--- /dev/null
+From 18a7826aea6fd09f2d371c02cec70c7234fc4879 Mon Sep 17 00:00:00 2001
+From: Kenneth Feng <kenneth.feng@amd.com>
+Date: Thu, 25 Jun 2026 17:48:22 +0800
+Subject: drm/amd/amdgpu: disable ASPM on VI if pcie dpm is disabled
+
+From: Kenneth Feng <kenneth.feng@amd.com>
+
+commit 18a7826aea6fd09f2d371c02cec70c7234fc4879 upstream.
+
+Disable ASPM on VI if PCIE dpm is disabled.
+
+Fixes: bb00bf17328d ("drm/amd/amdgpu: decouple ASPM with pcie dpm")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5370
+Signed-off-by: Kenneth Feng <kenneth.feng@amd.com>
+Reviewed-by: Yang Wang <kevinyang.wang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 873a8d6b3c0a386408c891e4ff1c684fa11783e1)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -1888,7 +1888,8 @@ static bool amdgpu_device_aspm_support_q
+ * It's unclear if this is a platform-specific or GPU-specific issue.
+ * Disable ASPM on SI for the time being.
+ */
+- if (adev->family == AMDGPU_FAMILY_SI)
++ if (adev->family == AMDGPU_FAMILY_SI ||
++ (!(adev->pm.pp_feature & PP_PCIE_DPM_MASK) && adev->family == AMDGPU_FAMILY_VI))
+ return true;
+
+ #if IS_ENABLED(CONFIG_X86)
--- /dev/null
+From e987eabc02646920cd13ab75902693e99735eca0 Mon Sep 17 00:00:00 2001
+From: Yang Wang <kevinyang.wang@amd.com>
+Date: Mon, 6 Jul 2026 09:29:24 +0800
+Subject: drm/amd/pm: fix smu14 power limit range calculation
+
+From: Yang Wang <kevinyang.wang@amd.com>
+
+commit e987eabc02646920cd13ab75902693e99735eca0 upstream.
+
+SMU14 derives the default PPT limit from SocketPowerLimitAc/Dc, but
+MsgLimits.Power may expose a different firmware limit for the same PPT0
+throttler. Using those values independently as fixed min/max bases can
+report an incorrect configurable power range.
+
+Keep the socket power limit as the default value and as the fallback for
+current-limit queries. Calculate the reported range from both firmware
+values instead, using the lower value as the minimum base and the higher
+value as the maximum base before applying OD percentages.
+
+Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
+Reviewed-by: Kenneth Feng <kenneth.feng@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit c936b8126b444401318fcbeb1828488cc5312dee)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 28 ++++++++++---------
+ 1 file changed, 16 insertions(+), 12 deletions(-)
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c
+@@ -1701,19 +1701,23 @@ static int smu_v14_0_2_get_power_limit(s
+ table_context->power_play_table;
+ PPTable_t *pptable = table_context->driver_pptable;
+ CustomSkuTable_t *skutable = &pptable->CustomSkuTable;
+- int16_t od_percent_upper = 0, od_percent_lower = 0;
++ uint32_t pp_limit = smu->adev->pm.ac_power ?
++ skutable->SocketPowerLimitAc[PPT_THROTTLER_PPT0] :
++ skutable->SocketPowerLimitDc[PPT_THROTTLER_PPT0];
+ uint32_t msg_limit = pptable->SkuTable.MsgLimits.Power[PPT_THROTTLER_PPT0][POWER_SOURCE_AC];
+- uint32_t power_limit;
++ uint32_t min_limit = min_t(uint32_t, pp_limit, msg_limit);
++ uint32_t max_limit = max_t(uint32_t, pp_limit, msg_limit);
++ int16_t od_percent_upper = 0, od_percent_lower = 0;
++ int ret;
+
+- if (smu_v14_0_get_current_power_limit(smu, &power_limit))
+- power_limit = smu->adev->pm.ac_power ?
+- skutable->SocketPowerLimitAc[PPT_THROTTLER_PPT0] :
+- skutable->SocketPowerLimitDc[PPT_THROTTLER_PPT0];
++ if (current_power_limit) {
++ ret = smu_v14_0_get_current_power_limit(smu, current_power_limit);
++ if (ret)
++ *current_power_limit = pp_limit;
++ }
+
+- if (current_power_limit)
+- *current_power_limit = power_limit;
+ if (default_power_limit)
+- *default_power_limit = power_limit;
++ *default_power_limit = pp_limit;
+
+ if (powerplay_table) {
+ if (smu->od_enabled &&
+@@ -1727,15 +1731,15 @@ static int smu_v14_0_2_get_power_limit(s
+ }
+
+ dev_dbg(smu->adev->dev, "od percent upper:%d, od percent lower:%d (default power: %d)\n",
+- od_percent_upper, od_percent_lower, power_limit);
++ od_percent_upper, od_percent_lower, pp_limit);
+
+ if (max_power_limit) {
+- *max_power_limit = msg_limit * (100 + od_percent_upper);
++ *max_power_limit = max_limit * (100 + od_percent_upper);
+ *max_power_limit /= 100;
+ }
+
+ if (min_power_limit) {
+- *min_power_limit = power_limit * (100 + od_percent_lower);
++ *min_power_limit = min_limit * (100 + od_percent_lower);
+ *min_power_limit /= 100;
+ }
+
--- /dev/null
+From 04cc4aa3617b0ed67e859f91f09de5d896a46f3a Mon Sep 17 00:00:00 2001
+From: Shahyan Soltani <shahyan.soltani@amd.com>
+Date: Mon, 6 Jul 2026 08:15:21 -0400
+Subject: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shahyan Soltani <shahyan.soltani@amd.com>
+
+commit 04cc4aa3617b0ed67e859f91f09de5d896a46f3a upstream.
+
+The vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only
+valid while the lock is still being held. Once xa_unlock_irqrestore is
+called and returned, the pointer is no longer under lock and is subject
+to modification. Since, the caller still dereferences vm->task_info in
+amdgpu_vm_get_task_info_vm() after the lock is removed, this causes a
+use after unlock problem.
+
+Remove the lifetime issue present in amdgpu_vm_get_task_info_pasid()
+through removing the amdgpu_vm_get_vm_from_pasid() function from
+amdgpu_vm.c and making the relevant code inline to hold the lock while
+it is still in use.
+
+Signed-off-by: Shahyan Soltani <shahyan.soltani@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 9d01579f3f868b333acc901815972685989092c7)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 25 ++++++++++---------------
+ 1 file changed, 10 insertions(+), 15 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+@@ -2453,19 +2453,6 @@ static void amdgpu_vm_destroy_task_info(
+ kfree(ti);
+ }
+
+-static inline struct amdgpu_vm *
+-amdgpu_vm_get_vm_from_pasid(struct amdgpu_device *adev, u32 pasid)
+-{
+- struct amdgpu_vm *vm;
+- unsigned long flags;
+-
+- xa_lock_irqsave(&adev->vm_manager.pasids, flags);
+- vm = xa_load(&adev->vm_manager.pasids, pasid);
+- xa_unlock_irqrestore(&adev->vm_manager.pasids, flags);
+-
+- return vm;
+-}
+-
+ /**
+ * amdgpu_vm_put_task_info - reference down the vm task_info ptr
+ *
+@@ -2512,8 +2499,16 @@ amdgpu_vm_get_task_info_vm(struct amdgpu
+ struct amdgpu_task_info *
+ amdgpu_vm_get_task_info_pasid(struct amdgpu_device *adev, u32 pasid)
+ {
+- return amdgpu_vm_get_task_info_vm(
+- amdgpu_vm_get_vm_from_pasid(adev, pasid));
++ struct amdgpu_task_info *ti;
++ struct amdgpu_vm *vm;
++ unsigned long flags;
++
++ xa_lock_irqsave(&adev->vm_manager.pasids, flags);
++ vm = xa_load(&adev->vm_manager.pasids, pasid);
++ ti = amdgpu_vm_get_task_info_vm(vm);
++ xa_unlock_irqrestore(&adev->vm_manager.pasids, flags);
++
++ return ti;
+ }
+
+ static int amdgpu_vm_create_task_info(struct amdgpu_vm *vm)
--- /dev/null
+From f0262c3a3f14d60140f6b826d40d44edf62c36d6 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 26 Jun 2026 16:29:13 -0400
+Subject: drm/gfx10: Program DB_RING_CONTROL
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit f0262c3a3f14d60140f6b826d40d44edf62c36d6 upstream.
+
+This is needed to allocate occlusion counters across
+both gfx pipes.
+
+Fixes: b7a1a0ef12b8 ("drm/amd/amdgpu: add pipe1 hardware support")
+Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 6807352cbabb74b61ba42888769283af72191f66)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+@@ -5349,6 +5349,15 @@ static void gfx_v10_0_constants_init(str
+ gfx_v10_0_get_tcc_info(adev);
+ adev->gfx.config.pa_sc_tile_steering_override =
+ gfx_v10_0_init_pa_sc_tile_steering_override(adev);
++ /* Program DB_RING_CONTROL for multiple GFX pipes
++ * Default power up value is 1.
++ * Possible values:
++ * 0 - split occlusion counters between gfx pipes
++ * 1 - all occlusion counters to pipe 0
++ * 2 - all occlusion counters to pipe 1
++ */
++ WREG32_FIELD15(GC, 0, DB_RING_CONTROL, COUNTER_CONTROL,
++ (adev->gfx.me.num_pipe_per_me > 1) ? 0 : 1);
+
+ /* XXX SH_MEM regs */
+ /* where to put LDS, scratch, GPUVM in FSA64 space */
--- /dev/null
+From 2084503f2d087bf956198e7f6eb25b03a7049cb2 Mon Sep 17 00:00:00 2001
+From: Jani Nikula <jani.nikula@intel.com>
+Date: Fri, 26 Jun 2026 17:01:55 +0300
+Subject: drm/i915/bios: range check LFP Data Block panel_type2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+commit 2084503f2d087bf956198e7f6eb25b03a7049cb2 upstream.
+
+While the panel_type from LFP Data Block is range checked, panel_type2
+is not. Add a few helpers for range checking, and use them to not only
+check panel_type2, but also improve clarity and correctness in the panel
+type selection.
+
+Discovered using AI-assisted static analysis confirmed by Intel Product
+Security.
+
+v2:
+- Fix commit message typo (Michał)
+- Add is_panel_type_pnp() (Ville)
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: 6434cf630086 ("drm/i915/bios: calculate panel type as per child device index in VBT")
+Cc: stable@vger.kernel.org # v6.0+
+Cc: Animesh Manna <animesh.manna@intel.com>
+Cc: Ville Syrjälä <ville.syrjala@intel.com>
+Reviewed-by: Michał Grzelak <michal.grzelak@intel.com> # v1
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patch.msgid.link/20260626140155.1389655-1-jani.nikula@intel.com
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+(cherry picked from commit c9ebe5d2f25729d6cfbbb1235d640bf67f9275df)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_bios.c | 36 +++++++++++++++++++++++-------
+ 1 file changed, 28 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_bios.c
++++ b/drivers/gpu/drm/i915/display/intel_bios.c
+@@ -624,6 +624,21 @@ get_lfp_data_tail(const struct bdb_lfp_d
+ return NULL;
+ }
+
++static bool is_panel_type_valid(int panel_type)
++{
++ return panel_type >= 0 && panel_type < 16;
++}
++
++static bool is_panel_type_pnp(int panel_type)
++{
++ return panel_type == 0xff;
++}
++
++static bool is_panel_type_valid_or_pnp(int panel_type)
++{
++ return is_panel_type_valid(panel_type) || is_panel_type_pnp(panel_type);
++}
++
+ static int opregion_get_panel_type(struct intel_display *display,
+ const struct intel_bios_encoder_data *devdata,
+ const struct drm_edid *drm_edid, bool use_fallback)
+@@ -641,15 +656,21 @@ static int vbt_get_panel_type(struct int
+ if (!lfp_options)
+ return -1;
+
+- if (lfp_options->panel_type > 0xf &&
+- lfp_options->panel_type != 0xff) {
++ if (!is_panel_type_valid_or_pnp(lfp_options->panel_type)) {
+ drm_dbg_kms(display->drm, "Invalid VBT panel type 0x%x\n",
+ lfp_options->panel_type);
+ return -1;
+ }
+
+- if (devdata && devdata->child.handle == DEVICE_HANDLE_LFP2)
++ if (devdata && devdata->child.handle == DEVICE_HANDLE_LFP2) {
++ if (!is_panel_type_valid_or_pnp(lfp_options->panel_type2)) {
++ drm_dbg_kms(display->drm, "Invalid VBT panel type 2 0x%x\n",
++ lfp_options->panel_type2);
++ return -1;
++ }
++
+ return lfp_options->panel_type2;
++ }
+
+ drm_WARN_ON(display->drm,
+ devdata && devdata->child.handle != DEVICE_HANDLE_LFP1);
+@@ -763,13 +784,12 @@ static int get_panel_type(struct intel_d
+ panel_types[i].name, panel_types[i].panel_type);
+ }
+
+- if (panel_types[PANEL_TYPE_OPREGION].panel_type >= 0)
++ if (is_panel_type_valid(panel_types[PANEL_TYPE_OPREGION].panel_type))
+ i = PANEL_TYPE_OPREGION;
+- else if (panel_types[PANEL_TYPE_VBT].panel_type == 0xff &&
+- panel_types[PANEL_TYPE_PNPID].panel_type >= 0)
++ else if (is_panel_type_pnp(panel_types[PANEL_TYPE_VBT].panel_type) &&
++ is_panel_type_valid(panel_types[PANEL_TYPE_PNPID].panel_type))
+ i = PANEL_TYPE_PNPID;
+- else if (panel_types[PANEL_TYPE_VBT].panel_type != 0xff &&
+- panel_types[PANEL_TYPE_VBT].panel_type >= 0)
++ else if (is_panel_type_valid(panel_types[PANEL_TYPE_VBT].panel_type))
+ i = PANEL_TYPE_VBT;
+ else
+ i = PANEL_TYPE_FALLBACK;
--- /dev/null
+From eed3de2acf6aa5154d49098b026710b646db67ee Mon Sep 17 00:00:00 2001
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Date: Wed, 1 Jul 2026 10:30:30 +0300
+Subject: drm/i915/gem: Do not leak siblings[] on proto context error
+
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+
+commit eed3de2acf6aa5154d49098b026710b646db67ee upstream.
+
+After a successful BALANCE/PARALLEL_SUBMIT extension on context
+creation, error during processing of next user extension leaks
+the siblings[] array. Fix that.
+
+Discovered using AI-assisted static analysis confirmed by
+Intel Product Security.
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)")
+Cc: Faith Ekstrand <faith.ekstrand@collabora.com>
+Cc: Simona Vetter <simona.vetter@ffwll.ch>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: <stable@vger.kernel.org> # v5.15+
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
+Link: https://lore.kernel.org/r/20260701073030.44850-1-joonas.lahtinen@linux.intel.com
+(cherry picked from commit aa65e0a4b51b3b54b53e4142aaa2d997aa1061ff)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gem/i915_gem_context.c | 22 ++++++++++++++--------
+ 1 file changed, 14 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c
++++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c
+@@ -770,8 +770,8 @@ static int set_proto_ctx_engines(struct
+ struct intel_engine_cs *engine;
+
+ if (copy_from_user(&ci, &user->engines[n], sizeof(ci))) {
+- kfree(set.engines);
+- return -EFAULT;
++ err = -EFAULT;
++ goto err;
+ }
+
+ memset(&set.engines[n], 0, sizeof(set.engines[n]));
+@@ -787,8 +787,8 @@ static int set_proto_ctx_engines(struct
+ drm_dbg(&i915->drm,
+ "Invalid engine[%d]: { class:%d, instance:%d }\n",
+ n, ci.engine_class, ci.engine_instance);
+- kfree(set.engines);
+- return -ENOENT;
++ err = -ENOENT;
++ goto err;
+ }
+
+ set.engines[n].type = I915_GEM_ENGINE_TYPE_PHYSICAL;
+@@ -801,15 +801,21 @@ static int set_proto_ctx_engines(struct
+ set_proto_ctx_engines_extensions,
+ ARRAY_SIZE(set_proto_ctx_engines_extensions),
+ &set);
+- if (err) {
+- kfree(set.engines);
+- return err;
+- }
++ if (err)
++ goto err_extensions;
+
+ pc->num_user_engines = set.num_engines;
+ pc->user_engines = set.engines;
+
+ return 0;
++
++err_extensions:
++ for (n = 0; n < set.num_engines; n++)
++ kfree(set.engines[n].siblings);
++err:
++ kfree(set.engines);
++
++ return err;
+ }
+
+ static int set_proto_ctx_sseu(struct drm_i915_file_private *fpriv,
--- /dev/null
+From 2b56757a9a7456825eb668fde92299e01c5e2721 Mon Sep 17 00:00:00 2001
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Date: Wed, 1 Jul 2026 10:55:55 +0300
+Subject: drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU
+
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+
+commit 2b56757a9a7456825eb668fde92299e01c5e2721 upstream.
+
+Setting context engine slot N into I915_ENGINE_CLASS_INVALID /
+I915_ENGINE_CLASS_INVALID_NONE and attempting to apply
+I915_CONTEXT_PARAM_SSEU to the same slot N will deref NULL.
+Fix that.
+
+Discovered using AI-assisted static analysis confirmed by
+Intel Product Security.
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)")
+Cc: Faith Ekstrand <faith.ekstrand@collabora.com>
+Cc: Simona Vetter <simona.vetter@ffwll.ch>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: <stable@vger.kernel.org> # v5.15+
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
+Link: https://patch.msgid.link/20260701075555.52142-1-joonas.lahtinen@linux.intel.com
+(cherry picked from commit 36eda5b5c2d40da41cc0a5403c26986237cf9e87)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gem/i915_gem_context.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c
++++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c
+@@ -857,7 +857,7 @@ static int set_proto_ctx_sseu(struct drm
+ pe = &pc->user_engines[idx];
+
+ /* Only render engine supports RPCS configuration. */
+- if (pe->engine->class != RENDER_CLASS)
++ if (!pe->engine || pe->engine->class != RENDER_CLASS)
+ return -EINVAL;
+
+ sseu = &pe->sseu;
--- /dev/null
+From 005771c18c5b2c98cb4e7517661aea460990fd3f Mon Sep 17 00:00:00 2001
+From: Jani Nikula <jani.nikula@intel.com>
+Date: Thu, 25 Jun 2026 17:22:04 +0300
+Subject: drm/i915/mst: limit DP MST ESI service loop
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+commit 005771c18c5b2c98cb4e7517661aea460990fd3f upstream.
+
+The loop in intel_dp_check_mst_status() keeps servicing interrupts
+originating from the sink without bound. Add an upper bound to the new
+interrupts occurring during interrupt processing to not get stuck on
+potentially stuck sink devices. Use arbitrary 32 tries to clear incoming
+interrupts in one go.
+
+Discovered using AI-assisted static analysis confirmed by Intel Product
+Security.
+
+Note: The condition likely pre-dates the commit in the Fixes: tag, but
+this is about as far back as a backport has any chance of
+succeeding. Before that, the retry had a goto.
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: 3c0ec2c2d594 ("drm/i915: Flatten intel_dp_check_mst_status() a bit")
+Cc: stable@vger.kernel.org # v5.8+
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Imre Deak <imre.deak@intel.com>
+Reviewed-by: Imre Deak <imre.deak@intel.com>
+Link: https://patch.msgid.link/20260625142204.1078287-1-jani.nikula@intel.com
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+(cherry picked from commit b4ea5272133059acb493cc36599071a9e852ec2e)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_dp.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_dp.c
++++ b/drivers/gpu/drm/i915/display/intel_dp.c
+@@ -5203,8 +5203,9 @@ intel_dp_check_mst_status(struct intel_d
+ struct intel_encoder *encoder = &dig_port->base;
+ bool link_ok = true;
+ bool reprobe_needed = false;
++ int tries = 33;
+
+- for (;;) {
++ while (--tries) {
+ u8 esi[4] = {};
+ u8 ack[4] = {};
+
+@@ -5247,6 +5248,11 @@ intel_dp_check_mst_status(struct intel_d
+ if (!link_ok || intel_dp->link.force_retrain)
+ intel_encoder_link_check_queue_work(encoder, 0);
+
++ if (!tries) {
++ drm_dbg_kms(display->drm, "DPRX ESI not clearing, device may be stuck\n");
++ reprobe_needed = true;
++ }
++
+ return !reprobe_needed;
+ }
+
--- /dev/null
+From 1e33f0de5fdcd09e51fdec1e5822448970b6420f Mon Sep 17 00:00:00 2001
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Date: Wed, 24 Jun 2026 12:09:40 +0300
+Subject: drm/i915: Return NULL on error in active_instance
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+
+commit 1e33f0de5fdcd09e51fdec1e5822448970b6420f upstream.
+
+Avoid returning &node->base when node is NULL due to OOM
+during GFP_ATOMIC allocation.
+
+Discovered using AI-assisted static analysis confirmed by
+Intel Product Security.
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: bfaae47db3c0 ("drm/i915: make lockdep slightly happier about execbuf.")
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Cc: Simona Vetter <simona.vetter@ffwll.ch>
+Cc: <stable@vger.kernel.org> # v5.13+
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Reviewed-by: Sebastian Brzezinka <sebastian.brzezinka@intel.com>
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Link: https://patch.msgid.link/20260624090940.74840-1-joonas.lahtinen@linux.intel.com
+(cherry picked from commit 6029bc064f0b1bac184203a50fbaaf070fa18832)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/i915_active.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/i915_active.c
++++ b/drivers/gpu/drm/i915/i915_active.c
+@@ -318,7 +318,7 @@ active_instance(struct i915_active *ref,
+ */
+ node = kmem_cache_alloc(slab_cache, GFP_ATOMIC);
+ if (!node)
+- goto out;
++ goto err;
+
+ __i915_active_fence_init(&node->base, NULL, node_retire);
+ node->ref = ref;
+@@ -332,6 +332,11 @@ out:
+ spin_unlock_irq(&ref->tree_lock);
+
+ return &node->base;
++
++err:
++ spin_unlock_irq(&ref->tree_lock);
++
++ return NULL;
+ }
+
+ void __i915_active_init(struct i915_active *ref,
--- /dev/null
+From d489a5305b9d5480d6fb97d5636f5f4b1e0b3827 Mon Sep 17 00:00:00 2001
+From: Jason Macnak <natsu@google.com>
+Date: Thu, 25 Jun 2026 10:08:28 -0700
+Subject: drm/virtio: Don't detach GEM from a non-created context
+
+From: Jason Macnak <natsu@google.com>
+
+commit d489a5305b9d5480d6fb97d5636f5f4b1e0b3827 upstream.
+
+Applies the same treatment as commit 7cf6dd467e87 ("drm/virtio:
+Don't attach GEM to a non-created context in gem_object_open()")
+to virtio_gpu_gem_object_close() to avoid trying to detach
+a resource that was never attached due to a context
+never being created when context_init is supported.
+
+Fixes: 086b9f27f0ab ("drm/virtio: Don't create a context with default param if context_init is supported")
+Cc: <stable@vger.kernel.org> # v6.14+
+Signed-off-by: Jason Macnak <natsu@google.com>
+Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Link: https://patch.msgid.link/20260625170828.3335431-1-natsu@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/virtio/virtgpu_gem.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/virtio/virtgpu_gem.c
++++ b/drivers/gpu/drm/virtio/virtgpu_gem.c
+@@ -139,13 +139,15 @@ void virtio_gpu_gem_object_close(struct
+ if (!vgdev->has_virgl_3d)
+ return;
+
+- objs = virtio_gpu_array_alloc(1);
+- if (!objs)
+- return;
+- virtio_gpu_array_add_obj(objs, obj);
++ if (vfpriv->context_created) {
++ objs = virtio_gpu_array_alloc(1);
++ if (!objs)
++ return;
++ virtio_gpu_array_add_obj(objs, obj);
+
+- virtio_gpu_cmd_context_detach_resource(vgdev, vfpriv->ctx_id,
+- objs);
++ virtio_gpu_cmd_context_detach_resource(vgdev, vfpriv->ctx_id,
++ objs);
++ }
+ virtio_gpu_notify(vgdev);
+ }
+
drm-amdgpu-sdma6.0-replace-bug_on-with-warn_on.patch
drm-amdgpu-sdma5.2-replace-bug_on-with-warn_on.patch
drm-amdgpu-sdma5.0-replace-bug_on-with-warn_on.patch
+drm-i915-return-null-on-error-in-active_instance.patch
+drm-i915-bios-range-check-lfp-data-block-panel_type2.patch
+drm-amd-amdgpu-disable-aspm-on-vi-if-pcie-dpm-is-disabled.patch
+drm-amdgpu-fix-lifetime-issue-of-amdgpu_vm_get_task_info_pasid.patch
+drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch
+drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch
+drm-i915-mst-limit-dp-mst-esi-service-loop.patch
+drm-amd-pm-fix-smu14-power-limit-range-calculation.patch
+drm-gfx10-program-db_ring_control.patch
+drm-virtio-don-t-detach-gem-from-a-non-created-context.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
