From: Greg Kroah-Hartman Date: Wed, 29 Jul 2026 10:56:35 +0000 (+0200) Subject: 6.12-stable patches X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=12e4dfdae44d8625df29d7cd4ec4dff031c1985c;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: drm-amdgpu-fix-amdgpu_bo_move-when-old_mem-and-new_mem-are-both-gtt.patch drm-amdgpu-validate-cp_gfx_shadow-chunk-size-in-cs-pass1.patch drm-displayid-fix-tiled-display-topology-id-size.patch drm-i915-gem-add-missing-nospec-on-parallel-submit-slot.patch drm-nouveau-acr-fix-missing-nvkm_done-in-error-path-of-nvkm_acr_oneinit.patch drm-nouveau-fix-reversed-error-cleanup-order-in-ucopy-functions.patch drm-radeon-fix-r100_copy_blit-for-large-bos.patch --- diff --git a/queue-6.12/drm-amdgpu-fix-amdgpu_bo_move-when-old_mem-and-new_mem-are-both-gtt.patch b/queue-6.12/drm-amdgpu-fix-amdgpu_bo_move-when-old_mem-and-new_mem-are-both-gtt.patch new file mode 100644 index 0000000000..46e87bcda3 --- /dev/null +++ b/queue-6.12/drm-amdgpu-fix-amdgpu_bo_move-when-old_mem-and-new_mem-are-both-gtt.patch @@ -0,0 +1,60 @@ +From ee94a65f192c05c543b4d3ad7137cd696b5c18fc Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Timur=20Krist=C3=B3f?= +Date: Mon, 25 May 2026 13:33:18 +0200 +Subject: drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +commit ee94a65f192c05c543b4d3ad7137cd696b5c18fc upstream. + +The UVD code relies on GTT to GTT moves in order to ensure +that its BOs don't cross 256M segments. + +Fixes: bfe5e585b44f ("drm/ttm: move last binding into the drivers.") +Signed-off-by: Timur Kristóf +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +(cherry picked from commit 21fd45e5e2628d00b478590bcc3d14d3de5d45b6) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +@@ -501,6 +501,15 @@ static int amdgpu_bo_move(struct ttm_buf + + if (new_mem->mem_type == TTM_PL_TT || + new_mem->mem_type == AMDGPU_PL_PREEMPT) { ++ if (old_mem && (old_mem->mem_type == TTM_PL_TT || ++ old_mem->mem_type == AMDGPU_PL_PREEMPT)) { ++ r = ttm_bo_wait_ctx(bo, ctx); ++ if (r) ++ return r; ++ ++ amdgpu_ttm_backend_unbind(bo->bdev, bo->ttm); ++ } ++ + r = amdgpu_ttm_backend_bind(bo->bdev, bo->ttm, new_mem); + if (r) + return r; +@@ -533,6 +542,15 @@ static int amdgpu_bo_move(struct ttm_buf + amdgpu_bo_move_notify(bo, evict, new_mem); + ttm_resource_free(bo, &bo->resource); + ttm_bo_assign_mem(bo, new_mem); ++ return 0; ++ } ++ if ((old_mem->mem_type == TTM_PL_TT || ++ old_mem->mem_type == AMDGPU_PL_PREEMPT) && ++ (new_mem->mem_type == TTM_PL_TT || ++ new_mem->mem_type == AMDGPU_PL_PREEMPT)) { ++ amdgpu_bo_move_notify(bo, evict, new_mem); ++ ttm_resource_free(bo, &bo->resource); ++ ttm_bo_assign_mem(bo, new_mem); + return 0; + } + diff --git a/queue-6.12/drm-amdgpu-validate-cp_gfx_shadow-chunk-size-in-cs-pass1.patch b/queue-6.12/drm-amdgpu-validate-cp_gfx_shadow-chunk-size-in-cs-pass1.patch new file mode 100644 index 0000000000..20ae5cf60f --- /dev/null +++ b/queue-6.12/drm-amdgpu-validate-cp_gfx_shadow-chunk-size-in-cs-pass1.patch @@ -0,0 +1,57 @@ +From 84c4c36acd5c4b2558b5069f869a165b2c655c84 Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Fri, 12 Jun 2026 21:07:24 -0500 +Subject: drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 + +From: Mario Limonciello + +commit 84c4c36acd5c4b2558b5069f869a165b2c655c84 upstream. + +Add a minimum-length check for the AMDGPU_CHUNK_ID_CP_GFX_SHADOW chunk in +amdgpu_cs_pass1(), matching the gate already present for the IB, FENCE and +BO_HANDLES chunk types. + +The CP_GFX_SHADOW case previously shared a bare break with the dependency +and syncobj chunk types, which do not dereference a fixed-size struct. When +userspace submits this chunk with length_dw == 0, vmemdup_array_user() is +called with size 0 and returns ZERO_SIZE_PTR, which passes the IS_ERR() +check. amdgpu_cs_p2_shadow() then dereferences chunk->kdata as a struct +drm_amdgpu_cs_chunk_cp_gfx_shadow (reading shadow->flags), faulting on the +ZERO_SIZE_PTR and causing a NULL-pointer dereference. + +This is reachable by an unprivileged process in the render group. Reject +undersized chunks with -EINVAL during pass1 so the bad submission is +rejected before pass2 ever dereferences the data. + +Fixes: ac9287055ff1 ("drm/amdgpu: add gfx shadow CS IOCTL support") +Reviewed-by: Alex Deucher +Signed-off-by: Mario Limonciello +Signed-off-by: Alex Deucher +(cherry picked from commit 7f61b2eef7415eccdb40850aca0de94211948657) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +@@ -272,13 +272,17 @@ static int amdgpu_cs_pass1(struct amdgpu + goto free_partial_kdata; + break; + ++ case AMDGPU_CHUNK_ID_CP_GFX_SHADOW: ++ if (size < sizeof(struct drm_amdgpu_cs_chunk_cp_gfx_shadow)) ++ goto free_partial_kdata; ++ break; ++ + case AMDGPU_CHUNK_ID_DEPENDENCIES: + case AMDGPU_CHUNK_ID_SYNCOBJ_IN: + case AMDGPU_CHUNK_ID_SYNCOBJ_OUT: + case AMDGPU_CHUNK_ID_SCHEDULED_DEPENDENCIES: + case AMDGPU_CHUNK_ID_SYNCOBJ_TIMELINE_WAIT: + case AMDGPU_CHUNK_ID_SYNCOBJ_TIMELINE_SIGNAL: +- case AMDGPU_CHUNK_ID_CP_GFX_SHADOW: + break; + + default: diff --git a/queue-6.12/drm-displayid-fix-tiled-display-topology-id-size.patch b/queue-6.12/drm-displayid-fix-tiled-display-topology-id-size.patch new file mode 100644 index 0000000000..12e9822a43 --- /dev/null +++ b/queue-6.12/drm-displayid-fix-tiled-display-topology-id-size.patch @@ -0,0 +1,129 @@ +From 90c0486a82e27393f9eaf3bb350f51a0bd38cb6b Mon Sep 17 00:00:00 2001 +From: Jani Nikula +Date: Wed, 10 Jun 2026 17:15:49 +0300 +Subject: drm/displayid: fix Tiled Display Topology ID size + +From: Jani Nikula + +commit 90c0486a82e27393f9eaf3bb350f51a0bd38cb6b upstream. + +The Tiled Display Topology ID of a DisplayID Tiled Display Topology Data +Block consists of three fields: + +- Tiled Display Manufacturer/Vendor ID Field (3 bytes) +- Tiled Display Product ID Code Field (2 bytes) +- Tiled Display Serial Number Field (4 bytes) + +i.e. a total of 9 bytes, not 8. + +The DisplayID Tiled Display Topology ID is used as the tile group +identifier. + +Update both struct displayid_tiled_block topology_id member and struct +drm_tile_group group_data member to full 9 bytes. + +The group data was missing the last byte of the serial number. I don't +know whether there are known bug reports that might be linked to this, +but it's plausible the last byte could be the differentiating part for +the tile groups, and fewer tile groups might have been created than +intended. + +Fixes: b49b55bd4fba ("drm/displayid: add displayid defines and edid extension (v2)") +Fixes: 138f9ebb9755 ("drm: add tile_group support. (v3)") +Cc: Dave Airlie +Cc: stable@vger.kernel.org # v3.19+ +Reviewed-by: Dave Airlie +Link: https://patch.msgid.link/20260610141549.555605-1-jani.nikula@intel.com +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_connector.c | 12 ++++++------ + drivers/gpu/drm/drm_displayid_internal.h | 2 +- + include/drm/drm_connector.h | 6 +++--- + 3 files changed, 10 insertions(+), 10 deletions(-) + +--- a/drivers/gpu/drm/drm_connector.c ++++ b/drivers/gpu/drm/drm_connector.c +@@ -3393,7 +3393,7 @@ EXPORT_SYMBOL(drm_mode_put_tile_group); + /** + * drm_mode_get_tile_group - get a reference to an existing tile group + * @dev: DRM device +- * @topology: 8-bytes unique per monitor. ++ * @topology_id: 9-byte unique ID per monitor. + * + * Use the unique bytes to get a reference to an existing tile group. + * +@@ -3401,14 +3401,14 @@ EXPORT_SYMBOL(drm_mode_put_tile_group); + * tile group or NULL if not found. + */ + struct drm_tile_group *drm_mode_get_tile_group(struct drm_device *dev, +- const char topology[8]) ++ const char topology_id[9]) + { + struct drm_tile_group *tg; + int id; + + mutex_lock(&dev->mode_config.idr_mutex); + idr_for_each_entry(&dev->mode_config.tile_idr, tg, id) { +- if (!memcmp(tg->group_data, topology, 8)) { ++ if (!memcmp(tg->group_data, topology_id, sizeof(tg->group_data))) { + if (!kref_get_unless_zero(&tg->refcount)) + tg = NULL; + mutex_unlock(&dev->mode_config.idr_mutex); +@@ -3423,7 +3423,7 @@ EXPORT_SYMBOL(drm_mode_get_tile_group); + /** + * drm_mode_create_tile_group - create a tile group from a displayid description + * @dev: DRM device +- * @topology: 8-bytes unique per monitor. ++ * @topology_id: 9-byte unique ID per monitor. + * + * Create a tile group for the unique monitor, and get a unique + * identifier for the tile group. +@@ -3432,7 +3432,7 @@ EXPORT_SYMBOL(drm_mode_get_tile_group); + * new tile group or NULL. + */ + struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev, +- const char topology[8]) ++ const char topology_id[9]) + { + struct drm_tile_group *tg; + int ret; +@@ -3442,7 +3442,7 @@ struct drm_tile_group *drm_mode_create_t + return NULL; + + kref_init(&tg->refcount); +- memcpy(tg->group_data, topology, 8); ++ memcpy(tg->group_data, topology_id, sizeof(tg->group_data)); + tg->dev = dev; + + mutex_lock(&dev->mode_config.idr_mutex); +--- a/drivers/gpu/drm/drm_displayid_internal.h ++++ b/drivers/gpu/drm/drm_displayid_internal.h +@@ -108,7 +108,7 @@ struct displayid_tiled_block { + u8 topo[3]; + u8 tile_size[4]; + u8 tile_pixel_bezel[5]; +- u8 topology_id[8]; ++ u8 topology_id[9]; + } __packed; + + struct displayid_detailed_timings_1 { +--- a/include/drm/drm_connector.h ++++ b/include/drm/drm_connector.h +@@ -2312,13 +2312,13 @@ struct drm_tile_group { + struct kref refcount; + struct drm_device *dev; + int id; +- u8 group_data[8]; ++ u8 group_data[9]; + }; + + struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev, +- const char topology[8]); ++ const char topology_id[9]); + struct drm_tile_group *drm_mode_get_tile_group(struct drm_device *dev, +- const char topology[8]); ++ const char topology_id[9]); + void drm_mode_put_tile_group(struct drm_device *dev, + struct drm_tile_group *tg); + diff --git a/queue-6.12/drm-i915-gem-add-missing-nospec-on-parallel-submit-slot.patch b/queue-6.12/drm-i915-gem-add-missing-nospec-on-parallel-submit-slot.patch new file mode 100644 index 0000000000..3aebeeae24 --- /dev/null +++ b/queue-6.12/drm-i915-gem-add-missing-nospec-on-parallel-submit-slot.patch @@ -0,0 +1,41 @@ +From 914a76a9f08366434bf595700f62026b7a19a9cc Mon Sep 17 00:00:00 2001 +From: Joonas Lahtinen +Date: Mon, 22 Jun 2026 16:25:39 +0300 +Subject: drm/i915/gem: Add missing nospec on parallel submit slot + +From: Joonas Lahtinen + +commit 914a76a9f08366434bf595700f62026b7a19a9cc upstream. + +Add missing Spectre mitigation for userspace controlled parallel +submission slot. + +Discovered using AI-assisted static analysis confirmed by Intel +Product Security. + +Reported-by: Martin Hodo +Fixes: e5e32171a2cf ("drm/i915/guc: Connect UAPI to GuC multi-lrc interface") +Cc: Matthew Brost +Cc: Tvrtko Ursulin +Signed-off-by: Joonas Lahtinen +Reviewed-by: Matthew Brost +Reviewed-by: Tvrtko Ursulin +Cc: # v5.16+ +Link: https://patch.msgid.link/20260622132539.165558-1-joonas.lahtinen@linux.intel.com +(cherry picked from commit 15b9353deff3cf72331c387780de3cf9c316b643) +Signed-off-by: Joonas Lahtinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/gem/i915_gem_context.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c +@@ -613,6 +613,7 @@ set_proto_ctx_engines_parallel_submit(st + return -EINVAL; + } + ++ slot = array_index_nospec(slot, set->num_engines); + if (set->engines[slot].type != I915_GEM_ENGINE_TYPE_INVALID) { + drm_dbg(&i915->drm, + "Invalid placement[%d], already occupied\n", slot); diff --git a/queue-6.12/drm-nouveau-acr-fix-missing-nvkm_done-in-error-path-of-nvkm_acr_oneinit.patch b/queue-6.12/drm-nouveau-acr-fix-missing-nvkm_done-in-error-path-of-nvkm_acr_oneinit.patch new file mode 100644 index 0000000000..d6482119ee --- /dev/null +++ b/queue-6.12/drm-nouveau-acr-fix-missing-nvkm_done-in-error-path-of-nvkm_acr_oneinit.patch @@ -0,0 +1,44 @@ +From c3027973f692077a1b66a9fb26d6a7c46c0dc72c Mon Sep 17 00:00:00 2001 +From: Wentao Liang +Date: Sat, 6 Jun 2026 15:56:06 +0000 +Subject: drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() + +From: Wentao Liang + +commit c3027973f692077a1b66a9fb26d6a7c46c0dc72c upstream. + +In nvkm_acr_oneinit(), nvkm_kmap(acr->wpr) is invoked unconditionally +at line 309 to obtain a mapping reference. Additionally, when both +acr->wpr_fw and acr->wpr_comp are present, a second nvkm_kmap() is +called inside the conditional block. Both mappings are expected to be +released by nvkm_done(acr->wpr) at line 320 before the function returns +successfully. + +However, when a mismatch is detected during the loop within the +conditional block, the function returns -EINVAL at line 318 without +calling nvkm_done(). This results in a leak of the kmap reference(s) +acquired earlier. + +Fix the issue by invoking nvkm_done(acr->wpr) prior to the early return +to ensure proper release of the mapping references. + +Fixes: 22dcda45a3d1 ("drm/nouveau/acr: implement new subdev to replace "secure boot"") +Cc: stable@vger.kernel.org +Signed-off-by: Wentao Liang +Link: https://patch.msgid.link/20260606155606.77593-1-vulab@iscas.ac.cn +Signed-off-by: Danilo Krummrich +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c +@@ -315,6 +315,7 @@ nvkm_acr_oneinit(struct nvkm_subdev *sub + i, us, fw); + } + } ++ nvkm_done(acr->wpr); + return -EINVAL; + } + nvkm_done(acr->wpr); diff --git a/queue-6.12/drm-nouveau-fix-reversed-error-cleanup-order-in-ucopy-functions.patch b/queue-6.12/drm-nouveau-fix-reversed-error-cleanup-order-in-ucopy-functions.patch new file mode 100644 index 0000000000..ab0488c625 --- /dev/null +++ b/queue-6.12/drm-nouveau-fix-reversed-error-cleanup-order-in-ucopy-functions.patch @@ -0,0 +1,66 @@ +From ab99ead646b1b833ecd57fe577a2816f2e848167 Mon Sep 17 00:00:00 2001 +From: Junrui Luo +Date: Wed, 10 Jun 2026 18:01:28 +0800 +Subject: drm/nouveau: fix reversed error cleanup order in ucopy functions + +From: Junrui Luo + +commit ab99ead646b1b833ecd57fe577a2816f2e848167 upstream. + +nouveau_uvmm_vm_bind_ucopy() and nouveau_exec_ucopy() place their error +cleanup labels in allocation order rather than reverse allocation order. +On a u_memcpya() failure for in_sync.s, the goto to err_free_ops (or +err_free_pushs) frees the first allocation and then falls through to +err_free_ins, which calls u_free() on args->in_sync.s. + +Since args->in_sync.s still holds the ERR_PTR returned by the failed +u_memcpya(), and ERR_PTR values are not caught by ZERO_OR_NULL_PTR(), +kvfree() proceeds to dereference it, which can result in a kernel oops. +A failure for out_sync.s instead jumps to err_free_ins and skips freeing +the first allocation, leading to a memory leak. + +Fix by swapping the cleanup label order so resources are freed in the +correct reverse allocation sequence. + +Fixes: b88baab82871 ("drm/nouveau: implement new VM_BIND uAPI") +Reported-by: Yuhao Jiang +Cc: stable@vger.kernel.org +Signed-off-by: Junrui Luo +Link: https://patch.msgid.link/SYBPR01MB7881484D91A6F80271415F71AF1A2@SYBPR01MB7881.ausprd01.prod.outlook.com +Signed-off-by: Danilo Krummrich +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/nouveau_exec.c | 4 ++-- + drivers/gpu/drm/nouveau/nouveau_uvmm.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/nouveau/nouveau_exec.c ++++ b/drivers/gpu/drm/nouveau/nouveau_exec.c +@@ -327,10 +327,10 @@ nouveau_exec_ucopy(struct nouveau_exec_j + + return 0; + +-err_free_pushs: +- u_free(args->push.s); + err_free_ins: + u_free(args->in_sync.s); ++err_free_pushs: ++ u_free(args->push.s); + return ret; + } + +--- a/drivers/gpu/drm/nouveau/nouveau_uvmm.c ++++ b/drivers/gpu/drm/nouveau/nouveau_uvmm.c +@@ -1708,10 +1708,10 @@ nouveau_uvmm_vm_bind_ucopy(struct nouvea + + return 0; + +-err_free_ops: +- u_free(args->op.s); + err_free_ins: + u_free(args->in_sync.s); ++err_free_ops: ++ u_free(args->op.s); + return ret; + } + diff --git a/queue-6.12/drm-radeon-fix-r100_copy_blit-for-large-bos.patch b/queue-6.12/drm-radeon-fix-r100_copy_blit-for-large-bos.patch new file mode 100644 index 0000000000..d7845fd95c --- /dev/null +++ b/queue-6.12/drm-radeon-fix-r100_copy_blit-for-large-bos.patch @@ -0,0 +1,82 @@ +From f896e86273dbbebb5eac966b4a201b5c62a02e9a Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Pavel=20Ondra=C4=8Dka?= +Date: Wed, 10 Jun 2026 10:32:45 +0200 +Subject: drm/radeon: fix r100_copy_blit for large BOs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pavel Ondračka + +commit f896e86273dbbebb5eac966b4a201b5c62a02e9a upstream. + +r100_copy_blit() copies BOs as 1024-pixel-wide ARGB8888 blits, so one +GPU page becomes one blit row. Large copies are split into chunks of at +most 8191 rows. + +The kernel register header names the packet coordinate dwords SRC_Y_X +and DST_Y_X. In the BITBLT_MULTI description in +R5xx_Acceleration_v1.5.pdf docs, these correspond to [SRC_X1 | SRC_Y1] +and [DST_X1 | DST_Y1], which are signed 13-bit coordinates in the +-8192..8191 range. The old code kept SRC/DST_PITCH_OFFSET at the BO base +and used SRC_Y_X/DST_Y_X as the chunk address, so large BO moves could +exceed that coordinate range. + +Compute per-chunk SRC/DST_PITCH_OFFSET bases and emit zero source and +destination coordinates. r100_copy_blit() already packs +SRC/DST_PITCH_OFFSET as pitch plus base offset, so large chunk addresses +belong there rather than in the coordinate fields. + +This fixes Prison Architect corruption with 4096x4096 mipped textures +after they are evicted to GTT under memory pressure on RV530. + +Closes: https://gitlab.freedesktop.org/mesa/mesa/-/work_items/6716 +Acked-by: Christian König +Signed-off-by: Pavel Ondračka +Signed-off-by: Alex Deucher +(cherry picked from commit 87be26aee76239c6da03e599f238a426897f78ad) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/radeon/r100.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/radeon/r100.c ++++ b/drivers/gpu/drm/radeon/r100.c +@@ -906,6 +906,7 @@ struct radeon_fence *r100_copy_blit(stru + { + struct radeon_ring *ring = &rdev->ring[RADEON_RING_TYPE_GFX_INDEX]; + struct radeon_fence *fence; ++ uint64_t cur_src_offset, cur_dst_offset; + uint32_t cur_pages; + uint32_t stride_bytes = RADEON_GPU_PAGE_SIZE; + uint32_t pitch; +@@ -934,6 +935,10 @@ struct radeon_fence *r100_copy_blit(stru + cur_pages = 8191; + } + num_gpu_pages -= cur_pages; ++ cur_src_offset = src_offset + ++ (uint64_t)num_gpu_pages * RADEON_GPU_PAGE_SIZE; ++ cur_dst_offset = dst_offset + ++ (uint64_t)num_gpu_pages * RADEON_GPU_PAGE_SIZE; + + /* pages are in Y direction - height + page width in X direction - width */ +@@ -950,13 +955,13 @@ struct radeon_fence *r100_copy_blit(stru + RADEON_DP_SRC_SOURCE_MEMORY | + RADEON_GMC_CLR_CMP_CNTL_DIS | + RADEON_GMC_WR_MSK_DIS); +- radeon_ring_write(ring, (pitch << 22) | (src_offset >> 10)); +- radeon_ring_write(ring, (pitch << 22) | (dst_offset >> 10)); ++ radeon_ring_write(ring, (pitch << 22) | (cur_src_offset >> 10)); ++ radeon_ring_write(ring, (pitch << 22) | (cur_dst_offset >> 10)); + radeon_ring_write(ring, (0x1fff) | (0x1fff << 16)); + radeon_ring_write(ring, 0); + radeon_ring_write(ring, (0x1fff) | (0x1fff << 16)); +- radeon_ring_write(ring, num_gpu_pages); +- radeon_ring_write(ring, num_gpu_pages); ++ radeon_ring_write(ring, 0); ++ radeon_ring_write(ring, 0); + radeon_ring_write(ring, cur_pages | (stride_pixels << 16)); + } + radeon_ring_write(ring, PACKET0(RADEON_DSTCACHE_CTLSTAT, 0)); diff --git a/queue-6.12/series b/queue-6.12/series index 410e2b6c1e..9d3b182444 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -260,3 +260,10 @@ drm-imagination-fit-paired-fragment-job-in-the-correct-cccb.patch drm-dp-mst-fix-oob-reads-on-2-byte-fields-in-sideband-reply-parsers.patch drm-amdgpu-uvd-fix-forcing-msg-fb-bos-into-vcpu-segment-when-it-isn-t-at-0-v2.patch drm-amdgpu-uvd-place-vcpu-bo-only-in-vram-for-uvd-4.x-and-older.patch +drm-amdgpu-fix-amdgpu_bo_move-when-old_mem-and-new_mem-are-both-gtt.patch +drm-amdgpu-validate-cp_gfx_shadow-chunk-size-in-cs-pass1.patch +drm-nouveau-fix-reversed-error-cleanup-order-in-ucopy-functions.patch +drm-displayid-fix-tiled-display-topology-id-size.patch +drm-i915-gem-add-missing-nospec-on-parallel-submit-slot.patch +drm-nouveau-acr-fix-missing-nvkm_done-in-error-path-of-nvkm_acr_oneinit.patch +drm-radeon-fix-r100_copy_blit-for-large-bos.patch