024 11:22:46 +0200 +Subject: driver: iio: add missing checks on iio_info's callback access + +From: Julien Stephan + +[ Upstream commit c4ec8dedca961db056ec85cb7ca8c9f7e2e92252 ] + +Some callbacks from iio_info structure are accessed without any check, so +if a driver doesn't implement them trying to access the corresponding +sysfs entries produce a kernel oops such as: + +[ 2203.527791] Unable to handle kernel NULL pointer dereference at virtual address 00000000 when execute +[...] +[ 2203.783416] Call trace: +[ 2203.783429] iio_read_channel_info_avail from dev_attr_show+0x18/0x48 +[ 2203.789807] dev_attr_show from sysfs_kf_seq_show+0x90/0x120 +[ 2203.794181] sysfs_kf_seq_show from seq_read_iter+0xd0/0x4e4 +[ 2203.798555] seq_read_iter from vfs_read+0x238/0x2a0 +[ 2203.802236] vfs_read from ksys_read+0xa4/0xd4 +[ 2203.805385] ksys_read from ret_fast_syscall+0x0/0x54 +[ 2203.809135] Exception stack(0xe0badfa8 to 0xe0badff0) +[ 2203.812880] dfa0: 00000003 b6f10f80 00000003 b6eab000 00020000 00000000 +[ 2203.819746] dfc0: 00000003 b6f10f80 7ff00000 00000003 00000003 00000000 00020000 00000000 +[ 2203.826619] dfe0: b6e1bc88 bed80958 b6e1bc94 b6e1bcb0 +[ 2203.830363] Code: bad PC value +[ 2203.832695] ---[ end trace 0000000000000000 ]--- + +Reviewed-by: Nuno Sa +Signed-off-by: Julien Stephan +Link: https://lore.kernel.org/r/20240530-iio-core-fix-segfault-v3-1-8b7cd2a03773@baylibre.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/industrialio-core.c | 7 ++++++- + drivers/iio/industrialio-event.c | 9 +++++++++ + drivers/iio/inkern.c | 32 ++++++++++++++++++++++---------- + 3 files changed, 37 insertions(+), 11 deletions(-) + +diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c +index fa7cc051b4c4..2f185b386949 100644 +--- a/drivers/iio/industrialio-core.c ++++ b/drivers/iio/industrialio-core.c +@@ -758,9 +758,11 @@ static ssize_t iio_read_channel_info(struct device *dev, + INDIO_MAX_RAW_ELEMENTS, + vals, &val_len, + this_attr->address); +- else ++ else if (indio_dev->info->read_raw) + ret = indio_dev->info->read_raw(indio_dev, this_attr->c, + &vals[0], &vals[1], this_attr->address); ++ else ++ return -EINVAL; + + if (ret < 0) + return ret; +@@ -842,6 +844,9 @@ static ssize_t iio_read_channel_info_avail(struct device *dev, + int length; + int type; + ++ if (!indio_dev->info->read_avail) ++ return -EINVAL; ++ + ret = indio_dev->info->read_avail(indio_dev, this_attr->c, + &vals, &type, &length, + this_attr->address); +diff --git a/drivers/iio/industrialio-event.c b/drivers/iio/industrialio-event.c +index 910c1f14abd5..a64f8fbac597 100644 +--- a/drivers/iio/industrialio-event.c ++++ b/drivers/iio/industrialio-event.c +@@ -285,6 +285,9 @@ static ssize_t iio_ev_state_store(struct device *dev, + if (ret < 0) + return ret; + ++ if (!indio_dev->info->write_event_config) ++ return -EINVAL; ++ + ret = indio_dev->info->write_event_config(indio_dev, + this_attr->c, iio_ev_attr_type(this_attr), + iio_ev_attr_dir(this_attr), val); +@@ -300,6 +303,9 @@ static ssize_t iio_ev_state_show(struct device *dev, + struct iio_dev_attr *this_attr = to_iio_dev_attr(attr); + int val; + ++ if (!indio_dev->info->read_event_config) ++ return -EINVAL; ++ + val = indio_dev->info->read_event_config(indio_dev, + this_attr->c, iio_ev_attr_type(this_attr), + iio_ev_attr_dir(this_attr)); +@@ -318,6 +324,9 @@ static ssize_t iio_ev_value_show(struct device *dev, + int val, val2, val_arr[2]; + int ret; + ++ if (!indio_dev->info->read_event_value) ++ return -EINVAL; ++ + ret = indio_dev->info->read_event_value(indio_dev, + this_attr->c, iio_ev_attr_type(this_attr), + iio_ev_attr_dir(this_attr), iio_ev_attr_info(this_attr), +diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c +index 485e6fc44a04..39cf26d69d17 100644 +--- a/drivers/iio/inkern.c ++++ b/drivers/iio/inkern.c +@@ -543,6 +543,7 @@ EXPORT_SYMBOL_GPL(devm_iio_channel_get_all); + static int iio_channel_read(struct iio_channel *chan, int *val, int *val2, + enum iio_chan_info_enum info) + { ++ const struct iio_info *iio_info = chan->indio_dev->info; + int unused; + int vals[INDIO_MAX_RAW_ELEMENTS]; + int ret; +@@ -554,15 +555,18 @@ static int iio_channel_read(struct iio_channel *chan, int *val, int *val2, + if (!iio_channel_has_info(chan->channel, info)) + return -EINVAL; + +- if (chan->indio_dev->info->read_raw_multi) { +- ret = chan->indio_dev->info->read_raw_multi(chan->indio_dev, +- chan->channel, INDIO_MAX_RAW_ELEMENTS, +- vals, &val_len, info); ++ if (iio_info->read_raw_multi) { ++ ret = iio_info->read_raw_multi(chan->indio_dev, ++ chan->channel, ++ INDIO_MAX_RAW_ELEMENTS, ++ vals, &val_len, info); + *val = vals[0]; + *val2 = vals[1]; ++ } else if (iio_info->read_raw) { ++ ret = iio_info->read_raw(chan->indio_dev, ++ chan->channel, val, val2, info); + } else { +- ret = chan->indio_dev->info->read_raw(chan->indio_dev, +- chan->channel, val, val2, info); ++ return -EINVAL; + } + + return ret; +@@ -750,11 +754,15 @@ static int iio_channel_read_avail(struct iio_channel *chan, + const int **vals, int *type, int *length, + enum iio_chan_info_enum info) + { ++ const struct iio_info *iio_info = chan->indio_dev->info; ++ + if (!iio_channel_has_available(chan->channel, info)) + return -EINVAL; + +- return chan->indio_dev->info->read_avail(chan->indio_dev, chan->channel, +- vals, type, length, info); ++ if (iio_info->read_avail) ++ return iio_info->read_avail(chan->indio_dev, chan->channel, ++ vals, type, length, info); ++ return -EINVAL; + } + + int iio_read_avail_channel_attribute(struct iio_channel *chan, +@@ -917,8 +925,12 @@ EXPORT_SYMBOL_GPL(iio_get_channel_type); + static int iio_channel_write(struct iio_channel *chan, int val, int val2, + enum iio_chan_info_enum info) + { +- return chan->indio_dev->info->write_raw(chan->indio_dev, +- chan->channel, val, val2, info); ++ const struct iio_info *iio_info = chan->indio_dev->info; ++ ++ if (iio_info->write_raw) ++ return iio_info->write_raw(chan->indio_dev, ++ chan->channel, val, val2, info); ++ return -EINVAL; + } + + int iio_write_channel_attribute(struct iio_channel *chan, int val, int val2, +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-amdgpu-check-tbo-resource-pointer.patch b/queue-6.10/drm-amd-amdgpu-check-tbo-resource-pointer.patch new file mode 100644 index 00000000000..add0385a657 --- /dev/null +++ b/queue-6.10/drm-amd-amdgpu-check-tbo-resource-pointer.patch @@ -0,0 +1,40 @@ +From fb1410ca7e9e10bca6fc9db0b73f80c3a02b71a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Apr 2024 02:26:55 +0800 +Subject: drm/amd/amdgpu: Check tbo resource pointer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Asad Kamal + +[ Upstream commit 6cd2b872643bb29bba01a8ac739138db7bd79007 ] + +Validate tbo resource pointer, skip if NULL + +Signed-off-by: Asad Kamal +Reviewed-by: Christian König +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index 89cf9ac6da17..13b54e00a247 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -5012,7 +5012,8 @@ static int amdgpu_device_recover_vram(struct amdgpu_device *adev) + shadow = vmbo->shadow; + + /* No need to recover an evicted BO */ +- if (shadow->tbo.resource->mem_type != TTM_PL_TT || ++ if (!shadow->tbo.resource || ++ shadow->tbo.resource->mem_type != TTM_PL_TT || + shadow->tbo.resource->start == AMDGPU_BO_INVALID_OFFSET || + shadow->parent->tbo.resource->mem_type != TTM_PL_VRAM) + continue; +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-add-array-index-check-for-hdcp-ddc-a.patch b/queue-6.10/drm-amd-display-add-array-index-check-for-hdcp-ddc-a.patch new file mode 100644 index 00000000000..f38af9d3af6 --- /dev/null +++ b/queue-6.10/drm-amd-display-add-array-index-check-for-hdcp-ddc-a.patch @@ -0,0 +1,95 @@ +From 7c31a36e4d3b0b66831bd02c4ec46669babe4149 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 10:09:31 -0400 +Subject: drm/amd/display: Add array index check for hdcp ddc access + +From: Hersen Wu + +[ Upstream commit 4e70c0f5251c25885c31ee84a31f99a01f7cf50e ] + +[Why] +Coverity reports OVERRUN warning. Do not check if array +index valid. + +[How] +Check msg_id valid and valid array index. + +Reviewed-by: Alex Hung +Acked-by: Tom Chung +Signed-off-by: Hersen Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/modules/hdcp/hdcp_ddc.c | 28 ++++++++++++++++--- + 1 file changed, 24 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c +index 8e9caae7c955..1b2df97226a3 100644 +--- a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c ++++ b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c +@@ -156,11 +156,16 @@ static enum mod_hdcp_status read(struct mod_hdcp *hdcp, + uint32_t cur_size = 0; + uint32_t data_offset = 0; + +- if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID) { ++ if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID || ++ msg_id >= MOD_HDCP_MESSAGE_ID_MAX) + return MOD_HDCP_STATUS_DDC_FAILURE; +- } + + if (is_dp_hdcp(hdcp)) { ++ int num_dpcd_addrs = sizeof(hdcp_dpcd_addrs) / ++ sizeof(hdcp_dpcd_addrs[0]); ++ if (msg_id >= num_dpcd_addrs) ++ return MOD_HDCP_STATUS_DDC_FAILURE; ++ + while (buf_len > 0) { + cur_size = MIN(buf_len, HDCP_MAX_AUX_TRANSACTION_SIZE); + success = hdcp->config.ddc.funcs.read_dpcd(hdcp->config.ddc.handle, +@@ -175,6 +180,11 @@ static enum mod_hdcp_status read(struct mod_hdcp *hdcp, + data_offset += cur_size; + } + } else { ++ int num_i2c_offsets = sizeof(hdcp_i2c_offsets) / ++ sizeof(hdcp_i2c_offsets[0]); ++ if (msg_id >= num_i2c_offsets) ++ return MOD_HDCP_STATUS_DDC_FAILURE; ++ + success = hdcp->config.ddc.funcs.read_i2c( + hdcp->config.ddc.handle, + HDCP_I2C_ADDR, +@@ -219,11 +229,16 @@ static enum mod_hdcp_status write(struct mod_hdcp *hdcp, + uint32_t cur_size = 0; + uint32_t data_offset = 0; + +- if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID) { ++ if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID || ++ msg_id >= MOD_HDCP_MESSAGE_ID_MAX) + return MOD_HDCP_STATUS_DDC_FAILURE; +- } + + if (is_dp_hdcp(hdcp)) { ++ int num_dpcd_addrs = sizeof(hdcp_dpcd_addrs) / ++ sizeof(hdcp_dpcd_addrs[0]); ++ if (msg_id >= num_dpcd_addrs) ++ return MOD_HDCP_STATUS_DDC_FAILURE; ++ + while (buf_len > 0) { + cur_size = MIN(buf_len, HDCP_MAX_AUX_TRANSACTION_SIZE); + success = hdcp->config.ddc.funcs.write_dpcd( +@@ -239,6 +254,11 @@ static enum mod_hdcp_status write(struct mod_hdcp *hdcp, + data_offset += cur_size; + } + } else { ++ int num_i2c_offsets = sizeof(hdcp_i2c_offsets) / ++ sizeof(hdcp_i2c_offsets[0]); ++ if (msg_id >= num_i2c_offsets) ++ return MOD_HDCP_STATUS_DDC_FAILURE; ++ + hdcp->buf[0] = hdcp_i2c_offsets[msg_id]; + memmove(&hdcp->buf[1], buf, buf_len); + success = hdcp->config.ddc.funcs.write_i2c( +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-add-missing-null-pointer-check-withi.patch b/queue-6.10/drm-amd-display-add-missing-null-pointer-check-withi.patch new file mode 100644 index 00000000000..3ad39435e2a --- /dev/null +++ b/queue-6.10/drm-amd-display-add-missing-null-pointer-check-withi.patch @@ -0,0 +1,39 @@ +From 0c5b2ed8845536761da66b1caa3d98336a25c15e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 16:22:44 -0400 +Subject: drm/amd/display: Add missing NULL pointer check within + dpcd_extend_address_range + +From: Hersen Wu + +[ Upstream commit 5524fa301ba649f8cf00848f91468e0ba7e4f24c ] + +[Why & How] +ASSERT if return NULL from kcalloc. + +Reviewed-by: Alex Hung +Reviewed-by: Rodrigo Siqueira +Acked-by: Tom Chung +Signed-off-by: Hersen Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c +index a72c898b64fa..584b9295a12a 100644 +--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c ++++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c +@@ -165,6 +165,7 @@ static void dpcd_extend_address_range( + *out_address = new_addr_range.start; + *out_size = ADDRESS_RANGE_SIZE(new_addr_range.start, new_addr_range.end); + *out_data = kcalloc(*out_size, sizeof(**out_data), GFP_KERNEL); ++ ASSERT(*out_data); + } + } + +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-add-otg_master-null-check-within-res.patch b/queue-6.10/drm-amd-display-add-otg_master-null-check-within-res.patch new file mode 100644 index 00000000000..f0b6d1a5d41 --- /dev/null +++ b/queue-6.10/drm-amd-display-add-otg_master-null-check-within-res.patch @@ -0,0 +1,43 @@ +From e8e28385e39720e3003e7968fef7b34b3292e298 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Apr 2024 11:13:47 -0400 +Subject: drm/amd/display: Add otg_master NULL check within + resource_log_pipe_topology_update + +From: Hersen Wu + +[ Upstream commit 871cd9d881fa791d3f82885000713de07041c0ae ] + +[Why] +Coverity reports NULL_RETURN warning. + +[How] +Add otg_master NULL check. + +Reviewed-by: Harry Wentland +Acked-by: Tom Chung +Signed-off-by: Hersen Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +index ce5adb8bc377..b43e489e8d61 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +@@ -2283,6 +2283,9 @@ void resource_log_pipe_topology_update(struct dc *dc, struct dc_state *state) + state->stream_status[stream_idx].mall_stream_config.paired_stream); + otg_master = resource_get_otg_master_for_stream( + &state->res_ctx, state->streams[phantom_stream_idx]); ++ if (!otg_master) ++ continue; ++ + resource_log_pipe_for_stream(dc, state, otg_master, stream_idx); + } + } +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-added-null-check-at-start-of-dc_vali.patch b/queue-6.10/drm-amd-display-added-null-check-at-start-of-dc_vali.patch new file mode 100644 index 00000000000..b9ee3170a23 --- /dev/null +++ b/queue-6.10/drm-amd-display-added-null-check-at-start-of-dc_vali.patch @@ -0,0 +1,43 @@ +From 85d98207eaaff28a3f2bcc435dcbf37446835125 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 May 2024 08:51:19 -0400 +Subject: drm/amd/display: added NULL check at start of dc_validate_stream + +From: winstang + +[ Upstream commit 26c56049cc4f1705b498df013949427692a4b0d5 ] + +[Why] +prevent invalid memory access + +[How] +check if dc and stream are NULL + +Co-authored-by: winstang +Reviewed-by: Alvin Lee +Acked-by: Zaeem Mohamed +Signed-off-by: winstang +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +index b43e489e8d61..786b56e96a81 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +@@ -4672,6 +4672,9 @@ void resource_build_bit_depth_reduction_params(struct dc_stream_state *stream, + + enum dc_status dc_validate_stream(struct dc *dc, struct dc_stream_state *stream) + { ++ if (dc == NULL || stream == NULL) ++ return DC_ERROR_UNEXPECTED; ++ + struct dc_link *link = stream->link; + struct timing_generator *tg = dc->res_pool->timing_generators[0]; + enum dc_status res = DC_OK; +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-assign-linear_pitch_alignment-even-f.patch b/queue-6.10/drm-amd-display-assign-linear_pitch_alignment-even-f.patch new file mode 100644 index 00000000000..1ce91058898 --- /dev/null +++ b/queue-6.10/drm-amd-display-assign-linear_pitch_alignment-even-f.patch @@ -0,0 +1,38 @@ +From 68f207c20d9563857ef95cd0a65a035276bb5467 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Apr 2024 14:42:18 -0400 +Subject: drm/amd/display: Assign linear_pitch_alignment even for VM + +From: Alvin Lee + +[ Upstream commit 984debc133efa05e62f5aa1a7a1dd8ca0ef041f4 ] + +[Description] +Assign linear_pitch_alignment so we don't cause a divide by 0 +error in VM environments + +Reviewed-by: Sohaib Nadeem +Acked-by: Wayne Lin +Signed-off-by: Alvin Lee +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c +index 236876d95185..da237f718dbd 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c +@@ -1421,6 +1421,7 @@ struct dc *dc_create(const struct dc_init_data *init_params) + return NULL; + + if (init_params->dce_environment == DCE_ENV_VIRTUAL_HW) { ++ dc->caps.linear_pitch_alignment = 64; + if (!dc_construct_ctx(dc, init_params)) + goto destruct_dc; + } else { +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-avoid-overflow-from-uint32_t-to-uint.patch b/queue-6.10/drm-amd-display-avoid-overflow-from-uint32_t-to-uint.patch new file mode 100644 index 00000000000..53eb58b52fa --- /dev/null +++ b/queue-6.10/drm-amd-display-avoid-overflow-from-uint32_t-to-uint.patch @@ -0,0 +1,55 @@ +From 9596b494824caa5df25b821efe6609e07f8b02bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 May 2024 11:51:26 -0600 +Subject: drm/amd/display: Avoid overflow from uint32_t to uint8_t + +From: Alex Hung + +[ Upstream commit d6b54900c564e35989cf6813e4071504fa0a90e0 ] + +[WHAT & HOW] +dmub_rb_cmd's ramping_boundary has size of uint8_t and it is assigned +0xFFFF. Fix it by changing it to uint8_t with value of 0xFF. + +This fixes 2 INTEGER_OVERFLOW issues reported by Coverity. + +Reviewed-by: Rodrigo Siqueira +Acked-by: Zaeem Mohamed +Signed-off-by: Alex Hung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c | 2 +- + drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c b/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c +index b851fc65f5b7..5c2d6642633d 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c +@@ -258,7 +258,7 @@ bool dmub_abm_set_pipe(struct abm *abm, + { + union dmub_rb_cmd cmd; + struct dc_context *dc = abm->ctx; +- uint32_t ramping_boundary = 0xFFFF; ++ uint8_t ramping_boundary = 0xFF; + + memset(&cmd, 0, sizeof(cmd)); + cmd.abm_set_pipe.header.type = DMUB_CMD__ABM; +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c +index 804be977ea47..3de65a9f0e6f 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c +@@ -142,7 +142,7 @@ static bool dmub_abm_set_pipe(struct abm *abm, uint32_t otg_inst, + { + union dmub_rb_cmd cmd; + struct dc_context *dc = abm->ctx; +- uint32_t ramping_boundary = 0xFFFF; ++ uint8_t ramping_boundary = 0xFF; + + memset(&cmd, 0, sizeof(cmd)); + cmd.abm_set_pipe.header.type = DMUB_CMD__ABM; +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-check-bios-images-before-it-is-used.patch b/queue-6.10/drm-amd-display-check-bios-images-before-it-is-used.patch new file mode 100644 index 00000000000..7e66c697eec --- /dev/null +++ b/queue-6.10/drm-amd-display-check-bios-images-before-it-is-used.patch @@ -0,0 +1,86 @@ +From b99f11fe9011ffddc2b8c83f76db2c2b88ca71cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 08:24:13 -0600 +Subject: drm/amd/display: Check BIOS images before it is used + +From: Alex Hung + +[ Upstream commit 8b0ddf19cca2a352b2a7e01d99d3ba949a99c84c ] + +BIOS images may fail to load and null checks are added before they are +used. + +This fixes 6 NULL_RETURNS issues reported by Coverity. + +Reviewed-by: Harry Wentland +Acked-by: Hamza Mahfooz +Signed-off-by: Alex Hung +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c b/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c +index 25fe1a124029..3bacf470f7c5 100644 +--- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c ++++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c +@@ -665,6 +665,9 @@ static enum bp_result get_ss_info_v3_1( + ss_table_header_include = ((ATOM_ASIC_INTERNAL_SS_INFO_V3 *) bios_get_image(&bp->base, + DATA_TABLES(ASIC_InternalSS_Info), + struct_size(ss_table_header_include, asSpreadSpectrum, 1))); ++ if (!ss_table_header_include) ++ return BP_RESULT_UNSUPPORTED; ++ + table_size = + (le16_to_cpu(ss_table_header_include->sHeader.usStructureSize) + - sizeof(ATOM_COMMON_TABLE_HEADER)) +@@ -1034,6 +1037,8 @@ static enum bp_result get_ss_info_from_internal_ss_info_tbl_V2_1( + &bp->base, + DATA_TABLES(ASIC_InternalSS_Info), + struct_size(header, asSpreadSpectrum, 1))); ++ if (!header) ++ return result; + + memset(info, 0, sizeof(struct spread_spectrum_info)); + +@@ -1107,6 +1112,8 @@ static enum bp_result get_ss_info_from_ss_info_table( + get_atom_data_table_revision(header, &revision); + + tbl = GET_IMAGE(ATOM_SPREAD_SPECTRUM_INFO, DATA_TABLES(SS_Info)); ++ if (!tbl) ++ return result; + + if (1 != revision.major || 2 > revision.minor) + return result; +@@ -1634,6 +1641,8 @@ static uint32_t get_ss_entry_number_from_ss_info_tbl( + + tbl = GET_IMAGE(ATOM_SPREAD_SPECTRUM_INFO, + DATA_TABLES(SS_Info)); ++ if (!tbl) ++ return number; + + if (1 != revision.major || 2 > revision.minor) + return number; +@@ -1716,6 +1725,8 @@ static uint32_t get_ss_entry_number_from_internal_ss_info_tbl_v2_1( + &bp->base, + DATA_TABLES(ASIC_InternalSS_Info), + struct_size(header_include, asSpreadSpectrum, 1))); ++ if (!header_include) ++ return 0; + + size = (le16_to_cpu(header_include->sHeader.usStructureSize) + - sizeof(ATOM_COMMON_TABLE_HEADER)) +@@ -1755,6 +1766,9 @@ static uint32_t get_ss_entry_number_from_internal_ss_info_tbl_V3_1( + header_include = ((ATOM_ASIC_INTERNAL_SS_INFO_V3 *) bios_get_image(&bp->base, + DATA_TABLES(ASIC_InternalSS_Info), + struct_size(header_include, asSpreadSpectrum, 1))); ++ if (!header_include) ++ return number; ++ + size = (le16_to_cpu(header_include->sHeader.usStructureSize) - + sizeof(ATOM_COMMON_TABLE_HEADER)) / + sizeof(ATOM_ASIC_SS_ASSIGNMENT_V3); +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-check-gpio_id-before-used-as-array-i.patch b/queue-6.10/drm-amd-display-check-gpio_id-before-used-as-array-i.patch new file mode 100644 index 00000000000..5d3ea1efdf9 --- /dev/null +++ b/queue-6.10/drm-amd-display-check-gpio_id-before-used-as-array-i.patch @@ -0,0 +1,80 @@ +From 708d191b5dee4e8d1dc578f58302d9f1cc409e18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Apr 2024 16:40:00 -0600 +Subject: drm/amd/display: Check gpio_id before used as array index + +From: Alex Hung + +[ Upstream commit 2a5626eeb3b5eec7a36886f9556113dd93ec8ed6 ] + +[WHY & HOW] +GPIO_ID_UNKNOWN (-1) is not a valid value for array index and therefore +should be checked in advance. + +This fixes 5 OVERRUN issues reported by Coverity. + +Reviewed-by: Harry Wentland +Acked-by: Tom Chung +Signed-off-by: Alex Hung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c b/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c +index 663c17f52779..d19d5c177022 100644 +--- a/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c ++++ b/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c +@@ -239,6 +239,9 @@ static bool is_pin_busy( + enum gpio_id id, + uint32_t en) + { ++ if (id == GPIO_ID_UNKNOWN) ++ return false; ++ + return service->busyness[id][en]; + } + +@@ -247,6 +250,9 @@ static void set_pin_busy( + enum gpio_id id, + uint32_t en) + { ++ if (id == GPIO_ID_UNKNOWN) ++ return; ++ + service->busyness[id][en] = true; + } + +@@ -255,6 +261,9 @@ static void set_pin_free( + enum gpio_id id, + uint32_t en) + { ++ if (id == GPIO_ID_UNKNOWN) ++ return; ++ + service->busyness[id][en] = false; + } + +@@ -263,7 +272,7 @@ enum gpio_result dal_gpio_service_lock( + enum gpio_id id, + uint32_t en) + { +- if (!service->busyness[id]) { ++ if (id != GPIO_ID_UNKNOWN && !service->busyness[id]) { + ASSERT_CRITICAL(false); + return GPIO_RESULT_OPEN_FAILED; + } +@@ -277,7 +286,7 @@ enum gpio_result dal_gpio_service_unlock( + enum gpio_id id, + uint32_t en) + { +- if (!service->busyness[id]) { ++ if (id != GPIO_ID_UNKNOWN && !service->busyness[id]) { + ASSERT_CRITICAL(false); + return GPIO_RESULT_OPEN_FAILED; + } +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-check-index-for-aux_rd_interval-befo.patch b/queue-6.10/drm-amd-display-check-index-for-aux_rd_interval-befo.patch new file mode 100644 index 00000000000..543ef1c7be6 --- /dev/null +++ b/queue-6.10/drm-amd-display-check-index-for-aux_rd_interval-befo.patch @@ -0,0 +1,43 @@ +From 4a912a6fbfa72bf4966c7e1dec7475e0ce114823 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Apr 2024 18:22:43 -0600 +Subject: drm/amd/display: Check index for aux_rd_interval before using + +From: Alex Hung + +[ Upstream commit 9ba2ea6337b4f159aecb177555a6a81da92d302e ] + +aux_rd_interval has size of 7 and should be checked. + +This fixes 3 OVERRUN and 1 INTEGER_OVERFLOW issues reported by Coverity. + +Reviewed-by: Rodrigo Siqueira +Acked-by: Tom Chung +Signed-off-by: Alex Hung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/dc/link/protocols/link_dp_training.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c +index 1818970b8eaf..b8e704dbe956 100644 +--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c ++++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c +@@ -914,10 +914,10 @@ static enum dc_status configure_lttpr_mode_non_transparent( + /* Driver does not need to train the first hop. Skip DPCD read and clear + * AUX_RD_INTERVAL for DPTX-to-DPIA hop. + */ +- if (link->ep_type == DISPLAY_ENDPOINT_USB4_DPIA) ++ if (link->ep_type == DISPLAY_ENDPOINT_USB4_DPIA && repeater_cnt > 0 && repeater_cnt < MAX_REPEATER_CNT) + link->dpcd_caps.lttpr_caps.aux_rd_interval[--repeater_cnt] = 0; + +- for (repeater_id = repeater_cnt; repeater_id > 0; repeater_id--) { ++ for (repeater_id = repeater_cnt; repeater_id > 0 && repeater_id < MAX_REPEATER_CNT; repeater_id--) { + aux_interval_address = DP_TRAINING_AUX_RD_INTERVAL_PHY_REPEATER1 + + ((DP_REPEATER_CONFIGURATION_AND_STATUS_SIZE) * (repeater_id - 1)); + core_link_read_dpcd( +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-check-link_index-before-accessing-dc.patch b/queue-6.10/drm-amd-display-check-link_index-before-accessing-dc.patch new file mode 100644 index 00000000000..21660a0e457 --- /dev/null +++ b/queue-6.10/drm-amd-display-check-link_index-before-accessing-dc.patch @@ -0,0 +1,42 @@ +From 2949eea1c4129f0d659203997b3d1a9bbc43a673 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Apr 2024 16:30:17 -0600 +Subject: drm/amd/display: Check link_index before accessing dc->links[] + +From: Alex Hung + +[ Upstream commit 8aa2864044b9d13e95fe224f32e808afbf79ecdf ] + +[WHY & HOW] +dc->links[] has max size of MAX_LINKS and NULL is return when trying to +access with out-of-bound index. + +This fixes 3 OVERRUN and 1 RESOURCE_LEAK issues reported by Coverity. + +Reviewed-by: Harry Wentland +Acked-by: Tom Chung +Signed-off-by: Alex Hung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_link_exports.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_exports.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_exports.c +index c6c35037bdb8..dfdfe22d9e85 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_exports.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_exports.c +@@ -37,6 +37,9 @@ + #include "dce/dce_i2c.h" + struct dc_link *dc_get_link_at_index(struct dc *dc, uint32_t link_index) + { ++ if (link_index >= MAX_LINKS) ++ return NULL; ++ + return dc->links[link_index]; + } + +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-check-msg_id-before-processing-trans.patch b/queue-6.10/drm-amd-display-check-msg_id-before-processing-trans.patch new file mode 100644 index 00000000000..74a624805eb --- /dev/null +++ b/queue-6.10/drm-amd-display-check-msg_id-before-processing-trans.patch @@ -0,0 +1,68 @@ +From 91ecf80629e78d6ecfc2301b1e98f223f242fb95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Apr 2024 16:47:42 -0600 +Subject: drm/amd/display: Check msg_id before processing transcation + +From: Alex Hung + +[ Upstream commit fa71face755e27dc44bc296416ebdf2c67163316 ] + +[WHY & HOW] +HDCP_MESSAGE_ID_INVALID (-1) is not a valid msg_id nor is it a valid +array index, and it needs checking before used. + +This fixes 4 OVERRUN issues reported by Coverity. + +Reviewed-by: Harry Wentland +Acked-by: Tom Chung +Signed-off-by: Alex Hung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c b/drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c +index 99e17c164ce7..1d3e8f0b915b 100644 +--- a/drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c ++++ b/drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c +@@ -128,13 +128,21 @@ static bool hdmi_14_process_transaction( + const uint8_t hdcp_i2c_addr_link_primary = 0x3a; /* 0x74 >> 1*/ + const uint8_t hdcp_i2c_addr_link_secondary = 0x3b; /* 0x76 >> 1*/ + struct i2c_command i2c_command; +- uint8_t offset = hdcp_i2c_offsets[message_info->msg_id]; ++ uint8_t offset; + struct i2c_payload i2c_payloads[] = { +- { true, 0, 1, &offset }, ++ { true, 0, 1, 0 }, + /* actual hdcp payload, will be filled later, zeroed for now*/ + { 0 } + }; + ++ if (message_info->msg_id == HDCP_MESSAGE_ID_INVALID) { ++ DC_LOG_ERROR("%s: Invalid message_info msg_id - %d\n", __func__, message_info->msg_id); ++ return false; ++ } ++ ++ offset = hdcp_i2c_offsets[message_info->msg_id]; ++ i2c_payloads[0].data = &offset; ++ + switch (message_info->link) { + case HDCP_LINK_SECONDARY: + i2c_payloads[0].address = hdcp_i2c_addr_link_secondary; +@@ -308,6 +316,11 @@ static bool dp_11_process_transaction( + struct dc_link *link, + struct hdcp_protection_message *message_info) + { ++ if (message_info->msg_id == HDCP_MESSAGE_ID_INVALID) { ++ DC_LOG_ERROR("%s: Invalid message_info msg_id - %d\n", __func__, message_info->msg_id); ++ return false; ++ } ++ + return dpcd_access_helper( + link, + message_info->length, +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-check-num_valid_sets-before-accessin.patch b/queue-6.10/drm-amd-display-check-num_valid_sets-before-accessin.patch new file mode 100644 index 00000000000..03c3f9992ae --- /dev/null +++ b/queue-6.10/drm-amd-display-check-num_valid_sets-before-accessin.patch @@ -0,0 +1,43 @@ +From 115692fb6ed59e3d503eee30fc1448b57d23a959 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Apr 2024 16:22:35 -0600 +Subject: drm/amd/display: Check num_valid_sets before accessing + reader_wm_sets[] + +From: Alex Hung + +[ Upstream commit b38a4815f79b87efb196cd5121579fc51e29a7fb ] + +[WHY & HOW] +num_valid_sets needs to be checked to avoid a negative index when +accessing reader_wm_sets[num_valid_sets - 1]. + +This fixes an OVERRUN issue reported by Coverity. + +Reviewed-by: Harry Wentland +Acked-by: Tom Chung +Signed-off-by: Alex Hung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c +index 5ef0879f6ad9..aea4bb46856e 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c +@@ -484,7 +484,8 @@ static void build_watermark_ranges(struct clk_bw_params *bw_params, struct pp_sm + ranges->reader_wm_sets[num_valid_sets].max_fill_clk_mhz = PP_SMU_WM_SET_RANGE_CLK_UNCONSTRAINED_MAX; + + /* Modify previous watermark range to cover up to max */ +- ranges->reader_wm_sets[num_valid_sets - 1].max_fill_clk_mhz = PP_SMU_WM_SET_RANGE_CLK_UNCONSTRAINED_MAX; ++ if (num_valid_sets > 0) ++ ranges->reader_wm_sets[num_valid_sets - 1].max_fill_clk_mhz = PP_SMU_WM_SET_RANGE_CLK_UNCONSTRAINED_MAX; + } + num_valid_sets++; + } +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-correct-the-defined-value-for-amdgpu.patch b/queue-6.10/drm-amd-display-correct-the-defined-value-for-amdgpu.patch new file mode 100644 index 00000000000..2a4ed38988c --- /dev/null +++ b/queue-6.10/drm-amd-display-correct-the-defined-value-for-amdgpu.patch @@ -0,0 +1,41 @@ +From 2f285b1944529f04aadcfa69d37124416f1a5aa2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 May 2024 15:33:48 +0800 +Subject: drm/amd/display: Correct the defined value for + AMDGPU_DMUB_NOTIFICATION_MAX + +From: Wayne Lin + +[ Upstream commit ad28d7c3d989fc5689581664653879d664da76f0 ] + +[Why & How] +It actually exposes '6' types in enum dmub_notification_type. Not 5. Using smaller +number to create array dmub_callback & dmub_thread_offload has potential to access +item out of array bound. Fix it. + +Reviewed-by: Jerry Zuo +Acked-by: Zaeem Mohamed +Signed-off-by: Wayne Lin +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h +index 09519b7abf67..5c9d32dff853 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h +@@ -50,7 +50,7 @@ + + #define AMDGPU_DM_MAX_NUM_EDP 2 + +-#define AMDGPU_DMUB_NOTIFICATION_MAX 5 ++#define AMDGPU_DMUB_NOTIFICATION_MAX 6 + + #define HDMI_AMD_VENDOR_SPECIFIC_DATA_BLOCK_IEEE_REGISTRATION_ID 0x00001A + #define AMD_VSDB_VERSION_3_FEATURECAP_REPLAYMODE 0x40 +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-disable-dmcub-timeout-for-dcn35.patch b/queue-6.10/drm-amd-display-disable-dmcub-timeout-for-dcn35.patch new file mode 100644 index 00000000000..674b9a45015 --- /dev/null +++ b/queue-6.10/drm-amd-display-disable-dmcub-timeout-for-dcn35.patch @@ -0,0 +1,51 @@ +From 6cece8d64a7f95f4abc6ed73aa8f45c0a355c77c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 May 2024 12:12:09 -0400 +Subject: drm/amd/display: Disable DMCUB timeout for DCN35 + +From: Nicholas Kazlauskas + +[ Upstream commit 7c70e60fbf4bff1123f0e8d5cb1ae71df6164d7f ] + +[Why] +DMCUB can intermittently take longer than expected to process commands. + +Old ASIC policy was to continue while logging a diagnostic error - which +works fine for ASIC without IPS, but with IPS this could lead to a race +condition where we attempt to access DCN state while it's inaccessible, +leading to a system hang when the NIU port is not disabled or register +accesses that timeout and the display configuration in an undefined +state. + +[How] +We need to investigate why these accesses take longer than expected, but +for now we should disable the timeout on DCN35 to avoid this race +condition. Since the waits happen only at lower interrupt levels the +risk of taking too long at higher IRQ and causing a system watchdog +timeout are minimal. + +Reviewed-by: Ovidiu Bunea +Acked-by: Zaeem Mohamed +Signed-off-by: Nicholas Kazlauskas +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c +index 28c459907698..915d68cc04e9 100644 +--- a/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c +@@ -785,6 +785,7 @@ static const struct dc_debug_options debug_defaults_drv = { + .ips2_entry_delay_us = 800, + .disable_dmub_reallow_idle = false, + .static_screen_wait_frames = 2, ++ .disable_timeout = true, + }; + + static const struct dc_panel_config panel_config_defaults = { +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-don-t-use-fsleep-for-psr-exit-waits-.patch b/queue-6.10/drm-amd-display-don-t-use-fsleep-for-psr-exit-waits-.patch new file mode 100644 index 00000000000..786a4c6e158 --- /dev/null +++ b/queue-6.10/drm-amd-display-don-t-use-fsleep-for-psr-exit-waits-.patch @@ -0,0 +1,42 @@ +From 761fab6250526fa1f19ee46d8abf1cd5101e99f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Sep 2023 15:06:41 -0400 +Subject: drm/amd/display: Don't use fsleep for PSR exit waits on dmub replay + +From: Nicholas Kazlauskas + +[ Upstream commit b5236da757adc75d7e52c69bdc233d29249a0d0c ] + +[Why] +These functions can be called from high IRQ levels and the OS will hang +if it tries to use a usleep_highres or a msleep. + +[How] +Replace the flseep with a udelay for dmub_replay_enable. + +Reviewed-by: Rodrigo Siqueira +Signed-off-by: Nicholas Kazlauskas +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce/dmub_replay.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_replay.c b/drivers/gpu/drm/amd/display/dc/dce/dmub_replay.c +index 09cf54586fd5..424669632b3b 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dmub_replay.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_replay.c +@@ -102,7 +102,8 @@ static void dmub_replay_enable(struct dmub_replay *dmub, bool enable, bool wait, + break; + } + +- fsleep(500); ++ /* must *not* be fsleep - this can be called from high irq levels */ ++ udelay(500); + } + + /* assert if max retry hit */ +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-ensure-array-index-tg_inst-won-t-be-.patch b/queue-6.10/drm-amd-display-ensure-array-index-tg_inst-won-t-be-.patch new file mode 100644 index 00000000000..e2d439cd671 --- /dev/null +++ b/queue-6.10/drm-amd-display-ensure-array-index-tg_inst-won-t-be-.patch @@ -0,0 +1,41 @@ +From b98af2ebcb39f0851af4f9d98a4f4069552489e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Apr 2024 16:44:17 -0600 +Subject: drm/amd/display: Ensure array index tg_inst won't be -1 + +From: Alex Hung + +[ Upstream commit 687fe329f18ab0ab0496b20ed2cb003d4879d931 ] + +[WHY & HOW] +tg_inst will be a negative if timing_generator_count equals 0, which +should be checked before used. + +This fixes 2 OVERRUN issues reported by Coverity. + +Reviewed-by: Harry Wentland +Acked-by: Tom Chung +Signed-off-by: Alex Hung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +index 8ed599324693..ce5adb8bc377 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +@@ -3508,7 +3508,7 @@ static bool acquire_otg_master_pipe_for_stream( + if (pool->dpps[pipe_idx]) + pipe_ctx->plane_res.mpcc_inst = pool->dpps[pipe_idx]->inst; + +- if (pipe_idx >= pool->timing_generator_count) { ++ if (pipe_idx >= pool->timing_generator_count && pool->timing_generator_count != 0) { + int tg_inst = pool->timing_generator_count - 1; + + pipe_ctx->stream_res.tg = pool->timing_generators[tg_inst]; +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-ensure-index-calculation-will-not-ov.patch b/queue-6.10/drm-amd-display-ensure-index-calculation-will-not-ov.patch new file mode 100644 index 00000000000..cec667a7e93 --- /dev/null +++ b/queue-6.10/drm-amd-display-ensure-index-calculation-will-not-ov.patch @@ -0,0 +1,46 @@ +From 9408be2c27b7f3c4aa6e2f2bb5b482ce8de932fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 17:08:04 -0600 +Subject: drm/amd/display: Ensure index calculation will not overflow + +From: Alex Hung + +[ Upstream commit 8e2734bf444767fed787305ccdcb36a2be5301a2 ] + +[WHY & HOW] +Make sure vmid0p72_idx, vnom0p8_idx and vmax0p9_idx calculation will +never overflow and exceess array size. + +This fixes 3 OVERRUN and 1 INTEGER_OVERFLOW issues reported by Coverity. + +Reviewed-by: Harry Wentland +Acked-by: Tom Chung +Signed-off-by: Alex Hung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dml/calcs/dcn_calcs.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/calcs/dcn_calcs.c b/drivers/gpu/drm/amd/display/dc/dml/calcs/dcn_calcs.c +index 0c4a8fe8e5ca..f1cde1e4265f 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/calcs/dcn_calcs.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/calcs/dcn_calcs.c +@@ -1453,10 +1453,9 @@ void dcn_bw_update_from_pplib_fclks( + ASSERT(fclks->num_levels); + + vmin0p65_idx = 0; +- vmid0p72_idx = fclks->num_levels - +- (fclks->num_levels > 2 ? 3 : (fclks->num_levels > 1 ? 2 : 1)); +- vnom0p8_idx = fclks->num_levels - (fclks->num_levels > 1 ? 2 : 1); +- vmax0p9_idx = fclks->num_levels - 1; ++ vmid0p72_idx = fclks->num_levels > 2 ? fclks->num_levels - 3 : 0; ++ vnom0p8_idx = fclks->num_levels > 1 ? fclks->num_levels - 2 : 0; ++ vmax0p9_idx = fclks->num_levels > 0 ? fclks->num_levels - 1 : 0; + + dc->dcn_soc->fabric_and_dram_bandwidth_vmin0p65 = + 32 * (fclks->data[vmin0p65_idx].clocks_in_khz / 1000.0) / 1000.0; +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-fix-coverity-integer_overflow-within.patch b/queue-6.10/drm-amd-display-fix-coverity-integer_overflow-within.patch new file mode 100644 index 00000000000..d6f7a60f0fc --- /dev/null +++ b/queue-6.10/drm-amd-display-fix-coverity-integer_overflow-within.patch @@ -0,0 +1,52 @@ +From f0a5de71a0dd96ff2e08417d87cb75c5c71b5f17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Apr 2024 11:58:11 -0400 +Subject: drm/amd/display: Fix Coverity INTEGER_OVERFLOW within + dal_gpio_service_create + +From: Hersen Wu + +[ Upstream commit c6077aa66fa230d12f37fef01161ef080d13b726 ] + +[Why] +For subtraction, coverity reports integer overflow +warning message when variable type is uint32_t. + +[How] +Change variable type to int32_t. + +Reviewed-by: Harry Wentland +Acked-by: Tom Chung +Signed-off-by: Hersen Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c b/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c +index d19d5c177022..f344478e9bd4 100644 +--- a/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c ++++ b/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c +@@ -56,7 +56,7 @@ struct gpio_service *dal_gpio_service_create( + struct dc_context *ctx) + { + struct gpio_service *service; +- uint32_t index_of_id; ++ int32_t index_of_id; + + service = kzalloc(sizeof(struct gpio_service), GFP_KERNEL); + +@@ -112,7 +112,7 @@ struct gpio_service *dal_gpio_service_create( + return service; + + failure_2: +- while (index_of_id) { ++ while (index_of_id > 0) { + --index_of_id; + kfree(service->busyness[index_of_id]); + } +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-fix-coverity-integer_overflow-within.patch-32439 b/queue-6.10/drm-amd-display-fix-coverity-integer_overflow-within.patch-32439 new file mode 100644 index 00000000000..0873a26e068 --- /dev/null +++ b/queue-6.10/drm-amd-display-fix-coverity-integer_overflow-within.patch-32439 @@ -0,0 +1,50 @@ +From 2e2d0e86f3514371d0f3c3d2ec9fea979f7c74cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Apr 2024 12:13:59 -0400 +Subject: drm/amd/display: Fix Coverity INTEGER_OVERFLOW within + decide_fallback_link_setting_max_bw_policy + +From: Hersen Wu + +[ Upstream commit 83c0c8361347cf43937348e8ca0a487679c003ae ] + +[Why] +For addtion (uint8_t) variable + constant 1, +coverity generates message below: +Truncation due to cast operation on "cur_idx + 1" from +32 to 8 bits. + +Then Coverity assume result is 32 bits value be saved into +8 bits variable. When result is used as index to access +array, Coverity suspects index invalid. + +[How] +Change varaible type to uint32_t. + +Reviewed-by: Alex Hung +Reviewed-by: Harry Wentland +Acked-by: Tom Chung +Signed-off-by: Hersen Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c +index d487dfcd219b..b26faed3bb20 100644 +--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c ++++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c +@@ -534,7 +534,7 @@ static bool decide_fallback_link_setting_max_bw_policy( + struct dc_link_settings *cur, + enum link_training_result training_result) + { +- uint8_t cur_idx = 0, next_idx; ++ uint32_t cur_idx = 0, next_idx; + bool found = false; + + if (training_result == LINK_TRAINING_ABORT) +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-fix-coverity-interger_overflow-withi.patch b/queue-6.10/drm-amd-display-fix-coverity-interger_overflow-withi.patch new file mode 100644 index 00000000000..c2da5b0b060 --- /dev/null +++ b/queue-6.10/drm-amd-display-fix-coverity-interger_overflow-withi.patch @@ -0,0 +1,65 @@ +From 3fcd32e115b491c6843ed181224c2d3fba71a721 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Apr 2024 10:46:41 -0400 +Subject: drm/amd/display: Fix Coverity INTERGER_OVERFLOW within + construct_integrated_info + +From: Hersen Wu + +[ Upstream commit 176abbcc71952e23009a6ed194fd203b99646884 ] + +[Why] +For substrcation, coverity reports integer overflow +warning message when variable type is uint32_t. + +[How] +Change varaible type to int32_t. + +Reviewed-by: Alex Hung +Reviewed-by: Harry Wentland +Acked-by: Tom Chung +Signed-off-by: Hersen Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 4 ++-- + drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 7 +++++-- + 2 files changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c b/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c +index bc16db69a663..25fe1a124029 100644 +--- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c ++++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c +@@ -2551,8 +2551,8 @@ static enum bp_result construct_integrated_info( + + /* Sort voltage table from low to high*/ + if (result == BP_RESULT_OK) { +- uint32_t i; +- uint32_t j; ++ int32_t i; ++ int32_t j; + + for (i = 1; i < NUMBER_OF_DISP_CLK_VOLTAGE; ++i) { + for (j = i; j > 0; --j) { +diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +index 9fe0020bcb9c..c8c8587a059d 100644 +--- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c ++++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +@@ -2920,8 +2920,11 @@ static enum bp_result construct_integrated_info( + struct atom_common_table_header *header; + struct atom_data_revision revision; + +- uint32_t i; +- uint32_t j; ++ int32_t i; ++ int32_t j; ++ ++ if (!info) ++ return result; + + if (info && DATA_TABLES(integratedsysteminfo)) { + header = GET_IMAGE(struct atom_common_table_header, +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-fix-incorrect-size-calculation-for-l.patch b/queue-6.10/drm-amd-display-fix-incorrect-size-calculation-for-l.patch new file mode 100644 index 00000000000..a9de97d824e --- /dev/null +++ b/queue-6.10/drm-amd-display-fix-incorrect-size-calculation-for-l.patch @@ -0,0 +1,44 @@ +From cfbe01890908d80b06c7f07d59cdc84c4e174d8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Apr 2024 20:23:36 -0600 +Subject: drm/amd/display: Fix incorrect size calculation for loop + +From: Alex Hung + +[ Upstream commit 3941a3aa4b653b69876d894d08f3fff1cc965267 ] + +[WHY] +fe_clk_en has size of 5 but sizeof(fe_clk_en) has byte size 20 which is +lager than the array size. + +[HOW] +Divide byte size 20 by its element size. + +This fixes 2 OVERRUN issues reported by Coverity. + +Reviewed-by: Harry Wentland +Acked-by: Tom Chung +Signed-off-by: Alex Hung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn35/dcn35_dccg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn35/dcn35_dccg.c b/drivers/gpu/drm/amd/display/dc/dcn35/dcn35_dccg.c +index 58dd3c5bbff0..4677eb485f94 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn35/dcn35_dccg.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn35/dcn35_dccg.c +@@ -940,7 +940,7 @@ static uint8_t dccg35_get_other_enabled_symclk_fe(struct dccg *dccg, uint32_t st + /* for DPMST, this backend could be used by multiple front end. + only disable the backend if this stream_enc_ins is the last active stream enc connected to this back_end*/ + uint8_t i; +- for (i = 0; i != link_enc_inst && i < sizeof(fe_clk_en); i++) { ++ for (i = 0; i != link_enc_inst && i < ARRAY_SIZE(fe_clk_en); i++) { + if (fe_clk_en[i] && be_clk_sel[i] == link_enc_inst) + num_enabled_symclk_fe++; + } +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-fix-index-may-exceed-array-range-wit.patch b/queue-6.10/drm-amd-display-fix-index-may-exceed-array-range-wit.patch new file mode 100644 index 00000000000..de065b41d04 --- /dev/null +++ b/queue-6.10/drm-amd-display-fix-index-may-exceed-array-range-wit.patch @@ -0,0 +1,117 @@ +From d1fe383b316f7a46e80065eaeeeb2428789225e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Apr 2024 09:24:44 -0400 +Subject: drm/amd/display: Fix index may exceed array range within + fpu_update_bw_bounding_box + +From: Hersen Wu + +[ Upstream commit 188fd1616ec43033cedbe343b6579e9921e2d898 ] + +[Why] +Coverity reports OVERRUN warning. soc.num_states could +be 40. But array range of bw_params->clk_table.entries is 8. + +[How] +Assert if soc.num_states greater than 8. + +Reviewed-by: Alex Hung +Acked-by: Tom Chung +Signed-off-by: Hersen Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c | 10 ++++++++++ + drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c | 10 ++++++++++ + drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 10 ++++++++++ + drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c | 10 ++++++++++ + 4 files changed, 40 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c +index e2bcd205aa93..8da97a96b1ce 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c +@@ -304,6 +304,16 @@ void dcn302_fpu_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_p + dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz * 16; + } + ++ /* bw_params->clk_table.entries[MAX_NUM_DPM_LVL]. ++ * MAX_NUM_DPM_LVL is 8. ++ * dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES]. ++ * DC__VOLTAGE_STATES is 40. ++ */ ++ if (num_states > MAX_NUM_DPM_LVL) { ++ ASSERT(0); ++ return; ++ } ++ + dcn3_02_soc.num_states = num_states; + for (i = 0; i < dcn3_02_soc.num_states; i++) { + dcn3_02_soc.clock_limits[i].state = i; +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c +index 3f02bb806d42..e968870a4b81 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c +@@ -310,6 +310,16 @@ void dcn303_fpu_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_p + dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz * 16; + } + ++ /* bw_params->clk_table.entries[MAX_NUM_DPM_LVL]. ++ * MAX_NUM_DPM_LVL is 8. ++ * dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES]. ++ * DC__VOLTAGE_STATES is 40. ++ */ ++ if (num_states > MAX_NUM_DPM_LVL) { ++ ASSERT(0); ++ return; ++ } ++ + dcn3_03_soc.num_states = num_states; + for (i = 0; i < dcn3_03_soc.num_states; i++) { + dcn3_03_soc.clock_limits[i].state = i; +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +index f6fe0a64beac..ebcf5ece209a 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +@@ -3232,6 +3232,16 @@ void dcn32_update_bw_bounding_box_fpu(struct dc *dc, struct clk_bw_params *bw_pa + dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz * 16; + } + ++ /* bw_params->clk_table.entries[MAX_NUM_DPM_LVL]. ++ * MAX_NUM_DPM_LVL is 8. ++ * dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES]. ++ * DC__VOLTAGE_STATES is 40. ++ */ ++ if (num_states > MAX_NUM_DPM_LVL) { ++ ASSERT(0); ++ return; ++ } ++ + dcn3_2_soc.num_states = num_states; + for (i = 0; i < dcn3_2_soc.num_states; i++) { + dcn3_2_soc.clock_limits[i].state = i; +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c +index ff4d795c7966..4297402bdab3 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c +@@ -803,6 +803,16 @@ void dcn321_update_bw_bounding_box_fpu(struct dc *dc, struct clk_bw_params *bw_p + dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz * 16; + } + ++ /* bw_params->clk_table.entries[MAX_NUM_DPM_LVL]. ++ * MAX_NUM_DPM_LVL is 8. ++ * dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES]. ++ * DC__VOLTAGE_STATES is 40. ++ */ ++ if (num_states > MAX_NUM_DPM_LVL) { ++ ASSERT(0); ++ return; ++ } ++ + dcn3_21_soc.num_states = num_states; + for (i = 0; i < dcn3_21_soc.num_states; i++) { + dcn3_21_soc.clock_limits[i].state = i; +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-fix-pipe-addition-logic-in-calc_bloc.patch b/queue-6.10/drm-amd-display-fix-pipe-addition-logic-in-calc_bloc.patch new file mode 100644 index 00000000000..dd63460fc14 --- /dev/null +++ b/queue-6.10/drm-amd-display-fix-pipe-addition-logic-in-calc_bloc.patch @@ -0,0 +1,52 @@ +From 5497d8019e25152a6cb14d56d2f4c6ee1f7e17f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 May 2024 14:01:39 -0400 +Subject: drm/amd/display: Fix pipe addition logic in calc_blocks_to_ungate + DCN35 + +From: Nicholas Susanto + +[ Upstream commit 3aec7a5af4d6248b7462b7d1eb597f06d35f5ee0 ] + +[Why] + +Missing check for when there is new pipe configuration but both cur_pipe +and new_pipe are both populated causing update_state of DSC for that +instance not being updated correctly. + +This causes some display mode changes to cause underflow since DSCCLK +is still gated when the display requires DSC. + +[How] + +Added another condition in the new pipe addition branch that checks if +there is a new pipe configuration and if it is not the same as cur_pipe. +cur_pipe does not necessarily have to be NULL to go in this branch. + +Reviewed-by: Nicholas Kazlauskas +Acked-by: Roman Li +Signed-off-by: Nicholas Susanto +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c +index dcced89c07b3..f829ff82797e 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c +@@ -1077,7 +1077,8 @@ void dcn35_calc_blocks_to_ungate(struct dc *dc, struct dc_state *context, + continue; + + if ((!cur_pipe->plane_state && new_pipe->plane_state) || +- (!cur_pipe->stream && new_pipe->stream)) { ++ (!cur_pipe->stream && new_pipe->stream) || ++ (cur_pipe->stream != new_pipe->stream && new_pipe->stream)) { + // New pipe addition + for (j = 0; j < PG_HW_PIPE_RESOURCES_NUM_ELEMENT; j++) { + if (j == PG_HUBP && new_pipe->plane_res.hubp) +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-fix-writeback-job-lock-evasion-withi.patch b/queue-6.10/drm-amd-display-fix-writeback-job-lock-evasion-withi.patch new file mode 100644 index 00000000000..d509f93c178 --- /dev/null +++ b/queue-6.10/drm-amd-display-fix-writeback-job-lock-evasion-withi.patch @@ -0,0 +1,63 @@ +From 99e85dd291ed190d794e7eb6b64bf2cca50dc416 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Apr 2024 14:24:17 -0400 +Subject: drm/amd/display: Fix writeback job lock evasion within + dm_crtc_high_irq + +From: Hersen Wu + +[ Upstream commit 922c2877827dcc474f3079e464773ab31ac13b79 ] + +[Why] +Coverity report LOCK_EVASION warning. Access +acrtc->wb_pending without lock wb_conn->job_lock. + +[How] +Lock wb_conn->job_lock before accessing +acrtc->wb_pending. + +Reviewed-by: Alex Hung +Acked-by: Tom Chung +Signed-off-by: Hersen Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index e3662f646baa..382a41c5b515 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -594,12 +594,14 @@ static void dm_crtc_high_irq(void *interrupt_params) + if (!acrtc) + return; + +- if (acrtc->wb_pending) { +- if (acrtc->wb_conn) { +- spin_lock_irqsave(&acrtc->wb_conn->job_lock, flags); ++ if (acrtc->wb_conn) { ++ spin_lock_irqsave(&acrtc->wb_conn->job_lock, flags); ++ ++ if (acrtc->wb_pending) { + job = list_first_entry_or_null(&acrtc->wb_conn->job_queue, + struct drm_writeback_job, + list_entry); ++ acrtc->wb_pending = false; + spin_unlock_irqrestore(&acrtc->wb_conn->job_lock, flags); + + if (job) { +@@ -617,8 +619,7 @@ static void dm_crtc_high_irq(void *interrupt_params) + acrtc->dm_irq_params.stream, 0); + } + } else +- DRM_ERROR("%s: no amdgpu_crtc wb_conn\n", __func__); +- acrtc->wb_pending = false; ++ spin_unlock_irqrestore(&acrtc->wb_conn->job_lock, flags); + } + + vrr_active = amdgpu_dm_crtc_vrr_active_irq(acrtc); +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-handle-the-case-which-quad_part-is-e.patch b/queue-6.10/drm-amd-display-handle-the-case-which-quad_part-is-e.patch new file mode 100644 index 00000000000..a6ed22430d0 --- /dev/null +++ b/queue-6.10/drm-amd-display-handle-the-case-which-quad_part-is-e.patch @@ -0,0 +1,39 @@ +From 86ee19a4bd2c2e9e19336be7dcec5b656938cb13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Apr 2024 17:39:39 -0600 +Subject: drm/amd/display: Handle the case which quad_part is equal 0 + +From: Rodrigo Siqueira + +[ Upstream commit 02fb803db110dbdac9f0d446180f0f7b545e15ff ] + +Add code to handle case when quad_part is 0 in gpu_addr_to_uma(). + +Acked-by: Wayne Lin +Signed-off-by: Rodrigo Siqueira +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/hwss/dcn201/dcn201_hwseq.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn201/dcn201_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn201/dcn201_hwseq.c +index 6be846635a79..59f46df01551 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn201/dcn201_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn201/dcn201_hwseq.c +@@ -95,8 +95,11 @@ static bool gpu_addr_to_uma(struct dce_hwseq *hwseq, + } else if (hwseq->fb_offset.quad_part <= addr->quad_part && + addr->quad_part <= hwseq->uma_top.quad_part) { + is_in_uma = true; ++ } else if (addr->quad_part == 0) { ++ is_in_uma = false; + } else { + is_in_uma = false; ++ BREAK_TO_DEBUGGER(); + } + return is_in_uma; + } +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-release-clck_src-memory-if-clk_src_c.patch b/queue-6.10/drm-amd-display-release-clck_src-memory-if-clk_src_c.patch new file mode 100644 index 00000000000..7c704ef5abc --- /dev/null +++ b/queue-6.10/drm-amd-display-release-clck_src-memory-if-clk_src_c.patch @@ -0,0 +1,106 @@ +From 3b7d5c0cf75c56a1dd7c5bdfb67d1b287d31905d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 20:18:30 -0400 +Subject: drm/amd/display: Release clck_src memory if clk_src_construct fails + +From: Hersen Wu + +[ Upstream commit 674704a5dabe4a434645fdd11e35437f4e06dfc4 ] + +[Why] +Coverity reports RESOURCE_LEAK for some implemenations +of clock_source_create. Do not release memory of clk_src +if contructor fails. + +[How] +Free clk_src if contructor fails. + +Reviewed-by: Harry Wentland +Acked-by: Tom Chung +Signed-off-by: Hersen Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/dc/resource/dce80/dce80_resource.c | 1 + + .../gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c | 1 + + .../gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c | 4 ++-- + .../gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c | 1 + + .../gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c | 1 + + 5 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/resource/dce80/dce80_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dce80/dce80_resource.c +index 56ee45e12b46..a73d3c6ef425 100644 +--- a/drivers/gpu/drm/amd/display/dc/resource/dce80/dce80_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/resource/dce80/dce80_resource.c +@@ -1538,6 +1538,7 @@ struct resource_pool *dce83_create_resource_pool( + if (dce83_construct(num_virtual_links, dc, pool)) + return &pool->base; + ++ kfree(pool); + BREAK_TO_DEBUGGER(); + return NULL; + } +diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c +index d4c3e2754f51..5d1801dce273 100644 +--- a/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c +@@ -1864,6 +1864,7 @@ static struct clock_source *dcn30_clock_source_create( + return &clk_src->base; + } + ++ kfree(clk_src); + BREAK_TO_DEBUGGER(); + return NULL; + } +diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c +index ff50f43e4c00..da73e842c55c 100644 +--- a/drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c +@@ -1660,8 +1660,8 @@ static struct clock_source *dcn31_clock_source_create( + return &clk_src->base; + } + +- BREAK_TO_DEBUGGER(); + kfree(clk_src); ++ BREAK_TO_DEBUGGER(); + return NULL; + } + +@@ -1821,8 +1821,8 @@ static struct clock_source *dcn30_clock_source_create( + return &clk_src->base; + } + +- BREAK_TO_DEBUGGER(); + kfree(clk_src); ++ BREAK_TO_DEBUGGER(); + return NULL; + } + +diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c +index 2df8a742516c..28c459907698 100644 +--- a/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c +@@ -1716,6 +1716,7 @@ static struct clock_source *dcn35_clock_source_create( + return &clk_src->base; + } + ++ kfree(clk_src); + BREAK_TO_DEBUGGER(); + return NULL; + } +diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c +index ddf9560ab772..b7bd0f36125a 100644 +--- a/drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c +@@ -1696,6 +1696,7 @@ static struct clock_source *dcn35_clock_source_create( + return &clk_src->base; + } + ++ kfree(clk_src); + BREAK_TO_DEBUGGER(); + return NULL; + } +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-release-state-memory-if-amdgpu_dm_cr.patch b/queue-6.10/drm-amd-display-release-state-memory-if-amdgpu_dm_cr.patch new file mode 100644 index 00000000000..446f33e9084 --- /dev/null +++ b/queue-6.10/drm-amd-display-release-state-memory-if-amdgpu_dm_cr.patch @@ -0,0 +1,48 @@ +From 502dbf958e96679e65629270ab4a6b0a7b63400f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 20:32:53 -0400 +Subject: drm/amd/display: Release state memory if + amdgpu_dm_create_color_properties fail + +From: Hersen Wu + +[ Upstream commit 52cbcf980509e6190740dd1e2a1a437e8fb8101b ] + +[Why] +Coverity reports RESOURCE_LEAK warning. State memory +is not released if dm_create_color_properties fail. + +[How] +Call kfree(state) before return. + +Reviewed-by: Alex Hung +Reviewed-by: Harry Wentland +Acked-by: Tom Chung +Signed-off-by: Hersen Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 9cf9c8f917a1..c00d96ec8be4 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -4129,8 +4129,11 @@ static int amdgpu_dm_mode_config_init(struct amdgpu_device *adev) + } + + #ifdef AMD_PRIVATE_COLOR +- if (amdgpu_dm_create_color_properties(adev)) ++ if (amdgpu_dm_create_color_properties(adev)) { ++ dc_state_release(state->context); ++ kfree(state); + return -ENOMEM; ++ } + #endif + + r = amdgpu_dm_audio_init(adev); +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-remove-register-from-dcn35-dmcub-dia.patch b/queue-6.10/drm-amd-display-remove-register-from-dcn35-dmcub-dia.patch new file mode 100644 index 00000000000..de343874d08 --- /dev/null +++ b/queue-6.10/drm-amd-display-remove-register-from-dcn35-dmcub-dia.patch @@ -0,0 +1,54 @@ +From c4e304f5d9f3c0908cf8ecb19076c5f03923e901 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 May 2024 15:25:30 -0400 +Subject: drm/amd/display: Remove register from DCN35 DMCUB diagnostic + collection + +From: Nicholas Kazlauskas + +[ Upstream commit 466423c6dd8af23ebb3a69d43434d01aed0db356 ] + +[Why] +These registers should not be read from driver and triggering the +security violation when DMCUB work times out and diagnostics are +collected blocks Z8 entry. + +[How] +Remove the register read from DCN35. + +Reviewed-by: Duncan Ma +Acked-by: Zaeem Mohamed +Signed-off-by: Nicholas Kazlauskas +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dmub/src/dmub_dcn35.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn35.c b/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn35.c +index 70e63aeb8f89..a330827f900c 100644 +--- a/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn35.c ++++ b/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn35.c +@@ -459,7 +459,7 @@ uint32_t dmub_dcn35_get_current_time(struct dmub_srv *dmub) + void dmub_dcn35_get_diagnostic_data(struct dmub_srv *dmub, struct dmub_diagnostic_data *diag_data) + { + uint32_t is_dmub_enabled, is_soft_reset, is_sec_reset; +- uint32_t is_traceport_enabled, is_cw0_enabled, is_cw6_enabled; ++ uint32_t is_traceport_enabled, is_cw6_enabled; + + if (!dmub || !diag_data) + return; +@@ -510,9 +510,6 @@ void dmub_dcn35_get_diagnostic_data(struct dmub_srv *dmub, struct dmub_diagnosti + REG_GET(DMCUB_CNTL, DMCUB_TRACEPORT_EN, &is_traceport_enabled); + diag_data->is_traceport_en = is_traceport_enabled; + +- REG_GET(DMCUB_REGION3_CW0_TOP_ADDRESS, DMCUB_REGION3_CW0_ENABLE, &is_cw0_enabled); +- diag_data->is_cw0_enabled = is_cw0_enabled; +- + REG_GET(DMCUB_REGION3_CW6_TOP_ADDRESS, DMCUB_REGION3_CW6_ENABLE, &is_cw6_enabled); + diag_data->is_cw6_enabled = is_cw6_enabled; + +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-skip-inactive-planes-within-modesupp.patch b/queue-6.10/drm-amd-display-skip-inactive-planes-within-modesupp.patch new file mode 100644 index 00000000000..a61be44e8c8 --- /dev/null +++ b/queue-6.10/drm-amd-display-skip-inactive-planes-within-modesupp.patch @@ -0,0 +1,48 @@ +From ce1ead7049700c950d27a2fe8bad2f98e98771df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Apr 2024 16:39:37 -0400 +Subject: drm/amd/display: Skip inactive planes within + ModeSupportAndSystemConfiguration + +From: Hersen Wu + +[ Upstream commit a54f7e866cc73a4cb71b8b24bb568ba35c8969df ] + +[Why] +Coverity reports Memory - illegal accesses. + +[How] +Skip inactive planes. + +Reviewed-by: Alex Hung +Acked-by: Tom Chung +Signed-off-by: Hersen Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c b/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c +index 9a3ded311195..85453bbb4f9b 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c +@@ -1099,8 +1099,13 @@ void ModeSupportAndSystemConfiguration(struct display_mode_lib *mode_lib) + + // Total Available Pipes Support Check + for (k = 0; k < mode_lib->vba.NumberOfActivePlanes; ++k) { +- total_pipes += mode_lib->vba.DPPPerPlane[k]; + pipe_idx = get_pipe_idx(mode_lib, k); ++ if (pipe_idx == -1) { ++ ASSERT(0); ++ continue; // skip inactive planes ++ } ++ total_pipes += mode_lib->vba.DPPPerPlane[k]; ++ + if (mode_lib->vba.cache_pipes[pipe_idx].clks_cfg.dppclk_mhz > 0.0) + mode_lib->vba.DPPCLK[k] = mode_lib->vba.cache_pipes[pipe_idx].clks_cfg.dppclk_mhz; + else +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-skip-wbscl_set_scaler_filter-if-filt.patch b/queue-6.10/drm-amd-display-skip-wbscl_set_scaler_filter-if-filt.patch new file mode 100644 index 00000000000..861d4eaadc5 --- /dev/null +++ b/queue-6.10/drm-amd-display-skip-wbscl_set_scaler_filter-if-filt.patch @@ -0,0 +1,41 @@ +From aa615f6c9f324498838cb84566722bbc8d85ecb3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 10:47:37 -0600 +Subject: drm/amd/display: Skip wbscl_set_scaler_filter if filter is null + +From: Alex Hung + +[ Upstream commit c4d31653c03b90e51515b1380115d1aedad925dd ] + +Callers can pass null in filter (i.e. from returned from the function +wbscl_get_filter_coeffs_16p) and a null check is added to ensure that is +not the case. + +This fixes 4 NULL_RETURNS issues reported by Coverity. + +Reviewed-by: Harry Wentland +Acked-by: Hamza Mahfooz +Signed-off-by: Alex Hung +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dwb_scl.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dwb_scl.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dwb_scl.c +index 994fb732a7cb..a0d437f0ce2b 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dwb_scl.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dwb_scl.c +@@ -690,6 +690,9 @@ static void wbscl_set_scaler_filter( + int pair; + uint16_t odd_coef, even_coef; + ++ if (!filter) ++ return; ++ + for (phase = 0; phase < (NUM_PHASES / 2 + 1); phase++) { + for (pair = 0; pair < tap_pairs; pair++) { + even_coef = filter[phase * taps + 2 * pair]; +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-spinlock-before-reading-event.patch b/queue-6.10/drm-amd-display-spinlock-before-reading-event.patch new file mode 100644 index 00000000000..42f1afb8df0 --- /dev/null +++ b/queue-6.10/drm-amd-display-spinlock-before-reading-event.patch @@ -0,0 +1,54 @@ +From 1344f55ca737d9f655e17550bbf57a27b4019256 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Apr 2024 10:33:47 -0600 +Subject: drm/amd/display: Spinlock before reading event + +From: Alex Hung + +[ Upstream commit ae13c8a5cff92015b9a3eb7cee65ebc75859487f ] + +[WHY & HOW] +A read of acrtc_attach->base.state->event was not locked so moving it +inside the spinlock. + +This fixes a LOCK_EVASION issue reported by Coverity. + +Reviewed-by: Harry Wentland +Acked-by: Tom Chung +Signed-off-by: Alex Hung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index c00d96ec8be4..e3662f646baa 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -8645,15 +8645,13 @@ static void amdgpu_dm_commit_planes(struct drm_atomic_state *state, + bundle->stream_update.vrr_infopacket = + &acrtc_state->stream->vrr_infopacket; + } +- } else if (cursor_update && acrtc_state->active_planes > 0 && +- acrtc_attach->base.state->event) { +- drm_crtc_vblank_get(pcrtc); +- ++ } else if (cursor_update && acrtc_state->active_planes > 0) { + spin_lock_irqsave(&pcrtc->dev->event_lock, flags); +- +- acrtc_attach->event = acrtc_attach->base.state->event; +- acrtc_attach->base.state->event = NULL; +- ++ if (acrtc_attach->base.state->event) { ++ drm_crtc_vblank_get(pcrtc); ++ acrtc_attach->event = acrtc_attach->base.state->event; ++ acrtc_attach->base.state->event = NULL; ++ } + spin_unlock_irqrestore(&pcrtc->dev->event_lock, flags); + } + +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-stop-amdgpu_dm-initialize-when-link-.patch b/queue-6.10/drm-amd-display-stop-amdgpu_dm-initialize-when-link-.patch new file mode 100644 index 00000000000..15977de4dc6 --- /dev/null +++ b/queue-6.10/drm-amd-display-stop-amdgpu_dm-initialize-when-link-.patch @@ -0,0 +1,60 @@ +From b69cf916c806e58fc8974ec49b41588f8f19c5c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 16:15:15 -0400 +Subject: drm/amd/display: Stop amdgpu_dm initialize when link nums greater + than max_links + +From: Hersen Wu + +[ Upstream commit cf8b16857db702ceb8d52f9219a4613363e2b1cf ] + +[Why] +Coverity report OVERRUN warning. There are +only max_links elements within dc->links. link +count could up to AMDGPU_DM_MAX_DISPLAY_INDEX 31. + +[How] +Make sure link count less than max_links. + +Reviewed-by: Harry Wentland +Acked-by: Tom Chung +Signed-off-by: Hersen Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index b6228847b797..9cf9c8f917a1 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -4587,17 +4587,17 @@ static int amdgpu_dm_initialize_drm_device(struct amdgpu_device *adev) + } + } + ++ if (link_cnt > MAX_LINKS) { ++ DRM_ERROR( ++ "KMS: Cannot support more than %d display indexes\n", ++ MAX_LINKS); ++ goto fail; ++ } ++ + /* loops over all connectors on the board */ + for (i = 0; i < link_cnt; i++) { + struct dc_link *link = NULL; + +- if (i > AMDGPU_DM_MAX_DISPLAY_INDEX) { +- DRM_ERROR( +- "KMS: Cannot support more than %d display indexes\n", +- AMDGPU_DM_MAX_DISPLAY_INDEX); +- continue; +- } +- + link = dc_get_link_at_index(dm->dc, i); + + if (link->connector_signal == SIGNAL_TYPE_VIRTUAL) { +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-stop-amdgpu_dm-initialize-when-strea.patch b/queue-6.10/drm-amd-display-stop-amdgpu_dm-initialize-when-strea.patch new file mode 100644 index 00000000000..6627f9370b3 --- /dev/null +++ b/queue-6.10/drm-amd-display-stop-amdgpu_dm-initialize-when-strea.patch @@ -0,0 +1,46 @@ +From 8587aa1be1e7565aa6b29997c937e54c69572f78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 16:00:19 -0400 +Subject: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater + than 6 + +From: Hersen Wu + +[ Upstream commit 84723eb6068c50610c5c0893980d230d7afa2105 ] + +[Why] +Coverity reports OVERRUN warning. Should abort amdgpu_dm +initialize. + +[How] +Return failure to amdgpu_dm_init. + +Reviewed-by: Harry Wentland +Acked-by: Tom Chung +Signed-off-by: Hersen Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 8d4ad15b8e17..b6228847b797 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -4466,7 +4466,10 @@ static int amdgpu_dm_initialize_drm_device(struct amdgpu_device *adev) + + /* There is one primary plane per CRTC */ + primary_planes = dm->dc->caps.max_streams; +- ASSERT(primary_planes <= AMDGPU_MAX_PLANES); ++ if (primary_planes > AMDGPU_MAX_PLANES) { ++ DRM_ERROR("DM: Plane nums out of 6 planes\n"); ++ return -EINVAL; ++ } + + /* + * Initialize primary planes, implicit planes for legacy IOCTLS. +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-use-preferred-link-settings-for-dp-s.patch b/queue-6.10/drm-amd-display-use-preferred-link-settings-for-dp-s.patch new file mode 100644 index 00000000000..75c87a93334 --- /dev/null +++ b/queue-6.10/drm-amd-display-use-preferred-link-settings-for-dp-s.patch @@ -0,0 +1,63 @@ +From 22992e82971937b0afc9acf488988efb3ee7cdcf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 May 2024 12:20:41 -0400 +Subject: drm/amd/display: use preferred link settings for dp signal only + +From: Wenjing Liu + +[ Upstream commit abf34ca465f5cd182b07701d3f3d369c0fc04723 ] + +[why] +We set preferred link settings for virtual signal. However we don't support +virtual signal for UHBR link rate. If preferred is set to UHBR link rate, we +will allow virtual signal with UHBR link rate which causes system crashes. + +Reviewed-by: Dillon Varone +Acked-by: Zaeem Mohamed +Signed-off-by: Wenjing Liu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../dc/link/protocols/link_dp_capability.c | 24 ++++++++----------- + 1 file changed, 10 insertions(+), 14 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c +index b26faed3bb20..a3df1b55e48b 100644 +--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c ++++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c +@@ -914,21 +914,17 @@ bool link_decide_link_settings(struct dc_stream_state *stream, + + memset(link_setting, 0, sizeof(*link_setting)); + +- /* if preferred is specified through AMDDP, use it, if it's enough +- * to drive the mode +- */ +- if (link->preferred_link_setting.lane_count != +- LANE_COUNT_UNKNOWN && +- link->preferred_link_setting.link_rate != +- LINK_RATE_UNKNOWN) { ++ if (dc_is_dp_signal(stream->signal) && ++ link->preferred_link_setting.lane_count != LANE_COUNT_UNKNOWN && ++ link->preferred_link_setting.link_rate != LINK_RATE_UNKNOWN) { ++ /* if preferred is specified through AMDDP, use it, if it's enough ++ * to drive the mode ++ */ + *link_setting = link->preferred_link_setting; +- return true; +- } +- +- /* MST doesn't perform link training for now +- * TODO: add MST specific link training routine +- */ +- if (stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST) { ++ } else if (stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST) { ++ /* MST doesn't perform link training for now ++ * TODO: add MST specific link training routine ++ */ + decide_mst_link_settings(link, link_setting); + } else if (link->connector_signal == SIGNAL_TYPE_EDP) { + /* enable edp link optimization for DSC eDP case */ +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-pm-check-negtive-return-for-table-entries.patch b/queue-6.10/drm-amd-pm-check-negtive-return-for-table-entries.patch new file mode 100644 index 00000000000..7da40ca0bac --- /dev/null +++ b/queue-6.10/drm-amd-pm-check-negtive-return-for-table-entries.patch @@ -0,0 +1,61 @@ +From c68512fa620a3162303cfd3762637047be039058 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 May 2024 16:01:23 +0800 +Subject: drm/amd/pm: check negtive return for table entries + +From: Jesse Zhang + +[ Upstream commit f76059fe14395b37ba8d997eb0381b1b9e80a939 ] + +Function hwmgr->hwmgr_func->get_num_of_pp_table_entries(hwmgr) returns a negative number + +Signed-off-by: Jesse Zhang +Suggested-by: Tim Huang +Reviewed-by: Tim Huang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/pp_psm.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pp_psm.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pp_psm.c +index f4bd8e9357e2..18f00038d844 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pp_psm.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pp_psm.c +@@ -30,9 +30,8 @@ int psm_init_power_state_table(struct pp_hwmgr *hwmgr) + { + int result; + unsigned int i; +- unsigned int table_entries; + struct pp_power_state *state; +- int size; ++ int size, table_entries; + + if (hwmgr->hwmgr_func->get_num_of_pp_table_entries == NULL) + return 0; +@@ -40,15 +39,19 @@ int psm_init_power_state_table(struct pp_hwmgr *hwmgr) + if (hwmgr->hwmgr_func->get_power_state_size == NULL) + return 0; + +- hwmgr->num_ps = table_entries = hwmgr->hwmgr_func->get_num_of_pp_table_entries(hwmgr); ++ table_entries = hwmgr->hwmgr_func->get_num_of_pp_table_entries(hwmgr); + +- hwmgr->ps_size = size = hwmgr->hwmgr_func->get_power_state_size(hwmgr) + ++ size = hwmgr->hwmgr_func->get_power_state_size(hwmgr) + + sizeof(struct pp_power_state); + +- if (table_entries == 0 || size == 0) { ++ if (table_entries <= 0 || size == 0) { + pr_warn("Please check whether power state management is supported on this asic\n"); ++ hwmgr->num_ps = 0; ++ hwmgr->ps_size = 0; + return 0; + } ++ hwmgr->num_ps = table_entries; ++ hwmgr->ps_size = size; + + hwmgr->ps = kcalloc(table_entries, size, GFP_KERNEL); + if (hwmgr->ps == NULL) +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-pm-check-specific-index-for-aldebaran.patch b/queue-6.10/drm-amd-pm-check-specific-index-for-aldebaran.patch new file mode 100644 index 00000000000..3cb1873d983 --- /dev/null +++ b/queue-6.10/drm-amd-pm-check-specific-index-for-aldebaran.patch @@ -0,0 +1,37 @@ +From e1cf67b8ddb4e2ac91bbf66dbd9a73feda353d1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 May 2024 17:13:28 +0800 +Subject: drm/amd/pm: check specific index for aldebaran + +From: Jesse Zhang + +[ Upstream commit 0ce8ef2639c112ae203c985b758389e378630aac ] + +Check for specific indexes that may be invalid values. + +Signed-off-by: Jesse Zhang +Reviewed-by: Yang Wang +Reviewed-by: Tim Huang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c +index ce941fbb9cfb..a22eb6bbb05e 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c +@@ -1886,7 +1886,8 @@ static int aldebaran_mode2_reset(struct smu_context *smu) + + index = smu_cmn_to_asic_specific_index(smu, CMN2ASIC_MAPPING_MSG, + SMU_MSG_GfxDeviceDriverReset); +- ++ if (index < 0 ) ++ return -EINVAL; + mutex_lock(&smu->message_lock); + if (smu->smc_fw_version >= 0x00441400) { + ret = smu_cmn_send_msg_without_waiting(smu, (uint16_t)index, SMU_RESET_MODE_2); +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-pm-check-specific-index-for-smu13.patch b/queue-6.10/drm-amd-pm-check-specific-index-for-smu13.patch new file mode 100644 index 00000000000..fe41dbcef8d --- /dev/null +++ b/queue-6.10/drm-amd-pm-check-specific-index-for-smu13.patch @@ -0,0 +1,37 @@ +From 68e8773729e88462b65e5b32448f4d06d5c8c583 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 May 2024 17:50:21 +0800 +Subject: drm/amd/pm: check specific index for smu13 + +From: Jesse Zhang + +[ Upstream commit a3ac9d1c9751f00026c2d98b802ec8a98626c3ed ] + +Check for specific indexes that may be invalid values. + +Signed-off-by: Jesse Zhang +Suggested-by: Tim Huang +Reviewed-by: Tim Huang +Reviewed-by: Yang Wang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c +index 4d3eca2fc3f1..f4469d001d7c 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c +@@ -2333,6 +2333,8 @@ static int smu_v13_0_6_mode2_reset(struct smu_context *smu) + + index = smu_cmn_to_asic_specific_index(smu, CMN2ASIC_MAPPING_MSG, + SMU_MSG_GfxDeviceDriverReset); ++ if (index < 0) ++ return index; + + mutex_lock(&smu->message_lock); + +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-pm-fix-negative-array-index-read.patch b/queue-6.10/drm-amd-pm-fix-negative-array-index-read.patch new file mode 100644 index 00000000000..5ffabfd90f4 --- /dev/null +++ b/queue-6.10/drm-amd-pm-fix-negative-array-index-read.patch @@ -0,0 +1,94 @@ +From 1597ca2d7bfa42aa0195ece28d459dff36132f07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Apr 2024 10:23:48 +0800 +Subject: drm/amd/pm: Fix negative array index read + +From: Jesse Zhang + +[ Upstream commit c8c19ebf7c0b202a6a2d37a52ca112432723db5f ] + +Avoid using the negative values +for clk_idex as an index into an array pptable->DpmDescriptor. + +V2: fix clk_index return check (Tim Huang) + +Signed-off-by: Jesse Zhang +Reviewed-by: Tim Huang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 27 ++++++++++++++----- + 1 file changed, 21 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c +index 5a68d365967f..c06e0d6e3017 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c +@@ -1219,19 +1219,22 @@ static int navi10_get_current_clk_freq_by_table(struct smu_context *smu, + value); + } + +-static bool navi10_is_support_fine_grained_dpm(struct smu_context *smu, enum smu_clk_type clk_type) ++static int navi10_is_support_fine_grained_dpm(struct smu_context *smu, enum smu_clk_type clk_type) + { + PPTable_t *pptable = smu->smu_table.driver_pptable; + DpmDescriptor_t *dpm_desc = NULL; +- uint32_t clk_index = 0; ++ int clk_index = 0; + + clk_index = smu_cmn_to_asic_specific_index(smu, + CMN2ASIC_MAPPING_CLK, + clk_type); ++ if (clk_index < 0) ++ return clk_index; ++ + dpm_desc = &pptable->DpmDescriptor[clk_index]; + + /* 0 - Fine grained DPM, 1 - Discrete DPM */ +- return dpm_desc->SnapToDiscrete == 0; ++ return dpm_desc->SnapToDiscrete == 0 ? 1 : 0; + } + + static inline bool navi10_od_feature_is_supported(struct smu_11_0_overdrive_table *od_table, enum SMU_11_0_ODFEATURE_CAP cap) +@@ -1287,7 +1290,11 @@ static int navi10_emit_clk_levels(struct smu_context *smu, + if (ret) + return ret; + +- if (!navi10_is_support_fine_grained_dpm(smu, clk_type)) { ++ ret = navi10_is_support_fine_grained_dpm(smu, clk_type); ++ if (ret < 0) ++ return ret; ++ ++ if (!ret) { + for (i = 0; i < count; i++) { + ret = smu_v11_0_get_dpm_freq_by_index(smu, + clk_type, i, &value); +@@ -1496,7 +1503,11 @@ static int navi10_print_clk_levels(struct smu_context *smu, + if (ret) + return size; + +- if (!navi10_is_support_fine_grained_dpm(smu, clk_type)) { ++ ret = navi10_is_support_fine_grained_dpm(smu, clk_type); ++ if (ret < 0) ++ return ret; ++ ++ if (!ret) { + for (i = 0; i < count; i++) { + ret = smu_v11_0_get_dpm_freq_by_index(smu, clk_type, i, &value); + if (ret) +@@ -1665,7 +1676,11 @@ static int navi10_force_clk_levels(struct smu_context *smu, + case SMU_UCLK: + case SMU_FCLK: + /* There is only 2 levels for fine grained DPM */ +- if (navi10_is_support_fine_grained_dpm(smu, clk_type)) { ++ ret = navi10_is_support_fine_grained_dpm(smu, clk_type); ++ if (ret < 0) ++ return ret; ++ ++ if (ret) { + soft_max_level = (soft_max_level >= 1 ? 1 : 0); + soft_min_level = (soft_min_level >= 1 ? 1 : 0); + } +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-pm-fix-the-out-of-bounds-read-warning.patch b/queue-6.10/drm-amd-pm-fix-the-out-of-bounds-read-warning.patch new file mode 100644 index 00000000000..5994799e6f8 --- /dev/null +++ b/queue-6.10/drm-amd-pm-fix-the-out-of-bounds-read-warning.patch @@ -0,0 +1,39 @@ +From 65d821f15a0c0b535a1177ebdf7c64adbf91e8ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Apr 2024 10:29:08 +0800 +Subject: drm/amd/pm: fix the Out-of-bounds read warning + +From: Jesse Zhang + +[ Upstream commit 12c6967428a099bbba9dfd247bb4322a984fcc0b ] + +using index i - 1U may beyond element index +for mc_data[] when i = 0. + +Signed-off-by: Jesse Zhang +Reviewed-by: Tim Huang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c +index b1b4c09c3467..b56298d9da98 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c +@@ -73,8 +73,9 @@ static int atomctrl_retrieve_ac_timing( + j++; + } else if ((table->mc_reg_address[i].uc_pre_reg_data & + LOW_NIBBLE_MASK) == DATA_EQU_PREV) { +- table->mc_reg_table_entry[num_ranges].mc_data[i] = +- table->mc_reg_table_entry[num_ranges].mc_data[i-1]; ++ if (i) ++ table->mc_reg_table_entry[num_ranges].mc_data[i] = ++ table->mc_reg_table_entry[num_ranges].mc_data[i-1]; + } + } + num_ranges++; +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-pm-fix-uninitialized-variable-warning-for-sm.patch b/queue-6.10/drm-amd-pm-fix-uninitialized-variable-warning-for-sm.patch new file mode 100644 index 00000000000..bb12fc20eea --- /dev/null +++ b/queue-6.10/drm-amd-pm-fix-uninitialized-variable-warning-for-sm.patch @@ -0,0 +1,87 @@ +From 65b79306cb41f3ad756416bd3fd69a1f052ee40f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Apr 2024 12:52:45 +0800 +Subject: drm/amd/pm: fix uninitialized variable warning for smu8_hwmgr +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tim Huang + +[ Upstream commit 86df36b934640866eb249a4488abb148b985a0d9 ] + +Clear warnings that using uninitialized value level when fails +to get the value from SMU. + +Signed-off-by: Tim Huang +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/pm/powerplay/hwmgr/smu8_hwmgr.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu8_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu8_hwmgr.c +index eb744401e056..7e1197420873 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu8_hwmgr.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu8_hwmgr.c +@@ -584,6 +584,7 @@ static int smu8_init_uvd_limit(struct pp_hwmgr *hwmgr) + hwmgr->dyn_state.uvd_clock_voltage_dependency_table; + unsigned long clock = 0; + uint32_t level; ++ int ret; + + if (NULL == table || table->count <= 0) + return -EINVAL; +@@ -591,7 +592,9 @@ static int smu8_init_uvd_limit(struct pp_hwmgr *hwmgr) + data->uvd_dpm.soft_min_clk = 0; + data->uvd_dpm.hard_min_clk = 0; + +- smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMaxUvdLevel, &level); ++ ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMaxUvdLevel, &level); ++ if (ret) ++ return ret; + + if (level < table->count) + clock = table->entries[level].vclk; +@@ -611,6 +614,7 @@ static int smu8_init_vce_limit(struct pp_hwmgr *hwmgr) + hwmgr->dyn_state.vce_clock_voltage_dependency_table; + unsigned long clock = 0; + uint32_t level; ++ int ret; + + if (NULL == table || table->count <= 0) + return -EINVAL; +@@ -618,7 +622,9 @@ static int smu8_init_vce_limit(struct pp_hwmgr *hwmgr) + data->vce_dpm.soft_min_clk = 0; + data->vce_dpm.hard_min_clk = 0; + +- smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMaxEclkLevel, &level); ++ ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMaxEclkLevel, &level); ++ if (ret) ++ return ret; + + if (level < table->count) + clock = table->entries[level].ecclk; +@@ -638,6 +644,7 @@ static int smu8_init_acp_limit(struct pp_hwmgr *hwmgr) + hwmgr->dyn_state.acp_clock_voltage_dependency_table; + unsigned long clock = 0; + uint32_t level; ++ int ret; + + if (NULL == table || table->count <= 0) + return -EINVAL; +@@ -645,7 +652,9 @@ static int smu8_init_acp_limit(struct pp_hwmgr *hwmgr) + data->acp_dpm.soft_min_clk = 0; + data->acp_dpm.hard_min_clk = 0; + +- smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMaxAclkLevel, &level); ++ ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMaxAclkLevel, &level); ++ if (ret) ++ return ret; + + if (level < table->count) + clock = table->entries[level].acpclk; +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-pm-fix-uninitialized-variable-warning-for-sm.patch-18788 b/queue-6.10/drm-amd-pm-fix-uninitialized-variable-warning-for-sm.patch-18788 new file mode 100644 index 00000000000..3b5c4146ee8 --- /dev/null +++ b/queue-6.10/drm-amd-pm-fix-uninitialized-variable-warning-for-sm.patch-18788 @@ -0,0 +1,238 @@ +From 824dcde0125117934e863bdc32ca14634647a314 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Apr 2024 11:17:54 +0800 +Subject: drm/amd/pm: fix uninitialized variable warning for smu_v13 + +From: Tim Huang + +[ Upstream commit 6e46b89f40e39e2054f2e179e8e8c3132e7a9d57 ] + +Clear warning that using uninitialized variable when the dpm is +not enabled and reuse the code for SMU13 to get the boot frequency. + +Signed-off-by: Tim Huang +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h | 4 ++ + .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 55 +++++++++++++------ + .../drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c | 28 +--------- + .../drm/amd/pm/swsmu/smu13/smu_v13_0_5_ppt.c | 28 +--------- + .../drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c | 28 +--------- + 5 files changed, 51 insertions(+), 92 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h b/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h +index d9700a3f28d2..e58220a7ee2f 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h ++++ b/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h +@@ -298,5 +298,9 @@ int smu_v13_0_enable_uclk_shadow(struct smu_context *smu, bool enable); + + int smu_v13_0_set_wbrf_exclusion_ranges(struct smu_context *smu, + struct freq_band_range *exclusion_ranges); ++ ++int smu_v13_0_get_boot_freq_by_index(struct smu_context *smu, ++ enum smu_clk_type clk_type, ++ uint32_t *value); + #endif + #endif +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c +index b63ad9cb24bf..933fe93c8d1e 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c +@@ -1559,22 +1559,9 @@ int smu_v13_0_get_dpm_ultimate_freq(struct smu_context *smu, enum smu_clk_type c + uint32_t clock_limit; + + if (!smu_cmn_clk_dpm_is_enabled(smu, clk_type)) { +- switch (clk_type) { +- case SMU_MCLK: +- case SMU_UCLK: +- clock_limit = smu->smu_table.boot_values.uclk; +- break; +- case SMU_GFXCLK: +- case SMU_SCLK: +- clock_limit = smu->smu_table.boot_values.gfxclk; +- break; +- case SMU_SOCCLK: +- clock_limit = smu->smu_table.boot_values.socclk; +- break; +- default: +- clock_limit = 0; +- break; +- } ++ ret = smu_v13_0_get_boot_freq_by_index(smu, clk_type, &clock_limit); ++ if (ret) ++ return ret; + + /* clock in Mhz unit */ + if (min) +@@ -1894,6 +1881,40 @@ int smu_v13_0_set_power_source(struct smu_context *smu, + NULL); + } + ++int smu_v13_0_get_boot_freq_by_index(struct smu_context *smu, ++ enum smu_clk_type clk_type, ++ uint32_t *value) ++{ ++ int ret = 0; ++ ++ switch (clk_type) { ++ case SMU_MCLK: ++ case SMU_UCLK: ++ *value = smu->smu_table.boot_values.uclk; ++ break; ++ case SMU_FCLK: ++ *value = smu->smu_table.boot_values.fclk; ++ break; ++ case SMU_GFXCLK: ++ case SMU_SCLK: ++ *value = smu->smu_table.boot_values.gfxclk; ++ break; ++ case SMU_SOCCLK: ++ *value = smu->smu_table.boot_values.socclk; ++ break; ++ case SMU_VCLK: ++ *value = smu->smu_table.boot_values.vclk; ++ break; ++ case SMU_DCLK: ++ *value = smu->smu_table.boot_values.dclk; ++ break; ++ default: ++ ret = -EINVAL; ++ break; ++ } ++ return ret; ++} ++ + int smu_v13_0_get_dpm_freq_by_index(struct smu_context *smu, + enum smu_clk_type clk_type, uint16_t level, + uint32_t *value) +@@ -1905,7 +1926,7 @@ int smu_v13_0_get_dpm_freq_by_index(struct smu_context *smu, + return -EINVAL; + + if (!smu_cmn_clk_dpm_is_enabled(smu, clk_type)) +- return 0; ++ return smu_v13_0_get_boot_freq_by_index(smu, clk_type, value); + + clk_id = smu_cmn_to_asic_specific_index(smu, + CMN2ASIC_MAPPING_CLK, +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c +index b6257f34a7c6..b081ae3e8f43 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c +@@ -758,31 +758,9 @@ static int smu_v13_0_4_get_dpm_ultimate_freq(struct smu_context *smu, + int ret = 0; + + if (!smu_v13_0_4_clk_dpm_is_enabled(smu, clk_type)) { +- switch (clk_type) { +- case SMU_MCLK: +- case SMU_UCLK: +- clock_limit = smu->smu_table.boot_values.uclk; +- break; +- case SMU_FCLK: +- clock_limit = smu->smu_table.boot_values.fclk; +- break; +- case SMU_GFXCLK: +- case SMU_SCLK: +- clock_limit = smu->smu_table.boot_values.gfxclk; +- break; +- case SMU_SOCCLK: +- clock_limit = smu->smu_table.boot_values.socclk; +- break; +- case SMU_VCLK: +- clock_limit = smu->smu_table.boot_values.vclk; +- break; +- case SMU_DCLK: +- clock_limit = smu->smu_table.boot_values.dclk; +- break; +- default: +- clock_limit = 0; +- break; +- } ++ ret = smu_v13_0_get_boot_freq_by_index(smu, clk_type, &clock_limit); ++ if (ret) ++ return ret; + + /* clock in Mhz unit */ + if (min) +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_5_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_5_ppt.c +index 218f209c3775..59854465d711 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_5_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_5_ppt.c +@@ -733,31 +733,9 @@ static int smu_v13_0_5_get_dpm_ultimate_freq(struct smu_context *smu, + int ret = 0; + + if (!smu_v13_0_5_clk_dpm_is_enabled(smu, clk_type)) { +- switch (clk_type) { +- case SMU_MCLK: +- case SMU_UCLK: +- clock_limit = smu->smu_table.boot_values.uclk; +- break; +- case SMU_FCLK: +- clock_limit = smu->smu_table.boot_values.fclk; +- break; +- case SMU_GFXCLK: +- case SMU_SCLK: +- clock_limit = smu->smu_table.boot_values.gfxclk; +- break; +- case SMU_SOCCLK: +- clock_limit = smu->smu_table.boot_values.socclk; +- break; +- case SMU_VCLK: +- clock_limit = smu->smu_table.boot_values.vclk; +- break; +- case SMU_DCLK: +- clock_limit = smu->smu_table.boot_values.dclk; +- break; +- default: +- clock_limit = 0; +- break; +- } ++ ret = smu_v13_0_get_boot_freq_by_index(smu, clk_type, &clock_limit); ++ if (ret) ++ return ret; + + /* clock in Mhz unit */ + if (min) +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c +index d8bcf765a803..5917c88cc87d 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c +@@ -867,31 +867,9 @@ static int yellow_carp_get_dpm_ultimate_freq(struct smu_context *smu, + int ret = 0; + + if (!yellow_carp_clk_dpm_is_enabled(smu, clk_type)) { +- switch (clk_type) { +- case SMU_MCLK: +- case SMU_UCLK: +- clock_limit = smu->smu_table.boot_values.uclk; +- break; +- case SMU_FCLK: +- clock_limit = smu->smu_table.boot_values.fclk; +- break; +- case SMU_GFXCLK: +- case SMU_SCLK: +- clock_limit = smu->smu_table.boot_values.gfxclk; +- break; +- case SMU_SOCCLK: +- clock_limit = smu->smu_table.boot_values.socclk; +- break; +- case SMU_VCLK: +- clock_limit = smu->smu_table.boot_values.vclk; +- break; +- case SMU_DCLK: +- clock_limit = smu->smu_table.boot_values.dclk; +- break; +- default: +- clock_limit = 0; +- break; +- } ++ ret = smu_v13_0_get_boot_freq_by_index(smu, clk_type, &clock_limit); ++ if (ret) ++ return ret; + + /* clock in Mhz unit */ + if (min) +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-pm-fix-uninitialized-variable-warning.patch b/queue-6.10/drm-amd-pm-fix-uninitialized-variable-warning.patch new file mode 100644 index 00000000000..862790d831c --- /dev/null +++ b/queue-6.10/drm-amd-pm-fix-uninitialized-variable-warning.patch @@ -0,0 +1,37 @@ +From 6982e801d84c1e364db06b2de86b2fd2a112f72e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Apr 2024 15:36:26 +0800 +Subject: drm/amd/pm: fix uninitialized variable warning + +From: Jesse Zhang + +[ Upstream commit 7c836905520703dbc8b938993b6d4d718bc739f3 ] + +Check the return of function smum_send_msg_to_smc +as it may fail to initialize the variable. + +Signed-off-by: Jesse Zhang +Reviewed-by: Yang Wang +Reviewed-by: Tim Huang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c b/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c +index f531ce1d2b1d..a71c6117d7e5 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c +@@ -99,7 +99,7 @@ static void pp_swctf_delayed_work_handler(struct work_struct *work) + struct amdgpu_device *adev = hwmgr->adev; + struct amdgpu_dpm_thermal *range = + &adev->pm.dpm.thermal; +- uint32_t gpu_temperature, size; ++ uint32_t gpu_temperature, size = sizeof(gpu_temperature); + int ret; + + /* +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-pm-fix-uninitialized-variable-warnings-for-v.patch b/queue-6.10/drm-amd-pm-fix-uninitialized-variable-warnings-for-v.patch new file mode 100644 index 00000000000..99fe6db8c87 --- /dev/null +++ b/queue-6.10/drm-amd-pm-fix-uninitialized-variable-warnings-for-v.patch @@ -0,0 +1,180 @@ +From 2b9471d926f7aaee41e52afbb09beb5bfaefac3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Apr 2024 12:41:42 +0800 +Subject: drm/amd/pm: fix uninitialized variable warnings for vega10_hwmgr + +From: Tim Huang + +[ Upstream commit 5fa7d540d95d97ddc021a74583f6b3da4df9c93a ] + +Clear warnings that using uninitialized variable when fails +to get the valid value from SMU. + +Signed-off-by: Tim Huang +Reviewed-by: Yang Wang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 46 ++++++++++++++----- + .../amd/pm/powerplay/smumgr/vega10_smumgr.c | 6 ++- + 2 files changed, 39 insertions(+), 13 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c +index 574ead01430f..246b6568eb0d 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c +@@ -354,13 +354,13 @@ static int vega10_odn_initial_default_setting(struct pp_hwmgr *hwmgr) + return 0; + } + +-static void vega10_init_dpm_defaults(struct pp_hwmgr *hwmgr) ++static int vega10_init_dpm_defaults(struct pp_hwmgr *hwmgr) + { + struct vega10_hwmgr *data = hwmgr->backend; +- int i; + uint32_t sub_vendor_id, hw_revision; + uint32_t top32, bottom32; + struct amdgpu_device *adev = hwmgr->adev; ++ int ret, i; + + vega10_initialize_power_tune_defaults(hwmgr); + +@@ -485,9 +485,12 @@ static void vega10_init_dpm_defaults(struct pp_hwmgr *hwmgr) + if (data->registry_data.vr0hot_enabled) + data->smu_features[GNLD_VR0HOT].supported = true; + +- smum_send_msg_to_smc(hwmgr, ++ ret = smum_send_msg_to_smc(hwmgr, + PPSMC_MSG_GetSmuVersion, + &hwmgr->smu_version); ++ if (ret) ++ return ret; ++ + /* ACG firmware has major version 5 */ + if ((hwmgr->smu_version & 0xff000000) == 0x5000000) + data->smu_features[GNLD_ACG].supported = true; +@@ -505,10 +508,16 @@ static void vega10_init_dpm_defaults(struct pp_hwmgr *hwmgr) + data->smu_features[GNLD_PCC_LIMIT].supported = true; + + /* Get the SN to turn into a Unique ID */ +- smum_send_msg_to_smc(hwmgr, PPSMC_MSG_ReadSerialNumTop32, &top32); +- smum_send_msg_to_smc(hwmgr, PPSMC_MSG_ReadSerialNumBottom32, &bottom32); ++ ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_ReadSerialNumTop32, &top32); ++ if (ret) ++ return ret; ++ ++ ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_ReadSerialNumBottom32, &bottom32); ++ if (ret) ++ return ret; + + adev->unique_id = ((uint64_t)bottom32 << 32) | top32; ++ return 0; + } + + #ifdef PPLIB_VEGA10_EVV_SUPPORT +@@ -882,7 +891,9 @@ static int vega10_hwmgr_backend_init(struct pp_hwmgr *hwmgr) + + vega10_set_features_platform_caps(hwmgr); + +- vega10_init_dpm_defaults(hwmgr); ++ result = vega10_init_dpm_defaults(hwmgr); ++ if (result) ++ return result; + + #ifdef PPLIB_VEGA10_EVV_SUPPORT + /* Get leakage voltage based on leakage ID. */ +@@ -3913,11 +3924,14 @@ static int vega10_get_gpu_power(struct pp_hwmgr *hwmgr, + uint32_t *query) + { + uint32_t value; ++ int ret; + + if (!query) + return -EINVAL; + +- smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetCurrPkgPwr, &value); ++ ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetCurrPkgPwr, &value); ++ if (ret) ++ return ret; + + /* SMC returning actual watts, keep consistent with legacy asics, low 8 bit as 8 fractional bits */ + *query = value << 8; +@@ -4813,14 +4827,16 @@ static int vega10_print_clock_levels(struct pp_hwmgr *hwmgr, + uint32_t gen_speed, lane_width, current_gen_speed, current_lane_width; + PPTable_t *pptable = &(data->smc_state_table.pp_table); + +- int i, now, size = 0, count = 0; ++ int i, ret, now, size = 0, count = 0; + + switch (type) { + case PP_SCLK: + if (data->registry_data.sclk_dpm_key_disabled) + break; + +- smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetCurrentGfxclkIndex, &now); ++ ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetCurrentGfxclkIndex, &now); ++ if (ret) ++ break; + + if (hwmgr->pp_one_vf && + (hwmgr->dpm_level == AMD_DPM_FORCED_LEVEL_PROFILE_PEAK)) +@@ -4836,7 +4852,9 @@ static int vega10_print_clock_levels(struct pp_hwmgr *hwmgr, + if (data->registry_data.mclk_dpm_key_disabled) + break; + +- smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetCurrentUclkIndex, &now); ++ ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetCurrentUclkIndex, &now); ++ if (ret) ++ break; + + for (i = 0; i < mclk_table->count; i++) + size += sprintf(buf + size, "%d: %uMhz %s\n", +@@ -4847,7 +4865,9 @@ static int vega10_print_clock_levels(struct pp_hwmgr *hwmgr, + if (data->registry_data.socclk_dpm_key_disabled) + break; + +- smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetCurrentSocclkIndex, &now); ++ ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetCurrentSocclkIndex, &now); ++ if (ret) ++ break; + + for (i = 0; i < soc_table->count; i++) + size += sprintf(buf + size, "%d: %uMhz %s\n", +@@ -4858,8 +4878,10 @@ static int vega10_print_clock_levels(struct pp_hwmgr *hwmgr, + if (data->registry_data.dcefclk_dpm_key_disabled) + break; + +- smum_send_msg_to_smc_with_parameter(hwmgr, ++ ret = smum_send_msg_to_smc_with_parameter(hwmgr, + PPSMC_MSG_GetClockFreqMHz, CLK_DCEFCLK, &now); ++ if (ret) ++ break; + + for (i = 0; i < dcef_table->count; i++) + size += sprintf(buf + size, "%d: %uMhz %s\n", +diff --git a/drivers/gpu/drm/amd/pm/powerplay/smumgr/vega10_smumgr.c b/drivers/gpu/drm/amd/pm/powerplay/smumgr/vega10_smumgr.c +index a70d73896649..f9c0f117725d 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/smumgr/vega10_smumgr.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/smumgr/vega10_smumgr.c +@@ -130,13 +130,17 @@ int vega10_get_enabled_smc_features(struct pp_hwmgr *hwmgr, + uint64_t *features_enabled) + { + uint32_t enabled_features; ++ int ret; + + if (features_enabled == NULL) + return -EINVAL; + +- smum_send_msg_to_smc(hwmgr, ++ ret = smum_send_msg_to_smc(hwmgr, + PPSMC_MSG_GetEnabledSmuFeatures, + &enabled_features); ++ if (ret) ++ return ret; ++ + *features_enabled = enabled_features; + + return 0; +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-pm-fix-uninitialized-variable-warnings-for-v.patch-20400 b/queue-6.10/drm-amd-pm-fix-uninitialized-variable-warnings-for-v.patch-20400 new file mode 100644 index 00000000000..91f80647a61 --- /dev/null +++ b/queue-6.10/drm-amd-pm-fix-uninitialized-variable-warnings-for-v.patch-20400 @@ -0,0 +1,56 @@ +From acc43b97ab3ce97c8c3066865bab2e07a35b8f30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Apr 2024 15:42:03 +0800 +Subject: drm/amd/pm: fix uninitialized variable warnings for vangogh_ppt + +From: Tim Huang + +[ Upstream commit b2871de6961d24d421839fbfa4aa3008ec9170d5 ] + +1. Fix a issue that using uninitialized mask to get the ultimate frequency. +2. Check return of smu_cmn_send_smc_msg_with_param to avoid using +uninitialized variable residency. + +Signed-off-by: Tim Huang +Reviewed-by: Yang Wang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c +index 379e44eb0019..22737b11b1bf 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c +@@ -976,6 +976,18 @@ static int vangogh_get_dpm_ultimate_freq(struct smu_context *smu, + } + } + if (min) { ++ ret = vangogh_get_profiling_clk_mask(smu, ++ AMD_DPM_FORCED_LEVEL_PROFILE_MIN_MCLK, ++ NULL, ++ NULL, ++ &mclk_mask, ++ &fclk_mask, ++ &soc_mask); ++ if (ret) ++ goto failed; ++ ++ vclk_mask = dclk_mask = 0; ++ + switch (clk_type) { + case SMU_UCLK: + case SMU_MCLK: +@@ -2450,6 +2462,8 @@ static u32 vangogh_set_gfxoff_residency(struct smu_context *smu, bool start) + + ret = smu_cmn_send_smc_msg_with_param(smu, SMU_MSG_LogGfxOffResidency, + start, &residency); ++ if (ret) ++ return ret; + + if (!start) + adev->gfx.gfx_off_residency = residency; +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-pm-fix-warning-using-uninitialized-value-of-.patch b/queue-6.10/drm-amd-pm-fix-warning-using-uninitialized-value-of-.patch new file mode 100644 index 00000000000..7bb7bd6e3d0 --- /dev/null +++ b/queue-6.10/drm-amd-pm-fix-warning-using-uninitialized-value-of-.patch @@ -0,0 +1,41 @@ +From 8acc8e7c994c05443f86c41f4c9b64951e59e8ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Apr 2024 15:26:25 +0800 +Subject: drm/amd/pm: fix warning using uninitialized value of max_vid_step + +From: Jesse Zhang + +[ Upstream commit 17e3bea65cdc453695b2fe4ff26d25d17f5339e9 ] + +Check the return of pp_atomfwctrl_get_Voltage_table_v4 +as it may fail to initialize max_vid_step +V2: change the check condition (Tim Huang) + +Signed-off-by: Jesse Zhang +Reviewed-by: Tim Huang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c +index f4acdb226741..574ead01430f 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c +@@ -2571,8 +2571,11 @@ static int vega10_init_smc_table(struct pp_hwmgr *hwmgr) + } + } + +- pp_atomfwctrl_get_voltage_table_v4(hwmgr, VOLTAGE_TYPE_VDDC, ++ result = pp_atomfwctrl_get_voltage_table_v4(hwmgr, VOLTAGE_TYPE_VDDC, + VOLTAGE_OBJ_SVID2, &voltage_table); ++ PP_ASSERT_WITH_CODE(!result, ++ "Failed to get voltage table!", ++ return result); + pp_table->MaxVidStep = voltage_table.max_vid_step; + + pp_table->GfxDpmVoltageMode = +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-add-lock-in-amdgpu_gart_invalidate_tlb.patch b/queue-6.10/drm-amdgpu-add-lock-in-amdgpu_gart_invalidate_tlb.patch new file mode 100644 index 00000000000..cdd2df547ce --- /dev/null +++ b/queue-6.10/drm-amdgpu-add-lock-in-amdgpu_gart_invalidate_tlb.patch @@ -0,0 +1,51 @@ +From 35934f158a5c0b235914534fd2c99527a59e6d98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 May 2024 17:11:30 -0400 +Subject: drm/amdgpu: add lock in amdgpu_gart_invalidate_tlb +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Yunxiang Li + +[ Upstream commit 18f2525d31401e5142db95ff3a6ec0f4147be818 ] + +We need to take the reset domain lock before flush hdp. We can't put the +lock inside amdgpu_device_flush_hdp itself because it is used during +reset where we already take the write side lock. + +Signed-off-by: Yunxiang Li +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c +index c623e23049d1..a6ddffbf8b4d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c +@@ -34,6 +34,7 @@ + #include + #endif + #include "amdgpu.h" ++#include "amdgpu_reset.h" + #include + #include + +@@ -408,7 +409,10 @@ void amdgpu_gart_invalidate_tlb(struct amdgpu_device *adev) + return; + + mb(); +- amdgpu_device_flush_hdp(adev, NULL); ++ if (down_read_trylock(&adev->reset_domain->sem)) { ++ amdgpu_device_flush_hdp(adev, NULL); ++ up_read(&adev->reset_domain->sem); ++ } + for_each_set_bit(i, adev->vmhubs_mask, AMDGPU_MAX_VMHUBS) + amdgpu_gmc_flush_gpu_tlb(adev, 0, i, 0); + } +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-add-lock-in-kfd_process_dequeue_from_devi.patch b/queue-6.10/drm-amdgpu-add-lock-in-kfd_process_dequeue_from_devi.patch new file mode 100644 index 00000000000..9a0a3139685 --- /dev/null +++ b/queue-6.10/drm-amdgpu-add-lock-in-kfd_process_dequeue_from_devi.patch @@ -0,0 +1,52 @@ +From fc119049d26c16969653237c633a7e219556c1dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 12:29:30 -0400 +Subject: drm/amdgpu: add lock in kfd_process_dequeue_from_device + +From: Yunxiang Li + +[ Upstream commit d225960c2330e102370815367b877baaf8bb8b5d ] + +We need to take the reset domain lock before talking to MES. While in +this case we can take the lock inside the mes helper. We can't do so for +most other mes helpers since they are used during reset. So for +consistency sake we add the lock here. + +Signed-off-by: Yunxiang Li +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c +index 4858112f9a53..a5bdc3258ae5 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c +@@ -28,6 +28,7 @@ + #include "kfd_priv.h" + #include "kfd_kernel_queue.h" + #include "amdgpu_amdkfd.h" ++#include "amdgpu_reset.h" + + static inline struct process_queue_node *get_queue_by_qid( + struct process_queue_manager *pqm, unsigned int qid) +@@ -87,8 +88,12 @@ void kfd_process_dequeue_from_device(struct kfd_process_device *pdd) + return; + + dev->dqm->ops.process_termination(dev->dqm, &pdd->qpd); +- if (dev->kfd->shared_resources.enable_mes) +- amdgpu_mes_flush_shader_debugger(dev->adev, pdd->proc_ctx_gpu_addr); ++ if (dev->kfd->shared_resources.enable_mes && ++ down_read_trylock(&dev->adev->reset_domain->sem)) { ++ amdgpu_mes_flush_shader_debugger(dev->adev, ++ pdd->proc_ctx_gpu_addr); ++ up_read(&dev->adev->reset_domain->sem); ++ } + pdd->already_dequeued = true; + } + +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-add-skip_hw_access-checks-for-sriov.patch b/queue-6.10/drm-amdgpu-add-skip_hw_access-checks-for-sriov.patch new file mode 100644 index 00000000000..828618655e6 --- /dev/null +++ b/queue-6.10/drm-amdgpu-add-skip_hw_access-checks-for-sriov.patch @@ -0,0 +1,60 @@ +From 848ce9db46d195b9334ecf709c5f41dc732047b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 May 2024 16:14:55 -0400 +Subject: drm/amdgpu: add skip_hw_access checks for sriov +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Yunxiang Li + +[ Upstream commit b3948ad1ac582f560e1f3aeaecf384619921c48d ] + +Accessing registers via host is missing the check for skip_hw_access and +the lockdep check that comes with it. + +Signed-off-by: Yunxiang Li +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +index 923d51f16ec8..2359d1d60275 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +@@ -977,6 +977,9 @@ u32 amdgpu_virt_rlcg_reg_rw(struct amdgpu_device *adev, u32 offset, u32 v, u32 f + return 0; + } + ++ if (amdgpu_device_skip_hw_access(adev)) ++ return 0; ++ + reg_access_ctrl = &adev->gfx.rlc.reg_access_ctrl[xcc_id]; + scratch_reg0 = (void __iomem *)adev->rmmio + 4 * reg_access_ctrl->scratch_reg0; + scratch_reg1 = (void __iomem *)adev->rmmio + 4 * reg_access_ctrl->scratch_reg1; +@@ -1053,6 +1056,9 @@ void amdgpu_sriov_wreg(struct amdgpu_device *adev, + { + u32 rlcg_flag; + ++ if (amdgpu_device_skip_hw_access(adev)) ++ return; ++ + if (!amdgpu_sriov_runtime(adev) && + amdgpu_virt_get_rlcg_reg_access_flag(adev, acc_flags, hwip, true, &rlcg_flag)) { + amdgpu_virt_rlcg_reg_rw(adev, offset, value, rlcg_flag, xcc_id); +@@ -1070,6 +1076,9 @@ u32 amdgpu_sriov_rreg(struct amdgpu_device *adev, + { + u32 rlcg_flag; + ++ if (amdgpu_device_skip_hw_access(adev)) ++ return 0; ++ + if (!amdgpu_sriov_runtime(adev) && + amdgpu_virt_get_rlcg_reg_access_flag(adev, acc_flags, hwip, false, &rlcg_flag)) + return amdgpu_virt_rlcg_reg_rw(adev, offset, 0, rlcg_flag, xcc_id); +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-avoid-reading-vf2pf-info-size-from-fb.patch b/queue-6.10/drm-amdgpu-avoid-reading-vf2pf-info-size-from-fb.patch new file mode 100644 index 00000000000..80513062b8a --- /dev/null +++ b/queue-6.10/drm-amdgpu-avoid-reading-vf2pf-info-size-from-fb.patch @@ -0,0 +1,37 @@ +From f661956f64881d70ac4b636c0144b972ee3d0b59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Apr 2024 16:35:14 -0400 +Subject: drm/amdgpu: avoid reading vf2pf info size from FB + +From: Zhigang Luo + +[ Upstream commit 3bcc0ee14768d886cedff65da72d83d375a31a56 ] + +VF can't access FB when host is doing mode1 reset. Using sizeof to get +vf2pf info size, instead of reading it from vf2pf header stored in FB. + +Signed-off-by: Zhigang Luo +Reviewed-by: Hawking Zhang +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +index f5fedf1be236..761fff80ec1f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +@@ -585,7 +585,7 @@ static int amdgpu_virt_write_vf2pf_data(struct amdgpu_device *adev) + } + vf2pf_info->checksum = + amd_sriov_msg_checksum( +- vf2pf_info, vf2pf_info->header.size, 0, 0); ++ vf2pf_info, sizeof(*vf2pf_info), 0, 0); + + return 0; + } +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-fix-compiler-side-effect-check-issue-for-.patch b/queue-6.10/drm-amdgpu-fix-compiler-side-effect-check-issue-for-.patch new file mode 100644 index 00000000000..ef82e6d6676 --- /dev/null +++ b/queue-6.10/drm-amdgpu-fix-compiler-side-effect-check-issue-for-.patch @@ -0,0 +1,80 @@ +From a71029d401399c799731b5b6966d6a4e224389eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 May 2024 07:48:19 +0800 +Subject: drm/amdgpu: fix compiler 'side-effect' check issue for + RAS_EVENT_LOG() + +From: Yang Wang + +[ Upstream commit b712d7c20133b67f13aa134e7534369f19e1214f ] + +create a new helper function to avoid compiler 'side-effect' +check about RAS_EVENT_LOG() macro. + +Signed-off-by: Yang Wang +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 18 ++++++++++++++++++ + drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h | 13 ++++++------- + 2 files changed, 24 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +index 0c4ee06451e9..57fdc4ab9c54 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +@@ -4504,3 +4504,21 @@ int amdgpu_ras_reserve_page(struct amdgpu_device *adev, uint64_t pfn) + + return ret; + } ++ ++void amdgpu_ras_event_log_print(struct amdgpu_device *adev, u64 event_id, ++ const char *fmt, ...) ++{ ++ struct va_format vaf; ++ va_list args; ++ ++ va_start(args, fmt); ++ vaf.fmt = fmt; ++ vaf.va = &args; ++ ++ if (amdgpu_ras_event_id_is_valid(adev, event_id)) ++ dev_printk(KERN_INFO, adev->dev, "{%llu}%pV", event_id, &vaf); ++ else ++ dev_printk(KERN_INFO, adev->dev, "%pV", &vaf); ++ ++ va_end(args); ++} +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h +index 7021c4a66fb5..d06c01b978cd 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h +@@ -67,13 +67,8 @@ struct amdgpu_iv_entry; + /* The high three bits indicates socketid */ + #define AMDGPU_RAS_GET_FEATURES(val) ((val) & ~AMDGPU_RAS_FEATURES_SOCKETID_MASK) + +-#define RAS_EVENT_LOG(_adev, _id, _fmt, ...) \ +-do { \ +- if (amdgpu_ras_event_id_is_valid((_adev), (_id))) \ +- dev_info((_adev)->dev, "{%llu}" _fmt, (_id), ##__VA_ARGS__); \ +- else \ +- dev_info((_adev)->dev, _fmt, ##__VA_ARGS__); \ +-} while (0) ++#define RAS_EVENT_LOG(adev, id, fmt, ...) \ ++ amdgpu_ras_event_log_print((adev), (id), (fmt), ##__VA_ARGS__); + + enum amdgpu_ras_block { + AMDGPU_RAS_BLOCK__UMC = 0, +@@ -956,4 +951,8 @@ int amdgpu_ras_put_poison_req(struct amdgpu_device *adev, + enum amdgpu_ras_block block, uint16_t pasid, + pasid_notify pasid_fn, void *data, uint32_t reset); + ++__printf(3, 4) ++void amdgpu_ras_event_log_print(struct amdgpu_device *adev, u64 event_id, ++ const char *fmt, ...); ++ + #endif +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-fix-dereference-after-null-check.patch b/queue-6.10/drm-amdgpu-fix-dereference-after-null-check.patch new file mode 100644 index 00000000000..41d7d54bd47 --- /dev/null +++ b/queue-6.10/drm-amdgpu-fix-dereference-after-null-check.patch @@ -0,0 +1,35 @@ +From fc781f5ae33d7fc6ccd088947abe654fa8f8d6dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 May 2024 14:51:35 +0800 +Subject: drm/amdgpu: fix dereference after null check + +From: Jesse Zhang + +[ Upstream commit b1f7810b05d1950350ac2e06992982974343e441 ] + +check the pointer hive before use. + +Signed-off-by: Jesse Zhang +Reviewed-by: Tim Huang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index 13b54e00a247..d24d7a108624 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -5727,7 +5727,7 @@ int amdgpu_device_gpu_recover(struct amdgpu_device *adev, + * to put adev in the 1st position. + */ + INIT_LIST_HEAD(&device_list); +- if (!amdgpu_sriov_vf(adev) && (adev->gmc.xgmi.num_physical_nodes > 1)) { ++ if (!amdgpu_sriov_vf(adev) && (adev->gmc.xgmi.num_physical_nodes > 1) && hive) { + list_for_each_entry(tmp_adev, &hive->device_list, gmc.xgmi.head) { + list_add_tail(&tmp_adev->reset_list, &device_list); + if (adev->shutdown) +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-fix-mc_data-out-of-bounds-read-warning.patch b/queue-6.10/drm-amdgpu-fix-mc_data-out-of-bounds-read-warning.patch new file mode 100644 index 00000000000..e6e46d3bf17 --- /dev/null +++ b/queue-6.10/drm-amdgpu-fix-mc_data-out-of-bounds-read-warning.patch @@ -0,0 +1,35 @@ +From aa4d6664d9c73966d08fffb7249c16f4ba08ed41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 May 2024 16:30:01 +0800 +Subject: drm/amdgpu: fix mc_data out-of-bounds read warning + +From: Tim Huang + +[ Upstream commit 51dfc0a4d609fe700750a62f41447f01b8c9ea50 ] + +Clear warning that read mc_data[i-1] may out-of-bounds. + +Signed-off-by: Tim Huang +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c +index 52b12c1718eb..7dc102f0bc1d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c +@@ -1484,6 +1484,8 @@ int amdgpu_atombios_init_mc_reg_table(struct amdgpu_device *adev, + (u32)le32_to_cpu(*((u32 *)reg_data + j)); + j++; + } else if ((reg_table->mc_reg_address[i].pre_reg_data & LOW_NIBBLE_MASK) == DATA_EQU_PREV) { ++ if (i == 0) ++ continue; + reg_table->mc_reg_table_entry[num_ranges].mc_data[i] = + reg_table->mc_reg_table_entry[num_ranges].mc_data[i - 1]; + } +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-fix-out-of-bounds-read-of-df_v1_7_channel.patch b/queue-6.10/drm-amdgpu-fix-out-of-bounds-read-of-df_v1_7_channel.patch new file mode 100644 index 00000000000..4a4d3fe91db --- /dev/null +++ b/queue-6.10/drm-amdgpu-fix-out-of-bounds-read-of-df_v1_7_channel.patch @@ -0,0 +1,36 @@ +From c57416b4e0f60e21a3a9a0d508d7a103e091df12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 May 2024 09:29:33 +0800 +Subject: drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number + +From: Ma Jun + +[ Upstream commit d768394fa99467bcf2703bde74ddc96eeb0b71fa ] + +Check the fb_channel_number range to avoid the array out-of-bounds +read error + +Signed-off-by: Ma Jun +Reviewed-by: Tim Huang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/df_v1_7.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/df_v1_7.c b/drivers/gpu/drm/amd/amdgpu/df_v1_7.c +index 5dfab80ffff2..cd298556f7a6 100644 +--- a/drivers/gpu/drm/amd/amdgpu/df_v1_7.c ++++ b/drivers/gpu/drm/amd/amdgpu/df_v1_7.c +@@ -70,6 +70,8 @@ static u32 df_v1_7_get_hbm_channel_number(struct amdgpu_device *adev) + int fb_channel_number; + + fb_channel_number = adev->df.funcs->get_fb_channel_number(adev); ++ if (fb_channel_number >= ARRAY_SIZE(df_v1_7_channel_number)) ++ fb_channel_number = 0; + + return df_v1_7_channel_number[fb_channel_number]; + } +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-fix-out-of-bounds-write-warning.patch b/queue-6.10/drm-amdgpu-fix-out-of-bounds-write-warning.patch new file mode 100644 index 00000000000..30e0875ef6c --- /dev/null +++ b/queue-6.10/drm-amdgpu-fix-out-of-bounds-write-warning.patch @@ -0,0 +1,40 @@ +From 8e8e4119effd74ad12aa2628245da61dff2d0f44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Apr 2024 14:00:17 +0800 +Subject: drm/amdgpu: Fix out-of-bounds write warning +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ma Jun + +[ Upstream commit be1684930f5262a622d40ce7a6f1423530d87f89 ] + +Check the ring type value to fix the out-of-bounds +write warning + +Signed-off-by: Ma Jun +Suggested-by: Christian König +Reviewed-by: Tim Huang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c +index d20405d84e12..e6344a6b0a9f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c +@@ -354,7 +354,7 @@ int amdgpu_ring_init(struct amdgpu_device *adev, struct amdgpu_ring *ring, + ring->max_dw = max_dw; + ring->hw_prio = hw_prio; + +- if (!ring->no_scheduler) { ++ if (!ring->no_scheduler && ring->funcs->type < AMDGPU_HW_IP_NUM) { + hw_ip = ring->funcs->type; + num_sched = &adev->gpu_sched[hw_ip][hw_prio].num_scheds; + adev->gpu_sched[hw_ip][hw_prio].sched[(*num_sched)++] = +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-fix-overflowed-array-index-read-warning.patch b/queue-6.10/drm-amdgpu-fix-overflowed-array-index-read-warning.patch new file mode 100644 index 00000000000..b1e0f227b57 --- /dev/null +++ b/queue-6.10/drm-amdgpu-fix-overflowed-array-index-read-warning.patch @@ -0,0 +1,41 @@ +From a31984269bc1d9239b44a1544568cca024afee43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Apr 2024 13:15:27 +0800 +Subject: drm/amdgpu: fix overflowed array index read warning +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tim Huang + +[ Upstream commit ebbc2ada5c636a6a63d8316a3408753768f5aa9f ] + +Clear overflowed array index read warning by cast operation. + +Signed-off-by: Tim Huang +Reviewed-by: Alex Deucher +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c +index 88ffb15e25cc..d20405d84e12 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c +@@ -475,8 +475,9 @@ static ssize_t amdgpu_debugfs_ring_read(struct file *f, char __user *buf, + size_t size, loff_t *pos) + { + struct amdgpu_ring *ring = file_inode(f)->i_private; +- int r, i; + uint32_t value, result, early[3]; ++ loff_t i; ++ int r; + + if (*pos & 3 || size & 3) + return -EINVAL; +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-fix-overflowed-constant-warning-in-mmhub_.patch b/queue-6.10/drm-amdgpu-fix-overflowed-constant-warning-in-mmhub_.patch new file mode 100644 index 00000000000..2685c7fa4ad --- /dev/null +++ b/queue-6.10/drm-amdgpu-fix-overflowed-constant-warning-in-mmhub_.patch @@ -0,0 +1,82 @@ +From a61502bd6cf60fd6b70bb37446df6491fabb55ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 16:33:35 +0800 +Subject: drm/amdgpu: fix overflowed constant warning in + mmhub_set_clockgating() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bob Zhou + +[ Upstream commit be6a69b21a3517122ba6cf7ab8f62f4803637dbe ] + +To fix potential overflowed constant warning, modify the variables to u32 +for getting the return value of RREG32_SOC15(). + +Signed-off-by: Bob Zhou +Acked-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/mmhub_v1_7.c | 2 +- + drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c | 2 +- + drivers/gpu/drm/amd/amdgpu/mmhub_v3_3.c | 2 +- + drivers/gpu/drm/amd/amdgpu/mmhub_v9_4.c | 2 +- + 4 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_7.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_7.c +index 92432cd2c0c7..9689e2b5d4e5 100644 +--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_7.c ++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_7.c +@@ -544,7 +544,7 @@ static int mmhub_v1_7_set_clockgating(struct amdgpu_device *adev, + + static void mmhub_v1_7_get_clockgating(struct amdgpu_device *adev, u64 *flags) + { +- int data, data1; ++ u32 data, data1; + + if (amdgpu_sriov_vf(adev)) + *flags = 0; +diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c +index 02fd45261399..a0cc8e218ca1 100644 +--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c +@@ -671,7 +671,7 @@ static int mmhub_v2_0_set_clockgating(struct amdgpu_device *adev, + + static void mmhub_v2_0_get_clockgating(struct amdgpu_device *adev, u64 *flags) + { +- int data, data1; ++ u32 data, data1; + + if (amdgpu_sriov_vf(adev)) + *flags = 0; +diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v3_3.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v3_3.c +index 238ea40c2450..d7c317825497 100644 +--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v3_3.c ++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v3_3.c +@@ -560,7 +560,7 @@ static int mmhub_v3_3_set_clockgating(struct amdgpu_device *adev, + + static void mmhub_v3_3_get_clockgating(struct amdgpu_device *adev, u64 *flags) + { +- int data; ++ u32 data; + + if (amdgpu_sriov_vf(adev)) + *flags = 0; +diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v9_4.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v9_4.c +index 1b7da4aff2b8..ff1b58e44689 100644 +--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v9_4.c ++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v9_4.c +@@ -657,7 +657,7 @@ static int mmhub_v9_4_set_clockgating(struct amdgpu_device *adev, + + static void mmhub_v9_4_get_clockgating(struct amdgpu_device *adev, u64 *flags) + { +- int data, data1; ++ u32 data, data1; + + if (amdgpu_sriov_vf(adev)) + *flags = 0; +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-fix-the-uninitialized-variable-warning.patch b/queue-6.10/drm-amdgpu-fix-the-uninitialized-variable-warning.patch new file mode 100644 index 00000000000..a6b391caa39 --- /dev/null +++ b/queue-6.10/drm-amdgpu-fix-the-uninitialized-variable-warning.patch @@ -0,0 +1,38 @@ +From 84a43555ffad6222e7584ab959f345a439517d34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 15:44:56 +0800 +Subject: drm/amdgpu: Fix the uninitialized variable warning + +From: Ma Jun + +[ Upstream commit 7e39d7ec35883a168343ea02f40e260e176c6c63 ] + +Check the user input and phy_id value range to fix +"Using uninitialized value phy_id" + +Signed-off-by: Ma Jun +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c +index 8ed0e073656f..41ebe690eeff 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c +@@ -135,6 +135,10 @@ static ssize_t amdgpu_securedisplay_debugfs_write(struct file *f, const char __u + mutex_unlock(&psp->securedisplay_context.mutex); + break; + case 2: ++ if (size < 3 || phy_id >= TA_SECUREDISPLAY_MAX_PHY) { ++ dev_err(adev->dev, "Invalid input: %s\n", str); ++ return -EINVAL; ++ } + mutex_lock(&psp->securedisplay_context.mutex); + psp_prep_securedisplay_cmd_buf(psp, &securedisplay_cmd, + TA_SECUREDISPLAY_COMMAND__SEND_ROI_CRC); +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-fix-the-waring-dereferencing-hive.patch b/queue-6.10/drm-amdgpu-fix-the-waring-dereferencing-hive.patch new file mode 100644 index 00000000000..9fb7b16b376 --- /dev/null +++ b/queue-6.10/drm-amdgpu-fix-the-waring-dereferencing-hive.patch @@ -0,0 +1,36 @@ +From 9ff3a471bedb47a5f34b605c81c6042be5e136f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 May 2024 16:20:49 +0800 +Subject: drm/amdgpu: fix the waring dereferencing hive + +From: Jesse Zhang + +[ Upstream commit 1940708ccf5aff76de4e0b399f99267c93a89193 ] + +Check the amdgpu_hive_info *hive that maybe is NULL. + +Signed-off-by: Jesse Zhang +Reviewed-by: Tim Huang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index cef9dd0a012b..b3df27ce7663 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -1375,6 +1375,9 @@ static void psp_xgmi_reflect_topology_info(struct psp_context *psp, + uint8_t dst_num_links = node_info.num_links; + + hive = amdgpu_get_xgmi_hive(psp->adev); ++ if (WARN_ON(!hive)) ++ return; ++ + list_for_each_entry(mirror_adev, &hive->device_list, gmc.xgmi.head) { + struct psp_xgmi_topology_info *mirror_top_info; + int j; +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-fix-the-warning-bad-bit-shift-operation-f.patch b/queue-6.10/drm-amdgpu-fix-the-warning-bad-bit-shift-operation-f.patch new file mode 100644 index 00000000000..2eff7364a47 --- /dev/null +++ b/queue-6.10/drm-amdgpu-fix-the-warning-bad-bit-shift-operation-f.patch @@ -0,0 +1,36 @@ +From 2a1c8527ef03fa16b97ab5683a2381012d2c7d52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 13:17:47 +0800 +Subject: drm/amdgpu: fix the warning bad bit shift operation for + aca_error_type type + +From: Jesse Zhang + +[ Upstream commit e6ae021adb79e5f4c4bc4362dd651d7b8b646340 ] + +Filter invalid aca error types before performing a shift operation. + +Signed-off-by: Jesse Zhang +Reviewed-by: Yang Wang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c +index c50202215f6b..9baee7c246b6 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c +@@ -534,7 +534,7 @@ int amdgpu_aca_get_error_data(struct amdgpu_device *adev, struct aca_handle *han + if (aca_handle_is_valid(handle)) + return -EOPNOTSUPP; + +- if (!(BIT(type) & handle->mask)) ++ if ((type < 0) || (!(BIT(type) & handle->mask))) + return 0; + + return __aca_get_error_data(adev, handle, type, err_data, qctx); +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-fix-the-warning-division-or-modulo-by-zer.patch b/queue-6.10/drm-amdgpu-fix-the-warning-division-or-modulo-by-zer.patch new file mode 100644 index 00000000000..f58f0fd614f --- /dev/null +++ b/queue-6.10/drm-amdgpu-fix-the-warning-division-or-modulo-by-zer.patch @@ -0,0 +1,40 @@ +From fca3681b0964af734963eec8ed6d58777a6d831e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 May 2024 17:32:53 +0800 +Subject: drm/amdgpu: Fix the warning division or modulo by zero + +From: Jesse Zhang + +[ Upstream commit 1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c ] + +Checks the partition mode and returns an error for an invalid mode. + +Signed-off-by: Jesse Zhang +Suggested-by: Lijo Lazar +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c b/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c +index d4e2aed2efa3..2c9a0aa41e2d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c ++++ b/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c +@@ -501,6 +501,12 @@ static int aqua_vanjaram_switch_partition_mode(struct amdgpu_xcp_mgr *xcp_mgr, + + if (mode == AMDGPU_AUTO_COMPUTE_PARTITION_MODE) { + mode = __aqua_vanjaram_get_auto_mode(xcp_mgr); ++ if (mode == AMDGPU_UNKNOWN_COMPUTE_PARTITION_MODE) { ++ dev_err(adev->dev, ++ "Invalid config, no compatible compute partition mode found, available memory partitions: %d", ++ adev->gmc.num_mem_partitions); ++ return -EINVAL; ++ } + } else if (!__aqua_vanjaram_is_valid_mode(xcp_mgr, mode)) { + dev_err(adev->dev, + "Invalid compute partition mode requested, requested: %s, available memory partitions: %d", +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-fix-ucode-out-of-bounds-read-warning.patch b/queue-6.10/drm-amdgpu-fix-ucode-out-of-bounds-read-warning.patch new file mode 100644 index 00000000000..0039cf3aa01 --- /dev/null +++ b/queue-6.10/drm-amdgpu-fix-ucode-out-of-bounds-read-warning.patch @@ -0,0 +1,36 @@ +From 5028266cec7c9721038c1a2fb6703702d87926b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 May 2024 16:21:00 +0800 +Subject: drm/amdgpu: fix ucode out-of-bounds read warning + +From: Tim Huang + +[ Upstream commit 8944acd0f9db33e17f387fdc75d33bb473d7936f ] + +Clear warning that read ucode[] may out-of-bounds. + +Signed-off-by: Tim Huang +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c +index b8280be6225d..c3d89088123d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c +@@ -213,6 +213,9 @@ static int amdgpu_cgs_get_firmware_info(struct cgs_device *cgs_device, + struct amdgpu_firmware_info *ucode; + + id = fw_type_convert(cgs_device, type); ++ if (id >= AMDGPU_UCODE_ID_MAXIMUM) ++ return -EINVAL; ++ + ucode = &adev->firmware.ucode[id]; + if (ucode->fw == NULL) + return -EINVAL; +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-fix-uninitialized-scalar-variable-warning.patch b/queue-6.10/drm-amdgpu-fix-uninitialized-scalar-variable-warning.patch new file mode 100644 index 00000000000..526dcc5f09e --- /dev/null +++ b/queue-6.10/drm-amdgpu-fix-uninitialized-scalar-variable-warning.patch @@ -0,0 +1,36 @@ +From 7dfa15ce501971fd457b541ebfbe4b5241e34007 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Apr 2024 08:43:30 +0800 +Subject: drm/amdgpu: fix uninitialized scalar variable warning + +From: Tim Huang + +[ Upstream commit 0fa4c25db8b791f79bc0d5a0cd58aff9ad85186b ] + +Clear warning that field bp is uninitialized when +calling amdgpu_virt_ras_add_bps. + +Signed-off-by: Tim Huang +Reviewed-by: Yang Wang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +index 972a58f0f492..f5fedf1be236 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +@@ -395,6 +395,8 @@ static void amdgpu_virt_add_bad_page(struct amdgpu_device *adev, + else + vram_usage_va = adev->mman.drv_vram_usage_va; + ++ memset(&bp, 0, sizeof(bp)); ++ + if (bp_block_size) { + bp_cnt = bp_block_size / sizeof(uint64_t); + for (bp_idx = 0; bp_idx < bp_cnt; bp_idx++) { +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-fix-uninitialized-variable-warning-for-am.patch b/queue-6.10/drm-amdgpu-fix-uninitialized-variable-warning-for-am.patch new file mode 100644 index 00000000000..7cdab413a8b --- /dev/null +++ b/queue-6.10/drm-amdgpu-fix-uninitialized-variable-warning-for-am.patch @@ -0,0 +1,36 @@ +From fb792822512b563b3d9607f4f01445577ab9575e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 May 2024 13:48:57 +0800 +Subject: drm/amdgpu: fix uninitialized variable warning for amdgpu_xgmi + +From: Tim Huang + +[ Upstream commit 8f184f8e7a07fddc33ee4e6a38b717c770c3aedd ] + +Clear warning that using uninitialized variable current_node. + +Signed-off-by: Tim Huang +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c +index dd2ec48cf5c2..4a14f9c1bfe8 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c +@@ -434,6 +434,9 @@ static ssize_t amdgpu_xgmi_show_connected_port_num(struct device *dev, + } + } + ++ if (i == top->num_nodes) ++ return -EINVAL; ++ + for (i = 0; i < top->num_nodes; i++) { + for (j = 0; j < top->nodes[i].num_links; j++) + /* node id in sysfs starts from 1 rather than 0 so +1 here */ +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-fix-uninitialized-variable-warning-for-jp.patch b/queue-6.10/drm-amdgpu-fix-uninitialized-variable-warning-for-jp.patch new file mode 100644 index 00000000000..d2c30016910 --- /dev/null +++ b/queue-6.10/drm-amdgpu-fix-uninitialized-variable-warning-for-jp.patch @@ -0,0 +1,35 @@ +From c7265581b20fd43ab35b5948cd893fc019c0a045 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 May 2024 13:57:03 +0800 +Subject: drm/amdgpu: fix uninitialized variable warning for jpeg_v4 + +From: Tim Huang + +[ Upstream commit 9e5da942594034ec377ba8c0caa9c15e1d26ba08 ] + +Clear warning that using uninitialized variable r. + +Signed-off-by: Tim Huang +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_5.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_5.c b/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_5.c +index da6bb9022b80..4c8f9772437b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_5.c ++++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_5.c +@@ -187,7 +187,7 @@ static int jpeg_v4_0_5_hw_init(void *handle) + { + struct amdgpu_device *adev = (struct amdgpu_device *)handle; + struct amdgpu_ring *ring; +- int r, i; ++ int i, r = 0; + + // TODO: Enable ring test with DPG support + if (adev->pg_flags & AMD_PG_SUPPORT_JPEG_DPG) { +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-fix-uninitialized-variable-warning-in-amd.patch b/queue-6.10/drm-amdgpu-fix-uninitialized-variable-warning-in-amd.patch new file mode 100644 index 00000000000..be7bc03281c --- /dev/null +++ b/queue-6.10/drm-amdgpu-fix-uninitialized-variable-warning-in-amd.patch @@ -0,0 +1,35 @@ +From a50252f0714e68b57d65005501d54b4ca90c16e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 10:50:54 +0800 +Subject: drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr + +From: Ma Jun + +[ Upstream commit c0d6bd3cd209419cc46ac49562bef1db65d90e70 ] + +Assign value to clock to fix the warning below: +"Using uninitialized value res. Field res.clock is uninitialized" + +Signed-off-by: Ma Jun +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_afmt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_afmt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_afmt.c +index a4d65973bf7c..80771b1480ff 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_afmt.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_afmt.c +@@ -100,6 +100,7 @@ struct amdgpu_afmt_acr amdgpu_afmt_acr(uint32_t clock) + amdgpu_afmt_calc_cts(clock, &res.cts_32khz, &res.n_32khz, 32000); + amdgpu_afmt_calc_cts(clock, &res.cts_44_1khz, &res.n_44_1khz, 44100); + amdgpu_afmt_calc_cts(clock, &res.cts_48khz, &res.n_48khz, 48000); ++ res.clock = clock; + + return res; + } +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-fix-uninitialized-variable-warning-in-amd.patch-11331 b/queue-6.10/drm-amdgpu-fix-uninitialized-variable-warning-in-amd.patch-11331 new file mode 100644 index 00000000000..f2878c8ddb3 --- /dev/null +++ b/queue-6.10/drm-amdgpu-fix-uninitialized-variable-warning-in-amd.patch-11331 @@ -0,0 +1,62 @@ +From bceb8c9656b1a31ecf699099b10e3c0b2908887c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 May 2024 14:01:33 +0800 +Subject: drm/amdgpu: Fix uninitialized variable warning in amdgpu_info_ioctl + +From: Ma Jun + +[ Upstream commit 0991e49d2b73bb4189f83a49eb41cdf16976bbf6 ] + +Check the return value of amdgpu_xcp_get_inst_details, otherwise we +may use an uninitialized variable inst_mask + +Signed-off-by: Ma Jun +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +index a0ea6fe8d060..977cde6d1362 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +@@ -623,25 +623,32 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) + switch (type) { + case AMD_IP_BLOCK_TYPE_GFX: + ret = amdgpu_xcp_get_inst_details(xcp, AMDGPU_XCP_GFX, &inst_mask); ++ if (ret) ++ return ret; + count = hweight32(inst_mask); + break; + case AMD_IP_BLOCK_TYPE_SDMA: + ret = amdgpu_xcp_get_inst_details(xcp, AMDGPU_XCP_SDMA, &inst_mask); ++ if (ret) ++ return ret; + count = hweight32(inst_mask); + break; + case AMD_IP_BLOCK_TYPE_JPEG: + ret = amdgpu_xcp_get_inst_details(xcp, AMDGPU_XCP_VCN, &inst_mask); ++ if (ret) ++ return ret; + count = hweight32(inst_mask) * adev->jpeg.num_jpeg_rings; + break; + case AMD_IP_BLOCK_TYPE_VCN: + ret = amdgpu_xcp_get_inst_details(xcp, AMDGPU_XCP_VCN, &inst_mask); ++ if (ret) ++ return ret; + count = hweight32(inst_mask); + break; + default: + return -EINVAL; + } +- if (ret) +- return ret; ++ + return copy_to_user(out, &count, min(size, 4u)) ? -EFAULT : 0; + } + +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-handle-sg-size-limit-for-contiguous-alloc.patch b/queue-6.10/drm-amdgpu-handle-sg-size-limit-for-contiguous-alloc.patch new file mode 100644 index 00000000000..569b54b0307 --- /dev/null +++ b/queue-6.10/drm-amdgpu-handle-sg-size-limit-for-contiguous-alloc.patch @@ -0,0 +1,83 @@ +From 44ae455c202ee88897fbd58501bc553f1582ebdb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Apr 2024 16:27:00 -0400 +Subject: drm/amdgpu: Handle sg size limit for contiguous allocation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Philip Yang + +[ Upstream commit b2dba064c9bdd18c7dd39066d25453af28451dbf ] + +Define macro AMDGPU_MAX_SG_SEGMENT_SIZE 2GB, because struct scatterlist +length is unsigned int, and some users of it cast to a signed int, so +every segment of sg table is limited to size 2GB maximum. + +For contiguous VRAM allocation, don't limit the max buddy block size in +order to get contiguous VRAM memory. To workaround the sg table segment +size limit, allocate multiple segments if contiguous size is bigger than +AMDGPU_MAX_SG_SEGMENT_SIZE. + +Signed-off-by: Philip Yang +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c +index 6c30eceec896..f91cc149d06c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c +@@ -31,6 +31,8 @@ + #include "amdgpu_atomfirmware.h" + #include "atom.h" + ++#define AMDGPU_MAX_SG_SEGMENT_SIZE (2UL << 30) ++ + struct amdgpu_vram_reservation { + u64 start; + u64 size; +@@ -518,9 +520,7 @@ static int amdgpu_vram_mgr_new(struct ttm_resource_manager *man, + else + min_block_size = mgr->default_page_size; + +- /* Limit maximum size to 2GiB due to SG table limitations */ +- size = min(remaining_size, 2ULL << 30); +- ++ size = remaining_size; + if ((size >= (u64)pages_per_block << PAGE_SHIFT) && + !(size & (((u64)pages_per_block << PAGE_SHIFT) - 1))) + min_block_size = (u64)pages_per_block << PAGE_SHIFT; +@@ -660,7 +660,7 @@ int amdgpu_vram_mgr_alloc_sgt(struct amdgpu_device *adev, + amdgpu_res_first(res, offset, length, &cursor); + while (cursor.remaining) { + num_entries++; +- amdgpu_res_next(&cursor, cursor.size); ++ amdgpu_res_next(&cursor, min(cursor.size, AMDGPU_MAX_SG_SEGMENT_SIZE)); + } + + r = sg_alloc_table(*sgt, num_entries, GFP_KERNEL); +@@ -680,7 +680,7 @@ int amdgpu_vram_mgr_alloc_sgt(struct amdgpu_device *adev, + amdgpu_res_first(res, offset, length, &cursor); + for_each_sgtable_sg((*sgt), sg, i) { + phys_addr_t phys = cursor.start + adev->gmc.aper_base; +- size_t size = cursor.size; ++ unsigned long size = min(cursor.size, AMDGPU_MAX_SG_SEGMENT_SIZE); + dma_addr_t addr; + + addr = dma_map_resource(dev, phys, size, dir, +@@ -693,7 +693,7 @@ int amdgpu_vram_mgr_alloc_sgt(struct amdgpu_device *adev, + sg_dma_address(sg) = addr; + sg_dma_len(sg) = size; + +- amdgpu_res_next(&cursor, cursor.size); ++ amdgpu_res_next(&cursor, size); + } + + return 0; +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-pm-check-input-value-for-custom-profile-m.patch b/queue-6.10/drm-amdgpu-pm-check-input-value-for-custom-profile-m.patch new file mode 100644 index 00000000000..3620144743f --- /dev/null +++ b/queue-6.10/drm-amdgpu-pm-check-input-value-for-custom-profile-m.patch @@ -0,0 +1,65 @@ +From 6c105c855f88ce75f2a82ca8b8e3f656c0098b37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 May 2024 10:05:21 +0800 +Subject: drm/amdgpu/pm: Check input value for CUSTOM profile mode setting on + legacy SOCs + +From: Ma Jun + +[ Upstream commit df0a9bd92fbbd3fcafcb2bce6463c9228a3e6868 ] + +Check the input value for CUSTOM profile mode setting on legacy +SOCs. Otherwise we may use uninitalized value of input[] + +Signed-off-by: Ma Jun +Reviewed-by: Yang Wang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 2 +- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c | 8 ++++++-- + 2 files changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c +index f1c369945ac5..bc27a70a1224 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c +@@ -5641,7 +5641,7 @@ static int smu7_set_power_profile_mode(struct pp_hwmgr *hwmgr, long *input, uint + mode = input[size]; + switch (mode) { + case PP_SMC_POWER_PROFILE_CUSTOM: +- if (size < 8 && size != 0) ++ if (size != 8 && size != 0) + return -EINVAL; + /* If only CUSTOM is passed in, use the saved values. Check + * that we actually have a CUSTOM profile by ensuring that +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c +index bf1b829f9d68..baf251fe5d82 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c +@@ -4102,9 +4102,11 @@ static int vega20_set_power_profile_mode(struct pp_hwmgr *hwmgr, long *input, ui + if (power_profile_mode == PP_SMC_POWER_PROFILE_CUSTOM) { + struct vega20_hwmgr *data = + (struct vega20_hwmgr *)(hwmgr->backend); +- if (size == 0 && !data->is_custom_profile_set) ++ ++ if (size != 10 && size != 0) + return -EINVAL; +- if (size < 10 && size != 0) ++ ++ if (size == 0 && !data->is_custom_profile_set) + return -EINVAL; + + result = vega20_get_activity_monitor_coeff(hwmgr, +@@ -4166,6 +4168,8 @@ static int vega20_set_power_profile_mode(struct pp_hwmgr *hwmgr, long *input, ui + activity_monitor.Fclk_PD_Data_error_coeff = input[8]; + activity_monitor.Fclk_PD_Data_error_rate_coeff = input[9]; + break; ++ default: ++ return -EINVAL; + } + + result = vega20_set_activity_monitor_coeff(hwmgr, +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-pm-check-input-value-for-power-profile-se.patch b/queue-6.10/drm-amdgpu-pm-check-input-value-for-power-profile-se.patch new file mode 100644 index 00000000000..8431ea452ff --- /dev/null +++ b/queue-6.10/drm-amdgpu-pm-check-input-value-for-power-profile-se.patch @@ -0,0 +1,164 @@ +From 6a2942300d44372e4201e59425d380965eb862cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 May 2024 16:39:29 +0800 +Subject: drm/amdgpu/pm: Check input value for power profile setting on smu11, + smu13 and smu14 + +From: Ma Jun + +[ Upstream commit adb9de4dd207fb1264ea70b9eacab9f70ee4707a ] + +Check the input value for CUSTOM profile mode setting on smu 11, +smu13 and smu14. Otherwise we use uninitialized value of input[] + +Signed-off-by: Ma Jun +Reviewed-by: Yang Wang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 5 +++++ + drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 4 ++++ + drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 4 ++++ + drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 5 +++++ + drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 4 ++++ + drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 5 +++++ + 6 files changed, 27 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c +index 6d334a2aff67..623f6052f97e 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c +@@ -1416,6 +1416,9 @@ static int arcturus_set_power_profile_mode(struct smu_context *smu, + + if ((profile_mode == PP_SMC_POWER_PROFILE_CUSTOM) && + (smu->smc_fw_version >= 0x360d00)) { ++ if (size != 10) ++ return -EINVAL; ++ + ret = smu_cmn_update_table(smu, + SMU_TABLE_ACTIVITY_MONITOR_COEFF, + WORKLOAD_PPLIB_CUSTOM_BIT, +@@ -1449,6 +1452,8 @@ static int arcturus_set_power_profile_mode(struct smu_context *smu, + activity_monitor.Mem_PD_Data_error_coeff = input[8]; + activity_monitor.Mem_PD_Data_error_rate_coeff = input[9]; + break; ++ default: ++ return -EINVAL; + } + + ret = smu_cmn_update_table(smu, +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c +index c06e0d6e3017..01039cdd456b 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c +@@ -2021,6 +2021,8 @@ static int navi10_set_power_profile_mode(struct smu_context *smu, long *input, u + } + + if (smu->power_profile_mode == PP_SMC_POWER_PROFILE_CUSTOM) { ++ if (size != 10) ++ return -EINVAL; + + ret = smu_cmn_update_table(smu, + SMU_TABLE_ACTIVITY_MONITOR_COEFF, WORKLOAD_PPLIB_CUSTOM_BIT, +@@ -2064,6 +2066,8 @@ static int navi10_set_power_profile_mode(struct smu_context *smu, long *input, u + activity_monitor.Mem_PD_Data_error_coeff = input[8]; + activity_monitor.Mem_PD_Data_error_rate_coeff = input[9]; + break; ++ default: ++ return -EINVAL; + } + + ret = smu_cmn_update_table(smu, +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c +index e426f457a017..d5a21d7836cc 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c +@@ -1722,6 +1722,8 @@ static int sienna_cichlid_set_power_profile_mode(struct smu_context *smu, long * + } + + if (smu->power_profile_mode == PP_SMC_POWER_PROFILE_CUSTOM) { ++ if (size != 10) ++ return -EINVAL; + + ret = smu_cmn_update_table(smu, + SMU_TABLE_ACTIVITY_MONITOR_COEFF, WORKLOAD_PPLIB_CUSTOM_BIT, +@@ -1765,6 +1767,8 @@ static int sienna_cichlid_set_power_profile_mode(struct smu_context *smu, long * + activity_monitor->Mem_PD_Data_error_coeff = input[8]; + activity_monitor->Mem_PD_Data_error_rate_coeff = input[9]; + break; ++ default: ++ return -EINVAL; + } + + ret = smu_cmn_update_table(smu, +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c +index 1e09d5f2d82f..f7e756ca36dc 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c +@@ -2495,6 +2495,9 @@ static int smu_v13_0_0_set_power_profile_mode(struct smu_context *smu, + } + + if (smu->power_profile_mode == PP_SMC_POWER_PROFILE_CUSTOM) { ++ if (size != 9) ++ return -EINVAL; ++ + ret = smu_cmn_update_table(smu, + SMU_TABLE_ACTIVITY_MONITOR_COEFF, + WORKLOAD_PPLIB_CUSTOM_BIT, +@@ -2526,6 +2529,8 @@ static int smu_v13_0_0_set_power_profile_mode(struct smu_context *smu, + activity_monitor->Fclk_PD_Data_error_coeff = input[7]; + activity_monitor->Fclk_PD_Data_error_rate_coeff = input[8]; + break; ++ default: ++ return -EINVAL; + } + + ret = smu_cmn_update_table(smu, +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c +index e996a0a4d33e..4f98869e0284 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c +@@ -2450,6 +2450,8 @@ static int smu_v13_0_7_set_power_profile_mode(struct smu_context *smu, long *inp + } + + if (smu->power_profile_mode == PP_SMC_POWER_PROFILE_CUSTOM) { ++ if (size != 8) ++ return -EINVAL; + + ret = smu_cmn_update_table(smu, + SMU_TABLE_ACTIVITY_MONITOR_COEFF, WORKLOAD_PPLIB_CUSTOM_BIT, +@@ -2478,6 +2480,8 @@ static int smu_v13_0_7_set_power_profile_mode(struct smu_context *smu, long *inp + activity_monitor->Fclk_MinActiveFreq = input[6]; + activity_monitor->Fclk_BoosterFreq = input[7]; + break; ++ default: ++ return -EINVAL; + } + + ret = smu_cmn_update_table(smu, +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c +index 90703f4542ab..06b65159f7b4 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c +@@ -1364,6 +1364,9 @@ static int smu_v14_0_2_set_power_profile_mode(struct smu_context *smu, + } + + if (smu->power_profile_mode == PP_SMC_POWER_PROFILE_CUSTOM) { ++ if (size != 9) ++ return -EINVAL; ++ + ret = smu_cmn_update_table(smu, + SMU_TABLE_ACTIVITY_MONITOR_COEFF, + WORKLOAD_PPLIB_CUSTOM_BIT, +@@ -1395,6 +1398,8 @@ static int smu_v14_0_2_set_power_profile_mode(struct smu_context *smu, + activity_monitor->Fclk_PD_Data_error_coeff = input[7]; + activity_monitor->Fclk_PD_Data_error_rate_coeff = input[8]; + break; ++ default: ++ return -EINVAL; + } + + ret = smu_cmn_update_table(smu, +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-pm-check-the-return-value-of-smum_send_ms.patch b/queue-6.10/drm-amdgpu-pm-check-the-return-value-of-smum_send_ms.patch new file mode 100644 index 00000000000..6b552722cd2 --- /dev/null +++ b/queue-6.10/drm-amdgpu-pm-check-the-return-value-of-smum_send_ms.patch @@ -0,0 +1,49 @@ +From c1fe1f55a84112f3840904a2272b3b5c6f93c49a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Apr 2024 14:38:04 +0800 +Subject: drm/amdgpu/pm: Check the return value of smum_send_msg_to_smc + +From: Ma Jun + +[ Upstream commit 579f0c21baec9e7506b6bb3f60f0a9b6d07693b4 ] + +Check the return value of smum_send_msg_to_smc, otherwise +we might use an uninitialized variable "now" + +Signed-off-by: Ma Jun +Reviewed-by: Tim Huang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c +index 02ba68d7c654..0b181bc8931c 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c +@@ -1036,7 +1036,9 @@ static int smu10_print_clock_levels(struct pp_hwmgr *hwmgr, + + switch (type) { + case PP_SCLK: +- smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetGfxclkFrequency, &now); ++ ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetGfxclkFrequency, &now); ++ if (ret) ++ return ret; + + /* driver only know min/max gfx_clk, Add level 1 for all other gfx clks */ + if (now == data->gfx_max_freq_limit/100) +@@ -1057,7 +1059,9 @@ static int smu10_print_clock_levels(struct pp_hwmgr *hwmgr, + i == 2 ? "*" : ""); + break; + case PP_MCLK: +- smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetFclkFrequency, &now); ++ ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetFclkFrequency, &now); ++ if (ret) ++ return ret; + + for (i = 0; i < mclk_table->count; i++) + size += sprintf(buf + size, "%d: %uMhz %s\n", +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-pm-fix-uninitialized-variable-agc_btc_res.patch b/queue-6.10/drm-amdgpu-pm-fix-uninitialized-variable-agc_btc_res.patch new file mode 100644 index 00000000000..1c55fdabdda --- /dev/null +++ b/queue-6.10/drm-amdgpu-pm-fix-uninitialized-variable-agc_btc_res.patch @@ -0,0 +1,50 @@ +From 20a5ca6c880942348987ddf044e372af2b9a0a5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Apr 2024 14:41:38 +0800 +Subject: drm/amdgpu/pm: Fix uninitialized variable agc_btc_response + +From: Ma Jun + +[ Upstream commit df4409d8a04dd39d7f2aa0c5f528a56b99eaaa13 ] + +Assign an default value to agc_btc_response in failed case + +Signed-off-by: Ma Jun +Acked-by: Alex Deucher +Reviewed-by: Yang Wang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c +index 246b6568eb0d..ff605063d7ef 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c +@@ -2361,15 +2361,20 @@ static int vega10_acg_enable(struct pp_hwmgr *hwmgr) + { + struct vega10_hwmgr *data = hwmgr->backend; + uint32_t agc_btc_response; ++ int ret; + + if (data->smu_features[GNLD_ACG].supported) { + if (0 == vega10_enable_smc_features(hwmgr, true, + data->smu_features[GNLD_DPM_PREFETCHER].smu_feature_bitmap)) + data->smu_features[GNLD_DPM_PREFETCHER].enabled = true; + +- smum_send_msg_to_smc(hwmgr, PPSMC_MSG_InitializeAcg, NULL); ++ ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_InitializeAcg, NULL); ++ if (ret) ++ return ret; + +- smum_send_msg_to_smc(hwmgr, PPSMC_MSG_RunAcgBtc, &agc_btc_response); ++ ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_RunAcgBtc, &agc_btc_response); ++ if (ret) ++ agc_btc_response = 0; + + if (1 == agc_btc_response) { + if (1 == data->acg_loop_state) +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-pm-fix-uninitialized-variable-warning-for.patch b/queue-6.10/drm-amdgpu-pm-fix-uninitialized-variable-warning-for.patch new file mode 100644 index 00000000000..bb65d3df17c --- /dev/null +++ b/queue-6.10/drm-amdgpu-pm-fix-uninitialized-variable-warning-for.patch @@ -0,0 +1,185 @@ +From acf487a1560c6b409cf106d349ce44dfd10ee0dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Apr 2024 17:46:08 +0800 +Subject: drm/amdgpu/pm: Fix uninitialized variable warning for smu10 + +From: Ma Jun + +[ Upstream commit 336c8f558d596699d3d9814a45600139b2f23f27 ] + +Check return value of smum_send_msg_to_smc to fix +uninitialized variable varning + +Signed-off-by: Ma Jun +Acked-by: Alex Deucher +Reviewed-by: Yang Wang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c | 21 +++++++++++++---- + .../drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c | 20 ++++++++++++---- + .../drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c | 23 ++++++++++++++----- + 3 files changed, 48 insertions(+), 16 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c +index 0b181bc8931c..f62381b189ad 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c +@@ -1554,7 +1554,10 @@ static int smu10_set_fine_grain_clk_vol(struct pp_hwmgr *hwmgr, + } + + if (input[0] == 0) { +- smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMinGfxclkFrequency, &min_freq); ++ ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMinGfxclkFrequency, &min_freq); ++ if (ret) ++ return ret; ++ + if (input[1] < min_freq) { + pr_err("Fine grain setting minimum sclk (%ld) MHz is less than the minimum allowed (%d) MHz\n", + input[1], min_freq); +@@ -1562,7 +1565,10 @@ static int smu10_set_fine_grain_clk_vol(struct pp_hwmgr *hwmgr, + } + smu10_data->gfx_actual_soft_min_freq = input[1]; + } else if (input[0] == 1) { +- smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMaxGfxclkFrequency, &max_freq); ++ ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMaxGfxclkFrequency, &max_freq); ++ if (ret) ++ return ret; ++ + if (input[1] > max_freq) { + pr_err("Fine grain setting maximum sclk (%ld) MHz is greater than the maximum allowed (%d) MHz\n", + input[1], max_freq); +@@ -1577,10 +1583,15 @@ static int smu10_set_fine_grain_clk_vol(struct pp_hwmgr *hwmgr, + pr_err("Input parameter number not correct\n"); + return -EINVAL; + } +- smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMinGfxclkFrequency, &min_freq); +- smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMaxGfxclkFrequency, &max_freq); +- ++ ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMinGfxclkFrequency, &min_freq); ++ if (ret) ++ return ret; + smu10_data->gfx_actual_soft_min_freq = min_freq; ++ ++ ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMaxGfxclkFrequency, &max_freq); ++ if (ret) ++ return ret; ++ + smu10_data->gfx_actual_soft_max_freq = max_freq; + } else if (type == PP_OD_COMMIT_DPM_TABLE) { + if (size != 0) { +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c +index c223e3a6bfca..10fd4e9f016c 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c +@@ -293,12 +293,12 @@ static int vega12_set_features_platform_caps(struct pp_hwmgr *hwmgr) + return 0; + } + +-static void vega12_init_dpm_defaults(struct pp_hwmgr *hwmgr) ++static int vega12_init_dpm_defaults(struct pp_hwmgr *hwmgr) + { + struct vega12_hwmgr *data = (struct vega12_hwmgr *)(hwmgr->backend); + struct amdgpu_device *adev = hwmgr->adev; + uint32_t top32, bottom32; +- int i; ++ int i, ret; + + data->smu_features[GNLD_DPM_PREFETCHER].smu_feature_id = + FEATURE_DPM_PREFETCHER_BIT; +@@ -364,10 +364,16 @@ static void vega12_init_dpm_defaults(struct pp_hwmgr *hwmgr) + } + + /* Get the SN to turn into a Unique ID */ +- smum_send_msg_to_smc(hwmgr, PPSMC_MSG_ReadSerialNumTop32, &top32); +- smum_send_msg_to_smc(hwmgr, PPSMC_MSG_ReadSerialNumBottom32, &bottom32); ++ ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_ReadSerialNumTop32, &top32); ++ if (ret) ++ return ret; ++ ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_ReadSerialNumBottom32, &bottom32); ++ if (ret) ++ return ret; + + adev->unique_id = ((uint64_t)bottom32 << 32) | top32; ++ ++ return 0; + } + + static int vega12_set_private_data_based_on_pptable(struct pp_hwmgr *hwmgr) +@@ -410,7 +416,11 @@ static int vega12_hwmgr_backend_init(struct pp_hwmgr *hwmgr) + + vega12_set_features_platform_caps(hwmgr); + +- vega12_init_dpm_defaults(hwmgr); ++ result = vega12_init_dpm_defaults(hwmgr); ++ if (result) { ++ pr_err("%s failed\n", __func__); ++ return result; ++ } + + /* Parse pptable data read from VBIOS */ + vega12_set_private_data_based_on_pptable(hwmgr); +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c +index f9efb0bad807..bf1b829f9d68 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c +@@ -328,12 +328,12 @@ static int vega20_set_features_platform_caps(struct pp_hwmgr *hwmgr) + return 0; + } + +-static void vega20_init_dpm_defaults(struct pp_hwmgr *hwmgr) ++static int vega20_init_dpm_defaults(struct pp_hwmgr *hwmgr) + { + struct vega20_hwmgr *data = (struct vega20_hwmgr *)(hwmgr->backend); + struct amdgpu_device *adev = hwmgr->adev; + uint32_t top32, bottom32; +- int i; ++ int i, ret; + + data->smu_features[GNLD_DPM_PREFETCHER].smu_feature_id = + FEATURE_DPM_PREFETCHER_BIT; +@@ -404,10 +404,17 @@ static void vega20_init_dpm_defaults(struct pp_hwmgr *hwmgr) + } + + /* Get the SN to turn into a Unique ID */ +- smum_send_msg_to_smc(hwmgr, PPSMC_MSG_ReadSerialNumTop32, &top32); +- smum_send_msg_to_smc(hwmgr, PPSMC_MSG_ReadSerialNumBottom32, &bottom32); ++ ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_ReadSerialNumTop32, &top32); ++ if (ret) ++ return ret; ++ ++ ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_ReadSerialNumBottom32, &bottom32); ++ if (ret) ++ return ret; + + adev->unique_id = ((uint64_t)bottom32 << 32) | top32; ++ ++ return 0; + } + + static int vega20_set_private_data_based_on_pptable(struct pp_hwmgr *hwmgr) +@@ -427,6 +434,7 @@ static int vega20_hwmgr_backend_init(struct pp_hwmgr *hwmgr) + { + struct vega20_hwmgr *data; + struct amdgpu_device *adev = hwmgr->adev; ++ int result; + + data = kzalloc(sizeof(struct vega20_hwmgr), GFP_KERNEL); + if (data == NULL) +@@ -452,8 +460,11 @@ static int vega20_hwmgr_backend_init(struct pp_hwmgr *hwmgr) + + vega20_set_features_platform_caps(hwmgr); + +- vega20_init_dpm_defaults(hwmgr); +- ++ result = vega20_init_dpm_defaults(hwmgr); ++ if (result) { ++ pr_err("%s failed\n", __func__); ++ return result; ++ } + /* Parse pptable data read from VBIOS */ + vega20_set_private_data_based_on_pptable(hwmgr); + +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-queue-kfd-reset-workitem-in-vf-fed.patch b/queue-6.10/drm-amdgpu-queue-kfd-reset-workitem-in-vf-fed.patch new file mode 100644 index 00000000000..ba3b8566b3a --- /dev/null +++ b/queue-6.10/drm-amdgpu-queue-kfd-reset-workitem-in-vf-fed.patch @@ -0,0 +1,41 @@ +From 11e53f5e26c8b031e1e31a9d841ce5c7fb149159 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 May 2024 10:39:43 -0400 +Subject: drm/amdgpu: Queue KFD reset workitem in VF FED + +From: Victor Skvortsov + +[ Upstream commit 5434bc03f52de2ec57d6ce684b1853928f508cbc ] + +The guest recovery sequence is buggy in Fatal Error when both +FLR & KFD reset workitems are queued at the same time. In addition, +FLR guest recovery sequence is out of order when PF/VF communication +breaks due to a GPU fatal error + +As a temporary work around, perform a KFD style reset (Initiate reset +request from the guest) inside the pf2vf thread on FED. + +Signed-off-by: Victor Skvortsov +Reviewed-by: Zhigang Luo +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +index 761fff80ec1f..923d51f16ec8 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +@@ -602,7 +602,7 @@ static void amdgpu_virt_update_vf2pf_work_item(struct work_struct *work) + amdgpu_sriov_runtime(adev) && !amdgpu_in_reset(adev)) { + amdgpu_ras_set_fed(adev, true); + if (amdgpu_reset_domain_schedule(adev->reset_domain, +- &adev->virt.flr_work)) ++ &adev->kfd.reset_work)) + return; + else + dev_err(adev->dev, "Failed to queue work! at %s", __func__); +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-set-ras-fed-status-for-more-cases.patch b/queue-6.10/drm-amdgpu-set-ras-fed-status-for-more-cases.patch new file mode 100644 index 00000000000..7a80873a9a1 --- /dev/null +++ b/queue-6.10/drm-amdgpu-set-ras-fed-status-for-more-cases.patch @@ -0,0 +1,47 @@ +From d130731051d6847e0388296c6a4525a92cb377cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 11:20:57 +0800 +Subject: drm/amdgpu: set RAS fed status for more cases + +From: Tao Zhou + +[ Upstream commit 09a3d8202df1e9fa1eb5f5f63524c8948275ff4c ] + +Indicate fatal error for each RAS block and NBIO. + +Signed-off-by: Tao Zhou +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 1 + + drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +index 57fdc4ab9c54..7ba90c5974ed 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +@@ -2112,6 +2112,7 @@ static void amdgpu_ras_interrupt_umc_handler(struct ras_manager *obj, + /* Let IP handle its data, maybe we need get the output + * from the callback to update the error type/count, etc + */ ++ amdgpu_ras_set_fed(obj->adev, true); + ret = data->cb(obj->adev, &err_data, entry); + /* ue will trigger an interrupt, and in that case + * we need do a reset to recovery the whole system. +diff --git a/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c b/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c +index 750ce281b97b..e326d6f06ca9 100644 +--- a/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c ++++ b/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c +@@ -418,6 +418,7 @@ static void nbio_v7_4_handle_ras_controller_intr_no_bifring(struct amdgpu_device + /* ras_controller_int is dedicated for nbif ras error, + * not the global interrupt for sync flood + */ ++ amdgpu_ras_set_fed(adev, true); + amdgpu_ras_reset_gpu(adev); + } + +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-the-warning-dereferencing-obj-for-nbio_v7.patch b/queue-6.10/drm-amdgpu-the-warning-dereferencing-obj-for-nbio_v7.patch new file mode 100644 index 00000000000..60d3c0914d4 --- /dev/null +++ b/queue-6.10/drm-amdgpu-the-warning-dereferencing-obj-for-nbio_v7.patch @@ -0,0 +1,36 @@ +From e74fe4093111b61ccbbc3c1aa751c74c1cdd4864 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 May 2024 15:22:42 +0800 +Subject: drm/amdgpu: the warning dereferencing obj for nbio_v7_4 + +From: Jesse Zhang + +[ Upstream commit d190b459b2a4304307c3468ed97477b808381011 ] + +if ras_manager obj null, don't print NBIO err data + +Signed-off-by: Jesse Zhang +Suggested-by: Tim Huang +Reviewed-by: Tim Huang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c b/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c +index 19986ff6a48d..750ce281b97b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c ++++ b/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c +@@ -387,7 +387,7 @@ static void nbio_v7_4_handle_ras_controller_intr_no_bifring(struct amdgpu_device + else + WREG32_SOC15(NBIO, 0, mmBIF_DOORBELL_INT_CNTL, bif_doorbell_intr_cntl); + +- if (!ras->disable_ras_err_cnt_harvest) { ++ if (ras && !ras->disable_ras_err_cnt_harvest && obj) { + /* + * clear error status after ras_controller_intr + * according to hw team and count ue number +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-update-type-of-buf-size-to-u32-for-eeprom.patch b/queue-6.10/drm-amdgpu-update-type-of-buf-size-to-u32-for-eeprom.patch new file mode 100644 index 00000000000..4fb3feafbdd --- /dev/null +++ b/queue-6.10/drm-amdgpu-update-type-of-buf-size-to-u32-for-eeprom.patch @@ -0,0 +1,71 @@ +From 127481cccf7592630398ad4761989b8cf20b57a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 May 2024 18:04:26 +0800 +Subject: drm/amdgpu: update type of buf size to u32 for eeprom functions + +From: Tao Zhou + +[ Upstream commit 2aadb520bfacec12527effce3566f8df55e5d08e ] + +Avoid overflow issue. + +Signed-off-by: Tao Zhou +Reviewed-by: Yang Wang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.c | 6 +++--- + drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.h | 4 ++-- + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.c +index e71768661ca8..09a34c7258e2 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.c +@@ -179,7 +179,7 @@ static int __amdgpu_eeprom_xfer(struct i2c_adapter *i2c_adap, u32 eeprom_addr, + * Returns the number of bytes read/written; -errno on error. + */ + static int amdgpu_eeprom_xfer(struct i2c_adapter *i2c_adap, u32 eeprom_addr, +- u8 *eeprom_buf, u16 buf_size, bool read) ++ u8 *eeprom_buf, u32 buf_size, bool read) + { + const struct i2c_adapter_quirks *quirks = i2c_adap->quirks; + u16 limit; +@@ -225,7 +225,7 @@ static int amdgpu_eeprom_xfer(struct i2c_adapter *i2c_adap, u32 eeprom_addr, + + int amdgpu_eeprom_read(struct i2c_adapter *i2c_adap, + u32 eeprom_addr, u8 *eeprom_buf, +- u16 bytes) ++ u32 bytes) + { + return amdgpu_eeprom_xfer(i2c_adap, eeprom_addr, eeprom_buf, bytes, + true); +@@ -233,7 +233,7 @@ int amdgpu_eeprom_read(struct i2c_adapter *i2c_adap, + + int amdgpu_eeprom_write(struct i2c_adapter *i2c_adap, + u32 eeprom_addr, u8 *eeprom_buf, +- u16 bytes) ++ u32 bytes) + { + return amdgpu_eeprom_xfer(i2c_adap, eeprom_addr, eeprom_buf, bytes, + false); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.h +index 6935adb2be1f..8083b8253ef4 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.h +@@ -28,10 +28,10 @@ + + int amdgpu_eeprom_read(struct i2c_adapter *i2c_adap, + u32 eeprom_addr, u8 *eeprom_buf, +- u16 bytes); ++ u32 bytes); + + int amdgpu_eeprom_write(struct i2c_adapter *i2c_adap, + u32 eeprom_addr, u8 *eeprom_buf, +- u16 bytes); ++ u32 bytes); + + #endif +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-vcn-remove-irq-disabling-in-vcn-5-suspend.patch b/queue-6.10/drm-amdgpu-vcn-remove-irq-disabling-in-vcn-5-suspend.patch new file mode 100644 index 00000000000..37d1eb7c062 --- /dev/null +++ b/queue-6.10/drm-amdgpu-vcn-remove-irq-disabling-in-vcn-5-suspend.patch @@ -0,0 +1,71 @@ +From ccbef38c04161f1199ddc642f05976a4eb71324a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 13:40:10 -0400 +Subject: drm/amdgpu/vcn: remove irq disabling in vcn 5 suspend + +From: David (Ming Qiang) Wu + +[ Upstream commit 10fe1a79cd1bff3048e13120e93c02f8ecd05e9d ] + +We do not directly enable/disable VCN IRQ in vcn 5.0.0. +And we do not handle the IRQ state as well. So the calls to +disable IRQ and set state are removed. This effectively gets +rid of the warining of + "WARN_ON(!amdgpu_irq_enabled(adev, src, type))" +in amdgpu_irq_put(). + +Signed-off-by: David (Ming Qiang) Wu +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c | 19 ------------------- + 1 file changed, 19 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c +index fbd3f7a582c1..55465b8a3df6 100644 +--- a/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c +@@ -229,8 +229,6 @@ static int vcn_v5_0_0_hw_fini(void *handle) + for (i = 0; i < adev->vcn.num_vcn_inst; ++i) { + if (adev->vcn.harvest_config & (1 << i)) + continue; +- +- amdgpu_irq_put(adev, &adev->vcn.inst[i].irq, 0); + } + + return 0; +@@ -1232,22 +1230,6 @@ static int vcn_v5_0_0_set_powergating_state(void *handle, enum amd_powergating_s + return ret; + } + +-/** +- * vcn_v5_0_0_set_interrupt_state - set VCN block interrupt state +- * +- * @adev: amdgpu_device pointer +- * @source: interrupt sources +- * @type: interrupt types +- * @state: interrupt states +- * +- * Set VCN block interrupt state +- */ +-static int vcn_v5_0_0_set_interrupt_state(struct amdgpu_device *adev, struct amdgpu_irq_src *source, +- unsigned type, enum amdgpu_interrupt_state state) +-{ +- return 0; +-} +- + /** + * vcn_v5_0_0_process_interrupt - process VCN block interrupt + * +@@ -1293,7 +1275,6 @@ static int vcn_v5_0_0_process_interrupt(struct amdgpu_device *adev, struct amdgp + } + + static const struct amdgpu_irq_src_funcs vcn_v5_0_0_irq_funcs = { +- .set = vcn_v5_0_0_set_interrupt_state, + .process = vcn_v5_0_0_process_interrupt, + }; + +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgu-fix-unintentional-integer-overflow-for-mal.patch b/queue-6.10/drm-amdgu-fix-unintentional-integer-overflow-for-mal.patch new file mode 100644 index 00000000000..ec54454a24c --- /dev/null +++ b/queue-6.10/drm-amdgu-fix-unintentional-integer-overflow-for-mal.patch @@ -0,0 +1,39 @@ +From 30531b1837a0b00d9f1ea00be3a91bb1e9230b84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 May 2024 17:29:01 +0800 +Subject: drm/amdgu: fix Unintentional integer overflow for mall size +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jesse Zhang + +[ Upstream commit c09d2eff81a997c169e0cacacd6b60c5e3aa33f2 ] + +Potentially overflowing expression mall_size_per_umc * adev->gmc.num_umc with type unsigned int (32 bits, unsigned) +is evaluated using 32-bit arithmetic,and then used in a context that expects an expression of type u64 (64 bits, unsigned). + +Signed-off-by: Jesse Zhang +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +index f1b08893765c..1ea55ee4796e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +@@ -1597,7 +1597,7 @@ static int amdgpu_discovery_get_mall_info(struct amdgpu_device *adev) + break; + case 2: + mall_size_per_umc = le32_to_cpu(mall_info->v2.mall_size_per_umc); +- adev->gmc.mall_size = mall_size_per_umc * adev->gmc.num_umc; ++ adev->gmc.mall_size = (uint64_t)mall_size_per_umc * adev->gmc.num_umc; + break; + default: + dev_err(adev->dev, +-- +2.43.0 + diff --git a/queue-6.10/drm-amdkfd-check-debug-trap-enable-before-write-dbg_.patch b/queue-6.10/drm-amdkfd-check-debug-trap-enable-before-write-dbg_.patch new file mode 100644 index 00000000000..0403d76e420 --- /dev/null +++ b/queue-6.10/drm-amdkfd-check-debug-trap-enable-before-write-dbg_.patch @@ -0,0 +1,47 @@ +From f300b8fb512daa93d389cf74d2631093791f20b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 11:27:16 +0800 +Subject: drm/amdkfd: Check debug trap enable before write dbg_ev_file + +From: Lin.Cao + +[ Upstream commit 547033b593063eb85bfdf9b25a5f1b8fd1911be2 ] + +In interrupt context, write dbg_ev_file will be run by work queue. It +will cause write dbg_ev_file execution after debug_trap_disable, which +will cause NULL pointer access. +v2: cancel work "debug_event_workarea" before set dbg_ev_file as NULL. + +Signed-off-by: Lin.Cao +Reviewed-by: Jonathan Kim +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_debug.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_debug.c b/drivers/gpu/drm/amd/amdkfd/kfd_debug.c +index d889e3545120..6c2f6a26c479 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_debug.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_debug.c +@@ -103,7 +103,8 @@ void debug_event_write_work_handler(struct work_struct *work) + struct kfd_process, + debug_event_workarea); + +- kernel_write(process->dbg_ev_file, &write_data, 1, &pos); ++ if (process->debug_trap_enabled && process->dbg_ev_file) ++ kernel_write(process->dbg_ev_file, &write_data, 1, &pos); + } + + /* update process/device/queue exception status, write to descriptor +@@ -645,6 +646,7 @@ int kfd_dbg_trap_disable(struct kfd_process *target) + else if (target->runtime_info.runtime_state != DEBUG_RUNTIME_STATE_DISABLED) + target->runtime_info.runtime_state = DEBUG_RUNTIME_STATE_ENABLED; + ++ cancel_work_sync(&target->debug_event_workarea); + fput(target->dbg_ev_file); + target->dbg_ev_file = NULL; + +-- +2.43.0 + diff --git a/queue-6.10/drm-amdkfd-reconcile-the-definition-and-use-of-oem_i.patch b/queue-6.10/drm-amdkfd-reconcile-the-definition-and-use-of-oem_i.patch new file mode 100644 index 00000000000..6cec235f3c8 --- /dev/null +++ b/queue-6.10/drm-amdkfd-reconcile-the-definition-and-use-of-oem_i.patch @@ -0,0 +1,71 @@ +From e10369e903fe2f38d3daa895926e1a1b9d33a97a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 May 2024 15:31:08 -0400 +Subject: drm/amdkfd: Reconcile the definition and use of oem_id in struct + kfd_topology_device + +From: Michael Chen + +[ Upstream commit 10f624ef239bd136cdcc5bbc626157a57b938a31 ] + +Currently oem_id is defined as uint8_t[6] and casted to uint64_t* +in some use case. This would lead code scanner to complain about +access beyond. Re-define it in union to enforce 8-byte size and +alignment to avoid potential issue. + +Signed-off-by: Michael Chen +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_crat.h | 2 -- + drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 3 +-- + drivers/gpu/drm/amd/amdkfd/kfd_topology.h | 5 ++++- + 3 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_crat.h b/drivers/gpu/drm/amd/amdkfd/kfd_crat.h +index 300634b9f668..a8ca7ecb6d27 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.h ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.h +@@ -42,8 +42,6 @@ + #define CRAT_OEMTABLEID_LENGTH 8 + #define CRAT_RESERVED_LENGTH 6 + +-#define CRAT_OEMID_64BIT_MASK ((1ULL << (CRAT_OEMID_LENGTH * 8)) - 1) +- + /* Compute Unit flags */ + #define COMPUTE_UNIT_CPU (1 << 0) /* Create Virtual CRAT for CPU */ + #define COMPUTE_UNIT_GPU (1 << 1) /* Create Virtual CRAT for GPU */ +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c +index bc9eb847ecfe..1d271ecc386f 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c +@@ -958,8 +958,7 @@ static void kfd_update_system_properties(void) + dev = list_last_entry(&topology_device_list, + struct kfd_topology_device, list); + if (dev) { +- sys_props.platform_id = +- (*((uint64_t *)dev->oem_id)) & CRAT_OEMID_64BIT_MASK; ++ sys_props.platform_id = dev->oem_id64; + sys_props.platform_oem = *((uint64_t *)dev->oem_table_id); + sys_props.platform_rev = dev->oem_revision; + } +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.h b/drivers/gpu/drm/amd/amdkfd/kfd_topology.h +index 27386ce9a021..2d1c9d771bef 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.h ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.h +@@ -154,7 +154,10 @@ struct kfd_topology_device { + struct attribute attr_gpuid; + struct attribute attr_name; + struct attribute attr_props; +- uint8_t oem_id[CRAT_OEMID_LENGTH]; ++ union { ++ uint8_t oem_id[CRAT_OEMID_LENGTH]; ++ uint64_t oem_id64; ++ }; + uint8_t oem_table_id[CRAT_OEMTABLEID_LENGTH]; + uint32_t oem_revision; + }; +-- +2.43.0 + diff --git a/queue-6.10/drm-amdkfd-use-mode1-reset-for-ras-poison-consumptio.patch b/queue-6.10/drm-amdkfd-use-mode1-reset-for-ras-poison-consumptio.patch new file mode 100644 index 00000000000..8671320e44a --- /dev/null +++ b/queue-6.10/drm-amdkfd-use-mode1-reset-for-ras-poison-consumptio.patch @@ -0,0 +1,44 @@ +From 781db70cf242ae566593d5a351707500c2f8c042 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jun 2024 14:54:11 +0800 +Subject: drm/amdkfd: use mode1 reset for RAS poison consumption + +From: Tao Zhou + +[ Upstream commit 4280f60e8e7caa5160135223e486545893bc9013 ] + +Per firmware's requirement, replace mode2 with mode1. + +Signed-off-by: Tao Zhou +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_int_process_v9.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_int_process_v9.c b/drivers/gpu/drm/amd/amdkfd/kfd_int_process_v9.c +index e1c21d250611..78dde62fb04a 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_int_process_v9.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_int_process_v9.c +@@ -164,7 +164,7 @@ static void event_interrupt_poison_consumption_v9(struct kfd_node *dev, + case SOC15_IH_CLIENTID_SE3SH: + case SOC15_IH_CLIENTID_UTCL2: + block = AMDGPU_RAS_BLOCK__GFX; +- reset = AMDGPU_RAS_GPU_RESET_MODE2_RESET; ++ reset = AMDGPU_RAS_GPU_RESET_MODE1_RESET; + break; + case SOC15_IH_CLIENTID_VMC: + case SOC15_IH_CLIENTID_VMC1: +@@ -177,7 +177,7 @@ static void event_interrupt_poison_consumption_v9(struct kfd_node *dev, + case SOC15_IH_CLIENTID_SDMA3: + case SOC15_IH_CLIENTID_SDMA4: + block = AMDGPU_RAS_BLOCK__SDMA; +- reset = AMDGPU_RAS_GPU_RESET_MODE2_RESET; ++ reset = AMDGPU_RAS_GPU_RESET_MODE1_RESET; + break; + default: + dev_warn(dev->adev->dev, +-- +2.43.0 + diff --git a/queue-6.10/drm-bridge-tc358767-check-if-fully-initialized-befor.patch b/queue-6.10/drm-bridge-tc358767-check-if-fully-initialized-befor.patch new file mode 100644 index 00000000000..f7ac5131470 --- /dev/null +++ b/queue-6.10/drm-bridge-tc358767-check-if-fully-initialized-befor.patch @@ -0,0 +1,39 @@ +From 8beb3de012708bfccfd773fe13bfe54f6f03dc60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 May 2024 22:33:12 +0200 +Subject: drm/bridge: tc358767: Check if fully initialized before signalling + HPD event via IRQ + +From: Marek Vasut + +[ Upstream commit 162e48cb1d84c2c966b649b8ac5c9d4f75f6d44f ] + +Make sure the connector is fully initialized before signalling any +HPD events via drm_kms_helper_hotplug_event(), otherwise this may +lead to NULL pointer dereference. + +Signed-off-by: Marek Vasut +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20240531203333.277476-1-marex@denx.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358767.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c +index 166f9a3e9622..332f0aa50fee 100644 +--- a/drivers/gpu/drm/bridge/tc358767.c ++++ b/drivers/gpu/drm/bridge/tc358767.c +@@ -2135,7 +2135,7 @@ static irqreturn_t tc_irq_handler(int irq, void *arg) + dev_err(tc->dev, "syserr %x\n", stat); + } + +- if (tc->hpd_pin >= 0 && tc->bridge.dev) { ++ if (tc->hpd_pin >= 0 && tc->bridge.dev && tc->aux.drm_dev) { + /* + * H is triggered when the GPIO goes high. + * +-- +2.43.0 + diff --git a/queue-6.10/drm-drm-bridge-drop-conditionals-around-of_node-poin.patch b/queue-6.10/drm-drm-bridge-drop-conditionals-around-of_node-poin.patch new file mode 100644 index 00000000000..ddb47f03265 --- /dev/null +++ b/queue-6.10/drm-drm-bridge-drop-conditionals-around-of_node-poin.patch @@ -0,0 +1,47 @@ +From d76aa5563963da412162cffbe21a90b6cb5cf22f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 May 2024 02:00:00 +0800 +Subject: drm/drm-bridge: Drop conditionals around of_node pointers + +From: Sui Jingfeng + +[ Upstream commit ad3323a6ccb7d43bbeeaa46d5311c43d5d361fc7 ] + +Having conditional around the of_node pointer of the drm_bridge structure +is not necessary, since drm_bridge structure always has the of_node as its +member. + +Let's drop the conditional to get a better looks, please also note that +this is following the already accepted commitments. see commit d8dfccde2709 +("drm/bridge: Drop conditionals around of_node pointers") for reference. + +Signed-off-by: Sui Jingfeng +Reviewed-by: Laurent Pinchart +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20240507180001.1358816-1-sui.jingfeng@linux.dev +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_bridge.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c +index 28abe9aa99ca..584d109330ab 100644 +--- a/drivers/gpu/drm/drm_bridge.c ++++ b/drivers/gpu/drm/drm_bridge.c +@@ -353,13 +353,8 @@ int drm_bridge_attach(struct drm_encoder *encoder, struct drm_bridge *bridge, + bridge->encoder = NULL; + list_del(&bridge->chain_node); + +-#ifdef CONFIG_OF + DRM_ERROR("failed to attach bridge %pOF to encoder %s: %d\n", + bridge->of_node, encoder->name, ret); +-#else +- DRM_ERROR("failed to attach bridge to encoder %s: %d\n", +- encoder->name, ret); +-#endif + + return ret; + } +-- +2.43.0 + diff --git a/queue-6.10/drm-kfd-correct-pinned-buffer-handling-at-kfd-restor.patch b/queue-6.10/drm-kfd-correct-pinned-buffer-handling-at-kfd-restor.patch new file mode 100644 index 00000000000..0914107a5d8 --- /dev/null +++ b/queue-6.10/drm-kfd-correct-pinned-buffer-handling-at-kfd-restor.patch @@ -0,0 +1,59 @@ +From 3cb8ac65c27b3b5172a6a0ccaad32461248110ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 May 2024 23:54:25 -0500 +Subject: drm/kfd: Correct pinned buffer handling at kfd restore and validate + process + +From: Xiaogang Chen + +[ Upstream commit f326d7cc745683f53052b84382bd10567b45cd5d ] + +This reverts commit 8a774fe912ff ("drm/amdgpu: avoid restore process run into dead loop") +since buffer got pinned is not related whether it needs mapping +And skip buffer validation at kfd driver if the buffer has been pinned. + +Signed-off-by: Xiaogang Chen +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +index 48ad0c04aa72..e675e4815650 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +@@ -415,6 +415,10 @@ static int amdgpu_amdkfd_bo_validate(struct amdgpu_bo *bo, uint32_t domain, + "Called with userptr BO")) + return -EINVAL; + ++ /* bo has been pinned, not need validate it */ ++ if (bo->tbo.pin_count) ++ return 0; ++ + amdgpu_bo_placement_from_domain(bo, domain); + + ret = ttm_bo_validate(&bo->tbo, &bo->placement, &ctx); +@@ -2712,7 +2716,7 @@ static int confirm_valid_user_pages_locked(struct amdkfd_process_info *process_i + + /* keep mem without hmm range at userptr_inval_list */ + if (!mem->range) +- continue; ++ continue; + + /* Only check mem with hmm range associated */ + valid = amdgpu_ttm_tt_get_user_pages_done( +@@ -2957,9 +2961,6 @@ int amdgpu_amdkfd_gpuvm_restore_process_bos(void *info, struct dma_fence __rcu * + if (!attachment->is_mapped) + continue; + +- if (attachment->bo_va->base.bo->tbo.pin_count) +- continue; +- + kfd_mem_dmaunmap_attachment(mem, attachment); + ret = update_gpuvm_pte(mem, attachment, &sync_obj); + if (ret) { +-- +2.43.0 + diff --git a/queue-6.10/drm-meson-plane-add-error-handling.patch b/queue-6.10/drm-meson-plane-add-error-handling.patch new file mode 100644 index 00000000000..9109f7cf0a2 --- /dev/null +++ b/queue-6.10/drm-meson-plane-add-error-handling.patch @@ -0,0 +1,63 @@ +From 634539e6cf9a4dc802433a63e8e8c9e7932ae659 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 03:34:05 -0800 +Subject: drm/meson: plane: Add error handling + +From: Haoran Liu + +[ Upstream commit 3c28b239620e249b68beeca17f429e317fa6b8d4 ] + +This patch adds robust error handling to the meson_plane_create +function in drivers/gpu/drm/meson/meson_plane.c. The function +previously lacked proper handling for potential failure scenarios +of the drm_universal_plane_init call. + +Signed-off-by: Haoran Liu +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20231129113405.33057-1-liuhaoran14@163.com +[narmstrong: fixe the commit subject] +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20231129113405.33057-1-liuhaoran14@163.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/meson/meson_plane.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/meson/meson_plane.c b/drivers/gpu/drm/meson/meson_plane.c +index 815dfe30492b..b43ac61201f3 100644 +--- a/drivers/gpu/drm/meson/meson_plane.c ++++ b/drivers/gpu/drm/meson/meson_plane.c +@@ -534,6 +534,7 @@ int meson_plane_create(struct meson_drm *priv) + struct meson_plane *meson_plane; + struct drm_plane *plane; + const uint64_t *format_modifiers = format_modifiers_default; ++ int ret; + + meson_plane = devm_kzalloc(priv->drm->dev, sizeof(*meson_plane), + GFP_KERNEL); +@@ -548,12 +549,16 @@ int meson_plane_create(struct meson_drm *priv) + else if (meson_vpu_is_compatible(priv, VPU_COMPATIBLE_G12A)) + format_modifiers = format_modifiers_afbc_g12a; + +- drm_universal_plane_init(priv->drm, plane, 0xFF, +- &meson_plane_funcs, +- supported_drm_formats, +- ARRAY_SIZE(supported_drm_formats), +- format_modifiers, +- DRM_PLANE_TYPE_PRIMARY, "meson_primary_plane"); ++ ret = drm_universal_plane_init(priv->drm, plane, 0xFF, ++ &meson_plane_funcs, ++ supported_drm_formats, ++ ARRAY_SIZE(supported_drm_formats), ++ format_modifiers, ++ DRM_PLANE_TYPE_PRIMARY, "meson_primary_plane"); ++ if (ret) { ++ devm_kfree(priv->drm->dev, meson_plane); ++ return ret; ++ } + + drm_plane_helper_add(plane, &meson_plane_helper_funcs); + +-- +2.43.0 + diff --git a/queue-6.10/drm-xe-add-guc-state-asserts-to-deregister_exec_queu.patch b/queue-6.10/drm-xe-add-guc-state-asserts-to-deregister_exec_queu.patch new file mode 100644 index 00000000000..d05dfea0217 --- /dev/null +++ b/queue-6.10/drm-xe-add-guc-state-asserts-to-deregister_exec_queu.patch @@ -0,0 +1,38 @@ +From abc489ba0f0f5a70d22ff187e655e09131a920b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jun 2024 07:40:50 -0700 +Subject: drm/xe: Add GuC state asserts to deregister_exec_queue + +From: Matthew Brost + +[ Upstream commit 716ce587a81e6165a4133ea32f63f3d69f80e1e7 ] + +Will help catch bugs in GuC state machine. + +Signed-off-by: Matthew Brost +Reviewed-by: Jonathan Cavitt +Link: https://patchwork.freedesktop.org/patch/msgid/20240611144053.2805091-9-matthew.brost@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_guc_submit.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c +index e48285c81bf5..0a496612c810 100644 +--- a/drivers/gpu/drm/xe/xe_guc_submit.c ++++ b/drivers/gpu/drm/xe/xe_guc_submit.c +@@ -1551,6 +1551,11 @@ static void deregister_exec_queue(struct xe_guc *guc, struct xe_exec_queue *q) + q->guc->id, + }; + ++ xe_gt_assert(guc_to_gt(guc), exec_queue_destroyed(q)); ++ xe_gt_assert(guc_to_gt(guc), exec_queue_registered(q)); ++ xe_gt_assert(guc_to_gt(guc), !exec_queue_pending_disable(q)); ++ xe_gt_assert(guc_to_gt(guc), !exec_queue_pending_enable(q)); ++ + trace_xe_exec_queue_deregister(q); + + xe_guc_ct_send_g2h_handler(&guc->ct, action, ARRAY_SIZE(action)); +-- +2.43.0 + diff --git a/queue-6.10/drm-xe-check-valid-domain-is-passed-in-xe_force_wake.patch b/queue-6.10/drm-xe-check-valid-domain-is-passed-in-xe_force_wake.patch new file mode 100644 index 00000000000..57f5a0d9f57 --- /dev/null +++ b/queue-6.10/drm-xe-check-valid-domain-is-passed-in-xe_force_wake.patch @@ -0,0 +1,46 @@ +From 7c85ed4a198580b52ad884b70fd4bd3f68c3331e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 18:27:41 +0530 +Subject: drm/xe: Check valid domain is passed in xe_force_wake_ref + +From: Himal Prasad Ghimiray + +[ Upstream commit 35feb8dbbca627d118ccc1f2111841788c142703 ] + +Assert domain is not XE_FORCEWAKE_ALL. + +v2 +- use domain != XE_FORCEWAKE_ALL (Michal) + +v3 +- Fix commit description. + +Cc: Michal Wajdeczko +Cc: Rodrigo Vivi +Cc: Lucas De Marchi +Cc: Badal Nilawar +Signed-off-by: Himal Prasad Ghimiray +Reviewed-by: Michal Wajdeczko +Link: https://patchwork.freedesktop.org/patch/msgid/20240607125741.1407331-2-himal.prasad.ghimiray@intel.com +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_force_wake.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/xe/xe_force_wake.h b/drivers/gpu/drm/xe/xe_force_wake.h +index 8cbb04fe0ed9..a2577672f4e3 100644 +--- a/drivers/gpu/drm/xe/xe_force_wake.h ++++ b/drivers/gpu/drm/xe/xe_force_wake.h +@@ -24,7 +24,7 @@ static inline int + xe_force_wake_ref(struct xe_force_wake *fw, + enum xe_force_wake_domains domain) + { +- xe_gt_assert(fw->gt, domain); ++ xe_gt_assert(fw->gt, domain != XE_FORCEWAKE_ALL); + return fw->domains[ffs(domain) - 1].ref; + } + +-- +2.43.0 + diff --git a/queue-6.10/drm-xe-demote-ccs_mode-info-to-debug-only.patch b/queue-6.10/drm-xe-demote-ccs_mode-info-to-debug-only.patch new file mode 100644 index 00000000000..86b49cd0392 --- /dev/null +++ b/queue-6.10/drm-xe-demote-ccs_mode-info-to-debug-only.patch @@ -0,0 +1,40 @@ +From 6f445c7d2b12441f23cd0d1da119383b0b3d4ada Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 May 2024 15:03:31 -0400 +Subject: drm/xe: Demote CCS_MODE info to debug only + +From: Rodrigo Vivi + +[ Upstream commit e9c190b9b8e7e07bc0ef0ba9b87321fa37b456c5 ] + +This information is printed in any gt_reset, which actually +occurs in any runtime resume, what can be so verbose in +production build. Let's demote it to debug only. + +Cc: Niranjana Vishwanathapura +Reviewed-by: Lucas De Marchi +Link: https://patchwork.freedesktop.org/patch/msgid/20240503190331.6690-1-rodrigo.vivi@intel.com +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_gt_ccs_mode.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_gt_ccs_mode.c b/drivers/gpu/drm/xe/xe_gt_ccs_mode.c +index 396aeb5b9924..a34c9a24dafc 100644 +--- a/drivers/gpu/drm/xe/xe_gt_ccs_mode.c ++++ b/drivers/gpu/drm/xe/xe_gt_ccs_mode.c +@@ -68,8 +68,8 @@ static void __xe_gt_apply_ccs_mode(struct xe_gt *gt, u32 num_engines) + + xe_mmio_write32(gt, CCS_MODE, mode); + +- xe_gt_info(gt, "CCS_MODE=%x config:%08x, num_engines:%d, num_slices:%d\n", +- mode, config, num_engines, num_slices); ++ xe_gt_dbg(gt, "CCS_MODE=%x config:%08x, num_engines:%d, num_slices:%d\n", ++ mode, config, num_engines, num_slices); + } + + void xe_gt_apply_ccs_mode(struct xe_gt *gt) +-- +2.43.0 + diff --git a/queue-6.10/drm-xe-don-t-overmap-identity-vram-mapping.patch b/queue-6.10/drm-xe-don-t-overmap-identity-vram-mapping.patch new file mode 100644 index 00000000000..a903bbdb4b9 --- /dev/null +++ b/queue-6.10/drm-xe-don-t-overmap-identity-vram-mapping.patch @@ -0,0 +1,146 @@ +From da06390fda39a10d41b6bad37ff446a170291ea6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 11:18:24 -0700 +Subject: drm/xe: Don't overmap identity VRAM mapping + +From: Matthew Brost + +[ Upstream commit 6d3581edffea0b3a64b0d3094d3f09222e0024f7 ] + +Overmapping the identity VRAM mapping is triggering hardware bugs on +certain platforms. Use 2M pages for the last unaligned (to 1G) VRAM +chunk. + +v2: + - Always use 2M pages for last chunk (Fei Yang) + - break loop when 2M pages are used + - Add assert for usable_size being 2M aligned +v3: + - Fix checkpatch + +Cc: Maarten Lankhorst +Cc: Fei Yang +Signed-off-by: Matthew Brost +Reviewed-by: Fei Yang +Link: https://patchwork.freedesktop.org/patch/msgid/20240603181824.1927675-1-matthew.brost@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_migrate.c | 55 +++++++++++++++++++++++++-------- + 1 file changed, 42 insertions(+), 13 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_migrate.c b/drivers/gpu/drm/xe/xe_migrate.c +index 198f5c2189cb..208649436fdb 100644 +--- a/drivers/gpu/drm/xe/xe_migrate.c ++++ b/drivers/gpu/drm/xe/xe_migrate.c +@@ -69,7 +69,7 @@ struct xe_migrate { + + #define MAX_PREEMPTDISABLE_TRANSFER SZ_8M /* Around 1ms. */ + #define MAX_CCS_LIMITED_TRANSFER SZ_4M /* XE_PAGE_SIZE * (FIELD_MAX(XE2_CCS_SIZE_MASK) + 1) */ +-#define NUM_KERNEL_PDE 17 ++#define NUM_KERNEL_PDE 15 + #define NUM_PT_SLOTS 32 + #define LEVEL0_PAGE_TABLE_ENCODE_SIZE SZ_2M + #define MAX_NUM_PTE 512 +@@ -137,10 +137,11 @@ static int xe_migrate_prepare_vm(struct xe_tile *tile, struct xe_migrate *m, + struct xe_device *xe = tile_to_xe(tile); + u16 pat_index = xe->pat.idx[XE_CACHE_WB]; + u8 id = tile->id; +- u32 num_entries = NUM_PT_SLOTS, num_level = vm->pt_root[id]->level; ++ u32 num_entries = NUM_PT_SLOTS, num_level = vm->pt_root[id]->level, ++ num_setup = num_level + 1; + u32 map_ofs, level, i; + struct xe_bo *bo, *batch = tile->mem.kernel_bb_pool->bo; +- u64 entry; ++ u64 entry, pt30_ofs; + + /* Can't bump NUM_PT_SLOTS too high */ + BUILD_BUG_ON(NUM_PT_SLOTS > SZ_2M/XE_PAGE_SIZE); +@@ -160,10 +161,12 @@ static int xe_migrate_prepare_vm(struct xe_tile *tile, struct xe_migrate *m, + if (IS_ERR(bo)) + return PTR_ERR(bo); + +- entry = vm->pt_ops->pde_encode_bo(bo, bo->size - XE_PAGE_SIZE, pat_index); ++ /* PT31 reserved for 2M identity map */ ++ pt30_ofs = bo->size - 2 * XE_PAGE_SIZE; ++ entry = vm->pt_ops->pde_encode_bo(bo, pt30_ofs, pat_index); + xe_pt_write(xe, &vm->pt_root[id]->bo->vmap, 0, entry); + +- map_ofs = (num_entries - num_level) * XE_PAGE_SIZE; ++ map_ofs = (num_entries - num_setup) * XE_PAGE_SIZE; + + /* Map the entire BO in our level 0 pt */ + for (i = 0, level = 0; i < num_entries; level++) { +@@ -234,7 +237,7 @@ static int xe_migrate_prepare_vm(struct xe_tile *tile, struct xe_migrate *m, + } + + /* Write PDE's that point to our BO. */ +- for (i = 0; i < num_entries - num_level; i++) { ++ for (i = 0; i < map_ofs / PAGE_SIZE; i++) { + entry = vm->pt_ops->pde_encode_bo(bo, (u64)i * XE_PAGE_SIZE, + pat_index); + +@@ -252,28 +255,54 @@ static int xe_migrate_prepare_vm(struct xe_tile *tile, struct xe_migrate *m, + /* Identity map the entire vram at 256GiB offset */ + if (IS_DGFX(xe)) { + u64 pos, ofs, flags; ++ /* XXX: Unclear if this should be usable_size? */ ++ u64 vram_limit = xe->mem.vram.actual_physical_size + ++ xe->mem.vram.dpa_base; + + level = 2; + ofs = map_ofs + XE_PAGE_SIZE * level + 256 * 8; + flags = vm->pt_ops->pte_encode_addr(xe, 0, pat_index, level, + true, 0); + ++ xe_assert(xe, IS_ALIGNED(xe->mem.vram.usable_size, SZ_2M)); ++ + /* +- * Use 1GB pages, it shouldn't matter the physical amount of +- * vram is less, when we don't access it. ++ * Use 1GB pages when possible, last chunk always use 2M ++ * pages as mixing reserved memory (stolen, WOCPM) with a single ++ * mapping is not allowed on certain platforms. + */ +- for (pos = xe->mem.vram.dpa_base; +- pos < xe->mem.vram.actual_physical_size + xe->mem.vram.dpa_base; +- pos += SZ_1G, ofs += 8) ++ for (pos = xe->mem.vram.dpa_base; pos < vram_limit; ++ pos += SZ_1G, ofs += 8) { ++ if (pos + SZ_1G >= vram_limit) { ++ u64 pt31_ofs = bo->size - XE_PAGE_SIZE; ++ ++ entry = vm->pt_ops->pde_encode_bo(bo, pt31_ofs, ++ pat_index); ++ xe_map_wr(xe, &bo->vmap, ofs, u64, entry); ++ ++ flags = vm->pt_ops->pte_encode_addr(xe, 0, ++ pat_index, ++ level - 1, ++ true, 0); ++ ++ for (ofs = pt31_ofs; pos < vram_limit; ++ pos += SZ_2M, ofs += 8) ++ xe_map_wr(xe, &bo->vmap, ofs, u64, pos | flags); ++ break; /* Ensure pos == vram_limit assert correct */ ++ } ++ + xe_map_wr(xe, &bo->vmap, ofs, u64, pos | flags); ++ } ++ ++ xe_assert(xe, pos == vram_limit); + } + + /* + * Example layout created above, with root level = 3: + * [PT0...PT7]: kernel PT's for copy/clear; 64 or 4KiB PTE's + * [PT8]: Kernel PT for VM_BIND, 4 KiB PTE's +- * [PT9...PT28]: Userspace PT's for VM_BIND, 4 KiB PTE's +- * [PT29 = PDE 0] [PT30 = PDE 1] [PT31 = PDE 2] ++ * [PT9...PT27]: Userspace PT's for VM_BIND, 4 KiB PTE's ++ * [PT28 = PDE 0] [PT29 = PDE 1] [PT30 = PDE 2] [PT31 = 2M vram identity map] + * + * This makes the lowest part of the VM point to the pagetables. + * Hence the lowest 2M in the vm should point to itself, with a few writes +-- +2.43.0 + diff --git a/queue-6.10/drm-xe-ensure-caller-uses-sole-domain-for-xe_force_w.patch b/queue-6.10/drm-xe-ensure-caller-uses-sole-domain-for-xe_force_w.patch new file mode 100644 index 00000000000..75d42597687 --- /dev/null +++ b/queue-6.10/drm-xe-ensure-caller-uses-sole-domain-for-xe_force_w.patch @@ -0,0 +1,62 @@ +From 1c9d45ffc8c3bcc04d66763f6459db51301777d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 18:27:40 +0530 +Subject: drm/xe: Ensure caller uses sole domain for xe_force_wake_assert_held + +From: Himal Prasad Ghimiray + +[ Upstream commit 3541e19d0d3b30ad099c0c26ba87561aedfbd652 ] + +xe_force_wake_assert_held() is designed to confirm a particular +forcewake domain's wakefulness; it doesn't verify the wakefulness of +multiple domains. Make sure the caller doesn't input multiple +domains(XE_FORCEWAKE_ALL) as a parameter. + +v2 +- use domain != XE_FORCEWAKE_ALL (Michal) + +v3 +- Add kernel-doc + +Cc: Michal Wajdeczko +Cc: Rodrigo Vivi +Cc: Lucas De Marchi +Cc: Badal Nilawar +Signed-off-by: Himal Prasad Ghimiray +Reviewed-by: Michal Wajdeczko +Link: https://patchwork.freedesktop.org/patch/msgid/20240607125741.1407331-1-himal.prasad.ghimiray@intel.com +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_force_wake.h | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/gpu/drm/xe/xe_force_wake.h b/drivers/gpu/drm/xe/xe_force_wake.h +index 83cb157da7cc..8cbb04fe0ed9 100644 +--- a/drivers/gpu/drm/xe/xe_force_wake.h ++++ b/drivers/gpu/drm/xe/xe_force_wake.h +@@ -28,10 +28,21 @@ xe_force_wake_ref(struct xe_force_wake *fw, + return fw->domains[ffs(domain) - 1].ref; + } + ++/** ++ * xe_force_wake_assert_held - asserts domain is awake ++ * @fw : xe_force_wake structure ++ * @domain: xe_force_wake_domains apart from XE_FORCEWAKE_ALL ++ * ++ * xe_force_wake_assert_held() is designed to confirm a particular ++ * forcewake domain's wakefulness; it doesn't verify the wakefulness of ++ * multiple domains. Make sure the caller doesn't input multiple ++ * domains(XE_FORCEWAKE_ALL) as a parameter. ++ */ + static inline void + xe_force_wake_assert_held(struct xe_force_wake *fw, + enum xe_force_wake_domains domain) + { ++ xe_gt_assert(fw->gt, domain != XE_FORCEWAKE_ALL); + xe_gt_assert(fw->gt, fw->awake_domains & domain); + } + +-- +2.43.0 + diff --git a/queue-6.10/drm-xe-fix-the-warning-conditions.patch b/queue-6.10/drm-xe-fix-the-warning-conditions.patch new file mode 100644 index 00000000000..03ced3ad3d2 --- /dev/null +++ b/queue-6.10/drm-xe-fix-the-warning-conditions.patch @@ -0,0 +1,67 @@ +From d262dd234559c0319d6dc759fde174fc4bf4ff36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 May 2024 20:52:16 +0530 +Subject: drm/xe: Fix the warning conditions + +From: Himal Prasad Ghimiray + +[ Upstream commit 4c0be90e6874b8af30541c37689780fc7c8276c9 ] + +The maximum timeout display uses in xe_pcode_request is 3 msec, add the +warning in cases the function is misused with higher timeouts. + +Add a warning if pcode_try_request is not passed the timeout parameter +greater than 0. + +Cc: Lucas De Marchi +Cc: Rodrigo Vivi +Signed-off-by: Himal Prasad Ghimiray +Reviewed-by: Lucas De Marchi +Link: https://patchwork.freedesktop.org/patch/msgid/20240508152216.3263109-3-himal.prasad.ghimiray@intel.com +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_pcode.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/xe/xe_pcode.c b/drivers/gpu/drm/xe/xe_pcode.c +index a5e7da8cf944..9c4eefdf6642 100644 +--- a/drivers/gpu/drm/xe/xe_pcode.c ++++ b/drivers/gpu/drm/xe/xe_pcode.c +@@ -10,6 +10,7 @@ + + #include + ++#include "xe_assert.h" + #include "xe_device.h" + #include "xe_gt.h" + #include "xe_mmio.h" +@@ -124,6 +125,8 @@ static int pcode_try_request(struct xe_gt *gt, u32 mbox, + { + int slept, wait = 10; + ++ xe_gt_assert(gt, timeout_us > 0); ++ + for (slept = 0; slept < timeout_us; slept += wait) { + if (locked) + *status = pcode_mailbox_rw(gt, mbox, &request, NULL, 1, true, +@@ -169,6 +172,8 @@ int xe_pcode_request(struct xe_gt *gt, u32 mbox, u32 request, + u32 status; + int ret; + ++ xe_gt_assert(gt, timeout_base_ms <= 3); ++ + mutex_lock(>->pcode.lock); + + ret = pcode_try_request(gt, mbox, request, reply_mask, reply, &status, +@@ -188,7 +193,6 @@ int xe_pcode_request(struct xe_gt *gt, u32 mbox, u32 request, + */ + drm_err(>_to_xe(gt)->drm, + "PCODE timeout, retrying with preemption disabled\n"); +- drm_WARN_ON_ONCE(>_to_xe(gt)->drm, timeout_base_ms > 1); + preempt_disable(); + ret = pcode_try_request(gt, mbox, request, reply_mask, reply, &status, + true, 50 * 1000, true); +-- +2.43.0 + diff --git a/queue-6.10/drm-xe-gt-fix-assert-in-l3-bank-mask-generation.patch b/queue-6.10/drm-xe-gt-fix-assert-in-l3-bank-mask-generation.patch new file mode 100644 index 00000000000..85425d48fa2 --- /dev/null +++ b/queue-6.10/drm-xe-gt-fix-assert-in-l3-bank-mask-generation.patch @@ -0,0 +1,52 @@ +From 75dea505e45fee6f1e6035b2248963ba985dc58d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 May 2024 14:43:10 +0200 +Subject: drm/xe/gt: Fix assert in L3 bank mask generation + +From: Francois Dugast + +[ Upstream commit 8ad0e1810bf23f22cedb8a2664548b15646570c7 ] + +What needs to be asserted is that the pattern fits in the number +of bits provided by the user in patternbits, otherwise it would +be truncated when replicated according to the mask, which is +likely not the intended use of this function. +The pattern argument is a bitmap so use find_last_bit() instead +of fls(). The bit position starts at index 0 so remove "or equal" +from the comparison. XE_MAX_L3_BANK_MASK_BITS would be the +returned value if the pattern is 0, which can be the case on some +platforms. + +v2: Check the result does not overflow the array (Lucas De Marchi) + +v3: Use __fls() for long and handle mask == 0 (Lucas De Marchi) + +Cc: Matt Roper +Cc: Lucas De Marchi +Signed-off-by: Francois Dugast +Reviewed-by: Lucas De Marchi +Link: https://patchwork.freedesktop.org/patch/msgid/20240502124311.159695-1-francois.dugast@intel.com +Signed-off-by: Lucas De Marchi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_gt_topology.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/xe/xe_gt_topology.c b/drivers/gpu/drm/xe/xe_gt_topology.c +index 3733e7a6860d..d224ed1b5c0f 100644 +--- a/drivers/gpu/drm/xe/xe_gt_topology.c ++++ b/drivers/gpu/drm/xe/xe_gt_topology.c +@@ -108,7 +108,9 @@ gen_l3_mask_from_pattern(struct xe_device *xe, xe_l3_bank_mask_t dst, + { + unsigned long bit; + +- xe_assert(xe, fls(mask) <= patternbits); ++ xe_assert(xe, find_last_bit(pattern, XE_MAX_L3_BANK_MASK_BITS) < patternbits || ++ bitmap_empty(pattern, XE_MAX_L3_BANK_MASK_BITS)); ++ xe_assert(xe, !mask || patternbits * (__fls(mask) + 1) <= XE_MAX_L3_BANK_MASK_BITS); + for_each_set_bit(bit, &mask, 32) { + xe_l3_bank_mask_t shifted_pattern = {}; + +-- +2.43.0 + diff --git a/queue-6.10/drm-xe-hwmon-remove-unwanted-write-permission-for-cu.patch b/queue-6.10/drm-xe-hwmon-remove-unwanted-write-permission-for-cu.patch new file mode 100644 index 00000000000..12f62ab96d9 --- /dev/null +++ b/queue-6.10/drm-xe-hwmon-remove-unwanted-write-permission-for-cu.patch @@ -0,0 +1,48 @@ +From f385a4d83079b7e69b4d4dfa035ce7b8c747ee3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Apr 2024 18:29:45 +0530 +Subject: drm/xe/hwmon: Remove unwanted write permission for currN_label + +From: Karthik Poosa + +[ Upstream commit 515f08972355e160f896f612347121fbb685e740 ] + +Change umode of currN_label from 0644 to 0444 as write permission +not needed for label. + +Signed-off-by: Karthik Poosa +Reviewed-by: Riana Tauro +Link: https://patchwork.freedesktop.org/patch/msgid/20240419125945.4085629-1-karthik.poosa@intel.com +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_hwmon.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_hwmon.c b/drivers/gpu/drm/xe/xe_hwmon.c +index bb815dbde63a..daf0d15354fe 100644 +--- a/drivers/gpu/drm/xe/xe_hwmon.c ++++ b/drivers/gpu/drm/xe/xe_hwmon.c +@@ -551,12 +551,17 @@ xe_hwmon_curr_is_visible(const struct xe_hwmon *hwmon, u32 attr, int channel) + { + u32 uval; + ++ /* hwmon sysfs attribute of current available only for package */ ++ if (channel != CHANNEL_PKG) ++ return 0; ++ + switch (attr) { + case hwmon_curr_crit: +- case hwmon_curr_label: +- if (channel == CHANNEL_PKG) + return (xe_hwmon_pcode_read_i1(hwmon->gt, &uval) || + (uval & POWER_SETUP_I1_WATTS)) ? 0 : 0644; ++ case hwmon_curr_label: ++ return (xe_hwmon_pcode_read_i1(hwmon->gt, &uval) || ++ (uval & POWER_SETUP_I1_WATTS)) ? 0 : 0444; + break; + default: + return 0; +-- +2.43.0 + diff --git a/queue-6.10/drm-xe-use-missing-lock-in-relay_needs_worker.patch b/queue-6.10/drm-xe-use-missing-lock-in-relay_needs_worker.patch new file mode 100644 index 00000000000..2460c7bc7bf --- /dev/null +++ b/queue-6.10/drm-xe-use-missing-lock-in-relay_needs_worker.patch @@ -0,0 +1,43 @@ +From c80fc2bb3557069c1781c0f00483aa559e2a882b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 10:17:23 +0200 +Subject: drm/xe: Use missing lock in relay_needs_worker + +From: Nirmoy Das + +[ Upstream commit 8b01f970ee890574b3607c85781354a765c849bd ] + +Add missing lock that is protecting relay->incoming_actions. + +Cc: Michal Wajdeczko +Reviewed-by: Michal Wajdeczko +Link: https://patchwork.freedesktop.org/patch/msgid/20240603081723.18775-1-nirmoy.das@intel.com +Signed-off-by: Nirmoy Das +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_guc_relay.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/xe/xe_guc_relay.c b/drivers/gpu/drm/xe/xe_guc_relay.c +index c0a2d8d5d3b3..b49137ea6d84 100644 +--- a/drivers/gpu/drm/xe/xe_guc_relay.c ++++ b/drivers/gpu/drm/xe/xe_guc_relay.c +@@ -757,7 +757,14 @@ static void relay_process_incoming_action(struct xe_guc_relay *relay) + + static bool relay_needs_worker(struct xe_guc_relay *relay) + { +- return !list_empty(&relay->incoming_actions); ++ bool is_empty; ++ ++ spin_lock(&relay->lock); ++ is_empty = list_empty(&relay->incoming_actions); ++ spin_unlock(&relay->lock); ++ ++ return !is_empty; ++ + } + + static void relay_kick_worker(struct xe_guc_relay *relay) +-- +2.43.0 + diff --git a/queue-6.10/f2fs-fix-to-do-sanity-check-on-blocks-for-inline_dat.patch b/queue-6.10/f2fs-fix-to-do-sanity-check-on-blocks-for-inline_dat.patch new file mode 100644 index 00000000000..c5e95aded74 --- /dev/null +++ b/queue-6.10/f2fs-fix-to-do-sanity-check-on-blocks-for-inline_dat.patch @@ -0,0 +1,86 @@ +From 19804705037d9abafc1538c0d3340d6fcfbdcd92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 14:23:18 +0800 +Subject: f2fs: fix to do sanity check on blocks for inline_data inode + +From: Chao Yu + +[ Upstream commit c240c87bcd44a1a2375fc8ef8c645d1f1fe76466 ] + +inode can be fuzzed, so it can has F2FS_INLINE_DATA flag and valid +i_blocks/i_nid value, this patch supports to do extra sanity check +to detect such corrupted state. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/f2fs.h | 2 +- + fs/f2fs/inline.c | 20 +++++++++++++++++++- + fs/f2fs/inode.c | 2 +- + 3 files changed, 21 insertions(+), 3 deletions(-) + +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index 5556ab491368..92fda31c68cd 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -4154,7 +4154,7 @@ extern struct kmem_cache *f2fs_inode_entry_slab; + * inline.c + */ + bool f2fs_may_inline_data(struct inode *inode); +-bool f2fs_sanity_check_inline_data(struct inode *inode); ++bool f2fs_sanity_check_inline_data(struct inode *inode, struct page *ipage); + bool f2fs_may_inline_dentry(struct inode *inode); + void f2fs_do_read_inline_data(struct folio *folio, struct page *ipage); + void f2fs_truncate_inline_inode(struct inode *inode, +diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c +index 215daa71dc18..cca7d448e55c 100644 +--- a/fs/f2fs/inline.c ++++ b/fs/f2fs/inline.c +@@ -33,11 +33,29 @@ bool f2fs_may_inline_data(struct inode *inode) + return !f2fs_post_read_required(inode); + } + +-bool f2fs_sanity_check_inline_data(struct inode *inode) ++static bool inode_has_blocks(struct inode *inode, struct page *ipage) ++{ ++ struct f2fs_inode *ri = F2FS_INODE(ipage); ++ int i; ++ ++ if (F2FS_HAS_BLOCKS(inode)) ++ return true; ++ ++ for (i = 0; i < DEF_NIDS_PER_INODE; i++) { ++ if (ri->i_nid[i]) ++ return true; ++ } ++ return false; ++} ++ ++bool f2fs_sanity_check_inline_data(struct inode *inode, struct page *ipage) + { + if (!f2fs_has_inline_data(inode)) + return false; + ++ if (inode_has_blocks(inode, ipage)) ++ return false; ++ + if (!support_inline_data(inode)) + return true; + +diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c +index ed629dabbfda..57da02bfa823 100644 +--- a/fs/f2fs/inode.c ++++ b/fs/f2fs/inode.c +@@ -347,7 +347,7 @@ static bool sanity_check_inode(struct inode *inode, struct page *node_page) + } + } + +- if (f2fs_sanity_check_inline_data(inode)) { ++ if (f2fs_sanity_check_inline_data(inode, node_page)) { + f2fs_warn(sbi, "%s: inode (ino=%lx, mode=%u) should not have inline_data, run fsck to fix", + __func__, inode->i_ino, inode->i_mode); + return false; +-- +2.43.0 + diff --git a/queue-6.10/fsnotify-clear-parent_watched-flags-lazily.patch b/queue-6.10/fsnotify-clear-parent_watched-flags-lazily.patch new file mode 100644 index 00000000000..cfe33e81a85 --- /dev/null +++ b/queue-6.10/fsnotify-clear-parent_watched-flags-lazily.patch @@ -0,0 +1,208 @@ +From 6e7ec37b55bbca14ddaa8d190451c2069488bcac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 May 2024 13:30:07 +0200 +Subject: fsnotify: clear PARENT_WATCHED flags lazily + +From: Amir Goldstein + +[ Upstream commit 172e422ffea20a89bfdc672741c1aad6fbb5044e ] + +In some setups directories can have many (usually negative) dentries. +Hence __fsnotify_update_child_dentry_flags() function can take a +significant amount of time. Since the bulk of this function happens +under inode->i_lock this causes a significant contention on the lock +when we remove the watch from the directory as the +__fsnotify_update_child_dentry_flags() call from fsnotify_recalc_mask() +races with __fsnotify_update_child_dentry_flags() calls from +__fsnotify_parent() happening on children. This can lead upto softlockup +reports reported by users. + +Fix the problem by calling fsnotify_update_children_dentry_flags() to +set PARENT_WATCHED flags only when parent starts watching children. + +When parent stops watching children, clear false positive PARENT_WATCHED +flags lazily in __fsnotify_parent() for each accessed child. + +Suggested-by: Jan Kara +Signed-off-by: Amir Goldstein +Signed-off-by: Stephen Brennan +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/notify/fsnotify.c | 31 +++++++++++++++++++++---------- + fs/notify/fsnotify.h | 2 +- + fs/notify/mark.c | 32 +++++++++++++++++++++++++++++--- + include/linux/fsnotify_backend.h | 8 +++++--- + 4 files changed, 56 insertions(+), 17 deletions(-) + +diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c +index ff69ae24c4e8..272c8a1dab3c 100644 +--- a/fs/notify/fsnotify.c ++++ b/fs/notify/fsnotify.c +@@ -117,17 +117,13 @@ void fsnotify_sb_free(struct super_block *sb) + * parent cares. Thus when an event happens on a child it can quickly tell + * if there is a need to find a parent and send the event to the parent. + */ +-void __fsnotify_update_child_dentry_flags(struct inode *inode) ++void fsnotify_set_children_dentry_flags(struct inode *inode) + { + struct dentry *alias; +- int watched; + + if (!S_ISDIR(inode->i_mode)) + return; + +- /* determine if the children should tell inode about their events */ +- watched = fsnotify_inode_watches_children(inode); +- + spin_lock(&inode->i_lock); + /* run all of the dentries associated with this inode. Since this is a + * directory, there damn well better only be one item on this list */ +@@ -143,10 +139,7 @@ void __fsnotify_update_child_dentry_flags(struct inode *inode) + continue; + + spin_lock_nested(&child->d_lock, DENTRY_D_LOCK_NESTED); +- if (watched) +- child->d_flags |= DCACHE_FSNOTIFY_PARENT_WATCHED; +- else +- child->d_flags &= ~DCACHE_FSNOTIFY_PARENT_WATCHED; ++ child->d_flags |= DCACHE_FSNOTIFY_PARENT_WATCHED; + spin_unlock(&child->d_lock); + } + spin_unlock(&alias->d_lock); +@@ -154,6 +147,24 @@ void __fsnotify_update_child_dentry_flags(struct inode *inode) + spin_unlock(&inode->i_lock); + } + ++/* ++ * Lazily clear false positive PARENT_WATCHED flag for child whose parent had ++ * stopped watching children. ++ */ ++static void fsnotify_clear_child_dentry_flag(struct inode *pinode, ++ struct dentry *dentry) ++{ ++ spin_lock(&dentry->d_lock); ++ /* ++ * d_lock is a sufficient barrier to prevent observing a non-watched ++ * parent state from before the fsnotify_set_children_dentry_flags() ++ * or fsnotify_update_flags() call that had set PARENT_WATCHED. ++ */ ++ if (!fsnotify_inode_watches_children(pinode)) ++ dentry->d_flags &= ~DCACHE_FSNOTIFY_PARENT_WATCHED; ++ spin_unlock(&dentry->d_lock); ++} ++ + /* Are inode/sb/mount interested in parent and name info with this event? */ + static bool fsnotify_event_needs_parent(struct inode *inode, __u32 mnt_mask, + __u32 mask) +@@ -228,7 +239,7 @@ int __fsnotify_parent(struct dentry *dentry, __u32 mask, const void *data, + p_inode = parent->d_inode; + p_mask = fsnotify_inode_watches_children(p_inode); + if (unlikely(parent_watched && !p_mask)) +- __fsnotify_update_child_dentry_flags(p_inode); ++ fsnotify_clear_child_dentry_flag(p_inode, dentry); + + /* + * Include parent/name in notification either if some notification +diff --git a/fs/notify/fsnotify.h b/fs/notify/fsnotify.h +index 2d059f789ee3..663759ed6fbc 100644 +--- a/fs/notify/fsnotify.h ++++ b/fs/notify/fsnotify.h +@@ -93,7 +93,7 @@ static inline void fsnotify_clear_marks_by_sb(struct super_block *sb) + * update the dentry->d_flags of all of inode's children to indicate if inode cares + * about events that happen to its children. + */ +-extern void __fsnotify_update_child_dentry_flags(struct inode *inode); ++extern void fsnotify_set_children_dentry_flags(struct inode *inode); + + extern struct kmem_cache *fsnotify_mark_connector_cachep; + +diff --git a/fs/notify/mark.c b/fs/notify/mark.c +index c3eefa70633c..5e170e713088 100644 +--- a/fs/notify/mark.c ++++ b/fs/notify/mark.c +@@ -250,6 +250,24 @@ static void *__fsnotify_recalc_mask(struct fsnotify_mark_connector *conn) + return fsnotify_update_iref(conn, want_iref); + } + ++static bool fsnotify_conn_watches_children( ++ struct fsnotify_mark_connector *conn) ++{ ++ if (conn->type != FSNOTIFY_OBJ_TYPE_INODE) ++ return false; ++ ++ return fsnotify_inode_watches_children(fsnotify_conn_inode(conn)); ++} ++ ++static void fsnotify_conn_set_children_dentry_flags( ++ struct fsnotify_mark_connector *conn) ++{ ++ if (conn->type != FSNOTIFY_OBJ_TYPE_INODE) ++ return; ++ ++ fsnotify_set_children_dentry_flags(fsnotify_conn_inode(conn)); ++} ++ + /* + * Calculate mask of events for a list of marks. The caller must make sure + * connector and connector->obj cannot disappear under us. Callers achieve +@@ -258,15 +276,23 @@ static void *__fsnotify_recalc_mask(struct fsnotify_mark_connector *conn) + */ + void fsnotify_recalc_mask(struct fsnotify_mark_connector *conn) + { ++ bool update_children; ++ + if (!conn) + return; + + spin_lock(&conn->lock); ++ update_children = !fsnotify_conn_watches_children(conn); + __fsnotify_recalc_mask(conn); ++ update_children &= fsnotify_conn_watches_children(conn); + spin_unlock(&conn->lock); +- if (conn->type == FSNOTIFY_OBJ_TYPE_INODE) +- __fsnotify_update_child_dentry_flags( +- fsnotify_conn_inode(conn)); ++ /* ++ * Set children's PARENT_WATCHED flags only if parent started watching. ++ * When parent stops watching, we clear false positive PARENT_WATCHED ++ * flags lazily in __fsnotify_parent(). ++ */ ++ if (update_children) ++ fsnotify_conn_set_children_dentry_flags(conn); + } + + /* Free all connectors queued for freeing once SRCU period ends */ +diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h +index 4dd6143db271..8be029bc50b1 100644 +--- a/include/linux/fsnotify_backend.h ++++ b/include/linux/fsnotify_backend.h +@@ -594,12 +594,14 @@ static inline __u32 fsnotify_parent_needed_mask(__u32 mask) + + static inline int fsnotify_inode_watches_children(struct inode *inode) + { ++ __u32 parent_mask = READ_ONCE(inode->i_fsnotify_mask); ++ + /* FS_EVENT_ON_CHILD is set if the inode may care */ +- if (!(inode->i_fsnotify_mask & FS_EVENT_ON_CHILD)) ++ if (!(parent_mask & FS_EVENT_ON_CHILD)) + return 0; + /* this inode might care about child events, does it care about the + * specific set of events that can happen on a child? */ +- return inode->i_fsnotify_mask & FS_EVENTS_POSS_ON_CHILD; ++ return parent_mask & FS_EVENTS_POSS_ON_CHILD; + } + + /* +@@ -613,7 +615,7 @@ static inline void fsnotify_update_flags(struct dentry *dentry) + /* + * Serialisation of setting PARENT_WATCHED on the dentries is provided + * by d_lock. If inotify_inode_watched changes after we have taken +- * d_lock, the following __fsnotify_update_child_dentry_flags call will ++ * d_lock, the following fsnotify_set_children_dentry_flags call will + * find our entry, so it will spin until we complete here, and update + * us with the new state. + */ +-- +2.43.0 + diff --git a/queue-6.10/gfs2-revert-add-quota_change-type.patch b/queue-6.10/gfs2-revert-add-quota_change-type.patch new file mode 100644 index 00000000000..8dd1f804be7 --- /dev/null +++ b/queue-6.10/gfs2-revert-add-quota_change-type.patch @@ -0,0 +1,115 @@ +From 434da310b1eec81c604bf77d7d39837a21b0678b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jun 2024 22:13:15 +0200 +Subject: gfs2: Revert "Add quota_change type" + +From: Andreas Gruenbacher + +[ Upstream commit ec4b5200c8af9ce021399d3192b3379c089396c3 ] + +Commit 432928c93779 ("gfs2: Add quota_change type") makes the incorrect +assertion that function do_qc() should behave differently in the two +contexts it is used in, but that isn't actually true. In all cases, +do_qc() grabs a "reference" when it starts using a slot in the per-node +quota changes file, and it releases that "reference" when no more +residual changes remain. Revert that broken commit. + +There are some remaining issues with function do_qc() which are +addressed in the next commit. + +This reverts commit 432928c9377959684c748a9bc6553ed2d3c2ea4f. + +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/quota.c | 19 +++++++------------ + fs/gfs2/util.c | 6 +++--- + 2 files changed, 10 insertions(+), 15 deletions(-) + +diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c +index aa9cf0102848..52556b6bae6b 100644 +--- a/fs/gfs2/quota.c ++++ b/fs/gfs2/quota.c +@@ -75,9 +75,6 @@ + #define GFS2_QD_HASH_SIZE BIT(GFS2_QD_HASH_SHIFT) + #define GFS2_QD_HASH_MASK (GFS2_QD_HASH_SIZE - 1) + +-#define QC_CHANGE 0 +-#define QC_SYNC 1 +- + /* Lock order: qd_lock -> bucket lock -> qd->lockref.lock -> lru lock */ + /* -> sd_bitmap_lock */ + static DEFINE_SPINLOCK(qd_lock); +@@ -710,7 +707,7 @@ static int sort_qd(const void *a, const void *b) + return 0; + } + +-static void do_qc(struct gfs2_quota_data *qd, s64 change, int qc_type) ++static void do_qc(struct gfs2_quota_data *qd, s64 change) + { + struct gfs2_sbd *sdp = qd->qd_sbd; + struct gfs2_inode *ip = GFS2_I(sdp->sd_qc_inode); +@@ -735,18 +732,16 @@ static void do_qc(struct gfs2_quota_data *qd, s64 change, int qc_type) + qd->qd_change = x; + spin_unlock(&qd_lock); + +- if (qc_type == QC_CHANGE) { +- if (!test_and_set_bit(QDF_CHANGE, &qd->qd_flags)) { +- qd_hold(qd); +- slot_hold(qd); +- } +- } else { ++ if (!x) { + gfs2_assert_warn(sdp, test_bit(QDF_CHANGE, &qd->qd_flags)); + clear_bit(QDF_CHANGE, &qd->qd_flags); + qc->qc_flags = 0; + qc->qc_id = 0; + slot_put(qd); + qd_put(qd); ++ } else if (!test_and_set_bit(QDF_CHANGE, &qd->qd_flags)) { ++ qd_hold(qd); ++ slot_hold(qd); + } + + if (change < 0) /* Reset quiet flag if we freed some blocks */ +@@ -992,7 +987,7 @@ static int do_sync(unsigned int num_qd, struct gfs2_quota_data **qda) + if (error) + goto out_end_trans; + +- do_qc(qd, -qd->qd_change_sync, QC_SYNC); ++ do_qc(qd, -qd->qd_change_sync); + set_bit(QDF_REFRESH, &qd->qd_flags); + } + +@@ -1312,7 +1307,7 @@ void gfs2_quota_change(struct gfs2_inode *ip, s64 change, + + if (qid_eq(qd->qd_id, make_kqid_uid(uid)) || + qid_eq(qd->qd_id, make_kqid_gid(gid))) { +- do_qc(qd, change, QC_CHANGE); ++ do_qc(qd, change); + } + } + } +diff --git a/fs/gfs2/util.c b/fs/gfs2/util.c +index af4758d8d894..551efd7820ad 100644 +--- a/fs/gfs2/util.c ++++ b/fs/gfs2/util.c +@@ -99,12 +99,12 @@ int check_journal_clean(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd, + */ + int gfs2_freeze_lock_shared(struct gfs2_sbd *sdp) + { ++ int flags = LM_FLAG_NOEXP | GL_EXACT; + int error; + +- error = gfs2_glock_nq_init(sdp->sd_freeze_gl, LM_ST_SHARED, +- LM_FLAG_NOEXP | GL_EXACT, ++ error = gfs2_glock_nq_init(sdp->sd_freeze_gl, LM_ST_SHARED, flags, + &sdp->sd_freeze_gh); +- if (error) ++ if (error && error != GLR_TRYFAILED) + fs_err(sdp, "can't lock the freeze glock: %d\n", error); + return error; + } +-- +2.43.0 + diff --git a/queue-6.10/hwmon-k10temp-check-return-value-of-amd_smn_read.patch b/queue-6.10/hwmon-k10temp-check-return-value-of-amd_smn_read.patch new file mode 100644 index 00000000000..65eaf12cae0 --- /dev/null +++ b/queue-6.10/hwmon-k10temp-check-return-value-of-amd_smn_read.patch @@ -0,0 +1,123 @@ +From c95f1499dd76472b61100f84e6c46131cc69523e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 11:12:56 -0500 +Subject: hwmon: (k10temp) Check return value of amd_smn_read() + +From: Yazen Ghannam + +[ Upstream commit c2d79cc5455c891de6c93e1e0c73d806e299c54f ] + +Check the return value of amd_smn_read() before saving a value. This +ensures invalid values aren't saved or used. + +There are three cases here with slightly different behavior: + +1) read_tempreg_nb_zen(): + This is a function pointer which does not include a return code. + In this case, set the register value to 0 on failure. This + enforces Read-as-Zero behavior. + +2) k10temp_read_temp(): + This function does have return codes, so return the error code + from the failed register read. Continued operation is not + necessary, since there is no valid data from the register. + Furthermore, if the register value was set to 0, then the + following operation would underflow. + +3) k10temp_get_ccd_support(): + This function reads the same register from multiple CCD + instances in a loop. And a bitmask is formed if a specific bit + is set in each register instance. The loop should continue on a + failed register read, skipping the bit check. + +Signed-off-by: Yazen Ghannam +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Mario Limonciello +Acked-by: Guenter Roeck +Link: https://lore.kernel.org/r/20240606-fix-smn-bad-read-v4-3-ffde21931c3f@amd.com +Signed-off-by: Sasha Levin +--- + drivers/hwmon/k10temp.c | 36 +++++++++++++++++++++++++++--------- + 1 file changed, 27 insertions(+), 9 deletions(-) + +diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c +index 8092312c0a87..6cad35e7f182 100644 +--- a/drivers/hwmon/k10temp.c ++++ b/drivers/hwmon/k10temp.c +@@ -153,8 +153,9 @@ static void read_tempreg_nb_f15(struct pci_dev *pdev, u32 *regval) + + static void read_tempreg_nb_zen(struct pci_dev *pdev, u32 *regval) + { +- amd_smn_read(amd_pci_dev_to_node_id(pdev), +- ZEN_REPORTED_TEMP_CTRL_BASE, regval); ++ if (amd_smn_read(amd_pci_dev_to_node_id(pdev), ++ ZEN_REPORTED_TEMP_CTRL_BASE, regval)) ++ *regval = 0; + } + + static long get_raw_temp(struct k10temp_data *data) +@@ -205,6 +206,7 @@ static int k10temp_read_temp(struct device *dev, u32 attr, int channel, + long *val) + { + struct k10temp_data *data = dev_get_drvdata(dev); ++ int ret = -EOPNOTSUPP; + u32 regval; + + switch (attr) { +@@ -221,13 +223,17 @@ static int k10temp_read_temp(struct device *dev, u32 attr, int channel, + *val = 0; + break; + case 2 ... 13: /* Tccd{1-12} */ +- amd_smn_read(amd_pci_dev_to_node_id(data->pdev), +- ZEN_CCD_TEMP(data->ccd_offset, channel - 2), +- ®val); ++ ret = amd_smn_read(amd_pci_dev_to_node_id(data->pdev), ++ ZEN_CCD_TEMP(data->ccd_offset, channel - 2), ++ ®val); ++ ++ if (ret) ++ return ret; ++ + *val = (regval & ZEN_CCD_TEMP_MASK) * 125 - 49000; + break; + default: +- return -EOPNOTSUPP; ++ return ret; + } + break; + case hwmon_temp_max: +@@ -243,7 +249,7 @@ static int k10temp_read_temp(struct device *dev, u32 attr, int channel, + - ((regval >> 24) & 0xf)) * 500 + 52000; + break; + default: +- return -EOPNOTSUPP; ++ return ret; + } + return 0; + } +@@ -381,8 +387,20 @@ static void k10temp_get_ccd_support(struct pci_dev *pdev, + int i; + + for (i = 0; i < limit; i++) { +- amd_smn_read(amd_pci_dev_to_node_id(pdev), +- ZEN_CCD_TEMP(data->ccd_offset, i), ®val); ++ /* ++ * Ignore inaccessible CCDs. ++ * ++ * Some systems will return a register value of 0, and the TEMP_VALID ++ * bit check below will naturally fail. ++ * ++ * Other systems will return a PCI_ERROR_RESPONSE (0xFFFFFFFF) for ++ * the register value. And this will incorrectly pass the TEMP_VALID ++ * bit check. ++ */ ++ if (amd_smn_read(amd_pci_dev_to_node_id(pdev), ++ ZEN_CCD_TEMP(data->ccd_offset, i), ®val)) ++ continue; ++ + if (regval & ZEN_CCD_TEMP_VALID) + data->show_temp |= BIT(TCCD_BIT(i)); + } +-- +2.43.0 + diff --git a/queue-6.10/hwspinlock-introduce-hwspin_lock_bust.patch b/queue-6.10/hwspinlock-introduce-hwspin_lock_bust.patch new file mode 100644 index 00000000000..32d75906c25 --- /dev/null +++ b/queue-6.10/hwspinlock-introduce-hwspin_lock_bust.patch @@ -0,0 +1,137 @@ +From f66ccc74d654a251bc53d81b3c8af50217e862d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 May 2024 11:09:55 -0700 +Subject: hwspinlock: Introduce hwspin_lock_bust() + +From: Richard Maina + +[ Upstream commit 7c327d56597d8de1680cf24e956b704270d3d84a ] + +When a remoteproc crashes or goes down unexpectedly this can result in +a state where locks held by the remoteproc will remain locked possibly +resulting in deadlock. This new API hwspin_lock_bust() allows +hwspinlock implementers to define a bust operation for freeing previously +acquired hwspinlocks after verifying ownership of the acquired lock. + +Signed-off-by: Richard Maina +Reviewed-by: Bjorn Andersson +Signed-off-by: Chris Lew +Link: https://lore.kernel.org/r/20240529-hwspinlock-bust-v3-1-c8b924ffa5a2@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + Documentation/locking/hwspinlock.rst | 11 ++++++++++ + drivers/hwspinlock/hwspinlock_core.c | 28 ++++++++++++++++++++++++ + drivers/hwspinlock/hwspinlock_internal.h | 3 +++ + include/linux/hwspinlock.h | 6 +++++ + 4 files changed, 48 insertions(+) + +diff --git a/Documentation/locking/hwspinlock.rst b/Documentation/locking/hwspinlock.rst +index 6f03713b7003..2ffaa3cbd63f 100644 +--- a/Documentation/locking/hwspinlock.rst ++++ b/Documentation/locking/hwspinlock.rst +@@ -85,6 +85,17 @@ is already free). + + Should be called from a process context (might sleep). + ++:: ++ ++ int hwspin_lock_bust(struct hwspinlock *hwlock, unsigned int id); ++ ++After verifying the owner of the hwspinlock, release a previously acquired ++hwspinlock; returns 0 on success, or an appropriate error code on failure ++(e.g. -EOPNOTSUPP if the bust operation is not defined for the specific ++hwspinlock). ++ ++Should be called from a process context (might sleep). ++ + :: + + int hwspin_lock_timeout(struct hwspinlock *hwlock, unsigned int timeout); +diff --git a/drivers/hwspinlock/hwspinlock_core.c b/drivers/hwspinlock/hwspinlock_core.c +index 0c0a932c00f3..6505261e6068 100644 +--- a/drivers/hwspinlock/hwspinlock_core.c ++++ b/drivers/hwspinlock/hwspinlock_core.c +@@ -305,6 +305,34 @@ void __hwspin_unlock(struct hwspinlock *hwlock, int mode, unsigned long *flags) + } + EXPORT_SYMBOL_GPL(__hwspin_unlock); + ++/** ++ * hwspin_lock_bust() - bust a specific hwspinlock ++ * @hwlock: a previously-acquired hwspinlock which we want to bust ++ * @id: identifier of the remote lock holder, if applicable ++ * ++ * This function will bust a hwspinlock that was previously acquired as ++ * long as the current owner of the lock matches the id given by the caller. ++ * ++ * Context: Process context. ++ * ++ * Returns: 0 on success, or -EINVAL if the hwspinlock does not exist, or ++ * the bust operation fails, and -EOPNOTSUPP if the bust operation is not ++ * defined for the hwspinlock. ++ */ ++int hwspin_lock_bust(struct hwspinlock *hwlock, unsigned int id) ++{ ++ if (WARN_ON(!hwlock)) ++ return -EINVAL; ++ ++ if (!hwlock->bank->ops->bust) { ++ pr_err("bust operation not defined\n"); ++ return -EOPNOTSUPP; ++ } ++ ++ return hwlock->bank->ops->bust(hwlock, id); ++} ++EXPORT_SYMBOL_GPL(hwspin_lock_bust); ++ + /** + * of_hwspin_lock_simple_xlate - translate hwlock_spec to return a lock id + * @hwlock_spec: hwlock specifier as found in the device tree +diff --git a/drivers/hwspinlock/hwspinlock_internal.h b/drivers/hwspinlock/hwspinlock_internal.h +index 29892767bb7a..f298fc0ee5ad 100644 +--- a/drivers/hwspinlock/hwspinlock_internal.h ++++ b/drivers/hwspinlock/hwspinlock_internal.h +@@ -21,6 +21,8 @@ struct hwspinlock_device; + * @trylock: make a single attempt to take the lock. returns 0 on + * failure and true on success. may _not_ sleep. + * @unlock: release the lock. always succeed. may _not_ sleep. ++ * @bust: optional, platform-specific bust handler, called by hwspinlock ++ * core to bust a specific lock. + * @relax: optional, platform-specific relax handler, called by hwspinlock + * core while spinning on a lock, between two successive + * invocations of @trylock. may _not_ sleep. +@@ -28,6 +30,7 @@ struct hwspinlock_device; + struct hwspinlock_ops { + int (*trylock)(struct hwspinlock *lock); + void (*unlock)(struct hwspinlock *lock); ++ int (*bust)(struct hwspinlock *lock, unsigned int id); + void (*relax)(struct hwspinlock *lock); + }; + +diff --git a/include/linux/hwspinlock.h b/include/linux/hwspinlock.h +index bfe7c1f1ac6d..f0231dbc4777 100644 +--- a/include/linux/hwspinlock.h ++++ b/include/linux/hwspinlock.h +@@ -68,6 +68,7 @@ int __hwspin_lock_timeout(struct hwspinlock *, unsigned int, int, + int __hwspin_trylock(struct hwspinlock *, int, unsigned long *); + void __hwspin_unlock(struct hwspinlock *, int, unsigned long *); + int of_hwspin_lock_get_id_byname(struct device_node *np, const char *name); ++int hwspin_lock_bust(struct hwspinlock *hwlock, unsigned int id); + int devm_hwspin_lock_free(struct device *dev, struct hwspinlock *hwlock); + struct hwspinlock *devm_hwspin_lock_request(struct device *dev); + struct hwspinlock *devm_hwspin_lock_request_specific(struct device *dev, +@@ -127,6 +128,11 @@ void __hwspin_unlock(struct hwspinlock *hwlock, int mode, unsigned long *flags) + { + } + ++static inline int hwspin_lock_bust(struct hwspinlock *hwlock, unsigned int id) ++{ ++ return 0; ++} ++ + static inline int of_hwspin_lock_get_id(struct device_node *np, int index) + { + return 0; +-- +2.43.0 + diff --git a/queue-6.10/ionic-fix-potential-irq-name-truncation.patch b/queue-6.10/ionic-fix-potential-irq-name-truncation.patch new file mode 100644 index 00000000000..d5bca65c42d --- /dev/null +++ b/queue-6.10/ionic-fix-potential-irq-name-truncation.patch @@ -0,0 +1,38 @@ +From 06dc5c1ea9e288eb7a9876362f0feb5459b3ece8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 May 2024 17:02:53 -0700 +Subject: ionic: fix potential irq name truncation + +From: Shannon Nelson + +[ Upstream commit 3eb76e71b16e8ba5277bf97617aef51f5e64dbe4 ] + +Address a warning about potential string truncation based on the +string buffer sizes. We can add some hints to the string format +specifier to set limits on the resulting possible string to +squelch the complaints. + +Signed-off-by: Shannon Nelson +Link: https://lore.kernel.org/r/20240529000259.25775-2-shannon.nelson@amd.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/pensando/ionic/ionic_lif.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +index 1837a30ba08a..f64d18949f68 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +@@ -242,7 +242,7 @@ static int ionic_request_irq(struct ionic_lif *lif, struct ionic_qcq *qcq) + name = dev_name(dev); + + snprintf(intr->name, sizeof(intr->name), +- "%s-%s-%s", IONIC_DRV_NAME, name, q->name); ++ "%.5s-%.16s-%.8s", IONIC_DRV_NAME, name, q->name); + + return devm_request_irq(dev, intr->vector, ionic_isr, + 0, intr->name, &qcq->napi); +-- +2.43.0 + diff --git a/queue-6.10/media-uvcvideo-enforce-alignment-of-frame-and-interv.patch b/queue-6.10/media-uvcvideo-enforce-alignment-of-frame-and-interv.patch new file mode 100644 index 00000000000..501f7e42329 --- /dev/null +++ b/queue-6.10/media-uvcvideo-enforce-alignment-of-frame-and-interv.patch @@ -0,0 +1,68 @@ +From d271a359bf0b2ac8991176532ae7145885173220 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Apr 2024 17:56:18 +0000 +Subject: media: uvcvideo: Enforce alignment of frame and interval + +From: Ricardo Ribalda + +[ Upstream commit c8931ef55bd325052ec496f242aea7f6de47dc9c ] + +Struct uvc_frame and interval (u32*) are packaged together on +streaming->formats on a single contiguous allocation. + +Right now they are allocated right after uvc_format, without taking into +consideration their required alignment. + +This is working fine because both structures have a field with a +pointer, but it will stop working when the sizeof() of any of those +structs is not a multiple of the sizeof(void*). + +Enforce that alignment during the allocation. + +Signed-off-by: Ricardo Ribalda +Reviewed-by: Laurent Pinchart +Link: https://lore.kernel.org/r/20240404-uvc-align-v2-1-9e104b0ecfbd@chromium.org +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_driver.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c +index d435b6a6c295..13c2c11cfdf6 100644 +--- a/drivers/media/usb/uvc/uvc_driver.c ++++ b/drivers/media/usb/uvc/uvc_driver.c +@@ -687,16 +687,26 @@ static int uvc_parse_streaming(struct uvc_device *dev, + goto error; + } + +- size = nformats * sizeof(*format) + nframes * sizeof(*frame) ++ /* ++ * Allocate memory for the formats, the frames and the intervals, ++ * plus any required padding to guarantee that everything has the ++ * correct alignment. ++ */ ++ size = nformats * sizeof(*format); ++ size = ALIGN(size, __alignof__(*frame)) + nframes * sizeof(*frame); ++ size = ALIGN(size, __alignof__(*interval)) + + nintervals * sizeof(*interval); ++ + format = kzalloc(size, GFP_KERNEL); +- if (format == NULL) { ++ if (!format) { + ret = -ENOMEM; + goto error; + } + +- frame = (struct uvc_frame *)&format[nformats]; +- interval = (u32 *)&frame[nframes]; ++ frame = (void *)format + nformats * sizeof(*format); ++ frame = PTR_ALIGN(frame, __alignof__(*frame)); ++ interval = (void *)frame + nframes * sizeof(*frame); ++ interval = PTR_ALIGN(interval, __alignof__(*interval)); + + streaming->formats = format; + streaming->nformats = 0; +-- +2.43.0 + diff --git a/queue-6.10/media-v4l2-cci-always-assign-val.patch b/queue-6.10/media-v4l2-cci-always-assign-val.patch new file mode 100644 index 00000000000..f2bfdab3817 --- /dev/null +++ b/queue-6.10/media-v4l2-cci-always-assign-val.patch @@ -0,0 +1,46 @@ +From 60b9b2bc6d6c37147aa1b09e8cfce4321e5639f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 May 2024 14:00:51 +0300 +Subject: media: v4l2-cci: Always assign *val + +From: Sakari Ailus + +[ Upstream commit 7417b1b1f36cc214dc458e717278a27a912d3b51 ] + +Always assign *val to 0 in cci_read(). This has the benefit of not +requiring initialisation of the variables data is read to using +cci_read(). Once smatch is fixed, it could catch the use of uninitialised +reads. + +Signed-off-by: Sakari Ailus +Tested-by: Benjamin Mugnier +Reviewed-by: Hans de Goede +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-cci.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/media/v4l2-core/v4l2-cci.c b/drivers/media/v4l2-core/v4l2-cci.c +index ee3475bed37f..1ff94affbaf3 100644 +--- a/drivers/media/v4l2-core/v4l2-cci.c ++++ b/drivers/media/v4l2-core/v4l2-cci.c +@@ -23,6 +23,15 @@ int cci_read(struct regmap *map, u32 reg, u64 *val, int *err) + u8 buf[8]; + int ret; + ++ /* ++ * TODO: Fix smatch. Assign *val to 0 here in order to avoid ++ * failing a smatch check on caller when the caller proceeds to ++ * read *val without initialising it on caller's side. *val is set ++ * to a valid value whenever this function returns 0 but smatch ++ * can't figure that out currently. ++ */ ++ *val = 0; ++ + if (err && *err) + return *err; + +-- +2.43.0 + diff --git a/queue-6.10/net-mlx5e-shampo-fix-incorrect-page-release.patch b/queue-6.10/net-mlx5e-shampo-fix-incorrect-page-release.patch new file mode 100644 index 00000000000..58f1deae1f5 --- /dev/null +++ b/queue-6.10/net-mlx5e-shampo-fix-incorrect-page-release.patch @@ -0,0 +1,47 @@ +From fe344648704bd2f1908cdd8d03e8e4582c5609cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jun 2024 00:22:07 +0300 +Subject: net/mlx5e: SHAMPO, Fix incorrect page release + +From: Dragos Tatulea + +[ Upstream commit 70bd03b89f20b9bbe51a7f73c4950565a17a45f7 ] + +Under the following conditions: +1) No skb created yet +2) header_size == 0 (no SHAMPO header) +3) header_index + 1 % MLX5E_SHAMPO_WQ_HEADER_PER_PAGE == 0 (this is the + last page fragment of a SHAMPO header page) + +a new skb is formed with a page that is NOT a SHAMPO header page (it +is a regular data page). Further down in the same function +(mlx5e_handle_rx_cqe_mpwrq_shampo()), a SHAMPO header page from +header_index is released. This is wrong and it leads to SHAMPO header +pages being released more than once. + +Signed-off-by: Dragos Tatulea +Signed-off-by: Tariq Toukan +Link: https://lore.kernel.org/r/20240603212219.1037656-3-tariqt@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +index cdc84a27a04e..0138f77eaeed 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +@@ -2369,7 +2369,8 @@ static void mlx5e_handle_rx_cqe_mpwrq_shampo(struct mlx5e_rq *rq, struct mlx5_cq + if (flush) + mlx5e_shampo_flush_skb(rq, cqe, match); + free_hd_entry: +- mlx5e_free_rx_shampo_hd_entry(rq, header_index); ++ if (likely(head_size)) ++ mlx5e_free_rx_shampo_hd_entry(rq, header_index); + mpwrq_cqe_out: + if (likely(wi->consumed_strides < rq->mpwqe.num_strides)) + return; +-- +2.43.0 + diff --git a/queue-6.10/net-remove-null-pointer-net-parameter-in-ip_metrics_.patch b/queue-6.10/net-remove-null-pointer-net-parameter-in-ip_metrics_.patch new file mode 100644 index 00000000000..6e775770ce3 --- /dev/null +++ b/queue-6.10/net-remove-null-pointer-net-parameter-in-ip_metrics_.patch @@ -0,0 +1,183 @@ +From 12b6df7134b899385813c48030ecdc0fc7f7d0fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 May 2024 23:46:34 +0800 +Subject: net: remove NULL-pointer net parameter in ip_metrics_convert + +From: Jason Xing + +[ Upstream commit 61e2bbafb00e4b9a5de45e6448a7b6b818658576 ] + +When I was doing some experiments, I found that when using the first +parameter, namely, struct net, in ip_metrics_convert() always triggers NULL +pointer crash. Then I digged into this part, realizing that we can remove +this one due to its uselessness. + +Signed-off-by: Jason Xing +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/ip.h | 3 +-- + include/net/tcp.h | 2 +- + net/ipv4/fib_semantics.c | 5 ++--- + net/ipv4/metrics.c | 8 ++++---- + net/ipv4/tcp_cong.c | 11 +++++------ + net/ipv6/route.c | 2 +- + 6 files changed, 14 insertions(+), 17 deletions(-) + +diff --git a/include/net/ip.h b/include/net/ip.h +index 6d735e00d3f3..c5606cadb1a5 100644 +--- a/include/net/ip.h ++++ b/include/net/ip.h +@@ -506,8 +506,7 @@ static inline unsigned int ip_skb_dst_mtu(struct sock *sk, + return mtu - lwtunnel_headroom(skb_dst(skb)->lwtstate, mtu); + } + +-struct dst_metrics *ip_fib_metrics_init(struct net *net, struct nlattr *fc_mx, +- int fc_mx_len, ++struct dst_metrics *ip_fib_metrics_init(struct nlattr *fc_mx, int fc_mx_len, + struct netlink_ext_ack *extack); + static inline void ip_fib_metrics_put(struct dst_metrics *fib_metrics) + { +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 32815a40dea1..45bbb54e42e8 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -1216,7 +1216,7 @@ extern struct tcp_congestion_ops tcp_reno; + + struct tcp_congestion_ops *tcp_ca_find(const char *name); + struct tcp_congestion_ops *tcp_ca_find_key(u32 key); +-u32 tcp_ca_get_key_by_name(struct net *net, const char *name, bool *ecn_ca); ++u32 tcp_ca_get_key_by_name(const char *name, bool *ecn_ca); + #ifdef CONFIG_INET + char *tcp_ca_get_name_by_key(u32 key, char *buffer); + #else +diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c +index 8956026bc0a2..2b57cd2b96e2 100644 +--- a/net/ipv4/fib_semantics.c ++++ b/net/ipv4/fib_semantics.c +@@ -1030,7 +1030,7 @@ bool fib_metrics_match(struct fib_config *cfg, struct fib_info *fi) + bool ecn_ca = false; + + nla_strscpy(tmp, nla, sizeof(tmp)); +- val = tcp_ca_get_key_by_name(fi->fib_net, tmp, &ecn_ca); ++ val = tcp_ca_get_key_by_name(tmp, &ecn_ca); + } else { + if (nla_len(nla) != sizeof(u32)) + return false; +@@ -1459,8 +1459,7 @@ struct fib_info *fib_create_info(struct fib_config *cfg, + fi = kzalloc(struct_size(fi, fib_nh, nhs), GFP_KERNEL); + if (!fi) + goto failure; +- fi->fib_metrics = ip_fib_metrics_init(fi->fib_net, cfg->fc_mx, +- cfg->fc_mx_len, extack); ++ fi->fib_metrics = ip_fib_metrics_init(cfg->fc_mx, cfg->fc_mx_len, extack); + if (IS_ERR(fi->fib_metrics)) { + err = PTR_ERR(fi->fib_metrics); + kfree(fi); +diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c +index 0e3ee1532848..8ddac1f595ed 100644 +--- a/net/ipv4/metrics.c ++++ b/net/ipv4/metrics.c +@@ -7,7 +7,7 @@ + #include + #include + +-static int ip_metrics_convert(struct net *net, struct nlattr *fc_mx, ++static int ip_metrics_convert(struct nlattr *fc_mx, + int fc_mx_len, u32 *metrics, + struct netlink_ext_ack *extack) + { +@@ -31,7 +31,7 @@ static int ip_metrics_convert(struct net *net, struct nlattr *fc_mx, + char tmp[TCP_CA_NAME_MAX]; + + nla_strscpy(tmp, nla, sizeof(tmp)); +- val = tcp_ca_get_key_by_name(net, tmp, &ecn_ca); ++ val = tcp_ca_get_key_by_name(tmp, &ecn_ca); + if (val == TCP_CA_UNSPEC) { + NL_SET_ERR_MSG(extack, "Unknown tcp congestion algorithm"); + return -EINVAL; +@@ -63,7 +63,7 @@ static int ip_metrics_convert(struct net *net, struct nlattr *fc_mx, + return 0; + } + +-struct dst_metrics *ip_fib_metrics_init(struct net *net, struct nlattr *fc_mx, ++struct dst_metrics *ip_fib_metrics_init(struct nlattr *fc_mx, + int fc_mx_len, + struct netlink_ext_ack *extack) + { +@@ -77,7 +77,7 @@ struct dst_metrics *ip_fib_metrics_init(struct net *net, struct nlattr *fc_mx, + if (unlikely(!fib_metrics)) + return ERR_PTR(-ENOMEM); + +- err = ip_metrics_convert(net, fc_mx, fc_mx_len, fib_metrics->metrics, ++ err = ip_metrics_convert(fc_mx, fc_mx_len, fib_metrics->metrics, + extack); + if (!err) { + refcount_set(&fib_metrics->refcnt, 1); +diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c +index 28ffcfbeef14..48617d99abb0 100644 +--- a/net/ipv4/tcp_cong.c ++++ b/net/ipv4/tcp_cong.c +@@ -46,8 +46,7 @@ void tcp_set_ca_state(struct sock *sk, const u8 ca_state) + } + + /* Must be called with rcu lock held */ +-static struct tcp_congestion_ops *tcp_ca_find_autoload(struct net *net, +- const char *name) ++static struct tcp_congestion_ops *tcp_ca_find_autoload(const char *name) + { + struct tcp_congestion_ops *ca = tcp_ca_find(name); + +@@ -178,7 +177,7 @@ int tcp_update_congestion_control(struct tcp_congestion_ops *ca, struct tcp_cong + return ret; + } + +-u32 tcp_ca_get_key_by_name(struct net *net, const char *name, bool *ecn_ca) ++u32 tcp_ca_get_key_by_name(const char *name, bool *ecn_ca) + { + const struct tcp_congestion_ops *ca; + u32 key = TCP_CA_UNSPEC; +@@ -186,7 +185,7 @@ u32 tcp_ca_get_key_by_name(struct net *net, const char *name, bool *ecn_ca) + might_sleep(); + + rcu_read_lock(); +- ca = tcp_ca_find_autoload(net, name); ++ ca = tcp_ca_find_autoload(name); + if (ca) { + key = ca->key; + *ecn_ca = ca->flags & TCP_CONG_NEEDS_ECN; +@@ -283,7 +282,7 @@ int tcp_set_default_congestion_control(struct net *net, const char *name) + int ret; + + rcu_read_lock(); +- ca = tcp_ca_find_autoload(net, name); ++ ca = tcp_ca_find_autoload(name); + if (!ca) { + ret = -ENOENT; + } else if (!bpf_try_module_get(ca, ca->owner)) { +@@ -421,7 +420,7 @@ int tcp_set_congestion_control(struct sock *sk, const char *name, bool load, + if (!load) + ca = tcp_ca_find(name); + else +- ca = tcp_ca_find_autoload(sock_net(sk), name); ++ ca = tcp_ca_find_autoload(name); + + /* No change asking for existing value */ + if (ca == icsk->icsk_ca_ops) { +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index c9a9506b714d..a9644a8edb96 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -3764,7 +3764,7 @@ static struct fib6_info *ip6_route_info_create(struct fib6_config *cfg, + if (!rt) + goto out; + +- rt->fib6_metrics = ip_fib_metrics_init(net, cfg->fc_mx, cfg->fc_mx_len, ++ rt->fib6_metrics = ip_fib_metrics_init(cfg->fc_mx, cfg->fc_mx_len, + extack); + if (IS_ERR(rt->fib6_metrics)) { + err = PTR_ERR(rt->fib6_metrics); +-- +2.43.0 + diff --git a/queue-6.10/net-tcp-dccp-prepare-for-tw_timer-un-pinning.patch b/queue-6.10/net-tcp-dccp-prepare-for-tw_timer-un-pinning.patch new file mode 100644 index 00000000000..b17f31744c0 --- /dev/null +++ b/queue-6.10/net-tcp-dccp-prepare-for-tw_timer-un-pinning.patch @@ -0,0 +1,217 @@ +From 164188192b0f05f840a96f6505ed8e38d3da8814 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 17:11:37 +0200 +Subject: net: tcp/dccp: prepare for tw_timer un-pinning + +From: Valentin Schneider + +[ Upstream commit b334b924c9b709bc969644fb5c406f5c9d01dceb ] + +The TCP timewait timer is proving to be problematic for setups where +scheduler CPU isolation is achieved at runtime via cpusets (as opposed to +statically via isolcpus=domains). + +What happens there is a CPU goes through tcp_time_wait(), arming the +time_wait timer, then gets isolated. TCP_TIMEWAIT_LEN later, the timer +fires, causing interference for the now-isolated CPU. This is conceptually +similar to the issue described in commit e02b93124855 ("workqueue: Unbind +kworkers before sending them to exit()") + +Move inet_twsk_schedule() to within inet_twsk_hashdance(), with the ehash +lock held. Expand the lock's critical section from inet_twsk_kill() to +inet_twsk_deschedule_put(), serializing the scheduling vs descheduling of +the timer. IOW, this prevents the following race: + + tcp_time_wait() + inet_twsk_hashdance() + inet_twsk_deschedule_put() + del_timer_sync() + inet_twsk_schedule() + +Thanks to Paolo Abeni for suggesting to leverage the ehash lock. + +This also restores a comment from commit ec94c2696f0b ("tcp/dccp: avoid +one atomic operation for timewait hashdance") as inet_twsk_hashdance() had +a "Step 1" and "Step 3" comment, but the "Step 2" had gone missing. + +inet_twsk_deschedule_put() now acquires the ehash spinlock to synchronize +with inet_twsk_hashdance_schedule(). + +To ease possible regression search, actual un-pin is done in next patch. + +Link: https://lore.kernel.org/all/ZPhpfMjSiHVjQkTk@localhost.localdomain/ +Reviewed-by: Eric Dumazet +Signed-off-by: Valentin Schneider +Co-developed-by: Florian Westphal +Signed-off-by: Florian Westphal +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/inet_timewait_sock.h | 6 ++-- + net/dccp/minisocks.c | 3 +- + net/ipv4/inet_timewait_sock.c | 52 +++++++++++++++++++++++++++----- + net/ipv4/tcp_ipv4.c | 2 +- + net/ipv4/tcp_minisocks.c | 3 +- + 5 files changed, 52 insertions(+), 14 deletions(-) + +diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h +index 2a536eea9424..5b43d220243d 100644 +--- a/include/net/inet_timewait_sock.h ++++ b/include/net/inet_timewait_sock.h +@@ -93,8 +93,10 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk, + struct inet_timewait_death_row *dr, + const int state); + +-void inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk, +- struct inet_hashinfo *hashinfo); ++void inet_twsk_hashdance_schedule(struct inet_timewait_sock *tw, ++ struct sock *sk, ++ struct inet_hashinfo *hashinfo, ++ int timeo); + + void __inet_twsk_schedule(struct inet_timewait_sock *tw, int timeo, + bool rearm); +diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c +index 251a57cf5822..deb52d7d31b4 100644 +--- a/net/dccp/minisocks.c ++++ b/net/dccp/minisocks.c +@@ -59,11 +59,10 @@ void dccp_time_wait(struct sock *sk, int state, int timeo) + * we complete the initialization. + */ + local_bh_disable(); +- inet_twsk_schedule(tw, timeo); + /* Linkage updates. + * Note that access to tw after this point is illegal. + */ +- inet_twsk_hashdance(tw, sk, &dccp_hashinfo); ++ inet_twsk_hashdance_schedule(tw, sk, &dccp_hashinfo, timeo); + local_bh_enable(); + } else { + /* Sorry, if we're out of memory, just CLOSE this +diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c +index e28075f0006e..628d33a41ce5 100644 +--- a/net/ipv4/inet_timewait_sock.c ++++ b/net/ipv4/inet_timewait_sock.c +@@ -96,9 +96,13 @@ static void inet_twsk_add_node_rcu(struct inet_timewait_sock *tw, + * Enter the time wait state. This is called with locally disabled BH. + * Essentially we whip up a timewait bucket, copy the relevant info into it + * from the SK, and mess with hash chains and list linkage. ++ * ++ * The caller must not access @tw anymore after this function returns. + */ +-void inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk, +- struct inet_hashinfo *hashinfo) ++void inet_twsk_hashdance_schedule(struct inet_timewait_sock *tw, ++ struct sock *sk, ++ struct inet_hashinfo *hashinfo, ++ int timeo) + { + const struct inet_sock *inet = inet_sk(sk); + const struct inet_connection_sock *icsk = inet_csk(sk); +@@ -129,26 +133,33 @@ void inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk, + + spin_lock(lock); + ++ /* Step 2: Hash TW into tcp ehash chain */ + inet_twsk_add_node_rcu(tw, &ehead->chain); + + /* Step 3: Remove SK from hash chain */ + if (__sk_nulls_del_node_init_rcu(sk)) + sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1); + +- spin_unlock(lock); + ++ /* Ensure above writes are committed into memory before updating the ++ * refcount. ++ * Provides ordering vs later refcount_inc(). ++ */ ++ smp_wmb(); + /* tw_refcnt is set to 3 because we have : + * - one reference for bhash chain. + * - one reference for ehash chain. + * - one reference for timer. +- * We can use atomic_set() because prior spin_lock()/spin_unlock() +- * committed into memory all tw fields. + * Also note that after this point, we lost our implicit reference + * so we are not allowed to use tw anymore. + */ + refcount_set(&tw->tw_refcnt, 3); ++ ++ inet_twsk_schedule(tw, timeo); ++ ++ spin_unlock(lock); + } +-EXPORT_SYMBOL_GPL(inet_twsk_hashdance); ++EXPORT_SYMBOL_GPL(inet_twsk_hashdance_schedule); + + static void tw_timer_handler(struct timer_list *t) + { +@@ -217,7 +228,34 @@ EXPORT_SYMBOL_GPL(inet_twsk_alloc); + */ + void inet_twsk_deschedule_put(struct inet_timewait_sock *tw) + { +- if (del_timer_sync(&tw->tw_timer)) ++ struct inet_hashinfo *hashinfo = tw->tw_dr->hashinfo; ++ spinlock_t *lock = inet_ehash_lockp(hashinfo, tw->tw_hash); ++ ++ /* inet_twsk_purge() walks over all sockets, including tw ones, ++ * and removes them via inet_twsk_deschedule_put() after a ++ * refcount_inc_not_zero(). ++ * ++ * inet_twsk_hashdance_schedule() must (re)init the refcount before ++ * arming the timer, i.e. inet_twsk_purge can obtain a reference to ++ * a twsk that did not yet schedule the timer. ++ * ++ * The ehash lock synchronizes these two: ++ * After acquiring the lock, the timer is always scheduled (else ++ * timer_shutdown returns false), because hashdance_schedule releases ++ * the ehash lock only after completing the timer initialization. ++ * ++ * Without grabbing the ehash lock, we get: ++ * 1) cpu x sets twsk refcount to 3 ++ * 2) cpu y bumps refcount to 4 ++ * 3) cpu y calls inet_twsk_deschedule_put() and shuts timer down ++ * 4) cpu x tries to start timer, but mod_timer is a noop post-shutdown ++ * -> timer refcount is never decremented. ++ */ ++ spin_lock(lock); ++ /* Makes sure hashdance_schedule() has completed */ ++ spin_unlock(lock); ++ ++ if (timer_shutdown_sync(&tw->tw_timer)) + inet_twsk_kill(tw); + inet_twsk_put(tw); + } +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index 3b7430201397..da0f50255399 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -159,7 +159,7 @@ int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp) + if (ts_recent_stamp && + (!twp || (reuse && time_after32(ktime_get_seconds(), + ts_recent_stamp)))) { +- /* inet_twsk_hashdance() sets sk_refcnt after putting twsk ++ /* inet_twsk_hashdance_schedule() sets sk_refcnt after putting twsk + * and releasing the bucket lock. + */ + if (unlikely(!refcount_inc_not_zero(&sktw->sk_refcnt))) +diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c +index 5e4a12d01622..d5da3ec8f846 100644 +--- a/net/ipv4/tcp_minisocks.c ++++ b/net/ipv4/tcp_minisocks.c +@@ -350,11 +350,10 @@ void tcp_time_wait(struct sock *sk, int state, int timeo) + * we complete the initialization. + */ + local_bh_disable(); +- inet_twsk_schedule(tw, timeo); + /* Linkage updates. + * Note that access to tw after this point is illegal. + */ +- inet_twsk_hashdance(tw, sk, net->ipv4.tcp_death_row.hashinfo); ++ inet_twsk_hashdance_schedule(tw, sk, net->ipv4.tcp_death_row.hashinfo, timeo); + local_bh_enable(); + } else { + /* Sorry, if we're out of memory, just CLOSE this +-- +2.43.0 + diff --git a/queue-6.10/pci-al-check-ioresource_bus-existence-during-probe.patch b/queue-6.10/pci-al-check-ioresource_bus-existence-during-probe.patch new file mode 100644 index 00000000000..535412f369e --- /dev/null +++ b/queue-6.10/pci-al-check-ioresource_bus-existence-during-probe.patch @@ -0,0 +1,85 @@ +From a24493cfb8f55c7489fdd94b599859513a4422f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 May 2024 15:57:05 +0300 +Subject: PCI: al: Check IORESOURCE_BUS existence during probe +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Aleksandr Mishin + +[ Upstream commit a9927c2cac6e9831361e43a14d91277818154e6a ] + +If IORESOURCE_BUS is not provided in Device Tree it will be fabricated in +of_pci_parse_bus_range(), so NULL pointer dereference should not happen +here. + +But that's hard to verify, so check for NULL anyway. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Link: https://lore.kernel.org/linux-pci/20240503125705.46055-1-amishin@t-argos.ru +Suggested-by: Bjorn Helgaas +Signed-off-by: Aleksandr Mishin +Signed-off-by: Krzysztof Wilczyński +[bhelgaas: commit log] +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-al.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pcie-al.c b/drivers/pci/controller/dwc/pcie-al.c +index 6dfdda59f328..643115f74092 100644 +--- a/drivers/pci/controller/dwc/pcie-al.c ++++ b/drivers/pci/controller/dwc/pcie-al.c +@@ -242,18 +242,24 @@ static struct pci_ops al_child_pci_ops = { + .write = pci_generic_config_write, + }; + +-static void al_pcie_config_prepare(struct al_pcie *pcie) ++static int al_pcie_config_prepare(struct al_pcie *pcie) + { + struct al_pcie_target_bus_cfg *target_bus_cfg; + struct dw_pcie_rp *pp = &pcie->pci->pp; + unsigned int ecam_bus_mask; ++ struct resource_entry *ft; + u32 cfg_control_offset; ++ struct resource *bus; + u8 subordinate_bus; + u8 secondary_bus; + u32 cfg_control; + u32 reg; +- struct resource *bus = resource_list_first_type(&pp->bridge->windows, IORESOURCE_BUS)->res; + ++ ft = resource_list_first_type(&pp->bridge->windows, IORESOURCE_BUS); ++ if (!ft) ++ return -ENODEV; ++ ++ bus = ft->res; + target_bus_cfg = &pcie->target_bus_cfg; + + ecam_bus_mask = (pcie->ecam_size >> PCIE_ECAM_BUS_SHIFT) - 1; +@@ -287,6 +293,8 @@ static void al_pcie_config_prepare(struct al_pcie *pcie) + FIELD_PREP(CFG_CONTROL_SEC_BUS_MASK, secondary_bus); + + al_pcie_controller_writel(pcie, cfg_control_offset, reg); ++ ++ return 0; + } + + static int al_pcie_host_init(struct dw_pcie_rp *pp) +@@ -305,7 +313,9 @@ static int al_pcie_host_init(struct dw_pcie_rp *pp) + if (rc) + return rc; + +- al_pcie_config_prepare(pcie); ++ rc = al_pcie_config_prepare(pcie); ++ if (rc) ++ return rc; + + return 0; + } +-- +2.43.0 + diff --git a/queue-6.10/pinctrl-core-reset-gpio_device-in-loop-in-pinctrl_pi.patch b/queue-6.10/pinctrl-core-reset-gpio_device-in-loop-in-pinctrl_pi.patch new file mode 100644 index 00000000000..5d3499e753e --- /dev/null +++ b/queue-6.10/pinctrl-core-reset-gpio_device-in-loop-in-pinctrl_pi.patch @@ -0,0 +1,45 @@ +From e86caea0a6ce903b1d778c35be3b848a3c42d3c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Apr 2024 15:58:02 +0200 +Subject: pinctrl: core: reset gpio_device in loop in pinctrl_pins_show() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Léo DUBOIN + +[ Upstream commit 9dfbcf2fc566c0be2de1c7685f29effd25696b75 ] + +We were not resetting the pointer to the associated gpio_device once +we are done displaying a pin's information. + +This meant that once we reached the end of a gpio-range, if there +were pins right after it that did not belong to any known range, +they would be associated with the previous range's gpio device. + +This resulted in those pins appearing as <4294966783:old_gdev> instead +of the expected <0:?> (due to gpio_num being -1). + +Signed-off-by: Léo DUBOIN +Link: https://lore.kernel.org/r/c40d0634abefa19e689ffd450e0f48a8d63c4fc4.1714049455.git.lduboin@freebox.fr +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c +index 4438f3b4b5ef..60f866f1e6d7 100644 +--- a/drivers/pinctrl/core.c ++++ b/drivers/pinctrl/core.c +@@ -1670,6 +1670,7 @@ static int pinctrl_pins_show(struct seq_file *s, void *what) + seq_printf(s, "pin %d (%s) ", pin, desc->name); + + #ifdef CONFIG_GPIOLIB ++ gdev = NULL; + gpio_num = -1; + list_for_each_entry(range, &pctldev->gpio_ranges, node) { + if ((pin >= range->pin_base) && +-- +2.43.0 + diff --git a/queue-6.10/pinctrl-renesas-rzg2l-validate-power-registers-for-s.patch b/queue-6.10/pinctrl-renesas-rzg2l-validate-power-registers-for-s.patch new file mode 100644 index 00000000000..3fda36b74f6 --- /dev/null +++ b/queue-6.10/pinctrl-renesas-rzg2l-validate-power-registers-for-s.patch @@ -0,0 +1,57 @@ +From 733d68b80016957bec1dfa9dab7c5064e14f3bdc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 May 2024 18:38:48 +0100 +Subject: pinctrl: renesas: rzg2l: Validate power registers for SD and ETH + +From: Lad Prabhakar + +[ Upstream commit a3a632ed87f0913779092c30bd0ea7dfd81601f3 ] + +On RZ/V2H(P) SoC, the power registers for SD and ETH do not exist, +resulting in invalid register offsets. Ensure that the register offsets +are valid before any read/write operations are performed. If the power +registers are not available, both SD and ETH will be set to '0'. + +Signed-off-by: Lad Prabhakar +Reviewed-by: Geert Uytterhoeven +Tested-by: Claudiu Beznea # on RZ/G3S +Link: https://lore.kernel.org/r/20240530173857.164073-7-prabhakar.mahadev-lad.rj@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pinctrl-rzg2l.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/pinctrl/renesas/pinctrl-rzg2l.c b/drivers/pinctrl/renesas/pinctrl-rzg2l.c +index 60be78da9f52..389602e4d7ab 100644 +--- a/drivers/pinctrl/renesas/pinctrl-rzg2l.c ++++ b/drivers/pinctrl/renesas/pinctrl-rzg2l.c +@@ -2583,8 +2583,10 @@ static int rzg2l_pinctrl_suspend_noirq(struct device *dev) + rzg2l_pinctrl_pm_setup_dedicated_regs(pctrl, true); + + for (u8 i = 0; i < 2; i++) { +- cache->sd_ch[i] = readb(pctrl->base + SD_CH(regs->sd_ch, i)); +- cache->eth_poc[i] = readb(pctrl->base + ETH_POC(regs->eth_poc, i)); ++ if (regs->sd_ch) ++ cache->sd_ch[i] = readb(pctrl->base + SD_CH(regs->sd_ch, i)); ++ if (regs->eth_poc) ++ cache->eth_poc[i] = readb(pctrl->base + ETH_POC(regs->eth_poc, i)); + } + + cache->qspi = readb(pctrl->base + QSPI); +@@ -2615,8 +2617,10 @@ static int rzg2l_pinctrl_resume_noirq(struct device *dev) + writeb(cache->qspi, pctrl->base + QSPI); + writeb(cache->eth_mode, pctrl->base + ETH_MODE); + for (u8 i = 0; i < 2; i++) { +- writeb(cache->sd_ch[i], pctrl->base + SD_CH(regs->sd_ch, i)); +- writeb(cache->eth_poc[i], pctrl->base + ETH_POC(regs->eth_poc, i)); ++ if (regs->sd_ch) ++ writeb(cache->sd_ch[i], pctrl->base + SD_CH(regs->sd_ch, i)); ++ if (regs->eth_poc) ++ writeb(cache->eth_poc[i], pctrl->base + ETH_POC(regs->eth_poc, i)); + } + + rzg2l_pinctrl_pm_setup_pfc(pctrl); +-- +2.43.0 + diff --git a/queue-6.10/platform-chrome-cros_ec_lpc-mec-access-can-use-an-am.patch b/queue-6.10/platform-chrome-cros_ec_lpc-mec-access-can-use-an-am.patch new file mode 100644 index 00000000000..653af0a559e --- /dev/null +++ b/queue-6.10/platform-chrome-cros_ec_lpc-mec-access-can-use-an-am.patch @@ -0,0 +1,178 @@ +From 250d6da35a83929d562e7f713e7af5fb0d76decb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jun 2024 07:33:48 +0100 +Subject: platform/chrome: cros_ec_lpc: MEC access can use an AML mutex + +From: Ben Walsh + +[ Upstream commit 60c7df66450e3a7821a8d68496c20c95de6a15c5 ] + +Framework Laptops have ACPI code which accesses the MEC memory. It +uses an AML mutex to prevent concurrent access. But the cros_ec_lpc +driver was not aware of this mutex. The ACPI code and LPC driver both +attempted to talk to the EC at the same time, messing up communication +with the EC. + +Allow the LPC driver MEC code to find and use the AML mutex. + +Tested-by: Dustin L. Howett +Signed-off-by: Ben Walsh +Link: https://lore.kernel.org/r/20240605063351.14836-3-ben@jubnut.com +Signed-off-by: Tzung-Bi Shih +Signed-off-by: Sasha Levin +--- + drivers/platform/chrome/cros_ec_lpc_mec.c | 76 ++++++++++++++++++++++- + drivers/platform/chrome/cros_ec_lpc_mec.h | 11 ++++ + 2 files changed, 85 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/chrome/cros_ec_lpc_mec.c b/drivers/platform/chrome/cros_ec_lpc_mec.c +index 0d9c79b270ce..63b6b261b8e5 100644 +--- a/drivers/platform/chrome/cros_ec_lpc_mec.c ++++ b/drivers/platform/chrome/cros_ec_lpc_mec.c +@@ -10,13 +10,65 @@ + + #include "cros_ec_lpc_mec.h" + ++#define ACPI_LOCK_DELAY_MS 500 ++ + /* + * This mutex must be held while accessing the EMI unit. We can't rely on the + * EC mutex because memmap data may be accessed without it being held. + */ + static DEFINE_MUTEX(io_mutex); ++/* ++ * An alternative mutex to be used when the ACPI AML code may also ++ * access memmap data. When set, this mutex is used in preference to ++ * io_mutex. ++ */ ++static acpi_handle aml_mutex; ++ + static u16 mec_emi_base, mec_emi_end; + ++/** ++ * cros_ec_lpc_mec_lock() - Acquire mutex for EMI ++ * ++ * @return: Negative error code, or zero for success ++ */ ++static int cros_ec_lpc_mec_lock(void) ++{ ++ bool success; ++ ++ if (!aml_mutex) { ++ mutex_lock(&io_mutex); ++ return 0; ++ } ++ ++ success = ACPI_SUCCESS(acpi_acquire_mutex(aml_mutex, ++ NULL, ACPI_LOCK_DELAY_MS)); ++ if (!success) ++ return -EBUSY; ++ ++ return 0; ++} ++ ++/** ++ * cros_ec_lpc_mec_unlock() - Release mutex for EMI ++ * ++ * @return: Negative error code, or zero for success ++ */ ++static int cros_ec_lpc_mec_unlock(void) ++{ ++ bool success; ++ ++ if (!aml_mutex) { ++ mutex_unlock(&io_mutex); ++ return 0; ++ } ++ ++ success = ACPI_SUCCESS(acpi_release_mutex(aml_mutex, NULL)); ++ if (!success) ++ return -EBUSY; ++ ++ return 0; ++} ++ + /** + * cros_ec_lpc_mec_emi_write_address() - Initialize EMI at a given address. + * +@@ -77,6 +129,7 @@ u8 cros_ec_lpc_io_bytes_mec(enum cros_ec_lpc_mec_io_type io_type, + int io_addr; + u8 sum = 0; + enum cros_ec_lpc_mec_emi_access_mode access, new_access; ++ int ret; + + /* Return checksum of 0 if window is not initialized */ + WARN_ON(mec_emi_base == 0 || mec_emi_end == 0); +@@ -92,7 +145,9 @@ u8 cros_ec_lpc_io_bytes_mec(enum cros_ec_lpc_mec_io_type io_type, + else + access = ACCESS_TYPE_LONG_AUTO_INCREMENT; + +- mutex_lock(&io_mutex); ++ ret = cros_ec_lpc_mec_lock(); ++ if (ret) ++ return ret; + + /* Initialize I/O at desired address */ + cros_ec_lpc_mec_emi_write_address(offset, access); +@@ -134,7 +189,9 @@ u8 cros_ec_lpc_io_bytes_mec(enum cros_ec_lpc_mec_io_type io_type, + } + + done: +- mutex_unlock(&io_mutex); ++ ret = cros_ec_lpc_mec_unlock(); ++ if (ret) ++ return ret; + + return sum; + } +@@ -146,3 +203,18 @@ void cros_ec_lpc_mec_init(unsigned int base, unsigned int end) + mec_emi_end = end; + } + EXPORT_SYMBOL(cros_ec_lpc_mec_init); ++ ++int cros_ec_lpc_mec_acpi_mutex(struct acpi_device *adev, const char *pathname) ++{ ++ int status; ++ ++ if (!adev) ++ return -ENOENT; ++ ++ status = acpi_get_handle(adev->handle, pathname, &aml_mutex); ++ if (ACPI_FAILURE(status)) ++ return -ENOENT; ++ ++ return 0; ++} ++EXPORT_SYMBOL(cros_ec_lpc_mec_acpi_mutex); +diff --git a/drivers/platform/chrome/cros_ec_lpc_mec.h b/drivers/platform/chrome/cros_ec_lpc_mec.h +index 9d0521b23e8a..3f3af37e58a5 100644 +--- a/drivers/platform/chrome/cros_ec_lpc_mec.h ++++ b/drivers/platform/chrome/cros_ec_lpc_mec.h +@@ -8,6 +8,8 @@ + #ifndef __CROS_EC_LPC_MEC_H + #define __CROS_EC_LPC_MEC_H + ++#include ++ + enum cros_ec_lpc_mec_emi_access_mode { + /* 8-bit access */ + ACCESS_TYPE_BYTE = 0x0, +@@ -45,6 +47,15 @@ enum cros_ec_lpc_mec_io_type { + */ + void cros_ec_lpc_mec_init(unsigned int base, unsigned int end); + ++/** ++ * cros_ec_lpc_mec_acpi_mutex() - Find and set ACPI mutex for MEC ++ * ++ * @adev: Parent ACPI device ++ * @pathname: Name of AML mutex ++ * @return: Negative error code, or zero for success ++ */ ++int cros_ec_lpc_mec_acpi_mutex(struct acpi_device *adev, const char *pathname); ++ + /** + * cros_ec_lpc_mec_in_range() - Determine if addresses are in MEC EMI range. + * +-- +2.43.0 + diff --git a/queue-6.10/pwm-xilinx-fix-u32-overflow-issue-in-32-bit-width-pw.patch b/queue-6.10/pwm-xilinx-fix-u32-overflow-issue-in-32-bit-width-pw.patch new file mode 100644 index 00000000000..baff4724290 --- /dev/null +++ b/queue-6.10/pwm-xilinx-fix-u32-overflow-issue-in-32-bit-width-pw.patch @@ -0,0 +1,59 @@ +From bb166462f96c3f1a8b859331ed663cb37f3f370c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Dec 2022 16:07:15 +0000 +Subject: pwm: xilinx: Fix u32 overflow issue in 32-bit width PWM mode. + +From: Ken Sloat + +[ Upstream commit 56f45266df67aa0f5b2a6881c8c4d16dbfff6b7d ] + +This timer HW supports 8, 16 and 32-bit timer widths. This +driver currently uses a u32 to store the max possible value +of the timer. However, statements perform addition of 2 in +xilinx_pwm_apply() when calculating the period_cycles and +duty_cycles values. Since priv->max is a u32, this will +result in an overflow to 1 which will not only be incorrect +but fail on range comparison. This results in making it +impossible to set the PWM in this timer mode. + +There are two obvious solutions to the current problem: +1. Cast each instance where overflow occurs to u64. +2. Change priv->max from a u32 to a u64. + +Solution #1 requires more code modifications, and leaves +opportunity to introduce similar overflows if other math +statements are added in the future. These may also go +undetected if running in non 32-bit timer modes. + +Solution #2 is the much smaller and cleaner approach and +thus the chosen method in this patch. + +This was tested on a Zynq UltraScale+ with multiple +instances of the PWM IP. + +Signed-off-by: Ken Sloat +Reviewed-by: Michal Simek +Reviewed-by: Sean Anderson +Link: https://lore.kernel.org/r/SJ0P222MB0107490C5371B848EF04351CA1E19@SJ0P222MB0107.NAMP222.PROD.OUTLOOK.COM +Signed-off-by: Michal Simek +Signed-off-by: Sasha Levin +--- + include/clocksource/timer-xilinx.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/clocksource/timer-xilinx.h b/include/clocksource/timer-xilinx.h +index c0f56fe6d22a..d116f18de899 100644 +--- a/include/clocksource/timer-xilinx.h ++++ b/include/clocksource/timer-xilinx.h +@@ -41,7 +41,7 @@ struct regmap; + struct xilinx_timer_priv { + struct regmap *map; + struct clk *clk; +- u32 max; ++ u64 max; + }; + + /** +-- +2.43.0 + diff --git a/queue-6.10/ras-amd-atl-validate-address-map-when-information-is.patch b/queue-6.10/ras-amd-atl-validate-address-map-when-information-is.patch new file mode 100644 index 00000000000..3874f3001e7 --- /dev/null +++ b/queue-6.10/ras-amd-atl-validate-address-map-when-information-is.patch @@ -0,0 +1,205 @@ +From ffe6d04f7aa3e1d1a31333f4f20cac3448afa249 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 20:33:11 +0000 +Subject: RAS/AMD/ATL: Validate address map when information is gathered + +From: John Allen + +[ Upstream commit d5811a165caf63a69cd8ae11156b8587cc57d1d1 ] + +Validate address maps at the time the information is gathered as the +address map will not change during translation. + +Signed-off-by: John Allen +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Yazen Ghannam +Link: https://lore.kernel.org/r/20240606203313.51197-5-john.allen@amd.com +Signed-off-by: Sasha Levin +--- + drivers/ras/amd/atl/dehash.c | 43 -------------------- + drivers/ras/amd/atl/map.c | 77 ++++++++++++++++++++++++++++++++++++ + 2 files changed, 77 insertions(+), 43 deletions(-) + +diff --git a/drivers/ras/amd/atl/dehash.c b/drivers/ras/amd/atl/dehash.c +index 4ea46262c4f5..d4ee7ecabaee 100644 +--- a/drivers/ras/amd/atl/dehash.c ++++ b/drivers/ras/amd/atl/dehash.c +@@ -12,41 +12,10 @@ + + #include "internal.h" + +-/* +- * Verify the interleave bits are correct in the different interleaving +- * settings. +- * +- * If @num_intlv_dies and/or @num_intlv_sockets are 1, it means the +- * respective interleaving is disabled. +- */ +-static inline bool map_bits_valid(struct addr_ctx *ctx, u8 bit1, u8 bit2, +- u8 num_intlv_dies, u8 num_intlv_sockets) +-{ +- if (!(ctx->map.intlv_bit_pos == bit1 || ctx->map.intlv_bit_pos == bit2)) { +- pr_debug("Invalid interleave bit: %u", ctx->map.intlv_bit_pos); +- return false; +- } +- +- if (ctx->map.num_intlv_dies > num_intlv_dies) { +- pr_debug("Invalid number of interleave dies: %u", ctx->map.num_intlv_dies); +- return false; +- } +- +- if (ctx->map.num_intlv_sockets > num_intlv_sockets) { +- pr_debug("Invalid number of interleave sockets: %u", ctx->map.num_intlv_sockets); +- return false; +- } +- +- return true; +-} +- + static int df2_dehash_addr(struct addr_ctx *ctx) + { + u8 hashed_bit, intlv_bit, intlv_bit_pos; + +- if (!map_bits_valid(ctx, 8, 9, 1, 1)) +- return -EINVAL; +- + intlv_bit_pos = ctx->map.intlv_bit_pos; + intlv_bit = !!(BIT_ULL(intlv_bit_pos) & ctx->ret_addr); + +@@ -67,9 +36,6 @@ static int df3_dehash_addr(struct addr_ctx *ctx) + bool hash_ctl_64k, hash_ctl_2M, hash_ctl_1G; + u8 hashed_bit, intlv_bit, intlv_bit_pos; + +- if (!map_bits_valid(ctx, 8, 9, 1, 1)) +- return -EINVAL; +- + hash_ctl_64k = FIELD_GET(DF3_HASH_CTL_64K, ctx->map.ctl); + hash_ctl_2M = FIELD_GET(DF3_HASH_CTL_2M, ctx->map.ctl); + hash_ctl_1G = FIELD_GET(DF3_HASH_CTL_1G, ctx->map.ctl); +@@ -171,9 +137,6 @@ static int df4_dehash_addr(struct addr_ctx *ctx) + bool hash_ctl_64k, hash_ctl_2M, hash_ctl_1G; + u8 hashed_bit, intlv_bit; + +- if (!map_bits_valid(ctx, 8, 8, 1, 2)) +- return -EINVAL; +- + hash_ctl_64k = FIELD_GET(DF4_HASH_CTL_64K, ctx->map.ctl); + hash_ctl_2M = FIELD_GET(DF4_HASH_CTL_2M, ctx->map.ctl); + hash_ctl_1G = FIELD_GET(DF4_HASH_CTL_1G, ctx->map.ctl); +@@ -247,9 +210,6 @@ static int df4p5_dehash_addr(struct addr_ctx *ctx) + u8 hashed_bit, intlv_bit; + u64 rehash_vector; + +- if (!map_bits_valid(ctx, 8, 8, 1, 2)) +- return -EINVAL; +- + hash_ctl_64k = FIELD_GET(DF4_HASH_CTL_64K, ctx->map.ctl); + hash_ctl_2M = FIELD_GET(DF4_HASH_CTL_2M, ctx->map.ctl); + hash_ctl_1G = FIELD_GET(DF4_HASH_CTL_1G, ctx->map.ctl); +@@ -360,9 +320,6 @@ static int mi300_dehash_addr(struct addr_ctx *ctx) + bool hashed_bit, intlv_bit, test_bit; + u8 num_intlv_bits, base_bit, i; + +- if (!map_bits_valid(ctx, 8, 8, 4, 1)) +- return -EINVAL; +- + hash_ctl_4k = FIELD_GET(DF4p5_HASH_CTL_4K, ctx->map.ctl); + hash_ctl_64k = FIELD_GET(DF4_HASH_CTL_64K, ctx->map.ctl); + hash_ctl_2M = FIELD_GET(DF4_HASH_CTL_2M, ctx->map.ctl); +diff --git a/drivers/ras/amd/atl/map.c b/drivers/ras/amd/atl/map.c +index 8b908e8d7495..04419923f088 100644 +--- a/drivers/ras/amd/atl/map.c ++++ b/drivers/ras/amd/atl/map.c +@@ -642,6 +642,79 @@ static int get_global_map_data(struct addr_ctx *ctx) + return 0; + } + ++/* ++ * Verify the interleave bits are correct in the different interleaving ++ * settings. ++ * ++ * If @num_intlv_dies and/or @num_intlv_sockets are 1, it means the ++ * respective interleaving is disabled. ++ */ ++static inline bool map_bits_valid(struct addr_ctx *ctx, u8 bit1, u8 bit2, ++ u8 num_intlv_dies, u8 num_intlv_sockets) ++{ ++ if (!(ctx->map.intlv_bit_pos == bit1 || ctx->map.intlv_bit_pos == bit2)) { ++ pr_debug("Invalid interleave bit: %u", ctx->map.intlv_bit_pos); ++ return false; ++ } ++ ++ if (ctx->map.num_intlv_dies > num_intlv_dies) { ++ pr_debug("Invalid number of interleave dies: %u", ctx->map.num_intlv_dies); ++ return false; ++ } ++ ++ if (ctx->map.num_intlv_sockets > num_intlv_sockets) { ++ pr_debug("Invalid number of interleave sockets: %u", ctx->map.num_intlv_sockets); ++ return false; ++ } ++ ++ return true; ++} ++ ++static int validate_address_map(struct addr_ctx *ctx) ++{ ++ switch (ctx->map.intlv_mode) { ++ case DF2_2CHAN_HASH: ++ case DF3_COD4_2CHAN_HASH: ++ case DF3_COD2_4CHAN_HASH: ++ case DF3_COD1_8CHAN_HASH: ++ if (!map_bits_valid(ctx, 8, 9, 1, 1)) ++ goto err; ++ break; ++ ++ case DF4_NPS4_2CHAN_HASH: ++ case DF4_NPS2_4CHAN_HASH: ++ case DF4_NPS1_8CHAN_HASH: ++ case DF4p5_NPS4_2CHAN_1K_HASH: ++ case DF4p5_NPS4_2CHAN_2K_HASH: ++ case DF4p5_NPS2_4CHAN_1K_HASH: ++ case DF4p5_NPS2_4CHAN_2K_HASH: ++ case DF4p5_NPS1_8CHAN_1K_HASH: ++ case DF4p5_NPS1_8CHAN_2K_HASH: ++ case DF4p5_NPS1_16CHAN_1K_HASH: ++ case DF4p5_NPS1_16CHAN_2K_HASH: ++ if (!map_bits_valid(ctx, 8, 8, 1, 2)) ++ goto err; ++ break; ++ ++ case MI3_HASH_8CHAN: ++ case MI3_HASH_16CHAN: ++ case MI3_HASH_32CHAN: ++ if (!map_bits_valid(ctx, 8, 8, 4, 1)) ++ goto err; ++ break; ++ ++ /* Nothing to do for modes that don't need special validation checks. */ ++ default: ++ break; ++ } ++ ++ return 0; ++ ++err: ++ atl_debug(ctx, "Inconsistent address map"); ++ return -EINVAL; ++} ++ + static void dump_address_map(struct dram_addr_map *map) + { + u8 i; +@@ -678,5 +751,9 @@ int get_address_map(struct addr_ctx *ctx) + + dump_address_map(&ctx->map); + ++ ret = validate_address_map(ctx); ++ if (ret) ++ return ret; ++ + return ret; + } +-- +2.43.0 + diff --git a/queue-6.10/rcu-nocb-remove-buggy-bypass-lock-contention-mitigat.patch b/queue-6.10/rcu-nocb-remove-buggy-bypass-lock-contention-mitigat.patch new file mode 100644 index 00000000000..682f5684a97 --- /dev/null +++ b/queue-6.10/rcu-nocb-remove-buggy-bypass-lock-contention-mitigat.patch @@ -0,0 +1,140 @@ +From 4c229c2be47fd4248d8da6d7466982318acd93c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Apr 2024 16:18:35 +0200 +Subject: rcu/nocb: Remove buggy bypass lock contention mitigation + +From: Frederic Weisbecker + +[ Upstream commit e4f78057291608f6968a6789c5ebb3bde7d95504 ] + +The bypass lock contention mitigation assumes there can be at most +2 contenders on the bypass lock, following this scheme: + +1) One kthread takes the bypass lock +2) Another one spins on it and increment the contended counter +3) A third one (a bypass enqueuer) sees the contended counter on and + busy loops waiting on it to decrement. + +However this assumption is wrong. There can be only one CPU to find the +lock contended because call_rcu() (the bypass enqueuer) is the only +bypass lock acquire site that may not already hold the NOCB lock +beforehand, all the other sites must first contend on the NOCB lock. +Therefore step 2) is impossible. + +The other problem is that the mitigation assumes that contenders all +belong to the same rdp CPU, which is also impossible for a raw spinlock. +In theory the warning could trigger if the enqueuer holds the bypass +lock and another CPU flushes the bypass queue concurrently but this is +prevented from all flush users: + +1) NOCB kthreads only flush if they successfully _tried_ to lock the + bypass lock. So no contention management here. + +2) Flush on callbacks migration happen remotely when the CPU is offline. + No concurrency against bypass enqueue. + +3) Flush on deoffloading happen either locally with IRQs disabled or + remotely when the CPU is not yet online. No concurrency against + bypass enqueue. + +4) Flush on barrier entrain happen either locally with IRQs disabled or + remotely when the CPU is offline. No concurrency against + bypass enqueue. + +For those reasons, the bypass lock contention mitigation isn't needed +and is even wrong. Remove it but keep the warning reporting a contended +bypass lock on a remote CPU, to keep unexpected contention awareness. + +Signed-off-by: Frederic Weisbecker +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + kernel/rcu/tree.h | 1 - + kernel/rcu/tree_nocb.h | 32 ++++++-------------------------- + 2 files changed, 6 insertions(+), 27 deletions(-) + +diff --git a/kernel/rcu/tree.h b/kernel/rcu/tree.h +index bae7925c497f..179f60ca0313 100644 +--- a/kernel/rcu/tree.h ++++ b/kernel/rcu/tree.h +@@ -223,7 +223,6 @@ struct rcu_data { + struct swait_queue_head nocb_state_wq; /* For offloading state changes */ + struct task_struct *nocb_gp_kthread; + raw_spinlock_t nocb_lock; /* Guard following pair of fields. */ +- atomic_t nocb_lock_contended; /* Contention experienced. */ + int nocb_defer_wakeup; /* Defer wakeup of nocb_kthread. */ + struct timer_list nocb_timer; /* Enforce finite deferral. */ + unsigned long nocb_gp_adv_time; /* Last call_rcu() CB adv (jiffies). */ +diff --git a/kernel/rcu/tree_nocb.h b/kernel/rcu/tree_nocb.h +index 3f85577bddd4..2d9eed2bf750 100644 +--- a/kernel/rcu/tree_nocb.h ++++ b/kernel/rcu/tree_nocb.h +@@ -91,8 +91,7 @@ module_param(nocb_nobypass_lim_per_jiffy, int, 0); + + /* + * Acquire the specified rcu_data structure's ->nocb_bypass_lock. If the +- * lock isn't immediately available, increment ->nocb_lock_contended to +- * flag the contention. ++ * lock isn't immediately available, perform minimal sanity check. + */ + static void rcu_nocb_bypass_lock(struct rcu_data *rdp) + __acquires(&rdp->nocb_bypass_lock) +@@ -100,29 +99,12 @@ static void rcu_nocb_bypass_lock(struct rcu_data *rdp) + lockdep_assert_irqs_disabled(); + if (raw_spin_trylock(&rdp->nocb_bypass_lock)) + return; +- atomic_inc(&rdp->nocb_lock_contended); ++ /* ++ * Contention expected only when local enqueue collide with ++ * remote flush from kthreads. ++ */ + WARN_ON_ONCE(smp_processor_id() != rdp->cpu); +- smp_mb__after_atomic(); /* atomic_inc() before lock. */ + raw_spin_lock(&rdp->nocb_bypass_lock); +- smp_mb__before_atomic(); /* atomic_dec() after lock. */ +- atomic_dec(&rdp->nocb_lock_contended); +-} +- +-/* +- * Spinwait until the specified rcu_data structure's ->nocb_lock is +- * not contended. Please note that this is extremely special-purpose, +- * relying on the fact that at most two kthreads and one CPU contend for +- * this lock, and also that the two kthreads are guaranteed to have frequent +- * grace-period-duration time intervals between successive acquisitions +- * of the lock. This allows us to use an extremely simple throttling +- * mechanism, and further to apply it only to the CPU doing floods of +- * call_rcu() invocations. Don't try this at home! +- */ +-static void rcu_nocb_wait_contended(struct rcu_data *rdp) +-{ +- WARN_ON_ONCE(smp_processor_id() != rdp->cpu); +- while (WARN_ON_ONCE(atomic_read(&rdp->nocb_lock_contended))) +- cpu_relax(); + } + + /* +@@ -510,7 +492,6 @@ static bool rcu_nocb_try_bypass(struct rcu_data *rdp, struct rcu_head *rhp, + } + + // We need to use the bypass. +- rcu_nocb_wait_contended(rdp); + rcu_nocb_bypass_lock(rdp); + ncbs = rcu_cblist_n_cbs(&rdp->nocb_bypass); + rcu_segcblist_inc_len(&rdp->cblist); /* Must precede enqueue. */ +@@ -1678,12 +1659,11 @@ static void show_rcu_nocb_state(struct rcu_data *rdp) + + sprintf(bufw, "%ld", rsclp->gp_seq[RCU_WAIT_TAIL]); + sprintf(bufr, "%ld", rsclp->gp_seq[RCU_NEXT_READY_TAIL]); +- pr_info(" CB %d^%d->%d %c%c%c%c%c%c F%ld L%ld C%d %c%c%s%c%s%c%c q%ld %c CPU %d%s\n", ++ pr_info(" CB %d^%d->%d %c%c%c%c%c F%ld L%ld C%d %c%c%s%c%s%c%c q%ld %c CPU %d%s\n", + rdp->cpu, rdp->nocb_gp_rdp->cpu, + nocb_next_rdp ? nocb_next_rdp->cpu : -1, + "kK"[!!rdp->nocb_cb_kthread], + "bB"[raw_spin_is_locked(&rdp->nocb_bypass_lock)], +- "cC"[!!atomic_read(&rdp->nocb_lock_contended)], + "lL"[raw_spin_is_locked(&rdp->nocb_lock)], + "sS"[!!rdp->nocb_cb_sleep], + ".W"[swait_active(&rdp->nocb_cb_wq)], +-- +2.43.0 + diff --git a/queue-6.10/rdma-efa-properly-handle-unexpected-aq-completions.patch b/queue-6.10/rdma-efa-properly-handle-unexpected-aq-completions.patch new file mode 100644 index 00000000000..d619d49de54 --- /dev/null +++ b/queue-6.10/rdma-efa-properly-handle-unexpected-aq-completions.patch @@ -0,0 +1,112 @@ +From c600d0f7d858958e9dd1b97d9d5bbffccf9817ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 May 2024 06:46:30 +0000 +Subject: RDMA/efa: Properly handle unexpected AQ completions + +From: Michael Margolin + +[ Upstream commit 2d0e7ba468eae365f3c4bc9266679e1f8dd405f0 ] + +Do not try to handle admin command completion if it has an unexpected +command id and print a relevant error message. + +Reviewed-by: Firas Jahjah +Reviewed-by: Yehuda Yitschak +Signed-off-by: Michael Margolin +Link: https://lore.kernel.org/r/20240513064630.6247-1-mrgolin@amazon.com +Reviewed-by: Gal Pressman +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/efa/efa_com.c | 30 ++++++++++++++++------------- + 1 file changed, 17 insertions(+), 13 deletions(-) + +diff --git a/drivers/infiniband/hw/efa/efa_com.c b/drivers/infiniband/hw/efa/efa_com.c +index 16a24a05fc2a..bafd210dd43e 100644 +--- a/drivers/infiniband/hw/efa/efa_com.c ++++ b/drivers/infiniband/hw/efa/efa_com.c +@@ -1,6 +1,6 @@ + // SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause + /* +- * Copyright 2018-2021 Amazon.com, Inc. or its affiliates. All rights reserved. ++ * Copyright 2018-2024 Amazon.com, Inc. or its affiliates. All rights reserved. + */ + + #include "efa_com.h" +@@ -406,8 +406,8 @@ static struct efa_comp_ctx *efa_com_submit_admin_cmd(struct efa_com_admin_queue + return comp_ctx; + } + +-static void efa_com_handle_single_admin_completion(struct efa_com_admin_queue *aq, +- struct efa_admin_acq_entry *cqe) ++static int efa_com_handle_single_admin_completion(struct efa_com_admin_queue *aq, ++ struct efa_admin_acq_entry *cqe) + { + struct efa_comp_ctx *comp_ctx; + u16 cmd_id; +@@ -416,11 +416,11 @@ static void efa_com_handle_single_admin_completion(struct efa_com_admin_queue *a + EFA_ADMIN_ACQ_COMMON_DESC_COMMAND_ID); + + comp_ctx = efa_com_get_comp_ctx(aq, cmd_id, false); +- if (!comp_ctx) { ++ if (comp_ctx->status != EFA_CMD_SUBMITTED) { + ibdev_err(aq->efa_dev, +- "comp_ctx is NULL. Changing the admin queue running state\n"); +- clear_bit(EFA_AQ_STATE_RUNNING_BIT, &aq->state); +- return; ++ "Received completion with unexpected command id[%d], sq producer: %d, sq consumer: %d, cq consumer: %d\n", ++ cmd_id, aq->sq.pc, aq->sq.cc, aq->cq.cc); ++ return -EINVAL; + } + + comp_ctx->status = EFA_CMD_COMPLETED; +@@ -428,14 +428,17 @@ static void efa_com_handle_single_admin_completion(struct efa_com_admin_queue *a + + if (!test_bit(EFA_AQ_STATE_POLLING_BIT, &aq->state)) + complete(&comp_ctx->wait_event); ++ ++ return 0; + } + + static void efa_com_handle_admin_completion(struct efa_com_admin_queue *aq) + { + struct efa_admin_acq_entry *cqe; + u16 queue_size_mask; +- u16 comp_num = 0; ++ u16 comp_cmds = 0; + u8 phase; ++ int err; + u16 ci; + + queue_size_mask = aq->depth - 1; +@@ -453,10 +456,12 @@ static void efa_com_handle_admin_completion(struct efa_com_admin_queue *aq) + * phase bit was validated + */ + dma_rmb(); +- efa_com_handle_single_admin_completion(aq, cqe); ++ err = efa_com_handle_single_admin_completion(aq, cqe); ++ if (!err) ++ comp_cmds++; + ++ aq->cq.cc++; + ci++; +- comp_num++; + if (ci == aq->depth) { + ci = 0; + phase = !phase; +@@ -465,10 +470,9 @@ static void efa_com_handle_admin_completion(struct efa_com_admin_queue *aq) + cqe = &aq->cq.entries[ci]; + } + +- aq->cq.cc += comp_num; + aq->cq.phase = phase; +- aq->sq.cc += comp_num; +- atomic64_add(comp_num, &aq->stats.completed_cmd); ++ aq->sq.cc += comp_cmds; ++ atomic64_add(comp_cmds, &aq->stats.completed_cmd); + } + + static int efa_com_comp_status_to_errno(u8 comp_status) +-- +2.43.0 + diff --git a/queue-6.10/regmap-spi-fix-potential-off-by-one-when-calculating.patch b/queue-6.10/regmap-spi-fix-potential-off-by-one-when-calculating.patch new file mode 100644 index 00000000000..56933df693d --- /dev/null +++ b/queue-6.10/regmap-spi-fix-potential-off-by-one-when-calculating.patch @@ -0,0 +1,47 @@ +From ad36f317553415236c0e6f824e15a68d9f03ea88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jun 2024 23:53:15 +0300 +Subject: regmap: spi: Fix potential off-by-one when calculating reserved size + +From: Andy Shevchenko + +[ Upstream commit d4ea1d504d2701ba04412f98dc00d45a104c52ab ] + +If we ever meet a hardware that uses weird register bits and padding, +we may end up in off-by-one error since x/8 + y/8 might not be equal +to (x + y)/8 in some cases. + +bits pad x/8+y/8 (x+y)/8 +4..7 0..3 0 0 // x + y from 4 up to 7 +4..7 4..7 0 1 // x + y from 8 up to 11 +4..7 8..11 1 1 // x + y from 12 up to 15 +8..15 0..7 1 1 // x + y from 8 up to 15 +8..15 8..15 2 2 // x + y from 16 up to 23 + +Fix this by using (x+y)/8. + +Signed-off-by: Andy Shevchenko +Link: https://msgid.link/r/20240605205315.19132-1-andy.shevchenko@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap-spi.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/base/regmap/regmap-spi.c b/drivers/base/regmap/regmap-spi.c +index 094cf2a2ca3c..14b1d88997cb 100644 +--- a/drivers/base/regmap/regmap-spi.c ++++ b/drivers/base/regmap/regmap-spi.c +@@ -122,8 +122,7 @@ static const struct regmap_bus *regmap_get_spi_bus(struct spi_device *spi, + return ERR_PTR(-ENOMEM); + + max_msg_size = spi_max_message_size(spi); +- reg_reserve_size = config->reg_bits / BITS_PER_BYTE +- + config->pad_bits / BITS_PER_BYTE; ++ reg_reserve_size = (config->reg_bits + config->pad_bits) / BITS_PER_BYTE; + if (max_size + reg_reserve_size > max_msg_size) + max_size -= reg_reserve_size; + +-- +2.43.0 + diff --git a/queue-6.10/remoteproc-mediatek-zero-out-only-remaining-bytes-of.patch b/queue-6.10/remoteproc-mediatek-zero-out-only-remaining-bytes-of.patch new file mode 100644 index 00000000000..4e68a831b41 --- /dev/null +++ b/queue-6.10/remoteproc-mediatek-zero-out-only-remaining-bytes-of.patch @@ -0,0 +1,38 @@ +From 7cb985567fff3e600302452ce7228a62e6d701d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 May 2024 13:27:24 +0200 +Subject: remoteproc: mediatek: Zero out only remaining bytes of IPI buffer + +From: AngeloGioacchino Del Regno + +[ Upstream commit 9dbd9962cfe56d210be5232349851420b5f9c8f6 ] + +In scp_ipi_handler(), instead of zeroing out the entire shared +buffer, which may be as large as 600 bytes, overwrite it with the +received data, then zero out only the remaining bytes. + +Signed-off-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20240520112724.139945-1-angelogioacchino.delregno@collabora.com +Signed-off-by: Mathieu Poirier +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/mtk_scp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/remoteproc/mtk_scp.c b/drivers/remoteproc/mtk_scp.c +index abf7b371b860..e744c07507ee 100644 +--- a/drivers/remoteproc/mtk_scp.c ++++ b/drivers/remoteproc/mtk_scp.c +@@ -117,8 +117,8 @@ static void scp_ipi_handler(struct mtk_scp *scp) + return; + } + +- memset(scp->share_buf, 0, scp_sizes->ipi_share_buffer_size); + memcpy_fromio(scp->share_buf, &rcv_obj->share_buf, len); ++ memset(&scp->share_buf[len], 0, scp_sizes->ipi_share_buffer_size - len); + handler(scp->share_buf, len, ipi_desc[id].priv); + scp_ipi_unlock(scp, id); + +-- +2.43.0 + diff --git a/queue-6.10/remoteproc-qcom_q6v5_pas-add-hwspinlock-bust-on-stop.patch b/queue-6.10/remoteproc-qcom_q6v5_pas-add-hwspinlock-bust-on-stop.patch new file mode 100644 index 00000000000..c3d798867e0 --- /dev/null +++ b/queue-6.10/remoteproc-qcom_q6v5_pas-add-hwspinlock-bust-on-stop.patch @@ -0,0 +1,113 @@ +From bb41d3ef281a25f456f35f0c4ec437bdc0543294 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 May 2024 11:09:58 -0700 +Subject: remoteproc: qcom_q6v5_pas: Add hwspinlock bust on stop + +From: Richard Maina + +[ Upstream commit 568b13b65078e2b557ccf47674a354cecd1db641 ] + +When remoteproc goes down unexpectedly this results in a state where any +acquired hwspinlocks will remain locked possibly resulting in deadlock. +In order to ensure all locks are freed we include a call to +qcom_smem_bust_hwspin_lock_by_host() during remoteproc shutdown. + +For qcom_q6v5_pas remoteprocs, each remoteproc has an assigned smem +host_id. Remoteproc can pass this id to smem to try and bust the lock on +remoteproc stop. + +This edge case only occurs with q6v5_pas watchdog crashes. The error +fatal case has handling to clear the hwspinlock before the error fatal +interrupt is triggered. + +Signed-off-by: Richard Maina +Reviewed-by: Bjorn Andersson +Signed-off-by: Chris Lew +Link: https://lore.kernel.org/r/20240529-hwspinlock-bust-v3-4-c8b924ffa5a2@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/qcom_q6v5_pas.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/remoteproc/qcom_q6v5_pas.c b/drivers/remoteproc/qcom_q6v5_pas.c +index 54d8005d40a3..8458bcfe9e19 100644 +--- a/drivers/remoteproc/qcom_q6v5_pas.c ++++ b/drivers/remoteproc/qcom_q6v5_pas.c +@@ -52,6 +52,7 @@ struct adsp_data { + const char *ssr_name; + const char *sysmon_name; + int ssctl_id; ++ unsigned int smem_host_id; + + int region_assign_idx; + int region_assign_count; +@@ -81,6 +82,7 @@ struct qcom_adsp { + int lite_pas_id; + unsigned int minidump_id; + int crash_reason_smem; ++ unsigned int smem_host_id; + bool decrypt_shutdown; + const char *info_name; + +@@ -399,6 +401,9 @@ static int adsp_stop(struct rproc *rproc) + if (handover) + qcom_pas_handover(&adsp->q6v5); + ++ if (adsp->smem_host_id) ++ ret = qcom_smem_bust_hwspin_lock_by_host(adsp->smem_host_id); ++ + return ret; + } + +@@ -727,6 +732,7 @@ static int adsp_probe(struct platform_device *pdev) + adsp->pas_id = desc->pas_id; + adsp->lite_pas_id = desc->lite_pas_id; + adsp->info_name = desc->sysmon_name; ++ adsp->smem_host_id = desc->smem_host_id; + adsp->decrypt_shutdown = desc->decrypt_shutdown; + adsp->region_assign_idx = desc->region_assign_idx; + adsp->region_assign_count = min_t(int, MAX_ASSIGN_COUNT, desc->region_assign_count); +@@ -1196,6 +1202,7 @@ static const struct adsp_data sm8550_adsp_resource = { + .ssr_name = "lpass", + .sysmon_name = "adsp", + .ssctl_id = 0x14, ++ .smem_host_id = 2, + }; + + static const struct adsp_data sm8550_cdsp_resource = { +@@ -1216,6 +1223,7 @@ static const struct adsp_data sm8550_cdsp_resource = { + .ssr_name = "cdsp", + .sysmon_name = "cdsp", + .ssctl_id = 0x17, ++ .smem_host_id = 5, + }; + + static const struct adsp_data sm8550_mpss_resource = { +@@ -1236,6 +1244,7 @@ static const struct adsp_data sm8550_mpss_resource = { + .ssr_name = "mpss", + .sysmon_name = "modem", + .ssctl_id = 0x12, ++ .smem_host_id = 1, + .region_assign_idx = 2, + .region_assign_count = 1, + .region_assign_vmid = QCOM_SCM_VMID_MSS_MSA, +@@ -1275,6 +1284,7 @@ static const struct adsp_data sm8650_cdsp_resource = { + .ssr_name = "cdsp", + .sysmon_name = "cdsp", + .ssctl_id = 0x17, ++ .smem_host_id = 5, + .region_assign_idx = 2, + .region_assign_count = 1, + .region_assign_shared = true, +@@ -1299,6 +1309,7 @@ static const struct adsp_data sm8650_mpss_resource = { + .ssr_name = "mpss", + .sysmon_name = "modem", + .ssctl_id = 0x12, ++ .smem_host_id = 1, + .region_assign_idx = 2, + .region_assign_count = 3, + .region_assign_vmid = QCOM_SCM_VMID_MSS_MSA, +-- +2.43.0 + diff --git a/queue-6.10/revert-drm-amd-display-fix-incorrect-pointer-assignm.patch b/queue-6.10/revert-drm-amd-display-fix-incorrect-pointer-assignm.patch new file mode 100644 index 00000000000..0db14096c56 --- /dev/null +++ b/queue-6.10/revert-drm-amd-display-fix-incorrect-pointer-assignm.patch @@ -0,0 +1,59 @@ +From 12e8b91720b7b2a58c74a84aabf1ae6fb47c30c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Apr 2024 16:25:41 -0400 +Subject: Revert "drm/amd/display: Fix incorrect pointer assignment" + +From: Joshua Aberback + +[ Upstream commit 0c9c0674f81add3edb2bb992b3e89be8a44f03db ] + +This reverts commit 0a571e8657c40047e6602466abfcb6514a391041. + +[Why] +The change being reverted incorrectly assumes that a pointer type was +intended, however copying to a new structure is correct. As well, there +is no compiler error, it was instead an error in the testing framework +being used. + +Reviewed-by: Chaitanya Dhere +Acked-by: Aurabindo Pillai +Signed-off-by: Joshua Aberback +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_state.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_state.c b/drivers/gpu/drm/amd/display/dc/core/dc_state.c +index 52a1cfc5feed..502740f6fb2c 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_state.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_state.c +@@ -191,7 +191,7 @@ static void init_state(struct dc *dc, struct dc_state *state) + struct dc_state *dc_state_create(struct dc *dc, struct dc_state_create_params *params) + { + #ifdef CONFIG_DRM_AMD_DC_FP +- struct dml2_configuration_options *dml2_opt = &dc->dml2_options; ++ struct dml2_configuration_options dml2_opt = dc->dml2_options; + #endif + struct dc_state *state = kvzalloc(sizeof(struct dc_state), + GFP_KERNEL); +@@ -205,11 +205,11 @@ struct dc_state *dc_state_create(struct dc *dc, struct dc_state_create_params *p + + #ifdef CONFIG_DRM_AMD_DC_FP + if (dc->debug.using_dml2) { +- dml2_opt->use_clock_dc_limits = false; +- dml2_create(dc, dml2_opt, &state->bw_ctx.dml2); ++ dml2_opt.use_clock_dc_limits = false; ++ dml2_create(dc, &dml2_opt, &state->bw_ctx.dml2); + +- dml2_opt->use_clock_dc_limits = true; +- dml2_create(dc, dml2_opt, &state->bw_ctx.dml2_dc_power_source); ++ dml2_opt.use_clock_dc_limits = true; ++ dml2_create(dc, &dml2_opt, &state->bw_ctx.dml2_dc_power_source); + } + #endif + +-- +2.43.0 + diff --git a/queue-6.10/series b/queue-6.10/series index 60b8655201b..a9d7a377cb0 100644 --- a/queue-6.10/series +++ b/queue-6.10/series @@ -37,3 +37,144 @@ selftests-mptcp-join-check-re-adding-init-endp-with-.patch selftests-mptcp-join-validate-event-numbers.patch selftests-mptcp-join-check-re-re-adding-id-0-signal.patch selftests-mptcp-join-test-for-flush-re-add-endpoints.patch +drm-amdgpu-fix-uninitialized-variable-warning-in-amd.patch +revert-drm-amd-display-fix-incorrect-pointer-assignm.patch +drm-amd-display-handle-the-case-which-quad_part-is-e.patch +drm-amd-display-assign-linear_pitch_alignment-even-f.patch +drm-amdgpu-handle-sg-size-limit-for-contiguous-alloc.patch +drm-amdgpu-fix-overflowed-array-index-read-warning.patch +drm-amdgpu-pm-check-the-return-value-of-smum_send_ms.patch +drm-amd-pm-fix-uninitialized-variable-warning.patch +drm-amd-pm-fix-uninitialized-variable-warning-for-sm.patch +drm-amd-pm-fix-warning-using-uninitialized-value-of-.patch +drm-amd-pm-fix-negative-array-index-read.patch +drm-amd-pm-fix-uninitialized-variable-warning-for-sm.patch-18788 +drm-amd-pm-fix-the-out-of-bounds-read-warning.patch +drm-amdgpu-fix-uninitialized-scalar-variable-warning.patch +drm-amd-pm-fix-uninitialized-variable-warnings-for-v.patch +drm-xe-gt-fix-assert-in-l3-bank-mask-generation.patch +drm-amdgpu-avoid-reading-vf2pf-info-size-from-fb.patch +drm-amd-display-ensure-array-index-tg_inst-won-t-be-.patch +drm-amd-display-check-gpio_id-before-used-as-array-i.patch +drm-amd-display-stop-amdgpu_dm-initialize-when-strea.patch +drm-amd-display-stop-amdgpu_dm-initialize-when-link-.patch +drm-amd-display-fix-incorrect-size-calculation-for-l.patch +drm-amd-display-check-index-for-aux_rd_interval-befo.patch +drm-amd-display-add-missing-null-pointer-check-withi.patch +drm-amd-display-add-array-index-check-for-hdcp-ddc-a.patch +drm-amd-display-check-num_valid_sets-before-accessin.patch +drm-amd-display-check-msg_id-before-processing-trans.patch +drm-amd-display-release-state-memory-if-amdgpu_dm_cr.patch +drm-amd-display-check-link_index-before-accessing-dc.patch +drm-amd-display-add-otg_master-null-check-within-res.patch +drm-amd-display-fix-coverity-interger_overflow-withi.patch +drm-amd-display-fix-coverity-integer_overflow-within.patch +drm-amd-display-release-clck_src-memory-if-clk_src_c.patch +drm-amd-display-spinlock-before-reading-event.patch +drm-amd-display-fix-coverity-integer_overflow-within.patch-32439 +drm-amd-display-ensure-index-calculation-will-not-ov.patch +drm-amd-display-skip-inactive-planes-within-modesupp.patch +drm-amd-display-fix-writeback-job-lock-evasion-withi.patch +drm-amd-display-fix-index-may-exceed-array-range-wit.patch +drm-amd-amdgpu-check-tbo-resource-pointer.patch +drm-xe-demote-ccs_mode-info-to-debug-only.patch +drm-drm-bridge-drop-conditionals-around-of_node-poin.patch +drm-amd-pm-fix-uninitialized-variable-warnings-for-v.patch-20400 +drm-amdgpu-pm-fix-uninitialized-variable-warning-for.patch +drm-amdgpu-pm-fix-uninitialized-variable-agc_btc_res.patch +drm-amdgpu-fix-the-uninitialized-variable-warning.patch +drm-amdgpu-fix-out-of-bounds-write-warning.patch +drm-amdkfd-check-debug-trap-enable-before-write-dbg_.patch +drm-amdgpu-fix-uninitialized-variable-warning-for-am.patch +drm-amdgpu-fix-uninitialized-variable-warning-for-jp.patch +drm-amdgpu-fix-out-of-bounds-read-of-df_v1_7_channel.patch +drm-amdgpu-fix-uninitialized-variable-warning-in-amd.patch-11331 +drm-amdgpu-fix-ucode-out-of-bounds-read-warning.patch +drm-amdgpu-fix-mc_data-out-of-bounds-read-warning.patch +drm-amdkfd-reconcile-the-definition-and-use-of-oem_i.patch +drm-xe-hwmon-remove-unwanted-write-permission-for-cu.patch +apparmor-fix-possible-null-pointer-dereference.patch +wifi-ath12k-initialize-ret-in-ath12k_qmi_load_file_t.patch +wifi-ath11k-initialize-ret-in-ath11k_qmi_load_file_t.patch +wifi-ath12k-initialize-ret-in-ath12k_dp_rxdma_ring_s.patch +drm-amdgpu-pm-check-input-value-for-custom-profile-m.patch +drm-amdgpu-pm-check-input-value-for-power-profile-se.patch +drm-amdgpu-vcn-remove-irq-disabling-in-vcn-5-suspend.patch +drm-amdgpu-fix-the-warning-division-or-modulo-by-zer.patch +drm-amdgpu-fix-dereference-after-null-check.patch +drm-amdgpu-fix-the-waring-dereferencing-hive.patch +drm-amd-pm-check-specific-index-for-aldebaran.patch +drm-amd-pm-check-specific-index-for-smu13.patch +drm-amdgpu-the-warning-dereferencing-obj-for-nbio_v7.patch +drm-amdgpu-fix-the-warning-bad-bit-shift-operation-f.patch +drm-amd-pm-check-negtive-return-for-table-entries.patch +wifi-rtw89-ser-avoid-multiple-deinit-on-same-cam.patch +drm-xe-fix-the-warning-conditions.patch +drm-kfd-correct-pinned-buffer-handling-at-kfd-restor.patch +drm-amdgpu-fix-compiler-side-effect-check-issue-for-.patch +drm-amd-display-fix-pipe-addition-logic-in-calc_bloc.patch +drm-amdgpu-queue-kfd-reset-workitem-in-vf-fed.patch +drm-amdgpu-update-type-of-buf-size-to-u32-for-eeprom.patch +wifi-iwlwifi-remove-fw_running-op.patch +wifi-cfg80211-restrict-operation-during-radar-detect.patch +cpufreq-scmi-avoid-overflow-of-target_freq-in-fast-s.patch +pci-al-check-ioresource_bus-existence-during-probe.patch +remoteproc-mediatek-zero-out-only-remaining-bytes-of.patch +wifi-iwlwifi-mvm-use-only-beacon-bss-load-for-active.patch +wifi-mac80211-check-ieee80211_bss_info_change_notify.patch +hwspinlock-introduce-hwspin_lock_bust.patch +soc-qcom-smem-add-qcom_smem_bust_hwspin_lock_by_host.patch +remoteproc-qcom_q6v5_pas-add-hwspinlock-bust-on-stop.patch +rdma-efa-properly-handle-unexpected-aq-completions.patch +ionic-fix-potential-irq-name-truncation.patch +pwm-xilinx-fix-u32-overflow-issue-in-32-bit-width-pw.patch +rcu-nocb-remove-buggy-bypass-lock-contention-mitigat.patch +media-v4l2-cci-always-assign-val.patch +usbip-don-t-submit-special-requests-twice.patch +usb-typec-ucsi-fix-null-pointer-dereference-in-trace.patch +drm-xe-use-missing-lock-in-relay_needs_worker.patch +fsnotify-clear-parent_watched-flags-lazily.patch +net-remove-null-pointer-net-parameter-in-ip_metrics_.patch +tcp-annotate-data-races-around-tw-tw_ts_recent-and-t.patch +drm-amdgu-fix-unintentional-integer-overflow-for-mal.patch +drm-xe-don-t-overmap-identity-vram-mapping.patch +regmap-spi-fix-potential-off-by-one-when-calculating.patch +smack-tcp-ipv4-fix-incorrect-labeling.patch +platform-chrome-cros_ec_lpc-mec-access-can-use-an-am.patch +net-mlx5e-shampo-fix-incorrect-page-release.patch +drm-meson-plane-add-error-handling.patch +crypto-stm32-cryp-call-finalize-with-bh-disabled.patch +gfs2-revert-add-quota_change-type.patch +ras-amd-atl-validate-address-map-when-information-is.patch +net-tcp-dccp-prepare-for-tw_timer-un-pinning.patch +drm-bridge-tc358767-check-if-fully-initialized-befor.patch +drm-xe-ensure-caller-uses-sole-domain-for-xe_force_w.patch +drm-xe-check-valid-domain-is-passed-in-xe_force_wake.patch +pinctrl-renesas-rzg2l-validate-power-registers-for-s.patch +dmaengine-altera-msgdma-use-irq-variant-of-spin_lock.patch +dmaengine-altera-msgdma-properly-free-descriptor-in-.patch +thermal-trip-use-read_once-for-lockless-access-to-tr.patch +hwmon-k10temp-check-return-value-of-amd_smn_read.patch +wifi-cfg80211-make-hash-table-duplicates-more-surviv.patch +f2fs-fix-to-do-sanity-check-on-blocks-for-inline_dat.patch +drm-xe-add-guc-state-asserts-to-deregister_exec_queu.patch +driver-iio-add-missing-checks-on-iio_info-s-callback.patch +block-remove-the-blk_flush_integrity-call-in-blk_int.patch +drm-amdgpu-add-skip_hw_access-checks-for-sriov.patch +drm-amdgpu-add-lock-in-amdgpu_gart_invalidate_tlb.patch +drm-amdgpu-add-lock-in-kfd_process_dequeue_from_devi.patch +drm-amdgpu-fix-overflowed-constant-warning-in-mmhub_.patch +drm-amd-display-don-t-use-fsleep-for-psr-exit-waits-.patch +drm-amd-display-added-null-check-at-start-of-dc_vali.patch +drm-amd-display-correct-the-defined-value-for-amdgpu.patch +drm-amd-display-remove-register-from-dcn35-dmcub-dia.patch +drm-amd-display-use-preferred-link-settings-for-dp-s.patch +drm-amd-display-disable-dmcub-timeout-for-dcn35.patch +drm-amd-display-avoid-overflow-from-uint32_t-to-uint.patch +drm-amdgpu-set-ras-fed-status-for-more-cases.patch +drm-amdkfd-use-mode1-reset-for-ras-poison-consumptio.patch +drm-amd-display-check-bios-images-before-it-is-used.patch +drm-amd-display-skip-wbscl_set_scaler_filter-if-filt.patch +crypto-ecc-fix-off-by-one-missing-to-clear-most-sign.patch +media-uvcvideo-enforce-alignment-of-frame-and-interv.patch +pinctrl-core-reset-gpio_device-in-loop-in-pinctrl_pi.patch diff --git a/queue-6.10/smack-tcp-ipv4-fix-incorrect-labeling.patch b/queue-6.10/smack-tcp-ipv4-fix-incorrect-labeling.patch new file mode 100644 index 00000000000..857983c0afa --- /dev/null +++ b/queue-6.10/smack-tcp-ipv4-fix-incorrect-labeling.patch @@ -0,0 +1,69 @@ +From c9a4da5a5c42fc42312d306301b0a33041cd4286 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jun 2024 15:41:50 -0700 +Subject: smack: tcp: ipv4, fix incorrect labeling + +From: Casey Schaufler + +[ Upstream commit 2fe209d0ad2e2729f7e22b9b31a86cc3ff0db550 ] + +Currently, Smack mirrors the label of incoming tcp/ipv4 connections: +when a label 'foo' connects to a label 'bar' with tcp/ipv4, +'foo' always gets 'foo' in returned ipv4 packets. So, +1) returned packets are incorrectly labeled ('foo' instead of 'bar') +2) 'bar' can write to 'foo' without being authorized to write. + +Here is a scenario how to see this: + +* Take two machines, let's call them C and S, + with active Smack in the default state + (no settings, no rules, no labeled hosts, only builtin labels) + +* At S, add Smack rule 'foo bar w' + (labels 'foo' and 'bar' are instantiated at S at this moment) + +* At S, at label 'bar', launch a program + that listens for incoming tcp/ipv4 connections + +* From C, at label 'foo', connect to the listener at S. + (label 'foo' is instantiated at C at this moment) + Connection succeedes and works. + +* Send some data in both directions. +* Collect network traffic of this connection. + +All packets in both directions are labeled with the CIPSO +of the label 'foo'. Hence, label 'bar' writes to 'foo' without +being authorized, and even without ever being known at C. + +If anybody cares: exactly the same happens with DCCP. + +This behavior 1st manifested in release 2.6.29.4 (see Fixes below) +and it looks unintentional. At least, no explanation was provided. + +I changed returned packes label into the 'bar', +to bring it into line with the Smack documentation claims. + +Signed-off-by: Konstantin Andreev +Signed-off-by: Casey Schaufler +Signed-off-by: Sasha Levin +--- + security/smack/smack_lsm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index 081129be5b62..ab939e6449e4 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -4456,7 +4456,7 @@ static int smack_inet_conn_request(const struct sock *sk, struct sk_buff *skb, + rcu_read_unlock(); + + if (hskp == NULL) +- rc = netlbl_req_setattr(req, &skp->smk_netlabel); ++ rc = netlbl_req_setattr(req, &ssp->smk_out->smk_netlabel); + else + netlbl_req_delattr(req); + +-- +2.43.0 + diff --git a/queue-6.10/soc-qcom-smem-add-qcom_smem_bust_hwspin_lock_by_host.patch b/queue-6.10/soc-qcom-smem-add-qcom_smem_bust_hwspin_lock_by_host.patch new file mode 100644 index 00000000000..9a03acbc4a7 --- /dev/null +++ b/queue-6.10/soc-qcom-smem-add-qcom_smem_bust_hwspin_lock_by_host.patch @@ -0,0 +1,76 @@ +From f647328ab911c5331a4a5dcc13a904c0ddf28537 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 May 2024 11:09:57 -0700 +Subject: soc: qcom: smem: Add qcom_smem_bust_hwspin_lock_by_host() + +From: Chris Lew + +[ Upstream commit 2e3f0d693875db698891ffe89a18121bda5b95b8 ] + +Add qcom_smem_bust_hwspin_lock_by_host to enable remoteproc to bust the +hwspin_lock owned by smem. In the event the remoteproc crashes +unexpectedly, the remoteproc driver can invoke this API to try and bust +the hwspin_lock and release the lock if still held by the remoteproc +device. + +Signed-off-by: Chris Lew +Reviewed-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20240529-hwspinlock-bust-v3-3-c8b924ffa5a2@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/smem.c | 26 ++++++++++++++++++++++++++ + include/linux/soc/qcom/smem.h | 2 ++ + 2 files changed, 28 insertions(+) + +diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c +index 7191fa0c087f..50039e983eba 100644 +--- a/drivers/soc/qcom/smem.c ++++ b/drivers/soc/qcom/smem.c +@@ -359,6 +359,32 @@ static struct qcom_smem *__smem; + /* Timeout (ms) for the trylock of remote spinlocks */ + #define HWSPINLOCK_TIMEOUT 1000 + ++/* The qcom hwspinlock id is always plus one from the smem host id */ ++#define SMEM_HOST_ID_TO_HWSPINLOCK_ID(__x) ((__x) + 1) ++ ++/** ++ * qcom_smem_bust_hwspin_lock_by_host() - bust the smem hwspinlock for a host ++ * @host: remote processor id ++ * ++ * Busts the hwspin_lock for the given smem host id. This helper is intended ++ * for remoteproc drivers that manage remoteprocs with an equivalent smem ++ * driver instance in the remote firmware. Drivers can force a release of the ++ * smem hwspin_lock if the rproc unexpectedly goes into a bad state. ++ * ++ * Context: Process context. ++ * ++ * Returns: 0 on success, otherwise negative errno. ++ */ ++int qcom_smem_bust_hwspin_lock_by_host(unsigned int host) ++{ ++ /* This function is for remote procs, so ignore SMEM_HOST_APPS */ ++ if (host == SMEM_HOST_APPS || host >= SMEM_HOST_COUNT) ++ return -EINVAL; ++ ++ return hwspin_lock_bust(__smem->hwlock, SMEM_HOST_ID_TO_HWSPINLOCK_ID(host)); ++} ++EXPORT_SYMBOL_GPL(qcom_smem_bust_hwspin_lock_by_host); ++ + /** + * qcom_smem_is_available() - Check if SMEM is available + * +diff --git a/include/linux/soc/qcom/smem.h b/include/linux/soc/qcom/smem.h +index a36a3b9d4929..03187bc95851 100644 +--- a/include/linux/soc/qcom/smem.h ++++ b/include/linux/soc/qcom/smem.h +@@ -14,4 +14,6 @@ phys_addr_t qcom_smem_virt_to_phys(void *p); + + int qcom_smem_get_soc_id(u32 *id); + ++int qcom_smem_bust_hwspin_lock_by_host(unsigned int host); ++ + #endif +-- +2.43.0 + diff --git a/queue-6.10/tcp-annotate-data-races-around-tw-tw_ts_recent-and-t.patch b/queue-6.10/tcp-annotate-data-races-around-tw-tw_ts_recent-and-t.patch new file mode 100644 index 00000000000..7a11cff1d95 --- /dev/null +++ b/queue-6.10/tcp-annotate-data-races-around-tw-tw_ts_recent-and-t.patch @@ -0,0 +1,149 @@ +From 034fc6e33febb6f14584f838a5253e68af931c13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 15:51:06 +0000 +Subject: tcp: annotate data-races around tw->tw_ts_recent and + tw->tw_ts_recent_stamp + +From: Eric Dumazet + +[ Upstream commit 69e0b33a7fce4d96649b9fa32e56b696921aa48e ] + +These fields can be read and written locklessly, add annotations +around these minor races. + +Signed-off-by: Eric Dumazet +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_ipv4.c | 12 +++++++----- + net/ipv4/tcp_minisocks.c | 22 ++++++++++++++-------- + net/ipv6/tcp_ipv6.c | 6 +++--- + 3 files changed, 24 insertions(+), 16 deletions(-) + +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index 8f8f93716ff8..3b7430201397 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -116,6 +116,7 @@ int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp) + const struct inet_timewait_sock *tw = inet_twsk(sktw); + const struct tcp_timewait_sock *tcptw = tcp_twsk(sktw); + struct tcp_sock *tp = tcp_sk(sk); ++ int ts_recent_stamp; + + if (reuse == 2) { + /* Still does not detect *everything* that goes through +@@ -154,9 +155,10 @@ int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp) + If TW bucket has been already destroyed we fall back to VJ's scheme + and use initial timestamp retrieved from peer table. + */ +- if (tcptw->tw_ts_recent_stamp && ++ ts_recent_stamp = READ_ONCE(tcptw->tw_ts_recent_stamp); ++ if (ts_recent_stamp && + (!twp || (reuse && time_after32(ktime_get_seconds(), +- tcptw->tw_ts_recent_stamp)))) { ++ ts_recent_stamp)))) { + /* inet_twsk_hashdance() sets sk_refcnt after putting twsk + * and releasing the bucket lock. + */ +@@ -180,8 +182,8 @@ int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp) + if (!seq) + seq = 1; + WRITE_ONCE(tp->write_seq, seq); +- tp->rx_opt.ts_recent = tcptw->tw_ts_recent; +- tp->rx_opt.ts_recent_stamp = tcptw->tw_ts_recent_stamp; ++ tp->rx_opt.ts_recent = READ_ONCE(tcptw->tw_ts_recent); ++ tp->rx_opt.ts_recent_stamp = ts_recent_stamp; + } + + return 1; +@@ -1066,7 +1068,7 @@ static void tcp_v4_timewait_ack(struct sock *sk, struct sk_buff *skb) + tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt, + tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale, + tcp_tw_tsval(tcptw), +- tcptw->tw_ts_recent, ++ READ_ONCE(tcptw->tw_ts_recent), + tw->tw_bound_dev_if, &key, + tw->tw_transparent ? IP_REPLY_ARG_NOSRCCHECK : 0, + tw->tw_tos, +diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c +index 0fbebf6266e9..5e4a12d01622 100644 +--- a/net/ipv4/tcp_minisocks.c ++++ b/net/ipv4/tcp_minisocks.c +@@ -101,16 +101,18 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb, + struct tcp_options_received tmp_opt; + struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw); + bool paws_reject = false; ++ int ts_recent_stamp; + + tmp_opt.saw_tstamp = 0; +- if (th->doff > (sizeof(*th) >> 2) && tcptw->tw_ts_recent_stamp) { ++ ts_recent_stamp = READ_ONCE(tcptw->tw_ts_recent_stamp); ++ if (th->doff > (sizeof(*th) >> 2) && ts_recent_stamp) { + tcp_parse_options(twsk_net(tw), skb, &tmp_opt, 0, NULL); + + if (tmp_opt.saw_tstamp) { + if (tmp_opt.rcv_tsecr) + tmp_opt.rcv_tsecr -= tcptw->tw_ts_offset; +- tmp_opt.ts_recent = tcptw->tw_ts_recent; +- tmp_opt.ts_recent_stamp = tcptw->tw_ts_recent_stamp; ++ tmp_opt.ts_recent = READ_ONCE(tcptw->tw_ts_recent); ++ tmp_opt.ts_recent_stamp = ts_recent_stamp; + paws_reject = tcp_paws_reject(&tmp_opt, th->rst); + } + } +@@ -152,8 +154,10 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb, + twsk_rcv_nxt_update(tcptw, TCP_SKB_CB(skb)->end_seq); + + if (tmp_opt.saw_tstamp) { +- tcptw->tw_ts_recent_stamp = ktime_get_seconds(); +- tcptw->tw_ts_recent = tmp_opt.rcv_tsval; ++ WRITE_ONCE(tcptw->tw_ts_recent_stamp, ++ ktime_get_seconds()); ++ WRITE_ONCE(tcptw->tw_ts_recent, ++ tmp_opt.rcv_tsval); + } + + inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN); +@@ -197,8 +201,10 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb, + } + + if (tmp_opt.saw_tstamp) { +- tcptw->tw_ts_recent = tmp_opt.rcv_tsval; +- tcptw->tw_ts_recent_stamp = ktime_get_seconds(); ++ WRITE_ONCE(tcptw->tw_ts_recent, ++ tmp_opt.rcv_tsval); ++ WRITE_ONCE(tcptw->tw_ts_recent_stamp, ++ ktime_get_seconds()); + } + + inet_twsk_put(tw); +@@ -225,7 +231,7 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb, + if (th->syn && !th->rst && !th->ack && !paws_reject && + (after(TCP_SKB_CB(skb)->seq, tcptw->tw_rcv_nxt) || + (tmp_opt.saw_tstamp && +- (s32)(tcptw->tw_ts_recent - tmp_opt.rcv_tsval) < 0))) { ++ (s32)(READ_ONCE(tcptw->tw_ts_recent) - tmp_opt.rcv_tsval) < 0))) { + u32 isn = tcptw->tw_snd_nxt + 65535 + 2; + if (isn == 0) + isn++; +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index 3385faf1d5dc..66f6fe5afb03 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -1196,9 +1196,9 @@ static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb) + tcp_v6_send_ack(sk, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt, + tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale, + tcp_tw_tsval(tcptw), +- tcptw->tw_ts_recent, tw->tw_bound_dev_if, &key, +- tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel), tw->tw_priority, +- tw->tw_txhash); ++ READ_ONCE(tcptw->tw_ts_recent), tw->tw_bound_dev_if, ++ &key, tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel), ++ tw->tw_priority, tw->tw_txhash); + + #ifdef CONFIG_TCP_AO + out: +-- +2.43.0 + diff --git a/queue-6.10/thermal-trip-use-read_once-for-lockless-access-to-tr.patch b/queue-6.10/thermal-trip-use-read_once-for-lockless-access-to-tr.patch new file mode 100644 index 00000000000..62ceec7e98f --- /dev/null +++ b/queue-6.10/thermal-trip-use-read_once-for-lockless-access-to-tr.patch @@ -0,0 +1,70 @@ +From c710b0f24ceaf0fa78de7beb66d10095abbaea84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 May 2024 18:52:13 +0200 +Subject: thermal: trip: Use READ_ONCE() for lockless access to trip properties + +From: Rafael J. Wysocki + +[ Upstream commit a52641bc6293a24f25956a597e7f32148b0e2bb8 ] + +When accessing trip temperature and hysteresis without locking, it is +better to use READ_ONCE() to prevent compiler optimizations possibly +affecting the read from being applied. + +Of course, for the READ_ONCE() to be effective, WRITE_ONCE() needs to +be used when updating their values. + +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/thermal/thermal_sysfs.c | 6 +++--- + drivers/thermal/thermal_trip.c | 2 +- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/thermal/thermal_sysfs.c b/drivers/thermal/thermal_sysfs.c +index 88211ccdfbd6..5be6113e7c80 100644 +--- a/drivers/thermal/thermal_sysfs.c ++++ b/drivers/thermal/thermal_sysfs.c +@@ -150,7 +150,7 @@ trip_point_temp_show(struct device *dev, struct device_attribute *attr, + if (sscanf(attr->attr.name, "trip_point_%d_temp", &trip_id) != 1) + return -EINVAL; + +- return sprintf(buf, "%d\n", tz->trips[trip_id].trip.temperature); ++ return sprintf(buf, "%d\n", READ_ONCE(tz->trips[trip_id].trip.temperature)); + } + + static ssize_t +@@ -174,7 +174,7 @@ trip_point_hyst_store(struct device *dev, struct device_attribute *attr, + trip = &tz->trips[trip_id].trip; + + if (hyst != trip->hysteresis) { +- trip->hysteresis = hyst; ++ WRITE_ONCE(trip->hysteresis, hyst); + + thermal_zone_trip_updated(tz, trip); + } +@@ -194,7 +194,7 @@ trip_point_hyst_show(struct device *dev, struct device_attribute *attr, + if (sscanf(attr->attr.name, "trip_point_%d_hyst", &trip_id) != 1) + return -EINVAL; + +- return sprintf(buf, "%d\n", tz->trips[trip_id].trip.hysteresis); ++ return sprintf(buf, "%d\n", READ_ONCE(tz->trips[trip_id].trip.hysteresis)); + } + + static ssize_t +diff --git a/drivers/thermal/thermal_trip.c b/drivers/thermal/thermal_trip.c +index 49e63db68517..b4e7411b2fe7 100644 +--- a/drivers/thermal/thermal_trip.c ++++ b/drivers/thermal/thermal_trip.c +@@ -152,7 +152,7 @@ void thermal_zone_set_trip_temp(struct thermal_zone_device *tz, + if (trip->temperature == temp) + return; + +- trip->temperature = temp; ++ WRITE_ONCE(trip->temperature, temp); + thermal_notify_tz_trip_change(tz, trip); + + if (temp == THERMAL_TEMP_INVALID) { +-- +2.43.0 + diff --git a/queue-6.10/usb-typec-ucsi-fix-null-pointer-dereference-in-trace.patch b/queue-6.10/usb-typec-ucsi-fix-null-pointer-dereference-in-trace.patch new file mode 100644 index 00000000000..67fa2cacd6b --- /dev/null +++ b/queue-6.10/usb-typec-ucsi-fix-null-pointer-dereference-in-trace.patch @@ -0,0 +1,44 @@ +From 76e93da93a818e13aa9d163238f09150a44d5a4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 May 2024 20:12:41 +0000 +Subject: usb: typec: ucsi: Fix null pointer dereference in trace + +From: Abhishek Pandit-Subedi + +[ Upstream commit 99516f76db48e1a9d54cdfed63c1babcee4e71a5 ] + +ucsi_register_altmode checks IS_ERR for the alt pointer and treats +NULL as valid. When CONFIG_TYPEC_DP_ALTMODE is not enabled, +ucsi_register_displayport returns NULL which causes a NULL pointer +dereference in trace. Rather than return NULL, call +typec_port_register_altmode to register DisplayPort alternate mode +as a non-controllable mode when CONFIG_TYPEC_DP_ALTMODE is not enabled. + +Reviewed-by: Benson Leung +Reviewed-by: Heikki Krogerus +Signed-off-by: Abhishek Pandit-Subedi +Signed-off-by: Jameson Thies +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240510201244.2968152-2-jthies@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/ucsi/ucsi.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/typec/ucsi/ucsi.h b/drivers/usb/typec/ucsi/ucsi.h +index c4d103db9d0f..f66224a270bc 100644 +--- a/drivers/usb/typec/ucsi/ucsi.h ++++ b/drivers/usb/typec/ucsi/ucsi.h +@@ -496,7 +496,7 @@ ucsi_register_displayport(struct ucsi_connector *con, + bool override, int offset, + struct typec_altmode_desc *desc) + { +- return NULL; ++ return typec_port_register_altmode(con->port, desc); + } + + static inline void +-- +2.43.0 + diff --git a/queue-6.10/usbip-don-t-submit-special-requests-twice.patch b/queue-6.10/usbip-don-t-submit-special-requests-twice.patch new file mode 100644 index 00000000000..ee19d27641f --- /dev/null +++ b/queue-6.10/usbip-don-t-submit-special-requests-twice.patch @@ -0,0 +1,183 @@ +From 0292ecf9d9279aa831ec871aa577d55cf04c5715 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 May 2024 16:15:38 +0200 +Subject: usbip: Don't submit special requests twice + +From: Simon Holesch + +[ Upstream commit 8b6b386f9aa936ed0c190446c71cf59d4a507690 ] + +Skip submitting URBs, when identical requests were already sent in +tweak_special_requests(). Instead call the completion handler directly +to return the result of the URB. + +Even though submitting those requests twice should be harmless, there +are USB devices that react poorly to some duplicated requests. + +One example is the ChipIdea controller implementation in U-Boot: The +second SET_CONFIGURATION request makes U-Boot disable and re-enable all +endpoints. Re-enabling an endpoint in the ChipIdea controller, however, +was broken until U-Boot commit b272c8792502 ("usb: ci: Fix gadget +reinit"). + +Signed-off-by: Simon Holesch +Acked-by: Shuah Khan +Reviewed-by: Hongren Zheng +Tested-by: Hongren Zheng +Link: https://lore.kernel.org/r/20240519141922.171460-1-simon@holesch.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/usbip/stub_rx.c | 77 ++++++++++++++++++++++++------------- + 1 file changed, 50 insertions(+), 27 deletions(-) + +diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c +index fc01b31bbb87..6338d818bc8b 100644 +--- a/drivers/usb/usbip/stub_rx.c ++++ b/drivers/usb/usbip/stub_rx.c +@@ -144,53 +144,62 @@ static int tweak_set_configuration_cmd(struct urb *urb) + if (err && err != -ENODEV) + dev_err(&sdev->udev->dev, "can't set config #%d, error %d\n", + config, err); +- return 0; ++ return err; + } + + static int tweak_reset_device_cmd(struct urb *urb) + { + struct stub_priv *priv = (struct stub_priv *) urb->context; + struct stub_device *sdev = priv->sdev; ++ int err; + + dev_info(&urb->dev->dev, "usb_queue_reset_device\n"); + +- if (usb_lock_device_for_reset(sdev->udev, NULL) < 0) { ++ err = usb_lock_device_for_reset(sdev->udev, NULL); ++ if (err < 0) { + dev_err(&urb->dev->dev, "could not obtain lock to reset device\n"); +- return 0; ++ return err; + } +- usb_reset_device(sdev->udev); ++ err = usb_reset_device(sdev->udev); + usb_unlock_device(sdev->udev); + +- return 0; ++ return err; + } + + /* + * clear_halt, set_interface, and set_configuration require special tricks. ++ * Returns 1 if request was tweaked, 0 otherwise. + */ +-static void tweak_special_requests(struct urb *urb) ++static int tweak_special_requests(struct urb *urb) + { ++ int err; ++ + if (!urb || !urb->setup_packet) +- return; ++ return 0; + + if (usb_pipetype(urb->pipe) != PIPE_CONTROL) +- return; ++ return 0; + + if (is_clear_halt_cmd(urb)) + /* tweak clear_halt */ +- tweak_clear_halt_cmd(urb); ++ err = tweak_clear_halt_cmd(urb); + + else if (is_set_interface_cmd(urb)) + /* tweak set_interface */ +- tweak_set_interface_cmd(urb); ++ err = tweak_set_interface_cmd(urb); + + else if (is_set_configuration_cmd(urb)) + /* tweak set_configuration */ +- tweak_set_configuration_cmd(urb); ++ err = tweak_set_configuration_cmd(urb); + + else if (is_reset_device_cmd(urb)) +- tweak_reset_device_cmd(urb); +- else ++ err = tweak_reset_device_cmd(urb); ++ else { + usbip_dbg_stub_rx("no need to tweak\n"); ++ return 0; ++ } ++ ++ return !err; + } + + /* +@@ -468,6 +477,7 @@ static void stub_recv_cmd_submit(struct stub_device *sdev, + int support_sg = 1; + int np = 0; + int ret, i; ++ int is_tweaked; + + if (pipe == -1) + return; +@@ -580,8 +590,11 @@ static void stub_recv_cmd_submit(struct stub_device *sdev, + priv->urbs[i]->pipe = pipe; + priv->urbs[i]->complete = stub_complete; + +- /* no need to submit an intercepted request, but harmless? */ +- tweak_special_requests(priv->urbs[i]); ++ /* ++ * all URBs belong to a single PDU, so a global is_tweaked flag is ++ * enough ++ */ ++ is_tweaked = tweak_special_requests(priv->urbs[i]); + + masking_bogus_flags(priv->urbs[i]); + } +@@ -594,22 +607,32 @@ static void stub_recv_cmd_submit(struct stub_device *sdev, + + /* urb is now ready to submit */ + for (i = 0; i < priv->num_urbs; i++) { +- ret = usb_submit_urb(priv->urbs[i], GFP_KERNEL); ++ if (!is_tweaked) { ++ ret = usb_submit_urb(priv->urbs[i], GFP_KERNEL); + +- if (ret == 0) +- usbip_dbg_stub_rx("submit urb ok, seqnum %u\n", +- pdu->base.seqnum); +- else { +- dev_err(&udev->dev, "submit_urb error, %d\n", ret); +- usbip_dump_header(pdu); +- usbip_dump_urb(priv->urbs[i]); ++ if (ret == 0) ++ usbip_dbg_stub_rx("submit urb ok, seqnum %u\n", ++ pdu->base.seqnum); ++ else { ++ dev_err(&udev->dev, "submit_urb error, %d\n", ret); ++ usbip_dump_header(pdu); ++ usbip_dump_urb(priv->urbs[i]); + ++ /* ++ * Pessimistic. ++ * This connection will be discarded. ++ */ ++ usbip_event_add(ud, SDEV_EVENT_ERROR_SUBMIT); ++ break; ++ } ++ } else { + /* +- * Pessimistic. +- * This connection will be discarded. ++ * An identical URB was already submitted in ++ * tweak_special_requests(). Skip submitting this URB to not ++ * duplicate the request. + */ +- usbip_event_add(ud, SDEV_EVENT_ERROR_SUBMIT); +- break; ++ priv->urbs[i]->status = 0; ++ stub_complete(priv->urbs[i]); + } + } + +-- +2.43.0 + diff --git a/queue-6.10/wifi-ath11k-initialize-ret-in-ath11k_qmi_load_file_t.patch b/queue-6.10/wifi-ath11k-initialize-ret-in-ath11k_qmi_load_file_t.patch new file mode 100644 index 00000000000..658b332aacd --- /dev/null +++ b/queue-6.10/wifi-ath11k-initialize-ret-in-ath11k_qmi_load_file_t.patch @@ -0,0 +1,45 @@ +From c5e31804cdbc22262dd8c106ab79702d6992188a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 May 2024 11:52:09 -0700 +Subject: wifi: ath11k: initialize 'ret' in ath11k_qmi_load_file_target_mem() + +From: Jeff Johnson + +[ Upstream commit 199f149e97dc7be80e5eed4b232529c1d1aa8055 ] + +smatch flagged the following issue: + +drivers/net/wireless/ath/ath11k/qmi.c:2401 ath11k_qmi_load_file_target_mem() error: uninitialized symbol 'ret'. + +The reality is that 'ret' is initialized in every path through +ath11k_qmi_load_file_target_mem() except one, the case where the input +'len' is 0, and hence the "while (remaining)" loop is never entered. +But to make sure this case is also handled, add an initializer to the +declaration of 'ret'. + +No functional changes, compile tested only. + +Signed-off-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240504-qmi_load_file_target_mem-v1-2-069fc44c45eb@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/qmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath11k/qmi.c b/drivers/net/wireless/ath/ath11k/qmi.c +index d4a243b64f6c..aa160e6fe24f 100644 +--- a/drivers/net/wireless/ath/ath11k/qmi.c ++++ b/drivers/net/wireless/ath/ath11k/qmi.c +@@ -2293,7 +2293,7 @@ static int ath11k_qmi_load_file_target_mem(struct ath11k_base *ab, + struct qmi_txn txn; + const u8 *temp = data; + void __iomem *bdf_addr = NULL; +- int ret; ++ int ret = 0; + u32 remaining = len; + + req = kzalloc(sizeof(*req), GFP_KERNEL); +-- +2.43.0 + diff --git a/queue-6.10/wifi-ath12k-initialize-ret-in-ath12k_dp_rxdma_ring_s.patch b/queue-6.10/wifi-ath12k-initialize-ret-in-ath12k_dp_rxdma_ring_s.patch new file mode 100644 index 00000000000..f1d4d3ef0cb --- /dev/null +++ b/queue-6.10/wifi-ath12k-initialize-ret-in-ath12k_dp_rxdma_ring_s.patch @@ -0,0 +1,46 @@ +From 5367a9bab988ecaa32121609c9fdc614f3c0f65f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 May 2024 13:45:03 +0300 +Subject: wifi: ath12k: initialize 'ret' in + ath12k_dp_rxdma_ring_sel_config_wcn7850() + +From: Jeff Johnson + +[ Upstream commit 3b9344740843d965e9e37fba30620b3b1c0afa4f ] + +smatch flagged the following issue: + +drivers/net/wireless/ath/ath12k/dp_rx.c:4065 ath12k_dp_rxdma_ring_sel_config_wcn7850() error: uninitialized symbol 'ret'. + +In ath12k_dp_rxdma_ring_sel_config_wcn7850() if it were ever the case +that ab->hw_params->num_rxdma_per_pdev was 0 then 'ret' would be +uninitialized when it is returned. This should never be the case, but +to be safe and to quiet smatch, add an initializer to the declaration +of 'ret'. + +No functional changes, compile tested only. + +Signed-off-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240504-ath12k_dp_rxdma_ring_sel_config_wcn7850-ret-v1-2-44d2843a2857@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/dp_rx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c +index 1d287ed25a94..3cdc4c51d6df 100644 +--- a/drivers/net/wireless/ath/ath12k/dp_rx.c ++++ b/drivers/net/wireless/ath/ath12k/dp_rx.c +@@ -4058,7 +4058,7 @@ int ath12k_dp_rxdma_ring_sel_config_wcn7850(struct ath12k_base *ab) + struct ath12k_dp *dp = &ab->dp; + struct htt_rx_ring_tlv_filter tlv_filter = {0}; + u32 ring_id; +- int ret; ++ int ret = 0; + u32 hal_rx_desc_sz = ab->hal.hal_desc_sz; + int i; + +-- +2.43.0 + diff --git a/queue-6.10/wifi-ath12k-initialize-ret-in-ath12k_qmi_load_file_t.patch b/queue-6.10/wifi-ath12k-initialize-ret-in-ath12k_qmi_load_file_t.patch new file mode 100644 index 00000000000..22636ce1644 --- /dev/null +++ b/queue-6.10/wifi-ath12k-initialize-ret-in-ath12k_qmi_load_file_t.patch @@ -0,0 +1,45 @@ +From a30b6180bdcb7f16321ec0546394affd4d1173d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 May 2024 11:52:08 -0700 +Subject: wifi: ath12k: initialize 'ret' in ath12k_qmi_load_file_target_mem() + +From: Jeff Johnson + +[ Upstream commit bb0b0a6b96e6de854cb1e349e17bd0e8bf421a59 ] + +smatch flagged the following issue: + +drivers/net/wireless/ath/ath12k/qmi.c:2619 ath12k_qmi_load_file_target_mem() error: uninitialized symbol 'ret'. + +The reality is that 'ret' is initialized in every path through +ath12k_qmi_load_file_target_mem() except one, the case where the input +'len' is 0, and hence the "while (remaining)" loop is never entered. +But to make sure this case is also handled, add an initializer to the +declaration of 'ret'. + +No functional changes, compile tested only. + +Signed-off-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240504-qmi_load_file_target_mem-v1-1-069fc44c45eb@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/qmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath12k/qmi.c b/drivers/net/wireless/ath/ath12k/qmi.c +index 5484112859a6..6d1ebbba17d9 100644 +--- a/drivers/net/wireless/ath/ath12k/qmi.c ++++ b/drivers/net/wireless/ath/ath12k/qmi.c +@@ -2538,7 +2538,7 @@ static int ath12k_qmi_load_file_target_mem(struct ath12k_base *ab, + struct qmi_wlanfw_bdf_download_resp_msg_v01 resp = {}; + struct qmi_txn txn; + const u8 *temp = data; +- int ret; ++ int ret = 0; + u32 remaining = len; + + req = kzalloc(sizeof(*req), GFP_KERNEL); +-- +2.43.0 + diff --git a/queue-6.10/wifi-cfg80211-make-hash-table-duplicates-more-surviv.patch b/queue-6.10/wifi-cfg80211-make-hash-table-duplicates-more-surviv.patch new file mode 100644 index 00000000000..e008adeca6e --- /dev/null +++ b/queue-6.10/wifi-cfg80211-make-hash-table-duplicates-more-surviv.patch @@ -0,0 +1,130 @@ +From 598dce4d4cbfcfccd3ea169db1e080b700df0d65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 20:17:17 +0200 +Subject: wifi: cfg80211: make hash table duplicates more survivable + +From: Johannes Berg + +[ Upstream commit 7f12e26a194d0043441f870708093d9c2c3bad7d ] + +Jiazi Li reported that they occasionally see hash table duplicates +as evidenced by the WARN_ON() in rb_insert_bss() in this code. It +isn't clear how that happens, nor have I been able to reproduce it, +but if it does happen, the kernel crashes later, when it tries to +unhash the entry that's now not hashed. + +Try to make this situation more survivable by removing the BSS from +the list(s) as well, that way it's fully leaked here (as had been +the intent in the hash insert error path), and no longer reachable +through the list(s) so it shouldn't be unhashed again later. + +Link: https://lore.kernel.org/r/20231026013528.GA24122@Jiazi.Li +Signed-off-by: Johannes Berg +Link: https://msgid.link/20240607181726.36835-2-johannes@sipsolutions.net +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/scan.c | 46 +++++++++++++++++++++++++++++++++------------ + 1 file changed, 34 insertions(+), 12 deletions(-) + +diff --git a/net/wireless/scan.c b/net/wireless/scan.c +index 292b530a6dd3..64c779788a64 100644 +--- a/net/wireless/scan.c ++++ b/net/wireless/scan.c +@@ -1604,7 +1604,7 @@ struct cfg80211_bss *__cfg80211_get_bss(struct wiphy *wiphy, + } + EXPORT_SYMBOL(__cfg80211_get_bss); + +-static void rb_insert_bss(struct cfg80211_registered_device *rdev, ++static bool rb_insert_bss(struct cfg80211_registered_device *rdev, + struct cfg80211_internal_bss *bss) + { + struct rb_node **p = &rdev->bss_tree.rb_node; +@@ -1620,7 +1620,7 @@ static void rb_insert_bss(struct cfg80211_registered_device *rdev, + + if (WARN_ON(!cmp)) { + /* will sort of leak this BSS */ +- return; ++ return false; + } + + if (cmp < 0) +@@ -1631,6 +1631,7 @@ static void rb_insert_bss(struct cfg80211_registered_device *rdev, + + rb_link_node(&bss->rbn, parent, p); + rb_insert_color(&bss->rbn, &rdev->bss_tree); ++ return true; + } + + static struct cfg80211_internal_bss * +@@ -1657,6 +1658,34 @@ rb_find_bss(struct cfg80211_registered_device *rdev, + return NULL; + } + ++static void cfg80211_insert_bss(struct cfg80211_registered_device *rdev, ++ struct cfg80211_internal_bss *bss) ++{ ++ lockdep_assert_held(&rdev->bss_lock); ++ ++ if (!rb_insert_bss(rdev, bss)) ++ return; ++ list_add_tail(&bss->list, &rdev->bss_list); ++ rdev->bss_entries++; ++} ++ ++static void cfg80211_rehash_bss(struct cfg80211_registered_device *rdev, ++ struct cfg80211_internal_bss *bss) ++{ ++ lockdep_assert_held(&rdev->bss_lock); ++ ++ rb_erase(&bss->rbn, &rdev->bss_tree); ++ if (!rb_insert_bss(rdev, bss)) { ++ list_del(&bss->list); ++ if (!list_empty(&bss->hidden_list)) ++ list_del_init(&bss->hidden_list); ++ if (!list_empty(&bss->pub.nontrans_list)) ++ list_del_init(&bss->pub.nontrans_list); ++ rdev->bss_entries--; ++ } ++ rdev->bss_generation++; ++} ++ + static bool cfg80211_combine_bsses(struct cfg80211_registered_device *rdev, + struct cfg80211_internal_bss *new) + { +@@ -1969,9 +1998,7 @@ __cfg80211_bss_update(struct cfg80211_registered_device *rdev, + bss_ref_get(rdev, bss_from_pub(tmp->pub.transmitted_bss)); + } + +- list_add_tail(&new->list, &rdev->bss_list); +- rdev->bss_entries++; +- rb_insert_bss(rdev, new); ++ cfg80211_insert_bss(rdev, new); + found = new; + } + +@@ -3354,19 +3381,14 @@ void cfg80211_update_assoc_bss_entry(struct wireless_dev *wdev, + if (!WARN_ON(!__cfg80211_unlink_bss(rdev, new))) + rdev->bss_generation++; + } +- +- rb_erase(&cbss->rbn, &rdev->bss_tree); +- rb_insert_bss(rdev, cbss); +- rdev->bss_generation++; ++ cfg80211_rehash_bss(rdev, cbss); + + list_for_each_entry_safe(nontrans_bss, tmp, + &cbss->pub.nontrans_list, + nontrans_list) { + bss = bss_from_pub(nontrans_bss); + bss->pub.channel = chan; +- rb_erase(&bss->rbn, &rdev->bss_tree); +- rb_insert_bss(rdev, bss); +- rdev->bss_generation++; ++ cfg80211_rehash_bss(rdev, bss); + } + + done: +-- +2.43.0 + diff --git a/queue-6.10/wifi-cfg80211-restrict-operation-during-radar-detect.patch b/queue-6.10/wifi-cfg80211-restrict-operation-during-radar-detect.patch new file mode 100644 index 00000000000..58e5b67f1f1 --- /dev/null +++ b/queue-6.10/wifi-cfg80211-restrict-operation-during-radar-detect.patch @@ -0,0 +1,122 @@ +From c2a234406964b2ae3e87c1e1bbc8eff0450d65ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 May 2024 21:11:59 +0200 +Subject: wifi: cfg80211: restrict operation during radar detection + +From: Johannes Berg + +[ Upstream commit 2d33ecf5d0148671c74e68e18755b9411a7ba923 ] + +Just like it's not currently possible to start radar +detection while already operating, it shouldn't be +possible to start operating while radar detection is +running. Fix that. + +Also, improve the check whether operating (carrier +might not be up if e.g. attempting to join IBSS). + +Reviewed-by: Miriam Rachel Korenblit +Link: https://msgid.link/20240506211158.ae8dca3d0d6c.I7c70a66a5fbdbc63a78fee8a34f31d1995491bc3@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/ibss.c | 5 ++++- + net/wireless/mesh.c | 5 ++++- + net/wireless/nl80211.c | 21 +++++++++++++++------ + 3 files changed, 23 insertions(+), 8 deletions(-) + +diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c +index 9f02ee5f08be..34e5acff3935 100644 +--- a/net/wireless/ibss.c ++++ b/net/wireless/ibss.c +@@ -3,7 +3,7 @@ + * Some IBSS support code for cfg80211. + * + * Copyright 2009 Johannes Berg +- * Copyright (C) 2020-2023 Intel Corporation ++ * Copyright (C) 2020-2024 Intel Corporation + */ + + #include +@@ -94,6 +94,9 @@ int __cfg80211_join_ibss(struct cfg80211_registered_device *rdev, + + lockdep_assert_held(&rdev->wiphy.mtx); + ++ if (wdev->cac_started) ++ return -EBUSY; ++ + if (wdev->u.ibss.ssid_len) + return -EALREADY; + +diff --git a/net/wireless/mesh.c b/net/wireless/mesh.c +index 83306979fbe2..aaca65b66af4 100644 +--- a/net/wireless/mesh.c ++++ b/net/wireless/mesh.c +@@ -1,7 +1,7 @@ + // SPDX-License-Identifier: GPL-2.0 + /* + * Portions +- * Copyright (C) 2022-2023 Intel Corporation ++ * Copyright (C) 2022-2024 Intel Corporation + */ + #include + #include +@@ -127,6 +127,9 @@ int __cfg80211_join_mesh(struct cfg80211_registered_device *rdev, + if (!rdev->ops->join_mesh) + return -EOPNOTSUPP; + ++ if (wdev->cac_started) ++ return -EBUSY; ++ + if (!setup->chandef.chan) { + /* if no channel explicitly given, use preset channel */ + setup->chandef = wdev->u.mesh.preset_chandef; +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index c2829d673bc7..967bc4935b4e 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -5965,6 +5965,9 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info) + if (!rdev->ops->start_ap) + return -EOPNOTSUPP; + ++ if (wdev->cac_started) ++ return -EBUSY; ++ + if (wdev->links[link_id].ap.beacon_interval) + return -EALREADY; + +@@ -9957,6 +9960,17 @@ static int nl80211_start_radar_detection(struct sk_buff *skb, + + flush_delayed_work(&rdev->dfs_update_channels_wk); + ++ switch (wdev->iftype) { ++ case NL80211_IFTYPE_AP: ++ case NL80211_IFTYPE_P2P_GO: ++ case NL80211_IFTYPE_MESH_POINT: ++ case NL80211_IFTYPE_ADHOC: ++ break; ++ default: ++ /* caution - see cfg80211_beaconing_iface_active() below */ ++ return -EINVAL; ++ } ++ + wiphy_lock(wiphy); + + dfs_region = reg_get_dfs_region(wiphy); +@@ -9987,12 +10001,7 @@ static int nl80211_start_radar_detection(struct sk_buff *skb, + goto unlock; + } + +- if (netif_carrier_ok(dev)) { +- err = -EBUSY; +- goto unlock; +- } +- +- if (wdev->cac_started) { ++ if (cfg80211_beaconing_iface_active(wdev) || wdev->cac_started) { + err = -EBUSY; + goto unlock; + } +-- +2.43.0 + diff --git a/queue-6.10/wifi-iwlwifi-mvm-use-only-beacon-bss-load-for-active.patch b/queue-6.10/wifi-iwlwifi-mvm-use-only-beacon-bss-load-for-active.patch new file mode 100644 index 00000000000..13f1860b1a2 --- /dev/null +++ b/queue-6.10/wifi-iwlwifi-mvm-use-only-beacon-bss-load-for-active.patch @@ -0,0 +1,72 @@ +From 2699a1a526051f66a004f360b49806ba9f8e607d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 May 2024 19:06:08 +0300 +Subject: wifi: iwlwifi: mvm: use only beacon BSS load for active links + +From: Johannes Berg + +[ Upstream commit d9b7531fe98a0c2a0387270557cf0a514c28dd28 ] + +For active links, don't take information that may have been +received in probe responses, as those are not protected. For +inactive links, there may not be a choice. + +Signed-off-by: Johannes Berg +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20240527190228.6947dc462fa9.I2076961211d6785c8a15b4308e0e87a413148222@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/link.c | 14 ++++++++++++-- + .../net/wireless/intel/iwlwifi/mvm/tests/links.c | 1 + + 2 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/link.c b/drivers/net/wireless/intel/iwlwifi/mvm/link.c +index 92ac6cc40faa..61b5648d3ab0 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/link.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/link.c +@@ -504,17 +504,27 @@ iwl_mvm_get_puncturing_factor(const struct ieee80211_bss_conf *link_conf) + static unsigned int + iwl_mvm_get_chan_load(struct ieee80211_bss_conf *link_conf) + { ++ struct ieee80211_vif *vif = link_conf->vif; + struct iwl_mvm_vif_link_info *mvm_link = + iwl_mvm_vif_from_mac80211(link_conf->vif)->link[link_conf->link_id]; + const struct element *bss_load_elem; + const struct ieee80211_bss_load_elem *bss_load; + enum nl80211_band band = link_conf->chanreq.oper.chan->band; ++ const struct cfg80211_bss_ies *ies; + unsigned int chan_load; + u32 chan_load_by_us; + + rcu_read_lock(); +- bss_load_elem = ieee80211_bss_get_elem(link_conf->bss, +- WLAN_EID_QBSS_LOAD); ++ if (ieee80211_vif_link_active(vif, link_conf->link_id)) ++ ies = rcu_dereference(link_conf->bss->beacon_ies); ++ else ++ ies = rcu_dereference(link_conf->bss->ies); ++ ++ if (ies) ++ bss_load_elem = cfg80211_find_elem(WLAN_EID_QBSS_LOAD, ++ ies->data, ies->len); ++ else ++ bss_load_elem = NULL; + + /* If there isn't BSS Load element, take the defaults */ + if (!bss_load_elem || +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tests/links.c b/drivers/net/wireless/intel/iwlwifi/mvm/tests/links.c +index f49e3c98b1ba..991dc875a7ea 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/tests/links.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tests/links.c +@@ -208,6 +208,7 @@ static void setup_link_conf(struct kunit *test) + bss_load->channel_util = params->channel_util; + + rcu_assign_pointer(bss.ies, ies); ++ rcu_assign_pointer(bss.beacon_ies, ies); + } + + static void test_link_grading(struct kunit *test) +-- +2.43.0 + diff --git a/queue-6.10/wifi-iwlwifi-remove-fw_running-op.patch b/queue-6.10/wifi-iwlwifi-remove-fw_running-op.patch new file mode 100644 index 00000000000..59020acd989 --- /dev/null +++ b/queue-6.10/wifi-iwlwifi-remove-fw_running-op.patch @@ -0,0 +1,80 @@ +From 4918fcf98933a877ef7460fb8761e479d96f86e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 May 2024 17:06:40 +0300 +Subject: wifi: iwlwifi: remove fw_running op + +From: Shahar S Matityahu + +[ Upstream commit 37733bffda3285d18bd1d72c14b3a1cf39c56a5e ] + +fw_running assumes that memory can be retrieved only after alive. +This assumption is no longer true as we support dump before alive. +To avoid invalid access to the NIC, check that STATUS_DEVICE_ENABLED +bit in trans status is set before dumping instead of the prior check. + +Signed-off-by: Shahar S Matityahu +Reviewed-by: Luciano Coelho +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20240510170500.ca07138cedeb.I090e31d3eaeb4ba19f5f84aba997ccd36927e9ac@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/fw/debugfs.c | 3 +-- + drivers/net/wireless/intel/iwlwifi/fw/runtime.h | 1 - + drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 6 ------ + 3 files changed, 1 insertion(+), 9 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c b/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c +index 751a125a1566..893b21fcaf87 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c ++++ b/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c +@@ -230,8 +230,7 @@ static ssize_t iwl_dbgfs_send_hcmd_write(struct iwl_fw_runtime *fwrt, char *buf, + .data = { NULL, }, + }; + +- if (fwrt->ops && fwrt->ops->fw_running && +- !fwrt->ops->fw_running(fwrt->ops_ctx)) ++ if (!iwl_trans_fw_running(fwrt->trans)) + return -EIO; + + if (count < header_size + 1 || count > 1024 * 4) +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/runtime.h b/drivers/net/wireless/intel/iwlwifi/fw/runtime.h +index 9122f9a1260a..d201440066ea 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/runtime.h ++++ b/drivers/net/wireless/intel/iwlwifi/fw/runtime.h +@@ -19,7 +19,6 @@ + struct iwl_fw_runtime_ops { + void (*dump_start)(void *ctx); + void (*dump_end)(void *ctx); +- bool (*fw_running)(void *ctx); + int (*send_hcmd)(void *ctx, struct iwl_host_cmd *host_cmd); + bool (*d3_debug_enable)(void *ctx); + }; +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c +index 1380ae5155f3..498afbe4ee6b 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c +@@ -770,11 +770,6 @@ static void iwl_mvm_fwrt_dump_end(void *ctx) + mutex_unlock(&mvm->mutex); + } + +-static bool iwl_mvm_fwrt_fw_running(void *ctx) +-{ +- return iwl_mvm_firmware_running(ctx); +-} +- + static int iwl_mvm_fwrt_send_hcmd(void *ctx, struct iwl_host_cmd *host_cmd) + { + struct iwl_mvm *mvm = (struct iwl_mvm *)ctx; +@@ -795,7 +790,6 @@ static bool iwl_mvm_d3_debug_enable(void *ctx) + static const struct iwl_fw_runtime_ops iwl_mvm_fwrt_ops = { + .dump_start = iwl_mvm_fwrt_dump_start, + .dump_end = iwl_mvm_fwrt_dump_end, +- .fw_running = iwl_mvm_fwrt_fw_running, + .send_hcmd = iwl_mvm_fwrt_send_hcmd, + .d3_debug_enable = iwl_mvm_d3_debug_enable, + }; +-- +2.43.0 + diff --git a/queue-6.10/wifi-mac80211-check-ieee80211_bss_info_change_notify.patch b/queue-6.10/wifi-mac80211-check-ieee80211_bss_info_change_notify.patch new file mode 100644 index 00000000000..898a5835fac --- /dev/null +++ b/queue-6.10/wifi-mac80211-check-ieee80211_bss_info_change_notify.patch @@ -0,0 +1,45 @@ +From 4b9956a8b8607f68a9082884e1a29438e051a6b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 May 2024 12:11:40 +0200 +Subject: wifi: mac80211: check ieee80211_bss_info_change_notify() against MLD + +From: Johannes Berg + +[ Upstream commit a0ca76e5b7d550fcd74753d5fdaaf23f1a9bfdb4 ] + +It's not valid to call ieee80211_bss_info_change_notify() with +an sdata that's an MLD, remove the FIXME comment (it's not true) +and add a warning. + +Reviewed-by: Miriam Rachel Korenblit +Link: https://msgid.link/20240523121140.97a589b13d24.I61988788d81fb3cf97a490dfd3167f67a141d1fd@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/mac80211/main.c b/net/mac80211/main.c +index 7ba329ebdda9..e44b2a26354b 100644 +--- a/net/mac80211/main.c ++++ b/net/mac80211/main.c +@@ -337,6 +337,8 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata, + + might_sleep(); + ++ WARN_ON_ONCE(ieee80211_vif_is_mld(&sdata->vif)); ++ + if (!changed || sdata->vif.type == NL80211_IFTYPE_AP_VLAN) + return; + +@@ -369,7 +371,6 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata, + if (changed & ~BSS_CHANGED_VIF_CFG_FLAGS) { + u64 ch = changed & ~BSS_CHANGED_VIF_CFG_FLAGS; + +- /* FIXME: should be for each link */ + trace_drv_link_info_changed(local, sdata, &sdata->vif.bss_conf, + changed); + if (local->ops->link_info_changed) +-- +2.43.0 + diff --git a/queue-6.10/wifi-rtw89-ser-avoid-multiple-deinit-on-same-cam.patch b/queue-6.10/wifi-rtw89-ser-avoid-multiple-deinit-on-same-cam.patch new file mode 100644 index 00000000000..a441bc32eed --- /dev/null +++ b/queue-6.10/wifi-rtw89-ser-avoid-multiple-deinit-on-same-cam.patch @@ -0,0 +1,44 @@ +From a8f49ba4fbf2773d026f61e2086f4f6c590a3fd2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 17:06:43 +0800 +Subject: wifi: rtw89: ser: avoid multiple deinit on same CAM + +From: Zong-Zhe Yang + +[ Upstream commit cea4066588308fa932b6b03486c608efff1d761c ] + +We did deinit CAM in STA iteration in VIF loop. But, the STA iteration +missed to restrict the target VIF. So, if there are multiple VIFs, we +would deinit a CAM multiple times. Now, fix it. + +Signed-off-by: Zong-Zhe Yang +Signed-off-by: Ping-Ke Shih +Link: https://msgid.link/20240509090646.35304-2-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/ser.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c +index 99896d85d2f8..5fc2faa9ba5a 100644 +--- a/drivers/net/wireless/realtek/rtw89/ser.c ++++ b/drivers/net/wireless/realtek/rtw89/ser.c +@@ -308,9 +308,13 @@ static void ser_reset_vif(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif) + + static void ser_sta_deinit_cam_iter(void *data, struct ieee80211_sta *sta) + { +- struct rtw89_vif *rtwvif = (struct rtw89_vif *)data; +- struct rtw89_dev *rtwdev = rtwvif->rtwdev; ++ struct rtw89_vif *target_rtwvif = (struct rtw89_vif *)data; + struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv; ++ struct rtw89_vif *rtwvif = rtwsta->rtwvif; ++ struct rtw89_dev *rtwdev = rtwvif->rtwdev; ++ ++ if (rtwvif != target_rtwvif) ++ return; + + if (rtwvif->net_type == RTW89_NET_TYPE_AP_MODE || sta->tdls) + rtw89_cam_deinit_addr_cam(rtwdev, &rtwsta->addr_cam); +-- +2.43.0 + -- 2.47.3