--- /dev/null
+From ee94a65f192c05c543b4d3ad7137cd696b5c18fc Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Timur=20Krist=C3=B3f?= <timur.kristof@gmail.com>
+Date: Mon, 25 May 2026 13:33:18 +0200
+Subject: drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+commit ee94a65f192c05c543b4d3ad7137cd696b5c18fc upstream.
+
+The UVD code relies on GTT to GTT moves in order to ensure
+that its BOs don't cross 256M segments.
+
+Fixes: bfe5e585b44f ("drm/ttm: move last binding into the drivers.")
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 21fd45e5e2628d00b478590bcc3d14d3de5d45b6)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+@@ -479,6 +479,15 @@ static int amdgpu_bo_move(struct ttm_buf
+
+ if (new_mem->mem_type == TTM_PL_TT ||
+ new_mem->mem_type == AMDGPU_PL_PREEMPT) {
++ if (old_mem && (old_mem->mem_type == TTM_PL_TT ||
++ old_mem->mem_type == AMDGPU_PL_PREEMPT)) {
++ r = ttm_bo_wait_ctx(bo, ctx);
++ if (r)
++ return r;
++
++ amdgpu_ttm_backend_unbind(bo->bdev, bo->ttm);
++ }
++
+ r = amdgpu_ttm_backend_bind(bo->bdev, bo->ttm, new_mem);
+ if (r)
+ return r;
+@@ -511,6 +520,15 @@ static int amdgpu_bo_move(struct ttm_buf
+ amdgpu_bo_move_notify(bo, evict, new_mem);
+ ttm_resource_free(bo, &bo->resource);
+ ttm_bo_assign_mem(bo, new_mem);
++ return 0;
++ }
++ if ((old_mem->mem_type == TTM_PL_TT ||
++ old_mem->mem_type == AMDGPU_PL_PREEMPT) &&
++ (new_mem->mem_type == TTM_PL_TT ||
++ new_mem->mem_type == AMDGPU_PL_PREEMPT)) {
++ amdgpu_bo_move_notify(bo, evict, new_mem);
++ ttm_resource_free(bo, &bo->resource);
++ ttm_bo_assign_mem(bo, new_mem);
+ return 0;
+ }
+
--- /dev/null
+From 84c4c36acd5c4b2558b5069f869a165b2c655c84 Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <mario.limonciello@amd.com>
+Date: Fri, 12 Jun 2026 21:07:24 -0500
+Subject: drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+commit 84c4c36acd5c4b2558b5069f869a165b2c655c84 upstream.
+
+Add a minimum-length check for the AMDGPU_CHUNK_ID_CP_GFX_SHADOW chunk in
+amdgpu_cs_pass1(), matching the gate already present for the IB, FENCE and
+BO_HANDLES chunk types.
+
+The CP_GFX_SHADOW case previously shared a bare break with the dependency
+and syncobj chunk types, which do not dereference a fixed-size struct. When
+userspace submits this chunk with length_dw == 0, vmemdup_array_user() is
+called with size 0 and returns ZERO_SIZE_PTR, which passes the IS_ERR()
+check. amdgpu_cs_p2_shadow() then dereferences chunk->kdata as a struct
+drm_amdgpu_cs_chunk_cp_gfx_shadow (reading shadow->flags), faulting on the
+ZERO_SIZE_PTR and causing a NULL-pointer dereference.
+
+This is reachable by an unprivileged process in the render group. Reject
+undersized chunks with -EINVAL during pass1 so the bad submission is
+rejected before pass2 ever dereferences the data.
+
+Fixes: ac9287055ff1 ("drm/amdgpu: add gfx shadow CS IOCTL support")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 7f61b2eef7415eccdb40850aca0de94211948657)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -272,13 +272,17 @@ static int amdgpu_cs_pass1(struct amdgpu
+ goto free_partial_kdata;
+ break;
+
++ case AMDGPU_CHUNK_ID_CP_GFX_SHADOW:
++ if (size < sizeof(struct drm_amdgpu_cs_chunk_cp_gfx_shadow))
++ goto free_partial_kdata;
++ break;
++
+ case AMDGPU_CHUNK_ID_DEPENDENCIES:
+ case AMDGPU_CHUNK_ID_SYNCOBJ_IN:
+ case AMDGPU_CHUNK_ID_SYNCOBJ_OUT:
+ case AMDGPU_CHUNK_ID_SCHEDULED_DEPENDENCIES:
+ case AMDGPU_CHUNK_ID_SYNCOBJ_TIMELINE_WAIT:
+ case AMDGPU_CHUNK_ID_SYNCOBJ_TIMELINE_SIGNAL:
+- case AMDGPU_CHUNK_ID_CP_GFX_SHADOW:
+ break;
+
+ default:
--- /dev/null
+From 90c0486a82e27393f9eaf3bb350f51a0bd38cb6b Mon Sep 17 00:00:00 2001
+From: Jani Nikula <jani.nikula@intel.com>
+Date: Wed, 10 Jun 2026 17:15:49 +0300
+Subject: drm/displayid: fix Tiled Display Topology ID size
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+commit 90c0486a82e27393f9eaf3bb350f51a0bd38cb6b upstream.
+
+The Tiled Display Topology ID of a DisplayID Tiled Display Topology Data
+Block consists of three fields:
+
+- Tiled Display Manufacturer/Vendor ID Field (3 bytes)
+- Tiled Display Product ID Code Field (2 bytes)
+- Tiled Display Serial Number Field (4 bytes)
+
+i.e. a total of 9 bytes, not 8.
+
+The DisplayID Tiled Display Topology ID is used as the tile group
+identifier.
+
+Update both struct displayid_tiled_block topology_id member and struct
+drm_tile_group group_data member to full 9 bytes.
+
+The group data was missing the last byte of the serial number. I don't
+know whether there are known bug reports that might be linked to this,
+but it's plausible the last byte could be the differentiating part for
+the tile groups, and fewer tile groups might have been created than
+intended.
+
+Fixes: b49b55bd4fba ("drm/displayid: add displayid defines and edid extension (v2)")
+Fixes: 138f9ebb9755 ("drm: add tile_group support. (v3)")
+Cc: Dave Airlie <airlied@redhat.com>
+Cc: stable@vger.kernel.org # v3.19+
+Reviewed-by: Dave Airlie <airlied@redhat.com>
+Link: https://patch.msgid.link/20260610141549.555605-1-jani.nikula@intel.com
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_connector.c | 12 ++++++------
+ drivers/gpu/drm/drm_displayid_internal.h | 2 +-
+ include/drm/drm_connector.h | 6 +++---
+ 3 files changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
+index 47dc53c4a738..29634757c06d 100644
+--- a/drivers/gpu/drm/drm_connector.c
++++ b/drivers/gpu/drm/drm_connector.c
+@@ -3576,7 +3576,7 @@ EXPORT_SYMBOL(drm_mode_put_tile_group);
+ /**
+ * drm_mode_get_tile_group - get a reference to an existing tile group
+ * @dev: DRM device
+- * @topology: 8-bytes unique per monitor.
++ * @topology_id: 9-byte unique ID per monitor.
+ *
+ * Use the unique bytes to get a reference to an existing tile group.
+ *
+@@ -3584,14 +3584,14 @@ EXPORT_SYMBOL(drm_mode_put_tile_group);
+ * tile group or NULL if not found.
+ */
+ struct drm_tile_group *drm_mode_get_tile_group(struct drm_device *dev,
+- const char topology[8])
++ const char topology_id[9])
+ {
+ struct drm_tile_group *tg;
+ int id;
+
+ mutex_lock(&dev->mode_config.idr_mutex);
+ idr_for_each_entry(&dev->mode_config.tile_idr, tg, id) {
+- if (!memcmp(tg->group_data, topology, 8)) {
++ if (!memcmp(tg->group_data, topology_id, sizeof(tg->group_data))) {
+ if (!kref_get_unless_zero(&tg->refcount))
+ tg = NULL;
+ mutex_unlock(&dev->mode_config.idr_mutex);
+@@ -3606,7 +3606,7 @@ EXPORT_SYMBOL(drm_mode_get_tile_group);
+ /**
+ * drm_mode_create_tile_group - create a tile group from a displayid description
+ * @dev: DRM device
+- * @topology: 8-bytes unique per monitor.
++ * @topology_id: 9-byte unique ID per monitor.
+ *
+ * Create a tile group for the unique monitor, and get a unique
+ * identifier for the tile group.
+@@ -3615,7 +3615,7 @@ EXPORT_SYMBOL(drm_mode_get_tile_group);
+ * new tile group or NULL.
+ */
+ struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev,
+- const char topology[8])
++ const char topology_id[9])
+ {
+ struct drm_tile_group *tg;
+ int ret;
+@@ -3625,7 +3625,7 @@ struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev,
+ return NULL;
+
+ kref_init(&tg->refcount);
+- memcpy(tg->group_data, topology, 8);
++ memcpy(tg->group_data, topology_id, sizeof(tg->group_data));
+ tg->dev = dev;
+
+ mutex_lock(&dev->mode_config.idr_mutex);
+diff --git a/drivers/gpu/drm/drm_displayid_internal.h b/drivers/gpu/drm/drm_displayid_internal.h
+index 5b1b32f73516..4590d6a3d821 100644
+--- a/drivers/gpu/drm/drm_displayid_internal.h
++++ b/drivers/gpu/drm/drm_displayid_internal.h
+@@ -109,7 +109,7 @@ struct displayid_tiled_block {
+ u8 topo[3];
+ u8 tile_size[4];
+ u8 tile_pixel_bezel[5];
+- u8 topology_id[8];
++ u8 topology_id[9];
+ } __packed;
+
+ struct displayid_detailed_timings_1 {
+diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
+index f83f28cae207..877b5ca87e95 100644
+--- a/include/drm/drm_connector.h
++++ b/include/drm/drm_connector.h
+@@ -2608,13 +2608,13 @@ struct drm_tile_group {
+ struct kref refcount;
+ struct drm_device *dev;
+ int id;
+- u8 group_data[8];
++ u8 group_data[9];
+ };
+
+ struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev,
+- const char topology[8]);
++ const char topology_id[9]);
+ struct drm_tile_group *drm_mode_get_tile_group(struct drm_device *dev,
+- const char topology[8]);
++ const char topology_id[9]);
+ void drm_mode_put_tile_group(struct drm_device *dev,
+ struct drm_tile_group *tg);
+
+--
+2.55.0
+
--- /dev/null
+From 914a76a9f08366434bf595700f62026b7a19a9cc Mon Sep 17 00:00:00 2001
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Date: Mon, 22 Jun 2026 16:25:39 +0300
+Subject: drm/i915/gem: Add missing nospec on parallel submit slot
+
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+
+commit 914a76a9f08366434bf595700f62026b7a19a9cc upstream.
+
+Add missing Spectre mitigation for userspace controlled parallel
+submission slot.
+
+Discovered using AI-assisted static analysis confirmed by Intel
+Product Security.
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: e5e32171a2cf ("drm/i915/guc: Connect UAPI to GuC multi-lrc interface")
+Cc: Matthew Brost <matthew.brost@intel.com>
+Cc: Tvrtko Ursulin <tursulin@ursulin.net>
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Cc: <stable@vger.kernel.org> # v5.16+
+Link: https://patch.msgid.link/20260622132539.165558-1-joonas.lahtinen@linux.intel.com
+(cherry picked from commit 15b9353deff3cf72331c387780de3cf9c316b643)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gem/i915_gem_context.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c
++++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c
+@@ -610,6 +610,7 @@ set_proto_ctx_engines_parallel_submit(st
+ return -EINVAL;
+ }
+
++ slot = array_index_nospec(slot, set->num_engines);
+ if (set->engines[slot].type != I915_GEM_ENGINE_TYPE_INVALID) {
+ drm_dbg(&i915->drm,
+ "Invalid placement[%d], already occupied\n", slot);
--- /dev/null
+From c3027973f692077a1b66a9fb26d6a7c46c0dc72c Mon Sep 17 00:00:00 2001
+From: Wentao Liang <vulab@iscas.ac.cn>
+Date: Sat, 6 Jun 2026 15:56:06 +0000
+Subject: drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit()
+
+From: Wentao Liang <vulab@iscas.ac.cn>
+
+commit c3027973f692077a1b66a9fb26d6a7c46c0dc72c upstream.
+
+In nvkm_acr_oneinit(), nvkm_kmap(acr->wpr) is invoked unconditionally
+at line 309 to obtain a mapping reference. Additionally, when both
+acr->wpr_fw and acr->wpr_comp are present, a second nvkm_kmap() is
+called inside the conditional block. Both mappings are expected to be
+released by nvkm_done(acr->wpr) at line 320 before the function returns
+successfully.
+
+However, when a mismatch is detected during the loop within the
+conditional block, the function returns -EINVAL at line 318 without
+calling nvkm_done(). This results in a leak of the kmap reference(s)
+acquired earlier.
+
+Fix the issue by invoking nvkm_done(acr->wpr) prior to the early return
+to ensure proper release of the mapping references.
+
+Fixes: 22dcda45a3d1 ("drm/nouveau/acr: implement new subdev to replace "secure boot"")
+Cc: stable@vger.kernel.org
+Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
+Link: https://patch.msgid.link/20260606155606.77593-1-vulab@iscas.ac.cn
+Signed-off-by: Danilo Krummrich <dakr@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c
+@@ -315,6 +315,7 @@ nvkm_acr_oneinit(struct nvkm_subdev *sub
+ i, us, fw);
+ }
+ }
++ nvkm_done(acr->wpr);
+ return -EINVAL;
+ }
+ nvkm_done(acr->wpr);
--- /dev/null
+From ab99ead646b1b833ecd57fe577a2816f2e848167 Mon Sep 17 00:00:00 2001
+From: Junrui Luo <moonafterrain@outlook.com>
+Date: Wed, 10 Jun 2026 18:01:28 +0800
+Subject: drm/nouveau: fix reversed error cleanup order in ucopy functions
+
+From: Junrui Luo <moonafterrain@outlook.com>
+
+commit ab99ead646b1b833ecd57fe577a2816f2e848167 upstream.
+
+nouveau_uvmm_vm_bind_ucopy() and nouveau_exec_ucopy() place their error
+cleanup labels in allocation order rather than reverse allocation order.
+On a u_memcpya() failure for in_sync.s, the goto to err_free_ops (or
+err_free_pushs) frees the first allocation and then falls through to
+err_free_ins, which calls u_free() on args->in_sync.s.
+
+Since args->in_sync.s still holds the ERR_PTR returned by the failed
+u_memcpya(), and ERR_PTR values are not caught by ZERO_OR_NULL_PTR(),
+kvfree() proceeds to dereference it, which can result in a kernel oops.
+A failure for out_sync.s instead jumps to err_free_ins and skips freeing
+the first allocation, leading to a memory leak.
+
+Fix by swapping the cleanup label order so resources are freed in the
+correct reverse allocation sequence.
+
+Fixes: b88baab82871 ("drm/nouveau: implement new VM_BIND uAPI")
+Reported-by: Yuhao Jiang <danisjiang@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
+Link: https://patch.msgid.link/SYBPR01MB7881484D91A6F80271415F71AF1A2@SYBPR01MB7881.ausprd01.prod.outlook.com
+Signed-off-by: Danilo Krummrich <dakr@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_exec.c | 4 ++--
+ drivers/gpu/drm/nouveau/nouveau_uvmm.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/nouveau/nouveau_exec.c
++++ b/drivers/gpu/drm/nouveau/nouveau_exec.c
+@@ -353,10 +353,10 @@ nouveau_exec_ucopy(struct nouveau_exec_j
+
+ return 0;
+
+-err_free_pushs:
+- u_free(args->push.s);
+ err_free_ins:
+ u_free(args->in_sync.s);
++err_free_pushs:
++ u_free(args->push.s);
+ return ret;
+ }
+
+--- a/drivers/gpu/drm/nouveau/nouveau_uvmm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_uvmm.c
+@@ -1730,10 +1730,10 @@ nouveau_uvmm_vm_bind_ucopy(struct nouvea
+
+ return 0;
+
+-err_free_ops:
+- u_free(args->op.s);
+ err_free_ins:
+ u_free(args->in_sync.s);
++err_free_ops:
++ u_free(args->op.s);
+ return ret;
+ }
+
--- /dev/null
+From f896e86273dbbebb5eac966b4a201b5c62a02e9a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pavel=20Ondra=C4=8Dka?= <pavel.ondracka@gmail.com>
+Date: Wed, 10 Jun 2026 10:32:45 +0200
+Subject: drm/radeon: fix r100_copy_blit for large BOs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pavel Ondračka <pavel.ondracka@gmail.com>
+
+commit f896e86273dbbebb5eac966b4a201b5c62a02e9a upstream.
+
+r100_copy_blit() copies BOs as 1024-pixel-wide ARGB8888 blits, so one
+GPU page becomes one blit row. Large copies are split into chunks of at
+most 8191 rows.
+
+The kernel register header names the packet coordinate dwords SRC_Y_X
+and DST_Y_X. In the BITBLT_MULTI description in
+R5xx_Acceleration_v1.5.pdf docs, these correspond to [SRC_X1 | SRC_Y1]
+and [DST_X1 | DST_Y1], which are signed 13-bit coordinates in the
+-8192..8191 range. The old code kept SRC/DST_PITCH_OFFSET at the BO base
+and used SRC_Y_X/DST_Y_X as the chunk address, so large BO moves could
+exceed that coordinate range.
+
+Compute per-chunk SRC/DST_PITCH_OFFSET bases and emit zero source and
+destination coordinates. r100_copy_blit() already packs
+SRC/DST_PITCH_OFFSET as pitch plus base offset, so large chunk addresses
+belong there rather than in the coordinate fields.
+
+This fixes Prison Architect corruption with 4096x4096 mipped textures
+after they are evicted to GTT under memory pressure on RV530.
+
+Closes: https://gitlab.freedesktop.org/mesa/mesa/-/work_items/6716
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Pavel Ondračka <pavel.ondracka@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 87be26aee76239c6da03e599f238a426897f78ad)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/radeon/r100.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/r100.c
++++ b/drivers/gpu/drm/radeon/r100.c
+@@ -905,6 +905,7 @@ struct radeon_fence *r100_copy_blit(stru
+ {
+ struct radeon_ring *ring = &rdev->ring[RADEON_RING_TYPE_GFX_INDEX];
+ struct radeon_fence *fence;
++ uint64_t cur_src_offset, cur_dst_offset;
+ uint32_t cur_pages;
+ uint32_t stride_bytes = RADEON_GPU_PAGE_SIZE;
+ uint32_t pitch;
+@@ -933,6 +934,10 @@ struct radeon_fence *r100_copy_blit(stru
+ cur_pages = 8191;
+ }
+ num_gpu_pages -= cur_pages;
++ cur_src_offset = src_offset +
++ (uint64_t)num_gpu_pages * RADEON_GPU_PAGE_SIZE;
++ cur_dst_offset = dst_offset +
++ (uint64_t)num_gpu_pages * RADEON_GPU_PAGE_SIZE;
+
+ /* pages are in Y direction - height
+ page width in X direction - width */
+@@ -949,13 +954,13 @@ struct radeon_fence *r100_copy_blit(stru
+ RADEON_DP_SRC_SOURCE_MEMORY |
+ RADEON_GMC_CLR_CMP_CNTL_DIS |
+ RADEON_GMC_WR_MSK_DIS);
+- radeon_ring_write(ring, (pitch << 22) | (src_offset >> 10));
+- radeon_ring_write(ring, (pitch << 22) | (dst_offset >> 10));
++ radeon_ring_write(ring, (pitch << 22) | (cur_src_offset >> 10));
++ radeon_ring_write(ring, (pitch << 22) | (cur_dst_offset >> 10));
+ radeon_ring_write(ring, (0x1fff) | (0x1fff << 16));
+ radeon_ring_write(ring, 0);
+ radeon_ring_write(ring, (0x1fff) | (0x1fff << 16));
+- radeon_ring_write(ring, num_gpu_pages);
+- radeon_ring_write(ring, num_gpu_pages);
++ radeon_ring_write(ring, 0);
++ radeon_ring_write(ring, 0);
+ radeon_ring_write(ring, cur_pages | (stride_pixels << 16));
+ }
+ radeon_ring_write(ring, PACKET0(RADEON_DSTCACHE_CTLSTAT, 0));
drm-dp-mst-fix-oob-reads-on-2-byte-fields-in-sideband-reply-parsers.patch
drm-amdgpu-uvd-fix-forcing-msg-fb-bos-into-vcpu-segment-when-it-isn-t-at-0-v2.patch
drm-amdgpu-uvd-place-vcpu-bo-only-in-vram-for-uvd-4.x-and-older.patch
+drm-amdgpu-fix-amdgpu_bo_move-when-old_mem-and-new_mem-are-both-gtt.patch
+drm-amdgpu-validate-cp_gfx_shadow-chunk-size-in-cs-pass1.patch
+drm-nouveau-fix-reversed-error-cleanup-order-in-ucopy-functions.patch
+drm-i915-gem-add-missing-nospec-on-parallel-submit-slot.patch
+drm-nouveau-acr-fix-missing-nvkm_done-in-error-path-of-nvkm_acr_oneinit.patch
+drm-radeon-fix-r100_copy_blit-for-large-bos.patch
+drm-displayid-fix-tiled-display-topology-id-size.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
