--- /dev/null
+From 342981fff32802a819d6fc7cf3c9fedf9f3d9d60 Mon Sep 17 00:00:00 2001
+From: Honglei Huang <honghuan@amd.com>
+Date: Fri, 29 May 2026 10:23:17 +0800
+Subject: drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Honglei Huang <honghuan@amd.com>
+
+commit 342981fff32802a819d6fc7cf3c9fedf9f3d9d60 upstream.
+
+Since commit c08972f55594 ("drm/amdgpu: fix amdgpu_hmm_range_get_pages")
+moved mmu_interval_read_begin() out of the per-chunk loop, the
+captured notifier_seq is no longer refreshed across retries. As a
+result, the existing -EBUSY retry path can never make progress:
+
+ hmm_range_fault() returns -EBUSY only when
+ mmu_interval_check_retry(notifier, notifier_seq) reports that the
+ sequence is stale. Once the sequence has advanced, the stored seq
+ will never match again, so every subsequent call within the same
+ invocation returns -EBUSY immediately.
+
+The "goto retry" therefore degenerates into a busy spin that simply
+burns CPU for the full HMM_RANGE_DEFAULT_TIMEOUT (~1s) window before
+finally bailing out with -EAGAIN. This is pure latency with no chance
+of recovery, and it actively hurts the KFD userptr stack: the caller
+ends up blocked for a second while holding mmap_lock, only to return
+-EAGAIN to the restore worker (or to userspace) which would have
+re-driven the operation immediately anyway.
+
+Drop the retry/timeout entirely and let -EBUSY propagate straight to
+out_free_pfns, where it is already translated to -EAGAIN. Recovery is
+handled at a higher level: the KFD restore_userptr_worker reschedules
+itself, and the userptr ioctl path returns -EAGAIN to userspace.
+
+No functional regression: the previous behaviour on -EBUSY was already
+to fail with -EAGAIN after a 1s stall; we just skip the stall.
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Honglei Huang <honghuan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c
+@@ -174,7 +174,6 @@ int amdgpu_hmm_range_get_pages(struct mm
+ const u64 max_bytes = SZ_2G;
+
+ struct hmm_range *hmm_range = &range->hmm_range;
+- unsigned long timeout;
+ unsigned long *pfns;
+ unsigned long end;
+ int r;
+@@ -201,15 +200,9 @@ int amdgpu_hmm_range_get_pages(struct mm
+ pr_debug("hmm range: start = 0x%lx, end = 0x%lx",
+ hmm_range->start, hmm_range->end);
+
+- timeout = jiffies + msecs_to_jiffies(HMM_RANGE_DEFAULT_TIMEOUT);
+-
+-retry:
+ r = hmm_range_fault(hmm_range);
+- if (unlikely(r)) {
+- if (r == -EBUSY && !time_after(jiffies, timeout))
+- goto retry;
++ if (unlikely(r))
+ goto out_free_pfns;
+- }
+
+ if (hmm_range->end == end)
+ break;
--- /dev/null
+From 426e5846eba75feaf1c9c6c119cb153610192da1 Mon Sep 17 00:00:00 2001
+From: Rafael Passos <rafael@rcpassos.me>
+Date: Tue, 2 Jun 2026 00:05:19 -0300
+Subject: HID: Input: Add battery list cleanup with devm action
+
+From: Rafael Passos <rafael@rcpassos.me>
+
+commit 426e5846eba75feaf1c9c6c119cb153610192da1 upstream.
+
+The batteries list (hdev->batteries) is not cleaned up during
+hidinput_disconnect(), but struct hid_battery entries are allocated
+with devm_kzalloc.
+When a driver is unbound (e.g. during devicereprobe), devm frees those
+entries while their list_head nodesremain dangling in hdev->batteries,
+which persists across rebinds.
+
+Link: https://lore.kernel.org/all/20260602011949.2825852-1-rafael@rcpassos.me/
+Fixes: 4a58ae85c3f9 ("HID: input: Add support for multiple batteries per device")
+Signed-off-by: Rafael Passos <rafael@rcpassos.me>
+Acked-by: Lucas Zampieri <lcasmz54@gmail.com>
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-input.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -519,6 +519,13 @@ static struct hid_battery *hidinput_find
+ return NULL;
+ }
+
++static void hidinput_cleanup_battery(void *res)
++{
++ struct hid_battery *bat = res;
++
++ list_del(&bat->list);
++}
++
+ static int hidinput_setup_battery(struct hid_device *dev, unsigned report_type,
+ struct hid_field *field, bool is_percentage)
+ {
+@@ -610,6 +617,12 @@ static int hidinput_setup_battery(struct
+
+ power_supply_powers(bat->ps, &dev->dev);
+ list_add_tail(&bat->list, &dev->batteries);
++
++ error = devm_add_action_or_reset(&dev->dev,
++ hidinput_cleanup_battery, bat);
++ if (error)
++ return error;
++
+ return 0;
+
+ err_free_name:
projects / thirdparty / kernel / stable-queue.git / commitdiff
