--- /dev/null
+From c764b7af15289051718b4859a67f9a3bc69d3fb2 Mon Sep 17 00:00:00 2001
+From: Yang Wang <kevinyang.wang@amd.com>
+Date: Wed, 21 Jan 2026 11:04:06 +0800
+Subject: drm/amd/pm: fix smu v13 soft clock frequency setting issue
+
+From: Yang Wang <kevinyang.wang@amd.com>
+
+commit c764b7af15289051718b4859a67f9a3bc69d3fb2 upstream.
+
+v1:
+resolve the issue where some freq frequencies cannot be set correctly
+due to insufficient floating-point precision.
+
+v2:
+patch this convert on 'max' value only.
+
+Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 6194f60c707e3878e120adeb36997075664d8429)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h | 1 +
+ drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h
++++ b/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h
+@@ -56,6 +56,7 @@
+ #define SMUQ10_TO_UINT(x) ((x) >> 10)
+ #define SMUQ10_FRAC(x) ((x) & 0x3ff)
+ #define SMUQ10_ROUND(x) ((SMUQ10_TO_UINT(x)) + ((SMUQ10_FRAC(x)) >= 0x200))
++#define SMU_V13_SOFT_FREQ_ROUND(x) ((x) + 1)
+
+ extern const int pmfw_decoded_link_speed[5];
+ extern const int pmfw_decoded_link_width[7];
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
+@@ -1555,6 +1555,7 @@ int smu_v13_0_set_soft_freq_limited_rang
+ return clk_id;
+
+ if (max > 0) {
++ max = SMU_V13_SOFT_FREQ_ROUND(max);
+ if (automatic)
+ param = (uint32_t)((clk_id << 16) | 0xffff);
+ else
--- /dev/null
+From 239d0ccf567c3b09aed58eb88cd3376af37aaf14 Mon Sep 17 00:00:00 2001
+From: Yang Wang <kevinyang.wang@amd.com>
+Date: Wed, 21 Jan 2026 11:06:29 +0800
+Subject: drm/amd/pm: fix smu v14 soft clock frequency setting issue
+
+From: Yang Wang <kevinyang.wang@amd.com>
+
+commit 239d0ccf567c3b09aed58eb88cd3376af37aaf14 upstream.
+
+v1:
+resolve the issue where some freq frequencies cannot be set correctly
+due to insufficient floating-point precision.
+
+v2:
+patch this convert on 'max' value only.
+
+Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 53868dd8774344051999c880115740da92f97feb)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/inc/smu_v14_0.h | 1 +
+ drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v14_0.h
++++ b/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v14_0.h
+@@ -57,6 +57,7 @@ extern const int decoded_link_width[8];
+
+ #define DECODE_GEN_SPEED(gen_speed_idx) (decoded_link_speed[gen_speed_idx])
+ #define DECODE_LANE_WIDTH(lane_width_idx) (decoded_link_width[lane_width_idx])
++#define SMU_V14_SOFT_FREQ_ROUND(x) ((x) + 1)
+
+ struct smu_14_0_max_sustainable_clocks {
+ uint32_t display_clock;
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c
+@@ -1178,6 +1178,7 @@ int smu_v14_0_set_soft_freq_limited_rang
+ return clk_id;
+
+ if (max > 0) {
++ max = SMU_V14_SOFT_FREQ_ROUND(max);
+ if (automatic)
+ param = (uint32_t)((clk_id << 16) | 0xffff);
+ else
--- /dev/null
+From b1defcdc4457649db236415ee618a7151e28788c Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 26 Jan 2026 23:44:45 -0500
+Subject: drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule()
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit b1defcdc4457649db236415ee618a7151e28788c upstream.
+
+The EXEC_COUNT field must be > 0. In the gfx shadow
+handling we always emit a cond_exec packet after the gfx_shadow
+packet, but the EXEC_COUNT never gets patched. This leads
+to a hang when we try and reset queues on gfx11 APUs.
+
+Fixes: c68cbbfd54c6 ("drm/amdgpu: cleanup conditional execution")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4789
+Reviewed-by: Jesse Zhang <Jesse.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit ba205ac3d6e83f56c4f824f23f1b4522cb844ff3)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
+@@ -228,7 +228,7 @@ int amdgpu_ib_schedule(struct amdgpu_rin
+
+ amdgpu_ring_ib_begin(ring);
+
+- if (ring->funcs->emit_gfx_shadow)
++ if (ring->funcs->emit_gfx_shadow && adev->gfx.cp_gfx_shadow)
+ amdgpu_ring_emit_gfx_shadow(ring, shadow_va, csa_va, gds_va,
+ init_shadow, vmid);
+
+@@ -284,7 +284,8 @@ int amdgpu_ib_schedule(struct amdgpu_rin
+ fence_flags | AMDGPU_FENCE_FLAG_64BIT);
+ }
+
+- if (ring->funcs->emit_gfx_shadow && ring->funcs->init_cond_exec) {
++ if (ring->funcs->emit_gfx_shadow && ring->funcs->init_cond_exec &&
++ adev->gfx.cp_gfx_shadow) {
+ amdgpu_ring_emit_gfx_shadow(ring, 0, 0, 0, false, 0);
+ amdgpu_ring_init_cond_exec(ring, ring->cond_exe_gpu_addr);
+ }
--- /dev/null
+From 8b1ecc9377bc641533cd9e76dfa3aee3cd04a007 Mon Sep 17 00:00:00 2001
+From: Jon Doron <jond@wiz.io>
+Date: Sat, 20 Dec 2025 15:04:40 +0200
+Subject: drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jon Doron <jond@wiz.io>
+
+commit 8b1ecc9377bc641533cd9e76dfa3aee3cd04a007 upstream.
+
+On APUs such as Raven and Renoir (GC 9.1.0, 9.2.2, 9.3.0), the ih1 and
+ih2 interrupt ring buffers are not initialized. This is by design, as
+these secondary IH rings are only available on discrete GPUs. See
+vega10_ih_sw_init() which explicitly skips ih1/ih2 initialization when
+AMD_IS_APU is set.
+
+However, amdgpu_gmc_filter_faults_remove() unconditionally uses ih1 to
+get the timestamp of the last interrupt entry. When retry faults are
+enabled on APUs (noretry=0), this function is called from the SVM page
+fault recovery path, resulting in a NULL pointer dereference when
+amdgpu_ih_decode_iv_ts_helper() attempts to access ih->ring[].
+
+The crash manifests as:
+
+ BUG: kernel NULL pointer dereference, address: 0000000000000004
+ RIP: 0010:amdgpu_ih_decode_iv_ts_helper+0x22/0x40 [amdgpu]
+ Call Trace:
+ amdgpu_gmc_filter_faults_remove+0x60/0x130 [amdgpu]
+ svm_range_restore_pages+0xae5/0x11c0 [amdgpu]
+ amdgpu_vm_handle_fault+0xc8/0x340 [amdgpu]
+ gmc_v9_0_process_interrupt+0x191/0x220 [amdgpu]
+ amdgpu_irq_dispatch+0xed/0x2c0 [amdgpu]
+ amdgpu_ih_process+0x84/0x100 [amdgpu]
+
+This issue was exposed by commit 1446226d32a4 ("drm/amdgpu: Remove GC HW
+IP 9.3.0 from noretry=1") which changed the default for Renoir APU from
+noretry=1 to noretry=0, enabling retry fault handling and thus
+exercising the buggy code path.
+
+Fix this by adding a check for ih1.ring_size before attempting to use
+it. Also restore the soft_ih support from commit dd299441654f ("drm/amdgpu:
+Rework retry fault removal"). This is needed if the hardware doesn't
+support secondary HW IH rings.
+
+v2: additional updates (Alex)
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3814
+Fixes: dd299441654f ("drm/amdgpu: Rework retry fault removal")
+Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
+Reviewed-by: Philip Yang <Philip.Yang@amd.com>
+Signed-off-by: Jon Doron <jond@wiz.io>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 6ce8d536c80aa1f059e82184f0d1994436b1d526)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
+@@ -498,8 +498,13 @@ void amdgpu_gmc_filter_faults_remove(str
+
+ if (adev->irq.retry_cam_enabled)
+ return;
++ else if (adev->irq.ih1.ring_size)
++ ih = &adev->irq.ih1;
++ else if (adev->irq.ih_soft.enabled)
++ ih = &adev->irq.ih_soft;
++ else
++ return;
+
+- ih = &adev->irq.ih1;
+ /* Get the WPTR of the last entry in IH ring */
+ last_wptr = amdgpu_ih_get_wptr(adev, ih);
+ /* Order wptr with ring data. */
--- /dev/null
+From cc4f433b14e05eaa4a98fd677b836e9229422387 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 28 Jan 2026 20:51:08 -0500
+Subject: drm/amdgpu/gfx10: fix wptr reset in KGQ init
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit cc4f433b14e05eaa4a98fd677b836e9229422387 upstream.
+
+wptr is a 64 bit value and we need to update the
+full value, not just 32 bits. Align with what we
+already do for KCQs.
+
+Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
+Reviewed-by: Jesse Zhang <jesse.zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit e80b1d1aa1073230b6c25a1a72e88f37e425ccda)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+@@ -6878,7 +6878,7 @@ static int gfx_v10_0_kgq_init_queue(stru
+ memcpy_toio(mqd, adev->gfx.me.mqd_backup[mqd_idx], sizeof(*mqd));
+ /* reset the ring */
+ ring->wptr = 0;
+- *ring->wptr_cpu_addr = 0;
++ atomic64_set((atomic64_t *)ring->wptr_cpu_addr, 0);
+ amdgpu_ring_clear_ring(ring);
+ }
+
--- /dev/null
+From 3eb46fbb601f9a0b4df8eba79252a0a85e983044 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 28 Jan 2026 22:55:46 -0500
+Subject: drm/amdgpu/gfx11: adjust KGQ reset sequence
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 3eb46fbb601f9a0b4df8eba79252a0a85e983044 upstream.
+
+Kernel gfx queues do not need to be reinitialized or
+remapped after a reset. This fixes queue reset failures
+on APUs.
+
+v2: preserve init and remap for MMIO case.
+
+Fixes: b3e9bfd86658 ("drm/amdgpu/gfx11: add ring reset callbacks")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4789
+Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit b340ff216fdabfe71ba0cdd47e9835a141d08e10)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+@@ -6821,11 +6821,12 @@ static int gfx_v11_0_reset_kgq(struct am
+ struct amdgpu_fence *timedout_fence)
+ {
+ struct amdgpu_device *adev = ring->adev;
++ bool use_mmio = false;
+ int r;
+
+ amdgpu_ring_reset_helper_begin(ring, timedout_fence);
+
+- r = amdgpu_mes_reset_legacy_queue(ring->adev, ring, vmid, false);
++ r = amdgpu_mes_reset_legacy_queue(ring->adev, ring, vmid, use_mmio);
+ if (r) {
+
+ dev_warn(adev->dev, "reset via MES failed and try pipe reset %d\n", r);
+@@ -6834,16 +6835,18 @@ static int gfx_v11_0_reset_kgq(struct am
+ return r;
+ }
+
+- r = gfx_v11_0_kgq_init_queue(ring, true);
+- if (r) {
+- dev_err(adev->dev, "failed to init kgq\n");
+- return r;
+- }
++ if (use_mmio) {
++ r = gfx_v11_0_kgq_init_queue(ring, true);
++ if (r) {
++ dev_err(adev->dev, "failed to init kgq\n");
++ return r;
++ }
+
+- r = amdgpu_mes_map_legacy_queue(adev, ring);
+- if (r) {
+- dev_err(adev->dev, "failed to remap kgq\n");
+- return r;
++ r = amdgpu_mes_map_legacy_queue(adev, ring);
++ if (r) {
++ dev_err(adev->dev, "failed to remap kgq\n");
++ return r;
++ }
+ }
+
+ return amdgpu_ring_reset_helper_end(ring, timedout_fence);
--- /dev/null
+From b1f810471c6a6bd349f7f9f2f2fed96082056d46 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 28 Jan 2026 18:09:03 -0500
+Subject: drm/amdgpu/gfx11: fix wptr reset in KGQ init
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit b1f810471c6a6bd349f7f9f2f2fed96082056d46 upstream.
+
+wptr is a 64 bit value and we need to update the
+full value, not just 32 bits. Align with what we
+already do for KCQs.
+
+Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
+Reviewed-by: Jesse Zhang <jesse.zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 1f16866bdb1daed7a80ca79ae2837a9832a74fbc)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+@@ -4199,7 +4199,7 @@ static int gfx_v11_0_kgq_init_queue(stru
+ memcpy_toio(mqd, adev->gfx.me.mqd_backup[mqd_idx], sizeof(*mqd));
+ /* reset the ring */
+ ring->wptr = 0;
+- *ring->wptr_cpu_addr = 0;
++ atomic64_set((atomic64_t *)ring->wptr_cpu_addr, 0);
+ amdgpu_ring_clear_ring(ring);
+ }
+
--- /dev/null
+From dfd64f6e8cd7b59238cdaf8af7a55711f13a89db Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 28 Jan 2026 23:05:50 -0500
+Subject: drm/amdgpu/gfx12: adjust KGQ reset sequence
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit dfd64f6e8cd7b59238cdaf8af7a55711f13a89db upstream.
+
+Kernel gfx queues do not need to be reinitialized or
+remapped after a reset. Align with gfx11.
+
+v2: preserve init and remap for MMIO case.
+
+Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 0a6d6ed694d72b66b0ed7a483d5effa01acd3951)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c
+@@ -5296,11 +5296,12 @@ static int gfx_v12_0_reset_kgq(struct am
+ struct amdgpu_fence *timedout_fence)
+ {
+ struct amdgpu_device *adev = ring->adev;
++ bool use_mmio = false;
+ int r;
+
+ amdgpu_ring_reset_helper_begin(ring, timedout_fence);
+
+- r = amdgpu_mes_reset_legacy_queue(ring->adev, ring, vmid, false);
++ r = amdgpu_mes_reset_legacy_queue(ring->adev, ring, vmid, use_mmio);
+ if (r) {
+ dev_warn(adev->dev, "reset via MES failed and try pipe reset %d\n", r);
+ r = gfx_v12_reset_gfx_pipe(ring);
+@@ -5308,16 +5309,18 @@ static int gfx_v12_0_reset_kgq(struct am
+ return r;
+ }
+
+- r = gfx_v12_0_kgq_init_queue(ring, true);
+- if (r) {
+- dev_err(adev->dev, "failed to init kgq\n");
+- return r;
+- }
++ if (use_mmio) {
++ r = gfx_v12_0_kgq_init_queue(ring, true);
++ if (r) {
++ dev_err(adev->dev, "failed to init kgq\n");
++ return r;
++ }
+
+- r = amdgpu_mes_map_legacy_queue(adev, ring);
+- if (r) {
+- dev_err(adev->dev, "failed to remap kgq\n");
+- return r;
++ r = amdgpu_mes_map_legacy_queue(adev, ring);
++ if (r) {
++ dev_err(adev->dev, "failed to remap kgq\n");
++ return r;
++ }
+ }
+
+ return amdgpu_ring_reset_helper_end(ring, timedout_fence);
--- /dev/null
+From 9077d32a4b570fa20500aa26e149981c366c965d Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 28 Jan 2026 18:13:16 -0500
+Subject: drm/amdgpu/gfx12: fix wptr reset in KGQ init
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 9077d32a4b570fa20500aa26e149981c366c965d upstream.
+
+wptr is a 64 bit value and we need to update the
+full value, not just 32 bits. Align with what we
+already do for KCQs.
+
+Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
+Reviewed-by: Jesse Zhang <jesse.zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit a2918f958d3f677ea93c0ac257cb6ba69b7abb7c)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c
+@@ -3078,7 +3078,7 @@ static int gfx_v12_0_kgq_init_queue(stru
+ memcpy_toio(mqd, adev->gfx.me.mqd_backup[mqd_idx], sizeof(*mqd));
+ /* reset the ring */
+ ring->wptr = 0;
+- *ring->wptr_cpu_addr = 0;
++ atomic64_set((atomic64_t *)ring->wptr_cpu_addr, 0);
+ amdgpu_ring_clear_ring(ring);
+ }
+
--- /dev/null
+From e7fbff9e7622a00c2b53cb14df481916f0019742 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 16 Jan 2026 17:33:05 -0500
+Subject: drm/amdgpu/soc21: fix xclk for APUs
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit e7fbff9e7622a00c2b53cb14df481916f0019742 upstream.
+
+The reference clock is supposed to be 100Mhz, but it
+appears to actually be slightly lower (99.81Mhz).
+
+Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/14451
+Reviewed-by: Jesse Zhang <Jesse.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 637fee3954d4bd509ea9d95ad1780fc174489860)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/soc21.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/soc21.c
++++ b/drivers/gpu/drm/amd/amdgpu/soc21.c
+@@ -225,7 +225,13 @@ static u32 soc21_get_config_memsize(stru
+
+ static u32 soc21_get_xclk(struct amdgpu_device *adev)
+ {
+- return adev->clock.spll.reference_freq;
++ u32 reference_clock = adev->clock.spll.reference_freq;
++
++ /* reference clock is actually 99.81 Mhz rather than 100 Mhz */
++ if ((adev->flags & AMD_IS_APU) && reference_clock == 10000)
++ return 9981;
++
++ return reference_clock;
+ }
+
+
--- /dev/null
+From 12f15d52d38ac53f7c70ea3d4b3d76afed04e064 Mon Sep 17 00:00:00 2001
+From: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Date: Fri, 23 Jan 2026 14:15:40 +0000
+Subject: drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+
+commit 12f15d52d38ac53f7c70ea3d4b3d76afed04e064 upstream.
+
+Since GEM bo handles are u32 in the uapi and the internal implementation
+uses idr_alloc() which uses int ranges, passing a new handle larger than
+INT_MAX trivially triggers a kernel warning:
+
+idr_alloc():
+...
+ if (WARN_ON_ONCE(start < 0))
+ return -EINVAL;
+...
+
+Fix it by rejecting new handles above INT_MAX and at the same time make
+the end limit calculation more obvious by moving into int domain.
+
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Reported-by: Zhi Wang <wangzhi@stu.xidian.edu.cn>
+Fixes: 53096728b891 ("drm: Add DRM prime interface to reassign GEM handle")
+Cc: David Francis <David.Francis@amd.com>
+Cc: Felix Kuehling <felix.kuehling@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Cc: <stable@vger.kernel.org> # v6.18+
+Tested-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
+Link: https://lore.kernel.org/r/20260123141540.76540-1-tvrtko.ursulin@igalia.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_gem.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/drm_gem.c
++++ b/drivers/gpu/drm/drm_gem.c
+@@ -970,16 +970,21 @@ int drm_gem_change_handle_ioctl(struct d
+ {
+ struct drm_gem_change_handle *args = data;
+ struct drm_gem_object *obj;
+- int ret;
++ int handle, ret;
+
+ if (!drm_core_check_feature(dev, DRIVER_GEM))
+ return -EOPNOTSUPP;
+
++ /* idr_alloc() limitation. */
++ if (args->new_handle > INT_MAX)
++ return -EINVAL;
++ handle = args->new_handle;
++
+ obj = drm_gem_object_lookup(file_priv, args->handle);
+ if (!obj)
+ return -ENOENT;
+
+- if (args->handle == args->new_handle) {
++ if (args->handle == handle) {
+ ret = 0;
+ goto out;
+ }
+@@ -987,18 +992,19 @@ int drm_gem_change_handle_ioctl(struct d
+ mutex_lock(&file_priv->prime.lock);
+
+ spin_lock(&file_priv->table_lock);
+- ret = idr_alloc(&file_priv->object_idr, obj,
+- args->new_handle, args->new_handle + 1, GFP_NOWAIT);
++ ret = idr_alloc(&file_priv->object_idr, obj, handle, handle + 1,
++ GFP_NOWAIT);
+ spin_unlock(&file_priv->table_lock);
+
+ if (ret < 0)
+ goto out_unlock;
+
+ if (obj->dma_buf) {
+- ret = drm_prime_add_buf_handle(&file_priv->prime, obj->dma_buf, args->new_handle);
++ ret = drm_prime_add_buf_handle(&file_priv->prime, obj->dma_buf,
++ handle);
+ if (ret < 0) {
+ spin_lock(&file_priv->table_lock);
+- idr_remove(&file_priv->object_idr, args->new_handle);
++ idr_remove(&file_priv->object_idr, handle);
+ spin_unlock(&file_priv->table_lock);
+ goto out_unlock;
+ }
--- /dev/null
+From e535c23513c63f02f67e3e09e0787907029efeaf Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 30 Oct 2025 17:34:56 +0100
+Subject: drm/imx/tve: fix probe device leak
+
+From: Johan Hovold <johan@kernel.org>
+
+commit e535c23513c63f02f67e3e09e0787907029efeaf upstream.
+
+Make sure to drop the reference taken to the DDC device during probe on
+probe failure (e.g. probe deferral) and on driver unbind.
+
+Fixes: fcbc51e54d2a ("staging: drm/imx: Add support for Television Encoder (TVEv2)")
+Cc: stable@vger.kernel.org # 3.10
+Cc: Philipp Zabel <p.zabel@pengutronix.de>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20251030163456.15807-1-johan@kernel.org
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/imx/ipuv3/imx-tve.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/drivers/gpu/drm/imx/ipuv3/imx-tve.c
++++ b/drivers/gpu/drm/imx/ipuv3/imx-tve.c
+@@ -525,6 +525,13 @@ static const struct component_ops imx_tv
+ .bind = imx_tve_bind,
+ };
+
++static void imx_tve_put_device(void *_dev)
++{
++ struct device *dev = _dev;
++
++ put_device(dev);
++}
++
+ static int imx_tve_probe(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+@@ -546,6 +553,12 @@ static int imx_tve_probe(struct platform
+ if (ddc_node) {
+ tve->ddc = of_find_i2c_adapter_by_node(ddc_node);
+ of_node_put(ddc_node);
++ if (tve->ddc) {
++ ret = devm_add_action_or_reset(dev, imx_tve_put_device,
++ &tve->ddc->dev);
++ if (ret)
++ return ret;
++ }
+ }
+
+ tve->mode = of_get_tve_mode(np);
--- /dev/null
+From dedb897f11c5d7e32c0e0a0eff7cec23a8047167 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Sun, 21 Dec 2025 17:45:52 +0100
+Subject: drm/msm/a6xx: fix bogus hwcg register updates
+
+From: Johan Hovold <johan@kernel.org>
+
+commit dedb897f11c5d7e32c0e0a0eff7cec23a8047167 upstream.
+
+The hw clock gating register sequence consists of register value pairs
+that are written to the GPU during initialisation.
+
+The a690 hwcg sequence has two GMU registers in it that used to amount
+to random writes in the GPU mapping, but since commit 188db3d7fe66
+("drm/msm/a6xx: Rebase GMU register offsets") they trigger a fault as
+the updated offsets now lie outside the mapping. This in turn breaks
+boot of machines like the Lenovo ThinkPad X13s.
+
+Note that the updates of these GMU registers is already taken care of
+properly since commit 40c297eb245b ("drm/msm/a6xx: Set GMU CGC
+properties on a6xx too"), but for some reason these two entries were
+left in the table.
+
+Fixes: 5e7665b5e484 ("drm/msm/adreno: Add Adreno A690 support")
+Cc: stable@vger.kernel.org # 6.5
+Cc: Bjorn Andersson <andersson@kernel.org>
+Cc: Konrad Dybcio <konradybcio@kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Reviewed-by: Akhil P Oommen <akhilpo@oss.qualcomm.com>
+Fixes: 188db3d7fe66 ("drm/msm/a6xx: Rebase GMU register offsets")
+Patchwork: https://patchwork.freedesktop.org/patch/695778/
+Message-ID: <20251221164552.19990-1-johan@kernel.org>
+Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
+(cherry picked from commit dcbd2f8280eea2c965453ed8c3c69d6f121e950b)
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_catalog.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/gpu/drm/msm/adreno/a6xx_catalog.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_catalog.c
+@@ -501,8 +501,6 @@ static const struct adreno_reglist a690_
+ {REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
+ {REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
+ {REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
+- {REG_A6XX_GPU_GMU_AO_GMU_CGC_DELAY_CNTL, 0x10111},
+- {REG_A6XX_GPU_GMU_AO_GMU_CGC_HYST_CNTL, 0x5555},
+ {}
+ };
+
--- /dev/null
+From b0581f6ab952ffd135ca4402d2ee3da641538d6b Mon Sep 17 00:00:00 2001
+From: Miguel Ojeda <ojeda@kernel.org>
+Date: Sat, 24 Jan 2026 17:09:48 +0100
+Subject: drm/tyr: depend on `COMMON_CLK` to fix build error
+
+From: Miguel Ojeda <ojeda@kernel.org>
+
+commit b0581f6ab952ffd135ca4402d2ee3da641538d6b upstream.
+
+Tyr needs `CONFIG_COMMON_CLK` to build:
+
+ error[E0432]: unresolved import `kernel::clk::Clk`
+ --> drivers/gpu/drm/tyr/driver.rs:3:5
+ |
+ 3 | use kernel::clk::Clk;
+ | ^^^^^^^^^^^^^^^^ no `Clk` in `clk`
+
+ error[E0432]: unresolved import `kernel::clk::OptionalClk`
+ --> drivers/gpu/drm/tyr/driver.rs:4:5
+ |
+ 4 | use kernel::clk::OptionalClk;
+ | ^^^^^^^^^^^^^^^^^^^^^^^^ no `OptionalClk` in `clk`
+
+Thus add the dependency to fix it.
+
+Fixes: cf4fd52e3236 ("rust: drm: Introduce the Tyr driver for Arm Mali GPUs")
+Cc: stable@vger.kernel.org
+Acked-by: Alice Ryhl <aliceryhl@google.com>
+Link: https://patch.msgid.link/20260124160948.67508-1-ojeda@kernel.org
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/tyr/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/tyr/Kconfig
++++ b/drivers/gpu/drm/tyr/Kconfig
+@@ -6,6 +6,7 @@ config DRM_TYR
+ depends on RUST
+ depends on ARM || ARM64 || COMPILE_TEST
+ depends on !GENERIC_ATOMIC64 # for IOMMU_IO_PGTABLE_LPAE
++ depends on COMMON_CLK
+ default n
+ help
+ Rust DRM driver for ARM Mali CSF-based GPUs.
--- /dev/null
+From 051be49133971076717846e2a04c746ab3476282 Mon Sep 17 00:00:00 2001
+From: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Date: Fri, 16 Jan 2026 09:50:40 +0000
+Subject: drm/xe/xelp: Fix Wa_18022495364
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+
+commit 051be49133971076717846e2a04c746ab3476282 upstream.
+
+It looks I mistyped CS_DEBUG_MODE2 as CS_DEBUG_MODE1 when adding the
+workaround. Fix it.
+
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Fixes: ca33cd271ef9 ("drm/xe/xelp: Add Wa_18022495364")
+Cc: Matt Roper <matthew.d.roper@intel.com>
+Cc: "Thomas Hellström" <thomas.hellstrom@linux.intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: <stable@vger.kernel.org> # v6.18+
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Link: https://patch.msgid.link/20260116095040.49335-1-tvrtko.ursulin@igalia.com
+(cherry picked from commit 7fe6cae2f7fad2b5166b0fc096618629f9e2ebcb)
+Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/xe_lrc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_lrc.c b/drivers/gpu/drm/xe/xe_lrc.c
+index 281286f2b5f9..b8c1dd953665 100644
+--- a/drivers/gpu/drm/xe/xe_lrc.c
++++ b/drivers/gpu/drm/xe/xe_lrc.c
+@@ -1185,7 +1185,7 @@ static ssize_t setup_invalidate_state_cache_wa(struct xe_lrc *lrc,
+ return -ENOSPC;
+
+ *cmd++ = MI_LOAD_REGISTER_IMM | MI_LRI_NUM_REGS(1);
+- *cmd++ = CS_DEBUG_MODE1(0).addr;
++ *cmd++ = CS_DEBUG_MODE2(0).addr;
+ *cmd++ = _MASKED_BIT_ENABLE(INSTRUCTION_STATE_CACHE_INVALIDATE);
+
+ return cmd - batch;
+--
+2.53.0
+
--- /dev/null
+From e64d1cb21a1c6ecd51bc1c94c83f6fc656f7c94d Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Wed, 28 Jan 2026 10:58:54 +0100
+Subject: gpiolib: acpi: Fix potential out-of-boundary left shift
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+commit e64d1cb21a1c6ecd51bc1c94c83f6fc656f7c94d upstream.
+
+GPIO Address Space handler gets a pointer to the in or out value.
+This value is supposed to be at least 64-bit, but it's not limited
+to be exactly 64-bit. When ACPI tables are being parsed, for
+the bigger Connection():s ACPICA creates a Buffer instead of regular
+Integer object. The Buffer exists as long as Namespace holds
+the certain Connection(). Hence we can access the necessary bits
+without worrying. On the other hand, the left shift, used in
+the code, is limited by 31 (on 32-bit platforms) and otherwise
+considered to be Undefined Behaviour. Also the code uses only
+the first 64-bit word for the value, and anything bigger than 63
+will be also subject to UB. Fix all this by modifying the code
+to correctly set or clear the respective bit in the bitmap constructed
+of 64-bit words.
+
+Fixes: 59084c564c41 ("gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler")
+Fixes: 2c4d00cb8fc5 ("gpiolib: acpi: Use BIT() macro to increase readability")
+Cc: stable@vger.kernel.org
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://patch.msgid.link/20260128095918.4157491-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpio/gpiolib-acpi-core.c | 21 +++++++++++++++++----
+ 1 file changed, 17 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpio/gpiolib-acpi-core.c
++++ b/drivers/gpio/gpiolib-acpi-core.c
+@@ -1104,6 +1104,7 @@ acpi_gpio_adr_space_handler(u32 function
+ unsigned int pin = agpio->pin_table[i];
+ struct acpi_gpio_connection *conn;
+ struct gpio_desc *desc;
++ u16 word, shift;
+ bool found;
+
+ mutex_lock(&achip->conn_lock);
+@@ -1158,10 +1159,22 @@ acpi_gpio_adr_space_handler(u32 function
+
+ mutex_unlock(&achip->conn_lock);
+
+- if (function == ACPI_WRITE)
+- gpiod_set_raw_value_cansleep(desc, !!(*value & BIT_ULL(i)));
+- else
+- *value |= (u64)gpiod_get_raw_value_cansleep(desc) << i;
++ /*
++ * For the cases when OperationRegion() consists of more than
++ * 64 bits calculate the word and bit shift to use that one to
++ * access the value.
++ */
++ word = i / 64;
++ shift = i % 64;
++
++ if (function == ACPI_WRITE) {
++ gpiod_set_raw_value_cansleep(desc, value[word] & BIT_ULL(shift));
++ } else {
++ if (gpiod_get_raw_value_cansleep(desc))
++ value[word] |= BIT_ULL(shift);
++ else
++ value[word] &= ~BIT_ULL(shift);
++ }
+ }
+
+ out:
--- /dev/null
+From 80f1a2c2332fee0edccd006fe87fc8a6db94bab3 Mon Sep 17 00:00:00 2001
+From: Nicolin Chen <nicolinc@nvidia.com>
+Date: Thu, 29 Jan 2026 14:43:41 -0800
+Subject: iommu/tegra241-cmdqv: Reset VCMDQ in tegra241_vcmdq_hw_init_user()
+
+From: Nicolin Chen <nicolinc@nvidia.com>
+
+commit 80f1a2c2332fee0edccd006fe87fc8a6db94bab3 upstream.
+
+The Enable bits in CMDQV/VINTF/VCMDQ_CONFIG registers do not actually reset
+the HW registers. So, the driver explicitly clears all the registers when a
+VINTF or VCMDQ is being initialized calling its hw_deinit() function.
+
+However, a userspace VCMDQ is not properly reset, unlike an in-kernel VCMDQ
+getting reset in tegra241_vcmdq_hw_init().
+
+Meanwhile, tegra241_vintf_hw_init() calling tegra241_vintf_hw_deinit() will
+not deinit any VCMDQ, since there is no userspace VCMDQ mapped to the VINTF
+at that stage.
+
+Then, this may result in dirty VCMDQ registers, which can fail the VM.
+
+Like tegra241_vcmdq_hw_init(), reset a VCMDQ in tegra241_vcmdq_hw_init() to
+fix this bug. This is required by a host kernel.
+
+Fixes: 6717f26ab1e7 ("iommu/tegra241-cmdqv: Add user-space use support")
+Cc: stable@vger.kernel.org
+Reported-by: Bao Nguyen <ncqb@google.com>
+Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
+index 378104cd395e..04cc7a9036e4 100644
+--- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
++++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
+@@ -1078,6 +1078,9 @@ static int tegra241_vcmdq_hw_init_user(struct tegra241_vcmdq *vcmdq)
+ {
+ char header[64];
+
++ /* Reset VCMDQ */
++ tegra241_vcmdq_hw_deinit(vcmdq);
++
+ /* Configure the vcmdq only; User space does the enabling */
+ writeq_relaxed(vcmdq->cmdq.q.q_base, REG_VCMDQ_PAGE1(vcmdq, BASE));
+
+--
+2.53.0
+
--- /dev/null
+From 09c3c9112d71c44146419c87c55c710e68335741 Mon Sep 17 00:00:00 2001
+From: Alexandre Courbot <acourbot@nvidia.com>
+Date: Mon, 8 Dec 2025 11:47:02 +0900
+Subject: rust: bits: always inline functions using build_assert with arguments
+
+From: Alexandre Courbot <acourbot@nvidia.com>
+
+commit 09c3c9112d71c44146419c87c55c710e68335741 upstream.
+
+`build_assert` relies on the compiler to optimize out its error path.
+Functions using it with its arguments must thus always be inlined,
+otherwise the error path of `build_assert` might not be optimized out,
+triggering a build error.
+
+Cc: stable@vger.kernel.org
+Fixes: cc84ef3b88f4 ("rust: bits: add support for bits/genmask macros")
+Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
+Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
+Link: https://patch.msgid.link/20251208-io-build-assert-v3-4-98aded02c1ea@nvidia.com
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ rust/kernel/bits.rs | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/rust/kernel/bits.rs b/rust/kernel/bits.rs
+index 553d50265883..2daead125626 100644
+--- a/rust/kernel/bits.rs
++++ b/rust/kernel/bits.rs
+@@ -27,7 +27,8 @@ pub fn [<checked_bit_ $ty>](n: u32) -> Option<$ty> {
+ ///
+ /// This version is the default and should be used if `n` is known at
+ /// compile time.
+- #[inline]
++ // Always inline to optimize out error path of `build_assert`.
++ #[inline(always)]
+ pub const fn [<bit_ $ty>](n: u32) -> $ty {
+ build_assert!(n < <$ty>::BITS);
+ (1 as $ty) << n
+@@ -75,7 +76,8 @@ pub fn [<genmask_checked_ $ty>](range: RangeInclusive<u32>) -> Option<$ty> {
+ /// This version is the default and should be used if the range is known
+ /// at compile time.
+ $(#[$genmask_ex])*
+- #[inline]
++ // Always inline to optimize out error path of `build_assert`.
++ #[inline(always)]
+ pub const fn [<genmask_ $ty>](range: RangeInclusive<u32>) -> $ty {
+ let start = *range.start();
+ let end = *range.end();
+--
+2.53.0
+
--- /dev/null
+From bd36f6e2abf7f85644f7ea8deb1de4040b03bbc1 Mon Sep 17 00:00:00 2001
+From: Miguel Ojeda <ojeda@kernel.org>
+Date: Sat, 24 Jan 2026 00:34:32 +0100
+Subject: rust: sync: atomic: Provide stub for `rusttest` 32-bit hosts
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Miguel Ojeda <ojeda@kernel.org>
+
+commit bd36f6e2abf7f85644f7ea8deb1de4040b03bbc1 upstream.
+
+For arm32, on a x86_64 builder, running the `rusttest` target yields:
+
+ error[E0080]: evaluation of constant value failed
+ --> rust/kernel/static_assert.rs:37:23
+ |
+ 37 | const _: () = ::core::assert!($condition $(,$arg)?);
+ | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ the evaluated program panicked at 'assertion failed: size_of::<isize>() == size_of::<isize_atomic_repr>()', rust/kernel/sync/atomic/predefine.rs:68:1
+ |
+ ::: rust/kernel/sync/atomic/predefine.rs:68:1
+ |
+ 68 | static_assert!(size_of::<isize>() == size_of::<isize_atomic_repr>());
+ | -------------------------------------------------------------------- in this macro invocation
+ |
+ = note: this error originates in the macro `::core::assert` which comes from the expansion of the macro `static_assert` (in Nightly builds, run with -Z macro-backtrace for more info)
+
+The reason is that `rusttest` runs on the host, so for e.g. a x86_64
+builder `isize` is 64 bits but it is not a `CONFIG_64BIT` build.
+
+Fix it by providing a stub for `rusttest` as usual.
+
+Fixes: 84c6d36bcaf9 ("rust: sync: atomic: Add Atomic<{usize,isize}>")
+Cc: stable@vger.kernel.org
+Reviewed-by: Onur Özkan <work@onurozkan.dev>
+Acked-by: Boqun Feng <boqun.feng@gmail.com>
+Link: https://patch.msgid.link/20260123233432.22703-1-ojeda@kernel.org
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ rust/kernel/sync/atomic/predefine.rs | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/rust/kernel/sync/atomic/predefine.rs b/rust/kernel/sync/atomic/predefine.rs
+index 45a17985cda4..0fca1ba3c2db 100644
+--- a/rust/kernel/sync/atomic/predefine.rs
++++ b/rust/kernel/sync/atomic/predefine.rs
+@@ -35,12 +35,23 @@ fn rhs_into_delta(rhs: i64) -> i64 {
+ // as `isize` and `usize`, and `isize` and `usize` are always bi-directional transmutable to
+ // `isize_atomic_repr`, which also always implements `AtomicImpl`.
+ #[allow(non_camel_case_types)]
++#[cfg(not(testlib))]
+ #[cfg(not(CONFIG_64BIT))]
+ type isize_atomic_repr = i32;
+ #[allow(non_camel_case_types)]
++#[cfg(not(testlib))]
+ #[cfg(CONFIG_64BIT)]
+ type isize_atomic_repr = i64;
+
++#[allow(non_camel_case_types)]
++#[cfg(testlib)]
++#[cfg(target_pointer_width = "32")]
++type isize_atomic_repr = i32;
++#[allow(non_camel_case_types)]
++#[cfg(testlib)]
++#[cfg(target_pointer_width = "64")]
++type isize_atomic_repr = i64;
++
+ // Ensure size and alignment requirements are checked.
+ static_assert!(size_of::<isize>() == size_of::<isize_atomic_repr>());
+ static_assert!(align_of::<isize>() == align_of::<isize_atomic_repr>());
+--
+2.53.0
+
--- /dev/null
+From d6ff6e870077ae0f01a6f860ca1e4a5a825dc032 Mon Sep 17 00:00:00 2001
+From: Alexandre Courbot <acourbot@nvidia.com>
+Date: Mon, 8 Dec 2025 11:47:03 +0900
+Subject: rust: sync: refcount: always inline functions using build_assert with arguments
+
+From: Alexandre Courbot <acourbot@nvidia.com>
+
+commit d6ff6e870077ae0f01a6f860ca1e4a5a825dc032 upstream.
+
+`build_assert` relies on the compiler to optimize out its error path.
+Functions using it with its arguments must thus always be inlined,
+otherwise the error path of `build_assert` might not be optimized out,
+triggering a build error.
+
+Cc: stable@vger.kernel.org
+Fixes: bb38f35b35f9 ("rust: implement `kernel::sync::Refcount`")
+Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
+Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
+Acked-by: Boqun Feng <boqun.feng@gmail.com>
+Link: https://patch.msgid.link/20251208-io-build-assert-v3-5-98aded02c1ea@nvidia.com
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ rust/kernel/sync/refcount.rs | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/rust/kernel/sync/refcount.rs b/rust/kernel/sync/refcount.rs
+index 19236a5bccde..6c7ae8b05a0b 100644
+--- a/rust/kernel/sync/refcount.rs
++++ b/rust/kernel/sync/refcount.rs
+@@ -23,7 +23,8 @@ impl Refcount {
+ /// Construct a new [`Refcount`] from an initial value.
+ ///
+ /// The initial value should be non-saturated.
+- #[inline]
++ // Always inline to optimize out error path of `build_assert`.
++ #[inline(always)]
+ pub fn new(value: i32) -> Self {
+ build_assert!(value >= 0, "initial value saturated");
+ // SAFETY: There are no safety requirements for this FFI call.
+--
+2.53.0
+
--- /dev/null
+From 5157c328edb35bac05ce77da473c3209d20e0bbb Mon Sep 17 00:00:00 2001
+From: Tamir Duberstein <tamird@kernel.org>
+Date: Wed, 23 Jul 2025 11:39:40 -0400
+Subject: scripts: generate_rust_analyzer: Add compiler_builtins -> core dep
+
+From: Tamir Duberstein <tamird@kernel.org>
+
+commit 5157c328edb35bac05ce77da473c3209d20e0bbb upstream.
+
+Add a dependency edge from `compiler_builtins` to `core` to
+`scripts/generate_rust_analyzer.py` to match `rust/Makefile`. This has
+been incorrect since commit 8c4555ccc55c ("scripts: add
+`generate_rust_analyzer.py`")
+
+Signed-off-by: Tamir Duberstein <tamird@kernel.org>
+Reviewed-by: Jesung Yang <y.j3ms.n@gmail.com>
+Acked-by: Benno Lossin <lossin@kernel.org>
+Fixes: 8c4555ccc55c ("scripts: add `generate_rust_analyzer.py`")
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20250723-rust-analyzer-pin-init-v1-1-3c6956173c78@kernel.org
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ scripts/generate_rust_analyzer.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/scripts/generate_rust_analyzer.py
++++ b/scripts/generate_rust_analyzer.py
+@@ -106,7 +106,7 @@ def generate_crates(srctree, objtree, sy
+ append_crate(
+ "compiler_builtins",
+ srctree / "rust" / "compiler_builtins.rs",
+- [],
++ ["core"],
+ )
+
+ append_crate(
--- /dev/null
+From 98dcca855343512a99432224447f07c5988753ad Mon Sep 17 00:00:00 2001
+From: Tamir Duberstein <tamird@kernel.org>
+Date: Wed, 23 Jul 2025 11:39:41 -0400
+Subject: scripts: generate_rust_analyzer: Add pin_init -> compiler_builtins dep
+
+From: Tamir Duberstein <tamird@kernel.org>
+
+commit 98dcca855343512a99432224447f07c5988753ad upstream.
+
+Add a dependency edge from `pin_init` to `compiler_builtins` to
+`scripts/generate_rust_analyzer.py` to match `rust/Makefile`. This has
+been incorrect since commit d7659acca7a3 ("rust: add pin-init crate
+build infrastructure").
+
+Signed-off-by: Tamir Duberstein <tamird@kernel.org>
+Reviewed-by: Jesung Yang <y.j3ms.n@gmail.com>
+Acked-by: Benno Lossin <lossin@kernel.org>
+Fixes: d7659acca7a3 ("rust: add pin-init crate build infrastructure")
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20250723-rust-analyzer-pin-init-v1-2-3c6956173c78@kernel.org
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ scripts/generate_rust_analyzer.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/scripts/generate_rust_analyzer.py
++++ b/scripts/generate_rust_analyzer.py
+@@ -110,7 +110,7 @@ def generate_crates(srctree, objtree, sy
+ append_crate(
+ "pin_init",
+ srctree / "rust" / "pin-init" / "src" / "lib.rs",
+- ["core", "pin_init_internal", "macros"],
++ ["core", "compiler_builtins", "pin_init_internal", "macros"],
+ cfg=["kernel"],
+ )
+
--- /dev/null
+From 74e15ac34b098934895fd27655d098971d2b43d9 Mon Sep 17 00:00:00 2001
+From: Tamir Duberstein <tamird@kernel.org>
+Date: Wed, 23 Jul 2025 11:39:42 -0400
+Subject: scripts: generate_rust_analyzer: Add pin_init_internal deps
+
+From: Tamir Duberstein <tamird@kernel.org>
+
+commit 74e15ac34b098934895fd27655d098971d2b43d9 upstream.
+
+Commit d7659acca7a3 ("rust: add pin-init crate build infrastructure")
+did not add dependencies to `pin_init_internal`, resulting in broken
+navigation. Thus add them now.
+
+[ Tamir elaborates:
+
+ "before this series, go-to-symbol from pin_init_internal to e.g.
+ proc_macro::TokenStream doesn't work."
+
+ - Miguel ]
+
+Signed-off-by: Tamir Duberstein <tamird@kernel.org>
+Reviewed-by: Jesung Yang <y.j3ms.n@gmail.com>
+Acked-by: Benno Lossin <lossin@kernel.org>
+Fixes: d7659acca7a3 ("rust: add pin-init crate build infrastructure")
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20250723-rust-analyzer-pin-init-v1-3-3c6956173c78@kernel.org
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ scripts/generate_rust_analyzer.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/scripts/generate_rust_analyzer.py
++++ b/scripts/generate_rust_analyzer.py
+@@ -102,7 +102,7 @@ def generate_crates(srctree, objtree, sy
+ append_crate(
+ "pin_init_internal",
+ srctree / "rust" / "pin-init" / "internal" / "src" / "lib.rs",
+- [],
++ ["std", "proc_macro"],
+ cfg=["kernel"],
+ is_proc_macro=True,
+ )
--- /dev/null
+From ac3c50b9a24e9ebeb585679078d6c47922034bb6 Mon Sep 17 00:00:00 2001
+From: Tamir Duberstein <tamird@kernel.org>
+Date: Fri, 16 Jan 2026 15:46:04 -0500
+Subject: scripts: generate_rust_analyzer: compile sysroot with correct edition
+
+From: Tamir Duberstein <tamird@kernel.org>
+
+commit ac3c50b9a24e9ebeb585679078d6c47922034bb6 upstream.
+
+Use `core_edition` for all sysroot crates rather than just core as all
+were updated to edition 2024 in Rust 1.87.
+
+Fixes: f4daa80d6be7 ("rust: compile libcore with edition 2024 for 1.87+")
+Signed-off-by: Tamir Duberstein <tamird@kernel.org>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20260116-rust-analyzer-sysroot-v2-1-094aedc33208@kernel.org
+[ Added `>`s to make the quote a single block. - Miguel ]
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ scripts/generate_rust_analyzer.py | 29 ++++++++++++++++++++++++++---
+ 1 file changed, 26 insertions(+), 3 deletions(-)
+
+--- a/scripts/generate_rust_analyzer.py
++++ b/scripts/generate_rust_analyzer.py
+@@ -61,7 +61,6 @@ def generate_crates(srctree, objtree, sy
+ display_name,
+ deps,
+ cfg=[],
+- edition="2021",
+ ):
+ append_crate(
+ display_name,
+@@ -69,13 +68,37 @@ def generate_crates(srctree, objtree, sy
+ deps,
+ cfg,
+ is_workspace_member=False,
+- edition=edition,
++ # Miguel Ojeda writes:
++ #
++ # > ... in principle even the sysroot crates may have different
++ # > editions.
++ # >
++ # > For instance, in the move to 2024, it seems all happened at once
++ # > in 1.87.0 in these upstream commits:
++ # >
++ # > 0e071c2c6a58 ("Migrate core to Rust 2024")
++ # > f505d4e8e380 ("Migrate alloc to Rust 2024")
++ # > 0b2489c226c3 ("Migrate proc_macro to Rust 2024")
++ # > 993359e70112 ("Migrate std to Rust 2024")
++ # >
++ # > But in the previous move to 2021, `std` moved in 1.59.0, while
++ # > the others in 1.60.0:
++ # >
++ # > b656384d8398 ("Update stdlib to the 2021 edition")
++ # > 06a1c14d52a8 ("Switch all libraries to the 2021 edition")
++ #
++ # Link: https://lore.kernel.org/all/CANiq72kd9bHdKaAm=8xCUhSHMy2csyVed69bOc4dXyFAW4sfuw@mail.gmail.com/
++ #
++ # At the time of writing all rust versions we support build the
++ # sysroot crates with the same edition. We may need to relax this
++ # assumption if future edition moves span multiple rust versions.
++ edition=core_edition,
+ )
+
+ # NB: sysroot crates reexport items from one another so setting up our transitive dependencies
+ # here is important for ensuring that rust-analyzer can resolve symbols. The sources of truth
+ # for this dependency graph are `(sysroot_src / crate / "Cargo.toml" for crate in crates)`.
+- append_sysroot_crate("core", [], cfg=crates_cfgs.get("core", []), edition=core_edition)
++ append_sysroot_crate("core", [], cfg=crates_cfgs.get("core", []))
+ append_sysroot_crate("alloc", ["core"])
+ append_sysroot_crate("std", ["alloc", "core"])
+ append_sysroot_crate("proc_macro", ["core", "std"])
--- /dev/null
+From e440bc5c190cd0e5f148b2892aeb1f4bbbf54507 Mon Sep 17 00:00:00 2001
+From: SeungJong Ha <engineer.jjhama@gmail.com>
+Date: Fri, 23 Jan 2026 13:18:44 +0000
+Subject: scripts: generate_rust_analyzer: fix resolution of #[pin_data] macros
+
+From: SeungJong Ha <engineer.jjhama@gmail.com>
+
+commit e440bc5c190cd0e5f148b2892aeb1f4bbbf54507 upstream.
+
+Currently, rust-analyzer fails to properly resolve structs annotated with
+`#[pin_data]`. This prevents IDE features like "Go to Definition" from
+working correctly for those structs.
+
+Add the missing configuration to `generate_rust_analyzer.py` to ensure
+the `pin-init` crate macros are handled correctly.
+
+Signed-off-by: SeungJong Ha <engineer.jjhama@gmail.com>
+Fixes: d7659acca7a3 ("rust: add pin-init crate build infrastructure")
+Cc: stable@vger.kernel.org
+Tested-by: Tamir Duberstein <tamird@kernel.org>
+Acked-by: Tamir Duberstein <tamird@kernel.org>
+Acked-by: Gary Guo <gary@garyguo.net>
+Reviewed-by: Jesung Yang <y.j3ms.n@gmail.com>
+Link: https://patch.msgid.link/20260123-fix-pin-init-crate-dependecies-v2-1-bb1c2500e54c@gmail.com
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ scripts/generate_rust_analyzer.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/scripts/generate_rust_analyzer.py
++++ b/scripts/generate_rust_analyzer.py
+@@ -192,7 +192,7 @@ def generate_crates(srctree, objtree, sy
+ append_crate(
+ name,
+ path,
+- ["core", "kernel"],
++ ["core", "kernel", "pin_init"],
+ cfg=cfg,
+ )
+
--- /dev/null
+From 1b83ef9f7ad4635c913b80ef5e718f95f48e85af Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Onur=20=C3=96zkan?= <work@onurozkan.dev>
+Date: Wed, 24 Dec 2025 16:53:43 +0300
+Subject: scripts: generate_rust_analyzer: remove sysroot assertion
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Onur Özkan <work@onurozkan.dev>
+
+commit 1b83ef9f7ad4635c913b80ef5e718f95f48e85af upstream.
+
+With nixpkgs's rustc, rust-src component is not bundled
+with the compiler by default and is instead provided from
+a separate store path, so this assumption does not hold.
+
+The assertion assumes these paths are in the same location
+which causes `make LLVM=1 rust-analyzer` to fail on NixOS.
+
+Link: https://rust-for-linux.zulipchat.com/#narrow/stream/x/topic/x/near/565284250
+Signed-off-by: Onur Özkan <work@onurozkan.dev>
+Reviewed-by: Gary Guo <gary@garyguo.net>
+Fixes: fe992163575b ("rust: Support latest version of `rust-analyzer`")
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20251224135343.32476-1-work@onurozkan.dev
+[ Reworded title. - Miguel ]
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ scripts/generate_rust_analyzer.py | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/scripts/generate_rust_analyzer.py
++++ b/scripts/generate_rust_analyzer.py
+@@ -192,9 +192,6 @@ def main():
+ level=logging.INFO if args.verbose else logging.WARNING
+ )
+
+- # Making sure that the `sysroot` and `sysroot_src` belong to the same toolchain.
+- assert args.sysroot in args.sysroot_src.parents
+-
+ rust_project = {
+ "crates": generate_crates(args.srctree, args.objtree, args.sysroot_src, args.exttree, args.cfgs, args.core_edition),
+ "sysroot": str(args.sysroot),
mm-memory-failure-teach-kill_accessing_process-to-accept-hugetlb-tail-page-pfn.patch
mm-shmem-swap-fix-race-of-truncate-and-swap-entry-split.patch
net-fix-segmentation-of-forwarding-fraglist-gro.patch
+rust-bits-always-inline-functions-using-build_assert-with-arguments.patch
+rust-sync-atomic-provide-stub-for-rusttest-32-bit-hosts.patch
+rust-sync-refcount-always-inline-functions-using-build_assert-with-arguments.patch
+scripts-generate_rust_analyzer-add-pin_init-compiler_builtins-dep.patch
+scripts-generate_rust_analyzer-add-pin_init_internal-deps.patch
+scripts-generate_rust_analyzer-remove-sysroot-assertion.patch
+scripts-generate_rust_analyzer-compile-sysroot-with-correct-edition.patch
+scripts-generate_rust_analyzer-fix-resolution-of-macros.patch
+scripts-generate_rust_analyzer-add-compiler_builtins-core-dep.patch
+drm-do-not-allow-userspace-to-trigger-kernel-warnings-in-drm_gem_change_handle_ioctl.patch
+drm-xe-xelp-fix-wa_18022495364.patch
+drm-tyr-depend-on-common_clk-to-fix-build-error.patch
+drm-msm-a6xx-fix-bogus-hwcg-register-updates.patch
+drm-imx-tve-fix-probe-device-leak.patch
+drm-amd-pm-fix-smu-v13-soft-clock-frequency-setting-issue.patch
+drm-amd-pm-fix-smu-v14-soft-clock-frequency-setting-issue.patch
+drm-amdgpu-soc21-fix-xclk-for-apus.patch
+drm-amdgpu-gfx10-fix-wptr-reset-in-kgq-init.patch
+drm-amdgpu-gfx11-fix-wptr-reset-in-kgq-init.patch
+drm-amdgpu-gfx11-adjust-kgq-reset-sequence.patch
+drm-amdgpu-gfx12-fix-wptr-reset-in-kgq-init.patch
+drm-amdgpu-gfx12-adjust-kgq-reset-sequence.patch
+drm-amdgpu-fix-null-pointer-dereference-in-amdgpu_gmc_filter_faults_remove.patch
+drm-amdgpu-fix-cond_exec-handling-in-amdgpu_ib_schedule.patch
+iommu-tegra241-cmdqv-reset-vcmdq-in-tegra241_vcmdq_hw_init_user.patch
+gpiolib-acpi-fix-potential-out-of-boundary-left-shift.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
