--- /dev/null
+From f51e944182973509a1bb4cbc4554b83c5fe63ccd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 Nov 2024 17:03:25 +0000
+Subject: dma-buf: Fix __dma_buf_debugfs_list_del argument for !CONFIG_DEBUG_FS
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: T.J. Mercier <tjmercier@google.com>
+
+[ Upstream commit 0cff90dec63da908fb16d9ea2872ebbcd2d18e6a ]
+
+The arguments for __dma_buf_debugfs_list_del do not match for both the
+CONFIG_DEBUG_FS case and the !CONFIG_DEBUG_FS case. The !CONFIG_DEBUG_FS
+case should take a struct dma_buf *, but it's currently struct file *.
+This can lead to the build error:
+
+error: passing argument 1 of ‘__dma_buf_debugfs_list_del’ from
+incompatible pointer type [-Werror=incompatible-pointer-types]
+
+dma-buf.c:63:53: note: expected ‘struct file *’ but argument is of
+type ‘struct dma_buf *’
+ 63 | static void __dma_buf_debugfs_list_del(struct file *file)
+
+Fixes: bfc7bc539392 ("dma-buf: Do not build debugfs related code when !CONFIG_DEBUG_FS")
+Signed-off-by: T.J. Mercier <tjmercier@google.com>
+Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241117170326.1971113-1-tjmercier@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma-buf/dma-buf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
+index 8892bc701a66..afb8c1c50107 100644
+--- a/drivers/dma-buf/dma-buf.c
++++ b/drivers/dma-buf/dma-buf.c
+@@ -60,7 +60,7 @@ static void __dma_buf_debugfs_list_add(struct dma_buf *dmabuf)
+ {
+ }
+
+-static void __dma_buf_debugfs_list_del(struct file *file)
++static void __dma_buf_debugfs_list_del(struct dma_buf *dmabuf)
+ {
+ }
+ #endif
+--
+2.39.5
+
--- /dev/null
+From 35152126976cc9b26b44bbeca07ca21670ec8e59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2024 13:17:45 +0100
+Subject: drm/amdgpu: don't access invalid sched
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com>
+
+[ Upstream commit a93b1020eb9386d7da11608477121b10079c076a ]
+
+Since 2320c9e6a768 ("drm/sched: memset() 'job' in drm_sched_job_init()")
+accessing job->base.sched can produce unexpected results as the initialisation
+of (*job)->base.sched done in amdgpu_job_alloc is overwritten by the
+memset.
+
+This commit fixes an issue when a CS would fail validation and would
+be rejected after job->num_ibs is incremented. In this case,
+amdgpu_ib_free(ring->adev, ...) will be called, which would crash the
+machine because the ring value is bogus.
+
+To fix this, pass a NULL pointer to amdgpu_ib_free(): we can do this
+because the device is actually not used in this function.
+
+The next commit will remove the ring argument completely.
+
+Fixes: 2320c9e6a768 ("drm/sched: memset() 'job' in drm_sched_job_init()")
+Signed-off-by: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 2ae520cb12831d264ceb97c61f72c59d33c0dbd7)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
+index 16f2605ac50b..1ce20a19be8b 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
+@@ -253,7 +253,6 @@ void amdgpu_job_set_resources(struct amdgpu_job *job, struct amdgpu_bo *gds,
+
+ void amdgpu_job_free_resources(struct amdgpu_job *job)
+ {
+- struct amdgpu_ring *ring = to_amdgpu_ring(job->base.sched);
+ struct dma_fence *f;
+ unsigned i;
+
+@@ -266,7 +265,7 @@ void amdgpu_job_free_resources(struct amdgpu_job *job)
+ f = NULL;
+
+ for (i = 0; i < job->num_ibs; ++i)
+- amdgpu_ib_free(ring->adev, &job->ibs[i], f);
++ amdgpu_ib_free(NULL, &job->ibs[i], f);
+ }
+
+ static void amdgpu_job_free_cb(struct drm_sched_job *s_job)
+--
+2.39.5
+
--- /dev/null
+From 43d6b0a3525f5334f0b715c7ae763fa30cc99374 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2024 15:34:08 +0800
+Subject: drm/panel: himax-hx83102: Add a check to prevent NULL pointer
+ dereference
+
+From: Zhang Zekun <zhangzekun11@huawei.com>
+
+[ Upstream commit e1e1af9148dc4c866eda3fb59cd6ec3c7ea34b1d ]
+
+drm_mode_duplicate() could return NULL due to lack of memory,
+which will then call NULL pointer dereference. Add a check to
+prevent it.
+
+Fixes: 0ef94554dc40 ("drm/panel: himax-hx83102: Break out as separate driver")
+Signed-off-by: Zhang Zekun <zhangzekun11@huawei.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20241025073408.27481-3-zhangzekun11@huawei.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241025073408.27481-3-zhangzekun11@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-himax-hx83102.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/panel/panel-himax-hx83102.c b/drivers/gpu/drm/panel/panel-himax-hx83102.c
+index 8b48bba18131..3644a7544b93 100644
+--- a/drivers/gpu/drm/panel/panel-himax-hx83102.c
++++ b/drivers/gpu/drm/panel/panel-himax-hx83102.c
+@@ -565,6 +565,8 @@ static int hx83102_get_modes(struct drm_panel *panel,
+ struct drm_display_mode *mode;
+
+ mode = drm_mode_duplicate(connector->dev, m);
++ if (!mode)
++ return -ENOMEM;
+
+ mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
+ drm_mode_set_name(mode);
+--
+2.39.5
+
--- /dev/null
+From 7bac252a732a582511222bdbc07425fa4da44b3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2024 20:39:57 +0800
+Subject: drm/panel: novatek-nt35950: fix return value check in nt35950_probe()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit f8fd0968eff52cf092c0d517d17507ea2f6e5ea5 ]
+
+mipi_dsi_device_register_full() never returns NULL pointer, it
+will return ERR_PTR() when it fails, so replace the check with
+IS_ERR().
+
+Fixes: 623a3531e9cf ("drm/panel: Add driver for Novatek NT35950 DSI DriverIC panels")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20241029123957.1588-1-yangyingliang@huaweicloud.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241029123957.1588-1-yangyingliang@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-novatek-nt35950.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35950.c b/drivers/gpu/drm/panel/panel-novatek-nt35950.c
+index b036208f9356..08b22b592ab0 100644
+--- a/drivers/gpu/drm/panel/panel-novatek-nt35950.c
++++ b/drivers/gpu/drm/panel/panel-novatek-nt35950.c
+@@ -481,9 +481,9 @@ static int nt35950_probe(struct mipi_dsi_device *dsi)
+ return dev_err_probe(dev, -EPROBE_DEFER, "Cannot get secondary DSI host\n");
+
+ nt->dsi[1] = mipi_dsi_device_register_full(dsi_r_host, info);
+- if (!nt->dsi[1]) {
++ if (IS_ERR(nt->dsi[1])) {
+ dev_err(dev, "Cannot get secondary DSI node\n");
+- return -ENODEV;
++ return PTR_ERR(nt->dsi[1]);
+ }
+ num_dsis++;
+ }
+--
+2.39.5
+
--- /dev/null
+From 075953e2fe55a6f66fb83d175e16ea09dc6717be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Nov 2024 23:48:07 +0100
+Subject: drm/panel: st7701: Add prepare_prev_first flag to drm_panel
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 406dd4c7984a457567ca652455d5efad81983f02 ]
+
+The DSI host must be enabled for the panel to be initialized in
+prepare(). Set the prepare_prev_first flag to guarantee this.
+This fixes the panel operation on NXP i.MX8MP SoC / Samsung DSIM
+DSI host.
+
+Fixes: 849b2e3ff969 ("drm/panel: Add Sitronix ST7701 panel driver")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Reviewed-by: Jessica Zhang <quic_jesszhan@quicinc.com>
+Link: https://lore.kernel.org/r/20241124224812.150263-1-marex@denx.de
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241124224812.150263-1-marex@denx.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-sitronix-st7701.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/panel/panel-sitronix-st7701.c b/drivers/gpu/drm/panel/panel-sitronix-st7701.c
+index eef03d04e0cd..1f72ef7ca74c 100644
+--- a/drivers/gpu/drm/panel/panel-sitronix-st7701.c
++++ b/drivers/gpu/drm/panel/panel-sitronix-st7701.c
+@@ -1177,6 +1177,7 @@ static int st7701_probe(struct device *dev, int connector_type)
+ return dev_err_probe(dev, ret, "Failed to get orientation\n");
+
+ drm_panel_init(&st7701->panel, dev, &st7701_funcs, connector_type);
++ st7701->panel.prepare_prev_first = true;
+
+ /**
+ * Once sleep out has been issued, ST7701 IC required to wait 120ms
+--
+2.39.5
+
--- /dev/null
+From 4fc73ad913c25fa263072c64fcd045219fd7252f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2024 17:29:58 +0100
+Subject: drm/panel: synaptics-r63353: Fix regulator unbalance
+
+From: Michael Trimarchi <michael@amarulasolutions.com>
+
+[ Upstream commit d2bd3fcb825725a59c8880070b1206b1710922bd ]
+
+The shutdown function can be called when the display is already
+unprepared. For example during reboot this trigger a kernel
+backlog. Calling the drm_panel_unprepare, allow us to avoid
+to trigger the kernel warning.
+
+Fixes: 2e87bad7cd33 ("drm/panel: Add Synaptics R63353 panel driver")
+Tested-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
+Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Reviewed-by: Jessica Zhang <quic_jesszhan@quicinc.com>
+Link: https://lore.kernel.org/r/20241205163002.1804784-1-dario.binacchi@amarulasolutions.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241205163002.1804784-1-dario.binacchi@amarulasolutions.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-synaptics-r63353.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-synaptics-r63353.c b/drivers/gpu/drm/panel/panel-synaptics-r63353.c
+index 169c629746c7..17349825543f 100644
+--- a/drivers/gpu/drm/panel/panel-synaptics-r63353.c
++++ b/drivers/gpu/drm/panel/panel-synaptics-r63353.c
+@@ -325,7 +325,7 @@ static void r63353_panel_shutdown(struct mipi_dsi_device *dsi)
+ {
+ struct r63353_panel *rpanel = mipi_dsi_get_drvdata(dsi);
+
+- r63353_panel_unprepare(&rpanel->base);
++ drm_panel_unprepare(&rpanel->base);
+ }
+
+ static const struct r63353_desc sharp_ls068b3sx02_data = {
+--
+2.39.5
+
--- /dev/null
+From 25e4c00aa37a44dc9003c8f7eb513fb6c6dd6287 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2024 09:40:06 -0800
+Subject: i915/guc: Accumulate active runtime on gt reset
+
+From: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
+
+[ Upstream commit 1622ed27d26ab4c234476be746aa55bcd39159dd ]
+
+On gt reset, if a context is running, then accumulate it's active time
+into the busyness counter since there will be no chance for the context
+to switch out and update it's run time.
+
+v2: Move comment right above the if (John)
+
+Fixes: 77cdd054dd2c ("drm/i915/pmu: Connect engine busyness stats from GuC to pmu")
+Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
+Reviewed-by: John Harrison <John.C.Harrison@Intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241127174006.190128-4-umesh.nerlige.ramappa@intel.com
+(cherry picked from commit 7ed047da59cfa1acb558b95169d347acc8d85da1)
+Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
+index fbff9b9a067c..ee12ee0ed418 100644
+--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
+@@ -1449,8 +1449,21 @@ static void __reset_guc_busyness_stats(struct intel_guc *guc)
+
+ guc_update_pm_timestamp(guc, &unused);
+ for_each_engine(engine, gt, id) {
++ struct intel_engine_guc_stats *stats = &engine->stats.guc;
++
+ guc_update_engine_gt_clks(engine);
+- engine->stats.guc.prev_total = 0;
++
++ /*
++ * If resetting a running context, accumulate the active
++ * time as well since there will be no context switch.
++ */
++ if (stats->running) {
++ u64 clk = guc->timestamp.gt_stamp - stats->start_gt_clk;
++
++ stats->total_gt_clks += clk;
++ }
++ stats->prev_total = 0;
++ stats->running = 0;
+ }
+
+ spin_unlock_irqrestore(&guc->timestamp.lock, flags);
+--
+2.39.5
+
--- /dev/null
+From 15433fee23cc4bf9d8f689730684e9aa6c9a298f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2024 09:40:05 -0800
+Subject: i915/guc: Ensure busyness counter increases motonically
+
+From: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
+
+[ Upstream commit 59a0b46788d58fdcee8d2f6b4e619d264a1799bf ]
+
+Active busyness of an engine is calculated using gt timestamp and the
+context switch in time. While capturing the gt timestamp, it's possible
+that the context switches out. This race could result in an active
+busyness value that is greater than the actual context runtime value by a
+small amount. This leads to a negative delta and throws off busyness
+calculations for the user.
+
+If a subsequent count is smaller than the previous one, just return the
+previous one, since we expect the busyness to catch up.
+
+Fixes: 77cdd054dd2c ("drm/i915/pmu: Connect engine busyness stats from GuC to pmu")
+Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
+Reviewed-by: John Harrison <John.C.Harrison@Intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241127174006.190128-3-umesh.nerlige.ramappa@intel.com
+(cherry picked from commit cf907f6d294217985e9dafd9985dce874e04ca37)
+Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/intel_engine_types.h | 5 +++++
+ drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 5 ++++-
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/intel_engine_types.h b/drivers/gpu/drm/i915/gt/intel_engine_types.h
+index ba55c059063d..fe1f85e5dda3 100644
+--- a/drivers/gpu/drm/i915/gt/intel_engine_types.h
++++ b/drivers/gpu/drm/i915/gt/intel_engine_types.h
+@@ -343,6 +343,11 @@ struct intel_engine_guc_stats {
+ * @start_gt_clk: GT clock time of last idle to active transition.
+ */
+ u64 start_gt_clk;
++
++ /**
++ * @total: The last value of total returned
++ */
++ u64 total;
+ };
+
+ union intel_engine_tlb_inv_reg {
+diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
+index 4793759f4d4a..fbff9b9a067c 100644
+--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
+@@ -1378,9 +1378,12 @@ static ktime_t guc_engine_busyness(struct intel_engine_cs *engine, ktime_t *now)
+ total += intel_gt_clock_interval_to_ns(gt, clk);
+ }
+
++ if (total > stats->total)
++ stats->total = total;
++
+ spin_unlock_irqrestore(&guc->timestamp.lock, flags);
+
+- return ns_to_ktime(total);
++ return ns_to_ktime(stats->total);
+ }
+
+ static void guc_enable_busyness_worker(struct intel_guc *guc)
+--
+2.39.5
+
--- /dev/null
+From 3eb9a8e90e084ada12cd521e4b4fe9fbdd2eb000 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2024 09:40:04 -0800
+Subject: i915/guc: Reset engine utilization buffer before registration
+
+From: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
+
+[ Upstream commit abcc2ddae5f82aa6cfca162e3db643dd33f0a2e8 ]
+
+On GT reset, we store total busyness counts for all engines and
+re-register the utilization buffer with GuC. At that time we should
+reset the buffer, so that we don't get spurious busyness counts on
+subsequent queries.
+
+To repro this issue, run igt@perf_pmu@busy-hang followed by
+igt@perf_pmu@most-busy-idle-check-all for a couple iterations.
+
+Fixes: 77cdd054dd2c ("drm/i915/pmu: Connect engine busyness stats from GuC to pmu")
+Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
+Reviewed-by: John Harrison <John.C.Harrison@Intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241127174006.190128-2-umesh.nerlige.ramappa@intel.com
+(cherry picked from commit abd318237fa6556c1e5225529af145ef15d5ff0d)
+Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/i915/gt/uc/intel_guc_submission.c | 21 +++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
+index ed979847187f..4793759f4d4a 100644
+--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
+@@ -1243,6 +1243,21 @@ static void __get_engine_usage_record(struct intel_engine_cs *engine,
+ } while (++i < 6);
+ }
+
++static void __set_engine_usage_record(struct intel_engine_cs *engine,
++ u32 last_in, u32 id, u32 total)
++{
++ struct iosys_map rec_map = intel_guc_engine_usage_record_map(engine);
++
++#define record_write(map_, field_, val_) \
++ iosys_map_wr_field(map_, 0, struct guc_engine_usage_record, field_, val_)
++
++ record_write(&rec_map, last_switch_in_stamp, last_in);
++ record_write(&rec_map, current_context_index, id);
++ record_write(&rec_map, total_runtime, total);
++
++#undef record_write
++}
++
+ static void guc_update_engine_gt_clks(struct intel_engine_cs *engine)
+ {
+ struct intel_engine_guc_stats *stats = &engine->stats.guc;
+@@ -1543,6 +1558,9 @@ static void guc_timestamp_ping(struct work_struct *wrk)
+
+ static int guc_action_enable_usage_stats(struct intel_guc *guc)
+ {
++ struct intel_gt *gt = guc_to_gt(guc);
++ struct intel_engine_cs *engine;
++ enum intel_engine_id id;
+ u32 offset = intel_guc_engine_usage_offset(guc);
+ u32 action[] = {
+ INTEL_GUC_ACTION_SET_ENG_UTIL_BUFF,
+@@ -1550,6 +1568,9 @@ static int guc_action_enable_usage_stats(struct intel_guc *guc)
+ 0,
+ };
+
++ for_each_engine(engine, gt, id)
++ __set_engine_usage_record(engine, 0, 0xffffffff, 0);
++
+ return intel_guc_send(guc, action, ARRAY_SIZE(action));
+ }
+
+--
+2.39.5
+
netdev-genl-avoid-empty-messages-in-queue-dump.patch
psample-adjust-size-if-rate_as_probability-is-set.patch
net-mdiobus-fix-an-of-node-reference-leak.patch
+udmabuf-udmabuf_create-pin-folio-codestyle-cleanup.patch
+udmabuf-fix-memory-leak-on-last-export_udmabuf-error.patch
+dma-buf-fix-__dma_buf_debugfs_list_del-argument-for-.patch
+drm-panel-himax-hx83102-add-a-check-to-prevent-null-.patch
+drm-panel-novatek-nt35950-fix-return-value-check-in-.patch
+drm-panel-st7701-add-prepare_prev_first-flag-to-drm_.patch
+drm-panel-synaptics-r63353-fix-regulator-unbalance.patch
+i915-guc-reset-engine-utilization-buffer-before-regi.patch
+i915-guc-ensure-busyness-counter-increases-motonical.patch
+i915-guc-accumulate-active-runtime-on-gt-reset.patch
+drm-amdgpu-don-t-access-invalid-sched.patch
--- /dev/null
+From 56ebc1b3fb2199fad2a698b4af71614f111e5c1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2024 17:26:21 +0100
+Subject: udmabuf: fix memory leak on last export_udmabuf() error path
+
+From: Jann Horn <jannh@google.com>
+
+[ Upstream commit f49856f525acd5bef52ae28b7da2e001bbe7439e ]
+
+In export_udmabuf(), if dma_buf_fd() fails because the FD table is full, a
+dma_buf owning the udmabuf has already been created; but the error handling
+in udmabuf_create() will tear down the udmabuf without doing anything about
+the containing dma_buf.
+
+This leaves a dma_buf in memory that contains a dangling pointer; though
+that doesn't seem to lead to anything bad except a memory leak.
+
+Fix it by moving the dma_buf_fd() call out of export_udmabuf() so that we
+can give it different error handling.
+
+Note that the shape of this code changed a lot in commit 5e72b2b41a21
+("udmabuf: convert udmabuf driver to use folios"); but the memory leak
+seems to have existed since the introduction of udmabuf.
+
+Fixes: fbb0de795078 ("Add udmabuf misc device")
+Acked-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241204-udmabuf-fixes-v2-3-23887289de1c@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma-buf/udmabuf.c | 28 +++++++++++++++++-----------
+ 1 file changed, 17 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
+index 970e08a95dc0..614df433c451 100644
+--- a/drivers/dma-buf/udmabuf.c
++++ b/drivers/dma-buf/udmabuf.c
+@@ -276,12 +276,10 @@ static int check_memfd_seals(struct file *memfd)
+ return 0;
+ }
+
+-static int export_udmabuf(struct udmabuf *ubuf,
+- struct miscdevice *device,
+- u32 flags)
++static struct dma_buf *export_udmabuf(struct udmabuf *ubuf,
++ struct miscdevice *device)
+ {
+ DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
+- struct dma_buf *buf;
+
+ ubuf->device = device;
+ exp_info.ops = &udmabuf_ops;
+@@ -289,11 +287,7 @@ static int export_udmabuf(struct udmabuf *ubuf,
+ exp_info.priv = ubuf;
+ exp_info.flags = O_RDWR;
+
+- buf = dma_buf_export(&exp_info);
+- if (IS_ERR(buf))
+- return PTR_ERR(buf);
+-
+- return dma_buf_fd(buf, flags);
++ return dma_buf_export(&exp_info);
+ }
+
+ static long udmabuf_pin_folios(struct udmabuf *ubuf, struct file *memfd,
+@@ -356,6 +350,7 @@ static long udmabuf_create(struct miscdevice *device,
+ {
+ pgoff_t pgcnt = 0, pglimit;
+ struct udmabuf *ubuf;
++ struct dma_buf *dmabuf;
+ long ret = -EINVAL;
+ u32 i, flags;
+
+@@ -413,9 +408,20 @@ static long udmabuf_create(struct miscdevice *device,
+ }
+
+ flags = head->flags & UDMABUF_FLAGS_CLOEXEC ? O_CLOEXEC : 0;
+- ret = export_udmabuf(ubuf, device, flags);
+- if (ret < 0)
++ dmabuf = export_udmabuf(ubuf, device);
++ if (IS_ERR(dmabuf)) {
++ ret = PTR_ERR(dmabuf);
+ goto err;
++ }
++ /*
++ * Ownership of ubuf is held by the dmabuf from here.
++ * If the following dma_buf_fd() fails, dma_buf_put() cleans up both the
++ * dmabuf and the ubuf (through udmabuf_ops.release).
++ */
++
++ ret = dma_buf_fd(dmabuf, flags);
++ if (ret < 0)
++ dma_buf_put(dmabuf);
+
+ return ret;
+
+--
+2.39.5
+
--- /dev/null
+From 9bbd94e239ad8d4bee72eacef473282aa234e58a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Sep 2024 10:52:27 +0800
+Subject: udmabuf: udmabuf_create pin folio codestyle cleanup
+
+From: Huan Yang <link@vivo.com>
+
+[ Upstream commit 164fd9efd46531fddfaa933d394569259896642b ]
+
+This patch aim to simplify the memfd folio pin during the udmabuf
+create. No functional changes.
+
+This patch create a udmabuf_pin_folios function, in this, do the memfd
+pin folio and then record each pinned folio, offset.
+
+This patch simplify the pinned folio record, iter by each pinned folio,
+and then record each offset in it.
+
+Compare to iter by pgcnt, more readable.
+
+Suggested-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
+Signed-off-by: Huan Yang <link@vivo.com>
+Acked-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
+Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240918025238.2957823-5-link@vivo.com
+Stable-dep-of: f49856f525ac ("udmabuf: fix memory leak on last export_udmabuf() error path")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma-buf/udmabuf.c | 137 +++++++++++++++++++++-----------------
+ 1 file changed, 76 insertions(+), 61 deletions(-)
+
+diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
+index a3638ccc15f5..970e08a95dc0 100644
+--- a/drivers/dma-buf/udmabuf.c
++++ b/drivers/dma-buf/udmabuf.c
+@@ -262,9 +262,6 @@ static int check_memfd_seals(struct file *memfd)
+ {
+ int seals;
+
+- if (!memfd)
+- return -EBADFD;
+-
+ if (!shmem_file(memfd) && !is_file_hugepages(memfd))
+ return -EBADFD;
+
+@@ -299,17 +296,68 @@ static int export_udmabuf(struct udmabuf *ubuf,
+ return dma_buf_fd(buf, flags);
+ }
+
++static long udmabuf_pin_folios(struct udmabuf *ubuf, struct file *memfd,
++ loff_t start, loff_t size)
++{
++ pgoff_t pgoff, pgcnt, upgcnt = ubuf->pagecount;
++ struct folio **folios = NULL;
++ u32 cur_folio, cur_pgcnt;
++ long nr_folios;
++ long ret = 0;
++ loff_t end;
++
++ pgcnt = size >> PAGE_SHIFT;
++ folios = kvmalloc_array(pgcnt, sizeof(*folios), GFP_KERNEL);
++ if (!folios)
++ return -ENOMEM;
++
++ end = start + (pgcnt << PAGE_SHIFT) - 1;
++ nr_folios = memfd_pin_folios(memfd, start, end, folios, pgcnt, &pgoff);
++ if (nr_folios <= 0) {
++ ret = nr_folios ? nr_folios : -EINVAL;
++ goto end;
++ }
++
++ cur_pgcnt = 0;
++ for (cur_folio = 0; cur_folio < nr_folios; ++cur_folio) {
++ pgoff_t subpgoff = pgoff;
++ size_t fsize = folio_size(folios[cur_folio]);
++
++ ret = add_to_unpin_list(&ubuf->unpin_list, folios[cur_folio]);
++ if (ret < 0)
++ goto end;
++
++ for (; subpgoff < fsize; subpgoff += PAGE_SIZE) {
++ ubuf->folios[upgcnt] = folios[cur_folio];
++ ubuf->offsets[upgcnt] = subpgoff;
++ ++upgcnt;
++
++ if (++cur_pgcnt >= pgcnt)
++ goto end;
++ }
++
++ /**
++ * In a given range, only the first subpage of the first folio
++ * has an offset, that is returned by memfd_pin_folios().
++ * The first subpages of other folios (in the range) have an
++ * offset of 0.
++ */
++ pgoff = 0;
++ }
++end:
++ ubuf->pagecount = upgcnt;
++ kvfree(folios);
++ return ret;
++}
++
+ static long udmabuf_create(struct miscdevice *device,
+ struct udmabuf_create_list *head,
+ struct udmabuf_create_item *list)
+ {
+- pgoff_t pgoff, pgcnt, pglimit, pgbuf = 0;
+- long nr_folios, ret = -EINVAL;
+- struct file *memfd = NULL;
+- struct folio **folios;
++ pgoff_t pgcnt = 0, pglimit;
+ struct udmabuf *ubuf;
+- u32 i, j, k, flags;
+- loff_t end;
++ long ret = -EINVAL;
++ u32 i, flags;
+
+ ubuf = kzalloc(sizeof(*ubuf), GFP_KERNEL);
+ if (!ubuf)
+@@ -318,81 +366,50 @@ static long udmabuf_create(struct miscdevice *device,
+ INIT_LIST_HEAD(&ubuf->unpin_list);
+ pglimit = (size_limit_mb * 1024 * 1024) >> PAGE_SHIFT;
+ for (i = 0; i < head->count; i++) {
+- if (!IS_ALIGNED(list[i].offset, PAGE_SIZE))
++ if (!PAGE_ALIGNED(list[i].offset))
+ goto err;
+- if (!IS_ALIGNED(list[i].size, PAGE_SIZE))
++ if (!PAGE_ALIGNED(list[i].size))
+ goto err;
+- ubuf->pagecount += list[i].size >> PAGE_SHIFT;
+- if (ubuf->pagecount > pglimit)
++
++ pgcnt += list[i].size >> PAGE_SHIFT;
++ if (pgcnt > pglimit)
+ goto err;
+ }
+
+- if (!ubuf->pagecount)
++ if (!pgcnt)
+ goto err;
+
+- ubuf->folios = kvmalloc_array(ubuf->pagecount, sizeof(*ubuf->folios),
+- GFP_KERNEL);
++ ubuf->folios = kvmalloc_array(pgcnt, sizeof(*ubuf->folios), GFP_KERNEL);
+ if (!ubuf->folios) {
+ ret = -ENOMEM;
+ goto err;
+ }
+- ubuf->offsets = kvcalloc(ubuf->pagecount, sizeof(*ubuf->offsets),
+- GFP_KERNEL);
++
++ ubuf->offsets = kvcalloc(pgcnt, sizeof(*ubuf->offsets), GFP_KERNEL);
+ if (!ubuf->offsets) {
+ ret = -ENOMEM;
+ goto err;
+ }
+
+- pgbuf = 0;
+ for (i = 0; i < head->count; i++) {
+- memfd = fget(list[i].memfd);
+- ret = check_memfd_seals(memfd);
+- if (ret < 0)
+- goto err;
++ struct file *memfd = fget(list[i].memfd);
+
+- pgcnt = list[i].size >> PAGE_SHIFT;
+- folios = kvmalloc_array(pgcnt, sizeof(*folios), GFP_KERNEL);
+- if (!folios) {
+- ret = -ENOMEM;
++ if (!memfd) {
++ ret = -EBADFD;
+ goto err;
+ }
+
+- end = list[i].offset + (pgcnt << PAGE_SHIFT) - 1;
+- ret = memfd_pin_folios(memfd, list[i].offset, end,
+- folios, pgcnt, &pgoff);
+- if (ret <= 0) {
+- kvfree(folios);
+- if (!ret)
+- ret = -EINVAL;
++ ret = check_memfd_seals(memfd);
++ if (ret < 0) {
++ fput(memfd);
+ goto err;
+ }
+
+- nr_folios = ret;
+- pgoff >>= PAGE_SHIFT;
+- for (j = 0, k = 0; j < pgcnt; j++) {
+- ubuf->folios[pgbuf] = folios[k];
+- ubuf->offsets[pgbuf] = pgoff << PAGE_SHIFT;
+-
+- if (j == 0 || ubuf->folios[pgbuf-1] != folios[k]) {
+- ret = add_to_unpin_list(&ubuf->unpin_list,
+- folios[k]);
+- if (ret < 0) {
+- kfree(folios);
+- goto err;
+- }
+- }
+-
+- pgbuf++;
+- if (++pgoff == folio_nr_pages(folios[k])) {
+- pgoff = 0;
+- if (++k == nr_folios)
+- break;
+- }
+- }
+-
+- kvfree(folios);
++ ret = udmabuf_pin_folios(ubuf, memfd, list[i].offset,
++ list[i].size);
+ fput(memfd);
+- memfd = NULL;
++ if (ret)
++ goto err;
+ }
+
+ flags = head->flags & UDMABUF_FLAGS_CLOEXEC ? O_CLOEXEC : 0;
+@@ -403,8 +420,6 @@ static long udmabuf_create(struct miscdevice *device,
+ return ret;
+
+ err:
+- if (memfd)
+- fput(memfd);
+ unpin_all_folios(&ubuf->unpin_list);
+ kvfree(ubuf->offsets);
+ kvfree(ubuf->folios);
+--
+2.39.5
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
