--- /dev/null
+From 3477c1b0972dc1c8a46f78e8fb1fa6966095b5ec Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <mdaenzer@redhat.com>
+Date: Wed, 30 Jul 2025 10:09:02 +0200
+Subject: drm/amd/display: Add primary plane to commits for correct VRR handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michel Dänzer <mdaenzer@redhat.com>
+
+commit 3477c1b0972dc1c8a46f78e8fb1fa6966095b5ec upstream.
+
+amdgpu_dm_commit_planes calls update_freesync_state_on_stream only for
+the primary plane. If a commit affects a CRTC but not its primary plane,
+it would previously not trigger a refresh cycle or affect LFC, violating
+current UAPI semantics.
+
+Fixes e.g. atomic commits affecting only the cursor plane being limited
+to the minimum refresh rate.
+
+Don't do this for the legacy cursor ioctls though, it would break the
+UAPI semantics for those.
+
+Suggested-by: Xaver Hugl <xaver.hugl@kde.org>
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3034
+Signed-off-by: Michel Dänzer <mdaenzer@redhat.com>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit cc7bfba95966251b254cb970c21627124da3b7f4)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
+@@ -664,6 +664,15 @@ static int amdgpu_dm_crtc_helper_atomic_
+ return -EINVAL;
+ }
+
++ if (!state->legacy_cursor_update && amdgpu_dm_crtc_vrr_active(dm_crtc_state)) {
++ struct drm_plane_state *primary_state;
++
++ /* Pull in primary plane for correct VRR handling */
++ primary_state = drm_atomic_get_plane_state(state, crtc->primary);
++ if (IS_ERR(primary_state))
++ return PTR_ERR(primary_state);
++ }
++
+ /* In some use cases, like reset, no stream is attached */
+ if (!dm_crtc_state->stream)
+ return 0;
--- /dev/null
+From 4db9cd554883e051df1840d4d58d636043101034 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Timur=20Krist=C3=B3f?= <timur.kristof@gmail.com>
+Date: Tue, 22 Jul 2025 17:58:29 +0200
+Subject: drm/amd/display: Don't overwrite dce60_clk_mgr
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+commit 4db9cd554883e051df1840d4d58d636043101034 upstream.
+
+dc_clk_mgr_create accidentally overwrites the dce60_clk_mgr
+with the dce_clk_mgr, causing incorrect behaviour on DCE6.
+Fix it by removing the extra dce_clk_mgr_construct.
+
+Fixes: 62eab49faae7 ("drm/amd/display: hide VGH asic specific structs")
+Reviewed-by: Rodrigo Siqueira <siqueira@igalia.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit bbddcbe36a686af03e91341b9bbfcca94bd45fb6)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c
+@@ -158,7 +158,6 @@ struct clk_mgr *dc_clk_mgr_create(struct
+ return NULL;
+ }
+ dce60_clk_mgr_construct(ctx, clk_mgr);
+- dce_clk_mgr_construct(ctx, clk_mgr);
+ return &clk_mgr->base;
+ }
+ #endif
--- /dev/null
+From 1bcf63a44381691d6192872801f830ce3250e367 Mon Sep 17 00:00:00 2001
+From: Siyang Liu <Security@tencent.com>
+Date: Fri, 4 Jul 2025 11:16:22 +0800
+Subject: drm/amd/display: fix a Null pointer dereference vulnerability
+
+From: Siyang Liu <Security@tencent.com>
+
+commit 1bcf63a44381691d6192872801f830ce3250e367 upstream.
+
+[Why]
+A null pointer dereference vulnerability exists in the AMD display driver's
+(DC module) cleanup function dc_destruct().
+When display control context (dc->ctx) construction fails
+(due to memory allocation failure), this pointer remains NULL.
+During subsequent error handling when dc_destruct() is called,
+there's no NULL check before dereferencing the perf_trace member
+(dc->ctx->perf_trace), causing a kernel null pointer dereference crash.
+
+[How]
+Check if dc->ctx is non-NULL before dereferencing.
+
+Link: https://lore.kernel.org/r/tencent_54FF4252EDFB6533090A491A25EEF3EDBF06@qq.com
+Co-developed-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+(Updated commit text and removed unnecessary error message)
+Signed-off-by: Siyang Liu <Security@tencent.com>
+Signed-off-by: Roman Li <roman.li@amd.com>
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 9dd8e2ba268c636c240a918e0a31e6feaee19404)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -890,17 +890,18 @@ static void dc_destruct(struct dc *dc)
+ if (dc->link_srv)
+ link_destroy_link_service(&dc->link_srv);
+
+- if (dc->ctx->gpio_service)
+- dal_gpio_service_destroy(&dc->ctx->gpio_service);
++ if (dc->ctx) {
++ if (dc->ctx->gpio_service)
++ dal_gpio_service_destroy(&dc->ctx->gpio_service);
+
+- if (dc->ctx->created_bios)
+- dal_bios_parser_destroy(&dc->ctx->dc_bios);
++ if (dc->ctx->created_bios)
++ dal_bios_parser_destroy(&dc->ctx->dc_bios);
++ kfree(dc->ctx->logger);
++ dc_perf_trace_destroy(&dc->ctx->perf_trace);
+
+- kfree(dc->ctx->logger);
+- dc_perf_trace_destroy(&dc->ctx->perf_trace);
+-
+- kfree(dc->ctx);
+- dc->ctx = NULL;
++ kfree(dc->ctx);
++ dc->ctx = NULL;
++ }
+
+ kfree(dc->bw_vbios);
+ dc->bw_vbios = NULL;
--- /dev/null
+From ed4efe426a49729952b3dc05d20e33b94409bdd1 Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <mario.limonciello@amd.com>
+Date: Thu, 24 Jul 2025 22:12:21 -0500
+Subject: drm/amd: Restore cached power limit during resume
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+commit ed4efe426a49729952b3dc05d20e33b94409bdd1 upstream.
+
+The power limit will be cached in smu->current_power_limit but
+if the ASIC goes into S3 this value won't be restored.
+
+Restore the value during SMU resume.
+
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Link: https://lore.kernel.org/r/20250725031222.3015095-2-superm1@kernel.org
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 26a609e053a6fc494403e95403bc6a2470383bec)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+@@ -2153,6 +2153,12 @@ static int smu_resume(void *handle)
+
+ adev->pm.dpm_enabled = true;
+
++ if (smu->current_power_limit) {
++ ret = smu_set_power_limit(smu, smu->current_power_limit);
++ if (ret && ret != -EOPNOTSUPP)
++ return ret;
++ }
++
+ dev_info(adev->dev, "SMU is resumed successfully!\n");
+
+ return 0;
--- /dev/null
+From 1f02f2044bda1db1fd995bc35961ab075fa7b5a2 Mon Sep 17 00:00:00 2001
+From: Gang Ba <Gang.Ba@amd.com>
+Date: Tue, 8 Jul 2025 14:36:13 -0400
+Subject: drm/amdgpu: Avoid extra evict-restore process.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Gang Ba <Gang.Ba@amd.com>
+
+commit 1f02f2044bda1db1fd995bc35961ab075fa7b5a2 upstream.
+
+If vm belongs to another process, this is fclose after fork,
+wait may enable signaling KFD eviction fence and cause parent process queue evicted.
+
+[677852.634569] amdkfd_fence_enable_signaling+0x56/0x70 [amdgpu]
+[677852.634814] __dma_fence_enable_signaling+0x3e/0xe0
+[677852.634820] dma_fence_wait_timeout+0x3a/0x140
+[677852.634825] amddma_resv_wait_timeout+0x7f/0xf0 [amdkcl]
+[677852.634831] amdgpu_vm_wait_idle+0x2d/0x60 [amdgpu]
+[677852.635026] amdgpu_flush+0x34/0x50 [amdgpu]
+[677852.635208] filp_flush+0x38/0x90
+[677852.635213] filp_close+0x14/0x30
+[677852.635216] do_close_on_exec+0xdd/0x130
+[677852.635221] begin_new_exec+0x1da/0x490
+[677852.635225] load_elf_binary+0x307/0xea0
+[677852.635231] ? srso_alias_return_thunk+0x5/0xfbef5
+[677852.635235] ? ima_bprm_check+0xa2/0xd0
+[677852.635240] search_binary_handler+0xda/0x260
+[677852.635245] exec_binprm+0x58/0x1a0
+[677852.635249] bprm_execve.part.0+0x16f/0x210
+[677852.635254] bprm_execve+0x45/0x80
+[677852.635257] do_execveat_common.isra.0+0x190/0x200
+
+Suggested-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Gang Ba <Gang.Ba@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+@@ -2292,13 +2292,11 @@ void amdgpu_vm_adjust_size(struct amdgpu
+ */
+ long amdgpu_vm_wait_idle(struct amdgpu_vm *vm, long timeout)
+ {
+- timeout = dma_resv_wait_timeout(vm->root.bo->tbo.base.resv,
+- DMA_RESV_USAGE_BOOKKEEP,
+- true, timeout);
++ timeout = drm_sched_entity_flush(&vm->immediate, timeout);
+ if (timeout <= 0)
+ return timeout;
+
+- return dma_fence_wait_timeout(vm->last_unlocked, true, timeout);
++ return drm_sched_entity_flush(&vm->delayed, timeout);
+ }
+
+ static void amdgpu_vm_destroy_task_info(struct kref *kref)
--- /dev/null
+From b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288 Mon Sep 17 00:00:00 2001
+From: Peter Shkenev <mustela@erminea.space>
+Date: Thu, 17 Jul 2025 23:48:17 +0300
+Subject: drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities
+
+From: Peter Shkenev <mustela@erminea.space>
+
+commit b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288 upstream.
+
+HUBBUB structure is not initialized on DCE hardware, so check if it is NULL
+to avoid null dereference while accessing amdgpu_dm_capabilities file in
+debugfs.
+
+Signed-off-by: Peter Shkenev <mustela@erminea.space>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+@@ -3932,7 +3932,7 @@ static int capabilities_show(struct seq_
+
+ struct hubbub *hubbub = dc->res_pool->hubbub;
+
+- if (hubbub->funcs->get_mall_en)
++ if (hubbub && hubbub->funcs->get_mall_en)
+ hubbub->funcs->get_mall_en(hubbub, &mall_in_use);
+
+ if (dc->cap_funcs.get_subvp_en)
--- /dev/null
+From 514678da56da089b756b4d433efd964fa22b2079 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 30 Jul 2025 11:16:05 -0400
+Subject: drm/amdgpu/discovery: fix fw based ip discovery
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 514678da56da089b756b4d433efd964fa22b2079 upstream.
+
+We only need the fw based discovery table for sysfs. No
+need to parse it. Additionally parsing some of the board
+specific tables may result in incorrect data on some boards.
+just load the binary and don't parse it on those boards.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4441
+Fixes: 80a0e8282933 ("drm/amdgpu/discovery: optionally use fw based ip discovery")
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 62eedd150fa11aefc2d377fc746633fdb1baeb55)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 5 -
+ drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 72 ++++++++++++++------------
+ 2 files changed, 41 insertions(+), 36 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -2387,9 +2387,6 @@ static int amdgpu_device_parse_gpu_info_
+
+ adev->firmware.gpu_info_fw = NULL;
+
+- if (adev->mman.discovery_bin)
+- return 0;
+-
+ switch (adev->asic_type) {
+ default:
+ return 0;
+@@ -2411,6 +2408,8 @@ static int amdgpu_device_parse_gpu_info_
+ chip_name = "arcturus";
+ break;
+ case CHIP_NAVI12:
++ if (adev->mman.discovery_bin)
++ return 0;
+ chip_name = "navi12";
+ break;
+ }
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+@@ -2455,40 +2455,11 @@ int amdgpu_discovery_set_ip_blocks(struc
+
+ switch (adev->asic_type) {
+ case CHIP_VEGA10:
+- case CHIP_VEGA12:
+- case CHIP_RAVEN:
+- case CHIP_VEGA20:
+- case CHIP_ARCTURUS:
+- case CHIP_ALDEBARAN:
+- /* this is not fatal. We have a fallback below
+- * if the new firmwares are not present. some of
+- * this will be overridden below to keep things
+- * consistent with the current behavior.
++ /* This is not fatal. We only need the discovery
++ * binary for sysfs. We don't need it for a
++ * functional system.
+ */
+- r = amdgpu_discovery_reg_base_init(adev);
+- if (!r) {
+- amdgpu_discovery_harvest_ip(adev);
+- amdgpu_discovery_get_gfx_info(adev);
+- amdgpu_discovery_get_mall_info(adev);
+- amdgpu_discovery_get_vcn_info(adev);
+- }
+- break;
+- default:
+- r = amdgpu_discovery_reg_base_init(adev);
+- if (r) {
+- drm_err(&adev->ddev, "discovery failed: %d\n", r);
+- return r;
+- }
+-
+- amdgpu_discovery_harvest_ip(adev);
+- amdgpu_discovery_get_gfx_info(adev);
+- amdgpu_discovery_get_mall_info(adev);
+- amdgpu_discovery_get_vcn_info(adev);
+- break;
+- }
+-
+- switch (adev->asic_type) {
+- case CHIP_VEGA10:
++ amdgpu_discovery_init(adev);
+ vega10_reg_base_init(adev);
+ adev->sdma.num_instances = 2;
+ adev->gmc.num_umc = 4;
+@@ -2511,6 +2482,11 @@ int amdgpu_discovery_set_ip_blocks(struc
+ adev->ip_versions[DCI_HWIP][0] = IP_VERSION(12, 0, 0);
+ break;
+ case CHIP_VEGA12:
++ /* This is not fatal. We only need the discovery
++ * binary for sysfs. We don't need it for a
++ * functional system.
++ */
++ amdgpu_discovery_init(adev);
+ vega10_reg_base_init(adev);
+ adev->sdma.num_instances = 2;
+ adev->gmc.num_umc = 4;
+@@ -2533,6 +2509,11 @@ int amdgpu_discovery_set_ip_blocks(struc
+ adev->ip_versions[DCI_HWIP][0] = IP_VERSION(12, 0, 1);
+ break;
+ case CHIP_RAVEN:
++ /* This is not fatal. We only need the discovery
++ * binary for sysfs. We don't need it for a
++ * functional system.
++ */
++ amdgpu_discovery_init(adev);
+ vega10_reg_base_init(adev);
+ adev->sdma.num_instances = 1;
+ adev->vcn.num_vcn_inst = 1;
+@@ -2572,6 +2553,11 @@ int amdgpu_discovery_set_ip_blocks(struc
+ }
+ break;
+ case CHIP_VEGA20:
++ /* This is not fatal. We only need the discovery
++ * binary for sysfs. We don't need it for a
++ * functional system.
++ */
++ amdgpu_discovery_init(adev);
+ vega20_reg_base_init(adev);
+ adev->sdma.num_instances = 2;
+ adev->gmc.num_umc = 8;
+@@ -2595,6 +2581,11 @@ int amdgpu_discovery_set_ip_blocks(struc
+ adev->ip_versions[DCI_HWIP][0] = IP_VERSION(12, 1, 0);
+ break;
+ case CHIP_ARCTURUS:
++ /* This is not fatal. We only need the discovery
++ * binary for sysfs. We don't need it for a
++ * functional system.
++ */
++ amdgpu_discovery_init(adev);
+ arct_reg_base_init(adev);
+ adev->sdma.num_instances = 8;
+ adev->vcn.num_vcn_inst = 2;
+@@ -2623,6 +2614,11 @@ int amdgpu_discovery_set_ip_blocks(struc
+ adev->ip_versions[UVD_HWIP][1] = IP_VERSION(2, 5, 0);
+ break;
+ case CHIP_ALDEBARAN:
++ /* This is not fatal. We only need the discovery
++ * binary for sysfs. We don't need it for a
++ * functional system.
++ */
++ amdgpu_discovery_init(adev);
+ aldebaran_reg_base_init(adev);
+ adev->sdma.num_instances = 5;
+ adev->vcn.num_vcn_inst = 2;
+@@ -2649,6 +2645,16 @@ int amdgpu_discovery_set_ip_blocks(struc
+ adev->ip_versions[XGMI_HWIP][0] = IP_VERSION(6, 1, 0);
+ break;
+ default:
++ r = amdgpu_discovery_reg_base_init(adev);
++ if (r) {
++ drm_err(&adev->ddev, "discovery failed: %d\n", r);
++ return r;
++ }
++
++ amdgpu_discovery_harvest_ip(adev);
++ amdgpu_discovery_get_gfx_info(adev);
++ amdgpu_discovery_get_mall_info(adev);
++ amdgpu_discovery_get_vcn_info(adev);
+ break;
+ }
+
--- /dev/null
+From c90f2e1172c51fa25492471dc9910e2d7c1444b9 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <nathan@kernel.org>
+Date: Tue, 15 Jul 2025 16:50:22 -0700
+Subject: drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram()
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+commit c90f2e1172c51fa25492471dc9910e2d7c1444b9 upstream.
+
+After a recent change in clang to expose uninitialized warnings from
+const variables and pointers [1], there is a warning in
+imu_v12_0_program_rlc_ram() because data is passed uninitialized to
+program_imu_rlc_ram():
+
+ drivers/gpu/drm/amd/amdgpu/imu_v12_0.c:374:30: error: variable 'data' is uninitialized when used here [-Werror,-Wuninitialized]
+ 374 | program_imu_rlc_ram(adev, data, (const u32)size);
+ | ^~~~
+
+As this warning happens early in clang's frontend, it does not realize
+that due to the assignment of r to -EINVAL, program_imu_rlc_ram() is
+never actually called, and even if it were, data would not be
+dereferenced because size is 0.
+
+Just initialize data to NULL to silence the warning, as the commit that
+added program_imu_rlc_ram() mentioned it would eventually be used over
+the old method, at which point data can be properly initialized and
+used.
+
+Cc: stable@vger.kernel.org
+Closes: https://github.com/ClangBuiltLinux/linux/issues/2107
+Fixes: 56159fffaab5 ("drm/amdgpu: use new method to program rlc ram")
+Link: https://github.com/llvm/llvm-project/commit/2464313eef01c5b1edf0eccf57a32cdee01472c7 [1]
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/imu_v12_0.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/imu_v12_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/imu_v12_0.c
+@@ -361,7 +361,7 @@ static void program_imu_rlc_ram(struct a
+ static void imu_v12_0_program_rlc_ram(struct amdgpu_device *adev)
+ {
+ u32 reg_data, size = 0;
+- const u32 *data;
++ const u32 *data = NULL;
+ int r = -EINVAL;
+
+ WREG32_SOC15(GC, 0, regGFX_IMU_RLC_RAM_INDEX, 0x2);
--- /dev/null
+From 05c8b690511854ba31d8d1bff7139a13ec66b9e7 Mon Sep 17 00:00:00 2001
+From: Lijo Lazar <lijo.lazar@amd.com>
+Date: Fri, 25 Jul 2025 10:21:10 +0530
+Subject: drm/amdgpu: Update external revid for GC v9.5.0
+
+From: Lijo Lazar <lijo.lazar@amd.com>
+
+commit 05c8b690511854ba31d8d1bff7139a13ec66b9e7 upstream.
+
+Use different external revid for GC v9.5.0 SOCs.
+
+Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Reviewed-by: Asad Kamal <asad.kamal@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 21c6764ed4bfaecad034bc4fd15dd64c5a436325)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/soc15.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
+@@ -1183,6 +1183,8 @@ static int soc15_common_early_init(void
+ AMD_PG_SUPPORT_JPEG;
+ /*TODO: need a new external_rev_id for GC 9.4.4? */
+ adev->external_rev_id = adev->rev_id + 0x46;
++ if (amdgpu_ip_version(adev, GC_HWIP, 0) == IP_VERSION(9, 5, 0))
++ adev->external_rev_id = adev->rev_id + 0x50;
+ break;
+ default:
+ /* FIXME: not supported yet */
--- /dev/null
+From 0bae62cc989fa99ac9cb564eb573aad916d1eb61 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 18 Jul 2025 15:52:04 -0400
+Subject: drm/amdgpu: update mmhub 3.0.1 client id mappings
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 0bae62cc989fa99ac9cb564eb573aad916d1eb61 upstream.
+
+Update the client id mapping so the correct clients
+get printed when there is a mmhub page fault.
+
+Reviewed-by: David (Ming Qiang) Wu <David.Wu3@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 2a2681eda73b99a2c1ee8cdb006099ea5d0c2505)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c | 57 ++++++++++++++++--------------
+ 1 file changed, 32 insertions(+), 25 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c
++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c
+@@ -36,40 +36,47 @@
+
+ static const char *mmhub_client_ids_v3_0_1[][2] = {
+ [0][0] = "VMC",
++ [1][0] = "ISPXT",
++ [2][0] = "ISPIXT",
+ [4][0] = "DCEDMC",
+ [5][0] = "DCEVGA",
+ [6][0] = "MP0",
+ [7][0] = "MP1",
+- [8][0] = "MPIO",
+- [16][0] = "HDP",
+- [17][0] = "LSDMA",
+- [18][0] = "JPEG",
+- [19][0] = "VCNU0",
+- [21][0] = "VSCH",
+- [22][0] = "VCNU1",
+- [23][0] = "VCN1",
+- [32+20][0] = "VCN0",
+- [2][1] = "DBGUNBIO",
++ [8][0] = "MPM",
++ [12][0] = "ISPTNR",
++ [14][0] = "ISPCRD0",
++ [15][0] = "ISPCRD1",
++ [16][0] = "ISPCRD2",
++ [22][0] = "HDP",
++ [23][0] = "LSDMA",
++ [24][0] = "JPEG",
++ [27][0] = "VSCH",
++ [28][0] = "VCNU",
++ [29][0] = "VCN",
++ [1][1] = "ISPXT",
++ [2][1] = "ISPIXT",
+ [3][1] = "DCEDWB",
+ [4][1] = "DCEDMC",
+ [5][1] = "DCEVGA",
+ [6][1] = "MP0",
+ [7][1] = "MP1",
+- [8][1] = "MPIO",
+- [10][1] = "DBGU0",
+- [11][1] = "DBGU1",
+- [12][1] = "DBGU2",
+- [13][1] = "DBGU3",
+- [14][1] = "XDP",
+- [15][1] = "OSSSYS",
+- [16][1] = "HDP",
+- [17][1] = "LSDMA",
+- [18][1] = "JPEG",
+- [19][1] = "VCNU0",
+- [20][1] = "VCN0",
+- [21][1] = "VSCH",
+- [22][1] = "VCNU1",
+- [23][1] = "VCN1",
++ [8][1] = "MPM",
++ [10][1] = "ISPMWR0",
++ [11][1] = "ISPMWR1",
++ [12][1] = "ISPTNR",
++ [13][1] = "ISPSWR",
++ [14][1] = "ISPCWR0",
++ [15][1] = "ISPCWR1",
++ [16][1] = "ISPCWR2",
++ [17][1] = "ISPCWR3",
++ [18][1] = "XDP",
++ [21][1] = "OSSSYS",
++ [22][1] = "HDP",
++ [23][1] = "LSDMA",
++ [24][1] = "JPEG",
++ [27][1] = "VSCH",
++ [28][1] = "VCNU",
++ [29][1] = "VCN",
+ };
+
+ static uint32_t mmhub_v3_0_1_get_invalidate_req(unsigned int vmid,
--- /dev/null
+From a0b34e4c8663b13e45c78267b4de3004b1a72490 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 18 Jul 2025 15:53:54 -0400
+Subject: drm/amdgpu: update mmhub 4.1.0 client id mappings
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit a0b34e4c8663b13e45c78267b4de3004b1a72490 upstream.
+
+Update the client id mapping so the correct clients
+get printed when there is a mmhub page fault.
+
+Tested-by: David (Ming Qiang) Wu <David.Wu3@amd.com>
+Reviewed-by: David (Ming Qiang) Wu <David.Wu3@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/mmhub_v4_1_0.c | 34 +++++++++++-------------------
+ 1 file changed, 13 insertions(+), 21 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v4_1_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v4_1_0.c
+@@ -37,39 +37,31 @@
+ static const char *mmhub_client_ids_v4_1_0[][2] = {
+ [0][0] = "VMC",
+ [4][0] = "DCEDMC",
+- [5][0] = "DCEVGA",
+ [6][0] = "MP0",
+ [7][0] = "MP1",
+ [8][0] = "MPIO",
+- [16][0] = "HDP",
+- [17][0] = "LSDMA",
+- [18][0] = "JPEG",
+- [19][0] = "VCNU0",
+- [21][0] = "VSCH",
+- [22][0] = "VCNU1",
+- [23][0] = "VCN1",
+- [32+20][0] = "VCN0",
+- [2][1] = "DBGUNBIO",
++ [16][0] = "LSDMA",
++ [17][0] = "JPEG",
++ [19][0] = "VCNU",
++ [22][0] = "VSCH",
++ [23][0] = "HDP",
++ [32+23][0] = "VCNRD",
+ [3][1] = "DCEDWB",
+ [4][1] = "DCEDMC",
+- [5][1] = "DCEVGA",
+ [6][1] = "MP0",
+ [7][1] = "MP1",
+ [8][1] = "MPIO",
+ [10][1] = "DBGU0",
+ [11][1] = "DBGU1",
+- [12][1] = "DBGU2",
+- [13][1] = "DBGU3",
++ [12][1] = "DBGUNBIO",
+ [14][1] = "XDP",
+ [15][1] = "OSSSYS",
+- [16][1] = "HDP",
+- [17][1] = "LSDMA",
+- [18][1] = "JPEG",
+- [19][1] = "VCNU0",
+- [20][1] = "VCN0",
+- [21][1] = "VSCH",
+- [22][1] = "VCNU1",
+- [23][1] = "VCN1",
++ [16][1] = "LSDMA",
++ [17][1] = "JPEG",
++ [18][1] = "VCNWR",
++ [19][1] = "VCNU",
++ [22][1] = "VSCH",
++ [23][1] = "HDP",
+ };
+
+ static uint32_t mmhub_v4_1_0_get_invalidate_req(unsigned int vmid,
--- /dev/null
+From 2e58401a24e7b2d4ec619104e1a76590c1284a4c Mon Sep 17 00:00:00 2001
+From: Amber Lin <Amber.Lin@amd.com>
+Date: Thu, 31 Jul 2025 20:45:00 -0400
+Subject: drm/amdkfd: Destroy KFD debugfs after destroy KFD wq
+
+From: Amber Lin <Amber.Lin@amd.com>
+
+commit 2e58401a24e7b2d4ec619104e1a76590c1284a4c upstream.
+
+Since KFD proc content was moved to kernel debugfs, we can't destroy KFD
+debugfs before kfd_process_destroy_wq. Move kfd_process_destroy_wq prior
+to kfd_debugfs_fini to fix a kernel NULL pointer problem. It happens
+when /sys/kernel/debug/kfd was already destroyed in kfd_debugfs_fini but
+kfd_process_destroy_wq calls kfd_debugfs_remove_process. This line
+ debugfs_remove_recursive(entry->proc_dentry);
+tries to remove /sys/kernel/debug/kfd/proc/<pid> while
+/sys/kernel/debug/kfd is already gone. It hangs the kernel by kernel
+NULL pointer.
+
+Signed-off-by: Amber Lin <Amber.Lin@amd.com>
+Reviewed-by: Eric Huang <jinhuieric.huang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 0333052d90683d88531558dcfdbf2525cc37c233)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_module.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_module.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_module.c
+@@ -78,8 +78,8 @@ err_ioctl:
+ static void kfd_exit(void)
+ {
+ kfd_cleanup_processes();
+- kfd_debugfs_fini();
+ kfd_process_destroy_wq();
++ kfd_debugfs_fini();
+ kfd_procfs_shutdown();
+ kfd_topology_shutdown();
+ kfd_chardev_exit();
--- /dev/null
+From 69080ec3d0daba8a894025476c98ab16b5a505a4 Mon Sep 17 00:00:00 2001
+From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Date: Tue, 13 May 2025 17:23:45 +0300
+Subject: media: qcom: camss: cleanup media device allocated resource on error path
+
+From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+
+commit 69080ec3d0daba8a894025476c98ab16b5a505a4 upstream.
+
+A call to media_device_init() requires media_device_cleanup() counterpart
+to complete cleanup and release any allocated resources.
+
+This has been done in the driver .remove() right from the beginning, but
+error paths on .probe() shall also be fixed.
+
+Fixes: a1d7c116fcf7 ("media: camms: Add core files")
+Cc: stable@vger.kernel.org
+Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/camss/camss.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/platform/qcom/camss/camss.c
++++ b/drivers/media/platform/qcom/camss/camss.c
+@@ -2275,7 +2275,7 @@ static int camss_probe(struct platform_d
+ ret = v4l2_device_register(camss->dev, &camss->v4l2_dev);
+ if (ret < 0) {
+ dev_err(dev, "Failed to register V4L2 device: %d\n", ret);
+- goto err_genpd_cleanup;
++ goto err_media_device_cleanup;
+ }
+
+ v4l2_async_nf_init(&camss->notifier, &camss->v4l2_dev);
+@@ -2330,6 +2330,8 @@ err_v4l2_device_unregister:
+ v4l2_device_unregister(&camss->v4l2_dev);
+ v4l2_async_nf_cleanup(&camss->notifier);
+ pm_runtime_disable(dev);
++err_media_device_cleanup:
++ media_device_cleanup(&camss->media_dev);
+ err_genpd_cleanup:
+ camss_genpd_cleanup(camss);
+
--- /dev/null
+From 49befc830daa743e051a65468c05c2ff9e8580e6 Mon Sep 17 00:00:00 2001
+From: Vedang Nagar <quic_vnagar@quicinc.com>
+Date: Mon, 19 May 2025 12:42:21 +0530
+Subject: media: venus: Add a check for packet size after reading from shared memory
+
+From: Vedang Nagar <quic_vnagar@quicinc.com>
+
+commit 49befc830daa743e051a65468c05c2ff9e8580e6 upstream.
+
+Add a check to ensure that the packet size does not exceed the number of
+available words after reading the packet header from shared memory. This
+ensures that the size provided by the firmware is safe to process and
+prevent potential out-of-bounds memory access.
+
+Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files")
+Cc: stable@vger.kernel.org
+Signed-off-by: Vedang Nagar <quic_vnagar@quicinc.com>
+Co-developed-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/venus/hfi_venus.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/media/platform/qcom/venus/hfi_venus.c
++++ b/drivers/media/platform/qcom/venus/hfi_venus.c
+@@ -239,6 +239,7 @@ static int venus_write_queue(struct venu
+ static int venus_read_queue(struct venus_hfi_device *hdev,
+ struct iface_queue *queue, void *pkt, u32 *tx_req)
+ {
++ struct hfi_pkt_hdr *pkt_hdr = NULL;
+ struct hfi_queue_header *qhdr;
+ u32 dwords, new_rd_idx;
+ u32 rd_idx, wr_idx, type, qsize;
+@@ -304,6 +305,9 @@ static int venus_read_queue(struct venus
+ memcpy(pkt, rd_ptr, len);
+ memcpy(pkt + len, queue->qmem.kva, new_rd_idx << 2);
+ }
++ pkt_hdr = (struct hfi_pkt_hdr *)(pkt);
++ if ((pkt_hdr->size >> 2) != dwords)
++ return -EINVAL;
+ } else {
+ /* bad packet received, dropping */
+ new_rd_idx = qhdr->write_idx;
--- /dev/null
+From ee3b94f22638e0f7a1893d95d87b08698b680052 Mon Sep 17 00:00:00 2001
+From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Date: Sat, 31 May 2025 14:22:00 +0200
+Subject: media: venus: Fix MSM8998 frequency table
+
+From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+
+commit ee3b94f22638e0f7a1893d95d87b08698b680052 upstream.
+
+Fill in the correct data for the production SKU.
+
+Fixes: 193b3dac29a4 ("media: venus: add msm8998 support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Reviewed-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/venus/core.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/platform/qcom/venus/core.c
++++ b/drivers/media/platform/qcom/venus/core.c
+@@ -593,11 +593,11 @@ static const struct venus_resources msm8
+ };
+
+ static const struct freq_tbl msm8998_freq_table[] = {
+- { 1944000, 465000000 }, /* 4k UHD @ 60 (decode only) */
+- { 972000, 465000000 }, /* 4k UHD @ 30 */
+- { 489600, 360000000 }, /* 1080p @ 60 */
+- { 244800, 186000000 }, /* 1080p @ 30 */
+- { 108000, 100000000 }, /* 720p @ 30 */
++ { 1728000, 533000000 }, /* 4k UHD @ 60 (decode only) */
++ { 1036800, 444000000 }, /* 2k @ 120 */
++ { 829440, 355200000 }, /* 4k @ 44 */
++ { 489600, 269330000 },/* 4k @ 30 */
++ { 108000, 200000000 }, /* 1080p @ 60 */
+ };
+
+ static const struct reg_val msm8998_reg_preset[] = {
--- /dev/null
+From 640803003cd903cea73dc6a86bf6963e238e2b3f Mon Sep 17 00:00:00 2001
+From: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
+Date: Thu, 19 Jun 2025 09:48:30 +0200
+Subject: media: venus: hfi: explicitly release IRQ during teardown
+
+From: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
+
+commit 640803003cd903cea73dc6a86bf6963e238e2b3f upstream.
+
+Ensure the IRQ is disabled - and all pending handlers completed - before
+dismantling the interrupt routing and clearing related pointers.
+
+This prevents any possibility of the interrupt triggering after the
+handler context has been invalidated.
+
+Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
+Reviewed-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Dikshita Agarwal <quic_dikshita@quicinc.com> # RB5
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/venus/hfi_venus.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/platform/qcom/venus/hfi_venus.c
++++ b/drivers/media/platform/qcom/venus/hfi_venus.c
+@@ -1693,6 +1693,7 @@ void venus_hfi_destroy(struct venus_core
+ venus_interface_queues_release(hdev);
+ mutex_destroy(&hdev->lock);
+ kfree(hdev);
++ disable_irq(core->irq);
+ core->ops = NULL;
+ }
+
--- /dev/null
+From 3200144a2fa4209dc084a19941b9b203b43580f0 Mon Sep 17 00:00:00 2001
+From: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
+Date: Fri, 6 Jun 2025 17:25:22 +0200
+Subject: media: venus: protect against spurious interrupts during probe
+
+From: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
+
+commit 3200144a2fa4209dc084a19941b9b203b43580f0 upstream.
+
+Make sure the interrupt handler is initialized before the interrupt is
+registered.
+
+If the IRQ is registered before hfi_create(), it's possible that an
+interrupt fires before the handler setup is complete, leading to a NULL
+dereference.
+
+This error condition has been observed during system boot on Rb3Gen2.
+
+Fixes: af2c3834c8ca ("[media] media: venus: adding core part and helper functions")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Reviewed-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Reviewed-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Dikshita Agarwal <quic_dikshita@quicinc.com> # RB5
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/venus/core.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/platform/qcom/venus/core.c
++++ b/drivers/media/platform/qcom/venus/core.c
+@@ -340,13 +340,13 @@ static int venus_probe(struct platform_d
+ INIT_DELAYED_WORK(&core->work, venus_sys_error_handler);
+ init_waitqueue_head(&core->sys_err_done);
+
+- ret = devm_request_threaded_irq(dev, core->irq, hfi_isr, venus_isr_thread,
+- IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
+- "venus", core);
++ ret = hfi_create(core, &venus_core_ops);
+ if (ret)
+ goto err_core_put;
+
+- ret = hfi_create(core, &venus_core_ops);
++ ret = devm_request_threaded_irq(dev, core->irq, hfi_isr, venus_isr_thread,
++ IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
++ "venus", core);
+ if (ret)
+ goto err_core_put;
+
--- /dev/null
+From 377dc500d253f0b26732b2cb062e89668aef890a Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda <ribalda@chromium.org>
+Date: Mon, 16 Jun 2025 15:29:14 +0000
+Subject: media: venus: vdec: Clamp param smaller than 1fps and bigger than 240.
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+commit 377dc500d253f0b26732b2cb062e89668aef890a upstream.
+
+The driver uses "whole" fps in all its calculations (e.g. in
+load_per_instance()). Those calculation expect an fps bigger than 1, and
+not big enough to overflow.
+
+Clamp the value if the user provides a param that will result in an invalid
+fps.
+
+Reported-by: Hans Verkuil <hverkuil@xs4all.nl>
+Closes: https://lore.kernel.org/linux-media/f11653a7-bc49-48cd-9cdb-1659147453e4@xs4all.nl/T/#m91cd962ac942834654f94c92206e2f85ff7d97f0
+Fixes: 7472c1c69138 ("[media] media: venus: vdec: add video decoder files")
+Cc: stable@vger.kernel.org
+Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> # qrb5615-rb5
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+[bod: Change "parm" to "param"]
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/venus/core.h | 2 ++
+ drivers/media/platform/qcom/venus/vdec.c | 5 ++---
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/platform/qcom/venus/core.h
++++ b/drivers/media/platform/qcom/venus/core.h
+@@ -27,6 +27,8 @@
+ #define VIDC_VCODEC_CLKS_NUM_MAX 2
+ #define VIDC_RESETS_NUM_MAX 2
+
++#define VENUS_MAX_FPS 240
++
+ extern int venus_fw_debug;
+
+ struct freq_tbl {
+--- a/drivers/media/platform/qcom/venus/vdec.c
++++ b/drivers/media/platform/qcom/venus/vdec.c
+@@ -481,11 +481,10 @@ static int vdec_s_parm(struct file *file
+ us_per_frame = timeperframe->numerator * (u64)USEC_PER_SEC;
+ do_div(us_per_frame, timeperframe->denominator);
+
+- if (!us_per_frame)
+- return -EINVAL;
+-
++ us_per_frame = clamp(us_per_frame, 1, USEC_PER_SEC);
+ fps = (u64)USEC_PER_SEC;
+ do_div(fps, us_per_frame);
++ fps = min(VENUS_MAX_FPS, fps);
+
+ inst->fps = fps;
+ inst->timeperframe = *timeperframe;
--- /dev/null
+From 417c01b92ec278a1118a05c6ad8a796eaa0c9c52 Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda <ribalda@chromium.org>
+Date: Mon, 16 Jun 2025 15:29:15 +0000
+Subject: media: venus: venc: Clamp param smaller than 1fps and bigger than 240
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+commit 417c01b92ec278a1118a05c6ad8a796eaa0c9c52 upstream.
+
+The driver uses "whole" fps in all its calculations (e.g. in
+load_per_instance()). Those calculation expect an fps bigger than 1, and
+not big enough to overflow.
+
+Clamp the param if the user provides a value that will result in an invalid
+fps.
+
+Reported-by: Hans Verkuil <hverkuil@xs4all.nl>
+Closes: https://lore.kernel.org/linux-media/f11653a7-bc49-48cd-9cdb-1659147453e4@xs4all.nl/T/#m91cd962ac942834654f94c92206e2f85ff7d97f0
+Fixes: aaaa93eda64b ("[media] media: venus: venc: add video encoder files")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+[bod: Change "parm" to "param"]
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/venus/venc.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/platform/qcom/venus/venc.c
++++ b/drivers/media/platform/qcom/venus/venc.c
+@@ -411,11 +411,10 @@ static int venc_s_parm(struct file *file
+ us_per_frame = timeperframe->numerator * (u64)USEC_PER_SEC;
+ do_div(us_per_frame, timeperframe->denominator);
+
+- if (!us_per_frame)
+- return -EINVAL;
+-
++ us_per_frame = clamp(us_per_frame, 1, USEC_PER_SEC);
+ fps = (u64)USEC_PER_SEC;
+ do_div(fps, us_per_frame);
++ fps = min(VENUS_MAX_FPS, fps);
+
+ inst->timeperframe = *timeperframe;
+ inst->fps = fps;
media-ov2659-fix-memory-leaks-in-ov2659_probe.patch
media-mt9m114-fix-deadlock-in-get_frame_interval-set_frame_interval.patch
media-ivsc-fix-crash-at-shutdown-due-to-missing-mei_cldev_disable-calls.patch
+media-qcom-camss-cleanup-media-device-allocated-resource-on-error-path.patch
+media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch
+media-venus-fix-msm8998-frequency-table.patch
+media-venus-hfi-explicitly-release-irq-during-teardown.patch
+media-venus-protect-against-spurious-interrupts-during-probe.patch
+media-venus-vdec-clamp-param-smaller-than-1fps-and-bigger-than-240.patch
+media-venus-venc-clamp-param-smaller-than-1fps-and-bigger-than-240.patch
+drm-amdgpu-discovery-fix-fw-based-ip-discovery.patch
+drm-amd-restore-cached-power-limit-during-resume.patch
+drm-amdgpu-avoid-extra-evict-restore-process.patch
+drm-amdgpu-check-if-hubbub-is-null-in-debugfs-amdgpu_dm_capabilities.patch
+drm-amdgpu-initialize-data-to-null-in-imu_v12_0_program_rlc_ram.patch
+drm-amdgpu-update-external-revid-for-gc-v9.5.0.patch
+drm-amdgpu-update-mmhub-3.0.1-client-id-mappings.patch
+drm-amdgpu-update-mmhub-4.1.0-client-id-mappings.patch
+drm-amdkfd-destroy-kfd-debugfs-after-destroy-kfd-wq.patch
+drm-amd-display-add-primary-plane-to-commits-for-correct-vrr-handling.patch
+drm-amd-display-fix-a-null-pointer-dereference-vulnerability.patch
+drm-amd-display-don-t-overwrite-dce60_clk_mgr.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
