- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] Revert "drm/hisilicon/hibmc: hibmc-drm bugfix for DP"
by Tengda Wu 06 Feb '26

06 Feb '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13655 ------------------------------------------ This reverts commit 70dcc68078ac0303c412b9dedfddcc0a850e29f1. Commit 70dcc68078ac introduced a null-pointer dereference exception, causing kernel boot failure: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000048 Call trace: hibmc_debugfs_init+0x38/0x68 [hibmc_drm] hibmc_pci_probe+0xdc/0x1ac [hibmc_drm] local_pci_probe+0x48/0xb0 work_for_cpu_fn+0x24/0x50 process_one_work+0x1d8/0x4c0 worker_thread+0x25c/0x470 kthread+0x108/0x150 Temporarily revert this patch to circumvent the issue. Fixes: 70dcc68078ac ("drm/hisilicon/hibmc: hibmc-drm bugfix for DP") Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h | 5 +- drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c | 83 ++++++------------- drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h | 9 -- drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c | 67 ++++----------- drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h | 10 +-- .../gpu/drm/hisilicon/hibmc/dp/dp_serdes.c | 12 +++ .../drm/hisilicon/hibmc/hibmc_drm_debugfs.c | 49 +---------- .../gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c | 65 --------------- .../gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 37 ++++----- .../gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h | 1 - .../gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c | 5 -- .../gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c | 13 +-- 12 files changed, 77 insertions(+), 279 deletions(-) diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h index 1107e10b2047..4bbe6b567056 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h +++ b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h @@ -15,7 +15,6 @@ #include "dp_hw.h" -#define HIBMC_DP_LINK_RATE_CAL 27 #define HIBMC_DP_LANE_NUM_MAX 2 struct hibmc_link_status { @@ -26,9 +25,6 @@ struct hibmc_link_status { struct hibmc_link_cap { u8 link_rate; u8 lanes; - int rx_dpcd_revision; - bool is_tps3; - bool is_tps4; }; struct hibmc_dp_link { @@ -67,6 +63,7 @@ struct hibmc_dp_dev { void hibmc_dp_aux_init(struct hibmc_dp *dp); int hibmc_dp_link_training(struct hibmc_dp_dev *dp); +int hibmc_dp_serdes_init(struct hibmc_dp_dev *dp); int hibmc_dp_serdes_rate_switch(u8 rate, struct hibmc_dp_dev *dp); int hibmc_dp_serdes_set_tx_cfg(struct hibmc_dp_dev *dp, u8 train_set[HIBMC_DP_LANE_NUM_MAX]); diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c index 9e8f95d957f2..8f0daec7d174 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c +++ b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c @@ -154,6 +154,7 @@ int hibmc_dp_hw_init(struct hibmc_dp *dp) { struct drm_device *drm_dev = dp->drm_dev; struct hibmc_dp_dev *dp_dev; + int ret; dp_dev = devm_kzalloc(drm_dev->dev, sizeof(struct hibmc_dp_dev), GFP_KERNEL); if (!dp_dev) @@ -165,22 +166,23 @@ int hibmc_dp_hw_init(struct hibmc_dp *dp) dp_dev->dev = drm_dev; dp_dev->base = dp->mmio + HIBMC_DP_OFFSET; - dp_dev->serdes_base = dp_dev->base + HIBMC_DP_HOST_OFFSET; hibmc_dp_aux_init(dp); + ret = hibmc_dp_serdes_init(dp_dev); + if (ret) + return ret; + dp_dev->link.cap.lanes = 0x2; dp_dev->link.cap.link_rate = DP_LINK_BW_8_1; + /* hdcp data */ + writel(HIBMC_DP_HDCP, dp_dev->base + HIBMC_DP_HDCP_CFG); /* int init */ writel(0, dp_dev->base + HIBMC_DP_INTR_ENABLE); writel(HIBMC_DP_INT_RST, dp_dev->base + HIBMC_DP_INTR_ORIGINAL_STATUS); /* rst */ - writel(0, dp_dev->base + HIBMC_DP_DPTX_RST_CTRL); - usleep_range(30, 50); writel(HIBMC_DP_DPTX_RST, dp_dev->base + HIBMC_DP_DPTX_RST_CTRL); - /* hdcp data */ - writel(HIBMC_DP_HDCP, dp_dev->base + HIBMC_DP_HDCP_CFG); /* clock enable */ writel(HIBMC_DP_CLK_EN, dp_dev->base + HIBMC_DP_DPTX_CLK_CTRL); @@ -222,17 +224,14 @@ void hibmc_dp_display_en(struct hibmc_dp *dp, bool enable) struct hibmc_dp_dev *dp_dev = dp->dp_dev; if (enable) { - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_VIDEO_CTRL, - HIBMC_DP_CFG_MST_ENABLE, 0x1); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_VIDEO_CTRL, BIT(0), 0x1); writel(HIBMC_DP_SYNC_EN_MASK, dp_dev->base + HIBMC_DP_TIMING_SYNC_CTRL); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_DPTX_GCTL0, - HIBMC_DP_CFG_TIMING_GEN_ENABLE, 0x1); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_DPTX_GCTL0, BIT(10), 0x1); writel(HIBMC_DP_SYNC_EN_MASK, dp_dev->base + HIBMC_DP_TIMING_SYNC_CTRL); } else { - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_DPTX_GCTL0, - HIBMC_DP_CFG_TIMING_GEN_ENABLE, 0); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_DPTX_GCTL0, BIT(10), 0); writel(HIBMC_DP_SYNC_EN_MASK, dp_dev->base + HIBMC_DP_TIMING_SYNC_CTRL); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_VIDEO_CTRL, HIBMC_DP_CFG_MST_ENABLE, 0); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_VIDEO_CTRL, BIT(0), 0); writel(HIBMC_DP_SYNC_EN_MASK, dp_dev->base + HIBMC_DP_TIMING_SYNC_CTRL); } @@ -258,36 +257,10 @@ int hibmc_dp_mode_set(struct hibmc_dp *dp, struct drm_display_mode *mode) return 0; } -u8 hibmc_dp_get_link_rate(struct hibmc_dp *dp) -{ - if (!dp->dp_dev) - return 0; - - return dp->dp_dev->link.cap.link_rate; -} - -u8 hibmc_dp_get_lanes(struct hibmc_dp *dp) -{ - if (!dp->dp_dev) - return 0; - - return dp->dp_dev->link.cap.lanes; -} - -int hibmc_dp_get_dpcd(struct hibmc_dp *dp) -{ - if (!dp->dp_dev) - return 0; - - return dp->dp_dev->link.cap.rx_dpcd_revision; -} - void hibmc_dp_reset_link(struct hibmc_dp *dp) { - if (dp->dp_dev) { - dp->dp_dev->link.status.clock_recovered = false; - dp->dp_dev->link.status.channel_equalized = false; - } + dp->dp_dev->link.status.clock_recovered = false; + dp->dp_dev->link.status.channel_equalized = false; } static const struct hibmc_dp_color_raw g_rgb_raw[] = { @@ -309,30 +282,26 @@ void hibmc_dp_set_cbar(struct hibmc_dp *dp, const struct hibmc_dp_cbar_cfg *cfg) struct hibmc_dp_color_raw raw_data; if (cfg->enable) { - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_TIMING_SEL_M, cfg->self_timing); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_CTRL_M, cfg->dynamic_rate); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, BIT(9), + cfg->self_timing); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, GENMASK(8, 1), + cfg->dynamic_rate); if (cfg->pattern == CBAR_COLOR_BAR) { - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_PATTERN_SEL_M, 0); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, BIT(10), 0); } else { raw_data = g_rgb_raw[cfg->pattern]; drm_dbg_dp(dp->drm_dev, "r:%x g:%x b:%x\n", raw_data.r_value, raw_data.g_value, raw_data.b_value); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_PATTERN_SEL_M, 1); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_DATA_R_M, raw_data.r_value); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL1, - HIBMC_DP_COLOR_BAR_DATA_G_M, raw_data.g_value); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL1, - HIBMC_DP_COLOR_BAR_DATA_B_M, raw_data.b_value); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, BIT(10), 1); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, GENMASK(23, 12), + raw_data.r_value); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL1, GENMASK(23, 12), + raw_data.g_value); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL1, GENMASK(11, 0), + raw_data.b_value); } } - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_ENABLE_M, cfg->enable); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, BIT(0), cfg->enable); writel(HIBMC_DP_SYNC_EN_MASK, dp_dev->base + HIBMC_DP_TIMING_SYNC_CTRL); } - diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h index 4740db06e1b0..f55d78d266f2 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h +++ b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h @@ -12,10 +12,6 @@ #include <drm/drm_print.h> #include <drm/drm_dp_helper.h> -// 27 * 10000000 * 80% = 216000000 -#define DP_MODE_VALI_CAL 216000000 -#define BPP_24 24 - struct hibmc_dp_dev; enum hibmc_dp_cbar_pattern { @@ -55,16 +51,11 @@ struct hibmc_dp { struct hibmc_dp_cbar_cfg cfg; u32 irq_status; int hpd_status; - bool is_connected; }; int hibmc_dp_hw_init(struct hibmc_dp *dp); int hibmc_dp_mode_set(struct hibmc_dp *dp, struct drm_display_mode *mode); void hibmc_dp_display_en(struct hibmc_dp *dp, bool enable); -struct edid *hibmc_dp_get_edid(struct hibmc_dp *dp); -int hibmc_dp_get_dpcd(struct hibmc_dp *dp); -u8 hibmc_dp_get_link_rate(struct hibmc_dp *dp); -u8 hibmc_dp_get_lanes(struct hibmc_dp *dp); void hibmc_dp_set_cbar(struct hibmc_dp *dp, const struct hibmc_dp_cbar_cfg *cfg); void hibmc_dp_reset_link(struct hibmc_dp *dp); void hibmc_dp_hpd_cfg(struct hibmc_dp *dp); diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c index 9b632428fec6..c3e648e2f1a8 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c +++ b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c @@ -39,14 +39,6 @@ static int hibmc_dp_link_training_configure(struct hibmc_dp_dev *dp) /* enhanced frame */ hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_CTRL, HIBMC_DP_CFG_STREAM_FRAME_MODE, 0x1); - ret = hibmc_dp_get_serdes_rate_cfg(dp); - if (ret < 0) - return ret; - - ret = hibmc_dp_serdes_rate_switch(ret, dp); - if (ret) - return ret; - /* set rate and lane count */ buf[0] = dp->link.cap.link_rate; buf[1] = DP_LANE_COUNT_ENHANCED_FRAME_EN | dp->link.cap.lanes; @@ -209,23 +201,21 @@ static int hibmc_dp_link_training_cr(struct hibmc_dp_dev *dp) bool level_changed; u32 voltage_tries; u32 cr_tries; - u32 max_cr; int ret; /* * DP 1.4 spec define 10 for maxtries value, for pre DP 1.4 version set a limit of 80 * (4 voltage levels x 4 preemphasis levels x 5 identical voltage retries) */ - max_cr = dp->link.cap.rx_dpcd_revision >= DP_DPCD_REV_14 ? 10 : 80; voltage_tries = 1; - for (cr_tries = 0; cr_tries < max_cr; cr_tries++) { + for (cr_tries = 0; cr_tries < 80; cr_tries++) { drm_dp_link_train_clock_recovery_delay(dp->dpcd); ret = drm_dp_dpcd_read_link_status(dp->aux, lane_status); if (ret != DP_LINK_STATUS_SIZE) { - drm_err(dp->dev, "Get lane status failed, ret: %d\n", ret); - return ret >= 0 ? -EIO : ret; + drm_err(dp->dev, "Get lane status failed\n"); + return ret; } if (drm_dp_clock_recovery_ok(lane_status, dp->link.cap.lanes)) { @@ -256,7 +246,7 @@ static int hibmc_dp_link_training_cr(struct hibmc_dp_dev *dp) voltage_tries = level_changed ? 1 : voltage_tries + 1; } - drm_err(dp->dev, "dp link training clock recovery %u timers failed\n", max_cr); + drm_err(dp->dev, "dp link training clock recovery 80 times failed\n"); dp->link.status.clock_recovered = false; return 0; @@ -266,17 +256,9 @@ static int hibmc_dp_link_training_channel_eq(struct hibmc_dp_dev *dp) { u8 lane_status[DP_LINK_STATUS_SIZE] = {0}; u8 eq_tries; - int tps; int ret; - if (dp->link.cap.is_tps4) - tps = DP_TRAINING_PATTERN_4; - else if (dp->link.cap.is_tps3) - tps = DP_TRAINING_PATTERN_3; - else - tps = DP_TRAINING_PATTERN_2; - - ret = hibmc_dp_link_set_pattern(dp, tps); + ret = hibmc_dp_link_set_pattern(dp, DP_TRAINING_PATTERN_2); if (ret) return ret; @@ -306,7 +288,7 @@ static int hibmc_dp_link_training_channel_eq(struct hibmc_dp_dev *dp) ret = hibmc_dp_serdes_set_tx_cfg(dp, dp->link.train_set); if (ret) - break; + return ret; ret = drm_dp_dpcd_write(dp->aux, DP_TRAINING_LANE0_SET, dp->link.train_set, dp->link.cap.lanes); @@ -335,17 +317,7 @@ static int hibmc_dp_link_downgrade_training_cr(struct hibmc_dp_dev *dp) static int hibmc_dp_link_downgrade_training_eq(struct hibmc_dp_dev *dp) { - u8 status[DP_LINK_STATUS_SIZE] = {0}; - int ret; - - ret = drm_dp_dpcd_read_link_status(dp->aux, status); - if (ret != DP_LINK_STATUS_SIZE) { - drm_err(dp->dev, "get lane status failed\n"); - return ret >= 0 ? -EIO : ret; - } - - if ((dp->link.status.clock_recovered && !dp->link.status.channel_equalized) || - (status[0] != 0 && !dp->link.status.clock_recovered)) { // at least one cr_done + if ((dp->link.status.clock_recovered && !dp->link.status.channel_equalized)) { if (!hibmc_dp_link_reduce_lane(dp)) return 0; } @@ -353,20 +325,6 @@ static int hibmc_dp_link_downgrade_training_eq(struct hibmc_dp_dev *dp) return hibmc_dp_link_reduce_rate(dp); } -static void hibmc_dp_update_caps(struct hibmc_dp_dev *dp) -{ - dp->link.cap.rx_dpcd_revision = dp->dpcd[DP_DPCD_REV]; - - dp->link.cap.is_tps3 = (dp->dpcd[DP_DPCD_REV] >= DP_DPCD_REV_13) && - (dp->dpcd[DP_MAX_LANE_COUNT] & DP_TPS3_SUPPORTED); - dp->link.cap.is_tps4 = (dp->dpcd[DP_DPCD_REV] >= DP_DPCD_REV_14) && - (dp->dpcd[DP_MAX_DOWNSPREAD] & DP_TPS4_SUPPORTED); - dp->link.cap.link_rate = dp->dpcd[DP_MAX_LINK_RATE]; - dp->link.cap.lanes = dp->dpcd[DP_MAX_LANE_COUNT] & DP_MAX_LANE_COUNT_MASK; - if (dp->link.cap.lanes > HIBMC_DP_LANE_NUM_MAX) - dp->link.cap.lanes = HIBMC_DP_LANE_NUM_MAX; -} - int hibmc_dp_link_training(struct hibmc_dp_dev *dp) { struct hibmc_dp_link *link = &dp->link; @@ -376,7 +334,16 @@ int hibmc_dp_link_training(struct hibmc_dp_dev *dp) if (ret) drm_err(dp->dev, "dp aux read dpcd failed, ret: %d\n", ret); - hibmc_dp_update_caps(dp); + dp->link.cap.link_rate = dp->dpcd[DP_MAX_LINK_RATE]; + dp->link.cap.lanes = 0x2; + + ret = hibmc_dp_get_serdes_rate_cfg(dp); + if (ret < 0) + return ret; + + ret = hibmc_dp_serdes_rate_switch(ret, dp); + if (ret) + return ret; while (true) { ret = hibmc_dp_link_training_cr_pre(dp); diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h index 156e5d63c47f..394b1e933c3a 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h +++ b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h @@ -68,14 +68,8 @@ #define HIBMC_DP_CFG_STREAM_HBLANK_SIZE GENMASK(15, 0) #define HIBMC_DP_COLOR_BAR_CTRL 0x260 -#define HIBMC_DP_COLOR_BAR_ENABLE_M BIT(0) -#define HIBMC_DP_COLOR_BAR_CTRL_M GENMASK(8, 1) -#define HIBMC_DP_COLOR_BAR_TIMING_SEL_M BIT(9) -#define HIBMC_DP_COLOR_BAR_PATTERN_SEL_M BIT(10) -#define HIBMC_DP_COLOR_BAR_DATA_R_M GENMASK(23, 12) #define HIBMC_DP_COLOR_BAR_CTRL1 0x264 -#define HIBMC_DP_COLOR_BAR_DATA_B_M GENMASK(11, 0) -#define HIBMC_DP_COLOR_BAR_DATA_G_M GENMASK(23, 12) + #define HIBMC_DP_TIMING_GEN_CONFIG0 0x26c #define HIBMC_DP_CFG_TIMING_GEN0_HACTIVE GENMASK(31, 16) #define HIBMC_DP_CFG_TIMING_GEN0_HBLANK GENMASK(15, 0) @@ -96,8 +90,6 @@ #define HIBMC_DP_DPTX_GCTL0 0x708 #define HIBMC_DP_CFG_PHY_LANE_NUM GENMASK(2, 1) -#define HIBMC_DP_CFG_TIMING_GEN_ENABLE BIT(10) -#define HIBMC_DP_CFG_MST_ENABLE BIT(0) #define HIBMC_DP_INTR_ENABLE 0x720 #define HIBMC_DP_INTR_ORIGINAL_STATUS 0x728 diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_serdes.c b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_serdes.c index 8191233aa965..676059d4c1e6 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_serdes.c +++ b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_serdes.c @@ -57,3 +57,15 @@ int hibmc_dp_serdes_rate_switch(u8 rate, struct hibmc_dp_dev *dp) return 0; } + +int hibmc_dp_serdes_init(struct hibmc_dp_dev *dp) +{ + dp->serdes_base = dp->base + HIBMC_DP_HOST_OFFSET; + + writel(FIELD_PREP(HIBMC_DP_PMA_TXDEEMPH, DP_SERDES_VOL0_PRE0), + dp->serdes_base + HIBMC_DP_PMA_LANE0_OFFSET); + writel(FIELD_PREP(HIBMC_DP_PMA_TXDEEMPH, DP_SERDES_VOL0_PRE0), + dp->serdes_base + HIBMC_DP_PMA_LANE1_OFFSET); + + return hibmc_dp_serdes_rate_switch(DP_SERDES_BW_8_1, dp); +} diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_debugfs.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_debugfs.c index 6c6ff3255d15..83d2cd48f81c 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_debugfs.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_debugfs.c @@ -15,44 +15,6 @@ #define MAX_BUF_SIZE 12 -static int hibmc_dp_show(struct seq_file *m, void *arg) -{ - struct drm_info_node *node = m->private; - struct drm_device *dev = node->minor->dev; - struct hibmc_drm_private *priv = to_hibmc_drm_private(dev); - int idx, rate; - - if (!drm_dev_enter(dev, &idx)) - return -ENODEV; - - switch (hibmc_dp_get_link_rate(&priv->dp)) { - case 0x1e: - rate = 810; // 8.1Gbps - break; - case 0x14: - rate = 540; // 5.4Gbps - break; - case 0xA: - rate = 270; // 2.7Gbps - break; - case 0x6: - rate = 162; // 1.62Gbps - break; - default: - rate = 0; - } - - seq_printf(m, "enable lanes: %u\n", hibmc_dp_get_lanes(&priv->dp)); - seq_printf(m, "link rate: %d\n", rate); - seq_printf(m, "vfresh: %d\n", drm_mode_vrefresh(&priv->crtc.mode)); - seq_printf(m, "dpcd version: 0x%x\n", hibmc_dp_get_dpcd(&priv->dp)); - seq_printf(m, "hpd status: %d\n", priv->dp.hpd_status); - - drm_dev_exit(idx); - - return 0; -} - static ssize_t hibmc_control_write(struct file *file, const char __user *user_buf, size_t count, loff_t *ppos) { @@ -131,19 +93,12 @@ static const struct file_operations hibmc_dbg_fops = { .release = single_release, }; -static struct drm_info_list hibmc_debugfs_list[] = { - { "hibmc-dp", hibmc_dp_show }, -}; - void hibmc_debugfs_init(struct drm_connector *connector, struct dentry *root) { struct drm_device *dev = connector->dev; struct hibmc_drm_private *priv = to_hibmc_drm_private(dev); - struct drm_minor *minor = dev->primary; /* create the file in drm directory, so we don't need to remove manually */ - debugfs_create_file("colorbar-cfg", 0200, root, priv, &hibmc_dbg_fops); - - drm_debugfs_create_files(hibmc_debugfs_list, ARRAY_SIZE(hibmc_debugfs_list), - minor->debugfs_root, minor); + debugfs_create_file("colorbar-cfg", 0200, + root, priv, &hibmc_dbg_fops); } diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c index ae6f5c235e02..c2cda042c736 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c @@ -11,7 +11,6 @@ #include <drm/drm_edid.h> #include "hibmc_drm_drv.h" -#include "hibmc_drm_regs.h" #include "dp/dp_hw.h" #define HIBMC_DP_MASKED_SINK_HPD_PLUG_INT BIT(2) @@ -20,56 +19,14 @@ static int hibmc_dp_connector_get_modes(struct drm_connector *connector) { int count; - struct hibmc_dp *dp = to_hibmc_dp(connector); - struct edid *edid; - - - edid = drm_get_edid(connector, &dp->aux.ddc); - if (edid) { - drm_connector_update_edid_property(connector, edid); - count = drm_add_edid_modes(connector, edid); - if (count) { - dp->is_connected = true; - goto out; - } - } - - - dp->is_connected = false; count = drm_add_modes_noedid(connector, connector->dev->mode_config.max_width, connector->dev->mode_config.max_height); drm_set_preferred_mode(connector, 1024, 768); // temporary implementation -out: - kfree(edid); - return count; } -static int hibmc_dp_mode_valid(struct drm_connector *connector, - struct drm_display_mode *mode, - struct drm_modeset_acquire_ctx *ctx, - enum drm_mode_status *status) -{ - struct hibmc_dp *dp = to_hibmc_dp(connector); - u64 cur_val, max_val; - - if (!dp->is_connected) { - *status = MODE_OK; - return 0; - } - - cur_val = (u64)mode->htotal * mode->vtotal * drm_mode_vrefresh(mode) * BPP_24; - max_val = (u64)hibmc_dp_get_link_rate(dp) * DP_MODE_VALI_CAL * hibmc_dp_get_lanes(dp); - if (cur_val > max_val) - *status = MODE_CLOCK_HIGH; - else - *status = MODE_OK; - - return 0; -} - static int hibmc_dp_detect(struct drm_connector *connector, struct drm_modeset_acquire_ctx *ctx, bool force) { @@ -83,7 +40,6 @@ static int hibmc_dp_detect(struct drm_connector *connector, static const struct drm_connector_helper_funcs hibmc_dp_conn_helper_funcs = { .get_modes = hibmc_dp_connector_get_modes, - .mode_valid_ctx = hibmc_dp_mode_valid, .detect_ctx = hibmc_dp_detect, }; @@ -148,26 +104,9 @@ static void hibmc_dp_encoder_disable(struct drm_encoder *drm_encoder, hibmc_dp_display_en(dp, false); } -static void hibmc_dp_encoder_mode_set(struct drm_encoder *encoder, - struct drm_crtc_state *crtc_state, - struct drm_connector_state *conn_state) -{ - u32 reg; - struct drm_device *dev = encoder->dev; - struct hibmc_drm_private *priv = to_hibmc_drm_private(dev); - - reg = readl(priv->mmio + HIBMC_DISPLAY_CONTROL_HISILE); - reg |= HIBMC_DISPLAY_CONTROL_FPVDDEN(1); - reg |= HIBMC_DISPLAY_CONTROL_PANELDATE(1); - reg |= HIBMC_DISPLAY_CONTROL_FPEN(1); - reg |= HIBMC_DISPLAY_CONTROL_VBIASEN(1); - writel(reg, priv->mmio + HIBMC_DISPLAY_CONTROL_HISILE); -} - static const struct drm_encoder_helper_funcs hibmc_dp_encoder_helper_funcs = { .atomic_enable = hibmc_dp_encoder_enable, .atomic_disable = hibmc_dp_encoder_disable, - .atomic_mode_set = hibmc_dp_encoder_mode_set, }; static const struct drm_encoder_funcs hibmc_encoder_funcs = { @@ -191,8 +130,6 @@ irqreturn_t hibmc_dp_hpd_isr(int irq, void *arg) dp->hpd_status = 0; if (dev->registered) drm_helper_hpd_irq_event(dev); - } else { - drm_dbg_dp(dev, "HPD OUT occur but err!\n"); } } else { if (dp->irq_status & HIBMC_DP_MASKED_SINK_HPD_PLUG_INT) { @@ -201,8 +138,6 @@ irqreturn_t hibmc_dp_hpd_isr(int irq, void *arg) dp->hpd_status = 1; if (dev->registered) drm_helper_hpd_irq_event(dev); - } else { - drm_dbg_dp(dev, "HPD IN occur but err!\n"); } } diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c index b9398a78c26c..147354daed84 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c @@ -20,7 +20,6 @@ #include <drm/drm_irq.h> #include <drm/drm_managed.h> #include <drm/drm_vblank.h> -#include <drm/drm_probe_helper.h> #include "hibmc_drm_drv.h" #include "hibmc_drm_regs.h" @@ -120,7 +119,7 @@ static int hibmc_kms_init(struct hibmc_drm_private *priv) ret = hibmc_de_init(priv); if (ret) { drm_err(priv->dev, "failed to init de: %d\n", ret); - goto err; + return ret; } /* @@ -130,25 +129,17 @@ static int hibmc_kms_init(struct hibmc_drm_private *priv) ret = readl(priv->mmio + HIBMC_DP_HOST_SERDES_CTRL); if (ret) { ret = hibmc_dp_init(priv); - if (ret) { + if (ret) drm_err(priv->dev, "failed to init dp: %d\n", ret); - goto err; - } } ret = hibmc_vdac_init(priv); if (ret) { drm_err(priv->dev, "failed to init vdac: %d\n", ret); - goto err; + return ret; } - drm_kms_helper_poll_init(priv->dev); return 0; - -err: - drm_atomic_helper_shutdown(priv->dev); - - return ret; } static void hibmc_kms_fini(struct hibmc_drm_private *priv) @@ -300,7 +291,6 @@ static int hibmc_hw_init(struct hibmc_drm_private *priv) static void hibmc_unload(struct drm_device *dev) { drm_atomic_helper_shutdown(dev); - drm_kms_helper_poll_fini(dev); } static int hibmc_msi_init(struct drm_device *dev) @@ -355,19 +345,21 @@ static int hibmc_load(struct drm_device *dev) priv->dev = dev; ret = hibmc_hw_init(priv); - if (ret) - return ret; + if (ret) { + drm_err(dev, "failed to initialize hardware: %d\n", ret); + goto err_alloc; + } ret = hibmc_mm_init(priv); if (ret) { - drm_err(dev, "Error initializing VRAM MM; %d\n", ret); - return ret; + drm_err(dev, "failed to initialize mm: %d\n", ret); + goto err_hw; } ret = hibmc_kms_init(priv); if (ret) { - drm_err(dev, "hibmc kms init failed, ret:%d\n", ret); - return ret; + drm_err(dev, "failed to initialize kms: %d\n", ret); + goto err_mm; } ret = drm_vblank_init(dev, dev->mode_config.num_crtc); @@ -389,8 +381,11 @@ static int hibmc_load(struct drm_device *dev) err_kms: hibmc_kms_fini(priv); +err_mm: hibmc_mm_fini(priv); +err_hw: hibmc_hw_unmap(priv); +err_alloc: dev->dev_private = NULL; return ret; @@ -400,7 +395,6 @@ static int hibmc_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) { struct drm_device *dev; - struct hibmc_drm_private *priv; int ret; ret = drm_fb_helper_remove_conflicting_pci_framebuffers(pdev, @@ -440,9 +434,6 @@ static int hibmc_pci_probe(struct pci_dev *pdev, drm_fbdev_generic_setup(dev, dev->mode_config.preferred_depth); - priv = to_hibmc_drm_private(dev); - hibmc_debugfs_init(&priv->dp.connector, dev->primary->debugfs_root); - return 0; err_unload: diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h index 617585268009..0b0addca37f9 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h @@ -79,7 +79,6 @@ void hibmc_mm_fini(struct hibmc_drm_private *hibmc); int hibmc_dumb_create(struct drm_file *file, struct drm_device *dev, struct drm_mode_create_dumb *args); int hibmc_ddc_create(struct drm_device *drm_dev, struct hibmc_vdac *connector); -void hibmc_ddc_del(struct hibmc_vdac *vdac); int hibmc_dp_init(struct hibmc_drm_private *priv); extern const struct drm_mode_config_funcs hibmc_mode_funcs; diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c index 2e0fcd2b3bc1..4f801c0fbd96 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c @@ -96,8 +96,3 @@ int hibmc_ddc_create(struct drm_device *drm_dev, struct hibmc_vdac *vdac) return i2c_bit_add_bus(&vdac->adapter); } - -void hibmc_ddc_del(struct hibmc_vdac *vdac) -{ - i2c_del_adapter(&vdac->adapter); -} diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c index 9c0ec6e54df0..f183dd819daf 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c @@ -88,7 +88,7 @@ static enum drm_mode_status hibmc_connector_mode_valid( return hibmc_valid_mode(mode->hdisplay, mode->vdisplay); } -static void hibmc_vdac_connector_destroy(struct drm_connector *connector) +static void hibmc_connector_destroy(struct drm_connector *connector) { struct hibmc_vdac *vdac = to_hibmc_vdac(connector); @@ -130,7 +130,7 @@ static void hibmc_vdac_force(struct drm_connector *connector) static const struct drm_connector_funcs hibmc_connector_funcs = { .fill_modes = drm_helper_probe_single_connector_modes, - .destroy = hibmc_vdac_connector_destroy, + .destroy = hibmc_connector_destroy, .reset = drm_atomic_helper_connector_reset, .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state, .atomic_destroy_state = drm_atomic_helper_connector_destroy_state, @@ -180,7 +180,7 @@ int hibmc_vdac_init(struct hibmc_drm_private *priv) DRM_MODE_ENCODER_DAC, NULL); if (ret) { drm_err(dev, "failed to init encoder: %d\n", ret); - goto err; + return ret; } drm_encoder_helper_add(encoder, &hibmc_encoder_helper_funcs); @@ -191,7 +191,7 @@ int hibmc_vdac_init(struct hibmc_drm_private *priv) &vdac->adapter); if (ret) { drm_err(dev, "failed to init connector: %d\n", ret); - goto err; + return ret; } drm_connector_helper_add(connector, &hibmc_connector_helper_funcs); @@ -200,9 +200,4 @@ int hibmc_vdac_init(struct hibmc_drm_private *priv) connector->polled = DRM_CONNECTOR_POLL_CONNECT | DRM_CONNECTOR_POLL_DISCONNECT; return 0; - -err: - hibmc_ddc_del(vdac); - - return ret; } -- 2.34.1

2 1

[PATCH v2 OLK-6.6 0/3] Fix CVE-2025-21696
by Ze Zuo 06 Feb '26

06 Feb '26

Fix CVE-2025-21696. change since v1: - fix kabi breakage due to first patch. Lokesh Gidra (1): userfaultfd: move userfaultfd_ctx struct to header file Ryan Roberts (1): mm: clear uffd-wp PTE/PMD state on mremap() Ze Zuo (1): userfaultfd: fix kabi breakage due to struct userfaultfd_ctx fs/userfaultfd.c | 39 -------------------------- include/linux/userfaultfd_k.h | 53 +++++++++++++++++++++++++++++++++++ mm/huge_memory.c | 12 ++++++++ mm/hugetlb.c | 14 ++++++++- mm/mremap.c | 32 ++++++++++++++++++++- 5 files changed, 109 insertions(+), 41 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6] x86/CPU/AMD: Add RDSEED fix for Zen5
by Bowen You 06 Feb '26

06 Feb '26

From: Gregory Price <gourry(a)gourry.net> stable inclusion from stable-v6.12.57 commit e980de2ff109dacb6d9d3a77f01b27c467115ecb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11500 CVE: CVE-2025-68313 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 607b9fb2ce248cc5b633c5949e0153838992c152 upstream. There's an issue with RDSEED's 16-bit and 32-bit register output variants on Zen5 which return a random value of 0 "at a rate inconsistent with randomness while incorrectly signaling success (CF=1)". Search the web for AMD-SB-7055 for more detail. Add a fix glue which checks microcode revisions. [ bp: Add microcode revisions checking, rewrite. ] Cc: stable(a)vger.kernel.org Signed-off-by: Gregory Price <gourry(a)gourry.net> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Link: https://lore.kernel.org/r/20251018024010.4112396-1-gourry@gourry.net [ bp: 6.12 backport: use the alternative microcode version checking. ] Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/x86/include/asm/cpu.h [Add the definition of zen_patch_rev] Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/x86/kernel/cpu/amd.c | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c index f89dbe6f48e6..5a46bf0cce5d 100644 --- a/arch/x86/kernel/cpu/amd.c +++ b/arch/x86/kernel/cpu/amd.c @@ -1135,8 +1135,43 @@ static void init_amd_zen4(struct cpuinfo_x86 *c) } } +static bool check_rdseed_microcode(void) +{ + struct cpuinfo_x86 *c = &boot_cpu_data; + union zen_patch_rev p; + u32 min_rev = 0; + + p.ext_fam = c->x86 - 0xf; + p.model = c->x86_model; + p.ext_model = c->x86_model >> 4; + p.stepping = c->x86_stepping; + /* reserved bits are expected to be 0 in test below */ + p.__reserved = 0; + + if (cpu_has(c, X86_FEATURE_ZEN5)) { + switch (p.ucode_rev >> 8) { + case 0xb0021: min_rev = 0xb00215a; break; + case 0xb1010: min_rev = 0xb101054; break; + default: + pr_debug("%s: ucode_rev: 0x%x, current revision: 0x%x\n", + __func__, p.ucode_rev, c->microcode); + return false; + } + } + + if (!min_rev) + return false; + + return c->microcode >= min_rev; +} + static void init_amd_zen5(struct cpuinfo_x86 *c) { + if (!check_rdseed_microcode()) { + clear_cpu_cap(c, X86_FEATURE_RDSEED); + msr_clear_bit(MSR_AMD64_CPUID_FN_7, 18); + pr_emerg_once("RDSEED32 is broken. Disabling the corresponding CPUID bit.\n"); + } } static void init_amd(struct cpuinfo_x86 *c) -- 2.34.1

2 1

[PATCH OLK-5.10] arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA
by Jinjie Ruan 06 Feb '26

06 Feb '26

From: Mark Rutland <mark.rutland(a)arm.com> stable inclusion from stable-v6.6.122 commit 19b2c3f3ca1b4b6dccd2a42aca2692d8c79c4214 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13639 CVE: CVE-2026-23107 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ea8ccfddbce0bee6310da4f3fc560ad520f5e6b4 upstream. The code to restore a ZA context doesn't attempt to allocate the task's sve_state before setting TIF_SME. Consequently, restoring a ZA context can place a task into an invalid state where TIF_SME is set but the task's sve_state is NULL. In legitimate but uncommon cases where the ZA signal context was NOT created by the kernel in the context of the same task (e.g. if the task is saved/restored with something like CRIU), we have no guarantee that sve_state had been allocated previously. In these cases, userspace can enter streaming mode without trapping while sve_state is NULL, causing a later NULL pointer dereference when the kernel attempts to store the register state: | # ./sigreturn-za | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 | Mem abort info: | ESR = 0x0000000096000046 | EC = 0x25: DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x06: level 2 translation fault | Data abort info: | ISV = 0, ISS = 0x00000046, ISS2 = 0x00000000 | CM = 0, WnR = 1, TnD = 0, TagAccess = 0 | GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 | user pgtable: 4k pages, 52-bit VAs, pgdp=0000000101f47c00 | [0000000000000000] pgd=08000001021d8403, p4d=0800000102274403, pud=0800000102275403, pmd=0000000000000000 | Internal error: Oops: 0000000096000046 [#1] SMP | Modules linked in: | CPU: 0 UID: 0 PID: 153 Comm: sigreturn-za Not tainted 6.19.0-rc1 #1 PREEMPT | Hardware name: linux,dummy-virt (DT) | pstate: 214000c9 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) | pc : sve_save_state+0x4/0xf0 | lr : fpsimd_save_user_state+0xb0/0x1c0 | sp : ffff80008070bcc0 | x29: ffff80008070bcc0 x28: fff00000c1ca4c40 x27: 63cfa172fb5cf658 | x26: fff00000c1ca5228 x25: 0000000000000000 x24: 0000000000000000 | x23: 0000000000000000 x22: fff00000c1ca4c40 x21: fff00000c1ca4c40 | x20: 0000000000000020 x19: fff00000ff6900f0 x18: 0000000000000000 | x17: fff05e8e0311f000 x16: 0000000000000000 x15: 028fca8f3bdaf21c | x14: 0000000000000212 x13: fff00000c0209f10 x12: 0000000000000020 | x11: 0000000000200b20 x10: 0000000000000000 x9 : fff00000ff69dcc0 | x8 : 00000000000003f2 x7 : 0000000000000001 x6 : fff00000c1ca5b48 | x5 : fff05e8e0311f000 x4 : 0000000008000000 x3 : 0000000000000000 | x2 : 0000000000000001 x1 : fff00000c1ca5970 x0 : 0000000000000440 | Call trace: | sve_save_state+0x4/0xf0 (P) | fpsimd_thread_switch+0x48/0x198 | __switch_to+0x20/0x1c0 | __schedule+0x36c/0xce0 | schedule+0x34/0x11c | exit_to_user_mode_loop+0x124/0x188 | el0_interrupt+0xc8/0xd8 | __el0_irq_handler_common+0x18/0x24 | el0t_64_irq_handler+0x10/0x1c | el0t_64_irq+0x198/0x19c | Code: 54000040 d51b4408 d65f03c0 d503245f (e5bb5800) | ---[ end trace 0000000000000000 ]--- Fix this by having restore_za_context() ensure that the task's sve_state is allocated, matching what we do when taking an SME trap. Any live SVE/SSVE state (which is restored earlier from a separate signal context) must be preserved, and hence this is not zeroed. Fixes: 39782210eb7e ("arm64/sme: Implement ZA signal handling") Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Cc: <stable(a)vger.kernel.org> Cc: Mark Brown <broonie(a)kernel.org> Cc: Will Deacon <will(a)kernel.org> Reviewed-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/arm64/kernel/signal.c [conflict because ce514000da4f ("arm64/sme: Rename za_state to sme_state")] Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- arch/arm64/kernel/signal.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c index a0c85bb01751..d8c9434f975e 100644 --- a/arch/arm64/kernel/signal.c +++ b/arch/arm64/kernel/signal.c @@ -363,6 +363,10 @@ int restore_za_context(struct user_ctxs *user) fpsimd_flush_task_state(current); /* From now, fpsimd_thread_switch() won't touch thread.sve_state */ + sve_alloc(current, false); + if (!current->thread.sve_state) + return -ENOMEM; + sme_alloc(current, true); if (!current->thread.za_state) { current->thread.svcr &= ~SVCR_ZA_MASK; -- 2.34.1

2 1

[PATCH OLK-6.6] x86/CPU/AMD: Add RDSEED fix for Zen5
by Bowen You 06 Feb '26

06 Feb '26

From: Gregory Price <gourry(a)gourry.net> stable inclusion from stable-v6.12.57 commit e980de2ff109dacb6d9d3a77f01b27c467115ecb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11500 CVE: CVE-2025-68313 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 607b9fb2ce248cc5b633c5949e0153838992c152 upstream. There's an issue with RDSEED's 16-bit and 32-bit register output variants on Zen5 which return a random value of 0 "at a rate inconsistent with randomness while incorrectly signaling success (CF=1)". Search the web for AMD-SB-7055 for more detail. Add a fix glue which checks microcode revisions. [ bp: Add microcode revisions checking, rewrite. ] Cc: stable(a)vger.kernel.org Signed-off-by: Gregory Price <gourry(a)gourry.net> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Link: https://lore.kernel.org/r/20251018024010.4112396-1-gourry@gourry.net [ bp: 6.12 backport: use the alternative microcode version checking. ] Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/x86/include/asm/cpu.h [Add the definition of zen_patch_rev] Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/x86/kernel/cpu/amd.c | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c index f89dbe6f48e6..5a46bf0cce5d 100644 --- a/arch/x86/kernel/cpu/amd.c +++ b/arch/x86/kernel/cpu/amd.c @@ -1135,8 +1135,43 @@ static void init_amd_zen4(struct cpuinfo_x86 *c) } } +static bool check_rdseed_microcode(void) +{ + struct cpuinfo_x86 *c = &boot_cpu_data; + union zen_patch_rev p; + u32 min_rev = 0; + + p.ext_fam = c->x86 - 0xf; + p.model = c->x86_model; + p.ext_model = c->x86_model >> 4; + p.stepping = c->x86_stepping; + /* reserved bits are expected to be 0 in test below */ + p.__reserved = 0; + + if (cpu_has(c, X86_FEATURE_ZEN5)) { + switch (p.ucode_rev >> 8) { + case 0xb0021: min_rev = 0xb00215a; break; + case 0xb1010: min_rev = 0xb101054; break; + default: + pr_debug("%s: ucode_rev: 0x%x, current revision: 0x%x\n", + __func__, p.ucode_rev, c->microcode); + return false; + } + } + + if (!min_rev) + return false; + + return c->microcode >= min_rev; +} + static void init_amd_zen5(struct cpuinfo_x86 *c) { + if (!check_rdseed_microcode()) { + clear_cpu_cap(c, X86_FEATURE_RDSEED); + msr_clear_bit(MSR_AMD64_CPUID_FN_7, 18); + pr_emerg_once("RDSEED32 is broken. Disabling the corresponding CPUID bit.\n"); + } } static void init_amd(struct cpuinfo_x86 *c) -- 2.34.1

2 1

[PATCH OLK-5.10] irqchip/gic-v3-its: Avoid truncating memory addresses
by Jinjie Ruan 06 Feb '26

06 Feb '26

From: Arnd Bergmann <arnd(a)arndb.de> stable inclusion from stable-v6.6.122 commit 1b323391560354d8c515de8658b057a1daa82adb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13618 CVE: CVE-2026-23085 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8d76a7d89c12d08382b66e2f21f20d0627d14859 upstream. On 32-bit machines with CONFIG_ARM_LPAE, it is possible for lowmem allocations to be backed by addresses physical memory above the 32-bit address limit, as found while experimenting with larger VMSPLIT configurations. This caused the qemu virt model to crash in the GICv3 driver, which allocates the 'itt' object using GFP_KERNEL. Since all memory below the 4GB physical address limit is in ZONE_DMA in this configuration, kmalloc() defaults to higher addresses for ZONE_NORMAL, and the ITS driver stores the physical address in a 32-bit 'unsigned long' variable. Change the itt_addr variable to the correct phys_addr_t type instead, along with all other variables in this driver that hold a physical address. The gicv5 driver correctly uses u64 variables, while all other irqchip drivers don't call virt_to_phys or similar interfaces. It's expected that other device drivers have similar issues, but fixing this one is sufficient for booting a virtio based guest. Fixes: cc2d3216f53c ("irqchip: GICv3: ITS command queue") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Thomas Gleixner <tglx(a)kernel.org> Reviewed-by: Marc Zyngier <maz(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20260119201603.2713066-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/irqchip/irq-gic-v3-its.c [ conflict becasue 5ddbc909f82a ("[Backport] irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1") not merged. ] Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/irqchip/irq-gic-v3-its.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index fbe83b657dcc..8cac29a0996c 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -954,7 +954,7 @@ static struct its_collection *its_build_mapd_cmd(struct its_node *its, struct its_cmd_block *cmd, struct its_cmd_desc *desc) { - unsigned long itt_addr; + phys_addr_t itt_addr; u8 size = ilog2(desc->its_mapd_cmd.dev->nr_ites); itt_addr = virt_to_phys(desc->its_mapd_cmd.dev->itt); @@ -1184,7 +1184,7 @@ static struct its_vpe *its_build_vmapp_cmd(struct its_node *its, struct its_cmd_block *cmd, struct its_cmd_desc *desc) { - unsigned long vpt_addr, vconf_addr; + phys_addr_t vpt_addr, vconf_addr; u64 target; bool alloc; @@ -2891,10 +2891,10 @@ static int its_setup_baser(struct its_node *its, struct its_baser *baser, baser->psz = psz; tmp = indirect ? GITS_LVL1_ENTRY_SIZE : esz; - pr_info("ITS@%pa: allocated %d %s @%lx (%s, esz %d, psz %dK, shr %d)\n", + pr_info("ITS@%pa: allocated %d %s @%llx (%s, esz %d, psz %dK, shr %d)\n", &its->phys_base, (int)(PAGE_ORDER_TO_SIZE(order) / (int)tmp), its_base_type_string[type], - (unsigned long)virt_to_phys(base), + (u64)virt_to_phys(base), indirect ? "indirect" : "flat", (int)esz, psz / SZ_1K, (int)shr >> GITS_BASER_SHAREABILITY_SHIFT); -- 2.34.1

2 1

[PATCH OLK-6.6] irqchip/gic-v3-its: Avoid truncating memory addresses
by Jinjie Ruan 06 Feb '26

06 Feb '26

From: Arnd Bergmann <arnd(a)arndb.de> stable inclusion from stable-v6.6.122 commit 1b323391560354d8c515de8658b057a1daa82adb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13618 CVE: CVE-2026-23085 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8d76a7d89c12d08382b66e2f21f20d0627d14859 upstream. On 32-bit machines with CONFIG_ARM_LPAE, it is possible for lowmem allocations to be backed by addresses physical memory above the 32-bit address limit, as found while experimenting with larger VMSPLIT configurations. This caused the qemu virt model to crash in the GICv3 driver, which allocates the 'itt' object using GFP_KERNEL. Since all memory below the 4GB physical address limit is in ZONE_DMA in this configuration, kmalloc() defaults to higher addresses for ZONE_NORMAL, and the ITS driver stores the physical address in a 32-bit 'unsigned long' variable. Change the itt_addr variable to the correct phys_addr_t type instead, along with all other variables in this driver that hold a physical address. The gicv5 driver correctly uses u64 variables, while all other irqchip drivers don't call virt_to_phys or similar interfaces. It's expected that other device drivers have similar issues, but fixing this one is sufficient for booting a virtio based guest. Fixes: cc2d3216f53c ("irqchip: GICv3: ITS command queue") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Thomas Gleixner <tglx(a)kernel.org> Reviewed-by: Marc Zyngier <maz(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20260119201603.2713066-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/irqchip/irq-gic-v3-its.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index c8e327f96303..a9802a3870db 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -978,7 +978,7 @@ static struct its_collection *its_build_mapd_cmd(struct its_node *its, struct its_cmd_block *cmd, struct its_cmd_desc *desc) { - unsigned long itt_addr; + phys_addr_t itt_addr; u8 size = ilog2(desc->its_mapd_cmd.dev->nr_ites); itt_addr = virt_to_phys(desc->its_mapd_cmd.dev->itt); @@ -1208,7 +1208,7 @@ static struct its_vpe *its_build_vmapp_cmd(struct its_node *its, struct its_cmd_desc *desc) { struct its_vpe *vpe = valid_vpe(its, desc->its_vmapp_cmd.vpe); - unsigned long vpt_addr, vconf_addr; + phys_addr_t vpt_addr, vconf_addr; u64 target; bool alloc; @@ -2836,10 +2836,10 @@ static int its_setup_baser(struct its_node *its, struct its_baser *baser, baser->psz = psz; tmp = indirect ? GITS_LVL1_ENTRY_SIZE : esz; - pr_info("ITS@%pa: allocated %d %s @%lx (%s, esz %d, psz %dK, shr %d)\n", + pr_info("ITS@%pa: allocated %d %s @%llx (%s, esz %d, psz %dK, shr %d)\n", &its->phys_base, (int)(PAGE_ORDER_TO_SIZE(order) / (int)tmp), its_base_type_string[type], - (unsigned long)virt_to_phys(base), + (u64)virt_to_phys(base), indirect ? "indirect" : "flat", (int)esz, psz / SZ_1K, (int)shr >> GITS_BASER_SHAREABILITY_SHIFT); -- 2.34.1

2 1

[PATCH OLK-6.6 00/10] fix CVE-2024-50102
by Qi Xi 06 Feb '26

06 Feb '26

*** BLURB HERE *** David Gow (1): x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit David Laight (1): x86: fix off-by-one in access_ok() Linus Torvalds (6): runtime constants: deal with old decrepit linkers runtime constants: add x86 architecture support x86: fix whitespace in runtime-const assembler output x86/uaccess: Improve the 8-byte getuser() case x86: fix user address masking non-canonical speculation issue x86: uaccess: don't use runtime-const rewriting in modules Stephen Brennan (1): dcache: keep dentry_hashtable or d_hash_shift even when not used Thomas Gleixner (1): x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() arch/x86/include/asm/runtime-const.h | 65 ++++++++++++++++++++++ arch/x86/include/asm/uaccess_64.h | 49 ++++++++++------- arch/x86/kernel/cpu/common.c | 14 +++++ arch/x86/kernel/vmlinux.lds.S | 4 ++ arch/x86/lib/getuser.S | 80 ++++++++++------------------ fs/dcache.c | 9 +++- include/asm-generic/vmlinux.lds.h | 7 +++ 7 files changed, 157 insertions(+), 71 deletions(-) create mode 100644 arch/x86/include/asm/runtime-const.h -- 2.33.0

2 11

[PATCH OLK-5.10 0/1] CVE-2023-53712
by Liu Mingrui 06 Feb '26

06 Feb '26

From: Mingrui Liu <liumingrui(a)huawei.com> CVE-2023-53712 Mårten Lindahl (1): ARM: 9317/1: kexec: Make smp stop calls asynchronous arch/arm/kernel/machine_kexec.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6 00/17] backport some net bugfix from 6.6 lts
by Zhang Changzhong 06 Feb '26

06 Feb '26

Alexey Simakov (1): sctp: avoid NULL dereference when chunk data buffer is missing Eric Dumazet (2): sctp: initialize more fields in sctp_v6_from_sk() sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto Hans de Goede (1): net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer Ido Schimmel (1): nexthop: Forbid FDB status change while nexthop is in a group Ilya Dryomov (1): libceph: fix potential use-after-free in have_mon_and_osd_map() Kuniyuki Iwashima (3): tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). tipc: Fix use-after-free in tipc_mon_reinit_self(). tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). Paul Chaignon (1): bpf: Explicitly check accesses to bpf_sock_addr Slavin Liu (1): ipvs: Defer ip_vs_ftp unregister during netns cleanup Stefan Wiehler (3): sctp: Hold RCU read lock while iterating over address list sctp: Prevent TOCTOU out-of-bounds write sctp: Hold sock lock while iterating over address list Wang Liang (1): netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm ziming zhang (2): libceph: prevent potential out-of-bounds writes in handle_auth_session_key() libceph: replace BUG_ON with bounds check for map->max_osd net/bridge/br_netfilter_hooks.c | 3 --- net/ceph/auth_x.c | 2 ++ net/ceph/ceph_common.c | 53 +++++++++++++++++++++++++---------------- net/ceph/debugfs.c | 14 +++++++---- net/ceph/osdmap.c | 18 ++++++++------ net/core/filter.c | 16 ++++++++----- net/ipv4/nexthop.c | 7 ++++++ net/ipv4/tcp.c | 5 ++++ net/ipv4/tcp_input.c | 1 - net/netfilter/ipvs/ip_vs_ftp.c | 4 +++- net/rfkill/rfkill-gpio.c | 4 ++-- net/sctp/diag.c | 21 ++++++++++++---- net/sctp/inqueue.c | 13 +++++----- net/sctp/ipv6.c | 2 ++ net/sctp/transport.c | 13 ++++++---- net/tipc/net.c | 2 ++ 16 files changed, 118 insertions(+), 60 deletions(-) -- 2.9.5

2 18