From: Greg Kroah-Hartman Date: Wed, 29 Jul 2026 12:40:42 +0000 (+0200) Subject: 7.1-stable patches X-Git-Tag: v6.1.179~48 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=1d8a06413ccb27079b0b4137f9a0153808c2b5ed;p=thirdparty%2Fkernel%2Fstable-queue.git 7.1-stable patches added patches: drm-amd-amdgpu-disable-aspm-on-vi-if-pcie-dpm-is-disabled.patch drm-amd-pm-fix-smu14-power-limit-range-calculation.patch drm-amdgpu-fix-lifetime-issue-of-amdgpu_vm_get_task_info_pasid.patch drm-amdgpu-gfx11-replace-bug_on-with-warn_on.patch drm-amdgpu-soc24-reset-dgpu-if-suspend-got-aborted.patch drm-amdgpu-trigger-gpu-recovery-when-userq-destroy-fails-to-unmap-a-hung-queue.patch drm-gfx10-program-db_ring_control.patch drm-i915-bios-range-check-lfp-data-block-panel_type2.patch drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch drm-i915-gt-fix-null-deref-on-sched_engine-alloc-failure.patch drm-i915-mst-limit-dp-mst-esi-service-loop.patch drm-i915-return-null-on-error-in-active_instance.patch drm-virtio-don-t-detach-gem-from-a-non-created-context.patch --- diff --git a/queue-7.1/drm-amd-amdgpu-disable-aspm-on-vi-if-pcie-dpm-is-disabled.patch b/queue-7.1/drm-amd-amdgpu-disable-aspm-on-vi-if-pcie-dpm-is-disabled.patch new file mode 100644 index 0000000000..b6e8e6b3f1 --- /dev/null +++ b/queue-7.1/drm-amd-amdgpu-disable-aspm-on-vi-if-pcie-dpm-is-disabled.patch @@ -0,0 +1,35 @@ +From 18a7826aea6fd09f2d371c02cec70c7234fc4879 Mon Sep 17 00:00:00 2001 +From: Kenneth Feng +Date: Thu, 25 Jun 2026 17:48:22 +0800 +Subject: drm/amd/amdgpu: disable ASPM on VI if pcie dpm is disabled + +From: Kenneth Feng + +commit 18a7826aea6fd09f2d371c02cec70c7234fc4879 upstream. + +Disable ASPM on VI if PCIE dpm is disabled. + +Fixes: bb00bf17328d ("drm/amd/amdgpu: decouple ASPM with pcie dpm") +Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5370 +Signed-off-by: Kenneth Feng +Reviewed-by: Yang Wang +Signed-off-by: Alex Deucher +(cherry picked from commit 873a8d6b3c0a386408c891e4ff1c684fa11783e1) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -1328,7 +1328,8 @@ static bool amdgpu_device_aspm_support_q + * It's unclear if this is a platform-specific or GPU-specific issue. + * Disable ASPM on SI for the time being. + */ +- if (adev->family == AMDGPU_FAMILY_SI) ++ if (adev->family == AMDGPU_FAMILY_SI || ++ (!(adev->pm.pp_feature & PP_PCIE_DPM_MASK) && adev->family == AMDGPU_FAMILY_VI)) + return true; + + #if IS_ENABLED(CONFIG_X86) diff --git a/queue-7.1/drm-amd-pm-fix-smu14-power-limit-range-calculation.patch b/queue-7.1/drm-amd-pm-fix-smu14-power-limit-range-calculation.patch new file mode 100644 index 0000000000..88e0c22247 --- /dev/null +++ b/queue-7.1/drm-amd-pm-fix-smu14-power-limit-range-calculation.patch @@ -0,0 +1,83 @@ +From e987eabc02646920cd13ab75902693e99735eca0 Mon Sep 17 00:00:00 2001 +From: Yang Wang +Date: Mon, 6 Jul 2026 09:29:24 +0800 +Subject: drm/amd/pm: fix smu14 power limit range calculation + +From: Yang Wang + +commit e987eabc02646920cd13ab75902693e99735eca0 upstream. + +SMU14 derives the default PPT limit from SocketPowerLimitAc/Dc, but +MsgLimits.Power may expose a different firmware limit for the same PPT0 +throttler. Using those values independently as fixed min/max bases can +report an incorrect configurable power range. + +Keep the socket power limit as the default value and as the fallback for +current-limit queries. Calculate the reported range from both firmware +values instead, using the lower value as the minimum base and the higher +value as the maximum base before applying OD percentages. + +Signed-off-by: Yang Wang +Reviewed-by: Kenneth Feng +Signed-off-by: Alex Deucher +(cherry picked from commit c936b8126b444401318fcbeb1828488cc5312dee) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 28 ++++++++++--------- + 1 file changed, 16 insertions(+), 12 deletions(-) + +--- a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c +@@ -1621,19 +1621,23 @@ static int smu_v14_0_2_get_power_limit(s + table_context->power_play_table; + PPTable_t *pptable = table_context->driver_pptable; + CustomSkuTable_t *skutable = &pptable->CustomSkuTable; +- int16_t od_percent_upper = 0, od_percent_lower = 0; ++ uint32_t pp_limit = smu->adev->pm.ac_power ? ++ skutable->SocketPowerLimitAc[PPT_THROTTLER_PPT0] : ++ skutable->SocketPowerLimitDc[PPT_THROTTLER_PPT0]; + uint32_t msg_limit = pptable->SkuTable.MsgLimits.Power[PPT_THROTTLER_PPT0][POWER_SOURCE_AC]; +- uint32_t power_limit; ++ uint32_t min_limit = min_t(uint32_t, pp_limit, msg_limit); ++ uint32_t max_limit = max_t(uint32_t, pp_limit, msg_limit); ++ int16_t od_percent_upper = 0, od_percent_lower = 0; ++ int ret; + +- if (smu_v14_0_get_current_power_limit(smu, &power_limit)) +- power_limit = smu->adev->pm.ac_power ? +- skutable->SocketPowerLimitAc[PPT_THROTTLER_PPT0] : +- skutable->SocketPowerLimitDc[PPT_THROTTLER_PPT0]; ++ if (current_power_limit) { ++ ret = smu_v14_0_get_current_power_limit(smu, current_power_limit); ++ if (ret) ++ *current_power_limit = pp_limit; ++ } + +- if (current_power_limit) +- *current_power_limit = power_limit; + if (default_power_limit) +- *default_power_limit = power_limit; ++ *default_power_limit = pp_limit; + + if (powerplay_table) { + if (smu->od_enabled && +@@ -1647,15 +1651,15 @@ static int smu_v14_0_2_get_power_limit(s + } + + dev_dbg(smu->adev->dev, "od percent upper:%d, od percent lower:%d (default power: %d)\n", +- od_percent_upper, od_percent_lower, power_limit); ++ od_percent_upper, od_percent_lower, pp_limit); + + if (max_power_limit) { +- *max_power_limit = msg_limit * (100 + od_percent_upper); ++ *max_power_limit = max_limit * (100 + od_percent_upper); + *max_power_limit /= 100; + } + + if (min_power_limit) { +- *min_power_limit = power_limit * (100 + od_percent_lower); ++ *min_power_limit = min_limit * (100 + od_percent_lower); + *min_power_limit /= 100; + } + diff --git a/queue-7.1/drm-amdgpu-fix-lifetime-issue-of-amdgpu_vm_get_task_info_pasid.patch b/queue-7.1/drm-amdgpu-fix-lifetime-issue-of-amdgpu_vm_get_task_info_pasid.patch new file mode 100644 index 0000000000..b965e548d0 --- /dev/null +++ b/queue-7.1/drm-amdgpu-fix-lifetime-issue-of-amdgpu_vm_get_task_info_pasid.patch @@ -0,0 +1,75 @@ +From 04cc4aa3617b0ed67e859f91f09de5d896a46f3a Mon Sep 17 00:00:00 2001 +From: Shahyan Soltani +Date: Mon, 6 Jul 2026 08:15:21 -0400 +Subject: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Shahyan Soltani + +commit 04cc4aa3617b0ed67e859f91f09de5d896a46f3a upstream. + +The vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only +valid while the lock is still being held. Once xa_unlock_irqrestore is +called and returned, the pointer is no longer under lock and is subject +to modification. Since, the caller still dereferences vm->task_info in +amdgpu_vm_get_task_info_vm() after the lock is removed, this causes a +use after unlock problem. + +Remove the lifetime issue present in amdgpu_vm_get_task_info_pasid() +through removing the amdgpu_vm_get_vm_from_pasid() function from +amdgpu_vm.c and making the relevant code inline to hold the lock while +it is still in use. + +Signed-off-by: Shahyan Soltani +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +(cherry picked from commit 9d01579f3f868b333acc901815972685989092c7) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 25 ++++++++++--------------- + 1 file changed, 10 insertions(+), 15 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +@@ -2487,19 +2487,6 @@ static void amdgpu_vm_destroy_task_info( + kfree(ti); + } + +-static inline struct amdgpu_vm * +-amdgpu_vm_get_vm_from_pasid(struct amdgpu_device *adev, u32 pasid) +-{ +- struct amdgpu_vm *vm; +- unsigned long flags; +- +- xa_lock_irqsave(&adev->vm_manager.pasids, flags); +- vm = xa_load(&adev->vm_manager.pasids, pasid); +- xa_unlock_irqrestore(&adev->vm_manager.pasids, flags); +- +- return vm; +-} +- + /** + * amdgpu_vm_put_task_info - reference down the vm task_info ptr + * +@@ -2546,8 +2533,16 @@ amdgpu_vm_get_task_info_vm(struct amdgpu + struct amdgpu_task_info * + amdgpu_vm_get_task_info_pasid(struct amdgpu_device *adev, u32 pasid) + { +- return amdgpu_vm_get_task_info_vm( +- amdgpu_vm_get_vm_from_pasid(adev, pasid)); ++ struct amdgpu_task_info *ti; ++ struct amdgpu_vm *vm; ++ unsigned long flags; ++ ++ xa_lock_irqsave(&adev->vm_manager.pasids, flags); ++ vm = xa_load(&adev->vm_manager.pasids, pasid); ++ ti = amdgpu_vm_get_task_info_vm(vm); ++ xa_unlock_irqrestore(&adev->vm_manager.pasids, flags); ++ ++ return ti; + } + + static int amdgpu_vm_create_task_info(struct amdgpu_vm *vm) diff --git a/queue-7.1/drm-amdgpu-gfx11-replace-bug_on-with-warn_on.patch b/queue-7.1/drm-amdgpu-gfx11-replace-bug_on-with-warn_on.patch new file mode 100644 index 0000000000..c1dd84dda9 --- /dev/null +++ b/queue-7.1/drm-amdgpu-gfx11-replace-bug_on-with-warn_on.patch @@ -0,0 +1,76 @@ +From 0eebcab1ea2a77f086a04108f386f82ee3496022 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 15 Jun 2026 18:20:55 -0400 +Subject: drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() + +From: Alex Deucher + +commit 0eebcab1ea2a77f086a04108f386f82ee3496022 upstream. + +There's no need to crash the kernel for these cases. + +Reviewed-by: Vitaly Prosyak +Signed-off-by: Alex Deucher +(cherry picked from commit daa62107452d2451787c4248ca38fa2d1a0cbefd) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +index f856b0cf5bec..92c16392b916 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +@@ -546,7 +546,7 @@ static void gfx_v11_0_wait_reg_mem(struct amdgpu_ring *ring, int eng_sel, + WAIT_REG_MEM_ENGINE(eng_sel))); + + if (mem_space) +- BUG_ON(addr0 & 0x3); /* Dword align */ ++ WARN_ON(addr0 & 0x3); /* Dword align */ + amdgpu_ring_write(ring, addr0); + amdgpu_ring_write(ring, addr1); + amdgpu_ring_write(ring, ref); +@@ -5997,7 +5997,7 @@ static void gfx_v11_0_ring_emit_ib_gfx(struct amdgpu_ring *ring, + } + + amdgpu_ring_write(ring, header); +- BUG_ON(ib->gpu_addr & 0x3); /* Dword align */ ++ WARN_ON(ib->gpu_addr & 0x3); /* Dword align */ + amdgpu_ring_write(ring, + #ifdef __BIG_ENDIAN + (2 << 0) | +@@ -6032,7 +6032,7 @@ static void gfx_v11_0_ring_emit_ib_compute(struct amdgpu_ring *ring, + } + + amdgpu_ring_write(ring, PACKET3(PACKET3_INDIRECT_BUFFER, 2)); +- BUG_ON(ib->gpu_addr & 0x3); /* Dword align */ ++ WARN_ON(ib->gpu_addr & 0x3); /* Dword align */ + amdgpu_ring_write(ring, + #ifdef __BIG_ENDIAN + (2 << 0) | +@@ -6065,9 +6065,9 @@ static void gfx_v11_0_ring_emit_fence(struct amdgpu_ring *ring, u64 addr, + * aligned if only send 32bit data low (discard data high) + */ + if (write64bit) +- BUG_ON(addr & 0x7); ++ WARN_ON(addr & 0x7); + else +- BUG_ON(addr & 0x3); ++ WARN_ON(addr & 0x3); + amdgpu_ring_write(ring, lower_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(addr)); + amdgpu_ring_write(ring, lower_32_bits(seq)); +@@ -6121,9 +6121,6 @@ static void gfx_v11_0_ring_emit_fence_kiq(struct amdgpu_ring *ring, u64 addr, + { + struct amdgpu_device *adev = ring->adev; + +- /* we only allocate 32bit for each seq wb address */ +- BUG_ON(flags & AMDGPU_FENCE_FLAG_64BIT); +- + /* write fence seq to the "addr" */ + amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3)); + amdgpu_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) | +-- +2.55.0 + diff --git a/queue-7.1/drm-amdgpu-soc24-reset-dgpu-if-suspend-got-aborted.patch b/queue-7.1/drm-amdgpu-soc24-reset-dgpu-if-suspend-got-aborted.patch new file mode 100644 index 0000000000..366b30a42f --- /dev/null +++ b/queue-7.1/drm-amdgpu-soc24-reset-dgpu-if-suspend-got-aborted.patch @@ -0,0 +1,80 @@ +From aff079bdce65f6d085e4b0091fdf87fffa95b0d9 Mon Sep 17 00:00:00 2001 +From: Jakob Linke +Date: Wed, 17 Jun 2026 08:24:15 +0200 +Subject: drm/amdgpu/soc24: reset dGPU if suspend got aborted + +From: Jakob Linke + +commit aff079bdce65f6d085e4b0091fdf87fffa95b0d9 upstream. + +For SOC24 ASICs (RDNA4 / Navi 4x dGPUs) re-enabling PM features fails if an +S3 suspend got aborted, the same issue already handled for SOC21 and SOC15: + + commit df3c7dc5c58b ("drm/amdgpu: Reset dGPU if suspend got aborted") + commit 38e8ca3e4b6d ("amdgpu/soc15: enable asic reset for dGPU in case of suspend abort") + +The aborted resume fails with: + + amdgpu: SMU: No response msg_reg: 6 resp_reg: 0 + amdgpu: Failed to enable requested dpm features! + amdgpu: resume of IP block failed -62 + +Apply the same workaround for soc24: detect the aborted-suspend state at +resume via the sign-of-life register and reset the device before re-init. + +This is a workaround till a proper solution is finalized. + +Fixes: 98b912c50e44 ("drm/amdgpu: Add soc24 common ip block (v2)") +Signed-off-by: Jakob Linke +Signed-off-by: Alex Deucher +(cherry picked from commit fed5bdbfe1d4a19a26c70f7fc58017dc88be1c18) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/soc24.c | 28 ++++++++++++++++++++++++++++ + 1 file changed, 28 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/soc24.c b/drivers/gpu/drm/amd/amdgpu/soc24.c +index 265db9331d0b..9dce30d2bb8d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/soc24.c ++++ b/drivers/gpu/drm/amd/amdgpu/soc24.c +@@ -496,8 +496,36 @@ static int soc24_common_suspend(struct amdgpu_ip_block *ip_block) + return soc24_common_hw_fini(ip_block); + } + ++static bool soc24_need_reset_on_resume(struct amdgpu_device *adev) ++{ ++ u32 sol_reg1, sol_reg2; ++ ++ /* Will reset for the following suspend abort cases. ++ * 1) Only reset dGPU side. ++ * 2) S3 suspend got aborted and TOS is active. ++ * As for dGPU suspend abort cases the SOL value ++ * will be kept as zero at this resume point. ++ */ ++ if (!(adev->flags & AMD_IS_APU) && adev->in_s3) { ++ sol_reg1 = RREG32_SOC15(MP0, 0, regMPASP_SMN_C2PMSG_81); ++ msleep(100); ++ sol_reg2 = RREG32_SOC15(MP0, 0, regMPASP_SMN_C2PMSG_81); ++ ++ return (sol_reg1 != sol_reg2); ++ } ++ ++ return false; ++} ++ + static int soc24_common_resume(struct amdgpu_ip_block *ip_block) + { ++ struct amdgpu_device *adev = ip_block->adev; ++ ++ if (soc24_need_reset_on_resume(adev)) { ++ dev_info(adev->dev, "S3 suspend aborted, resetting..."); ++ soc24_asic_reset(adev); ++ } ++ + return soc24_common_hw_init(ip_block); + } + +-- +2.55.0 + diff --git a/queue-7.1/drm-amdgpu-trigger-gpu-recovery-when-userq-destroy-fails-to-unmap-a-hung-queue.patch b/queue-7.1/drm-amdgpu-trigger-gpu-recovery-when-userq-destroy-fails-to-unmap-a-hung-queue.patch new file mode 100644 index 0000000000..254072a8a6 --- /dev/null +++ b/queue-7.1/drm-amdgpu-trigger-gpu-recovery-when-userq-destroy-fails-to-unmap-a-hung-queue.patch @@ -0,0 +1,44 @@ +From 614e8a989d462876c4f6a659f56e1075e72ad515 Mon Sep 17 00:00:00 2001 +From: Jesse Zhang +Date: Wed, 1 Jul 2026 18:17:03 +0800 +Subject: drm/amdgpu: trigger GPU recovery when userq destroy fails to unmap a hung queue + +From: Jesse Zhang + +commit 614e8a989d462876c4f6a659f56e1075e72ad515 upstream. + +Destroying a hung user queue issues a MES REMOVE_QUEUE that times out, +The destroy path only logged the error and freed the queue, so the +next userq submission failed and forced a GPU reset attributed to an innocent workload. + +Kick the userq reset work when unmap fails so the GPU is recovered at +destroy time. + +Acked-by: Alex Deucher +Signed-off-by: Jesse Zhang +Signed-off-by: Alex Deucher +(cherry picked from commit 8396b9de4198a54ec4760a94a179347540a9764d) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c +@@ -523,6 +523,15 @@ amdgpu_userq_destroy(struct amdgpu_userq + amdgpu_userq_cleanup(queue); + mutex_unlock(&uq_mgr->userq_mutex); + ++ /* ++ * A failed unmap means MES could not remove the hung queue and is now ++ * unresponsive. Recover the GPU here so the wedged MES does not fail ++ * the next, unrelated queue submission and trigger a reset attributed ++ * to an innocent workload. ++ */ ++ if (r) ++ queue_work(adev->reset_domain->wq, &uq_mgr->reset_work); ++ + cancel_delayed_work_sync(&queue->hang_detect_work); + uq_funcs->mqd_destroy(queue); + queue->userq_mgr = NULL; diff --git a/queue-7.1/drm-gfx10-program-db_ring_control.patch b/queue-7.1/drm-gfx10-program-db_ring_control.patch new file mode 100644 index 0000000000..96d33e2869 --- /dev/null +++ b/queue-7.1/drm-gfx10-program-db_ring_control.patch @@ -0,0 +1,43 @@ +From f0262c3a3f14d60140f6b826d40d44edf62c36d6 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Fri, 26 Jun 2026 16:29:13 -0400 +Subject: drm/gfx10: Program DB_RING_CONTROL +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +commit f0262c3a3f14d60140f6b826d40d44edf62c36d6 upstream. + +This is needed to allocate occlusion counters across +both gfx pipes. + +Fixes: b7a1a0ef12b8 ("drm/amd/amdgpu: add pipe1 hardware support") +Reviewed-by: Timur Kristóf +Signed-off-by: Alex Deucher +(cherry picked from commit 6807352cbabb74b61ba42888769283af72191f66) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +@@ -5350,6 +5350,15 @@ static void gfx_v10_0_constants_init(str + gfx_v10_0_get_tcc_info(adev); + adev->gfx.config.pa_sc_tile_steering_override = + gfx_v10_0_init_pa_sc_tile_steering_override(adev); ++ /* Program DB_RING_CONTROL for multiple GFX pipes ++ * Default power up value is 1. ++ * Possible values: ++ * 0 - split occlusion counters between gfx pipes ++ * 1 - all occlusion counters to pipe 0 ++ * 2 - all occlusion counters to pipe 1 ++ */ ++ WREG32_FIELD15(GC, 0, DB_RING_CONTROL, COUNTER_CONTROL, ++ (adev->gfx.me.num_pipe_per_me > 1) ? 0 : 1); + + /* XXX SH_MEM regs */ + /* where to put LDS, scratch, GPUVM in FSA64 space */ diff --git a/queue-7.1/drm-i915-bios-range-check-lfp-data-block-panel_type2.patch b/queue-7.1/drm-i915-bios-range-check-lfp-data-block-panel_type2.patch new file mode 100644 index 0000000000..0ac668abac --- /dev/null +++ b/queue-7.1/drm-i915-bios-range-check-lfp-data-block-panel_type2.patch @@ -0,0 +1,107 @@ +From 2084503f2d087bf956198e7f6eb25b03a7049cb2 Mon Sep 17 00:00:00 2001 +From: Jani Nikula +Date: Fri, 26 Jun 2026 17:01:55 +0300 +Subject: drm/i915/bios: range check LFP Data Block panel_type2 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jani Nikula + +commit 2084503f2d087bf956198e7f6eb25b03a7049cb2 upstream. + +While the panel_type from LFP Data Block is range checked, panel_type2 +is not. Add a few helpers for range checking, and use them to not only +check panel_type2, but also improve clarity and correctness in the panel +type selection. + +Discovered using AI-assisted static analysis confirmed by Intel Product +Security. + +v2: +- Fix commit message typo (Michał) +- Add is_panel_type_pnp() (Ville) + +Reported-by: Martin Hodo +Fixes: 6434cf630086 ("drm/i915/bios: calculate panel type as per child device index in VBT") +Cc: stable@vger.kernel.org # v6.0+ +Cc: Animesh Manna +Cc: Ville Syrjälä +Reviewed-by: Michał Grzelak # v1 +Reviewed-by: Ville Syrjälä +Link: https://patch.msgid.link/20260626140155.1389655-1-jani.nikula@intel.com +Signed-off-by: Jani Nikula +(cherry picked from commit c9ebe5d2f25729d6cfbbb1235d640bf67f9275df) +Signed-off-by: Joonas Lahtinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_bios.c | 36 +++++++++++++++++++++++------- + 1 file changed, 28 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/i915/display/intel_bios.c ++++ b/drivers/gpu/drm/i915/display/intel_bios.c +@@ -623,6 +623,21 @@ get_lfp_data_tail(const struct bdb_lfp_d + return NULL; + } + ++static bool is_panel_type_valid(int panel_type) ++{ ++ return panel_type >= 0 && panel_type < 16; ++} ++ ++static bool is_panel_type_pnp(int panel_type) ++{ ++ return panel_type == 0xff; ++} ++ ++static bool is_panel_type_valid_or_pnp(int panel_type) ++{ ++ return is_panel_type_valid(panel_type) || is_panel_type_pnp(panel_type); ++} ++ + static int opregion_get_panel_type(struct intel_display *display, + const struct intel_bios_encoder_data *devdata, + const struct drm_edid *drm_edid, bool use_fallback) +@@ -640,15 +655,21 @@ static int vbt_get_panel_type(struct int + if (!lfp_options) + return -1; + +- if (lfp_options->panel_type > 0xf && +- lfp_options->panel_type != 0xff) { ++ if (!is_panel_type_valid_or_pnp(lfp_options->panel_type)) { + drm_dbg_kms(display->drm, "Invalid VBT panel type 0x%x\n", + lfp_options->panel_type); + return -1; + } + +- if (devdata && devdata->child.handle == DEVICE_HANDLE_LFP2) ++ if (devdata && devdata->child.handle == DEVICE_HANDLE_LFP2) { ++ if (!is_panel_type_valid_or_pnp(lfp_options->panel_type2)) { ++ drm_dbg_kms(display->drm, "Invalid VBT panel type 2 0x%x\n", ++ lfp_options->panel_type2); ++ return -1; ++ } ++ + return lfp_options->panel_type2; ++ } + + drm_WARN_ON(display->drm, + devdata && devdata->child.handle != DEVICE_HANDLE_LFP1); +@@ -762,13 +783,12 @@ static int get_panel_type(struct intel_d + panel_types[i].name, panel_types[i].panel_type); + } + +- if (panel_types[PANEL_TYPE_OPREGION].panel_type >= 0) ++ if (is_panel_type_valid(panel_types[PANEL_TYPE_OPREGION].panel_type)) + i = PANEL_TYPE_OPREGION; +- else if (panel_types[PANEL_TYPE_VBT].panel_type == 0xff && +- panel_types[PANEL_TYPE_PNPID].panel_type >= 0) ++ else if (is_panel_type_pnp(panel_types[PANEL_TYPE_VBT].panel_type) && ++ is_panel_type_valid(panel_types[PANEL_TYPE_PNPID].panel_type)) + i = PANEL_TYPE_PNPID; +- else if (panel_types[PANEL_TYPE_VBT].panel_type != 0xff && +- panel_types[PANEL_TYPE_VBT].panel_type >= 0) ++ else if (is_panel_type_valid(panel_types[PANEL_TYPE_VBT].panel_type)) + i = PANEL_TYPE_VBT; + else + i = PANEL_TYPE_FALLBACK; diff --git a/queue-7.1/drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch b/queue-7.1/drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch new file mode 100644 index 0000000000..f64a992d94 --- /dev/null +++ b/queue-7.1/drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch @@ -0,0 +1,84 @@ +From eed3de2acf6aa5154d49098b026710b646db67ee Mon Sep 17 00:00:00 2001 +From: Joonas Lahtinen +Date: Wed, 1 Jul 2026 10:30:30 +0300 +Subject: drm/i915/gem: Do not leak siblings[] on proto context error + +From: Joonas Lahtinen + +commit eed3de2acf6aa5154d49098b026710b646db67ee upstream. + +After a successful BALANCE/PARALLEL_SUBMIT extension on context +creation, error during processing of next user extension leaks +the siblings[] array. Fix that. + +Discovered using AI-assisted static analysis confirmed by +Intel Product Security. + +Reported-by: Martin Hodo +Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)") +Cc: Faith Ekstrand +Cc: Simona Vetter +Cc: Tvrtko Ursulin +Cc: Maarten Lankhorst +Cc: # v5.15+ +Signed-off-by: Joonas Lahtinen +Reviewed-by: Maarten Lankhorst +Signed-off-by: Tvrtko Ursulin +Link: https://lore.kernel.org/r/20260701073030.44850-1-joonas.lahtinen@linux.intel.com +(cherry picked from commit aa65e0a4b51b3b54b53e4142aaa2d997aa1061ff) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/gem/i915_gem_context.c | 22 ++++++++++++++-------- + 1 file changed, 14 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c +@@ -769,8 +769,8 @@ static int set_proto_ctx_engines(struct + struct intel_engine_cs *engine; + + if (copy_from_user(&ci, &user->engines[n], sizeof(ci))) { +- kfree(set.engines); +- return -EFAULT; ++ err = -EFAULT; ++ goto err; + } + + memset(&set.engines[n], 0, sizeof(set.engines[n])); +@@ -786,8 +786,8 @@ static int set_proto_ctx_engines(struct + drm_dbg(&i915->drm, + "Invalid engine[%d]: { class:%d, instance:%d }\n", + n, ci.engine_class, ci.engine_instance); +- kfree(set.engines); +- return -ENOENT; ++ err = -ENOENT; ++ goto err; + } + + set.engines[n].type = I915_GEM_ENGINE_TYPE_PHYSICAL; +@@ -800,15 +800,21 @@ static int set_proto_ctx_engines(struct + set_proto_ctx_engines_extensions, + ARRAY_SIZE(set_proto_ctx_engines_extensions), + &set); +- if (err) { +- kfree(set.engines); +- return err; +- } ++ if (err) ++ goto err_extensions; + + pc->num_user_engines = set.num_engines; + pc->user_engines = set.engines; + + return 0; ++ ++err_extensions: ++ for (n = 0; n < set.num_engines; n++) ++ kfree(set.engines[n].siblings); ++err: ++ kfree(set.engines); ++ ++ return err; + } + + static int set_proto_ctx_sseu(struct drm_i915_file_private *fpriv, diff --git a/queue-7.1/drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch b/queue-7.1/drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch new file mode 100644 index 0000000000..228223a797 --- /dev/null +++ b/queue-7.1/drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch @@ -0,0 +1,46 @@ +From 2b56757a9a7456825eb668fde92299e01c5e2721 Mon Sep 17 00:00:00 2001 +From: Joonas Lahtinen +Date: Wed, 1 Jul 2026 10:55:55 +0300 +Subject: drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU + +From: Joonas Lahtinen + +commit 2b56757a9a7456825eb668fde92299e01c5e2721 upstream. + +Setting context engine slot N into I915_ENGINE_CLASS_INVALID / +I915_ENGINE_CLASS_INVALID_NONE and attempting to apply +I915_CONTEXT_PARAM_SSEU to the same slot N will deref NULL. +Fix that. + +Discovered using AI-assisted static analysis confirmed by +Intel Product Security. + +Reported-by: Martin Hodo +Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)") +Cc: Faith Ekstrand +Cc: Simona Vetter +Cc: Tvrtko Ursulin +Cc: Maarten Lankhorst +Cc: # v5.15+ +Signed-off-by: Joonas Lahtinen +Reviewed-by: Maarten Lankhorst +Reviewed-by: Andi Shyti +Link: https://patch.msgid.link/20260701075555.52142-1-joonas.lahtinen@linux.intel.com +(cherry picked from commit 36eda5b5c2d40da41cc0a5403c26986237cf9e87) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/gem/i915_gem_context.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c +@@ -856,7 +856,7 @@ static int set_proto_ctx_sseu(struct drm + pe = &pc->user_engines[idx]; + + /* Only render engine supports RPCS configuration. */ +- if (pe->engine->class != RENDER_CLASS) ++ if (!pe->engine || pe->engine->class != RENDER_CLASS) + return -EINVAL; + + sseu = &pe->sseu; diff --git a/queue-7.1/drm-i915-gt-fix-null-deref-on-sched_engine-alloc-failure.patch b/queue-7.1/drm-i915-gt-fix-null-deref-on-sched_engine-alloc-failure.patch new file mode 100644 index 0000000000..e51f6a6a8f --- /dev/null +++ b/queue-7.1/drm-i915-gt-fix-null-deref-on-sched_engine-alloc-failure.patch @@ -0,0 +1,88 @@ +From 82ec992c404c3dc774c5e9f3d4aa858e97187675 Mon Sep 17 00:00:00 2001 +From: Joonas Lahtinen +Date: Wed, 1 Jul 2026 14:45:13 +0300 +Subject: drm/i915/gt: Fix NULL deref on sched_engine alloc failure + +From: Joonas Lahtinen + +commit 82ec992c404c3dc774c5e9f3d4aa858e97187675 upstream. + +Avoid using intel_context_put() before intel_context_init() in +execlists_create_virtual() as the kref_put() inside would lead +to NULL deref on the IOCTL path when sched_engine allocation fails. + +Discovered using AI-assisted static analysis confirmed by +Intel Product Security. + +Reported-by: Martin Hodo +Fixes: 3e28d37146db ("drm/i915: Move priolist to new i915_sched_engine object") +Cc: Matthew Brost +Cc: Daniele Ceraolo Spurio +Cc: Tvrtko Ursulin +Cc: # v5.15+ +Signed-off-by: Joonas Lahtinen +Reviewed-by: Andi Shyti +Signed-off-by: Tvrtko Ursulin +Link: https://lore.kernel.org/r/20260701114513.221254-1-joonas.lahtinen@linux.intel.com +(cherry picked from commit 4f2a12f2d50e9f48227656e4dcbd6423506be31d) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/gt/intel_execlists_submission.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +--- a/drivers/gpu/drm/i915/gt/intel_execlists_submission.c ++++ b/drivers/gpu/drm/i915/gt/intel_execlists_submission.c +@@ -3932,11 +3932,11 @@ execlists_create_virtual(struct intel_en + struct drm_i915_private *i915 = siblings[0]->i915; + struct virtual_engine *ve; + unsigned int n; +- int err; ++ int err = -ENOMEM; + + ve = kzalloc_flex(*ve, siblings, count); + if (!ve) +- return ERR_PTR(-ENOMEM); ++ goto err; + + ve->base.i915 = i915; + ve->base.gt = siblings[0]->gt; +@@ -3968,10 +3968,8 @@ execlists_create_virtual(struct intel_en + intel_engine_init_execlists(&ve->base); + + ve->base.sched_engine = i915_sched_engine_create(ENGINE_VIRTUAL); +- if (!ve->base.sched_engine) { +- err = -ENOMEM; +- goto err_put; +- } ++ if (!ve->base.sched_engine) ++ goto err_noput; + ve->base.sched_engine->private_data = &ve->base; + + ve->base.cops = &virtual_context_ops; +@@ -3987,10 +3985,8 @@ execlists_create_virtual(struct intel_en + intel_context_init(&ve->context, &ve->base); + + ve->base.breadcrumbs = intel_breadcrumbs_create(NULL); +- if (!ve->base.breadcrumbs) { +- err = -ENOMEM; ++ if (!ve->base.breadcrumbs) + goto err_put; +- } + + for (n = 0; n < count; n++) { + struct intel_engine_cs *sibling = siblings[n]; +@@ -4065,8 +4061,13 @@ execlists_create_virtual(struct intel_en + virtual_engine_initial_hint(ve); + return &ve->context; + ++err_noput: ++ kfree(ve); ++ goto err; ++ + err_put: + intel_context_put(&ve->context); ++err: + return ERR_PTR(err); + } + diff --git a/queue-7.1/drm-i915-mst-limit-dp-mst-esi-service-loop.patch b/queue-7.1/drm-i915-mst-limit-dp-mst-esi-service-loop.patch new file mode 100644 index 0000000000..313d6cc1c5 --- /dev/null +++ b/queue-7.1/drm-i915-mst-limit-dp-mst-esi-service-loop.patch @@ -0,0 +1,65 @@ +From 005771c18c5b2c98cb4e7517661aea460990fd3f Mon Sep 17 00:00:00 2001 +From: Jani Nikula +Date: Thu, 25 Jun 2026 17:22:04 +0300 +Subject: drm/i915/mst: limit DP MST ESI service loop +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jani Nikula + +commit 005771c18c5b2c98cb4e7517661aea460990fd3f upstream. + +The loop in intel_dp_check_mst_status() keeps servicing interrupts +originating from the sink without bound. Add an upper bound to the new +interrupts occurring during interrupt processing to not get stuck on +potentially stuck sink devices. Use arbitrary 32 tries to clear incoming +interrupts in one go. + +Discovered using AI-assisted static analysis confirmed by Intel Product +Security. + +Note: The condition likely pre-dates the commit in the Fixes: tag, but +this is about as far back as a backport has any chance of +succeeding. Before that, the retry had a goto. + +Reported-by: Martin Hodo +Fixes: 3c0ec2c2d594 ("drm/i915: Flatten intel_dp_check_mst_status() a bit") +Cc: stable@vger.kernel.org # v5.8+ +Cc: Ville Syrjälä +Cc: Imre Deak +Reviewed-by: Imre Deak +Link: https://patch.msgid.link/20260625142204.1078287-1-jani.nikula@intel.com +Signed-off-by: Jani Nikula +(cherry picked from commit b4ea5272133059acb493cc36599071a9e852ec2e) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_dp.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/display/intel_dp.c ++++ b/drivers/gpu/drm/i915/display/intel_dp.c +@@ -5589,8 +5589,9 @@ intel_dp_check_mst_status(struct intel_d + struct intel_display *display = to_intel_display(intel_dp); + bool force_retrain = intel_dp->link.force_retrain; + bool reprobe_needed = false; ++ int tries = 33; + +- for (;;) { ++ while (--tries) { + u8 esi[4] = {}; + u8 ack[4] = {}; + bool new_irqs; +@@ -5633,6 +5634,11 @@ intel_dp_check_mst_status(struct intel_d + break; + } + ++ if (!tries) { ++ drm_dbg_kms(display->drm, "DPRX ESI not clearing, device may be stuck\n"); ++ reprobe_needed = true; ++ } ++ + return !reprobe_needed; + } + diff --git a/queue-7.1/drm-i915-return-null-on-error-in-active_instance.patch b/queue-7.1/drm-i915-return-null-on-error-in-active_instance.patch new file mode 100644 index 0000000000..12a6d07aa8 --- /dev/null +++ b/queue-7.1/drm-i915-return-null-on-error-in-active_instance.patch @@ -0,0 +1,58 @@ +From 1e33f0de5fdcd09e51fdec1e5822448970b6420f Mon Sep 17 00:00:00 2001 +From: Joonas Lahtinen +Date: Wed, 24 Jun 2026 12:09:40 +0300 +Subject: drm/i915: Return NULL on error in active_instance +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Joonas Lahtinen + +commit 1e33f0de5fdcd09e51fdec1e5822448970b6420f upstream. + +Avoid returning &node->base when node is NULL due to OOM +during GFP_ATOMIC allocation. + +Discovered using AI-assisted static analysis confirmed by +Intel Product Security. + +Reported-by: Martin Hodo +Fixes: bfaae47db3c0 ("drm/i915: make lockdep slightly happier about execbuf.") +Cc: Maarten Lankhorst +Cc: Thomas Hellström +Cc: Simona Vetter +Cc: # v5.13+ +Signed-off-by: Joonas Lahtinen +Reviewed-by: Sebastian Brzezinka +Reviewed-by: Maarten Lankhorst +Link: https://patch.msgid.link/20260624090940.74840-1-joonas.lahtinen@linux.intel.com +(cherry picked from commit 6029bc064f0b1bac184203a50fbaaf070fa18832) +Signed-off-by: Joonas Lahtinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/i915_active.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/i915_active.c ++++ b/drivers/gpu/drm/i915/i915_active.c +@@ -318,7 +318,7 @@ active_instance(struct i915_active *ref, + */ + node = kmem_cache_alloc(slab_cache, GFP_ATOMIC); + if (!node) +- goto out; ++ goto err; + + __i915_active_fence_init(&node->base, NULL, node_retire); + node->ref = ref; +@@ -332,6 +332,11 @@ out: + spin_unlock_irq(&ref->tree_lock); + + return &node->base; ++ ++err: ++ spin_unlock_irq(&ref->tree_lock); ++ ++ return NULL; + } + + void __i915_active_init(struct i915_active *ref, diff --git a/queue-7.1/drm-virtio-don-t-detach-gem-from-a-non-created-context.patch b/queue-7.1/drm-virtio-don-t-detach-gem-from-a-non-created-context.patch new file mode 100644 index 0000000000..a7f2a969a2 --- /dev/null +++ b/queue-7.1/drm-virtio-don-t-detach-gem-from-a-non-created-context.patch @@ -0,0 +1,49 @@ +From d489a5305b9d5480d6fb97d5636f5f4b1e0b3827 Mon Sep 17 00:00:00 2001 +From: Jason Macnak +Date: Thu, 25 Jun 2026 10:08:28 -0700 +Subject: drm/virtio: Don't detach GEM from a non-created context + +From: Jason Macnak + +commit d489a5305b9d5480d6fb97d5636f5f4b1e0b3827 upstream. + +Applies the same treatment as commit 7cf6dd467e87 ("drm/virtio: +Don't attach GEM to a non-created context in gem_object_open()") +to virtio_gpu_gem_object_close() to avoid trying to detach +a resource that was never attached due to a context +never being created when context_init is supported. + +Fixes: 086b9f27f0ab ("drm/virtio: Don't create a context with default param if context_init is supported") +Cc: # v6.14+ +Signed-off-by: Jason Macnak +Signed-off-by: Dmitry Osipenko +Link: https://patch.msgid.link/20260625170828.3335431-1-natsu@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/virtio/virtgpu_gem.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/virtio/virtgpu_gem.c ++++ b/drivers/gpu/drm/virtio/virtgpu_gem.c +@@ -139,13 +139,15 @@ void virtio_gpu_gem_object_close(struct + if (!vgdev->has_virgl_3d) + return; + +- objs = virtio_gpu_array_alloc(1); +- if (!objs) +- return; +- virtio_gpu_array_add_obj(objs, obj); ++ if (vfpriv->context_created) { ++ objs = virtio_gpu_array_alloc(1); ++ if (!objs) ++ return; ++ virtio_gpu_array_add_obj(objs, obj); + +- virtio_gpu_cmd_context_detach_resource(vgdev, vfpriv->ctx_id, +- objs); ++ virtio_gpu_cmd_context_detach_resource(vgdev, vfpriv->ctx_id, ++ objs); ++ } + virtio_gpu_notify(vgdev); + } + diff --git a/queue-7.1/series b/queue-7.1/series index 7ddb2773da..bd2a258aa5 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -432,3 +432,17 @@ drm-amdgpu-sdma7.0-replace-bug_on-with-warn_on.patch drm-amdgpu-sdma6.0-replace-bug_on-with-warn_on.patch drm-amdgpu-sdma5.2-replace-bug_on-with-warn_on.patch drm-amdgpu-sdma5.0-replace-bug_on-with-warn_on.patch +drm-i915-return-null-on-error-in-active_instance.patch +drm-i915-bios-range-check-lfp-data-block-panel_type2.patch +drm-amdgpu-soc24-reset-dgpu-if-suspend-got-aborted.patch +drm-amdgpu-gfx11-replace-bug_on-with-warn_on.patch +drm-amd-amdgpu-disable-aspm-on-vi-if-pcie-dpm-is-disabled.patch +drm-amdgpu-fix-lifetime-issue-of-amdgpu_vm_get_task_info_pasid.patch +drm-amdgpu-trigger-gpu-recovery-when-userq-destroy-fails-to-unmap-a-hung-queue.patch +drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch +drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch +drm-i915-gt-fix-null-deref-on-sched_engine-alloc-failure.patch +drm-i915-mst-limit-dp-mst-esi-service-loop.patch +drm-amd-pm-fix-smu14-power-limit-range-calculation.patch +drm-gfx10-program-db_ring_control.patch +drm-virtio-don-t-detach-gem-from-a-non-created-context.patch