--- /dev/null
+From ebe82c6e75cfc547154d0fd843b0dd6cca3d548f Mon Sep 17 00:00:00 2001
+From: Xi Ruoyao <xry111@xry111.site>
+Date: Fri, 6 Mar 2026 14:28:03 +0800
+Subject: drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END}
+
+From: Xi Ruoyao <xry111@xry111.site>
+
+commit ebe82c6e75cfc547154d0fd843b0dd6cca3d548f upstream.
+
+[Why]
+The dcn32_override_min_req_memclk function is in dcn32_fpu.c, which is
+compiled with CC_FLAGS_FPU into FP instructions. So when we call it we
+must use DC_FP_{START,END} to save and restore the FP context, and
+prepare the FP unit on architectures like LoongArch where the FP unit
+isn't always on.
+
+Reported-by: LiarOnce <liaronce@hotmail.com>
+Fixes: ee7be8f3de1c ("drm/amd/display: Limit DCN32 8 channel or less parts to DPM1 for FPO")
+Signed-off-by: Xi Ruoyao <xry111@xry111.site>
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 25bb1d54ba3983c064361033a8ec15474fece37e)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c
+@@ -1784,7 +1784,10 @@ static bool dml1_validate(struct dc *dc,
+
+ dc->res_pool->funcs->calculate_wm_and_dlg(dc, context, pipes, pipe_cnt, vlevel);
+
++ DC_FP_START();
+ dcn32_override_min_req_memclk(dc, context);
++ DC_FP_END();
++
+ dcn32_override_min_req_dcfclk(dc, context);
+
+ BW_VAL_TRACE_END_WATERMARKS();
--- /dev/null
+From 9787f7da186ee8143b7b6d914cfa0b6e7fee2648 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 25 Sep 2023 10:44:07 -0400
+Subject: drm/amdgpu: apply state adjust rules to some additional HAINAN vairants
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 9787f7da186ee8143b7b6d914cfa0b6e7fee2648 upstream.
+
+They need a similar workaround.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1839
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 0de31d92a173d3d94f28051b0b80a6c98913aed4)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -3440,9 +3440,11 @@ static void si_apply_state_adjust_rules(
+ if (adev->asic_type == CHIP_HAINAN) {
+ if ((adev->pdev->revision == 0x81) ||
+ (adev->pdev->revision == 0xC3) ||
++ (adev->pdev->device == 0x6660) ||
+ (adev->pdev->device == 0x6664) ||
+ (adev->pdev->device == 0x6665) ||
+- (adev->pdev->device == 0x6667)) {
++ (adev->pdev->device == 0x6667) ||
++ (adev->pdev->device == 0x666F)) {
+ max_sclk = 75000;
+ }
+ if ((adev->pdev->revision == 0xC3) ||
--- /dev/null
+From f39e1270277f4b06db0b2c6ec9405b6dd766fb13 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 16 Mar 2026 15:51:08 -0400
+Subject: drm/amdgpu/gmc9.0: add bounds checking for cid
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit f39e1270277f4b06db0b2c6ec9405b6dd766fb13 upstream.
+
+The value should never exceed the array size as those
+are the only values the hardware is expected to return,
+but add checks anyway.
+
+Cc: Benjamin Cheng <benjamin.cheng@amd.com>
+Reviewed-by: Benjamin Cheng <benjamin.cheng@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit e14d468304832bcc4a082d95849bc0a41b18ddea)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+@@ -688,28 +688,35 @@ static int gmc_v9_0_process_interrupt(st
+ } else {
+ switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
+ case IP_VERSION(9, 0, 0):
+- mmhub_cid = mmhub_client_ids_vega10[cid][rw];
++ mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_vega10) ?
++ mmhub_client_ids_vega10[cid][rw] : NULL;
+ break;
+ case IP_VERSION(9, 3, 0):
+- mmhub_cid = mmhub_client_ids_vega12[cid][rw];
++ mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_vega12) ?
++ mmhub_client_ids_vega12[cid][rw] : NULL;
+ break;
+ case IP_VERSION(9, 4, 0):
+- mmhub_cid = mmhub_client_ids_vega20[cid][rw];
++ mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_vega20) ?
++ mmhub_client_ids_vega20[cid][rw] : NULL;
+ break;
+ case IP_VERSION(9, 4, 1):
+- mmhub_cid = mmhub_client_ids_arcturus[cid][rw];
++ mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_arcturus) ?
++ mmhub_client_ids_arcturus[cid][rw] : NULL;
+ break;
+ case IP_VERSION(9, 1, 0):
+ case IP_VERSION(9, 2, 0):
+- mmhub_cid = mmhub_client_ids_raven[cid][rw];
++ mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_raven) ?
++ mmhub_client_ids_raven[cid][rw] : NULL;
+ break;
+ case IP_VERSION(1, 5, 0):
+ case IP_VERSION(2, 4, 0):
+- mmhub_cid = mmhub_client_ids_renoir[cid][rw];
++ mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_renoir) ?
++ mmhub_client_ids_renoir[cid][rw] : NULL;
+ break;
+ case IP_VERSION(1, 8, 0):
+ case IP_VERSION(9, 4, 2):
+- mmhub_cid = mmhub_client_ids_aldebaran[cid][rw];
++ mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_aldebaran) ?
++ mmhub_client_ids_aldebaran[cid][rw] : NULL;
+ break;
+ default:
+ mmhub_cid = NULL;
--- /dev/null
+From 0b26edac4ac5535df1f63e6e8ab44c24fe1acad7 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 4 Mar 2026 17:22:43 -0500
+Subject: drm/amdgpu/mmhub2.0: add bounds checking for cid
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 0b26edac4ac5535df1f63e6e8ab44c24fe1acad7 upstream.
+
+The value should never exceed the array size as those
+are the only values the hardware is expected to return,
+but add checks anyway.
+
+Reviewed-by: Benjamin Cheng <benjamin.cheng@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit e064cef4b53552602bb6ac90399c18f662f3cacd)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
+@@ -154,14 +154,17 @@ mmhub_v2_0_print_l2_protection_fault_sta
+ switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
+ case IP_VERSION(2, 0, 0):
+ case IP_VERSION(2, 0, 2):
+- mmhub_cid = mmhub_client_ids_navi1x[cid][rw];
++ mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_navi1x) ?
++ mmhub_client_ids_navi1x[cid][rw] : NULL;
+ break;
+ case IP_VERSION(2, 1, 0):
+ case IP_VERSION(2, 1, 1):
+- mmhub_cid = mmhub_client_ids_sienna_cichlid[cid][rw];
++ mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_sienna_cichlid) ?
++ mmhub_client_ids_sienna_cichlid[cid][rw] : NULL;
+ break;
+ case IP_VERSION(2, 1, 2):
+- mmhub_cid = mmhub_client_ids_beige_goby[cid][rw];
++ mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_beige_goby) ?
++ mmhub_client_ids_beige_goby[cid][rw] : NULL;
+ break;
+ default:
+ mmhub_cid = NULL;
--- /dev/null
+From a54403a534972af5d9ba5aaa3bb6ead612500ec6 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 4 Mar 2026 17:24:10 -0500
+Subject: drm/amdgpu/mmhub2.3: add bounds checking for cid
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit a54403a534972af5d9ba5aaa3bb6ead612500ec6 upstream.
+
+The value should never exceed the array size as those
+are the only values the hardware is expected to return,
+but add checks anyway.
+
+Reviewed-by: Benjamin Cheng <benjamin.cheng@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 89cd90375c19fb45138990b70e9f4ba4806f05c4)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/mmhub_v2_3.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_3.c
++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_3.c
+@@ -94,7 +94,8 @@ mmhub_v2_3_print_l2_protection_fault_sta
+ case IP_VERSION(2, 3, 0):
+ case IP_VERSION(2, 4, 0):
+ case IP_VERSION(2, 4, 1):
+- mmhub_cid = mmhub_client_ids_vangogh[cid][rw];
++ mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_vangogh) ?
++ mmhub_client_ids_vangogh[cid][rw] : NULL;
+ break;
+ default:
+ mmhub_cid = NULL;
--- /dev/null
+From cdb82ecbeccb55fae75a3c956b605f7801a30db1 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 4 Mar 2026 17:25:30 -0500
+Subject: drm/amdgpu/mmhub3.0: add bounds checking for cid
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit cdb82ecbeccb55fae75a3c956b605f7801a30db1 upstream.
+
+The value should never exceed the array size as those
+are the only values the hardware is expected to return,
+but add checks anyway.
+
+Reviewed-by: Benjamin Cheng <benjamin.cheng@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit f14f27bbe2a3ed7af32d5f6eaf3f417139f45253)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/mmhub_v3_0.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0.c
+@@ -110,7 +110,8 @@ mmhub_v3_0_print_l2_protection_fault_sta
+ switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
+ case IP_VERSION(3, 0, 0):
+ case IP_VERSION(3, 0, 1):
+- mmhub_cid = mmhub_client_ids_v3_0_0[cid][rw];
++ mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_v3_0_0) ?
++ mmhub_client_ids_v3_0_0[cid][rw] : NULL;
+ break;
+ default:
+ mmhub_cid = NULL;
--- /dev/null
+From 5d4e88bcfef29569a1db224ef15e28c603666c6d Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 4 Mar 2026 17:24:35 -0500
+Subject: drm/amdgpu/mmhub3.0.1: add bounds checking for cid
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 5d4e88bcfef29569a1db224ef15e28c603666c6d upstream.
+
+The value should never exceed the array size as those
+are the only values the hardware is expected to return,
+but add checks anyway.
+
+Reviewed-by: Benjamin Cheng <benjamin.cheng@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 5f76083183363c4528a4aaa593f5d38c28fe7d7b)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c
++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c
+@@ -117,7 +117,8 @@ mmhub_v3_0_1_print_l2_protection_fault_s
+
+ switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
+ case IP_VERSION(3, 0, 1):
+- mmhub_cid = mmhub_client_ids_v3_0_1[cid][rw];
++ mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_v3_0_1) ?
++ mmhub_client_ids_v3_0_1[cid][rw] : NULL;
+ break;
+ default:
+ mmhub_cid = NULL;
--- /dev/null
+From e5e6d67b1ce9764e67aef2d0eef9911af53ad99a Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 4 Mar 2026 17:25:09 -0500
+Subject: drm/amdgpu/mmhub3.0.2: add bounds checking for cid
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit e5e6d67b1ce9764e67aef2d0eef9911af53ad99a upstream.
+
+The value should never exceed the array size as those
+are the only values the hardware is expected to return,
+but add checks anyway.
+
+Reviewed-by: Benjamin Cheng <benjamin.cheng@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 1441f52c7f6ae6553664aa9e3e4562f6fc2fe8ea)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_2.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_2.c
++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_2.c
+@@ -108,7 +108,8 @@ mmhub_v3_0_2_print_l2_protection_fault_s
+ "MMVM_L2_PROTECTION_FAULT_STATUS:0x%08X\n",
+ status);
+
+- mmhub_cid = mmhub_client_ids_v3_0_2[cid][rw];
++ mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_v3_0_2) ?
++ mmhub_client_ids_v3_0_2[cid][rw] : NULL;
+ dev_err(adev->dev, "\t Faulty UTCL2 client ID: %s (0x%x)\n",
+ mmhub_cid ? mmhub_cid : "unknown", cid);
+ dev_err(adev->dev, "\t MORE_FAULTS: 0x%lx\n",
--- /dev/null
+From 3cdd405831d8cc50a5eae086403402697bb98a4a Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 4 Mar 2026 17:25:56 -0500
+Subject: drm/amdgpu/mmhub4.1.0: add bounds checking for cid
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 3cdd405831d8cc50a5eae086403402697bb98a4a upstream.
+
+The value should never exceed the array size as those
+are the only values the hardware is expected to return,
+but add checks anyway.
+
+Reviewed-by: Benjamin Cheng <benjamin.cheng@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 04f063d85090f5dd0c671010ce88ee49d9dcc8ed)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/mmhub_v4_1_0.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v4_1_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v4_1_0.c
+@@ -102,7 +102,8 @@ mmhub_v4_1_0_print_l2_protection_fault_s
+ status);
+ switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
+ case IP_VERSION(4, 1, 0):
+- mmhub_cid = mmhub_client_ids_v4_1_0[cid][rw];
++ mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_v4_1_0) ?
++ mmhub_client_ids_v4_1_0[cid][rw] : NULL;
+ break;
+ default:
+ mmhub_cid = NULL;
--- /dev/null
+From 6bee098b91417654703e17eb5c1822c6dfd0c01d Mon Sep 17 00:00:00 2001
+From: Maarten Lankhorst <dev@lankhorst.se>
+Date: Fri, 13 Mar 2026 16:17:27 +0100
+Subject: drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maarten Lankhorst <dev@lankhorst.se>
+
+commit 6bee098b91417654703e17eb5c1822c6dfd0c01d upstream.
+
+When trying to do a rather aggressive test of igt's "xe_module_load
+--r reload" with a full desktop environment and game running I noticed
+a few OOPSes when dereferencing freed pointers, related to
+framebuffers and property blobs after the compositor exits.
+
+Solve this by guarding the freeing in drm_file with drm_dev_enter/exit,
+and immediately put the references from struct drm_file objects during
+drm_dev_unplug().
+
+Related warnings for framebuffers on the subtest:
+[ 739.713076] ------------[ cut here ]------------
+ WARN_ON(!list_empty(&dev->mode_config.fb_list))
+[ 739.713079] WARNING: drivers/gpu/drm/drm_mode_config.c:584 at drm_mode_config_cleanup+0x30b/0x320 [drm], CPU#12: xe_module_load/13145
+....
+[ 739.713328] Call Trace:
+[ 739.713330] <TASK>
+[ 739.713335] ? intel_pmdemand_destroy_state+0x11/0x20 [xe]
+[ 739.713574] ? intel_atomic_global_obj_cleanup+0xe4/0x1a0 [xe]
+[ 739.713794] intel_display_driver_remove_noirq+0x51/0xb0 [xe]
+[ 739.714041] xe_display_fini_early+0x33/0x50 [xe]
+[ 739.714284] devm_action_release+0xf/0x20
+[ 739.714294] devres_release_all+0xad/0xf0
+[ 739.714301] device_unbind_cleanup+0x12/0xa0
+[ 739.714305] device_release_driver_internal+0x1b7/0x210
+[ 739.714311] device_driver_detach+0x14/0x20
+[ 739.714315] unbind_store+0xa6/0xb0
+[ 739.714319] drv_attr_store+0x21/0x30
+[ 739.714322] sysfs_kf_write+0x48/0x60
+[ 739.714328] kernfs_fop_write_iter+0x16b/0x240
+[ 739.714333] vfs_write+0x266/0x520
+[ 739.714341] ksys_write+0x72/0xe0
+[ 739.714345] __x64_sys_write+0x19/0x20
+[ 739.714347] x64_sys_call+0xa15/0xa30
+[ 739.714355] do_syscall_64+0xd8/0xab0
+[ 739.714361] entry_SYSCALL_64_after_hwframe+0x4b/0x53
+
+and
+
+[ 739.714459] ------------[ cut here ]------------
+[ 739.714461] xe 0000:67:00.0: [drm] drm_WARN_ON(!list_empty(&fb->filp_head))
+[ 739.714464] WARNING: drivers/gpu/drm/drm_framebuffer.c:833 at drm_framebuffer_free+0x6c/0x90 [drm], CPU#12: xe_module_load/13145
+[ 739.714715] RIP: 0010:drm_framebuffer_free+0x7a/0x90 [drm]
+...
+[ 739.714869] Call Trace:
+[ 739.714871] <TASK>
+[ 739.714876] drm_mode_config_cleanup+0x26a/0x320 [drm]
+[ 739.714998] ? __drm_printfn_seq_file+0x20/0x20 [drm]
+[ 739.715115] ? drm_mode_config_cleanup+0x207/0x320 [drm]
+[ 739.715235] intel_display_driver_remove_noirq+0x51/0xb0 [xe]
+[ 739.715576] xe_display_fini_early+0x33/0x50 [xe]
+[ 739.715821] devm_action_release+0xf/0x20
+[ 739.715828] devres_release_all+0xad/0xf0
+[ 739.715843] device_unbind_cleanup+0x12/0xa0
+[ 739.715850] device_release_driver_internal+0x1b7/0x210
+[ 739.715856] device_driver_detach+0x14/0x20
+[ 739.715860] unbind_store+0xa6/0xb0
+[ 739.715865] drv_attr_store+0x21/0x30
+[ 739.715868] sysfs_kf_write+0x48/0x60
+[ 739.715873] kernfs_fop_write_iter+0x16b/0x240
+[ 739.715878] vfs_write+0x266/0x520
+[ 739.715886] ksys_write+0x72/0xe0
+[ 739.715890] __x64_sys_write+0x19/0x20
+[ 739.715893] x64_sys_call+0xa15/0xa30
+[ 739.715900] do_syscall_64+0xd8/0xab0
+[ 739.715905] entry_SYSCALL_64_after_hwframe+0x4b/0x53
+
+and then finally file close blows up:
+
+[ 743.186530] Oops: general protection fault, probably for non-canonical address 0xdead000000000122: 0000 [#1] SMP
+[ 743.186535] CPU: 3 UID: 1000 PID: 3453 Comm: kwin_wayland Tainted: G W 7.0.0-rc1-valkyria+ #110 PREEMPT_{RT,(lazy)}
+[ 743.186537] Tainted: [W]=WARN
+[ 743.186538] Hardware name: Gigabyte Technology Co., Ltd. X299 AORUS Gaming 3/X299 AORUS Gaming 3-CF, BIOS F8n 12/06/2021
+[ 743.186539] RIP: 0010:drm_framebuffer_cleanup+0x55/0xc0 [drm]
+[ 743.186588] Code: d8 72 73 0f b6 42 05 ff c3 39 c3 72 e8 49 8d bd 50 07 00 00 31 f6 e8 3a 80 d3 e1 49 8b 44 24 10 49 8d 7c 24 08 49 8b 54 24 08 <48> 3b 38 0f 85 95 7f 02 00 48 3b 7a 08 0f 85 8b 7f 02 00 48 89 42
+[ 743.186589] RSP: 0018:ffffc900085e3cf8 EFLAGS: 00010202
+[ 743.186591] RAX: dead000000000122 RBX: 0000000000000001 RCX: ffffffff8217ed03
+[ 743.186592] RDX: dead000000000100 RSI: 0000000000000000 RDI: ffff88814675ba08
+[ 743.186593] RBP: ffffc900085e3d10 R08: 0000000000000000 R09: 0000000000000000
+[ 743.186593] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88814675ba00
+[ 743.186594] R13: ffff88810d778000 R14: ffff888119f6dca0 R15: ffff88810c660bb0
+[ 743.186595] FS: 00007ff377d21280(0000) GS:ffff888cec3f8000(0000) knlGS:0000000000000000
+[ 743.186596] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 743.186596] CR2: 000055690b55e000 CR3: 0000000113586003 CR4: 00000000003706f0
+[ 743.186597] Call Trace:
+[ 743.186598] <TASK>
+[ 743.186603] intel_user_framebuffer_destroy+0x12/0x90 [xe]
+[ 743.186722] drm_framebuffer_free+0x3a/0x90 [drm]
+[ 743.186750] ? trace_hardirqs_on+0x5f/0x120
+[ 743.186754] drm_mode_object_put+0x51/0x70 [drm]
+[ 743.186786] drm_fb_release+0x105/0x190 [drm]
+[ 743.186812] ? rt_mutex_slowunlock+0x3aa/0x410
+[ 743.186817] ? rt_spin_lock+0xea/0x1b0
+[ 743.186819] drm_file_free+0x1e0/0x2c0 [drm]
+[ 743.186843] drm_release_noglobal+0x91/0xf0 [drm]
+[ 743.186865] __fput+0x100/0x2e0
+[ 743.186869] fput_close_sync+0x40/0xa0
+[ 743.186870] __x64_sys_close+0x3e/0x80
+[ 743.186873] x64_sys_call+0xa07/0xa30
+[ 743.186879] do_syscall_64+0xd8/0xab0
+[ 743.186881] entry_SYSCALL_64_after_hwframe+0x4b/0x53
+[ 743.186882] RIP: 0033:0x7ff37e567732
+[ 743.186884] Code: 08 0f 85 a1 38 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 55 bf 01 00
+[ 743.186885] RSP: 002b:00007ffc818169a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
+[ 743.186886] RAX: ffffffffffffffda RBX: 00007ffc81816a30 RCX: 00007ff37e567732
+[ 743.186887] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000012
+[ 743.186888] RBP: 00007ffc818169d0 R08: 0000000000000000 R09: 0000000000000000
+[ 743.186889] R10: 0000000000000000 R11: 0000000000000246 R12: 000055d60a7996e0
+[ 743.186889] R13: 00007ffc81816a90 R14: 00007ffc81816a90 R15: 000055d60a782a30
+[ 743.186892] </TASK>
+[ 743.186893] Modules linked in: rfcomm snd_hrtimer xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp xt_addrtype nft_compat x_tables nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables overlay cfg80211 bnep mtd_intel_dg snd_hda_codec_intelhdmi mtd snd_hda_codec_hdmi nls_utf8 mxm_wmi intel_wmi_thunderbolt gigabyte_wmi wmi_bmof xe drm_gpuvm drm_gpusvm_helper i2c_algo_bit drm_buddy drm_ttm_helper ttm video drm_suballoc_helper gpu_sched drm_client_lib drm_exec drm_display_helper cec drm_kunit_helpers drm_kms_helper kunit x86_pkg_temp_thermal intel_powerclamp coretemp snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_intel snd_soc_avs snd_soc_hda_codec snd_hda_ext_core snd_hda_codec snd_hwdep snd_hda_core snd_intel_dspcfg snd_soc_core snd_compress ac97_bus snd_pcm snd_seq snd_seq_device snd_timer i2c_i801 i2c_mux snd i2c_smbus btusb btrtl btbcm btmtk btintel bluetooth ecdh_generic rfkill ecc mei_me mei ioatdma dca wmi nfsd drm i2c_dev fuse nfnetlink
+[ 743.186938] ---[ end trace 0000000000000000 ]---
+
+And for property blobs:
+
+void drm_mode_config_cleanup(struct drm_device *dev)
+{
+...
+ list_for_each_entry_safe(blob, bt, &dev->mode_config.property_blob_list,
+ head_global) {
+ drm_property_blob_put(blob);
+ }
+
+Resulting in:
+
+[ 371.072940] BUG: unable to handle page fault for address: 000001ffffffffff
+[ 371.072944] #PF: supervisor read access in kernel mode
+[ 371.072945] #PF: error_code(0x0000) - not-present page
+[ 371.072947] PGD 0 P4D 0
+[ 371.072950] Oops: Oops: 0000 [#1] SMP
+[ 371.072953] CPU: 0 UID: 1000 PID: 3693 Comm: kwin_wayland Not tainted 7.0.0-rc1-valkyria+ #111 PREEMPT_{RT,(lazy)}
+[ 371.072956] Hardware name: Gigabyte Technology Co., Ltd. X299 AORUS Gaming 3/X299 AORUS Gaming 3-CF, BIOS F8n 12/06/2021
+[ 371.072957] RIP: 0010:drm_property_destroy_user_blobs+0x3b/0x90 [drm]
+[ 371.073019] Code: 00 00 48 83 ec 10 48 8b 86 30 01 00 00 48 39 c3 74 59 48 89 c2 48 8d 48 c8 48 8b 00 4c 8d 60 c8 eb 04 4c 8d 60 c8 48 8b 71 40 <48> 39 16 0f 85 39 32 01 00 48 3b 50 08 0f 85 2f 32 01 00 48 89 70
+[ 371.073021] RSP: 0018:ffffc90006a73de8 EFLAGS: 00010293
+[ 371.073022] RAX: 000001ffffffffff RBX: ffff888118a1a930 RCX: ffff8881b92355c0
+[ 371.073024] RDX: ffff8881b92355f8 RSI: 000001ffffffffff RDI: ffff888118be4000
+[ 371.073025] RBP: ffffc90006a73e08 R08: ffff8881009b7300 R09: ffff888cecc5b000
+[ 371.073026] R10: ffffc90006a73e90 R11: 0000000000000002 R12: 000001ffffffffc7
+[ 371.073027] R13: ffff888118a1a980 R14: ffff88810b366d20 R15: ffff888118a1a970
+[ 371.073028] FS: 00007f1faccbb280(0000) GS:ffff888cec2db000(0000) knlGS:0000000000000000
+[ 371.073029] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 371.073030] CR2: 000001ffffffffff CR3: 000000010655c001 CR4: 00000000003706f0
+[ 371.073031] Call Trace:
+[ 371.073033] <TASK>
+[ 371.073036] drm_file_free+0x1df/0x2a0 [drm]
+[ 371.073077] drm_release_noglobal+0x7a/0xe0 [drm]
+[ 371.073113] __fput+0xe2/0x2b0
+[ 371.073118] fput_close_sync+0x40/0xa0
+[ 371.073119] __x64_sys_close+0x3e/0x80
+[ 371.073122] x64_sys_call+0xa07/0xa30
+[ 371.073126] do_syscall_64+0xc0/0x840
+[ 371.073130] entry_SYSCALL_64_after_hwframe+0x4b/0x53
+[ 371.073132] RIP: 0033:0x7f1fb3501732
+[ 371.073133] Code: 08 0f 85 a1 38 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 55 bf 01 00
+[ 371.073135] RSP: 002b:00007ffe8e6f0278 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
+[ 371.073136] RAX: ffffffffffffffda RBX: 00007ffe8e6f0300 RCX: 00007f1fb3501732
+[ 371.073137] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000012
+[ 371.073138] RBP: 00007ffe8e6f02a0 R08: 0000000000000000 R09: 0000000000000000
+[ 371.073139] R10: 0000000000000000 R11: 0000000000000246 R12: 00005585ba46eea0
+[ 371.073140] R13: 00007ffe8e6f0360 R14: 00007ffe8e6f0360 R15: 00005585ba458a30
+[ 371.073143] </TASK>
+[ 371.073144] Modules linked in: rfcomm snd_hrtimer xt_addrtype xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp nft_compat x_tables nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables overlay cfg80211 bnep snd_hda_codec_intelhdmi snd_hda_codec_hdmi mtd_intel_dg mtd nls_utf8 wmi_bmof mxm_wmi gigabyte_wmi intel_wmi_thunderbolt xe drm_gpuvm drm_gpusvm_helper i2c_algo_bit drm_buddy drm_ttm_helper ttm video drm_suballoc_helper gpu_sched drm_client_lib drm_exec drm_display_helper cec drm_kunit_helpers drm_kms_helper kunit x86_pkg_temp_thermal intel_powerclamp coretemp snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_intel snd_soc_avs snd_soc_hda_codec snd_hda_ext_core snd_hda_codec snd_hwdep snd_hda_core snd_intel_dspcfg snd_soc_core snd_compress ac97_bus snd_pcm snd_seq snd_seq_device snd_timer i2c_i801 btusb i2c_mux i2c_smbus btrtl snd btbcm btmtk btintel bluetooth ecdh_generic rfkill ecc mei_me mei ioatdma dca wmi nfsd drm i2c_dev fuse nfnetlink
+[ 371.073198] CR2: 000001ffffffffff
+[ 371.073199] ---[ end trace 0000000000000000 ]---
+
+Add a guard around file close, and ensure the warnings from drm_mode_config
+do not trigger. Fix those by allowing an open reference to the file descriptor
+and cleaning up the file linked list entry in drm_mode_config_cleanup().
+
+Cc: <stable@vger.kernel.org> # v4.18+
+Fixes: bee330f3d672 ("drm: Use srcu to protect drm_device.unplugged")
+Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Link: https://patch.msgid.link/20260313151728.14990-4-dev@lankhorst.se
+Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_file.c | 5 ++++-
+ drivers/gpu/drm/drm_mode_config.c | 9 ++++++---
+ 2 files changed, 10 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/drm_file.c
++++ b/drivers/gpu/drm/drm_file.c
+@@ -223,6 +223,7 @@ static void drm_events_release(struct dr
+ void drm_file_free(struct drm_file *file)
+ {
+ struct drm_device *dev;
++ int idx;
+
+ if (!file)
+ return;
+@@ -236,9 +237,11 @@ void drm_file_free(struct drm_file *file
+
+ drm_events_release(file);
+
+- if (drm_core_check_feature(dev, DRIVER_MODESET)) {
++ if (drm_core_check_feature(dev, DRIVER_MODESET) &&
++ drm_dev_enter(dev, &idx)) {
+ drm_fb_release(file);
+ drm_property_destroy_user_blobs(dev, file);
++ drm_dev_exit(idx);
+ }
+
+ if (drm_core_check_feature(dev, DRIVER_SYNCOBJ))
+--- a/drivers/gpu/drm/drm_mode_config.c
++++ b/drivers/gpu/drm/drm_mode_config.c
+@@ -553,10 +553,13 @@ void drm_mode_config_cleanup(struct drm_
+ */
+ WARN_ON(!list_empty(&dev->mode_config.fb_list));
+ list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {
+- struct drm_printer p = drm_dbg_printer(dev, DRM_UT_KMS, "[leaked fb]");
++ if (list_empty(&fb->filp_head) || drm_framebuffer_read_refcount(fb) > 1) {
++ struct drm_printer p = drm_dbg_printer(dev, DRM_UT_KMS, "[leaked fb]");
+
+- drm_printf(&p, "framebuffer[%u]:\n", fb->base.id);
+- drm_framebuffer_print_info(&p, 1, fb);
++ drm_printf(&p, "framebuffer[%u]:\n", fb->base.id);
++ drm_framebuffer_print_info(&p, 1, fb);
++ }
++ list_del_init(&fb->filp_head);
+ drm_framebuffer_free(&fb->base.refcount);
+ }
+
--- /dev/null
+From a55c2a5c8d680156495b7b1e2a9f5a3e313ba524 Mon Sep 17 00:00:00 2001
+From: Alessio Belle <alessio.belle@imgtec.com>
+Date: Mon, 9 Mar 2026 15:23:48 +0000
+Subject: drm/imagination: Fix deadlock in soft reset sequence
+
+From: Alessio Belle <alessio.belle@imgtec.com>
+
+commit a55c2a5c8d680156495b7b1e2a9f5a3e313ba524 upstream.
+
+The soft reset sequence is currently executed from the threaded IRQ
+handler, hence it cannot call disable_irq() which internally waits
+for IRQ handlers, i.e. itself, to complete.
+
+Use disable_irq_nosync() during a soft reset instead.
+
+Fixes: cc1aeedb98ad ("drm/imagination: Implement firmware infrastructure and META FW support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Alessio Belle <alessio.belle@imgtec.com>
+Reviewed-by: Matt Coster <matt.coster@imgtec.com>
+Link: https://patch.msgid.link/20260309-fix-soft-reset-v1-1-121113be554f@imgtec.com
+Signed-off-by: Matt Coster <matt.coster@imgtec.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/imagination/pvr_power.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/imagination/pvr_power.c
++++ b/drivers/gpu/drm/imagination/pvr_power.c
+@@ -408,7 +408,16 @@ pvr_power_reset(struct pvr_device *pvr_d
+ }
+
+ /* Disable IRQs for the duration of the reset. */
+- disable_irq(pvr_dev->irq);
++ if (hard_reset) {
++ disable_irq(pvr_dev->irq);
++ } else {
++ /*
++ * Soft reset is triggered as a response to a FW command to the Host and is
++ * processed from the threaded IRQ handler. This code cannot (nor needs to)
++ * wait for any IRQ processing to complete.
++ */
++ disable_irq_nosync(pvr_dev->irq);
++ }
+
+ do {
+ if (hard_reset) {
--- /dev/null
+From 86650ee2241ff84207eaa298ab318533f3c21a38 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 25 Sep 2023 10:44:06 -0400
+Subject: drm/radeon: apply state adjust rules to some additional HAINAN vairants
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 86650ee2241ff84207eaa298ab318533f3c21a38 upstream.
+
+They need a similar workaround.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1839
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 87327658c848f56eac166cb382b57b83bf06c5ac)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/radeon/si_dpm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -2915,9 +2915,11 @@ static void si_apply_state_adjust_rules(
+ if (rdev->family == CHIP_HAINAN) {
+ if ((rdev->pdev->revision == 0x81) ||
+ (rdev->pdev->revision == 0xC3) ||
++ (rdev->pdev->device == 0x6660) ||
+ (rdev->pdev->device == 0x6664) ||
+ (rdev->pdev->device == 0x6665) ||
+- (rdev->pdev->device == 0x6667)) {
++ (rdev->pdev->device == 0x6667) ||
++ (rdev->pdev->device == 0x666F)) {
+ max_sclk = 75000;
+ }
+ if ((rdev->pdev->revision == 0xC3) ||
--- /dev/null
+From 9be6fd9fbd2032b683e51374497768af9aaa228a Mon Sep 17 00:00:00 2001
+From: Ashutosh Dixit <ashutosh.dixit@intel.com>
+Date: Thu, 12 Mar 2026 22:36:30 -0700
+Subject: drm/xe/oa: Allow reading after disabling OA stream
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ashutosh Dixit <ashutosh.dixit@intel.com>
+
+commit 9be6fd9fbd2032b683e51374497768af9aaa228a upstream.
+
+Some OA data might be present in the OA buffer when OA stream is
+disabled. Allow UMD's to retrieve this data, so that all data till the
+point when OA stream is disabled can be retrieved.
+
+v2: Update tail pointer after disable (Umesh)
+
+Fixes: efb315d0a013 ("drm/xe/oa/uapi: Read file_operation")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
+Reviewed-by: Umesh Nerlige Ramappa<umesh.nerlige.ramappa@intel.com>
+Link: https://patch.msgid.link/20260313053630.3176100-1-ashutosh.dixit@intel.com
+(cherry picked from commit 4ff57c5e8dbba23b5457be12f9709d5c016da16e)
+Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/xe_oa.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/xe/xe_oa.c
++++ b/drivers/gpu/drm/xe/xe_oa.c
+@@ -520,8 +520,7 @@ static ssize_t xe_oa_read(struct file *f
+ size_t offset = 0;
+ int ret;
+
+- /* Can't read from disabled streams */
+- if (!stream->enabled || !stream->sample)
++ if (!stream->sample)
+ return -EINVAL;
+
+ if (!(file->f_flags & O_NONBLOCK)) {
+@@ -1375,6 +1374,10 @@ static void xe_oa_stream_disable(struct
+
+ if (stream->sample)
+ hrtimer_cancel(&stream->poll_check_timer);
++
++ /* Update stream->oa_buffer.tail to allow any final reports to be read */
++ if (xe_oa_buffer_check_unlocked(stream))
++ wake_up(&stream->poll_wq);
+ }
+
+ static int xe_oa_enable_preempt_timeslice(struct xe_oa_stream *stream)
--- /dev/null
+From 01f2557aa684e514005541e71a3d01f4cd45c170 Mon Sep 17 00:00:00 2001
+From: Matthew Brost <matthew.brost@intel.com>
+Date: Tue, 10 Mar 2026 18:50:39 -0400
+Subject: drm/xe: Open-code GGTT MMIO access protection
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Matthew Brost <matthew.brost@intel.com>
+
+commit 01f2557aa684e514005541e71a3d01f4cd45c170 upstream.
+
+GGTT MMIO access is currently protected by hotplug (drm_dev_enter),
+which works correctly when the driver loads successfully and is later
+unbound or unloaded. However, if driver load fails, this protection is
+insufficient because drm_dev_unplug() is never called.
+
+Additionally, devm release functions cannot guarantee that all BOs with
+GGTT mappings are destroyed before the GGTT MMIO region is removed, as
+some BOs may be freed asynchronously by worker threads.
+
+To address this, introduce an open-coded flag, protected by the GGTT
+lock, that guards GGTT MMIO access. The flag is cleared during the
+dev_fini_ggtt devm release function to ensure MMIO access is disabled
+once teardown begins.
+
+Cc: stable@vger.kernel.org
+Fixes: 919bb54e989c ("drm/xe: Fix missing runtime outer protection for ggtt_remove_node")
+Reviewed-by: Zhanjun Dong <zhanjun.dong@intel.com>
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Link: https://patch.msgid.link/20260310225039.1320161-8-zhanjun.dong@intel.com
+(cherry picked from commit 4f3a998a173b4325c2efd90bdadc6ccd3ad9a431)
+Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/xe_ggtt.c | 10 ++++------
+ drivers/gpu/drm/xe/xe_ggtt_types.h | 5 ++++-
+ 2 files changed, 8 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/xe/xe_ggtt.c
++++ b/drivers/gpu/drm/xe/xe_ggtt.c
+@@ -202,6 +202,8 @@ static void dev_fini_ggtt(void *arg)
+ {
+ struct xe_ggtt *ggtt = arg;
+
++ scoped_guard(mutex, &ggtt->lock)
++ ggtt->flags &= ~XE_GGTT_FLAGS_ONLINE;
+ drain_workqueue(ggtt->wq);
+ }
+
+@@ -261,6 +263,7 @@ int xe_ggtt_init_early(struct xe_ggtt *g
+ if (err)
+ return err;
+
++ ggtt->flags |= XE_GGTT_FLAGS_ONLINE;
+ err = devm_add_action_or_reset(xe->drm.dev, dev_fini_ggtt, ggtt);
+ if (err)
+ return err;
+@@ -293,13 +296,10 @@ static void xe_ggtt_initial_clear(struct
+ static void ggtt_node_remove(struct xe_ggtt_node *node)
+ {
+ struct xe_ggtt *ggtt = node->ggtt;
+- struct xe_device *xe = tile_to_xe(ggtt->tile);
+ bool bound;
+- int idx;
+-
+- bound = drm_dev_enter(&xe->drm, &idx);
+
+ mutex_lock(&ggtt->lock);
++ bound = ggtt->flags & XE_GGTT_FLAGS_ONLINE;
+ if (bound)
+ xe_ggtt_clear(ggtt, node->base.start, node->base.size);
+ drm_mm_remove_node(&node->base);
+@@ -312,8 +312,6 @@ static void ggtt_node_remove(struct xe_g
+ if (node->invalidate_on_remove)
+ xe_ggtt_invalidate(ggtt);
+
+- drm_dev_exit(idx);
+-
+ free_node:
+ xe_ggtt_node_fini(node);
+ }
+--- a/drivers/gpu/drm/xe/xe_ggtt_types.h
++++ b/drivers/gpu/drm/xe/xe_ggtt_types.h
+@@ -25,11 +25,14 @@ struct xe_ggtt {
+ /** @size: Total size of this GGTT */
+ u64 size;
+
+-#define XE_GGTT_FLAGS_64K BIT(0)
++#define XE_GGTT_FLAGS_64K BIT(0)
++#define XE_GGTT_FLAGS_ONLINE BIT(1)
+ /**
+ * @flags: Flags for this GGTT
+ * Acceptable flags:
+ * - %XE_GGTT_FLAGS_64K - if PTE size is 64K. Otherwise, regular is 4K.
++ * - %XE_GGTT_FLAGS_ONLINE - is GGTT online, protected by ggtt->lock
++ * after init
+ */
+ unsigned int flags;
+ /** @scratch: Internal object allocation used as a scratch page */
serial-8250-add-late-synchronize_irq-to-shutdown-to-handle-dw-uart-busy.patch
serial-uartlite-fix-pm-runtime-usage-count-underflow-on-probe.patch
io_uring-kbuf-propagate-buf_more-through-early-buffer-commit-path.patch
+drm-fix-use-after-free-on-framebuffers-and-property-blobs-when-calling-drm_dev_unplug.patch
+drm-amd-display-wrap-dcn32_override_min_req_memclk-in-dc_fp_-start-end.patch
+drm-amdgpu-gmc9.0-add-bounds-checking-for-cid.patch
+drm-amdgpu-mmhub2.0-add-bounds-checking-for-cid.patch
+drm-amdgpu-mmhub2.3-add-bounds-checking-for-cid.patch
+drm-amdgpu-mmhub3.0.1-add-bounds-checking-for-cid.patch
+drm-amdgpu-mmhub3.0.2-add-bounds-checking-for-cid.patch
+drm-amdgpu-mmhub3.0-add-bounds-checking-for-cid.patch
+drm-amdgpu-mmhub4.1.0-add-bounds-checking-for-cid.patch
+drm-imagination-fix-deadlock-in-soft-reset-sequence.patch
+drm-radeon-apply-state-adjust-rules-to-some-additional-hainan-vairants.patch
+drm-amdgpu-apply-state-adjust-rules-to-some-additional-hainan-vairants.patch
+drm-xe-oa-allow-reading-after-disabling-oa-stream.patch
+drm-xe-open-code-ggtt-mmio-access-protection.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
