--- /dev/null
+From 18a7826aea6fd09f2d371c02cec70c7234fc4879 Mon Sep 17 00:00:00 2001
+From: Kenneth Feng <kenneth.feng@amd.com>
+Date: Thu, 25 Jun 2026 17:48:22 +0800
+Subject: drm/amd/amdgpu: disable ASPM on VI if pcie dpm is disabled
+
+From: Kenneth Feng <kenneth.feng@amd.com>
+
+commit 18a7826aea6fd09f2d371c02cec70c7234fc4879 upstream.
+
+Disable ASPM on VI if PCIE dpm is disabled.
+
+Fixes: bb00bf17328d ("drm/amd/amdgpu: decouple ASPM with pcie dpm")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5370
+Signed-off-by: Kenneth Feng <kenneth.feng@amd.com>
+Reviewed-by: Yang Wang <kevinyang.wang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 873a8d6b3c0a386408c891e4ff1c684fa11783e1)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -1328,7 +1328,8 @@ static bool amdgpu_device_aspm_support_q
+ * It's unclear if this is a platform-specific or GPU-specific issue.
+ * Disable ASPM on SI for the time being.
+ */
+- if (adev->family == AMDGPU_FAMILY_SI)
++ if (adev->family == AMDGPU_FAMILY_SI ||
++ (!(adev->pm.pp_feature & PP_PCIE_DPM_MASK) && adev->family == AMDGPU_FAMILY_VI))
+ return true;
+
+ #if IS_ENABLED(CONFIG_X86)
--- /dev/null
+From e987eabc02646920cd13ab75902693e99735eca0 Mon Sep 17 00:00:00 2001
+From: Yang Wang <kevinyang.wang@amd.com>
+Date: Mon, 6 Jul 2026 09:29:24 +0800
+Subject: drm/amd/pm: fix smu14 power limit range calculation
+
+From: Yang Wang <kevinyang.wang@amd.com>
+
+commit e987eabc02646920cd13ab75902693e99735eca0 upstream.
+
+SMU14 derives the default PPT limit from SocketPowerLimitAc/Dc, but
+MsgLimits.Power may expose a different firmware limit for the same PPT0
+throttler. Using those values independently as fixed min/max bases can
+report an incorrect configurable power range.
+
+Keep the socket power limit as the default value and as the fallback for
+current-limit queries. Calculate the reported range from both firmware
+values instead, using the lower value as the minimum base and the higher
+value as the maximum base before applying OD percentages.
+
+Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
+Reviewed-by: Kenneth Feng <kenneth.feng@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit c936b8126b444401318fcbeb1828488cc5312dee)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 28 ++++++++++---------
+ 1 file changed, 16 insertions(+), 12 deletions(-)
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c
+@@ -1621,19 +1621,23 @@ static int smu_v14_0_2_get_power_limit(s
+ table_context->power_play_table;
+ PPTable_t *pptable = table_context->driver_pptable;
+ CustomSkuTable_t *skutable = &pptable->CustomSkuTable;
+- int16_t od_percent_upper = 0, od_percent_lower = 0;
++ uint32_t pp_limit = smu->adev->pm.ac_power ?
++ skutable->SocketPowerLimitAc[PPT_THROTTLER_PPT0] :
++ skutable->SocketPowerLimitDc[PPT_THROTTLER_PPT0];
+ uint32_t msg_limit = pptable->SkuTable.MsgLimits.Power[PPT_THROTTLER_PPT0][POWER_SOURCE_AC];
+- uint32_t power_limit;
++ uint32_t min_limit = min_t(uint32_t, pp_limit, msg_limit);
++ uint32_t max_limit = max_t(uint32_t, pp_limit, msg_limit);
++ int16_t od_percent_upper = 0, od_percent_lower = 0;
++ int ret;
+
+- if (smu_v14_0_get_current_power_limit(smu, &power_limit))
+- power_limit = smu->adev->pm.ac_power ?
+- skutable->SocketPowerLimitAc[PPT_THROTTLER_PPT0] :
+- skutable->SocketPowerLimitDc[PPT_THROTTLER_PPT0];
++ if (current_power_limit) {
++ ret = smu_v14_0_get_current_power_limit(smu, current_power_limit);
++ if (ret)
++ *current_power_limit = pp_limit;
++ }
+
+- if (current_power_limit)
+- *current_power_limit = power_limit;
+ if (default_power_limit)
+- *default_power_limit = power_limit;
++ *default_power_limit = pp_limit;
+
+ if (powerplay_table) {
+ if (smu->od_enabled &&
+@@ -1647,15 +1651,15 @@ static int smu_v14_0_2_get_power_limit(s
+ }
+
+ dev_dbg(smu->adev->dev, "od percent upper:%d, od percent lower:%d (default power: %d)\n",
+- od_percent_upper, od_percent_lower, power_limit);
++ od_percent_upper, od_percent_lower, pp_limit);
+
+ if (max_power_limit) {
+- *max_power_limit = msg_limit * (100 + od_percent_upper);
++ *max_power_limit = max_limit * (100 + od_percent_upper);
+ *max_power_limit /= 100;
+ }
+
+ if (min_power_limit) {
+- *min_power_limit = power_limit * (100 + od_percent_lower);
++ *min_power_limit = min_limit * (100 + od_percent_lower);
+ *min_power_limit /= 100;
+ }
+
--- /dev/null
+From 04cc4aa3617b0ed67e859f91f09de5d896a46f3a Mon Sep 17 00:00:00 2001
+From: Shahyan Soltani <shahyan.soltani@amd.com>
+Date: Mon, 6 Jul 2026 08:15:21 -0400
+Subject: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shahyan Soltani <shahyan.soltani@amd.com>
+
+commit 04cc4aa3617b0ed67e859f91f09de5d896a46f3a upstream.
+
+The vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only
+valid while the lock is still being held. Once xa_unlock_irqrestore is
+called and returned, the pointer is no longer under lock and is subject
+to modification. Since, the caller still dereferences vm->task_info in
+amdgpu_vm_get_task_info_vm() after the lock is removed, this causes a
+use after unlock problem.
+
+Remove the lifetime issue present in amdgpu_vm_get_task_info_pasid()
+through removing the amdgpu_vm_get_vm_from_pasid() function from
+amdgpu_vm.c and making the relevant code inline to hold the lock while
+it is still in use.
+
+Signed-off-by: Shahyan Soltani <shahyan.soltani@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 9d01579f3f868b333acc901815972685989092c7)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 25 ++++++++++---------------
+ 1 file changed, 10 insertions(+), 15 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+@@ -2487,19 +2487,6 @@ static void amdgpu_vm_destroy_task_info(
+ kfree(ti);
+ }
+
+-static inline struct amdgpu_vm *
+-amdgpu_vm_get_vm_from_pasid(struct amdgpu_device *adev, u32 pasid)
+-{
+- struct amdgpu_vm *vm;
+- unsigned long flags;
+-
+- xa_lock_irqsave(&adev->vm_manager.pasids, flags);
+- vm = xa_load(&adev->vm_manager.pasids, pasid);
+- xa_unlock_irqrestore(&adev->vm_manager.pasids, flags);
+-
+- return vm;
+-}
+-
+ /**
+ * amdgpu_vm_put_task_info - reference down the vm task_info ptr
+ *
+@@ -2546,8 +2533,16 @@ amdgpu_vm_get_task_info_vm(struct amdgpu
+ struct amdgpu_task_info *
+ amdgpu_vm_get_task_info_pasid(struct amdgpu_device *adev, u32 pasid)
+ {
+- return amdgpu_vm_get_task_info_vm(
+- amdgpu_vm_get_vm_from_pasid(adev, pasid));
++ struct amdgpu_task_info *ti;
++ struct amdgpu_vm *vm;
++ unsigned long flags;
++
++ xa_lock_irqsave(&adev->vm_manager.pasids, flags);
++ vm = xa_load(&adev->vm_manager.pasids, pasid);
++ ti = amdgpu_vm_get_task_info_vm(vm);
++ xa_unlock_irqrestore(&adev->vm_manager.pasids, flags);
++
++ return ti;
+ }
+
+ static int amdgpu_vm_create_task_info(struct amdgpu_vm *vm)
--- /dev/null
+From 0eebcab1ea2a77f086a04108f386f82ee3496022 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 15 Jun 2026 18:20:55 -0400
+Subject: drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON()
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 0eebcab1ea2a77f086a04108f386f82ee3496022 upstream.
+
+There's no need to crash the kernel for these cases.
+
+Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit daa62107452d2451787c4248ca38fa2d1a0cbefd)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+index f856b0cf5bec..92c16392b916 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+@@ -546,7 +546,7 @@ static void gfx_v11_0_wait_reg_mem(struct amdgpu_ring *ring, int eng_sel,
+ WAIT_REG_MEM_ENGINE(eng_sel)));
+
+ if (mem_space)
+- BUG_ON(addr0 & 0x3); /* Dword align */
++ WARN_ON(addr0 & 0x3); /* Dword align */
+ amdgpu_ring_write(ring, addr0);
+ amdgpu_ring_write(ring, addr1);
+ amdgpu_ring_write(ring, ref);
+@@ -5997,7 +5997,7 @@ static void gfx_v11_0_ring_emit_ib_gfx(struct amdgpu_ring *ring,
+ }
+
+ amdgpu_ring_write(ring, header);
+- BUG_ON(ib->gpu_addr & 0x3); /* Dword align */
++ WARN_ON(ib->gpu_addr & 0x3); /* Dword align */
+ amdgpu_ring_write(ring,
+ #ifdef __BIG_ENDIAN
+ (2 << 0) |
+@@ -6032,7 +6032,7 @@ static void gfx_v11_0_ring_emit_ib_compute(struct amdgpu_ring *ring,
+ }
+
+ amdgpu_ring_write(ring, PACKET3(PACKET3_INDIRECT_BUFFER, 2));
+- BUG_ON(ib->gpu_addr & 0x3); /* Dword align */
++ WARN_ON(ib->gpu_addr & 0x3); /* Dword align */
+ amdgpu_ring_write(ring,
+ #ifdef __BIG_ENDIAN
+ (2 << 0) |
+@@ -6065,9 +6065,9 @@ static void gfx_v11_0_ring_emit_fence(struct amdgpu_ring *ring, u64 addr,
+ * aligned if only send 32bit data low (discard data high)
+ */
+ if (write64bit)
+- BUG_ON(addr & 0x7);
++ WARN_ON(addr & 0x7);
+ else
+- BUG_ON(addr & 0x3);
++ WARN_ON(addr & 0x3);
+ amdgpu_ring_write(ring, lower_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(addr));
+ amdgpu_ring_write(ring, lower_32_bits(seq));
+@@ -6121,9 +6121,6 @@ static void gfx_v11_0_ring_emit_fence_kiq(struct amdgpu_ring *ring, u64 addr,
+ {
+ struct amdgpu_device *adev = ring->adev;
+
+- /* we only allocate 32bit for each seq wb address */
+- BUG_ON(flags & AMDGPU_FENCE_FLAG_64BIT);
+-
+ /* write fence seq to the "addr" */
+ amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
+ amdgpu_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) |
+--
+2.55.0
+
--- /dev/null
+From aff079bdce65f6d085e4b0091fdf87fffa95b0d9 Mon Sep 17 00:00:00 2001
+From: Jakob Linke <jakob@linke.cx>
+Date: Wed, 17 Jun 2026 08:24:15 +0200
+Subject: drm/amdgpu/soc24: reset dGPU if suspend got aborted
+
+From: Jakob Linke <jakob@linke.cx>
+
+commit aff079bdce65f6d085e4b0091fdf87fffa95b0d9 upstream.
+
+For SOC24 ASICs (RDNA4 / Navi 4x dGPUs) re-enabling PM features fails if an
+S3 suspend got aborted, the same issue already handled for SOC21 and SOC15:
+
+ commit df3c7dc5c58b ("drm/amdgpu: Reset dGPU if suspend got aborted")
+ commit 38e8ca3e4b6d ("amdgpu/soc15: enable asic reset for dGPU in case of suspend abort")
+
+The aborted resume fails with:
+
+ amdgpu: SMU: No response msg_reg: 6 resp_reg: 0
+ amdgpu: Failed to enable requested dpm features!
+ amdgpu: resume of IP block <smu> failed -62
+
+Apply the same workaround for soc24: detect the aborted-suspend state at
+resume via the sign-of-life register and reset the device before re-init.
+
+This is a workaround till a proper solution is finalized.
+
+Fixes: 98b912c50e44 ("drm/amdgpu: Add soc24 common ip block (v2)")
+Signed-off-by: Jakob Linke <jakob@linke.cx>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit fed5bdbfe1d4a19a26c70f7fc58017dc88be1c18)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/soc24.c | 28 ++++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/soc24.c b/drivers/gpu/drm/amd/amdgpu/soc24.c
+index 265db9331d0b..9dce30d2bb8d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/soc24.c
++++ b/drivers/gpu/drm/amd/amdgpu/soc24.c
+@@ -496,8 +496,36 @@ static int soc24_common_suspend(struct amdgpu_ip_block *ip_block)
+ return soc24_common_hw_fini(ip_block);
+ }
+
++static bool soc24_need_reset_on_resume(struct amdgpu_device *adev)
++{
++ u32 sol_reg1, sol_reg2;
++
++ /* Will reset for the following suspend abort cases.
++ * 1) Only reset dGPU side.
++ * 2) S3 suspend got aborted and TOS is active.
++ * As for dGPU suspend abort cases the SOL value
++ * will be kept as zero at this resume point.
++ */
++ if (!(adev->flags & AMD_IS_APU) && adev->in_s3) {
++ sol_reg1 = RREG32_SOC15(MP0, 0, regMPASP_SMN_C2PMSG_81);
++ msleep(100);
++ sol_reg2 = RREG32_SOC15(MP0, 0, regMPASP_SMN_C2PMSG_81);
++
++ return (sol_reg1 != sol_reg2);
++ }
++
++ return false;
++}
++
+ static int soc24_common_resume(struct amdgpu_ip_block *ip_block)
+ {
++ struct amdgpu_device *adev = ip_block->adev;
++
++ if (soc24_need_reset_on_resume(adev)) {
++ dev_info(adev->dev, "S3 suspend aborted, resetting...");
++ soc24_asic_reset(adev);
++ }
++
+ return soc24_common_hw_init(ip_block);
+ }
+
+--
+2.55.0
+
--- /dev/null
+From 614e8a989d462876c4f6a659f56e1075e72ad515 Mon Sep 17 00:00:00 2001
+From: Jesse Zhang <Jesse.Zhang@amd.com>
+Date: Wed, 1 Jul 2026 18:17:03 +0800
+Subject: drm/amdgpu: trigger GPU recovery when userq destroy fails to unmap a hung queue
+
+From: Jesse Zhang <Jesse.Zhang@amd.com>
+
+commit 614e8a989d462876c4f6a659f56e1075e72ad515 upstream.
+
+Destroying a hung user queue issues a MES REMOVE_QUEUE that times out,
+The destroy path only logged the error and freed the queue, so the
+next userq submission failed and forced a GPU reset attributed to an innocent workload.
+
+Kick the userq reset work when unmap fails so the GPU is recovered at
+destroy time.
+
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 8396b9de4198a54ec4760a94a179347540a9764d)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
+@@ -523,6 +523,15 @@ amdgpu_userq_destroy(struct amdgpu_userq
+ amdgpu_userq_cleanup(queue);
+ mutex_unlock(&uq_mgr->userq_mutex);
+
++ /*
++ * A failed unmap means MES could not remove the hung queue and is now
++ * unresponsive. Recover the GPU here so the wedged MES does not fail
++ * the next, unrelated queue submission and trigger a reset attributed
++ * to an innocent workload.
++ */
++ if (r)
++ queue_work(adev->reset_domain->wq, &uq_mgr->reset_work);
++
+ cancel_delayed_work_sync(&queue->hang_detect_work);
+ uq_funcs->mqd_destroy(queue);
+ queue->userq_mgr = NULL;
--- /dev/null
+From f0262c3a3f14d60140f6b826d40d44edf62c36d6 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 26 Jun 2026 16:29:13 -0400
+Subject: drm/gfx10: Program DB_RING_CONTROL
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit f0262c3a3f14d60140f6b826d40d44edf62c36d6 upstream.
+
+This is needed to allocate occlusion counters across
+both gfx pipes.
+
+Fixes: b7a1a0ef12b8 ("drm/amd/amdgpu: add pipe1 hardware support")
+Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 6807352cbabb74b61ba42888769283af72191f66)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+@@ -5350,6 +5350,15 @@ static void gfx_v10_0_constants_init(str
+ gfx_v10_0_get_tcc_info(adev);
+ adev->gfx.config.pa_sc_tile_steering_override =
+ gfx_v10_0_init_pa_sc_tile_steering_override(adev);
++ /* Program DB_RING_CONTROL for multiple GFX pipes
++ * Default power up value is 1.
++ * Possible values:
++ * 0 - split occlusion counters between gfx pipes
++ * 1 - all occlusion counters to pipe 0
++ * 2 - all occlusion counters to pipe 1
++ */
++ WREG32_FIELD15(GC, 0, DB_RING_CONTROL, COUNTER_CONTROL,
++ (adev->gfx.me.num_pipe_per_me > 1) ? 0 : 1);
+
+ /* XXX SH_MEM regs */
+ /* where to put LDS, scratch, GPUVM in FSA64 space */
--- /dev/null
+From 2084503f2d087bf956198e7f6eb25b03a7049cb2 Mon Sep 17 00:00:00 2001
+From: Jani Nikula <jani.nikula@intel.com>
+Date: Fri, 26 Jun 2026 17:01:55 +0300
+Subject: drm/i915/bios: range check LFP Data Block panel_type2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+commit 2084503f2d087bf956198e7f6eb25b03a7049cb2 upstream.
+
+While the panel_type from LFP Data Block is range checked, panel_type2
+is not. Add a few helpers for range checking, and use them to not only
+check panel_type2, but also improve clarity and correctness in the panel
+type selection.
+
+Discovered using AI-assisted static analysis confirmed by Intel Product
+Security.
+
+v2:
+- Fix commit message typo (Michał)
+- Add is_panel_type_pnp() (Ville)
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: 6434cf630086 ("drm/i915/bios: calculate panel type as per child device index in VBT")
+Cc: stable@vger.kernel.org # v6.0+
+Cc: Animesh Manna <animesh.manna@intel.com>
+Cc: Ville Syrjälä <ville.syrjala@intel.com>
+Reviewed-by: Michał Grzelak <michal.grzelak@intel.com> # v1
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patch.msgid.link/20260626140155.1389655-1-jani.nikula@intel.com
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+(cherry picked from commit c9ebe5d2f25729d6cfbbb1235d640bf67f9275df)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_bios.c | 36 +++++++++++++++++++++++-------
+ 1 file changed, 28 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_bios.c
++++ b/drivers/gpu/drm/i915/display/intel_bios.c
+@@ -623,6 +623,21 @@ get_lfp_data_tail(const struct bdb_lfp_d
+ return NULL;
+ }
+
++static bool is_panel_type_valid(int panel_type)
++{
++ return panel_type >= 0 && panel_type < 16;
++}
++
++static bool is_panel_type_pnp(int panel_type)
++{
++ return panel_type == 0xff;
++}
++
++static bool is_panel_type_valid_or_pnp(int panel_type)
++{
++ return is_panel_type_valid(panel_type) || is_panel_type_pnp(panel_type);
++}
++
+ static int opregion_get_panel_type(struct intel_display *display,
+ const struct intel_bios_encoder_data *devdata,
+ const struct drm_edid *drm_edid, bool use_fallback)
+@@ -640,15 +655,21 @@ static int vbt_get_panel_type(struct int
+ if (!lfp_options)
+ return -1;
+
+- if (lfp_options->panel_type > 0xf &&
+- lfp_options->panel_type != 0xff) {
++ if (!is_panel_type_valid_or_pnp(lfp_options->panel_type)) {
+ drm_dbg_kms(display->drm, "Invalid VBT panel type 0x%x\n",
+ lfp_options->panel_type);
+ return -1;
+ }
+
+- if (devdata && devdata->child.handle == DEVICE_HANDLE_LFP2)
++ if (devdata && devdata->child.handle == DEVICE_HANDLE_LFP2) {
++ if (!is_panel_type_valid_or_pnp(lfp_options->panel_type2)) {
++ drm_dbg_kms(display->drm, "Invalid VBT panel type 2 0x%x\n",
++ lfp_options->panel_type2);
++ return -1;
++ }
++
+ return lfp_options->panel_type2;
++ }
+
+ drm_WARN_ON(display->drm,
+ devdata && devdata->child.handle != DEVICE_HANDLE_LFP1);
+@@ -762,13 +783,12 @@ static int get_panel_type(struct intel_d
+ panel_types[i].name, panel_types[i].panel_type);
+ }
+
+- if (panel_types[PANEL_TYPE_OPREGION].panel_type >= 0)
++ if (is_panel_type_valid(panel_types[PANEL_TYPE_OPREGION].panel_type))
+ i = PANEL_TYPE_OPREGION;
+- else if (panel_types[PANEL_TYPE_VBT].panel_type == 0xff &&
+- panel_types[PANEL_TYPE_PNPID].panel_type >= 0)
++ else if (is_panel_type_pnp(panel_types[PANEL_TYPE_VBT].panel_type) &&
++ is_panel_type_valid(panel_types[PANEL_TYPE_PNPID].panel_type))
+ i = PANEL_TYPE_PNPID;
+- else if (panel_types[PANEL_TYPE_VBT].panel_type != 0xff &&
+- panel_types[PANEL_TYPE_VBT].panel_type >= 0)
++ else if (is_panel_type_valid(panel_types[PANEL_TYPE_VBT].panel_type))
+ i = PANEL_TYPE_VBT;
+ else
+ i = PANEL_TYPE_FALLBACK;
--- /dev/null
+From eed3de2acf6aa5154d49098b026710b646db67ee Mon Sep 17 00:00:00 2001
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Date: Wed, 1 Jul 2026 10:30:30 +0300
+Subject: drm/i915/gem: Do not leak siblings[] on proto context error
+
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+
+commit eed3de2acf6aa5154d49098b026710b646db67ee upstream.
+
+After a successful BALANCE/PARALLEL_SUBMIT extension on context
+creation, error during processing of next user extension leaks
+the siblings[] array. Fix that.
+
+Discovered using AI-assisted static analysis confirmed by
+Intel Product Security.
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)")
+Cc: Faith Ekstrand <faith.ekstrand@collabora.com>
+Cc: Simona Vetter <simona.vetter@ffwll.ch>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: <stable@vger.kernel.org> # v5.15+
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
+Link: https://lore.kernel.org/r/20260701073030.44850-1-joonas.lahtinen@linux.intel.com
+(cherry picked from commit aa65e0a4b51b3b54b53e4142aaa2d997aa1061ff)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gem/i915_gem_context.c | 22 ++++++++++++++--------
+ 1 file changed, 14 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c
++++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c
+@@ -769,8 +769,8 @@ static int set_proto_ctx_engines(struct
+ struct intel_engine_cs *engine;
+
+ if (copy_from_user(&ci, &user->engines[n], sizeof(ci))) {
+- kfree(set.engines);
+- return -EFAULT;
++ err = -EFAULT;
++ goto err;
+ }
+
+ memset(&set.engines[n], 0, sizeof(set.engines[n]));
+@@ -786,8 +786,8 @@ static int set_proto_ctx_engines(struct
+ drm_dbg(&i915->drm,
+ "Invalid engine[%d]: { class:%d, instance:%d }\n",
+ n, ci.engine_class, ci.engine_instance);
+- kfree(set.engines);
+- return -ENOENT;
++ err = -ENOENT;
++ goto err;
+ }
+
+ set.engines[n].type = I915_GEM_ENGINE_TYPE_PHYSICAL;
+@@ -800,15 +800,21 @@ static int set_proto_ctx_engines(struct
+ set_proto_ctx_engines_extensions,
+ ARRAY_SIZE(set_proto_ctx_engines_extensions),
+ &set);
+- if (err) {
+- kfree(set.engines);
+- return err;
+- }
++ if (err)
++ goto err_extensions;
+
+ pc->num_user_engines = set.num_engines;
+ pc->user_engines = set.engines;
+
+ return 0;
++
++err_extensions:
++ for (n = 0; n < set.num_engines; n++)
++ kfree(set.engines[n].siblings);
++err:
++ kfree(set.engines);
++
++ return err;
+ }
+
+ static int set_proto_ctx_sseu(struct drm_i915_file_private *fpriv,
--- /dev/null
+From 2b56757a9a7456825eb668fde92299e01c5e2721 Mon Sep 17 00:00:00 2001
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Date: Wed, 1 Jul 2026 10:55:55 +0300
+Subject: drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU
+
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+
+commit 2b56757a9a7456825eb668fde92299e01c5e2721 upstream.
+
+Setting context engine slot N into I915_ENGINE_CLASS_INVALID /
+I915_ENGINE_CLASS_INVALID_NONE and attempting to apply
+I915_CONTEXT_PARAM_SSEU to the same slot N will deref NULL.
+Fix that.
+
+Discovered using AI-assisted static analysis confirmed by
+Intel Product Security.
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)")
+Cc: Faith Ekstrand <faith.ekstrand@collabora.com>
+Cc: Simona Vetter <simona.vetter@ffwll.ch>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: <stable@vger.kernel.org> # v5.15+
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
+Link: https://patch.msgid.link/20260701075555.52142-1-joonas.lahtinen@linux.intel.com
+(cherry picked from commit 36eda5b5c2d40da41cc0a5403c26986237cf9e87)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gem/i915_gem_context.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c
++++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c
+@@ -856,7 +856,7 @@ static int set_proto_ctx_sseu(struct drm
+ pe = &pc->user_engines[idx];
+
+ /* Only render engine supports RPCS configuration. */
+- if (pe->engine->class != RENDER_CLASS)
++ if (!pe->engine || pe->engine->class != RENDER_CLASS)
+ return -EINVAL;
+
+ sseu = &pe->sseu;
--- /dev/null
+From 82ec992c404c3dc774c5e9f3d4aa858e97187675 Mon Sep 17 00:00:00 2001
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Date: Wed, 1 Jul 2026 14:45:13 +0300
+Subject: drm/i915/gt: Fix NULL deref on sched_engine alloc failure
+
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+
+commit 82ec992c404c3dc774c5e9f3d4aa858e97187675 upstream.
+
+Avoid using intel_context_put() before intel_context_init() in
+execlists_create_virtual() as the kref_put() inside would lead
+to NULL deref on the IOCTL path when sched_engine allocation fails.
+
+Discovered using AI-assisted static analysis confirmed by
+Intel Product Security.
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: 3e28d37146db ("drm/i915: Move priolist to new i915_sched_engine object")
+Cc: Matthew Brost <matthew.brost@intel.com>
+Cc: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Cc: Tvrtko Ursulin <tursulin@ursulin.net>
+Cc: <stable@vger.kernel.org> # v5.15+
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
+Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
+Link: https://lore.kernel.org/r/20260701114513.221254-1-joonas.lahtinen@linux.intel.com
+(cherry picked from commit 4f2a12f2d50e9f48227656e4dcbd6423506be31d)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gt/intel_execlists_submission.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/i915/gt/intel_execlists_submission.c
++++ b/drivers/gpu/drm/i915/gt/intel_execlists_submission.c
+@@ -3932,11 +3932,11 @@ execlists_create_virtual(struct intel_en
+ struct drm_i915_private *i915 = siblings[0]->i915;
+ struct virtual_engine *ve;
+ unsigned int n;
+- int err;
++ int err = -ENOMEM;
+
+ ve = kzalloc_flex(*ve, siblings, count);
+ if (!ve)
+- return ERR_PTR(-ENOMEM);
++ goto err;
+
+ ve->base.i915 = i915;
+ ve->base.gt = siblings[0]->gt;
+@@ -3968,10 +3968,8 @@ execlists_create_virtual(struct intel_en
+ intel_engine_init_execlists(&ve->base);
+
+ ve->base.sched_engine = i915_sched_engine_create(ENGINE_VIRTUAL);
+- if (!ve->base.sched_engine) {
+- err = -ENOMEM;
+- goto err_put;
+- }
++ if (!ve->base.sched_engine)
++ goto err_noput;
+ ve->base.sched_engine->private_data = &ve->base;
+
+ ve->base.cops = &virtual_context_ops;
+@@ -3987,10 +3985,8 @@ execlists_create_virtual(struct intel_en
+ intel_context_init(&ve->context, &ve->base);
+
+ ve->base.breadcrumbs = intel_breadcrumbs_create(NULL);
+- if (!ve->base.breadcrumbs) {
+- err = -ENOMEM;
++ if (!ve->base.breadcrumbs)
+ goto err_put;
+- }
+
+ for (n = 0; n < count; n++) {
+ struct intel_engine_cs *sibling = siblings[n];
+@@ -4065,8 +4061,13 @@ execlists_create_virtual(struct intel_en
+ virtual_engine_initial_hint(ve);
+ return &ve->context;
+
++err_noput:
++ kfree(ve);
++ goto err;
++
+ err_put:
+ intel_context_put(&ve->context);
++err:
+ return ERR_PTR(err);
+ }
+
--- /dev/null
+From 005771c18c5b2c98cb4e7517661aea460990fd3f Mon Sep 17 00:00:00 2001
+From: Jani Nikula <jani.nikula@intel.com>
+Date: Thu, 25 Jun 2026 17:22:04 +0300
+Subject: drm/i915/mst: limit DP MST ESI service loop
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+commit 005771c18c5b2c98cb4e7517661aea460990fd3f upstream.
+
+The loop in intel_dp_check_mst_status() keeps servicing interrupts
+originating from the sink without bound. Add an upper bound to the new
+interrupts occurring during interrupt processing to not get stuck on
+potentially stuck sink devices. Use arbitrary 32 tries to clear incoming
+interrupts in one go.
+
+Discovered using AI-assisted static analysis confirmed by Intel Product
+Security.
+
+Note: The condition likely pre-dates the commit in the Fixes: tag, but
+this is about as far back as a backport has any chance of
+succeeding. Before that, the retry had a goto.
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: 3c0ec2c2d594 ("drm/i915: Flatten intel_dp_check_mst_status() a bit")
+Cc: stable@vger.kernel.org # v5.8+
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Imre Deak <imre.deak@intel.com>
+Reviewed-by: Imre Deak <imre.deak@intel.com>
+Link: https://patch.msgid.link/20260625142204.1078287-1-jani.nikula@intel.com
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+(cherry picked from commit b4ea5272133059acb493cc36599071a9e852ec2e)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_dp.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_dp.c
++++ b/drivers/gpu/drm/i915/display/intel_dp.c
+@@ -5589,8 +5589,9 @@ intel_dp_check_mst_status(struct intel_d
+ struct intel_display *display = to_intel_display(intel_dp);
+ bool force_retrain = intel_dp->link.force_retrain;
+ bool reprobe_needed = false;
++ int tries = 33;
+
+- for (;;) {
++ while (--tries) {
+ u8 esi[4] = {};
+ u8 ack[4] = {};
+ bool new_irqs;
+@@ -5633,6 +5634,11 @@ intel_dp_check_mst_status(struct intel_d
+ break;
+ }
+
++ if (!tries) {
++ drm_dbg_kms(display->drm, "DPRX ESI not clearing, device may be stuck\n");
++ reprobe_needed = true;
++ }
++
+ return !reprobe_needed;
+ }
+
--- /dev/null
+From 1e33f0de5fdcd09e51fdec1e5822448970b6420f Mon Sep 17 00:00:00 2001
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Date: Wed, 24 Jun 2026 12:09:40 +0300
+Subject: drm/i915: Return NULL on error in active_instance
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+
+commit 1e33f0de5fdcd09e51fdec1e5822448970b6420f upstream.
+
+Avoid returning &node->base when node is NULL due to OOM
+during GFP_ATOMIC allocation.
+
+Discovered using AI-assisted static analysis confirmed by
+Intel Product Security.
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: bfaae47db3c0 ("drm/i915: make lockdep slightly happier about execbuf.")
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Cc: Simona Vetter <simona.vetter@ffwll.ch>
+Cc: <stable@vger.kernel.org> # v5.13+
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Reviewed-by: Sebastian Brzezinka <sebastian.brzezinka@intel.com>
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Link: https://patch.msgid.link/20260624090940.74840-1-joonas.lahtinen@linux.intel.com
+(cherry picked from commit 6029bc064f0b1bac184203a50fbaaf070fa18832)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/i915_active.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/i915_active.c
++++ b/drivers/gpu/drm/i915/i915_active.c
+@@ -318,7 +318,7 @@ active_instance(struct i915_active *ref,
+ */
+ node = kmem_cache_alloc(slab_cache, GFP_ATOMIC);
+ if (!node)
+- goto out;
++ goto err;
+
+ __i915_active_fence_init(&node->base, NULL, node_retire);
+ node->ref = ref;
+@@ -332,6 +332,11 @@ out:
+ spin_unlock_irq(&ref->tree_lock);
+
+ return &node->base;
++
++err:
++ spin_unlock_irq(&ref->tree_lock);
++
++ return NULL;
+ }
+
+ void __i915_active_init(struct i915_active *ref,
--- /dev/null
+From d489a5305b9d5480d6fb97d5636f5f4b1e0b3827 Mon Sep 17 00:00:00 2001
+From: Jason Macnak <natsu@google.com>
+Date: Thu, 25 Jun 2026 10:08:28 -0700
+Subject: drm/virtio: Don't detach GEM from a non-created context
+
+From: Jason Macnak <natsu@google.com>
+
+commit d489a5305b9d5480d6fb97d5636f5f4b1e0b3827 upstream.
+
+Applies the same treatment as commit 7cf6dd467e87 ("drm/virtio:
+Don't attach GEM to a non-created context in gem_object_open()")
+to virtio_gpu_gem_object_close() to avoid trying to detach
+a resource that was never attached due to a context
+never being created when context_init is supported.
+
+Fixes: 086b9f27f0ab ("drm/virtio: Don't create a context with default param if context_init is supported")
+Cc: <stable@vger.kernel.org> # v6.14+
+Signed-off-by: Jason Macnak <natsu@google.com>
+Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Link: https://patch.msgid.link/20260625170828.3335431-1-natsu@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/virtio/virtgpu_gem.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/virtio/virtgpu_gem.c
++++ b/drivers/gpu/drm/virtio/virtgpu_gem.c
+@@ -139,13 +139,15 @@ void virtio_gpu_gem_object_close(struct
+ if (!vgdev->has_virgl_3d)
+ return;
+
+- objs = virtio_gpu_array_alloc(1);
+- if (!objs)
+- return;
+- virtio_gpu_array_add_obj(objs, obj);
++ if (vfpriv->context_created) {
++ objs = virtio_gpu_array_alloc(1);
++ if (!objs)
++ return;
++ virtio_gpu_array_add_obj(objs, obj);
+
+- virtio_gpu_cmd_context_detach_resource(vgdev, vfpriv->ctx_id,
+- objs);
++ virtio_gpu_cmd_context_detach_resource(vgdev, vfpriv->ctx_id,
++ objs);
++ }
+ virtio_gpu_notify(vgdev);
+ }
+
drm-amdgpu-sdma6.0-replace-bug_on-with-warn_on.patch
drm-amdgpu-sdma5.2-replace-bug_on-with-warn_on.patch
drm-amdgpu-sdma5.0-replace-bug_on-with-warn_on.patch
+drm-i915-return-null-on-error-in-active_instance.patch
+drm-i915-bios-range-check-lfp-data-block-panel_type2.patch
+drm-amdgpu-soc24-reset-dgpu-if-suspend-got-aborted.patch
+drm-amdgpu-gfx11-replace-bug_on-with-warn_on.patch
+drm-amd-amdgpu-disable-aspm-on-vi-if-pcie-dpm-is-disabled.patch
+drm-amdgpu-fix-lifetime-issue-of-amdgpu_vm_get_task_info_pasid.patch
+drm-amdgpu-trigger-gpu-recovery-when-userq-destroy-fails-to-unmap-a-hung-queue.patch
+drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch
+drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch
+drm-i915-gt-fix-null-deref-on-sched_engine-alloc-failure.patch
+drm-i915-mst-limit-dp-mst-esi-service-loop.patch
+drm-amd-pm-fix-smu14-power-limit-range-calculation.patch
+drm-gfx10-program-db_ring_control.patch
+drm-virtio-don-t-detach-gem-from-a-non-created-context.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
