--- /dev/null
+From 8e0d1edb5c16732b695eaf4bd7096b1569817cf0 Mon Sep 17 00:00:00 2001
+From: Yang Wang <kevinyang.wang@amd.com>
+Date: Thu, 24 Jul 2025 15:16:18 +0800
+Subject: drm/amd/amdgpu: fix missing lock for cper.ring->rptr/wptr access
+
+From: Yang Wang <kevinyang.wang@amd.com>
+
+commit 8e0d1edb5c16732b695eaf4bd7096b1569817cf0 upstream.
+
+Add lock protection for 'ring->wptr'/'ring->rptr' to ensure the correct execution.
+
+Fixes: 8652920d2c00 ("drm/amdgpu: add mutex lock for cper ring")
+Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
+Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_cper.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cper.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cper.c
+index 15dde1f50328..25252231a68a 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cper.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cper.c
+@@ -459,7 +459,7 @@ static u32 amdgpu_cper_ring_get_ent_sz(struct amdgpu_ring *ring, u64 pos)
+
+ void amdgpu_cper_ring_write(struct amdgpu_ring *ring, void *src, int count)
+ {
+- u64 pos, wptr_old, rptr = *ring->rptr_cpu_addr & ring->ptr_mask;
++ u64 pos, wptr_old, rptr;
+ int rec_cnt_dw = count >> 2;
+ u32 chunk, ent_sz;
+ u8 *s = (u8 *)src;
+@@ -472,9 +472,11 @@ void amdgpu_cper_ring_write(struct amdgpu_ring *ring, void *src, int count)
+ return;
+ }
+
+- wptr_old = ring->wptr;
+-
+ mutex_lock(&ring->adev->cper.ring_lock);
++
++ wptr_old = ring->wptr;
++ rptr = *ring->rptr_cpu_addr & ring->ptr_mask;
++
+ while (count) {
+ ent_sz = amdgpu_cper_ring_get_ent_sz(ring, ring->wptr);
+ chunk = umin(ent_sz, count);
+--
+2.50.1
+
--- /dev/null
+From 3477c1b0972dc1c8a46f78e8fb1fa6966095b5ec Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <mdaenzer@redhat.com>
+Date: Wed, 30 Jul 2025 10:09:02 +0200
+Subject: drm/amd/display: Add primary plane to commits for correct VRR handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michel Dänzer <mdaenzer@redhat.com>
+
+commit 3477c1b0972dc1c8a46f78e8fb1fa6966095b5ec upstream.
+
+amdgpu_dm_commit_planes calls update_freesync_state_on_stream only for
+the primary plane. If a commit affects a CRTC but not its primary plane,
+it would previously not trigger a refresh cycle or affect LFC, violating
+current UAPI semantics.
+
+Fixes e.g. atomic commits affecting only the cursor plane being limited
+to the minimum refresh rate.
+
+Don't do this for the legacy cursor ioctls though, it would break the
+UAPI semantics for those.
+
+Suggested-by: Xaver Hugl <xaver.hugl@kde.org>
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3034
+Signed-off-by: Michel Dänzer <mdaenzer@redhat.com>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit cc7bfba95966251b254cb970c21627124da3b7f4)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
+@@ -661,6 +661,15 @@ static int amdgpu_dm_crtc_helper_atomic_
+ return -EINVAL;
+ }
+
++ if (!state->legacy_cursor_update && amdgpu_dm_crtc_vrr_active(dm_crtc_state)) {
++ struct drm_plane_state *primary_state;
++
++ /* Pull in primary plane for correct VRR handling */
++ primary_state = drm_atomic_get_plane_state(state, crtc->primary);
++ if (IS_ERR(primary_state))
++ return PTR_ERR(primary_state);
++ }
++
+ /* In some use cases, like reset, no stream is attached */
+ if (!dm_crtc_state->stream)
+ return 0;
--- /dev/null
+From 4db9cd554883e051df1840d4d58d636043101034 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Timur=20Krist=C3=B3f?= <timur.kristof@gmail.com>
+Date: Tue, 22 Jul 2025 17:58:29 +0200
+Subject: drm/amd/display: Don't overwrite dce60_clk_mgr
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+commit 4db9cd554883e051df1840d4d58d636043101034 upstream.
+
+dc_clk_mgr_create accidentally overwrites the dce60_clk_mgr
+with the dce_clk_mgr, causing incorrect behaviour on DCE6.
+Fix it by removing the extra dce_clk_mgr_construct.
+
+Fixes: 62eab49faae7 ("drm/amd/display: hide VGH asic specific structs")
+Reviewed-by: Rodrigo Siqueira <siqueira@igalia.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit bbddcbe36a686af03e91341b9bbfcca94bd45fb6)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c
+@@ -158,7 +158,6 @@ struct clk_mgr *dc_clk_mgr_create(struct
+ return NULL;
+ }
+ dce60_clk_mgr_construct(ctx, clk_mgr);
+- dce_clk_mgr_construct(ctx, clk_mgr);
+ return &clk_mgr->base;
+ }
+ #endif
--- /dev/null
+From 1bcf63a44381691d6192872801f830ce3250e367 Mon Sep 17 00:00:00 2001
+From: Siyang Liu <Security@tencent.com>
+Date: Fri, 4 Jul 2025 11:16:22 +0800
+Subject: drm/amd/display: fix a Null pointer dereference vulnerability
+
+From: Siyang Liu <Security@tencent.com>
+
+commit 1bcf63a44381691d6192872801f830ce3250e367 upstream.
+
+[Why]
+A null pointer dereference vulnerability exists in the AMD display driver's
+(DC module) cleanup function dc_destruct().
+When display control context (dc->ctx) construction fails
+(due to memory allocation failure), this pointer remains NULL.
+During subsequent error handling when dc_destruct() is called,
+there's no NULL check before dereferencing the perf_trace member
+(dc->ctx->perf_trace), causing a kernel null pointer dereference crash.
+
+[How]
+Check if dc->ctx is non-NULL before dereferencing.
+
+Link: https://lore.kernel.org/r/tencent_54FF4252EDFB6533090A491A25EEF3EDBF06@qq.com
+Co-developed-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+(Updated commit text and removed unnecessary error message)
+Signed-off-by: Siyang Liu <Security@tencent.com>
+Signed-off-by: Roman Li <roman.li@amd.com>
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 9dd8e2ba268c636c240a918e0a31e6feaee19404)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -938,17 +938,18 @@ static void dc_destruct(struct dc *dc)
+ if (dc->link_srv)
+ link_destroy_link_service(&dc->link_srv);
+
+- if (dc->ctx->gpio_service)
+- dal_gpio_service_destroy(&dc->ctx->gpio_service);
++ if (dc->ctx) {
++ if (dc->ctx->gpio_service)
++ dal_gpio_service_destroy(&dc->ctx->gpio_service);
+
+- if (dc->ctx->created_bios)
+- dal_bios_parser_destroy(&dc->ctx->dc_bios);
++ if (dc->ctx->created_bios)
++ dal_bios_parser_destroy(&dc->ctx->dc_bios);
++ kfree(dc->ctx->logger);
++ dc_perf_trace_destroy(&dc->ctx->perf_trace);
+
+- kfree(dc->ctx->logger);
+- dc_perf_trace_destroy(&dc->ctx->perf_trace);
+-
+- kfree(dc->ctx);
+- dc->ctx = NULL;
++ kfree(dc->ctx);
++ dc->ctx = NULL;
++ }
+
+ kfree(dc->bw_vbios);
+ dc->bw_vbios = NULL;
--- /dev/null
+From 1c8dc3e088e09531bcdfc9fe348204abc3decb6c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Timur=20Krist=C3=B3f?= <timur.kristof@gmail.com>
+Date: Tue, 22 Jul 2025 17:58:30 +0200
+Subject: drm/amd/display: Fix DCE 6.0 and 6.4 PLL programming.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+commit 1c8dc3e088e09531bcdfc9fe348204abc3decb6c upstream.
+
+Apparently, both DCE 6.0 and 6.4 have 3 PLLs, but PLL0 can only
+be used for DP. Make sure to initialize the correct amount of PLLs
+in DC for these DCE versions and use PLL0 only for DP.
+
+Also, on DCE 6.0 and 6.4, the PLL0 needs to be powered on at
+initialization as opposed to DCE 6.1 and 7.x which use a different
+clock source for DFS.
+
+The following functions were used as reference from the old
+radeon driver implementation of DCE 6.x:
+- radeon_atom_pick_pll
+- atombios_crtc_set_disp_eng_pll
+
+Reviewed-by: Rodrigo Siqueira <siqueira@igalia.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 35222b5934ec8d762473592ece98659baf6bc48e)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/clk_mgr/dce100/dce_clk_mgr.c | 5 +
+ drivers/gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c | 34 +++++-----
+ 2 files changed, 25 insertions(+), 14 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dce100/dce_clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dce100/dce_clk_mgr.c
+@@ -245,6 +245,11 @@ int dce_set_clock(
+ pxl_clk_params.target_pixel_clock_100hz = requested_clk_khz * 10;
+ pxl_clk_params.pll_id = CLOCK_SOURCE_ID_DFS;
+
++ /* DCE 6.0, DCE 6.4: engine clock is the same as PLL0 */
++ if (clk_mgr_base->ctx->dce_version == DCE_VERSION_6_0 ||
++ clk_mgr_base->ctx->dce_version == DCE_VERSION_6_4)
++ pxl_clk_params.pll_id = CLOCK_SOURCE_ID_PLL0;
++
+ if (clk_mgr_dce->dfs_bypass_active)
+ pxl_clk_params.flags.SET_DISPCLK_DFS_BYPASS = true;
+
+--- a/drivers/gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c
+@@ -373,7 +373,7 @@ static const struct resource_caps res_ca
+ .num_timing_generator = 6,
+ .num_audio = 6,
+ .num_stream_encoder = 6,
+- .num_pll = 2,
++ .num_pll = 3,
+ .num_ddc = 6,
+ };
+
+@@ -389,7 +389,7 @@ static const struct resource_caps res_ca
+ .num_timing_generator = 2,
+ .num_audio = 2,
+ .num_stream_encoder = 2,
+- .num_pll = 2,
++ .num_pll = 3,
+ .num_ddc = 2,
+ };
+
+@@ -973,21 +973,24 @@ static bool dce60_construct(
+
+ if (bp->fw_info_valid && bp->fw_info.external_clock_source_frequency_for_dp != 0) {
+ pool->base.dp_clock_source =
+- dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_EXTERNAL, NULL, true);
++ dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_EXTERNAL, NULL, true);
+
++ /* DCE 6.0 and 6.4: PLL0 can only be used with DP. Don't initialize it here. */
+ pool->base.clock_sources[0] =
+- dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL0, &clk_src_regs[0], false);
++ dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL1, &clk_src_regs[1], false);
+ pool->base.clock_sources[1] =
+- dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL1, &clk_src_regs[1], false);
++ dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL2, &clk_src_regs[2], false);
+ pool->base.clk_src_count = 2;
+
+ } else {
+ pool->base.dp_clock_source =
+- dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL0, &clk_src_regs[0], true);
++ dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL0, &clk_src_regs[0], true);
+
+ pool->base.clock_sources[0] =
+- dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL1, &clk_src_regs[1], false);
+- pool->base.clk_src_count = 1;
++ dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL1, &clk_src_regs[1], false);
++ pool->base.clock_sources[1] =
++ dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL2, &clk_src_regs[2], false);
++ pool->base.clk_src_count = 2;
+ }
+
+ if (pool->base.dp_clock_source == NULL) {
+@@ -1365,21 +1368,24 @@ static bool dce64_construct(
+
+ if (bp->fw_info_valid && bp->fw_info.external_clock_source_frequency_for_dp != 0) {
+ pool->base.dp_clock_source =
+- dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_EXTERNAL, NULL, true);
++ dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_EXTERNAL, NULL, true);
+
++ /* DCE 6.0 and 6.4: PLL0 can only be used with DP. Don't initialize it here. */
+ pool->base.clock_sources[0] =
+- dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL1, &clk_src_regs[0], false);
++ dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL1, &clk_src_regs[1], false);
+ pool->base.clock_sources[1] =
+- dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL2, &clk_src_regs[1], false);
++ dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL2, &clk_src_regs[2], false);
+ pool->base.clk_src_count = 2;
+
+ } else {
+ pool->base.dp_clock_source =
+- dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL1, &clk_src_regs[0], true);
++ dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL0, &clk_src_regs[0], true);
+
+ pool->base.clock_sources[0] =
+- dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL2, &clk_src_regs[1], false);
+- pool->base.clk_src_count = 1;
++ dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL1, &clk_src_regs[1], false);
++ pool->base.clock_sources[1] =
++ dce60_clock_source_create(ctx, bp, CLOCK_SOURCE_ID_PLL2, &clk_src_regs[2], false);
++ pool->base.clk_src_count = 2;
+ }
+
+ if (pool->base.dp_clock_source == NULL) {
--- /dev/null
+From 9c2883057b3c861879b647f34e8bc448954e8729 Mon Sep 17 00:00:00 2001
+From: Lauri Tirkkonen <lauri@hacktheplanet.fi>
+Date: Mon, 21 Jul 2025 09:59:40 +0900
+Subject: drm/amd/display: fix initial backlight brightness calculation
+
+From: Lauri Tirkkonen <lauri@hacktheplanet.fi>
+
+commit 9c2883057b3c861879b647f34e8bc448954e8729 upstream.
+
+DIV_ROUND_CLOSEST(x, 100) returns either 0 or 1 if 0<x<=100, so the
+division needs to be performed after the multiplication and not the
+other way around, to properly scale the value.
+
+Fixes: 8b5f3a229a70 ("drm/amd/display: Fix default DC and AC levels")
+Signed-off-by: Lauri Tirkkonen <lauri@hacktheplanet.fi>
+Cc: stable@vger.kernel.org
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://lore.kernel.org/r/aH2Q_HJvxKbW74vU@hacktheplanet.fi
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -4952,9 +4952,9 @@ amdgpu_dm_register_backlight_device(stru
+ caps = &dm->backlight_caps[aconnector->bl_idx];
+ if (get_brightness_range(caps, &min, &max)) {
+ if (power_supply_is_system_supplied() > 0)
+- props.brightness = (max - min) * DIV_ROUND_CLOSEST(caps->ac_level, 100);
++ props.brightness = DIV_ROUND_CLOSEST((max - min) * caps->ac_level, 100);
+ else
+- props.brightness = (max - min) * DIV_ROUND_CLOSEST(caps->dc_level, 100);
++ props.brightness = DIV_ROUND_CLOSEST((max - min) * caps->dc_level, 100);
+ /* min is zero, so max needs to be adjusted */
+ props.max_brightness = max - min;
+ drm_dbg(drm, "Backlight caps: min: %d, max: %d, ac %d, dc %d\n", min, max,
--- /dev/null
+From 2b6943df54136f40aff8a6d7ba7c26724d89a0bd Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <mario.limonciello@amd.com>
+Date: Thu, 15 May 2025 15:16:17 -0500
+Subject: drm/amd/display: Pass up errors for reset GPU that fails to init HW
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+commit 2b6943df54136f40aff8a6d7ba7c26724d89a0bd upstream.
+
+[Why]
+If a GPU is in reset and the hardware fails to initialize the rest of the
+resume sequence shouldn't be run.
+
+[How]
+Pass error code up to caller of dm_resume().
+
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -3343,8 +3343,10 @@ static int dm_resume(struct amdgpu_ip_bl
+ link_enc_cfg_copy(adev->dm.dc->current_state, dc_state);
+
+ r = dm_dmub_hw_init(adev);
+- if (r)
++ if (r) {
+ drm_err(adev_to_drm(adev), "DMUB interface failed to initialize: status=%d\n", r);
++ return r;
++ }
+
+ dc_dmub_srv_set_power_state(dm->dc->ctx->dmub_srv, DC_ACPI_CM_POWER_STATE_D0);
+ dc_set_power_state(dm->dc, DC_ACPI_CM_POWER_STATE_D0);
--- /dev/null
+From 8e6a18cbf3ee2c1e3d0afd8d3debd0ba8738ad0c Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <mario.limonciello@amd.com>
+Date: Sun, 20 Jul 2025 23:39:41 -0500
+Subject: drm/amd/display: Revert "drm/amd/display: Fix AMDGPU_MAX_BL_LEVEL value"
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+commit 8e6a18cbf3ee2c1e3d0afd8d3debd0ba8738ad0c upstream.
+
+This reverts commit 66abb996999de0d440a02583a6e70c2c24deab45.
+This broke custom brightness curves but it wasn't obvious because
+of other related changes. Custom brightness curves are always
+from a 0-255 input signal. The correct fix was to fix the default
+value which was done by [1].
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4412
+Link: https://lore.kernel.org/amd-gfx/0f094c4b-d2a3-42cd-824c-dc2858a5618d@kernel.org/T/#m69f875a7e69aa22df3370b3e3a9e69f4a61fdaf2
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Roman Li <roman.li@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 6ec8a5cbec751625133461600d0d4950ffd3a214)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -4733,16 +4733,16 @@ static int get_brightness_range(const st
+ return 1;
+ }
+
+-/* Rescale from [min..max] to [0..MAX_BACKLIGHT_LEVEL] */
++/* Rescale from [min..max] to [0..AMDGPU_MAX_BL_LEVEL] */
+ static inline u32 scale_input_to_fw(int min, int max, u64 input)
+ {
+- return DIV_ROUND_CLOSEST_ULL(input * MAX_BACKLIGHT_LEVEL, max - min);
++ return DIV_ROUND_CLOSEST_ULL(input * AMDGPU_MAX_BL_LEVEL, max - min);
+ }
+
+-/* Rescale from [0..MAX_BACKLIGHT_LEVEL] to [min..max] */
++/* Rescale from [0..AMDGPU_MAX_BL_LEVEL] to [min..max] */
+ static inline u32 scale_fw_to_input(int min, int max, u64 input)
+ {
+- return min + DIV_ROUND_CLOSEST_ULL(input * (max - min), MAX_BACKLIGHT_LEVEL);
++ return min + DIV_ROUND_CLOSEST_ULL(input * (max - min), AMDGPU_MAX_BL_LEVEL);
+ }
+
+ static void convert_custom_brightness(const struct amdgpu_dm_backlight_caps *caps,
--- /dev/null
+From ed4efe426a49729952b3dc05d20e33b94409bdd1 Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <mario.limonciello@amd.com>
+Date: Thu, 24 Jul 2025 22:12:21 -0500
+Subject: drm/amd: Restore cached power limit during resume
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+commit ed4efe426a49729952b3dc05d20e33b94409bdd1 upstream.
+
+The power limit will be cached in smu->current_power_limit but
+if the ASIC goes into S3 this value won't be restored.
+
+Restore the value during SMU resume.
+
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Link: https://lore.kernel.org/r/20250725031222.3015095-2-superm1@kernel.org
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 26a609e053a6fc494403e95403bc6a2470383bec)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+@@ -2175,6 +2175,12 @@ static int smu_resume(struct amdgpu_ip_b
+
+ adev->pm.dpm_enabled = true;
+
++ if (smu->current_power_limit) {
++ ret = smu_set_power_limit(smu, smu->current_power_limit);
++ if (ret && ret != -EOPNOTSUPP)
++ return ret;
++ }
++
+ dev_info(adev->dev, "SMU is resumed successfully!\n");
+
+ return 0;
--- /dev/null
+From 0395cde08e1f7eee810b5799466e41635a21e599 Mon Sep 17 00:00:00 2001
+From: Frank Min <Frank.Min@amd.com>
+Date: Wed, 4 Jun 2025 21:39:34 +0800
+Subject: drm/amdgpu: add kicker fws loading for gfx12/smu14/psp14
+
+From: Frank Min <Frank.Min@amd.com>
+
+commit 0395cde08e1f7eee810b5799466e41635a21e599 upstream.
+
+1. Add kicker firmwares loading for gfx12/smu14/psp14
+2. Register additional MODULE_FIRMWARE entries for kicker fws
+ - gc_12_0_1_rlc_kicker.bin
+ - gc_12_0_1_imu_kicker.bin
+ - psp_14_0_3_sos_kicker.bin
+ - psp_14_0_3_ta_kicker.bin
+ - smu_14_0_3_kicker.bin
+
+Signed-off-by: Frank Min <Frank.Min@amd.com>
+Reviewed-by: Gui Chengming <Jack.Gui@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | 1 +
+ drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 14 ++++++++++----
+ drivers/gpu/drm/amd/amdgpu/imu_v12_0.c | 11 ++++++++---
+ drivers/gpu/drm/amd/amdgpu/psp_v14_0.c | 2 ++
+ drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 11 ++++++++---
+ 5 files changed, 29 insertions(+), 10 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c
+@@ -32,6 +32,7 @@
+
+ static const struct kicker_device kicker_device_list[] = {
+ {0x744B, 0x00},
++ {0x7551, 0xC8}
+ };
+
+ static void amdgpu_ucode_print_common_hdr(const struct common_firmware_header *hdr)
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c
+@@ -79,6 +79,7 @@ MODULE_FIRMWARE("amdgpu/gc_12_0_1_pfp.bi
+ MODULE_FIRMWARE("amdgpu/gc_12_0_1_me.bin");
+ MODULE_FIRMWARE("amdgpu/gc_12_0_1_mec.bin");
+ MODULE_FIRMWARE("amdgpu/gc_12_0_1_rlc.bin");
++MODULE_FIRMWARE("amdgpu/gc_12_0_1_rlc_kicker.bin");
+ MODULE_FIRMWARE("amdgpu/gc_12_0_1_toc.bin");
+
+ static const struct amdgpu_hwip_reg_entry gc_reg_list_12_0[] = {
+@@ -586,7 +587,7 @@ out:
+
+ static int gfx_v12_0_init_microcode(struct amdgpu_device *adev)
+ {
+- char ucode_prefix[15];
++ char ucode_prefix[30];
+ int err;
+ const struct rlc_firmware_header_v2_0 *rlc_hdr;
+ uint16_t version_major;
+@@ -613,9 +614,14 @@ static int gfx_v12_0_init_microcode(stru
+ amdgpu_gfx_cp_init_microcode(adev, AMDGPU_UCODE_ID_CP_RS64_ME_P0_STACK);
+
+ if (!amdgpu_sriov_vf(adev)) {
+- err = amdgpu_ucode_request(adev, &adev->gfx.rlc_fw,
+- AMDGPU_UCODE_REQUIRED,
+- "amdgpu/%s_rlc.bin", ucode_prefix);
++ if (amdgpu_is_kicker_fw(adev))
++ err = amdgpu_ucode_request(adev, &adev->gfx.rlc_fw,
++ AMDGPU_UCODE_REQUIRED,
++ "amdgpu/%s_rlc_kicker.bin", ucode_prefix);
++ else
++ err = amdgpu_ucode_request(adev, &adev->gfx.rlc_fw,
++ AMDGPU_UCODE_REQUIRED,
++ "amdgpu/%s_rlc.bin", ucode_prefix);
+ if (err)
+ goto out;
+ rlc_hdr = (const struct rlc_firmware_header_v2_0 *)adev->gfx.rlc_fw->data;
+--- a/drivers/gpu/drm/amd/amdgpu/imu_v12_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/imu_v12_0.c
+@@ -34,12 +34,13 @@
+
+ MODULE_FIRMWARE("amdgpu/gc_12_0_0_imu.bin");
+ MODULE_FIRMWARE("amdgpu/gc_12_0_1_imu.bin");
++MODULE_FIRMWARE("amdgpu/gc_12_0_1_imu_kicker.bin");
+
+ #define TRANSFER_RAM_MASK 0x001c0000
+
+ static int imu_v12_0_init_microcode(struct amdgpu_device *adev)
+ {
+- char ucode_prefix[15];
++ char ucode_prefix[30];
+ int err;
+ const struct imu_firmware_header_v1_0 *imu_hdr;
+ struct amdgpu_firmware_info *info = NULL;
+@@ -47,8 +48,12 @@ static int imu_v12_0_init_microcode(stru
+ DRM_DEBUG("\n");
+
+ amdgpu_ucode_ip_version_decode(adev, GC_HWIP, ucode_prefix, sizeof(ucode_prefix));
+- err = amdgpu_ucode_request(adev, &adev->gfx.imu_fw, AMDGPU_UCODE_REQUIRED,
+- "amdgpu/%s_imu.bin", ucode_prefix);
++ if (amdgpu_is_kicker_fw(adev))
++ err = amdgpu_ucode_request(adev, &adev->gfx.imu_fw, AMDGPU_UCODE_REQUIRED,
++ "amdgpu/%s_imu_kicker.bin", ucode_prefix);
++ else
++ err = amdgpu_ucode_request(adev, &adev->gfx.imu_fw, AMDGPU_UCODE_REQUIRED,
++ "amdgpu/%s_imu.bin", ucode_prefix);
+ if (err)
+ goto out;
+
+--- a/drivers/gpu/drm/amd/amdgpu/psp_v14_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/psp_v14_0.c
+@@ -34,7 +34,9 @@
+ MODULE_FIRMWARE("amdgpu/psp_14_0_2_sos.bin");
+ MODULE_FIRMWARE("amdgpu/psp_14_0_2_ta.bin");
+ MODULE_FIRMWARE("amdgpu/psp_14_0_3_sos.bin");
++MODULE_FIRMWARE("amdgpu/psp_14_0_3_sos_kicker.bin");
+ MODULE_FIRMWARE("amdgpu/psp_14_0_3_ta.bin");
++MODULE_FIRMWARE("amdgpu/psp_14_0_3_ta_kicker.bin");
+ MODULE_FIRMWARE("amdgpu/psp_14_0_5_toc.bin");
+ MODULE_FIRMWARE("amdgpu/psp_14_0_5_ta.bin");
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c
+@@ -62,13 +62,14 @@ const int decoded_link_width[8] = {0, 1,
+
+ MODULE_FIRMWARE("amdgpu/smu_14_0_2.bin");
+ MODULE_FIRMWARE("amdgpu/smu_14_0_3.bin");
++MODULE_FIRMWARE("amdgpu/smu_14_0_3_kicker.bin");
+
+ #define ENABLE_IMU_ARG_GFXOFF_ENABLE 1
+
+ int smu_v14_0_init_microcode(struct smu_context *smu)
+ {
+ struct amdgpu_device *adev = smu->adev;
+- char ucode_prefix[15];
++ char ucode_prefix[30];
+ int err = 0;
+ const struct smc_firmware_header_v1_0 *hdr;
+ const struct common_firmware_header *header;
+@@ -79,8 +80,12 @@ int smu_v14_0_init_microcode(struct smu_
+ return 0;
+
+ amdgpu_ucode_ip_version_decode(adev, MP1_HWIP, ucode_prefix, sizeof(ucode_prefix));
+- err = amdgpu_ucode_request(adev, &adev->pm.fw, AMDGPU_UCODE_REQUIRED,
+- "amdgpu/%s.bin", ucode_prefix);
++ if (amdgpu_is_kicker_fw(adev))
++ err = amdgpu_ucode_request(adev, &adev->pm.fw, AMDGPU_UCODE_REQUIRED,
++ "amdgpu/%s_kicker.bin", ucode_prefix);
++ else
++ err = amdgpu_ucode_request(adev, &adev->pm.fw, AMDGPU_UCODE_REQUIRED,
++ "amdgpu/%s.bin", ucode_prefix);
+ if (err)
+ goto out;
+
--- /dev/null
+From 81699fe81b0be287fb28b6210324db48e8458d9f Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 4 Aug 2025 11:40:20 -0400
+Subject: drm/amdgpu: add missing vram lost check for LEGACY RESET
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 81699fe81b0be287fb28b6210324db48e8458d9f upstream.
+
+Legacy resets reset the memory controllers so VRAM contents
+may be unreliable after reset.
+
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit aae94897b6661a2a4b1de2d328090fc388b3e0af)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -3234,6 +3234,7 @@ static bool amdgpu_device_check_vram_los
+ * always assumed to be lost.
+ */
+ switch (amdgpu_asic_reset_method(adev)) {
++ case AMD_RESET_METHOD_LEGACY:
+ case AMD_RESET_METHOD_LINK:
+ case AMD_RESET_METHOD_BACO:
+ case AMD_RESET_METHOD_MODE1:
--- /dev/null
+From 1f02f2044bda1db1fd995bc35961ab075fa7b5a2 Mon Sep 17 00:00:00 2001
+From: Gang Ba <Gang.Ba@amd.com>
+Date: Tue, 8 Jul 2025 14:36:13 -0400
+Subject: drm/amdgpu: Avoid extra evict-restore process.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Gang Ba <Gang.Ba@amd.com>
+
+commit 1f02f2044bda1db1fd995bc35961ab075fa7b5a2 upstream.
+
+If vm belongs to another process, this is fclose after fork,
+wait may enable signaling KFD eviction fence and cause parent process queue evicted.
+
+[677852.634569] amdkfd_fence_enable_signaling+0x56/0x70 [amdgpu]
+[677852.634814] __dma_fence_enable_signaling+0x3e/0xe0
+[677852.634820] dma_fence_wait_timeout+0x3a/0x140
+[677852.634825] amddma_resv_wait_timeout+0x7f/0xf0 [amdkcl]
+[677852.634831] amdgpu_vm_wait_idle+0x2d/0x60 [amdgpu]
+[677852.635026] amdgpu_flush+0x34/0x50 [amdgpu]
+[677852.635208] filp_flush+0x38/0x90
+[677852.635213] filp_close+0x14/0x30
+[677852.635216] do_close_on_exec+0xdd/0x130
+[677852.635221] begin_new_exec+0x1da/0x490
+[677852.635225] load_elf_binary+0x307/0xea0
+[677852.635231] ? srso_alias_return_thunk+0x5/0xfbef5
+[677852.635235] ? ima_bprm_check+0xa2/0xd0
+[677852.635240] search_binary_handler+0xda/0x260
+[677852.635245] exec_binprm+0x58/0x1a0
+[677852.635249] bprm_execve.part.0+0x16f/0x210
+[677852.635254] bprm_execve+0x45/0x80
+[677852.635257] do_execveat_common.isra.0+0x190/0x200
+
+Suggested-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Gang Ba <Gang.Ba@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+@@ -2409,13 +2409,11 @@ void amdgpu_vm_adjust_size(struct amdgpu
+ */
+ long amdgpu_vm_wait_idle(struct amdgpu_vm *vm, long timeout)
+ {
+- timeout = dma_resv_wait_timeout(vm->root.bo->tbo.base.resv,
+- DMA_RESV_USAGE_BOOKKEEP,
+- true, timeout);
++ timeout = drm_sched_entity_flush(&vm->immediate, timeout);
+ if (timeout <= 0)
+ return timeout;
+
+- return dma_fence_wait_timeout(vm->last_unlocked, true, timeout);
++ return drm_sched_entity_flush(&vm->delayed, timeout);
+ }
+
+ static void amdgpu_vm_destroy_task_info(struct kref *kref)
--- /dev/null
+From b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288 Mon Sep 17 00:00:00 2001
+From: Peter Shkenev <mustela@erminea.space>
+Date: Thu, 17 Jul 2025 23:48:17 +0300
+Subject: drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities
+
+From: Peter Shkenev <mustela@erminea.space>
+
+commit b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288 upstream.
+
+HUBBUB structure is not initialized on DCE hardware, so check if it is NULL
+to avoid null dereference while accessing amdgpu_dm_capabilities file in
+debugfs.
+
+Signed-off-by: Peter Shkenev <mustela@erminea.space>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+@@ -3988,7 +3988,7 @@ static int capabilities_show(struct seq_
+
+ struct hubbub *hubbub = dc->res_pool->hubbub;
+
+- if (hubbub->funcs->get_mall_en)
++ if (hubbub && hubbub->funcs->get_mall_en)
+ hubbub->funcs->get_mall_en(hubbub, &mall_in_use);
+
+ if (dc->cap_funcs.get_subvp_en)
--- /dev/null
+From 514678da56da089b756b4d433efd964fa22b2079 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 30 Jul 2025 11:16:05 -0400
+Subject: drm/amdgpu/discovery: fix fw based ip discovery
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 514678da56da089b756b4d433efd964fa22b2079 upstream.
+
+We only need the fw based discovery table for sysfs. No
+need to parse it. Additionally parsing some of the board
+specific tables may result in incorrect data on some boards.
+just load the binary and don't parse it on those boards.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4441
+Fixes: 80a0e8282933 ("drm/amdgpu/discovery: optionally use fw based ip discovery")
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 62eedd150fa11aefc2d377fc746633fdb1baeb55)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 5 -
+ drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 72 ++++++++++++++------------
+ 2 files changed, 41 insertions(+), 36 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -2561,9 +2561,6 @@ static int amdgpu_device_parse_gpu_info_
+
+ adev->firmware.gpu_info_fw = NULL;
+
+- if (adev->mman.discovery_bin)
+- return 0;
+-
+ switch (adev->asic_type) {
+ default:
+ return 0;
+@@ -2585,6 +2582,8 @@ static int amdgpu_device_parse_gpu_info_
+ chip_name = "arcturus";
+ break;
+ case CHIP_NAVI12:
++ if (adev->mman.discovery_bin)
++ return 0;
+ chip_name = "navi12";
+ break;
+ }
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+@@ -2555,40 +2555,11 @@ int amdgpu_discovery_set_ip_blocks(struc
+
+ switch (adev->asic_type) {
+ case CHIP_VEGA10:
+- case CHIP_VEGA12:
+- case CHIP_RAVEN:
+- case CHIP_VEGA20:
+- case CHIP_ARCTURUS:
+- case CHIP_ALDEBARAN:
+- /* this is not fatal. We have a fallback below
+- * if the new firmwares are not present. some of
+- * this will be overridden below to keep things
+- * consistent with the current behavior.
++ /* This is not fatal. We only need the discovery
++ * binary for sysfs. We don't need it for a
++ * functional system.
+ */
+- r = amdgpu_discovery_reg_base_init(adev);
+- if (!r) {
+- amdgpu_discovery_harvest_ip(adev);
+- amdgpu_discovery_get_gfx_info(adev);
+- amdgpu_discovery_get_mall_info(adev);
+- amdgpu_discovery_get_vcn_info(adev);
+- }
+- break;
+- default:
+- r = amdgpu_discovery_reg_base_init(adev);
+- if (r) {
+- drm_err(&adev->ddev, "discovery failed: %d\n", r);
+- return r;
+- }
+-
+- amdgpu_discovery_harvest_ip(adev);
+- amdgpu_discovery_get_gfx_info(adev);
+- amdgpu_discovery_get_mall_info(adev);
+- amdgpu_discovery_get_vcn_info(adev);
+- break;
+- }
+-
+- switch (adev->asic_type) {
+- case CHIP_VEGA10:
++ amdgpu_discovery_init(adev);
+ vega10_reg_base_init(adev);
+ adev->sdma.num_instances = 2;
+ adev->gmc.num_umc = 4;
+@@ -2611,6 +2582,11 @@ int amdgpu_discovery_set_ip_blocks(struc
+ adev->ip_versions[DCI_HWIP][0] = IP_VERSION(12, 0, 0);
+ break;
+ case CHIP_VEGA12:
++ /* This is not fatal. We only need the discovery
++ * binary for sysfs. We don't need it for a
++ * functional system.
++ */
++ amdgpu_discovery_init(adev);
+ vega10_reg_base_init(adev);
+ adev->sdma.num_instances = 2;
+ adev->gmc.num_umc = 4;
+@@ -2633,6 +2609,11 @@ int amdgpu_discovery_set_ip_blocks(struc
+ adev->ip_versions[DCI_HWIP][0] = IP_VERSION(12, 0, 1);
+ break;
+ case CHIP_RAVEN:
++ /* This is not fatal. We only need the discovery
++ * binary for sysfs. We don't need it for a
++ * functional system.
++ */
++ amdgpu_discovery_init(adev);
+ vega10_reg_base_init(adev);
+ adev->sdma.num_instances = 1;
+ adev->vcn.num_vcn_inst = 1;
+@@ -2674,6 +2655,11 @@ int amdgpu_discovery_set_ip_blocks(struc
+ }
+ break;
+ case CHIP_VEGA20:
++ /* This is not fatal. We only need the discovery
++ * binary for sysfs. We don't need it for a
++ * functional system.
++ */
++ amdgpu_discovery_init(adev);
+ vega20_reg_base_init(adev);
+ adev->sdma.num_instances = 2;
+ adev->gmc.num_umc = 8;
+@@ -2697,6 +2683,11 @@ int amdgpu_discovery_set_ip_blocks(struc
+ adev->ip_versions[DCI_HWIP][0] = IP_VERSION(12, 1, 0);
+ break;
+ case CHIP_ARCTURUS:
++ /* This is not fatal. We only need the discovery
++ * binary for sysfs. We don't need it for a
++ * functional system.
++ */
++ amdgpu_discovery_init(adev);
+ arct_reg_base_init(adev);
+ adev->sdma.num_instances = 8;
+ adev->vcn.num_vcn_inst = 2;
+@@ -2725,6 +2716,11 @@ int amdgpu_discovery_set_ip_blocks(struc
+ adev->ip_versions[UVD_HWIP][1] = IP_VERSION(2, 5, 0);
+ break;
+ case CHIP_ALDEBARAN:
++ /* This is not fatal. We only need the discovery
++ * binary for sysfs. We don't need it for a
++ * functional system.
++ */
++ amdgpu_discovery_init(adev);
+ aldebaran_reg_base_init(adev);
+ adev->sdma.num_instances = 5;
+ adev->vcn.num_vcn_inst = 2;
+@@ -2751,6 +2747,16 @@ int amdgpu_discovery_set_ip_blocks(struc
+ adev->ip_versions[XGMI_HWIP][0] = IP_VERSION(6, 1, 0);
+ break;
+ default:
++ r = amdgpu_discovery_reg_base_init(adev);
++ if (r) {
++ drm_err(&adev->ddev, "discovery failed: %d\n", r);
++ return r;
++ }
++
++ amdgpu_discovery_harvest_ip(adev);
++ amdgpu_discovery_get_gfx_info(adev);
++ amdgpu_discovery_get_mall_info(adev);
++ amdgpu_discovery_get_vcn_info(adev);
+ break;
+ }
+
--- /dev/null
+From c90f2e1172c51fa25492471dc9910e2d7c1444b9 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <nathan@kernel.org>
+Date: Tue, 15 Jul 2025 16:50:22 -0700
+Subject: drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram()
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+commit c90f2e1172c51fa25492471dc9910e2d7c1444b9 upstream.
+
+After a recent change in clang to expose uninitialized warnings from
+const variables and pointers [1], there is a warning in
+imu_v12_0_program_rlc_ram() because data is passed uninitialized to
+program_imu_rlc_ram():
+
+ drivers/gpu/drm/amd/amdgpu/imu_v12_0.c:374:30: error: variable 'data' is uninitialized when used here [-Werror,-Wuninitialized]
+ 374 | program_imu_rlc_ram(adev, data, (const u32)size);
+ | ^~~~
+
+As this warning happens early in clang's frontend, it does not realize
+that due to the assignment of r to -EINVAL, program_imu_rlc_ram() is
+never actually called, and even if it were, data would not be
+dereferenced because size is 0.
+
+Just initialize data to NULL to silence the warning, as the commit that
+added program_imu_rlc_ram() mentioned it would eventually be used over
+the old method, at which point data can be properly initialized and
+used.
+
+Cc: stable@vger.kernel.org
+Closes: https://github.com/ClangBuiltLinux/linux/issues/2107
+Fixes: 56159fffaab5 ("drm/amdgpu: use new method to program rlc ram")
+Link: https://github.com/llvm/llvm-project/commit/2464313eef01c5b1edf0eccf57a32cdee01472c7 [1]
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/imu_v12_0.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/imu_v12_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/imu_v12_0.c
+@@ -367,7 +367,7 @@ static void program_imu_rlc_ram(struct a
+ static void imu_v12_0_program_rlc_ram(struct amdgpu_device *adev)
+ {
+ u32 reg_data, size = 0;
+- const u32 *data;
++ const u32 *data = NULL;
+ int r = -EINVAL;
+
+ WREG32_SOC15(GC, 0, regGFX_IMU_RLC_RAM_INDEX, 0x2);
--- /dev/null
+From c00d8b79fd2167c6ac65e096619535acdf8678d5 Mon Sep 17 00:00:00 2001
+From: YuanShang <YuanShang.Mao@amd.com>
+Date: Wed, 23 Jul 2025 16:44:49 +0800
+Subject: drm/amdgpu: Retain job->vm in amdgpu_job_prepare_job
+
+From: YuanShang <YuanShang.Mao@amd.com>
+
+commit c00d8b79fd2167c6ac65e096619535acdf8678d5 upstream.
+
+The field job->vm is used in function amdgpu_job_run to get the page
+table re-generation counter and decide whether the job should be skipped.
+
+Specifically, function amdgpu_vm_generation checks if the VM is valid for this job to use.
+For instance, if a gfx job depends on a cancelled sdma job from entity vm->delayed,
+then the gfx job should be skipped.
+
+Fixes: 26c95e838e63 ("drm/amdgpu: set the VM pointer to NULL in amdgpu_job_prepare")
+Signed-off-by: YuanShang <YuanShang.Mao@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit ed76936c6b10b547c6df4ca75412331e9ef6d339)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 7 -------
+ 1 file changed, 7 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
+@@ -387,13 +387,6 @@ amdgpu_job_prepare_job(struct drm_sched_
+ dev_err(ring->adev->dev, "Error getting VM ID (%d)\n", r);
+ goto error;
+ }
+- /*
+- * The VM structure might be released after the VMID is
+- * assigned, we had multiple problems with people trying to use
+- * the VM pointer so better set it to NULL.
+- */
+- if (!fence)
+- job->vm = NULL;
+ return fence;
+ }
+
--- /dev/null
+From 284d4dfe850e665f0e7d4dfaf4d3d3da76d11fb0 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 24 Jun 2025 11:22:26 -0400
+Subject: drm/amdgpu: track whether a queue is a kernel queue in amdgpu_mqd_prop
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 284d4dfe850e665f0e7d4dfaf4d3d3da76d11fb0 upstream.
+
+Used to to set the MQD appropriately for each queue type.
+Kernel queues have additional privileges.
+
+Acked-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 6.16.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 +
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+@@ -886,6 +886,7 @@ struct amdgpu_mqd_prop {
+ uint64_t csa_addr;
+ uint64_t fence_address;
+ bool tmz_queue;
++ bool kernel_queue;
+ };
+
+ struct amdgpu_mqd {
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
+@@ -687,6 +687,7 @@ static void amdgpu_ring_to_mqd_prop(stru
+ prop->eop_gpu_addr = ring->eop_gpu_addr;
+ prop->use_doorbell = ring->use_doorbell;
+ prop->doorbell_index = ring->doorbell_index;
++ prop->kernel_queue = true;
+
+ /* map_queues packet doesn't need activate the queue,
+ * so only kiq need set this field.
--- /dev/null
+From 05c8b690511854ba31d8d1bff7139a13ec66b9e7 Mon Sep 17 00:00:00 2001
+From: Lijo Lazar <lijo.lazar@amd.com>
+Date: Fri, 25 Jul 2025 10:21:10 +0530
+Subject: drm/amdgpu: Update external revid for GC v9.5.0
+
+From: Lijo Lazar <lijo.lazar@amd.com>
+
+commit 05c8b690511854ba31d8d1bff7139a13ec66b9e7 upstream.
+
+Use different external revid for GC v9.5.0 SOCs.
+
+Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Reviewed-by: Asad Kamal <asad.kamal@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 21c6764ed4bfaecad034bc4fd15dd64c5a436325)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/soc15.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
+@@ -1218,6 +1218,8 @@ static int soc15_common_early_init(struc
+ AMD_PG_SUPPORT_JPEG;
+ /*TODO: need a new external_rev_id for GC 9.4.4? */
+ adev->external_rev_id = adev->rev_id + 0x46;
++ if (amdgpu_ip_version(adev, GC_HWIP, 0) == IP_VERSION(9, 5, 0))
++ adev->external_rev_id = adev->rev_id + 0x50;
+ break;
+ default:
+ /* FIXME: not supported yet */
--- /dev/null
+From 0bae62cc989fa99ac9cb564eb573aad916d1eb61 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 18 Jul 2025 15:52:04 -0400
+Subject: drm/amdgpu: update mmhub 3.0.1 client id mappings
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 0bae62cc989fa99ac9cb564eb573aad916d1eb61 upstream.
+
+Update the client id mapping so the correct clients
+get printed when there is a mmhub page fault.
+
+Reviewed-by: David (Ming Qiang) Wu <David.Wu3@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 2a2681eda73b99a2c1ee8cdb006099ea5d0c2505)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c | 57 ++++++++++++++++--------------
+ 1 file changed, 32 insertions(+), 25 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c
++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c
+@@ -36,40 +36,47 @@
+
+ static const char *mmhub_client_ids_v3_0_1[][2] = {
+ [0][0] = "VMC",
++ [1][0] = "ISPXT",
++ [2][0] = "ISPIXT",
+ [4][0] = "DCEDMC",
+ [5][0] = "DCEVGA",
+ [6][0] = "MP0",
+ [7][0] = "MP1",
+- [8][0] = "MPIO",
+- [16][0] = "HDP",
+- [17][0] = "LSDMA",
+- [18][0] = "JPEG",
+- [19][0] = "VCNU0",
+- [21][0] = "VSCH",
+- [22][0] = "VCNU1",
+- [23][0] = "VCN1",
+- [32+20][0] = "VCN0",
+- [2][1] = "DBGUNBIO",
++ [8][0] = "MPM",
++ [12][0] = "ISPTNR",
++ [14][0] = "ISPCRD0",
++ [15][0] = "ISPCRD1",
++ [16][0] = "ISPCRD2",
++ [22][0] = "HDP",
++ [23][0] = "LSDMA",
++ [24][0] = "JPEG",
++ [27][0] = "VSCH",
++ [28][0] = "VCNU",
++ [29][0] = "VCN",
++ [1][1] = "ISPXT",
++ [2][1] = "ISPIXT",
+ [3][1] = "DCEDWB",
+ [4][1] = "DCEDMC",
+ [5][1] = "DCEVGA",
+ [6][1] = "MP0",
+ [7][1] = "MP1",
+- [8][1] = "MPIO",
+- [10][1] = "DBGU0",
+- [11][1] = "DBGU1",
+- [12][1] = "DBGU2",
+- [13][1] = "DBGU3",
+- [14][1] = "XDP",
+- [15][1] = "OSSSYS",
+- [16][1] = "HDP",
+- [17][1] = "LSDMA",
+- [18][1] = "JPEG",
+- [19][1] = "VCNU0",
+- [20][1] = "VCN0",
+- [21][1] = "VSCH",
+- [22][1] = "VCNU1",
+- [23][1] = "VCN1",
++ [8][1] = "MPM",
++ [10][1] = "ISPMWR0",
++ [11][1] = "ISPMWR1",
++ [12][1] = "ISPTNR",
++ [13][1] = "ISPSWR",
++ [14][1] = "ISPCWR0",
++ [15][1] = "ISPCWR1",
++ [16][1] = "ISPCWR2",
++ [17][1] = "ISPCWR3",
++ [18][1] = "XDP",
++ [21][1] = "OSSSYS",
++ [22][1] = "HDP",
++ [23][1] = "LSDMA",
++ [24][1] = "JPEG",
++ [27][1] = "VSCH",
++ [28][1] = "VCNU",
++ [29][1] = "VCN",
+ };
+
+ static uint32_t mmhub_v3_0_1_get_invalidate_req(unsigned int vmid,
--- /dev/null
+From 9f9bddfa31d87b084700a6e9eca1a8b4f8ddcdf6 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 18 Jul 2025 15:53:21 -0400
+Subject: drm/amdgpu: update mmhub 3.3 client id mappings
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 9f9bddfa31d87b084700a6e9eca1a8b4f8ddcdf6 upstream.
+
+Update the client id mapping so the correct clients
+get printed when there is a mmhub page fault.
+
+v2: fix typos spotted by David Wu.
+v3: fix additional typo spotted by David.
+
+Reviewed-by: David (Ming Qiang) Wu <David.Wu3@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit e932f4779a2d329841bb9ca70bb80a4bb2d707b6)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/mmhub_v3_3.c | 105 +++++++++++++++++++++++++++++++-
+ 1 file changed, 104 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v3_3.c
++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v3_3.c
+@@ -40,30 +40,129 @@
+
+ static const char *mmhub_client_ids_v3_3[][2] = {
+ [0][0] = "VMC",
++ [1][0] = "ISPXT",
++ [2][0] = "ISPIXT",
+ [4][0] = "DCEDMC",
+ [6][0] = "MP0",
+ [7][0] = "MP1",
+ [8][0] = "MPM",
++ [9][0] = "ISPPDPRD",
++ [10][0] = "ISPCSTATRD",
++ [11][0] = "ISPBYRPRD",
++ [12][0] = "ISPRGBPRD",
++ [13][0] = "ISPMCFPRD",
++ [14][0] = "ISPMCFPRD1",
++ [15][0] = "ISPYUVPRD",
++ [16][0] = "ISPMCSCRD",
++ [17][0] = "ISPGDCRD",
++ [18][0] = "ISPLMERD",
++ [22][0] = "ISPXT1",
++ [23][0] = "ISPIXT1",
+ [24][0] = "HDP",
+ [25][0] = "LSDMA",
+ [26][0] = "JPEG",
+ [27][0] = "VPE",
++ [28][0] = "VSCH",
+ [29][0] = "VCNU",
+ [30][0] = "VCN",
++ [1][1] = "ISPXT",
++ [2][1] = "ISPIXT",
+ [3][1] = "DCEDWB",
+ [4][1] = "DCEDMC",
++ [5][1] = "ISPCSISWR",
+ [6][1] = "MP0",
+ [7][1] = "MP1",
+ [8][1] = "MPM",
++ [9][1] = "ISPPDPWR",
++ [10][1] = "ISPCSTATWR",
++ [11][1] = "ISPBYRPWR",
++ [12][1] = "ISPRGBPWR",
++ [13][1] = "ISPMCFPWR",
++ [14][1] = "ISPMWR0",
++ [15][1] = "ISPYUVPWR",
++ [16][1] = "ISPMCSCWR",
++ [17][1] = "ISPGDCWR",
++ [18][1] = "ISPLMEWR",
++ [20][1] = "ISPMWR2",
+ [21][1] = "OSSSYS",
++ [22][1] = "ISPXT1",
++ [23][1] = "ISPIXT1",
+ [24][1] = "HDP",
+ [25][1] = "LSDMA",
+ [26][1] = "JPEG",
+ [27][1] = "VPE",
++ [28][1] = "VSCH",
+ [29][1] = "VCNU",
+ [30][1] = "VCN",
+ };
+
++static const char *mmhub_client_ids_v3_3_1[][2] = {
++ [0][0] = "VMC",
++ [4][0] = "DCEDMC",
++ [6][0] = "MP0",
++ [7][0] = "MP1",
++ [8][0] = "MPM",
++ [24][0] = "HDP",
++ [25][0] = "LSDMA",
++ [26][0] = "JPEG0",
++ [27][0] = "VPE0",
++ [28][0] = "VSCH",
++ [29][0] = "VCNU0",
++ [30][0] = "VCN0",
++ [32+1][0] = "ISPXT",
++ [32+2][0] = "ISPIXT",
++ [32+9][0] = "ISPPDPRD",
++ [32+10][0] = "ISPCSTATRD",
++ [32+11][0] = "ISPBYRPRD",
++ [32+12][0] = "ISPRGBPRD",
++ [32+13][0] = "ISPMCFPRD",
++ [32+14][0] = "ISPMCFPRD1",
++ [32+15][0] = "ISPYUVPRD",
++ [32+16][0] = "ISPMCSCRD",
++ [32+17][0] = "ISPGDCRD",
++ [32+18][0] = "ISPLMERD",
++ [32+22][0] = "ISPXT1",
++ [32+23][0] = "ISPIXT1",
++ [32+26][0] = "JPEG1",
++ [32+27][0] = "VPE1",
++ [32+29][0] = "VCNU1",
++ [32+30][0] = "VCN1",
++ [3][1] = "DCEDWB",
++ [4][1] = "DCEDMC",
++ [6][1] = "MP0",
++ [7][1] = "MP1",
++ [8][1] = "MPM",
++ [21][1] = "OSSSYS",
++ [24][1] = "HDP",
++ [25][1] = "LSDMA",
++ [26][1] = "JPEG0",
++ [27][1] = "VPE0",
++ [28][1] = "VSCH",
++ [29][1] = "VCNU0",
++ [30][1] = "VCN0",
++ [32+1][1] = "ISPXT",
++ [32+2][1] = "ISPIXT",
++ [32+5][1] = "ISPCSISWR",
++ [32+9][1] = "ISPPDPWR",
++ [32+10][1] = "ISPCSTATWR",
++ [32+11][1] = "ISPBYRPWR",
++ [32+12][1] = "ISPRGBPWR",
++ [32+13][1] = "ISPMCFPWR",
++ [32+14][1] = "ISPMWR0",
++ [32+15][1] = "ISPYUVPWR",
++ [32+16][1] = "ISPMCSCWR",
++ [32+17][1] = "ISPGDCWR",
++ [32+18][1] = "ISPLMEWR",
++ [32+19][1] = "ISPMWR1",
++ [32+20][1] = "ISPMWR2",
++ [32+22][1] = "ISPXT1",
++ [32+23][1] = "ISPIXT1",
++ [32+26][1] = "JPEG1",
++ [32+27][1] = "VPE1",
++ [32+29][1] = "VCNU1",
++ [32+30][1] = "VCN1",
++};
++
+ static uint32_t mmhub_v3_3_get_invalidate_req(unsigned int vmid,
+ uint32_t flush_type)
+ {
+@@ -102,12 +201,16 @@ mmhub_v3_3_print_l2_protection_fault_sta
+
+ switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
+ case IP_VERSION(3, 3, 0):
+- case IP_VERSION(3, 3, 1):
+ case IP_VERSION(3, 3, 2):
+ mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_v3_3) ?
+ mmhub_client_ids_v3_3[cid][rw] :
+ cid == 0x140 ? "UMSCH" : NULL;
+ break;
++ case IP_VERSION(3, 3, 1):
++ mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_v3_3_1) ?
++ mmhub_client_ids_v3_3_1[cid][rw] :
++ cid == 0x140 ? "UMSCH" : NULL;
++ break;
+ default:
+ mmhub_cid = NULL;
+ break;
--- /dev/null
+From a0b34e4c8663b13e45c78267b4de3004b1a72490 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 18 Jul 2025 15:53:54 -0400
+Subject: drm/amdgpu: update mmhub 4.1.0 client id mappings
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit a0b34e4c8663b13e45c78267b4de3004b1a72490 upstream.
+
+Update the client id mapping so the correct clients
+get printed when there is a mmhub page fault.
+
+Tested-by: David (Ming Qiang) Wu <David.Wu3@amd.com>
+Reviewed-by: David (Ming Qiang) Wu <David.Wu3@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/mmhub_v4_1_0.c | 34 +++++++++++-------------------
+ 1 file changed, 13 insertions(+), 21 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v4_1_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v4_1_0.c
+@@ -37,39 +37,31 @@
+ static const char *mmhub_client_ids_v4_1_0[][2] = {
+ [0][0] = "VMC",
+ [4][0] = "DCEDMC",
+- [5][0] = "DCEVGA",
+ [6][0] = "MP0",
+ [7][0] = "MP1",
+ [8][0] = "MPIO",
+- [16][0] = "HDP",
+- [17][0] = "LSDMA",
+- [18][0] = "JPEG",
+- [19][0] = "VCNU0",
+- [21][0] = "VSCH",
+- [22][0] = "VCNU1",
+- [23][0] = "VCN1",
+- [32+20][0] = "VCN0",
+- [2][1] = "DBGUNBIO",
++ [16][0] = "LSDMA",
++ [17][0] = "JPEG",
++ [19][0] = "VCNU",
++ [22][0] = "VSCH",
++ [23][0] = "HDP",
++ [32+23][0] = "VCNRD",
+ [3][1] = "DCEDWB",
+ [4][1] = "DCEDMC",
+- [5][1] = "DCEVGA",
+ [6][1] = "MP0",
+ [7][1] = "MP1",
+ [8][1] = "MPIO",
+ [10][1] = "DBGU0",
+ [11][1] = "DBGU1",
+- [12][1] = "DBGU2",
+- [13][1] = "DBGU3",
++ [12][1] = "DBGUNBIO",
+ [14][1] = "XDP",
+ [15][1] = "OSSSYS",
+- [16][1] = "HDP",
+- [17][1] = "LSDMA",
+- [18][1] = "JPEG",
+- [19][1] = "VCNU0",
+- [20][1] = "VCN0",
+- [21][1] = "VSCH",
+- [22][1] = "VCNU1",
+- [23][1] = "VCN1",
++ [16][1] = "LSDMA",
++ [17][1] = "JPEG",
++ [18][1] = "VCNWR",
++ [19][1] = "VCNU",
++ [22][1] = "VSCH",
++ [23][1] = "HDP",
+ };
+
+ static uint32_t mmhub_v4_1_0_get_invalidate_req(unsigned int vmid,
--- /dev/null
+From 389d79a195a9f71a103b39097ee8341a7ca60927 Mon Sep 17 00:00:00 2001
+From: Lijo Lazar <lijo.lazar@amd.com>
+Date: Tue, 8 Jul 2025 13:17:18 +0530
+Subject: drm/amdgpu: Update supported modes for GC v9.5.0
+
+From: Lijo Lazar <lijo.lazar@amd.com>
+
+commit 389d79a195a9f71a103b39097ee8341a7ca60927 upstream.
+
+For GC v9.5.0 SOCs, both CPX and QPX compute modes are also supported in
+NPS2 mode.
+
+Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
+Acked-by: Mangesh Gadre <Mangesh.Gadre@amd.com>
+Reviewed-by: Asad Kamal <asad.kamal@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 9d1ac25c7f830e0132aa816393b1e9f140e71148)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c
++++ b/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c
+@@ -453,6 +453,7 @@ static int __aqua_vanjaram_get_px_mode_i
+ uint16_t *nps_modes)
+ {
+ struct amdgpu_device *adev = xcp_mgr->adev;
++ uint32_t gc_ver = amdgpu_ip_version(adev, GC_HWIP, 0);
+
+ if (!num_xcp || !nps_modes || !(xcp_mgr->supp_xcp_modes & BIT(px_mode)))
+ return -EINVAL;
+@@ -476,12 +477,14 @@ static int __aqua_vanjaram_get_px_mode_i
+ *num_xcp = 4;
+ *nps_modes = BIT(AMDGPU_NPS1_PARTITION_MODE) |
+ BIT(AMDGPU_NPS4_PARTITION_MODE);
++ if (gc_ver == IP_VERSION(9, 5, 0))
++ *nps_modes |= BIT(AMDGPU_NPS2_PARTITION_MODE);
+ break;
+ case AMDGPU_CPX_PARTITION_MODE:
+ *num_xcp = NUM_XCC(adev->gfx.xcc_mask);
+ *nps_modes = BIT(AMDGPU_NPS1_PARTITION_MODE) |
+ BIT(AMDGPU_NPS4_PARTITION_MODE);
+- if (amdgpu_sriov_vf(adev))
++ if (gc_ver == IP_VERSION(9, 5, 0))
+ *nps_modes |= BIT(AMDGPU_NPS2_PARTITION_MODE);
+ break;
+ default:
--- /dev/null
+From 2e58401a24e7b2d4ec619104e1a76590c1284a4c Mon Sep 17 00:00:00 2001
+From: Amber Lin <Amber.Lin@amd.com>
+Date: Thu, 31 Jul 2025 20:45:00 -0400
+Subject: drm/amdkfd: Destroy KFD debugfs after destroy KFD wq
+
+From: Amber Lin <Amber.Lin@amd.com>
+
+commit 2e58401a24e7b2d4ec619104e1a76590c1284a4c upstream.
+
+Since KFD proc content was moved to kernel debugfs, we can't destroy KFD
+debugfs before kfd_process_destroy_wq. Move kfd_process_destroy_wq prior
+to kfd_debugfs_fini to fix a kernel NULL pointer problem. It happens
+when /sys/kernel/debug/kfd was already destroyed in kfd_debugfs_fini but
+kfd_process_destroy_wq calls kfd_debugfs_remove_process. This line
+ debugfs_remove_recursive(entry->proc_dentry);
+tries to remove /sys/kernel/debug/kfd/proc/<pid> while
+/sys/kernel/debug/kfd is already gone. It hangs the kernel by kernel
+NULL pointer.
+
+Signed-off-by: Amber Lin <Amber.Lin@amd.com>
+Reviewed-by: Eric Huang <jinhuieric.huang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 0333052d90683d88531558dcfdbf2525cc37c233)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_module.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_module.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_module.c
+@@ -78,8 +78,8 @@ err_ioctl:
+ static void kfd_exit(void)
+ {
+ kfd_cleanup_processes();
+- kfd_debugfs_fini();
+ kfd_process_destroy_wq();
++ kfd_debugfs_fini();
+ kfd_procfs_shutdown();
+ kfd_topology_shutdown();
+ kfd_chardev_exit();
--- /dev/null
+From f6c0f3d24478a0792e50a64c2eba9f34d65519f2 Mon Sep 17 00:00:00 2001
+From: David Yat Sin <David.YatSin@amd.com>
+Date: Wed, 16 Jul 2025 22:04:28 +0000
+Subject: drm/amdkfd: Fix checkpoint-restore on multi-xcc
+
+From: David Yat Sin <David.YatSin@amd.com>
+
+commit f6c0f3d24478a0792e50a64c2eba9f34d65519f2 upstream.
+
+GPUs with multi-xcc have multiple MQDs per queue. This patch saves and
+restores all the MQDs within the partition.
+
+Signed-off-by: David Yat Sin <David.YatSin@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit a578f2a58c3ab38f0643b1b6e7534af860233cb1)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 2
+ drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | 61 ++++++++++++++---
+ drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 20 ++++-
+ 3 files changed, 67 insertions(+), 16 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+@@ -2716,7 +2716,7 @@ static void get_queue_checkpoint_info(st
+
+ dqm_lock(dqm);
+ mqd_mgr = dqm->mqd_mgrs[mqd_type];
+- *mqd_size = mqd_mgr->mqd_size;
++ *mqd_size = mqd_mgr->mqd_size * NUM_XCC(mqd_mgr->dev->xcc_mask);
+ *ctl_stack_size = 0;
+
+ if (q->properties.type == KFD_QUEUE_TYPE_COMPUTE && mqd_mgr->get_checkpoint_info)
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
+@@ -373,7 +373,7 @@ static void get_checkpoint_info(struct m
+ {
+ struct v9_mqd *m = get_mqd(mqd);
+
+- *ctl_stack_size = m->cp_hqd_cntl_stack_size;
++ *ctl_stack_size = m->cp_hqd_cntl_stack_size * NUM_XCC(mm->dev->xcc_mask);
+ }
+
+ static void checkpoint_mqd(struct mqd_manager *mm, void *mqd, void *mqd_dst, void *ctl_stack_dst)
+@@ -388,6 +388,24 @@ static void checkpoint_mqd(struct mqd_ma
+ memcpy(ctl_stack_dst, ctl_stack, m->cp_hqd_cntl_stack_size);
+ }
+
++static void checkpoint_mqd_v9_4_3(struct mqd_manager *mm,
++ void *mqd,
++ void *mqd_dst,
++ void *ctl_stack_dst)
++{
++ struct v9_mqd *m;
++ int xcc;
++ uint64_t size = get_mqd(mqd)->cp_mqd_stride_size;
++
++ for (xcc = 0; xcc < NUM_XCC(mm->dev->xcc_mask); xcc++) {
++ m = get_mqd(mqd + size * xcc);
++
++ checkpoint_mqd(mm, m,
++ (uint8_t *)mqd_dst + sizeof(*m) * xcc,
++ (uint8_t *)ctl_stack_dst + m->cp_hqd_cntl_stack_size * xcc);
++ }
++}
++
+ static void restore_mqd(struct mqd_manager *mm, void **mqd,
+ struct kfd_mem_obj *mqd_mem_obj, uint64_t *gart_addr,
+ struct queue_properties *qp,
+@@ -764,13 +782,35 @@ static void restore_mqd_v9_4_3(struct mq
+ const void *mqd_src,
+ const void *ctl_stack_src, u32 ctl_stack_size)
+ {
+- restore_mqd(mm, mqd, mqd_mem_obj, gart_addr, qp, mqd_src, ctl_stack_src, ctl_stack_size);
+- if (amdgpu_sriov_multi_vf_mode(mm->dev->adev)) {
+- struct v9_mqd *m;
++ struct kfd_mem_obj xcc_mqd_mem_obj;
++ u32 mqd_ctl_stack_size;
++ struct v9_mqd *m;
++ u32 num_xcc;
++ int xcc;
+
+- m = (struct v9_mqd *) mqd_mem_obj->cpu_ptr;
+- m->cp_hqd_pq_doorbell_control |= 1 <<
+- CP_HQD_PQ_DOORBELL_CONTROL__DOORBELL_MODE__SHIFT;
++ uint64_t offset = mm->mqd_stride(mm, qp);
++
++ mm->dev->dqm->current_logical_xcc_start++;
++
++ num_xcc = NUM_XCC(mm->dev->xcc_mask);
++ mqd_ctl_stack_size = ctl_stack_size / num_xcc;
++
++ memset(&xcc_mqd_mem_obj, 0x0, sizeof(struct kfd_mem_obj));
++
++ /* Set the MQD pointer and gart address to XCC0 MQD */
++ *mqd = mqd_mem_obj->cpu_ptr;
++ if (gart_addr)
++ *gart_addr = mqd_mem_obj->gpu_addr;
++
++ for (xcc = 0; xcc < num_xcc; xcc++) {
++ get_xcc_mqd(mqd_mem_obj, &xcc_mqd_mem_obj, offset * xcc);
++ restore_mqd(mm, (void **)&m,
++ &xcc_mqd_mem_obj,
++ NULL,
++ qp,
++ (uint8_t *)mqd_src + xcc * sizeof(*m),
++ (uint8_t *)ctl_stack_src + xcc * mqd_ctl_stack_size,
++ mqd_ctl_stack_size);
+ }
+ }
+ static int destroy_mqd_v9_4_3(struct mqd_manager *mm, void *mqd,
+@@ -906,7 +946,6 @@ struct mqd_manager *mqd_manager_init_v9(
+ mqd->free_mqd = kfd_free_mqd_cp;
+ mqd->is_occupied = kfd_is_occupied_cp;
+ mqd->get_checkpoint_info = get_checkpoint_info;
+- mqd->checkpoint_mqd = checkpoint_mqd;
+ mqd->mqd_size = sizeof(struct v9_mqd);
+ mqd->mqd_stride = mqd_stride_v9;
+ #if defined(CONFIG_DEBUG_FS)
+@@ -918,16 +957,18 @@ struct mqd_manager *mqd_manager_init_v9(
+ mqd->init_mqd = init_mqd_v9_4_3;
+ mqd->load_mqd = load_mqd_v9_4_3;
+ mqd->update_mqd = update_mqd_v9_4_3;
+- mqd->restore_mqd = restore_mqd_v9_4_3;
+ mqd->destroy_mqd = destroy_mqd_v9_4_3;
+ mqd->get_wave_state = get_wave_state_v9_4_3;
++ mqd->checkpoint_mqd = checkpoint_mqd_v9_4_3;
++ mqd->restore_mqd = restore_mqd_v9_4_3;
+ } else {
+ mqd->init_mqd = init_mqd;
+ mqd->load_mqd = load_mqd;
+ mqd->update_mqd = update_mqd;
+- mqd->restore_mqd = restore_mqd;
+ mqd->destroy_mqd = kfd_destroy_mqd_cp;
+ mqd->get_wave_state = get_wave_state;
++ mqd->checkpoint_mqd = checkpoint_mqd;
++ mqd->restore_mqd = restore_mqd;
+ }
+ break;
+ case KFD_MQD_TYPE_HIQ:
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
+@@ -914,7 +914,10 @@ static int criu_checkpoint_queues_device
+
+ q_data = (struct kfd_criu_queue_priv_data *)q_private_data;
+
+- /* data stored in this order: priv_data, mqd, ctl_stack */
++ /*
++ * data stored in this order:
++ * priv_data, mqd[xcc0], mqd[xcc1],..., ctl_stack[xcc0], ctl_stack[xcc1]...
++ */
+ q_data->mqd_size = mqd_size;
+ q_data->ctl_stack_size = ctl_stack_size;
+
+@@ -963,7 +966,7 @@ int kfd_criu_checkpoint_queues(struct kf
+ }
+
+ static void set_queue_properties_from_criu(struct queue_properties *qp,
+- struct kfd_criu_queue_priv_data *q_data)
++ struct kfd_criu_queue_priv_data *q_data, uint32_t num_xcc)
+ {
+ qp->is_interop = false;
+ qp->queue_percent = q_data->q_percent;
+@@ -976,7 +979,11 @@ static void set_queue_properties_from_cr
+ qp->eop_ring_buffer_size = q_data->eop_ring_buffer_size;
+ qp->ctx_save_restore_area_address = q_data->ctx_save_restore_area_address;
+ qp->ctx_save_restore_area_size = q_data->ctx_save_restore_area_size;
+- qp->ctl_stack_size = q_data->ctl_stack_size;
++ if (q_data->type == KFD_QUEUE_TYPE_COMPUTE)
++ qp->ctl_stack_size = q_data->ctl_stack_size / num_xcc;
++ else
++ qp->ctl_stack_size = q_data->ctl_stack_size;
++
+ qp->type = q_data->type;
+ qp->format = q_data->format;
+ }
+@@ -1036,12 +1043,15 @@ int kfd_criu_restore_queue(struct kfd_pr
+ goto exit;
+ }
+
+- /* data stored in this order: mqd, ctl_stack */
++ /*
++ * data stored in this order:
++ * mqd[xcc0], mqd[xcc1],..., ctl_stack[xcc0], ctl_stack[xcc1]...
++ */
+ mqd = q_extra_data;
+ ctl_stack = mqd + q_data->mqd_size;
+
+ memset(&qp, 0, sizeof(qp));
+- set_queue_properties_from_criu(&qp, q_data);
++ set_queue_properties_from_criu(&qp, q_data, NUM_XCC(pdd->dev->adev->gfx.xcc_mask));
+
+ print_queue_properties(&qp);
+
--- /dev/null
+From ccfb15b8158c11a8304204aeac354c7b1cfb18a3 Mon Sep 17 00:00:00 2001
+From: "Vodapalli, Ravi Kumar" <ravi.kumar.vodapalli@intel.com>
+Date: Fri, 4 Jul 2025 16:05:27 +0530
+Subject: drm/xe/bmg: Add one additional PCI ID
+
+From: Vodapalli, Ravi Kumar <ravi.kumar.vodapalli@intel.com>
+
+commit ccfb15b8158c11a8304204aeac354c7b1cfb18a3 upstream.
+
+One additional PCI ID is added in Bspec for BMG, Add it so that
+driver recognizes this device with this new ID.
+
+Bspec: 68090
+Cc: stable@vger.kernel.org # v6.12+
+Signed-off-by: Vodapalli, Ravi Kumar <ravi.kumar.vodapalli@intel.com>
+Reviewed-by: Shekhar Chauhan <shekhar.chauhan@intel.com>
+Acked-by: Matthew Auld <matthew.auld@intel.com>
+Signed-off-by: Matthew Auld <matthew.auld@intel.com>
+Link: https://lore.kernel.org/r/20250704103527.100178-1-ravi.kumar.vodapalli@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/drm/intel/pciids.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/drm/intel/pciids.h
++++ b/include/drm/intel/pciids.h
+@@ -846,6 +846,7 @@
+ /* BMG */
+ #define INTEL_BMG_IDS(MACRO__, ...) \
+ MACRO__(0xE202, ## __VA_ARGS__), \
++ MACRO__(0xE209, ## __VA_ARGS__), \
+ MACRO__(0xE20B, ## __VA_ARGS__), \
+ MACRO__(0xE20C, ## __VA_ARGS__), \
+ MACRO__(0xE20D, ## __VA_ARGS__), \
--- /dev/null
+From 2dd7a47669ae6c1da18c55f8e89c4a44418c7006 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Thomas=20Hellstr=C3=B6m?= <thomas.hellstrom@linux.intel.com>
+Date: Tue, 5 Aug 2025 09:48:42 +0200
+Subject: drm/xe: Defer buffer object shrinker write-backs and GPU waits
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+
+commit 2dd7a47669ae6c1da18c55f8e89c4a44418c7006 upstream.
+
+When the xe buffer-object shrinker allows GPU waits and write-back,
+(typically from kswapd), perform multiple passes, skipping
+subsequent passes if the shrinker number of scanned objects target
+is reached.
+
+1) Without GPU waits and write-back
+2) Without write-back
+3) With both GPU-waits and write-back
+
+This is to avoid stalls and costly write- and readbacks unless they
+are really necessary.
+
+v2:
+- Don't test for scan completion twice. (Stuart Summers)
+- Update tags.
+
+Reported-by: melvyn <melvyn2@dnsense.pub>
+Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/5557
+Cc: Summers Stuart <stuart.summers@intel.com>
+Fixes: 00c8efc3180f ("drm/xe: Add a shrinker for xe bos")
+Cc: <stable@vger.kernel.org> # v6.15+
+Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Reviewed-by: Stuart Summers <stuart.summers@intel.com>
+Link: https://lore.kernel.org/r/20250805074842.11359-1-thomas.hellstrom@linux.intel.com
+(cherry picked from commit 80944d334182ce5eb27d00e2bf20a88bfc32dea1)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/xe_shrinker.c | 51 +++++++++++++++++++++++++++++++++++----
+ 1 file changed, 47 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/xe/xe_shrinker.c
++++ b/drivers/gpu/drm/xe/xe_shrinker.c
+@@ -53,10 +53,10 @@ xe_shrinker_mod_pages(struct xe_shrinker
+ write_unlock(&shrinker->lock);
+ }
+
+-static s64 xe_shrinker_walk(struct xe_device *xe,
+- struct ttm_operation_ctx *ctx,
+- const struct xe_bo_shrink_flags flags,
+- unsigned long to_scan, unsigned long *scanned)
++static s64 __xe_shrinker_walk(struct xe_device *xe,
++ struct ttm_operation_ctx *ctx,
++ const struct xe_bo_shrink_flags flags,
++ unsigned long to_scan, unsigned long *scanned)
+ {
+ unsigned int mem_type;
+ s64 freed = 0, lret;
+@@ -86,6 +86,48 @@ static s64 xe_shrinker_walk(struct xe_de
+ return freed;
+ }
+
++/*
++ * Try shrinking idle objects without writeback first, then if not sufficient,
++ * try also non-idle objects and finally if that's not sufficient either,
++ * add writeback. This avoids stalls and explicit writebacks with light or
++ * moderate memory pressure.
++ */
++static s64 xe_shrinker_walk(struct xe_device *xe,
++ struct ttm_operation_ctx *ctx,
++ const struct xe_bo_shrink_flags flags,
++ unsigned long to_scan, unsigned long *scanned)
++{
++ bool no_wait_gpu = true;
++ struct xe_bo_shrink_flags save_flags = flags;
++ s64 lret, freed;
++
++ swap(no_wait_gpu, ctx->no_wait_gpu);
++ save_flags.writeback = false;
++ lret = __xe_shrinker_walk(xe, ctx, save_flags, to_scan, scanned);
++ swap(no_wait_gpu, ctx->no_wait_gpu);
++ if (lret < 0 || *scanned >= to_scan)
++ return lret;
++
++ freed = lret;
++ if (!ctx->no_wait_gpu) {
++ lret = __xe_shrinker_walk(xe, ctx, save_flags, to_scan, scanned);
++ if (lret < 0)
++ return lret;
++ freed += lret;
++ if (*scanned >= to_scan)
++ return freed;
++ }
++
++ if (flags.writeback) {
++ lret = __xe_shrinker_walk(xe, ctx, flags, to_scan, scanned);
++ if (lret < 0)
++ return lret;
++ freed += lret;
++ }
++
++ return freed;
++}
++
+ static unsigned long
+ xe_shrinker_count(struct shrinker *shrink, struct shrink_control *sc)
+ {
+@@ -192,6 +234,7 @@ static unsigned long xe_shrinker_scan(st
+ runtime_pm = xe_shrinker_runtime_pm_get(shrinker, true, 0, can_backup);
+
+ shrink_flags.purge = false;
++
+ lret = xe_shrinker_walk(shrinker->xe, &ctx, shrink_flags,
+ nr_to_scan, &nr_scanned);
+ if (lret >= 0)
--- /dev/null
+From caf2055487694b6cb52f2ecb161c6c5de660dd72 Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Date: Fri, 9 May 2025 14:08:50 +0530
+Subject: media: iris: Avoid updating frame size to firmware during reconfig
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+commit caf2055487694b6cb52f2ecb161c6c5de660dd72 upstream.
+
+During reconfig, the firmware sends the resolution aligned to 8 bytes.
+If the driver sends the same resolution back to the firmware the resolution
+will be aligned to 16 bytes not 8.
+
+The alignment mismatch would then subsequently cause the firmware to
+send another redundant sequence change event.
+
+Fix this by not setting the resolution property during reconfig.
+
+Cc: stable@vger.kernel.org
+Fixes: 3a19d7b9e08b ("media: iris: implement set properties to firmware during streamon")
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-HDK
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Vikash Garodia <quic_vgarodia@quicinc.com> # on sa8775p-ride
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c | 15 ++++++++-------
+ drivers/media/platform/qcom/iris/iris_state.c | 2 +-
+ drivers/media/platform/qcom/iris/iris_state.h | 1 +
+ 3 files changed, 10 insertions(+), 8 deletions(-)
+
+--- a/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c
++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c
+@@ -546,14 +546,15 @@ static int iris_hfi_gen1_set_resolution(
+ struct hfi_framesize fs;
+ int ret;
+
+- fs.buffer_type = HFI_BUFFER_INPUT;
+- fs.width = inst->fmt_src->fmt.pix_mp.width;
+- fs.height = inst->fmt_src->fmt.pix_mp.height;
+-
+- ret = hfi_gen1_set_property(inst, ptype, &fs, sizeof(fs));
+- if (ret)
+- return ret;
++ if (!iris_drc_pending(inst)) {
++ fs.buffer_type = HFI_BUFFER_INPUT;
++ fs.width = inst->fmt_src->fmt.pix_mp.width;
++ fs.height = inst->fmt_src->fmt.pix_mp.height;
+
++ ret = hfi_gen1_set_property(inst, ptype, &fs, sizeof(fs));
++ if (ret)
++ return ret;
++ }
+ fs.buffer_type = HFI_BUFFER_OUTPUT2;
+ fs.width = inst->fmt_dst->fmt.pix_mp.width;
+ fs.height = inst->fmt_dst->fmt.pix_mp.height;
+--- a/drivers/media/platform/qcom/iris/iris_state.c
++++ b/drivers/media/platform/qcom/iris/iris_state.c
+@@ -245,7 +245,7 @@ int iris_inst_sub_state_change_pause(str
+ return iris_inst_change_sub_state(inst, 0, set_sub_state);
+ }
+
+-static inline bool iris_drc_pending(struct iris_inst *inst)
++bool iris_drc_pending(struct iris_inst *inst)
+ {
+ return inst->sub_state & IRIS_INST_SUB_DRC &&
+ inst->sub_state & IRIS_INST_SUB_DRC_LAST;
+--- a/drivers/media/platform/qcom/iris/iris_state.h
++++ b/drivers/media/platform/qcom/iris/iris_state.h
+@@ -140,5 +140,6 @@ int iris_inst_sub_state_change_drain_las
+ int iris_inst_sub_state_change_drc_last(struct iris_inst *inst);
+ int iris_inst_sub_state_change_pause(struct iris_inst *inst, u32 plane);
+ bool iris_allow_cmd(struct iris_inst *inst, u32 cmd);
++bool iris_drc_pending(struct iris_inst *inst);
+
+ #endif
--- /dev/null
+From f3516f856d1f11d9dff7d72491d474a2bae1cf8e Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Date: Fri, 9 May 2025 14:08:51 +0530
+Subject: media: iris: Drop port check for session property response
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+commit f3516f856d1f11d9dff7d72491d474a2bae1cf8e upstream.
+
+Currently, port check enforces that session property response must
+arrive only on the BITSTREAM port. However, firmware can send some
+responses on other port as well.
+
+Remove the strict port validation to correctly handle session property
+responses from the firmware.
+
+Cc: stable@vger.kernel.org
+Fixes: 3a19d7b9e08b ("media: iris: implement set properties to firmware during streamon")
+Acked-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-HDK
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Vikash Garodia <quic_vgarodia@quicinc.com> # on sa8775p-ride
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c b/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c
+index b75a01641d5d..d1a2a497a7b2 100644
+--- a/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c
++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c
+@@ -636,9 +636,6 @@ static int iris_hfi_gen2_handle_session_property(struct iris_inst *inst,
+ {
+ struct iris_inst_hfi_gen2 *inst_hfi_gen2 = to_iris_inst_hfi_gen2(inst);
+
+- if (pkt->port != HFI_PORT_BITSTREAM)
+- return 0;
+-
+ if (pkt->flags & HFI_FW_FLAGS_INFORMATION)
+ return 0;
+
+--
+2.50.1
+
--- /dev/null
+From 91c6d55b477e1b66578c268214e915dff9f5ea57 Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Date: Fri, 9 May 2025 14:08:59 +0530
+Subject: media: iris: Fix buffer preparation failure during resolution change
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+commit 91c6d55b477e1b66578c268214e915dff9f5ea57 upstream.
+
+When the resolution changes, the driver internally updates the width and
+height, but the client continue to queue buffers with the older
+resolution until the last flag is received. This results in a mismatch
+when the buffers are prepared, causing failure due to outdated size.
+
+Introduce a check to prevent size validation during buffer preparation
+if a resolution reconfiguration is in progress, to handle this.
+
+Cc: stable@vger.kernel.org
+Fixes: 17f2a485ca67 ("media: iris: implement vb2 ops for buf_queue and firmware response")
+Reviewed-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-HDK
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Vikash Garodia <quic_vgarodia@quicinc.com> # on sa8775p-ride
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_vb2.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/iris/iris_vb2.c b/drivers/media/platform/qcom/iris/iris_vb2.c
+index cdf11feb590b..b3bde10eb6d2 100644
+--- a/drivers/media/platform/qcom/iris/iris_vb2.c
++++ b/drivers/media/platform/qcom/iris/iris_vb2.c
+@@ -259,13 +259,14 @@ int iris_vb2_buf_prepare(struct vb2_buffer *vb)
+ return -EINVAL;
+ }
+
+- if (vb->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE &&
+- vb2_plane_size(vb, 0) < iris_get_buffer_size(inst, BUF_OUTPUT))
+- return -EINVAL;
+- if (vb->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE &&
+- vb2_plane_size(vb, 0) < iris_get_buffer_size(inst, BUF_INPUT))
+- return -EINVAL;
+-
++ if (!(inst->sub_state & IRIS_INST_SUB_DRC)) {
++ if (vb->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE &&
++ vb2_plane_size(vb, 0) < iris_get_buffer_size(inst, BUF_OUTPUT))
++ return -EINVAL;
++ if (vb->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE &&
++ vb2_plane_size(vb, 0) < iris_get_buffer_size(inst, BUF_INPUT))
++ return -EINVAL;
++ }
+ return 0;
+ }
+
+--
+2.50.1
+
--- /dev/null
+From c314a28cdabe45f050fe7bd403ddeaf4b9c960d1 Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Date: Fri, 9 May 2025 14:08:55 +0530
+Subject: media: iris: Fix missing function pointer initialization
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+commit c314a28cdabe45f050fe7bd403ddeaf4b9c960d1 upstream.
+
+The function pointers responsible for setting firmware properties were
+never initialized in the instance capability structure, causing it to
+remain NULL. As a result, the firmware properties were not being set
+correctly.
+
+Fix this by properly assigning the function pointers from the core
+capability to the instance capability, ensuring that the properties are
+correctly applied to the firmware.
+
+Cc: stable@vger.kernel.org
+Fixes: 3a19d7b9e08b ("media: iris: implement set properties to firmware during streamon")
+Acked-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-HDK
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Vikash Garodia <quic_vgarodia@quicinc.com> # on sa8775p-ride
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_ctrls.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/platform/qcom/iris/iris_ctrls.c
++++ b/drivers/media/platform/qcom/iris/iris_ctrls.c
+@@ -163,6 +163,7 @@ void iris_session_init_caps(struct iris_
+ core->inst_fw_caps[cap_id].value = caps[i].value;
+ core->inst_fw_caps[cap_id].flags = caps[i].flags;
+ core->inst_fw_caps[cap_id].hfi_id = caps[i].hfi_id;
++ core->inst_fw_caps[cap_id].set = caps[i].set;
+ }
+ }
+
--- /dev/null
+From 0f837559ccdd275c5a059e6ac4d5034b03409f1d Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Date: Fri, 9 May 2025 14:08:56 +0530
+Subject: media: iris: Fix NULL pointer dereference
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+commit 0f837559ccdd275c5a059e6ac4d5034b03409f1d upstream.
+
+A warning reported by smatch indicated a possible null pointer
+dereference where one of the arguments to API
+"iris_hfi_gen2_handle_system_error" could sometimes be null.
+
+To fix this, add a check to validate that the argument passed is not
+null before accessing its members.
+
+Cc: stable@vger.kernel.org
+Fixes: fb583a214337 ("media: iris: introduce host firmware interface with necessary hooks")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/linux-media/634cc9b8-f099-4b54-8556-d879fb2b5169@stanley.mountain/
+Acked-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-HDK
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Vikash Garodia <quic_vgarodia@quicinc.com> # on sa8775p-ride
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c b/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c
+index d1a2a497a7b2..4488540d1d41 100644
+--- a/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c
++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c
+@@ -265,7 +265,8 @@ static int iris_hfi_gen2_handle_system_error(struct iris_core *core,
+ {
+ struct iris_inst *instance;
+
+- dev_err(core->dev, "received system error of type %#x\n", pkt->type);
++ if (pkt)
++ dev_err(core->dev, "received system error of type %#x\n", pkt->type);
+
+ core->state = IRIS_CORE_ERROR;
+
+--
+2.50.1
+
--- /dev/null
+From 58edc8a68de7af45a4c815636595daa530f02c13 Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Date: Fri, 9 May 2025 14:08:57 +0530
+Subject: media: iris: Fix typo in depth variable
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+commit 58edc8a68de7af45a4c815636595daa530f02c13 upstream.
+
+Correct a typo from "dpeth" to "depth".
+
+Cc: stable@vger.kernel.org
+Fixes: 3a19d7b9e08b ("media: iris: implement set properties to firmware during streamon")
+Acked-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-HDK
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Vikash Garodia <quic_vgarodia@quicinc.com> # on sa8775p-ride
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_hfi_gen2_command.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen2_command.c b/drivers/media/platform/qcom/iris/iris_hfi_gen2_command.c
+index a908b41e2868..802fa62c26eb 100644
+--- a/drivers/media/platform/qcom/iris/iris_hfi_gen2_command.c
++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen2_command.c
+@@ -178,7 +178,7 @@ static int iris_hfi_gen2_set_crop_offsets(struct iris_inst *inst)
+ sizeof(u64));
+ }
+
+-static int iris_hfi_gen2_set_bit_dpeth(struct iris_inst *inst)
++static int iris_hfi_gen2_set_bit_depth(struct iris_inst *inst)
+ {
+ struct iris_inst_hfi_gen2 *inst_hfi_gen2 = to_iris_inst_hfi_gen2(inst);
+ u32 port = iris_hfi_gen2_get_port(V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE);
+@@ -378,7 +378,7 @@ static int iris_hfi_gen2_session_set_config_params(struct iris_inst *inst, u32 p
+ {HFI_PROP_BITSTREAM_RESOLUTION, iris_hfi_gen2_set_bitstream_resolution },
+ {HFI_PROP_CROP_OFFSETS, iris_hfi_gen2_set_crop_offsets },
+ {HFI_PROP_CODED_FRAMES, iris_hfi_gen2_set_coded_frames },
+- {HFI_PROP_LUMA_CHROMA_BIT_DEPTH, iris_hfi_gen2_set_bit_dpeth },
++ {HFI_PROP_LUMA_CHROMA_BIT_DEPTH, iris_hfi_gen2_set_bit_depth },
+ {HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT, iris_hfi_gen2_set_min_output_count },
+ {HFI_PROP_PIC_ORDER_CNT_TYPE, iris_hfi_gen2_set_picture_order_count },
+ {HFI_PROP_SIGNAL_COLOR_INFO, iris_hfi_gen2_set_colorspace },
+--
+2.50.1
+
--- /dev/null
+From 2781662dee7bbb9675e5440f5dff4e3991dc5624 Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Date: Fri, 9 May 2025 14:08:52 +0530
+Subject: media: iris: Prevent HFI queue writes when core is in deinit state
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+commit 2781662dee7bbb9675e5440f5dff4e3991dc5624 upstream.
+
+The current check only considers the core error state before allowing
+writes to the HFI queues. However, the core can also transition to the
+deinit state due to a system error triggered by the response thread.
+In such cases, writing to the HFI queues should not be allowed.
+
+Fix this by adding a check for the core deinit state, ensuring that
+writes are rejected when core is not in a valid state.
+
+Cc: stable@vger.kernel.org
+Fixes: fb583a214337 ("media: iris: introduce host firmware interface with necessary hooks")
+Acked-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-HDK
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Tested-by: Vikash Garodia <quic_vgarodia@quicinc.com> # on sa8775p-ride
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_hfi_queue.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/platform/qcom/iris/iris_hfi_queue.c
++++ b/drivers/media/platform/qcom/iris/iris_hfi_queue.c
+@@ -113,7 +113,7 @@ int iris_hfi_queue_cmd_write_locked(stru
+ {
+ struct iris_iface_q_info *q_info = &core->command_queue;
+
+- if (core->state == IRIS_CORE_ERROR)
++ if (core->state == IRIS_CORE_ERROR || core->state == IRIS_CORE_DEINIT)
+ return -EINVAL;
+
+ if (!iris_hfi_queue_write(q_info, pkt, pkt_size)) {
--- /dev/null
+From a693b4a3e7a95c010bedef4c8b3122bd8b0961b7 Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Date: Fri, 9 May 2025 14:08:54 +0530
+Subject: media: iris: Remove deprecated property setting to firmware
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+commit a693b4a3e7a95c010bedef4c8b3122bd8b0961b7 upstream.
+
+HFI_PROPERTY_CONFIG_VDEC_POST_LOOP_DEBLOCKER is deprecated and no longer
+supported on current firmware, remove setting the same to firmware.
+
+Cc: stable@vger.kernel.org
+Fixes: 79865252acb6 ("media: iris: enable video driver probe of SM8250 SoC")
+Acked-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-HDK
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Vikash Garodia <quic_vgarodia@quicinc.com> # on sa8775p-ride
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_ctrls.c | 4 ----
+ drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c | 8 --------
+ drivers/media/platform/qcom/iris/iris_hfi_gen1_defines.h | 1 -
+ drivers/media/platform/qcom/iris/iris_platform_common.h | 2 +-
+ drivers/media/platform/qcom/iris/iris_platform_sm8250.c | 9 ---------
+ 5 files changed, 1 insertion(+), 23 deletions(-)
+
+--- a/drivers/media/platform/qcom/iris/iris_ctrls.c
++++ b/drivers/media/platform/qcom/iris/iris_ctrls.c
+@@ -17,8 +17,6 @@ static inline bool iris_valid_cap_id(enu
+ static enum platform_inst_fw_cap_type iris_get_cap_id(u32 id)
+ {
+ switch (id) {
+- case V4L2_CID_MPEG_VIDEO_DECODER_MPEG4_DEBLOCK_FILTER:
+- return DEBLOCK;
+ case V4L2_CID_MPEG_VIDEO_H264_PROFILE:
+ return PROFILE;
+ case V4L2_CID_MPEG_VIDEO_H264_LEVEL:
+@@ -34,8 +32,6 @@ static u32 iris_get_v4l2_id(enum platfor
+ return 0;
+
+ switch (cap_id) {
+- case DEBLOCK:
+- return V4L2_CID_MPEG_VIDEO_DECODER_MPEG4_DEBLOCK_FILTER;
+ case PROFILE:
+ return V4L2_CID_MPEG_VIDEO_H264_PROFILE;
+ case LEVEL:
+--- a/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c
++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c
+@@ -490,14 +490,6 @@ iris_hfi_gen1_packet_session_set_propert
+ packet->shdr.hdr.size += sizeof(u32) + sizeof(*wm);
+ break;
+ }
+- case HFI_PROPERTY_CONFIG_VDEC_POST_LOOP_DEBLOCKER: {
+- struct hfi_enable *en = prop_data;
+- u32 *in = pdata;
+-
+- en->enable = *in;
+- packet->shdr.hdr.size += sizeof(u32) + sizeof(*en);
+- break;
+- }
+ default:
+ return -EINVAL;
+ }
+--- a/drivers/media/platform/qcom/iris/iris_hfi_gen1_defines.h
++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen1_defines.h
+@@ -65,7 +65,6 @@
+
+ #define HFI_PROPERTY_CONFIG_BUFFER_REQUIREMENTS 0x202001
+
+-#define HFI_PROPERTY_CONFIG_VDEC_POST_LOOP_DEBLOCKER 0x1200001
+ #define HFI_PROPERTY_PARAM_VDEC_DPB_COUNTS 0x120300e
+ #define HFI_PROPERTY_CONFIG_VDEC_ENTROPY 0x1204004
+
+--- a/drivers/media/platform/qcom/iris/iris_platform_common.h
++++ b/drivers/media/platform/qcom/iris/iris_platform_common.h
+@@ -89,7 +89,7 @@ enum platform_inst_fw_cap_type {
+ CODED_FRAMES,
+ BIT_DEPTH,
+ RAP_FRAME,
+- DEBLOCK,
++ TIER,
+ INST_FW_CAP_MAX,
+ };
+
+--- a/drivers/media/platform/qcom/iris/iris_platform_sm8250.c
++++ b/drivers/media/platform/qcom/iris/iris_platform_sm8250.c
+@@ -30,15 +30,6 @@ static struct platform_inst_fw_cap inst_
+ .hfi_id = HFI_PROPERTY_PARAM_WORK_MODE,
+ .set = iris_set_stage,
+ },
+- {
+- .cap_id = DEBLOCK,
+- .min = 0,
+- .max = 1,
+- .step_or_mask = 1,
+- .value = 0,
+- .hfi_id = HFI_PROPERTY_CONFIG_VDEC_POST_LOOP_DEBLOCKER,
+- .set = iris_set_u32,
+- },
+ };
+
+ static struct platform_inst_caps platform_inst_cap_sm8250 = {
--- /dev/null
+From 03e29ab0e94831fcca2f62c96121fd14263b399b Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Date: Fri, 9 May 2025 14:08:53 +0530
+Subject: media: iris: Remove error check for non-zero v4l2 controls
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+commit 03e29ab0e94831fcca2f62c96121fd14263b399b upstream.
+
+Remove the check for non-zero number of v4l2 controls as some SOCs might
+not expose any capability which requires v4l2 control.
+
+Cc: stable@vger.kernel.org
+Fixes: 33be1dde17e3 ("media: iris: implement iris v4l2_ctrl_ops")
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-HDK
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Vikash Garodia <quic_vgarodia@quicinc.com> # on sa8775p-ride
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_ctrls.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/media/platform/qcom/iris/iris_ctrls.c
++++ b/drivers/media/platform/qcom/iris/iris_ctrls.c
+@@ -80,8 +80,6 @@ int iris_ctrls_init(struct iris_inst *in
+ if (iris_get_v4l2_id(cap[idx].cap_id))
+ num_ctrls++;
+ }
+- if (!num_ctrls)
+- return -EINVAL;
+
+ /* Adding 1 to num_ctrls to include V4L2_CID_MIN_BUFFERS_FOR_CAPTURE */
+
--- /dev/null
+From b7a898184e74a8261c34f1265139ac1799ee4e1c Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Date: Fri, 9 May 2025 14:09:02 +0530
+Subject: media: iris: Remove unnecessary re-initialization of flush completion
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+commit b7a898184e74a8261c34f1265139ac1799ee4e1c upstream.
+
+Currently, The flush completion signal is being re-initialized even
+though no response is expected during a sequence change.
+
+Simplify the code by removing re-initialization of flush completion
+signal as it is redundant.
+
+Cc: stable@vger.kernel.org
+Fixes: 84e17adae3e3 ("media: iris: add support for dynamic resolution change")
+Acked-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-HDK
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Vikash Garodia <quic_vgarodia@quicinc.com> # on sa8775p-ride
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c b/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c
+index aaad32a70b9e..c8c0aa23536b 100644
+--- a/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c
++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c
+@@ -201,7 +201,6 @@ static void iris_hfi_gen1_event_seq_changed(struct iris_inst *inst,
+ iris_hfi_gen1_read_changed_params(inst, pkt);
+
+ if (inst->state != IRIS_INST_ERROR && !(inst->sub_state & IRIS_INST_SUB_FIRST_IPSC)) {
+- reinit_completion(&inst->flush_completion);
+
+ flush_pkt.shdr.hdr.size = sizeof(struct hfi_session_flush_pkt);
+ flush_pkt.shdr.hdr.pkt_type = HFI_CMD_SESSION_FLUSH;
+--
+2.50.1
+
--- /dev/null
+From 7adc11e6abf619d0bb0c05918d5da5b9d4bcb81e Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Date: Fri, 9 May 2025 14:09:00 +0530
+Subject: media: iris: Send V4L2_BUF_FLAG_ERROR for capture buffers with 0 filled length
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+commit 7adc11e6abf619d0bb0c05918d5da5b9d4bcb81e upstream.
+
+Firmware sends capture buffers with 0 filled length which are not to be
+displayed and should be dropped by client.
+To achieve the same, add V4L2_BUF_FLAG_ERROR to such buffers by making
+sure:
+- These 0 length buffers are not returned as result of flush.
+- Its not a buffer with LAST flag enabled which will also have 0 filled
+ length.
+
+Cc: stable@vger.kernel.org
+Fixes: d09100763bed ("media: iris: add support for drain sequence")
+Acked-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-HDK
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Vikash Garodia <quic_vgarodia@quicinc.com> # on sa8775p-ride
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c b/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c
+index 4488540d1d41..d2cede2fe1b5 100644
+--- a/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c
++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c
+@@ -378,6 +378,11 @@ static int iris_hfi_gen2_handle_output_buffer(struct iris_inst *inst,
+
+ buf->flags = iris_hfi_gen2_get_driver_buffer_flags(inst, hfi_buffer->flags);
+
++ if (!buf->data_size && inst->state == IRIS_INST_STREAMING &&
++ !(hfi_buffer->flags & HFI_BUF_FW_FLAG_LAST)) {
++ buf->flags |= V4L2_BUF_FLAG_ERROR;
++ }
++
+ return 0;
+ }
+
+--
+2.50.1
+
--- /dev/null
+From 7c452ffda30c0460c568273993a3d3c611486467 Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Date: Fri, 9 May 2025 14:08:47 +0530
+Subject: media: iris: Skip destroying internal buffer if not dequeued
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+commit 7c452ffda30c0460c568273993a3d3c611486467 upstream.
+
+Firmware might hold the DPB buffers for reference in case of sequence
+change, so skip destroying buffers for which QUEUED flag is not removed.
+
+Cc: stable@vger.kernel.org
+Fixes: 73702f45db81 ("media: iris: allocate, initialize and queue internal buffers")
+Reviewed-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-HDK
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Vikash Garodia <quic_vgarodia@quicinc.com> # on sa8775p-ride
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_buffer.c | 20 +++++++++++++++++++-
+ drivers/media/platform/qcom/iris/iris_buffer.h | 3 ++-
+ drivers/media/platform/qcom/iris/iris_vdec.c | 4 ++--
+ drivers/media/platform/qcom/iris/iris_vidc.c | 4 ++--
+ 4 files changed, 25 insertions(+), 6 deletions(-)
+
+--- a/drivers/media/platform/qcom/iris/iris_buffer.c
++++ b/drivers/media/platform/qcom/iris/iris_buffer.c
+@@ -376,7 +376,7 @@ int iris_destroy_internal_buffer(struct
+ return 0;
+ }
+
+-int iris_destroy_internal_buffers(struct iris_inst *inst, u32 plane)
++static int iris_destroy_internal_buffers(struct iris_inst *inst, u32 plane, bool force)
+ {
+ const struct iris_platform_data *platform_data = inst->core->iris_platform_data;
+ struct iris_buffer *buf, *next;
+@@ -396,6 +396,14 @@ int iris_destroy_internal_buffers(struct
+ for (i = 0; i < len; i++) {
+ buffers = &inst->buffers[internal_buf_type[i]];
+ list_for_each_entry_safe(buf, next, &buffers->list, list) {
++ /*
++ * during stream on, skip destroying internal(DPB) buffer
++ * if firmware did not return it.
++ * during close, destroy all buffers irrespectively.
++ */
++ if (!force && buf->attr & BUF_ATTR_QUEUED)
++ continue;
++
+ ret = iris_destroy_internal_buffer(inst, buf);
+ if (ret)
+ return ret;
+@@ -405,6 +413,16 @@ int iris_destroy_internal_buffers(struct
+ return 0;
+ }
+
++int iris_destroy_all_internal_buffers(struct iris_inst *inst, u32 plane)
++{
++ return iris_destroy_internal_buffers(inst, plane, true);
++}
++
++int iris_destroy_dequeued_internal_buffers(struct iris_inst *inst, u32 plane)
++{
++ return iris_destroy_internal_buffers(inst, plane, false);
++}
++
+ static int iris_release_internal_buffers(struct iris_inst *inst,
+ enum iris_buffer_type buffer_type)
+ {
+--- a/drivers/media/platform/qcom/iris/iris_buffer.h
++++ b/drivers/media/platform/qcom/iris/iris_buffer.h
+@@ -106,7 +106,8 @@ void iris_get_internal_buffers(struct ir
+ int iris_create_internal_buffers(struct iris_inst *inst, u32 plane);
+ int iris_queue_internal_buffers(struct iris_inst *inst, u32 plane);
+ int iris_destroy_internal_buffer(struct iris_inst *inst, struct iris_buffer *buffer);
+-int iris_destroy_internal_buffers(struct iris_inst *inst, u32 plane);
++int iris_destroy_all_internal_buffers(struct iris_inst *inst, u32 plane);
++int iris_destroy_dequeued_internal_buffers(struct iris_inst *inst, u32 plane);
+ int iris_alloc_and_queue_persist_bufs(struct iris_inst *inst);
+ int iris_alloc_and_queue_input_int_bufs(struct iris_inst *inst);
+ int iris_queue_buffer(struct iris_inst *inst, struct iris_buffer *buf);
+--- a/drivers/media/platform/qcom/iris/iris_vdec.c
++++ b/drivers/media/platform/qcom/iris/iris_vdec.c
+@@ -408,7 +408,7 @@ int iris_vdec_streamon_input(struct iris
+
+ iris_get_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE);
+
+- ret = iris_destroy_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE);
++ ret = iris_destroy_dequeued_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE);
+ if (ret)
+ return ret;
+
+@@ -496,7 +496,7 @@ int iris_vdec_streamon_output(struct iri
+
+ iris_get_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
+
+- ret = iris_destroy_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
++ ret = iris_destroy_dequeued_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
+ if (ret)
+ return ret;
+
+--- a/drivers/media/platform/qcom/iris/iris_vidc.c
++++ b/drivers/media/platform/qcom/iris/iris_vidc.c
+@@ -233,8 +233,8 @@ int iris_close(struct file *filp)
+ iris_session_close(inst);
+ iris_inst_change_state(inst, IRIS_INST_DEINIT);
+ iris_v4l2_fh_deinit(inst);
+- iris_destroy_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE);
+- iris_destroy_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
++ iris_destroy_all_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE);
++ iris_destroy_all_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
+ iris_remove_session(inst);
+ mutex_unlock(&inst->lock);
+ mutex_destroy(&inst->ctx_q_lock);
--- /dev/null
+From 1e27e9ffce59ac41cde71673d74eb368a533cdb2 Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Date: Fri, 9 May 2025 14:09:01 +0530
+Subject: media: iris: Skip flush on first sequence change
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+commit 1e27e9ffce59ac41cde71673d74eb368a533cdb2 upstream.
+
+Add a condition to skip the flush operation during the first sequence
+change event. At this point, the capture queue is not streaming, making
+the flush unnecessary.
+
+Cc: stable@vger.kernel.org
+Fixes: 84e17adae3e3 ("media: iris: add support for dynamic resolution change")
+Acked-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-HDK
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Vikash Garodia <quic_vgarodia@quicinc.com> # on sa8775p-ride
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c b/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c
+index 271e14469223..aaad32a70b9e 100644
+--- a/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c
++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c
+@@ -200,7 +200,7 @@ static void iris_hfi_gen1_event_seq_changed(struct iris_inst *inst,
+
+ iris_hfi_gen1_read_changed_params(inst, pkt);
+
+- if (inst->state != IRIS_INST_ERROR) {
++ if (inst->state != IRIS_INST_ERROR && !(inst->sub_state & IRIS_INST_SUB_FIRST_IPSC)) {
+ reinit_completion(&inst->flush_completion);
+
+ flush_pkt.shdr.hdr.size = sizeof(struct hfi_session_flush_pkt);
+--
+2.50.1
+
--- /dev/null
+From 9bf58db157139abcd60e425e5718c8e6a917f9dc Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Date: Fri, 9 May 2025 14:08:58 +0530
+Subject: media: iris: Track flush responses to prevent premature completion
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+commit 9bf58db157139abcd60e425e5718c8e6a917f9dc upstream.
+
+Currently, two types of flush commands are queued to the firmware,
+the first flush queued as part of sequence change, does not wait for a
+response, while the second flush queued as part of stop, expects a
+completion response before proceeding further.
+
+Due to timing issue, the flush response corresponding to the first
+command could arrive after the second flush is issued. This casuses the
+driver to incorrectly assume that the second flush has completed,
+leading to the premature signaling of flush_completion.
+
+To address this, introduce a counter to track the number of pending
+flush responses and signal flush completion only when all expected
+responses are received.
+
+Cc: stable@vger.kernel.org
+Fixes: 11712ce70f8e ("media: iris: implement vb2 streaming ops")
+Reviewed-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-HDK
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Vikash Garodia <quic_vgarodia@quicinc.com> # on sa8775p-ride
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c | 4 ++-
+ drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c | 17 +++++++++-----
+ drivers/media/platform/qcom/iris/iris_instance.h | 2 +
+ 3 files changed, 16 insertions(+), 7 deletions(-)
+
+--- a/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c
++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c
+@@ -208,8 +208,10 @@ static int iris_hfi_gen1_session_stop(st
+ flush_pkt.flush_type = flush_type;
+
+ ret = iris_hfi_queue_cmd_write(core, &flush_pkt, flush_pkt.shdr.hdr.size);
+- if (!ret)
++ if (!ret) {
++ inst->flush_responses_pending++;
+ ret = iris_wait_for_session_response(inst, true);
++ }
+ }
+
+ return ret;
+--- a/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c
++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c
+@@ -207,7 +207,8 @@ static void iris_hfi_gen1_event_seq_chan
+ flush_pkt.shdr.hdr.pkt_type = HFI_CMD_SESSION_FLUSH;
+ flush_pkt.shdr.session_id = inst->session_id;
+ flush_pkt.flush_type = HFI_FLUSH_OUTPUT;
+- iris_hfi_queue_cmd_write(inst->core, &flush_pkt, flush_pkt.shdr.hdr.size);
++ if (!iris_hfi_queue_cmd_write(inst->core, &flush_pkt, flush_pkt.shdr.hdr.size))
++ inst->flush_responses_pending++;
+ }
+
+ iris_vdec_src_change(inst);
+@@ -408,7 +409,9 @@ static void iris_hfi_gen1_session_ftb_do
+ flush_pkt.shdr.hdr.pkt_type = HFI_CMD_SESSION_FLUSH;
+ flush_pkt.shdr.session_id = inst->session_id;
+ flush_pkt.flush_type = HFI_FLUSH_OUTPUT;
+- iris_hfi_queue_cmd_write(core, &flush_pkt, flush_pkt.shdr.hdr.size);
++ if (!iris_hfi_queue_cmd_write(core, &flush_pkt, flush_pkt.shdr.hdr.size))
++ inst->flush_responses_pending++;
++
+ iris_inst_sub_state_change_drain_last(inst);
+
+ return;
+@@ -564,7 +567,6 @@ static void iris_hfi_gen1_handle_respons
+ const struct iris_hfi_gen1_response_pkt_info *pkt_info;
+ struct device *dev = core->dev;
+ struct hfi_session_pkt *pkt;
+- struct completion *done;
+ struct iris_inst *inst;
+ bool found = false;
+ u32 i;
+@@ -625,9 +627,12 @@ static void iris_hfi_gen1_handle_respons
+ if (shdr->error_type != HFI_ERR_NONE)
+ iris_inst_change_state(inst, IRIS_INST_ERROR);
+
+- done = pkt_info->pkt == HFI_MSG_SESSION_FLUSH ?
+- &inst->flush_completion : &inst->completion;
+- complete(done);
++ if (pkt_info->pkt == HFI_MSG_SESSION_FLUSH) {
++ if (!(--inst->flush_responses_pending))
++ complete(&inst->flush_completion);
++ } else {
++ complete(&inst->completion);
++ }
+ }
+ mutex_unlock(&inst->lock);
+
+--- a/drivers/media/platform/qcom/iris/iris_instance.h
++++ b/drivers/media/platform/qcom/iris/iris_instance.h
+@@ -27,6 +27,7 @@
+ * @crop: structure of crop info
+ * @completion: structure of signal completions
+ * @flush_completion: structure of signal completions for flush cmd
++ * @flush_responses_pending: counter to track number of pending flush responses
+ * @fw_caps: array of supported instance firmware capabilities
+ * @buffers: array of different iris buffers
+ * @fw_min_count: minimnum count of buffers needed by fw
+@@ -57,6 +58,7 @@ struct iris_inst {
+ struct iris_hfi_rect_desc crop;
+ struct completion completion;
+ struct completion flush_completion;
++ u32 flush_responses_pending;
+ struct platform_inst_fw_cap fw_caps[INST_FW_CAP_MAX];
+ struct iris_buffers buffers[BUF_TYPE_MAX];
+ u32 fw_min_count;
--- /dev/null
+From 8aadfd445373b74de4a5cd36736843ae01856636 Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Date: Fri, 9 May 2025 14:08:49 +0530
+Subject: media: iris: Update CAPTURE format info based on OUTPUT format
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+commit 8aadfd445373b74de4a5cd36736843ae01856636 upstream.
+
+Update the width, height and buffer size of CAPTURE based on the
+resolution set to OUTPUT via VIDIOC_S_FMT. This is required to set the
+updated capture resolution to firmware when S_FMT is called only for
+OUTPUT.
+
+Cc: stable@vger.kernel.org
+Fixes: b530b95de22c ("media: iris: implement s_fmt, g_fmt and try_fmt ioctls")
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Acked-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-HDK
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Vikash Garodia <quic_vgarodia@quicinc.com> # on sa8775p-ride
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_vdec.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/media/platform/qcom/iris/iris_vdec.c b/drivers/media/platform/qcom/iris/iris_vdec.c
+index 9c049b9671cc..d342f733feb9 100644
+--- a/drivers/media/platform/qcom/iris/iris_vdec.c
++++ b/drivers/media/platform/qcom/iris/iris_vdec.c
+@@ -171,6 +171,11 @@ int iris_vdec_s_fmt(struct iris_inst *inst, struct v4l2_format *f)
+ output_fmt->fmt.pix_mp.ycbcr_enc = f->fmt.pix_mp.ycbcr_enc;
+ output_fmt->fmt.pix_mp.quantization = f->fmt.pix_mp.quantization;
+
++ /* Update capture format based on new ip w/h */
++ output_fmt->fmt.pix_mp.width = ALIGN(f->fmt.pix_mp.width, 128);
++ output_fmt->fmt.pix_mp.height = ALIGN(f->fmt.pix_mp.height, 32);
++ inst->buffers[BUF_OUTPUT].size = iris_get_buffer_size(inst, BUF_OUTPUT);
++
+ inst->crop.left = 0;
+ inst->crop.top = 0;
+ inst->crop.width = f->fmt.pix_mp.width;
+--
+2.50.1
+
--- /dev/null
+From d2abb1ff5a3c13321d407ee19865d0d8d834c7c6 Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Date: Fri, 9 May 2025 14:08:48 +0530
+Subject: media: iris: Verify internal buffer release on close
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+commit d2abb1ff5a3c13321d407ee19865d0d8d834c7c6 upstream.
+
+Validate all internal buffers queued to firmware are released back to
+driver on close. This helps ensure buffer lifecycle correctness and aids
+in debugging any resporce leaks.
+
+Cc: stable@vger.kernel.org
+Fixes: 73702f45db81 ("media: iris: allocate, initialize and queue internal buffers")
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-HDK
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Vikash Garodia <quic_vgarodia@quicinc.com> # on sa8775p-ride
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_vidc.c | 29 ++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
+
+diff --git a/drivers/media/platform/qcom/iris/iris_vidc.c b/drivers/media/platform/qcom/iris/iris_vidc.c
+index 663f5602b5ad..a8144595cc78 100644
+--- a/drivers/media/platform/qcom/iris/iris_vidc.c
++++ b/drivers/media/platform/qcom/iris/iris_vidc.c
+@@ -221,6 +221,33 @@ static void iris_session_close(struct iris_inst *inst)
+ iris_wait_for_session_response(inst, false);
+ }
+
++static void iris_check_num_queued_internal_buffers(struct iris_inst *inst, u32 plane)
++{
++ const struct iris_platform_data *platform_data = inst->core->iris_platform_data;
++ struct iris_buffer *buf, *next;
++ struct iris_buffers *buffers;
++ const u32 *internal_buf_type;
++ u32 internal_buffer_count, i;
++ u32 count = 0;
++
++ if (V4L2_TYPE_IS_OUTPUT(plane)) {
++ internal_buf_type = platform_data->dec_ip_int_buf_tbl;
++ internal_buffer_count = platform_data->dec_ip_int_buf_tbl_size;
++ } else {
++ internal_buf_type = platform_data->dec_op_int_buf_tbl;
++ internal_buffer_count = platform_data->dec_op_int_buf_tbl_size;
++ }
++
++ for (i = 0; i < internal_buffer_count; i++) {
++ buffers = &inst->buffers[internal_buf_type[i]];
++ list_for_each_entry_safe(buf, next, &buffers->list, list)
++ count++;
++ if (count)
++ dev_err(inst->core->dev, "%d buffer of type %d not released",
++ count, internal_buf_type[i]);
++ }
++}
++
+ int iris_close(struct file *filp)
+ {
+ struct iris_inst *inst = iris_get_inst(filp, NULL);
+@@ -235,6 +262,8 @@ int iris_close(struct file *filp)
+ iris_v4l2_fh_deinit(inst);
+ iris_destroy_all_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE);
+ iris_destroy_all_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
++ iris_check_num_queued_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE);
++ iris_check_num_queued_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
+ iris_remove_session(inst);
+ mutex_unlock(&inst->lock);
+ mutex_destroy(&inst->ctx_q_lock);
+--
+2.50.1
+
--- /dev/null
+From 69080ec3d0daba8a894025476c98ab16b5a505a4 Mon Sep 17 00:00:00 2001
+From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Date: Tue, 13 May 2025 17:23:45 +0300
+Subject: media: qcom: camss: cleanup media device allocated resource on error path
+
+From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+
+commit 69080ec3d0daba8a894025476c98ab16b5a505a4 upstream.
+
+A call to media_device_init() requires media_device_cleanup() counterpart
+to complete cleanup and release any allocated resources.
+
+This has been done in the driver .remove() right from the beginning, but
+error paths on .probe() shall also be fixed.
+
+Fixes: a1d7c116fcf7 ("media: camms: Add core files")
+Cc: stable@vger.kernel.org
+Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/camss/camss.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/platform/qcom/camss/camss.c
++++ b/drivers/media/platform/qcom/camss/camss.c
+@@ -3625,7 +3625,7 @@ static int camss_probe(struct platform_d
+ ret = v4l2_device_register(camss->dev, &camss->v4l2_dev);
+ if (ret < 0) {
+ dev_err(dev, "Failed to register V4L2 device: %d\n", ret);
+- goto err_genpd_cleanup;
++ goto err_media_device_cleanup;
+ }
+
+ v4l2_async_nf_init(&camss->notifier, &camss->v4l2_dev);
+@@ -3680,6 +3680,8 @@ err_v4l2_device_unregister:
+ v4l2_device_unregister(&camss->v4l2_dev);
+ v4l2_async_nf_cleanup(&camss->notifier);
+ pm_runtime_disable(dev);
++err_media_device_cleanup:
++ media_device_cleanup(&camss->media_dev);
+ err_genpd_cleanup:
+ camss_genpd_cleanup(camss);
+
--- /dev/null
+From 868423c834a29981fe3a77d32caf645c6b91a4c5 Mon Sep 17 00:00:00 2001
+From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Date: Thu, 12 Jun 2025 09:07:15 +0100
+Subject: media: qcom: camss: csiphy-3ph: Fix inadvertent dropping of SDM660/SDM670 phy init
+
+From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+
+commit 868423c834a29981fe3a77d32caf645c6b91a4c5 upstream.
+
+The moving of init sequence hook from gen2() to subdev_init() doesn't
+account for gen1 devices such as SDM660 and SDM670. The switch should find
+the right offset for gen2 PHYs only, not reject gen1. Remove the default
+error case to restore gen1 CSIPHY support.
+
+Cc: stable@vger.kernel.org
+Fixes: fbce0ca24c3a ("media: qcom: camss: csiphy-3ph: Move CSIPHY variables to data field inside csiphy struct")
+Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c b/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c
+index f732a76de93e..88c0ba495c32 100644
+--- a/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c
++++ b/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c
+@@ -849,8 +849,7 @@ static int csiphy_init(struct csiphy_device *csiphy)
+ regs->offset = 0x1000;
+ break;
+ default:
+- WARN(1, "unknown csiphy version\n");
+- return -ENODEV;
++ break;
+ }
+
+ return 0;
+--
+2.50.1
+
--- /dev/null
+From c26e8dcd9d4e86d788c5bf7a5dd0ea70a95ab067 Mon Sep 17 00:00:00 2001
+From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Date: Thu, 26 Jun 2025 02:24:33 +0100
+Subject: media: qcom: camss: Remove extraneous -supply postfix on supply names
+
+From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+
+commit c26e8dcd9d4e86d788c5bf7a5dd0ea70a95ab067 upstream.
+
+The -supply postfix is wrong but wasn't noticed on the CRD devices or
+indeed the Dell devices, however on Lenovo devices the error comes up.
+
+Fixes: 1830cf0f56c3 ("media: qcom: camss: Add x1e80100 specific support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+[bod: reworded commit log per Konrad's feedback]
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/camss/camss.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c
+index e1d64c8f42ae..e08e70b93824 100644
+--- a/drivers/media/platform/qcom/camss/camss.c
++++ b/drivers/media/platform/qcom/camss/camss.c
+@@ -2486,8 +2486,8 @@ static const struct resources_icc icc_res_sm8550[] = {
+ static const struct camss_subdev_resources csiphy_res_x1e80100[] = {
+ /* CSIPHY0 */
+ {
+- .regulators = { "vdd-csiphy-0p8-supply",
+- "vdd-csiphy-1p2-supply" },
++ .regulators = { "vdd-csiphy-0p8",
++ "vdd-csiphy-1p2" },
+ .clock = { "csiphy0", "csiphy0_timer" },
+ .clock_rate = { { 300000000, 400000000, 480000000 },
+ { 266666667, 400000000 } },
+@@ -2501,8 +2501,8 @@ static const struct camss_subdev_resources csiphy_res_x1e80100[] = {
+ },
+ /* CSIPHY1 */
+ {
+- .regulators = { "vdd-csiphy-0p8-supply",
+- "vdd-csiphy-1p2-supply" },
++ .regulators = { "vdd-csiphy-0p8",
++ "vdd-csiphy-1p2" },
+ .clock = { "csiphy1", "csiphy1_timer" },
+ .clock_rate = { { 300000000, 400000000, 480000000 },
+ { 266666667, 400000000 } },
+@@ -2516,8 +2516,8 @@ static const struct camss_subdev_resources csiphy_res_x1e80100[] = {
+ },
+ /* CSIPHY2 */
+ {
+- .regulators = { "vdd-csiphy-0p8-supply",
+- "vdd-csiphy-1p2-supply" },
++ .regulators = { "vdd-csiphy-0p8",
++ "vdd-csiphy-1p2" },
+ .clock = { "csiphy2", "csiphy2_timer" },
+ .clock_rate = { { 300000000, 400000000, 480000000 },
+ { 266666667, 400000000 } },
+@@ -2531,8 +2531,8 @@ static const struct camss_subdev_resources csiphy_res_x1e80100[] = {
+ },
+ /* CSIPHY4 */
+ {
+- .regulators = { "vdd-csiphy-0p8-supply",
+- "vdd-csiphy-1p2-supply" },
++ .regulators = { "vdd-csiphy-0p8",
++ "vdd-csiphy-1p2" },
+ .clock = { "csiphy4", "csiphy4_timer" },
+ .clock_rate = { { 300000000, 400000000, 480000000 },
+ { 266666667, 400000000 } },
+--
+2.50.1
+
--- /dev/null
+From 49befc830daa743e051a65468c05c2ff9e8580e6 Mon Sep 17 00:00:00 2001
+From: Vedang Nagar <quic_vnagar@quicinc.com>
+Date: Mon, 19 May 2025 12:42:21 +0530
+Subject: media: venus: Add a check for packet size after reading from shared memory
+
+From: Vedang Nagar <quic_vnagar@quicinc.com>
+
+commit 49befc830daa743e051a65468c05c2ff9e8580e6 upstream.
+
+Add a check to ensure that the packet size does not exceed the number of
+available words after reading the packet header from shared memory. This
+ensures that the size provided by the firmware is safe to process and
+prevent potential out-of-bounds memory access.
+
+Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files")
+Cc: stable@vger.kernel.org
+Signed-off-by: Vedang Nagar <quic_vnagar@quicinc.com>
+Co-developed-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/venus/hfi_venus.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/media/platform/qcom/venus/hfi_venus.c
++++ b/drivers/media/platform/qcom/venus/hfi_venus.c
+@@ -239,6 +239,7 @@ static int venus_write_queue(struct venu
+ static int venus_read_queue(struct venus_hfi_device *hdev,
+ struct iface_queue *queue, void *pkt, u32 *tx_req)
+ {
++ struct hfi_pkt_hdr *pkt_hdr = NULL;
+ struct hfi_queue_header *qhdr;
+ u32 dwords, new_rd_idx;
+ u32 rd_idx, wr_idx, type, qsize;
+@@ -304,6 +305,9 @@ static int venus_read_queue(struct venus
+ memcpy(pkt, rd_ptr, len);
+ memcpy(pkt + len, queue->qmem.kva, new_rd_idx << 2);
+ }
++ pkt_hdr = (struct hfi_pkt_hdr *)(pkt);
++ if ((pkt_hdr->size >> 2) != dwords)
++ return -EINVAL;
+ } else {
+ /* bad packet received, dropping */
+ new_rd_idx = qhdr->write_idx;
--- /dev/null
+From ee3b94f22638e0f7a1893d95d87b08698b680052 Mon Sep 17 00:00:00 2001
+From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Date: Sat, 31 May 2025 14:22:00 +0200
+Subject: media: venus: Fix MSM8998 frequency table
+
+From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+
+commit ee3b94f22638e0f7a1893d95d87b08698b680052 upstream.
+
+Fill in the correct data for the production SKU.
+
+Fixes: 193b3dac29a4 ("media: venus: add msm8998 support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Reviewed-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/venus/core.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/platform/qcom/venus/core.c
++++ b/drivers/media/platform/qcom/venus/core.c
+@@ -709,11 +709,11 @@ static const struct venus_resources msm8
+ };
+
+ static const struct freq_tbl msm8998_freq_table[] = {
+- { 1944000, 465000000 }, /* 4k UHD @ 60 (decode only) */
+- { 972000, 465000000 }, /* 4k UHD @ 30 */
+- { 489600, 360000000 }, /* 1080p @ 60 */
+- { 244800, 186000000 }, /* 1080p @ 30 */
+- { 108000, 100000000 }, /* 720p @ 30 */
++ { 1728000, 533000000 }, /* 4k UHD @ 60 (decode only) */
++ { 1036800, 444000000 }, /* 2k @ 120 */
++ { 829440, 355200000 }, /* 4k @ 44 */
++ { 489600, 269330000 },/* 4k @ 30 */
++ { 108000, 200000000 }, /* 1080p @ 60 */
+ };
+
+ static const struct reg_val msm8998_reg_preset[] = {
--- /dev/null
+From 640803003cd903cea73dc6a86bf6963e238e2b3f Mon Sep 17 00:00:00 2001
+From: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
+Date: Thu, 19 Jun 2025 09:48:30 +0200
+Subject: media: venus: hfi: explicitly release IRQ during teardown
+
+From: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
+
+commit 640803003cd903cea73dc6a86bf6963e238e2b3f upstream.
+
+Ensure the IRQ is disabled - and all pending handlers completed - before
+dismantling the interrupt routing and clearing related pointers.
+
+This prevents any possibility of the interrupt triggering after the
+handler context has been invalidated.
+
+Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
+Reviewed-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Dikshita Agarwal <quic_dikshita@quicinc.com> # RB5
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/venus/hfi_venus.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/platform/qcom/venus/hfi_venus.c
++++ b/drivers/media/platform/qcom/venus/hfi_venus.c
+@@ -1682,6 +1682,7 @@ void venus_hfi_destroy(struct venus_core
+ venus_interface_queues_release(hdev);
+ mutex_destroy(&hdev->lock);
+ kfree(hdev);
++ disable_irq(core->irq);
+ core->ops = NULL;
+ }
+
--- /dev/null
+From 3200144a2fa4209dc084a19941b9b203b43580f0 Mon Sep 17 00:00:00 2001
+From: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
+Date: Fri, 6 Jun 2025 17:25:22 +0200
+Subject: media: venus: protect against spurious interrupts during probe
+
+From: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
+
+commit 3200144a2fa4209dc084a19941b9b203b43580f0 upstream.
+
+Make sure the interrupt handler is initialized before the interrupt is
+registered.
+
+If the IRQ is registered before hfi_create(), it's possible that an
+interrupt fires before the handler setup is complete, leading to a NULL
+dereference.
+
+This error condition has been observed during system boot on Rb3Gen2.
+
+Fixes: af2c3834c8ca ("[media] media: venus: adding core part and helper functions")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Reviewed-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Reviewed-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Dikshita Agarwal <quic_dikshita@quicinc.com> # RB5
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/venus/core.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/platform/qcom/venus/core.c
++++ b/drivers/media/platform/qcom/venus/core.c
+@@ -424,13 +424,13 @@ static int venus_probe(struct platform_d
+ INIT_DELAYED_WORK(&core->work, venus_sys_error_handler);
+ init_waitqueue_head(&core->sys_err_done);
+
+- ret = devm_request_threaded_irq(dev, core->irq, hfi_isr, venus_isr_thread,
+- IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
+- "venus", core);
++ ret = hfi_create(core, &venus_core_ops);
+ if (ret)
+ goto err_core_put;
+
+- ret = hfi_create(core, &venus_core_ops);
++ ret = devm_request_threaded_irq(dev, core->irq, hfi_isr, venus_isr_thread,
++ IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
++ "venus", core);
+ if (ret)
+ goto err_core_put;
+
--- /dev/null
+From 377dc500d253f0b26732b2cb062e89668aef890a Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda <ribalda@chromium.org>
+Date: Mon, 16 Jun 2025 15:29:14 +0000
+Subject: media: venus: vdec: Clamp param smaller than 1fps and bigger than 240.
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+commit 377dc500d253f0b26732b2cb062e89668aef890a upstream.
+
+The driver uses "whole" fps in all its calculations (e.g. in
+load_per_instance()). Those calculation expect an fps bigger than 1, and
+not big enough to overflow.
+
+Clamp the value if the user provides a param that will result in an invalid
+fps.
+
+Reported-by: Hans Verkuil <hverkuil@xs4all.nl>
+Closes: https://lore.kernel.org/linux-media/f11653a7-bc49-48cd-9cdb-1659147453e4@xs4all.nl/T/#m91cd962ac942834654f94c92206e2f85ff7d97f0
+Fixes: 7472c1c69138 ("[media] media: venus: vdec: add video decoder files")
+Cc: stable@vger.kernel.org
+Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> # qrb5615-rb5
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+[bod: Change "parm" to "param"]
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/venus/core.h | 2 ++
+ drivers/media/platform/qcom/venus/vdec.c | 5 ++---
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/platform/qcom/venus/core.h
++++ b/drivers/media/platform/qcom/venus/core.h
+@@ -28,6 +28,8 @@
+ #define VIDC_RESETS_NUM_MAX 2
+ #define VIDC_MAX_HIER_CODING_LAYER 6
+
++#define VENUS_MAX_FPS 240
++
+ extern int venus_fw_debug;
+
+ struct freq_tbl {
+--- a/drivers/media/platform/qcom/venus/vdec.c
++++ b/drivers/media/platform/qcom/venus/vdec.c
+@@ -481,11 +481,10 @@ static int vdec_s_parm(struct file *file
+ us_per_frame = timeperframe->numerator * (u64)USEC_PER_SEC;
+ do_div(us_per_frame, timeperframe->denominator);
+
+- if (!us_per_frame)
+- return -EINVAL;
+-
++ us_per_frame = clamp(us_per_frame, 1, USEC_PER_SEC);
+ fps = (u64)USEC_PER_SEC;
+ do_div(fps, us_per_frame);
++ fps = min(VENUS_MAX_FPS, fps);
+
+ inst->fps = fps;
+ inst->timeperframe = *timeperframe;
--- /dev/null
+From 417c01b92ec278a1118a05c6ad8a796eaa0c9c52 Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda <ribalda@chromium.org>
+Date: Mon, 16 Jun 2025 15:29:15 +0000
+Subject: media: venus: venc: Clamp param smaller than 1fps and bigger than 240
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+commit 417c01b92ec278a1118a05c6ad8a796eaa0c9c52 upstream.
+
+The driver uses "whole" fps in all its calculations (e.g. in
+load_per_instance()). Those calculation expect an fps bigger than 1, and
+not big enough to overflow.
+
+Clamp the param if the user provides a value that will result in an invalid
+fps.
+
+Reported-by: Hans Verkuil <hverkuil@xs4all.nl>
+Closes: https://lore.kernel.org/linux-media/f11653a7-bc49-48cd-9cdb-1659147453e4@xs4all.nl/T/#m91cd962ac942834654f94c92206e2f85ff7d97f0
+Fixes: aaaa93eda64b ("[media] media: venus: venc: add video encoder files")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+[bod: Change "parm" to "param"]
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/venus/venc.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/platform/qcom/venus/venc.c
++++ b/drivers/media/platform/qcom/venus/venc.c
+@@ -411,11 +411,10 @@ static int venc_s_parm(struct file *file
+ us_per_frame = timeperframe->numerator * (u64)USEC_PER_SEC;
+ do_div(us_per_frame, timeperframe->denominator);
+
+- if (!us_per_frame)
+- return -EINVAL;
+-
++ us_per_frame = clamp(us_per_frame, 1, USEC_PER_SEC);
+ fps = (u64)USEC_PER_SEC;
+ do_div(fps, us_per_frame);
++ fps = min(VENUS_MAX_FPS, fps);
+
+ inst->timeperframe = *timeperframe;
+ inst->fps = fps;
media-ov2659-fix-memory-leaks-in-ov2659_probe.patch
media-mt9m114-fix-deadlock-in-get_frame_interval-set_frame_interval.patch
media-ivsc-fix-crash-at-shutdown-due-to-missing-mei_cldev_disable-calls.patch
+media-qcom-camss-csiphy-3ph-fix-inadvertent-dropping-of-sdm660-sdm670-phy-init.patch
+media-qcom-camss-cleanup-media-device-allocated-resource-on-error-path.patch
+media-qcom-camss-remove-extraneous-supply-postfix-on-supply-names.patch
+media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch
+media-venus-fix-msm8998-frequency-table.patch
+media-venus-hfi-explicitly-release-irq-during-teardown.patch
+media-venus-protect-against-spurious-interrupts-during-probe.patch
+media-venus-vdec-clamp-param-smaller-than-1fps-and-bigger-than-240.patch
+media-venus-venc-clamp-param-smaller-than-1fps-and-bigger-than-240.patch
+media-iris-avoid-updating-frame-size-to-firmware-during-reconfig.patch
+media-iris-drop-port-check-for-session-property-response.patch
+media-iris-fix-buffer-preparation-failure-during-resolution-change.patch
+media-iris-fix-missing-function-pointer-initialization.patch
+media-iris-fix-null-pointer-dereference.patch
+media-iris-fix-typo-in-depth-variable.patch
+media-iris-prevent-hfi-queue-writes-when-core-is-in-deinit-state.patch
+media-iris-remove-deprecated-property-setting-to-firmware.patch
+media-iris-remove-error-check-for-non-zero-v4l2-controls.patch
+media-iris-send-v4l2_buf_flag_error-for-capture-buffers-with-0-filled-length.patch
+media-iris-skip-destroying-internal-buffer-if-not-dequeued.patch
+media-iris-skip-flush-on-first-sequence-change.patch
+media-iris-track-flush-responses-to-prevent-premature-completion.patch
+media-iris-update-capture-format-info-based-on-output-format.patch
+media-iris-verify-internal-buffer-release-on-close.patch
+media-iris-remove-unnecessary-re-initialization-of-flush-completion.patch
+drm-xe-bmg-add-one-additional-pci-id.patch
+drm-xe-defer-buffer-object-shrinker-write-backs-and-gpu-waits.patch
+drm-amd-amdgpu-fix-missing-lock-for-cper.ring-rptr-wptr-access.patch
+drm-amdgpu-discovery-fix-fw-based-ip-discovery.patch
+drm-amd-restore-cached-power-limit-during-resume.patch
+drm-amdgpu-add-kicker-fws-loading-for-gfx12-smu14-psp14.patch
+drm-amdgpu-add-missing-vram-lost-check-for-legacy-reset.patch
+drm-amdgpu-avoid-extra-evict-restore-process.patch
+drm-amdgpu-check-if-hubbub-is-null-in-debugfs-amdgpu_dm_capabilities.patch
+drm-amdgpu-initialize-data-to-null-in-imu_v12_0_program_rlc_ram.patch
+drm-amdgpu-retain-job-vm-in-amdgpu_job_prepare_job.patch
+drm-amdgpu-track-whether-a-queue-is-a-kernel-queue-in-amdgpu_mqd_prop.patch
+drm-amdgpu-update-external-revid-for-gc-v9.5.0.patch
+drm-amdgpu-update-mmhub-3.0.1-client-id-mappings.patch
+drm-amdgpu-update-mmhub-3.3-client-id-mappings.patch
+drm-amdgpu-update-mmhub-4.1.0-client-id-mappings.patch
+drm-amdgpu-update-supported-modes-for-gc-v9.5.0.patch
+drm-amdkfd-destroy-kfd-debugfs-after-destroy-kfd-wq.patch
+drm-amdkfd-fix-checkpoint-restore-on-multi-xcc.patch
+drm-amd-display-add-primary-plane-to-commits-for-correct-vrr-handling.patch
+drm-amd-display-fix-a-null-pointer-dereference-vulnerability.patch
+drm-amd-display-fix-dce-6.0-and-6.4-pll-programming.patch
+drm-amd-display-fix-initial-backlight-brightness-calculation.patch
+drm-amd-display-pass-up-errors-for-reset-gpu-that-fails-to-init-hw.patch
+drm-amd-display-revert-drm-amd-display-fix-amdgpu_max_bl_level-value.patch
+drm-amd-display-don-t-overwrite-dce60_clk_mgr.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
