--- /dev/null
+From 704bc361e3a4ead1c0eb40acc255b636b788dc89 Mon Sep 17 00:00:00 2001
+From: Leo Li <sunpeng.li@amd.com>
+Date: Tue, 11 Mar 2025 09:43:38 -0400
+Subject: drm/amd/display: Actually do immediate vblank disable
+
+From: Leo Li <sunpeng.li@amd.com>
+
+commit 704bc361e3a4ead1c0eb40acc255b636b788dc89 upstream.
+
+[Why]
+
+The `vblank_config.offdelay` field follows the same semantics as the
+`drm_vblank_offdelay` parameter. Setting it to 0 will never disable
+vblank.
+
+[How]
+
+Set `offdelay` to a positive number.
+
+Fixes: e45b6716de4b ("drm/amd/display: use a more lax vblank enable policy for DCN35+")
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Leo Li <sunpeng.li@amd.com>
+Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -8473,6 +8473,8 @@ static void manage_dm_interrupts(struct
+
+ config.offdelay_ms = offdelay ?: 30;
+ } else {
++ /* offdelay_ms = 0 will never disable vblank */
++ config.offdelay_ms = 1;
+ config.disable_immediate = true;
+ }
+
--- /dev/null
+From 1c5fdef30ed120613e769a3bd2a144cfd4c688d6 Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <mario.limonciello@amd.com>
+Date: Thu, 27 Mar 2025 14:07:55 -0500
+Subject: drm/amd/display: Add HP Elitebook 645 to the quirk list for eDP on DP1
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+commit 1c5fdef30ed120613e769a3bd2a144cfd4c688d6 upstream.
+
+[Why]
+HP Elitebook 645 has DP0 and DP1 swapped.
+
+[How]
+Add HP Elitebook 645 to DP0/DP1 swap quirk list.
+
+Cc: stable@vger.kernel.org
+Link: https://gitlab.freedesktop.org/drm/amd/-/issues/3701
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Roman Li <roman.li@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -1694,6 +1694,13 @@ static const struct dmi_system_id dmi_qu
+ .callback = edp0_on_dp1_callback,
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "HP"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "HP EliteBook 645 14 inch G11 Notebook PC"),
++ },
++ },
++ {
++ .callback = edp0_on_dp1_callback,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "HP"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP EliteBook 665 16 inch G11 Notebook PC"),
+ },
+ },
--- /dev/null
+From f21e6d149b49c92f9e68aa0c76033e1e13d9f5da Mon Sep 17 00:00:00 2001
+From: Leo Li <sunpeng.li@amd.com>
+Date: Mon, 10 Mar 2025 12:20:39 -0400
+Subject: drm/amd/display: Increase vblank offdelay for PSR panels
+
+From: Leo Li <sunpeng.li@amd.com>
+
+commit f21e6d149b49c92f9e68aa0c76033e1e13d9f5da upstream.
+
+[Why]
+
+Depending on when the HW latching event (vupdate) of double-buffered
+registers happen relative to the PSR SDP (signals panel psr enter/exit)
+deadline, and how bad the Panel clock has drifted since the last ALPM
+off event, there can be up to 3 frames of delay between sending the PSR
+exit cmd to DMUB fw, and when the panel starts displaying live frames.
+This can manifest as micro-stuttering when userspace commit patterns
+cause rapid toggling of the DRM vblank counter, since PSR enter/exit is
+hooked up to DRM vblank disable/enable respectively.
+
+In the ideal world, the panel should present the live frame immediately
+on PSR exit cmd. But due to HW design and PSR limitations, immediate
+exit can only happen by chance, when:
+
+1. PSR exit cmd is ack'd by FW before HW latching (vupdate) event, and
+2. Panel's SDP deadline -- determined by it's PSR Start Delay in DPCD
+ 71h -- is after the vupdate event. The PSR exit SDP can then be sent
+ immediately after HW latches. Otherwise, we have to wait 1 frame. And
+3. There is negligible drift between the panel's clock and source clock.
+ Otherwise, there can be up to 1 frame of drift.
+
+Note that this delay is not expected with Panel Replay.
+
+[How]
+
+Since PSR power savings can be quite substantial, and there are a lot of
+systems in the wild with PSR panels, It'll be nice to have a middle
+ground that balances user experience with power savings.
+
+A simple way to achieve this is by extending the vblank offdelay, such
+that additional PSR exit delays will be less perceivable.
+
+We can set:
+
+ 20/100 * offdelay_ms = 3_frames_ms
+=> offdelay_ms = 5 * 3_frames_ms
+
+This ensures that `3_frames_ms` will only be experienced as a 20% delay
+on top how long the panel has been static, and thus make the delay
+less perceivable.
+
+If this ends up being too high of a percentage, it can be dropped
+further in a future change.
+
+Fixes: 537ef0f88897 ("drm/amd/display: use new vblank enable policy for DCN35+")
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Leo Li <sunpeng.li@amd.com>
+Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 39 ++++++++++++++++++----
+ 1 file changed, 32 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -8458,14 +8458,39 @@ static void manage_dm_interrupts(struct
+ int offdelay;
+
+ if (acrtc_state) {
+- if (amdgpu_ip_version(adev, DCE_HWIP, 0) <
+- IP_VERSION(3, 5, 0) ||
+- acrtc_state->stream->link->psr_settings.psr_version <
+- DC_PSR_VERSION_UNSUPPORTED ||
+- !(adev->flags & AMD_IS_APU)) {
+- timing = &acrtc_state->stream->timing;
++ timing = &acrtc_state->stream->timing;
+
+- /* at least 2 frames */
++ /*
++ * Depending on when the HW latching event of double-buffered
++ * registers happen relative to the PSR SDP deadline, and how
++ * bad the Panel clock has drifted since the last ALPM off
++ * event, there can be up to 3 frames of delay between sending
++ * the PSR exit cmd to DMUB fw, and when the panel starts
++ * displaying live frames.
++ *
++ * We can set:
++ *
++ * 20/100 * offdelay_ms = 3_frames_ms
++ * => offdelay_ms = 5 * 3_frames_ms
++ *
++ * This ensures that `3_frames_ms` will only be experienced as a
++ * 20% delay on top how long the display has been static, and
++ * thus make the delay less perceivable.
++ */
++ if (acrtc_state->stream->link->psr_settings.psr_version <
++ DC_PSR_VERSION_UNSUPPORTED) {
++ offdelay = DIV64_U64_ROUND_UP((u64)5 * 3 * 10 *
++ timing->v_total *
++ timing->h_total,
++ timing->pix_clk_100hz);
++ config.offdelay_ms = offdelay ?: 30;
++ } else if (amdgpu_ip_version(adev, DCE_HWIP, 0) <
++ IP_VERSION(3, 5, 0) ||
++ !(adev->flags & AMD_IS_APU)) {
++ /*
++ * Older HW and DGPU have issues with instant off;
++ * use a 2 frame offdelay.
++ */
+ offdelay = DIV64_U64_ROUND_UP((u64)20 *
+ timing->v_total *
+ timing->h_total,
--- /dev/null
+From 8058061ed9d6bc259d1e678607b07d259342c08f Mon Sep 17 00:00:00 2001
+From: Brendan Tam <Brendan.Tam@amd.com>
+Date: Fri, 14 Mar 2025 13:09:13 -0400
+Subject: drm/amd/display: prevent hang on link training fail
+
+From: Brendan Tam <Brendan.Tam@amd.com>
+
+commit 8058061ed9d6bc259d1e678607b07d259342c08f upstream.
+
+[Why]
+When link training fails, the phy clock will be disabled. However, in
+enable_streams, it is assumed that link training succeeded and the
+mux selects the phy clock, causing a hang when a register write is made.
+
+[How]
+When enable_stream is hit, check if link training failed. If it did, fall
+back to the ref clock to avoid a hang and keep the system in a recoverable
+state.
+
+Reviewed-by: Dillon Varone <dillon.varone@amd.com>
+Signed-off-by: Brendan Tam <Brendan.Tam@amd.com>
+Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 6 +++++-
+ drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 7 +++++--
+ 2 files changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
+@@ -3003,7 +3003,11 @@ void dcn20_enable_stream(struct pipe_ctx
+ dccg->funcs->set_dpstreamclk(dccg, DTBCLK0, tg->inst, dp_hpo_inst);
+
+ phyd32clk = get_phyd32clk_src(link);
+- dccg->funcs->enable_symclk32_se(dccg, dp_hpo_inst, phyd32clk);
++ if (link->cur_link_settings.link_rate == LINK_RATE_UNKNOWN) {
++ dccg->funcs->disable_symclk32_se(dccg, dp_hpo_inst);
++ } else {
++ dccg->funcs->enable_symclk32_se(dccg, dp_hpo_inst, phyd32clk);
++ }
+ } else {
+ if (dccg->funcs->enable_symclk_se)
+ dccg->funcs->enable_symclk_se(dccg, stream_enc->stream_enc_inst,
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+@@ -1001,8 +1001,11 @@ void dcn401_enable_stream(struct pipe_ct
+ if (dc_is_dp_signal(pipe_ctx->stream->signal) || dc_is_virtual_signal(pipe_ctx->stream->signal)) {
+ if (dc->link_srv->dp_is_128b_132b_signal(pipe_ctx)) {
+ dccg->funcs->set_dpstreamclk(dccg, DPREFCLK, tg->inst, dp_hpo_inst);
+-
+- dccg->funcs->enable_symclk32_se(dccg, dp_hpo_inst, phyd32clk);
++ if (link->cur_link_settings.link_rate == LINK_RATE_UNKNOWN) {
++ dccg->funcs->disable_symclk32_se(dccg, dp_hpo_inst);
++ } else {
++ dccg->funcs->enable_symclk32_se(dccg, dp_hpo_inst, phyd32clk);
++ }
+ } else {
+ /* need to set DTBCLK_P source to DPREFCLK for DP8B10B */
+ dccg->funcs->set_dtbclk_p_src(dccg, DPREFCLK, tg->inst);
--- /dev/null
+From 5f054ddead33c1622ea9c0c0aaf07c6843fc7ab0 Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <mario.limonciello@amd.com>
+Date: Wed, 19 Mar 2025 11:58:31 -0500
+Subject: drm/amd: Handle being compiled without SI or CIK support better
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+commit 5f054ddead33c1622ea9c0c0aaf07c6843fc7ab0 upstream.
+
+If compiled without SI or CIK support but amdgpu tries to load it
+will run into failures with uninitialized callbacks.
+
+Show a nicer message in this case and fail probe instead.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4050
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 44 +++++++++++++++++---------------
+ 1 file changed, 24 insertions(+), 20 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -1795,7 +1795,6 @@ static const u16 amdgpu_unsupported_pcii
+ };
+
+ static const struct pci_device_id pciidlist[] = {
+-#ifdef CONFIG_DRM_AMDGPU_SI
+ {0x1002, 0x6780, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI},
+ {0x1002, 0x6784, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI},
+ {0x1002, 0x6788, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI},
+@@ -1868,8 +1867,6 @@ static const struct pci_device_id pciidl
+ {0x1002, 0x6665, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|AMD_IS_MOBILITY},
+ {0x1002, 0x6667, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|AMD_IS_MOBILITY},
+ {0x1002, 0x666F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|AMD_IS_MOBILITY},
+-#endif
+-#ifdef CONFIG_DRM_AMDGPU_CIK
+ /* Kaveri */
+ {0x1002, 0x1304, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KAVERI|AMD_IS_MOBILITY|AMD_IS_APU},
+ {0x1002, 0x1305, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KAVERI|AMD_IS_APU},
+@@ -1952,7 +1949,6 @@ static const struct pci_device_id pciidl
+ {0x1002, 0x985D, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MULLINS|AMD_IS_MOBILITY|AMD_IS_APU},
+ {0x1002, 0x985E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MULLINS|AMD_IS_MOBILITY|AMD_IS_APU},
+ {0x1002, 0x985F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_MULLINS|AMD_IS_MOBILITY|AMD_IS_APU},
+-#endif
+ /* topaz */
+ {0x1002, 0x6900, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TOPAZ},
+ {0x1002, 0x6901, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TOPAZ},
+@@ -2284,14 +2280,14 @@ static int amdgpu_pci_probe(struct pci_d
+ return -ENOTSUPP;
+ }
+
++ switch (flags & AMD_ASIC_MASK) {
++ case CHIP_TAHITI:
++ case CHIP_PITCAIRN:
++ case CHIP_VERDE:
++ case CHIP_OLAND:
++ case CHIP_HAINAN:
+ #ifdef CONFIG_DRM_AMDGPU_SI
+- if (!amdgpu_si_support) {
+- switch (flags & AMD_ASIC_MASK) {
+- case CHIP_TAHITI:
+- case CHIP_PITCAIRN:
+- case CHIP_VERDE:
+- case CHIP_OLAND:
+- case CHIP_HAINAN:
++ if (!amdgpu_si_support) {
+ dev_info(&pdev->dev,
+ "SI support provided by radeon.\n");
+ dev_info(&pdev->dev,
+@@ -2299,16 +2295,18 @@ static int amdgpu_pci_probe(struct pci_d
+ );
+ return -ENODEV;
+ }
+- }
++ break;
++#else
++ dev_info(&pdev->dev, "amdgpu is built without SI support.\n");
++ return -ENODEV;
+ #endif
++ case CHIP_KAVERI:
++ case CHIP_BONAIRE:
++ case CHIP_HAWAII:
++ case CHIP_KABINI:
++ case CHIP_MULLINS:
+ #ifdef CONFIG_DRM_AMDGPU_CIK
+- if (!amdgpu_cik_support) {
+- switch (flags & AMD_ASIC_MASK) {
+- case CHIP_KAVERI:
+- case CHIP_BONAIRE:
+- case CHIP_HAWAII:
+- case CHIP_KABINI:
+- case CHIP_MULLINS:
++ if (!amdgpu_cik_support) {
+ dev_info(&pdev->dev,
+ "CIK support provided by radeon.\n");
+ dev_info(&pdev->dev,
+@@ -2316,8 +2314,14 @@ static int amdgpu_pci_probe(struct pci_d
+ );
+ return -ENODEV;
+ }
+- }
++ break;
++#else
++ dev_info(&pdev->dev, "amdgpu is built without CIK support.\n");
++ return -ENODEV;
+ #endif
++ default:
++ break;
++ }
+
+ adev = devm_drm_dev_alloc(&pdev->dev, &amdgpu_kms_driver, typeof(*adev), ddev);
+ if (IS_ERR(adev))
--- /dev/null
+From 7c246a05df51c52fe0852ce56ba10c41e6ed1f39 Mon Sep 17 00:00:00 2001
+From: Denis Arefev <arefev@swemel.ru>
+Date: Fri, 21 Mar 2025 14:08:16 +0300
+Subject: drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero
+
+From: Denis Arefev <arefev@swemel.ru>
+
+commit 7c246a05df51c52fe0852ce56ba10c41e6ed1f39 upstream.
+
+The user can set any speed value.
+If speed is greater than UINT_MAX/8, division by zero is possible.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: c52dcf49195d ("drm/amd/pp: Avoid divide-by-zero in fan_ctrl_set_fan_speed_rpm")
+Signed-off-by: Denis Arefev <arefev@swemel.ru>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c
++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c
+@@ -267,10 +267,10 @@ int smu7_fan_ctrl_set_fan_speed_rpm(stru
+ if (hwmgr->thermal_controller.fanInfo.bNoFan ||
+ (hwmgr->thermal_controller.fanInfo.
+ ucTachometerPulsesPerRevolution == 0) ||
+- speed == 0 ||
++ (!speed || speed > UINT_MAX/8) ||
+ (speed < hwmgr->thermal_controller.fanInfo.ulMinRPM) ||
+ (speed > hwmgr->thermal_controller.fanInfo.ulMaxRPM))
+- return 0;
++ return -EINVAL;
+
+ if (PP_CAP(PHM_PlatformCaps_MicrocodeFanControl))
+ smu7_fan_ctrl_stop_smc_fan_control(hwmgr);
--- /dev/null
+From 4e3d9508c056d7e0a56b58d5c81253e2a0d22b6c Mon Sep 17 00:00:00 2001
+From: Denis Arefev <arefev@swemel.ru>
+Date: Fri, 21 Mar 2025 13:52:33 +0300
+Subject: drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero
+
+From: Denis Arefev <arefev@swemel.ru>
+
+commit 4e3d9508c056d7e0a56b58d5c81253e2a0d22b6c upstream.
+
+The user can set any speed value.
+If speed is greater than UINT_MAX/8, division by zero is possible.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 031db09017da ("drm/amd/powerplay/vega20: enable fan RPM and pwm settings V2")
+Signed-off-by: Denis Arefev <arefev@swemel.ru>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c
++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c
+@@ -191,7 +191,7 @@ int vega20_fan_ctrl_set_fan_speed_rpm(st
+ uint32_t tach_period, crystal_clock_freq;
+ int result = 0;
+
+- if (!speed)
++ if (!speed || speed > UINT_MAX/8)
+ return -EINVAL;
+
+ if (PP_CAP(PHM_PlatformCaps_MicrocodeFanControl)) {
--- /dev/null
+From 4b8c3c0d17c07f301011e2908fecd2ebdcfe3d1c Mon Sep 17 00:00:00 2001
+From: Denis Arefev <arefev@swemel.ru>
+Date: Fri, 21 Mar 2025 14:08:15 +0300
+Subject: drm/amd/pm/powerplay: Prevent division by zero
+
+From: Denis Arefev <arefev@swemel.ru>
+
+commit 4b8c3c0d17c07f301011e2908fecd2ebdcfe3d1c upstream.
+
+The user can set any speed value.
+If speed is greater than UINT_MAX/8, division by zero is possible.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: c52dcf49195d ("drm/amd/pp: Avoid divide-by-zero in fan_ctrl_set_fan_speed_rpm")
+Signed-off-by: Denis Arefev <arefev@swemel.ru>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_thermal.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_thermal.c
++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_thermal.c
+@@ -307,10 +307,10 @@ int vega10_fan_ctrl_set_fan_speed_rpm(st
+ int result = 0;
+
+ if (hwmgr->thermal_controller.fanInfo.bNoFan ||
+- speed == 0 ||
++ (!speed || speed > UINT_MAX/8) ||
+ (speed < hwmgr->thermal_controller.fanInfo.ulMinRPM) ||
+ (speed > hwmgr->thermal_controller.fanInfo.ulMaxRPM))
+- return -1;
++ return -EINVAL;
+
+ if (PP_CAP(PHM_PlatformCaps_MicrocodeFanControl))
+ result = vega10_fan_ctrl_stop_smc_fan_control(hwmgr);
--- /dev/null
+From 7d641c2b83275d3b0424127b2e0d2d0f7dd82aef Mon Sep 17 00:00:00 2001
+From: Denis Arefev <arefev@swemel.ru>
+Date: Fri, 21 Mar 2025 13:52:32 +0300
+Subject: drm/amd/pm: Prevent division by zero
+
+From: Denis Arefev <arefev@swemel.ru>
+
+commit 7d641c2b83275d3b0424127b2e0d2d0f7dd82aef upstream.
+
+The user can set any speed value.
+If speed is greater than UINT_MAX/8, division by zero is possible.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: b64625a303de ("drm/amd/pm: correct the address of Arcturus fan related registers")
+Signed-off-by: Denis Arefev <arefev@swemel.ru>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
+@@ -1267,6 +1267,9 @@ static int arcturus_set_fan_speed_rpm(st
+ uint32_t crystal_clock_freq = 2500;
+ uint32_t tach_period;
+
++ if (!speed || speed > UINT_MAX/8)
++ return -EINVAL;
++
+ tach_period = 60 * crystal_clock_freq * 10000 / (8 * speed);
+ WREG32_SOC15(THM, 0, mmCG_TACH_CTRL_ARCT,
+ REG_SET_FIELD(RREG32_SOC15(THM, 0, mmCG_TACH_CTRL_ARCT),
--- /dev/null
+From 7ba88b5cccc1a99c1afb96e31e7eedac9907704c Mon Sep 17 00:00:00 2001
+From: Denis Arefev <arefev@swemel.ru>
+Date: Thu, 20 Mar 2025 12:35:02 +0300
+Subject: drm/amd/pm/smu11: Prevent division by zero
+
+From: Denis Arefev <arefev@swemel.ru>
+
+commit 7ba88b5cccc1a99c1afb96e31e7eedac9907704c upstream.
+
+The user can set any speed value.
+If speed is greater than UINT_MAX/8, division by zero is possible.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 1e866f1fe528 ("drm/amd/pm: Prevent divide by zero")
+Signed-off-by: Denis Arefev <arefev@swemel.ru>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit da7dc714a8f8e1c9fc33c57cd63583779a3bef71)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
+@@ -1199,7 +1199,7 @@ int smu_v11_0_set_fan_speed_rpm(struct s
+ uint32_t crystal_clock_freq = 2500;
+ uint32_t tach_period;
+
+- if (speed == 0)
++ if (!speed || speed > UINT_MAX/8)
+ return -EINVAL;
+ /*
+ * To prevent from possible overheat, some ASICs may have requirement
--- /dev/null
+From f23e9116ebb71b63fe9cec0dcac792aa9af30b0c Mon Sep 17 00:00:00 2001
+From: Denis Arefev <arefev@swemel.ru>
+Date: Fri, 21 Mar 2025 13:52:31 +0300
+Subject: drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero
+
+From: Denis Arefev <arefev@swemel.ru>
+
+commit f23e9116ebb71b63fe9cec0dcac792aa9af30b0c upstream.
+
+The user can set any speed value.
+If speed is greater than UINT_MAX/8, division by zero is possible.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: c05d1c401572 ("drm/amd/swsmu: add aldebaran smu13 ip support (v3)")
+Signed-off-by: Denis Arefev <arefev@swemel.ru>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
+@@ -1228,7 +1228,7 @@ int smu_v13_0_set_fan_speed_rpm(struct s
+ uint32_t tach_period;
+ int ret;
+
+- if (!speed)
++ if (!speed || speed > UINT_MAX/8)
+ return -EINVAL;
+
+ ret = smu_v13_0_auto_fan_control(smu, 0);
--- /dev/null
+From 34779e14461cf715238dec5fd43a1e11977ec115 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Thu, 27 Mar 2025 17:46:59 -0400
+Subject: drm/amdgpu/mes12: optimize MES pipe FW version fetching
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 34779e14461cf715238dec5fd43a1e11977ec115 upstream.
+
+Don't fetch it again if we already have it. It seems the
+registers don't reliably have the value at resume in some
+cases.
+
+Fixes: 785f0f9fe742 ("drm/amdgpu: Add mes v12_0 ip block support (v4)")
+Reviewed-by: Shaoyun.liu <Shaoyun.liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 9e7b08d239c2f21e8f417854f81e5ff40edbebff)
+Cc: stable@vger.kernel.org # 6.12.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 21 ++++++++++++---------
+ 1 file changed, 12 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c
+@@ -1225,17 +1225,20 @@ static int mes_v12_0_queue_init(struct a
+ mes_v12_0_queue_init_register(ring);
+ }
+
+- /* get MES scheduler/KIQ versions */
+- mutex_lock(&adev->srbm_mutex);
+- soc21_grbm_select(adev, 3, pipe, 0, 0);
++ if (((pipe == AMDGPU_MES_SCHED_PIPE) && !adev->mes.sched_version) ||
++ ((pipe == AMDGPU_MES_KIQ_PIPE) && !adev->mes.kiq_version)) {
++ /* get MES scheduler/KIQ versions */
++ mutex_lock(&adev->srbm_mutex);
++ soc21_grbm_select(adev, 3, pipe, 0, 0);
+
+- if (pipe == AMDGPU_MES_SCHED_PIPE)
+- adev->mes.sched_version = RREG32_SOC15(GC, 0, regCP_MES_GP3_LO);
+- else if (pipe == AMDGPU_MES_KIQ_PIPE && adev->enable_mes_kiq)
+- adev->mes.kiq_version = RREG32_SOC15(GC, 0, regCP_MES_GP3_LO);
++ if (pipe == AMDGPU_MES_SCHED_PIPE)
++ adev->mes.sched_version = RREG32_SOC15(GC, 0, regCP_MES_GP3_LO);
++ else if (pipe == AMDGPU_MES_KIQ_PIPE && adev->enable_mes_kiq)
++ adev->mes.kiq_version = RREG32_SOC15(GC, 0, regCP_MES_GP3_LO);
+
+- soc21_grbm_select(adev, 0, 0, 0, 0);
+- mutex_unlock(&adev->srbm_mutex);
++ soc21_grbm_select(adev, 0, 0, 0, 0);
++ mutex_unlock(&adev->srbm_mutex);
++ }
+
+ return 0;
+ }
--- /dev/null
+From 27145f78f56a3178c4f9ffe51c4406d8dd0ca90c Mon Sep 17 00:00:00 2001
+From: Lijo Lazar <lijo.lazar@amd.com>
+Date: Tue, 25 Mar 2025 11:42:08 +0530
+Subject: drm/amdgpu: Prefer shadow rom when available
+
+From: Lijo Lazar <lijo.lazar@amd.com>
+
+commit 27145f78f56a3178c4f9ffe51c4406d8dd0ca90c upstream.
+
+Fetch VBIOS from shadow ROM when available before trying other methods
+like EFI method.
+
+Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Fixes: 9c081c11c621 ("drm/amdgpu: Reorder to read EFI exported ROM first")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4066
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 36 ++++++++++++++++++++++++-------
+ 1 file changed, 28 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
+@@ -437,6 +437,13 @@ success:
+ return true;
+ }
+
++static bool amdgpu_prefer_rom_resource(struct amdgpu_device *adev)
++{
++ struct resource *res = &adev->pdev->resource[PCI_ROM_RESOURCE];
++
++ return (res->flags & IORESOURCE_ROM_SHADOW);
++}
++
+ static bool amdgpu_get_bios_dgpu(struct amdgpu_device *adev)
+ {
+ if (amdgpu_atrm_get_bios(adev)) {
+@@ -455,14 +462,27 @@ static bool amdgpu_get_bios_dgpu(struct
+ goto success;
+ }
+
+- if (amdgpu_read_platform_bios(adev)) {
+- dev_info(adev->dev, "Fetched VBIOS from platform\n");
+- goto success;
+- }
+-
+- if (amdgpu_read_bios(adev)) {
+- dev_info(adev->dev, "Fetched VBIOS from ROM BAR\n");
+- goto success;
++ if (amdgpu_prefer_rom_resource(adev)) {
++ if (amdgpu_read_bios(adev)) {
++ dev_info(adev->dev, "Fetched VBIOS from ROM BAR\n");
++ goto success;
++ }
++
++ if (amdgpu_read_platform_bios(adev)) {
++ dev_info(adev->dev, "Fetched VBIOS from platform\n");
++ goto success;
++ }
++
++ } else {
++ if (amdgpu_read_platform_bios(adev)) {
++ dev_info(adev->dev, "Fetched VBIOS from platform\n");
++ goto success;
++ }
++
++ if (amdgpu_read_bios(adev)) {
++ dev_info(adev->dev, "Fetched VBIOS from ROM BAR\n");
++ goto success;
++ }
+ }
+
+ if (amdgpu_read_bios_from_rom(adev)) {
--- /dev/null
+From c28f72c6ca98e039c2aa5aac6752c416bc31dbab Mon Sep 17 00:00:00 2001
+From: Jocelyn Falempe <jfalempe@redhat.com>
+Date: Fri, 24 Jan 2025 15:11:31 +0100
+Subject: drm/ast: Fix ast_dp connection status
+
+From: Jocelyn Falempe <jfalempe@redhat.com>
+
+commit c28f72c6ca98e039c2aa5aac6752c416bc31dbab upstream.
+
+ast_dp_is_connected() used to also check for link training success
+to report the DP connector as connected. Without this check, the
+physical_status is always connected. So if no monitor is present, it
+will fail to read the EDID and set the default resolution to 640x480
+instead of 1024x768.
+
+Signed-off-by: Jocelyn Falempe <jfalempe@redhat.com>
+Fixes: 2281475168d2 ("drm/ast: astdp: Perform link training during atomic_enable")
+Reported-by: Jerry Hoemann <jerry.hoemann@hpe.com>
+Tested-by: Jose Lopez <jose.lopez@hpe.com>
+Cc: Thomas Zimmermann <tzimmermann@suse.de>
+Cc: Dave Airlie <airlied@redhat.com>
+Cc: dri-devel@lists.freedesktop.org
+Cc: <stable@vger.kernel.org> # v6.12+
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250124141142.2434138-1-jfalempe@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/ast/ast_dp.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/drm/ast/ast_dp.c b/drivers/gpu/drm/ast/ast_dp.c
+index 0e282b7b167c..30aad5c0112a 100644
+--- a/drivers/gpu/drm/ast/ast_dp.c
++++ b/drivers/gpu/drm/ast/ast_dp.c
+@@ -17,6 +17,12 @@ static bool ast_astdp_is_connected(struct ast_device *ast)
+ {
+ if (!ast_get_index_reg_mask(ast, AST_IO_VGACRI, 0xDF, AST_IO_VGACRDF_HPD))
+ return false;
++ /*
++ * HPD might be set even if no monitor is connected, so also check that
++ * the link training was successful.
++ */
++ if (!ast_get_index_reg_mask(ast, AST_IO_VGACRI, 0xDC, AST_IO_VGACRDC_LINK_SUCCESS))
++ return false;
+ return true;
+ }
+
+--
+2.49.0
+
--- /dev/null
+From a421f5033c82990d795f8fcd30d5b835f8975508 Mon Sep 17 00:00:00 2001
+From: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
+Date: Fri, 4 Apr 2025 13:35:40 +0530
+Subject: drm/i915/vrr: Add vrr.vsync_{start, end} in vrr_params_changed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
+
+commit a421f5033c82990d795f8fcd30d5b835f8975508 upstream.
+
+Add the missing vrr parameters in vrr_params_changed() helper.
+This ensures that changes in vrr.vsync_{start,end} trigger a call to
+appropriate helpers to update the VRR registers.
+
+Fixes: e8cd188e91bb ("drm/i915/display: Compute vrr_vsync params")
+Cc: Mitul Golani <mitulkumar.ajitkumar.golani@intel.com>
+Cc: Arun R Murthy <arun.r.murthy@intel.com>
+Cc: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: <stable@vger.kernel.org> # v6.10+
+Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://lore.kernel.org/r/20250404080540.2059511-1-ankit.k.nautiyal@intel.com
+(cherry picked from commit ced5e64f011cb5cd541988442997ceaa7385827e)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_display.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_display.c
++++ b/drivers/gpu/drm/i915/display/intel_display.c
+@@ -1006,7 +1006,9 @@ static bool vrr_params_changed(const str
+ old_crtc_state->vrr.vmin != new_crtc_state->vrr.vmin ||
+ old_crtc_state->vrr.vmax != new_crtc_state->vrr.vmax ||
+ old_crtc_state->vrr.guardband != new_crtc_state->vrr.guardband ||
+- old_crtc_state->vrr.pipeline_full != new_crtc_state->vrr.pipeline_full;
++ old_crtc_state->vrr.pipeline_full != new_crtc_state->vrr.pipeline_full ||
++ old_crtc_state->vrr.vsync_start != new_crtc_state->vrr.vsync_start ||
++ old_crtc_state->vrr.vsync_end != new_crtc_state->vrr.vsync_end;
+ }
+
+ static bool cmrr_params_changed(const struct intel_crtc_state *old_crtc_state,
--- /dev/null
+From f561db72a663f8a73c2250bf3244ce1ce221bed7 Mon Sep 17 00:00:00 2001
+From: Akhil P Oommen <quic_akhilpo@quicinc.com>
+Date: Wed, 26 Feb 2025 01:22:14 +0530
+Subject: drm/msm/a6xx: Fix stale rpmh votes from GPU
+
+From: Akhil P Oommen <quic_akhilpo@quicinc.com>
+
+commit f561db72a663f8a73c2250bf3244ce1ce221bed7 upstream.
+
+It was observed on sc7180 (A618 gpu) that GPU votes for GX rail and CNOC
+BCM nodes were not removed after GPU suspend. This was because we
+skipped sending 'prepare-slumber' request to gmu during suspend sequence
+in some cases. So, make sure we always call prepare-slumber hfi during
+suspend. Also, calling prepare-slumber without a prior oob-gpu handshake
+messes up gmu firmware's internal state. So, do that when required.
+
+Fixes: 4b565ca5a2cb ("drm/msm: Add A6XX device support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Akhil P Oommen <quic_akhilpo@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/639569/
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 82 ++++++++++++++++++----------------
+ 1 file changed, 44 insertions(+), 38 deletions(-)
+
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+@@ -1126,50 +1126,51 @@ static void a6xx_gmu_shutdown(struct a6x
+ struct a6xx_gpu *a6xx_gpu = container_of(gmu, struct a6xx_gpu, gmu);
+ struct adreno_gpu *adreno_gpu = &a6xx_gpu->base;
+ u32 val;
++ int ret;
+
+ /*
+- * The GMU may still be in slumber unless the GPU started so check and
+- * skip putting it back into slumber if so
++ * GMU firmware's internal power state gets messed up if we send "prepare_slumber" hfi when
++ * oob_gpu handshake wasn't done after the last wake up. So do a dummy handshake here when
++ * required
+ */
+- val = gmu_read(gmu, REG_A6XX_GPU_GMU_CX_GMU_RPMH_POWER_STATE);
++ if (adreno_gpu->base.needs_hw_init) {
++ if (a6xx_gmu_set_oob(&a6xx_gpu->gmu, GMU_OOB_GPU_SET))
++ goto force_off;
+
+- if (val != 0xf) {
+- int ret = a6xx_gmu_wait_for_idle(gmu);
+-
+- /* If the GMU isn't responding assume it is hung */
+- if (ret) {
+- a6xx_gmu_force_off(gmu);
+- return;
+- }
+-
+- a6xx_bus_clear_pending_transactions(adreno_gpu, a6xx_gpu->hung);
+-
+- /* tell the GMU we want to slumber */
+- ret = a6xx_gmu_notify_slumber(gmu);
+- if (ret) {
+- a6xx_gmu_force_off(gmu);
+- return;
+- }
+-
+- ret = gmu_poll_timeout(gmu,
+- REG_A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS, val,
+- !(val & A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS_GPUBUSYIGNAHB),
+- 100, 10000);
+-
+- /*
+- * Let the user know we failed to slumber but don't worry too
+- * much because we are powering down anyway
+- */
+-
+- if (ret)
+- DRM_DEV_ERROR(gmu->dev,
+- "Unable to slumber GMU: status = 0%x/0%x\n",
+- gmu_read(gmu,
+- REG_A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS),
+- gmu_read(gmu,
+- REG_A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS2));
++ a6xx_gmu_clear_oob(&a6xx_gpu->gmu, GMU_OOB_GPU_SET);
+ }
+
++ ret = a6xx_gmu_wait_for_idle(gmu);
++
++ /* If the GMU isn't responding assume it is hung */
++ if (ret)
++ goto force_off;
++
++ a6xx_bus_clear_pending_transactions(adreno_gpu, a6xx_gpu->hung);
++
++ /* tell the GMU we want to slumber */
++ ret = a6xx_gmu_notify_slumber(gmu);
++ if (ret)
++ goto force_off;
++
++ ret = gmu_poll_timeout(gmu,
++ REG_A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS, val,
++ !(val & A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS_GPUBUSYIGNAHB),
++ 100, 10000);
++
++ /*
++ * Let the user know we failed to slumber but don't worry too
++ * much because we are powering down anyway
++ */
++
++ if (ret)
++ DRM_DEV_ERROR(gmu->dev,
++ "Unable to slumber GMU: status = 0%x/0%x\n",
++ gmu_read(gmu,
++ REG_A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS),
++ gmu_read(gmu,
++ REG_A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS2));
++
+ /* Turn off HFI */
+ a6xx_hfi_stop(gmu);
+
+@@ -1178,6 +1179,11 @@ static void a6xx_gmu_shutdown(struct a6x
+
+ /* Tell RPMh to power off the GPU */
+ a6xx_rpmh_stop(gmu);
++
++ return;
++
++force_off:
++ a6xx_gmu_force_off(gmu);
+ }
+
+
--- /dev/null
+From 52b3f0e118b1700e5c60ff676a1f522ce44fadc8 Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <haoxiang_li2024@163.com>
+Date: Wed, 19 Feb 2025 12:07:12 +0800
+Subject: drm/msm/dsi: Add check for devm_kstrdup()
+
+From: Haoxiang Li <haoxiang_li2024@163.com>
+
+commit 52b3f0e118b1700e5c60ff676a1f522ce44fadc8 upstream.
+
+Add check for the return value of devm_kstrdup() in
+dsi_host_parse_dt() to catch potential exception.
+
+Fixes: 958d8d99ccb3 ("drm/msm/dsi: parse vsync source from device tree")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/638297/
+Link: https://lore.kernel.org/r/20250219040712.2598161-1-haoxiang_li2024@163.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/dsi/dsi_host.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
+@@ -1827,8 +1827,15 @@ static int dsi_host_parse_dt(struct msm_
+ __func__, ret);
+ goto err;
+ }
+- if (!ret)
++ if (!ret) {
+ msm_dsi->te_source = devm_kstrdup(dev, te_source, GFP_KERNEL);
++ if (!msm_dsi->te_source) {
++ DRM_DEV_ERROR(dev, "%s: failed to allocate te_source\n",
++ __func__);
++ ret = -ENOMEM;
++ goto err;
++ }
++ }
+ ret = 0;
+
+ if (of_property_read_bool(np, "syscon-sfpb")) {
--- /dev/null
+From 4d098000ac193f359e6b8ca4801dbdbd6a27b41f Mon Sep 17 00:00:00 2001
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Date: Thu, 16 Jan 2025 05:48:01 -0800
+Subject: drm/repaper: fix integer overflows in repeat functions
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+commit 4d098000ac193f359e6b8ca4801dbdbd6a27b41f upstream.
+
+There are conditions, albeit somewhat unlikely, under which right hand
+expressions, calculating the end of time period in functions like
+repaper_frame_fixed_repeat(), may overflow.
+
+For instance, if 'factor10x' in repaper_get_temperature() is high
+enough (170), as is 'epd->stage_time' in repaper_probe(), then the
+resulting value of 'end' will not fit in unsigned int expression.
+
+Mitigate this by casting 'epd->factored_stage_time' to wider type before
+any multiplication is done.
+
+Found by Linux Verification Center (linuxtesting.org) with static
+analysis tool SVACE.
+
+Fixes: 3589211e9b03 ("drm/tinydrm: Add RePaper e-ink driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Signed-off-by: Alex Lanzano <lanzano.alex@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250116134801.22067-1-n.zhandarovich@fintech.ru
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/tiny/repaper.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/tiny/repaper.c
++++ b/drivers/gpu/drm/tiny/repaper.c
+@@ -455,7 +455,7 @@ static void repaper_frame_fixed_repeat(s
+ enum repaper_stage stage)
+ {
+ u64 start = local_clock();
+- u64 end = start + (epd->factored_stage_time * 1000 * 1000);
++ u64 end = start + ((u64)epd->factored_stage_time * 1000 * 1000);
+
+ do {
+ repaper_frame_fixed(epd, fixed_value, stage);
+@@ -466,7 +466,7 @@ static void repaper_frame_data_repeat(st
+ const u8 *mask, enum repaper_stage stage)
+ {
+ u64 start = local_clock();
+- u64 end = start + (epd->factored_stage_time * 1000 * 1000);
++ u64 end = start + ((u64)epd->factored_stage_time * 1000 * 1000);
+
+ do {
+ repaper_frame_data(epd, image, mask, stage);
--- /dev/null
+From 20659d3150f1a2a258a173fe011013178ff2a197 Mon Sep 17 00:00:00 2001
+From: Matthew Brost <matthew.brost@intel.com>
+Date: Tue, 11 Mar 2025 11:29:15 -0700
+Subject: drm/xe: Use local fence in error path of xe_migrate_clear
+
+From: Matthew Brost <matthew.brost@intel.com>
+
+commit 20659d3150f1a2a258a173fe011013178ff2a197 upstream.
+
+The intent of the error path in xe_migrate_clear is to wait on locally
+generated fence and then return. The code is waiting on m->fence which
+could be the local fence but this is only stable under the job mutex
+leading to a possible UAF. Fix code to wait on local fence.
+
+Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
+Cc: stable@vger.kernel.org
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Matthew Auld <matthew.auld@intel.com>
+Link: https://lore.kernel.org/r/20250311182915.3606291-1-matthew.brost@intel.com
+(cherry picked from commit 762b7e95362170b3e13a8704f38d5e47eca4ba74)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/xe_migrate.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/xe/xe_migrate.c
++++ b/drivers/gpu/drm/xe/xe_migrate.c
+@@ -1177,7 +1177,7 @@ err:
+ err_sync:
+ /* Sync partial copies if any. FIXME: job_mutex? */
+ if (fence) {
+- dma_fence_wait(m->fence, false);
++ dma_fence_wait(fence, false);
+ dma_fence_put(fence);
+ }
+
perf-x86-intel-uncore-fix-the-scale-of-iio-free-running-counters-on-snr.patch
perf-x86-intel-uncore-fix-the-scale-of-iio-free-running-counters-on-icx.patch
perf-x86-intel-uncore-fix-the-scale-of-iio-free-running-counters-on-spr.patch
+drm-repaper-fix-integer-overflows-in-repeat-functions.patch
+drm-ast-fix-ast_dp-connection-status.patch
+drm-msm-dsi-add-check-for-devm_kstrdup.patch
+drm-msm-a6xx-fix-stale-rpmh-votes-from-gpu.patch
+drm-amdgpu-prefer-shadow-rom-when-available.patch
+drm-amd-display-prevent-hang-on-link-training-fail.patch
+drm-amd-handle-being-compiled-without-si-or-cik-support-better.patch
+drm-amd-display-actually-do-immediate-vblank-disable.patch
+drm-amd-display-increase-vblank-offdelay-for-psr-panels.patch
+drm-amd-pm-prevent-division-by-zero.patch
+drm-amd-pm-powerplay-prevent-division-by-zero.patch
+drm-amd-pm-smu11-prevent-division-by-zero.patch
+drm-amd-pm-powerplay-hwmgr-smu7_thermal-prevent-division-by-zero.patch
+drm-amd-pm-swsmu-smu13-smu_v13_0-prevent-division-by-zero.patch
+drm-amd-pm-powerplay-hwmgr-vega20_thermal-prevent-division-by-zero.patch
+drm-amdgpu-mes12-optimize-mes-pipe-fw-version-fetching.patch
+drm-i915-vrr-add-vrr.vsync_-start-end-in-vrr_params_changed.patch
+drm-xe-use-local-fence-in-error-path-of-xe_migrate_clear.patch
+drm-amd-display-add-hp-elitebook-645-to-the-quirk-list-for-edp-on-dp1.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
