--- /dev/null
+From c3027973f692077a1b66a9fb26d6a7c46c0dc72c Mon Sep 17 00:00:00 2001
+From: Wentao Liang <vulab@iscas.ac.cn>
+Date: Sat, 6 Jun 2026 15:56:06 +0000
+Subject: drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit()
+
+From: Wentao Liang <vulab@iscas.ac.cn>
+
+commit c3027973f692077a1b66a9fb26d6a7c46c0dc72c upstream.
+
+In nvkm_acr_oneinit(), nvkm_kmap(acr->wpr) is invoked unconditionally
+at line 309 to obtain a mapping reference. Additionally, when both
+acr->wpr_fw and acr->wpr_comp are present, a second nvkm_kmap() is
+called inside the conditional block. Both mappings are expected to be
+released by nvkm_done(acr->wpr) at line 320 before the function returns
+successfully.
+
+However, when a mismatch is detected during the loop within the
+conditional block, the function returns -EINVAL at line 318 without
+calling nvkm_done(). This results in a leak of the kmap reference(s)
+acquired earlier.
+
+Fix the issue by invoking nvkm_done(acr->wpr) prior to the early return
+to ensure proper release of the mapping references.
+
+Fixes: 22dcda45a3d1 ("drm/nouveau/acr: implement new subdev to replace "secure boot"")
+Cc: stable@vger.kernel.org
+Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
+Link: https://patch.msgid.link/20260606155606.77593-1-vulab@iscas.ac.cn
+Signed-off-by: Danilo Krummrich <dakr@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c
+@@ -314,6 +314,7 @@ nvkm_acr_oneinit(struct nvkm_subdev *sub
+ i, us, fw);
+ }
+ }
++ nvkm_done(acr->wpr);
+ return -EINVAL;
+ }
+ nvkm_done(acr->wpr);
--- /dev/null
+From f896e86273dbbebb5eac966b4a201b5c62a02e9a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pavel=20Ondra=C4=8Dka?= <pavel.ondracka@gmail.com>
+Date: Wed, 10 Jun 2026 10:32:45 +0200
+Subject: drm/radeon: fix r100_copy_blit for large BOs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pavel Ondračka <pavel.ondracka@gmail.com>
+
+commit f896e86273dbbebb5eac966b4a201b5c62a02e9a upstream.
+
+r100_copy_blit() copies BOs as 1024-pixel-wide ARGB8888 blits, so one
+GPU page becomes one blit row. Large copies are split into chunks of at
+most 8191 rows.
+
+The kernel register header names the packet coordinate dwords SRC_Y_X
+and DST_Y_X. In the BITBLT_MULTI description in
+R5xx_Acceleration_v1.5.pdf docs, these correspond to [SRC_X1 | SRC_Y1]
+and [DST_X1 | DST_Y1], which are signed 13-bit coordinates in the
+-8192..8191 range. The old code kept SRC/DST_PITCH_OFFSET at the BO base
+and used SRC_Y_X/DST_Y_X as the chunk address, so large BO moves could
+exceed that coordinate range.
+
+Compute per-chunk SRC/DST_PITCH_OFFSET bases and emit zero source and
+destination coordinates. r100_copy_blit() already packs
+SRC/DST_PITCH_OFFSET as pitch plus base offset, so large chunk addresses
+belong there rather than in the coordinate fields.
+
+This fixes Prison Architect corruption with 4096x4096 mipped textures
+after they are evicted to GTT under memory pressure on RV530.
+
+Closes: https://gitlab.freedesktop.org/mesa/mesa/-/work_items/6716
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Pavel Ondračka <pavel.ondracka@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 87be26aee76239c6da03e599f238a426897f78ad)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/radeon/r100.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/r100.c
++++ b/drivers/gpu/drm/radeon/r100.c
+@@ -904,6 +904,7 @@ struct radeon_fence *r100_copy_blit(stru
+ {
+ struct radeon_ring *ring = &rdev->ring[RADEON_RING_TYPE_GFX_INDEX];
+ struct radeon_fence *fence;
++ uint64_t cur_src_offset, cur_dst_offset;
+ uint32_t cur_pages;
+ uint32_t stride_bytes = RADEON_GPU_PAGE_SIZE;
+ uint32_t pitch;
+@@ -932,6 +933,10 @@ struct radeon_fence *r100_copy_blit(stru
+ cur_pages = 8191;
+ }
+ num_gpu_pages -= cur_pages;
++ cur_src_offset = src_offset +
++ (uint64_t)num_gpu_pages * RADEON_GPU_PAGE_SIZE;
++ cur_dst_offset = dst_offset +
++ (uint64_t)num_gpu_pages * RADEON_GPU_PAGE_SIZE;
+
+ /* pages are in Y direction - height
+ page width in X direction - width */
+@@ -948,13 +953,13 @@ struct radeon_fence *r100_copy_blit(stru
+ RADEON_DP_SRC_SOURCE_MEMORY |
+ RADEON_GMC_CLR_CMP_CNTL_DIS |
+ RADEON_GMC_WR_MSK_DIS);
+- radeon_ring_write(ring, (pitch << 22) | (src_offset >> 10));
+- radeon_ring_write(ring, (pitch << 22) | (dst_offset >> 10));
++ radeon_ring_write(ring, (pitch << 22) | (cur_src_offset >> 10));
++ radeon_ring_write(ring, (pitch << 22) | (cur_dst_offset >> 10));
+ radeon_ring_write(ring, (0x1fff) | (0x1fff << 16));
+ radeon_ring_write(ring, 0);
+ radeon_ring_write(ring, (0x1fff) | (0x1fff << 16));
+- radeon_ring_write(ring, num_gpu_pages);
+- radeon_ring_write(ring, num_gpu_pages);
++ radeon_ring_write(ring, 0);
++ radeon_ring_write(ring, 0);
+ radeon_ring_write(ring, cur_pages | (stride_pixels << 16));
+ }
+ radeon_ring_write(ring, PACKET0(RADEON_DSTCACHE_CTLSTAT, 0));
projects / thirdparty / kernel / stable-queue.git / commitdiff
