From 418a04107bf6b0444e763943ef2cd30e88a3a83a Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Mon, 13 Jan 2025 09:02:55 -0500 Subject: [PATCH] Fixes for 6.12 Signed-off-by: Sasha Levin --- ...arm-dts-imxrt1050-fix-clocks-for-mmc.patch | 36 ++ ...correct-the-address-length-of-netcmi.patch | 37 ++ ...a8775p-fix-the-secure-device-bootup-.patch | 37 ++ ...ip-add-hevc-power-domain-clock-to-rk.patch | 76 ++++ ...-waker_bfqq-uaf-after-bfq_split_bfqq.patch | 199 ++++++++++ ...y-touch-disp_reg_ovl_pitch_msb-if-af.patch | 130 +++++++ ...m-xe-oa-add-input-fence-dependencies.patch | 102 +++++ ...te-batch-submission-from-waiting-for.patch | 150 ++++++++ ...-define-and-parse-oa-sync-properties.patch | 253 ++++++++++++ ...misplaced-semicolon-from-stm32_firew.patch | 39 ++ ...fix-driver-producing-garbage-data-wh.patch | 70 ++++ ...e-between-de-compression-and-cpu-hot.patch | 119 ++++++ queue-6.12/series | 13 + ...-query-mode-of-operation-for-oar-oac.patch | 363 ++++++++++++++++++ 14 files changed, 1624 insertions(+) create mode 100644 queue-6.12/arm-dts-imxrt1050-fix-clocks-for-mmc.patch create mode 100644 queue-6.12/arm64-dts-imx95-correct-the-address-length-of-netcmi.patch create mode 100644 queue-6.12/arm64-dts-qcom-sa8775p-fix-the-secure-device-bootup-.patch create mode 100644 queue-6.12/arm64-dts-rockchip-add-hevc-power-domain-clock-to-rk.patch create mode 100644 queue-6.12/block-bfq-fix-waker_bfqq-uaf-after-bfq_split_bfqq.patch create mode 100644 queue-6.12/drm-mediatek-only-touch-disp_reg_ovl_pitch_msb-if-af.patch create mode 100644 queue-6.12/drm-xe-oa-add-input-fence-dependencies.patch create mode 100644 queue-6.12/drm-xe-oa-separate-batch-submission-from-waiting-for.patch create mode 100644 queue-6.12/drm-xe-oa-uapi-define-and-parse-oa-sync-properties.patch create mode 100644 queue-6.12/firewall-remove-misplaced-semicolon-from-stm32_firew.patch create mode 100644 queue-6.12/hwmon-drivetemp-fix-driver-producing-garbage-data-wh.patch create mode 100644 queue-6.12/mm-zswap-fix-race-between-de-compression-and-cpu-hot.patch create mode 100644 queue-6.12/xe-oa-fix-query-mode-of-operation-for-oar-oac.patch diff --git a/queue-6.12/arm-dts-imxrt1050-fix-clocks-for-mmc.patch b/queue-6.12/arm-dts-imxrt1050-fix-clocks-for-mmc.patch new file mode 100644 index 00000000000..2377d88675c --- /dev/null +++ b/queue-6.12/arm-dts-imxrt1050-fix-clocks-for-mmc.patch @@ -0,0 +1,36 @@ +From 39d9b4b5e04d1213eccbb858fccd69bb3f6264e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Nov 2024 10:36:41 -0500 +Subject: ARM: dts: imxrt1050: Fix clocks for mmc + +From: Jesse Taube + +[ Upstream commit 5f122030061db3e5d2bddd9cf5c583deaa6c54ff ] + +One of the usdhc1 controller's clocks should be IMXRT1050_CLK_AHB_PODF not +IMXRT1050_CLK_OSC. + +Fixes: 1c4f01be3490 ("ARM: dts: imx: Add i.MXRT1050-EVK support") +Signed-off-by: Jesse Taube +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/nxp/imx/imxrt1050.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/nxp/imx/imxrt1050.dtsi b/arch/arm/boot/dts/nxp/imx/imxrt1050.dtsi +index dd714d235d5f..b0bad0d1ba36 100644 +--- a/arch/arm/boot/dts/nxp/imx/imxrt1050.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imxrt1050.dtsi +@@ -87,7 +87,7 @@ + reg = <0x402c0000 0x4000>; + interrupts = <110>; + clocks = <&clks IMXRT1050_CLK_IPG_PDOF>, +- <&clks IMXRT1050_CLK_OSC>, ++ <&clks IMXRT1050_CLK_AHB_PODF>, + <&clks IMXRT1050_CLK_USDHC1>; + clock-names = "ipg", "ahb", "per"; + bus-width = <4>; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-imx95-correct-the-address-length-of-netcmi.patch b/queue-6.12/arm64-dts-imx95-correct-the-address-length-of-netcmi.patch new file mode 100644 index 00000000000..10e42348426 --- /dev/null +++ b/queue-6.12/arm64-dts-imx95-correct-the-address-length-of-netcmi.patch @@ -0,0 +1,37 @@ +From ca353fd95df0fd91ddba267ed7f99e21994d5d31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Nov 2024 13:46:02 +0800 +Subject: arm64: dts: imx95: correct the address length of netcmix_blk_ctrl + +From: Wei Fang + +[ Upstream commit c5b8d2c370842e3f9a15655893d8c597e2d981d9 ] + +The netc_blk_ctrl is controlled by the imx95-blk-ctl clock driver and +provides relevant clock configurations for NETC, SAI and MQS. Its address +length should be 8 bytes instead of 0x1000. + +Fixes: 7764fef26ea9 ("arm64: dts: imx95: Add NETCMIX block control support") +Signed-off-by: Wei Fang +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx95.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx95.dtsi b/arch/arm64/boot/dts/freescale/imx95.dtsi +index 03661e76550f..40cbb071f265 100644 +--- a/arch/arm64/boot/dts/freescale/imx95.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx95.dtsi +@@ -1609,7 +1609,7 @@ + + netcmix_blk_ctrl: syscon@4c810000 { + compatible = "nxp,imx95-netcmix-blk-ctrl", "syscon"; +- reg = <0x0 0x4c810000 0x0 0x10000>; ++ reg = <0x0 0x4c810000 0x0 0x8>; + #clock-cells = <1>; + clocks = <&scmi_clk IMX95_CLK_BUSNETCMIX>; + assigned-clocks = <&scmi_clk IMX95_CLK_BUSNETCMIX>; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-sa8775p-fix-the-secure-device-bootup-.patch b/queue-6.12/arm64-dts-qcom-sa8775p-fix-the-secure-device-bootup-.patch new file mode 100644 index 00000000000..e32ea8a614e --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-sa8775p-fix-the-secure-device-bootup-.patch @@ -0,0 +1,37 @@ +From 0b658c68726b8a6e4afe2d44ddd6a326ec92f754 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Dec 2024 10:52:16 +0800 +Subject: arm64: dts: qcom: sa8775p: fix the secure device bootup issue + +From: Jie Gan + +[ Upstream commit 8a6442ec3437083348f32a6159b9a67bf66417bc ] + +The secure device(fused) cannot bootup with TPDM_DCC device. So +disable it in DT. + +Fixes: 6596118ccdcd ("arm64: dts: qcom: Add coresight nodes for SA8775p") +Signed-off-by: Jie Gan +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20241219025216.3463527-1-quic_jiegan@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sa8775p.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/qcom/sa8775p.dtsi b/arch/arm64/boot/dts/qcom/sa8775p.dtsi +index 320a94dcac5c..8a21448c0fa8 100644 +--- a/arch/arm64/boot/dts/qcom/sa8775p.dtsi ++++ b/arch/arm64/boot/dts/qcom/sa8775p.dtsi +@@ -1940,6 +1940,7 @@ + + qcom,cmb-element-bits = <32>; + qcom,cmb-msrs-num = <32>; ++ status = "disabled"; + + out-ports { + port { +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-rockchip-add-hevc-power-domain-clock-to-rk.patch b/queue-6.12/arm64-dts-rockchip-add-hevc-power-domain-clock-to-rk.patch new file mode 100644 index 00000000000..283a6601fcc --- /dev/null +++ b/queue-6.12/arm64-dts-rockchip-add-hevc-power-domain-clock-to-rk.patch @@ -0,0 +1,76 @@ +From 7a0ddf413ae22e03f84734d03471ecce78436ee8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Dec 2024 22:43:39 +0000 +Subject: arm64: dts: rockchip: add hevc power domain clock to rk3328 + +From: Peter Geis + +[ Upstream commit 3699f2c43ea9984e00d70463f8c29baaf260ea97 ] + +There is a race condition at startup between disabling power domains not +used and disabling clocks not used on the rk3328. When the clocks are +disabled first, the hevc power domain fails to shut off leading to a +splat of failures. Add the hevc core clock to the rk3328 power domain +node to prevent this condition. + +rcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks: { 3-.... } +1087 jiffies s: 89 root: 0x8/. +rcu: blocking rcu_node structures (internal RCU debug): +Sending NMI from CPU 0 to CPUs 3: +NMI backtrace for cpu 3 +CPU: 3 UID: 0 PID: 86 Comm: kworker/3:3 Not tainted 6.12.0-rc5+ #53 +Hardware name: Firefly ROC-RK3328-CC (DT) +Workqueue: pm genpd_power_off_work_fn +pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : regmap_unlock_spinlock+0x18/0x30 +lr : regmap_read+0x60/0x88 +sp : ffff800081123c00 +x29: ffff800081123c00 x28: ffff2fa4c62cad80 x27: 0000000000000000 +x26: ffffd74e6e660eb8 x25: ffff2fa4c62cae00 x24: 0000000000000040 +x23: ffffd74e6d2f3ab8 x22: 0000000000000001 x21: ffff800081123c74 +x20: 0000000000000000 x19: ffff2fa4c0412000 x18: 0000000000000000 +x17: 77202c31203d2065 x16: 6c6469203a72656c x15: 6c6f72746e6f632d +x14: 7265776f703a6e6f x13: 2063766568206e69 x12: 616d6f64202c3431 +x11: 347830206f742030 x10: 3430303034783020 x9 : ffffd74e6c7369e0 +x8 : 3030316666206e69 x7 : 205d383738353733 x6 : 332e31202020205b +x5 : ffffd74e6c73fc88 x4 : ffffd74e6c73fcd4 x3 : ffffd74e6c740b40 +x2 : ffff800080015484 x1 : 0000000000000000 x0 : ffff2fa4c0412000 +Call trace: +regmap_unlock_spinlock+0x18/0x30 +rockchip_pmu_set_idle_request+0xac/0x2c0 +rockchip_pd_power+0x144/0x5f8 +rockchip_pd_power_off+0x1c/0x30 +_genpd_power_off+0x9c/0x180 +genpd_power_off.part.0.isra.0+0x130/0x2a8 +genpd_power_off_work_fn+0x6c/0x98 +process_one_work+0x170/0x3f0 +worker_thread+0x290/0x4a8 +kthread+0xec/0xf8 +ret_from_fork+0x10/0x20 +rockchip-pm-domain ff100000.syscon:power-controller: failed to get ack on domain 'hevc', val=0x88220 + +Fixes: 52e02d377a72 ("arm64: dts: rockchip: add core dtsi file for RK3328 SoCs") +Signed-off-by: Peter Geis +Reviewed-by: Dragan Simic +Link: https://lore.kernel.org/r/20241214224339.24674-1-pgwipeout@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3328.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +index c01a4cad48f3..d16a13d6442f 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +@@ -333,6 +333,7 @@ + + power-domain@RK3328_PD_HEVC { + reg = ; ++ clocks = <&cru SCLK_VENC_CORE>; + #power-domain-cells = <0>; + }; + power-domain@RK3328_PD_VIDEO { +-- +2.39.5 + diff --git a/queue-6.12/block-bfq-fix-waker_bfqq-uaf-after-bfq_split_bfqq.patch b/queue-6.12/block-bfq-fix-waker_bfqq-uaf-after-bfq_split_bfqq.patch new file mode 100644 index 00000000000..48aa298599f --- /dev/null +++ b/queue-6.12/block-bfq-fix-waker_bfqq-uaf-after-bfq_split_bfqq.patch @@ -0,0 +1,199 @@ +From bef7a18239dcf1350b3047e61810c423e099e1b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jan 2025 16:41:48 +0800 +Subject: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() + +From: Yu Kuai + +[ Upstream commit fcede1f0a043ccefe9bc6ad57f12718e42f63f1d ] + +Our syzkaller report a following UAF for v6.6: + +BUG: KASAN: slab-use-after-free in bfq_init_rq+0x175d/0x17a0 block/bfq-iosched.c:6958 +Read of size 8 at addr ffff8881b57147d8 by task fsstress/232726 + +CPU: 2 PID: 232726 Comm: fsstress Not tainted 6.6.0-g3629d1885222 #39 +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x91/0xf0 lib/dump_stack.c:106 + print_address_description.constprop.0+0x66/0x300 mm/kasan/report.c:364 + print_report+0x3e/0x70 mm/kasan/report.c:475 + kasan_report+0xb8/0xf0 mm/kasan/report.c:588 + hlist_add_head include/linux/list.h:1023 [inline] + bfq_init_rq+0x175d/0x17a0 block/bfq-iosched.c:6958 + bfq_insert_request.isra.0+0xe8/0xa20 block/bfq-iosched.c:6271 + bfq_insert_requests+0x27f/0x390 block/bfq-iosched.c:6323 + blk_mq_insert_request+0x290/0x8f0 block/blk-mq.c:2660 + blk_mq_submit_bio+0x1021/0x15e0 block/blk-mq.c:3143 + __submit_bio+0xa0/0x6b0 block/blk-core.c:639 + __submit_bio_noacct_mq block/blk-core.c:718 [inline] + submit_bio_noacct_nocheck+0x5b7/0x810 block/blk-core.c:747 + submit_bio_noacct+0xca0/0x1990 block/blk-core.c:847 + __ext4_read_bh fs/ext4/super.c:205 [inline] + ext4_read_bh+0x15e/0x2e0 fs/ext4/super.c:230 + __read_extent_tree_block+0x304/0x6f0 fs/ext4/extents.c:567 + ext4_find_extent+0x479/0xd20 fs/ext4/extents.c:947 + ext4_ext_map_blocks+0x1a3/0x2680 fs/ext4/extents.c:4182 + ext4_map_blocks+0x929/0x15a0 fs/ext4/inode.c:660 + ext4_iomap_begin_report+0x298/0x480 fs/ext4/inode.c:3569 + iomap_iter+0x3dd/0x1010 fs/iomap/iter.c:91 + iomap_fiemap+0x1f4/0x360 fs/iomap/fiemap.c:80 + ext4_fiemap+0x181/0x210 fs/ext4/extents.c:5051 + ioctl_fiemap.isra.0+0x1b4/0x290 fs/ioctl.c:220 + do_vfs_ioctl+0x31c/0x11a0 fs/ioctl.c:811 + __do_sys_ioctl fs/ioctl.c:869 [inline] + __se_sys_ioctl+0xae/0x190 fs/ioctl.c:857 + do_syscall_x64 arch/x86/entry/common.c:51 [inline] + do_syscall_64+0x70/0x120 arch/x86/entry/common.c:81 + entry_SYSCALL_64_after_hwframe+0x78/0xe2 + +Allocated by task 232719: + kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 + kasan_set_track+0x25/0x30 mm/kasan/common.c:52 + __kasan_slab_alloc+0x87/0x90 mm/kasan/common.c:328 + kasan_slab_alloc include/linux/kasan.h:188 [inline] + slab_post_alloc_hook mm/slab.h:768 [inline] + slab_alloc_node mm/slub.c:3492 [inline] + kmem_cache_alloc_node+0x1b8/0x6f0 mm/slub.c:3537 + bfq_get_queue+0x215/0x1f00 block/bfq-iosched.c:5869 + bfq_get_bfqq_handle_split+0x167/0x5f0 block/bfq-iosched.c:6776 + bfq_init_rq+0x13a4/0x17a0 block/bfq-iosched.c:6938 + bfq_insert_request.isra.0+0xe8/0xa20 block/bfq-iosched.c:6271 + bfq_insert_requests+0x27f/0x390 block/bfq-iosched.c:6323 + blk_mq_insert_request+0x290/0x8f0 block/blk-mq.c:2660 + blk_mq_submit_bio+0x1021/0x15e0 block/blk-mq.c:3143 + __submit_bio+0xa0/0x6b0 block/blk-core.c:639 + __submit_bio_noacct_mq block/blk-core.c:718 [inline] + submit_bio_noacct_nocheck+0x5b7/0x810 block/blk-core.c:747 + submit_bio_noacct+0xca0/0x1990 block/blk-core.c:847 + __ext4_read_bh fs/ext4/super.c:205 [inline] + ext4_read_bh_nowait+0x15a/0x240 fs/ext4/super.c:217 + ext4_read_bh_lock+0xac/0xd0 fs/ext4/super.c:242 + ext4_bread_batch+0x268/0x500 fs/ext4/inode.c:958 + __ext4_find_entry+0x448/0x10f0 fs/ext4/namei.c:1671 + ext4_lookup_entry fs/ext4/namei.c:1774 [inline] + ext4_lookup.part.0+0x359/0x6f0 fs/ext4/namei.c:1842 + ext4_lookup+0x72/0x90 fs/ext4/namei.c:1839 + __lookup_slow+0x257/0x480 fs/namei.c:1696 + lookup_slow fs/namei.c:1713 [inline] + walk_component+0x454/0x5c0 fs/namei.c:2004 + link_path_walk.part.0+0x773/0xda0 fs/namei.c:2331 + link_path_walk fs/namei.c:3826 [inline] + path_openat+0x1b9/0x520 fs/namei.c:3826 + do_filp_open+0x1b7/0x400 fs/namei.c:3857 + do_sys_openat2+0x5dc/0x6e0 fs/open.c:1428 + do_sys_open fs/open.c:1443 [inline] + __do_sys_openat fs/open.c:1459 [inline] + __se_sys_openat fs/open.c:1454 [inline] + __x64_sys_openat+0x148/0x200 fs/open.c:1454 + do_syscall_x64 arch/x86/entry/common.c:51 [inline] + do_syscall_64+0x70/0x120 arch/x86/entry/common.c:81 + entry_SYSCALL_64_after_hwframe+0x78/0xe2 + +Freed by task 232726: + kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 + kasan_set_track+0x25/0x30 mm/kasan/common.c:52 + kasan_save_free_info+0x2b/0x50 mm/kasan/generic.c:522 + ____kasan_slab_free mm/kasan/common.c:236 [inline] + __kasan_slab_free+0x12a/0x1b0 mm/kasan/common.c:244 + kasan_slab_free include/linux/kasan.h:164 [inline] + slab_free_hook mm/slub.c:1827 [inline] + slab_free_freelist_hook mm/slub.c:1853 [inline] + slab_free mm/slub.c:3820 [inline] + kmem_cache_free+0x110/0x760 mm/slub.c:3842 + bfq_put_queue+0x6a7/0xfb0 block/bfq-iosched.c:5428 + bfq_forget_entity block/bfq-wf2q.c:634 [inline] + bfq_put_idle_entity+0x142/0x240 block/bfq-wf2q.c:645 + bfq_forget_idle+0x189/0x1e0 block/bfq-wf2q.c:671 + bfq_update_vtime block/bfq-wf2q.c:1280 [inline] + __bfq_lookup_next_entity block/bfq-wf2q.c:1374 [inline] + bfq_lookup_next_entity+0x350/0x480 block/bfq-wf2q.c:1433 + bfq_update_next_in_service+0x1c0/0x4f0 block/bfq-wf2q.c:128 + bfq_deactivate_entity+0x10a/0x240 block/bfq-wf2q.c:1188 + bfq_deactivate_bfqq block/bfq-wf2q.c:1592 [inline] + bfq_del_bfqq_busy+0x2e8/0xad0 block/bfq-wf2q.c:1659 + bfq_release_process_ref+0x1cc/0x220 block/bfq-iosched.c:3139 + bfq_split_bfqq+0x481/0xdf0 block/bfq-iosched.c:6754 + bfq_init_rq+0xf29/0x17a0 block/bfq-iosched.c:6934 + bfq_insert_request.isra.0+0xe8/0xa20 block/bfq-iosched.c:6271 + bfq_insert_requests+0x27f/0x390 block/bfq-iosched.c:6323 + blk_mq_insert_request+0x290/0x8f0 block/blk-mq.c:2660 + blk_mq_submit_bio+0x1021/0x15e0 block/blk-mq.c:3143 + __submit_bio+0xa0/0x6b0 block/blk-core.c:639 + __submit_bio_noacct_mq block/blk-core.c:718 [inline] + submit_bio_noacct_nocheck+0x5b7/0x810 block/blk-core.c:747 + submit_bio_noacct+0xca0/0x1990 block/blk-core.c:847 + __ext4_read_bh fs/ext4/super.c:205 [inline] + ext4_read_bh+0x15e/0x2e0 fs/ext4/super.c:230 + __read_extent_tree_block+0x304/0x6f0 fs/ext4/extents.c:567 + ext4_find_extent+0x479/0xd20 fs/ext4/extents.c:947 + ext4_ext_map_blocks+0x1a3/0x2680 fs/ext4/extents.c:4182 + ext4_map_blocks+0x929/0x15a0 fs/ext4/inode.c:660 + ext4_iomap_begin_report+0x298/0x480 fs/ext4/inode.c:3569 + iomap_iter+0x3dd/0x1010 fs/iomap/iter.c:91 + iomap_fiemap+0x1f4/0x360 fs/iomap/fiemap.c:80 + ext4_fiemap+0x181/0x210 fs/ext4/extents.c:5051 + ioctl_fiemap.isra.0+0x1b4/0x290 fs/ioctl.c:220 + do_vfs_ioctl+0x31c/0x11a0 fs/ioctl.c:811 + __do_sys_ioctl fs/ioctl.c:869 [inline] + __se_sys_ioctl+0xae/0x190 fs/ioctl.c:857 + do_syscall_x64 arch/x86/entry/common.c:51 [inline] + do_syscall_64+0x70/0x120 arch/x86/entry/common.c:81 + entry_SYSCALL_64_after_hwframe+0x78/0xe2 + +commit 1ba0403ac644 ("block, bfq: fix uaf for accessing waker_bfqq after +splitting") fix the problem that if waker_bfqq is in the merge chain, +and current is the only procress, waker_bfqq can be freed from +bfq_split_bfqq(). However, the case that waker_bfqq is not in the merge +chain is missed, and if the procress reference of waker_bfqq is 0, +waker_bfqq can be freed as well. + +Fix the problem by checking procress reference if waker_bfqq is not in +the merge_chain. + +Fixes: 1ba0403ac644 ("block, bfq: fix uaf for accessing waker_bfqq after splitting") +Signed-off-by: Hou Tao +Signed-off-by: Yu Kuai +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20250108084148.1549973-1-yukuai1@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bfq-iosched.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index 95dd7b795935..cad16c163611 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -6844,16 +6844,24 @@ static struct bfq_queue *bfq_waker_bfqq(struct bfq_queue *bfqq) + if (new_bfqq == waker_bfqq) { + /* + * If waker_bfqq is in the merge chain, and current +- * is the only procress. ++ * is the only process, waker_bfqq can be freed. + */ + if (bfqq_process_refs(waker_bfqq) == 1) + return NULL; +- break; ++ ++ return waker_bfqq; + } + + new_bfqq = new_bfqq->new_bfqq; + } + ++ /* ++ * If waker_bfqq is not in the merge chain, and it's procress reference ++ * is 0, waker_bfqq can be freed. ++ */ ++ if (bfqq_process_refs(waker_bfqq) == 0) ++ return NULL; ++ + return waker_bfqq; + } + +-- +2.39.5 + diff --git a/queue-6.12/drm-mediatek-only-touch-disp_reg_ovl_pitch_msb-if-af.patch b/queue-6.12/drm-mediatek-only-touch-disp_reg_ovl_pitch_msb-if-af.patch new file mode 100644 index 00000000000..3ae02cb3642 --- /dev/null +++ b/queue-6.12/drm-mediatek-only-touch-disp_reg_ovl_pitch_msb-if-af.patch @@ -0,0 +1,130 @@ +From 0e34f4c63f10f5d956f2ac0fc86751a5bbf3cb6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Dec 2024 01:18:01 +0000 +Subject: drm/mediatek: Only touch DISP_REG_OVL_PITCH_MSB if AFBC is supported + +From: Daniel Golle + +[ Upstream commit f8d9b91739e1fb436447c437a346a36deb676a36 ] + +Touching DISP_REG_OVL_PITCH_MSB leads to video overlay on MT2701, MT7623N +and probably other older SoCs being broken. + +Move setting up AFBC layer configuration into a separate function only +being called on hardware which actually supports AFBC which restores the +behavior as it was before commit c410fa9b07c3 ("drm/mediatek: Add AFBC +support to Mediatek DRM driver") on non-AFBC hardware. + +Fixes: c410fa9b07c3 ("drm/mediatek: Add AFBC support to Mediatek DRM driver") +Cc: stable@vger.kernel.org +Signed-off-by: Daniel Golle +Reviewed-by: CK Hu +Link: https://patchwork.kernel.org/project/dri-devel/patch/c7fbd3c3e633c0b7dd6d1cd78ccbdded31e1ca0f.1734397800.git.daniel@makrotopia.org/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_disp_ovl.c | 57 +++++++++++++------------ + 1 file changed, 29 insertions(+), 28 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c +index a3091bfcbd43..19b0d5083981 100644 +--- a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c ++++ b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c +@@ -460,6 +460,29 @@ static unsigned int mtk_ovl_fmt_convert(struct mtk_disp_ovl *ovl, + } + } + ++static void mtk_ovl_afbc_layer_config(struct mtk_disp_ovl *ovl, ++ unsigned int idx, ++ struct mtk_plane_pending_state *pending, ++ struct cmdq_pkt *cmdq_pkt) ++{ ++ unsigned int pitch_msb = pending->pitch >> 16; ++ unsigned int hdr_pitch = pending->hdr_pitch; ++ unsigned int hdr_addr = pending->hdr_addr; ++ ++ if (pending->modifier != DRM_FORMAT_MOD_LINEAR) { ++ mtk_ddp_write_relaxed(cmdq_pkt, hdr_addr, &ovl->cmdq_reg, ovl->regs, ++ DISP_REG_OVL_HDR_ADDR(ovl, idx)); ++ mtk_ddp_write_relaxed(cmdq_pkt, ++ OVL_PITCH_MSB_2ND_SUBBUF | pitch_msb, ++ &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_PITCH_MSB(idx)); ++ mtk_ddp_write_relaxed(cmdq_pkt, hdr_pitch, &ovl->cmdq_reg, ovl->regs, ++ DISP_REG_OVL_HDR_PITCH(ovl, idx)); ++ } else { ++ mtk_ddp_write_relaxed(cmdq_pkt, pitch_msb, ++ &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_PITCH_MSB(idx)); ++ } ++} ++ + void mtk_ovl_layer_config(struct device *dev, unsigned int idx, + struct mtk_plane_state *state, + struct cmdq_pkt *cmdq_pkt) +@@ -467,9 +490,7 @@ void mtk_ovl_layer_config(struct device *dev, unsigned int idx, + struct mtk_disp_ovl *ovl = dev_get_drvdata(dev); + struct mtk_plane_pending_state *pending = &state->pending; + unsigned int addr = pending->addr; +- unsigned int hdr_addr = pending->hdr_addr; +- unsigned int pitch = pending->pitch; +- unsigned int hdr_pitch = pending->hdr_pitch; ++ unsigned int pitch_lsb = pending->pitch & GENMASK(15, 0); + unsigned int fmt = pending->format; + unsigned int rotation = pending->rotation; + unsigned int offset = (pending->y << 16) | pending->x; +@@ -477,16 +498,6 @@ void mtk_ovl_layer_config(struct device *dev, unsigned int idx, + unsigned int blend_mode = state->base.pixel_blend_mode; + unsigned int ignore_pixel_alpha = 0; + unsigned int con; +- bool is_afbc = pending->modifier != DRM_FORMAT_MOD_LINEAR; +- union overlay_pitch { +- struct split_pitch { +- u16 lsb; +- u16 msb; +- } split_pitch; +- u32 pitch; +- } overlay_pitch; +- +- overlay_pitch.pitch = pitch; + + if (!pending->enable) { + mtk_ovl_layer_off(dev, idx, cmdq_pkt); +@@ -532,11 +543,12 @@ void mtk_ovl_layer_config(struct device *dev, unsigned int idx, + } + + if (ovl->data->supports_afbc) +- mtk_ovl_set_afbc(ovl, cmdq_pkt, idx, is_afbc); ++ mtk_ovl_set_afbc(ovl, cmdq_pkt, idx, ++ pending->modifier != DRM_FORMAT_MOD_LINEAR); + + mtk_ddp_write_relaxed(cmdq_pkt, con, &ovl->cmdq_reg, ovl->regs, + DISP_REG_OVL_CON(idx)); +- mtk_ddp_write_relaxed(cmdq_pkt, overlay_pitch.split_pitch.lsb | ignore_pixel_alpha, ++ mtk_ddp_write_relaxed(cmdq_pkt, pitch_lsb | ignore_pixel_alpha, + &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_PITCH(idx)); + mtk_ddp_write_relaxed(cmdq_pkt, src_size, &ovl->cmdq_reg, ovl->regs, + DISP_REG_OVL_SRC_SIZE(idx)); +@@ -545,19 +557,8 @@ void mtk_ovl_layer_config(struct device *dev, unsigned int idx, + mtk_ddp_write_relaxed(cmdq_pkt, addr, &ovl->cmdq_reg, ovl->regs, + DISP_REG_OVL_ADDR(ovl, idx)); + +- if (is_afbc) { +- mtk_ddp_write_relaxed(cmdq_pkt, hdr_addr, &ovl->cmdq_reg, ovl->regs, +- DISP_REG_OVL_HDR_ADDR(ovl, idx)); +- mtk_ddp_write_relaxed(cmdq_pkt, +- OVL_PITCH_MSB_2ND_SUBBUF | overlay_pitch.split_pitch.msb, +- &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_PITCH_MSB(idx)); +- mtk_ddp_write_relaxed(cmdq_pkt, hdr_pitch, &ovl->cmdq_reg, ovl->regs, +- DISP_REG_OVL_HDR_PITCH(ovl, idx)); +- } else { +- mtk_ddp_write_relaxed(cmdq_pkt, +- overlay_pitch.split_pitch.msb, +- &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_PITCH_MSB(idx)); +- } ++ if (ovl->data->supports_afbc) ++ mtk_ovl_afbc_layer_config(ovl, idx, pending, cmdq_pkt); + + mtk_ovl_set_bit_depth(dev, idx, fmt, cmdq_pkt); + mtk_ovl_layer_on(dev, idx, cmdq_pkt); +-- +2.39.5 + diff --git a/queue-6.12/drm-xe-oa-add-input-fence-dependencies.patch b/queue-6.12/drm-xe-oa-add-input-fence-dependencies.patch new file mode 100644 index 00000000000..778f6067924 --- /dev/null +++ b/queue-6.12/drm-xe-oa-add-input-fence-dependencies.patch @@ -0,0 +1,102 @@ +From 1cbfdf7ff79d7d72299f37f928d319e8b081e99b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Oct 2024 13:03:48 -0700 +Subject: drm/xe/oa: Add input fence dependencies + +From: Ashutosh Dixit + +[ Upstream commit 2fb4350a283af03a5ee34ba765783a941f942b82 ] + +Add input fence dependencies which will make OA configuration wait till +these dependencies are met (till input fences signal). + +v2: Change add_deps arg to xe_oa_submit_bb from bool to enum (Matt Brost) + +Reviewed-by: Jonathan Cavitt +Signed-off-by: Ashutosh Dixit +Link: https://patchwork.freedesktop.org/patch/msgid/20241022200352.1192560-4-ashutosh.dixit@intel.com +Stable-dep-of: f0ed39830e60 ("xe/oa: Fix query mode of operation for OAR/OAC") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_oa.c | 25 +++++++++++++++++++++---- + 1 file changed, 21 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_oa.c b/drivers/gpu/drm/xe/xe_oa.c +index 94c558d949e1..fd14d62bfb54 100644 +--- a/drivers/gpu/drm/xe/xe_oa.c ++++ b/drivers/gpu/drm/xe/xe_oa.c +@@ -42,6 +42,11 @@ + #define DEFAULT_POLL_PERIOD_NS (NSEC_PER_SEC / DEFAULT_POLL_FREQUENCY_HZ) + #define XE_OA_UNIT_INVALID U32_MAX + ++enum xe_oa_submit_deps { ++ XE_OA_SUBMIT_NO_DEPS, ++ XE_OA_SUBMIT_ADD_DEPS, ++}; ++ + struct xe_oa_reg { + struct xe_reg addr; + u32 value; +@@ -572,7 +577,8 @@ static __poll_t xe_oa_poll(struct file *file, poll_table *wait) + return ret; + } + +-static struct dma_fence *xe_oa_submit_bb(struct xe_oa_stream *stream, struct xe_bb *bb) ++static struct dma_fence *xe_oa_submit_bb(struct xe_oa_stream *stream, enum xe_oa_submit_deps deps, ++ struct xe_bb *bb) + { + struct xe_sched_job *job; + struct dma_fence *fence; +@@ -585,11 +591,22 @@ static struct dma_fence *xe_oa_submit_bb(struct xe_oa_stream *stream, struct xe_ + goto exit; + } + ++ if (deps == XE_OA_SUBMIT_ADD_DEPS) { ++ for (int i = 0; i < stream->num_syncs && !err; i++) ++ err = xe_sync_entry_add_deps(&stream->syncs[i], job); ++ if (err) { ++ drm_dbg(&stream->oa->xe->drm, "xe_sync_entry_add_deps err %d\n", err); ++ goto err_put_job; ++ } ++ } ++ + xe_sched_job_arm(job); + fence = dma_fence_get(&job->drm.s_fence->finished); + xe_sched_job_push(job); + + return fence; ++err_put_job: ++ xe_sched_job_put(job); + exit: + return ERR_PTR(err); + } +@@ -667,7 +684,7 @@ static int xe_oa_modify_ctx_image(struct xe_oa_stream *stream, struct xe_lrc *lr + + xe_oa_store_flex(stream, lrc, bb, flex, count); + +- fence = xe_oa_submit_bb(stream, bb); ++ fence = xe_oa_submit_bb(stream, XE_OA_SUBMIT_NO_DEPS, bb); + if (IS_ERR(fence)) { + err = PTR_ERR(fence); + goto free_bb; +@@ -696,7 +713,7 @@ static int xe_oa_load_with_lri(struct xe_oa_stream *stream, struct xe_oa_reg *re + + write_cs_mi_lri(bb, reg_lri, 1); + +- fence = xe_oa_submit_bb(stream, bb); ++ fence = xe_oa_submit_bb(stream, XE_OA_SUBMIT_NO_DEPS, bb); + if (IS_ERR(fence)) { + err = PTR_ERR(fence); + goto free_bb; +@@ -944,7 +961,7 @@ static int xe_oa_emit_oa_config(struct xe_oa_stream *stream, struct xe_oa_config + goto exit; + } + +- fence = xe_oa_submit_bb(stream, oa_bo->bb); ++ fence = xe_oa_submit_bb(stream, XE_OA_SUBMIT_ADD_DEPS, oa_bo->bb); + if (IS_ERR(fence)) { + err = PTR_ERR(fence); + goto exit; +-- +2.39.5 + diff --git a/queue-6.12/drm-xe-oa-separate-batch-submission-from-waiting-for.patch b/queue-6.12/drm-xe-oa-separate-batch-submission-from-waiting-for.patch new file mode 100644 index 00000000000..5c58c38348d --- /dev/null +++ b/queue-6.12/drm-xe-oa-separate-batch-submission-from-waiting-for.patch @@ -0,0 +1,150 @@ +From 9aeced687e728b9de067a502a0780f8029e61763 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Oct 2024 13:03:46 -0700 +Subject: drm/xe/oa: Separate batch submission from waiting for completion + +From: Ashutosh Dixit + +[ Upstream commit dddcb19ad4d4bbe943a72a1fb3266c6e8aa8d541 ] + +When we introduce xe_syncs, we don't wait for internal OA programming +batches to complete. That is, xe_syncs are signaled asynchronously. In +anticipation for this, separate out batch submission from waiting for +completion of those batches. + +v2: Change return type of xe_oa_submit_bb to "struct dma_fence *" (Matt B) +v3: Retain init "int err = 0;" in xe_oa_submit_bb (Jose) + +Reviewed-by: Jonathan Cavitt +Signed-off-by: Ashutosh Dixit +Link: https://patchwork.freedesktop.org/patch/msgid/20241022200352.1192560-2-ashutosh.dixit@intel.com +Stable-dep-of: f0ed39830e60 ("xe/oa: Fix query mode of operation for OAR/OAC") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_oa.c | 57 +++++++++++++++++++++++++++++--------- + 1 file changed, 44 insertions(+), 13 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_oa.c b/drivers/gpu/drm/xe/xe_oa.c +index 78823f53d290..4962c9eb9a81 100644 +--- a/drivers/gpu/drm/xe/xe_oa.c ++++ b/drivers/gpu/drm/xe/xe_oa.c +@@ -567,11 +567,10 @@ static __poll_t xe_oa_poll(struct file *file, poll_table *wait) + return ret; + } + +-static int xe_oa_submit_bb(struct xe_oa_stream *stream, struct xe_bb *bb) ++static struct dma_fence *xe_oa_submit_bb(struct xe_oa_stream *stream, struct xe_bb *bb) + { + struct xe_sched_job *job; + struct dma_fence *fence; +- long timeout; + int err = 0; + + /* Kernel configuration is issued on stream->k_exec_q, not stream->exec_q */ +@@ -585,14 +584,9 @@ static int xe_oa_submit_bb(struct xe_oa_stream *stream, struct xe_bb *bb) + fence = dma_fence_get(&job->drm.s_fence->finished); + xe_sched_job_push(job); + +- timeout = dma_fence_wait_timeout(fence, false, HZ); +- dma_fence_put(fence); +- if (timeout < 0) +- err = timeout; +- else if (!timeout) +- err = -ETIME; ++ return fence; + exit: +- return err; ++ return ERR_PTR(err); + } + + static void write_cs_mi_lri(struct xe_bb *bb, const struct xe_oa_reg *reg_data, u32 n_regs) +@@ -656,6 +650,7 @@ static void xe_oa_store_flex(struct xe_oa_stream *stream, struct xe_lrc *lrc, + static int xe_oa_modify_ctx_image(struct xe_oa_stream *stream, struct xe_lrc *lrc, + const struct flex *flex, u32 count) + { ++ struct dma_fence *fence; + struct xe_bb *bb; + int err; + +@@ -667,7 +662,16 @@ static int xe_oa_modify_ctx_image(struct xe_oa_stream *stream, struct xe_lrc *lr + + xe_oa_store_flex(stream, lrc, bb, flex, count); + +- err = xe_oa_submit_bb(stream, bb); ++ fence = xe_oa_submit_bb(stream, bb); ++ if (IS_ERR(fence)) { ++ err = PTR_ERR(fence); ++ goto free_bb; ++ } ++ xe_bb_free(bb, fence); ++ dma_fence_put(fence); ++ ++ return 0; ++free_bb: + xe_bb_free(bb, NULL); + exit: + return err; +@@ -675,6 +679,7 @@ static int xe_oa_modify_ctx_image(struct xe_oa_stream *stream, struct xe_lrc *lr + + static int xe_oa_load_with_lri(struct xe_oa_stream *stream, struct xe_oa_reg *reg_lri) + { ++ struct dma_fence *fence; + struct xe_bb *bb; + int err; + +@@ -686,7 +691,16 @@ static int xe_oa_load_with_lri(struct xe_oa_stream *stream, struct xe_oa_reg *re + + write_cs_mi_lri(bb, reg_lri, 1); + +- err = xe_oa_submit_bb(stream, bb); ++ fence = xe_oa_submit_bb(stream, bb); ++ if (IS_ERR(fence)) { ++ err = PTR_ERR(fence); ++ goto free_bb; ++ } ++ xe_bb_free(bb, fence); ++ dma_fence_put(fence); ++ ++ return 0; ++free_bb: + xe_bb_free(bb, NULL); + exit: + return err; +@@ -914,15 +928,32 @@ static int xe_oa_emit_oa_config(struct xe_oa_stream *stream, struct xe_oa_config + { + #define NOA_PROGRAM_ADDITIONAL_DELAY_US 500 + struct xe_oa_config_bo *oa_bo; +- int err, us = NOA_PROGRAM_ADDITIONAL_DELAY_US; ++ int err = 0, us = NOA_PROGRAM_ADDITIONAL_DELAY_US; ++ struct dma_fence *fence; ++ long timeout; + ++ /* Emit OA configuration batch */ + oa_bo = xe_oa_alloc_config_buffer(stream, config); + if (IS_ERR(oa_bo)) { + err = PTR_ERR(oa_bo); + goto exit; + } + +- err = xe_oa_submit_bb(stream, oa_bo->bb); ++ fence = xe_oa_submit_bb(stream, oa_bo->bb); ++ if (IS_ERR(fence)) { ++ err = PTR_ERR(fence); ++ goto exit; ++ } ++ ++ /* Wait till all previous batches have executed */ ++ timeout = dma_fence_wait_timeout(fence, false, 5 * HZ); ++ dma_fence_put(fence); ++ if (timeout < 0) ++ err = timeout; ++ else if (!timeout) ++ err = -ETIME; ++ if (err) ++ drm_dbg(&stream->oa->xe->drm, "dma_fence_wait_timeout err %d\n", err); + + /* Additional empirical delay needed for NOA programming after registers are written */ + usleep_range(us, 2 * us); +-- +2.39.5 + diff --git a/queue-6.12/drm-xe-oa-uapi-define-and-parse-oa-sync-properties.patch b/queue-6.12/drm-xe-oa-uapi-define-and-parse-oa-sync-properties.patch new file mode 100644 index 00000000000..15c144f9329 --- /dev/null +++ b/queue-6.12/drm-xe-oa-uapi-define-and-parse-oa-sync-properties.patch @@ -0,0 +1,253 @@ +From 756233c8ca6cada8855f9f98aeadce3a60799ab3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Oct 2024 13:03:47 -0700 +Subject: drm/xe/oa/uapi: Define and parse OA sync properties +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ashutosh Dixit + +[ Upstream commit c8507a25cebd179db935dd266a33c51bef1b1e80 ] + +Now that we have laid the groundwork, introduce OA sync properties in the +uapi and parse the input xe_sync array as is done elsewhere in the +driver. Also add DRM_XE_OA_CAPS_SYNCS bit in OA capabilities for userspace. + +v2: Fix and document DRM_XE_SYNC_TYPE_USER_FENCE for OA (Matt B) + Add DRM_XE_OA_CAPS_SYNCS bit to OA capabilities (Jose) + +Acked-by: José Roberto de Souza +Reviewed-by: Jonathan Cavitt +Signed-off-by: Ashutosh Dixit +Link: https://patchwork.freedesktop.org/patch/msgid/20241022200352.1192560-3-ashutosh.dixit@intel.com +Stable-dep-of: f0ed39830e60 ("xe/oa: Fix query mode of operation for OAR/OAC") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_oa.c | 83 +++++++++++++++++++++++++++++++- + drivers/gpu/drm/xe/xe_oa_types.h | 6 +++ + drivers/gpu/drm/xe/xe_query.c | 2 +- + include/uapi/drm/xe_drm.h | 17 +++++++ + 4 files changed, 106 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_oa.c b/drivers/gpu/drm/xe/xe_oa.c +index 4962c9eb9a81..94c558d949e1 100644 +--- a/drivers/gpu/drm/xe/xe_oa.c ++++ b/drivers/gpu/drm/xe/xe_oa.c +@@ -36,6 +36,7 @@ + #include "xe_pm.h" + #include "xe_sched_job.h" + #include "xe_sriov.h" ++#include "xe_sync.h" + + #define DEFAULT_POLL_FREQUENCY_HZ 200 + #define DEFAULT_POLL_PERIOD_NS (NSEC_PER_SEC / DEFAULT_POLL_FREQUENCY_HZ) +@@ -70,6 +71,7 @@ struct flex { + }; + + struct xe_oa_open_param { ++ struct xe_file *xef; + u32 oa_unit_id; + bool sample; + u32 metric_set; +@@ -81,6 +83,9 @@ struct xe_oa_open_param { + struct xe_exec_queue *exec_q; + struct xe_hw_engine *hwe; + bool no_preempt; ++ struct drm_xe_sync __user *syncs_user; ++ int num_syncs; ++ struct xe_sync_entry *syncs; + }; + + struct xe_oa_config_bo { +@@ -1393,6 +1398,9 @@ static int xe_oa_stream_init(struct xe_oa_stream *stream, + stream->period_exponent = param->period_exponent; + stream->no_preempt = param->no_preempt; + ++ stream->num_syncs = param->num_syncs; ++ stream->syncs = param->syncs; ++ + /* + * For Xe2+, when overrun mode is enabled, there are no partial reports at the end + * of buffer, making the OA buffer effectively a non-power-of-2 size circular +@@ -1743,6 +1751,20 @@ static int xe_oa_set_no_preempt(struct xe_oa *oa, u64 value, + return 0; + } + ++static int xe_oa_set_prop_num_syncs(struct xe_oa *oa, u64 value, ++ struct xe_oa_open_param *param) ++{ ++ param->num_syncs = value; ++ return 0; ++} ++ ++static int xe_oa_set_prop_syncs_user(struct xe_oa *oa, u64 value, ++ struct xe_oa_open_param *param) ++{ ++ param->syncs_user = u64_to_user_ptr(value); ++ return 0; ++} ++ + typedef int (*xe_oa_set_property_fn)(struct xe_oa *oa, u64 value, + struct xe_oa_open_param *param); + static const xe_oa_set_property_fn xe_oa_set_property_funcs[] = { +@@ -1755,6 +1777,8 @@ static const xe_oa_set_property_fn xe_oa_set_property_funcs[] = { + [DRM_XE_OA_PROPERTY_EXEC_QUEUE_ID] = xe_oa_set_prop_exec_queue_id, + [DRM_XE_OA_PROPERTY_OA_ENGINE_INSTANCE] = xe_oa_set_prop_engine_instance, + [DRM_XE_OA_PROPERTY_NO_PREEMPT] = xe_oa_set_no_preempt, ++ [DRM_XE_OA_PROPERTY_NUM_SYNCS] = xe_oa_set_prop_num_syncs, ++ [DRM_XE_OA_PROPERTY_SYNCS] = xe_oa_set_prop_syncs_user, + }; + + static int xe_oa_user_ext_set_property(struct xe_oa *oa, u64 extension, +@@ -1814,6 +1838,49 @@ static int xe_oa_user_extensions(struct xe_oa *oa, u64 extension, int ext_number + return 0; + } + ++static int xe_oa_parse_syncs(struct xe_oa *oa, struct xe_oa_open_param *param) ++{ ++ int ret, num_syncs, num_ufence = 0; ++ ++ if (param->num_syncs && !param->syncs_user) { ++ drm_dbg(&oa->xe->drm, "num_syncs specified without sync array\n"); ++ ret = -EINVAL; ++ goto exit; ++ } ++ ++ if (param->num_syncs) { ++ param->syncs = kcalloc(param->num_syncs, sizeof(*param->syncs), GFP_KERNEL); ++ if (!param->syncs) { ++ ret = -ENOMEM; ++ goto exit; ++ } ++ } ++ ++ for (num_syncs = 0; num_syncs < param->num_syncs; num_syncs++) { ++ ret = xe_sync_entry_parse(oa->xe, param->xef, ¶m->syncs[num_syncs], ++ ¶m->syncs_user[num_syncs], 0); ++ if (ret) ++ goto err_syncs; ++ ++ if (xe_sync_is_ufence(¶m->syncs[num_syncs])) ++ num_ufence++; ++ } ++ ++ if (XE_IOCTL_DBG(oa->xe, num_ufence > 1)) { ++ ret = -EINVAL; ++ goto err_syncs; ++ } ++ ++ return 0; ++ ++err_syncs: ++ while (num_syncs--) ++ xe_sync_entry_cleanup(¶m->syncs[num_syncs]); ++ kfree(param->syncs); ++exit: ++ return ret; ++} ++ + /** + * xe_oa_stream_open_ioctl - Opens an OA stream + * @dev: @drm_device +@@ -1839,6 +1906,7 @@ int xe_oa_stream_open_ioctl(struct drm_device *dev, u64 data, struct drm_file *f + return -ENODEV; + } + ++ param.xef = xef; + ret = xe_oa_user_extensions(oa, data, 0, ¶m); + if (ret) + return ret; +@@ -1907,11 +1975,24 @@ int xe_oa_stream_open_ioctl(struct drm_device *dev, u64 data, struct drm_file *f + drm_dbg(&oa->xe->drm, "Using periodic sampling freq %lld Hz\n", oa_freq_hz); + } + ++ ret = xe_oa_parse_syncs(oa, ¶m); ++ if (ret) ++ goto err_exec_q; ++ + mutex_lock(¶m.hwe->gt->oa.gt_lock); + ret = xe_oa_stream_open_ioctl_locked(oa, ¶m); + mutex_unlock(¶m.hwe->gt->oa.gt_lock); ++ if (ret < 0) ++ goto err_sync_cleanup; ++ ++ return ret; ++ ++err_sync_cleanup: ++ while (param.num_syncs--) ++ xe_sync_entry_cleanup(¶m.syncs[param.num_syncs]); ++ kfree(param.syncs); + err_exec_q: +- if (ret < 0 && param.exec_q) ++ if (param.exec_q) + xe_exec_queue_put(param.exec_q); + return ret; + } +diff --git a/drivers/gpu/drm/xe/xe_oa_types.h b/drivers/gpu/drm/xe/xe_oa_types.h +index 8862eca73fbe..99f4b2d4bdcf 100644 +--- a/drivers/gpu/drm/xe/xe_oa_types.h ++++ b/drivers/gpu/drm/xe/xe_oa_types.h +@@ -238,5 +238,11 @@ struct xe_oa_stream { + + /** @no_preempt: Whether preemption and timeslicing is disabled for stream exec_q */ + u32 no_preempt; ++ ++ /** @num_syncs: size of @syncs array */ ++ u32 num_syncs; ++ ++ /** @syncs: syncs to wait on and to signal */ ++ struct xe_sync_entry *syncs; + }; + #endif +diff --git a/drivers/gpu/drm/xe/xe_query.c b/drivers/gpu/drm/xe/xe_query.c +index 1c96375bd7df..6fec5d1a1eb4 100644 +--- a/drivers/gpu/drm/xe/xe_query.c ++++ b/drivers/gpu/drm/xe/xe_query.c +@@ -679,7 +679,7 @@ static int query_oa_units(struct xe_device *xe, + du->oa_unit_id = u->oa_unit_id; + du->oa_unit_type = u->type; + du->oa_timestamp_freq = xe_oa_timestamp_frequency(gt); +- du->capabilities = DRM_XE_OA_CAPS_BASE; ++ du->capabilities = DRM_XE_OA_CAPS_BASE | DRM_XE_OA_CAPS_SYNCS; + + j = 0; + for_each_hw_engine(hwe, gt, hwe_id) { +diff --git a/include/uapi/drm/xe_drm.h b/include/uapi/drm/xe_drm.h +index c4182e95a619..4a8a4a63e99c 100644 +--- a/include/uapi/drm/xe_drm.h ++++ b/include/uapi/drm/xe_drm.h +@@ -1485,6 +1485,7 @@ struct drm_xe_oa_unit { + /** @capabilities: OA capabilities bit-mask */ + __u64 capabilities; + #define DRM_XE_OA_CAPS_BASE (1 << 0) ++#define DRM_XE_OA_CAPS_SYNCS (1 << 1) + + /** @oa_timestamp_freq: OA timestamp freq */ + __u64 oa_timestamp_freq; +@@ -1634,6 +1635,22 @@ enum drm_xe_oa_property_id { + * to be disabled for the stream exec queue. + */ + DRM_XE_OA_PROPERTY_NO_PREEMPT, ++ ++ /** ++ * @DRM_XE_OA_PROPERTY_NUM_SYNCS: Number of syncs in the sync array ++ * specified in @DRM_XE_OA_PROPERTY_SYNCS ++ */ ++ DRM_XE_OA_PROPERTY_NUM_SYNCS, ++ ++ /** ++ * @DRM_XE_OA_PROPERTY_SYNCS: Pointer to struct @drm_xe_sync array ++ * with array size specified via @DRM_XE_OA_PROPERTY_NUM_SYNCS. OA ++ * configuration will wait till input fences signal. Output fences ++ * will signal after the new OA configuration takes effect. For ++ * @DRM_XE_SYNC_TYPE_USER_FENCE, @addr is a user pointer, similar ++ * to the VM bind case. ++ */ ++ DRM_XE_OA_PROPERTY_SYNCS, + }; + + /** +-- +2.39.5 + diff --git a/queue-6.12/firewall-remove-misplaced-semicolon-from-stm32_firew.patch b/queue-6.12/firewall-remove-misplaced-semicolon-from-stm32_firew.patch new file mode 100644 index 00000000000..1a9f7e46bc6 --- /dev/null +++ b/queue-6.12/firewall-remove-misplaced-semicolon-from-stm32_firew.patch @@ -0,0 +1,39 @@ +From 708ed3fb70c6b41e5f64076dac7e3db75e7e68de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Dec 2024 09:33:35 +0100 +Subject: firewall: remove misplaced semicolon from stm32_firewall_get_firewall + +From: guanjing + +[ Upstream commit 155c5bf26f983e9988333eeb0ef217138304d13b ] + +Remove misplaced colon in stm32_firewall_get_firewall() +which results in a syntax error when the code is compiled +without CONFIG_STM32_FIREWALL. + +Fixes: 5c9668cfc6d7 ("firewall: introduce stm32_firewall framework") +Signed-off-by: guanjing +Reviewed-by: Gatien Chevallier +Signed-off-by: Alexandre Torgue +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + include/linux/bus/stm32_firewall_device.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/bus/stm32_firewall_device.h b/include/linux/bus/stm32_firewall_device.h +index 18e0a2fc3816..5178b72bc920 100644 +--- a/include/linux/bus/stm32_firewall_device.h ++++ b/include/linux/bus/stm32_firewall_device.h +@@ -115,7 +115,7 @@ void stm32_firewall_release_access_by_id(struct stm32_firewall *firewall, u32 su + #else /* CONFIG_STM32_FIREWALL */ + + int stm32_firewall_get_firewall(struct device_node *np, struct stm32_firewall *firewall, +- unsigned int nb_firewall); ++ unsigned int nb_firewall) + { + return -ENODEV; + } +-- +2.39.5 + diff --git a/queue-6.12/hwmon-drivetemp-fix-driver-producing-garbage-data-wh.patch b/queue-6.12/hwmon-drivetemp-fix-driver-producing-garbage-data-wh.patch new file mode 100644 index 00000000000..505c3c5f8ef --- /dev/null +++ b/queue-6.12/hwmon-drivetemp-fix-driver-producing-garbage-data-wh.patch @@ -0,0 +1,70 @@ +From c556c4148cfcffdc1f4061241f208c28155c2f04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Jan 2025 21:36:18 +0000 +Subject: hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors + occur + +From: Daniil Stas + +[ Upstream commit 82163d63ae7a4c36142cd252388737205bb7e4b9 ] + +scsi_execute_cmd() function can return both negative (linux codes) and +positive (scsi_cmnd result field) error codes. + +Currently the driver just passes error codes of scsi_execute_cmd() to +hwmon core, which is incorrect because hwmon only checks for negative +error codes. This leads to hwmon reporting uninitialized data to +userspace in case of SCSI errors (for example if the disk drive was +disconnected). + +This patch checks scsi_execute_cmd() output and returns -EIO if it's +error code is positive. + +Fixes: 5b46903d8bf37 ("hwmon: Driver for disk and solid state drives with temperature sensors") +Signed-off-by: Daniil Stas +Cc: Guenter Roeck +Cc: Chris Healy +Cc: Linus Walleij +Cc: Martin K. Petersen +Cc: Bart Van Assche +Cc: linux-kernel@vger.kernel.org +Cc: linux-scsi@vger.kernel.org +Cc: linux-ide@vger.kernel.org +Cc: linux-hwmon@vger.kernel.org +Link: https://lore.kernel.org/r/20250105213618.531691-1-daniil.stas@posteo.net +[groeck: Avoid inline variable declaration for portability] +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/drivetemp.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/drivetemp.c b/drivers/hwmon/drivetemp.c +index 6bdd21aa005a..2a4ec55ddb47 100644 +--- a/drivers/hwmon/drivetemp.c ++++ b/drivers/hwmon/drivetemp.c +@@ -165,6 +165,7 @@ static int drivetemp_scsi_command(struct drivetemp_data *st, + { + u8 scsi_cmd[MAX_COMMAND_SIZE]; + enum req_op op; ++ int err; + + memset(scsi_cmd, 0, sizeof(scsi_cmd)); + scsi_cmd[0] = ATA_16; +@@ -192,8 +193,11 @@ static int drivetemp_scsi_command(struct drivetemp_data *st, + scsi_cmd[12] = lba_high; + scsi_cmd[14] = ata_command; + +- return scsi_execute_cmd(st->sdev, scsi_cmd, op, st->smartdata, +- ATA_SECT_SIZE, HZ, 5, NULL); ++ err = scsi_execute_cmd(st->sdev, scsi_cmd, op, st->smartdata, ++ ATA_SECT_SIZE, HZ, 5, NULL); ++ if (err > 0) ++ err = -EIO; ++ return err; + } + + static int drivetemp_ata_command(struct drivetemp_data *st, u8 feature, +-- +2.39.5 + diff --git a/queue-6.12/mm-zswap-fix-race-between-de-compression-and-cpu-hot.patch b/queue-6.12/mm-zswap-fix-race-between-de-compression-and-cpu-hot.patch new file mode 100644 index 00000000000..b494fb0033e --- /dev/null +++ b/queue-6.12/mm-zswap-fix-race-between-de-compression-and-cpu-hot.patch @@ -0,0 +1,119 @@ +From c56e79d453ef5b5fc6ded252bc6ba461f12946ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Dec 2024 21:24:37 +0000 +Subject: mm: zswap: fix race between [de]compression and CPU hotunplug + +From: Yosry Ahmed + +[ Upstream commit eaebeb93922ca6ab0dd92027b73d0112701706ef ] + +In zswap_compress() and zswap_decompress(), the per-CPU acomp_ctx of the +current CPU at the beginning of the operation is retrieved and used +throughout. However, since neither preemption nor migration are disabled, +it is possible that the operation continues on a different CPU. + +If the original CPU is hotunplugged while the acomp_ctx is still in use, +we run into a UAF bug as the resources attached to the acomp_ctx are freed +during hotunplug in zswap_cpu_comp_dead(). + +The problem was introduced in commit 1ec3b5fe6eec ("mm/zswap: move to use +crypto_acomp API for hardware acceleration") when the switch to the +crypto_acomp API was made. Prior to that, the per-CPU crypto_comp was +retrieved using get_cpu_ptr() which disables preemption and makes sure the +CPU cannot go away from under us. Preemption cannot be disabled with the +crypto_acomp API as a sleepable context is needed. + +Commit 8ba2f844f050 ("mm/zswap: change per-cpu mutex and buffer to +per-acomp_ctx") increased the UAF surface area by making the per-CPU +buffers dynamic, adding yet another resource that can be freed from under +zswap compression/decompression by CPU hotunplug. + +There are a few ways to fix this: +(a) Add a refcount for acomp_ctx. +(b) Disable migration while using the per-CPU acomp_ctx. +(c) Disable CPU hotunplug while using the per-CPU acomp_ctx by holding +the CPUs read lock. + +Implement (c) since it's simpler than (a), and (b) involves using +migrate_disable() which is apparently undesired (see huge comment in +include/linux/preempt.h). + +Link: https://lkml.kernel.org/r/20241219212437.2714151-1-yosryahmed@google.com +Fixes: 1ec3b5fe6eec ("mm/zswap: move to use crypto_acomp API for hardware acceleration") +Signed-off-by: Yosry Ahmed +Reported-by: Johannes Weiner +Closes: https://lore.kernel.org/lkml/20241113213007.GB1564047@cmpxchg.org/ +Reported-by: Sam Sun +Closes: https://lore.kernel.org/lkml/CAEkJfYMtSdM5HceNsXUDf5haghD5+o2e7Qv4OcuruL4tPg6OaQ@mail.gmail.com/ +Reviewed-by: Chengming Zhou +Acked-by: Barry Song +Reviewed-by: Nhat Pham +Cc: Vitaly Wool +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + mm/zswap.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +diff --git a/mm/zswap.c b/mm/zswap.c +index 0030ce8fecfc..c86d4bcbb447 100644 +--- a/mm/zswap.c ++++ b/mm/zswap.c +@@ -875,6 +875,18 @@ static int zswap_cpu_comp_dead(unsigned int cpu, struct hlist_node *node) + return 0; + } + ++/* Prevent CPU hotplug from freeing up the per-CPU acomp_ctx resources */ ++static struct crypto_acomp_ctx *acomp_ctx_get_cpu(struct crypto_acomp_ctx __percpu *acomp_ctx) ++{ ++ cpus_read_lock(); ++ return raw_cpu_ptr(acomp_ctx); ++} ++ ++static void acomp_ctx_put_cpu(void) ++{ ++ cpus_read_unlock(); ++} ++ + static bool zswap_compress(struct folio *folio, struct zswap_entry *entry) + { + struct crypto_acomp_ctx *acomp_ctx; +@@ -887,8 +899,7 @@ static bool zswap_compress(struct folio *folio, struct zswap_entry *entry) + gfp_t gfp; + u8 *dst; + +- acomp_ctx = raw_cpu_ptr(entry->pool->acomp_ctx); +- ++ acomp_ctx = acomp_ctx_get_cpu(entry->pool->acomp_ctx); + mutex_lock(&acomp_ctx->mutex); + + dst = acomp_ctx->buffer; +@@ -944,6 +955,7 @@ static bool zswap_compress(struct folio *folio, struct zswap_entry *entry) + zswap_reject_alloc_fail++; + + mutex_unlock(&acomp_ctx->mutex); ++ acomp_ctx_put_cpu(); + return comp_ret == 0 && alloc_ret == 0; + } + +@@ -954,7 +966,7 @@ static void zswap_decompress(struct zswap_entry *entry, struct folio *folio) + struct crypto_acomp_ctx *acomp_ctx; + u8 *src; + +- acomp_ctx = raw_cpu_ptr(entry->pool->acomp_ctx); ++ acomp_ctx = acomp_ctx_get_cpu(entry->pool->acomp_ctx); + mutex_lock(&acomp_ctx->mutex); + + src = zpool_map_handle(zpool, entry->handle, ZPOOL_MM_RO); +@@ -984,6 +996,7 @@ static void zswap_decompress(struct zswap_entry *entry, struct folio *folio) + + if (src != acomp_ctx->buffer) + zpool_unmap_handle(zpool, entry->handle); ++ acomp_ctx_put_cpu(); + } + + /********************************* +-- +2.39.5 + diff --git a/queue-6.12/series b/queue-6.12/series index 32b1f27d772..eb35e25601b 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -172,3 +172,16 @@ iio-inkern-call-iio_device_put-only-on-mapped-devices.patch iio-adc-ad7173-fix-using-shared-static-info-struct.patch iio-adc-ad7124-disable-all-channels-at-probe-time.patch io_uring-eventfd-ensure-io_eventfd_signal-defers-another-rcu-period.patch +arm64-dts-imx95-correct-the-address-length-of-netcmi.patch +arm-dts-imxrt1050-fix-clocks-for-mmc.patch +arm64-dts-qcom-sa8775p-fix-the-secure-device-bootup-.patch +hwmon-drivetemp-fix-driver-producing-garbage-data-wh.patch +block-bfq-fix-waker_bfqq-uaf-after-bfq_split_bfqq.patch +arm64-dts-rockchip-add-hevc-power-domain-clock-to-rk.patch +firewall-remove-misplaced-semicolon-from-stm32_firew.patch +drm-xe-oa-separate-batch-submission-from-waiting-for.patch +drm-xe-oa-uapi-define-and-parse-oa-sync-properties.patch +drm-xe-oa-add-input-fence-dependencies.patch +xe-oa-fix-query-mode-of-operation-for-oar-oac.patch +mm-zswap-fix-race-between-de-compression-and-cpu-hot.patch +drm-mediatek-only-touch-disp_reg_ovl_pitch_msb-if-af.patch diff --git a/queue-6.12/xe-oa-fix-query-mode-of-operation-for-oar-oac.patch b/queue-6.12/xe-oa-fix-query-mode-of-operation-for-oar-oac.patch new file mode 100644 index 00000000000..f0104968fe1 --- /dev/null +++ b/queue-6.12/xe-oa-fix-query-mode-of-operation-for-oar-oac.patch @@ -0,0 +1,363 @@ +From a65d438e587efaac9af626908a555e536361984b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Dec 2024 09:19:18 -0800 +Subject: xe/oa: Fix query mode of operation for OAR/OAC +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Umesh Nerlige Ramappa + +[ Upstream commit f0ed39830e6064d62f9c5393505677a26569bb56 ] + +This is a set of squashed commits to facilitate smooth applying to +stable. Each commit message is retained for reference. + +1) Allow a GGTT mapped batch to be submitted to user exec queue + +For a OA use case, one of the HW registers needs to be modified by +submitting an MI_LOAD_REGISTER_IMM command to the users exec queue, so +that the register is modified in the user's hardware context. In order +to do this a batch that is mapped in GGTT, needs to be submitted to the +user exec queue. Since all user submissions use q->vm and hence PPGTT, +add some plumbing to enable submission of batches mapped in GGTT. + +v2: ggtt is zero-initialized, so no need to set it false (Matt Brost) + +2) xe/oa: Use MI_LOAD_REGISTER_IMMEDIATE to enable OAR/OAC + +To enable OAR/OAC, a bit in RING_CONTEXT_CONTROL needs to be set. +Setting this bit cause the context image size to change and if not done +correct, can cause undesired hangs. + +Current code uses a separate exec_queue to modify this bit and is +error-prone. As per HW recommendation, submit MI_LOAD_REGISTER_IMM to +the target hardware context to modify the relevant bit. + +In v2 version, an attempt to submit everything to the user-queue was +made, but it failed the unprivileged-single-ctx-counters test. It +appears that the OACTXCONTROL must be modified from a remote context. + +In v3 version, all context specific register configurations were moved +to use LOAD_REGISTER_IMMEDIATE and that seems to work well. This is a +cleaner way, since we can now submit all configuration to user +exec_queue and the fence handling is simplified. + +v2: +(Matt) +- set job->ggtt to true if create job is successful +- unlock vm on job error + +(Ashutosh) +- don't wait on job submission +- use kernel exec queue where possible + +v3: +(Ashutosh) +- Fix checkpatch issues +- Remove extra spaces/new-lines +- Add Fixes: and Cc: tags +- Reset context control bit when OA stream is closed +- Submit all config via MI_LOAD_REGISTER_IMMEDIATE + +(Umesh) +- Update commit message for v3 experiment +- Squash patches for easier port to stable + +v4: +(Ashutosh) +- No need to pass q to xe_oa_submit_bb +- Do not support exec queues with width > 1 +- Fix disabling of CTX_CTRL_OAC_CONTEXT_ENABLE + +v5: +(Ashutosh) +- Drop reg_lri related comments +- Use XE_OA_SUBMIT_NO_DEPS in xe_oa_load_with_lri + +Fixes: 8135f1c09dd2 ("drm/xe/oa: Don't reset OAC_CONTEXT_ENABLE on OA stream close") +Signed-off-by: Umesh Nerlige Ramappa +Reviewed-by: Matthew Brost # commit 1 +Reviewed-by: Ashutosh Dixit +Cc: stable@vger.kernel.org +Reviewed-by: Jonathan Cavitt +Signed-off-by: Ashutosh Dixit +Link: https://patchwork.freedesktop.org/patch/msgid/20241220171919.571528-2-umesh.nerlige.ramappa@intel.com +(cherry picked from commit 55039832f98c7e05f1cf9e0d8c12b2490abd0f16) +Signed-off-by: Thomas Hellström +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_oa.c | 134 ++++++++---------------- + drivers/gpu/drm/xe/xe_ring_ops.c | 5 +- + drivers/gpu/drm/xe/xe_sched_job_types.h | 2 + + 3 files changed, 51 insertions(+), 90 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_oa.c b/drivers/gpu/drm/xe/xe_oa.c +index fd14d62bfb54..d81f0b05b2df 100644 +--- a/drivers/gpu/drm/xe/xe_oa.c ++++ b/drivers/gpu/drm/xe/xe_oa.c +@@ -69,12 +69,6 @@ struct xe_oa_config { + struct rcu_head rcu; + }; + +-struct flex { +- struct xe_reg reg; +- u32 offset; +- u32 value; +-}; +- + struct xe_oa_open_param { + struct xe_file *xef; + u32 oa_unit_id; +@@ -577,19 +571,38 @@ static __poll_t xe_oa_poll(struct file *file, poll_table *wait) + return ret; + } + ++static void xe_oa_lock_vma(struct xe_exec_queue *q) ++{ ++ if (q->vm) { ++ down_read(&q->vm->lock); ++ xe_vm_lock(q->vm, false); ++ } ++} ++ ++static void xe_oa_unlock_vma(struct xe_exec_queue *q) ++{ ++ if (q->vm) { ++ xe_vm_unlock(q->vm); ++ up_read(&q->vm->lock); ++ } ++} ++ + static struct dma_fence *xe_oa_submit_bb(struct xe_oa_stream *stream, enum xe_oa_submit_deps deps, + struct xe_bb *bb) + { ++ struct xe_exec_queue *q = stream->exec_q ?: stream->k_exec_q; + struct xe_sched_job *job; + struct dma_fence *fence; + int err = 0; + +- /* Kernel configuration is issued on stream->k_exec_q, not stream->exec_q */ +- job = xe_bb_create_job(stream->k_exec_q, bb); ++ xe_oa_lock_vma(q); ++ ++ job = xe_bb_create_job(q, bb); + if (IS_ERR(job)) { + err = PTR_ERR(job); + goto exit; + } ++ job->ggtt = true; + + if (deps == XE_OA_SUBMIT_ADD_DEPS) { + for (int i = 0; i < stream->num_syncs && !err; i++) +@@ -604,10 +617,13 @@ static struct dma_fence *xe_oa_submit_bb(struct xe_oa_stream *stream, enum xe_oa + fence = dma_fence_get(&job->drm.s_fence->finished); + xe_sched_job_push(job); + ++ xe_oa_unlock_vma(q); ++ + return fence; + err_put_job: + xe_sched_job_put(job); + exit: ++ xe_oa_unlock_vma(q); + return ERR_PTR(err); + } + +@@ -655,63 +671,19 @@ static void xe_oa_free_configs(struct xe_oa_stream *stream) + free_oa_config_bo(oa_bo); + } + +-static void xe_oa_store_flex(struct xe_oa_stream *stream, struct xe_lrc *lrc, +- struct xe_bb *bb, const struct flex *flex, u32 count) +-{ +- u32 offset = xe_bo_ggtt_addr(lrc->bo); +- +- do { +- bb->cs[bb->len++] = MI_STORE_DATA_IMM | MI_SDI_GGTT | MI_SDI_NUM_DW(1); +- bb->cs[bb->len++] = offset + flex->offset * sizeof(u32); +- bb->cs[bb->len++] = 0; +- bb->cs[bb->len++] = flex->value; +- +- } while (flex++, --count); +-} +- +-static int xe_oa_modify_ctx_image(struct xe_oa_stream *stream, struct xe_lrc *lrc, +- const struct flex *flex, u32 count) +-{ +- struct dma_fence *fence; +- struct xe_bb *bb; +- int err; +- +- bb = xe_bb_new(stream->gt, 4 * count, false); +- if (IS_ERR(bb)) { +- err = PTR_ERR(bb); +- goto exit; +- } +- +- xe_oa_store_flex(stream, lrc, bb, flex, count); +- +- fence = xe_oa_submit_bb(stream, XE_OA_SUBMIT_NO_DEPS, bb); +- if (IS_ERR(fence)) { +- err = PTR_ERR(fence); +- goto free_bb; +- } +- xe_bb_free(bb, fence); +- dma_fence_put(fence); +- +- return 0; +-free_bb: +- xe_bb_free(bb, NULL); +-exit: +- return err; +-} +- +-static int xe_oa_load_with_lri(struct xe_oa_stream *stream, struct xe_oa_reg *reg_lri) ++static int xe_oa_load_with_lri(struct xe_oa_stream *stream, struct xe_oa_reg *reg_lri, u32 count) + { + struct dma_fence *fence; + struct xe_bb *bb; + int err; + +- bb = xe_bb_new(stream->gt, 3, false); ++ bb = xe_bb_new(stream->gt, 2 * count + 1, false); + if (IS_ERR(bb)) { + err = PTR_ERR(bb); + goto exit; + } + +- write_cs_mi_lri(bb, reg_lri, 1); ++ write_cs_mi_lri(bb, reg_lri, count); + + fence = xe_oa_submit_bb(stream, XE_OA_SUBMIT_NO_DEPS, bb); + if (IS_ERR(fence)) { +@@ -731,70 +703,54 @@ static int xe_oa_load_with_lri(struct xe_oa_stream *stream, struct xe_oa_reg *re + static int xe_oa_configure_oar_context(struct xe_oa_stream *stream, bool enable) + { + const struct xe_oa_format *format = stream->oa_buffer.format; +- struct xe_lrc *lrc = stream->exec_q->lrc[0]; +- u32 regs_offset = xe_lrc_regs_offset(lrc) / sizeof(u32); + u32 oacontrol = __format_to_oactrl(format, OAR_OACONTROL_COUNTER_SEL_MASK) | + (enable ? OAR_OACONTROL_COUNTER_ENABLE : 0); + +- struct flex regs_context[] = { ++ struct xe_oa_reg reg_lri[] = { + { + OACTXCONTROL(stream->hwe->mmio_base), +- stream->oa->ctx_oactxctrl_offset[stream->hwe->class] + 1, + enable ? OA_COUNTER_RESUME : 0, + }, ++ { ++ OAR_OACONTROL, ++ oacontrol, ++ }, + { + RING_CONTEXT_CONTROL(stream->hwe->mmio_base), +- regs_offset + CTX_CONTEXT_CONTROL, +- _MASKED_BIT_ENABLE(CTX_CTRL_OAC_CONTEXT_ENABLE), ++ _MASKED_FIELD(CTX_CTRL_OAC_CONTEXT_ENABLE, ++ enable ? CTX_CTRL_OAC_CONTEXT_ENABLE : 0) + }, + }; +- struct xe_oa_reg reg_lri = { OAR_OACONTROL, oacontrol }; +- int err; +- +- /* Modify stream hwe context image with regs_context */ +- err = xe_oa_modify_ctx_image(stream, stream->exec_q->lrc[0], +- regs_context, ARRAY_SIZE(regs_context)); +- if (err) +- return err; + +- /* Apply reg_lri using LRI */ +- return xe_oa_load_with_lri(stream, ®_lri); ++ return xe_oa_load_with_lri(stream, reg_lri, ARRAY_SIZE(reg_lri)); + } + + static int xe_oa_configure_oac_context(struct xe_oa_stream *stream, bool enable) + { + const struct xe_oa_format *format = stream->oa_buffer.format; +- struct xe_lrc *lrc = stream->exec_q->lrc[0]; +- u32 regs_offset = xe_lrc_regs_offset(lrc) / sizeof(u32); + u32 oacontrol = __format_to_oactrl(format, OAR_OACONTROL_COUNTER_SEL_MASK) | + (enable ? OAR_OACONTROL_COUNTER_ENABLE : 0); +- struct flex regs_context[] = { ++ struct xe_oa_reg reg_lri[] = { + { + OACTXCONTROL(stream->hwe->mmio_base), +- stream->oa->ctx_oactxctrl_offset[stream->hwe->class] + 1, + enable ? OA_COUNTER_RESUME : 0, + }, ++ { ++ OAC_OACONTROL, ++ oacontrol ++ }, + { + RING_CONTEXT_CONTROL(stream->hwe->mmio_base), +- regs_offset + CTX_CONTEXT_CONTROL, +- _MASKED_BIT_ENABLE(CTX_CTRL_OAC_CONTEXT_ENABLE) | ++ _MASKED_FIELD(CTX_CTRL_OAC_CONTEXT_ENABLE, ++ enable ? CTX_CTRL_OAC_CONTEXT_ENABLE : 0) | + _MASKED_FIELD(CTX_CTRL_RUN_ALONE, enable ? CTX_CTRL_RUN_ALONE : 0), + }, + }; +- struct xe_oa_reg reg_lri = { OAC_OACONTROL, oacontrol }; +- int err; + + /* Set ccs select to enable programming of OAC_OACONTROL */ + xe_mmio_write32(stream->gt, __oa_regs(stream)->oa_ctrl, __oa_ccs_select(stream)); + +- /* Modify stream hwe context image with regs_context */ +- err = xe_oa_modify_ctx_image(stream, stream->exec_q->lrc[0], +- regs_context, ARRAY_SIZE(regs_context)); +- if (err) +- return err; +- +- /* Apply reg_lri using LRI */ +- return xe_oa_load_with_lri(stream, ®_lri); ++ return xe_oa_load_with_lri(stream, reg_lri, ARRAY_SIZE(reg_lri)); + } + + static int xe_oa_configure_oa_context(struct xe_oa_stream *stream, bool enable) +@@ -1933,8 +1889,8 @@ int xe_oa_stream_open_ioctl(struct drm_device *dev, u64 data, struct drm_file *f + if (XE_IOCTL_DBG(oa->xe, !param.exec_q)) + return -ENOENT; + +- if (param.exec_q->width > 1) +- drm_dbg(&oa->xe->drm, "exec_q->width > 1, programming only exec_q->lrc[0]\n"); ++ if (XE_IOCTL_DBG(oa->xe, param.exec_q->width > 1)) ++ return -EOPNOTSUPP; + } + + /* +diff --git a/drivers/gpu/drm/xe/xe_ring_ops.c b/drivers/gpu/drm/xe/xe_ring_ops.c +index 0be4f489d3e1..9f327f27c072 100644 +--- a/drivers/gpu/drm/xe/xe_ring_ops.c ++++ b/drivers/gpu/drm/xe/xe_ring_ops.c +@@ -221,7 +221,10 @@ static int emit_pipe_imm_ggtt(u32 addr, u32 value, bool stall_only, u32 *dw, + + static u32 get_ppgtt_flag(struct xe_sched_job *job) + { +- return job->q->vm ? BIT(8) : 0; ++ if (job->q->vm && !job->ggtt) ++ return BIT(8); ++ ++ return 0; + } + + static int emit_copy_timestamp(struct xe_lrc *lrc, u32 *dw, int i) +diff --git a/drivers/gpu/drm/xe/xe_sched_job_types.h b/drivers/gpu/drm/xe/xe_sched_job_types.h +index 0d3f76fb05ce..c207361bf43e 100644 +--- a/drivers/gpu/drm/xe/xe_sched_job_types.h ++++ b/drivers/gpu/drm/xe/xe_sched_job_types.h +@@ -57,6 +57,8 @@ struct xe_sched_job { + u32 migrate_flush_flags; + /** @ring_ops_flush_tlb: The ring ops need to flush TLB before payload. */ + bool ring_ops_flush_tlb; ++ /** @ggtt: mapped in ggtt. */ ++ bool ggtt; + /** @ptrs: per instance pointers. */ + struct xe_job_ptrs ptrs[]; + }; +-- +2.39.5 + -- 2.47.3